probod-bootstrap could only resolve aws:// Secrets Manager refs.
Add awsps:// for SSM Parameter Store (GetParameter with decryption)
and awssm:// as an explicit Secrets Manager prefix. Keep aws:// for
backward compatibility. Values are cached per run per backend.
Update Helm, .env.example, and probod-bootstrap changelog.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
Introduce a Resolver that owns env lookup and typed parsing for
probod-bootstrap. Env values prefixed with aws://<secret-id> are
fetched from AWS Secrets Manager (plaintext SecretString); each
secret ID is cached per run. Builder now takes a Resolver only.
Prefix every probod-bootstrap input with PROBOD_ so bootstrap config
does not collide with unrelated process environment (for example
AWS_* used by other tooling). Secrets Manager authentication uses
the standard AWS SDK default chain (AWS_REGION, IAM role, profile);
PROBOD_AWS_* vars configure S3 in the generated config only.
Update Helm deployment env names, GNUmakefile dev-config, Lima
provision, e2e testutil, compose.prod.yaml, and docs.
Deployments must rename bootstrap env vars to PROBOD_* (e.g.
AUTH_COOKIE_SECRET → PROBOD_AUTH_COOKIE_SECRET).
BREAKING CHANGE: all env vars are now prefixed by `PROBOD_`.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
When PROBOD_ENCRYPTION_KEY is set, always run probod-bootstrap to regenerate
the config file. This ensures that updated environment variables take effect
even when a stale config file exists on a persistent volume (e.g., PVC).
Previously, an existing config file would be reused unconditionally, causing
env var changes to be ignored on container restart.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Zain Ahmad Khan <niazi_zain@hotmail.com>
AWS_USE_PATH_STYLE for docker had a code missing in entrypoint.sh which If not provided doesn't let us use minio or any other Storage with Probo Docker.
- Fix entrypoint.sh to place SAML config under auth.saml instead of root level,
resolving "SP certificate and private key are not configured" error
Fixes#541
Signed-off-by: pwnslinger <mahmadi@sorenhq.com>
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add PG_CA_BUNDLE_PATH environment variable to load PostgreSQL TLS CA
certificates from a file path. The bundle is read at startup and injected
into the generated configuration file, enabling secure connections to
PostgreSQL instances with custom CA certificates.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
