jcoffey-dev
5db3083696
reset-demo.sh carried EVALUATOR_PASSWORD as a literal, which put a working service-account password in the repository. Anyone who could read the source could log in as alerting-evaluator against the live demo and mint an ALERTING_SERVICE_TOKEN whenever they liked -- so rotating the token was theatre while the password that mints it stayed published. Nothing needed it to be a constant. The account exists only to mint that token a few lines later, and `docker compose down -v` earlier in the same script has already destroyed the previous account, so the value never outlives a single reset. Generated per run instead. DEMO_PASSWORD directly above is deliberately left alone: it is a public demo credential, prefilled on the login page and baked into the web bundle at build time from the demo host's compose override. Randomising it would break the demo's own login form, and it protects nothing.
hack
Local developer tooling that isn't part of any shipped component — scripts
you run against your own machine/dev stack, not code that ends up in a
container image (except dev-certs' output, which mounts into the
ingest container).
Not one of the top-level directories in the original monorepo scaffold —
added because dev-only mTLS cert generation didn't have a natural home in
/deploy (real deployment manifests), /transport, or any other existing
component. /hack is the conventional name for this in a lot of larger Go
monorepos (Kubernetes among them).
dev-certs/— generates a throwaway CA + server/client cert pair for local mTLS between the agent and ingest. See/docs/phase-0-runbook.mdfor when to run it.windows-fixture/— sends synthetic Windows Event Log-shaped records directly toingest, bypassing the real Windows agent. Tests whether the pipeline handles Windows-shaped data; doesn't test the realEvtSubscribe/ETW integration, which needs actual Windows. See/docs/phase-1-runbook.md.demo-simulator/— the public demo's synthetic world: a fictional fleet whose agents check in, report CPU/memory/disk, and ship realistically shaped logs for eight services. Backfills a window of history, then keeps generating in real time. Distinct frombenchmark-fixture/(volume, for the Phase 2 latency benchmark) andwindows-fixture/(correctness, for the Windows ingest path).demo-seed/— the rest of the demo deployment: its reset script, dashboards, alert rules, and the systemd unit that runsdemo-simulator.