bastian/travel-planner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: wire oidc environment configuration

Browse Source
This commit is contained in:
Bastian Wagner
2026-08-17 15:54:30 +02:00
parent 6e991bfd00
commit 60e09d5050
5 changed files with 41 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/architecture/deployment.md
View File

@@ -30,3 +30,11 @@ TeamCity supplies immutable `IMAGE_TAG` values (see `scripts/teamcity/build-imag
| Rollback | `scripts/teamcity/rollback.sh` |
The existing TeamCity project configures these as command-line/SSH build steps; all deployment logic stays in version control, not in TeamCity step configuration.
## OIDC configuration (Phase 02+)
`api` and `worker` both require `OIDC_ISSUER` and `OIDC_AUDIENCE` at startup (validated fail-fast by `loadEnvironment`, same as `DATABASE_URL`/`REDIS_URL`). Neither is a secret — this is a public PKCE client with no client secret. The Angular production bundle bakes `OIDC_ISSUER`/`OIDC_CLIENT_ID` in at **image build time** via `docker/edge.Dockerfile` build args (sourced from the `OIDC_ISSUER`/`OIDC_CLIENT_ID` environment variables passed to `docker compose build`), not at container runtime, since static frontend assets cannot read server-side environment variables after the fact.
## Migrations (Phase 02+)
`backend/apps/api/src/migration.ts` now runs real, versioned `node-pg-migrate` migrations from `backend/migrations/`; the Phase 01 no-op body has been replaced. The container command contract (`node backend/dist/apps/api/src/migration.js`) is unchanged, so `scripts/teamcity/deploy.sh` required no changes. Migrations are copied into the `travel-api` image so `docker compose run --rm --no-deps api node backend/dist/apps/api/src/migration.js` has everything it needs.