5 Commits
Author SHA1 Message Date
zooqueenandHanzo Dev db583d7833 Serve Help Center with gunicorn instead of the development server
gunicorn runs frappe.app with /assets and /files served in process, two
gthread workers as frappe_docker runs it. The Werkzeug debugger and
reloader are no longer in the request path. Frappe resolves the site from
the Host header.

Co-authored-by: Hanzo Dev <[email protected]>
2026-09-15 12:11:38 -07:00
zooqueen 5d7054c177 Carry the Hanzo mark across the Help Center
The desk SPA's titles, marks and install icons come from this repo's own
source, so they change here: the shell title and apple title, the PWA
manifest name, the sidebar and welcome-ticket copy, the fallback logo
component, the SPA favicon and the 180/192/512 install icons.

The login page, navbar, footer and favicon are rendered by the Frappe core,
which reads those marks from Website Settings / Navbar Settings / System
Settings at run time. helpdesk/brand.py writes them and the entrypoint runs
it per site on every boot, next to the SSO setup. Each field is set to a
constant and guarded on the field existing, so a boot against a site that
already exists restores the same values instead of failing.

The marks are served from this app's own public directory
(helpdesk/public -> /assets/helpdesk), so no page reaches a third-party host
for a logo.
2026-08-13 23:19:08 -07:00
zeekay bff786f343 helpdesk: IAM-SSO-only (fix OIDC endpoints, disable native signup) + per-org SQLite isolation
- hanzo_sso.py: correct OAuth2 URLs to hanzo.id OIDC discovery (authorize
  /v1/iam/oauth/authorize, token /v1/iam/oauth/token, userinfo
  /v1/iam/oauth/userinfo). Prior /v1/iam/login/oauth/* 404'd.
- hanzo_sso.py: disable native signup (Website Settings.disable_signup) and
  force SSO-only login (System Settings.disable_user_pass_login, v15+ guarded)
  so IAM is the ONE identity authority.
- entrypoint.sh: org == tenant -> one SQLite site (== one DB) per org, resolved
  by Host header; HANZO_ORGS provisions the set. Structural cross-tenant
  isolation.
- help.service.yaml: tag 1.26.3, wire IAM_CLIENT_SECRET, add HANZO_ORGS.
- LLM.md: corrected endpoints + multi-tenant model.
2026-07-02 07:20:02 -07:00
zeekay 6564142c76 entrypoint: cp -dR not -a (avoid utime EPERM on root-owned volume mount root) 2026-07-02 03:07:59 -07:00
zeekay 7b25c279cf Hanzo Help Center: Frappe helpdesk on Base/SQLite + IAM SSO
- Dockerfile: self-contained bench build (hanzoai/frappe SQLite core +
  telephony + helpdesk), assets snapshotted as image template
- deploy/entrypoint.sh: in-pod redis, per-org SQLite site (org==tenant),
  IAM SSO wiring, bench serve (no nginx)
- helpdesk/hanzo_sso.py: idempotent hanzo.id OAuth2 Social Login Key from env
- deploy/help.service.yaml: operator-native Service CR (hanzo.ai/v1)
- deploy/help.ingress.yaml: help.hanzo.ai ingress + help-app-db PVC
- LLM.md/CLAUDE.md: fork + deploy docs
2026-07-02 01:36:30 -07:00