Jean-Gabriel Gill-Couture
a4b3d18bd6
Caller must pass `UserPassCredentials` to `FleetNatsScore::user_pass` — no more `e2e-admin`/`e2e-device` defaults shipped in the library. The deploy binary reads `HARMONY_FLEET_*` env vars (default namespace `harmony-fleet-system`) and fails fast when NATS creds aren't set. Also: `style/dist/` gitignored, `manual_mint/mint.py` moved next to `nats/callout/` with README + secrets gitignore (the real RSA key that was sitting untracked has been removed), `architecture_review.md` moved to `docs/adr/drafts/024-`, three low-value ROADMAP docs deleted. Updates pre-merge checklist (§1.6, §1.8, §3.1, §5).
52 lines
1.8 KiB
Markdown
52 lines
1.8 KiB
Markdown
# manual_mint
|
|
|
|
One-shot operator tool — mint a Zitadel JWT-bearer access token by
|
|
hand for a NATS callout-account user, given that user's machine-key
|
|
PEM.
|
|
|
|
Lives next to `nats/callout/` because the access token this script
|
|
produces is the input the callout signs into a per-connection NATS
|
|
user JWT. The shape of the assertion (claims, scopes, audience) has
|
|
to match what the callout will accept at validation time — keeping
|
|
the two side by side makes that contract visible.
|
|
|
|
## When to use it
|
|
|
|
Almost never. Production agents mint their own tokens via the
|
|
`harmony-fleet-auth` `CredentialSource::ZitadelMachineKey`. Reach
|
|
for this only for:
|
|
|
|
- Out-of-band debugging when a real agent is failing to authenticate
|
|
and you want to confirm the Zitadel side is happy with a hand-
|
|
crafted token.
|
|
- Smoke-testing a fresh Zitadel install before the agent runtime is
|
|
wired up.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
cd nats/callout/manual_mint
|
|
python3 -m venv venv && source venv/bin/activate
|
|
pip install pyjwt requests
|
|
|
|
# Drop the Zitadel machine-key PEM next to mint.py (filename `ops.pem`).
|
|
# DO NOT commit this file — it is a private key. `.gitignore` is set
|
|
# up to keep it out of git, but double-check before `git add`.
|
|
python mint.py
|
|
```
|
|
|
|
## Secrets
|
|
|
|
The script reads `ops.pem` from the current directory. That file is
|
|
a Zitadel-issued RSA private key — treat it like any other secret.
|
|
`.gitignore` in this folder excludes `*.pem` and the `venv/`
|
|
directory; the only tracked file is `mint.py` itself.
|
|
|
|
## Hard-coded IDs
|
|
|
|
`mint.py` currently embeds `client_id`, `key_id`, `user_id`, and two
|
|
`project_id` values from a specific Zitadel staging install. Update
|
|
them to match your environment before running. A future cleanup
|
|
could read them from env vars; today the script is small enough to
|
|
edit in place.
|