From 173f1fd82b831b4c77000894a871f1e19e482aca Mon Sep 17 00:00:00 2001 From: Derek Date: Wed, 11 Nov 2026 09:43:42 +1100 Subject: [PATCH] fix(compose): read alert destinations from the engine's secrets backend The engine stores each alert destination's URL at alert-destinations/ in its secrets backend. The hunt runner reads it through scalo.secrets. The runner mounts only that directory of the engine's file backend read-only and sets DFE_ENGINE_SECRETS_PATH to match. Remove the old mount of the engine's alert-destinations directory: it holds only metadata. The engine creates the directory at startup. The runner waits for a healthy engine, so the subpath exists before the mount. --- docker-compose.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index bc2d04c..f3d7f20 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -502,15 +502,17 @@ services: DFE_ENGINE_ENV: ${DFE_ENGINE_ENV:-production} DFE_ENGINE_HUNTS_DIR: /app/config/deploy-repo/config/hunts DFE_ENGINE_HUNTS_RULES_DIR: /app/config/deploy-repo/config/rules + DFE_ENGINE_SECRETS_PATH: /app/config/.secrets OTEL_EXPORTER_OTLP_ENDPOINT: ${DFE_OTEL_EXPORTER_ENDPOINT:-} OTEL_SERVICE_NAME: dfe-hunt-runner volumes: + # Only the alert destinations from the engine's file secrets backend, never the whole root. - type: volume source: dfe-engine-config - target: /app/config/alert-destinations + target: /app/config/.secrets/alert-destinations read_only: true volume: - subpath: alert-destinations + subpath: .secrets/alert-destinations - type: volume source: dfe-engine-config target: /app/config/deploy-repo/config