refactor: the stack runs without one-off containers or default credentials

Merged
HA
3d ago
+441-882

Summary

Every start ran five containers that do one job and exit: base, shared-ca, cert-generator, user-seed and mongo-monitor-user. cert-generator's Kueue install held the backend and frontend back for up to 300 s (#408). Compose also fell back to public default passwords that the deploy guarded with seven checks.

Changes

  • nginx and the backend each make a self-signed certificate on first start. nginx verifies the backend's (proxy_ssl_verify on) through a read-only volume.
  • A ResourceQuota replaces Kueue: same cap (32 CPU, 4Gi requested), no controller, webhooks or CRDs. The worker creates the namespace, policy and quota itself, using k3s's own kubeconfig.
  • The backend seeds the users and the collector's Mongo user before gunicorn starts, and base is a stage of backend/Dockerfile.
  • Compose secrets have no defaults. .env comes from .env.example in dev and CI, and the deploy writes it on the server.

[!WARNING]
After the first deploy: run kubectl delete -f https://github.com/kubernetes-sigs/kueue/releases/download/v0.20.1/manifests.yaml on the server, since Kueue's pod webhook still intercepts every pod while installed. Secrets go into .env single-quoted (none may contain '). The old service account and the shared_ca volume stay until removed by hand.

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update
  • Refactoring (no functional changes)
  • CI/CD or tooling changes

Test Plan

  • Backend unit tests pass (cd backend && uv run pytest tests/unit)
  • Frontend unit tests pass (cd frontend && npm run test)
  • Backend E2E tests pass (docker compose exec -T backend sh -c 'uv sync --group test --no-dev --frozen --no-install-project --no-build && pytest tests/e2e')
  • Frontend E2E tests pass (cd frontend && npm run test:e2e)
  • API spec and client regenerated if routes or schemas changed (./deploy.sh openapi, then ./deploy.sh types), never edited by hand
  • Manual testing performed

Validation: ruff, mypy --strict, 573 backend unit tests, frontend lint, svelte-check and mkdocs --strict pass. On a bare local k3s v1.37.1 the worker created the namespace, policy and quota, an execution through https://localhost:5001 printed "hello from k3s", a 5Gi pod got "exceeded quota", and nginx kept verifying after a backend restart.

Checklist

  • My code follows the project's style guidelines
  • I have run pre-commit run --all-files and all checks pass
  • I have added tests that prove my fix/feature works
  • I have updated documentation if needed
  • My changes don't introduce new warnings