Petrolyst/petrolyst-infra
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5 Commits 1 Branch 0 Tags
7d01f66f849f54296cf2441d8e78f4d2712f0787
Commit Graph
5 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Nasim SadatandClaude Opus 5.5 7d01f66f84 traefik: apply secure-headers before sso on the dashboard
deploy / deploy (push) Canceled after 0s
Details 
forwardAuth answers unauthenticated requests itself, so a middleware listed
after it never sees that redirect: the dashboard's 302 to Keycloak went out
without HSTS, nosniff and frame options.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-24 00:43:43 +02:00
Nasim SadatandClaude Opus 5.5 1165566ed9 deploy: run from / so sudo -u deploy works from a root shell 
`sudo -u deploy deploy.sh` (manual deploy, re-deploy, rollback) keeps
root's working directory /root, which deploy cannot read; GNU find then
fails in preflight and the run stops. Every path is absolute, so lib.sh
now changes to / first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-24 00:39:40 +02:00
Nasim SadatandClaude Opus 5.5 d074092abd secrets-init: store a piped secret without a final newline 
`pbpaste | ssh petrolyst /root/secrets-init.sh keycloak-secret` sends the
secret without a trailing newline. read then sets the value but returns
non-zero, and set -e ended the script silently before storing it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-24 00:37:38 +02:00
Nasim SadatandClaude Opus 5.5 d3800ac9dd Petrolyst server infrastructure: Traefik, Trino and Superset 
Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-24 00:33:11 +02:00
Nasim SadatandClaude Opus 5.5 24327f9462 Baseline 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-23 23:36:42 +02:00