mirror of
https://github.com/hanzoai/tasks.git
synced 2026-11-03 03:56:04 +00:00
zeekay
818d40ed77
Production deployment infrastructure for tasks.hanzo.ai: K8s manifests (k8s/): - deployment.yaml: tasks server (gRPC 7233) + tasks-ui (HTTP 8080) with PostgreSQL backend, KMS-managed secrets, OTEL tracing - ingress.yaml: tasks.hanzo.ai (UI) + tasks-api.hanzo.ai (gRPC) - configmap.yaml: dynamic config (30d retention, rate limits) - kms-secrets.yaml: KMSSecret CRD for POSTGRES_PASSWORD, TASKS_AUTH_SECRET, IAM_CLIENT_SECRET - init-db.yaml: one-time job to create tasks + tasks_visibility DBs - kustomization.yaml: Kustomize overlay IAM integration: - Client ID: app-tasks (matches live deployment) - OIDC callback: https://tasks.hanzo.ai/auth/sso/callback - JWT validation via hanzo.id JWKS (TEMPORAL_JWT_KEY_SOURCE1) - scripts/register-iam.sh: IAM registration instructions CI/CD (GHCR migration): - docker-bake.hcl: IMAGE_REPO -> ghcr.io/hanzoai, image names server -> tasks, admin-tools -> tasks-admin-tools - build-and-publish.yml: GHCR auth via GITHUB_TOKEN - promote-*.yml: rewritten for GHCR (was DockerHub) - docker-build-manual.yml: GHCR push support - server.Dockerfile: user temporal -> tasks, workdir /etc/tasks - admin-tools.Dockerfile: matching user/path rebrand
38 lines
1.1 KiB
YAML
38 lines
1.1 KiB
YAML
# Hanzo Tasks Secrets via Hanzo KMS (kms.hanzo.ai)
|
|
#
|
|
# Uses shared universal-auth-credentials (same Machine Identity as chat,
|
|
# commerce, insights, etc.). Secrets are stored in the
|
|
# "hanzo-tasks" project under the /tasks path.
|
|
#
|
|
# Secrets stored in KMS at /tasks:
|
|
# - POSTGRES_PASSWORD # PostgreSQL auth for tasks persistence
|
|
# - TASKS_AUTH_SECRET # JWT signing key for multi-tenant auth
|
|
# - IAM_CLIENT_SECRET # hanzo.id OIDC client secret (app-tasks)
|
|
---
|
|
apiVersion: secrets.lux.network/v1alpha1
|
|
kind: KMSSecret
|
|
metadata:
|
|
name: tasks-kms-sync
|
|
namespace: hanzo
|
|
labels:
|
|
app.kubernetes.io/name: tasks
|
|
app.kubernetes.io/component: secrets
|
|
app.kubernetes.io/part-of: hanzo-platform
|
|
spec:
|
|
hostAPI: http://kms.hanzo.svc.cluster.local/api
|
|
resyncInterval: 60
|
|
authentication:
|
|
universalAuth:
|
|
credentialsRef:
|
|
secretName: universal-auth-credentials
|
|
secretNamespace: hanzo
|
|
secretsScope:
|
|
projectSlug: hanzo-k8s-epiq
|
|
envSlug: prod
|
|
secretsPath: /tasks
|
|
managedSecretReference:
|
|
secretName: tasks-secrets
|
|
secretNamespace: hanzo
|
|
secretType: Opaque
|
|
creationPolicy: Orphan
|