mirror of
https://github.com/hanzoai/tasks.git
synced 2026-11-03 03:56:04 +00:00
zeekay
818d40ed77
Production deployment infrastructure for tasks.hanzo.ai: K8s manifests (k8s/): - deployment.yaml: tasks server (gRPC 7233) + tasks-ui (HTTP 8080) with PostgreSQL backend, KMS-managed secrets, OTEL tracing - ingress.yaml: tasks.hanzo.ai (UI) + tasks-api.hanzo.ai (gRPC) - configmap.yaml: dynamic config (30d retention, rate limits) - kms-secrets.yaml: KMSSecret CRD for POSTGRES_PASSWORD, TASKS_AUTH_SECRET, IAM_CLIENT_SECRET - init-db.yaml: one-time job to create tasks + tasks_visibility DBs - kustomization.yaml: Kustomize overlay IAM integration: - Client ID: app-tasks (matches live deployment) - OIDC callback: https://tasks.hanzo.ai/auth/sso/callback - JWT validation via hanzo.id JWKS (TEMPORAL_JWT_KEY_SOURCE1) - scripts/register-iam.sh: IAM registration instructions CI/CD (GHCR migration): - docker-bake.hcl: IMAGE_REPO -> ghcr.io/hanzoai, image names server -> tasks, admin-tools -> tasks-admin-tools - build-and-publish.yml: GHCR auth via GITHUB_TOKEN - promote-*.yml: rewritten for GHCR (was DockerHub) - docker-build-manual.yml: GHCR push support - server.Dockerfile: user temporal -> tasks, workdir /etc/tasks - admin-tools.Dockerfile: matching user/path rebrand
36 lines
1.1 KiB
Docker
36 lines
1.1 KiB
Docker
# IMPORTANT: When updating ALPINE_TAG, also update the default value in:
|
|
# - docker/docker-bake.hcl (variable "ALPINE_TAG")
|
|
# - docker/targets/server.Dockerfile (ARG ALPINE_TAG)
|
|
# NOTE: We use just the tag without a digest pin because digest-pinned manifest lists
|
|
# cause platform resolution issues in multi-arch buildx builds (InvalidBaseImagePlatform warnings).
|
|
ARG ALPINE_TAG=3.23.3
|
|
|
|
FROM alpine:${ALPINE_TAG}
|
|
|
|
ARG TARGETARCH
|
|
|
|
RUN apk add --no-cache \
|
|
ca-certificates \
|
|
tzdata && addgroup -g 1000 tasks && \
|
|
adduser -u 1000 -G tasks -D tasks
|
|
|
|
# Copy all admin tool binaries:
|
|
# - temporal (CLI)
|
|
# - temporal-cassandra-tool
|
|
# - temporal-sql-tool
|
|
# - temporal-elasticsearch-tool
|
|
# - tdbg
|
|
COPY --chmod=755 \
|
|
./build/${TARGETARCH}/temporal \
|
|
./build/${TARGETARCH}/temporal-cassandra-tool \
|
|
./build/${TARGETARCH}/temporal-sql-tool \
|
|
./build/${TARGETARCH}/temporal-elasticsearch-tool \
|
|
./build/${TARGETARCH}/tdbg \
|
|
/usr/local/bin/
|
|
|
|
COPY ./build/temporal/schema /etc/tasks/schema
|
|
|
|
USER tasks
|
|
|
|
CMD ["sh", "-c", "trap exit INT HUP TERM; sleep infinity"]
|