coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.
This commit is contained in:
tegwick 2026-08-13 00:58:49 +02:00
parent bbf86b8373
commit 3a7d63e18f
18 changed files with 826 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

13
Containerfile
View file

@ -1,9 +1,18 @@
FROM python:3.12-slim
# Base pinned by digest, not a mutable tag (AUDIT-WP-0005-T03).
# Same python:3.12-slim digest as the deployed user-engine image.
FROM python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
ARG GIT_COMMIT=unknown
LABEL org.opencontainers.image.title="audit-core" \
org.opencontainers.image.source="https://forgejo.coulomb.social/coulomb/audit-core" \
org.opencontainers.image.revision="${GIT_COMMIT}"
RUN useradd --system --uid 10001 --create-home audit-core
WORKDIR /app
COPY pyproject.toml README.md LICENSE ./
COPY audit_core ./audit_core
RUN pip install --no-cache-dir ".[serve,postgres]"
USER 10001
USER 10001:10001
ENV PYTHONUNBUFFERED=1
EXPOSE 8080
CMD ["audit-core-ingest"]