eho/register-referentie
1
0
Fork 0
Code Issues 16 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

arch(infra): ADR-0007 + runbooks for the OZ→NRC notification wiring (refs #56)
All checks were successful
CI / lint (pull_request) Successful in 52s
Details
CI / build (pull_request) Successful in 40s
Details
CI / unit (pull_request) Successful in 49s
Details
CI / mutation (pull_request) Successful in 1m35s
Details
CI / integration (pull_request) Successful in 3m24s
Details
CI / notifications (pull_request) Successful in 3m14s
Details
CI / compose-smoke (pull_request) Successful in 4m2s
Details

Browse Source 
Records the wiring decision (AC-delegated auth, required celery-beat) and the two
non-obvious gotchas: single-label hosts aren't URL-valid (reach services by IP) and
abonnement callbacks must enforce auth. Documents the new notifications CI job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Niek Otten
2026-06-29 14:29:12 +02:00
parent 4d07285dcd
commit a256db1a23
4 changed files with 105 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
docs/runbooks/gitea-actions-gotchas.md
View File

@@ -152,8 +152,30 @@ service by name (`http://openzaak:8000`). For a test/seed that needs the repo's
code, deliver it via a **built image** (not a bind mount — §1), then
`docker run --network <stack>_cg …`.
**Applied** — `make integration` (the ACL ↔ real-OpenZaak test, ADR-0006) does
exactly this: `infra/run-integration.sh` runs the seed and the test as containers on
the OpenZaak network and reaches it by **container IP** (a single-label service name
like `openzaak` isn't URL-valid — OpenZaak echoes the request host into the URLs it
returns and then rejects them with Django's `URLValidator`; an IPv4 literal passes).
**Applied** — `make integration` (ADR-0006) and `make verify-notifications` (ADR-0007)
do exactly this: they run the seed/test/driver as containers on the stack network and
reach services by **container IP** (see §6).
---
## 6. OpenZaak / NRC reject single-label hosts in URLs
**Symptom** — talking to OpenZaak or NRC by compose **service name** fails where a URL
is validated: catalogus/zaaktype filters, the zaak `zaaktype` URL, and abonnement
`callbackUrl` come back `400 "Voer een geldige URL in."` — even though the host
resolves and is reachable.
**Why** — these apps validate URLs with Django's `URLValidator`, which rejects a
**single-label** host like `openzaak` or `nrc-web` (no dot, and not `localhost`).
`localhost` passes (so it's invisible in host-port-based local runs); in-network the
reality is a service name or an IPv4 literal — and only the IP passes.
**Fix** — in-network tooling reaches OpenZaak/NRC by **container IP**
(`docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'`), not
service name; the notif verify harness also registers the sink callback by IP.
(`infra/run-integration.sh`, `infra/verify-notifications.sh`.)
**Related — abonnement callbacks must enforce auth.** NRC probes a callback when an
abonnement is registered and refuses it (`no-auth-on-callback-url`) unless it returns
**401** without the configured `Authorization`. The verify sink
(`infra/notification-sink.py`) enforces a bearer token for exactly this reason.