7fb24e0452
Tiny Go service that returns ShellConfig JSON for any registered app.
Backs the runtime-loaded <AppShell> component being added to
@limitless/ui (next).
Endpoints:
GET /api/v1/shell/{appKey} → app + branding + user + menus, ETag-cached
GET /api/v1/apps → registered app inventory
GET /healthz, /readyz → ops probes
Auth:
Keycloak Bearer JWT validated against the gosecCloud realm.
Discovery URL is overridable so pods can hit Keycloak via the
in-cluster service (https://keycloak.keycloak.svc.cluster.local:8443)
while still validating the canonical issuer (auth.gosec.cloud).
Lazy JWKS init — pod stays up if Keycloak is briefly unreachable.
Data model (gsc_core.shell):
apps · menu_items (zone enum: topbar/sidebar/footer/user-menu) ·
menu_role_grants (Keycloak realm roles, OR semantics, empty=all) ·
branding
Seed includes the 8 gsc-crm sidebar items + topbar search +
user-menu (settings/support/logout) + footer (docs).
K8s:
Namespace gsc-shell (ambient mesh).
Deployment 2 replicas, internal-only ingress shell-api.gosec.internal,
EJBCA SERVER cert.
ServiceEntry for auth.gosec.cloud (vestigial — discovery now uses
in-cluster path; keeping for ad-hoc curl from inside pods).
Added to keycloak/allow-keycloak-clients AuthorizationPolicy out of band.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
26 lines
683 B
Docker
26 lines
683 B
Docker
# gsc-shell-api — runtime chrome data API.
|
|
#
|
|
# Build context is the project root (no monorepo file: deps).
|
|
# podman build -f Dockerfile -t gsc-shell-api .
|
|
|
|
FROM golang:1.23-alpine AS builder
|
|
RUN apk add --no-cache git ca-certificates
|
|
WORKDIR /src
|
|
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
|
|
go build -ldflags="-w -s" -o /out/gsc-shell-api ./cmd/server
|
|
|
|
# ----- runtime -----
|
|
FROM alpine:3.19
|
|
RUN apk add --no-cache ca-certificates tzdata && \
|
|
addgroup -S shell && adduser -S shell -G shell
|
|
WORKDIR /app
|
|
COPY --from=builder /out/gsc-shell-api /app/gsc-shell-api
|
|
USER shell
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/app/gsc-shell-api"]
|