coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Activate ACTIVITY-WP-0025: Authelia SSO ingress for ops and Temporal UI
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 54s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m47s
Details

Browse source 
Mark workplan active. Add Traefik ForwardAuth middleware and Ingress
manifests for activity.coulomb.social and activity-temporal.coulomb.social.
Prefer Authelia SSO identity for ops mutations; document DNS gate and
fleet pattern (docs/ops-sso-access.md).
This commit is contained in:
tegwick 2026-07-22 00:47:29 +02:00
parent 7e71c0c837
commit f885697e96
13 changed files with 366 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

36
docs/runbook.md
View file

@ -105,31 +105,39 @@ the UI** — change definition files and sync.
### Production access (railiance01)
API remains **ClusterIP** (no public Ingress in WP-0024; SSO planned in
ACTIVITY-WP-0025). Use the **hosteurope / railiance01** kubeconfig, not a local
empty cluster.
**Primary (SSO — ACTIVITY-WP-0025):** after DNS A records exist:
| UI | URL |
| --- | --- |
| Ops console | https://activity.coulomb.social/ops/ui |
| Temporal Web UI | https://activity-temporal.coulomb.social |
Login via Authelia (`auth.coulomb.social`). Design: `docs/ops-sso-access.md`.
Mutations accept SSO identity headers; shared token is break-glass only.
**DNS (required for TLS):**
```text
activity.coulomb.social A 92.205.62.239
activity-temporal.coulomb.social A 92.205.62.239
```
**Break-glass port-forward** (hosteurope kubeconfig):
```bash
export KUBECONFIG=~/.kube/config-hosteurope
# Ops console (activity-core API)
kubectl -n activity-core port-forward svc/actcore-api 8010:8010
# Browser: http://127.0.0.1:8010/ops/ui
# Temporal Web UI (second terminal — linked from ops nav as "Temporal UI")
kubectl -n activity-core port-forward svc/actcore-temporal-ui 8080:8080
# Browser: http://127.0.0.1:8080
# http://127.0.0.1:8010/ops/ui and http://127.0.0.1:8080
```
Override the Temporal link target if needed:
Env overrides:
```bash
# on actcore-api
ACTIVITY_CORE_TEMPORAL_UI_URL=http://127.0.0.1:8080
ACTIVITY_CORE_TEMPORAL_UI_URL=https://activity-temporal.coulomb.social
ACTIVITY_CORE_OPERATOR_TOKEN=… # break-glass; in actcore-runtime-secret
```
Ensure `ACTIVITY_CORE_OPERATOR_TOKEN` is set on actcore-api (runtime secret key).
Bootstrap token (operator workstation; never commit the value):
```bash