mirror of https://github.com/semantica-agi/semantica.git synced 2026-08-29 04:26:20 +00:00

Files

T

KaifAhmad1 b9e069301f fix(deploy): address security and correctness blockers from PR review

- gcp/cloudrun-service.yaml: add comment + README sed one-liner so PROJECT_ID
  is substituted before gcloud run services replace (was a literal placeholder
  that caused image-pull failure on the declarative deploy path)
- azure/main.parameters.json: replace wildcard allowedOrigins "*" with a
  REPLACE_ME placeholder; add README note to set the real URL after first deploy
- kubernetes/networkpolicy.yaml + helm networkpolicy template: add from: selector
  (ingress-nginx namespace + same-namespace pods) so ingress is no longer
  allow-all; restrict egress to FalkorDB port 6379 and DNS port 53 instead of
  the allow-all egress: - {} wildcard
- helm/values.yaml: expose networkPolicy.ingressNamespace and falkordbPort values
- kubernetes/deployment.yaml: add secretRef for knowledge-explorer-secrets so
  FALKORDB_PASSWORD is actually injected into the container
- app.py: add _mutation_bridge_installed guard to prevent closure stacking when
  the same GraphSession is passed to create_app() more than once; remove
  duplicate app.state.allowed_origins assignment (single source of truth is
  app.state.explorer_settings); add comment on falkordb_host/port dead config
- tests: update allowed_origins assertions to use explorer_settings dict
- .checkov.yaml: remove global CKV_K8S_21/28/30 suppressions; rely on per-file
  inline checkov:skip comments in cloudrun-service.yaml so future real K8s
  manifests are not silently exempted

2026-06-24 22:55:18 +05:30

1.2 KiB

Raw Blame History

Azure Container Apps

Deploy with Azure Developer CLI from this template directory:

cd deploy/azure
azd auth login
azd init --environment semantica-ke
azd env set AZURE_LOCATION eastus

# The template defaults to an internal (private) Container Apps environment.
# Provide the resource ID of an existing subnet (delegated to Microsoft.App/environments):
azd env set AZURE_INFRASTRUCTURE_SUBNET_ID /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/virtualNetworks/<vnet>/subnets/<subnet>

# For a quick public dev/test deployment without a VNet, override the default:
# azd env set AZURE_INFRASTRUCTURE_SUBNET_ID "" and set vnetInternal=false in main.parameters.json

azd up

After the first deploy, set allowedOrigins in main.parameters.json to the Container App URL printed by azd up (e.g. https://<app-name>.<unique>.eastus.azurecontainerapps.io), then re-run azd up to apply the CORS restriction.

The Bicep template provisions:

A Container Apps managed environment with an internal load balancer (private VNet, no public IP) and a system-assigned managed identity on the Container App (AZR-000363 / AZR-000361 compliant).
HTTP ingress, scale-to-zero, max 10 replicas, and a /api/health liveness probe.

1.2 KiB Raw Blame History

Azure Container Apps

1.2 KiB

Raw Blame History