notandClaude Opus 4.8
734dfb21dd
The ACL now discovers those URLs itself (S-27), so no stack captures/injects them: docker-compose.yml/.local.yml carry ZaaktypeIdentificatie/InformatieobjecttypeOmschrijving instead of placeholder URLs, run-domain-check.sh + local-seed stop emitting the URLs, and the local acl.env shrinks to the OpenZaak base URL. That base URL injection stays: OpenZaak rejects a single-label host on zaak-create (confirmed), so the ACL is still pointed at the container IP. ADR-0021 + demo-script note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
34 lines
1.8 KiB
Bash
Executable File
34 lines
1.8 KiB
Bash
Executable File
#!/bin/sh
|
|
# Local-stack bootstrap (S-B04, #110, ADR-0020) — the "seed zaaktype + wire the ACL" step.
|
|
#
|
|
# Runs as the `local-seed` init container of infra/docker-compose.local.yml. It seeds + publishes
|
|
# the BIG zaaktype (and the Diploma informatieobjecttype) into OpenZaak, then writes the resulting
|
|
# **server-assigned** URLs into /out/acl.env, which the ACL entrypoint sources before starting. This
|
|
# is the local-stack equivalent of what infra/run-domain-check.sh does for CI: the zaaktype UUID is
|
|
# assigned by OpenZaak at creation, so it can't be a static value in the compose file.
|
|
#
|
|
# Why the container IP and not the `openzaak` service name: OpenZaak validates URL query params
|
|
# (e.g. ?catalogus=) with Django's URLValidator, which rejects a single-label host like `openzaak`.
|
|
# Seeding against the resolved IP keeps the seeded URLs valid AND host-consistent with the ACL, which
|
|
# we point at the same IP below. See docs/runbooks/gitea-actions-gotchas.md and ADR-0020.
|
|
set -eu
|
|
|
|
oz_ip="$(python3 -c "import socket;print(socket.gethostbyname('openzaak'))")"
|
|
OZ_BASE="http://${oz_ip}:8000"
|
|
export OZ_BASE OZ_PUBLISH=1
|
|
|
|
echo ">> seeding + publishing the BIG zaaktype at ${OZ_BASE} (idempotent)"
|
|
out="$(python3 /work/seed_catalogus.py)"
|
|
echo "$out"
|
|
|
|
# Sanity-check that the zaaktype was actually published (the ACL discovers it by identificatie, S-27).
|
|
printf '%s\n' "$out" | grep -q '^ZAAKTYPE_URL ' || { echo "ERROR: seed did not publish the zaaktype" >&2; exit 1; }
|
|
|
|
# The ACL resolves the zaaktype/informatieobjecttype URLs itself (S-27, ADR-0021); the only value it
|
|
# still needs injected is the OpenZaak base URL at a URL-valid host (the container IP), because OpenZaak
|
|
# rejects a single-label host on zaak-create. The ACL entrypoint sources this.
|
|
cat > /out/acl.env <<EOF
|
|
Acl__OpenZaak__BaseUrl=${OZ_BASE}/
|
|
EOF
|
|
echo ">> wrote /out/acl.env (base=${OZ_BASE}/)"
|