From d289d4d9f69165940419e80266cafb9ba6919bf3 Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Fri, 14 Aug 2026 00:20:38 +0000 Subject: [PATCH 1/6] chore(release): 20.3.1 [skip ci] ## [20.3.1](https://github.com/maevsi/stack/compare/20.3.0...20.3.1) (2026-08-14) --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index bb22094f..33e9bbbf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,5 @@ +## [20.3.1](https://github.com/maevsi/stack/compare/20.3.0...20.3.1) (2026-08-14) + ## [20.3.0](https://github.com/maevsi/stack/compare/20.2.2...20.3.0) (2026-08-13) ## [20.2.2](https://github.com/maevsi/stack/compare/20.2.1...20.2.2) (2026-08-13) From 71d340589e51992c6dbb1bef3fa3f38947ebdfd1 Mon Sep 17 00:00:00 2001 From: Jonas Thelemann Date: Fri, 14 Aug 2026 13:46:42 +0200 Subject: [PATCH 2/6] refactor(postgraphile): derive JWT public key from private key (#295) --- Dockerfile.md | 2 +- artifacts/.gitignore | 1 + dargstack.yaml | 2 +- src/development/postgraphile/compose.yaml | 12 +++++++++++- .../postgraphile/configurations/jwtES256.key.pub | 4 ---- src/development/reccoom/compose.yaml | 4 +++- src/development/vibetype/compose.yaml | 4 +++- .../postgraphile/configurations/jwtES256.key.pub | 4 ---- .../postgraphile/configurations/jwtRS256.key.pub | 14 -------------- 9 files changed, 20 insertions(+), 27 deletions(-) delete mode 100644 src/development/postgraphile/configurations/jwtES256.key.pub delete mode 100644 src/production/postgraphile/configurations/jwtES256.key.pub delete mode 100644 src/production/postgraphile/configurations/jwtRS256.key.pub diff --git a/Dockerfile.md b/Dockerfile.md index b026300d..3db88ff2 100644 --- a/Dockerfile.md +++ b/Dockerfile.md @@ -1,3 +1,3 @@ # -FROM ghcr.io/dargstack/dargstack:4.12.3 +FROM ghcr.io/dargstack/dargstack:4.13.0 # diff --git a/artifacts/.gitignore b/artifacts/.gitignore index 87bd3818..5e281369 100644 --- a/artifacts/.gitignore +++ b/artifacts/.gitignore @@ -1,4 +1,5 @@ audit-log/ certificates/ +configs/ secrets/ .env.merged \ No newline at end of file diff --git a/dargstack.yaml b/dargstack.yaml index c6ec78ec..1d1d23b4 100644 --- a/dargstack.yaml +++ b/dargstack.yaml @@ -14,7 +14,7 @@ environment: # tag: latest # optional, defaults to "latest" metadata: - compatibility: ">=4.9.2-0 <5.0.0" + compatibility: ">=4.13.0-0 <5.0.0" name: "vibetype" source: name: "maevsi" diff --git a/src/development/postgraphile/compose.yaml b/src/development/postgraphile/compose.yaml index fd23c008..c19a62c2 100644 --- a/src/development/postgraphile/compose.yaml +++ b/src/development/postgraphile/compose.yaml @@ -11,6 +11,10 @@ secrets: postgraphile-sentry-dsn: # The GraphQL API's Sentry DSN. file: ~~/artifacts/secrets/postgraphile-sentry-dsn.secret +configs: + postgraphile-jwt-public-key: + # The GraphQL API's JWT public key, derived from postgraphile-jwt-secret. + file: ~~/artifacts/configs/postgraphile-jwt-public-key.pub services: postgraphile: # You can access the GraphQL API for the PostgreSQL database at [postgraphile.app.localhost](https://postgraphile.app.localhost/). @@ -49,9 +53,11 @@ services: target: /run/environment-variables/SENTRY_DSN - source: vibetype-turnstile-key target: /run/environment-variables/TURNSTILE_SECRET_KEY + configs: + - source: postgraphile-jwt-public-key + target: /run/environment-variables/POSTGRAPHILE_JWT_PUBLIC_KEY volumes: - ~~~/postgraphile/:/srv/app/ # dargstack:dev-only - - ./configurations/jwtES256.key.pub:/run/environment-variables/POSTGRAPHILE_JWT_PUBLIC_KEY:ro - pnpm-data:/srv/.pnpm-store/ # dargstack:dev-only - postgraphile-data:/srv/app/node_modules # dargstack:dev-only volumes: @@ -59,6 +65,10 @@ volumes: # The GraphQL API's data. {} x-dargstack: + configs: + postgraphile-jwt-public-key: + type: public_key + source: postgraphile-jwt-secret secrets: postgraphile-connection: type: template diff --git a/src/development/postgraphile/configurations/jwtES256.key.pub b/src/development/postgraphile/configurations/jwtES256.key.pub deleted file mode 100644 index e9b2a5e8..00000000 --- a/src/development/postgraphile/configurations/jwtES256.key.pub +++ /dev/null @@ -1,4 +0,0 @@ ------BEGIN PUBLIC KEY----- -MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgIYyEMm+hZzEnXhJLGUx9lwr3cKs -W2uJ+zLvei380CrUEPARnWQNR/V0usS0EFypTQllniuCpbLG6un87kxh6w== ------END PUBLIC KEY----- diff --git a/src/development/reccoom/compose.yaml b/src/development/reccoom/compose.yaml index c5996ec4..75bfbaa2 100644 --- a/src/development/reccoom/compose.yaml +++ b/src/development/reccoom/compose.yaml @@ -58,9 +58,11 @@ services: target: /run/environment-variables/SENTRY_DSN - source: reccoom-service-api-key target: /run/environment-variables/SERVICE_API_KEY + configs: + - source: postgraphile-jwt-public-key + target: /run/configurations/jwtES256.key.pub volumes: - ~~~/reccoom/:/srv/app/ # dargstack:dev-only - - ../postgraphile/configurations/jwtES256.key.pub:/run/configurations/jwtES256.key.pub:ro - reccoom-data:/home/python/.cache/ # dargstack:dev-only reccoom-consumer: # You can track the recommender's event streaming consumer using `redpanda-console`. diff --git a/src/development/vibetype/compose.yaml b/src/development/vibetype/compose.yaml index 849adea5..ad9ab920 100644 --- a/src/development/vibetype/compose.yaml +++ b/src/development/vibetype/compose.yaml @@ -72,12 +72,14 @@ services: target: /run/environment-variables/PGPASSWORD - source: postgres-role-service-vibetype-username target: /run/environment-variables/PGUSER + configs: + - source: postgraphile-jwt-public-key + target: /run/environment-variables/NUXT_PUBLIC_VIO_AUTH_JWT_PUBLIC_KEY volumes: - pnpm-data:/srv/.pnpm-store/ # dargstack:dev-only - ~~/artifacts/certificates/:/srv/certificates/ # dargstack:dev-only - ~~~/vibetype/:/srv/app/ # dargstack:dev-only - vibetype-data:/srv/app/node_modules # dargstack:dev-only - - ../postgraphile/configurations/jwtES256.key.pub:/run/environment-variables/NUXT_PUBLIC_VIO_AUTH_JWT_PUBLIC_KEY:ro volumes: vibetype-data: # The frontend's data. diff --git a/src/production/postgraphile/configurations/jwtES256.key.pub b/src/production/postgraphile/configurations/jwtES256.key.pub deleted file mode 100644 index ec4b9835..00000000 --- a/src/production/postgraphile/configurations/jwtES256.key.pub +++ /dev/null @@ -1,4 +0,0 @@ ------BEGIN PUBLIC KEY----- -MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBJC25Om3NLv2+zJlWtXGUPyijiXY -8ut0LSHk3EXInvmFYsk1wC8mUVO5T6jskZ7Zq0zwQsAirKVrSS9kpBKgjg== ------END PUBLIC KEY----- diff --git a/src/production/postgraphile/configurations/jwtRS256.key.pub b/src/production/postgraphile/configurations/jwtRS256.key.pub deleted file mode 100644 index e7ddc5d9..00000000 --- a/src/production/postgraphile/configurations/jwtRS256.key.pub +++ /dev/null @@ -1,14 +0,0 @@ ------BEGIN PUBLIC KEY----- -MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuxhUva8Nwcd88mUjNKa5 -OZqrhskSvWqsWRqVlyqSCVygblcEjV5PyT0CQ+41eTlAS/it61QWcR4Bk6OZW3ga -XQ739/2yuDCqgeXZ7VX0PXUZG+biaeA7BiiK2hB7Ve9YB0l72et0nNCFuQChAqjl -dSr4HvPJBQaofZ8CCRd29gue04uWDYj0hjzorHtQvj/AvmUQxw0vTUMpVPNfjeed -+4V0vciZJsyhRe1BoFqGrLrTVqvk+9AvFHInIjGXVUoR4JlVcE6CJQcLj+Sv6rIN -F5pk4fDJLc0/B5GTtXwuW4+A88Fl+765bvaMl2okfbaTS8V7FjXpZqr7BcGaRmCj -lSsiKDVOZGWXfIjiKoyCVT9M343PsLvTl2FKJQEwQ0svie9OgPx7qG1dNj+FJXzz -KdkwCwy0urQse2071vgAq10FUoTRiWk5ul9DPa75S8VrGuKu4/tA3kIx/qxAopGP -/px/MDIIsQBYMu5Lv6VMe3nY3bKrm0WYLwXvJDwHnQgMLjv0oblecu+SPm3ax7Ok -VLjdyMhM3TRkNJqC3vhAasmCGMBNShRtK4+EgoCKscFSxhvzokWUZEA6WTxDmMkF -l9dmKLjYbNL9ct3mAP/iG/Sa4xj/T0Qt/AKEH8zM5KXWpQ0m1mu8C9PjAfZF5d8u -pg1jBKql11Zp143eJg37WbkCAwEAAQ== ------END PUBLIC KEY----- From de692fb1e51d43539d8ab6f1d3f7dd6bf9e4c007 Mon Sep 17 00:00:00 2001 From: Jonas Thelemann Date: Fri, 14 Aug 2026 02:52:00 +0200 Subject: [PATCH 3/6] feat(debezium)!: consolidate cdc capture on the outbox table --- .../debezium/configurations/entrypoint.sh | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/development/debezium/configurations/entrypoint.sh b/src/development/debezium/configurations/entrypoint.sh index 4a61818f..32946a79 100755 --- a/src/development/debezium/configurations/entrypoint.sh +++ b/src/development/debezium/configurations/entrypoint.sh @@ -27,8 +27,18 @@ curl --fail --output /dev/null --silent --show-error \ "database.password": "'"$POSTGRES_PASSWORD"'", "database.user": "'"$POSTGRES_USER"'", "plugin.name": "pgoutput", - "table.include.list": "vibetype.event,vibetype.upload,vibetype_private.notification", - "topic.prefix" : "vibetype" + "table.include.list": "vibetype_private.outbox,vibetype.upload", + "topic.prefix" : "vibetype", + "transforms": "outbox", + "transforms.outbox.type": "io.debezium.transforms.outbox.EventRouter", + "transforms.outbox.route.by.field": "channel", + "transforms.outbox.route.topic.replacement": "vibetype.outbox.${routedByValue}", + "transforms.outbox.table.field.event.key": "id", + "transforms.outbox.table.field.event.payload": "payload", + "transforms.outbox.predicate": "isOutbox", + "predicates": "isOutbox", + "predicates.isOutbox.type": "org.apache.kafka.connect.transforms.predicates.TopicNameMatches", + "predicates.isOutbox.pattern": "vibetype\\.vibetype_private\\.outbox" }' echo "PostgreSQL connector '$CONNECTOR_NAME' is up to date." From ac230ce701a92029352c89c22406b5f215ea62fb Mon Sep 17 00:00:00 2001 From: Jonas Thelemann Date: Fri, 14 Aug 2026 03:29:00 +0200 Subject: [PATCH 4/6] feat(debezium)!: drop direct upload capture now that it routes through outbox --- src/development/debezium/configurations/entrypoint.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/development/debezium/configurations/entrypoint.sh b/src/development/debezium/configurations/entrypoint.sh index 32946a79..caa79593 100755 --- a/src/development/debezium/configurations/entrypoint.sh +++ b/src/development/debezium/configurations/entrypoint.sh @@ -27,7 +27,7 @@ curl --fail --output /dev/null --silent --show-error \ "database.password": "'"$POSTGRES_PASSWORD"'", "database.user": "'"$POSTGRES_USER"'", "plugin.name": "pgoutput", - "table.include.list": "vibetype_private.outbox,vibetype.upload", + "table.include.list": "vibetype_private.outbox", "topic.prefix" : "vibetype", "transforms": "outbox", "transforms.outbox.type": "io.debezium.transforms.outbox.EventRouter", From f146435f8abba1e825a6514b2526db028cc305bb Mon Sep 17 00:00:00 2001 From: Jonas Thelemann Date: Fri, 14 Aug 2026 04:07:00 +0200 Subject: [PATCH 5/6] feat(debezium)!: partition outbox topics by aggregate_id --- src/development/debezium/configurations/entrypoint.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/development/debezium/configurations/entrypoint.sh b/src/development/debezium/configurations/entrypoint.sh index caa79593..f15caea6 100755 --- a/src/development/debezium/configurations/entrypoint.sh +++ b/src/development/debezium/configurations/entrypoint.sh @@ -33,7 +33,7 @@ curl --fail --output /dev/null --silent --show-error \ "transforms.outbox.type": "io.debezium.transforms.outbox.EventRouter", "transforms.outbox.route.by.field": "channel", "transforms.outbox.route.topic.replacement": "vibetype.outbox.${routedByValue}", - "transforms.outbox.table.field.event.key": "id", + "transforms.outbox.table.field.event.key": "aggregate_id", "transforms.outbox.table.field.event.payload": "payload", "transforms.outbox.predicate": "isOutbox", "predicates": "isOutbox", From d6ddb05172aa84a8b9a87fc8ef90e5ccea2d8419 Mon Sep 17 00:00:00 2001 From: Jonas Thelemann Date: Fri, 14 Aug 2026 04:44:00 +0200 Subject: [PATCH 6/6] feat(debezium)!: route outbox topics by aggregate_type instead of type --- src/development/debezium/configurations/entrypoint.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/development/debezium/configurations/entrypoint.sh b/src/development/debezium/configurations/entrypoint.sh index f15caea6..d9c6643e 100755 --- a/src/development/debezium/configurations/entrypoint.sh +++ b/src/development/debezium/configurations/entrypoint.sh @@ -31,7 +31,7 @@ curl --fail --output /dev/null --silent --show-error \ "topic.prefix" : "vibetype", "transforms": "outbox", "transforms.outbox.type": "io.debezium.transforms.outbox.EventRouter", - "transforms.outbox.route.by.field": "channel", + "transforms.outbox.route.by.field": "aggregate_type", "transforms.outbox.route.topic.replacement": "vibetype.outbox.${routedByValue}", "transforms.outbox.table.field.event.key": "aggregate_id", "transforms.outbox.table.field.event.payload": "payload",