myapps/ibo
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ibo: Org myapps statt momentrum (Image myapps/ibo-web, CI-IMAGE)
Some checks failed
Momentrum CI / Version (aus PR-ID / SHA) (push) Successful in 2s
Details
Momentrum CI / Test (compile + pytest) (push) Failing after 12s
Details
Momentrum CI / Build & Push image (push) Has been skipped
Details
Momentrum CI / Helm lint + template (push) Successful in 8s
Details
Momentrum CI / Deploy PROD (Image-Tag -> CD-Repo) (push) Has been skipped
Details

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
timu 2026-07-18 01:24:29 +02:00
parent d1ccf17b5f
commit c54485dd6f
3 changed files with 24 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitea/workflows/momentrum-ci.yml
View File

@ -27,7 +27,7 @@ permissions:
env:
# :3000 = direkt zu Gitea (HTTP). Host-Docker hat diese Registry in insecure-registries.
REGISTRY: momentrum-k3s-01.tailcc1bcf.ts.net:3000
IMAGE: momentrum/ibo-web
IMAGE: myapps/ibo-web
CHART_PATH: infra/k8s/base/ibo
jobs:

30
infra/RUNBOOK-ibo.md
View File

@ -31,16 +31,30 @@ git push -u origin main
---
## 1. Zitadel: Redirect-URIs (KEIN neuer Client)
## 1. Zitadel-Clients + Sealed-Secret
`ibo-sso` und `dev-sso` nutzen — wie `luxly-sso` — den **bestehenden geteilten**
Zitadel-Client (K8s-Secret `oauth2-proxy-dev` in ns `iam`). **Kein neuer Client,
kein neues Secret.** Nur am vorhandenen Client (`https://auth.momentrum.de`) die
Redirect-URI ergaenzen:
- **prod (`ibo-sso`)** nutzt einen **eigenen** Zitadel-Web-Client. Dessen
ClientId/ClientSecret liegen im (nicht committeten) `.env` des ibo-Repos und
werden als SealedSecret **`oauth2-proxy-ibo`** (ns `iam`) in den Cluster gelegt:
- prod: `https://sso.ibo.momentrum.de/oauth2/callback` ← nur diese ist ibo-spezifisch
- dev (Previews): `https://sso.dev.momentrum.de/oauth2/callback` ← existiert i. d. R.
schon (kanban/luxly-Previews nutzen dasselbe dev-sso). Nichts zu tun, falls vorhanden.
```sh
# dort ausfuehren, wo Cluster-Zugriff besteht (Tunnel localhost:16443 / Bastion):
cd contabo-infra/platform/manifests/ibo-sso
IBO_ENV=../../../../projekte/ibo/.env ./seal-oauth2-proxy-ibo.sh
# -> erzeugt sealed-oauth2-proxy-ibo.yaml (committen & pushen -> ArgoCD entsiegelt)
# offline-Variante (ohne Cluster) mit Public-Cert:
# kubeseal --controller-namespace sealed-secrets --fetch-cert > pub.pem # einmal, mit Cluster
# SEALED_CERT=pub.pem IBO_ENV=.../.env ./seal-oauth2-proxy-ibo.sh
```
Am ibo-Client in Zitadel (`https://auth.momentrum.de`) die Redirect-URI
registrieren: `https://sso.ibo.momentrum.de/oauth2/callback`
(Post-Logout optional: `https://sso.ibo.momentrum.de`).
- **dev (Previews)** laufen weiter hinter dem **geteilten** `dev-sso`
(Client-Secret `oauth2-proxy-dev`). Dessen Redirect
`https://sso.dev.momentrum.de/oauth2/callback` existiert i. d. R. schon
(kanban/luxly nutzen es) — nichts zu tun.
---

2
infra/k8s/base/ibo/values.yaml
View File

@ -4,7 +4,7 @@
# umgebungs-agnostisch.
image:
repository: momentrum-k3s-01.tailcc1bcf.ts.net:3000/momentrum/ibo-web
repository: momentrum-k3s-01.tailcc1bcf.ts.net:3000/myapps/ibo-web
tag: latest
pullPolicy: IfNotPresent