mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
Three independent lines of work landing in one commit because they were all on disk together end-of-session and the cross-file edits (TODO, knoe-system, junie/README) interleave cleanly: 1. **Queue #3 — image rename `knoe-authority` → `knoe-auth`** (Junie). Closes drift R6. The Maven artifact has been `knoe-auth.jar` since commit b355855; the deploy manifests now match. authority/Dockerfile.app (NEW) deploy/gcp/gke/knoe-auth-deployment.yaml (3 image tags renamed) deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml (2 image tags renamed) Makefile (docker-build-auth + docker-push-auth + REGISTRY/KNOE_AUTH_VERSION defaults) docs/plans/junie/03-image-rename-knoe-authority-to-knoe-auth.md (brief, kept as design record) 2. **Phase 2 OIDC provider — GKE deploy** (Junie). Source landed via the merge that brought claude/crazy-bose-fec256 back; the k3d sandbox shipped earlier today (commit93157b0). This commit completes the GKE path: Kong route `/auth` → knoe-auth, default values added, signing key wired via `knoe-auth-oidc` secret per the brief. supabase/helm/knoe-supabase/templates/kong/config.yaml (Kong route /auth, gated on .Values.knoeAuth.enabled) supabase/helm/knoe-supabase/values.yaml (knoeAuth.enabled=false default; studioIngress block — also fixes the helm lint issue noted in earlier commit03bb731) docs/plans/junie/phase2-oidc-gke-deploy.md (brief, kept as design record) 3. **k3d dev-user seed: `chrisfu` + `knoe_developer`** (Claude). Closes "I want auth as chrisfu@knoey.com to my local cnpg database" for the local dev loop. `etc/init_knoe_auth.sh --mode k3d` now runs `seed_dev_users_k3d()` after the schema bootstrap, creating: - `knoe_developer` group role with R/W on `knoe`+`public` (mirrors the GKE production layout from docs/db-access.md; was hand-rolled in production per the 2026-04-30 onboarding work, never baked into postInitTemplateSQL). - `chrisfu` LOGIN role with password `chrisfu-dev` (idempotent — resets on every `make k3d-knoe-up`, so the rebuild loop is deterministic). Granted into `knoe_developer`. From the host with port-forward up: PGPASSWORD=chrisfu-dev psql "postgresql://chrisfu@localhost:5432/knoe-db?sslmode=require" Cross-cutting doc updates: docs/TODO.md — Phase 2 GKE entry removed from "In progress" (now "(none — all items shipped or paused)"); queue #3 + reality table R6 removed; pg_oauth paused note flipped to "OIDC issuer now deployed to GKE — pg_oauth can resume"; Done section gets new entries for #3, Phase 2 GKE, and chrisfu seed. docs/knoe-system.md — Phase 2 GKE row → Shipped; pg_oauth → Ready; knoe-auth-deployment.yaml note "knoe-auth:latest" instead of "knoe-authority:latest"; "One-time cluster setup" mentions the chrisfu seed. docs/local-dev-knoe-auth.md — "Verify psql connectivity" rewritten to connect as chrisfu (was `knoe`); new "Reset / rebuild loop" section explaining idempotency. docs/plans/junie/README.md — two new rows under Shipped: brief 03 and phase2-oidc-gke-deploy. Verification (the bits I ran locally): - bash -n etc/init_knoe_auth.sh OK - The seed SQL is idempotent (DO blocks with EXISTS checks + ALTER ROLE on the password reset path) - The Kong /auth route is gated on .Values.knoeAuth.enabled — default false, no behavior change until someone flips it on per Junie's brief Out of scope for this commit: - Actually flipping knoeAuth.enabled=true on the live GKE chart and rolling out — Junie's brief covers the runbook; needs the knoe-auth-oidc K8s secret populated from 1Password first - Rebuilding + pushing the new knoe-auth:latest image — `make docker-push-auth` is wired, just hasn't been run yet - Round 1.5 OpenBao transit-key encryption (still queued) Co-authored-by: Junie <junie@jetbrains.com> Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
128 lines
5.2 KiB
Makefile
128 lines
5.2 KiB
Makefile
# Makefile for Knoe Database Deployment and Installer
|
|
|
|
ifneq ($(wildcard bin/python3),)
|
|
PYTHON ?= bin/python3
|
|
else
|
|
PYTHON ?= python3
|
|
endif
|
|
PYINSTALLER = $(PYTHON) -m PyInstaller
|
|
DIST_DIR = dist
|
|
BUILD_DIR = build
|
|
KNOE_CONF ?= conf
|
|
KNOE_MODE ?= k3d
|
|
PIPELINE_DIR ?= deploy/opentofu/k3s
|
|
DEPLOYMENT_GIT_DIR ?= knoe/deployment
|
|
GITEA_SCRIPT ?= knoe/etc/gitea.sh
|
|
KUBECONFIG_PATH ?= $(CURDIR)/knoe-k3s.kubeconfig
|
|
REGISTRY ?= us-west3-docker.pkg.dev/plenary-truck-485623-p7/knoe-system
|
|
KNOE_AUTH_VERSION ?= latest
|
|
DEPLOYMENT_REPO_URL ?= http://gitea.local/knoe/deployment.git
|
|
|
|
.PHONY: all knoe build build-auth docker-build-auth docker-push-auth install deploy init clean help requirements test pyconv start \
|
|
k3d-knoe-up k3d-knoe-pf k3d-knoe-down
|
|
|
|
all: build
|
|
|
|
start: build
|
|
open "$(DIST_DIR)/Knoe.DB Installer.app"
|
|
|
|
help:
|
|
@echo "Knoe Build & Deployment System"
|
|
@echo ""
|
|
@echo "Targets:"
|
|
@echo " knoe - Launch the Ncurses installer"
|
|
@echo " start - Build and launch the GUI installer"
|
|
@echo " install - Run silent install via install.sh"
|
|
@echo " deploy - Run infrastructure deployment via deploy.sh"
|
|
@echo " build - Build the 'knoe' CLI binary"
|
|
@echo " build-auth - Build the knoe-auth Spring Boot jar (authority/pom.xml)"
|
|
@echo " requirements - Install Python dependencies"
|
|
@echo " test - Run full test suite"
|
|
@echo " pyconv - Check Python code style conventions (black)"
|
|
@echo " clean - Remove build artifacts"
|
|
@echo ""
|
|
@echo "Environment:"
|
|
@echo " KNOE_CONF - Directory containing knoe.cfg (default: conf)"
|
|
@echo ""
|
|
@echo "k3d dev loop targets:"
|
|
@echo " k3d-knoe-up - Bring up local k3d cluster (CNPG + KDC + schema)"
|
|
@echo " k3d-knoe-pf - Open port-forwards (5432/88/464) — foreground, ^C to stop"
|
|
@echo " k3d-knoe-down - Tear down the k3d-knoe cluster"
|
|
|
|
requirements:
|
|
@echo "Installing dependencies..."
|
|
$(PYTHON) -m pip install -r requirements.txt
|
|
|
|
knoe:
|
|
./install.sh
|
|
|
|
build:
|
|
@$(PYTHON) -c "import PyInstaller" 2>/dev/null || (echo "Error: PyInstaller not found. Please run 'make requirements' or install it with: $(PYTHON) -m pip install -r requirements.txt" && exit 1)
|
|
@echo "Building 'Knoe.DB Installer' macOS App Bundle..."
|
|
$(PYINSTALLER) --clean --noconfirm knoe.spec
|
|
@echo "✓ Build complete: $(DIST_DIR)/Knoe.DB Installer.app"
|
|
|
|
build-auth:
|
|
@command -v mvn >/dev/null 2>&1 || (echo "Error: mvn not found in PATH." && exit 1)
|
|
@echo "Building knoe-auth (dev.knoe:auth) via authority/pom.xml..."
|
|
mvn -f authority/pom.xml -DskipTests package
|
|
@echo "✓ knoe-auth jar: authority/target/knoe-auth.jar"
|
|
|
|
docker-build-auth: build-auth
|
|
@command -v docker >/dev/null 2>&1 || (echo "Error: docker not found in PATH." && exit 1)
|
|
@echo "Building Docker image knoe-auth:$(KNOE_AUTH_VERSION)..."
|
|
docker build -f authority/Dockerfile.app -t knoe-auth:$(KNOE_AUTH_VERSION) .
|
|
@echo "✓ Docker image: knoe-auth:$(KNOE_AUTH_VERSION)"
|
|
|
|
docker-push-auth: docker-build-auth
|
|
@echo "Tagging and pushing $(REGISTRY)/knoe-auth:$(KNOE_AUTH_VERSION)..."
|
|
docker tag knoe-auth:$(KNOE_AUTH_VERSION) $(REGISTRY)/knoe-auth:$(KNOE_AUTH_VERSION)
|
|
docker push $(REGISTRY)/knoe-auth:$(KNOE_AUTH_VERSION)
|
|
@echo "✓ Pushed: $(REGISTRY)/knoe-auth:$(KNOE_AUTH_VERSION)"
|
|
|
|
install:
|
|
@echo "Running silent install..."
|
|
KNOE_CONF=$(KNOE_CONF) ./install.sh -s -c $(KNOE_CONF)/knoe.cfg
|
|
|
|
init:
|
|
@command -v tofu >/dev/null 2>&1 || (echo "Error: OpenTofu (tofu) not found in PATH." && exit 1)
|
|
@echo "Syncing OpenTofu pipeline from $(KNOE_MODE) runtime into $(PIPELINE_DIR)..."
|
|
@KNOE_MODE=$(KNOE_MODE) KNOE_CONF=$(KNOE_CONF) KNOE_GIT_REPO=$(DEPLOYMENT_REPO_URL) PYTHONPATH=$(CURDIR) $(PYTHON) -c "from knoe.core.controller import KnoeController; from knoe.core.env import PROJECT_ROOT; from knoe.deployment import KnoeDeployment; import sys, os; conf_dir = os.environ.get('KNOE_CONF', 'conf'); cfg_path = PROJECT_ROOT / conf_dir / 'knoe.cfg'; deployment = KnoeDeployment(KnoeController(PROJECT_ROOT, verbose=False, cfg_path=cfg_path), PROJECT_ROOT); ok = deployment.duplicate_k3d_to_k3s(); sys.exit(0 if ok else 1)"
|
|
@echo "Initializing OpenTofu backend in $(PIPELINE_DIR)..."
|
|
@cd $(PIPELINE_DIR) && tofu init
|
|
@echo "Staging pipeline sources into $(DEPLOYMENT_GIT_DIR) for Gitea"
|
|
@mkdir -p $(DEPLOYMENT_GIT_DIR)
|
|
@if command -v rsync >/dev/null 2>&1; then rsync -a $(PIPELINE_DIR)/ $(DEPLOYMENT_GIT_DIR)/; else cp -a $(PIPELINE_DIR)/. $(DEPLOYMENT_GIT_DIR)/; fi
|
|
@cd $(DEPLOYMENT_GIT_DIR) && if [ ! -d .git ]; then git init -q; fi
|
|
@echo "✓ init complete"
|
|
|
|
deploy:
|
|
@echo "Running Knoe deployment..."
|
|
./deploy.sh
|
|
|
|
test: pyconv
|
|
@echo "Running full test suite..."
|
|
@./tests/run_tests.sh
|
|
@echo ""
|
|
@echo "Test Summary:"
|
|
@$(PYTHON) -m coverage report | grep TOTAL | awk '{print "Total Coverage: " $$4 " (Statements: " $$2 ", Missed: " $$3 ")"}'
|
|
|
|
pyconv:
|
|
@echo "Checking Python code style conventions..."
|
|
@$(PYTHON) -m black --check . || (echo "Warning: pyconv (black) found style issues. Run 'black .' to fix." && exit 1)
|
|
|
|
k3d-knoe-up:
|
|
@./scripts/k3d-knoe-up.sh
|
|
|
|
k3d-knoe-pf:
|
|
@./scripts/k3d-knoe-pf.sh
|
|
|
|
k3d-knoe-down:
|
|
@./scripts/k3d-knoe-down.sh
|
|
|
|
clean:
|
|
@echo "Cleaning build artifacts..."
|
|
rm -rf $(BUILD_DIR) $(DIST_DIR) *.spec
|
|
rm -rf __pycache__ knoe/__pycache__
|
|
@echo "✓ Clean complete"
|