coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish WP-0025 SSO cutover except group allowlist residual.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 29s
Details

Browse source 
Mark T03–T05 and T07–T08 done after live Authelia/TLS verification,
prefer SSO principal in ops UI copy and audits, and document break-glass
port-forward. Leave T06 waiting on net-kingdom LLDAP/Authelia group rules.
This commit is contained in:
tegwick 2026-07-22 10:23:36 +02:00
parent 27c087bcb4
commit 91353df7d0
8 changed files with 151 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/ops-sso-access.md
View file

@ -12,8 +12,10 @@ Founders / platform operators who already have Authelia accounts under
| `activity.coulomb.social` | `actcore-api:8010` | Ops console `/ops/ui`, JSON `/ops/*`, existing API |
| `temporal.coulomb.social` | `actcore-temporal-ui:8080` | Temporal Web UI (clean short name) |
Both resolve to the railiance01 Traefik LB (`92.205.62.239`) once DNS A records
exist (same pattern as `forgejo.coulomb.social`).
Both resolve to the railiance01 Traefik LB (`92.205.62.239`) — same pattern as
`forgejo.coulomb.social`. **DNS A records + Let's Encrypt certs are live**
(verified 2026-07-22); Certificate objects `actcore-ops-tls` /
`actcore-temporal-ui-tls` are Ready.
## Auth edge (fleet pattern)
@ -59,20 +61,17 @@ Priority for ops mutations (`POST /ops/...`):
## DNS (operator)
Create A records (or CNAME to the forgejo host pattern):
Expected records (live as of 2026-07-22):
```text
activity.coulomb.social A 92.205.62.239
temporal.coulomb.social A 92.205.62.239
```
**Important:** do **not** leave a stale **AAAA** (IPv6) record for
`activity.coulomb.social` pointing at parking (e.g. IONOS
`2001:8d8:100f:f000::200` / `217.160.0.253`). Cluster resolvers prefer AAAA;
cert-manager HTTP-01 self-check then hits the wrong host and returns 204.
Either remove AAAA or set it to the railiance01 public IPv6.
Until DNS is correct, cert-manager Certificate may stay Pending.
**Important:** do **not** leave a stale **AAAA** (IPv6) record for either host
pointing at parking (e.g. IONOS `2001:8d8:100f:f000::200` / `217.160.0.253`).
Cluster resolvers prefer AAAA; cert-manager HTTP-01 self-check then hits the
wrong host. Either remove AAAA or set it to the railiance01 public IPv6.
## Break-glass