mirror of
https://github.com/hanzoai/tasks.git
synced 2026-11-03 03:56:04 +00:00
zeekay
818d40ed77
Production deployment infrastructure for tasks.hanzo.ai: K8s manifests (k8s/): - deployment.yaml: tasks server (gRPC 7233) + tasks-ui (HTTP 8080) with PostgreSQL backend, KMS-managed secrets, OTEL tracing - ingress.yaml: tasks.hanzo.ai (UI) + tasks-api.hanzo.ai (gRPC) - configmap.yaml: dynamic config (30d retention, rate limits) - kms-secrets.yaml: KMSSecret CRD for POSTGRES_PASSWORD, TASKS_AUTH_SECRET, IAM_CLIENT_SECRET - init-db.yaml: one-time job to create tasks + tasks_visibility DBs - kustomization.yaml: Kustomize overlay IAM integration: - Client ID: app-tasks (matches live deployment) - OIDC callback: https://tasks.hanzo.ai/auth/sso/callback - JWT validation via hanzo.id JWKS (TEMPORAL_JWT_KEY_SOURCE1) - scripts/register-iam.sh: IAM registration instructions CI/CD (GHCR migration): - docker-bake.hcl: IMAGE_REPO -> ghcr.io/hanzoai, image names server -> tasks, admin-tools -> tasks-admin-tools - build-and-publish.yml: GHCR auth via GITHUB_TOKEN - promote-*.yml: rewritten for GHCR (was DockerHub) - docker-build-manual.yml: GHCR push support - server.Dockerfile: user temporal -> tasks, workdir /etc/tasks - admin-tools.Dockerfile: matching user/path rebrand
17 lines
587 B
Bash
17 lines
587 B
Bash
#!/bin/sh
|
|
# pipefail is included in alpine
|
|
# shellcheck disable=SC3040
|
|
set -eu -o pipefail
|
|
|
|
# Resolve hostname to IP address for binding if not already set (supports both IPv4 and IPv6)
|
|
: "${BIND_ON_IP:=$(getent hosts "$(hostname)" | awk '{print $1;}')}"
|
|
export BIND_ON_IP
|
|
|
|
# If binding to wildcard address (0.0.0.0 or ::0), set broadcast address if not already set
|
|
if [ "${BIND_ON_IP}" = "0.0.0.0" ] || [ "${BIND_ON_IP}" = "::0" ]; then
|
|
: "${TEMPORAL_BROADCAST_ADDRESS:=$(getent hosts "$(hostname)" | awk '{print $1;}')}"
|
|
export TEMPORAL_BROADCAST_ADDRESS
|
|
fi
|
|
|
|
exec tasksd start
|