mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
903f84f200
Three independent lines of work landing in one commit because they were all on disk together end-of-session and the cross-file edits (TODO, knoe-system, junie/README) interleave cleanly: 1. **Queue #3 — image rename `knoe-authority` → `knoe-auth`** (Junie). Closes drift R6. The Maven artifact has been `knoe-auth.jar` since commit b355855; the deploy manifests now match. authority/Dockerfile.app (NEW) deploy/gcp/gke/knoe-auth-deployment.yaml (3 image tags renamed) deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml (2 image tags renamed) Makefile (docker-build-auth + docker-push-auth + REGISTRY/KNOE_AUTH_VERSION defaults) docs/plans/junie/03-image-rename-knoe-authority-to-knoe-auth.md (brief, kept as design record) 2. **Phase 2 OIDC provider — GKE deploy** (Junie). Source landed via the merge that brought claude/crazy-bose-fec256 back; the k3d sandbox shipped earlier today (commit93157b0). This commit completes the GKE path: Kong route `/auth` → knoe-auth, default values added, signing key wired via `knoe-auth-oidc` secret per the brief. supabase/helm/knoe-supabase/templates/kong/config.yaml (Kong route /auth, gated on .Values.knoeAuth.enabled) supabase/helm/knoe-supabase/values.yaml (knoeAuth.enabled=false default; studioIngress block — also fixes the helm lint issue noted in earlier commit03bb731) docs/plans/junie/phase2-oidc-gke-deploy.md (brief, kept as design record) 3. **k3d dev-user seed: `chrisfu` + `knoe_developer`** (Claude). Closes "I want auth as chrisfu@knoey.com to my local cnpg database" for the local dev loop. `etc/init_knoe_auth.sh --mode k3d` now runs `seed_dev_users_k3d()` after the schema bootstrap, creating: - `knoe_developer` group role with R/W on `knoe`+`public` (mirrors the GKE production layout from docs/db-access.md; was hand-rolled in production per the 2026-04-30 onboarding work, never baked into postInitTemplateSQL). - `chrisfu` LOGIN role with password `chrisfu-dev` (idempotent — resets on every `make k3d-knoe-up`, so the rebuild loop is deterministic). Granted into `knoe_developer`. From the host with port-forward up: PGPASSWORD=chrisfu-dev psql "postgresql://chrisfu@localhost:5432/knoe-db?sslmode=require" Cross-cutting doc updates: docs/TODO.md — Phase 2 GKE entry removed from "In progress" (now "(none — all items shipped or paused)"); queue #3 + reality table R6 removed; pg_oauth paused note flipped to "OIDC issuer now deployed to GKE — pg_oauth can resume"; Done section gets new entries for #3, Phase 2 GKE, and chrisfu seed. docs/knoe-system.md — Phase 2 GKE row → Shipped; pg_oauth → Ready; knoe-auth-deployment.yaml note "knoe-auth:latest" instead of "knoe-authority:latest"; "One-time cluster setup" mentions the chrisfu seed. docs/local-dev-knoe-auth.md — "Verify psql connectivity" rewritten to connect as chrisfu (was `knoe`); new "Reset / rebuild loop" section explaining idempotency. docs/plans/junie/README.md — two new rows under Shipped: brief 03 and phase2-oidc-gke-deploy. Verification (the bits I ran locally): - bash -n etc/init_knoe_auth.sh OK - The seed SQL is idempotent (DO blocks with EXISTS checks + ALTER ROLE on the password reset path) - The Kong /auth route is gated on .Values.knoeAuth.enabled — default false, no behavior change until someone flips it on per Junie's brief Out of scope for this commit: - Actually flipping knoeAuth.enabled=true on the live GKE chart and rolling out — Junie's brief covers the runbook; needs the knoe-auth-oidc K8s secret populated from 1Password first - Rebuilding + pushing the new knoe-auth:latest image — `make docker-push-auth` is wired, just hasn't been run yet - Round 1.5 OpenBao transit-key encryption (still queued) Co-authored-by: Junie <junie@jetbrains.com> Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
31 lines
1.4 KiB
Erlang
31 lines
1.4 KiB
Erlang
# Dockerfile.app — Spring Boot runtime image for knoe-auth
|
|
# Build the jar first: make build-auth
|
|
# Then build this image: make docker-build-auth
|
|
#
|
|
# Multi-stage: build stage compiles the jar; runtime stage is minimal JRE.
|
|
|
|
# ── Build stage ──────────────────────────────────────────────────────────────
|
|
FROM maven:3.9-eclipse-temurin-21 AS build
|
|
WORKDIR /workspace
|
|
COPY authority/pom.xml pom.xml
|
|
# Download dependencies first (layer-cache friendly)
|
|
RUN mvn -f pom.xml dependency:go-offline -q
|
|
COPY authority/src src
|
|
RUN mvn -f pom.xml -DskipTests package -q && \
|
|
mv target/knoe-auth.jar /knoe-auth.jar
|
|
|
|
# ── Runtime stage ─────────────────────────────────────────────────────────────
|
|
FROM eclipse-temurin:21-jre-jammy
|
|
LABEL org.opencontainers.image.title="knoe-auth" \
|
|
org.opencontainers.image.description="Knoe authentication service (Spring Boot)" \
|
|
org.opencontainers.image.source="https://github.com/chrisfu/knoe-db"
|
|
|
|
RUN groupadd --system knoe && useradd --system --gid knoe knoe
|
|
WORKDIR /app
|
|
COPY --from=build /knoe-auth.jar knoe-auth.jar
|
|
RUN chown knoe:knoe knoe-auth.jar
|
|
|
|
USER knoe
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["java", "-jar", "/app/knoe-auth.jar"]
|