coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish WP-0025 SSO cutover except group allowlist residual.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 29s
Details

Browse source 
Mark T03–T05 and T07–T08 done after live Authelia/TLS verification,
prefer SSO principal in ops UI copy and audits, and document break-glass
port-forward. Leave T06 waiting on net-kingdom LLDAP/Authelia group rules.
This commit is contained in:
tegwick 2026-07-22 10:23:36 +02:00
parent 27c087bcb4
commit 91353df7d0
8 changed files with 151 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/ops-sso-access.md
View file

@ -12,8 +12,10 @@ Founders / platform operators who already have Authelia accounts under
| `activity.coulomb.social` | `actcore-api:8010` | Ops console `/ops/ui`, JSON `/ops/*`, existing API |
| `temporal.coulomb.social` | `actcore-temporal-ui:8080` | Temporal Web UI (clean short name) |
Both resolve to the railiance01 Traefik LB (`92.205.62.239`) once DNS A records
exist (same pattern as `forgejo.coulomb.social`).
Both resolve to the railiance01 Traefik LB (`92.205.62.239`) — same pattern as
`forgejo.coulomb.social`. **DNS A records + Let's Encrypt certs are live**
(verified 2026-07-22); Certificate objects `actcore-ops-tls` /
`actcore-temporal-ui-tls` are Ready.
## Auth edge (fleet pattern)
@ -59,20 +61,17 @@ Priority for ops mutations (`POST /ops/...`):
## DNS (operator)
Create A records (or CNAME to the forgejo host pattern):
Expected records (live as of 2026-07-22):
```text
activity.coulomb.social A 92.205.62.239
temporal.coulomb.social A 92.205.62.239
```
**Important:** do **not** leave a stale **AAAA** (IPv6) record for
`activity.coulomb.social` pointing at parking (e.g. IONOS
`2001:8d8:100f:f000::200` / `217.160.0.253`). Cluster resolvers prefer AAAA;
cert-manager HTTP-01 self-check then hits the wrong host and returns 204.
Either remove AAAA or set it to the railiance01 public IPv6.
Until DNS is correct, cert-manager Certificate may stay Pending.
**Important:** do **not** leave a stale **AAAA** (IPv6) record for either host
pointing at parking (e.g. IONOS `2001:8d8:100f:f000::200` / `217.160.0.253`).
Cluster resolvers prefer AAAA; cert-manager HTTP-01 self-check then hits the
wrong host. Either remove AAAA or set it to the railiance01 public IPv6.
## Break-glass

31
docs/runbook.md
View file

@ -57,18 +57,23 @@ Prefer the **ops console** over ad-hoc SSH/SQL for “did automations run?” an
### Auth
| Mode | When | How |
| --- | --- | --- |
| **SSO (primary)** | Browser via `activity.coulomb.social` | Authelia session; app trusts `Remote-User` / `Remote-Email` from Traefik ForwardAuth |
| **Break-glass token** | Port-forward / emergency / scripts | `X-Operator-Token` or `Authorization: Bearer` |
| **Local dev** | No token configured | `ACTIVITY_CORE_OPS_ALLOW_UNAUTH_MUTATIONS=1` only |
| Env | Purpose |
| --- | --- |
| `ACTIVITY_CORE_OPERATOR_TOKEN` | Shared operator token; required for **mutations** |
| `ACTIVITY_CORE_OPERATOR_TOKEN` | Shared operator token (break-glass); custody in `actcore-runtime-secret` |
| `ACTIVITY_CORE_OPS_ALLOW_UNAUTH_MUTATIONS` | `1` only for local dev without a token |
Mutations: `POST /ops/automations/{id}/trigger|enable|disable|pause|unpause`
Header: `X-Operator-Token: <token>` (or `Authorization: Bearer <token>`).
Mutations: `POST /ops/automations/{id}/trigger|enable|disable|pause|unpause`.
Fail-closed: if the token is unset and unauth is not allowed, mutations return
**403**. Reads (`GET /ops/...`) do not require the token (ClusterIP / port-forward
posture). **Do not** put the token in git, chat, or workplans. Store in
`actcore-runtime-secret` (or local `.env`) via operator custody.
Fail-closed: without SSO headers and without a valid token (and unauth not
allowed), mutations return **401/403**. Reads (`GET /ops/...`) do not require
auth at the app layer (ingress still gates browser access via Authelia).
**Do not** put the token in git, chat, or workplans.
### Daily checklist
@ -99,13 +104,13 @@ curl -sS -X POST "http://localhost:8010/ops/automations/<id>/disable" \
-H "X-Operator-Token: $ACTIVITY_CORE_OPERATOR_TOKEN"
```
Thin UI: open `/ops/ui`, paste the operator token into the browser field
(localStorage only), then use Run now / pause actions. **Cron edits are not in
Thin UI: open https://activity.coulomb.social/ops/ui (SSO). Break-glass UI still
accepts a pasted operator token (localStorage only). **Cron edits are not in
the UI** — change definition files and sync.
### Production access (railiance01)
**Primary (SSO — ACTIVITY-WP-0025):** after DNS A records exist:
**Primary (SSO — ACTIVITY-WP-0025, live):**
| UI | URL |
| --- | --- |
@ -113,12 +118,12 @@ the UI** — change definition files and sync.
| Temporal Web UI | https://temporal.coulomb.social |
Login via Authelia (`auth.coulomb.social`). Design: `docs/ops-sso-access.md`.
Mutations accept SSO identity headers; shared token is break-glass only.
Mutations use SSO identity; shared token is break-glass only.
**DNS (required for TLS):**
**DNS (already set for TLS):**
```text
activity.coulomb.social A 92.205.62.239
activity.coulomb.social A 92.205.62.239
temporal.coulomb.social A 92.205.62.239
```