mirror of
https://github.com/hanzoai/tasks.git
synced 2026-11-03 03:56:04 +00:00
zeekay
818d40ed77
Production deployment infrastructure for tasks.hanzo.ai: K8s manifests (k8s/): - deployment.yaml: tasks server (gRPC 7233) + tasks-ui (HTTP 8080) with PostgreSQL backend, KMS-managed secrets, OTEL tracing - ingress.yaml: tasks.hanzo.ai (UI) + tasks-api.hanzo.ai (gRPC) - configmap.yaml: dynamic config (30d retention, rate limits) - kms-secrets.yaml: KMSSecret CRD for POSTGRES_PASSWORD, TASKS_AUTH_SECRET, IAM_CLIENT_SECRET - init-db.yaml: one-time job to create tasks + tasks_visibility DBs - kustomization.yaml: Kustomize overlay IAM integration: - Client ID: app-tasks (matches live deployment) - OIDC callback: https://tasks.hanzo.ai/auth/sso/callback - JWT validation via hanzo.id JWKS (TEMPORAL_JWT_KEY_SOURCE1) - scripts/register-iam.sh: IAM registration instructions CI/CD (GHCR migration): - docker-bake.hcl: IMAGE_REPO -> ghcr.io/hanzoai, image names server -> tasks, admin-tools -> tasks-admin-tools - build-and-publish.yml: GHCR auth via GITHUB_TOKEN - promote-*.yml: rewritten for GHCR (was DockerHub) - docker-build-manual.yml: GHCR push support - server.Dockerfile: user temporal -> tasks, workdir /etc/tasks - admin-tools.Dockerfile: matching user/path rebrand
24 lines
761 B
Docker
24 lines
761 B
Docker
# IMPORTANT: When updating ALPINE_TAG, also update the default value in:
|
|
# - docker/docker-bake.hcl (variable "ALPINE_TAG")
|
|
# - docker/targets/admin-tools.Dockerfile (ARG ALPINE_TAG)
|
|
# NOTE: We use just the tag without a digest pin because digest-pinned manifest lists
|
|
# cause platform resolution issues in multi-arch buildx builds (InvalidBaseImagePlatform warnings).
|
|
ARG ALPINE_TAG=3.23.3
|
|
|
|
FROM alpine:${ALPINE_TAG}
|
|
|
|
ARG TARGETARCH
|
|
|
|
RUN apk add --no-cache \
|
|
ca-certificates \
|
|
tzdata && addgroup -g 1000 tasks && \
|
|
adduser -u 1000 -G tasks -D tasks
|
|
|
|
COPY --chmod=755 ./build/${TARGETARCH}/tasksd /usr/local/bin/
|
|
COPY --chmod=755 ./scripts/sh/entrypoint.sh /etc/tasks/entrypoint.sh
|
|
|
|
WORKDIR /etc/tasks
|
|
USER tasks
|
|
|
|
CMD [ "/etc/tasks/entrypoint.sh" ]
|