ms2k/remora
SHA256
Watch
0
Code Releases Activity

Move browser authentication behind a generated-contract BFF

Browse source
This commit is contained in:
ms2k 2026-07-19 18:21:17 +09:00
commit fa7220ee33
1 changed files with 7259 additions and 2825 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/spec/deployment.md
View file

@ -1,6 +1,6 @@
# Kubernetes Deployment
`deploy/charts/remora` runs API, Worker, and WebClient as separate Deployments.
`deploy/charts/remora` runs API, Worker, and WebClient with its `WebBFF` as separate Deployments.
CloudNativePG, Dragonfly, Vault, ZITADEL, and VersityGW remain externally
managed.
@ -19,8 +19,12 @@ managed.
- Dragonfly uses a deployment-unique namespace.
`REMORA_GLOBAL_ATTEMPT_LIMIT` and `REMORA_WORKER_LOCAL_ATTEMPT_LIMIT` remain
independent.
- ZITADEL supplies the issuer, project audience, client identifier, and exact
project-role claim.
- The WebBFF stores ephemeral WebSessions through a WebBFF-only Dragonfly
credential and namespace. Its credential Secret is not shared with API or
Worker coordination access. Loss of that namespace signs browser users out
without affecting durable application state.
- ZITADEL supplies the issuer, project audience, exact project-role claim, and
a confidential WebBFF client whose secret is mounted from a Secret.
- VersityGW uses dedicated credentials and a bucket whose `_remora` namespace
excludes other writers and lifecycle expiry. Deployments unable to establish
both properties are unsupported.
@ -28,13 +32,18 @@ managed.
## Security
NetworkPolicies default-deny each workload, isolate the Worker and management
ports, and allow dependencies by selector or CIDR. Public source egress excludes
ports, and allow dependencies by selector or CIDR. The WebBFF may reach only
the API, identity provider, and its session store. Public source egress excludes
non-global and metadata-capable IPv4 ranges. Private sources require matching
application and NetworkPolicy CIDR allowances.
Containers run non-root with read-only roots, dropped capabilities, resource
limits, and no service links. Worker temporary storage is bounded.
TLS ingress redirects HTTP to HTTPS and emits HSTS. The WebBFF session cookie
is always `Secure`; unencrypted origins are unsupported outside loopback test
environments.
## Operations
API and Worker expose liveness, dependency-aware readiness, and Prometheus