Sienna Meridian Satterwhite
7ffddcafcd
- Fix Hydra postLogoutRedirectUris for docs and people to match the actual URI sent by mozilla_django_oidc v5 (/api/v1.0/logout-callback/) instead of the root URL, resolving 599 logout errors. - Fix docs y-provider WebSocket backend port: use Service port 443 (not pod port 4444 which has no DNAT rule) in Pingora config. - Tighten VSO VaultDynamicSecret rotation sync: add allowStaticCreds:true and reduce refreshAfter from 1h to 5m across all static-creds paths (kratos, hydra, gitea, hive, people, docs) so credential rotation is reflected within 5 minutes instead of up to 1 hour. - Set Hydra token TTLs: access_token and id_token to 5m; refresh_token to 720h (30 days). Kratos session carries silent re-auth so the short access token TTL does not require users to log in manually. - Set SESSION_COOKIE_AGE=3600 (1h) in docs and people backends. After 1h, apps silently re-auth via the active Kratos session. Disabled identities (sunbeam user disable) cannot re-auth on next expiry.
144 lines
5.1 KiB
YAML
144 lines
5.1 KiB
YAML
# La Suite Numérique — People (desk chart).
|
|
# Env vars use the chart's dict-based envVars schema:
|
|
# string value → rendered as env.value
|
|
# map value → rendered as env.valueFrom (configMapKeyRef / secretKeyRef)
|
|
# DOMAIN_SUFFIX is substituted by sed at deploy time.
|
|
#
|
|
# Required secrets (created by seed script):
|
|
# oidc-people — CLIENT_ID, CLIENT_SECRET (created by Hydra Maester)
|
|
# people-db-credentials — password
|
|
# people-django-secret — DJANGO_SECRET_KEY
|
|
# seaweedfs-s3-credentials — S3_ACCESS_KEY, S3_SECRET_KEY (shared)
|
|
|
|
fullnameOverride: people
|
|
|
|
backend:
|
|
createsuperuser:
|
|
# Superuser creation disabled — users authenticate via OIDC.
|
|
enabled: false
|
|
|
|
envVars: &commonEnvVars
|
|
# ── Database ─────────────────────────────────────────────────────────────
|
|
DB_NAME: people_db
|
|
DB_USER: people
|
|
DB_HOST:
|
|
configMapKeyRef:
|
|
name: lasuite-postgres
|
|
key: DB_HOST
|
|
DB_PORT:
|
|
configMapKeyRef:
|
|
name: lasuite-postgres
|
|
key: DB_PORT
|
|
DB_ENGINE:
|
|
configMapKeyRef:
|
|
name: lasuite-postgres
|
|
key: DB_ENGINE
|
|
DB_PASSWORD:
|
|
secretKeyRef:
|
|
name: people-db-credentials
|
|
key: password
|
|
|
|
# ── Redis / Celery ────────────────────────────────────────────────────────
|
|
REDIS_URL:
|
|
configMapKeyRef:
|
|
name: lasuite-valkey
|
|
key: REDIS_URL
|
|
CELERY_BROKER_URL:
|
|
configMapKeyRef:
|
|
name: lasuite-valkey
|
|
key: CELERY_BROKER_URL
|
|
|
|
# ── S3 (profile media) ────────────────────────────────────────────────────
|
|
AWS_STORAGE_BUCKET_NAME: sunbeam-people
|
|
AWS_S3_ENDPOINT_URL:
|
|
configMapKeyRef:
|
|
name: lasuite-s3
|
|
key: AWS_S3_ENDPOINT_URL
|
|
AWS_S3_REGION_NAME:
|
|
configMapKeyRef:
|
|
name: lasuite-s3
|
|
key: AWS_S3_REGION_NAME
|
|
AWS_DEFAULT_ACL:
|
|
configMapKeyRef:
|
|
name: lasuite-s3
|
|
key: AWS_DEFAULT_ACL
|
|
AWS_ACCESS_KEY_ID:
|
|
secretKeyRef:
|
|
name: seaweedfs-s3-credentials
|
|
key: S3_ACCESS_KEY
|
|
AWS_SECRET_ACCESS_KEY:
|
|
secretKeyRef:
|
|
name: seaweedfs-s3-credentials
|
|
key: S3_SECRET_KEY
|
|
|
|
# ── OIDC (Hydra) ──────────────────────────────────────────────────────────
|
|
OIDC_RP_CLIENT_ID:
|
|
secretKeyRef:
|
|
name: oidc-people
|
|
key: CLIENT_ID
|
|
OIDC_RP_CLIENT_SECRET:
|
|
secretKeyRef:
|
|
name: oidc-people
|
|
key: CLIENT_SECRET
|
|
OIDC_RP_SIGN_ALGO:
|
|
configMapKeyRef:
|
|
name: lasuite-oidc-provider
|
|
key: OIDC_RP_SIGN_ALGO
|
|
OIDC_RP_SCOPES:
|
|
configMapKeyRef:
|
|
name: lasuite-oidc-provider
|
|
key: OIDC_RP_SCOPES
|
|
OIDC_OP_JWKS_ENDPOINT:
|
|
configMapKeyRef:
|
|
name: lasuite-oidc-provider
|
|
key: OIDC_OP_JWKS_ENDPOINT
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT:
|
|
configMapKeyRef:
|
|
name: lasuite-oidc-provider
|
|
key: OIDC_OP_AUTHORIZATION_ENDPOINT
|
|
OIDC_OP_TOKEN_ENDPOINT:
|
|
configMapKeyRef:
|
|
name: lasuite-oidc-provider
|
|
key: OIDC_OP_TOKEN_ENDPOINT
|
|
OIDC_OP_USER_ENDPOINT:
|
|
configMapKeyRef:
|
|
name: lasuite-oidc-provider
|
|
key: OIDC_OP_USER_ENDPOINT
|
|
OIDC_OP_LOGOUT_ENDPOINT:
|
|
configMapKeyRef:
|
|
name: lasuite-oidc-provider
|
|
key: OIDC_OP_LOGOUT_ENDPOINT
|
|
OIDC_VERIFY_SSL:
|
|
configMapKeyRef:
|
|
name: lasuite-oidc-provider
|
|
key: OIDC_VERIFY_SSL
|
|
|
|
# ── Django ────────────────────────────────────────────────────────────────
|
|
DJANGO_SECRET_KEY:
|
|
secretKeyRef:
|
|
name: people-django-secret
|
|
key: DJANGO_SECRET_KEY
|
|
# Production settings class enables SECURE_PROXY_SSL_HEADER so Django builds
|
|
# https:// URLs when Pingora forwards X-Forwarded-Proto: https.
|
|
DJANGO_CONFIGURATION: Production
|
|
# Production's ALLOWED_HOSTS reads ALLOWED_HOSTS (no DJANGO_ prefix).
|
|
ALLOWED_HOSTS: people.DOMAIN_SUFFIX
|
|
DJANGO_ALLOWED_HOSTS: people.DOMAIN_SUFFIX
|
|
DJANGO_CSRF_TRUSTED_ORIGINS: https://people.DOMAIN_SUFFIX
|
|
# Redirect to frontend SPA root after successful OIDC login/logout.
|
|
LOGIN_REDIRECT_URL: /
|
|
LOGOUT_REDIRECT_URL: /
|
|
# 1h sessions: silent OIDC re-auth via Kratos keeps users logged in.
|
|
SESSION_COOKIE_AGE: "3600"
|
|
|
|
# celeryWorker and celeryBeat intentionally have no envVars here.
|
|
# The desk chart template automatically injects backend.envVars into all
|
|
# celery containers (see celery_beat_deployment.yaml: $backendEnvVars).
|
|
# Adding envVars here would duplicate every env var.
|
|
|
|
ingress:
|
|
enabled: false
|
|
|
|
ingressAdmin:
|
|
enabled: false
|