coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Activate ACTIVITY-WP-0025: Authelia SSO ingress for ops and Temporal UI
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 54s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m47s
Details

Browse source 
Mark workplan active. Add Traefik ForwardAuth middleware and Ingress
manifests for activity.coulomb.social and activity-temporal.coulomb.social.
Prefer Authelia SSO identity for ops mutations; document DNS gate and
fleet pattern (docs/ops-sso-access.md).
This commit is contained in:
tegwick 2026-07-22 00:47:29 +02:00
parent 7e71c0c837
commit f885697e96
13 changed files with 366 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

33
workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "SSO access control for ops console and Temporal UI"
domain: infotech
repo: activity-core
status: proposed
status: active
owner: codex
topic_slug: activity-core
created: "2026-07-22"
@ -81,7 +81,7 @@ git or State Hub.
```task
id: ACTIVITY-WP-0025-T01
status: todo
status: done
priority: high
state_hub_task_id: "de28ac08-cae5-476b-b093-82fcf8e3fa5e"
```
@ -100,7 +100,7 @@ hostnames and IdP group named.
```task
id: ACTIVITY-WP-0025-T02
status: todo
status: done
priority: high
state_hub_task_id: "650db102-ad4e-4d8e-86c1-eee50f5bafcc"
```
@ -116,7 +116,7 @@ state_hub_task_id: "650db102-ad4e-4d8e-86c1-eee50f5bafcc"
```task
id: ACTIVITY-WP-0025-T03
status: todo
status: progress
priority: high
state_hub_task_id: "7084f7d5-4181-4dfa-b239-0dad15efbae9"
```
@ -134,7 +134,7 @@ port-forward; unauthorized gets login or 403.
```task
id: ACTIVITY-WP-0025-T04
status: todo
status: progress
priority: high
state_hub_task_id: "99b36f31-eb19-4f96-b3f1-9ac1ab02d78f"
```
@ -151,7 +151,7 @@ port-forward, under SSO.
```task
id: ACTIVITY-WP-0025-T05
status: todo
status: progress
priority: high
state_hub_task_id: "77fff202-bfb6-49eb-b8e5-3760abacc8bd"
```
@ -170,7 +170,7 @@ token not required for normal operator use.
```task
id: ACTIVITY-WP-0025-T06
status: todo
status: wait
priority: medium
state_hub_task_id: "b14e1f2c-1320-4218-8bd3-2a309295a69c"
```
@ -186,7 +186,7 @@ account.
```task
id: ACTIVITY-WP-0025-T07
status: todo
status: progress
priority: medium
state_hub_task_id: "c5945e64-c460-4830-a19e-a944bb44a67e"
```
@ -243,3 +243,20 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
- `src/activity_core/ops_api.py` — `ACTIVITY_CORE_TEMPORAL_UI_URL`
- `k8s/railiance/` — `actcore-api`, `actcore-temporal-ui` ClusterIP services
- ACTIVITY-WP-0024 operator automation console
## Progress 2026-07-22
| Task | Status | Notes |
| --- | --- | --- |
| T01 | done | Hosts: activity.coulomb.social + activity-temporal.coulomb.social; docs/ops-sso-access.md |
| T02 | done | Reuse Authelia + Traefik ForwardAuth (sso ns); not oauth2-proxy |
| T03 | progress | Ingress + middleware manifests landed; **blocked on DNS A records** for cert |
| T04 | progress | Temporal Ingress manifest + CORS env; same DNS gate |
| T05 | progress | SSO headers preferred over shared token in ops_auth |
| T06 | wait | LLDAP group activity-core-operators + Authelia rules (net-kingdom) |
| T07 | progress | Runbook + design doc updated |
| T08 | todo | After DNS/cert Ready: smoke HTTPS + SSO login |
**Operator action required:** create DNS A records for both hosts → 92.205.62.239,
then apply `k8s/railiance/30-*.yaml`–`32-*.yaml` and set
`ACTIVITY_CORE_TEMPORAL_UI_URL=https://activity-temporal.coulomb.social` on actcore-api.