prole

chrisfu/prole

Fork 0

mirror of https://github.com/dredx/prole.git synced 2026-09-24 14:04:31 +00:00

Commit Graph

Author	SHA1	Message	Date
chrisfu	dc099b99f9	fix(knoe-auth): wire Google Workspace login for prole.org - Add KNOE_AUTH_BASE_URL=https://api.prole.org/auth to knoe-auth deployment; LoginController.java defaulted to api.0.knoe.dev causing redirect_uri mismatch on every Google login attempt - Update oauth2-proxy-deployment-prole.yaml to reflect live config: --provider=oidc --oidc-issuer-url=https://api.prole.org/auth (was stale --provider=google; live deployment already switched to OIDC) - Fix redirect URIs in knoe-auth-google-prole-secret.example.yaml: remove spurious double /auth/auth/ prefix (Kong strip_path=false so Spring @RequestMapping(/auth) gives /auth/callback/google not /auth/auth/callback/google) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-28 07:11:13 -07:00
chrisfu	cf33342500	feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation knoe-auth (prole.org k3s): - Fix CNPG manifest drift: remove spec.backup.pluginConfiguration (CNPG 1.28 only), switch spec.certificates from serverTLSSecret to serverAltDNSNames - Apply knoe-auth Round 1 schema + GRANTs manually (postInitSQL had never run on live cluster) - Fix OIDC signing key generator: base64(DER) not base64(PEM) — OidcTokenService does Base64.decode() → PKCS8EncodedKeySpec which requires raw DER bytes - Add OIDC controllers: authorize, token, userinfo, jwks, discovery - Add prole Spring profile: cookieDomain, emailDomain, Kerberos config - Add secret example templates: knoe-db-user, knoe-auth-oidc-signing, knoe-auth-google-prole - Kong configmap: scope knoe-auth route to /auth prefix only Tenant onboarding: - Add etc/onboard_tenant.sh: provision/apply/rotate/status workflow backed by 1Password vaults; types: 'enterprise' (own Kerberos + domain) and 'tenant' (hosted, initContainer KDC) - Provision 'Knoe Tenant - prole.org' vault; apply all 7 k8s secrets to knoe-system - init_knoe_auth.sh: add explicit GRANT + ALTER DEFAULT PRIVILEGES for knoe role Cluster stabilisation: - gitea: roll back 14-day stuck rollout (RWO PVC + maxSurge=100% deadlock); patch deployment strategy to Recreate - supabase: create supabase_admin role, _supabase db, _analytics schema, _realtime schema in CNPG — analytics and realtime had never connected since Helm install day 1 - knoe-db barman ObjectStore: add GCS-backed objectstore manifest + scheduled backup Infrastructure: - gandalf host_vars: k3s registry config - pi host_vars: clean up stale entries - knoe-db schemas: ekosystem.sql, ekosystem_objects.sql - init_prole_app.sql: prole app DB initialisation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-26 00:50:37 -07:00

Author

SHA1

Message

Date

chrisfu

dc099b99f9

fix(knoe-auth): wire Google Workspace login for prole.org

- Add KNOE_AUTH_BASE_URL=https://api.prole.org/auth to knoe-auth
  deployment; LoginController.java defaulted to api.0.knoe.dev causing
  redirect_uri mismatch on every Google login attempt

- Update oauth2-proxy-deployment-prole.yaml to reflect live config:
  --provider=oidc --oidc-issuer-url=https://api.prole.org/auth (was
  stale --provider=google; live deployment already switched to OIDC)

- Fix redirect URIs in knoe-auth-google-prole-secret.example.yaml:
  remove spurious double /auth/auth/ prefix (Kong strip_path=false so
  Spring @RequestMapping(/auth) gives /auth/callback/google not
  /auth/auth/callback/google)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-28 07:11:13 -07:00

chrisfu

cf33342500

feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation

knoe-auth (prole.org k3s):
- Fix CNPG manifest drift: remove spec.backup.pluginConfiguration (CNPG 1.28 only),
  switch spec.certificates from serverTLSSecret to serverAltDNSNames
- Apply knoe-auth Round 1 schema + GRANTs manually (postInitSQL had never run on live cluster)
- Fix OIDC signing key generator: base64(DER) not base64(PEM) — OidcTokenService
  does Base64.decode() → PKCS8EncodedKeySpec which requires raw DER bytes
- Add OIDC controllers: authorize, token, userinfo, jwks, discovery
- Add prole Spring profile: cookieDomain, emailDomain, Kerberos config
- Add secret example templates: knoe-db-user, knoe-auth-oidc-signing, knoe-auth-google-prole
- Kong configmap: scope knoe-auth route to /auth prefix only

Tenant onboarding:
- Add etc/onboard_tenant.sh: provision/apply/rotate/status workflow backed by 1Password
  vaults; types: 'enterprise' (own Kerberos + domain) and 'tenant' (hosted, initContainer KDC)
- Provision 'Knoe Tenant - prole.org' vault; apply all 7 k8s secrets to knoe-system
- init_knoe_auth.sh: add explicit GRANT + ALTER DEFAULT PRIVILEGES for knoe role

Cluster stabilisation:
- gitea: roll back 14-day stuck rollout (RWO PVC + maxSurge=100% deadlock);
  patch deployment strategy to Recreate
- supabase: create supabase_admin role, _supabase db, _analytics schema, _realtime schema
  in CNPG — analytics and realtime had never connected since Helm install day 1
- knoe-db barman ObjectStore: add GCS-backed objectstore manifest + scheduled backup

Infrastructure:
- gandalf host_vars: k3s registry config
- pi host_vars: clean up stale entries
- knoe-db schemas: ekosystem.sql, ekosystem_objects.sql
- init_prole_app.sql: prole app DB initialisation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-26 00:50:37 -07:00

2 Commits