[operator-action] fix(dev): make dev-web bootable against the Bunyip OP (LC-22 fallout) #362
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/dev-web-bunyip-sso-startup"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Why
The LC-22 pure-RP cutover made the four
LETS_CHAT_BUNYIP_SSO_*vars mandatory at startup (no_ENABLEDflag, no local-auth fallback) but never updatedcompose.dev-web.yml. Result:just dev-webbuilds fine then crash-loops onLETS_CHAT_BUNYIP_SSO_ISSUER is required for Bunyip SSO startup. This makes the dev stack bootable against the per-developer dev Bunyip OP.What
compose.dev-web.yml: sets the four SSO vars (issuer / client_id / client_secret / redirect_uri) pointed at the dev OP. The redirect_uri is{base}/auth/bunyip/callbackto match the OP client's registered redirect.server/src/oidc/client.rs: adds a dev-onlyLETS_CHAT_BUNYIP_SSO_INSECURE_TLSflag that builds the SSO reqwest client withdanger_accept_invalid_certs. The dev OP sits behind a Traefik serving a self-signed default cert, and reqwest'srustls-tlsuses bundled webpki roots that ignore the system CA store, so there is no env- or mount-only remedy. The flag is dark by default; production still verifies the issuer cert.compose.dev-web.yml: adds anextra_hostsentry pinning the issuer host to the dev Traefik container. In dev that hostname resolves to the public IP, where the routers are not served (they live on Traefik'snebula-secureentrypoint), so server-to-server discovery/JWKS/token calls 404 otherwise. The issuer string stays the public URL, so ID-tokenissvalidation is unaffected and the browser flow is untouched.CLAUDE.md: documents the four mandatoryLETS_CHAT_BUNYIP_SSO_*vars (previously undocumented in the env table) and the new dev flag.Verification
just dev-webnow boots clean: container healthy,listening 0.0.0.0:8080,GET /loginreturns 200 with the "Sign in with Bunyip" shell, andGET /auth/bunyip/startissues a 303 to the OP authorize endpoint with the correct client_id, redirect_uri, scopes (openid email), and PKCE S256 challenge.Operator action
No production action. The new
LETS_CHAT_BUNYIP_SSO_INSECURE_TLSvar is dev-only (unset = strict TLS); never set it in production as it disables issuer TLS authentication for the whole SSO trust path. The fourLETS_CHAT_BUNYIP_SSO_*vars remain mandatory as of LC-22.Notes (not in this PR)
extra_hostsIP is the dev Traefik container's current address onnetwork-traefik-public; if that network is recreated, refresh it (command is in a comment in the compose file)._sqlx_migrationsledger: commit9c082ebin the bunyip repo edited 11 already-applied migration files, which trips the immutable-migration ratchet (the LC-212 failure mode) on every operator whose DB applied the originals. That is a bunyip-side bug worth fixing upstream; it is out of scope here.The LC-22 pure-RP cutover made the four LETS_CHAT_BUNYIP_SSO_* vars mandatory at startup (no flag, no fallback) but never updated compose.dev-web.yml, so `just dev-web` built fine then crash-looped on `LETS_CHAT_BUNYIP_SSO_ISSUER is required`. This wires the dev stack to the dev Bunyip OP and adds the two dev-only escape hatches that the OP's dev posture requires. Changes: compose.dev-web.yml now sets the four SSO vars (issuer/client_id/client_secret/redirect_uri) pointed at the per-developer dev OP; the redirect_uri is `{base}/auth/bunyip/callback` to match the client's registered redirect. server/src/oidc/client.rs gains a dev-only LETS_CHAT_BUNYIP_SSO_INSECURE_TLS flag that builds the SSO reqwest client with danger_accept_invalid_certs, because the dev OP sits behind a Traefik serving a self-signed default cert and reqwest's rustls-tls uses bundled webpki roots that ignore the system CA store (no env/mount-only remedy exists). compose also adds an extra_hosts entry pinning the issuer host to the dev Traefik container, because in dev that hostname resolves to the public IP where the routers are not served (they live on the nebula-secure entrypoint), so server-to-server discovery/JWKS/token calls 404 otherwise; the issuer string stays the public URL so ID-token iss validation is unaffected. CLAUDE.md documents the four mandatory vars (previously undocumented) and the new dev flag. The insecure-TLS flag is strictly opt-in and dark by default; production is unaffected and continues to verify the issuer cert. Operator-Action: No production action. New dev-only env var LETS_CHAT_BUNYIP_SSO_INSECURE_TLS (unset = strict TLS); never set it in production as it disables issuer TLS authentication for the whole SSO trust path. The four LETS_CHAT_BUNYIP_SSO_* vars remain mandatory as of LC-22. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>