fix(docker): integrate Hubble with PD deployment

[imbajin]

What changes for users

The PD Docker deployment becomes a complete graph stack with Hubble included. After starting Compose, users can open Hubble at http://localhost:8088, sign in, and access the Server without deploying or wiring Hubble by hand.

Before -> After

User task	Before	After
Start the PD stack	Compose starts PD, Store, and Server only	The same Compose stack also starts Hubble after Server is healthy
Open the graph UI	Hubble must be deployed and configured separately	Open http://localhost:8088
Use authentication	Embedded Gremlin accepts Basic auth but rejects Hubble's Bearer token	Basic auth still works, and embedded Gremlin also accepts a valid Bearer token
Keep authentication stable	Server REST and graph auth have no Compose-managed shared token secret	The entrypoint generates or accepts one shared secret, writes it to both configs, and reuses it after restart
Use release or local images	Server and Hubble image selection is tied to Compose defaults	Image names and pull policies can be overridden for release and local development

Deployment flow

Before

Browser     Hubble (manual setup)
   X------------X
                  \
                   -- Bearer token --> Server (rejected by embedded Gremlin)


After

Browser
   |
   | http://localhost:8088
   v
Hubble --------------------> PD
   |                         | discovery
   | Bearer JWT              v
   +---------------------> Server -----> Store
                              |
                              +-- shared auth secret for REST and Gremlin

Hubble binds to 127.0.0.1 by default. Remote access requires an explicit host override and should be placed behind HTTPS and trusted network controls.

Main implementation points

• Add Hubble to both release and development PD Compose files.
• Configure Hubble to discover the hg cluster through PD and reach Server through the Docker network.
• Let embedded Gremlin authenticate Bearer JWTs while preserving existing Basic authentication.
• Require a non-default administrator password and validate explicit JWT secrets at 32 bytes or longer.
• Wait for real Server and Hubble health responses instead of treating an open port as ready.

Paired Hubble change

This PR provides the Server and Compose side of the authentication path. apache/hugegraph-toolchain#753 makes Hubble send and preserve Bearer credentials.

The two PRs are independently scoped, but the authenticated Hubble flow requires both and should be validated and released together.

Verification

• JDK 11 focused authentication suite: 7 tests passed
• Docker entrypoint generation, injection, validation, and secret reuse: passed
• Release and development Compose configuration: passed
• Relevant Apache RAT checks: passed
• Independent review and re-review: no actionable findings

[Copilot]

Pull request overview

This PR integrates HugeGraph Hubble into the single-node PD Compose deployments and extends the Server-side Docker/auth stack to support a shared JWT Bearer token contract (while preserving Basic auth) for embedded Gremlin and REST.

Changes:

• Add Hubble to release + dev Docker Compose stacks and document the new single-node workflow and required .env secrets.
• Enhance the server Docker entrypoint to configure PD registration/discovery settings, low-memory guard, and a shared/reused JWT token secret across REST + embedded Gremlin auth.
• Accept Authorization: Bearer <token> for HTTP Gremlin requests with targeted unit-test coverage and CI validation for entrypoint + Compose contracts.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/auth/WsAndHttpBasicAuthHandlerTest.java	Adds Bearer-token HTTP Gremlin auth tests and tightens Bearer token rejection cases.
hugegraph-server/hugegraph-dist/docker/test/test-docker-entrypoint.sh	Updates the unit test harness to source the refactored entrypoint helpers.
hugegraph-server/hugegraph-dist/docker/docker-entrypoint.sh	Adds property encoding/reuse helpers and maps new PD/auth env vars into config; generates/reuses JWT token secret.
hugegraph-server/hugegraph-dist/docker/docker-entrypoint-test.sh	New script to validate entrypoint behavior (env mapping, secret reuse, escaping) in CI.
hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/auth/WsAndHttpBasicAuthHandler.java	Adds Bearer parsing for HTTP Gremlin authorization while preserving Basic auth flow.
docker/README.md	Documents new single-node stacks (incl. Hubble), .env secret generation, and new env overrides.
docker/hugegraph-hubble.properties	New Hubble configuration for the Compose environment.
docker/docker-compose.yml	Adds Hubble service and makes Server/Hubble images + pull policy overridable; wires PD/auth env.
docker/docker-compose.dev.yml	Mirrors release Compose changes for dev builds; adds Hubble service and overrides.
.gitignore	Ignores docker/.env.
.github/workflows/server-ci.yml	Adds CI validation for entrypoint behavior and Compose rendering/contracts.
.dockerignore	Excludes /docker/.env from build contexts.

Suppressed comments (1)

hugegraph-server/hugegraph-dist/docker/docker-entrypoint.sh:97

• This length check sets LC_ALL=C globally, so the locale stays forced to C for the remainder of the entrypoint. If the goal is only to ensure ${#HG_SERVER_AUTH_TOKEN_SECRET} is counted in bytes, scope LC_ALL to just the arithmetic evaluation instead of mutating global environment.

if [[ -n "${HG_SERVER_AUTH_TOKEN_SECRET:-}" ]]; then
    LC_ALL=C
    if (( ${#HG_SERVER_AUTH_TOKEN_SECRET} < 32 )); then
        log "ERROR: HG_SERVER_AUTH_TOKEN_SECRET must be at least 32 bytes"
        exit 1

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.