0 Fork 0

Files

T

Nasim SadatandClaude Opus 5.5 78a498f1ce Sign-in by customer: realm petrolyst, row rules, guest role (PD-21)

Keycloak import for realm petrolyst: two clients, petrolyst with MFA for
Superset and Traefik, petrolyst-app password only. It lists only
app.petrolyst.com and traefik.petrolyst.com, and no customer names, as this
repository is public. public.v_operator shows each customer's group. Dashboards
overview and site, role Petrolyst Guest, filtered by row. Superset refuses a
user with no mapped role. The realm travels with the release: each release's
compose files name their realm and secret file, and a rollback needs only its
target's secret. Not deployed.

Checks earlier on this content: tests/run.sh 109 of 109 and read-only, dashboards
import twice, column drift 0, compose config on old and new trees, the secret
check on a scratch folder, a rehearsal on a throwaway Keycloak 26.4. Never a real
deploy or rollback; shellcheck not installed today, clean when last run. Codex
inspected once; its fixes are not re-inspected, on the owner's word.

Bands: persistence, Superset. Rules: 1, 2, 3, 6, 14.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-30 18:31:14 +01:00

2.4 KiB

Raw Permalink Blame History

petrolyst-infra: agent rules

Deployment of the petrolyst server (atoma.petrolyst.com) and the Superset customization. Runbook: README.md. Workspace rules: ../AGENTS.md; shared context: ../.context/ (server and identity facts: deployment.md).

Architecture: read ../.context/architecture.md before planning or building. This repository runs persistence (fuel-db and its migrations) and Superset; name the bands a change touches and keep the rules there; a change against a rule or an open conflict goes to the owner first.

Layout

stacks/, traefik/, deploy/, host/: how and where things run.
petrolyst-insights/: what Superset looks like and does (config, security manager, the guest role, branding, patches, dashboards as code). Its README maps each file to the image.
keycloak/: the import of realm petrolyst's two clients (petrolyst, petrolyst-app).

Rules

Commit messages end their body with the bands and rules touched, for example Bands: 4 (server). Rules: 2, 3., or Bands: none (docs). for text only (architecture rule 1).
Deploys: only by README "Manual deploy", only when the owner asks. There is no CI. Commit on main first; never push or deploy unprompted.
No secrets in the repository; deploy/deploy.sh refuses if one appears.
The Superset image's inputs (SUPERSET_INPUTS in deploy/lib.sh) make its tag: a change there rebuilds Superset on the next deploy.
Dashboards are code: change build_bundle.py and SPEC.md, never the UI followed by an export. import_bundle.py never deletes; old objects go by hand (dashboards/README.md).
Embedding stays off in production (superset_config.py) until PD-12's points are decided; the local stack turns it on in its own override.
Customers' users have no Superset account (PD-13, PD-21): role reader of client petrolyst-app opens the Petrolyst app only, for the customer of their Keycloak group; Superset refuses them.
fuel-db migrations (stacks/fuel-monitoring/fuel-db/migrations/) are applied by hand (P3).

Checks

Shell: the README's Docker shellcheck command (warnings and errors must be zero).
Dashboards: build_bundle.py checks the bundle as it builds; import locally and expect column drift 0 (../.context/local-stack.md).
Superset changes: rebuild the local image and check it turns healthy before calling it done.

2.4 KiB Raw Permalink Blame History

petrolyst-infra: agent rules

Layout

Rules

Checks

2.4 KiB

Raw Permalink Blame History