rock
16e3ff16f1
CI / CI (pull_request) Successful in 3m40s
SECURITY: - Add authentik_jwt.rs: OAuth2 client credentials flow with caching - SOPS encrypt secrets with age key (SOPS_AGE_KEY_FILE) - JWT tokens for LLM gateway, S3, and API gateway access - Token auto-refresh when expired (60s before expiry) - No hardcoded credentials in code or config ENTITY EXTRACTION: - LlmEntityExtractor now uses Authentik JWT instead of mock - Fallback to env var if Authentik not configured - Reflection verification still enabled - WikiLink extraction as Stage 0 (always active) DEPLOYMENT: - ConfigMap: LLM_ENDPOINT, LLM_MODEL, timeouts - Secret: AUTHENTIK_ISSUER, CLIENT_ID, CLIENT_SECRET, S3 keys - envFrom mounts both ConfigMap and Secret - KSOPS plugin for ArgoCD auto-decryption DOCUMENTATION: - docs/AUTHENTIK_SOPS_SETUP.md: Complete integration guide - Service account creation in Authentik - SOPS encryption/decryption workflow - JWT token exchange flow - Troubleshooting guide FILES: - crates/mem-ingest/src/authentik_jwt.rs (new, 180 LOC) - crates/mem-ingest/src/entity_extractor.rs (updated, JWT auth) - crates/mem-ingest/Cargo.toml (add reqwest) - k8s/app/poimen-memory-secrets.yaml (new, unencrypted template) - k8s/app/deployment.yaml (add secrets envFrom) - k8s/app/config.yaml (add LLM config) - k8s/.sops.yaml (encryption rules) - docs/AUTHENTIK_SOPS_SETUP.md (new, 350 LOC) NEXT: 1. Create Authentik service account (manual) 2. Encrypt secrets with SOPS 3. Deploy to poimen namespace 4. Test JWT token exchange with LLM endpoint
38 lines
1.7 KiB
Rust
38 lines
1.7 KiB
Rust
pub mod pi_session;
|
|
pub mod claude_transcript;
|
|
pub mod authentik_jwt;
|
|
pub mod doc_corpus;
|
|
pub mod derived_filter;
|
|
pub mod obsidian_ref_source;
|
|
pub mod reference_cycle_guard;
|
|
pub mod optimizer_sink;
|
|
pub mod optimizer_metrics;
|
|
pub mod query_metrics;
|
|
pub mod wiki_link;
|
|
pub mod entity_extractor;
|
|
pub mod fact_extractor;
|
|
pub mod contradiction_detector;
|
|
pub mod ingest_pipeline;
|
|
pub mod grm_retriever;
|
|
pub mod memorability_gate;
|
|
pub mod speaker_extractor;
|
|
|
|
pub use pi_session::PiSessionSource;
|
|
pub use claude_transcript::ClaudeTranscriptSource;
|
|
pub use doc_corpus::{DocCorpusSource, DocSection, DryRunReport};
|
|
pub use derived_filter::{ArtifactRecord, DerivedFilter, DerivedMatch};
|
|
pub use optimizer_sink::{OptimizationMetrics, CompressorStats, optimize_record_with_metrics};
|
|
pub use optimizer_metrics::MetricsCollector;
|
|
pub use query_metrics::{
|
|
QueryMetrics, QueryMetricsRepository, ProgressSnapshot, MetricsSummary,
|
|
OptimizationStatus, CompressorMetrics, ContentTypeMetrics,
|
|
};
|
|
pub use wiki_link::{WikiLink, WikiLinkParser, WikiLinkGraph, LinkType};
|
|
pub use entity_extractor::{ExtractedEntity, LlmEntityExtractor, CompositeEntityExtractor, WikiLinkFallbackExtractor};
|
|
pub use fact_extractor::{ExtractedFact, SimpleFactExtractor, LlmFactExtractor};
|
|
pub use contradiction_detector::{ContradictionResult, ContradictionHandler, ContradictionReview, LlmContradictionDetector, ContradictionPreFilter};
|
|
pub use ingest_pipeline::{Episode, ExtractionResult, IngestPipeline, QueueWorker};
|
|
pub use grm_retriever::{EntityContext, FactContext, MemorabilityDecision};
|
|
pub use speaker_extractor::{SpeakerConfig, ExtractedSpeaker, SpeakerMethod, HeuristicSpeakerExtractor};
|
|
pub use memorability_gate::{FilteredEntity, FilteredFact, MemorabilityGate};
|