Add remote instance management with mTLS agent and phone-home registration
Enables the CCP to manage CML instances on remote servers via a lightweight
HTTP agent. Key components:
- ExecutionDriver abstraction (local-driver.ts / remote-driver.ts) routes
operations to local Docker or remote agent transparently
- Remote agent package (agent/) with mTLS authentication, Docker Compose
operations, file management, backup/upgrade delegation
- Certificate service using openssl CLI for CA management and cert issuance
- Phone-home registration: remote agents register via invite code, CCP admin
approves, agent receives mTLS cert bundle automatically
- config.sh integration with configure_control_panel() section
- ccp-agent Docker Compose service (profile-gated)
- Frontend: AgentRegistrationsPage, InviteCodesPage, Remote Agents sidebar menu
- Security hardened: cert bundle wiped after delivery, shell injection prevention
via execFile, command allowlist with metachar rejection, rate-limited public
endpoints, auto-populated fingerprint pinning
Also wires ENABLE_SOCIAL/PEOPLE/ANALYTICS through env.ts, seed.ts, and
docker-compose env passthrough (from previous session).
Bunker Admin
bunker-admin
38ccaa8a5b