poimen-memory

198 Commits 15 Branches 0 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
rock	5fc9101888	fix: extract auth config to ConfigMap + SOPS, update Authentik slug (#40 ) CI / CI (push) Successful in 15m28s Details ## Problem JWT validation failing with `error decoding response body: expected value at line 6 column 1`. Root cause: `AUTHENTIK_ISSUER` pointed to slug `poimen-memory` which returns 404 on OIDC discovery. Slug was renamed to `poimen` in Authentik. Secondary issue: auth env vars were set via `kubectl set env` (not in git), so every ArgoCD sync reverted them. ## Changes - k8s/app/config.yaml — ConfigMap for non-sensitive env (auth mode, rate limits, OpenSearch/Obsidian URLs) - k8s/app/auth.enc.yaml — SOPS-encrypted Secret with `AUTHENTIK_ISSUER`, `AUTHENTIK_AUDIENCE`, `JWT_CACHE_TTL_SECS` - k8s/app/secret-generator.yaml — KSOPS generator for ArgoCD decryption - k8s/app/deployment.yaml — `envFrom` referencing ConfigMap + Secret - k8s/app/kustomization.yaml — Added config.yaml + KSOPS generator - k8s/app/opensearch-deployment.yaml — Updated JWKS/issuer URLs to `poimen` slug ## Rollout Reloader (`--auto-reload-all=true`) triggers rolling restart when ConfigMap/Secret change. Merge and ArgoCD sync handles everything.Reviewed-on: rock/poimen-memory#40 Co-authored-by: rock <[email protected]>	2026-09-08 05:34:17 +00:00
Story Crater Bot	56bee1915e	chore: Archive completed task files (M0, M1, M3, M3.5, M4.1-2, M3.6.1) Deleted 31 completed task files: - M0.x: 8 tasks (cargo, domain types, recordsource, tokenizer, adapters, gate) - M1.x: 8 tasks (llm-chat, standing-query, prompt template, parser, loop, log, e2e, gate) - M3.x: 4 tasks (l2-synthesis, rerank, mem-query, gate) - M3.5.x: 8 tasks (http-server, ingest, query, federation, skills, projects, rate-limiting, gate) - M3.6.1: DocCorpusSource (heading-boundary chunking) - M4.1-2: skill-draft, derived-filter Updated INDEX.md: - Removed M0 & M1 phase sections (archived in git history) - Updated progress table: 65 active tasks (42✅ + 2🟡 + 21⬜) - Updated status: M0/M1 complete, M3/M3.5 gates passing, M4.1-2 done - Noted M3.5.10 JWT auth implementation complete (awaiting image rollout) - Cleaned up broken links to deleted task files Total test count: 239 passing, 2 ignored (up from 196 at M3.4) Ready for M4.3 gate composition, M5 post-training, M7 source connectors.	2026-08-27 20:25:05 -07:00

Author

SHA1

Message

Date

rock

5fc9101888

fix: extract auth config to ConfigMap + SOPS, update Authentik slug (#40 )

CI / CI (push) Successful in 15m28s

Details

## Problem

JWT validation failing with `error decoding response body: expected value at line 6 column 1`.

Root cause: `AUTHENTIK_ISSUER` pointed to slug `poimen-memory` which returns 404 on OIDC discovery. Slug was renamed to `poimen` in Authentik.

Secondary issue: auth env vars were set via `kubectl set env` (not in git), so every ArgoCD sync reverted them.

## Changes

- **k8s/app/config.yaml** — ConfigMap for non-sensitive env (auth mode, rate limits, OpenSearch/Obsidian URLs)
- **k8s/app/auth.enc.yaml** — SOPS-encrypted Secret with `AUTHENTIK_ISSUER`, `AUTHENTIK_AUDIENCE`, `JWT_CACHE_TTL_SECS`
- **k8s/app/secret-generator.yaml** — KSOPS generator for ArgoCD decryption
- **k8s/app/deployment.yaml** — `envFrom` referencing ConfigMap + Secret
- **k8s/app/kustomization.yaml** — Added config.yaml + KSOPS generator
- **k8s/app/opensearch-deployment.yaml** — Updated JWKS/issuer URLs to `poimen` slug

## Rollout

Reloader (`--auto-reload-all=true`) triggers rolling restart when ConfigMap/Secret change. Merge and ArgoCD sync handles everything.Reviewed-on: rock/poimen-memory#40

Co-authored-by: rock <[email protected]>

2026-09-08 05:34:17 +00:00

Story Crater Bot

56bee1915e

chore: Archive completed task files (M0, M1, M3, M3.5, M4.1-2, M3.6.1)

Deleted 31 completed task files:
- M0.x: 8 tasks (cargo, domain types, recordsource, tokenizer, adapters, gate)
- M1.x: 8 tasks (llm-chat, standing-query, prompt template, parser, loop, log, e2e, gate)
- M3.x: 4 tasks (l2-synthesis, rerank, mem-query, gate)
- M3.5.x: 8 tasks (http-server, ingest, query, federation, skills, projects, rate-limiting, gate)
- M3.6.1: DocCorpusSource (heading-boundary chunking)
- M4.1-2: skill-draft, derived-filter

Updated INDEX.md:
- Removed M0 & M1 phase sections (archived in git history)
- Updated progress table: 65 active tasks (42✅ + 2🟡 + 21⬜)
- Updated status: M0/M1 complete, M3/M3.5 gates passing, M4.1-2 done
- Noted M3.5.10 JWT auth implementation complete (awaiting image rollout)
- Cleaned up broken links to deleted task files

Total test count: 239 passing, 2 ignored (up from 196 at M3.4)
Ready for M4.3 gate composition, M5 post-training, M7 source connectors.

2026-08-27 20:25:05 -07:00