Nasim SadatandClaude Opus 5.5
78a498f1ce
Keycloak import for realm petrolyst: two clients, petrolyst with MFA for Superset and Traefik, petrolyst-app password only. It lists only app.petrolyst.com and traefik.petrolyst.com, and no customer names, as this repository is public. public.v_operator shows each customer's group. Dashboards overview and site, role Petrolyst Guest, filtered by row. Superset refuses a user with no mapped role. The realm travels with the release: each release's compose files name their realm and secret file, and a rollback needs only its target's secret. Not deployed. Checks earlier on this content: tests/run.sh 109 of 109 and read-only, dashboards import twice, column drift 0, compose config on old and new trees, the secret check on a scratch folder, a rehearsal on a throwaway Keycloak 26.4. Never a real deploy or rollback; shellcheck not installed today, clean when last run. Codex inspected once; its fixes are not re-inspected, on the owner's word. Bands: persistence, Superset. Rules: 1, 2, 3, 6, 14. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
38 lines
2.4 KiB
Markdown
38 lines
2.4 KiB
Markdown
# petrolyst-infra: agent rules
|
|
|
|
Deployment of the petrolyst server (atoma.petrolyst.com) and the Superset customization.
|
|
Runbook: README.md. Workspace rules: `../AGENTS.md`; shared context: `../.context/` (server and
|
|
identity facts: `deployment.md`).
|
|
|
|
**Architecture:** read `../.context/architecture.md` before planning or building. This repository
|
|
runs persistence (fuel-db and its migrations) and Superset; name the bands a change touches and
|
|
keep the rules there; a change against a rule or an open conflict goes to the owner first.
|
|
|
|
## Layout
|
|
- `stacks/`, `traefik/`, `deploy/`, `host/`: how and where things run.
|
|
- `petrolyst-insights/`: what Superset looks like and does (config, security manager, the guest
|
|
role, branding, patches, dashboards as code). Its README maps each file to the image.
|
|
- `keycloak/`: the import of realm `petrolyst`'s two clients (`petrolyst`, `petrolyst-app`).
|
|
|
|
## Rules
|
|
- **Commit messages** end their body with the bands and rules touched, for example
|
|
`Bands: 4 (server). Rules: 2, 3.`, or `Bands: none (docs).` for text only (architecture rule 1).
|
|
- **Deploys:** only by README "Manual deploy", only when the owner asks. There is no CI. Commit on
|
|
`main` first; never push or deploy unprompted.
|
|
- **No secrets** in the repository; `deploy/deploy.sh` refuses if one appears.
|
|
- **The Superset image's inputs** (`SUPERSET_INPUTS` in `deploy/lib.sh`) make its tag: a change
|
|
there rebuilds Superset on the next deploy.
|
|
- **Dashboards are code:** change `build_bundle.py` and SPEC.md, never the UI followed by an
|
|
export. `import_bundle.py` never deletes; old objects go by hand (`dashboards/README.md`).
|
|
- **Embedding** stays off in production (`superset_config.py`) until PD-12's points are decided;
|
|
the local stack turns it on in its own override.
|
|
- **Customers' users** have no Superset account (PD-13, PD-21): role `reader` of client `petrolyst-app`
|
|
opens the Petrolyst app only, for the customer of their Keycloak group; Superset refuses them.
|
|
- fuel-db migrations (`stacks/fuel-monitoring/fuel-db/migrations/`) are applied by hand (P3).
|
|
|
|
## Checks
|
|
- Shell: the README's Docker shellcheck command (warnings and errors must be zero).
|
|
- Dashboards: `build_bundle.py` checks the bundle as it builds; import locally and expect column
|
|
drift 0 (`../.context/local-stack.md`).
|
|
- Superset changes: rebuild the local image and check it turns healthy before calling it done.
|