tegwick
3bd005acc9
Document AAAA parking pitfall for activity.coulomb.social. Use web+websecure entrypoints and Authelia middleware on SSO Ingress manifests.
99 lines
3.1 KiB
Markdown
99 lines
3.1 KiB
Markdown
# Ops console + Temporal UI — SSO access design (ACTIVITY-WP-0025)
|
|
|
|
## Audience
|
|
|
|
Founders / platform operators who already have Authelia accounts under
|
|
`coulomb.social` SSO (LLDAP → Authelia → KeyCape MFA path).
|
|
|
|
## Hostnames (locked)
|
|
|
|
| Host | Backend | Purpose |
|
|
| --- | --- | --- |
|
|
| `activity.coulomb.social` | `actcore-api:8010` | Ops console `/ops/ui`, JSON `/ops/*`, existing API |
|
|
| `temporal.coulomb.social` | `actcore-temporal-ui:8080` | Temporal Web UI (clean short name) |
|
|
|
|
Both resolve to the railiance01 Traefik LB (`92.205.62.239`) once DNS A records
|
|
exist (same pattern as `forgejo.coulomb.social`).
|
|
|
|
## Auth edge (fleet pattern)
|
|
|
|
| Component | Location |
|
|
| --- | --- |
|
|
| Ingress controller | Traefik (`ingressClassName: traefik`) |
|
|
| TLS | cert-manager `ClusterIssuer/letsencrypt-prod` |
|
|
| Login portal | Authelia `https://auth.coulomb.social` |
|
|
| IAM / MFA | KeyCape `https://kc.coulomb.social` (post-password) |
|
|
| Forward auth | Traefik Middleware `forwardAuth` → Authelia `/api/verify` |
|
|
|
|
**Not** oauth2-proxy — the live railiance01 stack already runs Authelia in
|
|
namespace `sso`. Reuse it.
|
|
|
|
### Middleware
|
|
|
|
`Middleware/authelia-forwardauth` in `activity-core` calls:
|
|
|
|
```text
|
|
http://authelia.sso.svc.cluster.local:9091/api/verify?rd=https://auth.coulomb.social/
|
|
```
|
|
|
|
Response headers trusted into the app:
|
|
|
|
- `Remote-User`
|
|
- `Remote-Groups`
|
|
- `Remote-Name`
|
|
- `Remote-Email`
|
|
|
|
### Access control policy
|
|
|
|
Authelia global `default_policy: one_factor` currently applies. MVP accepts any
|
|
authenticated Authelia user. Follow-up (T06): LLDAP group
|
|
`activity-core-operators` + Authelia domain rules (net-kingdom config change).
|
|
|
|
## Mutation identity
|
|
|
|
Priority for ops mutations (`POST /ops/...`):
|
|
|
|
1. SSO principal from Authelia headers (preferred)
|
|
2. Shared `ACTIVITY_CORE_OPERATOR_TOKEN` (break-glass)
|
|
3. Else 401/403 fail-closed
|
|
|
|
## DNS (operator)
|
|
|
|
Create A records (or CNAME to the forgejo host pattern):
|
|
|
|
```text
|
|
activity.coulomb.social A 92.205.62.239
|
|
temporal.coulomb.social A 92.205.62.239
|
|
```
|
|
|
|
**Important:** do **not** leave a stale **AAAA** (IPv6) record for
|
|
`activity.coulomb.social` pointing at parking (e.g. IONOS
|
|
`2001:8d8:100f:f000::200` / `217.160.0.253`). Cluster resolvers prefer AAAA;
|
|
cert-manager HTTP-01 self-check then hits the wrong host and returns 204.
|
|
Either remove AAAA or set it to the railiance01 public IPv6.
|
|
|
|
Until DNS is correct, cert-manager Certificate may stay Pending.
|
|
|
|
## Break-glass
|
|
|
|
Port-forward remains documented in `docs/runbook.md` if Ingress/SSO is down.
|
|
|
|
## Manifests
|
|
|
|
- `k8s/railiance/30-authelia-middleware.yaml`
|
|
- `k8s/railiance/31-ingress-ops-sso.yaml`
|
|
- `k8s/railiance/32-ingress-temporal-sso.yaml`
|
|
|
|
Apply after DNS:
|
|
|
|
```bash
|
|
export KUBECONFIG=~/.kube/config-hosteurope
|
|
kubectl apply -f k8s/railiance/30-authelia-middleware.yaml
|
|
kubectl apply -f k8s/railiance/31-ingress-ops-sso.yaml
|
|
kubectl apply -f k8s/railiance/32-ingress-temporal-sso.yaml
|
|
# set public Temporal URL on API after cert Ready:
|
|
kubectl -n activity-core set env deploy/actcore-api \
|
|
ACTIVITY_CORE_TEMPORAL_UI_URL=https://temporal.coulomb.social
|
|
kubectl -n activity-core set env deploy/actcore-temporal-ui \
|
|
TEMPORAL_CORS_ORIGINS=https://temporal.coulomb.social
|
|
```
|