chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 11:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces.

Browse Source 
Co-authored-by: Junie <junie@jetbrains.com>
This commit is contained in:
chrisfu 2026-04-22 15:08:35 -07:00
parent 2477d23bab
commit 55b6a6aff3
573 changed files with 8098 additions and 8135 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
AGENTS.md
View File

@ -1,8 +1,8 @@
# AGENTS.md — AI coding agent guide for knoe-db / Prole # AGENTS.md — AI coding agent guide for knoe-db / Knoe
## What this repo is ## What this repo is
**Knoe** is an infrastructure stack for deploying a Supabase-style internal developer platform (PostgreSQL, object storage, secrets, auth, observability) across K3d (local), K3s (on-prem), and GKE (cloud) environments. The Python "Prole" installer (`prole/cli.py`) drives all cluster setup via milestones. **Knoe** is an infrastructure stack for deploying a Supabase-style internal developer platform (PostgreSQL, object storage, secrets, auth, observability) across K3d (local), K3s (on-prem), and GKE (cloud) environments. The Python "Knoe" installer (`knoe/cli.py`) drives all cluster setup via milestones.
--- ---
@ -18,7 +18,7 @@ Two GKE clusters in `us-west3`:
**Critical:** Garage must NEVER be deployed to `knoe-cnpg-0`. SSD quota (300 GB) is fully consumed by CNPG — all non-CNPG PVCs must use `standard` storage class (HDD), not `standard-rwo`/`premium-rwo`. **Critical:** Garage must NEVER be deployed to `knoe-cnpg-0`. SSD quota (300 GB) is fully consumed by CNPG — all non-CNPG PVCs must use `standard` storage class (HDD), not `standard-rwo`/`premium-rwo`.
### Deployment environments / modes ### Deployment environments / modes
| `cluster_env` | `PROLE_MODE` | Target | | `cluster_env` | `KNOE_MODE` | Target |
|---|---|---| |---|---|---|
| `dev` | `k3d` | Local K3d cluster | | `dev` | `k3d` | Local K3d cluster |
| `service` | `k3s` | On-prem K3s cluster | | `service` | `k3s` | On-prem K3s cluster |
@ -27,12 +27,12 @@ Two GKE clusters in `us-west3`:
`_deployment_mode_from_env()` in `knoe/core/env.py` converts env strings to mode strings. `_deployment_mode_from_env()` in `knoe/core/env.py` converts env strings to mode strings.
### Config file mapping ### Config file mapping
`knoe/prole_conf.py` maps environments to config files under `conf/`: `knoe/knoe_conf.py` maps environments to config files under `conf/`:
- `dev` → `k3d.cfg` - `dev` → `k3d.cfg`
- `service` → `k3s.cfg` - `service` → `k3s.cfg`
- `prod` → `gke.cfg` - `prod` → `gke.cfg`
Config is layered: env-specific file overrides base. `PROLE_CONF` env var or `conf/service/` subdirs point to the active config. Config is layered: env-specific file overrides base. `KNOE_CONF` env var or `conf/service/` subdirs point to the active config.
--- ---
@ -43,7 +43,7 @@ Config is layered: env-specific file overrides base. `PROLE_CONF` env var or `co
| `knoe/core/env.py` | Core config/env helpers, secret encryption, kubeconfig resolution | | `knoe/core/env.py` | Core config/env helpers, secret encryption, kubeconfig resolution |
| `knoe/core/actions.py` | All installer actions and unattended workflow helpers (~8k lines) | | `knoe/core/actions.py` | All installer actions and unattended workflow helpers (~8k lines) |
| `knoe/milestone.py` | `Milestone` ABC — all install steps implement this; `_get_script_env()` builds the env for subprocesses | | `knoe/milestone.py` | `Milestone` ABC — all install steps implement this; `_get_script_env()` builds the env for subprocesses |
| `knoe/prole_conf.py` | Config path resolution and layered loading | | `knoe/knoe_conf.py` | Config path resolution and layered loading |
| `knoe/core/milestones.py` | Concrete milestone definitions | | `knoe/core/milestones.py` | Concrete milestone definitions |
| `conf/gke.cfg` | Production GKE config (must have correct `app_cluster_kubecontext` / `db_cluster_kubecontext`) | | `conf/gke.cfg` | Production GKE config (must have correct `app_cluster_kubecontext` / `db_cluster_kubecontext`) |
| `conf/service/prod.cfg` | Unattended deploy config for `./deploy.sh` | | `conf/service/prod.cfg` | Unattended deploy config for `./deploy.sh` |
@ -57,7 +57,7 @@ Config is layered: env-specific file overrides base. `PROLE_CONF` env var or `co
### Install dependencies ### Install dependencies
```bash ```bash
make requirements # pip install -r prole_requirements.txt make requirements # pip install -r requirements.txt
``` ```
### Run tests ### Run tests
@ -67,14 +67,14 @@ make test # runs pyconv (black check) then pytest with coverage
PYTHONPATH=. pytest tests/ PYTHONPATH=. pytest tests/
``` ```
### Build the prole CLI binary ### Build the knoe CLI binary
```bash ```bash
make prole # PyInstaller one-file binary → dist/prole make build # PyInstaller one-file binary → dist/knoe
``` ```
### Interactive installer (ncurses) ### Interactive installer (ncurses)
```bash ```bash
./install.sh # reads conf/gke.cfg (or PROLE_CONF) make knoe # launches ./install.sh
# or via the unified launcher: # or via the unified launcher:
./knoe.sh install ./knoe.sh install
``` ```
@ -93,7 +93,7 @@ black . # formatter (black --check . is enforced in CI)
## Secret handling ## Secret handling
Secrets in `prole.cfg` are AES-GCM encrypted at rest using `${PROLE_SECRET:v1:...}` tokens. On macOS, the key is in Keychain (`prole-installer` service); on Linux, at `~/.prole/secrets/knoe.key`. OpenBao references use `${OPENBAO:kv/prole/<ns>/<leaf>#<key>}`. Never store plaintext passwords in config files. Secrets in `knoe.cfg` are AES-GCM encrypted at rest using `${KNOE_SECRET:v1:...}` tokens. On macOS, the key is in Keychain (`knoe-installer` service); on Linux, at `~/.knoe/secrets/knoe.key`. OpenBao references use `${OPENBAO:kv/knoe/<ns>/<leaf>#<key>}`. Never store plaintext passwords in config files.
--- ---
@ -102,7 +102,7 @@ Secrets in `prole.cfg` are AES-GCM encrypted at rest using `${PROLE_SECRET:v1:..
All installer steps subclass `Milestone` (`knoe/milestone.py`). They must: All installer steps subclass `Milestone` (`knoe/milestone.py`). They must:
- Be UI-agnostic (no tkinter/ncurses imports) - Be UI-agnostic (no tkinter/ncurses imports)
- Use `_run_cmd()` for subprocesses (handles env injection) - Use `_run_cmd()` for subprocesses (handles env injection)
- Use `_get_script_env(state)` to build env dicts for shell scripts — this is where `KUBECONTEXT`, `DB_CLUSTER_KUBECONTEXT`, `PROLE_CONF`, etc. are set - Use `_get_script_env(state)` to build env dicts for shell scripts — this is where `KUBECONTEXT`, `DB_CLUSTER_KUBECONTEXT`, `KNOE_CONF`, etc. are set
Missing `init_cluster.app_cluster_kubecontext` in config causes Garage to deploy to the wrong cluster. Missing `init_cluster.app_cluster_kubecontext` in config causes Garage to deploy to the wrong cluster.
@ -112,6 +112,6 @@ Missing `init_cluster.app_cluster_kubecontext` in config causes Garage to deploy
- CNPG backups go to **GCS** (not Garage): `gs://knoe-0-backups/` and `gs://knoe-0-wal/` - CNPG backups go to **GCS** (not Garage): `gs://knoe-0-backups/` and `gs://knoe-0-wal/`
- Workload Identity SA: `cnpg-backup@plenary-truck-485623-p7.iam.gserviceaccount.com` - Workload Identity SA: `cnpg-backup@plenary-truck-485623-p7.iam.gserviceaccount.com`
- ObjectStore manifest: `k8s/prole/knoe-db-barman-objectstore-gcs.yaml` - ObjectStore manifest: `k8s/knoe/knoe-db-barman-objectstore-gcs.yaml`
- Setup: `etc/init_cnpg_gke.sh` and `etc/init_cnpg_backup.sh` - Setup: `etc/init_cnpg_gke.sh` and `etc/init_cnpg_backup.sh`

10
BUILD.md
View File

@ -7,26 +7,26 @@
make package make package
``` ```
This creates `dist/Prole Installer.app` - a self-contained macOS application. This creates `dist/Knoe Installer.app` - a self-contained macOS application.
## Usage ## Usage
**GUI Mode (double-click):** **GUI Mode (double-click):**
- Open `dist/Prole Installer.app` in Finder - Open `dist/Knoe Installer.app` in Finder
**Command-line:** **Command-line:**
```bash ```bash
# Auto-detect display (GUI or ncurses) # Auto-detect display (GUI or ncurses)
./dist/Prole\ Installer.app/Contents/MacOS/prole-installer ./dist/Knoe\ Installer.app/Contents/MacOS/knoe-installer
# Force ncurses mode # Force ncurses mode
./dist/Prole\ Installer.app/Contents/MacOS/prole-installer --no-gui ./dist/Knoe\ Installer.app/Contents/MacOS/knoe-installer --no-gui
``` ```
## Install to /Applications ## Install to /Applications
```bash ```bash
cp -r "dist/Prole Installer.app" /Applications/ cp -r "dist/Knoe Installer.app" /Applications/
``` ```
## Makefile Targets ## Makefile Targets

4
CLAUDE.md
View File

@ -1,4 +1,4 @@
# CLAUDE.md — prole project context # CLAUDE.md — knoe project context
> Loaded automatically by Claude Code (CLI and IntelliJ plugin) as project context. > Loaded automatically by Claude Code (CLI and IntelliJ plugin) as project context.
@ -38,7 +38,7 @@ Backups use **GCS with Workload Identity** (not Garage):
- WAL bucket: `gs://knoe-0-wal/` - WAL bucket: `gs://knoe-0-wal/`
- GCP SA: `cnpg-backup@plenary-truck-485623-p7.iam.gserviceaccount.com` - GCP SA: `cnpg-backup@plenary-truck-485623-p7.iam.gserviceaccount.com`
- K8s SA: `cnpg-backup-sa` in `knoe-db-0` (annotated with WI) - K8s SA: `cnpg-backup-sa` in `knoe-db-0` (annotated with WI)
- ObjectStore manifest: `k8s/prole/knoe-db-barman-objectstore-gcs.yaml` - ObjectStore manifest: `k8s/knoe/knoe-db-barman-objectstore-gcs.yaml`
Setup script: `etc/init_cnpg_gke.sh` (creates buckets, GCP SA, WI binding, applies CNPG cluster). Setup script: `etc/init_cnpg_gke.sh` (creates buckets, GCP SA, WI binding, applies CNPG cluster).

89
Makefile
View File

@ -1,4 +1,4 @@
# Makefile for Prole Database Deployment and Installer # Makefile for Knoe Database Deployment and Installer
ifneq ($(wildcard bin/python3),) ifneq ($(wildcard bin/python3),)
PYTHON ?= bin/python3 PYTHON ?= bin/python3
@ -8,72 +8,59 @@ endif
PYINSTALLER = $(PYTHON) -m PyInstaller PYINSTALLER = $(PYTHON) -m PyInstaller
DIST_DIR = dist DIST_DIR = dist
BUILD_DIR = build BUILD_DIR = build
PROLE_CONF ?= conf KNOE_CONF ?= conf
PROLE_MODE ?= k3d KNOE_MODE ?= k3d
PIPELINE_DIR ?= deploy/opentofu/k3s PIPELINE_DIR ?= deploy/opentofu/k3s
DEPLOYMENT_GIT_DIR ?= prole/deployment DEPLOYMENT_GIT_DIR ?= knoe/deployment
GITEA_SCRIPT ?= prole/etc/gitea.sh GITEA_SCRIPT ?= knoe/etc/gitea.sh
KUBECONFIG_PATH ?= $(CURDIR)/prole-k3s.kubeconfig KUBECONFIG_PATH ?= $(CURDIR)/knoe-k3s.kubeconfig
DEPLOYMENT_REPO_URL ?= http://gitea.local/prole/deployment.git DEPLOYMENT_REPO_URL ?= http://gitea.local/knoe/deployment.git
.PHONY: all prole install deploy init clean help requirements test pyconv .PHONY: all knoe build install deploy init clean help requirements test pyconv start
all: prole all: build
start: build
open "$(DIST_DIR)/Knoe.DB Installer.app"
help: help:
@echo "Prole Build & Deployment System" @echo "Knoe Build & Deployment System"
@echo "" @echo ""
@echo "Targets:" @echo "Targets:"
@echo " prole - Build the 'prole' CLI binary (ncurses/silent only)" @echo " knoe - Launch the Ncurses installer"
@echo " start - Build and launch the GUI installer"
@echo " install - Run silent install via install.sh"
@echo " deploy - Run infrastructure deployment via deploy.sh"
@echo " build - Build the 'knoe' CLI binary"
@echo " requirements - Install Python dependencies" @echo " requirements - Install Python dependencies"
@echo " install - Run silent install via knoe.sh" @echo " test - Run full test suite"
@echo " init - Sync OpenTofu pipeline, tofu init, stage deployment git dir"
@echo " deploy - Run infrastructure deployment via OpenTofu"
@echo " test - Run full install.py test suite with pyconv and coverage summary"
@echo " pyconv - Check Python code style conventions (black)" @echo " pyconv - Check Python code style conventions (black)"
@echo " clean - Remove build artifacts" @echo " clean - Remove build artifacts"
@echo "" @echo ""
@echo "Environment:" @echo "Environment:"
@echo " PROLE_CONF - Directory containing prole.cfg (default: conf)" @echo " KNOE_CONF - Directory containing knoe.cfg (default: conf)"
requirements: requirements:
@echo "Installing dependencies..." @echo "Installing dependencies..."
$(PYTHON) -m pip install -r prole_requirements.txt $(PYTHON) -m pip install -r requirements.txt
prole: knoe:
@$(PYTHON) -c "import PyInstaller" 2>/dev/null || (echo "Error: PyInstaller not found. Please run 'make requirements' or install it with: $(PYTHON) -m pip install -r prole_requirements.txt" && exit 1) ./install.sh
@echo "Building 'prole' CLI binary (excluding Tk UI)..."
$(PYINSTALLER) --clean --noconfirm --onefile \ build:
--name prole \ @$(PYTHON) -c "import PyInstaller" 2>/dev/null || (echo "Error: PyInstaller not found. Please run 'make requirements' or install it with: $(PYTHON) -m pip install -r requirements.txt" && exit 1)
--exclude-module tkinter \ @echo "Building 'Knoe.DB Installer' macOS App Bundle..."
--exclude-module _tkinter \ $(PYINSTALLER) --clean --noconfirm knoe.spec
--exclude-module Tkinter \ @echo "✓ Build complete: $(DIST_DIR)/Knoe.DB Installer.app"
--add-data "etc:etc" \
--add-data "scan:scan" \
--add-data "k8s:k8s" \
--add-data "conf:conf" \
prole/cli.py
@echo "✓ Build complete: $(DIST_DIR)/prole"
install: install:
@echo "Running silent install..." @echo "Running silent install..."
PROLE_CONF=$(PROLE_CONF) ./knoe.sh install -s -c $(PROLE_CONF)/prole.cfg KNOE_CONF=$(KNOE_CONF) ./install.sh -s -c $(KNOE_CONF)/knoe.cfg
init: init:
@command -v tofu >/dev/null 2>&1 || (echo "Error: OpenTofu (tofu) not found in PATH." && exit 1) @command -v tofu >/dev/null 2>&1 || (echo "Error: OpenTofu (tofu) not found in PATH." && exit 1)
@echo "Syncing OpenTofu pipeline from $(PROLE_MODE) runtime into $(PIPELINE_DIR)..." @echo "Syncing OpenTofu pipeline from $(KNOE_MODE) runtime into $(PIPELINE_DIR)..."
@PROLE_MODE=$(PROLE_MODE) PROLE_CONF=$(PROLE_CONF) PROLE_GIT_REPO=$(DEPLOYMENT_REPO_URL) PYTHONPATH=$(CURDIR) $(PYTHON) - <<'PY' @KNOE_MODE=$(KNOE_MODE) KNOE_CONF=$(KNOE_CONF) KNOE_GIT_REPO=$(DEPLOYMENT_REPO_URL) PYTHONPATH=$(CURDIR) $(PYTHON) -c "from knoe.core.controller import KnoeController; from knoe.core.env import PROJECT_ROOT; from knoe.deployment import KnoeDeployment; import sys, os; conf_dir = os.environ.get('KNOE_CONF', 'conf'); cfg_path = PROJECT_ROOT / conf_dir / 'knoe.cfg'; deployment = KnoeDeployment(KnoeController(PROJECT_ROOT, verbose=False, cfg_path=cfg_path), PROJECT_ROOT); ok = deployment.duplicate_k3d_to_k3s(); sys.exit(0 if ok else 1)"
from knoe.core.controller import ProleController
from knoe.core.env import PROJECT_ROOT
from prole.deployment import ProleDeployment
import sys, os
from pathlib import Path
conf_dir = os.environ.get('PROLE_CONF', 'conf')
cfg_path = PROJECT_ROOT / conf_dir / 'prole.cfg'
deployment = ProleDeployment(ProleController(PROJECT_ROOT, verbose=False, cfg_path=cfg_path), PROJECT_ROOT)
ok = deployment.duplicate_k3d_to_k3s()
sys.exit(0 if ok else 1)
PY
@echo "Initializing OpenTofu backend in $(PIPELINE_DIR)..." @echo "Initializing OpenTofu backend in $(PIPELINE_DIR)..."
@cd $(PIPELINE_DIR) && tofu init @cd $(PIPELINE_DIR) && tofu init
@echo "Staging pipeline sources into $(DEPLOYMENT_GIT_DIR) for Gitea" @echo "Staging pipeline sources into $(DEPLOYMENT_GIT_DIR) for Gitea"
@ -82,14 +69,12 @@ PY
@cd $(DEPLOYMENT_GIT_DIR) && if [ ! -d .git ]; then git init -q; fi @cd $(DEPLOYMENT_GIT_DIR) && if [ ! -d .git ]; then git init -q; fi
@echo "✓ init complete" @echo "✓ init complete"
deploy: init deploy:
@echo "Deploying internal Gitea to k3s..." @echo "Running Knoe deployment..."
@KUBECONFIG=$(KUBECONFIG_PATH) PROLE_MODE=k3s PROLE_CONF=$(PROLE_CONF) $(GITEA_SCRIPT) deploy -c $(PROLE_CONF)/prole.cfg ./deploy.sh
@echo "Running Prole deployment (OpenTofu)..."
KUBECONFIG=$(KUBECONFIG_PATH) PYTHONPATH=$(CURDIR) PROLE_CONF=$(PROLE_CONF) PROLE_MODE=$(PROLE_MODE) PROLE_GIT_REPO=$(DEPLOYMENT_REPO_URL) $(PYTHON) prole/cli.py deploy
test: pyconv test: pyconv
@echo "Running full install.py test suite..." @echo "Running full test suite..."
@./tests/run_tests.sh @./tests/run_tests.sh
@echo "" @echo ""
@echo "Test Summary:" @echo "Test Summary:"
@ -102,5 +87,5 @@ pyconv:
clean: clean:
@echo "Cleaning build artifacts..." @echo "Cleaning build artifacts..."
rm -rf $(BUILD_DIR) $(DIST_DIR) *.spec rm -rf $(BUILD_DIR) $(DIST_DIR) *.spec
rm -rf __pycache__ prole/__pycache__ knoe/__pycache__ rm -rf __pycache__ knoe/__pycache__
@echo "✓ Clean complete" @echo "✓ Clean complete"

2
README.md
View File

@ -1,5 +1,5 @@
<div align="center"> <div align="center">
<a href="https://svc.prole.org"><pre> <a href="https://svc.knoe.org"><pre>
# ########################### # ###########################
# ╭──────────────────────╮ # # ╭──────────────────────╮ #
# │ _ │ # # │ _ │ #

2
authority/pom.xml
View File

@ -10,7 +10,7 @@
<relativePath/> <relativePath/>
</parent> </parent>
<groupId>org.prole</groupId> <groupId>org.knoe</groupId>
<artifactId>authority</artifactId> <artifactId>authority</artifactId>
<version>0.0.1-SNAPSHOT</version> <version>0.0.1-SNAPSHOT</version>
<name>knoe-authority</name> <name>knoe-authority</name>

2
authority/src/main/java/org/prole/authority/HealthController.java
View File

@ -1,4 +1,4 @@
package org.prole.authority; package org.knoe.authority;
import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;

2
authority/src/main/java/org/prole/authority/KnoeAuthApplication.java
View File

@ -1,4 +1,4 @@
package org.prole.authority; package org.knoe.authority;
import org.springframework.boot.SpringApplication; import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.autoconfigure.SpringBootApplication;

2
authority/src/main/java/org/prole/authority/config/AuthProperties.java
View File

@ -1,4 +1,4 @@
package org.prole.authority.config; package org.knoe.authority.config;
import java.time.Duration; import java.time.Duration;
import java.util.ArrayList; import java.util.ArrayList;

2
authority/src/main/java/org/prole/authority/config/KerberosProperties.java
View File

@ -1,4 +1,4 @@
package org.prole.authority.config; package org.knoe.authority.config;
import org.springframework.boot.context.properties.ConfigurationProperties; import org.springframework.boot.context.properties.ConfigurationProperties;

4
authority/src/main/java/org/prole/authority/kerberos/KerberosPasswordService.java
View File

@ -1,4 +1,4 @@
package org.prole.authority.kerberos; package org.knoe.authority.kerberos;
import java.io.IOException; import java.io.IOException;
import java.util.Map; import java.util.Map;
@ -23,7 +23,7 @@ public class KerberosPasswordService {
throw new IllegalArgumentException("password required"); throw new IllegalArgumentException("password required");
} }
Configuration jaasConfig = new PasswordJaasConfiguration(); Configuration jaasConfig = new PasswordJaasConfiguration();
LoginContext loginContext = new LoginContext("prole-krb5-pw", null, new FixedCallbackHandler(principal, password), jaasConfig); LoginContext loginContext = new LoginContext("knoe-krb5-pw", null, new FixedCallbackHandler(principal, password), jaasConfig);
loginContext.login(); loginContext.login();
} }

4
authority/src/main/java/org/prole/authority/kerberos/KerberosSpnegoService.java
View File

@ -1,4 +1,4 @@
package org.prole.authority.kerberos; package org.knoe.authority.kerberos;
import java.security.PrivilegedExceptionAction; import java.security.PrivilegedExceptionAction;
import java.util.Map; import java.util.Map;
@ -38,7 +38,7 @@ public class KerberosSpnegoService {
} }
Configuration jaasConfig = new KeytabJaasConfiguration(servicePrincipal, keytabPath); Configuration jaasConfig = new KeytabJaasConfiguration(servicePrincipal, keytabPath);
LoginContext loginContext = new LoginContext("prole-krb5", null, null, jaasConfig); LoginContext loginContext = new LoginContext("knoe-krb5", null, null, jaasConfig);
loginContext.login(); loginContext.login();
Subject subject = loginContext.getSubject(); Subject subject = loginContext.getSubject();

2
authority/src/main/java/org/prole/authority/session/SessionTokenService.java
View File

@ -1,4 +1,4 @@
package org.prole.authority.session; package org.knoe.authority.session;
import com.fasterxml.jackson.annotation.JsonIgnoreProperties; import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
import com.fasterxml.jackson.databind.ObjectMapper; import com.fasterxml.jackson.databind.ObjectMapper;

2
authority/src/main/java/org/prole/authority/session/SessionUser.java
View File

@ -1,4 +1,4 @@
package org.prole.authority.session; package org.knoe.authority.session;
import java.util.List; import java.util.List;

2
authority/src/main/java/org/prole/authority/user/PrincipalNormalizer.java
View File

@ -1,4 +1,4 @@
package org.prole.authority.user; package org.knoe.authority.user;
import java.util.Locale; import java.util.Locale;
import java.util.Optional; import java.util.Optional;

16
authority/src/main/java/org/prole/authority/web/LoginController.java
View File

@ -1,4 +1,4 @@
package org.prole.authority.web; package org.knoe.authority.web;
import java.net.URI; import java.net.URI;
import java.util.ArrayList; import java.util.ArrayList;
@ -10,13 +10,13 @@ import jakarta.annotation.PostConstruct;
import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse; import jakarta.servlet.http.HttpServletResponse;
import org.prole.authority.config.AuthProperties; import org.knoe.authority.config.AuthProperties;
import org.prole.authority.config.KerberosProperties; import org.knoe.authority.config.KerberosProperties;
import org.prole.authority.kerberos.KerberosPasswordService; import org.knoe.authority.kerberos.KerberosPasswordService;
import org.prole.authority.kerberos.KerberosSpnegoService; import org.knoe.authority.kerberos.KerberosSpnegoService;
import org.prole.authority.session.SessionTokenService; import org.knoe.authority.session.SessionTokenService;
import org.prole.authority.session.SessionUser; import org.knoe.authority.session.SessionUser;
import org.prole.authority.user.PrincipalNormalizer; import org.knoe.authority.user.PrincipalNormalizer;
import org.springframework.http.HttpHeaders; import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus; import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType; import org.springframework.http.MediaType;

14
authority/src/main/java/org/prole/authority/web/VerifyController.java
View File

@ -1,13 +1,13 @@
package org.prole.authority.web; package org.knoe.authority.web;
import jakarta.servlet.http.Cookie; import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletRequest;
import java.util.Arrays; import java.util.Arrays;
import java.util.Optional; import java.util.Optional;
import org.prole.authority.config.AuthProperties; import org.knoe.authority.config.AuthProperties;
import org.prole.authority.session.SessionTokenService; import org.knoe.authority.session.SessionTokenService;
import org.prole.authority.session.SessionUser; import org.knoe.authority.session.SessionUser;
import org.springframework.http.HttpHeaders; import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus; import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity; import org.springframework.http.ResponseEntity;
@ -18,9 +18,9 @@ import org.springframework.web.bind.annotation.RestController;
@RestController @RestController
@RequestMapping("/auth") @RequestMapping("/auth")
public class VerifyController { public class VerifyController {
public static final String USER_HEADER = "X-Prole-User"; public static final String USER_HEADER = "X-Knoe-User";
public static final String EMAIL_HEADER = "X-Prole-Email"; public static final String EMAIL_HEADER = "X-Knoe-Email";
public static final String GROUPS_HEADER = "X-Prole-Groups"; public static final String GROUPS_HEADER = "X-Knoe-Groups";
private final AuthProperties auth; private final AuthProperties auth;
private final SessionTokenService tokens; private final SessionTokenService tokens;

10
authority/src/test/java/org/prole/authority/session/SessionTokenServiceTest.java
View File

@ -1,4 +1,4 @@
package org.prole.authority.session; package org.knoe.authority.session;
import com.fasterxml.jackson.databind.ObjectMapper; import com.fasterxml.jackson.databind.ObjectMapper;
import java.time.Clock; import java.time.Clock;
@ -16,12 +16,12 @@ class SessionTokenServiceTest {
Clock clock = Clock.fixed(Instant.parse("2026-03-20T00:00:00Z"), ZoneOffset.UTC); Clock clock = Clock.fixed(Instant.parse("2026-03-20T00:00:00Z"), ZoneOffset.UTC);
SessionTokenService svc = SessionTokenService.forTests(om, clock); SessionTokenService svc = SessionTokenService.forTests(om, clock);
String token = svc.issue("secret", new SessionUser("alice", "alice@prole.org", java.util.List.of()), Duration.ofMinutes(5)); String token = svc.issue("secret", new SessionUser("alice", "alice@knoe.org", java.util.List.of()), Duration.ofMinutes(5));
assertNotNull(token); assertNotNull(token);
SessionUser user = svc.verify("secret", token).orElseThrow(); SessionUser user = svc.verify("secret", token).orElseThrow();
assertEquals("alice", user.username()); assertEquals("alice", user.username());
assertEquals("alice@prole.org", user.email()); assertEquals("alice@knoe.org", user.email());
} }
@Test @Test
@ -29,7 +29,7 @@ class SessionTokenServiceTest {
ObjectMapper om = new ObjectMapper(); ObjectMapper om = new ObjectMapper();
Clock clock = Clock.fixed(Instant.parse("2026-03-20T00:00:00Z"), ZoneOffset.UTC); Clock clock = Clock.fixed(Instant.parse("2026-03-20T00:00:00Z"), ZoneOffset.UTC);
SessionTokenService svc = SessionTokenService.forTests(om, clock); SessionTokenService svc = SessionTokenService.forTests(om, clock);
String token = svc.issue("secret", new SessionUser("alice", "alice@prole.org", java.util.List.of()), Duration.ofMinutes(5)); String token = svc.issue("secret", new SessionUser("alice", "alice@knoe.org", java.util.List.of()), Duration.ofMinutes(5));
assertTrue(svc.verify("other", token).isEmpty()); assertTrue(svc.verify("other", token).isEmpty());
} }
@ -38,7 +38,7 @@ class SessionTokenServiceTest {
ObjectMapper om = new ObjectMapper(); ObjectMapper om = new ObjectMapper();
Clock clock = Clock.fixed(Instant.parse("2026-03-20T00:00:00Z"), ZoneOffset.UTC); Clock clock = Clock.fixed(Instant.parse("2026-03-20T00:00:00Z"), ZoneOffset.UTC);
SessionTokenService svc = SessionTokenService.forTests(om, clock); SessionTokenService svc = SessionTokenService.forTests(om, clock);
String token = svc.issue("secret", new SessionUser("alice", "alice@prole.org", java.util.List.of()), Duration.ofSeconds(1)); String token = svc.issue("secret", new SessionUser("alice", "alice@knoe.org", java.util.List.of()), Duration.ofSeconds(1));
SessionTokenService svcLater = SessionTokenService.forTests(om, Clock.fixed(Instant.parse("2026-03-20T00:10:00Z"), ZoneOffset.UTC)); SessionTokenService svcLater = SessionTokenService.forTests(om, Clock.fixed(Instant.parse("2026-03-20T00:10:00Z"), ZoneOffset.UTC));
assertTrue(svcLater.verify("secret", token).isEmpty()); assertTrue(svcLater.verify("secret", token).isEmpty());

22
authority/src/test/java/org/prole/authority/web/VerifyControllerTest.java
View File

@ -1,9 +1,9 @@
package org.prole.authority.web; package org.knoe.authority.web;
import java.time.Duration; import java.time.Duration;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.prole.authority.session.SessionTokenService; import org.knoe.authority.session.SessionTokenService;
import org.prole.authority.session.SessionUser; import org.knoe.authority.session.SessionUser;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc; import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.test.context.SpringBootTest;
@ -14,12 +14,12 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
@SpringBootTest(properties = { @SpringBootTest(properties = {
"prole.auth.enabled=true", "knoe.auth.enabled=true",
"prole.auth.sessionSecret=test-secret", "knoe.auth.sessionSecret=test-secret",
"prole.auth.cookieName=prole_session", "knoe.auth.cookieName=knoe_session",
"prole.auth.sessionTtl=1h", "knoe.auth.sessionTtl=1h",
"prole.kerberos.servicePrincipal=HTTP/api.prole.org@EXAMPLE.TEST", "knoe.kerberos.servicePrincipal=HTTP/api.knoe.org@EXAMPLE.TEST",
"prole.kerberos.keytabPath=/tmp/does-not-matter" "knoe.kerberos.keytabPath=/tmp/does-not-matter"
}) })
@AutoConfigureMockMvc @AutoConfigureMockMvc
class VerifyControllerTest { class VerifyControllerTest {
@ -34,8 +34,8 @@ class VerifyControllerTest {
@Test @Test
void authenticatedGetsHeaders() throws Exception { void authenticatedGetsHeaders() throws Exception {
String token = tokens.issue("test-secret", new SessionUser("alice", "alice@prole.org", java.util.List.of()), Duration.ofMinutes(10)); String token = tokens.issue("test-secret", new SessionUser("alice", "alice@knoe.org", java.util.List.of()), Duration.ofMinutes(10));
mvc.perform(get("/auth/verify").header(HttpHeaders.COOKIE, "prole_session=" + token)) mvc.perform(get("/auth/verify").header(HttpHeaders.COOKIE, "knoe_session=" + token))
.andExpect(status().isOk()) .andExpect(status().isOk())
.andExpect(header().string(VerifyController.USER_HEADER, "alice")); .andExpect(header().string(VerifyController.USER_HEADER, "alice"));
} }

11
bin/prole-env.sh
View File

@ -1,11 +0,0 @@
#!/usr/bin/env bash
# Prole environment file. Sourced by other scripts in ~/.prole/bin.
# Customize PATH, KUBECONFIG, contexts, etc.
# Ensure common kubectl locations are available
export PATH="/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:$PATH"
# Example: point to a specific kubeconfig if needed
# export KUBECONFIG="$HOME/.kube/config"
# You can add any environment variables that your port-forward commands require here.

76
bin/prole-kpf.sh
View File

@ -1,76 +0,0 @@
#!/usr/bin/env bash
set -euo pipefail
LABEL="org.prole.knoe-db.kpf-dev"
PLIST="$HOME/Library/LaunchAgents/$LABEL.plist"
PROLE_HOME="$HOME/.prole"
BIN_DIR="$PROLE_HOME/bin"
RUN_DIR="$PROLE_HOME/run"
PIDFILE="$RUN_DIR/kpf.pids"
# Source environment if present
if [ -f "$BIN_DIR/prole-env.sh" ]; then
# shellcheck source=/dev/null
. "$BIN_DIR/prole-env.sh"
fi
ensure_dirs() {
mkdir -p "$BIN_DIR" "$RUN_DIR"
}
list_cmds() {
if /usr/libexec/PlistBuddy -c "Print :ProleCommands" "$PLIST" >/dev/null 2>&1; then
local i=0
while true; do
if ! val=$(/usr/libexec/PlistBuddy -c "Print :ProleCommands:$i" "$PLIST" 2>/dev/null); then
break
fi
echo "$val"
i=$((i+1))
done
fi
}
start() {
ensure_dirs
: > "$PIDFILE"
# Iterate over commands and start each in background shell
while IFS= read -r cmd; do
[ -z "$cmd" ] && continue
(sh -lc "$cmd") &
echo $! >> "$PIDFILE"
done < <(list_cmds)
wait || true
}
stop() {
if [ -f "$PIDFILE" ]; then
while read -r pid; do
[ -z "$pid" ] && continue
kill "$pid" 2>/dev/null || true
done < "$PIDFILE"
rm -f "$PIDFILE"
fi
}
status() {
if [ ! -f "$PIDFILE" ]; then
echo "not running"
exit 3
fi
local alive=0 total=0
while read -r pid; do
[ -z "$pid" ] && continue
total=$((total+1))
if kill -0 "$pid" 2>/dev/null; then alive=$((alive+1)); fi
done < "$PIDFILE"
echo "$alive/$total running"
}
case "${1:-}" in
start) start ;;
stop) stop ;;
restart) stop; start ;;
status) status ;;
*) echo "Usage: $0 {start|stop|restart|status}" >&2; exit 2 ;;
esac

12
conf/cnpg-placement/ecosystem-0-knoe-db.json
View File

@ -1,15 +1,15 @@
{ {
"assignments": { "assignments": {
"0": "gandalf.prole.org", "0": "gandalf.knoe.org",
"1": "merlin.prole.org", "1": "merlin.knoe.org",
"2": "myrddin.prole.org" "2": "myrddin.knoe.org"
}, },
"cluster_name": "knoe-db", "cluster_name": "knoe-db",
"desired_instances": 3, "desired_instances": 3,
"eligible_nodes": [ "eligible_nodes": [
"gandalf.prole.org", "gandalf.knoe.org",
"merlin.prole.org", "merlin.knoe.org",
"myrddin.prole.org" "myrddin.knoe.org"
], ],
"metadata": { "metadata": {
"prior_plan_present": true, "prior_plan_present": true,

12
conf/cnpg-placement/knoe-db-knoe-db.json
View File

@ -1,15 +1,15 @@
{ {
"assignments": { "assignments": {
"0": "merlin.prole.org", "0": "merlin.knoe.org",
"1": "myrddin.prole.org", "1": "myrddin.knoe.org",
"2": "pi.prole.org" "2": "pi.knoe.org"
}, },
"cluster_name": "knoe-db", "cluster_name": "knoe-db",
"desired_instances": 3, "desired_instances": 3,
"eligible_nodes": [ "eligible_nodes": [
"merlin.prole.org", "merlin.knoe.org",
"myrddin.prole.org", "myrddin.knoe.org",
"pi.prole.org" "pi.knoe.org"
], ],
"metadata": { "metadata": {
"prior_plan_present": true, "prior_plan_present": true,

44
conf/gke.cfg
View File

@ -1,4 +1,4 @@
; Prole Master Configuration File ; Knoe Master Configuration File
; Generated by install.py on 2026-04-21 20:06:41 ; Generated by install.py on 2026-04-21 20:06:41
; This file is used as input for Ansible deployment and k8s cluster creation. ; This file is used as input for Ansible deployment and k8s cluster creation.
@ -35,11 +35,11 @@ env_setup.DATABASE_NAMESPACE = ${DATABASE_NAMESPACE}
env_setup.DB_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-cnpg-0 env_setup.DB_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-cnpg-0
env_setup.DB_CLUSTER_MODE = standard env_setup.DB_CLUSTER_MODE = standard
env_setup.DB_CLUSTER_NAME = knoe-dev-cnpg-0 env_setup.DB_CLUSTER_NAME = knoe-dev-cnpg-0
env_setup.PROLE_CONF = /Users/chrisfu/dev/prole/conf env_setup.KNOE_CONF = /Users/chrisfu/dev/knoe/conf
env_setup.PROLE_DATA = /Users/chrisfu/dev/prole/data env_setup.PROLE_DATA = /Users/chrisfu/dev/knoe/data
env_setup.PROLE_HOME = /Users/chrisfu/dev/prole env_setup.KNOE_HOME = /Users/chrisfu/dev/knoe
env_setup.PROLE_LOGS = /Users/chrisfu/dev/prole/logs env_setup.PROLE_LOGS = /Users/chrisfu/dev/knoe/logs
env_setup.PROLE_SERVICE = /Users/chrisfu/dev/prole/etc env_setup.KNOE_SERVICE = /Users/chrisfu/dev/knoe/etc
gitops.git_provider = GitLab gitops.git_provider = GitLab
init_cluster.app_cluster_kubecontext = gke_plenary-truck-485623-p7_us-west3_knoe-dev-0 init_cluster.app_cluster_kubecontext = gke_plenary-truck-485623-p7_us-west3_knoe-dev-0
init_cluster.app_cluster_machine_type = e2-small init_cluster.app_cluster_machine_type = e2-small
@ -79,8 +79,8 @@ init_password.cluster_name = ${CLUSTER_NAME}
init_password.db_cluster_name = knoe-dev-cnpg-0 init_password.db_cluster_name = knoe-dev-cnpg-0
init_password.db_host_port = 5432 init_password.db_host_port = 5432
init_password.db_namespace = ${DATABASE_NAMESPACE} init_password.db_namespace = ${DATABASE_NAMESPACE}
init_password.db_password = ${PROLE_SECRET:v1:ZFFldOYIZkB0YP4L:hPhu1R9jyKh5lYPsbrtLdd8F0leQ_yBODT6f4cYL9lU9GrBh} init_password.db_password = ${KNOE_SECRET:v1:ZFFldOYIZkB0YP4L:hPhu1R9jyKh5lYPsbrtLdd8F0leQ_yBODT6f4cYL9lU9GrBh}
init_password.db_password_confirm = ${PROLE_SECRET:v1:ZFFldOYIZkB0YP4L:hPhu1R9jyKh5lYPsbrtLdd8F0leQ_yBODT6f4cYL9lU9GrBh} init_password.db_password_confirm = ${KNOE_SECRET:v1:ZFFldOYIZkB0YP4L:hPhu1R9jyKh5lYPsbrtLdd8F0leQ_yBODT6f4cYL9lU9GrBh}
init_password.db_username = chrisfu init_password.db_username = chrisfu
init_password.generate_ssh_key = true init_password.generate_ssh_key = true
init_scripts.run_scripts = true init_scripts.run_scripts = true
@ -104,7 +104,7 @@ ARTIFACT_REGISTRY = us-west3-docker.pkg.dev/plenary-truck-485623-p7/knoe-system
AUTHORITY_ENABLED = true AUTHORITY_ENABLED = true
AUTH_HOSTNAME = api.knoe.dev AUTH_HOSTNAME = api.knoe.dev
AUTH_LOGIN_PATH = /auth/login AUTH_LOGIN_PATH = /auth/login
AUTH_RESPONSE_HEADERS = X-Prole-User,X-Prole-Email,X-Prole-Groups AUTH_RESPONSE_HEADERS = X-Knoe-User,X-Knoe-Email,X-Knoe-Groups
AUTH_VERIFY_PATH = /auth/verify AUTH_VERIFY_PATH = /auth/verify
CLUSTER_ENV = prod CLUSTER_ENV = prod
CLUSTER_NAME = knoe-db CLUSTER_NAME = knoe-db
@ -114,9 +114,9 @@ CNPG_SIZE_PROFILE = small
DATABASE_NAMESPACE = knoe-db-0 DATABASE_NAMESPACE = knoe-db-0
DB_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-cnpg-0 DB_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-cnpg-0
DB_HOST_PORT = 5432 DB_HOST_PORT = 5432
DB_PASSWORD = ${PROLE_SECRET:v1:MnnRuv9H3uhhWQp2:-oCq5ybT1tVEOjAiH5DjrTDrPa8hYituYyK1gdxlcuLFfmXa} DB_PASSWORD = ${KNOE_SECRET:v1:MnnRuv9H3uhhWQp2:-oCq5ybT1tVEOjAiH5DjrTDrPa8hYituYyK1gdxlcuLFfmXa}
DEPLOYMENT_MODE = k8s DEPLOYMENT_MODE = k8s
DEPLOYMENT_TARGET = prole-prod-cluster DEPLOYMENT_TARGET = knoe-prod-cluster
DOCKER_IMPORT_DIR = DOCKER_IMPORT_DIR =
DOCKER_PRELOAD = false DOCKER_PRELOAD = false
GARAGE_PRIVATE_S3_ENDPOINT = http://10.180.15.239:3900 GARAGE_PRIVATE_S3_ENDPOINT = http://10.180.15.239:3900
@ -149,7 +149,7 @@ KNOE_USER_GITLAB_OIDC_REDIRECT_URI = https://git.knoe.dev/users/auth/openid_conn
KNOE_USER_GITLAB_PROVISIONING_READY = true KNOE_USER_GITLAB_PROVISIONING_READY = true
OPENTOFU_URL = http://127.0.0.1:8080 OPENTOFU_URL = http://127.0.0.1:8080
OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2 OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2
PROLE_HOME = $HOME/dev/prole KNOE_HOME = $HOME/dev/knoe
PROTECTED_DB_HOSTS = db.0.knoe.dev,api.0.knoe.dev PROTECTED_DB_HOSTS = db.0.knoe.dev,api.0.knoe.dev
PROTECTED_GIT_HOSTS = git.knoe.dev PROTECTED_GIT_HOSTS = git.knoe.dev
REDIS_HOST = redis-master.knoe-system.svc.cluster.local REDIS_HOST = redis-master.knoe-system.svc.cluster.local
@ -193,11 +193,11 @@ PORT_FORWARD_K3D_MAPPING_8 = id=grafana;namespace=monitoring;target=svc/kps-graf
PORT_FORWARD_K3D_MAPPING_9 = id=supabase-kong;namespace=supabase;target=svc/kong;address=0.0.0.0;hostPort=8000;servicePort=8000;protocol=TCP;description=Supabase API (Kong) PORT_FORWARD_K3D_MAPPING_9 = id=supabase-kong;namespace=supabase;target=svc/kong;address=0.0.0.0;hostPort=8000;servicePort=8000;protocol=TCP;description=Supabase API (Kong)
[System Environment] [System Environment]
PROLE_CONF = $HOME/dev/prole/conf KNOE_CONF = $HOME/dev/knoe/conf
PROLE_DATA = $HOME/dev/prole/data PROLE_DATA = $HOME/dev/knoe/data
PROLE_HOME = $HOME/dev/prole KNOE_HOME = $HOME/dev/knoe
PROLE_LOGS = $HOME/dev/prole/logs PROLE_LOGS = $HOME/dev/knoe/logs
PROLE_SERVICE = $HOME/dev/prole/etc KNOE_SERVICE = $HOME/dev/knoe/etc
[Monitoring] [Monitoring]
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
@ -233,8 +233,8 @@ KUBECTL_CONTEXT = prod
MODE = k3d MODE = k3d
[Service Cluster (k3s)] [Service Cluster (k3s)]
CLUSTER_ENV = prole-service-cluster CLUSTER_ENV = knoe-service-cluster
DISPLAY_NAME = prole-service-cluster DISPLAY_NAME = knoe-service-cluster
K3S_SERVER_URL = K3S_SERVER_URL =
K3S_TOKEN = K3S_TOKEN =
MODE = k3s MODE = k3s
@ -245,8 +245,8 @@ PIPELINE_URL = http://127.0.0.1:8080
[Prod Cluster (k8s)] [Prod Cluster (k8s)]
ARTIFACTS_DIR = ARTIFACTS_DIR =
CLUSTER_ENV = prole-prod-cluster CLUSTER_ENV = knoe-prod-cluster
DISPLAY_NAME = prole-prod-cluster DISPLAY_NAME = knoe-prod-cluster
MODE = k8s MODE = k8s
PIPELINE_URL = http://127.0.0.1:8080 PIPELINE_URL = http://127.0.0.1:8080
@ -258,7 +258,7 @@ PIPELINE_URL = http://127.0.0.1:8080
[Deployment] [Deployment]
MODE = k8s MODE = k8s
TARGET = prole-prod-cluster TARGET = knoe-prod-cluster
[Install] [Install]
STATUS = Finished STATUS = Finished

92
conf/k3d.cfg
View File

@ -1,4 +1,4 @@
; Prole Master Configuration File ; Knoe Master Configuration File
; Generated by install.py on 2026-04-14 06:09:00 ; Generated by install.py on 2026-04-14 06:09:00
; This file is used as input for Ansible deployment and k8s cluster creation. ; This file is used as input for Ansible deployment and k8s cluster creation.
@ -40,24 +40,24 @@ dependencies.opentofu.install = true
dependencies.python.install = true dependencies.python.install = true
dependencies.verify_all = false dependencies.verify_all = false
disk_selection.disk_type = local disk_selection.disk_type = local
disk_selection.local_path = /Users/chrisfu/dev/prole/prole-tools-app/dist disk_selection.local_path = /Users/chrisfu/dev/knoe/knoe-tools-app/dist
disk_selection.removable_mount = disk_selection.removable_mount =
env_setup.CLUSTER_NAME = ${CLUSTER_NAME} env_setup.CLUSTER_NAME = ${CLUSTER_NAME}
env_setup.DATABASE_NAMESPACE = ${DATABASE_NAMESPACE} env_setup.DATABASE_NAMESPACE = ${DATABASE_NAMESPACE}
env_setup.PROLE_CONF = /Users/chrisfu/dev/prole/conf env_setup.KNOE_CONF = /Users/chrisfu/dev/knoe/conf
env_setup.PROLE_DATA = /Users/chrisfu/dev/prole/data env_setup.PROLE_DATA = /Users/chrisfu/dev/knoe/data
env_setup.PROLE_HOME = /Users/chrisfu/dev/prole env_setup.KNOE_HOME = /Users/chrisfu/dev/knoe
env_setup.PROLE_LOGS = /Users/chrisfu/dev/prole/logs env_setup.PROLE_LOGS = /Users/chrisfu/dev/knoe/logs
env_setup.PROLE_SERVICE = /Users/chrisfu/dev/prole/etc env_setup.KNOE_SERVICE = /Users/chrisfu/dev/knoe/etc
gitops.git_provider = Gitea gitops.git_provider = Gitea
gitops.node_selector = gitops.node_selector =
init_cluster.argocd_enabled = false init_cluster.argocd_enabled = false
init_cluster.at_rest_encryption_enabled = true init_cluster.at_rest_encryption_enabled = true
init_cluster.cluster_env = dev init_cluster.cluster_env = dev
init_cluster.deployment_target = prole-dev-cluster init_cluster.deployment_target = knoe-dev-cluster
init_cluster.gitops_enabled = true init_cluster.gitops_enabled = true
init_cluster.k3s_server_url = https://myrddin.prole.org:6443 init_cluster.k3s_server_url = https://myrddin.knoe.org:6443
init_cluster.k3s_token = ${PROLE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==} init_cluster.k3s_token = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==}
init_cluster.kerberos_enabled = true init_cluster.kerberos_enabled = true
init_cluster.mode = k3d init_cluster.mode = k3d
init_cluster.start_cluster = true init_cluster.start_cluster = true
@ -84,46 +84,46 @@ ollama_config.model =
ollama_config.server_host = ollama_config.server_host =
ollama_config.server_port = 11434 ollama_config.server_port = 11434
supabase_config.pv_base_dir = /synology/d005 supabase_config.pv_base_dir = /synology/d005
supabase_config.pv_node = gandalf.prole.org supabase_config.pv_node = gandalf.knoe.org
[Global] [Global]
; Variables used by name in more than one place or assumed global scope ; Variables used by name in more than one place or assumed global scope
ARGOCD_NAMESPACE = argocd ARGOCD_NAMESPACE = argocd
ARTIFACT_REGISTRY = us-west3-docker.pkg.dev/plenary-truck-485623-p7/knoe-system ARTIFACT_REGISTRY = us-west3-docker.pkg.dev/plenary-truck-485623-p7/knoe-system
AUTHORITY_ENABLED = true AUTHORITY_ENABLED = true
AUTH_HOSTNAME = api.prole.org AUTH_HOSTNAME = api.knoe.org
AUTH_LOGIN_PATH = /auth/login AUTH_LOGIN_PATH = /auth/login
AUTH_RESPONSE_HEADERS = X-Prole-User,X-Prole-Email,X-Prole-Groups AUTH_RESPONSE_HEADERS = X-Knoe-User,X-Knoe-Email,X-Knoe-Groups
AUTH_VERIFY_PATH = /auth/verify AUTH_VERIFY_PATH = /auth/verify
CLUSTER_ENV = dev CLUSTER_ENV = dev
CLUSTER_NAME = knoe-db CLUSTER_NAME = knoe-db
CNPG_PLACEMENT_PLAN_FILE = /Users/chrisfu/dev/prole/conf/cnpg-placement/knoe-system-knoe-db.json CNPG_PLACEMENT_PLAN_FILE = /Users/chrisfu/dev/knoe/conf/cnpg-placement/knoe-system-knoe-db.json
CNPG_PLACEMENT_PLAN_HASH = 965d2fde4035059f CNPG_PLACEMENT_PLAN_HASH = 965d2fde4035059f
CNPG_PLACEMENT_PLAN_ID = cnpg-placement-965d2fde4035059f CNPG_PLACEMENT_PLAN_ID = cnpg-placement-965d2fde4035059f
DATABASE_NAMESPACE = knoe-db-18-008-18-009-18-013-18-014 DATABASE_NAMESPACE = knoe-db-18-008-18-009-18-013-18-014
DB_HOST_PORT = 5432 DB_HOST_PORT = 5432
DEPLOYMENT_MODE = k3d DEPLOYMENT_MODE = k3d
DEPLOYMENT_TARGET = prole-dev-cluster DEPLOYMENT_TARGET = knoe-dev-cluster
DOCKER_PRELOAD = false DOCKER_PRELOAD = false
GITLAB_PUBLIC_HOSTS = git.knoe.dev,git.prole.org GITLAB_PUBLIC_HOSTS = git.knoe.dev,git.knoe.org
K3S_SERVER = https://myrddin.prole.org:6443 K3S_SERVER = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:CWWf3RHFdbUrmfrY:It8a2G8QUUIsqVwMsm3LsI4UvSSChEc_uAdESwzYplZLOCiSsCbOKuT9FbPpIwQvEaG_gLz9ZAfkD0EQxJp81KAtpk_X3K_nxVUa0RPRlbt_wdeXXoMoFFpN5BqXXz2HZwKgh_gpK1hjVbsJQHKAbTqWfu8u_LTmYYg4ag==} K3S_TOKEN = ${KNOE_SECRET:v1:CWWf3RHFdbUrmfrY:It8a2G8QUUIsqVwMsm3LsI4UvSSChEc_uAdESwzYplZLOCiSsCbOKuT9FbPpIwQvEaG_gLz9ZAfkD0EQxJp81KAtpk_X3K_nxVUa0RPRlbt_wdeXXoMoFFpN5BqXXz2HZwKgh_gpK1hjVbsJQHKAbTqWfu8u_LTmYYg4ag==}
KNOE_DB_USER = root KNOE_DB_USER = root
KUBECONTEXT = dev KUBECONTEXT = dev
MONITORING_STORAGE_CLASS = local-path MONITORING_STORAGE_CLASS = local-path
OPENTOFU_URL = http://127.0.0.1:8080 OPENTOFU_URL = http://127.0.0.1:8080
OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2 OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2
PROLE_K3S_SERVER = https://myrddin.prole.org:6443 PROLE_K3S_SERVER = https://myrddin.knoe.org:6443
PROLE_K3S_TOKEN = ${PROLE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==} PROLE_K3S_TOKEN = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==}
PROLE_OPENTOFU_URL = http://127.0.0.1:8080 PROLE_OPENTOFU_URL = http://127.0.0.1:8080
PROTECTED_DB_HOSTS = db.0.knoe.dev,db.prole.org PROTECTED_DB_HOSTS = db.0.knoe.dev,db.knoe.org
PROTECTED_GIT_HOSTS = git.knoe.dev,git.prole.org PROTECTED_GIT_HOSTS = git.knoe.dev,git.knoe.org
REGISTRY_NAMESPACE = knoe-system REGISTRY_NAMESPACE = knoe-system
SERVICE_NAMESPACE = knoe-system SERVICE_NAMESPACE = knoe-system
SUPABASE_PV_BASE = /synology/d005 SUPABASE_PV_BASE = /synology/d005
SUPABASE_PV_BASE_DIR = /synology/d005 SUPABASE_PV_BASE_DIR = /synology/d005
SUPABASE_PV_NODE = gandalf.prole.org SUPABASE_PV_NODE = gandalf.knoe.org
SUPABASE_STUDIO_HOSTNAME = db.0.knoe.dev,db.prole.org SUPABASE_STUDIO_HOSTNAME = db.0.knoe.dev,db.knoe.org
[Welcome] [Welcome]
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
@ -132,13 +132,13 @@ SUPABASE_STUDIO_HOSTNAME = db.0.knoe.dev,db.prole.org
STATUS = All installed STATUS = All installed
[Network] [Network]
AD_DC_HOST = myrddin.prole.org AD_DC_HOST = myrddin.knoe.org
AD_DC_IP = 10.0.0.3 AD_DC_IP = 10.0.0.3
ANSIBLE_DOMAIN = prole.org ANSIBLE_DOMAIN = knoe.org
ANSIBLE_INFRASTRUCTURE = $HOME/dev/prole/infrastructure ANSIBLE_INFRASTRUCTURE = $HOME/dev/knoe/infrastructure
ANSIBLE_INVENTORY = $HOME/dev/prole/infrastructure/inventory ANSIBLE_INVENTORY = $HOME/dev/knoe/infrastructure/inventory
ANSIBLE_REALM = PROLE.ORG ANSIBLE_REALM = PROLE.ORG
ANSIBLE_TOPOLOGY = {"domain":"prole.org","realm":"PROLE.ORG","internal_records":{"aventage.prole.org":"10.0.0.206","fairyland.prole.org":"10.0.0.208","loghost.prole.org":"10.0.0.3","merlin.prole.org":"10.0.0.6","morana.prole.org":"10.0.0.66","morgoth.prole.org":"10.0.0.204","myrddin.prole.org":"10.0.0.3","pi.prole.org":"10.0.0.5","raspberry.prole.org":"10.0.0.4","retropie.prole.org":"10.0.0.207","synology.prole.org":"10.0.0.203","zinfandel.prole.org":"10.0.0.205"},"ad_dc":{"host":"myrddin.prole.org","ip":"10.0.0.3"},"k3s":{"server_url":"https://myrddin.prole.org:6443","server_host":"myrddin.prole.org","token_present":true},"groups":{"iscsi":["pi.prole.org","raspberry.prole.org","myrddin.prole.org","retropie.prole.org","merlin.prole.org","gandalf.prole.org"],"pihole":["pi.prole.org","raspberry.prole.org"],"ad_dc":["myrddin.prole.org"],"k3s_servers":["myrddin.prole.org"],"k3s_agents":["merlin.prole.org","gandalf.prole.org"],"k3s_hosts:children":["k3s_servers","k3s_agents"],"linux_hosts":["pi.prole.org","raspberry.prole.org","myrddin.prole.org","retropie.prole.org","merlin.prole.org","gandalf.prole.org"],"ssl_hosts":["myrddin.prole.org"],"mariadb_primary":["merlin.prole.org"],"mariadb_replica":["raspberry.prole.org"],"mariadb:children":["mariadb_primary","mariadb_replica"],"merlin_bootstrap":["merlin"],"k3s_hosts":["gandalf.prole.org"]},"hosts":{"merlin":"10.0.0.6","merlin.prole.org":"10.0.0.6","myrddin.prole.org":"10.0.0.3","pi.prole.org":"10.0.0.5","raspberry.prole.org":"10.0.0.4","retropie.prole.org":"10.0.0.207"},"unmapped_hosts":["gandalf.prole.org","k3s_agents","k3s_servers","mariadb_primary","mariadb_replica"]} ANSIBLE_TOPOLOGY = {"domain":"knoe.org","realm":"PROLE.ORG","internal_records":{"aventage.knoe.org":"10.0.0.206","fairyland.knoe.org":"10.0.0.208","loghost.knoe.org":"10.0.0.3","merlin.knoe.org":"10.0.0.6","morana.knoe.org":"10.0.0.66","morgoth.knoe.org":"10.0.0.204","myrddin.knoe.org":"10.0.0.3","pi.knoe.org":"10.0.0.5","raspberry.knoe.org":"10.0.0.4","retropie.knoe.org":"10.0.0.207","synology.knoe.org":"10.0.0.203","zinfandel.knoe.org":"10.0.0.205"},"ad_dc":{"host":"myrddin.knoe.org","ip":"10.0.0.3"},"k3s":{"server_url":"https://myrddin.knoe.org:6443","server_host":"myrddin.knoe.org","token_present":true},"groups":{"iscsi":["pi.knoe.org","raspberry.knoe.org","myrddin.knoe.org","retropie.knoe.org","merlin.knoe.org","gandalf.knoe.org"],"pihole":["pi.knoe.org","raspberry.knoe.org"],"ad_dc":["myrddin.knoe.org"],"k3s_servers":["myrddin.knoe.org"],"k3s_agents":["merlin.knoe.org","gandalf.knoe.org"],"k3s_hosts:children":["k3s_servers","k3s_agents"],"linux_hosts":["pi.knoe.org","raspberry.knoe.org","myrddin.knoe.org","retropie.knoe.org","merlin.knoe.org","gandalf.knoe.org"],"ssl_hosts":["myrddin.knoe.org"],"mariadb_primary":["merlin.knoe.org"],"mariadb_replica":["raspberry.knoe.org"],"mariadb:children":["mariadb_primary","mariadb_replica"],"merlin_bootstrap":["merlin"],"k3s_hosts":["gandalf.knoe.org"]},"hosts":{"merlin":"10.0.0.6","merlin.knoe.org":"10.0.0.6","myrddin.knoe.org":"10.0.0.3","pi.knoe.org":"10.0.0.5","raspberry.knoe.org":"10.0.0.4","retropie.knoe.org":"10.0.0.207"},"unmapped_hosts":["gandalf.knoe.org","k3s_agents","k3s_servers","mariadb_primary","mariadb_replica"]}
KDC_ANSIBLE_DETECTED = 10.0.0.3 KDC_ANSIBLE_DETECTED = 10.0.0.3
KDC_AUTO_DETECTED = 10.0.0.3 KDC_AUTO_DETECTED = 10.0.0.3
KERBEROS_AUTO_ENABLED = True KERBEROS_AUTO_ENABLED = True
@ -147,11 +147,11 @@ KERBEROS_AUTO_ENABLED = True
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
[System Environment] [System Environment]
PROLE_CONF = $HOME/dev/prole/conf KNOE_CONF = $HOME/dev/knoe/conf
PROLE_DATA = $HOME/dev/prole/data PROLE_DATA = $HOME/dev/knoe/data
PROLE_HOME = $HOME/dev/prole KNOE_HOME = $HOME/dev/knoe
PROLE_LOGS = $HOME/dev/prole/logs PROLE_LOGS = $HOME/dev/knoe/logs
PROLE_SERVICE = $HOME/dev/prole/etc KNOE_SERVICE = $HOME/dev/knoe/etc
[Monitoring] [Monitoring]
MONITORING_STORAGE_CLASS = local-path MONITORING_STORAGE_CLASS = local-path
@ -160,7 +160,7 @@ MONITORING_STORAGE_CLASS = local-path
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
[Ollama] [Ollama]
OLLAMA_SERVERS = 10.0.0.208:11434,fairyland.prole.org:11434,k3d.localhost:11434,morgoth.prole.org:11434 OLLAMA_SERVERS = 10.0.0.208:11434,fairyland.knoe.org:11434,k3d.localhost:11434,morgoth.knoe.org:11434
[Optional Features] [Optional Features]
AT_REST_ENCRYPTION_ENABLED = true AT_REST_ENCRYPTION_ENABLED = true
@ -179,8 +179,8 @@ DB_USER = root
[Initialize Cluster] [Initialize Cluster]
ENVIRONMENT = dev ENVIRONMENT = dev
K3S_SERVER_URL = https://myrddin.prole.org:6443 K3S_SERVER_URL = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:ozzcomisjsQYIkSH:Ytp91WR_iP4tJyTAmdH_SRhcKycgzea0zLAgTBNxDsQaBPM-pR_VK3u9wc5QkFzszdAHZGBhVN2HKyqnz-cqDR0WAus88DFbF4zWlgvl6gKEAynaXbdMwAa6vYLUGi8ZE0u1pRiO4KJyiulhBIpfoMReM1Wu6Mj1-20hXw==} K3S_TOKEN = ${KNOE_SECRET:v1:ozzcomisjsQYIkSH:Ytp91WR_iP4tJyTAmdH_SRhcKycgzea0zLAgTBNxDsQaBPM-pR_VK3u9wc5QkFzszdAHZGBhVN2HKyqnz-cqDR0WAus88DFbF4zWlgvl6gKEAynaXbdMwAa6vYLUGi8ZE0u1pRiO4KJyiulhBIpfoMReM1Wu6Mj1-20hXw==}
[Dev Cluster (k3d)] [Dev Cluster (k3d)]
CLUSTER_ENV = dev CLUSTER_ENV = dev
@ -189,10 +189,10 @@ KUBECTL_CONTEXT = dev
MODE = k3d MODE = k3d
[Service Cluster (k3s)] [Service Cluster (k3s)]
CLUSTER_ENV = prole-service-cluster CLUSTER_ENV = knoe-service-cluster
DISPLAY_NAME = prole-service-cluster DISPLAY_NAME = knoe-service-cluster
K3S_SERVER_URL = https://myrddin.prole.org:6443 K3S_SERVER_URL = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==} K3S_TOKEN = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==}
MODE = k3s MODE = k3s
[GCP] [GCP]
@ -202,21 +202,21 @@ ORG_ID = 584001916389
PROJECT_ID = plenary-truck-485623-p7 PROJECT_ID = plenary-truck-485623-p7
[Prod Cluster (k8s)] [Prod Cluster (k8s)]
ARTIFACTS_DIR = $HOME/dev/prole/data/staging ARTIFACTS_DIR = $HOME/dev/knoe/data/staging
CLUSTER_ENV = prole-prod-cluster CLUSTER_ENV = knoe-prod-cluster
DISPLAY_NAME = prole-prod-cluster DISPLAY_NAME = knoe-prod-cluster
MODE = k8s MODE = k8s
[Docker Build] [Docker Build]
LOCAL_REGISTRY = localhost:5000 LOCAL_REGISTRY = localhost:5000
LOCAL_REGISTRY_INTERNAL = k3d-prole-registry.localhost:5000 LOCAL_REGISTRY_INTERNAL = k3d-knoe-registry.localhost:5000
[Initialization Scripts] [Initialization Scripts]
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
[Deployment] [Deployment]
MODE = k3d MODE = k3d
TARGET = prole-dev-cluster TARGET = knoe-dev-cluster
[Install] [Install]
STATUS = Failed STATUS = Failed

108
conf/k3s.cfg
View File

@ -1,4 +1,4 @@
; Prole Master Configuration File ; Knoe Master Configuration File
; Generated by install.py on 2026-04-17 00:35:15 ; Generated by install.py on 2026-04-17 00:35:15
; This file is used as input for Ansible deployment and k8s cluster creation. ; This file is used as input for Ansible deployment and k8s cluster creation.
@ -40,7 +40,7 @@ dependencies.opentofu.install = true
dependencies.python.install = true dependencies.python.install = true
dependencies.verify_all = false dependencies.verify_all = false
disk_selection.disk_type = local disk_selection.disk_type = local
disk_selection.local_path = /Users/chrisfu/dev/prole/prole-tools-app/dist disk_selection.local_path = /Users/chrisfu/dev/knoe/knoe-tools-app/dist
disk_selection.removable_mount = disk_selection.removable_mount =
env_setup.APP_CLUSTER_KUBECONTEXT = env_setup.APP_CLUSTER_KUBECONTEXT =
env_setup.APP_CLUSTER_MODE = standard env_setup.APP_CLUSTER_MODE = standard
@ -50,11 +50,11 @@ env_setup.DATABASE_NAMESPACE = ${DATABASE_NAMESPACE}
env_setup.DB_CLUSTER_KUBECONTEXT = env_setup.DB_CLUSTER_KUBECONTEXT =
env_setup.DB_CLUSTER_MODE = standard env_setup.DB_CLUSTER_MODE = standard
env_setup.DB_CLUSTER_NAME = knoe-cnpg-0 env_setup.DB_CLUSTER_NAME = knoe-cnpg-0
env_setup.PROLE_CONF = /Users/chrisfu/dev/prole/conf env_setup.KNOE_CONF = /Users/chrisfu/dev/knoe/conf
env_setup.PROLE_DATA = /Users/chrisfu/dev/prole/data env_setup.PROLE_DATA = /Users/chrisfu/dev/knoe/data
env_setup.PROLE_HOME = /Users/chrisfu/dev/prole env_setup.KNOE_HOME = /Users/chrisfu/dev/knoe
env_setup.PROLE_LOGS = /Users/chrisfu/dev/prole/logs env_setup.PROLE_LOGS = /Users/chrisfu/dev/knoe/logs
env_setup.PROLE_SERVICE = /Users/chrisfu/dev/prole/etc env_setup.KNOE_SERVICE = /Users/chrisfu/dev/knoe/etc
gitops.git_provider = Gitea gitops.git_provider = Gitea
gitops.node_selector = gitops.node_selector =
init_cluster.app_cluster_kubecontext = init_cluster.app_cluster_kubecontext =
@ -74,10 +74,10 @@ init_cluster.db_cluster_name = knoe-cnpg-0
init_cluster.db_cluster_node_count = 3 init_cluster.db_cluster_node_count = 3
init_cluster.db_cluster_region = init_cluster.db_cluster_region =
init_cluster.db_cluster_zones = init_cluster.db_cluster_zones =
init_cluster.deployment_target = prole-service-cluster init_cluster.deployment_target = knoe-service-cluster
init_cluster.gitops_enabled = true init_cluster.gitops_enabled = true
init_cluster.k3s_server_url = https://myrddin.prole.org:6443 init_cluster.k3s_server_url = https://myrddin.knoe.org:6443
init_cluster.k3s_token = ${PROLE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==} init_cluster.k3s_token = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==}
init_cluster.kerberos_enabled = true init_cluster.kerberos_enabled = true
init_cluster.mode = k3s init_cluster.mode = k3s
init_cluster.start_cluster = true init_cluster.start_cluster = true
@ -96,8 +96,8 @@ init_password.cluster_name = ${CLUSTER_NAME}
init_password.db_cluster_name = knoe-cnpg-0 init_password.db_cluster_name = knoe-cnpg-0
init_password.db_host_port = 5432 init_password.db_host_port = 5432
init_password.db_namespace = ${DATABASE_NAMESPACE} init_password.db_namespace = ${DATABASE_NAMESPACE}
init_password.db_password = ${PROLE_SECRET:v1:CsdBnE_l6fe36We6:QO1ZEnnsfovmzFHFfEtPwvi2FPKzLxu0pmg0K3X3DSTIt-Fx} init_password.db_password = ${KNOE_SECRET:v1:CsdBnE_l6fe36We6:QO1ZEnnsfovmzFHFfEtPwvi2FPKzLxu0pmg0K3X3DSTIt-Fx}
init_password.db_password_confirm = ${PROLE_SECRET:v1:CsdBnE_l6fe36We6:QO1ZEnnsfovmzFHFfEtPwvi2FPKzLxu0pmg0K3X3DSTIt-Fx} init_password.db_password_confirm = ${KNOE_SECRET:v1:CsdBnE_l6fe36We6:QO1ZEnnsfovmzFHFfEtPwvi2FPKzLxu0pmg0K3X3DSTIt-Fx}
init_password.db_username = root init_password.db_username = root
init_password.generate_ssh_key = true init_password.generate_ssh_key = true
init_scripts.run_scripts = true init_scripts.run_scripts = true
@ -113,55 +113,55 @@ ollama_config.model =
ollama_config.server_host = ollama_config.server_host =
ollama_config.server_port = 11434 ollama_config.server_port = 11434
supabase_config.pv_base_dir = /synology/d005 supabase_config.pv_base_dir = /synology/d005
supabase_config.pv_node = gandalf.prole.org supabase_config.pv_node = gandalf.knoe.org
[Global] [Global]
; Variables used by name in more than one place or assumed global scope ; Variables used by name in more than one place or assumed global scope
ARGOCD_NAMESPACE = argocd ARGOCD_NAMESPACE = argocd
ARTIFACT_REGISTRY = us-west3-docker.pkg.dev/plenary-truck-485623-p7/knoe-system ARTIFACT_REGISTRY = us-west3-docker.pkg.dev/plenary-truck-485623-p7/knoe-system
AUTHORITY_ENABLED = true AUTHORITY_ENABLED = true
AUTH_HOSTNAME = api.prole.org AUTH_HOSTNAME = api.knoe.org
AUTH_LOGIN_PATH = /auth/login AUTH_LOGIN_PATH = /auth/login
AUTH_RESPONSE_HEADERS = X-Prole-User,X-Prole-Email,X-Prole-Groups AUTH_RESPONSE_HEADERS = X-Knoe-User,X-Knoe-Email,X-Knoe-Groups
AUTH_VERIFY_PATH = /auth/verify AUTH_VERIFY_PATH = /auth/verify
CLUSTER_ENV = service CLUSTER_ENV = service
CLUSTER_NAME = knoe-db CLUSTER_NAME = knoe-db
CNPG_ELIGIBLE_NODES = gandalf.prole.org,merlin.prole.org,myrddin.prole.org CNPG_ELIGIBLE_NODES = gandalf.knoe.org,merlin.knoe.org,myrddin.knoe.org
CNPG_PLACEMENT_PLAN_FILE = $HOME/dev/prole/conf/cnpg-placement/knoe-system-knoe-db.json CNPG_PLACEMENT_PLAN_FILE = $HOME/dev/knoe/conf/cnpg-placement/knoe-system-knoe-db.json
CNPG_PLACEMENT_PLAN_HASH = 962fb2e7bfd2a48b CNPG_PLACEMENT_PLAN_HASH = 962fb2e7bfd2a48b
CNPG_PLACEMENT_PLAN_ID = cnpg-placement-962fb2e7bfd2a48b CNPG_PLACEMENT_PLAN_ID = cnpg-placement-962fb2e7bfd2a48b
CNPG_STAGE1_NODE = gandalf.prole.org CNPG_STAGE1_NODE = gandalf.knoe.org
DATABASE_NAMESPACE = knoe-db DATABASE_NAMESPACE = knoe-db
DB_HOST_PORT = 5432 DB_HOST_PORT = 5432
DB_PASSWORD = ${PROLE_SECRET:v1:Vc5Sow_MQksbOtOJ:bvD1ABxenFlo0304dhf0Me_nzBX0SvLJ7oFvE_TkHGqc0YF8} DB_PASSWORD = ${KNOE_SECRET:v1:Vc5Sow_MQksbOtOJ:bvD1ABxenFlo0304dhf0Me_nzBX0SvLJ7oFvE_TkHGqc0YF8}
DEPLOYMENT_MODE = k3s DEPLOYMENT_MODE = k3s
DEPLOYMENT_TARGET = prole-service-cluster DEPLOYMENT_TARGET = knoe-service-cluster
DOCKER_IMPORT_DIR = DOCKER_IMPORT_DIR =
DOCKER_PRELOAD = false DOCKER_PRELOAD = false
GITEA_HOSTNAME = git-internal.prole.org GITEA_HOSTNAME = git-internal.knoe.org
GITLAB_PUBLIC_HOSTS = git.prole.org GITLAB_PUBLIC_HOSTS = git.knoe.org
GITLAB_REPAIR_BLOCKED_AUTOCLEAN = 1 GITLAB_REPAIR_BLOCKED_AUTOCLEAN = 1
K3S_SERVER = https://myrddin.prole.org:6443 K3S_SERVER = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:CWWf3RHFdbUrmfrY:It8a2G8QUUIsqVwMsm3LsI4UvSSChEc_uAdESwzYplZLOCiSsCbOKuT9FbPpIwQvEaG_gLz9ZAfkD0EQxJp81KAtpk_X3K_nxVUa0RPRlbt_wdeXXoMoFFpN5BqXXz2HZwKgh_gpK1hjVbsJQHKAbTqWfu8u_LTmYYg4ag==} K3S_TOKEN = ${KNOE_SECRET:v1:CWWf3RHFdbUrmfrY:It8a2G8QUUIsqVwMsm3LsI4UvSSChEc_uAdESwzYplZLOCiSsCbOKuT9FbPpIwQvEaG_gLz9ZAfkD0EQxJp81KAtpk_X3K_nxVUa0RPRlbt_wdeXXoMoFFpN5BqXXz2HZwKgh_gpK1hjVbsJQHKAbTqWfu8u_LTmYYg4ag==}
KNOE_DB_USER = root KNOE_DB_USER = root
KNOE_IMAGE_REGISTRY = registry.prole.org KNOE_IMAGE_REGISTRY = registry.knoe.org
MONITORING_STORAGE_CLASS = local-path MONITORING_STORAGE_CLASS = local-path
OPENTOFU_URL = http://127.0.0.1:8080 OPENTOFU_URL = http://127.0.0.1:8080
OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2 OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2
PROLE_HOME = $HOME/dev/prole KNOE_HOME = $HOME/dev/knoe
PROLE_K3S_SERVER = https://myrddin.prole.org:6443 PROLE_K3S_SERVER = https://myrddin.knoe.org:6443
PROLE_K3S_TOKEN = ${PROLE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==} PROLE_K3S_TOKEN = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==}
PROTECTED_DB_HOSTS = db.prole.org PROTECTED_DB_HOSTS = db.knoe.org
PROTECTED_GIT_HOSTS = git.prole.org PROTECTED_GIT_HOSTS = git.knoe.org
REDIS_HOST = redis-master.knoe-system.svc.cluster.local REDIS_HOST = redis-master.knoe-system.svc.cluster.local
REGISTRY_NAMESPACE = knoe-system REGISTRY_NAMESPACE = knoe-system
SERVICE_HOSTNAME = svc.prole.org SERVICE_HOSTNAME = svc.knoe.org
SERVICE_NAMESPACE = knoe-system SERVICE_NAMESPACE = knoe-system
SUPABASE_API_HOSTNAME = supabase.prole.org SUPABASE_API_HOSTNAME = supabase.knoe.org
SUPABASE_PV_BASE = /synology/d005 SUPABASE_PV_BASE = /synology/d005
SUPABASE_PV_BASE_DIR = /synology/d005 SUPABASE_PV_BASE_DIR = /synology/d005
SUPABASE_PV_NODE = gandalf.prole.org SUPABASE_PV_NODE = gandalf.knoe.org
SUPABASE_STUDIO_HOSTNAME = db.prole.org SUPABASE_STUDIO_HOSTNAME = db.knoe.org
SYNOLOGY_ROOTS = /synology/d001,/synology/d002,/synology/d004,/synology/d005 SYNOLOGY_ROOTS = /synology/d001,/synology/d002,/synology/d004,/synology/d005
[Welcome] [Welcome]
@ -171,13 +171,13 @@ SYNOLOGY_ROOTS = /synology/d001,/synology/d002,/synology/d004,/synology/d005
STATUS = All installed STATUS = All installed
[Network] [Network]
AD_DC_HOST = myrddin.prole.org AD_DC_HOST = myrddin.knoe.org
AD_DC_IP = 10.0.0.3 AD_DC_IP = 10.0.0.3
ANSIBLE_DOMAIN = prole.org ANSIBLE_DOMAIN = knoe.org
ANSIBLE_INFRASTRUCTURE = $HOME/dev/prole/infrastructure ANSIBLE_INFRASTRUCTURE = $HOME/dev/knoe/infrastructure
ANSIBLE_INVENTORY = $HOME/dev/prole/infrastructure/inventory ANSIBLE_INVENTORY = $HOME/dev/knoe/infrastructure/inventory
ANSIBLE_REALM = PROLE.ORG ANSIBLE_REALM = PROLE.ORG
ANSIBLE_TOPOLOGY = {"domain":"prole.org","realm":"PROLE.ORG","internal_records":{"aventage.prole.org":"10.0.0.206","fairyland.prole.org":"10.0.0.208","loghost.prole.org":"10.0.0.3","merlin.prole.org":"10.0.0.6","morana.prole.org":"10.0.0.66","morgoth.prole.org":"10.0.0.204","myrddin.prole.org":"10.0.0.3","pi.prole.org":"10.0.0.5","raspberry.prole.org":"10.0.0.4","retropie.prole.org":"10.0.0.207","synology.prole.org":"10.0.0.203","zinfandel.prole.org":"10.0.0.205"},"ad_dc":{"host":"myrddin.prole.org","ip":"10.0.0.3"},"k3s":{"server_url":"https://myrddin.prole.org:6443","server_host":"myrddin.prole.org","token_present":true},"groups":{"iscsi":["pi.prole.org","raspberry.prole.org","myrddin.prole.org","retropie.prole.org","merlin.prole.org","gandalf.prole.org"],"pihole":["pi.prole.org","raspberry.prole.org"],"ad_dc":["myrddin.prole.org"],"k3s_servers":["myrddin.prole.org"],"k3s_agents":["merlin.prole.org","gandalf.prole.org"],"k3s_hosts:children":["k3s_servers","k3s_agents"],"linux_hosts":["pi.prole.org","raspberry.prole.org","myrddin.prole.org","retropie.prole.org","merlin.prole.org","gandalf.prole.org"],"ssl_hosts":["myrddin.prole.org"],"mariadb_primary":["merlin.prole.org"],"mariadb_replica":["raspberry.prole.org"],"mariadb:children":["mariadb_primary","mariadb_replica"],"merlin_bootstrap":["merlin"],"k3s_hosts":["gandalf.prole.org"]},"hosts":{"merlin":"10.0.0.6","merlin.prole.org":"10.0.0.6","myrddin.prole.org":"10.0.0.3","pi.prole.org":"10.0.0.5","raspberry.prole.org":"10.0.0.4","retropie.prole.org":"10.0.0.207"},"unmapped_hosts":["gandalf.prole.org","k3s_agents","k3s_servers","mariadb_primary","mariadb_replica"]} ANSIBLE_TOPOLOGY = {"domain":"knoe.org","realm":"PROLE.ORG","internal_records":{"aventage.knoe.org":"10.0.0.206","fairyland.knoe.org":"10.0.0.208","loghost.knoe.org":"10.0.0.3","merlin.knoe.org":"10.0.0.6","morana.knoe.org":"10.0.0.66","morgoth.knoe.org":"10.0.0.204","myrddin.knoe.org":"10.0.0.3","pi.knoe.org":"10.0.0.5","raspberry.knoe.org":"10.0.0.4","retropie.knoe.org":"10.0.0.207","synology.knoe.org":"10.0.0.203","zinfandel.knoe.org":"10.0.0.205"},"ad_dc":{"host":"myrddin.knoe.org","ip":"10.0.0.3"},"k3s":{"server_url":"https://myrddin.knoe.org:6443","server_host":"myrddin.knoe.org","token_present":true},"groups":{"iscsi":["pi.knoe.org","raspberry.knoe.org","myrddin.knoe.org","retropie.knoe.org","merlin.knoe.org","gandalf.knoe.org"],"pihole":["pi.knoe.org","raspberry.knoe.org"],"ad_dc":["myrddin.knoe.org"],"k3s_servers":["myrddin.knoe.org"],"k3s_agents":["merlin.knoe.org","gandalf.knoe.org"],"k3s_hosts:children":["k3s_servers","k3s_agents"],"linux_hosts":["pi.knoe.org","raspberry.knoe.org","myrddin.knoe.org","retropie.knoe.org","merlin.knoe.org","gandalf.knoe.org"],"ssl_hosts":["myrddin.knoe.org"],"mariadb_primary":["merlin.knoe.org"],"mariadb_replica":["raspberry.knoe.org"],"mariadb:children":["mariadb_primary","mariadb_replica"],"merlin_bootstrap":["merlin"],"k3s_hosts":["gandalf.knoe.org"]},"hosts":{"merlin":"10.0.0.6","merlin.knoe.org":"10.0.0.6","myrddin.knoe.org":"10.0.0.3","pi.knoe.org":"10.0.0.5","raspberry.knoe.org":"10.0.0.4","retropie.knoe.org":"10.0.0.207"},"unmapped_hosts":["gandalf.knoe.org","k3s_agents","k3s_servers","mariadb_primary","mariadb_replica"]}
KDC_ANSIBLE_DETECTED = 10.0.0.3 KDC_ANSIBLE_DETECTED = 10.0.0.3
KDC_AUTO_DETECTED = 10.0.0.3 KDC_AUTO_DETECTED = 10.0.0.3
KERBEROS_AUTO_ENABLED = True KERBEROS_AUTO_ENABLED = True
@ -195,11 +195,11 @@ PORT_FORWARD_K3S_MAPPING_8 = id=grafana;namespace=monitoring;target=svc/kps-graf
PORT_FORWARD_K3S_MAPPING_9 = id=gitea-http;namespace=gitea;target=svc/gitea-http;address=0.0.0.0;hostPort=13000;servicePort=3000;protocol=TCP;description=Gitea Web PORT_FORWARD_K3S_MAPPING_9 = id=gitea-http;namespace=gitea;target=svc/gitea-http;address=0.0.0.0;hostPort=13000;servicePort=3000;protocol=TCP;description=Gitea Web
[System Environment] [System Environment]
PROLE_CONF = $HOME/dev/prole/conf KNOE_CONF = $HOME/dev/knoe/conf
PROLE_DATA = $HOME/dev/prole/data PROLE_DATA = $HOME/dev/knoe/data
PROLE_HOME = $HOME/dev/prole KNOE_HOME = $HOME/dev/knoe
PROLE_LOGS = $HOME/dev/prole/logs PROLE_LOGS = $HOME/dev/knoe/logs
PROLE_SERVICE = $HOME/dev/prole/etc KNOE_SERVICE = $HOME/dev/knoe/etc
[Monitoring] [Monitoring]
MONITORING_STORAGE_CLASS = local-path MONITORING_STORAGE_CLASS = local-path
@ -226,8 +226,8 @@ DB_USER = root
[Initialize Cluster] [Initialize Cluster]
ENVIRONMENT = service ENVIRONMENT = service
K3S_SERVER_URL = https://myrddin.prole.org:6443 K3S_SERVER_URL = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==} K3S_TOKEN = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==}
[Dev Cluster (k3d)] [Dev Cluster (k3d)]
CLUSTER_ENV = k3d-knoe-dev-cluster CLUSTER_ENV = k3d-knoe-dev-cluster
@ -236,11 +236,11 @@ KUBECTL_CONTEXT = service
MODE = k3d MODE = k3d
[Service Cluster (k3s)] [Service Cluster (k3s)]
CLUSTER_ENV = prole-service-cluster CLUSTER_ENV = knoe-service-cluster
DISPLAY_NAME = prole-service-cluster DISPLAY_NAME = knoe-service-cluster
K3S_SERVER_URL = https://myrddin.prole.org:6443 K3S_SERVER_URL = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==} K3S_TOKEN = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==}
KUBECTL_CONTEXT = prole-service-cluster KUBECTL_CONTEXT = knoe-service-cluster
MODE = k3s MODE = k3s
PIPELINE_URL = http://127.0.0.1:8080 PIPELINE_URL = http://127.0.0.1:8080
@ -249,8 +249,8 @@ PIPELINE_URL = http://127.0.0.1:8080
[Prod Cluster (k8s)] [Prod Cluster (k8s)]
ARTIFACTS_DIR = ARTIFACTS_DIR =
CLUSTER_ENV = prole-prod-cluster CLUSTER_ENV = knoe-prod-cluster
DISPLAY_NAME = prole-prod-cluster DISPLAY_NAME = knoe-prod-cluster
MODE = k8s MODE = k8s
PIPELINE_URL = http://127.0.0.1:8080 PIPELINE_URL = http://127.0.0.1:8080
@ -262,7 +262,7 @@ PIPELINE_URL = http://127.0.0.1:8080
[Deployment] [Deployment]
MODE = k3d MODE = k3d
TARGET = prole-dev-cluster TARGET = knoe-dev-cluster
[Install] [Install]
STATUS = Failed STATUS = Failed

118
conf/prole.silent.all.cfg → conf/knoe.silent.all.cfg
View File

@ -1,4 +1,4 @@
; Prole Master Configuration File ; Knoe Master Configuration File
; Generated by install.py on 2026-04-02 23:44:38 ; Generated by install.py on 2026-04-02 23:44:38
; This file is used as input for Ansible deployment and k8s cluster creation. ; This file is used as input for Ansible deployment and k8s cluster creation.
@ -8,7 +8,7 @@
[Inputs] [Inputs]
; Screen-scoped inputs used for unattended replays (-S) ; Screen-scoped inputs used for unattended replays (-S)
argocd.node_selector = gandalf.prole.org argocd.node_selector = gandalf.knoe.org
build.deploy_env = Dev build.deploy_env = Dev
build.run_build = false build.run_build = false
database_options.distribution = percona database_options.distribution = percona
@ -39,24 +39,24 @@ dependencies.opentofu.install = true
dependencies.python.install = true dependencies.python.install = true
dependencies.verify_all = false dependencies.verify_all = false
disk_selection.disk_type = local disk_selection.disk_type = local
disk_selection.local_path = /Users/chrisfu/dev/prole/prole-tools-app/dist disk_selection.local_path = /Users/chrisfu/dev/knoe/knoe-tools-app/dist
disk_selection.removable_mount = disk_selection.removable_mount =
env_setup.CLUSTER_NAME = ${CLUSTER_NAME} env_setup.CLUSTER_NAME = ${CLUSTER_NAME}
env_setup.DATABASE_NAMESPACE = ${DATABASE_NAMESPACE} env_setup.DATABASE_NAMESPACE = ${DATABASE_NAMESPACE}
env_setup.PROLE_CONF = /Users/chrisfu/dev/prole/conf env_setup.KNOE_CONF = /Users/chrisfu/dev/knoe/conf
env_setup.PROLE_DATA = /Users/chrisfu/dev/prole/data env_setup.PROLE_DATA = /Users/chrisfu/dev/knoe/data
env_setup.PROLE_HOME = /Users/chrisfu/dev/prole env_setup.KNOE_HOME = /Users/chrisfu/dev/knoe
env_setup.PROLE_LOGS = /Users/chrisfu/dev/prole/logs env_setup.PROLE_LOGS = /Users/chrisfu/dev/knoe/logs
env_setup.PROLE_SERVICE = /Users/chrisfu/dev/prole/etc env_setup.KNOE_SERVICE = /Users/chrisfu/dev/knoe/etc
gitops.git_provider = GitLab gitops.git_provider = GitLab
gitops.node_selector = gandalf.prole.org gitops.node_selector = gandalf.knoe.org
init_cluster.argocd_enabled = true init_cluster.argocd_enabled = true
init_cluster.at_rest_encryption_enabled = true init_cluster.at_rest_encryption_enabled = true
init_cluster.cluster_env = service init_cluster.cluster_env = service
init_cluster.deployment_target = prole-service-cluster init_cluster.deployment_target = knoe-service-cluster
init_cluster.gitops_enabled = true init_cluster.gitops_enabled = true
init_cluster.k3s_server_url = https://myrddin.prole.org:6443 init_cluster.k3s_server_url = https://myrddin.knoe.org:6443
init_cluster.k3s_token = ${PROLE_SECRET:v1:-5rud_XHzHRKoZIU:Dxv2nKbY883uDrJlmjRIqUKTtF42KPwXmzONy1s0-cIsJ2TLpTkaSWjfYx0tXNnz65lPnwIR16kXVtICYHhOxhfSIaz-lQiNGwZ_hm1tGMjp9BvpANt_l5Ie6swbOHVw8QfpGLtiXuIv7ur2ocSX4xAYSdCKtYWWV58U0Q==} init_cluster.k3s_token = ${KNOE_SECRET:v1:-5rud_XHzHRKoZIU:Dxv2nKbY883uDrJlmjRIqUKTtF42KPwXmzONy1s0-cIsJ2TLpTkaSWjfYx0tXNnz65lPnwIR16kXVtICYHhOxhfSIaz-lQiNGwZ_hm1tGMjp9BvpANt_l5Ie6swbOHVw8QfpGLtiXuIv7ur2ocSX4xAYSdCKtYWWV58U0Q==}
init_cluster.kerberos_enabled = true init_cluster.kerberos_enabled = true
init_cluster.mode = k3s init_cluster.mode = k3s
init_cluster.start_cluster = true init_cluster.start_cluster = true
@ -66,65 +66,65 @@ init_cluster.supabase_enabled = true
init_cluster.supabase_meta_enabled = true init_cluster.supabase_meta_enabled = true
init_cluster.supabase_realtime_enabled = true init_cluster.supabase_realtime_enabled = true
init_cluster.supabase_studio_enabled = false init_cluster.supabase_studio_enabled = false
init_cluster.supabase_studio_url = db.prole.org init_cluster.supabase_studio_url = db.knoe.org
init_cnpg_deploy.force_rollout = false init_cnpg_deploy.force_rollout = false
init_cnpg_deploy.run_deploy = true init_cnpg_deploy.run_deploy = true
init_db_build.run_build = true init_db_build.run_build = true
init_password.cluster_name = ${CLUSTER_NAME} init_password.cluster_name = ${CLUSTER_NAME}
init_password.db_host_port = 5432 init_password.db_host_port = 5432
init_password.db_namespace = ${DATABASE_NAMESPACE} init_password.db_namespace = ${DATABASE_NAMESPACE}
init_password.db_password = ${PROLE_SECRET:v1:TYl1mPEwJblWR-4g:PalHm2ODG8WF1ZRVeUt51erDvA0W0icX} init_password.db_password = ${KNOE_SECRET:v1:TYl1mPEwJblWR-4g:PalHm2ODG8WF1ZRVeUt51erDvA0W0icX}
init_password.db_password_confirm = ${PROLE_SECRET:v1:TYl1mPEwJblWR-4g:PalHm2ODG8WF1ZRVeUt51erDvA0W0icX} init_password.db_password_confirm = ${KNOE_SECRET:v1:TYl1mPEwJblWR-4g:PalHm2ODG8WF1ZRVeUt51erDvA0W0icX}
init_password.db_username = root init_password.db_username = root
init_password.generate_ssh_key = true init_password.generate_ssh_key = true
init_scripts.run_scripts = true init_scripts.run_scripts = true
kerberos_config.enabled = true kerberos_config.enabled = true
kerberos_config.init_authority = false kerberos_config.init_authority = false
kerberos_config.kdc = 10.0.0.3 kerberos_config.kdc = 10.0.0.3
kerberos_config.password = ${PROLE_SECRET:v1:U-EPMl7qv4heEB1k:BEcXGbI_LT4lCXwBuvFEGgPbLFa9MpVzECObdH0pbLtClDHf} kerberos_config.password = ${KNOE_SECRET:v1:U-EPMl7qv4heEB1k:BEcXGbI_LT4lCXwBuvFEGgPbLFa9MpVzECObdH0pbLtClDHf}
kerberos_config.realm = PROLE.ORG kerberos_config.realm = PROLE.ORG
kerberos_config.test_connection = true kerberos_config.test_connection = true
kerberos_config.user = administrator kerberos_config.user = administrator
network_scan.run = true network_scan.run = true
ollama_config.model = ollama_config.model =
ollama_config.server_host = fairyland.prole.org ollama_config.server_host = fairyland.knoe.org
ollama_config.server_port = 11434 ollama_config.server_port = 11434
supabase_config.pv_base_dir = /synology/d005 supabase_config.pv_base_dir = /synology/d005
supabase_config.pv_node = gandalf.prole.org supabase_config.pv_node = gandalf.knoe.org
[Global] [Global]
; Variables used by name in more than one place or assumed global scope ; Variables used by name in more than one place or assumed global scope
ARGOCD_NAMESPACE = argocd ARGOCD_NAMESPACE = argocd
ARGOCD_NODE_SELECTOR = gandalf.prole.org ARGOCD_NODE_SELECTOR = gandalf.knoe.org
CLUSTER_ENV = service CLUSTER_ENV = service
CLUSTER_NAME = knoe-db CLUSTER_NAME = knoe-db
CNPG_ELIGIBLE_NODES = gandalf.prole.org,merlin.prole.org,myrddin.prole.org CNPG_ELIGIBLE_NODES = gandalf.knoe.org,merlin.knoe.org,myrddin.knoe.org
CNPG_PLACEMENT_PLAN_FILE = /Users/chrisfu/dev/prole/conf/cnpg-placement/knoe-system-knoe-db.json CNPG_PLACEMENT_PLAN_FILE = /Users/chrisfu/dev/knoe/conf/cnpg-placement/knoe-system-knoe-db.json
CNPG_PLACEMENT_PLAN_HASH = 962fb2e7bfd2a48b CNPG_PLACEMENT_PLAN_HASH = 962fb2e7bfd2a48b
CNPG_PLACEMENT_PLAN_ID = cnpg-placement-962fb2e7bfd2a48b CNPG_PLACEMENT_PLAN_ID = cnpg-placement-962fb2e7bfd2a48b
CNPG_STAGE1_NODE = gandalf.prole.org CNPG_STAGE1_NODE = gandalf.knoe.org
DATABASE_NAMESPACE = knoe-db DATABASE_NAMESPACE = knoe-db
DB_HOST_PORT = 5432 DB_HOST_PORT = 5432
DB_PASSWORD = ${PROLE_SECRET:v1:t7NgRHfXTXH-mHcx:CRbKP9b6ccuxrTMMeJ742Q48_vegoUY4} DB_PASSWORD = ${KNOE_SECRET:v1:t7NgRHfXTXH-mHcx:CRbKP9b6ccuxrTMMeJ742Q48_vegoUY4}
DEPLOYMENT_MODE = k3s DEPLOYMENT_MODE = k3s
DEPLOYMENT_TARGET = prole-service-cluster DEPLOYMENT_TARGET = knoe-service-cluster
DOCKER_IMPORT_DIR = DOCKER_IMPORT_DIR =
DOCKER_PRELOAD = false DOCKER_PRELOAD = false
GITEA_NODE_SELECTOR = gandalf.prole.org GITEA_NODE_SELECTOR = gandalf.knoe.org
K3S_SERVER = https://myrddin.prole.org:6443 K3S_SERVER = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:gnQjvO_dhM7qkU_g:kFb7E6IQ40RM64JfsrJWBPzkJsMaLXNpNPxfho6t8w5KAeWCAyrw2bMsQtJ8n7cPc_SLWh_zX53Sa1pvEOclmd79e-c_Qff0gZleba1PzzfkjsYRfVlpzQ34gdAHrNHQG2mKnpkcyrNFZ0j6J-w4c3m_m6bTN1cV1KQvMQ==} K3S_TOKEN = ${KNOE_SECRET:v1:gnQjvO_dhM7qkU_g:kFb7E6IQ40RM64JfsrJWBPzkJsMaLXNpNPxfho6t8w5KAeWCAyrw2bMsQtJ8n7cPc_SLWh_zX53Sa1pvEOclmd79e-c_Qff0gZleba1PzzfkjsYRfVlpzQ34gdAHrNHQG2mKnpkcyrNFZ0j6J-w4c3m_m6bTN1cV1KQvMQ==}
KNOE_DB_USER = root KNOE_DB_USER = root
KUBECONTEXT = knoe.dev.prole.org KUBECONTEXT = knoe.dev.knoe.org
OPENTOFU_URL = http://myrddin.prole.org:8080 OPENTOFU_URL = http://myrddin.knoe.org:8080
OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2 OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2
PROLE_HOME = /Users/chrisfu/dev/prole KNOE_HOME = /Users/chrisfu/dev/knoe
PROLE_K3S_SERVER = https://myrddin.prole.org:6443 PROLE_K3S_SERVER = https://myrddin.knoe.org:6443
PROLE_K3S_TOKEN = ${PROLE_SECRET:v1:-5rud_XHzHRKoZIU:Dxv2nKbY883uDrJlmjRIqUKTtF42KPwXmzONy1s0-cIsJ2TLpTkaSWjfYx0tXNnz65lPnwIR16kXVtICYHhOxhfSIaz-lQiNGwZ_hm1tGMjp9BvpANt_l5Ie6swbOHVw8QfpGLtiXuIv7ur2ocSX4xAYSdCKtYWWV58U0Q==} PROLE_K3S_TOKEN = ${KNOE_SECRET:v1:-5rud_XHzHRKoZIU:Dxv2nKbY883uDrJlmjRIqUKTtF42KPwXmzONy1s0-cIsJ2TLpTkaSWjfYx0tXNnz65lPnwIR16kXVtICYHhOxhfSIaz-lQiNGwZ_hm1tGMjp9BvpANt_l5Ie6swbOHVw8QfpGLtiXuIv7ur2ocSX4xAYSdCKtYWWV58U0Q==}
REGISTRY_NAMESPACE = knoe-system REGISTRY_NAMESPACE = knoe-system
SERVICE_NAMESPACE = knoe-system SERVICE_NAMESPACE = knoe-system
SUPABASE_PV_BASE = /synology/d005 SUPABASE_PV_BASE = /synology/d005
SUPABASE_PV_BASE_DIR = /synology/d005 SUPABASE_PV_BASE_DIR = /synology/d005
SUPABASE_PV_NODE = gandalf.prole.org SUPABASE_PV_NODE = gandalf.knoe.org
SYNOLOGY_ROOTS = /synology/d001,/synology/d002,/synology/d004,/synology/d005 SYNOLOGY_ROOTS = /synology/d001,/synology/d002,/synology/d004,/synology/d005
[Welcome] [Welcome]
@ -134,13 +134,13 @@ SYNOLOGY_ROOTS = /synology/d001,/synology/d002,/synology/d004,/synology/d005
STATUS = All installed STATUS = All installed
[Network] [Network]
AD_DC_HOST = myrddin.prole.org AD_DC_HOST = myrddin.knoe.org
AD_DC_IP = 10.0.0.3 AD_DC_IP = 10.0.0.3
ANSIBLE_DOMAIN = prole.org ANSIBLE_DOMAIN = knoe.org
ANSIBLE_INFRASTRUCTURE = /Users/chrisfu/dev/prole/infrastructure ANSIBLE_INFRASTRUCTURE = /Users/chrisfu/dev/knoe/infrastructure
ANSIBLE_INVENTORY = /Users/chrisfu/dev/prole/infrastructure/inventory ANSIBLE_INVENTORY = /Users/chrisfu/dev/knoe/infrastructure/inventory
ANSIBLE_REALM = PROLE.ORG ANSIBLE_REALM = PROLE.ORG
ANSIBLE_TOPOLOGY = {"domain":"prole.org","realm":"PROLE.ORG","internal_records":{"aventage.prole.org":"10.0.0.206","fairyland.prole.org":"10.0.0.208","loghost.prole.org":"10.0.0.3","merlin.prole.org":"10.0.0.6","morana.prole.org":"10.0.0.66","morgoth.prole.org":"10.0.0.204","myrddin.prole.org":"10.0.0.3","pi.prole.org":"10.0.0.5","raspberry.prole.org":"10.0.0.4","retropie.prole.org":"10.0.0.207","synology.prole.org":"10.0.0.203","zinfandel.prole.org":"10.0.0.205"},"ad_dc":{"host":"myrddin.prole.org","ip":"10.0.0.3"},"k3s":{"server_url":"https://myrddin.prole.org:6443","server_host":"myrddin.prole.org","token_present":true},"groups":{"iscsi":["pi.prole.org","raspberry.prole.org","myrddin.prole.org","retropie.prole.org","merlin.prole.org","gandalf.prole.org"],"pihole":["pi.prole.org","raspberry.prole.org"],"ad_dc":["myrddin.prole.org"],"k3s_servers":["myrddin.prole.org"],"k3s_agents":["merlin.prole.org","gandalf.prole.org"],"k3s_hosts:children":["k3s_servers","k3s_agents"],"linux_hosts":["pi.prole.org","raspberry.prole.org","myrddin.prole.org","retropie.prole.org","merlin.prole.org","gandalf.prole.org"],"ssl_hosts":["myrddin.prole.org"],"mariadb_primary":["merlin.prole.org"],"mariadb_replica":["raspberry.prole.org"],"mariadb:children":["mariadb_primary","mariadb_replica"],"merlin_bootstrap":["merlin"],"k3s_hosts":["gandalf.prole.org"]},"hosts":{"merlin":"10.0.0.6","merlin.prole.org":"10.0.0.6","myrddin.prole.org":"10.0.0.3","pi.prole.org":"10.0.0.5","raspberry.prole.org":"10.0.0.4","retropie.prole.org":"10.0.0.207"},"unmapped_hosts":["gandalf.prole.org","k3s_agents","k3s_servers","mariadb_primary","mariadb_replica"]} ANSIBLE_TOPOLOGY = {"domain":"knoe.org","realm":"PROLE.ORG","internal_records":{"aventage.knoe.org":"10.0.0.206","fairyland.knoe.org":"10.0.0.208","loghost.knoe.org":"10.0.0.3","merlin.knoe.org":"10.0.0.6","morana.knoe.org":"10.0.0.66","morgoth.knoe.org":"10.0.0.204","myrddin.knoe.org":"10.0.0.3","pi.knoe.org":"10.0.0.5","raspberry.knoe.org":"10.0.0.4","retropie.knoe.org":"10.0.0.207","synology.knoe.org":"10.0.0.203","zinfandel.knoe.org":"10.0.0.205"},"ad_dc":{"host":"myrddin.knoe.org","ip":"10.0.0.3"},"k3s":{"server_url":"https://myrddin.knoe.org:6443","server_host":"myrddin.knoe.org","token_present":true},"groups":{"iscsi":["pi.knoe.org","raspberry.knoe.org","myrddin.knoe.org","retropie.knoe.org","merlin.knoe.org","gandalf.knoe.org"],"pihole":["pi.knoe.org","raspberry.knoe.org"],"ad_dc":["myrddin.knoe.org"],"k3s_servers":["myrddin.knoe.org"],"k3s_agents":["merlin.knoe.org","gandalf.knoe.org"],"k3s_hosts:children":["k3s_servers","k3s_agents"],"linux_hosts":["pi.knoe.org","raspberry.knoe.org","myrddin.knoe.org","retropie.knoe.org","merlin.knoe.org","gandalf.knoe.org"],"ssl_hosts":["myrddin.knoe.org"],"mariadb_primary":["merlin.knoe.org"],"mariadb_replica":["raspberry.knoe.org"],"mariadb:children":["mariadb_primary","mariadb_replica"],"merlin_bootstrap":["merlin"],"k3s_hosts":["gandalf.knoe.org"]},"hosts":{"merlin":"10.0.0.6","merlin.knoe.org":"10.0.0.6","myrddin.knoe.org":"10.0.0.3","pi.knoe.org":"10.0.0.5","raspberry.knoe.org":"10.0.0.4","retropie.knoe.org":"10.0.0.207"},"unmapped_hosts":["gandalf.knoe.org","k3s_agents","k3s_servers","mariadb_primary","mariadb_replica"]}
KDC_ANSIBLE_DETECTED = 10.0.0.3 KDC_ANSIBLE_DETECTED = 10.0.0.3
KDC_AUTO_DETECTED = 10.0.0.3 KDC_AUTO_DETECTED = 10.0.0.3
KERBEROS_AUTO_ENABLED = True KERBEROS_AUTO_ENABLED = True
@ -163,33 +163,33 @@ PORT_FORWARD_K3S_MAPPING_8 = id=grafana;namespace=monitoring;target=svc/kps-graf
PORT_FORWARD_K3S_MAPPING_9 = id=supabase-kong;namespace=supabase;target=svc/kong;address=0.0.0.0;hostPort=8000;servicePort=8000;protocol=TCP;description=Supabase API (Kong) PORT_FORWARD_K3S_MAPPING_9 = id=supabase-kong;namespace=supabase;target=svc/kong;address=0.0.0.0;hostPort=8000;servicePort=8000;protocol=TCP;description=Supabase API (Kong)
[System Environment] [System Environment]
PROLE_CONF = /Users/chrisfu/dev/prole/conf KNOE_CONF = /Users/chrisfu/dev/knoe/conf
PROLE_DATA = /Users/chrisfu/dev/prole/data PROLE_DATA = /Users/chrisfu/dev/knoe/data
PROLE_HOME = /Users/chrisfu/dev/prole KNOE_HOME = /Users/chrisfu/dev/knoe
PROLE_LOGS = /Users/chrisfu/dev/prole/logs PROLE_LOGS = /Users/chrisfu/dev/knoe/logs
PROLE_SERVICE = /Users/chrisfu/dev/prole/etc KNOE_SERVICE = /Users/chrisfu/dev/knoe/etc
[Monitoring] [Monitoring]
GRAFANA_ADMIN_PASSWORD = ${PROLE_SECRET:v1:L2BhAyHRKVei4cGM:-J83-HR_CpnPFpiB6NbOXKdmmagVW2qL} GRAFANA_ADMIN_PASSWORD = ${KNOE_SECRET:v1:L2BhAyHRKVei4cGM:-J83-HR_CpnPFpiB6NbOXKdmmagVW2qL}
[Kerberos Authentication] [Kerberos Authentication]
AD_PORT_FORWARD = 1 AD_PORT_FORWARD = 1
AD_PROXY_HOST_NETWORK = 1 AD_PROXY_HOST_NETWORK = 1
AD_PROXY_IMAGE = alpine/socat AD_PROXY_IMAGE = alpine/socat
AD_PROXY_SERVICE = prole-kerberos-ad-dc AD_PROXY_SERVICE = knoe-kerberos-ad-dc
AD_TCP_PORTS = 88 389 445 464 636 AD_TCP_PORTS = 88 389 445 464 636
AD_UDP_PORTS = 88 464 AD_UDP_PORTS = 88 464
ENABLED = True ENABLED = True
KDC = 10.0.0.3 KDC = 10.0.0.3
PASSWORD = ${PROLE_SECRET:v1:1nB72WDtH1Crj8Ey:ssg1wYn-1Y5Q4wF1tUZL2kO-7kLL-cSxq5GkTdeY_N3JQtJW} PASSWORD = ${KNOE_SECRET:v1:1nB72WDtH1Crj8Ey:ssg1wYn-1Y5Q4wF1tUZL2kO-7kLL-cSxq5GkTdeY_N3JQtJW}
REALM = PROLE.ORG REALM = PROLE.ORG
SERVER = 10.0.0.3 SERVER = 10.0.0.3
STATUS = Initialized STATUS = Initialized
USER = administrator USER = administrator
[Ollama] [Ollama]
OLLAMA_HOST = http://fairyland.prole.org:11434 OLLAMA_HOST = http://fairyland.knoe.org:11434
OLLAMA_SERVER_HOST = fairyland.prole.org OLLAMA_SERVER_HOST = fairyland.knoe.org
OLLAMA_SERVER_PORT = 11434 OLLAMA_SERVER_PORT = 11434
[Optional Features] [Optional Features]
@ -207,8 +207,8 @@ DB_USER = root
[Initialize Cluster] [Initialize Cluster]
ENVIRONMENT = service ENVIRONMENT = service
K3S_SERVER_URL = https://myrddin.prole.org:6443 K3S_SERVER_URL = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:-5rud_XHzHRKoZIU:Dxv2nKbY883uDrJlmjRIqUKTtF42KPwXmzONy1s0-cIsJ2TLpTkaSWjfYx0tXNnz65lPnwIR16kXVtICYHhOxhfSIaz-lQiNGwZ_hm1tGMjp9BvpANt_l5Ie6swbOHVw8QfpGLtiXuIv7ur2ocSX4xAYSdCKtYWWV58U0Q==} K3S_TOKEN = ${KNOE_SECRET:v1:-5rud_XHzHRKoZIU:Dxv2nKbY883uDrJlmjRIqUKTtF42KPwXmzONy1s0-cIsJ2TLpTkaSWjfYx0tXNnz65lPnwIR16kXVtICYHhOxhfSIaz-lQiNGwZ_hm1tGMjp9BvpANt_l5Ie6swbOHVw8QfpGLtiXuIv7ur2ocSX4xAYSdCKtYWWV58U0Q==}
[Dev Cluster (k3d)] [Dev Cluster (k3d)]
CLUSTER_ENV = k3d-knoe-dev-cluster CLUSTER_ENV = k3d-knoe-dev-cluster
@ -217,22 +217,22 @@ KUBECTL_CONTEXT = service
MODE = k3d MODE = k3d
[Service Cluster (k3s)] [Service Cluster (k3s)]
CLUSTER_ENV = prole-service-cluster CLUSTER_ENV = knoe-service-cluster
DISPLAY_NAME = prole-service-cluster DISPLAY_NAME = knoe-service-cluster
K3S_SERVER_URL = https://myrddin.prole.org:6443 K3S_SERVER_URL = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:-5rud_XHzHRKoZIU:Dxv2nKbY883uDrJlmjRIqUKTtF42KPwXmzONy1s0-cIsJ2TLpTkaSWjfYx0tXNnz65lPnwIR16kXVtICYHhOxhfSIaz-lQiNGwZ_hm1tGMjp9BvpANt_l5Ie6swbOHVw8QfpGLtiXuIv7ur2ocSX4xAYSdCKtYWWV58U0Q==} K3S_TOKEN = ${KNOE_SECRET:v1:-5rud_XHzHRKoZIU:Dxv2nKbY883uDrJlmjRIqUKTtF42KPwXmzONy1s0-cIsJ2TLpTkaSWjfYx0tXNnz65lPnwIR16kXVtICYHhOxhfSIaz-lQiNGwZ_hm1tGMjp9BvpANt_l5Ie6swbOHVw8QfpGLtiXuIv7ur2ocSX4xAYSdCKtYWWV58U0Q==}
MODE = k3s MODE = k3s
PIPELINE_URL = http://myrddin.prole.org:8080 PIPELINE_URL = http://myrddin.knoe.org:8080
[GCP] [GCP]
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
[Prod Cluster (k8s)] [Prod Cluster (k8s)]
ARTIFACTS_DIR = ARTIFACTS_DIR =
CLUSTER_ENV = prole-prod-cluster CLUSTER_ENV = knoe-prod-cluster
DISPLAY_NAME = prole-prod-cluster DISPLAY_NAME = knoe-prod-cluster
MODE = k8s MODE = k8s
PIPELINE_URL = http://myrddin.prole.org:8080 PIPELINE_URL = http://myrddin.knoe.org:8080
[Docker Build] [Docker Build]
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
@ -242,7 +242,7 @@ STATUS = Completed
[Deployment] [Deployment]
MODE = k3s MODE = k3s
TARGET = prole-service-cluster TARGET = knoe-service-cluster
[Install] [Install]
STATUS = Failed STATUS = Failed

2
conf/port-mapping.cfg
View File

@ -1,4 +1,4 @@
# Port mappings for Prole Tools (generated). # Port mappings for Knoe Tools (generated).
# Format: key: local=... remote=... ns=... svc=... address=... # Format: key: local=... remote=... ns=... svc=... address=...
argocd: local=8081 remote=80 ns=argocd svc=argocd-server address=0.0.0.0 argocd: local=8081 remote=80 ns=argocd svc=argocd-server address=0.0.0.0

2
conf/service/port-mapping.cfg
View File

@ -1,5 +1,5 @@
; Port mappings generated by init_port_forwards ; Port mappings generated by init_port_forwards
; Source: /Users/chrisfu/dev/prole/conf/k3s.cfg ; Source: /Users/chrisfu/dev/knoe/conf/k3s.cfg
[PortMappings] [PortMappings]
PORT_FORWARD_K3S_MAPPING_1 = id=argocd;namespace=argocd;target=svc/argocd-server;address=0.0.0.0;hostPort=8081;servicePort=80;protocol=TCP;description=ArgoCD PORT_FORWARD_K3S_MAPPING_1 = id=argocd;namespace=argocd;target=svc/argocd-server;address=0.0.0.0;hostPort=8081;servicePort=80;protocol=TCP;description=ArgoCD
PORT_FORWARD_K3S_MAPPING_10 = id=supabase-studio;namespace=supabase;target=svc/studio;address=0.0.0.0;hostPort=18080;servicePort=3000;protocol=TCP;description=Supabase Studio PORT_FORWARD_K3S_MAPPING_10 = id=supabase-studio;namespace=supabase;target=svc/studio;address=0.0.0.0;hostPort=18080;servicePort=3000;protocol=TCP;description=Supabase Studio

36
conf/service/prod.cfg
View File

@ -1,4 +1,4 @@
; Prole Master Configuration File ; Knoe Master Configuration File
; Generated by install.py on 2026-04-10 12:30:35 ; Generated by install.py on 2026-04-10 12:30:35
; This file is used as input for Ansible deployment and k8s cluster creation. ; This file is used as input for Ansible deployment and k8s cluster creation.
@ -31,11 +31,11 @@ env_setup.DATABASE_NAMESPACE = ${DATABASE_NAMESPACE}
env_setup.DB_CLUSTER_KUBECONTEXT = env_setup.DB_CLUSTER_KUBECONTEXT =
env_setup.DB_CLUSTER_MODE = standard env_setup.DB_CLUSTER_MODE = standard
env_setup.DB_CLUSTER_NAME = knoe-dev-cnpg-0 env_setup.DB_CLUSTER_NAME = knoe-dev-cnpg-0
env_setup.PROLE_CONF = /Users/chrisfu/dev/prole/conf env_setup.KNOE_CONF = /Users/chrisfu/dev/knoe/conf
env_setup.PROLE_DATA = /Users/chrisfu/dev/prole/data env_setup.PROLE_DATA = /Users/chrisfu/dev/knoe/data
env_setup.PROLE_HOME = /Users/chrisfu/dev/prole env_setup.KNOE_HOME = /Users/chrisfu/dev/knoe
env_setup.PROLE_LOGS = /Users/chrisfu/dev/prole/logs env_setup.PROLE_LOGS = /Users/chrisfu/dev/knoe/logs
env_setup.PROLE_SERVICE = /Users/chrisfu/dev/prole/etc env_setup.KNOE_SERVICE = /Users/chrisfu/dev/knoe/etc
init_cluster.app_cluster_kubecontext = gke_plenary-truck-485623-p7_us-west3_knoe-dev-0 init_cluster.app_cluster_kubecontext = gke_plenary-truck-485623-p7_us-west3_knoe-dev-0
init_cluster.app_cluster_machine_type = e2-standard-2 init_cluster.app_cluster_machine_type = e2-standard-2
init_cluster.app_cluster_mode = standard init_cluster.app_cluster_mode = standard
@ -104,7 +104,7 @@ DATABASE_NAMESPACE = knoe-db-0
DB_HOST_PORT = 5432 DB_HOST_PORT = 5432
DB_PASSWORD= vzx.wC4Akd4x-Dj6Wguh DB_PASSWORD= vzx.wC4Akd4x-Dj6Wguh
DEPLOYMENT_MODE = k8s DEPLOYMENT_MODE = k8s
DEPLOYMENT_TARGET = prole-prod-cluster DEPLOYMENT_TARGET = knoe-prod-cluster
DOCKER_IMPORT_DIR = DOCKER_IMPORT_DIR =
DOCKER_PRELOAD = false DOCKER_PRELOAD = false
K3S_SERVER = K3S_SERVER =
@ -112,7 +112,7 @@ K3S_TOKEN =
KNOE_DB_USER = chrisfu KNOE_DB_USER = chrisfu
OPENTOFU_URL = http://127.0.0.1:8080 OPENTOFU_URL = http://127.0.0.1:8080
OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2 OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2
PROLE_HOME = /Users/chrisfu/dev/prole KNOE_HOME = /Users/chrisfu/dev/knoe
REGISTRY_NAMESPACE = knoe-system REGISTRY_NAMESPACE = knoe-system
SERVICE_NAMESPACE = knoe-system SERVICE_NAMESPACE = knoe-system
@ -142,11 +142,11 @@ PORT_FORWARD_K3D_MAPPING_8 = id=grafana;namespace=monitoring;target=svc/kps-graf
PORT_FORWARD_K3D_MAPPING_9 = id=supabase-kong;namespace=supabase;target=svc/kong;address=0.0.0.0;hostPort=8000;servicePort=8000;protocol=TCP;description=Supabase API (Kong) PORT_FORWARD_K3D_MAPPING_9 = id=supabase-kong;namespace=supabase;target=svc/kong;address=0.0.0.0;hostPort=8000;servicePort=8000;protocol=TCP;description=Supabase API (Kong)
[System Environment] [System Environment]
PROLE_CONF = /Users/chrisfu/dev/prole/conf KNOE_CONF = /Users/chrisfu/dev/knoe/conf
PROLE_DATA = /Users/chrisfu/dev/prole/data PROLE_DATA = /Users/chrisfu/dev/knoe/data
PROLE_HOME = /Users/chrisfu/dev/prole KNOE_HOME = /Users/chrisfu/dev/knoe
PROLE_LOGS = /Users/chrisfu/dev/prole/logs PROLE_LOGS = /Users/chrisfu/dev/knoe/logs
PROLE_SERVICE = /Users/chrisfu/dev/prole/etc KNOE_SERVICE = /Users/chrisfu/dev/knoe/etc
[Monitoring] [Monitoring]
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
@ -181,8 +181,8 @@ KUBECTL_CONTEXT = prod
MODE = k3d MODE = k3d
[Service Cluster (k3s)] [Service Cluster (k3s)]
CLUSTER_ENV = prole-service-cluster CLUSTER_ENV = knoe-service-cluster
DISPLAY_NAME = prole-service-cluster DISPLAY_NAME = knoe-service-cluster
K3S_SERVER_URL = K3S_SERVER_URL =
K3S_TOKEN = K3S_TOKEN =
MODE = k3s MODE = k3s
@ -193,8 +193,8 @@ PIPELINE_URL = http://127.0.0.1:8080
[Prod Cluster (k8s)] [Prod Cluster (k8s)]
ARTIFACTS_DIR = ARTIFACTS_DIR =
CLUSTER_ENV = prole-prod-cluster CLUSTER_ENV = knoe-prod-cluster
DISPLAY_NAME = prole-prod-cluster DISPLAY_NAME = knoe-prod-cluster
MODE = k8s MODE = k8s
PIPELINE_URL = http://127.0.0.1:8080 PIPELINE_URL = http://127.0.0.1:8080
@ -206,7 +206,7 @@ PIPELINE_URL = http://127.0.0.1:8080
[Deployment] [Deployment]
MODE = k8s MODE = k8s
TARGET = prole-prod-cluster TARGET = knoe-prod-cluster
[Install] [Install]
STATUS = Finished STATUS = Finished

56
conf/test/prole.cfg → conf/test/knoe.cfg
View File

@ -1,4 +1,4 @@
; Prole Master Configuration File ; Knoe Master Configuration File
; Generated by install.py on 2026-03-17 00:58:58 ; Generated by install.py on 2026-03-17 00:58:58
; This file is used as input for Ansible deployment and k8s cluster creation. ; This file is used as input for Ansible deployment and k8s cluster creation.
@ -36,15 +36,15 @@ dependencies.opentofu.install = true
dependencies.python.install = true dependencies.python.install = true
dependencies.verify_all = false dependencies.verify_all = false
disk_selection.disk_type = local disk_selection.disk_type = local
disk_selection.local_path = /Users/chrisfu/dev/prole/prole-tools-app/dist disk_selection.local_path = /Users/chrisfu/dev/knoe/knoe-tools-app/dist
disk_selection.removable_mount = disk_selection.removable_mount =
init_cluster.argocd_enabled = false init_cluster.argocd_enabled = false
init_cluster.at_rest_encryption_enabled = true init_cluster.at_rest_encryption_enabled = true
init_cluster.cluster_env = service init_cluster.cluster_env = service
init_cluster.deployment_target = prole-service-cluster init_cluster.deployment_target = knoe-service-cluster
init_cluster.gitops_enabled = false init_cluster.gitops_enabled = false
init_cluster.k3s_server_url = https://myrddin.prole.org:6443 init_cluster.k3s_server_url = https://myrddin.knoe.org:6443
init_cluster.k3s_token = ${PROLE_SECRET:v1:tOW53iZqoGRwqxUz:n0jktIyKBQ5cAggXfdR2oZ7OYyt859dRFHn5f4MzCy2zL7D_Ur9C-4e89RrTNPVLlGmd2GbHnP9uSLfnxRKe4zmypr5CfQnj3WDpwTr977EZBckkGFaSUQvUq-nShA-mRNDj14bXc2s5Oba9IQ9tiYRj4HT0W32MQ04HzQ==} init_cluster.k3s_token = ${KNOE_SECRET:v1:tOW53iZqoGRwqxUz:n0jktIyKBQ5cAggXfdR2oZ7OYyt859dRFHn5f4MzCy2zL7D_Ur9C-4e89RrTNPVLlGmd2GbHnP9uSLfnxRKe4zmypr5CfQnj3WDpwTr977EZBckkGFaSUQvUq-nShA-mRNDj14bXc2s5Oba9IQ9tiYRj4HT0W32MQ04HzQ==}
init_cluster.kerberos_enabled = true init_cluster.kerberos_enabled = true
init_cluster.mode = k3s init_cluster.mode = k3s
init_cluster.start_cluster = true init_cluster.start_cluster = true
@ -74,14 +74,14 @@ CLUSTER_ENV = service
DB_HOST_PORT = 5432 DB_HOST_PORT = 5432
DB_PASSWORD = DB_PASSWORD =
DEPLOYMENT_MODE = k3s DEPLOYMENT_MODE = k3s
DEPLOYMENT_TARGET = prole-service-cluster DEPLOYMENT_TARGET = knoe-service-cluster
DOCKER_PRELOAD = false DOCKER_PRELOAD = false
KUBECONTEXT = prole-k3s KUBECONTEXT = knoe-k3s
NAMESPACE = knoe-db NAMESPACE = knoe-db
KNOE_DB_USER = root KNOE_DB_USER = root
PROLE_HOME = $HOME/dev/prole KNOE_HOME = $HOME/dev/knoe
PROLE_K3S_SERVER = https://myrddin.prole.org:6443 PROLE_K3S_SERVER = https://myrddin.knoe.org:6443
PROLE_K3S_TOKEN = ${PROLE_SECRET:v1:tOW53iZqoGRwqxUz:n0jktIyKBQ5cAggXfdR2oZ7OYyt859dRFHn5f4MzCy2zL7D_Ur9C-4e89RrTNPVLlGmd2GbHnP9uSLfnxRKe4zmypr5CfQnj3WDpwTr977EZBckkGFaSUQvUq-nShA-mRNDj14bXc2s5Oba9IQ9tiYRj4HT0W32MQ04HzQ==} PROLE_K3S_TOKEN = ${KNOE_SECRET:v1:tOW53iZqoGRwqxUz:n0jktIyKBQ5cAggXfdR2oZ7OYyt859dRFHn5f4MzCy2zL7D_Ur9C-4e89RrTNPVLlGmd2GbHnP9uSLfnxRKe4zmypr5CfQnj3WDpwTr977EZBckkGFaSUQvUq-nShA-mRNDj14bXc2s5Oba9IQ9tiYRj4HT0W32MQ04HzQ==}
PROLE_OPENTOFU_URL = http://127.0.0.1:8080 PROLE_OPENTOFU_URL = http://127.0.0.1:8080
SERVICE_NAMESPACE = knoe-system SERVICE_NAMESPACE = knoe-system
@ -92,13 +92,13 @@ SERVICE_NAMESPACE = knoe-system
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
[Network] [Network]
AD_DC_HOST = myrddin.prole.org AD_DC_HOST = myrddin.knoe.org
AD_DC_IP = 10.0.0.3 AD_DC_IP = 10.0.0.3
ANSIBLE_DOMAIN = prole.org ANSIBLE_DOMAIN = knoe.org
ANSIBLE_INFRASTRUCTURE = ${HOME}/dev/prole/infrastructure ANSIBLE_INFRASTRUCTURE = ${HOME}/dev/knoe/infrastructure
ANSIBLE_INVENTORY = ${HOME}/dev/prole/infrastructure/inventory ANSIBLE_INVENTORY = ${HOME}/dev/knoe/infrastructure/inventory
ANSIBLE_REALM = PROLE.ORG ANSIBLE_REALM = PROLE.ORG
ANSIBLE_TOPOLOGY = {"domain":"prole.org","realm":"PROLE.ORG","internal_records":{"aventage.prole.org":"10.0.0.206","fairyland.prole.org":"10.0.0.208","loghost.prole.org":"10.0.0.3","merlin.prole.org":"10.0.0.6","morana.prole.org":"10.0.0.66","morgoth.prole.org":"10.0.0.204","myrddin.prole.org":"10.0.0.3","pi.prole.org":"10.0.0.5","raspberry.prole.org":"10.0.0.4","retropie.prole.org":"10.0.0.207","synology.prole.org":"10.0.0.203","zinfandel.prole.org":"10.0.0.205"},"ad_dc":{"host":"myrddin.prole.org","ip":"10.0.0.3"},"k3s":{"server_url":"https://myrddin.prole.org:6443","server_host":"myrddin.prole.org","token_present":true},"groups":{"iscsi":["pi.prole.org","raspberry.prole.org","myrddin.prole.org","retropie.prole.org","merlin.prole.org"],"pihole":["pi.prole.org","raspberry.prole.org"],"ad_dc":["myrddin.prole.org"],"k3s_servers":["myrddin.prole.org"],"k3s_agents":["pi.prole.org","merlin.prole.org"],"k3s_hosts:children":["k3s_servers","k3s_agents"],"linux_hosts":["pi.prole.org","raspberry.prole.org","myrddin.prole.org","retropie.prole.org","merlin.prole.org"],"ssl_hosts":["myrddin.prole.org"],"mariadb_primary":["merlin.prole.org"],"mariadb_replica":["raspberry.prole.org"],"mariadb:children":["mariadb_primary","mariadb_replica"],"merlin_bootstrap":["merlin"]},"hosts":{"merlin":"10.0.0.6","merlin.prole.org":"10.0.0.6","myrddin.prole.org":"10.0.0.3","pi.prole.org":"10.0.0.5","raspberry.prole.org":"10.0.0.4","retropie.prole.org":"10.0.0.207"},"unmapped_hosts":["k3s_agents","k3s_servers","mariadb_primary","mariadb_replica"]} ANSIBLE_TOPOLOGY = {"domain":"knoe.org","realm":"PROLE.ORG","internal_records":{"aventage.knoe.org":"10.0.0.206","fairyland.knoe.org":"10.0.0.208","loghost.knoe.org":"10.0.0.3","merlin.knoe.org":"10.0.0.6","morana.knoe.org":"10.0.0.66","morgoth.knoe.org":"10.0.0.204","myrddin.knoe.org":"10.0.0.3","pi.knoe.org":"10.0.0.5","raspberry.knoe.org":"10.0.0.4","retropie.knoe.org":"10.0.0.207","synology.knoe.org":"10.0.0.203","zinfandel.knoe.org":"10.0.0.205"},"ad_dc":{"host":"myrddin.knoe.org","ip":"10.0.0.3"},"k3s":{"server_url":"https://myrddin.knoe.org:6443","server_host":"myrddin.knoe.org","token_present":true},"groups":{"iscsi":["pi.knoe.org","raspberry.knoe.org","myrddin.knoe.org","retropie.knoe.org","merlin.knoe.org"],"pihole":["pi.knoe.org","raspberry.knoe.org"],"ad_dc":["myrddin.knoe.org"],"k3s_servers":["myrddin.knoe.org"],"k3s_agents":["pi.knoe.org","merlin.knoe.org"],"k3s_hosts:children":["k3s_servers","k3s_agents"],"linux_hosts":["pi.knoe.org","raspberry.knoe.org","myrddin.knoe.org","retropie.knoe.org","merlin.knoe.org"],"ssl_hosts":["myrddin.knoe.org"],"mariadb_primary":["merlin.knoe.org"],"mariadb_replica":["raspberry.knoe.org"],"mariadb:children":["mariadb_primary","mariadb_replica"],"merlin_bootstrap":["merlin"]},"hosts":{"merlin":"10.0.0.6","merlin.knoe.org":"10.0.0.6","myrddin.knoe.org":"10.0.0.3","pi.knoe.org":"10.0.0.5","raspberry.knoe.org":"10.0.0.4","retropie.knoe.org":"10.0.0.207"},"unmapped_hosts":["k3s_agents","k3s_servers","mariadb_primary","mariadb_replica"]}
KDC_ANSIBLE_DETECTED = 10.0.0.3 KDC_ANSIBLE_DETECTED = 10.0.0.3
KDC_AUTO_DETECTED = 10.0.0.3 KDC_AUTO_DETECTED = 10.0.0.3
KERBEROS_AUTO_ENABLED = True KERBEROS_AUTO_ENABLED = True
@ -107,11 +107,11 @@ KERBEROS_AUTO_ENABLED = True
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
[System Environment] [System Environment]
PROLE_CONF = ${PROLE_CONF} KNOE_CONF = ${KNOE_CONF}
PROLE_DATA = ${PROLE_DATA} PROLE_DATA = ${PROLE_DATA}
PROLE_HOME = ${PROLE_HOME} KNOE_HOME = ${KNOE_HOME}
PROLE_LOGS = ${PROLE_LOGS} PROLE_LOGS = ${PROLE_LOGS}
PROLE_SERVICE = ${PROLE_SERVICE} KNOE_SERVICE = ${KNOE_SERVICE}
[Monitoring] [Monitoring]
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.
@ -136,27 +136,27 @@ SUPABASE_ENABLED = False
[Initialize Cluster] [Initialize Cluster]
ENVIRONMENT = service ENVIRONMENT = service
K3S_SERVER_URL = https://myrddin.prole.org:6443 K3S_SERVER_URL = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:tOW53iZqoGRwqxUz:n0jktIyKBQ5cAggXfdR2oZ7OYyt859dRFHn5f4MzCy2zL7D_Ur9C-4e89RrTNPVLlGmd2GbHnP9uSLfnxRKe4zmypr5CfQnj3WDpwTr977EZBckkGFaSUQvUq-nShA-mRNDj14bXc2s5Oba9IQ9tiYRj4HT0W32MQ04HzQ==} K3S_TOKEN = ${KNOE_SECRET:v1:tOW53iZqoGRwqxUz:n0jktIyKBQ5cAggXfdR2oZ7OYyt859dRFHn5f4MzCy2zL7D_Ur9C-4e89RrTNPVLlGmd2GbHnP9uSLfnxRKe4zmypr5CfQnj3WDpwTr977EZBckkGFaSUQvUq-nShA-mRNDj14bXc2s5Oba9IQ9tiYRj4HT0W32MQ04HzQ==}
[Dev Cluster (k3d)] [Dev Cluster (k3d)]
CLUSTER_ENV = dev CLUSTER_ENV = dev
DISPLAY_NAME = knoe-dev-cluster DISPLAY_NAME = knoe-dev-cluster
KUBECTL_CONTEXT = prole-k3s KUBECTL_CONTEXT = knoe-k3s
MODE = k3d MODE = k3d
[Service Cluster (k3s)] [Service Cluster (k3s)]
CLUSTER_ENV = prole-service-cluster CLUSTER_ENV = knoe-service-cluster
DISPLAY_NAME = prole-service-cluster DISPLAY_NAME = knoe-service-cluster
K3S_SERVER_URL = https://myrddin.prole.org:6443 K3S_SERVER_URL = https://myrddin.knoe.org:6443
K3S_TOKEN = ${PROLE_SECRET:v1:tOW53iZqoGRwqxUz:n0jktIyKBQ5cAggXfdR2oZ7OYyt859dRFHn5f4MzCy2zL7D_Ur9C-4e89RrTNPVLlGmd2GbHnP9uSLfnxRKe4zmypr5CfQnj3WDpwTr977EZBckkGFaSUQvUq-nShA-mRNDj14bXc2s5Oba9IQ9tiYRj4HT0W32MQ04HzQ==} K3S_TOKEN = ${KNOE_SECRET:v1:tOW53iZqoGRwqxUz:n0jktIyKBQ5cAggXfdR2oZ7OYyt859dRFHn5f4MzCy2zL7D_Ur9C-4e89RrTNPVLlGmd2GbHnP9uSLfnxRKe4zmypr5CfQnj3WDpwTr977EZBckkGFaSUQvUq-nShA-mRNDj14bXc2s5Oba9IQ9tiYRj4HT0W32MQ04HzQ==}
MODE = k3s MODE = k3s
PIPELINE_URL = http://127.0.0.1:8080 PIPELINE_URL = http://127.0.0.1:8080
[Prod Cluster (k8s)] [Prod Cluster (k8s)]
ARTIFACTS_DIR = ${PROLE_DATA}/staging ARTIFACTS_DIR = ${PROLE_DATA}/staging
CLUSTER_ENV = prole-prod-cluster CLUSTER_ENV = knoe-prod-cluster
DISPLAY_NAME = prole-prod-cluster DISPLAY_NAME = knoe-prod-cluster
MODE = k8s MODE = k8s
PIPELINE_URL = http://127.0.0.1:8080 PIPELINE_URL = http://127.0.0.1:8080
@ -168,7 +168,7 @@ PIPELINE_URL = http://127.0.0.1:8080
[Deployment] [Deployment]
MODE = k3s MODE = k3s
TARGET = prole-service-cluster TARGET = knoe-service-cluster
[Install] [Install]
; No configuration values captured yet for this section. ; No configuration values captured yet for this section.

158
config.py
View File

@ -1,7 +1,7 @@
""" """
Shared configuration and utility functions for the Prole installer (root-level). Shared configuration and utility functions for the Knoe installer (root-level).
This mirrors `prole.knoe.config` but is located under the root `installer/` This mirrors `knoe.knoe.config` but is located under the root `installer/`
package per the refactor request. UI code should import from `knoe.config`. package per the refactor request. UI code should import from `knoe.config`.
""" """
@ -24,29 +24,29 @@ from typing import Optional, Tuple
from cryptography.hazmat.primitives.ciphers.aead import AESGCM from cryptography.hazmat.primitives.ciphers.aead import AESGCM
def resolve_prole_home(env: dict[str, str] | None = None) -> Path: def resolve_knoe_home(env: dict[str, str] | None = None) -> Path:
"""Resolve `PROLE_HOME` from `env`/process environment. """Resolve `KNOE_HOME` from `env`/process environment.
Falls back to `$HOME/.prole` when `PROLE_HOME` is not set. Falls back to `$HOME/.knoe` when `KNOE_HOME` is not set.
NOTE: This is duplicated here (and in `knoe.core.env`) to avoid circular NOTE: This is duplicated here (and in `knoe.core.env`) to avoid circular
imports between the two modules. imports between the two modules.
""" """
env_map = env or os.environ env_map = env or os.environ
raw = (env_map.get("PROLE_HOME") or "").strip() raw = (env_map.get("KNOE_HOME") or "").strip()
if raw: if raw:
expanded = os.path.expanduser(os.path.expandvars(raw)) expanded = os.path.expanduser(os.path.expandvars(raw))
return Path(expanded) return Path(expanded)
return Path.home() / ".prole" return Path.home() / ".knoe"
# Secret handling (temporary encrypted values in prole.cfg) # Secret handling (temporary encrypted values in knoe.cfg)
PROLE_SECRET_PREFIX = "${PROLE_SECRET:" KNOE_SECRET_PREFIX = "${KNOE_SECRET:"
PROLE_SECRET_SUFFIX = "}" KNOE_SECRET_SUFFIX = "}"
OPENBAO_PREFIX = "${OPENBAO:" OPENBAO_PREFIX = "${OPENBAO:"
OPENBAO_SUFFIX = "}" OPENBAO_SUFFIX = "}"
PROLE_SECRET_VERSION = "v1" KNOE_SECRET_VERSION = "v1"
PROLE_SECRET_SERVICE = "prole-installer" KNOE_SECRET_SERVICE = "knoe-installer"
# Map config keys to OpenBao paths (namespace injected at runtime) # Map config keys to OpenBao paths (namespace injected at runtime)
SECRET_KEY_SPECS = { SECRET_KEY_SPECS = {
@ -59,11 +59,11 @@ SECRET_KEY_SPECS = {
} }
def _is_prole_secret(value: str | None) -> bool: def _is_knoe_secret(value: str | None) -> bool:
return ( return (
bool(value) bool(value)
and value.startswith(PROLE_SECRET_PREFIX) and value.startswith(KNOE_SECRET_PREFIX)
and value.endswith(PROLE_SECRET_SUFFIX) and value.endswith(KNOE_SECRET_SUFFIX)
) )
@ -76,7 +76,7 @@ def _is_openbao_ref(value: str | None) -> bool:
def _get_secret_key_file() -> Path: def _get_secret_key_file() -> Path:
return resolve_prole_home() / "secrets" / "knoe.key" return resolve_knoe_home() / "secrets" / "knoe.key"
def _get_keychain_key(service: str, account: str) -> bytes: def _get_keychain_key(service: str, account: str) -> bytes:
@ -132,16 +132,16 @@ def _get_file_key(path: Path) -> bytes:
def _get_secret_key() -> bytes: def _get_secret_key() -> bytes:
system = platform.system() system = platform.system()
account = getpass.getuser() or "prole" account = getpass.getuser() or "knoe"
if system == "Darwin": if system == "Darwin":
return _get_keychain_key(PROLE_SECRET_SERVICE, account) return _get_keychain_key(KNOE_SECRET_SERVICE, account)
return _get_file_key(_get_secret_key_file()) return _get_file_key(_get_secret_key_file())
def _encrypt_prole_secret(plaintext: str) -> str: def _encrypt_knoe_secret(plaintext: str) -> str:
if plaintext is None: if plaintext is None:
return "" return ""
if _is_prole_secret(plaintext): if _is_knoe_secret(plaintext):
return plaintext return plaintext
key = _get_secret_key() key = _get_secret_key()
aesgcm = AESGCM(key) aesgcm = AESGCM(key)
@ -149,15 +149,15 @@ def _encrypt_prole_secret(plaintext: str) -> str:
ciphertext = aesgcm.encrypt(nonce, plaintext.encode("utf-8"), None) ciphertext = aesgcm.encrypt(nonce, plaintext.encode("utf-8"), None)
nonce_b64 = base64.urlsafe_b64encode(nonce).decode("utf-8") nonce_b64 = base64.urlsafe_b64encode(nonce).decode("utf-8")
ct_b64 = base64.urlsafe_b64encode(ciphertext).decode("utf-8") ct_b64 = base64.urlsafe_b64encode(ciphertext).decode("utf-8")
return f"{PROLE_SECRET_PREFIX}{PROLE_SECRET_VERSION}:{nonce_b64}:{ct_b64}{PROLE_SECRET_SUFFIX}" return f"{KNOE_SECRET_PREFIX}{KNOE_SECRET_VERSION}:{nonce_b64}:{ct_b64}{KNOE_SECRET_SUFFIX}"
def _decrypt_prole_secret(value: str) -> str: def _decrypt_knoe_secret(value: str) -> str:
if not _is_prole_secret(value): if not _is_knoe_secret(value):
return value return value
inner = value[len(PROLE_SECRET_PREFIX) : -len(PROLE_SECRET_SUFFIX)] inner = value[len(KNOE_SECRET_PREFIX) : -len(KNOE_SECRET_SUFFIX)]
parts = inner.split(":") parts = inner.split(":")
if len(parts) != 3 or parts[0] != PROLE_SECRET_VERSION: if len(parts) != 3 or parts[0] != KNOE_SECRET_VERSION:
return value return value
try: try:
nonce = base64.urlsafe_b64decode(parts[1].encode("utf-8")) nonce = base64.urlsafe_b64decode(parts[1].encode("utf-8"))
@ -173,10 +173,10 @@ def _decrypt_prole_secret(value: str) -> str:
def _encrypt_cfg_secret(plaintext: str | None) -> str: def _encrypt_cfg_secret(plaintext: str | None) -> str:
if not plaintext: if not plaintext:
return "" return ""
if _is_prole_secret(plaintext) or _is_openbao_ref(plaintext): if _is_knoe_secret(plaintext) or _is_openbao_ref(plaintext):
return plaintext return plaintext
try: try:
return _encrypt_prole_secret(plaintext) return _encrypt_knoe_secret(plaintext)
except Exception: except Exception:
return str(plaintext) return str(plaintext)
@ -199,9 +199,9 @@ def _resolve_openbao_ref(value: str) -> str:
secret_path = rest secret_path = rest
token = os.environ.get("OPENBAO_ROOT_TOKEN", "") token = os.environ.get("OPENBAO_ROOT_TOKEN", "")
if not token: if not token:
prole_service = os.environ.get("PROLE_SERVICE") knoe_service = os.environ.get("KNOE_SERVICE")
if prole_service: if knoe_service:
token_path = Path(prole_service) / "secrets" / "openbao-root-token" token_path = Path(knoe_service) / "secrets" / "openbao-root-token"
if token_path.exists(): if token_path.exists():
token = token_path.read_text().strip() token = token_path.read_text().strip()
if not token: if not token:
@ -232,8 +232,8 @@ def _resolve_openbao_ref(value: str) -> str:
def _resolve_secret_value(value: str) -> str: def _resolve_secret_value(value: str) -> str:
if _is_prole_secret(value): if _is_knoe_secret(value):
return _decrypt_prole_secret(value) return _decrypt_knoe_secret(value)
if _is_openbao_ref(value): if _is_openbao_ref(value):
return _resolve_openbao_ref(value) return _resolve_openbao_ref(value)
return value return value
@ -261,8 +261,8 @@ def _load_properties(path: Path) -> dict:
# Repository root: this file lives at <repo>/installer/config.py → parent is repo # Repository root: this file lives at <repo>/installer/config.py → parent is repo
PROJECT_ROOT = Path(__file__).resolve().parents[1] PROJECT_ROOT = Path(__file__).resolve().parents[1]
PROLE_APP_DIR = PROJECT_ROOT / "prole-app" KNOE_APP_DIR = PROJECT_ROOT / "knoe-app"
PROLE_PROPS_PATH = PROLE_APP_DIR / "prole.properties" KNOE_PROPS_PATH = KNOE_APP_DIR / "knoe.properties"
import logging import logging
@ -314,30 +314,30 @@ def setup_logging(verbose=False, debug=False):
) )
_PROLE_PROPS_CACHE: Optional[dict] = None _KNOE_PROPS_CACHE: Optional[dict] = None
def get_properties() -> dict: def get_properties() -> dict:
"""Load and cache prole.properties from the repo (installer context). """Load and cache knoe.properties from the repo (installer context).
Order: Order:
- Repo default at prole-app/prole.properties - Repo default at knoe-app/knoe.properties
- Optional env override: PROLE_PROPERTIES points to a file - Optional env override: KNOE_PROPERTIES points to a file
""" """
global _PROLE_PROPS_CACHE global _KNOE_PROPS_CACHE
if _PROLE_PROPS_CACHE is None: if _KNOE_PROPS_CACHE is None:
props: dict[str, str] = {} props: dict[str, str] = {}
# repo default # repo default
if PROLE_PROPS_PATH.exists(): if KNOE_PROPS_PATH.exists():
props.update(_load_properties(PROLE_PROPS_PATH)) props.update(_load_properties(KNOE_PROPS_PATH))
# env override (absolute path) # env override (absolute path)
env_path = os.environ.get("PROLE_PROPERTIES") env_path = os.environ.get("KNOE_PROPERTIES")
if env_path: if env_path:
p = Path(env_path) p = Path(env_path)
if p.exists(): if p.exists():
props.update(_load_properties(p)) props.update(_load_properties(p))
_PROLE_PROPS_CACHE = props _KNOE_PROPS_CACHE = props
return dict(_PROLE_PROPS_CACHE) return dict(_KNOE_PROPS_CACHE)
def get_config_value(key: str, default: Optional[str] = None) -> Optional[str]: def get_config_value(key: str, default: Optional[str] = None) -> Optional[str]:
@ -348,39 +348,39 @@ def get_ui_icon_image_path() -> Path:
"""Return absolute path to the UI icon image for the installer. """Return absolute path to the UI icon image for the installer.
Priority (new → legacy): Priority (new → legacy):
- `icon` key in prole.properties (requested) - `icon` key in knoe.properties (requested)
- legacy `ui.icon` - legacy `ui.icon`
Defaults to img/proleIcon.png under repo root if not set or missing. Defaults to img/knoeIcon.png under repo root if not set or missing.
""" """
# Prefer new key `icon`, fall back to old `ui.icon` # Prefer new key `icon`, fall back to old `ui.icon`
rel = get_config_value("icon") or get_config_value("ui.icon") or "img/proleIcon.png" rel = get_config_value("icon") or get_config_value("ui.icon") or "img/knoeIcon.png"
p = (PROJECT_ROOT / rel).resolve() p = (PROJECT_ROOT / rel).resolve()
if p.exists(): if p.exists():
return p return p
# fallback # fallback
return (PROJECT_ROOT / "img/proleIcon.png").resolve() return (PROJECT_ROOT / "img/knoeIcon.png").resolve()
def get_ui_background_image_path() -> Path: def get_ui_background_image_path() -> Path:
"""Return absolute path to the UI background image. """Return absolute path to the UI background image.
Priority (new → legacy): Priority (new → legacy):
- `background` key in prole.properties (requested) - `background` key in knoe.properties (requested)
- legacy `ui.background` - legacy `ui.background`
Defaults to img/proleLogoSepia.png under repo root if not set or missing. Defaults to img/knoeLogoSepia.png under repo root if not set or missing.
""" """
rel = ( rel = (
get_config_value("background") get_config_value("background")
or get_config_value("ui.background") or get_config_value("ui.background")
or "img/proleLogoSepia.png" or "img/knoeLogoSepia.png"
) )
p = (PROJECT_ROOT / rel).resolve() p = (PROJECT_ROOT / rel).resolve()
if p.exists(): if p.exists():
return p return p
# fallback # fallback
return (PROJECT_ROOT / "img/proleLogoSepia.png").resolve() return (PROJECT_ROOT / "img/knoeLogoSepia.png").resolve()
def is_apple_silicon() -> bool: def is_apple_silicon() -> bool:
@ -394,7 +394,7 @@ def get_docker_build_platform_args(target_env: Optional[str] = None) -> list[str
env_key = (target_env or "").strip().lower() env_key = (target_env or "").strip().lower()
if env_key == "dev" and is_apple_silicon(): if env_key == "dev" and is_apple_silicon():
return ["--platform", "linux/arm64"] return ["--platform", "linux/arm64"]
if env_key in ("service", "k3s", "prole-service-cluster"): if env_key in ("service", "k3s", "knoe-service-cluster"):
return ["--platform", "linux/arm64"] return ["--platform", "linux/arm64"]
if is_apple_silicon(): if is_apple_silicon():
return ["--platform", "linux/amd64"] return ["--platform", "linux/amd64"]
@ -434,7 +434,7 @@ def _expand_path(val: str | None) -> str:
if not val: if not val:
return "" return ""
# Expand ~ and shell-style variables like $HOME. Use a small fixed-point loop # Expand ~ and shell-style variables like $HOME. Use a small fixed-point loop
# so nested refs (e.g. PROLE_HOME=$HOME/...) expand fully. # so nested refs (e.g. KNOE_HOME=$HOME/...) expand fully.
out = os.path.expanduser(str(val)) out = os.path.expanduser(str(val))
for _ in range(10): for _ in range(10):
new = os.path.expandvars(out) new = os.path.expandvars(out)
@ -448,9 +448,9 @@ def _normalize_persistence_mode(mode: str | None) -> str:
raw = (mode or "").strip().lower() raw = (mode or "").strip().lower()
if raw in {"dev", "k3d", "local"}: if raw in {"dev", "k3d", "local"}:
return "dev" return "dev"
if raw in {"service", "k3s", "k3s-hosts", "prole-service-cluster"}: if raw in {"service", "k3s", "k3s-hosts", "knoe-service-cluster"}:
return "k3s-hosts" return "k3s-hosts"
if raw in {"prod", "k8s", "prole-prod-cluster"}: if raw in {"prod", "k8s", "knoe-prod-cluster"}:
return "prod" return "prod"
return raw return raw
@ -604,7 +604,7 @@ def _collect_cfg_vars_from_data(
mode: str | None = None, mode: str | None = None,
explicit_keys: set[tuple[str, str]] | None = None, explicit_keys: set[tuple[str, str]] | None = None,
) -> dict[str, str]: ) -> dict[str, str]:
"""Collect variable names from a `prole_cfg_data`-style dict. """Collect variable names from a `knoe_cfg_data`-style dict.
This mirrors `_collect_cfg_vars()` but operates on the UI/controller's in-memory This mirrors `_collect_cfg_vars()` but operates on the UI/controller's in-memory
dict instead of a `configparser.ConfigParser`. dict instead of a `configparser.ConfigParser`.
@ -649,7 +649,7 @@ def _expand_cfg_vars_shellstyle(val: str, variables: dict[str, str]) -> str:
Notes: Notes:
- Only expands simple shell-style identifiers (letters/digits/underscore). - Only expands simple shell-style identifiers (letters/digits/underscore).
This intentionally avoids treating `${PROLE_SECRET:...}` or similar This intentionally avoids treating `${KNOE_SECRET:...}` or similar
colon-delimited references as variables. colon-delimited references as variables.
- Unknown variables are left intact. - Unknown variables are left intact.
""" """
@ -822,7 +822,7 @@ def _try_read_ansible_vault_value(vault_path: Path, key: str) -> str:
return "" return ""
def _update_prole_cfg_value( def _update_knoe_cfg_value(
section: str, section: str,
key: str, key: str,
value: str, value: str,
@ -830,15 +830,15 @@ def _update_prole_cfg_value(
mode: str | None = None, mode: str | None = None,
explicit: bool = False, explicit: bool = False,
): ):
# Prefer `$PROLE_CONF/prole.cfg` (single entrypoint) and follow symlink so we # Prefer `$KNOE_CONF/knoe.cfg` (single entrypoint) and follow symlink so we
# update the active environment base file without mutating other environments. # update the active environment base file without mutating other environments.
try: try:
from knoe import prole_conf from knoe import knoe_conf
conf_dir = prole_conf.resolve_prole_conf_dir(PROJECT_ROOT) conf_dir = knoe_conf.resolve_knoe_conf_dir(PROJECT_ROOT)
cfg_path = prole_conf.entrypoint_path(conf_dir) cfg_path = knoe_conf.entrypoint_path(conf_dir)
except Exception: except Exception:
cfg_path = PROJECT_ROOT / "conf" / "prole.cfg" cfg_path = PROJECT_ROOT / "conf" / "knoe.cfg"
if not cfg_path.exists(): if not cfg_path.exists():
return return
@ -900,27 +900,27 @@ def _write_k3s_kubeconfig(server_url: str, token: str) -> Path:
"- cluster:\n" "- cluster:\n"
f" server: {server_url}\n" f" server: {server_url}\n"
" insecure-skip-tls-verify: true\n" " insecure-skip-tls-verify: true\n"
" name: prole-k3s\n" " name: knoe-k3s\n"
"contexts:\n" "contexts:\n"
"- context:\n" "- context:\n"
" cluster: prole-k3s\n" " cluster: knoe-k3s\n"
" user: prole-k3s\n" " user: knoe-k3s\n"
" name: prole-k3s\n" " name: knoe-k3s\n"
"current-context: prole-k3s\n" "current-context: knoe-k3s\n"
"users:\n" "users:\n"
"- name: prole-k3s\n" "- name: knoe-k3s\n"
" user:\n" " user:\n"
f" token: {token}\n" f" token: {token}\n"
) )
prole_service = os.environ.get("PROLE_SERVICE", "").strip() knoe_service = os.environ.get("KNOE_SERVICE", "").strip()
if prole_service: if knoe_service:
path = Path(prole_service).expanduser() / "secrets" / "k3s.kubeconfig" path = Path(knoe_service).expanduser() / "secrets" / "k3s.kubeconfig"
else: else:
prole_home = os.environ.get("PROLE_HOME", "").strip() knoe_home = os.environ.get("KNOE_HOME", "").strip()
if prole_home: if knoe_home:
path = Path(prole_home).expanduser() / "prole-k3s.kubeconfig" path = Path(knoe_home).expanduser() / "knoe-k3s.kubeconfig"
else: else:
path = PROJECT_ROOT / "prole-k3s.kubeconfig" path = PROJECT_ROOT / "knoe-k3s.kubeconfig"
# Never overwrite a kubeconfig that uses client-certificate auth (e.g. # Never overwrite a kubeconfig that uses client-certificate auth (e.g.
# one fetched by Ansible) with a token-based fallback. # one fetched by Ansible) with a token-based fallback.
if path.exists(): if path.exists():
@ -1036,7 +1036,7 @@ DEPENDENCIES = [
{ {
"id": "docker", "id": "docker",
"name": "Docker", "name": "Docker",
"description": "Container platform for running Prole services", "description": "Container platform for running Knoe services",
"url": "https://www.docker.com/products/docker-desktop", "url": "https://www.docker.com/products/docker-desktop",
"install_cmd": None, "install_cmd": None,
"check_cmd": "docker --version", "check_cmd": "docker --version",

4
demo/gcp-config.cast
View File

@ -90,9 +90,9 @@
[0.672, "o", "\u001b[H\n\u001b[J\u001b[AFetching billing accounts…"] [0.672, "o", "\u001b[H\n\u001b[J\u001b[AFetching billing accounts…"]
[31.063, "o", "\r\u001b(B\u001b[0;1mSelect Billing Account\u001b(B\u001b[m\u001b[K\r\n───────────────────────────────────────────────────────────────────────────────\r\n \u001b(B\u001b[0;2mProject: plenary-truck-485623-p7\n\u001b[3G\u001b(B\u001b[0;7m My Billing Account 01193C-25783B-3211AD \r\u001b[24d\u001b(B\u001b[0;2m↑↓/jk navigate Enter select q quit 1/1\u001b(B\u001b[m"] [31.063, "o", "\r\u001b(B\u001b[0;1mSelect Billing Account\u001b(B\u001b[m\u001b[K\r\n───────────────────────────────────────────────────────────────────────────────\r\n \u001b(B\u001b[0;2mProject: plenary-truck-485623-p7\n\u001b[3G\u001b(B\u001b[0;7m My Billing Account 01193C-25783B-3211AD \r\u001b[24d\u001b(B\u001b[0;2m↑↓/jk navigate Enter select q quit 1/1\u001b(B\u001b[m"]
[2.113, "o", "\u001b[?12l\u001b[?25h"] [2.113, "o", "\u001b[?12l\u001b[?25h"]
[0.001, "o", "\u001b[H\u001b(B\u001b[0;1mConfig: --mode k8s --provider gcp — Confirm & Save\n\n\u001b[3G\u001b(B\u001b[mOrg ID: 584001916389\u001b[K\r\n Org Name: knoey.com\u001b[K\r\n Project ID:\u001b[5;22Hplenary-truck-485623-p7\r\n Project Name:\u001b[22GKnoey Auth\r\n Project Number: 507759242125\r\n Billing Account: 01193C-25783B-3211AD\r\n Billing Name:\u001b[22GMy Billing Account\r\n\n \u001b(B\u001b[0;1mOutput file: \u001b(B\u001b[m/Users/chrisfu/dev/prole/conf/prod/gcp.cfg\r\u001b[24d\u001b(B\u001b[0;2mEdit path above Enter to write Esc to cancel\u001b(B\u001b[m"] [0.001, "o", "\u001b[H\u001b(B\u001b[0;1mConfig: --mode k8s --provider gcp — Confirm & Save\n\n\u001b[3G\u001b(B\u001b[mOrg ID: 584001916389\u001b[K\r\n Org Name: knoey.com\u001b[K\r\n Project ID:\u001b[5;22Hplenary-truck-485623-p7\r\n Project Name:\u001b[22GKnoey Auth\r\n Project Number: 507759242125\r\n Billing Account: 01193C-25783B-3211AD\r\n Billing Name:\u001b[22GMy Billing Account\r\n\n \u001b(B\u001b[0;1mOutput file: \u001b(B\u001b[m/Users/chrisfu/dev/knoe/conf/prod/gcp.cfg\r\u001b[24d\u001b(B\u001b[0;2mEdit path above Enter to write Esc to cancel\u001b(B\u001b[m"]
[4.691, "o", "\u001b[?25l"] [4.691, "o", "\u001b[?25l"]
[0.002, "o", "\u001b[HConfiguration written.\u001b[K\r\n\u001b[K\n /Users/chrisfu/dev/prole/conf/prod/gcp.cfg\r\n\u001b[K\nNext steps:\u001b[K\r\n 1. Copy org_id / billing_account / billing_project into:\n\u001b[7G\u001b[1K deploy/gcp/terraform/cloud-setup.auto.tfvars\r\n 2. Open the installer — Prod Cluster → Cloud tab will be pre-filled\r\n (or click 'Load from gcp.cfg' to refresh on demand)\r\n\n\u001b[K\u001b[24d\u001b(B\u001b[0;2mPress any key to continue…\u001b(B\u001b[m\u001b[K"] [0.002, "o", "\u001b[HConfiguration written.\u001b[K\r\n\u001b[K\n /Users/chrisfu/dev/knoe/conf/prod/gcp.cfg\r\n\u001b[K\nNext steps:\u001b[K\r\n 1. Copy org_id / billing_account / billing_project into:\n\u001b[7G\u001b[1K deploy/gcp/terraform/cloud-setup.auto.tfvars\r\n 2. Open the installer — Prod Cluster → Cloud tab will be pre-filled\r\n (or click 'Load from gcp.cfg' to refresh on demand)\r\n\n\u001b[K\u001b[24d\u001b(B\u001b[0;2mPress any key to continue…\u001b(B\u001b[m\u001b[K"]
[2.724, "o", "\u001b[?1l\u001b>"] [2.724, "o", "\u001b[?1l\u001b>"]
[0.000, "o", "\u001b[24;1H\u001b[?12l\u001b[?25h\u001b[?1049l\r\u001b[?1l\u001b>"] [0.000, "o", "\u001b[24;1H\u001b[?12l\u001b[?25h\u001b[?1049l\r\u001b[?1l\u001b>"]
[0.011, "x", "0"] [0.011, "x", "0"]

8
deploy.sh
View File

@ -63,7 +63,7 @@ except subprocess.CalledProcessError:
PY PY
fi fi
"${PYTHON_BIN}" -m prole.deploy_pipeline --config "${CONFIG_PATH}" "$@" "${PYTHON_BIN}" -m knoe.deploy_pipeline --config "${CONFIG_PATH}" "$@"
# Post-deploy summary # Post-deploy summary
echo "" echo ""
@ -132,7 +132,7 @@ def get_runtime_config(path):
gitlab_public_hosts_raw = _cfg_first(g, e, i, "GITLAB_PUBLIC_HOSTS", "gitlab_public_hosts") gitlab_public_hosts_raw = _cfg_first(g, e, i, "GITLAB_PUBLIC_HOSTS", "gitlab_public_hosts")
gitlab_domain = _cfg_first(g, e, i, "GITLAB_DOMAIN", "GITLAB_HOSTNAME", "gitlab_domain", "gitlab_hostname") gitlab_domain = _cfg_first(g, e, i, "GITLAB_DOMAIN", "GITLAB_HOSTNAME", "gitlab_domain", "gitlab_hostname")
if not gitlab_domain: if not gitlab_domain:
gitlab_domain = "git.knoe.dev" if mode == "k8s" else "git.prole.org" gitlab_domain = "git.knoe.dev" if mode == "k8s" else "git.knoe.org"
gitlab_public_hosts = [h.strip() for h in str(gitlab_public_hosts_raw or "").split(",") if h.strip()] gitlab_public_hosts = [h.strip() for h in str(gitlab_public_hosts_raw or "").split(",") if h.strip()]
if not gitlab_public_hosts: if not gitlab_public_hosts:
gitlab_public_hosts = [gitlab_domain] gitlab_public_hosts = [gitlab_domain]
@ -145,11 +145,11 @@ def get_runtime_config(path):
auth_host = _cfg_first(g, e, i, "AUTH_HOSTNAME", "auth_hostname") auth_host = _cfg_first(g, e, i, "AUTH_HOSTNAME", "auth_hostname")
if not auth_host: if not auth_host:
auth_host = "api.knoe.dev" if mode == "k8s" else "api.prole.org" auth_host = "api.knoe.dev" if mode == "k8s" else "api.knoe.org"
service_host = _cfg_first(g, e, i, "SERVICE_HOSTNAME", "service_hostname", "GRAFANA_HOSTNAME", "grafana_hostname") service_host = _cfg_first(g, e, i, "SERVICE_HOSTNAME", "service_hostname", "GRAFANA_HOSTNAME", "grafana_hostname")
if not service_host: if not service_host:
service_host = "svc.knoe.dev" if mode == "k8s" else "svc.prole.org" service_host = "svc.knoe.dev" if mode == "k8s" else "svc.knoe.org"
service_ns = _cfg_first(g, e, i, "SERVICE_NAMESPACE", "service_namespace") or "knoe-system" service_ns = _cfg_first(g, e, i, "SERVICE_NAMESPACE", "service_namespace") or "knoe-system"

2
deploy/gcp/gke/gitlab-google-oidc-secret.example.yaml
View File

@ -4,7 +4,7 @@ metadata:
name: gitlab-google-oidc name: gitlab-google-oidc
namespace: gitlab namespace: gitlab
labels: labels:
app.kubernetes.io/managed-by: prole-installer app.kubernetes.io/managed-by: knoe-installer
# GitLab OmniAuth provider config for OpenID Connect via knoe-auth. # GitLab OmniAuth provider config for OpenID Connect via knoe-auth.
# See: https://docs.gitlab.com/ee/administration/auth/oidc.html # See: https://docs.gitlab.com/ee/administration/auth/oidc.html
# Applied by etc/init_gitlab.sh --mode k8s # Applied by etc/init_gitlab.sh --mode k8s

2
deploy/gcp/gke/knoe-auth-google-oidc-secret.example.yaml
View File

@ -4,7 +4,7 @@ metadata:
name: knoe-auth-google-oidc name: knoe-auth-google-oidc
namespace: knoe-system namespace: knoe-system
labels: labels:
app.kubernetes.io/managed-by: prole-installer app.kubernetes.io/managed-by: knoe-installer
# Fill in client_id and client_secret from your Google Cloud Console OAuth 2.0 credentials. # Fill in client_id and client_secret from your Google Cloud Console OAuth 2.0 credentials.
# Create at: https://console.cloud.google.com/apis/credentials # Create at: https://console.cloud.google.com/apis/credentials
# Authorized redirect URI: https://<frontdoor-host>/auth/callback/google # Authorized redirect URI: https://<frontdoor-host>/auth/callback/google

22
deploy/gcp/gke/knoe-db.yaml
View File

@ -41,16 +41,16 @@ spec:
- pg_tde - pg_tde
pg_hba: pg_hba:
- local all postgres trust - local all postgres trust
- local all prole scram-sha-256 - local all knoe scram-sha-256
- host all postgres all scram-sha-256 - host all postgres all scram-sha-256
- host prole knoe-db all scram-sha-256 - host knoe knoe-db all scram-sha-256
- host all all all scram-sha-256 - host all all all scram-sha-256
- hostssl prole knoe-db all scram-sha-256 - hostssl knoe knoe-db all scram-sha-256
bootstrap: bootstrap:
initdb: initdb:
database: knoe-db database: knoe-db
owner: prole owner: knoe
localeCollate: 'en_US.utf8' localeCollate: 'en_US.utf8'
localeCType: 'en_US.utf8' localeCType: 'en_US.utf8'
secret: secret:
@ -59,7 +59,7 @@ spec:
- CREATE EXTENSION IF NOT EXISTS pg_stat_statements; - CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
postInitSQL: postInitSQL:
- DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'knoe') THEN CREATE ROLE knoe LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT; END IF; END $do$; - DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'knoe') THEN CREATE ROLE knoe LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT; END IF; END $do$;
- DO $do$ DECLARE owner_password text; BEGIN SELECT rolpassword INTO owner_password FROM pg_authid WHERE rolname = 'prole'; IF owner_password IS NOT NULL THEN EXECUTE format('ALTER ROLE knoe PASSWORD %L', owner_password); END IF; END $do$; - DO $do$ DECLARE owner_password text; BEGIN SELECT rolpassword INTO owner_password FROM pg_authid WHERE rolname = 'knoe'; IF owner_password IS NOT NULL THEN EXECUTE format('ALTER ROLE knoe PASSWORD %L', owner_password); END IF; END $do$;
- DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'knoe_catalog_executor') THEN CREATE ROLE knoe_catalog_executor NOLOGIN; END IF; END $do$; - DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'knoe_catalog_executor') THEN CREATE ROLE knoe_catalog_executor NOLOGIN; END IF; END $do$;
- CREATE SCHEMA IF NOT EXISTS knoe AUTHORIZATION knoe; - CREATE SCHEMA IF NOT EXISTS knoe AUTHORIZATION knoe;
- ALTER SCHEMA knoe OWNER TO knoe; - ALTER SCHEMA knoe OWNER TO knoe;
@ -72,12 +72,12 @@ spec:
- ALTER SCHEMA topology OWNER TO knoe; - ALTER SCHEMA topology OWNER TO knoe;
- CREATE EXTENSION IF NOT EXISTS vector SCHEMA knoe; - CREATE EXTENSION IF NOT EXISTS vector SCHEMA knoe;
- CREATE EXTENSION IF NOT EXISTS tds_fdw SCHEMA knoe; - CREATE EXTENSION IF NOT EXISTS tds_fdw SCHEMA knoe;
- GRANT USAGE ON SCHEMA knoe TO prole; - GRANT USAGE ON SCHEMA knoe TO knoe;
- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA knoe TO prole; - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA knoe TO knoe;
- GRANT USAGE ON SCHEMA knoe TO knoe_catalog_executor; - GRANT USAGE ON SCHEMA knoe TO knoe_catalog_executor;
- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA knoe TO knoe_catalog_executor; - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA knoe TO knoe_catalog_executor;
- ALTER DEFAULT PRIVILEGES FOR ROLE knoe IN SCHEMA knoe GRANT EXECUTE ON FUNCTIONS TO knoe_catalog_executor; - ALTER DEFAULT PRIVILEGES FOR ROLE knoe IN SCHEMA knoe GRANT EXECUTE ON FUNCTIONS TO knoe_catalog_executor;
- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA topology TO prole; - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA topology TO knoe;
- CREATE SCHEMA IF NOT EXISTS storage; - CREATE SCHEMA IF NOT EXISTS storage;
- CREATE SCHEMA IF NOT EXISTS graphql_public; - CREATE SCHEMA IF NOT EXISTS graphql_public;
- DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'anon') THEN CREATE ROLE anon NOLOGIN; END IF; END $do$; - DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'anon') THEN CREATE ROLE anon NOLOGIN; END IF; END $do$;
@ -94,9 +94,9 @@ spec:
# knoe.user — identity registry (Knoey Users) # knoe.user — identity registry (Knoey Users)
- CREATE TABLE IF NOT EXISTS knoe.user (id SERIAL PRIMARY KEY, username TEXT NOT NULL UNIQUE, realm TEXT NOT NULL DEFAULT 'PROLE.LOCAL', email TEXT, display_name TEXT, tenant_realm TEXT, is_realm_admin BOOLEAN DEFAULT false, created_at TIMESTAMPTZ DEFAULT now(), updated_at TIMESTAMPTZ DEFAULT now()); - CREATE TABLE IF NOT EXISTS knoe.user (id SERIAL PRIMARY KEY, username TEXT NOT NULL UNIQUE, realm TEXT NOT NULL DEFAULT 'PROLE.LOCAL', email TEXT, display_name TEXT, tenant_realm TEXT, is_realm_admin BOOLEAN DEFAULT false, created_at TIMESTAMPTZ DEFAULT now(), updated_at TIMESTAMPTZ DEFAULT now());
- CREATE TABLE IF NOT EXISTS knoe.user_role (user_id INT NOT NULL REFERENCES knoe.user(id) ON DELETE CASCADE, role TEXT NOT NULL, granted_at TIMESTAMPTZ DEFAULT now(), PRIMARY KEY (user_id, role)); - CREATE TABLE IF NOT EXISTS knoe.user_role (user_id INT NOT NULL REFERENCES knoe.user(id) ON DELETE CASCADE, role TEXT NOT NULL, granted_at TIMESTAMPTZ DEFAULT now(), PRIMARY KEY (user_id, role));
- GRANT SELECT, INSERT, UPDATE ON knoe.user TO prole; - GRANT SELECT, INSERT, UPDATE ON knoe.user TO knoe;
- GRANT SELECT, INSERT, UPDATE ON knoe.user_role TO prole; - GRANT SELECT, INSERT, UPDATE ON knoe.user_role TO knoe;
- GRANT USAGE, SELECT ON SEQUENCE knoe.user_id_seq TO prole; - GRANT USAGE, SELECT ON SEQUENCE knoe.user_id_seq TO knoe;
managed: managed:
roles: roles:

2
deploy/gcp/gke/namespace.yaml
View File

@ -3,4 +3,4 @@ kind: Namespace
metadata: metadata:
name: knoe-db-0 name: knoe-db-0
labels: labels:
app.kubernetes.io/managed-by: prole-installer app.kubernetes.io/managed-by: knoe-installer

50
deploy/gcp/terraform/cloud-setup.auto.tfvars
View File

@ -10,7 +10,7 @@ module.cs-folders-level-1["Team 1/Production"].ids["Production"] and rename to
module.cs-folders-level-1["Team 1/Prod"].ids["Prod"] module.cs-folders-level-1["Team 1/Prod"].ids["Prod"]
*/ */
folders = { folders = {
"prole-db" : { "knoe-db" : {
"infrastructure" : { "infrastructure" : {
"Production" : {}, "Production" : {},
"Non-Production" : {}, "Non-Production" : {},
@ -79,51 +79,51 @@ folders = {
} }
cmek_autokey_folders = [ cmek_autokey_folders = [
{ {
"folder_path" : "prole-db/infrastructure/Production", "folder_path" : "knoe-db/infrastructure/Production",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/infrastructure/Non-Production", "folder_path" : "knoe-db/infrastructure/Non-Production",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/infrastructure/Development", "folder_path" : "knoe-db/infrastructure/Development",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/app/Production", "folder_path" : "knoe-db/app/Production",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/app/Non-Production", "folder_path" : "knoe-db/app/Non-Production",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/app/Development", "folder_path" : "knoe-db/app/Development",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/client/Production", "folder_path" : "knoe-db/client/Production",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/client/Non-Production", "folder_path" : "knoe-db/client/Non-Production",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/client/Development", "folder_path" : "knoe-db/client/Development",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/eng/Production", "folder_path" : "knoe-db/eng/Production",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/eng/Non-Production", "folder_path" : "knoe-db/eng/Non-Production",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
"folder_path" : "prole-db/eng/Development", "folder_path" : "knoe-db/eng/Development",
"key_project_name" : "kms-key-project", "key_project_name" : "kms-key-project",
}, },
{ {
@ -224,18 +224,18 @@ cmek_autokey_folders = [
}, },
] ]
application_enabled_folder_paths = [ application_enabled_folder_paths = [
"prole-db/infrastructure/Production", "knoe-db/infrastructure/Production",
"prole-db/infrastructure/Non-Production", "knoe-db/infrastructure/Non-Production",
"prole-db/infrastructure/Development", "knoe-db/infrastructure/Development",
"prole-db/app/Production", "knoe-db/app/Production",
"prole-db/app/Non-Production", "knoe-db/app/Non-Production",
"prole-db/app/Development", "knoe-db/app/Development",
"prole-db/client/Production", "knoe-db/client/Production",
"prole-db/client/Non-Production", "knoe-db/client/Non-Production",
"prole-db/client/Development", "knoe-db/client/Development",
"prole-db/eng/Production", "knoe-db/eng/Production",
"prole-db/eng/Non-Production", "knoe-db/eng/Non-Production",
"prole-db/eng/Development", "knoe-db/eng/Development",
"frobozzRobotics/infrastructure/Production", "frobozzRobotics/infrastructure/Production",
"frobozzRobotics/infrastructure/Non-Production", "frobozzRobotics/infrastructure/Non-Production",
"frobozzRobotics/infrastructure/Development", "frobozzRobotics/infrastructure/Development",

8
deploy/gcp/terraform/groups.tf
View File

@ -5,7 +5,7 @@ module "cs-gg-knoe-db-infrastr-prod-svc" {
source = "terraform-google-modules/group/google" source = "terraform-google-modules/group/google"
version = "~> 0.6" version = "~> 0.6"
id = "knoe-db-infrastr-prod-svc@prole.org" id = "knoe-db-infrastr-prod-svc@knoe.org"
display_name = "knoe-db-infrastr-prod-svc" display_name = "knoe-db-infrastr-prod-svc"
customer_id = data.google_organization.org.directory_customer_id customer_id = data.google_organization.org.directory_customer_id
types = [ types = [
@ -18,7 +18,7 @@ module "cs-gg-knoe-db-infrastr-nonprod-svc" {
source = "terraform-google-modules/group/google" source = "terraform-google-modules/group/google"
version = "~> 0.6" version = "~> 0.6"
id = "knoe-db-infrastr-nonprod-svc@prole.org" id = "knoe-db-infrastr-nonprod-svc@knoe.org"
display_name = "knoe-db-infrastr-nonprod-svc" display_name = "knoe-db-infrastr-nonprod-svc"
customer_id = data.google_organization.org.directory_customer_id customer_id = data.google_organization.org.directory_customer_id
types = [ types = [
@ -31,7 +31,7 @@ module "cs-gg-knoe-db-app-prod-svc" {
source = "terraform-google-modules/group/google" source = "terraform-google-modules/group/google"
version = "~> 0.6" version = "~> 0.6"
id = "knoe-db-app-prod-svc@prole.org" id = "knoe-db-app-prod-svc@knoe.org"
display_name = "knoe-db-app-prod-svc" display_name = "knoe-db-app-prod-svc"
customer_id = data.google_organization.org.directory_customer_id customer_id = data.google_organization.org.directory_customer_id
types = [ types = [
@ -44,7 +44,7 @@ module "cs-gg-knoe-db-app-nonprod-svc" {
source = "terraform-google-modules/group/google" source = "terraform-google-modules/group/google"
version = "~> 0.6" version = "~> 0.6"
id = "knoe-db-app-nonprod-svc@prole.org" id = "knoe-db-app-nonprod-svc@knoe.org"
display_name = "knoe-db-app-nonprod-svc" display_name = "knoe-db-app-nonprod-svc"
customer_id = data.google_organization.org.directory_customer_id customer_id = data.google_organization.org.directory_customer_id
types = [ types = [

118
deploy/gcp/terraform/iam.tf
View File

@ -7,7 +7,7 @@ module "cs-folders-iam-0-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -21,7 +21,7 @@ module "cs-folders-iam-0-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -35,7 +35,7 @@ module "cs-folders-iam-1-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -49,7 +49,7 @@ module "cs-folders-iam-1-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -63,7 +63,7 @@ module "cs-folders-iam-2-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -77,7 +77,7 @@ module "cs-folders-iam-2-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -91,7 +91,7 @@ module "cs-folders-iam-3-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -105,7 +105,7 @@ module "cs-folders-iam-3-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -119,7 +119,7 @@ module "cs-folders-iam-4-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -133,7 +133,7 @@ module "cs-folders-iam-4-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -147,7 +147,7 @@ module "cs-folders-iam-5-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -161,7 +161,7 @@ module "cs-folders-iam-5-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -175,7 +175,7 @@ module "cs-folders-iam-6-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -189,7 +189,7 @@ module "cs-folders-iam-6-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -203,7 +203,7 @@ module "cs-folders-iam-7-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -217,7 +217,7 @@ module "cs-folders-iam-7-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -231,7 +231,7 @@ module "cs-folders-iam-8-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -245,7 +245,7 @@ module "cs-folders-iam-8-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -259,7 +259,7 @@ module "cs-folders-iam-9-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -273,7 +273,7 @@ module "cs-folders-iam-9-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -287,7 +287,7 @@ module "cs-folders-iam-10-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -301,7 +301,7 @@ module "cs-folders-iam-10-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -315,7 +315,7 @@ module "cs-folders-iam-11-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -329,7 +329,7 @@ module "cs-folders-iam-11-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -343,7 +343,7 @@ module "cs-folders-iam-12-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -357,7 +357,7 @@ module "cs-folders-iam-12-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -371,7 +371,7 @@ module "cs-folders-iam-13-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -385,7 +385,7 @@ module "cs-folders-iam-13-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -399,7 +399,7 @@ module "cs-folders-iam-14-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -413,7 +413,7 @@ module "cs-folders-iam-14-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -427,7 +427,7 @@ module "cs-folders-iam-15-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -441,7 +441,7 @@ module "cs-folders-iam-15-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -455,7 +455,7 @@ module "cs-folders-iam-16-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -469,7 +469,7 @@ module "cs-folders-iam-16-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -483,7 +483,7 @@ module "cs-folders-iam-17-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -497,7 +497,7 @@ module "cs-folders-iam-17-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -511,7 +511,7 @@ module "cs-folders-iam-18-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -525,7 +525,7 @@ module "cs-folders-iam-18-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -539,7 +539,7 @@ module "cs-folders-iam-19-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -553,7 +553,7 @@ module "cs-folders-iam-19-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -567,7 +567,7 @@ module "cs-folders-iam-20-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -581,7 +581,7 @@ module "cs-folders-iam-20-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -595,7 +595,7 @@ module "cs-folders-iam-21-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -609,7 +609,7 @@ module "cs-folders-iam-21-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -623,7 +623,7 @@ module "cs-folders-iam-22-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -637,7 +637,7 @@ module "cs-folders-iam-22-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -651,7 +651,7 @@ module "cs-folders-iam-23-computeinstanceAdminv1" {
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -665,7 +665,7 @@ module "cs-folders-iam-23-containeradmin" {
] ]
bindings = { bindings = {
"roles/container.admin" = [ "roles/container.admin" = [
"group:gcp-developers@prole.org", "group:gcp-developers@knoe.org",
] ]
} }
} }
@ -679,7 +679,7 @@ module "cs-projects-iam-24-loggingviewer" {
] ]
bindings = { bindings = {
"roles/logging.viewer" = [ "roles/logging.viewer" = [
"group:gcp-logging-monitoring-viewers@prole.org", "group:gcp-logging-monitoring-viewers@knoe.org",
] ]
} }
} }
@ -693,7 +693,7 @@ module "cs-projects-iam-24-loggingprivateLogViewer" {
] ]
bindings = { bindings = {
"roles/logging.privateLogViewer" = [ "roles/logging.privateLogViewer" = [
"group:gcp-logging-monitoring-viewers@prole.org", "group:gcp-logging-monitoring-viewers@knoe.org",
] ]
} }
} }
@ -707,7 +707,7 @@ module "cs-projects-iam-24-bigquerydataViewer" {
] ]
bindings = { bindings = {
"roles/bigquery.dataViewer" = [ "roles/bigquery.dataViewer" = [
"group:gcp-logging-monitoring-viewers@prole.org", "group:gcp-logging-monitoring-viewers@knoe.org",
] ]
} }
} }
@ -721,7 +721,7 @@ module "cs-projects-iam-24-pubsubviewer" {
] ]
bindings = { bindings = {
"roles/pubsub.viewer" = [ "roles/pubsub.viewer" = [
"group:gcp-logging-monitoring-viewers@prole.org", "group:gcp-logging-monitoring-viewers@knoe.org",
] ]
} }
} }
@ -735,7 +735,7 @@ module "cs-projects-iam-24-monitoringviewer" {
] ]
bindings = { bindings = {
"roles/monitoring.viewer" = [ "roles/monitoring.viewer" = [
"group:gcp-logging-monitoring-viewers@prole.org", "group:gcp-logging-monitoring-viewers@knoe.org",
] ]
} }
} }
@ -749,7 +749,7 @@ module "cs-projects-iam-25-bigquerydataViewer" {
] ]
bindings = { bindings = {
"roles/bigquery.dataViewer" = [ "roles/bigquery.dataViewer" = [
"group:gcp-security-admins@prole.org", "group:gcp-security-admins@knoe.org",
] ]
} }
} }
@ -763,7 +763,7 @@ module "cs-projects-iam-25-pubsubviewer" {
] ]
bindings = { bindings = {
"roles/pubsub.viewer" = [ "roles/pubsub.viewer" = [
"group:gcp-security-admins@prole.org", "group:gcp-security-admins@knoe.org",
] ]
} }
} }
@ -773,7 +773,7 @@ module "cs-service-projects-iam-26-computeinstanceAdminv1" {
version = "~> 8.0" version = "~> 8.0"
projects = [ projects = [
module.cs-svc-prole--infras-prod-svc-a4ci.project_id, module.cs-svc-knoe--infras-prod-svc-a4ci.project_id,
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
@ -787,7 +787,7 @@ module "cs-service-projects-iam-27-computeinstanceAdminv1" {
version = "~> 8.0" version = "~> 8.0"
projects = [ projects = [
module.cs-svc-prole--infras-nonprod-svc-a4ci.project_id, module.cs-svc-knoe--infras-nonprod-svc-a4ci.project_id,
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
@ -801,7 +801,7 @@ module "cs-service-projects-iam-28-computeinstanceAdminv1" {
version = "~> 8.0" version = "~> 8.0"
projects = [ projects = [
module.cs-svc-prole--app-prod-svc-a4ci.project_id, module.cs-svc-knoe--app-prod-svc-a4ci.project_id,
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [
@ -815,7 +815,7 @@ module "cs-service-projects-iam-29-computeinstanceAdminv1" {
version = "~> 8.0" version = "~> 8.0"
projects = [ projects = [
module.cs-svc-prole--app-nonprod-svc-a4ci.project_id, module.cs-svc-knoe--app-nonprod-svc-a4ci.project_id,
] ]
bindings = { bindings = {
"roles/compute.instanceAdmin.v1" = [ "roles/compute.instanceAdmin.v1" = [

2
deploy/gcp/terraform/log-export.tf
View File

@ -20,7 +20,7 @@ module "cs-logging-destination" {
version = "~> 11.0" version = "~> 11.0"
project_id = module.cs-project-logging-monitoring.project_id project_id = module.cs-project-logging-monitoring.project_id
name = "prole-logging" name = "knoe-logging"
location = "global" location = "global"
retention_days = 30 retention_days = 30
log_sink_writer_identity = module.cs-logsink-logbucketsink.writer_identity log_sink_writer_identity = module.cs-logsink-logbucketsink.writer_identity

8
deploy/gcp/terraform/monitoring.tf
View File

@ -2,10 +2,10 @@ resource "google_monitoring_monitored_project" "cs-monitored-projects" {
for_each = toset([ for_each = toset([
module.cs-project-vpc-host-prod.project_id, module.cs-project-vpc-host-prod.project_id,
module.cs-project-vpc-host-nonprod.project_id, module.cs-project-vpc-host-nonprod.project_id,
module.cs-svc-prole--infras-prod-svc-a4ci.project_id, module.cs-svc-knoe--infras-prod-svc-a4ci.project_id,
module.cs-svc-prole--infras-nonprod-svc-a4ci.project_id, module.cs-svc-knoe--infras-nonprod-svc-a4ci.project_id,
module.cs-svc-prole--app-prod-svc-a4ci.project_id, module.cs-svc-knoe--app-prod-svc-a4ci.project_id,
module.cs-svc-prole--app-nonprod-svc-a4ci.project_id, module.cs-svc-knoe--app-nonprod-svc-a4ci.project_id,
]) ])
metrics_scope = "locations/global/metricsScopes/${module.cs-project-logging-monitoring.project_id}" metrics_scope = "locations/global/metricsScopes/${module.cs-project-logging-monitoring.project_id}"
name = each.value name = each.value

2
deploy/gcp/terraform/org-policy.tf
View File

@ -13,7 +13,7 @@ module "cs-org-policy-essentialcontacts_allowedContactDomains" {
{ {
enforcement = null enforcement = null
allow = [ allow = [
"@prole.org", "@knoe.org",
] ]
deny = [] deny = []
conditions = [] conditions = []

16
deploy/gcp/terraform/service-projects.tf
View File

@ -1,9 +1,9 @@
module "cs-svc-prole--infras-prod-svc-a4ci" { module "cs-svc-knoe--infras-prod-svc-a4ci" {
source = "terraform-google-modules/project-factory/google//modules/svpc_service_project" source = "terraform-google-modules/project-factory/google//modules/svpc_service_project"
version = "~> 18.0" version = "~> 18.0"
name = "knoe-db-infrastr-prod-svc" name = "knoe-db-infrastr-prod-svc"
project_id = "prole--infras-prod-svc-a4ci" project_id = "knoe--infras-prod-svc-a4ci"
org_id = var.org_id org_id = var.org_id
billing_account = var.billing_account billing_account = var.billing_account
folder_id = local.folder_map["knoe-db/infrastructure/Production"].id folder_id = local.folder_map["knoe-db/infrastructure/Production"].id
@ -25,12 +25,12 @@ module "cs-svc-prole--infras-prod-svc-a4ci" {
] ]
} }
module "cs-svc-prole--infras-nonprod-svc-a4ci" { module "cs-svc-knoe--infras-nonprod-svc-a4ci" {
source = "terraform-google-modules/project-factory/google//modules/svpc_service_project" source = "terraform-google-modules/project-factory/google//modules/svpc_service_project"
version = "~> 18.0" version = "~> 18.0"
name = "knoe-db-infrastr-nonprod-svc" name = "knoe-db-infrastr-nonprod-svc"
project_id = "prole--infras-nonprod-svc-a4ci" project_id = "knoe--infras-nonprod-svc-a4ci"
org_id = var.org_id org_id = var.org_id
billing_account = var.billing_account billing_account = var.billing_account
folder_id = local.folder_map["knoe-db/infrastructure/Non-Production"].id folder_id = local.folder_map["knoe-db/infrastructure/Non-Production"].id
@ -47,12 +47,12 @@ module "cs-svc-prole--infras-nonprod-svc-a4ci" {
] ]
} }
module "cs-svc-prole--app-prod-svc-a4ci" { module "cs-svc-knoe--app-prod-svc-a4ci" {
source = "terraform-google-modules/project-factory/google//modules/svpc_service_project" source = "terraform-google-modules/project-factory/google//modules/svpc_service_project"
version = "~> 18.0" version = "~> 18.0"
name = "knoe-db-app-prod-svc" name = "knoe-db-app-prod-svc"
project_id = "prole--app-prod-svc-a4ci" project_id = "knoe--app-prod-svc-a4ci"
org_id = var.org_id org_id = var.org_id
billing_account = var.billing_account billing_account = var.billing_account
folder_id = local.folder_map["knoe-db/app/Production"].id folder_id = local.folder_map["knoe-db/app/Production"].id
@ -69,12 +69,12 @@ module "cs-svc-prole--app-prod-svc-a4ci" {
] ]
} }
module "cs-svc-prole--app-nonprod-svc-a4ci" { module "cs-svc-knoe--app-nonprod-svc-a4ci" {
source = "terraform-google-modules/project-factory/google//modules/svpc_service_project" source = "terraform-google-modules/project-factory/google//modules/svpc_service_project"
version = "~> 18.0" version = "~> 18.0"
name = "knoe-db-app-nonprod-svc" name = "knoe-db-app-nonprod-svc"
project_id = "prole--app-nonprod-svc-a4ci" project_id = "knoe--app-nonprod-svc-a4ci"
org_id = var.org_id org_id = var.org_id
billing_account = var.billing_account billing_account = var.billing_account
folder_id = local.folder_map["knoe-db/app/Non-Production"].id folder_id = local.folder_map["knoe-db/app/Non-Production"].id

2
deploy/gcp/terraform/vpn.tf
View File

@ -40,7 +40,7 @@ module "cs-prod-prod-us-west1-gateway" {
network = module.cs-vpc-prod-shared.network_self_link network = module.cs-vpc-prod-shared.network_self_link
stack_type = "IPV4_IPV6" stack_type = "IPV4_IPV6"
peer_external_gateway = { peer_external_gateway = {
name = "svc-prole-org" name = "svc-knoe-org"
redundancy_type = "TWO_IPS_REDUNDANCY" redundancy_type = "TWO_IPS_REDUNDANCY"
interfaces = [ interfaces = [
{ {

4
deploy/opentofu/k3s/README.md
View File

@ -1,6 +1,6 @@
# OpenTofu k3s Pipeline # OpenTofu k3s Pipeline
This pipeline re-deploys the Prole environment into a k3s cluster using OpenTofu. This pipeline re-deploys the Knoe environment into a k3s cluster using OpenTofu.
## Usage ## Usage
@ -18,5 +18,5 @@ tofu apply
- `main.tf`: Applies Kubernetes manifests with the configured namespace. - `main.tf`: Applies Kubernetes manifests with the configured namespace.
- `variables.tf`: Pipeline inputs (server URL, token, namespace). - `variables.tf`: Pipeline inputs (server URL, token, namespace).
- `opentofu.auto.tfvars`: Auto-generated values from Prole install/config. - `opentofu.auto.tfvars`: Auto-generated values from Knoe install/config.
- `manifests/`: Copy of `k8s/` manifests to re-deploy. - `manifests/`: Copy of `k8s/` manifests to re-deploy.

6
deploy/opentofu/k3s/argocd/application-db.yaml
View File

@ -1,16 +1,16 @@
apiVersion: argoproj.io/v1alpha1 apiVersion: argoproj.io/v1alpha1
kind: Application kind: Application
metadata: metadata:
name: prole-db name: knoe-db
namespace: argocd namespace: argocd
spec: spec:
project: default project: default
source: source:
repoURL: git@github.com:dredx/prole.git repoURL: git@github.com:dredx/knoe.git
targetRevision: main targetRevision: main
path: deploy/opentofu/k3s/manifests/db path: deploy/opentofu/k3s/manifests/db
destination: destination:
server: https://myrddin.prole.org:6443 server: https://myrddin.knoe.org:6443
namespace: knoe-db namespace: knoe-db
syncPolicy: syncPolicy:
automated: automated:

6
deploy/opentofu/k3s/argocd/application-opentofu.yaml
View File

@ -1,16 +1,16 @@
apiVersion: argoproj.io/v1alpha1 apiVersion: argoproj.io/v1alpha1
kind: Application kind: Application
metadata: metadata:
name: prole-opentofu name: knoe-opentofu
namespace: argocd namespace: argocd
spec: spec:
project: default project: default
source: source:
repoURL: git@github.com:dredx/prole.git repoURL: git@github.com:dredx/knoe.git
targetRevision: main targetRevision: main
path: deploy/opentofu/k3s/manifests/opentofu path: deploy/opentofu/k3s/manifests/opentofu
destination: destination:
server: https://myrddin.prole.org:6443 server: https://myrddin.knoe.org:6443
namespace: knoe-db namespace: knoe-db
syncPolicy: syncPolicy:
automated: automated:

8
deploy/opentofu/k3s/argocd/application-prole.yaml
View File

@ -1,16 +1,16 @@
apiVersion: argoproj.io/v1alpha1 apiVersion: argoproj.io/v1alpha1
kind: Application kind: Application
metadata: metadata:
name: prole-prole name: knoe-knoe
namespace: argocd namespace: argocd
spec: spec:
project: default project: default
source: source:
repoURL: git@github.com:dredx/prole.git repoURL: git@github.com:dredx/knoe.git
targetRevision: main targetRevision: main
path: deploy/opentofu/k3s/manifests/prole path: deploy/opentofu/k3s/manifests/knoe
destination: destination:
server: https://myrddin.prole.org:6443 server: https://myrddin.knoe.org:6443
namespace: knoe-system namespace: knoe-system
syncPolicy: syncPolicy:
automated: automated:

6
deploy/opentofu/k3s/manifests/db/kustomization.yaml
View File

@ -2,6 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ../prole/knoe-db-barman-objectstore.yaml - ../knoe/knoe-db-barman-objectstore.yaml
- ../prole/knoe-db.yaml - ../knoe/knoe-db.yaml
- ../prole/knoe-db-postgres-service.yaml - ../knoe/knoe-db-postgres-service.yaml

2
deploy/opentofu/k3s/manifests/prole/dashboard-ingress.yaml → deploy/opentofu/k3s/manifests/knoe/dashboard-ingress.yaml
View File

@ -7,7 +7,7 @@ metadata:
kubernetes.io/ingress.class: traefik kubernetes.io/ingress.class: traefik
spec: spec:
rules: rules:
- host: dashboard.prole.org - host: dashboard.knoe.org
http: http:
paths: paths:
- path: / - path: /

0
deploy/opentofu/k3s/manifests/prole/garage-configmap.yaml → deploy/opentofu/k3s/manifests/knoe/garage-configmap.yaml
View File

0
deploy/opentofu/k3s/manifests/prole/garage-service.yaml → deploy/opentofu/k3s/manifests/knoe/garage-service.yaml
View File

2
deploy/opentofu/k3s/manifests/prole/garage-statefulset.yaml → deploy/opentofu/k3s/manifests/knoe/garage-statefulset.yaml
View File

@ -16,7 +16,7 @@ spec:
app: garage app: garage
spec: spec:
nodeSelector: nodeSelector:
kubernetes.io/hostname: myrddin.prole.org kubernetes.io/hostname: myrddin.knoe.org
containers: containers:
- name: garage - name: garage
image: dxflrs/garage:v1.3.1 image: dxflrs/garage:v1.3.1

16
deploy/opentofu/k3s/manifests/prole/grafana-proxy-configmap.yaml → deploy/opentofu/k3s/manifests/knoe/grafana-proxy-configmap.yaml
View File

@ -1,7 +1,7 @@
apiVersion: v1 apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: prole-grafana-proxy-nginx name: knoe-grafana-proxy-nginx
data: data:
nginx.conf: | nginx.conf: |
worker_processes 1; worker_processes 1;
@ -18,11 +18,11 @@ data:
# Never trust inbound auth headers from clients. # Never trust inbound auth headers from clients.
proxy_set_header X-WEBAUTH-USER ""; proxy_set_header X-WEBAUTH-USER "";
proxy_set_header X-Prole-Groups ""; proxy_set_header X-Knoe-Groups "";
location = /_auth_verify { location = /_auth_verify {
internal; internal;
proxy_pass http://prole-auth:8080/auth/verify; proxy_pass http://knoe-auth:8080/auth/verify;
proxy_pass_request_body off; proxy_pass_request_body off;
proxy_set_header Content-Length ""; proxy_set_header Content-Length "";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@ -32,14 +32,14 @@ data:
location / { location / {
auth_request /_auth_verify; auth_request /_auth_verify;
auth_request_set $prole_user $upstream_http_x_prole_user; auth_request_set $knoe_user $upstream_http_x_knoe_user;
auth_request_set $prole_groups $upstream_http_x_prole_groups; auth_request_set $knoe_groups $upstream_http_x_knoe_groups;
error_page 401 = @login; error_page 401 = @login;
error_page 403 = @login; error_page 403 = @login;
proxy_set_header X-WEBAUTH-USER $prole_user; proxy_set_header X-WEBAUTH-USER $knoe_user;
proxy_set_header X-Prole-Groups $prole_groups; proxy_set_header X-Knoe-Groups $knoe_groups;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
@ -52,7 +52,7 @@ data:
} }
location @login { location @login {
return 302 https://api.prole.org/auth/login?next=$scheme://$host$request_uri; return 302 https://api.knoe.org/auth/login?next=$scheme://$host$request_uri;
} }
} }
} }

10
deploy/opentofu/k3s/manifests/prole/grafana-proxy-deployment.yaml → deploy/opentofu/k3s/manifests/knoe/grafana-proxy-deployment.yaml
View File

@ -1,18 +1,18 @@
apiVersion: apps/v1 apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
name: prole-grafana-proxy name: knoe-grafana-proxy
labels: labels:
app: prole-grafana-proxy app: knoe-grafana-proxy
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
app: prole-grafana-proxy app: knoe-grafana-proxy
template: template:
metadata: metadata:
labels: labels:
app: prole-grafana-proxy app: knoe-grafana-proxy
spec: spec:
containers: containers:
- name: nginx - name: nginx
@ -27,4 +27,4 @@ spec:
volumes: volumes:
- name: nginx-config - name: nginx-config
configMap: configMap:
name: prole-grafana-proxy-nginx name: knoe-grafana-proxy-nginx

6
deploy/opentofu/k3s/manifests/prole/grafana-proxy-service.yaml → deploy/opentofu/k3s/manifests/knoe/grafana-proxy-service.yaml
View File

@ -1,12 +1,12 @@
apiVersion: v1 apiVersion: v1
kind: Service kind: Service
metadata: metadata:
name: prole-grafana-proxy name: knoe-grafana-proxy
labels: labels:
app: prole-grafana-proxy app: knoe-grafana-proxy
spec: spec:
selector: selector:
app: prole-grafana-proxy app: knoe-grafana-proxy
ports: ports:
- name: http - name: http
port: 80 port: 80

16
deploy/opentofu/k3s/manifests/prole/ingress.yaml → deploy/opentofu/k3s/manifests/knoe/ingress.yaml
View File

@ -1,29 +1,29 @@
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
metadata: metadata:
name: prole-ingress name: knoe-ingress
annotations: annotations:
kubernetes.io/ingress.class: traefik kubernetes.io/ingress.class: traefik
spec: spec:
rules: rules:
- host: git.prole.org - host: git.knoe.org
http: http:
paths: paths:
- path: / - path: /
pathType: Prefix pathType: Prefix
backend: backend:
service: service:
name: prole name: knoe
port: port:
number: 443 number: 443
- host: api.prole.org - host: api.knoe.org
http: http:
paths: paths:
- path: / - path: /
pathType: Prefix pathType: Prefix
backend: backend:
service: service:
name: prole name: knoe
port: port:
number: 443 number: 443
--- ---
@ -36,7 +36,7 @@ metadata:
kubernetes.io/ingress.class: traefik kubernetes.io/ingress.class: traefik
spec: spec:
rules: rules:
- host: dashboard.prole.org - host: dashboard.knoe.org
http: http:
paths: paths:
- path: / - path: /
@ -56,7 +56,7 @@ metadata:
kubernetes.io/ingress.class: traefik kubernetes.io/ingress.class: traefik
spec: spec:
rules: rules:
- host: db.prole.org - host: db.knoe.org
http: http:
paths: paths:
- path: / - path: /
@ -66,7 +66,7 @@ spec:
name: kong name: kong
port: port:
number: 8000 number: 8000
- host: supabase.prole.org - host: supabase.knoe.org
http: http:
paths: paths:
- path: / - path: /

20
deploy/opentofu/k3s/manifests/prole/iscsi-pvs.yaml → deploy/opentofu/k3s/manifests/knoe/iscsi-pvs.yaml
View File

@ -22,7 +22,7 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- myrddin.prole.org - myrddin.knoe.org
--- ---
apiVersion: v1 apiVersion: v1
kind: PersistentVolume kind: PersistentVolume
@ -48,7 +48,7 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- myrddin.prole.org - myrddin.knoe.org
--- ---
apiVersion: v1 apiVersion: v1
kind: PersistentVolume kind: PersistentVolume
@ -74,7 +74,7 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- myrddin.prole.org - myrddin.knoe.org
--- ---
apiVersion: v1 apiVersion: v1
kind: PersistentVolume kind: PersistentVolume
@ -100,7 +100,7 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- merlin.prole.org - merlin.knoe.org
--- ---
apiVersion: v1 apiVersion: v1
kind: PersistentVolume kind: PersistentVolume
@ -126,7 +126,7 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- merlin.prole.org - merlin.knoe.org
--- ---
apiVersion: v1 apiVersion: v1
kind: PersistentVolume kind: PersistentVolume
@ -152,7 +152,7 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- pi.prole.org - pi.knoe.org
--- ---
apiVersion: v1 apiVersion: v1
kind: PersistentVolume kind: PersistentVolume
@ -178,7 +178,7 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- pi.prole.org - pi.knoe.org
--- ---
apiVersion: v1 apiVersion: v1
kind: PersistentVolume kind: PersistentVolume
@ -204,7 +204,7 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- pi.prole.org - pi.knoe.org
--- ---
apiVersion: v1 apiVersion: v1
kind: PersistentVolume kind: PersistentVolume
@ -230,7 +230,7 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- merlin.prole.org - merlin.knoe.org
--- ---
apiVersion: v1 apiVersion: v1
kind: PersistentVolume kind: PersistentVolume
@ -256,4 +256,4 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- myrddin.prole.org - myrddin.knoe.org

0
deploy/opentofu/k3s/manifests/prole/knoe-db-barman-objectstore.yaml → deploy/opentofu/k3s/manifests/knoe/knoe-db-barman-objectstore.yaml
View File

0
deploy/opentofu/k3s/manifests/prole/knoe-db-postgres-service.yaml → deploy/opentofu/k3s/manifests/knoe/knoe-db-postgres-service.yaml
View File

22
deploy/opentofu/k3s/manifests/prole/knoe-db.yaml → deploy/opentofu/k3s/manifests/knoe/knoe-db.yaml
View File

@ -41,17 +41,17 @@ spec:
- pg_tde - pg_tde
pg_hba: pg_hba:
- local all postgres trust - local all postgres trust
- local all prole scram-sha-256 - local all knoe scram-sha-256
# SCRAM auth — Kerberos/GSS rules omitted (kerberos_enabled=false on k3s) # SCRAM auth — Kerberos/GSS rules omitted (kerberos_enabled=false on k3s)
- host all postgres all scram-sha-256 - host all postgres all scram-sha-256
- host prole knoe-db all scram-sha-256 - host knoe knoe-db all scram-sha-256
- host all all all scram-sha-256 - host all all all scram-sha-256
- hostssl prole knoe-db all scram-sha-256 - hostssl knoe knoe-db all scram-sha-256
bootstrap: bootstrap:
initdb: initdb:
database: knoe-db database: knoe-db
owner: prole owner: knoe
localeCollate: 'en_US.utf8' localeCollate: 'en_US.utf8'
localeCType: 'en_US.utf8' localeCType: 'en_US.utf8'
secret: secret:
@ -61,13 +61,13 @@ spec:
postInitSQL: postInitSQL:
- CREATE EXTENSION IF NOT EXISTS pg_tde; - CREATE EXTENSION IF NOT EXISTS pg_tde;
- CREATE EXTENSION IF NOT EXISTS pgcrypto; - CREATE EXTENSION IF NOT EXISTS pgcrypto;
- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO prole; - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO knoe;
- CREATE EXTENSION IF NOT EXISTS postgis; - CREATE EXTENSION IF NOT EXISTS postgis;
- CREATE EXTENSION IF NOT EXISTS postgis_topology; - CREATE EXTENSION IF NOT EXISTS postgis_topology;
- CREATE EXTENSION IF NOT EXISTS vector; - CREATE EXTENSION IF NOT EXISTS vector;
- CREATE EXTENSION IF NOT EXISTS tds_fdw; - CREATE EXTENSION IF NOT EXISTS tds_fdw;
- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO prole; - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO knoe;
- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA topology TO prole; - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA topology TO knoe;
- CREATE SCHEMA IF NOT EXISTS storage; - CREATE SCHEMA IF NOT EXISTS storage;
- CREATE SCHEMA IF NOT EXISTS graphql_public; - CREATE SCHEMA IF NOT EXISTS graphql_public;
- CREATE ROLE anon NOLOGIN; - CREATE ROLE anon NOLOGIN;
@ -87,13 +87,13 @@ spec:
- ALTER SCHEMA knoe OWNER TO knoe; - ALTER SCHEMA knoe OWNER TO knoe;
- REVOKE ALL ON SCHEMA knoe FROM PUBLIC; - REVOKE ALL ON SCHEMA knoe FROM PUBLIC;
- ALTER ROLE knoe SET search_path TO knoe, public; - ALTER ROLE knoe SET search_path TO knoe, public;
- GRANT USAGE ON SCHEMA knoe TO prole; - GRANT USAGE ON SCHEMA knoe TO knoe;
# knoe.user — identity registry (Knoey Users) # knoe.user — identity registry (Knoey Users)
- CREATE TABLE IF NOT EXISTS knoe.user (id SERIAL PRIMARY KEY, username TEXT NOT NULL UNIQUE, realm TEXT NOT NULL DEFAULT 'PROLE.LOCAL', email TEXT, display_name TEXT, tenant_realm TEXT, is_realm_admin BOOLEAN DEFAULT false, created_at TIMESTAMPTZ DEFAULT now(), updated_at TIMESTAMPTZ DEFAULT now()); - CREATE TABLE IF NOT EXISTS knoe.user (id SERIAL PRIMARY KEY, username TEXT NOT NULL UNIQUE, realm TEXT NOT NULL DEFAULT 'PROLE.LOCAL', email TEXT, display_name TEXT, tenant_realm TEXT, is_realm_admin BOOLEAN DEFAULT false, created_at TIMESTAMPTZ DEFAULT now(), updated_at TIMESTAMPTZ DEFAULT now());
- CREATE TABLE IF NOT EXISTS knoe.user_role (user_id INT NOT NULL REFERENCES knoe.user(id) ON DELETE CASCADE, role TEXT NOT NULL, granted_at TIMESTAMPTZ DEFAULT now(), PRIMARY KEY (user_id, role)); - CREATE TABLE IF NOT EXISTS knoe.user_role (user_id INT NOT NULL REFERENCES knoe.user(id) ON DELETE CASCADE, role TEXT NOT NULL, granted_at TIMESTAMPTZ DEFAULT now(), PRIMARY KEY (user_id, role));
- GRANT SELECT, INSERT, UPDATE ON knoe.user TO prole; - GRANT SELECT, INSERT, UPDATE ON knoe.user TO knoe;
- GRANT SELECT, INSERT, UPDATE ON knoe.user_role TO prole; - GRANT SELECT, INSERT, UPDATE ON knoe.user_role TO knoe;
- GRANT USAGE, SELECT ON SEQUENCE knoe.user_id_seq TO prole; - GRANT USAGE, SELECT ON SEQUENCE knoe.user_id_seq TO knoe;
managed: managed:
roles: roles:

18
deploy/opentofu/k3s/manifests/prole/kong-configmap.yaml → deploy/opentofu/k3s/manifests/knoe/kong-configmap.yaml
View File

@ -1,7 +1,7 @@
apiVersion: v1 apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: prole-svc-kong-config name: knoe-svc-kong-config
annotations: annotations:
argocd.argoproj.io/sync-wave: "0" argocd.argoproj.io/sync-wave: "0"
data: data:
@ -10,12 +10,12 @@ data:
_transform: true _transform: true
services: services:
- name: prole-service - name: knoe-service
url: http://prole-svc.knoe-system.svc.cluster.local:8080 url: http://knoe-svc.knoe-system.svc.cluster.local:8080
routes: routes:
- name: prole-k3s-kubeconfig - name: knoe-k3s-kubeconfig
hosts: hosts:
- svc.prole.org - svc.knoe.org
paths: paths:
- /k3s/kube_config.sh - /k3s/kube_config.sh
strip_path: false strip_path: false
@ -25,7 +25,7 @@ data:
routes: routes:
- name: backup-route - name: backup-route
hosts: hosts:
- svc.prole.org - svc.knoe.org
paths: paths:
- /backup - /backup
strip_path: false strip_path: false
@ -35,7 +35,7 @@ data:
routes: routes:
- name: grafana-root - name: grafana-root
hosts: hosts:
- svc.prole.org - svc.knoe.org
paths: paths:
- / - /
strip_path: false strip_path: false
@ -45,7 +45,7 @@ data:
routes: routes:
- name: knoe-auth-root - name: knoe-auth-root
hosts: hosts:
- api.prole.org - api.knoe.org
paths: paths:
- / - /
strip_path: false strip_path: false
@ -55,7 +55,7 @@ data:
routes: routes:
- name: gitea-root - name: gitea-root
hosts: hosts:
- git.prole.org - git.knoe.org
paths: paths:
- / - /
strip_path: false strip_path: false

16
deploy/opentofu/k3s/manifests/prole/kong-deployment.yaml → deploy/opentofu/k3s/manifests/knoe/kong-deployment.yaml
View File

@ -1,31 +1,31 @@
apiVersion: apps/v1 apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
name: prole-svc-kong name: knoe-svc-kong
annotations: annotations:
argocd.argoproj.io/sync-wave: "1" argocd.argoproj.io/sync-wave: "1"
labels: labels:
app: prole-svc-kong app: knoe-svc-kong
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
app: prole-svc-kong app: knoe-svc-kong
template: template:
metadata: metadata:
labels: labels:
app: prole-svc-kong app: knoe-svc-kong
spec: spec:
affinity: affinity:
nodeAffinity: nodeAffinity:
# Never schedule on pi.prole.org — pihole-FTL owns ports 80/443 there # Never schedule on pi.knoe.org — pihole-FTL owns ports 80/443 there
requiredDuringSchedulingIgnoredDuringExecution: requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms: nodeSelectorTerms:
- matchExpressions: - matchExpressions:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: NotIn operator: NotIn
values: values:
- pi.prole.org - pi.knoe.org
preferredDuringSchedulingIgnoredDuringExecution: preferredDuringSchedulingIgnoredDuringExecution:
- weight: 80 - weight: 80
preference: preference:
@ -33,7 +33,7 @@ spec:
- key: kubernetes.io/hostname - key: kubernetes.io/hostname
operator: In operator: In
values: values:
- gandalf.prole.org - gandalf.knoe.org
containers: containers:
- name: kong - name: kong
image: kong:3.9 image: kong:3.9
@ -85,4 +85,4 @@ spec:
volumes: volumes:
- name: kong-config - name: kong-config
configMap: configMap:
name: prole-svc-kong-config name: knoe-svc-kong-config

6
deploy/opentofu/k3s/manifests/prole/kong-service.yaml → deploy/opentofu/k3s/manifests/knoe/kong-service.yaml
View File

@ -1,14 +1,14 @@
apiVersion: v1 apiVersion: v1
kind: Service kind: Service
metadata: metadata:
name: prole-svc-kong name: knoe-svc-kong
annotations: annotations:
argocd.argoproj.io/sync-wave: "1" argocd.argoproj.io/sync-wave: "1"
labels: labels:
app: prole-svc-kong app: knoe-svc-kong
spec: spec:
selector: selector:
app: prole-svc-kong app: knoe-svc-kong
ports: ports:
- name: proxy - name: proxy
port: 8000 port: 8000

14
deploy/opentofu/k3s/manifests/prole/kustomization.yaml → deploy/opentofu/k3s/manifests/knoe/kustomization.yaml
View File

@ -5,13 +5,13 @@ resources:
- garage-configmap.yaml - garage-configmap.yaml
- garage-statefulset.yaml - garage-statefulset.yaml
- garage-service.yaml - garage-service.yaml
- prole-configmap.yaml - knoe-configmap.yaml
- prole-deployment.yaml - knoe-deployment.yaml
- prole-service.yaml - knoe-service.yaml
- prole-auth-deployment.yaml - knoe-auth-deployment.yaml
- prole-auth-service.yaml - knoe-auth-service.yaml
- prole-auth-kerberos-configmap.yaml - knoe-auth-kerberos-configmap.yaml
- prole-kdc-configmap.yaml - knoe-kdc-configmap.yaml
- grafana-proxy-configmap.yaml - grafana-proxy-configmap.yaml
- grafana-proxy-deployment.yaml - grafana-proxy-deployment.yaml
- grafana-proxy-service.yaml - grafana-proxy-service.yaml

0
deploy/opentofu/k3s/manifests/prole/openbao-service.yaml → deploy/opentofu/k3s/manifests/knoe/openbao-service.yaml
View File

2
deploy/opentofu/k3s/manifests/prole/openbao-statefulset.yaml → deploy/opentofu/k3s/manifests/knoe/openbao-statefulset.yaml
View File

@ -16,7 +16,7 @@ spec:
app: openbao app: openbao
spec: spec:
nodeSelector: nodeSelector:
kubernetes.io/hostname: myrddin.prole.org kubernetes.io/hostname: myrddin.knoe.org
containers: containers:
- name: openbao - name: openbao
image: ghcr.io/openbao/openbao:2.0.0 image: ghcr.io/openbao/openbao:2.0.0

94
deploy/opentofu/k3s/manifests/prole/prole-auth-deployment.yaml → deploy/opentofu/k3s/manifests/knoe/prole-auth-deployment.yaml
View File

@ -1,22 +1,22 @@
apiVersion: apps/v1 apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
name: prole-auth name: knoe-auth
labels: labels:
app: prole-auth app: knoe-auth
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
app: prole-auth app: knoe-auth
template: template:
metadata: metadata:
labels: labels:
app: prole-auth app: knoe-auth
spec: spec:
initContainers: initContainers:
- name: keytab-bootstrap - name: keytab-bootstrap
image: myrddin.prole.org:5000/prole-authority:latest image: myrddin.knoe.org:5000/knoe-authority:latest
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: command:
- /bin/bash - /bin/bash
@ -36,7 +36,7 @@ spec:
svc_principal="${svc_principal}@${realm}" svc_principal="${svc_principal}@${realm}"
fi fi
keytab_out="/etc/prole/keytabs/http.keytab" keytab_out="/etc/knoe/keytabs/http.keytab"
mkdir -p "$(dirname "${keytab_out}")" mkdir -p "$(dirname "${keytab_out}")"
if [[ -f /mnt/keytab-secret/http.keytab ]]; then if [[ -f /mnt/keytab-secret/http.keytab ]]; then
@ -56,22 +56,22 @@ spec:
fi fi
mkdir -p /etc/krb5kdc /var/lib/krb5kdc mkdir -p /etc/krb5kdc /var/lib/krb5kdc
if [[ -f /opt/prole-kdc/krb5.conf ]]; then if [[ -f /opt/knoe-kdc/krb5.conf ]]; then
cp /opt/prole-kdc/krb5.conf /etc/krb5.conf cp /opt/knoe-kdc/krb5.conf /etc/krb5.conf
fi fi
if [[ -f /opt/prole-kdc/kdc.conf ]]; then if [[ -f /opt/knoe-kdc/kdc.conf ]]; then
cp /opt/prole-kdc/kdc.conf /etc/krb5kdc/kdc.conf cp /opt/knoe-kdc/kdc.conf /etc/krb5kdc/kdc.conf
fi fi
if [[ -f /opt/prole-kdc/kadm5.acl ]]; then if [[ -f /opt/knoe-kdc/kadm5.acl ]]; then
cp /opt/prole-kdc/kadm5.acl /etc/krb5kdc/kadm5.acl cp /opt/knoe-kdc/kadm5.acl /etc/krb5kdc/kadm5.acl
fi fi
if [[ -z "${PROLE_KDC_MASTER_PASSWORD:-}" ]]; then if [[ -z "${PROLE_KDC_MASTER_PASSWORD:-}" ]]; then
echo "ERROR: Missing required env PROLE_KDC_MASTER_PASSWORD (secret 'prole-kdc-secrets/master_password')." >&2 echo "ERROR: Missing required env PROLE_KDC_MASTER_PASSWORD (secret 'knoe-kdc-secrets/master_password')." >&2
exit 1 exit 1
fi fi
if [[ -z "${PROLE_KDC_ADMIN_PASSWORD:-}" ]]; then if [[ -z "${PROLE_KDC_ADMIN_PASSWORD:-}" ]]; then
echo "ERROR: Missing required env PROLE_KDC_ADMIN_PASSWORD (secret 'prole-kdc-secrets/admin_password')." >&2 echo "ERROR: Missing required env PROLE_KDC_ADMIN_PASSWORD (secret 'knoe-kdc-secrets/admin_password')." >&2
exit 1 exit 1
fi fi
@ -96,40 +96,40 @@ spec:
- name: PROLE_KDC_REALM - name: PROLE_KDC_REALM
valueFrom: valueFrom:
configMapKeyRef: configMapKeyRef:
name: prole-auth-kerberos name: knoe-auth-kerberos
key: realm key: realm
- name: PROLE_KDC_ADMIN_PRINCIPAL - name: PROLE_KDC_ADMIN_PRINCIPAL
value: "admin/admin" value: "admin/admin"
- name: PROLE_KDC_MASTER_PASSWORD - name: PROLE_KDC_MASTER_PASSWORD
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: prole-kdc-secrets name: knoe-kdc-secrets
key: master_password key: master_password
- name: PROLE_KDC_ADMIN_PASSWORD - name: PROLE_KDC_ADMIN_PASSWORD
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: prole-kdc-secrets name: knoe-kdc-secrets
key: admin_password key: admin_password
- name: PROLE_KERBEROS_SERVICE_PRINCIPAL - name: PROLE_KERBEROS_SERVICE_PRINCIPAL
valueFrom: valueFrom:
configMapKeyRef: configMapKeyRef:
name: prole-auth-kerberos name: knoe-auth-kerberos
key: servicePrincipal key: servicePrincipal
volumeMounts: volumeMounts:
- name: keytab - name: keytab
mountPath: /etc/prole/keytabs mountPath: /etc/knoe/keytabs
- name: keytab-secret - name: keytab-secret
mountPath: /mnt/keytab-secret mountPath: /mnt/keytab-secret
readOnly: true readOnly: true
- name: prole-kdc-config - name: knoe-kdc-config
mountPath: /opt/prole-kdc mountPath: /opt/knoe-kdc
- name: prole-kdc-data - name: knoe-kdc-data
mountPath: /var/lib/krb5kdc mountPath: /var/lib/krb5kdc
- name: prole-kdc-data - name: knoe-kdc-data
mountPath: /etc/krb5kdc mountPath: /etc/krb5kdc
containers: containers:
- name: prole-auth - name: knoe-auth
image: prole-auth:latest image: knoe-auth:latest
ports: ports:
- containerPort: 8080 - containerPort: 8080
name: http name: http
@ -139,25 +139,25 @@ spec:
- name: PROLE_AUTH_COOKIE_DOMAIN - name: PROLE_AUTH_COOKIE_DOMAIN
valueFrom: valueFrom:
configMapKeyRef: configMapKeyRef:
name: prole-platform-config name: knoe-platform-config
key: authCookieDomain key: authCookieDomain
optional: true optional: true
- name: PROLE_AUTH_SESSION_SECRET - name: PROLE_AUTH_SESSION_SECRET
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: prole-auth-secrets name: knoe-auth-secrets
key: sessionSecret key: sessionSecret
- name: PROLE_KERBEROS_SERVICE_PRINCIPAL - name: PROLE_KERBEROS_SERVICE_PRINCIPAL
valueFrom: valueFrom:
configMapKeyRef: configMapKeyRef:
name: prole-auth-kerberos name: knoe-auth-kerberos
key: servicePrincipal key: servicePrincipal
- name: PROLE_KERBEROS_KEYTAB_PATH - name: PROLE_KERBEROS_KEYTAB_PATH
value: "/etc/prole/keytabs/http.keytab" value: "/etc/knoe/keytabs/http.keytab"
- name: PROLE_KERBEROS_REALM - name: PROLE_KERBEROS_REALM
valueFrom: valueFrom:
configMapKeyRef: configMapKeyRef:
name: prole-auth-kerberos name: knoe-auth-kerberos
key: realm key: realm
# ── Google Workspace OIDC (primary auth for GKE/prod) ────────── # ── Google Workspace OIDC (primary auth for GKE/prod) ──────────
# Secret created by installer from Auth+Routing tab OIDC fields. # Secret created by installer from Auth+Routing tab OIDC fields.
@ -187,7 +187,7 @@ spec:
- name: OIDC_BASE_URL - name: OIDC_BASE_URL
valueFrom: valueFrom:
configMapKeyRef: configMapKeyRef:
name: prole-platform-config name: knoe-platform-config
key: frontdoorHost key: frontdoorHost
optional: true optional: true
# Comma-separated list of bare usernames granted admin group in OIDC tokens # Comma-separated list of bare usernames granted admin group in OIDC tokens
@ -195,38 +195,38 @@ spec:
value: "admin" value: "admin"
volumeMounts: volumeMounts:
- name: keytab - name: keytab
mountPath: /etc/prole/keytabs mountPath: /etc/knoe/keytabs
readOnly: true readOnly: true
- name: prole-kdc-config - name: knoe-kdc-config
mountPath: /etc/krb5.conf mountPath: /etc/krb5.conf
subPath: krb5.conf subPath: krb5.conf
readOnly: true readOnly: true
- name: kdc - name: kdc
image: myrddin.prole.org:5000/prole-authority:latest image: myrddin.knoe.org:5000/knoe-authority:latest
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: ["/bin/bash", "/opt/prole-kdc/entrypoint.sh"] command: ["/bin/bash", "/opt/knoe-kdc/entrypoint.sh"]
env: env:
- name: PROLE_KDC_REALM - name: PROLE_KDC_REALM
valueFrom: valueFrom:
configMapKeyRef: configMapKeyRef:
name: prole-auth-kerberos name: knoe-auth-kerberos
key: realm key: realm
- name: PROLE_KDC_ADMIN_PRINCIPAL - name: PROLE_KDC_ADMIN_PRINCIPAL
value: "admin/admin" value: "admin/admin"
- name: PROLE_KDC_MASTER_PASSWORD - name: PROLE_KDC_MASTER_PASSWORD
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: prole-kdc-secrets name: knoe-kdc-secrets
key: master_password key: master_password
- name: PROLE_KDC_ADMIN_PASSWORD - name: PROLE_KDC_ADMIN_PASSWORD
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: prole-kdc-secrets name: knoe-kdc-secrets
key: admin_password key: admin_password
- name: PROLE_KDC_GUEST_PASSWORD - name: PROLE_KDC_GUEST_PASSWORD
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: prole-kdc-secrets name: knoe-kdc-secrets
key: guest_password key: guest_password
optional: true # auto-generated by init_knoe_users.sh if absent optional: true # auto-generated by init_knoe_users.sh if absent
ports: ports:
@ -246,22 +246,22 @@ spec:
containerPort: 749 containerPort: 749
protocol: TCP protocol: TCP
volumeMounts: volumeMounts:
- name: prole-kdc-config - name: knoe-kdc-config
mountPath: /opt/prole-kdc mountPath: /opt/knoe-kdc
- name: prole-kdc-data - name: knoe-kdc-data
mountPath: /var/lib/krb5kdc mountPath: /var/lib/krb5kdc
- name: prole-kdc-data - name: knoe-kdc-data
mountPath: /etc/krb5kdc mountPath: /etc/krb5kdc
volumes: volumes:
- name: keytab - name: keytab
emptyDir: {} emptyDir: {}
- name: keytab-secret - name: keytab-secret
secret: secret:
secretName: prole-auth-keytab secretName: knoe-auth-keytab
optional: true optional: true
- name: prole-kdc-config - name: knoe-kdc-config
configMap: configMap:
name: prole-kdc-config name: knoe-kdc-config
defaultMode: 0755 defaultMode: 0755
- name: prole-kdc-data - name: knoe-kdc-data
emptyDir: {} emptyDir: {}

4
deploy/opentofu/k3s/manifests/prole/prole-auth-kerberos-configmap.yaml → deploy/opentofu/k3s/manifests/knoe/prole-auth-kerberos-configmap.yaml
View File

@ -1,8 +1,8 @@
apiVersion: v1 apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: prole-auth-kerberos name: knoe-auth-kerberos
data: data:
# Kerberos HTTP service principal for SPNEGO (must match keytab) # Kerberos HTTP service principal for SPNEGO (must match keytab)
servicePrincipal: "HTTP/api.prole.org@PROLE.LOCAL" servicePrincipal: "HTTP/api.knoe.org@PROLE.LOCAL"
realm: "PROLE.LOCAL" realm: "PROLE.LOCAL"

2
deploy/opentofu/k3s/manifests/prole/prole-auth-secrets.example.yaml → deploy/opentofu/k3s/manifests/knoe/prole-auth-secrets.example.yaml
View File

@ -2,7 +2,7 @@
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
name: prole-auth-secrets name: knoe-auth-secrets
type: Opaque type: Opaque
stringData: stringData:
# Strong random value (e.g. 32+ bytes). Used to HMAC-sign session cookies. # Strong random value (e.g. 32+ bytes). Used to HMAC-sign session cookies.

6
deploy/opentofu/k3s/manifests/prole/prole-auth-service.yaml → deploy/opentofu/k3s/manifests/knoe/prole-auth-service.yaml
View File

@ -1,12 +1,12 @@
apiVersion: v1 apiVersion: v1
kind: Service kind: Service
metadata: metadata:
name: prole-auth name: knoe-auth
labels: labels:
app: prole-auth app: knoe-auth
spec: spec:
selector: selector:
app: prole-auth app: knoe-auth
ports: ports:
- name: http - name: http
port: 8080 port: 8080

2
k8s/prole/prole-configmap.yaml → deploy/opentofu/k3s/manifests/knoe/prole-configmap.yaml
View File

@ -1,7 +1,7 @@
apiVersion: v1 apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: prole-nginx-config name: knoe-nginx-config
data: data:
nginx.conf: | nginx.conf: |
user nginx; user nginx;

16
k8s/prole/prole-deployment.yaml → deploy/opentofu/k3s/manifests/knoe/prole-deployment.yaml
View File

@ -1,21 +1,21 @@
apiVersion: apps/v1 apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
name: prole name: knoe
labels: labels:
app: prole app: knoe
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
app: prole app: knoe
template: template:
metadata: metadata:
labels: labels:
app: prole app: knoe
spec: spec:
nodeSelector: nodeSelector:
kubernetes.io/hostname: myrddin.prole.org kubernetes.io/hostname: myrddin.knoe.org
containers: containers:
- name: nginx - name: nginx
image: nginx:1.27-alpine image: nginx:1.27-alpine
@ -41,10 +41,10 @@ spec:
volumes: volumes:
- name: nginx-config - name: nginx-config
configMap: configMap:
name: prole-nginx-config name: knoe-nginx-config
- name: tls - name: tls
secret: secret:
secretName: prole-nginx-tls secretName: knoe-nginx-tls
- name: web-root - name: web-root
configMap: configMap:
name: prole-index-html name: knoe-index-html

22
deploy/opentofu/k3s/manifests/prole/prole-kdc-configmap.yaml → deploy/opentofu/k3s/manifests/knoe/prole-kdc-configmap.yaml
View File

@ -1,7 +1,7 @@
apiVersion: v1 apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: prole-kdc-config name: knoe-kdc-config
data: data:
krb5.conf: | krb5.conf: |
[libdefaults] [libdefaults]
@ -15,8 +15,8 @@ data:
admin_server = 127.0.0.1 admin_server = 127.0.0.1
} }
PROLE.ORG = { PROLE.ORG = {
kdc = myrddin.prole.org kdc = myrddin.knoe.org
admin_server = myrddin.prole.org admin_server = myrddin.knoe.org
} }
[capaths] [capaths]
@ -64,22 +64,22 @@ data:
fi fi
mkdir -p /etc/krb5kdc /var/lib/krb5kdc mkdir -p /etc/krb5kdc /var/lib/krb5kdc
if [[ -f /opt/prole-kdc/krb5.conf ]]; then if [[ -f /opt/knoe-kdc/krb5.conf ]]; then
cp /opt/prole-kdc/krb5.conf /etc/krb5.conf cp /opt/knoe-kdc/krb5.conf /etc/krb5.conf
fi fi
if [[ -f /opt/prole-kdc/kdc.conf ]]; then if [[ -f /opt/knoe-kdc/kdc.conf ]]; then
cp /opt/prole-kdc/kdc.conf /etc/krb5kdc/kdc.conf cp /opt/knoe-kdc/kdc.conf /etc/krb5kdc/kdc.conf
fi fi
if [[ -f /opt/prole-kdc/kadm5.acl ]]; then if [[ -f /opt/knoe-kdc/kadm5.acl ]]; then
cp /opt/prole-kdc/kadm5.acl /etc/krb5kdc/kadm5.acl cp /opt/knoe-kdc/kadm5.acl /etc/krb5kdc/kadm5.acl
fi fi
if [[ -z "${PROLE_KDC_MASTER_PASSWORD:-}" ]]; then if [[ -z "${PROLE_KDC_MASTER_PASSWORD:-}" ]]; then
echo "ERROR: Missing required env PROLE_KDC_MASTER_PASSWORD (secret 'prole-kdc-secrets/master_password')." >&2 echo "ERROR: Missing required env PROLE_KDC_MASTER_PASSWORD (secret 'knoe-kdc-secrets/master_password')." >&2
exit 1 exit 1
fi fi
if [[ -z "${PROLE_KDC_ADMIN_PASSWORD:-}" ]]; then if [[ -z "${PROLE_KDC_ADMIN_PASSWORD:-}" ]]; then
echo "ERROR: Missing required env PROLE_KDC_ADMIN_PASSWORD (secret 'prole-kdc-secrets/admin_password')." >&2 echo "ERROR: Missing required env PROLE_KDC_ADMIN_PASSWORD (secret 'knoe-kdc-secrets/admin_password')." >&2
exit 1 exit 1
fi fi

6
deploy/opentofu/k3s/manifests/prole/prole-kdc-secrets.example.yaml → deploy/opentofu/k3s/manifests/knoe/prole-kdc-secrets.example.yaml
View File

@ -1,15 +1,15 @@
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
name: prole-kdc-secrets name: knoe-kdc-secrets
type: Opaque type: Opaque
stringData: stringData:
# Strong random values (do not commit real secrets) # Strong random values (do not commit real secrets)
master_password: "CHANGE_ME" master_password: "CHANGE_ME"
admin_password: "CHANGE_ME" admin_password: "CHANGE_ME"
# Shared secret used for cross-realm trust with myrddin.prole.org PROLE.ORG realm # Shared secret used for cross-realm trust with myrddin.knoe.org PROLE.ORG realm
trust_shared_password: "CHANGE_ME" trust_shared_password: "CHANGE_ME"
# myrddin.prole.org Samba AD admin password (for reciprocal trust principal creation) # myrddin.knoe.org Samba AD admin password (for reciprocal trust principal creation)
trust_password: "CHANGE_ME" trust_password: "CHANGE_ME"
# Password for guest@PROLE.LOCAL read-only principal (auto-generated by init_knoe_users.sh if absent) # Password for guest@PROLE.LOCAL read-only principal (auto-generated by init_knoe_users.sh if absent)
guest_password: "CHANGE_ME" guest_password: "CHANGE_ME"

6
deploy/opentofu/k3s/manifests/prole/prole-service.yaml → deploy/opentofu/k3s/manifests/knoe/prole-service.yaml
View File

@ -1,12 +1,12 @@
apiVersion: v1 apiVersion: v1
kind: Service kind: Service
metadata: metadata:
name: prole name: knoe
labels: labels:
app: prole app: knoe
spec: spec:
selector: selector:
app: prole app: knoe
ports: ports:
- name: https - name: https
port: 443 port: 443

0
deploy/opentofu/k3s/manifests/prole/storageclass-synology-iscsi.yaml → deploy/opentofu/k3s/manifests/knoe/storageclass-synology-iscsi.yaml
View File

4
deploy/opentofu/k3s/manifests/prole/supabase-ingress.yaml → deploy/opentofu/k3s/manifests/knoe/supabase-ingress.yaml
View File

@ -7,7 +7,7 @@ metadata:
kubernetes.io/ingress.class: traefik kubernetes.io/ingress.class: traefik
spec: spec:
rules: rules:
- host: db.prole.org - host: db.knoe.org
http: http:
paths: paths:
- path: / - path: /
@ -17,7 +17,7 @@ spec:
name: kong name: kong
port: port:
number: 8000 number: 8000
- host: supabase.prole.org - host: supabase.knoe.org
http: http:
paths: paths:
- path: / - path: /

6
deploy/opentofu/k3s/manifests/openbao/kerberos-configmap.yaml
View File

@ -1,7 +1,7 @@
apiVersion: v1 apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: prole-krb5-conf name: knoe-krb5-conf
namespace: default namespace: default
data: data:
krb5.conf: | krb5.conf: |
@ -17,5 +17,5 @@ data:
} }
[domain_realm] [domain_realm]
.prole.org = PROLE.ORG .knoe.org = PROLE.ORG
prole.org = PROLE.ORG knoe.org = PROLE.ORG

4
deploy/opentofu/k3s/manifests/opentofu/deployment.yaml
View File

@ -33,7 +33,7 @@ data:
<body> <body>
<div class="wrap"> <div class="wrap">
<h1>OpenTofu Pipeline Ready</h1> <h1>OpenTofu Pipeline Ready</h1>
<p>This service hosts the OpenTofu control plane for Prole deployments.</p> <p>This service hosts the OpenTofu control plane for Knoe deployments.</p>
<p>Pipeline root (on disk): <code>deploy/opentofu/k3s</code></p> <p>Pipeline root (on disk): <code>deploy/opentofu/k3s</code></p>
</div> </div>
</body> </body>
@ -56,7 +56,7 @@ spec:
app: opentofu app: opentofu
spec: spec:
nodeSelector: nodeSelector:
kubernetes.io/hostname: myrddin.prole.org kubernetes.io/hostname: myrddin.knoe.org
containers: containers:
- name: opentofu-ui - name: opentofu-ui
image: nginx:1.27-alpine image: nginx:1.27-alpine

6
deploy/opentofu/k3s/opentofu.auto.tfvars
View File

@ -1,4 +1,4 @@
k3s_server_url = "https://myrddin.prole.org:6443" k3s_server_url = "https://myrddin.knoe.org:6443"
k3s_token = "K107c8c6000488eca4a067d8a73119bbae2f07b4ea1bac7d8d3dc9c500cbb8acb18::server:04572345810eae2f9619a6ed4239702b" k3s_token = "K107c8c6000488eca4a067d8a73119bbae2f07b4ea1bac7d8d3dc9c500cbb8acb18::server:04572345810eae2f9619a6ed4239702b"
namespace = "prole-db" namespace = "knoe-db"
kubeconfig_path = "../../../prole-k3s.kubeconfig" kubeconfig_path = "../../../knoe-k3s.kubeconfig"

4
deploy/opentofu/k3s/variables.tf
View File

@ -1,6 +1,6 @@
variable "k3s_server_url" { variable "k3s_server_url" {
type = string type = string
description = "K3s API server URL (e.g., https://pi.prole.org:6443)" description = "K3s API server URL (e.g., https://pi.knoe.org:6443)"
} }
variable "k3s_token" { variable "k3s_token" {
@ -18,6 +18,6 @@ variable "kubeconfig_path" {
variable "namespace" { variable "namespace" {
type = string type = string
description = "Target namespace for Prole resources" description = "Target namespace for Knoe resources"
default = "default" default = "default"
} }

2
deploy/opentofu/prod/README.md
View File

@ -1,6 +1,6 @@
# OpenTofu Production Pipeline # OpenTofu Production Pipeline
This pipeline deploys Prole into a production cluster (AWS EKS / GCloud GKE). This pipeline deploys Knoe into a production cluster (AWS EKS / GCloud GKE).
## Usage ## Usage
1. Copy manifests from the k3s pipeline into `manifests/`. 1. Copy manifests from the k3s pipeline into `manifests/`.

2
deploy/opentofu/prod/variables.tf
View File

@ -17,6 +17,6 @@ variable "cluster_ca_cert" {
variable "namespace" { variable "namespace" {
type = string type = string
description = "Target namespace for Prole resources" description = "Target namespace for Knoe resources"
default = "default" default = "default"
} }

36
docs/DOCKER-BUILD-FIX.md
View File

@ -2,7 +2,7 @@
## Problem ## Problem
When the Prole Installer is packaged with PyInstaller and run as a standalone binary, Docker builds fail with the error: When the Knoe Installer is packaged with PyInstaller and run as a standalone binary, Docker builds fail with the error:
``` ```
Building knoe-db:17.7-037 in /var/folders/rt/pywlnmxj3dn7t5552vwdcpp80000gn/T/_MEIGozuj4/knoe-db... Building knoe-db:17.7-037 in /var/folders/rt/pywlnmxj3dn7t5552vwdcpp80000gn/T/_MEIGozuj4/knoe-db...
@ -38,11 +38,11 @@ def worker():
def worker(): def worker():
tag = self.get_knoe_db_version() tag = self.get_knoe_db_version()
# Use $PROLE_HOME/build for Docker build context # Use $KNOE_HOME/build for Docker build context
prole_home = resolve_prole_home() knoe_home = resolve_knoe_home()
# Use a mode-scoped build dir to avoid cross-mode interference (k3d vs k3s) # Use a mode-scoped build dir to avoid cross-mode interference (k3d vs k3s)
mode_key = _deployment_mode_from_env(env_key) or "default" mode_key = _deployment_mode_from_env(env_key) or "default"
build_dir = prole_home / "build" / mode_key / "knoe-db" build_dir = knoe_home / "build" / mode_key / "knoe-db"
build_dir.mkdir(parents=True, exist_ok=True) build_dir.mkdir(parents=True, exist_ok=True)
# Copy DB build context to writable location # Copy DB build context to writable location
@ -66,7 +66,7 @@ def worker():
The installer now creates and uses: The installer now creates and uses:
``` ```
$HOME/.prole/ $HOME/.knoe/
└── build/ └── build/
└── k3d/ # or k3s, k8s └── k3d/ # or k3s, k8s
└── knoe-db/ # Docker build context └── knoe-db/ # Docker build context
@ -74,12 +74,12 @@ $HOME/.prole/
├── conf/ ├── conf/
├── scripts/ ├── scripts/
├── ... ├── ...
└── .prole_build_context_ready # marker to preserve generated Dockerfile └── .knoe_build_context_ready # marker to preserve generated Dockerfile
Version metadata is also mode-scoped: Version metadata is also mode-scoped:
``` ```
$HOME/.prole/ $HOME/.knoe/
└── modes/ └── modes/
└── k3d/ # or k3s, k8s └── k3d/ # or k3s, k8s
├── conf/postgresql/.version ├── conf/postgresql/.version
@ -89,7 +89,7 @@ $HOME/.prole/
## Why This Works ## Why This Works
1. **Writable Location:** `$HOME/.prole/` is user-writable 1. **Writable Location:** `$HOME/.knoe/` is user-writable
2. **Persistent:** Files remain between runs (can be cached) 2. **Persistent:** Files remain between runs (can be cached)
3. **Clean State:** Each build starts fresh (old dir removed) 3. **Clean State:** Each build starts fresh (old dir removed)
4. **Docker Compatible:** Standard directory Docker can access 4. **Docker Compatible:** Standard directory Docker can access
@ -99,7 +99,7 @@ $HOME/.prole/
The `knoe-db` directory is: The `knoe-db` directory is:
- **Included in spec:** `('knoe-db', 'knoe-db')` - **Included in spec:** `('knoe-db', 'knoe-db')`
- **Extracted by PyInstaller:** To `_MEIPASS/knoe-db/` - **Extracted by PyInstaller:** To `_MEIPASS/knoe-db/`
- **Copied to writable location:** `$HOME/.prole/build/<mode>/knoe-db/` - **Copied to writable location:** `$HOME/.knoe/build/<mode>/knoe-db/`
- **Used for build:** Docker builds from writable copy - **Used for build:** Docker builds from writable copy
## Performance ## Performance
@ -125,16 +125,16 @@ python3 install.py --gui
### Test from Package ### Test from Package
```bash ```bash
make package make package
./dist/Prole\ Installer.app/Contents/MacOS/prole-installer --gui ./dist/Knoe\ Installer.app/Contents/MacOS/knoe-installer --gui
# Navigate to "Build Container" screen # Navigate to "Build Container" screen
# Click "Build Database Image" # Click "Build Database Image"
# Should create ~/.prole/build/<mode>/knoe-db and succeed # Should create ~/.knoe/build/<mode>/knoe-db and succeed
``` ```
### Verify Directory Creation ### Verify Directory Creation
```bash ```bash
# After build starts # After build starts
ls -la ~/.prole/build/<mode>/knoe-db/ ls -la ~/.knoe/build/<mode>/knoe-db/
# Should show Dockerfile and other files # Should show Dockerfile and other files
``` ```
@ -143,7 +143,7 @@ ls -la ~/.prole/build/<mode>/knoe-db/
The build directory persists after the installer exits. To clean up: The build directory persists after the installer exits. To clean up:
```bash ```bash
rm -rf ~/.prole/build rm -rf ~/.knoe/build
``` ```
Or include in the installer: Or include in the installer:
@ -151,7 +151,7 @@ Or include in the installer:
```python ```python
def cleanup_build_dirs(): def cleanup_build_dirs():
"""Clean up temporary build directories.""" """Clean up temporary build directories."""
build_dir = Path.home() / ".prole" / "build" build_dir = Path.home() / ".knoe" / "build"
if build_dir.exists(): if build_dir.exists():
shutil.rmtree(build_dir) shutil.rmtree(build_dir)
``` ```
@ -167,7 +167,7 @@ If Docker build still hangs, check:
2. **Docker context accessible:** 2. **Docker context accessible:**
```bash ```bash
ls -la ~/.prole/build/<mode>/knoe-db/Dockerfile ls -la ~/.knoe/build/<mode>/knoe-db/Dockerfile
``` ```
3. **Disk space:** 3. **Disk space:**
@ -186,7 +186,7 @@ If Docker build still hangs, check:
### 1. Use /tmp with Unique Names ### 1. Use /tmp with Unique Names
```python ```python
import tempfile import tempfile
build_dir = Path(tempfile.mkdtemp(prefix="prole-build-")) build_dir = Path(tempfile.mkdtemp(prefix="knoe-build-"))
``` ```
**Pros:** Automatic cleanup **Pros:** Automatic cleanup
**Cons:** Lost between runs, no caching **Cons:** Lost between runs, no caching
@ -205,7 +205,7 @@ cwd = PROJECT_ROOT / "knoe-db"
**Pros:** Works from source **Pros:** Works from source
**Cons:** ✗ Fails from package (_MEIPASS is read-only) **Cons:** ✗ Fails from package (_MEIPASS is read-only)
### 4. **Chosen: Copy to ~/.prole/build** ✓ ### 4. **Chosen: Copy to ~/.knoe/build** ✓
**Pros:** Works from both source and package, writable, persistent **Pros:** Works from both source and package, writable, persistent
**Cons:** Requires disk space, manual cleanup **Cons:** Requires disk space, manual cleanup
@ -249,7 +249,7 @@ cwd = PROJECT_ROOT / "knoe-db"
## Summary ## Summary
The Docker build now works correctly from both source and packaged binary by: The Docker build now works correctly from both source and packaged binary by:
1. Creating `~/.prole/build/<mode>/knoe-db/` directory 1. Creating `~/.knoe/build/<mode>/knoe-db/` directory
2. Copying build context from embedded resources 2. Copying build context from embedded resources
3. Running `docker build` in the writable directory 3. Running `docker build` in the writable directory
4. Avoiding PyInstaller's read-only temporary extraction directory 4. Avoiding PyInstaller's read-only temporary extraction directory

64
docs/EMBEDDED-RESOURCES.md
View File

@ -1,17 +1,17 @@
# Embedded Resources in Prole Installer # Embedded Resources in Knoe Installer
## Overview ## Overview
The Prole Installer package includes several embedded resources that must be accessible both when running from source and when packaged as a standalone binary. The Knoe Installer package includes several embedded resources that must be accessible both when running from source and when packaged as a standalone binary.
## Embedded Resources ## Embedded Resources
### 1. Images (img/) ### 1. Images (img/)
- **proleIcon.png** (1.5 MB) - Application icon - **knoeIcon.png** (1.5 MB) - Application icon
- **proleLogo.png** (2.2 MB) - Main logo - **knoeLogo.png** (2.2 MB) - Main logo
- **proleLogoSepia.png** (2.7 MB) - Sepia background for GUI - **knoeLogoSepia.png** (2.7 MB) - Sepia background for GUI
- **proleLogoBlueprint.png** (3.1 MB) - Blueprint variant - **knoeLogoBlueprint.png** (3.1 MB) - Blueprint variant
- **proleIconblueprint.png** (1.6 MB) - Blueprint icon variant - **knoeIconblueprint.png** (1.6 MB) - Blueprint icon variant
### 2. Binary Executables ### 2. Binary Executables
- **scan/network-agent** (6.8 MB) - Network scanner - **scan/network-agent** (6.8 MB) - Network scanner
@ -20,7 +20,7 @@ The Prole Installer package includes several embedded resources that must be acc
- Detects Kerberos, Active Directory, etc. - Detects Kerberos, Active Directory, etc.
### 3. Application Bundles ### 3. Application Bundles
- **prole-app/dist/Prole Tools.app** (~12 MB) - Pre-built Prole Tools - **knoe-app/dist/Knoe Tools.app** (~12 MB) - Pre-built Knoe Tools
- Complete macOS .app bundle - Complete macOS .app bundle
- Used by installer creation screen - Used by installer creation screen
- Can be copied to DMG or USB installer - Can be copied to DMG or USB installer
@ -47,7 +47,7 @@ def get_resource_path(relative_path):
**Image Loading:** **Image Loading:**
```python ```python
bg_path = get_resource_path('img/proleLogoSepia.png') bg_path = get_resource_path('img/knoeLogoSepia.png')
if bg_path.exists(): if bg_path.exists():
image = Image.open(str(bg_path)) image = Image.open(str(bg_path))
``` ```
@ -61,7 +61,7 @@ if scan_binary.exists():
**App Bundle Access:** **App Bundle Access:**
```python ```python
app_src = get_resource_path('prole-app/dist/Prole Tools.app') app_src = get_resource_path('knoe-app/dist/Knoe Tools.app')
if app_src.exists(): if app_src.exists():
# Copy to destination # Copy to destination
shutil.copytree(app_src, dest) shutil.copytree(app_src, dest)
@ -79,7 +79,7 @@ datas = [
('etc', 'etc'), ('etc', 'etc'),
('img', 'img'), ('img', 'img'),
('docs', 'docs'), ('docs', 'docs'),
('prole-app/dist/Prole Tools.app', 'prole-app/dist/Prole Tools.app'), ('knoe-app/dist/Knoe Tools.app', 'knoe-app/dist/Knoe Tools.app'),
] ]
``` ```
@ -99,7 +99,7 @@ Total embedded resources: ~30-35 MB
Breakdown: Breakdown:
- Images: ~11 MB - Images: ~11 MB
- network-agent: 6.8 MB - network-agent: 6.8 MB
- Prole Tools.app: ~12 MB - Knoe Tools.app: ~12 MB
- Other resources: ~5-10 MB - Other resources: ~5-10 MB
Final installer bundle: ~50-100 MB (includes Python runtime) Final installer bundle: ~50-100 MB (includes Python runtime)
@ -122,12 +122,12 @@ Output is captured in real-time and displayed in the scan results text widget.
### Installer Creation Screen ### Installer Creation Screen
The installer creation screen copies Prole Tools.app to DMG: The installer creation screen copies Knoe Tools.app to DMG:
```python ```python
app_src = get_resource_path('prole-app/dist/Prole Tools.app') app_src = get_resource_path('knoe-app/dist/Knoe Tools.app')
if app_src.exists(): if app_src.exists():
shutil.copytree(app_src, staging / 'Prole Tools.app') shutil.copytree(app_src, staging / 'Knoe Tools.app')
``` ```
## Testing ## Testing
@ -141,7 +141,7 @@ python3 test_embedded_resources.sh
This tests: This tests:
- ✓ All image files exist - ✓ All image files exist
- ✓ network-agent binary exists and is executable - ✓ network-agent binary exists and is executable
- ✓ Prole Tools.app bundle exists - ✓ Knoe Tools.app bundle exists
- ✓ Spec file includes all resources - ✓ Spec file includes all resources
- ✓ Resource sizes - ✓ Resource sizes
@ -151,12 +151,12 @@ After building:
```bash ```bash
# Check extracted resources # Check extracted resources
./dist/prole-installer --help ./dist/knoe-installer --help
# In another terminal, while installer is running: # In another terminal, while installer is running:
ls -la /tmp/_MEI*/scan/ ls -la /tmp/_MEI*/scan/
ls -la /tmp/_MEI*/img/ ls -la /tmp/_MEI*/img/
ls -la "/tmp/_MEI*/prole-app/dist/Prole Tools.app" ls -la "/tmp/_MEI*/knoe-app/dist/Knoe Tools.app"
``` ```
## Troubleshooting ## Troubleshooting
@ -190,13 +190,13 @@ binaries = [
### App Bundle Not Found ### App Bundle Not Found
**Error:** `Prole Tools.app not found` **Error:** `Knoe Tools.app not found`
**Cause:** App not built before packaging installer **Cause:** App not built before packaging installer
**Solution:** **Solution:**
1. Build Prole Tools.app first (in prole-app directory) 1. Build Knoe Tools.app first (in knoe-app directory)
2. Verify it exists: `ls "prole-app/dist/Prole Tools.app"` 2. Verify it exists: `ls "knoe-app/dist/Knoe Tools.app"`
3. Then build installer: `make package` 3. Then build installer: `make package`
### Large Bundle Size ### Large Bundle Size
@ -206,8 +206,8 @@ binaries = [
**Optimization Options:** **Optimization Options:**
1. **Compress app bundle:** 1. **Compress app bundle:**
```bash ```bash
cd prole-app/dist cd knoe-app/dist
zip -r "Prole Tools.zip" "Prole Tools.app" zip -r "Knoe Tools.zip" "Knoe Tools.app"
# Include zip instead of .app # Include zip instead of .app
``` ```
@ -264,7 +264,7 @@ Users can verify embedded binaries:
codesign --verify --verbose /tmp/_MEI*/scan/network-agent codesign --verify --verbose /tmp/_MEI*/scan/network-agent
# Check installer bundle signature # Check installer bundle signature
codesign --verify --verbose "dist/Prole Installer.app" codesign --verify --verbose "dist/Knoe Installer.app"
``` ```
## Future Enhancements ## Future Enhancements
@ -274,12 +274,12 @@ codesign --verify --verbose "dist/Prole Installer.app"
For large resources, consider lazy loading: For large resources, consider lazy loading:
```python ```python
def get_prole_tools_app(): def get_knoe_tools_app():
"""Download or extract Prole Tools.app only when needed.""" """Download or extract Knoe Tools.app only when needed."""
app_path = get_resource_path('prole-app/dist/Prole Tools.app') app_path = get_resource_path('knoe-app/dist/Knoe Tools.app')
if not app_path.exists(): if not app_path.exists():
# Download from server # Download from server
download_prole_tools(app_path) download_knoe_tools(app_path)
return app_path return app_path
``` ```
@ -290,15 +290,15 @@ Compress large resources:
```python ```python
# In spec file # In spec file
datas = [ datas = [
('prole-app/dist/Prole Tools.zip', 'prole-app/dist'), # Compressed ('knoe-app/dist/Knoe Tools.zip', 'knoe-app/dist'), # Compressed
] ]
# In code # In code
def extract_prole_tools(): def extract_knoe_tools():
zip_path = get_resource_path('prole-app/dist/Prole Tools.zip') zip_path = get_resource_path('knoe-app/dist/Knoe Tools.zip')
extract_dir = Path(tempfile.mkdtemp()) extract_dir = Path(tempfile.mkdtemp())
shutil.unpack_archive(zip_path, extract_dir) shutil.unpack_archive(zip_path, extract_dir)
return extract_dir / 'Prole Tools.app' return extract_dir / 'Knoe Tools.app'
``` ```
## References ## References

50
docs/IMAGE-RESOURCES.md
View File

@ -2,21 +2,21 @@
## Overview ## Overview
The Prole Database Installer includes multiple image assets that need to work both when running from source and when packaged as a standalone binary. This document explains how image resources are managed. The Knoe Database Installer includes multiple image assets that need to work both when running from source and when packaged as a standalone binary. This document explains how image resources are managed.
## Image Assets ## Image Assets
The following images are included in the installer: The following images are included in the installer:
### Primary Assets ### Primary Assets
- **proleIcon.png** (1,494,782 bytes) - Application icon - **knoeIcon.png** (1,494,782 bytes) - Application icon
- **proleLogo.png** (2,190,703 bytes) - Main Prole logo - **knoeLogo.png** (2,190,703 bytes) - Main Knoe logo
- **proleLogoSepia.png** (2,657,956 bytes) - Sepia-toned background logo - **knoeLogoSepia.png** (2,657,956 bytes) - Sepia-toned background logo
- **proleLogoBlueprint.png** (3,107,147 bytes) - Blueprint style logo - **knoeLogoBlueprint.png** (3,107,147 bytes) - Blueprint style logo
- **proleIconblueprint.png** (1,570,109 bytes) - Blueprint style icon - **knoeIconblueprint.png** (1,570,109 bytes) - Blueprint style icon
### Supplementary Assets ### Supplementary Assets
- **prole-type.gif** (599 bytes) - Small typing animation - **knoe-type.gif** (599 bytes) - Small typing animation
## Resource Path Resolution ## Resource Path Resolution
@ -49,10 +49,10 @@ All image loading code uses this function:
```python ```python
# Instead of: # Instead of:
bg_path = Path('img/proleLogoSepia.png') bg_path = Path('img/knoeLogoSepia.png')
# Use: # Use:
bg_path = get_resource_path('img/proleLogoSepia.png') bg_path = get_resource_path('img/knoeLogoSepia.png')
``` ```
## Implementation Details ## Implementation Details
@ -63,23 +63,23 @@ The following locations in `install.py` were updated to use `get_resource_path()
1. **Background logo loading** (line ~191) 1. **Background logo loading** (line ~191)
```python ```python
bg_path = get_resource_path('img/proleLogoSepia.png') bg_path = get_resource_path('img/knoeLogoSepia.png')
``` ```
2. **Application icon candidates** (line ~406) 2. **Application icon candidates** (line ~406)
```python ```python
img_candidates = [ img_candidates = [
get_resource_path('img/proleIcon.png'), get_resource_path('img/knoeIcon.png'),
get_resource_path('img/prole-type.png'), get_resource_path('img/knoe-type.png'),
get_resource_path('img/prole-type.gif'), get_resource_path('img/knoe-type.gif'),
get_resource_path('img/Prole.png'), get_resource_path('img/Knoe.png'),
get_resource_path('img/proleLogoSepia.png'), get_resource_path('img/knoeLogoSepia.png'),
] ]
``` ```
3. **DMG background image** (line ~3820) 3. **DMG background image** (line ~3820)
```python ```python
bg_img = get_resource_path('img/proleLogoSepia.png') bg_img = get_resource_path('img/knoeLogoSepia.png')
``` ```
### PyInstaller Configuration ### PyInstaller Configuration
@ -139,7 +139,7 @@ python3 install.py --gui
From built binary: From built binary:
```bash ```bash
make package make package
./dist/Prole\ Installer.app/Contents/MacOS/prole-installer --gui ./dist/Knoe\ Installer.app/Contents/MacOS/knoe-installer --gui
# Check that logo appears in background # Check that logo appears in background
``` ```
@ -148,23 +148,23 @@ make package
### PNG (Source) ### PNG (Source)
- Format: PNG with transparency - Format: PNG with transparency
- Resolution: 1024x1024 recommended - Resolution: 1024x1024 recommended
- Location: `img/proleIcon.png` - Location: `img/knoeIcon.png`
### ICNS (macOS Bundle) ### ICNS (macOS Bundle)
- Generated by build system from PNG - Generated by build system from PNG
- Contains multiple resolutions (16x16 through 1024x1024) - Contains multiple resolutions (16x16 through 1024x1024)
- Location: `build/prole.icns` (intermediate), embedded in `.app` bundle - Location: `build/knoe.icns` (intermediate), embedded in `.app` bundle
- Generated by: `make build/prole.icns` - Generated by: `make build/knoe.icns`
The build system automatically converts PNG to ICNS using macOS tools: The build system automatically converts PNG to ICNS using macOS tools:
```bash ```bash
sips -z 512 512 img/proleIcon.png --out build/icon.iconset/icon_512x512.png sips -z 512 512 img/knoeIcon.png --out build/icon.iconset/icon_512x512.png
iconutil -c icns build/icon.iconset -o build/prole.icns iconutil -c icns build/icon.iconset -o build/knoe.icns
``` ```
## Background Image Usage ## Background Image Usage
The GUI installer uses `proleLogoSepia.png` as a subtle background: The GUI installer uses `knoeLogoSepia.png` as a subtle background:
1. **Loading**: Image loaded via PIL (Pillow) 1. **Loading**: Image loaded via PIL (Pillow)
2. **Processing**: 2. **Processing**:
@ -178,7 +178,7 @@ The GUI installer uses `proleLogoSepia.png` as a subtle background:
Code snippet: Code snippet:
```python ```python
bg_path = get_resource_path('img/proleLogoSepia.png') bg_path = get_resource_path('img/knoeLogoSepia.png')
if bg_path.exists(): if bg_path.exists():
original = Image.open(str(bg_path)).convert('RGBA') original = Image.open(str(bg_path)).convert('RGBA')
white_bg = Image.new('RGBA', original.size, (255, 255, 255, 255)) white_bg = Image.new('RGBA', original.size, (255, 255, 255, 255))
@ -244,7 +244,7 @@ PyInstaller extracts bundled resources to a temporary directory on each launch:
### Memory Usage ### Memory Usage
Images are loaded into memory when displayed: Images are loaded into memory when displayed:
- **proleLogoSepia.png**: ~2.6 MB on disk, ~10 MB in memory (RGBA) - **knoeLogoSepia.png**: ~2.6 MB on disk, ~10 MB in memory (RGBA)
- **Scaled versions**: Additional memory for display size - **Scaled versions**: Additional memory for display size
### Optimization ### Optimization

6
docs/MERLIN-MARIADB-EXTERNAL-TEMP.md
View File

@ -1,6 +1,6 @@
# Merlin: temporary MariaDB storage on borrowed USB (`/external`) # Merlin: temporary MariaDB storage on borrowed USB (`/external`)
This is a temporary, host-specific setup for `merlin.prole.org` to move MariaDB storage off the current path and onto a borrowed USB disk. This is a temporary, host-specific setup for `merlin.knoe.org` to move MariaDB storage off the current path and onto a borrowed USB disk.
## What changed ## What changed
@ -8,7 +8,7 @@ This is a temporary, host-specific setup for `merlin.prole.org` to move MariaDB
- MariaDB data is migrated from `/srv/mariadb/mariadb/` to `/external/mariadb/`. - MariaDB data is migrated from `/srv/mariadb/mariadb/` to `/external/mariadb/`.
- After a successful copy, the original datadir is moved aside to `/srv/mariadb/mariadb.pre-external` (kept for rollback). - After a successful copy, the original datadir is moved aside to `/srv/mariadb/mariadb.pre-external` (kept for rollback).
- `/srv/mariadb/mariadb` is replaced with a **bind mount** of `/external/mariadb` (so MariaDB can keep using the same `datadir` path). - `/srv/mariadb/mariadb` is replaced with a **bind mount** of `/external/mariadb` (so MariaDB can keep using the same `datadir` path).
- A marker file is written to avoid repeating the migration destructively: `/external/mariadb/.prole-mariadb-external-migrated`. - A marker file is written to avoid repeating the migration destructively: `/external/mariadb/.knoe-mariadb-external-migrated`.
## Why this is temporary ## Why this is temporary
@ -84,5 +84,5 @@ sudo systemctl start mariadb
5) Remove/disable the Ansible external-storage configuration: 5) Remove/disable the Ansible external-storage configuration:
- In `infrastructure/inventory/host_vars/merlin.prole.org.yml`, set `mariadb_external_enabled: false` (or remove the `mariadb_external_*` vars). - In `infrastructure/inventory/host_vars/merlin.knoe.org.yml`, set `mariadb_external_enabled: false` (or remove the `mariadb_external_*` vars).
- Re-run the MariaDB provisioning playbook so it removes the persistent mount entries it previously created. - Re-run the MariaDB provisioning playbook so it removes the persistent mount entries it previously created.

38
docs/PROLE-CFG-SECRETS.md
View File

@ -1,44 +1,44 @@
# prole.cfg Secrets # knoe.cfg Secrets
This document describes how secrets are handled in `prole.cfg` and where they are stored in OpenBao. This document describes how secrets are handled in `knoe.cfg` and where they are stored in OpenBao.
## Temporary encrypted values ## Temporary encrypted values
During installation, secrets are written to `prole.cfg` as temporary encrypted values so an interrupted run can resume: During installation, secrets are written to `knoe.cfg` as temporary encrypted values so an interrupted run can resume:
- Format: `${PROLE_SECRET:v1:<nonce_b64>:<ciphertext_b64>}` - Format: `${KNOE_SECRET:v1:<nonce_b64>:<ciphertext_b64>}`
- Encryption: AES‑256‑GCM - Encryption: AES‑256‑GCM
- Key storage: - Key storage:
- macOS: login Keychain (service `prole-installer`) - macOS: login Keychain (service `knoe-installer`)
- Other platforms: `~/.prole/secrets/installer.key` (0600) - Other platforms: `~/.knoe/secrets/installer.key` (0600)
These encrypted values are removed at Post‑Install by running `etc/build-a-bao.sh`. These encrypted values are removed at Post‑Install by running `etc/build-a-bao.sh`.
## OpenBao placeholders ## OpenBao placeholders
After Post‑Install, secrets in `prole.cfg` are replaced with OpenBao placeholders that point to a namespace‑scoped KV path: After Post‑Install, secrets in `knoe.cfg` are replaced with OpenBao placeholders that point to a namespace‑scoped KV path:
- Format: `${OPENBAO:kv/prole/<namespace>/<leaf>#<key>}` - Format: `${OPENBAO:kv/knoe/<namespace>/<leaf>#<key>}`
The namespace comes from `NAMESPACE` in `prole.cfg` and makes the file 1:1 with a single `knoe-db` deployment. The namespace comes from `NAMESPACE` in `knoe.cfg` and makes the file 1:1 with a single `knoe-db` deployment.
## Secrets recorded in prole.cfg ## Secrets recorded in knoe.cfg
The following keys are treated as secrets and stored in OpenBao: The following keys are treated as secrets and stored in OpenBao:
| prole.cfg key | OpenBao KV path | | knoe.cfg key | OpenBao KV path |
| --- | --- | | --- | --- |
| `Inputs.init_password.db_password` | `kv/prole/<namespace>/db#password` | | `Inputs.init_password.db_password` | `kv/knoe/<namespace>/db#password` |
| `Inputs.init_password.db_password_confirm` | `kv/prole/<namespace>/db#password` | | `Inputs.init_password.db_password_confirm` | `kv/knoe/<namespace>/db#password` |
| `Global.DB_PASSWORD` | `kv/prole/<namespace>/db#password` | | `Global.DB_PASSWORD` | `kv/knoe/<namespace>/db#password` |
| `Inputs.kerberos_config.password` | `kv/prole/<namespace>/kerberos#password` | | `Inputs.kerberos_config.password` | `kv/knoe/<namespace>/kerberos#password` |
| `Kerberos Authentication.PASSWORD` | `kv/prole/<namespace>/kerberos#password` | | `Kerberos Authentication.PASSWORD` | `kv/knoe/<namespace>/kerberos#password` |
| `Monitoring.GRAFANA_ADMIN_PASSWORD` | `kv/prole/<namespace>/monitoring#grafana_admin_password` | | `Monitoring.GRAFANA_ADMIN_PASSWORD` | `kv/knoe/<namespace>/monitoring#grafana_admin_password` |
## Post‑Install step ## Post‑Install step
Run the Build‑A‑Bao step on the Post‑Install screen (or `etc/build-a-bao.sh`) to: Run the Build‑A‑Bao step on the Post‑Install screen (or `etc/build-a-bao.sh`) to:
1) Decrypt temporary secrets from `prole.cfg` 1) Decrypt temporary secrets from `knoe.cfg`
2) Write them to OpenBao under the namespace path 2) Write them to OpenBao under the namespace path
3) Replace `prole.cfg` secrets with OpenBao placeholders 3) Replace `knoe.cfg` secrets with OpenBao placeholders

88
docs/PROLE-HOME-DIRECTORY.md
View File

@ -1,13 +1,13 @@
# Prole Home Directory Structure # Knoe Home Directory Structure
## Overview ## Overview
The Prole Installer uses `$PROLE_HOME/` (defaulting to `$HOME/.prole/`) for writable storage when running from a packaged binary. This is necessary because PyInstaller extracts resources to a read-only temporary directory. The Knoe Installer uses `$KNOE_HOME/` (defaulting to `$HOME/.knoe/`) for writable storage when running from a packaged binary. This is necessary because PyInstaller extracts resources to a read-only temporary directory.
## Directory Structure ## Directory Structure
``` ```
$PROLE_HOME/ $KNOE_HOME/
├── build/ # Docker build contexts ├── build/ # Docker build contexts
│ └── knoe-db/ # PostgreSQL Docker build │ └── knoe-db/ # PostgreSQL Docker build
│ ├── Dockerfile │ ├── Dockerfile
@ -27,8 +27,8 @@ $PROLE_HOME/
**Usage:** **Usage:**
```python ```python
prole_home = resolve_prole_home() knoe_home = resolve_knoe_home()
build_dir = prole_home / "build" / "knoe-db" build_dir = knoe_home / "build" / "knoe-db"
build_dir.mkdir(parents=True, exist_ok=True) build_dir.mkdir(parents=True, exist_ok=True)
# Copy build context from embedded resources # Copy build context from embedded resources
@ -50,12 +50,12 @@ subprocess.Popen(['docker', 'build', '-t', 'knoe-db:TAG', '.'], cwd=build_dir)
**Purpose:** Writable working directory for network scan operations **Purpose:** Writable working directory for network scan operations
**Why:** The `prole-agent` binary may need to write output files, cache data, or store temporary results. Running from a read-only directory causes failures. **Why:** The `knoe-agent` binary may need to write output files, cache data, or store temporary results. Running from a read-only directory causes failures.
**Usage:** **Usage:**
```python ```python
prole_home = resolve_prole_home() knoe_home = resolve_knoe_home()
scan_dir = prole_home / "scan" scan_dir = knoe_home / "scan"
scan_dir.mkdir(parents=True, exist_ok=True) scan_dir.mkdir(parents=True, exist_ok=True)
# Run scan with writable cwd # Run scan with writable cwd
@ -65,7 +65,7 @@ subprocess.Popen([str(scan_binary)], cwd=str(scan_dir))
**Contents:** **Contents:**
- Network scan results (temporary) - Network scan results (temporary)
- Ollama API interaction cache - Ollama API interaction cache
- Any intermediate files created by prole-agent - Any intermediate files created by knoe-agent
**Size:** Varies, typically < 1 MB **Size:** Varies, typically < 1 MB
@ -77,18 +77,18 @@ All directories are created automatically when needed:
```python ```python
# Build directory # Build directory
(resolve_prole_home() / "build" / "knoe-db").mkdir(parents=True, exist_ok=True) (resolve_knoe_home() / "build" / "knoe-db").mkdir(parents=True, exist_ok=True)
# Scan directory # Scan directory
(resolve_prole_home() / "scan").mkdir(parents=True, exist_ok=True) (resolve_knoe_home() / "scan").mkdir(parents=True, exist_ok=True)
``` ```
### Manual Cleanup ### Manual Cleanup
To remove all Prole working directories: To remove all Knoe working directories:
```bash ```bash
rm -rf ~/.prole rm -rf ~/.knoe
``` ```
Or from Python: Or from Python:
@ -97,9 +97,9 @@ Or from Python:
import shutil import shutil
from pathlib import Path from pathlib import Path
prole_home = resolve_prole_home() knoe_home = resolve_knoe_home()
if prole_home.exists(): if knoe_home.exists():
shutil.rmtree(prole_home) shutil.rmtree(knoe_home)
``` ```
### Automatic Cleanup (Future) ### Automatic Cleanup (Future)
@ -107,13 +107,13 @@ if prole_home.exists():
Consider adding cleanup options to the installer: Consider adding cleanup options to the installer:
```python ```python
def cleanup_prole_home(): def cleanup_knoe_home():
"""Clean up .prole working directories.""" """Clean up .knoe working directories."""
prole_home = Path.home() / ".prole" knoe_home = Path.home() / ".knoe"
if prole_home.exists(): if knoe_home.exists():
# Keep or remove based on user preference # Keep or remove based on user preference
if messagebox.askyesno("Cleanup", "Remove temporary files?"): if messagebox.askyesno("Cleanup", "Remove temporary files?"):
shutil.rmtree(prole_home) shutil.rmtree(knoe_home)
``` ```
## Disk Space ## Disk Space
@ -135,7 +135,7 @@ def cleanup_prole_home():
### Permission Errors ### Permission Errors
**Error:** `Permission denied` creating `.prole` directory **Error:** `Permission denied` creating `.knoe` directory
**Cause:** Home directory not writable **Cause:** Home directory not writable
@ -154,7 +154,7 @@ chmod u+w ~
**Solution:** **Solution:**
```bash ```bash
df -h ~ df -h ~
rm -rf ~/.prole # Free up space rm -rf ~/.knoe # Free up space
``` ```
### Stale Build Context ### Stale Build Context
@ -173,18 +173,18 @@ shutil.copytree(source_dir, build_dir)
### File Permissions ### File Permissions
The `.prole` directory inherits user's home directory permissions: The `.knoe` directory inherits user's home directory permissions:
```bash ```bash
ls -ld ~/.prole ls -ld ~/.knoe
# drwxr-xr-x user group ~/.prole # drwxr-xr-x user group ~/.knoe
``` ```
Only the user should have write access. Only the user should have write access.
### Sensitive Data ### Sensitive Data
Avoid storing sensitive data in `.prole/`: Avoid storing sensitive data in `.knoe/`:
- ✓ Build contexts (public) - ✓ Build contexts (public)
- ✓ Scan results (network info, semi-sensitive) - ✓ Scan results (network info, semi-sensitive)
- ✗ Passwords, keys, credentials - ✗ Passwords, keys, credentials
@ -195,18 +195,18 @@ If distributing the installer, consider:
1. **Document cleanup:** 1. **Document cleanup:**
``` ```
To completely remove Prole: To completely remove Knoe:
1. Delete the app: rm -rf /Applications/Prole\ Installer.app 1. Delete the app: rm -rf /Applications/Knoe\ Installer.app
2. Clean up data: rm -rf ~/.prole 2. Clean up data: rm -rf ~/.knoe
``` ```
2. **Provide uninstall script:** 2. **Provide uninstall script:**
```bash ```bash
#!/bin/bash #!/bin/bash
# uninstall-prole.sh # uninstall-knoe.sh
rm -rf /Applications/Prole\ Installer.app rm -rf /Applications/Knoe\ Installer.app
rm -rf ~/.prole rm -rf ~/.knoe
echo "Prole uninstalled" echo "Knoe uninstalled"
``` ```
## Related Issues ## Related Issues
@ -215,7 +215,7 @@ If distributing the installer, consider:
**Problem:** Docker build hangs when running from packaged binary **Problem:** Docker build hangs when running from packaged binary
**Solution:** Copy build context to `~/.prole/build/knoe-db/` **Solution:** Copy build context to `~/.knoe/build/knoe-db/`
**See:** [DOCKER-BUILD-FIX.md](DOCKER-BUILD-FIX.md) **See:** [DOCKER-BUILD-FIX.md](DOCKER-BUILD-FIX.md)
@ -223,7 +223,7 @@ If distributing the installer, consider:
**Problem:** Network scan fails to make API calls from packaged binary **Problem:** Network scan fails to make API calls from packaged binary
**Solution:** Run scan with `cwd=~/.prole/scan` **Solution:** Run scan with `cwd=~/.knoe/scan`
**Reason:** Scan binary needs writable directory for output/cache **Reason:** Scan binary needs writable directory for output/cache
@ -234,16 +234,16 @@ If distributing the installer, consider:
**Build directory creation:** `install.py`, `run_db_build()` method (line ~1791) **Build directory creation:** `install.py`, `run_db_build()` method (line ~1791)
```python ```python
prole_home = Path.home() / ".prole" knoe_home = Path.home() / ".knoe"
build_dir = prole_home / "build" / "knoe-db" build_dir = knoe_home / "build" / "knoe-db"
build_dir.mkdir(parents=True, exist_ok=True) build_dir.mkdir(parents=True, exist_ok=True)
``` ```
**Scan directory creation:** `install.py`, network scan worker (line ~1102) **Scan directory creation:** `install.py`, network scan worker (line ~1102)
```python ```python
prole_home = Path.home() / ".prole" knoe_home = Path.home() / ".knoe"
scan_dir = prole_home / "scan" scan_dir = knoe_home / "scan"
scan_dir.mkdir(parents=True, exist_ok=True) scan_dir.mkdir(parents=True, exist_ok=True)
``` ```
@ -269,7 +269,7 @@ def get_resource_path(relative_path):
Store network scan results between runs: Store network scan results between runs:
```python ```python
scan_cache = Path.home() / ".prole" / "scan" / "cache.json" scan_cache = Path.home() / ".knoe" / "scan" / "cache.json"
if scan_cache.exists(): if scan_cache.exists():
# Load previous scan # Load previous scan
results = json.loads(scan_cache.read_text()) results = json.loads(scan_cache.read_text())
@ -284,7 +284,7 @@ else:
Store built Docker images as tarballs: Store built Docker images as tarballs:
```python ```python
image_cache = Path.home() / ".prole" / "build" / "knoe-db-TAG.tar" image_cache = Path.home() / ".knoe" / "build" / "knoe-db-TAG.tar"
if not image_cache.exists(): if not image_cache.exists():
# Build and save # Build and save
subprocess.run(['docker', 'build', '-t', 'knoe-db:TAG', '.']) subprocess.run(['docker', 'build', '-t', 'knoe-db:TAG', '.'])
@ -299,7 +299,7 @@ else:
Store user preferences: Store user preferences:
```python ```python
config_file = Path.home() / ".prole" / "config.json" config_file = Path.home() / ".knoe" / "config.json"
config = { config = {
'cluster_env': 'development', 'cluster_env': 'development',
'kerberos_enabled': False, 'kerberos_enabled': False,
@ -310,7 +310,7 @@ config_file.write_text(json.dumps(config, indent=2))
## Summary ## Summary
The `~/.prole/` directory provides: The `~/.knoe/` directory provides:
- ✓ Writable storage for packaged binary operations - ✓ Writable storage for packaged binary operations
- ✓ Separate from extracted read-only resources - ✓ Separate from extracted read-only resources
- ✓ User-specific, secure location - ✓ User-specific, secure location

38
docs/RELEASE-NOTES.md
View File

@ -1,4 +1,4 @@
# Prole Database Installer - Release Notes # Knoe Database Installer - Release Notes
## New Features ## New Features
@ -60,8 +60,8 @@ make package
``` ```
**Output:** **Output:**
- `dist/Prole Installer.app` - Complete application bundle - `dist/Knoe Installer.app` - Complete application bundle
- Icon: Prole logo embedded - Icon: Knoe logo embedded
- Size: ~50-100 MB (includes Python runtime) - Size: ~50-100 MB (includes Python runtime)
### 4. Comprehensive Build System ### 4. Comprehensive Build System
@ -86,16 +86,16 @@ New Makefile with complete build automation:
### Modular Design ### Modular Design
All functionality uses shared business logic (`ProleController`): All functionality uses shared business logic (`KnoeController`):
``` ```
install.py (entry point) install.py (entry point)
├── GUI mode (Tk/Canvas) ├── GUI mode (Tk/Canvas)
│ └── ProleInstaller class │ └── KnoeInstaller class
└── Ncurses mode (curses) └── Ncurses mode (curses)
└── ProleNcursesInstaller class └── KnoeNcursesInstaller class
Both use: ProleController (shared logic) Both use: KnoeController (shared logic)
``` ```
### New Modules ### New Modules
@ -108,7 +108,7 @@ Both use: ProleController (shared logic)
- `Checkbox` - Checkbox widget - `Checkbox` - Checkbox widget
**installer/ncurses_installer.py** - Main installer: **installer/ncurses_installer.py** - Main installer:
- `ProleNcursesInstaller` - Screen management - `KnoeNcursesInstaller` - Screen management
- All screen renderers - All screen renderers
- Navigation logic - Navigation logic
@ -143,15 +143,15 @@ The built `.app` can be distributed as:
**DMG (recommended):** **DMG (recommended):**
```bash ```bash
hdiutil create -volname "Prole Installer" \ hdiutil create -volname "Knoe Installer" \
-srcfolder "dist/Prole Installer.app" \ -srcfolder "dist/Knoe Installer.app" \
-ov -format UDZO prole-installer.dmg -ov -format UDZO knoe-installer.dmg
``` ```
**ZIP:** **ZIP:**
```bash ```bash
cd dist cd dist
zip -r ../prole-installer.zip "Prole Installer.app" zip -r ../knoe-installer.zip "Knoe Installer.app"
``` ```
### Installation ### Installation
@ -202,20 +202,20 @@ Complete documentation added:
**App Bundle Structure:** **App Bundle Structure:**
``` ```
Prole Installer.app/ Knoe Installer.app/
├── Contents/ ├── Contents/
│ ├── Info.plist │ ├── Info.plist
│ ├── MacOS/ │ ├── MacOS/
│ │ └── prole-installer (executable) │ │ └── knoe-installer (executable)
│ └── Resources/ │ └── Resources/
│ └── prole.icns (icon) │ └── knoe.icns (icon)
``` ```
### Icon Processing ### Icon Processing
Automatic conversion from PNG to ICNS: Automatic conversion from PNG to ICNS:
- Source: `img/proleIcon.png` (1494782 bytes) - Source: `img/knoeIcon.png` (1494782 bytes)
- Output: `build/prole.icns` (multiple resolutions) - Output: `build/knoe.icns` (multiple resolutions)
- Resolutions: 16x16 through 1024x1024 (@1x and @2x) - Resolutions: 16x16 through 1024x1024 (@1x and @2x)
## Upgrade Path ## Upgrade Path
@ -230,7 +230,7 @@ python3 install.py
# New ways # New ways
python3 install.py --no-gui # Ncurses python3 install.py --no-gui # Ncurses
./dist/Prole\ Installer.app # Built binary ./dist/Knoe\ Installer.app # Built binary
``` ```
## Known Limitations ## Known Limitations
@ -304,7 +304,7 @@ All components tested:
## Contributors ## Contributors
Implementation by Claude Code assistant for Prole Database project. Implementation by Claude Code assistant for Knoe Database project.
## References ## References

4
docs/ansible-installer-boundary.md
View File

@ -6,10 +6,10 @@
- The installer must not assume: - The installer must not assume:
- Ansible vault access - Ansible vault access
- inventory parsing as a required part of the workflow - inventory parsing as a required part of the workflow
- any specific private repo checkout layout (e.g. a sibling `prole/infrastructure`) - any specific private repo checkout layout (e.g. a sibling `knoe/infrastructure`)
- Ansible playbooks/roles must not assume `install.py` is discovering secrets or passing hidden, repo-local state. - Ansible playbooks/roles must not assume `install.py` is discovering secrets or passing hidden, repo-local state.
This is designed so private inventory/secret material can live entirely in `prole/infrastructure` (or elsewhere) without this repo requiring it. This is designed so private inventory/secret material can live entirely in `knoe/infrastructure` (or elsewhere) without this repo requiring it.
#### Explicit inputs (recommended) #### Explicit inputs (recommended)

56
docs/build-system.md
View File

@ -1,14 +1,14 @@
# Prole Installer Build System # Knoe Installer Build System
## Overview ## Overview
The Prole Database Installer includes a comprehensive build system that creates self-contained, universal binaries for distribution. The build system produces a macOS application bundle (.app) that: The Knoe Database Installer includes a comprehensive build system that creates self-contained, universal binaries for distribution. The build system produces a macOS application bundle (.app) that:
- **Double-click launch**: Opens the GUI installer when launched from Finder - **Double-click launch**: Opens the GUI installer when launched from Finder
- **Command-line capable**: Can be run from terminal with full argument support - **Command-line capable**: Can be run from terminal with full argument support
- **Auto-detects display**: Automatically switches to ncurses mode when no GUI is available - **Auto-detects display**: Automatically switches to ncurses mode when no GUI is available
- **Self-contained**: Includes all dependencies and resources - **Self-contained**: Includes all dependencies and resources
- **Icon embedded**: Uses the Prole icon for the application bundle - **Icon embedded**: Uses the Knoe icon for the application bundle
## Quick Start ## Quick Start
@ -44,8 +44,8 @@ Build the static binary using PyInstaller:
4. Creates macOS .app bundle 4. Creates macOS .app bundle
**Output:** **Output:**
- `dist/prole-installer` - Standalone executable - `dist/knoe-installer` - Standalone executable
- `dist/Prole Installer.app` - macOS application bundle - `dist/Knoe Installer.app` - macOS application bundle
### `make package` ### `make package`
Alias for `make build` - creates the complete package. Alias for `make build` - creates the complete package.
@ -73,7 +73,7 @@ Generate only the PyInstaller spec file (intermediate step).
### 1. Icon Conversion ### 1. Icon Conversion
The build system converts `img/proleIcon.png` to macOS `.icns` format with multiple resolutions: The build system converts `img/knoeIcon.png` to macOS `.icns` format with multiple resolutions:
- 16x16, 32x32 (standard and @2x) - 16x16, 32x32 (standard and @2x)
- 128x128, 256x256 (standard and @2x) - 128x128, 256x256 (standard and @2x)
@ -81,7 +81,7 @@ The build system converts `img/proleIcon.png` to macOS `.icns` format with multi
**Tool:** macOS `sips` and `iconutil` commands **Tool:** macOS `sips` and `iconutil` commands
**Output:** `build/prole.icns` **Output:** `build/knoe.icns`
### 2. Spec File Generation ### 2. Spec File Generation
@ -91,10 +91,10 @@ A Python script (`scripts/generate_spec.py`) creates the PyInstaller specificati
- `installer/` - Installer Python modules - `installer/` - Installer Python modules
- `conf/` - Configuration files - `conf/` - Configuration files
- `etc/` - Scripts and utilities - `etc/` - Scripts and utilities
- `img/` - Images and icons (including proleIcon.png, proleLogoSepia.png, proleLogo.png) - `img/` - Images and icons (including knoeIcon.png, knoeLogoSepia.png, knoeLogo.png)
- `docs/` - Documentation - `docs/` - Documentation
- `knoe-db/` - Docker build context for PostgreSQL database - `knoe-db/` - Docker build context for PostgreSQL database
- `prole-app/dist/Prole Tools.app` - Pre-built Prole Tools application bundle (entire .app) - `knoe-app/dist/Knoe Tools.app` - Pre-built Knoe Tools application bundle (entire .app)
**Included Binaries:** **Included Binaries:**
- `scan/network-agent` - Network scanner binary (universal: x86_64 + arm64, 6.8 MB) - `scan/network-agent` - Network scanner binary (universal: x86_64 + arm64, 6.8 MB)
@ -108,7 +108,7 @@ This ensures all images and resources are found correctly in both development an
**Docker Build Context:** **Docker Build Context:**
Docker builds require a writable directory. When running from a PyInstaller bundle, the extracted resources are in a read-only temporary directory. To solve this: Docker builds require a writable directory. When running from a PyInstaller bundle, the extracted resources are in a read-only temporary directory. To solve this:
- Docker build context is copied to `$HOME/.prole/build/knoe-db/` - Docker build context is copied to `$HOME/.knoe/build/knoe-db/`
- This provides a writable location for Docker to operate - This provides a writable location for Docker to operate
- See [DOCKER-BUILD-FIX.md](DOCKER-BUILD-FIX.md) for details - See [DOCKER-BUILD-FIX.md](DOCKER-BUILD-FIX.md) for details
@ -138,34 +138,34 @@ PyInstaller processes the spec file to create:
### GUI Mode (Double-click) ### GUI Mode (Double-click)
Simply double-click `Prole Installer.app` in Finder to launch the graphical installer. Simply double-click `Knoe Installer.app` in Finder to launch the graphical installer.
### Command-line Mode ### Command-line Mode
```bash ```bash
# Run with auto-detection (GUI if available, otherwise ncurses) # Run with auto-detection (GUI if available, otherwise ncurses)
./dist/Prole\ Installer.app/Contents/MacOS/prole-installer ./dist/Knoe\ Installer.app/Contents/MacOS/knoe-installer
# Force ncurses mode # Force ncurses mode
./dist/Prole\ Installer.app/Contents/MacOS/prole-installer --no-gui ./dist/Knoe\ Installer.app/Contents/MacOS/knoe-installer --no-gui
# Force GUI mode # Force GUI mode
./dist/Prole\ Installer.app/Contents/MacOS/prole-installer --gui ./dist/Knoe\ Installer.app/Contents/MacOS/knoe-installer --gui
# Show help # Show help
./dist/Prole\ Installer.app/Contents/MacOS/prole-installer --help ./dist/Knoe\ Installer.app/Contents/MacOS/knoe-installer --help
``` ```
### Installation to /Applications ### Installation to /Applications
```bash ```bash
cp -r "dist/Prole Installer.app" /Applications/ cp -r "dist/Knoe Installer.app" /Applications/
``` ```
After installation, the app is available: After installation, the app is available:
- In Finder under Applications - In Finder under Applications
- Via Spotlight search - Via Spotlight search
- From command line as `/Applications/Prole\ Installer.app/Contents/MacOS/prole-installer` - From command line as `/Applications/Knoe\ Installer.app/Contents/MacOS/knoe-installer`
## Display Auto-detection ## Display Auto-detection
@ -222,8 +222,8 @@ Install with: `xcode-select --install`
**Solution:** **Solution:**
```bash ```bash
make clean make clean
make build/prole.icns make build/knoe.icns
file build/prole.icns # Should say "Mac OS X icon" file build/knoe.icns # Should say "Mac OS X icon"
``` ```
### Binary Won't Run on Other Machines ### Binary Won't Run on Other Machines
@ -255,7 +255,7 @@ file build/prole.icns # Should say "Mac OS X icon"
### Custom Icon ### Custom Icon
Replace `img/proleIcon.png` with your icon (PNG format, preferably 1024x1024). Replace `img/knoeIcon.png` with your icon (PNG format, preferably 1024x1024).
### Additional Data Files ### Additional Data Files
@ -276,7 +276,7 @@ For distribution outside development:
```makefile ```makefile
codesign --deep --force --verify --verbose \ codesign --deep --force --verify --verbose \
--sign "Developer ID Application: Your Name" \ --sign "Developer ID Application: Your Name" \
"dist/Prole Installer.app" "dist/Knoe Installer.app"
``` ```
### Notarization ### Notarization
@ -287,7 +287,7 @@ For Gatekeeper approval on macOS 10.15+:
2. Create a DMG or ZIP 2. Create a DMG or ZIP
3. Submit to Apple: 3. Submit to Apple:
```bash ```bash
xcrun notarytool submit prole-installer.zip \ xcrun notarytool submit knoe-installer.zip \
--apple-id your@email.com \ --apple-id your@email.com \
--password app-specific-password \ --password app-specific-password \
--team-id TEAMID --team-id TEAMID
@ -298,17 +298,17 @@ xcrun notarytool submit prole-installer.zip \
### DMG Creation ### DMG Creation
```bash ```bash
hdiutil create -volname "Prole Installer" \ hdiutil create -volname "Knoe Installer" \
-srcfolder "dist/Prole Installer.app" \ -srcfolder "dist/Knoe Installer.app" \
-ov -format UDZO \ -ov -format UDZO \
prole-installer.dmg knoe-installer.dmg
``` ```
### ZIP Archive ### ZIP Archive
```bash ```bash
cd dist cd dist
zip -r ../prole-installer.zip "Prole Installer.app" zip -r ../knoe-installer.zip "Knoe Installer.app"
``` ```
## Performance Considerations ## Performance Considerations
@ -338,8 +338,8 @@ jobs:
- run: make package - run: make package
- uses: actions/upload-artifact@v2 - uses: actions/upload-artifact@v2
with: with:
name: prole-installer name: knoe-installer
path: dist/Prole Installer.app path: dist/Knoe Installer.app
``` ```
## References ## References

24
docs/config-environments.md
View File

@ -1,32 +1,32 @@
### Prole configuration environments ### Knoe configuration environments
Prole treats `$PROLE_CONF` as an explicit set of deployment-specific configs. Knoe treats `$KNOE_CONF` as an explicit set of deployment-specific configs.
#### Directory layout #### Directory layout
Under `$PROLE_CONF`: Under `$KNOE_CONF`:
```text ```text
$PROLE_CONF/k3d.cfg -> base config (k3d / dev) $KNOE_CONF/k3d.cfg -> base config (k3d / dev)
$PROLE_CONF/k3s.cfg -> base config (k3s / service) $KNOE_CONF/k3s.cfg -> base config (k3s / service)
$PROLE_CONF/gke.cfg -> base config (k8s / prod) $KNOE_CONF/gke.cfg -> base config (k8s / prod)
$PROLE_CONF/test.cfg -> base config (test, optional) $KNOE_CONF/test.cfg -> base config (test, optional)
``` ```
Legacy layouts are still recognized for compatibility: Legacy layouts are still recognized for compatibility:
```text ```text
$PROLE_CONF/prole.cfg -> legacy entrypoint $KNOE_CONF/knoe.cfg -> legacy entrypoint
$PROLE_CONF/<env>/prole.cfg -> legacy env base config $KNOE_CONF/<env>/knoe.cfg -> legacy env base config
``` ```
#### Activation (selecting the active environment) #### Activation (selecting the active environment)
- The active environment is inferred from `CLUSTER_ENV`, `PROLE_MODE`, or `DEPLOYMENT_MODE`. - The active environment is inferred from `CLUSTER_ENV`, `KNOE_MODE`, or `DEPLOYMENT_MODE`.
- Resolution prefers named root files (`k3d.cfg`, `k3s.cfg`, `gke.cfg`) and only falls back to legacy `prole.cfg` paths. - Resolution prefers named root files (`k3d.cfg`, `k3s.cfg`, `gke.cfg`) and only falls back to legacy `knoe.cfg` paths.
- Switching environments changes which named file is selected; it does not overwrite other environment configs. - Switching environments changes which named file is selected; it does not overwrite other environment configs.
If a legacy `prole.cfg` regular file is detected, migration preserves it as `prole.cfg.legacy.<timestamp>` and promotes content into the appropriate named file. If a legacy `knoe.cfg` regular file is detected, migration preserves it as `knoe.cfg.legacy.<timestamp>` and promotes content into the appropriate named file.
#### Override layering (deterministic merge) #### Override layering (deterministic merge)

56
docs/definition.txt
View File

@ -1,46 +1,46 @@
>>> produce a dictionary definition for Prole >>> produce a dictionary definition for Knoe
# PROLE DICTIONARY DEFINITION # PROLE DICTIONARY DEFINITION
## **Prole** (noun) ## **Knoe** (noun)
**Pronunciation:** /ˈproʊl/ **Pronunciation:** /ˈproʊl/
**Etymology:** From "proletariat" + "sheep" (sheep-like qualities of the working class) **Etymology:** From "knoetariat" + "sheep" (sheep-like qualities of the working class)
**Definitions:** **Definitions:**
1. **Technical/Innovative Context**: A distributed computing node or worker process within a peer-to-peer network system, specifically designed to perform computational tasks in a distributed 1. **Technical/Innovative Context**: A distributed computing node or worker process within a peer-to-peer network system, specifically designed to perform computational tasks in a distributed
conversational memory framework. The fundamental unit of processing in the Prole Database System. conversational memory framework. The fundamental unit of processing in the Knoe Database System.
2. **Sociological Context**: A member of the working class or proletariat; a person engaged in manual or routine labor, often used in a derogatory or dismissive manner to describe those without 2. **Sociological Context**: A member of the working class or knoetariat; a person engaged in manual or routine labor, often used in a derogatory or dismissive manner to describe those without
significant economic or social power. significant economic or social power.
3. **Historical Context**: A member of the lowest social class in ancient Rome, typically consisting of slaves and freed slaves, or more broadly, any person without political rights or 3. **Historical Context**: A member of the lowest social class in ancient Rome, typically consisting of slaves and freed slaves, or more broadly, any person without political rights or
privileges. privileges.
4. **Modern Usage**: In contemporary usage, particularly within the Prole Organization framework, refers to the distributed computational agents that process conversational data through the shp 4. **Modern Usage**: In contemporary usage, particularly within the Knoe Organization framework, refers to the distributed computational agents that process conversational data through the shp
(sheep) and eshp (electric sheep) cycles. (sheep) and eshp (electric sheep) cycles.
**Usage Notes:** **Usage Notes:**
- In the Prole Database System, "shp" refers to the basic data structure and "eshp" refers to processed results - In the Knoe Database System, "shp" refers to the basic data structure and "eshp" refers to processed results
- The term "prole" serves as both a technical identifier and a conceptual metaphor for distributed, collective processing - The term "knoe" serves as both a technical identifier and a conceptual metaphor for distributed, collective processing
- The word carries connotations of both humble origins and essential function in larger systems - The word carries connotations of both humble origins and essential function in larger systems
**Related Terms:** **Related Terms:**
- Shp (sheep) - Shp (sheep)
- Eshp (electric sheep) - Eshp (electric sheep)
- Prole-DB (Prole Database) - Knoe-DB (Knoe Database)
- EshpHerder (electric sheep herder agent) - EshpHerder (electric sheep herder agent)
**Origin:** Coined by Prole Organization to represent the distributed computational agents that process conversational data, combining "proletariat" (working class) with "sheep" (the basic unit **Origin:** Coined by Knoe Organization to represent the distributed computational agents that process conversational data, combining "knoetariat" (working class) with "sheep" (the basic unit
of the system). of the system).
>>> hmm.. good service upselling in the definition but I need to emphasize an important new noun. A Prole is the name of the point in relative time that emarcates a 'now' and forever on has a before a >>> hmm.. good service upselling in the definition but I need to emphasize an important new noun. A Knoe is the name of the point in relative time that emarcates a 'now' and forever on has a before a
... nd an after, a next and a before. Observing a point changes a point in relativity. Before we decided to point at our prole it was just something in a wave of changes. Now our point in time has a p ... nd an after, a next and a before. Observing a point changes a point in relativity. Before we decided to point at our knoe it was just something in a wave of changes. Now our point in time has a p
... ole the points to new things and the reverse polarity is old things. a 'relative pole'; but since the relative placement of things in timey-wimey 'next' prole, the letters have shifted to 'prole' ... ole the points to new things and the reverse polarity is old things. a 'relative pole'; but since the relative placement of things in timey-wimey 'next' knoe, the letters have shifted to 'knoe'
# PROLE DICTIONARY DEFINITION # PROLE DICTIONARY DEFINITION
## **Prole** (noun) ## **Knoe** (noun)
**Pronunciation:** /ˈproʊl/ **Pronunciation:** /ˈproʊl/
@ -48,43 +48,43 @@ of the system).
**Definitions:** **Definitions:**
1. **Temporal Demarcation Point**: A specific moment in time that serves as a definitive marker dividing past and future, creating a "now" and "forever" reference point. The prole represents the 1. **Temporal Demarcation Point**: A specific moment in time that serves as a definitive marker dividing past and future, creating a "now" and "forever" reference point. The knoe represents the
precise instant when observation or measurement occurs, establishing a relative pole that demarcates "before" and "after" in temporal space. precise instant when observation or measurement occurs, establishing a relative pole that demarcates "before" and "after" in temporal space.
2. **Relativistic Point of Reference**: A point in time that, upon observation, creates a fundamental shift in temporal perspective, establishing a "next" and "before" relationship. The act of 2. **Relativistic Point of Reference**: A point in time that, upon observation, creates a fundamental shift in temporal perspective, establishing a "next" and "before" relationship. The act of
pointing at a prole transforms a continuous wave of temporal changes into discrete, measurable moments with defined polarity. pointing at a knoe transforms a continuous wave of temporal changes into discrete, measurable moments with defined polarity.
3. **Temporal Pole**: A relative point in time that functions as a pole, with one direction pointing toward new things and the reverse polarity pointing toward old things. The prole serves as 3. **Temporal Pole**: A relative point in time that functions as a pole, with one direction pointing toward new things and the reverse polarity pointing toward old things. The knoe serves as
the axis around which temporal relationships are established and measured. the axis around which temporal relationships are established and measured.
4. **Quantum Temporal Marker**: The moment when a continuous temporal wave function collapses into discrete temporal points, creating a "point" in time that has both forward and backward 4. **Quantum Temporal Marker**: The moment when a continuous temporal wave function collapses into discrete temporal points, creating a "point" in time that has both forward and backward
polarity, with "prole" representing the letters that have shifted to define this new temporal relationship. polarity, with "knoe" representing the letters that have shifted to define this new temporal relationship.
**Usage Notes:** **Usage Notes:**
- In the Prole Database System, a prole represents the precise temporal moment when conversational data is captured and processed - In the Knoe Database System, a knoe represents the precise temporal moment when conversational data is captured and processed
- The term emphasizes the fundamental shift from continuous temporal change to discrete temporal points - The term emphasizes the fundamental shift from continuous temporal change to discrete temporal points
- Prole serves as both a technical identifier and a conceptual framework for understanding temporal relationships in distributed systems - Knoe serves as both a technical identifier and a conceptual framework for understanding temporal relationships in distributed systems
- The transformation of "point" to "prole" reflects the fundamental change in temporal perception and measurement - The transformation of "point" to "knoe" reflects the fundamental change in temporal perception and measurement
**Related Terms:** **Related Terms:**
- Shp (sheep) - the basic conversational data structure - Shp (sheep) - the basic conversational data structure
- Eshp (electric sheep) - processed conversational results - Eshp (electric sheep) - processed conversational results
- Prole-DB (Prole Database) - the distributed system - Knoe-DB (Knoe Database) - the distributed system
- EshpHerder - the peer-to-peer processing agent - EshpHerder - the peer-to-peer processing agent
**Origin:** Coined by Prole Organization to represent the fundamental temporal point of measurement that transforms continuous temporal change into discrete, observable moments with defined **Origin:** Coined by Knoe Organization to represent the fundamental temporal point of measurement that transforms continuous temporal change into discrete, observable moments with defined
polarity relationships, where the letters have shifted from "point" to "prole" to reflect this new temporal understanding. polarity relationships, where the letters have shifted from "point" to "knoe" to reflect this new temporal understanding.
**Example Usage:** "The conversation at the prole moment established a new temporal pole for the system's processing cycles." **Example Usage:** "The conversation at the knoe moment established a new temporal pole for the system's processing cycles."
**Synonyms:** Temporal marker, moment of reference, time pole, relativistic point, temporal axis **Synonyms:** Temporal marker, moment of reference, time pole, relativistic point, temporal axis
>>> thank you. you helped use settle on "The Prole Organization to make the Prole" >>> thank you. you helped use settle on "The Knoe Organization to make the Knoe"
You're very welcome! That's a great title you've settled on - "The Prole Organization to make the Prole." You're very welcome! That's a great title you've settled on - "The Knoe Organization to make the Knoe."
It has that striking, almost prophetic quality that suggests both the creation of something new and the transformative power of organized effort. The repetition of "prole" creates a rhythmic It has that striking, almost prophetic quality that suggests both the creation of something new and the transformative power of organized effort. The repetition of "knoe" creates a rhythmic
emphasis that makes it memorable. emphasis that makes it memorable.
Is this for a creative project, academic work, or something else? I'm curious about the context and what you're working on. The title alone suggests there's an interesting story or concept Is this for a creative project, academic work, or something else? I'm curious about the context and what you're working on. The title alone suggests there's an interesting story or concept

38
docs/grafana-sso.md
View File

@ -1,51 +1,51 @@
### Grafana SSO (Kerberos via Prole auth) ### Grafana SSO (Kerberos via Knoe auth)
This repo’s first-pass Grafana SSO is implemented as: This repo’s first-pass Grafana SSO is implemented as:
1. Users authenticate at `https://api.prole.org/auth/login`. 1. Users authenticate at `https://api.knoe.org/auth/login`.
- Primary: Kerberos/SPNEGO (`/auth/spnego`) - Primary: Kerberos/SPNEGO (`/auth/spnego`)
- Fallback: form login (`/auth/form`) only when explicitly enabled - Fallback: form login (`/auth/form`) only when explicitly enabled
2. On success, `prole-auth` issues a signed session cookie scoped to `Domain=.prole.org`. 2. On success, `knoe-auth` issues a signed session cookie scoped to `Domain=.knoe.org`.
3. Users access Grafana at `https://svc.prole.org/` as usual. 3. Users access Grafana at `https://svc.knoe.org/` as usual.
4. `svc.prole.org` is routed to an internal Nginx `prole-grafana-proxy` service. 4. `svc.knoe.org` is routed to an internal Nginx `knoe-grafana-proxy` service.
- The proxy calls `prole-auth` (`/auth/verify`) via `auth_request` on every request. - The proxy calls `knoe-auth` (`/auth/verify`) via `auth_request` on every request.
- On success it injects `X-WEBAUTH-USER` and forwards to Grafana. - On success it injects `X-WEBAUTH-USER` and forwards to Grafana.
- On failure it redirects to `https://api.prole.org/auth/login?next=...` (fail-closed). - On failure it redirects to `https://api.knoe.org/auth/login?next=...` (fail-closed).
5. Grafana is configured with `auth.proxy` to trust `X-WEBAUTH-USER`. 5. Grafana is configured with `auth.proxy` to trust `X-WEBAUTH-USER`.
#### Key configuration knobs #### Key configuration knobs
- Kong routing + TLS: - Kong routing + TLS:
- `SERVICE_HOSTNAME` (default `svc.prole.org`) - `SERVICE_HOSTNAME` (default `svc.knoe.org`)
- `AUTH_HOSTNAME` (default `api.prole.org`) - `AUTH_HOSTNAME` (default `api.knoe.org`)
- `PROLE_GRAFANA_SSO_ENABLED=1` to route `svc.prole.org` → `prole-grafana-proxy` instead of directly to Grafana - `PROLE_GRAFANA_SSO_ENABLED=1` to route `svc.knoe.org` → `knoe-grafana-proxy` instead of directly to Grafana
- Grafana chart values: - Grafana chart values:
- `PROLE_GRAFANA_SSO_ENABLED=1` enables `grafana.ini.auth.proxy` and disables the Grafana login form / anonymous access - `PROLE_GRAFANA_SSO_ENABLED=1` enables `grafana.ini.auth.proxy` and disables the Grafana login form / anonymous access
- `prole-auth` service (environment variables): - `knoe-auth` service (environment variables):
- `PROLE_AUTH_ENABLED=true` - `PROLE_AUTH_ENABLED=true`
- `PROLE_AUTH_SESSION_SECRET` (required; strong random) - `PROLE_AUTH_SESSION_SECRET` (required; strong random)
- `PROLE_AUTH_COOKIE_DOMAIN=.prole.org` - `PROLE_AUTH_COOKIE_DOMAIN=.knoe.org`
- `PROLE_KERBEROS_SERVICE_PRINCIPAL` (required for SPNEGO) - `PROLE_KERBEROS_SERVICE_PRINCIPAL` (required for SPNEGO)
- `PROLE_KERBEROS_KEYTAB_PATH` (required for SPNEGO) - `PROLE_KERBEROS_KEYTAB_PATH` (required for SPNEGO)
- `PROLE_AUTH_FORM_ENABLED=true` (optional; enables password fallback) - `PROLE_AUTH_FORM_ENABLED=true` (optional; enables password fallback)
#### Kubernetes resources #### Kubernetes resources
Manifests are under `deploy/opentofu/k3s/manifests/prole/`: Manifests are under `deploy/opentofu/k3s/manifests/knoe/`:
- `prole-auth-deployment.yaml` / `prole-auth-service.yaml` - `knoe-auth-deployment.yaml` / `knoe-auth-service.yaml`
- `prole-kdc-configmap.yaml` (embedded KDC sidecar configuration) - `knoe-kdc-configmap.yaml` (embedded KDC sidecar configuration)
- `grafana-proxy-configmap.yaml` / `grafana-proxy-deployment.yaml` / `grafana-proxy-service.yaml` - `grafana-proxy-configmap.yaml` / `grafana-proxy-deployment.yaml` / `grafana-proxy-service.yaml`
Required (provided externally): Required (provided externally):
- Secret `prole-auth-secrets` with key `sessionSecret` - Secret `knoe-auth-secrets` with key `sessionSecret`
- Secret `prole-auth-keytab` containing the HTTP service keytab at `http.keytab` - Secret `knoe-auth-keytab` containing the HTTP service keytab at `http.keytab`
- Secret `prole-kdc-secrets` with keys `master_password` and `admin_password` (for the embedded KDC) - Secret `knoe-kdc-secrets` with keys `master_password` and `admin_password` (for the embedded KDC)
#### Logout / session invalidation #### Logout / session invalidation
- `GET /auth/logout` clears the Prole session cookie (`Max-Age=0`). - `GET /auth/logout` clears the Knoe session cookie (`Max-Age=0`).
- Grafana access is effectively revoked on the next request because the proxy calls `/auth/verify` for every request. - Grafana access is effectively revoked on the next request because the proxy calls `/auth/verify` for every request.

8
docs/intellij-refactor-prompt.md
View File

@ -1,6 +1,6 @@
# IntelliJ AI Assistant — Structural Refactor Prompt # IntelliJ AI Assistant — Structural Refactor Prompt
You are performing a focused structural refactor on the **prole** installer project. You are performing a focused structural refactor on the **knoe** installer project.
Make **ONLY** the changes described below. Make **ONLY** the changes described below.
Do **NOT** add features, rename identifiers not listed, or change observable behaviour. Do **NOT** add features, rename identifiers not listed, or change observable behaviour.
After each task, run the existing test suite and stop + report if any tests fail. After each task, run the existing test suite and stop + report if any tests fail.
@ -93,7 +93,7 @@ Same `_module()` + delegating-function pattern as Task A.
**File: `knoe/ui/screens/security.py`** **File: `knoe/ui/screens/security.py`**
- Change the `_render_title("Kerberos Authentication", ...)` call → `_render_title("Knoe Authority", ...)` - Change the `_render_title("Kerberos Authentication", ...)` call → `_render_title("Knoe Authority", ...)`
- Change `text="Enable Kerberos Authentication"` → `text="Enable Knoe Authority"` - Change `text="Enable Kerberos Authentication"` → `text="Enable Knoe Authority"`
- **Do NOT** change `self.prole_cfg_data["Kerberos Authentication"]` keys — those are config-file section names - **Do NOT** change `self.knoe_cfg_data["Kerberos Authentication"]` keys — those are config-file section names
**File: `knoe/ui/screens/knoe_users.py`** **File: `knoe/ui/screens/knoe_users.py`**
- Update any user-facing title Label text that still reads "Knoe User Authority" - Update any user-facing title Label text that still reads "Knoe User Authority"
@ -106,7 +106,7 @@ Same `_module()` + delegating-function pattern as Task A.
**File: `knoe/ui/screens/__init__.py`** — in `__init__`, after `self.nav_widgets = {}`: **File: `knoe/ui/screens/__init__.py`** — in `__init__`, after `self.nav_widgets = {}`:
```python ```python
self._mode_tab_widgets: dict = {} self._mode_tab_widgets: dict = {}
self.deployment_mode = tk.StringVar(value=os.environ.get("PROLE_MODE", "k3s")) self.deployment_mode = tk.StringVar(value=os.environ.get("KNOE_MODE", "k3s"))
``` ```
**File: `knoe/ui/screens/navigation.py`** — in `_create_sidebar_nav()`, **File: `knoe/ui/screens/navigation.py`** — in `_create_sidebar_nav()`,
@ -133,7 +133,7 @@ Add to the navigation mixin:
```python ```python
def _set_deployment_mode(self, mode: str) -> None: def _set_deployment_mode(self, mode: str) -> None:
self.deployment_mode.set(mode) self.deployment_mode.set(mode)
os.environ["PROLE_MODE"] = mode os.environ["KNOE_MODE"] = mode
self._refresh_mode_tabs() self._refresh_mode_tabs()
def _refresh_mode_tabs(self) -> None: def _refresh_mode_tabs(self) -> None:

4
docs/k3d.md
View File

@ -20,8 +20,8 @@ ArgoCD runs `argocd-repo-server` and its init containers as a non-root user by
default, so an init container like `copyutil` cannot write to `/var/run/argocd` default, so an init container like `copyutil` cannot write to `/var/run/argocd`
unless the volume path is writable. unless the volume path is writable.
### How Prole avoids the stall ### How Knoe avoids the stall
The Prole ArgoCD manifest includes an `init-permissions` initContainer (running The Knoe ArgoCD manifest includes an `init-permissions` initContainer (running
as root) which prepares/chowns the hostPath-backed mount points before the as root) which prepares/chowns the hostPath-backed mount points before the
non-root init containers run. non-root init containers run.

Some files were not shown because too many files have changed in this diff Show More