From ad2f32880bca55a33ca72ca633feefffd96840bd Mon Sep 17 00:00:00 2001 From: Jonas Thelemann Date: Fri, 14 Aug 2026 07:15:00 +0200 Subject: [PATCH 1/2] chore(deps): bump dargstack to 4.13.0 --- Dockerfile.md | 2 +- dargstack.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile.md b/Dockerfile.md index b026300d..3db88ff2 100644 --- a/Dockerfile.md +++ b/Dockerfile.md @@ -1,3 +1,3 @@ # -FROM ghcr.io/dargstack/dargstack:4.12.3 +FROM ghcr.io/dargstack/dargstack:4.13.0 # diff --git a/dargstack.yaml b/dargstack.yaml index c6ec78ec..1d1d23b4 100644 --- a/dargstack.yaml +++ b/dargstack.yaml @@ -14,7 +14,7 @@ environment: # tag: latest # optional, defaults to "latest" metadata: - compatibility: ">=4.9.2-0 <5.0.0" + compatibility: ">=4.13.0-0 <5.0.0" name: "vibetype" source: name: "maevsi" From ad705acabf0be158c3d88536528c297f9b7ece07 Mon Sep 17 00:00:00 2001 From: Jonas Thelemann Date: Fri, 14 Aug 2026 07:48:00 +0200 Subject: [PATCH 2/2] refactor(postgraphile): derive JWT public key from private key --- artifacts/.gitignore | 1 + src/development/postgraphile/compose.yaml | 12 +++++++++++- .../postgraphile/configurations/jwtES256.key.pub | 4 ---- src/development/reccoom/compose.yaml | 4 +++- src/development/vibetype/compose.yaml | 4 +++- .../postgraphile/configurations/jwtES256.key.pub | 4 ---- .../postgraphile/configurations/jwtRS256.key.pub | 14 -------------- 7 files changed, 18 insertions(+), 25 deletions(-) delete mode 100644 src/development/postgraphile/configurations/jwtES256.key.pub delete mode 100644 src/production/postgraphile/configurations/jwtES256.key.pub delete mode 100644 src/production/postgraphile/configurations/jwtRS256.key.pub diff --git a/artifacts/.gitignore b/artifacts/.gitignore index 87bd3818..5e281369 100644 --- a/artifacts/.gitignore +++ b/artifacts/.gitignore @@ -1,4 +1,5 @@ audit-log/ certificates/ +configs/ secrets/ .env.merged \ No newline at end of file diff --git a/src/development/postgraphile/compose.yaml b/src/development/postgraphile/compose.yaml index fd23c008..c19a62c2 100644 --- a/src/development/postgraphile/compose.yaml +++ b/src/development/postgraphile/compose.yaml @@ -11,6 +11,10 @@ secrets: postgraphile-sentry-dsn: # The GraphQL API's Sentry DSN. file: ~~/artifacts/secrets/postgraphile-sentry-dsn.secret +configs: + postgraphile-jwt-public-key: + # The GraphQL API's JWT public key, derived from postgraphile-jwt-secret. + file: ~~/artifacts/configs/postgraphile-jwt-public-key.pub services: postgraphile: # You can access the GraphQL API for the PostgreSQL database at [postgraphile.app.localhost](https://postgraphile.app.localhost/). @@ -49,9 +53,11 @@ services: target: /run/environment-variables/SENTRY_DSN - source: vibetype-turnstile-key target: /run/environment-variables/TURNSTILE_SECRET_KEY + configs: + - source: postgraphile-jwt-public-key + target: /run/environment-variables/POSTGRAPHILE_JWT_PUBLIC_KEY volumes: - ~~~/postgraphile/:/srv/app/ # dargstack:dev-only - - ./configurations/jwtES256.key.pub:/run/environment-variables/POSTGRAPHILE_JWT_PUBLIC_KEY:ro - pnpm-data:/srv/.pnpm-store/ # dargstack:dev-only - postgraphile-data:/srv/app/node_modules # dargstack:dev-only volumes: @@ -59,6 +65,10 @@ volumes: # The GraphQL API's data. {} x-dargstack: + configs: + postgraphile-jwt-public-key: + type: public_key + source: postgraphile-jwt-secret secrets: postgraphile-connection: type: template diff --git a/src/development/postgraphile/configurations/jwtES256.key.pub b/src/development/postgraphile/configurations/jwtES256.key.pub deleted file mode 100644 index e9b2a5e8..00000000 --- a/src/development/postgraphile/configurations/jwtES256.key.pub +++ /dev/null @@ -1,4 +0,0 @@ ------BEGIN PUBLIC KEY----- -MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgIYyEMm+hZzEnXhJLGUx9lwr3cKs -W2uJ+zLvei380CrUEPARnWQNR/V0usS0EFypTQllniuCpbLG6un87kxh6w== ------END PUBLIC KEY----- diff --git a/src/development/reccoom/compose.yaml b/src/development/reccoom/compose.yaml index c5996ec4..75bfbaa2 100644 --- a/src/development/reccoom/compose.yaml +++ b/src/development/reccoom/compose.yaml @@ -58,9 +58,11 @@ services: target: /run/environment-variables/SENTRY_DSN - source: reccoom-service-api-key target: /run/environment-variables/SERVICE_API_KEY + configs: + - source: postgraphile-jwt-public-key + target: /run/configurations/jwtES256.key.pub volumes: - ~~~/reccoom/:/srv/app/ # dargstack:dev-only - - ../postgraphile/configurations/jwtES256.key.pub:/run/configurations/jwtES256.key.pub:ro - reccoom-data:/home/python/.cache/ # dargstack:dev-only reccoom-consumer: # You can track the recommender's event streaming consumer using `redpanda-console`. diff --git a/src/development/vibetype/compose.yaml b/src/development/vibetype/compose.yaml index 849adea5..ad9ab920 100644 --- a/src/development/vibetype/compose.yaml +++ b/src/development/vibetype/compose.yaml @@ -72,12 +72,14 @@ services: target: /run/environment-variables/PGPASSWORD - source: postgres-role-service-vibetype-username target: /run/environment-variables/PGUSER + configs: + - source: postgraphile-jwt-public-key + target: /run/environment-variables/NUXT_PUBLIC_VIO_AUTH_JWT_PUBLIC_KEY volumes: - pnpm-data:/srv/.pnpm-store/ # dargstack:dev-only - ~~/artifacts/certificates/:/srv/certificates/ # dargstack:dev-only - ~~~/vibetype/:/srv/app/ # dargstack:dev-only - vibetype-data:/srv/app/node_modules # dargstack:dev-only - - ../postgraphile/configurations/jwtES256.key.pub:/run/environment-variables/NUXT_PUBLIC_VIO_AUTH_JWT_PUBLIC_KEY:ro volumes: vibetype-data: # The frontend's data. diff --git a/src/production/postgraphile/configurations/jwtES256.key.pub b/src/production/postgraphile/configurations/jwtES256.key.pub deleted file mode 100644 index ec4b9835..00000000 --- a/src/production/postgraphile/configurations/jwtES256.key.pub +++ /dev/null @@ -1,4 +0,0 @@ ------BEGIN PUBLIC KEY----- -MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBJC25Om3NLv2+zJlWtXGUPyijiXY -8ut0LSHk3EXInvmFYsk1wC8mUVO5T6jskZ7Zq0zwQsAirKVrSS9kpBKgjg== ------END PUBLIC KEY----- diff --git a/src/production/postgraphile/configurations/jwtRS256.key.pub b/src/production/postgraphile/configurations/jwtRS256.key.pub deleted file mode 100644 index e7ddc5d9..00000000 --- a/src/production/postgraphile/configurations/jwtRS256.key.pub +++ /dev/null @@ -1,14 +0,0 @@ ------BEGIN PUBLIC KEY----- -MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuxhUva8Nwcd88mUjNKa5 -OZqrhskSvWqsWRqVlyqSCVygblcEjV5PyT0CQ+41eTlAS/it61QWcR4Bk6OZW3ga -XQ739/2yuDCqgeXZ7VX0PXUZG+biaeA7BiiK2hB7Ve9YB0l72et0nNCFuQChAqjl -dSr4HvPJBQaofZ8CCRd29gue04uWDYj0hjzorHtQvj/AvmUQxw0vTUMpVPNfjeed -+4V0vciZJsyhRe1BoFqGrLrTVqvk+9AvFHInIjGXVUoR4JlVcE6CJQcLj+Sv6rIN -F5pk4fDJLc0/B5GTtXwuW4+A88Fl+765bvaMl2okfbaTS8V7FjXpZqr7BcGaRmCj -lSsiKDVOZGWXfIjiKoyCVT9M343PsLvTl2FKJQEwQ0svie9OgPx7qG1dNj+FJXzz -KdkwCwy0urQse2071vgAq10FUoTRiWk5ul9DPa75S8VrGuKu4/tA3kIx/qxAopGP -/px/MDIIsQBYMu5Lv6VMe3nY3bKrm0WYLwXvJDwHnQgMLjv0oblecu+SPm3ax7Ok -VLjdyMhM3TRkNJqC3vhAasmCGMBNShRtK4+EgoCKscFSxhvzokWUZEA6WTxDmMkF -l9dmKLjYbNL9ct3mAP/iG/Sa4xj/T0Qt/AKEH8zM5KXWpQ0m1mu8C9PjAfZF5d8u -pg1jBKql11Zp143eJg37WbkCAwEAAQ== ------END PUBLIC KEY-----