3af105bccd
Replaces the client-side PIN login with real authentication against Azure Entra ID via PocketBase's built-in OAuth2 (OIDC) flow. Every Azure user is auto-provisioned as a team_member on first login. - pb_migrations: team_members becomes a PocketBase auth collection (OIDC provider configured from env); all collections require @request.auth.id - pb_hooks: provisioning of role (ENTRA_ADMIN_EMAILS allow-list) and enrollment_status, with admin-role re-sync on every login - frontend: "Sign in with Microsoft" login, pb.authStore-based session, TeamManager manages roster/roles (no PIN/manual create) - infra: Entra env wiring + pb_hooks mount for dev (Labs) and prod - src/lib/azureAuth.js + tests for the canonical role/allow-list logic - docs/auth-spec.md Knowledge base, generated tests and micro-learnings are left untouched. Existing PIN users are dropped (no migration required, per sign-off). Closes #16 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
75 lines
2.1 KiB
YAML
75 lines
2.1 KiB
YAML
- name: Deploy Learning Platform with Ansible
|
|
hosts: all
|
|
become: yes
|
|
gather_facts: yes
|
|
vars:
|
|
ansible_ssh_common_args: '-o StrictHostKeyChecking=no'
|
|
|
|
tasks:
|
|
- name: Set destination directory
|
|
ansible.builtin.set_fact:
|
|
dest_dir: "/opt/learning-platform"
|
|
|
|
- name: Ensure dependencies are installed
|
|
ansible.builtin.package:
|
|
name:
|
|
- docker-ce
|
|
state: present
|
|
ignore_errors: yes
|
|
register: docker_valid
|
|
|
|
- name: Include geerlingguy.docker role conditionally
|
|
include_role:
|
|
name: geerlingguy.docker
|
|
when: docker_valid is failed
|
|
|
|
- name: Ensure target directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ dest_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Copy compose.yml to destination
|
|
ansible.builtin.copy:
|
|
src: compose.yml
|
|
dest: "{{ dest_dir }}/compose.yml"
|
|
|
|
- name: Copy pb_migrations to destination
|
|
ansible.builtin.copy:
|
|
src: ../../../pb_migrations
|
|
dest: "{{ dest_dir }}/"
|
|
mode: "0755"
|
|
|
|
- name: Copy pb_hooks to destination
|
|
ansible.builtin.copy:
|
|
src: ../../../pb_hooks
|
|
dest: "{{ dest_dir }}/"
|
|
mode: "0755"
|
|
|
|
- name: Create .env file for secrets
|
|
ansible.builtin.copy:
|
|
dest: "{{ dest_dir }}/.env"
|
|
content: |
|
|
ANTHROPIC_API_KEY={{ anthropic_api_key | default('') }}
|
|
ENTRA_TENANT_ID={{ entra_tenant_id | default('') }}
|
|
ENTRA_CLIENT_ID={{ entra_client_id | default('') }}
|
|
ENTRA_CLIENT_SECRET={{ entra_client_secret | default('') }}
|
|
ENTRA_ADMIN_EMAILS={{ entra_admin_emails | default('') }}
|
|
mode: '0600'
|
|
|
|
- name: Pull latest image
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ dest_dir }}"
|
|
state: present
|
|
files: compose.yml
|
|
pull: always
|
|
|
|
- name: Start services with Docker Compose
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ dest_dir }}"
|
|
state: present
|
|
files: compose.yml
|
|
recreate: always
|