Sienna Meridian Satterwhite
7ffddcafcd
- Fix Hydra postLogoutRedirectUris for docs and people to match the actual URI sent by mozilla_django_oidc v5 (/api/v1.0/logout-callback/) instead of the root URL, resolving 599 logout errors. - Fix docs y-provider WebSocket backend port: use Service port 443 (not pod port 4444 which has no DNAT rule) in Pingora config. - Tighten VSO VaultDynamicSecret rotation sync: add allowStaticCreds:true and reduce refreshAfter from 1h to 5m across all static-creds paths (kratos, hydra, gitea, hive, people, docs) so credential rotation is reflected within 5 minutes instead of up to 1 hour. - Set Hydra token TTLs: access_token and id_token to 5m; refresh_token to 720h (30 days). Kratos session carries silent re-auth so the short access token TTL does not require users to log in manually. - Set SESSION_COOKIE_AGE=3600 (1h) in docs and people backends. After 1h, apps silently re-auth via the active Kratos session. Disabled identities (sunbeam user disable) cannot re-auth on next expiry.
90 lines
2.2 KiB
YAML
90 lines
2.2 KiB
YAML
# La Gaufre integration service — O Estúdio app launcher (La Gaufre v2).
|
|
# Serves the lagaufre.js v2 widget, SVG logos, and the v2 services API.
|
|
# Apps load gaufre.js (via people-frontend sub_filter) which in turn initialises
|
|
# the v2 widget with the button already rendered by @gouvfr-lasuite/ui-kit.
|
|
#
|
|
# Image: src.DOMAIN_SUFFIX/studio/integration:latest
|
|
# Built from sunbeam/integration-service/ (context: sunbeam/ root)
|
|
# Baked in: lagaufre.js v2, official La Suite logos, custom logos, gaufre.js, nginx.conf
|
|
#
|
|
# ConfigMap: only services.json (v2 format) — the one thing that varies per env
|
|
# DOMAIN_SUFFIX substituted at deploy time.
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: integration-config
|
|
namespace: lasuite
|
|
data:
|
|
services.json: |
|
|
{
|
|
"services": [
|
|
{
|
|
"name": "Docs",
|
|
"url": "https://docs.DOMAIN_SUFFIX",
|
|
"logo": "https://integration.DOMAIN_SUFFIX/logos/docs.svg"
|
|
},
|
|
{
|
|
"name": "Reuniões",
|
|
"url": "https://meet.DOMAIN_SUFFIX",
|
|
"logo": "https://integration.DOMAIN_SUFFIX/logos/visio.svg"
|
|
},
|
|
{
|
|
"name": "Humans",
|
|
"url": "https://people.DOMAIN_SUFFIX",
|
|
"logo": "https://integration.DOMAIN_SUFFIX/logos/people.svg"
|
|
}
|
|
]
|
|
}
|
|
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: integration
|
|
namespace: lasuite
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: integration
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: integration
|
|
spec:
|
|
containers:
|
|
- name: integration
|
|
image: integration
|
|
ports:
|
|
- name: http
|
|
containerPort: 80
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/integration/services.json
|
|
subPath: services.json
|
|
resources:
|
|
limits:
|
|
memory: 32Mi
|
|
requests:
|
|
memory: 16Mi
|
|
cpu: 5m
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: integration-config
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: integration
|
|
namespace: lasuite
|
|
spec:
|
|
selector:
|
|
app: integration
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: 80
|