coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Activate ACTIVITY-WP-0025: Authelia SSO ingress for ops and Temporal UI
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 54s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m47s
Details

Browse source 
Mark workplan active. Add Traefik ForwardAuth middleware and Ingress
manifests for activity.coulomb.social and activity-temporal.coulomb.social.
Prefer Authelia SSO identity for ops mutations; document DNS gate and
fleet pattern (docs/ops-sso-access.md).
This commit is contained in:
tegwick 2026-07-22 00:47:29 +02:00
parent 7e71c0c837
commit f885697e96
13 changed files with 366 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/activity_core/ops_api.py
View file

@ -15,7 +15,12 @@ from pydantic import BaseModel, Field
from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
from temporalio.client import Client
from activity_core.ops_auth import HEADER_NAME, operator_token_configured, require_operator
from activity_core.ops_auth import (
HEADER_NAME,
extract_sso_principal,
operator_token_configured,
require_operator,
)
from activity_core.ops_console import (
is_side_effect_definition,
ops_definition_detail,
@ -248,6 +253,11 @@ async def auth_status() -> dict[str, Any]:
"mutation_header": HEADER_NAME,
"mutations_require_token": operator_token_configured() or not allow,
"temporal_ui_url": temporal_ui_url(),
"sso_docs": "/docs not required — see docs/ops-sso-access.md",
"public_hosts": {
"ops": "https://activity.coulomb.social",
"temporal_ui": "https://activity-temporal.coulomb.social",
},
}
@ -271,17 +281,17 @@ pre { background: #f8f8f8; padding: 0.75rem; overflow: auto; font-size: 0.8rem;
def temporal_ui_url() -> str:
"""Browser URL for Temporal Web UI (port-forward or future SSO ingress).
"""Browser URL for Temporal Web UI (SSO ingress or local port-forward).
Override with ACTIVITY_CORE_TEMPORAL_UI_URL. Default assumes a local
port-forward of actcore-temporal-ui to 127.0.0.1:8080 (see runbook).
Override with ACTIVITY_CORE_TEMPORAL_UI_URL. Default prefers the public SSO
hostname when set via env; otherwise local port-forward on :8080.
"""
raw = (
os.environ.get("ACTIVITY_CORE_TEMPORAL_UI_URL")
or os.environ.get("TEMPORAL_UI_URL")
or "http://127.0.0.1:8080"
or "https://activity-temporal.coulomb.social"
).strip()
return raw.rstrip("/") or "http://127.0.0.1:8080"
return raw.rstrip("/") or "https://activity-temporal.coulomb.social"
def _page(title: str, body: str) -> HTMLResponse: