fix(compose): give the XTM One worker its public URL and accept OpenAEV's internal audience (#166)

.env.sample

@@ -41,6 +41,9 @@ PLATFORM_REGISTRATION_TOKEN=ChangeMeWithGeneratedRandomString # [MANDATORY] Repl
 # OPENAEV                 #
 ###########################
 
+# Public host name users open OpenAEV on. It is also the identity OpenAEV signs
+# its tokens with and checks on the tokens it receives; XTM One reaches OpenAEV
+# on http://openaev:8080 inside the stack.
 OPENAEV_HOST=localhost
 OPENAEV_PORT=8080
 OPENAEV_EXTERNAL_SCHEME=http
@@ -74,6 +77,8 @@ INJECTOR_NUCLEI_ID=e1bad898-9804-427d-99e4-dc32c5f2898d
 # XTM ONE                 #
 ###########################
 
+# Public host name users open XTM One on. It is also the identity XTM One signs
+# its tokens with; OpenAEV reaches XTM One on http://xtm-one:4000 inside the stack.
 XTM_ONE_HOST=localhost
 XTM_ONE_PORT=8090
 XTM_ONE_EXTERNAL_SCHEME=http

README.md

@@ -74,6 +74,17 @@ XTM One reuses the shared `redis` and `minio` services and connects to OpenAEV i
 
 All XTM One configuration (admin credentials, dedicated Postgres credentials, S3 bucket, license, log settings) lives in the `XTM ONE` section of [.env.sample](.env.sample). Once the stack is healthy, XTM One is available on `http://localhost:${XTM_ONE_PORT}` (default `8090`).
 
+### Public and internal URLs
+
+Each product has two URLs in this stack:
+
+- the **public URL** you open in your browser, built from `OPENAEV_EXTERNAL_SCHEME` / `OPENAEV_HOST` / `OPENAEV_PORT` and `XTM_ONE_EXTERNAL_SCHEME` / `XTM_ONE_HOST` / `XTM_ONE_PORT` (set the scheme to `https` together with the host when you publish them over TLS). It is also the identity each product signs its requests to the other with, so it is set on both XTM One containers (`BASE_URL`) and on OpenAEV (`OPENAEV_BASE-URL`);
+- the **internal URL** the containers reach each other on: `http://openaev:8080` (`OPENAEV_API_URL` on XTM One) and `http://xtm-one:4000` (`OPENAEV_XTM_ONE_URL` on OpenAEV).
+
+The public host name does not need to resolve inside the containers: XTM One fetches OpenAEV's signing keys and sends the autonomous run callbacks on the internal URL, and OpenAEV reads XTM One's public identity from `http://xtm-one:4000/xtm/auth/metadata`. This needs XTM One and OpenAEV releases that include [XTM-One-Platform/xtm-one#4883](https://github.com/XTM-One-Platform/xtm-one/pull/4883) and [OpenAEV-Platform/openaev#8143](https://github.com/OpenAEV-Platform/openaev/pull/8143).
+
+If OpenAEV registers with XTM One but every assistant action on OpenAEV data fails with `401`, the XTM One logs (`XTM JWT rejected`) and the OpenAEV logs (`Untrusted JWKS issuer`) name the URL that did not match.
+
 ## About
 
 OpenAEV is a product designed and developed by the company [Filigran](https://filigran.io).

docker-compose.yml

@@ -322,6 +322,10 @@ services:
       - ENTERPRISE_LICENSE=${XTM_ONE_ENTERPRISE_LICENSE:-}
       # Internal API endpoint for the OpenAEV integration (Docker hostname)
       - OPENAEV_API_URL=http://openaev:8080
+      # The URL OpenAEV reaches XTM One on (OPENAEV_XTM_ONE_URL): accepted as the
+      # audience of the tokens OpenAEV sends, for OpenAEV versions that address
+      # them to that URL instead of the BASE_URL above
+      - XTM_AUTH_ACCEPTED_AUDIENCES=http://xtm-one:4000
     ports:
       - "${XTM_ONE_PORT}:4000"
     depends_on:
@@ -344,6 +348,10 @@ services:
     environment:
       - PLATFORM_MODE=xtm_one
       - PLATFORM_REGISTRATION_TOKEN=${PLATFORM_REGISTRATION_TOKEN}
+      # Same public URL as the xtm-one service: the worker signs the tokens of
+      # background work (assignments, autonomous runs) sent to OpenAEV
+      - BASE_URL=${XTM_ONE_EXTERNAL_SCHEME}://${XTM_ONE_HOST}:${XTM_ONE_PORT}
+      - FRONTEND_URL=${XTM_ONE_EXTERNAL_SCHEME}://${XTM_ONE_HOST}:${XTM_ONE_PORT}
       - ADMIN_EMAIL=${XTM_ONE_ADMIN_EMAIL}
       - ADMIN_PASSWORD=${XTM_ONE_ADMIN_PASSWORD}
       - SECRET_KEY=${XTM_ONE_SECRET_KEY}