feat: harden orchestrator execution runtime

2026-07-24 23:53:32 +08:00
parent 396bb78200
commit f6f2cd0933
55 changed files with 5122 additions and 194 deletions
@@ -1,3 +1,14 @@
 ORCHESTRATOR_POSTGRES_PASSWORD=replace-with-a-long-random-password
 MEMIND_ORCHESTRATOR_SERVICE_TOKEN=replace-with-a-long-random-service-token
+MEMIND_ORCHESTRATOR_WORKER_TOKEN=replace-with-a-distinct-long-random-worker-token
 MEMIND_ORCHESTRATOR_PORT=8093
+
+# Closed by default. A local canary requires all three values plus the
+# goosed-worker Compose profile.
+MEMIND_ORCHESTRATOR_EXECUTION_ENABLED=0
+MEMIND_ORCHESTRATOR_ENABLED_EXECUTORS=
+MEMIND_ORCHESTRATOR_USER_ALLOWLIST=
+MEMIND_ORCHESTRATOR_TENANT_ALLOWLIST=
+MEMIND_EXECUTOR_GOOSED_URL=http://host.docker.internal:18006
+MEMIND_EXECUTOR_GOOSED_TOKEN=
+MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON={}