116 lines
6.5 KiB
Markdown
116 lines
6.5 KiB
Markdown
# Company environment
|
|
|
|
This capability owns the company-root tools, human workbench environment and
|
|
persistent read-only company mounts. Garden packaging and company certificates
|
|
remain in `../yookr-dev/`. Requests, queries, analysis, `uv.lock`, content and
|
|
runtime state stay in `~/yookr/workbench`.
|
|
|
|
Home Manager installs `devenv.nix` and `devenv.yaml` in `~/yookr/workbench`
|
|
(human credentials), selecting the system's exact nixpkgs store path. The work
|
|
profile also installs the tools for use at the company root without activation. The devenv CLI
|
|
uses its own upstream dependency closure; this avoids rebuilding its dependencies
|
|
against an unsupported pin. Its version is locked by the repository flake.
|
|
|
|
## Activation and trust
|
|
|
|
After reviewing and activating the configuration on each workstation:
|
|
|
|
1. Remove the obsolete `~/yookr/.envrc` and `~/yookr/workbench/.envrc`. Direnv is
|
|
no longer installed or hooked. Product/personal `.envrc` files remain yours to
|
|
migrate; this pass does not convert them.
|
|
2. Run `devenv allow` in `~/yookr/workbench` only. Open a new terminal
|
|
for the native Zsh hook. Reload/file watching uses upstream defaults.
|
|
3. `devenv.lock` and `.devenv/` are local generated state, not new configuration
|
|
owners. Do not commit them into the Nix repository. Retain product locks.
|
|
4. The human workbench attempts company, live and test resolution independently.
|
|
`workbench-reload` retries; `workbench-reload --tools-only` clears the variables
|
|
owned by this loader. Existing processes/editors keep their original environment.
|
|
|
|
For a clean, credential-free check use the flake's tools-only `#workbench` shell
|
|
from a clean parent environment. For native devenv without credential loading,
|
|
set `WORKBENCH_TOOLS_ONLY=1` before `devenv shell`. Neither method removes arbitrary
|
|
credentials already inherited from its parent; they are not isolation mechanisms.
|
|
|
|
The company root intentionally has no generated devenv environment pending review:
|
|
upstream's hook does nothing while another devenv shell is active, so an ancestor
|
|
shell would prevent automatic workbench entry and interfere with project environments.
|
|
The recommendation is installed tools at the company root, native activation at the
|
|
workbench, and product-owned environments below `projects/`.
|
|
|
|
## Credential provisioning (user-run only)
|
|
|
|
The encrypted company document belongs at `modules/secrets/company.yaml` in this
|
|
repository. It is deliberately absent until you migrate it. Reuse the existing
|
|
machine age identities; never copy private keys into Git. On each workstation,
|
|
obtain its public recipient with `age-keygen -y /var/lib/sops/keys.txt`.
|
|
|
|
On the machine holding the old credentials, run from this repository:
|
|
|
|
```console
|
|
SOPS_AGE_KEY_FILE="$HOME/.config/sops/age/keys.txt" python3 modules/capabilities/workbench/migrate-credentials.py \
|
|
"$HOME/.config/yookr/credentials.yaml" modules/secrets/company.yaml \
|
|
--age 'POLARIS_PUBLIC_AGE_RECIPIENT,ZENITH_PUBLIC_AGE_RECIPIENT'
|
|
```
|
|
|
|
The helper decrypts only in memory, preserves the old file, and refuses to overwrite
|
|
an existing destination. The new document contains root-level company login and
|
|
live database URLs for SecretSpec, plus the existing `leafcloud` map for mounts.
|
|
MySQL certificate verification behavior is preserved. Test credentials are not
|
|
copied into the new document. Review the encrypted result before a local commit;
|
|
pushing remains a separate decision. Other machines receive ciphertext through the
|
|
existing repository. Edit it with `sops edit modules/secrets/company.yaml` using the
|
|
machine's normal `SOPS_AGE_KEY_FILE=/var/lib/sops/keys.txt`.
|
|
|
|
### Test cluster: mapping and login still pending
|
|
|
|
No cluster query is needed to build this repository. Before enabling test loading,
|
|
settle the explicit test context and existing application Secret/namespace/key
|
|
mappings. The loader expects a `~/.config/workbench/test-secrets.toml` manifest with
|
|
profile `test`, using only explicit `k8s+secret://SECRET@NAMESPACE` providers and
|
|
`ref.item` for existing keys. Required exports are:
|
|
|
|
- `YOOKR_MYSQL_TEST_DATABASE_URL`, `YOOKR_MONGODB_TEST_DATABASE_URL`
|
|
- `RABBITMQADMIN_USERNAME`, `RABBITMQADMIN_PASSWORD`
|
|
|
|
If applications store URL components separately, the manifest/composition must be
|
|
adapted after confirming their keys; do not invent field names or change URL escaping.
|
|
This manifest is a provisioning boundary pending review, not a second global secret store.
|
|
|
|
Test loading also requires an explicitly prepared, noninteractive kubeconfig at
|
|
`$XDG_RUNTIME_DIR/workbench/test-kubeconfig`. No generic login helper is provided:
|
|
the actual context and exec plugin must be inspected first, then its native or
|
|
provider-specific cached login flow selected. Do not reimplement Kubernetes' exec
|
|
credential protocol for an unknown plugin. Until both runtime files exist, test
|
|
reports unavailable. Shell entry never invokes authentication or opens a login popup.
|
|
|
|
SecretSpec exports are captured in memory with stdin closed and a timeout. Errors
|
|
report only the unavailable source, not provider output or secret values. Sources
|
|
load independently; unavailable sources clear their old variables. Test never falls
|
|
back to SOPS, and live never depends on Kubernetes. Native devenv's all-at-once secret
|
|
resolution is intentionally not used: it would couple their failure behavior.
|
|
|
|
## Mounts
|
|
|
|
`company-obs.service` and `company-sharepoint.service` are user services on both
|
|
workstations. Mounts live at `~/yookr/workbench/{obs,sharepoint}`. They are read-only,
|
|
use `--vfs-cache-mode off`, and retry failures every minute. No background content
|
|
mirror remains. The existing local SharePoint mirror is preserved, not deleted.
|
|
Small memory buffers and filesystem metadata are still used.
|
|
|
|
OBS uses the company's encrypted `leafcloud` map and machine age key. SharePoint
|
|
uses the existing native rclone remotes `company-sharepoint` and
|
|
`company-sharepoint-projecten` in `~/.config/rclone/rclone.conf`; configure/login to
|
|
these on each workstation with rclone. Tokens remain application-owned outside Git.
|
|
Before first activation, unmount any old workbench-entry OBS mount. Do not empty or
|
|
replace nonempty mount directories: move any authored content deliberately first.
|
|
|
|
```console
|
|
systemctl --user restart company-obs company-sharepoint
|
|
systemctl --user status company-obs company-sharepoint
|
|
```
|
|
|
|
Do not invoke the old workspace `just mount-obs` helper once systemd owns the mount.
|
|
The old helper/recipes can be removed after the new mounts are accepted in use.
|
|
Shell exit does not unmount company files. All processes running as your user can
|
|
read the mounts; these services do not isolate agents.
|