tegwick
57afafaced
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
87 lines
2.6 KiB
Markdown
87 lines
2.6 KiB
Markdown
# Local development
|
|
|
|
## Prerequisites
|
|
|
|
- Python 3.12+
|
|
- [`uv`](https://github.com/astral-sh/uv)
|
|
|
|
## Setup
|
|
|
|
```bash
|
|
cd ~/coulomb-social
|
|
uv sync
|
|
uv run manage.py migrate
|
|
uv run manage.py runserver 0.0.0.0:8008
|
|
```
|
|
|
|
Open http://127.0.0.1:8008/ — **Sign in** uses dev claims when
|
|
`OIDC_ENABLED=false` (default) and `DEBUG=true`.
|
|
|
|
## Tests
|
|
|
|
```bash
|
|
make test
|
|
# or
|
|
uv run pytest
|
|
```
|
|
|
|
## Environment
|
|
|
|
See `.env.example`. Summary:
|
|
|
|
| Variable | Default | Purpose |
|
|
|----------|---------|---------|
|
|
| `SECRET_KEY` | insecure dev default | Django secret |
|
|
| `DATABASE_URL` | sqlite `./db.sqlite3` | DB |
|
|
| `DEFAULT_TENANT_ID` | `tenant:coulomb` | Platform tenant claim (KeyCape default) |
|
|
| `OIDC_ENABLED` | `false` | Use KeyCape / real issuer |
|
|
| `OIDC_ISSUER` | | e.g. `https://kc.coulomb.social` |
|
|
| `OIDC_CLIENT_ID` | | `coulomb-social` |
|
|
| `OIDC_CLIENT_SECRET` | empty | **public client** — leave empty |
|
|
| `OIDC_REDIRECT_URI` | | `http://127.0.0.1:8008/auth/callback/` |
|
|
| `USER_ENGINE_BASE_URL` | empty (stub) | e.g. `https://users.92-205-62-239.nip.io` |
|
|
| `USER_ENGINE_PROXY_SECRET` | empty | trusted proxy secret (with base URL → HTTP) |
|
|
| `USER_ENGINE_APPLICATION_ID` | `coulomb-social` | App id |
|
|
| `USER_ENGINE_EXPECTED_AUDIENCE` | `user-engine-portal` | required aud for /me |
|
|
| `FLEX_AUTH_BASE_URL` | empty (fail-closed except shell:view) | PDP |
|
|
| `FORGEJO_BASE_URL` | `https://forgejo.coulomb.social` | Space markdown source |
|
|
| `FORGEJO_TOKEN` | empty | Private repo raw reads (secret) |
|
|
| `FORGEJO_WEBHOOK_SECRET` | empty | Push webhook cache bust (secret) |
|
|
| `NETKINGDOM_REGISTRATION_URL` | empty | Landing Create account (when NK ships) |
|
|
|
|
### Platform OIDC (KeyCape)
|
|
|
|
Historical client registration has drifted: guarded inspection on 2026-10-06
|
|
finds it absent. Inspect through the safe owner wrapper (read-only default):
|
|
|
|
```bash
|
|
./scripts/register-keycape-client.sh
|
|
```
|
|
|
|
Live repair requires exact founder approval; see docs/release/personal-account-2026-10-06.md.
|
|
|
|
App configuration:
|
|
|
|
```bash
|
|
export OIDC_ENABLED=true
|
|
export OIDC_ISSUER=https://kc.coulomb.social
|
|
export OIDC_CLIENT_ID=coulomb-social
|
|
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
|
|
export OIDC_SCOPES="openid profile email groups"
|
|
make run
|
|
```
|
|
|
|
Sign-in redirects to Authelia (`auth.coulomb.social`) + MFA via privacyIDEA.
|
|
|
|
See `docs/adr/ADR-0001-netkingdom-identity.md` and `docs/identity/`.
|
|
|
|
### Cluster env Secret (production)
|
|
|
|
```bash
|
|
# dry-run (key names only)
|
|
./scripts/create-env-secret.sh --dry-run
|
|
# apply (needs kubectl + cluster access)
|
|
./scripts/create-env-secret.sh
|
|
```
|
|
|
|
Delegates to `railiance-apps/tools/create-coulomb-social-env-secret.sh`.
|