Files

Bryan Frimin c4e81ed092 Inline OAuth2 signing key in config

The OAuth2/OIDC server accepted its signing key via a file path
(key-file), while every other PEM key in the probod config (SAML
private key, ACME account key) is embedded inline. Switch the
field to a private-key string so the convention is uniform.

The signing key is operator-supplied material that must outlive
any process restart, so the bootstrap builder now treats
OAUTH2_SERVER_SIGNING_KEY as required and refuses to start
without one; silently minting a fresh key per boot would break
token validation across rollouts. The OAUTH2_SERVER_* env vars
otherwise flow through builder.Build like the existing SAML
block so the new OAuth2Server section is populated end-to-end.

Rework the e2e harness to render its config via bootstrap at
test setup, which removes the static
e2e/console/testdata/config.yaml and the previously generated
test-only PEM file. A per-run RSA key is minted via
bootstrap.GenerateOAuth2SigningKey (kept public for test
tooling) and injected through the builder env map. CI now
passes ACME_ROOT_CA inline instead of mutating a YAML on disk.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

2026-04-21 17:56:00 +02:00

3.1 KiB

Raw Blame History

GNUmakefile

The project uses a GNUmakefile at the root. Builds run with --jobs=$(nproc) by default.

Everyday targets

Target	Purpose
`make build`	Build `bin/probod`, `bin/prb`, and `bin/probod-bootstrap` (includes frontend apps, codegen, and Relay)
`SKIP_APPS=1 make build`	Build without frontend apps (faster for backend-only work)
`make test`	Run tests with race detection and coverage
`make test MODULE=./pkg/foo`	Run tests for a single module
`make test-verbose`	Tests with verbose output
`make test-short`	Short tests only
`make test-bench`	Run benchmarks
`make test-e2e`	Run console end-to-end tests (requires `bin/probod`)
`make lint`	Run all linters: `vet` + `go-fmt` + `go-fix` + `go-lint` + `npm-lint`
`make fmt`	Format Go code (`go fmt ./...`)
`make clean`	Remove all build artifacts, `node_modules`, generated files, and coverage
`make help`	List targets with `##` doc comments

Infrastructure

Target	Purpose
`make stack-up`	Start Docker Compose infra (Postgres, Pebble, Keycloak, etc.)
`make stack-down`	Stop Docker Compose infra
`make stack-ps`	List running containers
`make psql`	Open a `psql` shell to the dev Postgres database

Codegen

make generate runs all code generation (GraphQL + MCP + Relay). Individual codegen is driven by go generate:

go generate ./pkg/server/api/console/v1 — Console GraphQL (gqlgen)
go generate ./pkg/server/api/connect/v1 — Connect GraphQL (gqlgen)
go generate ./pkg/server/api/trust/v1 — Trust GraphQL (gqlgen)
go generate ./pkg/server/api/mcp/v1 — MCP (mcpgen)
go generate ./pkg/llm — LLM model registry from OpenRouter (make genmodels)

make relay merges split .graphql schema files and runs relay-compiler.

Coverage

Target	Purpose
`make coverage-report`	Unit test HTML coverage report (`coverage.html`)
`make test-e2e-coverage`	E2E coverage report (`coverage-e2e.html`)
`make coverage-combined`	Combined unit + e2e report (`coverage-combined.html`)

Docker

Target	Purpose
`make docker-build`	Build the Docker image (`ghcr.io/getprobo/probo`)
`make sbom`	Source SBOM (CycloneDX)
`make sbom-docker`	Docker image SBOM
`make scan`	Vulnerability scan (Grype) on source + Docker
`make scan-license`	License compliance scan (Trivy)

Sandbox (Lima)

Target	Purpose
`make sandbox-create`	Create a Lima sandbox VM for this worktree
`make sandbox-start`	Start the VM
`make sandbox-stop`	Stop (hibernate) the VM
`make sandbox-delete`	Delete the VM
`make sandbox-ssh`	Open a shell in the VM
`make sandbox-status`	Show VM status and IP

Overridable variables

Variable	Default	Purpose
`SKIP_APPS`	(unset)	Set to `1` to skip frontend app builds
`CGO_ENABLED`	`0`	Enable/disable CGO
`GOOS`	(host)	Cross-compile target OS
`TEST_FLAGS`	`-race -cover -coverprofile=coverage.out`	Extra flags passed to `go test`
`DOCKER_BUILD_FLAGS`	(empty)	Extra flags for `docker build`

3.1 KiB Raw Blame History