coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish WP-0025 SSO cutover except group allowlist residual.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 29s
Details

Browse source 
Mark T03–T05 and T07–T08 done after live Authelia/TLS verification,
prefer SSO principal in ops UI copy and audits, and document break-glass
port-forward. Leave T06 waiting on net-kingdom LLDAP/Authelia group rules.
This commit is contained in:
tegwick 2026-07-22 10:23:36 +02:00
parent 27c087bcb4
commit 91353df7d0
8 changed files with 151 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

31
docs/runbook.md
View file

@ -57,18 +57,23 @@ Prefer the **ops console** over ad-hoc SSH/SQL for “did automations run?” an
### Auth
| Mode | When | How |
| --- | --- | --- |
| **SSO (primary)** | Browser via `activity.coulomb.social` | Authelia session; app trusts `Remote-User` / `Remote-Email` from Traefik ForwardAuth |
| **Break-glass token** | Port-forward / emergency / scripts | `X-Operator-Token` or `Authorization: Bearer` |
| **Local dev** | No token configured | `ACTIVITY_CORE_OPS_ALLOW_UNAUTH_MUTATIONS=1` only |
| Env | Purpose |
| --- | --- |
| `ACTIVITY_CORE_OPERATOR_TOKEN` | Shared operator token; required for **mutations** |
| `ACTIVITY_CORE_OPERATOR_TOKEN` | Shared operator token (break-glass); custody in `actcore-runtime-secret` |
| `ACTIVITY_CORE_OPS_ALLOW_UNAUTH_MUTATIONS` | `1` only for local dev without a token |
Mutations: `POST /ops/automations/{id}/trigger|enable|disable|pause|unpause`
Header: `X-Operator-Token: <token>` (or `Authorization: Bearer <token>`).
Mutations: `POST /ops/automations/{id}/trigger|enable|disable|pause|unpause`.
Fail-closed: if the token is unset and unauth is not allowed, mutations return
**403**. Reads (`GET /ops/...`) do not require the token (ClusterIP / port-forward
posture). **Do not** put the token in git, chat, or workplans. Store in
`actcore-runtime-secret` (or local `.env`) via operator custody.
Fail-closed: without SSO headers and without a valid token (and unauth not
allowed), mutations return **401/403**. Reads (`GET /ops/...`) do not require
auth at the app layer (ingress still gates browser access via Authelia).
**Do not** put the token in git, chat, or workplans.
### Daily checklist
@ -99,13 +104,13 @@ curl -sS -X POST "http://localhost:8010/ops/automations/<id>/disable" \
-H "X-Operator-Token: $ACTIVITY_CORE_OPERATOR_TOKEN"
```
Thin UI: open `/ops/ui`, paste the operator token into the browser field
(localStorage only), then use Run now / pause actions. **Cron edits are not in
Thin UI: open https://activity.coulomb.social/ops/ui (SSO). Break-glass UI still
accepts a pasted operator token (localStorage only). **Cron edits are not in
the UI** — change definition files and sync.
### Production access (railiance01)
**Primary (SSO — ACTIVITY-WP-0025):** after DNS A records exist:
**Primary (SSO — ACTIVITY-WP-0025, live):**
| UI | URL |
| --- | --- |
@ -113,12 +118,12 @@ the UI** — change definition files and sync.
| Temporal Web UI | https://temporal.coulomb.social |
Login via Authelia (`auth.coulomb.social`). Design: `docs/ops-sso-access.md`.
Mutations accept SSO identity headers; shared token is break-glass only.
Mutations use SSO identity; shared token is break-glass only.
**DNS (required for TLS):**
**DNS (already set for TLS):**
```text
activity.coulomb.social A 92.205.62.239
activity.coulomb.social A 92.205.62.239
temporal.coulomb.social A 92.205.62.239
```