riotpiao-poimen/poimen-memory
2
0
Fork 0
Code Issues 13 Pull Requests 1 Actions Packages Projects Releases Wiki Activity
207 Commits 16 Branches 0 Tags
16e3ff16f1cb4f8737e9e56ed6aea0d0095c804e
Commit Graph
23 Commits
Author SHA1 Message Date
rock 16e3ff16f1 feat: authentik jwt + sops encryption for prod secrets & llm auth
CI / CI (pull_request) Successful in 3m40s
Details 
SECURITY:
- Add authentik_jwt.rs: OAuth2 client credentials flow with caching
- SOPS encrypt secrets with age key (SOPS_AGE_KEY_FILE)
- JWT tokens for LLM gateway, S3, and API gateway access
- Token auto-refresh when expired (60s before expiry)
- No hardcoded credentials in code or config

ENTITY EXTRACTION:
- LlmEntityExtractor now uses Authentik JWT instead of mock
- Fallback to env var if Authentik not configured
- Reflection verification still enabled
- WikiLink extraction as Stage 0 (always active)

DEPLOYMENT:
- ConfigMap: LLM_ENDPOINT, LLM_MODEL, timeouts
- Secret: AUTHENTIK_ISSUER, CLIENT_ID, CLIENT_SECRET, S3 keys
- envFrom mounts both ConfigMap and Secret
- KSOPS plugin for ArgoCD auto-decryption

DOCUMENTATION:
- docs/AUTHENTIK_SOPS_SETUP.md: Complete integration guide
- Service account creation in Authentik
- SOPS encryption/decryption workflow
- JWT token exchange flow
- Troubleshooting guide

FILES:
- crates/mem-ingest/src/authentik_jwt.rs (new, 180 LOC)
- crates/mem-ingest/src/entity_extractor.rs (updated, JWT auth)
- crates/mem-ingest/Cargo.toml (add reqwest)
- k8s/app/poimen-memory-secrets.yaml (new, unencrypted template)
- k8s/app/deployment.yaml (add secrets envFrom)
- k8s/app/config.yaml (add LLM config)
- k8s/.sops.yaml (encryption rules)
- docs/AUTHENTIK_SOPS_SETUP.md (new, 350 LOC)

NEXT:
1. Create Authentik service account (manual)
2. Encrypt secrets with SOPS
3. Deploy to poimen namespace
4. Test JWT token exchange with LLM endpoint
 2026-09-08 13:58:39 -07:00
rock 83e3206dcd fix: update deployment image to new riotpiao-poimen org path
CI / CI (pull_request) Successful in 4m22s
Details
2026-09-08 09:04:59 -07:00
rock 83a50844c5 feat: disable auth for testing + config refactor (#44)
CI / CI (push) Successful in 15m46s
Details 
Co-authored-by: rock <[email protected]>
 2026-09-08 15:51:15 +00:00
rock 5fc9101888 fix: extract auth config to ConfigMap + SOPS, update Authentik slug (#40)
CI / CI (push) Successful in 15m28s
Details 
## Problem

JWT validation failing with `error decoding response body: expected value at line 6 column 1`.

Root cause: `AUTHENTIK_ISSUER` pointed to slug `poimen-memory` which returns 404 on OIDC discovery. Slug was renamed to `poimen` in Authentik.

Secondary issue: auth env vars were set via `kubectl set env` (not in git), so every ArgoCD sync reverted them.

## Changes

- **k8s/app/config.yaml** — ConfigMap for non-sensitive env (auth mode, rate limits, OpenSearch/Obsidian URLs)
- **k8s/app/auth.enc.yaml** — SOPS-encrypted Secret with `AUTHENTIK_ISSUER`, `AUTHENTIK_AUDIENCE`, `JWT_CACHE_TTL_SECS`
- **k8s/app/secret-generator.yaml** — KSOPS generator for ArgoCD decryption
- **k8s/app/deployment.yaml** — `envFrom` referencing ConfigMap + Secret
- **k8s/app/kustomization.yaml** — Added config.yaml + KSOPS generator
- **k8s/app/opensearch-deployment.yaml** — Updated JWKS/issuer URLs to `poimen` slug

## Rollout

Reloader (`--auto-reload-all=true`) triggers rolling restart when ConfigMap/Secret change. Merge and ArgoCD sync handles everything.Reviewed-on: rock/poimen-memory#40

Co-authored-by: rock <[email protected]>
 2026-09-08 05:34:17 +00:00
rock 41c203ffed Phase 6 complete: JWT auth, pod-aware routing, Zep prompts, Temporal workflow links 
- Add migration 005_workflows_schema.sql (temporal_workflow_links reference table)
- Implement pod-aware SynthesisClient (internal vs external routing via ConfigMap)
- Encrypt endpoints config with SOPS/age (no topology exposure)
- Integrate Zep graph construction prompts (arXiv:2501.13956)
- Fix Phase 5.4 DRY violations (extracted capitalization helper)
- Fix Phase 6 concurrency (RwLock for metrics, exponential backoff + jitter for webhooks)
- Prune unnecessary docs, move to ../poimen-docs/
- JWT token propagation to all synthesis calls (reason_query, link_entities, infer_facts)

Quality improvements:
  CRAP: 2.63 → 2.23 (16.7% better)
  DRY: 90% → 95% (+5.5%)
  SOLID: 4.50 → 4.76 (+5.8%)

Compilation: ✅ Pass
Tests: 378+ (all passing)
 2026-09-05 00:31:28 -07:00
rock 92458e643c fix: remove unused vault PVC from memory deployment 
Memory service stores in pgvector, not local files.
PVC was RWO causing multi-node scheduling failures with 2 replicas.
MEM_HOME points to /tmp (emptyDir) for any scratch needs.
 2026-08-30 07:23:18 -07:00
rock 2501a68528 fix: add PodSecurity contexts to all poimen deployments 
- runAsNonRoot, runAsUser 1000, seccompProfile RuntimeDefault
- Drop ALL capabilities, no privilege escalation
- readOnlyRootFilesystem on memory (with /tmp emptyDir)
- git-sync init runs as root with only CHOWN+DAC_OVERRIDE caps
- All pods use their service accounts
 2026-08-30 07:20:08 -07:00
rock d6b6c763b6 fix: remove obsidian-remote UI (too glitchy via noVNC) 2026-08-29 09:37:07 -07:00
rock 10d7a0be77 fix: chown vault to uid 1000 after git-sync (obsidian runs as 1000) 2026-08-28 20:44:38 -07:00
rock c1167563b1 fix: add safe.directory for git-sync init container 2026-08-28 20:43:40 -07:00
rock 82507cf2a3 fix: move obsidian vault PVC to homelab repo (infra-managed) 2026-08-28 20:42:18 -07:00
rock 23019fdb27 fix: obsidian vault PVC ReadWriteMany for shared access 2026-08-28 20:28:37 -07:00
rock 89b4995213 fix: add obsidian + obsidian-ui to kustomization.yaml 2026-08-28 17:22:12 -07:00
rock cfae6f300f feat: add obsidian-remote UI for browsable vault in browser 
sytone/obsidian-remote provides full Obsidian Desktop via noVNC.
Shares vault PVC with obsidian-server (REST API stays for memory system).
UI accessible at obsidian.riotpiao.com
 2026-08-28 17:20:35 -07:00
rock a60c74fc78 fix: move obsidian ingress to homelab repo, use obsidian.riotpiao.com 
vault.riotpiao.com was already taken by HashiCorp Vault.
Ingress now managed centrally in homelab/k8s/bootstrap/ingress/ingress.yaml
 2026-08-28 16:43:36 -07:00
rock 2ddd2d6cdf fix: remove broken auth annotations from obsidian ingress 
Bearer auth-url was misconfigured (pointed to token endpoint, not
forward-auth). No Authentik outpost deployed yet. Remove for now,
vault.riotpiao.com accessible directly. TODO: add forward-auth
once outpost is set up.
 2026-08-28 16:42:00 -07:00
rock b94898d0d4 feat: obsidian git-sync from poimen-obesdient-memory repo 
- Add git-sync init container to clone/pull vault content
- Add SOPS-encrypted SSH deploy key (obsidian-git-ssh-secret.enc.yaml)
- Add .sops.yaml config (age encryption, same key as homelab)
- Repo: ssh://[email protected]:2222/rock/poimen-obesdient-memory.git
- Deploy key added to Forgejo repo (read-only)
 2026-08-28 16:31:48 -07:00
Story Crater Bot 69ec8aeec2 fix: Obsidian service port and health checks, use Longhorn storage 2026-08-27 21:37:47 -07:00
Story Crater Bot 0eecca815b refactor: replace Obsidian projector with standalone service (ppatlabs/obsidian) 2026-08-27 21:35:07 -07:00
Story Crater Bot 56bee1915e chore: Archive completed task files (M0, M1, M3, M3.5, M4.1-2, M3.6.1) 
Deleted 31 completed task files:
- M0.x: 8 tasks (cargo, domain types, recordsource, tokenizer, adapters, gate)
- M1.x: 8 tasks (llm-chat, standing-query, prompt template, parser, loop, log, e2e, gate)
- M3.x: 4 tasks (l2-synthesis, rerank, mem-query, gate)
- M3.5.x: 8 tasks (http-server, ingest, query, federation, skills, projects, rate-limiting, gate)
- M3.6.1: DocCorpusSource (heading-boundary chunking)
- M4.1-2: skill-draft, derived-filter

Updated INDEX.md:
- Removed M0 & M1 phase sections (archived in git history)
- Updated progress table: 65 active tasks (42✅ + 2🟡 + 21⬜)
- Updated status: M0/M1 complete, M3/M3.5 gates passing, M4.1-2 done
- Noted M3.5.10 JWT auth implementation complete (awaiting image rollout)
- Cleaned up broken links to deleted task files

Total test count: 239 passing, 2 ignored (up from 196 at M3.4)
Ready for M4.3 gate composition, M5 post-training, M7 source connectors.
 2026-08-27 20:25:05 -07:00
rock 46d993824f feat: add Obsidian vault projection with Longhorn storage (#13) 2026-08-24 01:58:39 +00:00
Story Crater Bot de9c4ffeae Implement M3.6.1: DocCorpusSource with heading-boundary chunking (196 tests) 2026-08-23 09:42:09 -07:00
Story Crater Bot eaed7fc42a Add K8s app deployment, Dockerfile, and CI workflow (Option A) 2026-08-23 00:01:30 -07:00