coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish WP-0025 SSO cutover except group allowlist residual.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 29s
Details

Browse source 
Mark T03–T05 and T07–T08 done after live Authelia/TLS verification,
prefer SSO principal in ops UI copy and audits, and document break-glass
port-forward. Leave T06 waiting on net-kingdom LLDAP/Authelia group rules.
This commit is contained in:
tegwick 2026-07-22 10:23:36 +02:00
parent 27c087bcb4
commit 91353df7d0
8 changed files with 151 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

25
src/activity_core/ops_api.py
View file

@ -248,15 +248,20 @@ async def auth_status() -> dict[str, Any]:
"yes",
"on",
}
temporal = temporal_ui_url()
return {
"operator_token_configured": operator_token_configured(),
"mutation_header": HEADER_NAME,
# True when a shared token is required for *break-glass* / non-SSO clients.
# Browser SSO (Authelia Remote-User / Remote-Email) does not need the token.
"mutations_require_token": operator_token_configured() or not allow,
"temporal_ui_url": temporal_ui_url(),
"sso_docs": "/docs not required — see docs/ops-sso-access.md",
"sso_preferred": True,
"sso_headers": ["Remote-User", "Remote-Email", "Remote-Groups"],
"temporal_ui_url": temporal,
"sso_docs": "docs/ops-sso-access.md",
"public_hosts": {
"ops": "https://activity.coulomb.social",
"temporal_ui": "https://temporal.coulomb.social",
"temporal_ui": temporal,
},
}
@ -309,7 +314,7 @@ def _page(title: str, body: str) -> HTMLResponse:
<a href="/ops/ui">Inventory</a>
<a href="/ops/ui/status?since=sunday">Status</a>
<a class="external" href="{temporal_href}" target="_blank" rel="noopener noreferrer"
title="Temporal Web UI — port-forward actcore-temporal-ui :8080 until SSO ingress">Temporal UI</a>
title="Temporal Web UI (SSO: temporal.coulomb.social)">Temporal UI</a>
<a href="/ops/auth/status">Auth JSON</a>
</nav>
<hr/>
@ -351,12 +356,15 @@ def _token_form() -> str:
configured = "yes" if operator_token_configured() else "no"
return f"""
<div class="card">
<label>Operator token (browser only):
<p><strong>Auth:</strong> On
<a href="https://activity.coulomb.social/ops/ui">activity.coulomb.social</a>,
Authelia SSO identity is preferred for mutations (no token paste needed).</p>
<label>Break-glass operator token (port-forward / emergency only):
<input id="op-token" type="password" placeholder="X-Operator-Token value" autocomplete="off"/>
</label>
<button type="button" onclick="saveToken()">Save token</button>
<p class="muted">Server token configured: <strong>{configured}</strong>.
Mutations require header <code>{html.escape(HEADER_NAME)}</code>.</p>
<p class="muted">Shared token configured on server: <strong>{configured}</strong>.
Header <code>{html.escape(HEADER_NAME)}</code> only when not using SSO.</p>
</div>
"""
@ -405,8 +413,7 @@ async def ui_index() -> HTMLResponse:
<p class="muted">Temporal Web UI (workflow debugger):
<a class="external" href="{html.escape(temporal_ui_url(), quote=True)}"
target="_blank" rel="noopener noreferrer">{html.escape(temporal_ui_url())}</a>
— requires port-forward of <code>svc/actcore-temporal-ui 8080:8080</code>
until SSO ingress (ACTIVITY-WP-0025).</p>
— primary SSO URL; port-forward of <code>svc/actcore-temporal-ui</code> is break-glass only.</p>
"""
return _page("Inventory", body)