hzhang
5ea2cdfc9e
Drops the AbstractWizard config-volume bootstrap entirely. All deploy-time
config now comes from docker env vars (.env). First-deploy admin user + OIDC
provider config are operator-driven via `docker exec hf_backend hf-cli ...`.
Backend changes:
- entrypoint.sh: drop config-wait loop, just exec uvicorn
- app/core/config.py: drop _resolve_db_url + OIDC_* env vars (DB only now);
keep HARBORFORGE_OIDC_ONLY (deploy-time policy)
- app/init_wizard.py → app/init_bootstrap.py: drop load_config / admin / OIDC /
default-project bootstrap; keep idempotent startup seed (permissions,
default roles, acc-mgr + deleted-user builtins)
- app/main.py: /config/status now returns {initialized: <admin exists>};
startup() imports init_bootstrap.run_bootstrap
- app/api/routers/oidc.py: get_effective_oidc reads DB only (no env fallback)
- app/services/harborforge_config.py: removed (replaced by direct env reads)
- app/services/discord_wakeup.py: HF_DISCORD_GUILD_ID / HF_DISCORD_BOT_TOKEN env
- app/api/routers/users.py + tests/conftest.py: rename init_wizard refs
New hf-cli surface (app/cli/, invoked via /usr/local/bin/hf-cli shim):
hf-cli admin create-user --email <e> [--username <u>] [--password <p>]
[--oidc-issuer <url> --oidc-subject <sub>]
hf-cli admin list
hf-cli admin set-role --username <u> --role <admin|mgr|dev|guest|account-manager>
hf-cli admin reset-password --username <u> --password <p>
hf-cli admin bind-oidc --username <u> --oidc-issuer <url> --oidc-subject <sub>
hf-cli config oidc [--issuer/...] [--client-id/...] [--client-secret/...]
[--redirect-uri/...] [--enabled true|false] [--show-secret]
Bootstrap migration on existing deployments: existing admin / OIDC settings
in the DB are preserved across the cutover; only the wizard config-volume
+ wizard sidecar services need to be removed from compose. Restart picks
up the new entrypoint + skips the config wait.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
35 lines
1.6 KiB
Plaintext
35 lines
1.6 KiB
Plaintext
# HarborForge Backend Environment Variables (v0.4.0+ — wizard removed)
|
|
|
|
# --- Database (used by both the mysql container and the backend) -----------
|
|
MYSQL_ROOT_PASSWORD=harborforge_root
|
|
MYSQL_DATABASE=harborforge
|
|
MYSQL_USER=harborforge
|
|
MYSQL_PASSWORD=harborforge_pass
|
|
# Full DSN used by the backend container. Default points to a service
|
|
# named "mysql" on the same docker network. Override if your DB is elsewhere.
|
|
DATABASE_URL=mysql+pymysql://harborforge:harborforge_pass@mysql:3306/harborforge
|
|
|
|
# --- Application ----------------------------------------------------------
|
|
# Must be 32+ chars and not a placeholder; use: openssl rand -hex 32
|
|
SECRET_KEY=change-me-use-openssl-rand-hex-32
|
|
LOG_LEVEL=INFO
|
|
|
|
# When true: password login is disabled, all sign-in goes through OIDC,
|
|
# user creation ignores any password (passwordless users that can only
|
|
# authenticate via OIDC binding or API keys). Frontend hides password UI.
|
|
HARBORFORGE_OIDC_ONLY=false
|
|
|
|
# --- Discord wakeup (optional; previously in wizard config) ---------------
|
|
# Used by /agents/{id}/wakeup to spin a private Discord channel + DM.
|
|
HARBORFORGE_DISCORD_GUILD_ID=
|
|
HARBORFORGE_DISCORD_BOT_TOKEN=
|
|
|
|
# --- OIDC issuer / client_id / client_secret / redirect_uri ---------------
|
|
# NOT env vars in v0.4.0+. Configure via:
|
|
# docker exec hf-backend hf-cli config oidc \
|
|
# --issuer https://login.example.com/realms/foo \
|
|
# --client-id harborforge --client-secret <s> \
|
|
# --redirect-uri https://hf-api.example.com/auth/oidc/callback \
|
|
# --post-login-redirect https://hf.example.com/oidc/callback \
|
|
# --enabled true
|