fix(frontend+ops): wire HUD modes and standardize Grafana password config

rwilliamspbg-ops · web-flow · commit b748dbddd8f4 · 2026-03-18T17:46:24.000Z
diff --git a/.env.dev b/.env.dev
@@ -13,4 +13,4 @@ REDIS_HOST_PORT=16379
 # Dev-only secrets
 MONGO_PASSWORD=dev_only_not_for_production
 REDIS_PASSWORD=dev_only_not_for_production
-GRAFANA_ADMIN_PASSWORD=dev_only_not_for_production
+GRAFANA_PASSWORD=dev_only_not_for_production
diff --git a/.env.example b/.env.example
@@ -15,7 +15,7 @@ MONGO_PASSWORD=CHANGE_ME_BEFORE_DEPLOYMENT
 REDIS_PASSWORD=CHANGE_ME_BEFORE_DEPLOYMENT
 
 # Grafana admin password (used by all monitoring deployments)
-GRAFANA_ADMIN_PASSWORD=CHANGE_ME_BEFORE_DEPLOYMENT
+GRAFANA_PASSWORD=CHANGE_ME_BEFORE_DEPLOYMENT
 
 # =============================================================================
 # API Keys (Optional)
diff --git a/.env.production b/.env.production
@@ -13,4 +13,4 @@ REDIS_HOST_PORT=26379
 # Required: set strong secrets before production deployment
 MONGO_PASSWORD=CHANGE_ME_BEFORE_PRODUCTION
 REDIS_PASSWORD=CHANGE_ME_BEFORE_PRODUCTION
-GRAFANA_ADMIN_PASSWORD=CHANGE_ME_BEFORE_PRODUCTION
+GRAFANA_PASSWORD=CHANGE_ME_BEFORE_PRODUCTION
diff --git a/.env.template b/.env.template
@@ -0,0 +1,48 @@
+# Sovereign Map Federated Learning Environment Variables
+#
+# Make a copy of this file named .env and fill in the values.
+#
+# Docker Compose will automatically use this file to populate
+# environment variables in the containers.
+
+# -----------------------------------------------------------------------------
+# Core Application Ports
+# -----------------------------------------------------------------------------
+# These ports are used to expose services to the host machine.
+# You can change these if they conflict with other services on your system.
+FRONTEND_HOST_PORT=3000
+BACKEND_API_HOST_PORT=8000
+BACKEND_GRPC_HOST_PORT=8080
+MONGO_HOST_PORT=27017
+REDIS_HOST_PORT=6379
+
+# -----------------------------------------------------------------------------
+# Credentials - CHANGE THESE FOR PRODUCTION
+# -----------------------------------------------------------------------------
+# It is strongly recommended to change these default passwords.
+MONGO_USER=admin
+MONGO_PASSWORD=CHANGE_ME_MONGO
+REDIS_PASSWORD=CHANGE_ME_REDIS
+GRAFANA_USER=admin
+GRAFANA_PASSWORD=CHANGE_ME_GRAFANA
+
+# -----------------------------------------------------------------------------
+# Federated Learning Parameters
+# -----------------------------------------------------------------------------
+# These parameters control the federated learning simulation.
+NUM_NODES=5
+NUM_ROUNDS=100
+
+# -----------------------------------------------------------------------------
+# Development Specific
+# -----------------------------------------------------------------------------
+# These are typically only used in the docker-compose.dev.yml
+FLASK_ENV=development
+FLASK_DEBUG=1
+
+# -----------------------------------------------------------------------------
+# Production Specific
+# -----------------------------------------------------------------------------
+# These are typically only used in the docker-compose.production.yml
+# Set to 'true' to enable TPM-based security features
+TPM_ENABLED=false
diff --git a/deploy.sh b/deploy.sh
@@ -132,7 +132,7 @@ if [ "$PROFILE" = "prod" ] || [ "$PROFILE" = "production" ] || [ "$PROFILE" = "l
 
     MONGO_PASSWORD_VALUE="${MONGO_PASSWORD:-}"
     REDIS_PASSWORD_VALUE="${REDIS_PASSWORD:-}"
-    GRAFANA_PASSWORD_VALUE="${GRAFANA_ADMIN_PASSWORD:-}"
+    GRAFANA_PASSWORD_VALUE="${GRAFANA_PASSWORD:-${GRAFANA_ADMIN_PASSWORD:-}}"
 
     if [ -f ".env" ]; then
         if [ -z "$MONGO_PASSWORD_VALUE" ]; then
@@ -141,6 +141,9 @@ if [ "$PROFILE" = "prod" ] || [ "$PROFILE" = "production" ] || [ "$PROFILE" = "l
         if [ -z "$REDIS_PASSWORD_VALUE" ]; then
             REDIS_PASSWORD_VALUE=$(grep -E '^REDIS_PASSWORD=' .env | tail -n1 | cut -d '=' -f2-)
         fi
+        if [ -z "$GRAFANA_PASSWORD_VALUE" ]; then
+            GRAFANA_PASSWORD_VALUE=$(grep -E '^GRAFANA_PASSWORD=' .env | tail -n1 | cut -d '=' -f2-)
+        fi
         if [ -z "$GRAFANA_PASSWORD_VALUE" ]; then
             GRAFANA_PASSWORD_VALUE=$(grep -E '^GRAFANA_ADMIN_PASSWORD=' .env | tail -n1 | cut -d '=' -f2-)
         fi
@@ -153,6 +156,9 @@ if [ "$PROFILE" = "prod" ] || [ "$PROFILE" = "production" ] || [ "$PROFILE" = "l
         if [ -z "$REDIS_PASSWORD_VALUE" ]; then
             REDIS_PASSWORD_VALUE=$(grep -E '^REDIS_PASSWORD=' "$COMPOSE_ENV_FILE" | tail -n1 | cut -d '=' -f2-)
         fi
+        if [ -z "$GRAFANA_PASSWORD_VALUE" ]; then
+            GRAFANA_PASSWORD_VALUE=$(grep -E '^GRAFANA_PASSWORD=' "$COMPOSE_ENV_FILE" | tail -n1 | cut -d '=' -f2-)
+        fi
         if [ -z "$GRAFANA_PASSWORD_VALUE" ]; then
             GRAFANA_PASSWORD_VALUE=$(grep -E '^GRAFANA_ADMIN_PASSWORD=' "$COMPOSE_ENV_FILE" | tail -n1 | cut -d '=' -f2-)
         fi
@@ -176,7 +182,7 @@ if [ "$PROFILE" = "prod" ] || [ "$PROFILE" = "production" ] || [ "$PROFILE" = "l
 
     case "$GRAFANA_PASSWORD_VALUE" in
         ""|CHANGE_ME*|changeme|dev_only_not_for_production)
-            echo -e "${RED}✗ GRAFANA_ADMIN_PASSWORD is missing or insecure placeholder.${NC}"
+            echo -e "${RED}✗ GRAFANA_PASSWORD is missing or insecure placeholder.${NC}"
             echo "  Set a strong value in environment or .env before production deployment."
             exit 1
             ;;
@@ -228,7 +234,7 @@ echo ""
 echo -e "${BLUE}Access Points:${NC}"
 echo "  Frontend:     ${GREEN}http://localhost:${FRONTEND_PORT}${NC}"
 echo "  Backend API:  ${GREEN}http://localhost:${BACKEND_API_PORT}${NC}"
-echo "  Grafana:      ${GREEN}http://localhost:${GRAFANA_PORT}${NC}  (credentials from GRAFANA_USER/GRAFANA_ADMIN_PASSWORD)"
+echo "  Grafana:      ${GREEN}http://localhost:${GRAFANA_PORT}${NC}  (credentials from GRAFANA_USER/GRAFANA_PASSWORD)"
 echo "  Prometheus:   ${GREEN}http://localhost:${PROMETHEUS_PORT}${NC}"
 echo ""
 
diff --git a/docker-compose.1000nodes.yml b/docker-compose.1000nodes.yml
@@ -251,7 +251,7 @@ services:
     ports:
       - "3001:3000"
     environment:
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-CHANGE_ME_GRAFANA}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-CHANGE_ME_GRAFANA}
       - GF_SECURITY_ADMIN_USER=admin
       - GF_USERS_ALLOW_SIGN_UP=false
       - GF_PANELS_PLUGIN_SUPPORT=enable
diff --git a/docker-compose.200nodes.yml b/docker-compose.200nodes.yml
@@ -88,7 +88,7 @@ services:
       - "3001:3000"
     environment:
       - GF_SECURITY_ADMIN_USER=${GRAFANA_USER:-admin}
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-CHANGE_ME_GRAFANA}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-CHANGE_ME_GRAFANA}
       - GF_USERS_ALLOW_SIGN_UP=false
     volumes:
       - grafana_data_200:/var/lib/grafana
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
@@ -185,7 +185,7 @@ services:
     ports:
       - "${GRAFANA_HOST_PORT:-3001}:3000"
     environment:
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-dev_only_not_for_production}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-dev_only_not_for_production}
       - GF_SECURITY_ADMIN_USER=admin
       - GF_USERS_ALLOW_SIGN_UP=false
     volumes:
diff --git a/docker-compose.full.yml b/docker-compose.full.yml
@@ -355,7 +355,7 @@ services:
       - "${FRONTEND_HOST_PORT:-3000}:3000"
     environment:
       - GF_SECURITY_ADMIN_USER=${GRAFANA_USER:-admin}
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-CHANGE_ME_GRAFANA}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-CHANGE_ME_GRAFANA}
       - GF_USERS_ALLOW_SIGN_UP=false
       - GF_INSTALL_PLUGINS=grafana-piechart-panel
     volumes:
diff --git a/docker-compose.large-scale.yml b/docker-compose.large-scale.yml
@@ -203,7 +203,7 @@ services:
     ports:
       - "3001:3000"
     environment:
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-CHANGE_ME_GRAFANA}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-CHANGE_ME_GRAFANA}
       - GF_SECURITY_ADMIN_USER=admin
       - GF_USERS_ALLOW_SIGN_UP=false
       - GF_PANELS_PLUGIN_SUPPORT=enable
diff --git a/docker-compose.monitoring.tpm.yml b/docker-compose.monitoring.tpm.yml
@@ -83,7 +83,7 @@ services:
       - "3000:3000"
     environment:
       - GF_SECURITY_ADMIN_USER=admin
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-CHANGE_ME_GRAFANA}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-CHANGE_ME_GRAFANA}
       - GF_USERS_ALLOW_SIGN_UP=false
       - GF_INSTALL_PLUGINS=grafana-piechart-panel
     volumes:
diff --git a/docker-compose.monitoring.yml b/docker-compose.monitoring.yml
@@ -27,7 +27,7 @@ services:
       - ./monitoring/dashboards:/var/lib/grafana/dashboards
     environment:
       - GF_SECURITY_ADMIN_USER=admin
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-CHANGE_ME_GRAFANA}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-CHANGE_ME_GRAFANA}
       - GF_INSTALL_PLUGINS=grafana-piechart-panel,grafana-worldmap-panel
       - GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH=/etc/grafana/provisioning/dashboards/genesis-launch-overview.json
       - GF_FEATURE_TOGGLES_ENABLE=publicDashboards
diff --git a/docker-compose.production.yml b/docker-compose.production.yml
@@ -91,48 +91,6 @@ services:
           cpus: '0.5'
           memory: 256M
 
-  # MongoDB: Primary Data Store
-  mongo:
-    image: mongo:7.0
-    ports:
-      - "127.0.0.1:${MONGO_HOST_PORT:-27017}:27017"
-    environment:
-      MONGO_INITDB_ROOT_USERNAME: ${MONGO_USER:-admin}
-      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD:-CHANGE_ME_MONGO}
-
-  # Frontend: React/Nginx Web UI
-  frontend:
-    build:
-      context: .
-      dockerfile: Dockerfile.frontend.optimized
-    image: sovereignmap/frontend:latest
-    ports:
-      - "${FRONTEND_HOST_PORT:-3000}:80"
-    depends_on:
-      - backend
-    restart: always
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost/health"]
-      interval: 15s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
-    networks:
-      - sovereignmap
-    logging:
-      driver: json-file
-      options:
-        max-size: "10m"
-        max-file: "3"
-    deploy:
-      resources:
-        limits:
-          cpus: '1'
-          memory: 512M
-        reservations:
-          cpus: '0.5'
-          memory: 256M
-
   # MongoDB: Primary Data Store
   mongo:
     image: mongo:7.0
@@ -460,7 +418,7 @@ services:
     ports:
       - "${GRAFANA_HOST_PORT:-3001}:3000"
     environment:
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-CHANGE_ME_GRAFANA}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-CHANGE_ME_GRAFANA}
       - GF_SECURITY_ADMIN_USER=${GRAFANA_USER:-admin}
       - GF_USERS_ALLOW_SIGN_UP=false
       - GF_INSTALL_PLUGINS=grafana-piechart-panel
diff --git a/frontend/src/App.jsx b/frontend/src/App.jsx
@@ -20,7 +20,7 @@ function App() {
   const [founders, setFounders] = useState([]);
   const [voiceQuery, setVoiceQuery] = useState('');
   const [voiceResponse, setVoiceResponse] = useState('');
-    const [trainingMetrics, setTrainingMetrics] = useState([]);
+  const [trainingMetrics, setTrainingMetrics] = useState([]);
   const [policyDraft, setPolicyDraft] = useState({
     require_proof: false,
     min_confidence_bps: 7000,
@@ -36,6 +36,10 @@ function App() {
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState(null);
 
+  const avgFlDuration = Number(metricsSummary?.avg_fl_duration);
+  const totalStake = Number(metricsSummary?.total_stake);
+  const cxlUtilization = Number(metricsSummary?.cxl_utilization);
+
   useEffect(() => {
     fetchData();
     const interval = setInterval(fetchData, 5000);
@@ -218,13 +222,13 @@ function App() {
           type="button"
         >
           Network Operations HUD
-               <button
-                 className={mode === 'privacy-dashboard' ? 'active' : ''}
-                 onClick={() => setMode('privacy-dashboard')}
-                 type="button"
-               >
-                 Privacy-Utility Analysis
-               </button>
+        </button>
+        <button
+          className={mode === 'privacy-dashboard' ? 'active' : ''}
+          onClick={() => setMode('privacy-dashboard')}
+          type="button"
+        >
+          Privacy-Utility Analysis
         </button>
       </nav>
 
@@ -265,13 +269,13 @@ function App() {
                 <strong>Total FL Rounds:</strong> {metricsSummary.fl_rounds_total}
               </div>
               <div className="summary-item">
-                <strong>Avg FL Duration:</strong> {metricsSummary.avg_fl_duration?.toFixed(2) || 'N/A'}s
+                <strong>Avg FL Duration:</strong> {Number.isFinite(avgFlDuration) ? `${avgFlDuration.toFixed(2)}s` : 'N/A'}
               </div>
               <div className="summary-item">
-                <strong>Total Stake:</strong> {metricsSummary.total_stake?.toFixed(2) || 'N/A'}
+                <strong>Total Stake:</strong> {Number.isFinite(totalStake) ? totalStake.toFixed(2) : 'N/A'}
               </div>
               <div className="summary-item">
-                <strong>CXL Utilization:</strong> {(metricsSummary.cxl_utilization * 100)?.toFixed(1) || 'N/A'}%
+                <strong>CXL Utilization:</strong> {Number.isFinite(cxlUtilization) ? `${(cxlUtilization * 100).toFixed(1)}%` : 'N/A'}
               </div>
             </div>
           )}
diff --git a/frontend/src/HUD.jsx b/frontend/src/HUD.jsx
@@ -78,7 +78,7 @@ export default function HUD({
               onChange={e => setVoiceQuery(e.target.value)} 
               placeholder="Query the sovereign agent..." 
             />
-            <button onClick={onSubmitVoiceQuery} disabled={loading || !voiceQuery}>
+            <button onClick={onSubmitVoiceQuery} disabled={loading || !voiceQuery.trim()}>
               Submit
             </button>
           </div>
diff --git a/genesis-launch.sh b/genesis-launch.sh
@@ -217,7 +217,7 @@ launch_monitoring() {
     # Check Grafana
     if curl -s "http://localhost:${GRAFANA_PORT}/api/health" > /dev/null 2>&1; then
         log_success "Grafana is healthy (http://localhost:${GRAFANA_PORT})"
-        log_info "Grafana credentials: admin/${GRAFANA_ADMIN_PASSWORD:-CHANGE_ME_GRAFANA}"
+        log_info "Grafana credentials: admin/${GRAFANA_PASSWORD:-${GRAFANA_ADMIN_PASSWORD:-CHANGE_ME_GRAFANA}}"
     else
         log_warn "Grafana health check failed"
     fi
diff --git a/monitoring/docker-compose.monitoring.yml b/monitoring/docker-compose.monitoring.yml
@@ -39,7 +39,7 @@ services:
     container_name: mohawk-grafana
     environment:
       - GF_SECURITY_ADMIN_USER=admin
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-CHANGE_ME_GRAFANA}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-CHANGE_ME_GRAFANA}
       - GF_AUTH_ANONYMOUS_ENABLED=true
     networks:
       - sovereign-network
diff --git a/validate-secrets.sh b/validate-secrets.sh
@@ -74,12 +74,15 @@ assert_valid_secret() {
 
 MONGO_PASSWORD_VALUE=$(load_from_env_file_if_missing "MONGO_PASSWORD" "${MONGO_PASSWORD:-}")
 REDIS_PASSWORD_VALUE=$(load_from_env_file_if_missing "REDIS_PASSWORD" "${REDIS_PASSWORD:-}")
-GRAFANA_PASSWORD_VALUE=$(load_from_env_file_if_missing "GRAFANA_ADMIN_PASSWORD" "${GRAFANA_ADMIN_PASSWORD:-}")
+GRAFANA_PASSWORD_VALUE=$(load_from_env_file_if_missing "GRAFANA_PASSWORD" "${GRAFANA_PASSWORD:-}")
+if [ -z "$GRAFANA_PASSWORD_VALUE" ]; then
+  GRAFANA_PASSWORD_VALUE=$(load_from_env_file_if_missing "GRAFANA_ADMIN_PASSWORD" "${GRAFANA_ADMIN_PASSWORD:-}")
+fi
 
 FAIL=0
 assert_valid_secret "MONGO_PASSWORD" "$MONGO_PASSWORD_VALUE" 20 || FAIL=1
 assert_valid_secret "REDIS_PASSWORD" "$REDIS_PASSWORD_VALUE" 20 || FAIL=1
-assert_valid_secret "GRAFANA_ADMIN_PASSWORD" "$GRAFANA_PASSWORD_VALUE" 16 || FAIL=1
+assert_valid_secret "GRAFANA_PASSWORD" "$GRAFANA_PASSWORD_VALUE" 16 || FAIL=1
 
 if [ "$FAIL" -ne 0 ]; then
   echo ""
