hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

ops: OIDC issuer deployment wiring — key volume, CORS for files, Drive authMode flip

Browse source
This commit is contained in:
glass beadian 2026-10-13 18:46:28 +00:00
parent 96e5a63dd8
commit 3117e1c18e
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
infra/occupymedia/docker-compose.app.yml
View file

@ -65,7 +65,7 @@ services:
S3_KEK: ${S3_KEK:?} S3_KEK: ${S3_KEK:?}
SUPERPOSTER_KEK: ${SUPERPOSTER_KEK:?} SUPERPOSTER_KEK: ${SUPERPOSTER_KEK:?}
SESSION_SECRET: ${SESSION_SECRET:?} SESSION_SECRET: ${SESSION_SECRET:?}
CORS_ORIGINS: https://app.occupymedia.cc CORS_ORIGINS: https://app.occupymedia.cc,https://files.occupymedia.cc
PUBLIC_ORIGIN: https://app.occupymedia.cc PUBLIC_ORIGIN: https://app.occupymedia.cc
WEB_ORIGIN: https://app.occupymedia.cc WEB_ORIGIN: https://app.occupymedia.cc
API_PUBLIC_URL: https://api.occupymedia.cc API_PUBLIC_URL: https://api.occupymedia.cc
@ -98,6 +98,10 @@ services:
# Publishing workflows and the scheduler worker MUST share one queue, # Publishing workflows and the scheduler worker MUST share one queue,
# else approved publishes sit unconsumed. # else approved publishes sit unconsumed.
TEMPORAL_TASK_QUEUE: ${TEMPORAL_TASK_QUEUE:-tmbh-publishing} TEMPORAL_TASK_QUEUE: ${TEMPORAL_TASK_QUEUE:-tmbh-publishing}
# Hub-as-OIDC-issuer signing keys (see docs/design/2026-10-13-files-oidc-sso.md).
OIDC_KEY_DIR: /var/lib/tmbh/oidc
volumes:
- oidckeys:/var/lib/tmbh/oidc
ports: ["3000:3000"] ports: ["3000:3000"]
depends_on: depends_on:
postgres: { condition: service_healthy } postgres: { condition: service_healthy }
@ -168,3 +172,4 @@ volumes:
pgdata: pgdata:
redisdata: redisdata:
mediaworkerstate: mediaworkerstate:
oidckeys: