coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use temporal.coulomb.social for Temporal UI SSO host
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m12s
Details

Browse source 
Prefer clean short hostname temporal.coulomb.social instead of
activity-temporal.coulomb.social for Ingress, CORS, and ops UI links.
This commit is contained in:
tegwick 2026-07-22 01:17:52 +02:00
parent 2acf2baffa
commit 54431db583
9 changed files with 21 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

2
SCOPE.md
View file

@ -213,7 +213,7 @@ Open product/policy workplan: **ACTIVITY-WP-0022** (IssueSink no-default-Forgejo
| **G7. Credential delivery** | Low (residual) | **FORGEJO_TOKEN** via ESO `actcore-forgejo-admin` (WP-0023-T05, Ready). issue-core `GITEA_BACKEND_TOKEN` still 503 forgejo-inbox for path A rest — **issue-core owner** (WP-0023-T06). |
| **G8. Live-images hygiene** | Medium (ops) | Multi-cluster `live-images-all.txt` must be refreshed after deploys or prune can delete live tags (incident 2026-07-21, restored). `scripts/refresh_live_images.sh` (T04). |
| **G9. Evidence federation** | Low | Progress often lands on railiance01 edge/hub; workstation primary hub may not show the same feed without tunnel/outbox health. |
| **G10. API external access** | Medium (in progress) | WP-0025: Traefik + Authelia SSO for `activity.coulomb.social` + `activity-temporal.coulomb.social`; port-forward remains break-glass until DNS/certs Ready. |
| **G10. API external access** | Medium (in progress) | WP-0025: Traefik + Authelia SSO for `activity.coulomb.social` + `temporal.coulomb.social`; port-forward remains break-glass until DNS/certs Ready. |
### Drift risks

8
docs/ops-sso-access.md
View file

@ -10,7 +10,7 @@ Founders / platform operators who already have Authelia accounts under
| Host | Backend | Purpose |
| --- | --- | --- |
| `activity.coulomb.social` | `actcore-api:8010` | Ops console `/ops/ui`, JSON `/ops/*`, existing API |
| `activity-temporal.coulomb.social` | `actcore-temporal-ui:8080` | Temporal Web UI |
| `temporal.coulomb.social` | `actcore-temporal-ui:8080` | Temporal Web UI (clean short name) |
Both resolve to the railiance01 Traefik LB (`92.205.62.239`) once DNS A records
exist (same pattern as `forgejo.coulomb.social`).
@ -63,7 +63,7 @@ Create A records (or CNAME to the forgejo host pattern):
```text
activity.coulomb.social A 92.205.62.239
activity-temporal.coulomb.social A 92.205.62.239
temporal.coulomb.social A 92.205.62.239
```
Until DNS exists, cert-manager Certificate will stay Pending and HTTPS will not
@ -88,7 +88,7 @@ kubectl apply -f k8s/railiance/31-ingress-ops-sso.yaml
kubectl apply -f k8s/railiance/32-ingress-temporal-sso.yaml
# set public Temporal URL on API after cert Ready:
kubectl -n activity-core set env deploy/actcore-api \
ACTIVITY_CORE_TEMPORAL_UI_URL=https://activity-temporal.coulomb.social
ACTIVITY_CORE_TEMPORAL_UI_URL=https://temporal.coulomb.social
kubectl -n activity-core set env deploy/actcore-temporal-ui \
TEMPORAL_CORS_ORIGINS=https://activity-temporal.coulomb.social
TEMPORAL_CORS_ORIGINS=https://temporal.coulomb.social
```

6
docs/runbook.md
View file

@ -110,7 +110,7 @@ the UI** — change definition files and sync.
| UI | URL |
| --- | --- |
| Ops console | https://activity.coulomb.social/ops/ui |
| Temporal Web UI | https://activity-temporal.coulomb.social |
| Temporal Web UI | https://temporal.coulomb.social |
Login via Authelia (`auth.coulomb.social`). Design: `docs/ops-sso-access.md`.
Mutations accept SSO identity headers; shared token is break-glass only.
@ -119,7 +119,7 @@ Mutations accept SSO identity headers; shared token is break-glass only.
```text
activity.coulomb.social A 92.205.62.239
activity-temporal.coulomb.social A 92.205.62.239
temporal.coulomb.social A 92.205.62.239
```
**Break-glass port-forward** (hosteurope kubeconfig):
@ -134,7 +134,7 @@ kubectl -n activity-core port-forward svc/actcore-temporal-ui 8080:8080
Env overrides:
```bash
ACTIVITY_CORE_TEMPORAL_UI_URL=https://activity-temporal.coulomb.social
ACTIVITY_CORE_TEMPORAL_UI_URL=https://temporal.coulomb.social
ACTIVITY_CORE_OPERATOR_TOKEN=… # break-glass; in actcore-runtime-secret
```

2
k8s/railiance/10-infrastructure.yaml
View file

@ -385,4 +385,4 @@ spec:
value: actcore-temporal:7233
- name: TEMPORAL_CORS_ORIGINS
# Include SSO host (ACTIVITY-WP-0025) and local port-forward.
value: https://activity-temporal.coulomb.social,http://localhost:8080,http://127.0.0.1:8080
value: https://temporal.coulomb.social,http://localhost:8080,http://127.0.0.1:8080

6
k8s/railiance/32-ingress-temporal-sso.yaml
View file

@ -1,5 +1,5 @@
# HTTPS SSO front door for Temporal Web UI.
# Requires DNS: activity-temporal.coulomb.social A → 92.205.62.239
# Requires DNS: temporal.coulomb.social A → 92.205.62.239
# ACTIVITY-WP-0025
apiVersion: networking.k8s.io/v1
kind: Ingress
@ -19,10 +19,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- activity-temporal.coulomb.social
- temporal.coulomb.social
secretName: actcore-temporal-ui-tls
rules:
- host: activity-temporal.coulomb.social
- host: temporal.coulomb.social
http:
paths:
- path: /

6
k8s/railiance/README.md
View file

@ -118,17 +118,17 @@ kubectl -n activity-core get svc
```bash
# DNS A records → 92.205.62.239 (once):
# activity.coulomb.social
# activity-temporal.coulomb.social
# temporal.coulomb.social
kubectl apply -f k8s/railiance/30-authelia-middleware.yaml
kubectl apply -f k8s/railiance/31-ingress-ops-sso.yaml
kubectl apply -f k8s/railiance/32-ingress-temporal-sso.yaml
kubectl -n activity-core set env deploy/actcore-api \
ACTIVITY_CORE_TEMPORAL_UI_URL=https://activity-temporal.coulomb.social
ACTIVITY_CORE_TEMPORAL_UI_URL=https://temporal.coulomb.social
```
- Ops: https://activity.coulomb.social/ops/ui (Authelia SSO)
- Temporal: https://activity-temporal.coulomb.social
- Temporal: https://temporal.coulomb.social
- Design: `docs/ops-sso-access.md`
### Break-glass port-forward

6
src/activity_core/ops_api.py
View file

@ -256,7 +256,7 @@ async def auth_status() -> dict[str, Any]:
"sso_docs": "/docs not required — see docs/ops-sso-access.md",
"public_hosts": {
"ops": "https://activity.coulomb.social",
"temporal_ui": "https://activity-temporal.coulomb.social",
"temporal_ui": "https://temporal.coulomb.social",
},
}
@ -289,9 +289,9 @@ def temporal_ui_url() -> str:
raw = (
os.environ.get("ACTIVITY_CORE_TEMPORAL_UI_URL")
or os.environ.get("TEMPORAL_UI_URL")
or "https://activity-temporal.coulomb.social"
or "https://temporal.coulomb.social"
).strip()
return raw.rstrip("/") or "https://activity-temporal.coulomb.social"
return raw.rstrip("/") or "https://temporal.coulomb.social"
def _page(title: str, body: str) -> HTMLResponse:

2
tests/test_ops_console_api.py
View file

@ -218,7 +218,7 @@ async def test_ui_index_renders(ops_app: FastAPI, monkeypatch: pytest.MonkeyPatc
assert "Daily Triage" in res.text
assert "Operator token" in res.text
assert "Temporal UI" in res.text
assert "activity-temporal.coulomb.social" in res.text
assert "temporal.coulomb.social" in res.text
@pytest.mark.asyncio

4
workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
View file

@ -248,7 +248,7 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
| Task | Status | Notes |
| --- | --- | --- |
| T01 | done | Hosts: activity.coulomb.social + activity-temporal.coulomb.social; docs/ops-sso-access.md |
| T01 | done | Hosts: activity.coulomb.social + temporal.coulomb.social; docs/ops-sso-access.md |
| T02 | done | Reuse Authelia + Traefik ForwardAuth (sso ns); not oauth2-proxy |
| T03 | progress | Ingress + middleware manifests landed; **blocked on DNS A records** for cert |
| T04 | progress | Temporal Ingress manifest + CORS env; same DNS gate |
@ -259,4 +259,4 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
**Operator action required:** create DNS A records for both hosts → 92.205.62.239,
then apply `k8s/railiance/30-*.yaml`–`32-*.yaml` and set
`ACTIVITY_CORE_TEMPORAL_UI_URL=https://activity-temporal.coulomb.social` on actcore-api.
`ACTIVITY_CORE_TEMPORAL_UI_URL=https://temporal.coulomb.social` on actcore-api.