set gitlab oidc and supabase auto clean

conf/gke.cfg

@@ -1,5 +1,5 @@
 ; Prole Master Configuration File
-; Generated by install.py on 2026-04-14 21:00:43
+; Generated by install.py on 2026-04-18 20:45:32
 ; This file is used as input for Ansible deployment and k8s cluster creation.
 
 [User]
@@ -8,6 +8,8 @@
 
 [Inputs]
 ; Screen-scoped inputs used for unattended replays (-S)
+auth.clientId = secretref://google-oidc-client-id
+auth.clientSecret = secretref://google-oidc-client-secret
 build.deploy_env = Prod
 build.run_build = false
 dependencies.ansible.install = true
@@ -15,6 +17,7 @@ dependencies.auto_install_missing = true
 dependencies.brew.install = true
 dependencies.docker.install = true
 dependencies.gcloud.install = true
+dependencies.gke-gcloud-auth-plugin.install = true
 dependencies.k3d.install = true
 dependencies.kubectl.install = true
 dependencies.kubectx.install = true
@@ -76,8 +79,8 @@ init_password.cluster_name = ${CLUSTER_NAME}
 init_password.db_cluster_name = knoe-dev-cnpg-0
 init_password.db_host_port = 5432
 init_password.db_namespace = ${DATABASE_NAMESPACE}
-init_password.db_password = ${PROLE_SECRET:v1:CBYbPqQon47mtCR_:1lGyamZHSQEw2cy8FwhTVXC8FIfXzqnDNZljAibbifr0hVvr}
+init_password.db_password = ${PROLE_SECRET:v1:5RlyU1vwz3CDoq6u:UfdWQw93uyPDIY_TWxRzdIbyZQCGv4sBpjNFmQMDRdmrypdVxcwz0w==}
-init_password.db_password_confirm = ${PROLE_SECRET:v1:CBYbPqQon47mtCR_:1lGyamZHSQEw2cy8FwhTVXC8FIfXzqnDNZljAibbifr0hVvr}
+init_password.db_password_confirm = ${PROLE_SECRET:v1:5RlyU1vwz3CDoq6u:UfdWQw93uyPDIY_TWxRzdIbyZQCGv4sBpjNFmQMDRdmrypdVxcwz0w==}
 init_password.db_username = chrisfu
 init_password.generate_ssh_key = true
 init_scripts.run_scripts = true
@@ -95,15 +98,7 @@ ollama_config.server_port = 11434
 
 [Global]
 ; Variables used by name in more than one place or assumed global scope
-; --- Public Endpoints (Resolved on APP Cluster) ---
+APP_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-0
-; api.knoe.dev      -> knoe-svc-kong (Prole authority)
-; git.knoe.dev      -> GitLab
-; db.0.knoe.dev     -> Supabase Studio
-; api.0.knoe.dev    -> Supabase Kong
-; svc.knoe.dev      -> Grafana
-; --- Topology ---
-; Supabase App Components: APP Cluster
-; Postgres Database: DB Cluster (Accessed Cross-Cluster)
 ARGOCD_NAMESPACE = argocd
 ARTIFACT_REGISTRY = us-west3-docker.pkg.dev/plenary-truck-485623-p7/knoe-system
 AUTHORITY_ENABLED = true
@@ -111,7 +106,6 @@ AUTH_HOSTNAME = api.knoe.dev
 AUTH_LOGIN_PATH = /auth/login
 AUTH_RESPONSE_HEADERS = X-Prole-User,X-Prole-Email,X-Prole-Groups
 AUTH_VERIFY_PATH = /auth/verify
-APP_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-0
 CLUSTER_ENV = prod
 CLUSTER_NAME = knoe-db
 CLUSTER_SIZE_PROFILE = small
@@ -120,32 +114,35 @@ CNPG_SIZE_PROFILE = small
 DATABASE_NAMESPACE = knoe-db-0
 DB_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-cnpg-0
 DB_HOST_PORT = 5432
-DB_PASSWORD = ${PROLE_SECRET:v1:rcUdi4vOG6kNGEU5:EqQse57hHcfquOmKCOJ6ll1zniOz2BMapc5E9fnLuRc4T3-B}
+DB_PASSWORD = ${PROLE_SECRET:v1:v42vq25mZFVFIwuZ:YK1Bz8WwwhkEQk712JAa2aCWqokdAyVG_Z1bP_Rj5RxVCoU6_lDYYA==}
 DEPLOYMENT_MODE = k8s
 DEPLOYMENT_TARGET = prole-prod-cluster
 DOCKER_IMPORT_DIR = 
 DOCKER_PRELOAD = false
 GARAGE_PRIVATE_S3_ENDPOINT = http://10.180.15.239:3900
 GITLAB_DOMAIN = git.knoe.dev
+GITLAB_GITALY_STORAGE_CLASS = standard
 GITLAB_INGRESS_CLASS = gce
+GITLAB_OIDC_CLIENT_ID = 200699021716-pbaekj5q8i3fplhof0u7gccrvkvvacug.apps.googleusercontent.com
+GITLAB_OIDC_CLIENT_SECRET = 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
 GITLAB_PUBLIC_HOSTS = git.knoe.dev
 GITLAB_REPAIR_BLOCKED_AUTOCLEAN = 1
-; Gitaly/registry/other persistent volumes use pd-standard (HDD) — the 300 GB
-; SSD_TOTAL_GB quota in us-west3 is fully consumed by CNPG, so GitLab PVCs
-; must NOT land on 'standard-rwo' (pd-balanced / SSD).
-GITLAB_GITALY_STORAGE_CLASS = standard
-; Webservice memory — Puma boot spike (Rails preload + worker fork) peaks
-; around 1.4–1.6 GB even with workerProcesses=1. 1800M gives headroom.
 GITLAB_WEBSERVICE_LIMITS_MEMORY = 1800M
-GITLAB_WEBSERVICE_REQUESTS_MEMORY = 900M
-GITLAB_WEBSERVICE_REQUESTS_CPU = 200m
-GITLAB_WEBSERVICE_WORKER_PROCESSES = 1
-GITLAB_WEBSERVICE_PUMA_THREADS_MIN = 2
 GITLAB_WEBSERVICE_PUMA_THREADS_MAX = 2
+GITLAB_WEBSERVICE_PUMA_THREADS_MIN = 2
+GITLAB_WEBSERVICE_REQUESTS_CPU = 200m
+GITLAB_WEBSERVICE_REQUESTS_MEMORY = 900M
+GITLAB_WEBSERVICE_WORKER_PROCESSES = 1
 GRAFANA_HOSTNAME = svc.knoe.dev
 K3S_SERVER = 
 K3S_TOKEN = 
 KNOE_DB_USER = chrisfu
+KNOE_USER_GITLAB_API_BASE = https://git.knoe.dev/api/v4
+KNOE_USER_GITLAB_AUTH_PROVIDER = openid_connect
+KNOE_USER_GITLAB_JIT_AUTO_CREATE_USERS = true
+KNOE_USER_GITLAB_OIDC_ISSUER = https://api.knoe.dev/auth
+KNOE_USER_GITLAB_OIDC_REDIRECT_URI = https://git.knoe.dev/users/auth/openid_connect/callback
+KNOE_USER_GITLAB_PROVISIONING_READY = true
 OPENTOFU_URL = http://127.0.0.1:8080
 OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2
 PROLE_HOME = $HOME/dev/prole
@@ -158,6 +155,8 @@ SUPABASE_API_HOSTNAME = api.0.knoe.dev
 SUPABASE_HOSTNAME = db.0.knoe.dev
 SUPABASE_INGRESS_CLASS = gce
 SUPABASE_STUDIO_HOSTNAME = db.0.knoe.dev
+SUPABASE_AUTO_CLEAN_RETAINED_PVS = true
+SUPABASE_AUTO_CLEAN_RETAINED_GCE_DISKS = true
 
 [Welcome]
 ; No configuration values captured yet for this section.
@@ -210,7 +209,7 @@ KERBEROS_ENABLED = false
 SUPABASE_ENABLED = true
 
 [GitOps]
-STATUS = Skipped
+STATUS = Deployed
 
 [Database Creation]
 APP_CLUSTER_NAME = knoe-dev-0
@@ -255,4 +254,4 @@ MODE = k8s
 TARGET = prole-prod-cluster
 
 [Install]
-STATUS = Failed
+STATUS = Finished