chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix: korrekt IAP_CLIENT_ID i GEMINI.md (kq8nt7ld + tala4meo)

Browse Source
This commit is contained in:
chrischristiansen-glitch 2026-06-28 12:17:39 +02:00
parent 5c25abb28e
commit b042234078
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
.gemini/GEMINI.md
View File

@ -49,7 +49,7 @@ BUDGET_CAP: 2500 NOK — spør Chris om +1000 NOK ved behov
OPERATOR: Chris Christiansen (chris.christiansen@vauco.no) OPERATOR: Chris Christiansen (chris.christiansen@vauco.no)
PRIMARY_GIT: http://34.59.131.162:3000/chris/OSVauco ← GITEA (primær) PRIMARY_GIT: http://34.59.131.162:3000/chris/OSVauco ← GITEA (primær)
GITHUB_LEGACY: https://github.com/vauco-saas/OSVauco ← faset ut GITHUB_LEGACY: https://github.com/vauco-saas/OSVauco ← faset ut
IAP_CLIENT_ID: 357036551735-kq8nt71d38hfqlcfb3n52ef7ala4meo.apps.googleusercontent.com IAP_CLIENT_ID: 357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com
``` ```
> LOCKED. Ikke endre uten eksplisitt instruksjon fra Chris. > LOCKED. Ikke endre uten eksplisitt instruksjon fra Chris.
@ -185,7 +185,8 @@ gcloud secrets versions access latest --secret=<navn> --project=propane-will-491
12. Gitea er primær Git — GitHub er ikke kilde til sannhet 12. Gitea er primær Git — GitHub er ikke kilde til sannhet
13. Emma rapporterer til Chris — ingen andre kan gi GO 13. Emma rapporterer til Chris — ingen andre kan gi GO
14. ALDRI bruk `--audiences`-flag med `gcloud auth print-identity-token` 14. ALDRI bruk `--audiences`-flag med `gcloud auth print-identity-token`
15. IAP identity token audience = IAP_CLIENT_ID, ikke base URL 15. IAP identity token audience = IAP_CLIENT_ID fra metadata server, ikke base URL
16. IAP_CLIENT_ID hentes alltid fra: `gcloud run services describe opax-mcp --format="value(spec.template.spec.containers[0].env)"`
--- ---
@ -200,14 +201,15 @@ SMOKE_URL=https://osvauco-agent-357036551735.us-central1.run.app
# Deploy # Deploy
gcloud builds submit --config=cloudbuild.yaml --project=propane-will-491900-m5 gcloud builds submit --config=cloudbuild.yaml --project=propane-will-491900-m5
# Auth # Auth — Cloud Run (user account OK)
TOKEN=$(gcloud auth print-identity-token) TOKEN=$(gcloud auth print-identity-token)
curl -si $SMOKE_URL/health -H "Authorization: Bearer $TOKEN" curl -si $SMOKE_URL/health -H "Authorization: Bearer $TOKEN"
# IAP identity token (opax.vauco.no) # Auth — IAP Load Balancer opax.vauco.no (MUST use metadata server + SA token)
TOKEN=$(curl -s -H "Metadata-Flavor: Google" \ TOKEN=$(curl -s -H "Metadata-Flavor: Google" \
"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=357036551735-kq8nt71d38hfqlcfb3n52ef7ala4meo.apps.googleusercontent.com&format=full") "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com&format=full")
curl -si https://opax.vauco.no/health -H "Authorization: Bearer $TOKEN" curl -si https://opax.vauco.no/health -H "Authorization: Bearer $TOKEN"
# Forventet: HTTP/2 200
# Ny Cloud Run-tjeneste: gi invoker-rettighet med en gang # Ny Cloud Run-tjeneste: gi invoker-rettighet med en gang
gcloud run services add-iam-policy-binding [SERVICE] \ gcloud run services add-iam-policy-binding [SERVICE] \