Wire the web surface into the demo stack #8

New issue

Open

opened 2026-07-10 13:15:48 +02:00 by qwc · 1 comment

qwc commented

2026-07-10 13:15:48 +02:00

Owner

Labels: demo, packaging
Priority: high (needed to demo 6b/6c/6d live)

docker-compose.yml exposes only :8080. Add the web UI + a scripted UI/CVE/triage walkthrough.

Expose :8081, set TULLI_WEB_ADDR, TULLI_BOOTSTRAP_ADMIN_TOKEN, TULLI_SESSION_SECRET
Extend demo.sh (or add demo-web.sh) to: create a user, mint a token, show a CVE match, triage-quarantine it, show the notify log line
Add a fixture repo with a known-vulnerable dependency for Trivy

**Labels:** `demo`, `packaging` **Priority:** high (needed to demo 6b/6c/6d live) `docker-compose.yml` exposes only `:8080`. Add the web UI + a scripted UI/CVE/triage walkthrough. - [ ] Expose `:8081`, set `TULLI_WEB_ADDR`, `TULLI_BOOTSTRAP_ADMIN_TOKEN`, `TULLI_SESSION_SECRET` - [ ] Extend `demo.sh` (or add `demo-web.sh`) to: create a user, mint a token, show a CVE match, triage-quarantine it, show the notify log line - [ ] Add a fixture repo with a known-vulnerable dependency for Trivy

qwc added the

labels

2026-07-10 13:52:45 +02:00

qwc commented

2026-07-10 14:08:10 +02:00

Author

Owner

Partly done: docker-compose.yml is now a full testing stack — wires the web UI (:8081), SSH (:2222) and git (:8080), sets TULLI_WEB_ADDR / TULLI_SSH_ADDR / TULLI_BOOTSTRAP_ADMIN_TOKEN (demo-admin) / TULLI_SESSION_SECRET, defaults to real https:// upstreams, and persists /data + Postgres in named volumes. demo.sh overrides to the file:// fixtures and starts from a clean volume, so the §12 secret-quarantine arc still runs. Dockerfile EXPOSEs all three ports.

Still open here: a scripted UI/CVE/triage walkthrough (create user → mint token → show a CVE match → triage-quarantine → show the notify log line) and a fixture repo with a known-vulnerable dependency for Trivy.

Partly done: `docker-compose.yml` is now a full testing stack — wires the web UI (`:8081`), SSH (`:2222`) and git (`:8080`), sets `TULLI_WEB_ADDR` / `TULLI_SSH_ADDR` / `TULLI_BOOTSTRAP_ADMIN_TOKEN` (`demo-admin`) / `TULLI_SESSION_SECRET`, defaults to real `https://` upstreams, and persists `/data` + Postgres in named volumes. `demo.sh` overrides to the file:// fixtures and starts from a clean volume, so the §12 secret-quarantine arc still runs. Dockerfile `EXPOSE`s all three ports. **Still open here:** a *scripted* UI/CVE/triage walkthrough (create user → mint token → show a CVE match → triage-quarantine → show the notify log line) and a fixture repo with a known-vulnerable dependency for Trivy.

qwc referenced this issue

2026-07-11 11:17:08 +02:00

Add a "what's mirrored + verdict" helper (tullictl / compose one-liner) #18

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

qwc-open/tulli#8

No description provided.

Rows
Columns