From b042234078630b8cc6f248c87bdfa0087a6b6c21 Mon Sep 17 00:00:00 2001 From: chrischristiansen-glitch Date: Sun, 28 Jun 2026 12:17:39 +0200 Subject: [PATCH] fix: korrekt IAP_CLIENT_ID i GEMINI.md (kq8nt7ld + tala4meo) --- .gemini/GEMINI.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.gemini/GEMINI.md b/.gemini/GEMINI.md index 6cef440..89cba82 100644 --- a/.gemini/GEMINI.md +++ b/.gemini/GEMINI.md @@ -49,7 +49,7 @@ BUDGET_CAP: 2500 NOK — spør Chris om +1000 NOK ved behov OPERATOR: Chris Christiansen (chris.christiansen@vauco.no) PRIMARY_GIT: http://34.59.131.162:3000/chris/OSVauco ← GITEA (primær) GITHUB_LEGACY: https://github.com/vauco-saas/OSVauco ← faset ut -IAP_CLIENT_ID: 357036551735-kq8nt71d38hfqlcfb3n52ef7ala4meo.apps.googleusercontent.com +IAP_CLIENT_ID: 357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com ``` > LOCKED. Ikke endre uten eksplisitt instruksjon fra Chris. @@ -185,7 +185,8 @@ gcloud secrets versions access latest --secret= --project=propane-will-491 12. Gitea er primær Git — GitHub er ikke kilde til sannhet 13. Emma rapporterer til Chris — ingen andre kan gi GO 14. ALDRI bruk `--audiences`-flag med `gcloud auth print-identity-token` -15. IAP identity token audience = IAP_CLIENT_ID, ikke base URL +15. IAP identity token audience = IAP_CLIENT_ID fra metadata server, ikke base URL +16. IAP_CLIENT_ID hentes alltid fra: `gcloud run services describe opax-mcp --format="value(spec.template.spec.containers[0].env)"` --- @@ -200,14 +201,15 @@ SMOKE_URL=https://osvauco-agent-357036551735.us-central1.run.app # Deploy gcloud builds submit --config=cloudbuild.yaml --project=propane-will-491900-m5 -# Auth +# Auth — Cloud Run (user account OK) TOKEN=$(gcloud auth print-identity-token) curl -si $SMOKE_URL/health -H "Authorization: Bearer $TOKEN" -# IAP identity token (opax.vauco.no) +# Auth — IAP Load Balancer opax.vauco.no (MUST use metadata server + SA token) TOKEN=$(curl -s -H "Metadata-Flavor: Google" \ - "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=357036551735-kq8nt71d38hfqlcfb3n52ef7ala4meo.apps.googleusercontent.com&format=full") + "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com&format=full") curl -si https://opax.vauco.no/health -H "Authorization: Bearer $TOKEN" +# Forventet: HTTP/2 200 # Ny Cloud Run-tjeneste: gi invoker-rettighet med en gang gcloud run services add-iam-policy-binding [SERVICE] \