Reset Solmara around authority-owned Relay and Evidence

.dockerignore

@@ -1,9 +1,21 @@
 .git
 .env
 .env.*
+.cache
+**/.cache
+config/evidence/local
+runtime
+**/runtime
+output
+**/output
+!generator/output
+!generator/output/**
+!output
 output/*
-!output/smoke/
-!output/smoke/**
+!output/smoke
+output/smoke/*
+!output/smoke/.gitkeep
+relays/*/package
 node_modules
 **/node_modules
 .svelte-kit
@@ -22,5 +34,28 @@ __pycache__
 **/__pycache__
 .pytest_cache
 **/.pytest_cache
+.ruff_cache
+**/.ruff_cache
 *.pyc
 *.log
+**/*.log
+**/*.jsonl
+**/*.sqlite
+**/*.sqlite-journal
+**/*.sqlite-shm
+**/*.sqlite-wal
+**/secrets
+**/secrets/**
+**/audit
+**/audit/**
+**/audits
+**/audits/**
+**/extracts
+**/extracts/**
+**/*private*.jwk
+**/*private*.jwk.json
+**/signing.jwk
+**/*.key
+**/*.pem
+**/*.p12
+**/*.pfx

.env.example

@@ -1,135 +1,26 @@
-# Generate .env with `just gen-secrets`. Values here are placeholders only.
+# Generate .env and the ignored Evidence/Mint/TLS files with `just gen-secrets`.
+# Values here are placeholders only.
 
 COMPOSE_PROJECT_NAME=solmara-lab-replace-me
 
-SOLMARA_RELAY_KEY_ACTIVE_WRITE_DEADLINE_UNIX_MS=4102444800000
-SOLMARA_RELAY_AUDIT_EVENT_RETENTION_MS=2592000000
-REGISTRY_ESIGNET_KYC_KEYSTORE_PASSWORD=
-REGISTRY_ESIGNET_KYC_TOKEN_SECRET=
-REGISTRY_ESIGNET_PSUT_SECRET=
-
-SOLMARA_POSTGRES_USER=solmara_registry
-SOLMARA_POSTGRES_PASSWORD=
-SOLMARA_POSTGRES_DB=solmara_lab
-NIA_SOURCE_POSTGRES_READER_PASSWORD=
-SIPF_SOURCE_POSTGRES_READER_PASSWORD=
-SOLMARA_NIA_DATABASE_URL=postgres://solmara_source_nia_reader:replace-me@postgres:5432/solmara_lab?sslmode=require
-SOLMARA_SIPF_DATABASE_URL=postgres://solmara_source_sipf_reader:replace-me@postgres:5432/solmara_lab?sslmode=require
-SOLMARA_ESIGNET_POSTGRES_PASSWORD=
-
-CRA_RELAY_AUDIT_HASH_SECRET=
-CRA_RELAY_AUDIT_PSEUDONYM_EPOCH_1=
-CRA_RELAY_POSTGRES_RUNTIME_PASSWORD=
-CRA_RELAY_POSTGRES_KEYRING_MAINTENANCE_PASSWORD=
-CRA_RELAY_POSTGRES_KEYRING_READER_PASSWORD=
-CRA_NOTARY_AUDIT_HASH_SECRET=
-CRA_NOTARY_POSTGRES_MIGRATOR_PASSWORD=
-CRA_NOTARY_POSTGRES_RUNTIME_PASSWORD=
-NIA_RELAY_AUDIT_HASH_SECRET=
-NIA_RELAY_AUDIT_PSEUDONYM_EPOCH_1=
-NIA_RELAY_POSTGRES_RUNTIME_PASSWORD=
-NIA_RELAY_POSTGRES_KEYRING_MAINTENANCE_PASSWORD=
-NIA_RELAY_POSTGRES_KEYRING_READER_PASSWORD=
-NIA_NOTARY_AUDIT_HASH_SECRET=
-NIA_NOTARY_POSTGRES_MIGRATOR_PASSWORD=
-NIA_NOTARY_POSTGRES_RUNTIME_PASSWORD=
-SRO_RELAY_AUDIT_HASH_SECRET=
-SRO_RELAY_AUDIT_PSEUDONYM_EPOCH_1=
-SRO_RELAY_POSTGRES_RUNTIME_PASSWORD=
-SRO_RELAY_POSTGRES_KEYRING_MAINTENANCE_PASSWORD=
-SRO_RELAY_POSTGRES_KEYRING_READER_PASSWORD=
-SRO_NOTARY_AUDIT_HASH_SECRET=
-SRO_NOTARY_POSTGRES_MIGRATOR_PASSWORD=
-SRO_NOTARY_POSTGRES_RUNTIME_PASSWORD=
-PROGRAMME_RELAY_AUDIT_HASH_SECRET=
-PROGRAMME_RELAY_AUDIT_PSEUDONYM_EPOCH_1=
-PROGRAMME_RELAY_POSTGRES_RUNTIME_PASSWORD=
-PROGRAMME_RELAY_POSTGRES_KEYRING_MAINTENANCE_PASSWORD=
-PROGRAMME_RELAY_POSTGRES_KEYRING_READER_PASSWORD=
-PROGRAMME_NOTARY_AUDIT_HASH_SECRET=
-PROGRAMME_NOTARY_POSTGRES_MIGRATOR_PASSWORD=
-PROGRAMME_NOTARY_POSTGRES_RUNTIME_PASSWORD=
-SIPF_RELAY_AUDIT_HASH_SECRET=
-SIPF_RELAY_AUDIT_PSEUDONYM_EPOCH_1=
-SIPF_RELAY_POSTGRES_RUNTIME_PASSWORD=
-SIPF_RELAY_POSTGRES_KEYRING_MAINTENANCE_PASSWORD=
-SIPF_RELAY_POSTGRES_KEYRING_READER_PASSWORD=
-SIPF_NOTARY_AUDIT_HASH_SECRET=
-SIPF_NOTARY_POSTGRES_MIGRATOR_PASSWORD=
-SIPF_NOTARY_POSTGRES_RUNTIME_PASSWORD=
-NAGDI_RELAY_AUDIT_HASH_SECRET=
-NAGDI_RELAY_AUDIT_PSEUDONYM_EPOCH_1=
-NAGDI_RELAY_POSTGRES_RUNTIME_PASSWORD=
-NAGDI_RELAY_POSTGRES_KEYRING_MAINTENANCE_PASSWORD=
-NAGDI_RELAY_POSTGRES_KEYRING_READER_PASSWORD=
-NAGDI_NOTARY_AUDIT_HASH_SECRET=
-NAGDI_NOTARY_POSTGRES_MIGRATOR_PASSWORD=
-NAGDI_NOTARY_POSTGRES_RUNTIME_PASSWORD=
-
+CRA_RELAY_AUDIT_KEY=
+NIA_RELAY_AUDIT_KEY=
+MOSD_RELAY_AUDIT_KEY=
+SIPF_RELAY_AUDIT_KEY=
+SIPF_RELAY_CURSOR_KEY=
+NAGDI_RELAY_AUDIT_KEY=
+NAGDI_RELAY_CURSOR_KEY=
 CHILD_BENEFIT_FEDERATOR_TOKEN=
-CRA_CHILD_BENEFIT_CLIENT_TOKEN=
-CRA_CHILD_BENEFIT_CLIENT_TOKEN_HASH=
-NIA_CHILD_BENEFIT_CLIENT_TOKEN=
-NIA_CHILD_BENEFIT_CLIENT_TOKEN_HASH=
-SRO_CHILD_BENEFIT_CLIENT_TOKEN=
-SRO_CHILD_BENEFIT_CLIENT_TOKEN_HASH=
-PROGRAMME_CHILD_BENEFIT_CLIENT_TOKEN=
-PROGRAMME_CHILD_BENEFIT_CLIENT_TOKEN_HASH=
-CRA_PENSION_CLIENT_TOKEN=
-CRA_PENSION_CLIENT_TOKEN_HASH=
-CRA_CITIZEN_CLIENT_TOKEN=
-CRA_CITIZEN_CLIENT_TOKEN_HASH=
-NIA_CITIZEN_CLIENT_TOKEN=
-NIA_CITIZEN_CLIENT_TOKEN_HASH=
-SIPF_PENSION_CLIENT_TOKEN=
-SIPF_PENSION_CLIENT_TOKEN_HASH=
-NAGDI_NOTARY_TOKEN=
-NAGDI_CLIENT_TOKEN_HASH=
-
-NIA_NOTARY_ISSUER_JWK=
-SIPF_NOTARY_ISSUER_JWK=
-NAGDI_NOTARY_ISSUER_JWK=
-CRA_RELAY_WORKLOAD_JWK=
-NIA_RELAY_WORKLOAD_JWK=
-NIA_ESIGNET_RELAY_WORKLOAD_JWK=
-SRO_RELAY_WORKLOAD_JWK=
-PROGRAMME_RELAY_WORKLOAD_JWK=
-SIPF_RELAY_WORKLOAD_JWK=
-NAGDI_RELAY_WORKLOAD_JWK=
+SOLMARA_EVIDENCE_CLIENT_KEY=/absolute/path/to/solmara-lab/config/evidence/local/cells/mint/clients/solmara-demo-client-key
 PORTAL_SESSION_SECRET=
 PORTAL_AUTH_PROVIDER=mock
+
+# Optional local eSignet profile.
+SOLMARA_ESIGNET_POSTGRES_PASSWORD=
+NIA_ESIGNET_CLIENT_PRIVATE_JWK=
+REGISTRY_ESIGNET_KYC_KEYSTORE_PASSWORD=
+REGISTRY_ESIGNET_KYC_TOKEN_SECRET=
+REGISTRY_ESIGNET_PSUT_SECRET=
 PORTAL_ESIGNET_CLIENT_ID=solmara-portal
 PORTAL_ESIGNET_CLIENT_KEY_ID=solmara-portal-key-1
 PORTAL_ESIGNET_CLIENT_PRIVATE_KEY_B64=
-PORTAL_ESIGNET_ISSUER=http://127.0.0.1:4308
-PORTAL_ESIGNET_AUTHORIZATION_ENDPOINT=http://127.0.0.1:4309/authorize
-PORTAL_ESIGNET_TOKEN_ENDPOINT=http://esignet:8088/v1/esignet/oauth/v2/token
-PORTAL_ESIGNET_CLIENT_ASSERTION_AUDIENCE=http://127.0.0.1:4308/v1/esignet/oauth/v2/token
-PORTAL_ESIGNET_USERINFO_ENDPOINT=http://esignet:8088/v1/esignet/oidc/userinfo
-PORTAL_ESIGNET_REDIRECT_URI=http://127.0.0.1:4300/auth/callback
-PORTAL_ESIGNET_SCOPE=openid profile
-PORTAL_ESIGNET_SUBJECT_CLAIM=individual_id
-
-CHILD_BENEFIT_FEDERATOR_URL=http://127.0.0.1:4321
-CRA_NOTARY_URL=http://127.0.0.1:4325
-NIA_NOTARY_URL=http://127.0.0.1:4326
-SRO_NOTARY_URL=http://127.0.0.1:4327
-PROGRAMME_NOTARY_URL=http://127.0.0.1:4328
-SIPF_NOTARY_URL=http://127.0.0.1:4322
-NAGDI_NOTARY_URL=http://127.0.0.1:4323
-PORTAL_URL=http://127.0.0.1:4300
-SCENARIO_RUNNER_URL=http://127.0.0.1:4302
-STATIC_METADATA_URL=http://127.0.0.1:4331
-SOLMARA_ESIGNET_PORT=4308
-SOLMARA_ESIGNET_UI_PORT=4309
-SOLMARA_ESIGNET_PUBLIC_BASE_URL=http://127.0.0.1:4308
-SOLMARA_ESIGNET_UI_PUBLIC_BASE_URL=http://127.0.0.1:4309
-
-# Hosted Walt holder wallet.
-CONFIG_REPO_REF=main
-WALT_DB_PASSWORD=
-WALT_AUTH_ENCRYPTION_KEY=
-WALT_AUTH_SIGN_KEY=
-WALT_AUTH_TOKEN_KEY=
-WALT_KTOR_SIGNING_KEY=
-WALT_KTOR_VERIFICATION_KEY=

.github/workflows/ci.yml

@@ -7,43 +7,37 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
-  checks:
+  authority-cell-checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
-      - name: Enable pnpm
-        run: corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4.4.0
         with:
           node-version: "22"
-          cache: pnpm
-          cache-dependency-path: portal/pnpm-lock.yaml
       - name: Install just
-        uses: extractions/setup-just@v2
-      - name: Setup
-        run: just setup
-      - name: Publish metadata
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes just
+      - name: Install dependencies
+        run: |
+          corepack enable
+          just setup
+      - name: Generate ignored runtime material
+        run: just generate
+      - name: Publish checked-in metadata
         run: just metadata-publish
-      - name: Lint
+      - name: Lint authority-cell configuration
         run: just lint
-      - name: Test
+      - name: Test authority-cell application
         run: just test
-      - name: Verify compiler-generated authority projects
-        run: |
-          just registry-projects-editor
-          if [ -n "$(git status --short -- projects)" ]; then
-            git status --short -- projects
-            exit 1
-          fi
-          just registry-projects-check
-          just registry-projects-test
-          just registry-projects-capabilities
-          just registry-projects-runtime-check
-      - name: Generate local secrets
-        run: just gen-secrets
-      - name: Compose
+      - name: Validate and package all Relay V2 projects
+        run: just relay-check
+      - name: Validate Compose topology
         run: just compose
-      - name: Review
-        run: just review