coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Activate ACTIVITY-WP-0025: Authelia SSO ingress for ops and Temporal UI
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 54s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m47s
Details

Browse source 
Mark workplan active. Add Traefik ForwardAuth middleware and Ingress
manifests for activity.coulomb.social and activity-temporal.coulomb.social.
Prefer Authelia SSO identity for ops mutations; document DNS gate and
fleet pattern (docs/ops-sso-access.md).
This commit is contained in:
tegwick 2026-07-22 00:47:29 +02:00
parent 7e71c0c837
commit f885697e96
13 changed files with 366 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

35
k8s/railiance/README.md
View file

@ -111,20 +111,33 @@ kubectl -n activity-core get pods
kubectl -n activity-core get svc
```
## Operator automation console (ACTIVITY-WP-0024)
## Operator automation console (ACTIVITY-WP-0024 / 0025)
API Service is ClusterIP-only. From a shell with cluster access:
### SSO (primary, after DNS)
```bash
kubectl -n activity-core port-forward svc/actcore-api 8010:8010
# UI: http://127.0.0.1:8010/ops/ui
# JSON: http://127.0.0.1:8010/ops/automations/status?since=sunday
# DNS A records → 92.205.62.239 (once):
# activity.coulomb.social
# activity-temporal.coulomb.social
kubectl apply -f k8s/railiance/30-authelia-middleware.yaml
kubectl apply -f k8s/railiance/31-ingress-ops-sso.yaml
kubectl apply -f k8s/railiance/32-ingress-temporal-sso.yaml
kubectl -n activity-core set env deploy/actcore-api \
ACTIVITY_CORE_TEMPORAL_UI_URL=https://activity-temporal.coulomb.social
```
Mutations require `ACTIVITY_CORE_OPERATOR_TOKEN` in `actcore-runtime-secret`
(injected via `envFrom` on `actcore-api`). Merge the key into the existing
secret (do not replace DB URL keys). Header: `X-Operator-Token`. See
`docs/runbook.md` § Operator automation console.
- Ops: https://activity.coulomb.social/ops/ui (Authelia SSO)
- Temporal: https://activity-temporal.coulomb.social
- Design: `docs/ops-sso-access.md`
Cron/schedule expression changes remain git-owned (definition files + sync);
the console supports Run now, enable/disable, and Temporal pause/unpause only.
### Break-glass port-forward
```bash
export KUBECONFIG=~/.kube/config-hosteurope
kubectl -n activity-core port-forward svc/actcore-api 8010:8010
# UI: http://127.0.0.1:8010/ops/ui
```
Mutations: SSO headers when behind Authelia, else `X-Operator-Token` from
`actcore-runtime-secret`. Cron edits remain git-owned.