coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4
This commit is contained in:
codex 2026-08-23 12:50:23 +02:00
parent 082c76979e
commit 517f68593d
13 changed files with 413 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

18
helm/openbao-ui-overlay/README.md
View file

@ -1,8 +1,9 @@
# OpenBao KeyCape login overlay
Streamlines the browser login mask at `https://bao.coulomb.social` to a single
**Sign in with KeyCape** action. Namespace, auth method, mount path, and role
are preset in `presets.json` and hidden by `overlay.css` / `overlay.js`.
Streamlines the browser login mask reached through the named
`openbao-ui-railiance01` operator tunnel at `http://127.0.0.1:18200` to a
single **Sign in with KeyCape** action. Namespace, auth method, mount path, and
role are preset in `presets.json` and hidden by `overlay.css` / `overlay.js`.
## Mechanism (T01 decision)
@ -54,9 +55,9 @@ make openbao-verify-login-overlay
3. Fetch live UI assets and compare hashes:
```bash
curl -sS https://bao.coulomb.social/ui/ -o /tmp/index.html
curl -sS http://127.0.0.1:18200/ui/ -o /tmp/index.html
# locate vault-*.js path in /tmp/index.html, then:
curl -sS "https://bao.coulomb.social/ui/assets/vault-....js" -o /tmp/vault.js
curl -sS "http://127.0.0.1:18200/ui/assets/vault-....js" -o /tmp/vault.js
sha256sum /tmp/index.html /tmp/vault.js
```
@ -64,6 +65,9 @@ make openbao-verify-login-overlay
`overlay.css` / `overlay.js` selectors against the new Ember templates.
5. Write `patches/<new-version>/manifest.sha256`, update `VERSION`.
6. Run `make openbao-verify-login-overlay CHECK_UPSTREAM_DRIFT=1`.
7. Attended browser login through KeyCape MFA.
7. Attended browser login through KeyCape MFA. The OpenBao role and KeyCape
client must both allow the exact loopback callback
`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` before the
former public listener is retracted.
Workplan: `helix-forge/workplans/HF-WP-0003-openbao-keycape-login-overlay.md`
Workplan: `helix-forge/workplans/HF-WP-0003-openbao-keycape-login-overlay.md`

6
helm/openbao-ui-overlay/patches/2.5.4/manifest.sha256
View file

@ -1,8 +1,8 @@
# OpenBao UI asset fingerprints for image tag 2.5.4.
# Regenerate after an OpenBao image bump when login markup drifts.
# Compare vault.js only — index.html is intentionally modified by the gateway.
# curl -sS https://bao.coulomb.social/ui/ -o /tmp/index.html
# curl -sS http://127.0.0.1:18200/ui/ -o /tmp/index.html
# vault_path=$(rg -o '/ui/assets/vault-[a-f0-9]+\\.js' /tmp/index.html | head -1)
# curl -sS "https://bao.coulomb.social${vault_path}" -o /tmp/vault.js
# curl -sS "http://127.0.0.1:18200${vault_path}" -o /tmp/vault.js
# sha256sum /tmp/vault.js
f0214b5be89377395f8d6521c34139877529bd95ba703901c78b527ab0f1c231 ui/assets/vault-bae6b876038fbf475728f993b5a62002.js
f0214b5be89377395f8d6521c34139877529bd95ba703901c78b527ab0f1c231 ui/assets/vault-bae6b876038fbf475728f993b5a62002.js