Petrolyst/petrolyst-infra
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6 Commits 1 Branch 0 Tags
bf96edc828791e84039a0b06a1b4a7d177fc8fb1
Commit Graph
6 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Nasim SadatandClaude Opus 5.5 bf96edc828 fuel-db: schema fm, derivations and BI views (draft, not applied); ATOMA dashboard spec 
Adds stacks/fuel-monitoring/fuel-db/migrations/0001-0003 with their README, and
petrolyst-insights/dashboards/atoma/SPEC.md. Nothing applies the migrations:
deploy.sh never touches fuel-db, and a person applies them by hand in phase P3.

Verified in scratch Docker (timescaledb 2.31.0-pg17 with this repository's
01-roles.sh, trino 484 with its trino/etc): 150 SQL checks pass; the 18 views
have 303 columns with identical types in PostgreSQL and Trino; fm cannot be
read through Trino. Codex (gpt-6-astra) inspected the change in four rounds;
the round-4 fixes are committed without a further inspection, on the owner's
instruction.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-24 09:58:14 +02:00
Nasim SadatandClaude Opus 5.5 7d01f66f84 traefik: apply secure-headers before sso on the dashboard
deploy / deploy (push) Canceled after 0s
Details 
forwardAuth answers unauthenticated requests itself, so a middleware listed
after it never sees that redirect: the dashboard's 302 to Keycloak went out
without HSTS, nosniff and frame options.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-24 00:43:43 +02:00
Nasim SadatandClaude Opus 5.5 1165566ed9 deploy: run from / so sudo -u deploy works from a root shell 
`sudo -u deploy deploy.sh` (manual deploy, re-deploy, rollback) keeps
root's working directory /root, which deploy cannot read; GNU find then
fails in preflight and the run stops. Every path is absolute, so lib.sh
now changes to / first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-24 00:39:40 +02:00
Nasim SadatandClaude Opus 5.5 d074092abd secrets-init: store a piped secret without a final newline 
`pbpaste | ssh petrolyst /root/secrets-init.sh keycloak-secret` sends the
secret without a trailing newline. read then sets the value but returns
non-zero, and set -e ended the script silently before storing it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-24 00:37:38 +02:00
Nasim SadatandClaude Opus 5.5 d3800ac9dd Petrolyst server infrastructure: Traefik, Trino and Superset 
Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.

Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-24 00:33:11 +02:00
Nasim SadatandClaude Opus 5.5 24327f9462 Baseline 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-23 23:36:42 +02:00