deploy: bring provisioning + notification to prod; scaffold SMS seal service - #565
Merged
Merged
Conversation
Two of the four prod-disabled backend services are now safe to enable; this brings them online. provisioning-service: flip enabled: true. Its only hard secretKeyRef (INTERNAL_PROVISION_SECRET) is already sealed into fuzefront-secrets, and it is a thin Kafka->HTTP bridge with no DB, migrations, or ingress, so no new precondition remains. notification-service: - Give it a dedicated fuzefront_notification database so its knex migration ledger cannot collide with the backend's knex_migrations in fuzefront_platform (the chat-service #499 crash-loop, pre-empted). The db-bootstrap Job creates + grants the DB when the service is enabled; the Deployment and the db-migrate Job both target notificationService.dbName. - Set migrate.enabled so the schema is created before the service starts (it does not self-migrate); idempotent via knex. - Enable it. DB_PASSWORD and JWT_SECRET are already sealed; NOTIFICATION_INTERNAL_TOKEN is optional (if-guarded) so leaving it unset only disables the /internal/publish fan-out. - Bump the Dockerfile to node:24-alpine, meeting the mandated toolchain floor (it was still on node:18-alpine). sms-service and payment-service remain disabled: they are blocked on owner-only preconditions (sealing 4 Twilio/SMS keys; and a missing release.yml image build) documented in values-prod.yaml. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hc8XVgyLJkyeMsRysJYCqP
Contributor
Automated code review (gate-code-review)Credit balance is too low Report-only — this check never blocks merge. |
Scaffolds the dispatching service that seals the four keys sms-service / phone-2FA needs (TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN, TWILIO_VERIFY_SERVICE_SID, SMS_AUTH_SECRET) into the existing fuzefront-secrets SealedSecret, mirroring seal-consumer-secret.yml. The three Twilio values are read from GitHub repo secrets the owner sets, so plaintext vendor credentials never appear in chat, a PR diff, or a build log; SMS_AUTH_SECRET is minted in-workflow (it is an internal shared token, not a vendor value). Fails loudly if any Twilio secret is unset, so it can never seal a placeholder that would CrashLoop the pod. Sealing is inert until go-live: it only adds keys to the Secret while smsService.enabled stays false. Enabling SMS remains a separate, deploy-window GitOps commit. Points SEAL_PROD_SECRETS.md at the workflow. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hc8XVgyLJkyeMsRysJYCqP
izzywdev
changed the title
Contributor
Automated code review (gate-code-review)Credit balance is too low Report-only — this check never blocks merge. |
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📋 Description
You had four backend services sitting
enabled: falsein prod. I checked each against what actually gates it, and two of the four turned out to already have their preconditions met — so this PR bringsprovisioning-serviceandnotification-serviceonline, and scaffolds the dispatching service that unblockssms-service.payment-serviceremains blocked (see Future Work).🔄 Type of Change
🔧 Implementation Details
provisioning-service — clean enable
enabled: true. Its only hardsecretKeyRef,INTERNAL_PROVISION_SECRET, is already sealed infuzefront-secrets. Thin Kafka→HTTP bridge: no DB, no migrations, no ingress. Image built + tag-bumped byrelease.yml.notification-service — enable + pre-empt the chat-service #499 collision
fuzefront_notificationDB so itsknex_migrationsledger can't collide with the backend's infuzefront_platform(the chat prod: chat-service migrate crash-loops — running against shared fuzefront_platform DB (fuzefront app Degraded) #499 crash-loop). Both the Deployment anddb-migrateJob targetnotificationService.dbName;db-bootstrap(weight-5) creates + grants it before migrate (-3).migrate.enabled: true— nothing else creates the tables and it doesn't self-migrate. Idempotent (knex).DB_PASSWORD+JWT_SECRET;NOTIFICATION_INTERNAL_TOKENstays unset (if-guarded → only disables/internal/publish).node:18-alpine→node:24-alpine(toolchain floor).sms-service — scaffold the sealing dispatch service
.github/workflows/seal-sms-secrets.yml(workflow_dispatch), mirroringseal-consumer-secret.yml. It reads the three Twilio values from GitHub repo secrets the owner sets and mintsSMS_AUTH_SECRETitself, sealing all four intofuzefront-secrets(merge-in). Vendor plaintext never touches chat, a PR diff, or a build log — the governance "agents scaffold the wiring, never hold the values" split. Fails loudly if any Twilio secret is unset, so it can't seal a placeholder.SEAL_PROD_SECRETS.mdpoints at it.sms-servicestaysenabled: falsehere on purpose. Sealing is inert (keys added, no pod renders). Go-live is a separate deploy-window commit after the seal is confirmed.🧪 Testing
release.ymlmatrix + bump anchors,secretKeyRefoptionality, hook ordering; edited YAML + new workflow YAML parse.helm template/docker buildnot possible in this sandbox (no docker daemon;get.helm.shproxy-blocked). Pre-merge net:helm-validate(render + kubeconform) and therelease.ymlimage build.📝 Deployment Notes
fuzefront_notificationvia the existing bootstrap Job — no manual step.fuzefront-notification-db-migratesucceeds.To bring sms-service live (owner, after this merges)
TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_VERIFY_SERVICE_SID.dry_run=truefirst to preview).smsService.enabled: true(I can send that PR).Future Work — payment-service (still blocked)
Not in the
release.ymlbuild matrix (tag""→InvalidImageName) and it's a scaffold, not the live money path (billing is). Go-live = add its release build + seal Stripe keys + a product call. Happy to wire the build as a follow-up.