@aifabrix/builder 2.0.0 → 2.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -2
- package/bin/aifabrix.js +9 -3
- package/jest.config.integration.js +30 -0
- package/lib/app-config.js +157 -0
- package/lib/app-deploy.js +233 -82
- package/lib/app-dockerfile.js +112 -0
- package/lib/app-prompts.js +244 -0
- package/lib/app-push.js +172 -0
- package/lib/app-run.js +334 -133
- package/lib/app.js +208 -274
- package/lib/audit-logger.js +2 -0
- package/lib/build.js +209 -98
- package/lib/cli.js +76 -86
- package/lib/commands/app.js +414 -0
- package/lib/commands/login.js +304 -0
- package/lib/config.js +78 -0
- package/lib/deployer.js +225 -81
- package/lib/env-reader.js +45 -30
- package/lib/generator.js +308 -191
- package/lib/github-generator.js +67 -7
- package/lib/infra.js +156 -61
- package/lib/push.js +105 -10
- package/lib/schema/application-schema.json +30 -2
- package/lib/schema/infrastructure-schema.json +589 -0
- package/lib/secrets.js +229 -24
- package/lib/template-validator.js +205 -0
- package/lib/templates.js +305 -170
- package/lib/utils/api.js +329 -0
- package/lib/utils/cli-utils.js +97 -0
- package/lib/utils/dockerfile-utils.js +131 -0
- package/lib/utils/environment-checker.js +125 -0
- package/lib/utils/error-formatter.js +61 -0
- package/lib/utils/health-check.js +187 -0
- package/lib/utils/logger.js +53 -0
- package/lib/utils/template-helpers.js +223 -0
- package/lib/utils/variable-transformer.js +271 -0
- package/lib/validator.js +27 -112
- package/package.json +13 -10
- package/templates/README.md +75 -3
- package/templates/applications/keycloak/Dockerfile +36 -0
- package/templates/applications/keycloak/env.template +32 -0
- package/templates/applications/keycloak/rbac.yaml +37 -0
- package/templates/applications/keycloak/variables.yaml +56 -0
- package/templates/applications/miso-controller/Dockerfile +125 -0
- package/templates/applications/miso-controller/env.template +129 -0
- package/templates/applications/miso-controller/rbac.yaml +168 -0
- package/templates/applications/miso-controller/variables.yaml +56 -0
- package/templates/github/release.yaml.hbs +5 -26
- package/templates/github/steps/npm.hbs +24 -0
- package/templates/infra/compose.yaml +6 -6
- package/templates/python/docker-compose.hbs +19 -12
- package/templates/python/main.py +80 -0
- package/templates/python/requirements.txt +4 -0
- package/templates/typescript/Dockerfile.hbs +2 -2
- package/templates/typescript/docker-compose.hbs +19 -12
- package/templates/typescript/index.ts +116 -0
- package/templates/typescript/package.json +26 -0
- package/templates/typescript/tsconfig.json +24 -0
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
roles:
|
|
2
|
+
- name: "AI Fabrix Admin"
|
|
3
|
+
value: "aifabrix-admin"
|
|
4
|
+
description: "Full access to all application features and configurations"
|
|
5
|
+
|
|
6
|
+
- name: "AI Fabrix User"
|
|
7
|
+
value: "aifabrix-user"
|
|
8
|
+
description: "Basic user access to the application"
|
|
9
|
+
|
|
10
|
+
- name: "AI Fabrix Developer"
|
|
11
|
+
value: "aifabrix-developer"
|
|
12
|
+
description: "Developer access for testing and debugging"
|
|
13
|
+
|
|
14
|
+
permissions:
|
|
15
|
+
- name: "myapp:read"
|
|
16
|
+
roles:
|
|
17
|
+
- "aifabrix-user"
|
|
18
|
+
- "aifabrix-admin"
|
|
19
|
+
- "aifabrix-developer"
|
|
20
|
+
description: "Read access to application data"
|
|
21
|
+
|
|
22
|
+
- name: "myapp:write"
|
|
23
|
+
roles:
|
|
24
|
+
- "aifabrix-admin"
|
|
25
|
+
- "aifabrix-developer"
|
|
26
|
+
description: "Create and edit application data"
|
|
27
|
+
|
|
28
|
+
- name: "myapp:delete"
|
|
29
|
+
roles:
|
|
30
|
+
- "aifabrix-admin"
|
|
31
|
+
description: "Delete application data"
|
|
32
|
+
|
|
33
|
+
- name: "myapp:admin"
|
|
34
|
+
roles:
|
|
35
|
+
- "aifabrix-admin"
|
|
36
|
+
description: "Administrative access to application configuration"
|
|
37
|
+
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
# Application Metadata
|
|
2
|
+
app:
|
|
3
|
+
key: keycloak
|
|
4
|
+
displayName: "AI Fabrix Keycloak"
|
|
5
|
+
description: "Identity and Access Management"
|
|
6
|
+
type: webapp
|
|
7
|
+
|
|
8
|
+
# Image Configuration
|
|
9
|
+
image:
|
|
10
|
+
name: aifabrix/keycloak
|
|
11
|
+
tag: "latest"
|
|
12
|
+
registry: devflowiseacr.azurecr.io
|
|
13
|
+
registryMode: acr
|
|
14
|
+
|
|
15
|
+
# Port Configuration
|
|
16
|
+
port: 8082
|
|
17
|
+
|
|
18
|
+
# Azure Requirements
|
|
19
|
+
requires:
|
|
20
|
+
database: true
|
|
21
|
+
databases:
|
|
22
|
+
- name: keycloak
|
|
23
|
+
redis: false
|
|
24
|
+
storage: false
|
|
25
|
+
|
|
26
|
+
# Health Check
|
|
27
|
+
healthCheck:
|
|
28
|
+
path: /health
|
|
29
|
+
interval: 30
|
|
30
|
+
probePath: /health
|
|
31
|
+
probeRequestType: GET
|
|
32
|
+
probeProtocol: Https
|
|
33
|
+
probeIntervalInSeconds: 120
|
|
34
|
+
|
|
35
|
+
# Authentication
|
|
36
|
+
authentication:
|
|
37
|
+
type: keycloak
|
|
38
|
+
enableSSO: true
|
|
39
|
+
requiredRoles: ["aifabrix-user"]
|
|
40
|
+
endpoints:
|
|
41
|
+
local: "http://localhost:8082/auth/callback"
|
|
42
|
+
|
|
43
|
+
# Build Configuration
|
|
44
|
+
build:
|
|
45
|
+
context: .. # Docker build context (relative to builder/)
|
|
46
|
+
dockerfile: builder/Dockerfile # Dockerfile name (empty = use template)
|
|
47
|
+
envOutputPath: .env # Copy .env to repo root for local dev
|
|
48
|
+
localPort: 8082 # Port for local development (different from Docker port)
|
|
49
|
+
containerPort: 8080 # Container port (different from local port)
|
|
50
|
+
language: typescript # Runtime language for template selection
|
|
51
|
+
secrets: # Path to secrets file (optional)
|
|
52
|
+
|
|
53
|
+
# Docker Compose
|
|
54
|
+
compose:
|
|
55
|
+
file: docker-compose.yaml
|
|
56
|
+
service: keycloak
|
|
@@ -0,0 +1,125 @@
|
|
|
1
|
+
# AI Fabrix Miso Controller - Optimized Dockerfile
|
|
2
|
+
FROM node:18-alpine
|
|
3
|
+
|
|
4
|
+
# Install only essential runtime dependencies
|
|
5
|
+
RUN apk add --no-cache \
|
|
6
|
+
curl \
|
|
7
|
+
wget \
|
|
8
|
+
openssl \
|
|
9
|
+
openssl-dev
|
|
10
|
+
|
|
11
|
+
# Install PNPM globally
|
|
12
|
+
RUN npm install -g pnpm
|
|
13
|
+
|
|
14
|
+
# Install tsconfig-paths globally for path resolution
|
|
15
|
+
RUN npm install -g tsconfig-paths
|
|
16
|
+
|
|
17
|
+
# Set working directory
|
|
18
|
+
WORKDIR /app
|
|
19
|
+
|
|
20
|
+
# Copy package files for dependency resolution
|
|
21
|
+
COPY package*.json ./
|
|
22
|
+
COPY pnpm-workspace.yaml ./
|
|
23
|
+
COPY packages/miso-azure/package*.json ./packages/miso-azure/
|
|
24
|
+
COPY packages/miso-controller/package*.json ./packages/miso-controller/
|
|
25
|
+
COPY packages/miso-controller/bin ./packages/miso-controller/bin
|
|
26
|
+
COPY packages/miso-ui/package*.json ./packages/miso-ui/
|
|
27
|
+
|
|
28
|
+
# Create .npmrc for hoisting to fix module resolution in Docker
|
|
29
|
+
RUN echo "shamefully-hoist=true" > .npmrc
|
|
30
|
+
|
|
31
|
+
# Install all dependencies (including dev for building)
|
|
32
|
+
RUN pnpm install
|
|
33
|
+
|
|
34
|
+
# Copy only the source code we need
|
|
35
|
+
COPY packages/miso-azure/src ./packages/miso-azure/src
|
|
36
|
+
COPY packages/miso-azure/tsconfig.json ./packages/miso-azure/
|
|
37
|
+
COPY packages/miso-controller/src ./packages/miso-controller/src
|
|
38
|
+
COPY packages/miso-controller/tsconfig.json ./packages/miso-controller/
|
|
39
|
+
COPY packages/miso-controller/tsconfig.docker.json ./packages/miso-controller/
|
|
40
|
+
COPY packages/miso-controller/openapi/openapi-complete.yaml ./packages/miso-controller/dist/openapi/
|
|
41
|
+
COPY packages/miso-controller/openapi/openapi-complete.json ./packages/miso-controller/dist/openapi/
|
|
42
|
+
COPY packages/miso-ui/src ./packages/miso-ui/src
|
|
43
|
+
COPY packages/miso-ui/tsconfig.json ./packages/miso-ui/
|
|
44
|
+
COPY packages/miso-ui/tsconfig.app.json ./packages/miso-ui/
|
|
45
|
+
COPY packages/miso-ui/tsconfig.node.json ./packages/miso-ui/
|
|
46
|
+
COPY packages/miso-ui/vite.config.ts ./packages/miso-ui/
|
|
47
|
+
COPY packages/miso-ui/index.html ./packages/miso-ui/
|
|
48
|
+
|
|
49
|
+
# Fix Rollup native module issue for Alpine Linux
|
|
50
|
+
RUN pnpm add @rollup/rollup-linux-x64-musl @types/express-serve-static-core --workspace-root
|
|
51
|
+
|
|
52
|
+
# Build packages
|
|
53
|
+
WORKDIR /app/packages/miso-azure
|
|
54
|
+
RUN pnpm run build
|
|
55
|
+
|
|
56
|
+
WORKDIR /app/packages/miso-ui
|
|
57
|
+
RUN pnpm run build
|
|
58
|
+
|
|
59
|
+
WORKDIR /app/packages/miso-controller
|
|
60
|
+
RUN pnpm run db:generate
|
|
61
|
+
RUN pnpm exec tsc -p tsconfig.docker.json || true
|
|
62
|
+
# Copy sensitive-fields.config.json to dist folder
|
|
63
|
+
RUN mkdir -p dist/src/services/logging && \
|
|
64
|
+
cp src/services/logging/sensitive-fields.config.json dist/src/services/logging/ || true
|
|
65
|
+
|
|
66
|
+
# Return to root to prune correctly (needed to keep workspace dependencies)
|
|
67
|
+
WORKDIR /app
|
|
68
|
+
|
|
69
|
+
# Remove source files and build artifacts, but preserve Prisma schema files and OpenAPI files
|
|
70
|
+
RUN mkdir -p packages/miso-controller/dist/database/prisma && \
|
|
71
|
+
cp packages/miso-controller/src/database/prisma/*.prisma packages/miso-controller/dist/database/prisma/ || true
|
|
72
|
+
RUN rm -rf packages/miso-azure/src packages/miso-controller/src packages/miso-ui/src
|
|
73
|
+
RUN rm -rf packages/miso-azure/tsconfig.json packages/miso-ui/tsconfig.json
|
|
74
|
+
RUN rm -rf packages/*/node_modules packages/*/.git packages/*/.github
|
|
75
|
+
|
|
76
|
+
# Reinstall to recreate symlinks after removing source files
|
|
77
|
+
# This ensures workspace dependencies are properly linked
|
|
78
|
+
RUN pnpm install --frozen-lockfile --filter "@aifabrix/miso-controller..." || pnpm install --frozen-lockfile
|
|
79
|
+
|
|
80
|
+
# Manually remove known dev dependencies
|
|
81
|
+
RUN rm -rf node_modules/markdownlint node_modules/markdownlint-cli node_modules/prettier
|
|
82
|
+
RUN rm -rf .pnpm/markdownlint* .pnpm/prettier*
|
|
83
|
+
|
|
84
|
+
# Create non-root user
|
|
85
|
+
RUN addgroup -g 1001 -S nodejs && \
|
|
86
|
+
adduser -S miso -u 1001
|
|
87
|
+
|
|
88
|
+
# Create necessary directories for mount points (with fallback to local storage)
|
|
89
|
+
RUN mkdir -p /mnt/data/logs /mnt/data/data /mnt/data/backup /mnt/data/config
|
|
90
|
+
RUN mkdir -p /app/data/logs /app/data/data /app/data/backup /app/data/config
|
|
91
|
+
|
|
92
|
+
# Change ownership of app directory and mount points
|
|
93
|
+
RUN chown -R miso:nodejs /app /mnt/data
|
|
94
|
+
|
|
95
|
+
# Switch to non-root user
|
|
96
|
+
USER miso
|
|
97
|
+
|
|
98
|
+
# Set working directory to controller
|
|
99
|
+
WORKDIR /app/packages/miso-controller
|
|
100
|
+
|
|
101
|
+
# Expose port
|
|
102
|
+
EXPOSE 3000
|
|
103
|
+
|
|
104
|
+
# Health check
|
|
105
|
+
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
|
|
106
|
+
CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1
|
|
107
|
+
|
|
108
|
+
# Set environment variable for tsconfig-paths
|
|
109
|
+
ENV TS_NODE_PROJECT=tsconfig.docker.json
|
|
110
|
+
|
|
111
|
+
# Set default data paths (can be overridden by environment variables)
|
|
112
|
+
ENV LOG_PATH=/mnt/data/logs
|
|
113
|
+
ENV DATA_PATH=/mnt/data/data
|
|
114
|
+
ENV BACKUP_PATH=/mnt/data/backup
|
|
115
|
+
ENV CONFIG_PATH=/mnt/data/config
|
|
116
|
+
|
|
117
|
+
# Create symlinks for fallback to local storage if mounts are not provided
|
|
118
|
+
RUN ln -sf /app/data/logs /mnt/data/logs || true
|
|
119
|
+
RUN ln -sf /app/data/data /mnt/data/data || true
|
|
120
|
+
RUN ln -sf /app/data/backup /mnt/data/backup || true
|
|
121
|
+
RUN ln -sf /app/data/config /mnt/data/config || true
|
|
122
|
+
|
|
123
|
+
# Start the application
|
|
124
|
+
CMD ["node", "-r", "tsconfig-paths/register", "dist/src/server.js"]
|
|
125
|
+
|
|
@@ -0,0 +1,129 @@
|
|
|
1
|
+
# Environment Variables Template
|
|
2
|
+
# Use kv:// references for secrets (resolved from secrets.local.yaml)
|
|
3
|
+
# Use ${VAR} for environment-specific values
|
|
4
|
+
|
|
5
|
+
# =============================================================================
|
|
6
|
+
# APPLICATION ENVIRONMENT
|
|
7
|
+
# =============================================================================
|
|
8
|
+
|
|
9
|
+
NODE_ENV=development
|
|
10
|
+
PORT=3000
|
|
11
|
+
AUTO_CREATE_TABLES=true
|
|
12
|
+
FAST_STARTUP=false
|
|
13
|
+
ALLOWED_ORIGINS=http://localhost:3000,http://localhost:5173
|
|
14
|
+
ENABLE_API_DOCS=true
|
|
15
|
+
|
|
16
|
+
# Package Version (auto-set by npm/pnpm, optional override)
|
|
17
|
+
# npm_package_version=1.0.0
|
|
18
|
+
|
|
19
|
+
# =============================================================================
|
|
20
|
+
# DATABASE CONFIGURATION
|
|
21
|
+
# =============================================================================
|
|
22
|
+
# Connects to external postgres from aifabrix-setup
|
|
23
|
+
|
|
24
|
+
DATABASE_URL=kv://databases-miso-controller-0-urlKeyVault
|
|
25
|
+
DATABASELOG_URL=kv://databases-miso-controller-1-urlKeyVault
|
|
26
|
+
MISO_ADMIN_PASSWORD=kv://miso-controller-admin-passwordKeyVault
|
|
27
|
+
|
|
28
|
+
# =============================================================================
|
|
29
|
+
# REDIS CONFIGURATION
|
|
30
|
+
# =============================================================================
|
|
31
|
+
# Connects to external redis from aifabrix-setup
|
|
32
|
+
|
|
33
|
+
REDIS_URL=kv://redis-urlKeyVault
|
|
34
|
+
REDIS_HOST=localhost
|
|
35
|
+
REDIS_PORT=6379
|
|
36
|
+
REDIS_PASSWORD=kv://redis-passwordKeyVault
|
|
37
|
+
REDIS_DB=0
|
|
38
|
+
REDIS_KEY_PREFIX=miso
|
|
39
|
+
REDIS_ROLES_TTL=900
|
|
40
|
+
REDIS_PERMISSIONS_TTL=900
|
|
41
|
+
|
|
42
|
+
# =============================================================================
|
|
43
|
+
# KEYCLOAK CONFIGURATION
|
|
44
|
+
# =============================================================================
|
|
45
|
+
# Connects to external keycloak from aifabrix-setup
|
|
46
|
+
|
|
47
|
+
KEYCLOAK_REALM=aifabrix
|
|
48
|
+
KEYCLOAK_AUTH_SERVER_URL=kv://keycloak-auth-server-urlKeyVault
|
|
49
|
+
KEYCLOAK_CLIENT_ID=miso-controller
|
|
50
|
+
KEYCLOAK_CLIENT_SECRET=kv://keycloak-client-secretKeyVault
|
|
51
|
+
KEYCLOAK_ADMIN_USERNAME=admin
|
|
52
|
+
KEYCLOAK_ADMIN_PASSWORD=kv://keycloak-admin-passwordKeyVault
|
|
53
|
+
KEYCLOAK_PUBLIC_KEY=
|
|
54
|
+
KEYCLOAK_VERIFY_AUDIENCE=false
|
|
55
|
+
KEYCLOAK_TOKEN_TIMEOUT=5000
|
|
56
|
+
KEYCLOAK_DEFAULT_PASSWORD=kv://keycloak-admin-passwordKeyVault
|
|
57
|
+
|
|
58
|
+
# Keycloak Events Configuration
|
|
59
|
+
KEYCLOAK_EVENTS_ENABLED=true
|
|
60
|
+
KEYCLOAK_EVENTS_VERIFY_SIGNATURE=true
|
|
61
|
+
KEYCLOAK_EVENTS_SECRET=kv://keycloak-events-secretKeyVault
|
|
62
|
+
|
|
63
|
+
# =============================================================================
|
|
64
|
+
# AZURE AD PROVIDER CONFIGURATION
|
|
65
|
+
# =============================================================================
|
|
66
|
+
|
|
67
|
+
AZURE_SUBSCRIPTION_ID=kv://azure-subscription-idKeyVault
|
|
68
|
+
AZURE_TENANT_ID=kv://azure-tenant-idKeyVault
|
|
69
|
+
AZURE_SERVICE_NAME=kv://azure-service-nameKeyVault
|
|
70
|
+
MOCK=true
|
|
71
|
+
AZURE_CLIENT_ID=kv://azure-client-idKeyVault
|
|
72
|
+
AZURE_CLIENT_SECRET=kv://azure-client-secretKeyVault
|
|
73
|
+
|
|
74
|
+
# Mock Mode (set to false for production)
|
|
75
|
+
MOCK=true
|
|
76
|
+
|
|
77
|
+
# =============================================================================
|
|
78
|
+
# SECURITY & ENCRYPTION
|
|
79
|
+
# =============================================================================
|
|
80
|
+
|
|
81
|
+
# Encryption Key for Database Secrets
|
|
82
|
+
ENCRYPTION_KEY=kv://secrets-encryptionKeyVault
|
|
83
|
+
|
|
84
|
+
# JWT Configuration (for client token generation)
|
|
85
|
+
JWT_SECRET=kv://miso-controller-jwt-secretKeyVault
|
|
86
|
+
|
|
87
|
+
# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
|
|
88
|
+
API_KEY=kv://miso-controller-api-key-secretKeyVault
|
|
89
|
+
|
|
90
|
+
# =============================================================================
|
|
91
|
+
# MISO CONTROLLER CONFIGURATION
|
|
92
|
+
# =============================================================================
|
|
93
|
+
|
|
94
|
+
# MISO Controller URL
|
|
95
|
+
MISO_CONTROLLER_URL=kv://miso-controller-url
|
|
96
|
+
|
|
97
|
+
# Web Server URL (for OpenAPI documentation server URLs)
|
|
98
|
+
# Used to generate correct server URLs in OpenAPI spec
|
|
99
|
+
WEB_SERVER_URL=kv ://web-server-url
|
|
100
|
+
|
|
101
|
+
# MISO Environment Configuration (miso, dev, tst, pro)
|
|
102
|
+
MISO_ENVIRONMENT=miso
|
|
103
|
+
|
|
104
|
+
# MISO Application Client Credentials (per application)
|
|
105
|
+
MISO_CLIENTID=kv ://miso-client-idKeyVault
|
|
106
|
+
MISO_CLIENTSECRET=kv ://miso-client-secretKeyVault
|
|
107
|
+
|
|
108
|
+
# =============================================================================
|
|
109
|
+
# MORI SERVICE CONFIGURATION
|
|
110
|
+
# =============================================================================
|
|
111
|
+
|
|
112
|
+
MORI_BASE_URL=kv://mori-base-urlKeyVault
|
|
113
|
+
MORI_API_KEY=kv ://mori-api-keyKeyVault
|
|
114
|
+
|
|
115
|
+
# =============================================================================
|
|
116
|
+
# LOGGING CONFIGURATION
|
|
117
|
+
# =============================================================================
|
|
118
|
+
|
|
119
|
+
LOG_TO_FILE=true
|
|
120
|
+
LOG_FILE_PATH=/mnt/data/logs
|
|
121
|
+
|
|
122
|
+
# =============================================================================
|
|
123
|
+
# STORAGE CONFIGURATION
|
|
124
|
+
# =============================================================================
|
|
125
|
+
|
|
126
|
+
# Mount Volume Configuration
|
|
127
|
+
MOUNT_VOLUME=C:/git/esystemsdev/aifabrix-miso/mount
|
|
128
|
+
|
|
129
|
+
|
|
@@ -0,0 +1,168 @@
|
|
|
1
|
+
roles:
|
|
2
|
+
- name: "AI Fabrix Platform Admin"
|
|
3
|
+
value: "aifabrix-platform-admin"
|
|
4
|
+
description: "Full platform infrastructure management and enterprise controller access"
|
|
5
|
+
Groups: ["AI-Fabrix-Platform-Admins"]
|
|
6
|
+
|
|
7
|
+
- name: "AI Fabrix Security Admin"
|
|
8
|
+
value: "aifabrix-security-admin"
|
|
9
|
+
description: "Security and compliance management for enterprise controller"
|
|
10
|
+
Groups: ["AI-Fabrix-Security-Admins"]
|
|
11
|
+
|
|
12
|
+
- name: "AI Fabrix Infrastructure Admin"
|
|
13
|
+
value: "aifabrix-infrastructure-admin"
|
|
14
|
+
description: "Infrastructure deployment and management across environments"
|
|
15
|
+
Groups: ["AI-Fabrix-Infrastructure-Admins"]
|
|
16
|
+
|
|
17
|
+
- name: "AI Fabrix Deployment Admin"
|
|
18
|
+
value: "aifabrix-deployment-admin"
|
|
19
|
+
description: "Application deployment orchestration and environment management"
|
|
20
|
+
Groups: ["AI-Fabrix-Deployment-Admins"]
|
|
21
|
+
|
|
22
|
+
- name: "AI Fabrix Compliance Admin"
|
|
23
|
+
value: "aifabrix-compliance-admin"
|
|
24
|
+
description: "ISO 27001 compliance monitoring and audit management"
|
|
25
|
+
Groups: ["AI-Fabrix-Compliance-Admins"]
|
|
26
|
+
|
|
27
|
+
- name: "AI Fabrix Developer"
|
|
28
|
+
value: "aifabrix-developer"
|
|
29
|
+
description: "Developer access to deploy applications via GitHub Actions"
|
|
30
|
+
Groups: ["AI-Fabrix-Developers"]
|
|
31
|
+
|
|
32
|
+
- name: "AI Fabrix Observer"
|
|
33
|
+
value: "aifabrix-observer"
|
|
34
|
+
description: "Read-only access to monitoring, logs, and compliance reports"
|
|
35
|
+
Groups: ["AI-Fabrix-Observers"]
|
|
36
|
+
|
|
37
|
+
permissions:
|
|
38
|
+
# Service User Management
|
|
39
|
+
- name: "service-user:create"
|
|
40
|
+
roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
|
|
41
|
+
description: "Create service users and API clients"
|
|
42
|
+
|
|
43
|
+
- name: "service-user:read"
|
|
44
|
+
roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-observer"]
|
|
45
|
+
description: "View service users and their configurations"
|
|
46
|
+
|
|
47
|
+
- name: "service-user:update"
|
|
48
|
+
roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
|
|
49
|
+
description: "Update service user configurations and regenerate secrets"
|
|
50
|
+
|
|
51
|
+
- name: "service-user:delete"
|
|
52
|
+
roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
|
|
53
|
+
description: "Deactivate service users"
|
|
54
|
+
|
|
55
|
+
# Template Applications (environment = null)
|
|
56
|
+
- name: "applications:create"
|
|
57
|
+
roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin"]
|
|
58
|
+
description: "Register new application templates"
|
|
59
|
+
|
|
60
|
+
- name: "applications:read"
|
|
61
|
+
roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin", "aifabrix-developer", "aifabrix-observer"]
|
|
62
|
+
description: "View application templates"
|
|
63
|
+
|
|
64
|
+
- name: "applications:update"
|
|
65
|
+
roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin"]
|
|
66
|
+
description: "Update application templates"
|
|
67
|
+
|
|
68
|
+
- name: "applications:delete"
|
|
69
|
+
roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin"]
|
|
70
|
+
description: "Remove application templates"
|
|
71
|
+
|
|
72
|
+
# Environments
|
|
73
|
+
- name: "environments:create"
|
|
74
|
+
roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin"]
|
|
75
|
+
description: "Create new environments (dev, tst, pro, miso)"
|
|
76
|
+
|
|
77
|
+
- name: "environments:read"
|
|
78
|
+
roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin", "aifabrix-developer", "aifabrix-observer"]
|
|
79
|
+
description: "View environments and their status"
|
|
80
|
+
|
|
81
|
+
- name: "environments:update"
|
|
82
|
+
roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin"]
|
|
83
|
+
description: "Update environment configuration"
|
|
84
|
+
|
|
85
|
+
- name: "environments:delete"
|
|
86
|
+
roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin"]
|
|
87
|
+
description: "Delete environments"
|
|
88
|
+
|
|
89
|
+
# Environment Applications
|
|
90
|
+
- name: "environments_applications:create"
|
|
91
|
+
roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer"]
|
|
92
|
+
description: "Create applications within environments"
|
|
93
|
+
|
|
94
|
+
- name: "environments_applications:read"
|
|
95
|
+
roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer", "aifabrix-observer"]
|
|
96
|
+
description: "View applications within environments"
|
|
97
|
+
|
|
98
|
+
- name: "environments_applications:update"
|
|
99
|
+
roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer"]
|
|
100
|
+
description: "Update applications within environments"
|
|
101
|
+
|
|
102
|
+
- name: "environments_applications:delete"
|
|
103
|
+
roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin"]
|
|
104
|
+
description: "Remove applications from environments"
|
|
105
|
+
|
|
106
|
+
# Pipeline & Deployment
|
|
107
|
+
- name: "applications:deploy"
|
|
108
|
+
roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer"]
|
|
109
|
+
description: "Deploy applications to environments"
|
|
110
|
+
|
|
111
|
+
- name: "deployments:read"
|
|
112
|
+
roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer", "aifabrix-observer"]
|
|
113
|
+
description: "View deployment history and status"
|
|
114
|
+
|
|
115
|
+
# Controller Operations
|
|
116
|
+
- name: "controller:admin"
|
|
117
|
+
roles: ["aifabrix-platform-admin"]
|
|
118
|
+
description: "Full administrative access to controller operations"
|
|
119
|
+
|
|
120
|
+
- name: "controller:deploy"
|
|
121
|
+
roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin"]
|
|
122
|
+
description: "Deploy infrastructure and manage environments"
|
|
123
|
+
|
|
124
|
+
- name: "controller:monitor"
|
|
125
|
+
roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-observer"]
|
|
126
|
+
description: "Monitor system health and view logs"
|
|
127
|
+
|
|
128
|
+
- name: "controller:compliance"
|
|
129
|
+
roles: ["aifabrix-platform-admin", "aifabrix-compliance-admin"]
|
|
130
|
+
description: "Access compliance reports and audit logs"
|
|
131
|
+
|
|
132
|
+
# Authentication & Authorization
|
|
133
|
+
- name: "auth:read"
|
|
134
|
+
roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-developer", "aifabrix-observer"]
|
|
135
|
+
description: "View user roles and permissions"
|
|
136
|
+
|
|
137
|
+
# Logs
|
|
138
|
+
- name: "logs:read"
|
|
139
|
+
roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-compliance-admin", "aifabrix-observer"]
|
|
140
|
+
description: "View application and audit logs"
|
|
141
|
+
|
|
142
|
+
- name: "logs:write"
|
|
143
|
+
roles: ["aifabrix-platform-admin", "aifabrix-developer"]
|
|
144
|
+
description: "Write audit and error logs"
|
|
145
|
+
|
|
146
|
+
# Admin Operations
|
|
147
|
+
- name: "admin.sync"
|
|
148
|
+
roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin"]
|
|
149
|
+
description: "Full system synchronization operations"
|
|
150
|
+
|
|
151
|
+
- name: "admin.keycloak"
|
|
152
|
+
roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
|
|
153
|
+
description: "Keycloak administration and configuration"
|
|
154
|
+
|
|
155
|
+
# Cache Management
|
|
156
|
+
- name: "cache:read"
|
|
157
|
+
roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-observer"]
|
|
158
|
+
description: "View cache statistics and performance metrics"
|
|
159
|
+
|
|
160
|
+
- name: "cache:admin"
|
|
161
|
+
roles: ["aifabrix-platform-admin"]
|
|
162
|
+
description: "Manage cache (clear, invalidate patterns)"
|
|
163
|
+
|
|
164
|
+
# Dashboard
|
|
165
|
+
- name: "dashboard:read"
|
|
166
|
+
roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer", "aifabrix-observer"]
|
|
167
|
+
description: "View dashboard summaries and aggregates"
|
|
168
|
+
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
# Application Metadata
|
|
2
|
+
app:
|
|
3
|
+
key: miso
|
|
4
|
+
displayName: "Miso Controller"
|
|
5
|
+
description: "AI Fabrix Miso Controller - Backend API and orchestration service"
|
|
6
|
+
type: webapp
|
|
7
|
+
|
|
8
|
+
# Image Configuration
|
|
9
|
+
image:
|
|
10
|
+
name: aifabrix/miso-controller
|
|
11
|
+
registry: devflowiseacr.azurecr.io
|
|
12
|
+
registryMode: acr
|
|
13
|
+
|
|
14
|
+
# Port Configuration
|
|
15
|
+
port: 3000
|
|
16
|
+
|
|
17
|
+
# Azure Requirements
|
|
18
|
+
requires:
|
|
19
|
+
database: true
|
|
20
|
+
databases:
|
|
21
|
+
- name: miso
|
|
22
|
+
- name: miso-logs
|
|
23
|
+
redis: true
|
|
24
|
+
storage: true
|
|
25
|
+
|
|
26
|
+
# Health Check
|
|
27
|
+
healthCheck:
|
|
28
|
+
path: /health
|
|
29
|
+
interval: 30
|
|
30
|
+
probePath: /health
|
|
31
|
+
probeRequestType: GET
|
|
32
|
+
probeProtocol: Https
|
|
33
|
+
probeIntervalInSeconds: 120
|
|
34
|
+
|
|
35
|
+
# Authentication
|
|
36
|
+
authentication:
|
|
37
|
+
type: keycloak
|
|
38
|
+
enableSSO: true
|
|
39
|
+
requiredRoles: ["aifabrix-user"]
|
|
40
|
+
endpoints:
|
|
41
|
+
local: "http://localhost:3000/auth/callback"
|
|
42
|
+
|
|
43
|
+
# Build Configuration
|
|
44
|
+
build:
|
|
45
|
+
context: .. # Docker build context (relative to builder/)
|
|
46
|
+
dockerfile: builder/Dockerfile # Dockerfile name (empty = use template)
|
|
47
|
+
envOutputPath: ../packages/miso-controller/.env # Copy .env to repo root for local dev
|
|
48
|
+
localPort: 3010 # Port for local development (different from Docker port)
|
|
49
|
+
language: typescript # Runtime language for template selection
|
|
50
|
+
secrets: # Path to secrets file (optional)
|
|
51
|
+
|
|
52
|
+
# Docker Compose
|
|
53
|
+
compose:
|
|
54
|
+
file: docker-compose.yaml
|
|
55
|
+
service: miso-controller
|
|
56
|
+
|
|
@@ -33,37 +33,16 @@ jobs:
|
|
|
33
33
|
exit 1
|
|
34
34
|
fi
|
|
35
35
|
|
|
36
|
-
{{#
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
runs-on: ubuntu-latest
|
|
40
|
-
needs: validate
|
|
41
|
-
steps:
|
|
42
|
-
- uses: actions/checkout@v4
|
|
43
|
-
|
|
44
|
-
- name: Setup Node.js
|
|
45
|
-
uses: actions/setup-node@v4
|
|
46
|
-
with:
|
|
47
|
-
node-version: '20'
|
|
48
|
-
registry-url: 'https://registry.npmjs.org'
|
|
49
|
-
cache: 'npm'
|
|
50
|
-
|
|
51
|
-
- name: Install dependencies
|
|
52
|
-
run: npm ci
|
|
53
|
-
|
|
54
|
-
- name: Build package
|
|
55
|
-
run: npm run build
|
|
56
|
-
|
|
57
|
-
- name: Publish to NPM
|
|
58
|
-
run: npm publish --access public
|
|
59
|
-
env:
|
|
60
|
-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
|
36
|
+
{{#each githubSteps}}
|
|
37
|
+
{{#if (lookup ../stepContent this)}}
|
|
38
|
+
{{{lookup ../stepContent this}}}
|
|
61
39
|
{{/if}}
|
|
40
|
+
{{/each}}
|
|
62
41
|
|
|
63
42
|
create-release:
|
|
64
43
|
name: Create GitHub Release
|
|
65
44
|
runs-on: ubuntu-latest
|
|
66
|
-
needs: {{#if
|
|
45
|
+
needs: {{#if hasNpmStep}}publish-npm{{else}}validate{{/if}}
|
|
67
46
|
steps:
|
|
68
47
|
- uses: actions/checkout@v4
|
|
69
48
|
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
publish-npm:
|
|
2
|
+
name: Publish to NPM
|
|
3
|
+
runs-on: ubuntu-latest
|
|
4
|
+
needs: validate
|
|
5
|
+
steps:
|
|
6
|
+
- uses: actions/checkout@v4
|
|
7
|
+
|
|
8
|
+
- name: Setup Node.js
|
|
9
|
+
uses: actions/setup-node@v4
|
|
10
|
+
with:
|
|
11
|
+
node-version: '20'
|
|
12
|
+
registry-url: 'https://registry.npmjs.org'
|
|
13
|
+
cache: 'npm'
|
|
14
|
+
|
|
15
|
+
- name: Install dependencies
|
|
16
|
+
run: npm ci
|
|
17
|
+
|
|
18
|
+
- name: Build package
|
|
19
|
+
run: npm run build
|
|
20
|
+
|
|
21
|
+
- name: Publish to NPM
|
|
22
|
+
run: npm publish --access public
|
|
23
|
+
env:
|
|
24
|
+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
|
@@ -20,7 +20,7 @@ services:
|
|
|
20
20
|
- postgres_data:/var/lib/postgresql/data
|
|
21
21
|
- ./init-scripts:/docker-entrypoint-initdb.d
|
|
22
22
|
networks:
|
|
23
|
-
-
|
|
23
|
+
- infra_aifabrix-network
|
|
24
24
|
healthcheck:
|
|
25
25
|
test: ["CMD-SHELL", "pg_isready -U pgadmin -d postgres"]
|
|
26
26
|
interval: 10s
|
|
@@ -38,7 +38,7 @@ services:
|
|
|
38
38
|
volumes:
|
|
39
39
|
- redis_data:/data
|
|
40
40
|
networks:
|
|
41
|
-
-
|
|
41
|
+
- infra_aifabrix-network
|
|
42
42
|
healthcheck:
|
|
43
43
|
test: ["CMD", "redis-cli", "ping"]
|
|
44
44
|
interval: 10s
|
|
@@ -61,7 +61,7 @@ services:
|
|
|
61
61
|
postgres:
|
|
62
62
|
condition: service_healthy
|
|
63
63
|
networks:
|
|
64
|
-
-
|
|
64
|
+
- infra_aifabrix-network
|
|
65
65
|
|
|
66
66
|
# Optional: Redis Commander for Redis management
|
|
67
67
|
redis-commander:
|
|
@@ -79,7 +79,7 @@ services:
|
|
|
79
79
|
redis:
|
|
80
80
|
condition: service_healthy
|
|
81
81
|
networks:
|
|
82
|
-
-
|
|
82
|
+
- infra_aifabrix-network
|
|
83
83
|
|
|
84
84
|
volumes:
|
|
85
85
|
postgres_data:
|
|
@@ -88,6 +88,6 @@ volumes:
|
|
|
88
88
|
driver: local
|
|
89
89
|
|
|
90
90
|
networks:
|
|
91
|
-
|
|
91
|
+
infra_aifabrix-network:
|
|
92
92
|
driver: bridge
|
|
93
|
-
name:
|
|
93
|
+
name: infra_aifabrix-network
|