From 312e30d9e4632a8694065b103d506ff49a4c5c53 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Wed, 18 Mar 2026 15:04:01 +0100
Subject: [PATCH] Add sandbox-specific probod config generation

Add a make target for probod-bootstrap and integrate it into the sandbox provisioning workflow. During VM provisioning, generate /etc/probod/config.yml with the Lima VM IP as the cookie domain, secure=false for HTTP access, and correct CORS origins. Also generate .env files for console and trust apps pointing to the VM IP. Update sandbox documentation to explain the auto-generated configuration.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 GNUmakefile               |  9 ++++++++-
 contrib/claude/sandbox.md |  9 +++++++++
 contrib/lima/provision.sh | 23 +++++++++++++++++++++++
 pkg/bootstrap/write.go    |  2 +-
 4 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/GNUmakefile b/GNUmakefile
index 39bad7a31..ee0f3392f 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -49,6 +49,9 @@ PROBOD_SRC=	cmd/probod/main.go
 PRB_BIN=	bin/prb
 PRB_SRC=	cmd/prb/main.go
 
+PROBOD_BOOTSTRAP_BIN=	bin/probod-bootstrap
+PROBOD_BOOTSTRAP_SRC=	cmd/probod-bootstrap/main.go
+
 ifndef SKIP_APPS
 PROBOD_BIN_EXTRA_DEPS += \
 	@probo/console \
@@ -123,7 +126,7 @@ coverage-combined: coverage-report test-e2e-coverage ## Generate combined covera
 	$(GO) tool cover -html=coverage-combined.out -o=coverage-combined.html
 
 .PHONY: build
-build: bin/probod bin/prb
+build: bin/probod bin/prb bin/probod-bootstrap
 
 .PHONY: sbom-docker
 sbom-docker: docker-build
@@ -184,6 +187,10 @@ bin/probod: pkg/server/api/connect/v1/schema/schema.go \
 bin/prb:
 	$(GO_BUILD) -o $(PRB_BIN) $(PRB_SRC)
 
+.PHONY: bin/probod-bootstrap
+bin/probod-bootstrap:
+	$(GO_BUILD) -o $(PROBOD_BOOTSTRAP_BIN) $(PROBOD_BOOTSTRAP_SRC)
+
 .PHONY: @probo/emails
 @probo/emails:
 	$(NPM) --workspace $@ run build
diff --git a/contrib/claude/sandbox.md b/contrib/claude/sandbox.md
index 7fdafc524..725268e82 100644
--- a/contrib/claude/sandbox.md
+++ b/contrib/claude/sandbox.md
@@ -49,6 +49,15 @@ After `sandbox.sh status`, use the VM IP to access services from the host:
 | Keycloak | `http://<vm-ip>:8082` |
 | PostgreSQL | `psql -h <vm-ip> -U probod` |
 
+## Auto-generated configuration
+
+During provisioning, the sandbox automatically generates:
+
+- **`/etc/probod/config.yml`** — probod config with the VM IP as cookie domain, `secure: false`, and correct CORS origins
+- **`apps/console/.env`** and **`apps/trust/.env`** — `VITE_API_URL` pointing to the VM IP
+
+Use `-cfg-file /etc/probod/config.yml` when running probod in the sandbox.
+
 ## Common workflows
 
 **Build and test:**
diff --git a/contrib/lima/provision.sh b/contrib/lima/provision.sh
index 832c1024c..76d05a055 100755
--- a/contrib/lima/provision.sh
+++ b/contrib/lima/provision.sh
@@ -84,3 +84,26 @@ LIMA_HOME=$(eval echo "~${LIMA_USER}")
 mkdir -p /root/.parallel "${LIMA_HOME}/.parallel"
 touch /root/.parallel/will-cite "${LIMA_HOME}/.parallel/will-cite"
 chown -R "${LIMA_USER}:${LIMA_USER}" "${LIMA_HOME}/.parallel"
+
+# Generate sandbox-specific probod config and frontend .env files
+VM_IP=$(ip -4 -j addr show dev lima0 | jq -r '.[0].addr_info[0].local')
+
+su - "${LIMA_USER}" -c "cd /workspace && make bin/probod-bootstrap"
+
+mkdir -p /etc/probod
+
+PROBOD_BASE_URL="http://${VM_IP}:8080" \
+AUTH_COOKIE_DOMAIN="${VM_IP}" \
+AUTH_COOKIE_SECURE=false \
+AUTH_COOKIE_SECRET="this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes" \
+AUTH_PASSWORD_PEPPER="this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes" \
+PROBOD_ENCRYPTION_KEY="thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA=" \
+API_CORS_ALLOWED_ORIGINS="http://${VM_IP}:8080,http://${VM_IP}:5173,http://${VM_IP}:5174" \
+AWS_ENDPOINT="http://127.0.0.1:8333" \
+AWS_ACCESS_KEY_ID="probod" \
+AWS_SECRET_ACCESS_KEY="thisisnotasecret" \
+AWS_USE_PATH_STYLE=true \
+    /workspace/bin/probod-bootstrap -output /etc/probod/config.yml
+
+echo "VITE_API_URL=http://${VM_IP}:8080" > /workspace/apps/console/.env
+echo "VITE_API_URL=http://${VM_IP}:8080" > /workspace/apps/trust/.env
diff --git a/pkg/bootstrap/write.go b/pkg/bootstrap/write.go
index 98f418ba8..805ac364f 100644
--- a/pkg/bootstrap/write.go
+++ b/pkg/bootstrap/write.go
@@ -20,7 +20,7 @@ import (
 	"path/filepath"
 
 	"go.probo.inc/probo/pkg/probod"
-	"gopkg.in/yaml.v3"
+	"sigs.k8s.io/yaml"
 )
 
 func WriteConfig(cfg *probod.FullConfig, path string) error {