Nick SzaunigandClaude Sonnet 5
e7b157ec35
Adds a one-way push (ApiCore -> M365) of Aufgaben/Durchsichten/ Behandlungen/Fütterungen/Ernten/Königinnen-Zuordnungen into the calendar of a Microsoft 365 group, via the Graph API. - CalendarSyncModule (app-only client-credentials Graph auth, separate from the interactive SSO app registration; new env vars M365_CALENDAR_TENANT_ID/_CLIENT_ID/_CLIENT_SECRET). - Outbox + minute-interval cron worker (CalendarSyncOutboxEntry) instead of a synchronous push, since Graph calls are too slow/flaky to block a domain create request on; failed syncs retry up to 5 times. - Per-source-type toggle plus a group-ID field, configurable in Verwaltung > Automatisierung > Kalender-Sync (Verwaltung > Backup, an env var still wins on those fields where one applies to related config). - Hooked into Tasks/Inspections/Treatments/Feedings/Harvests/Queens at their existing create (and Task update/complete) points; entries render as all-day Graph events to avoid timezone ambiguity. - Documents the design decision in ARCHITECTURE.md (Annahme 9), since this is a net-new capability the lastenheft doesn't scope. Co-Authored-By: Claude Sonnet 5 <[email protected]>
28 lines
1.5 KiB
YAML
28 lines
1.5 KiB
YAML
# Vorlage – keine echten Werte. Kopieren, echte Werte setzen, per `kubectl apply` außerhalb
|
||
# der Versionskontrolle anwenden (oder ueber Secret-Manager/Sealed-Secrets im Cluster).
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
name: apicore-backend-secret
|
||
type: Opaque
|
||
stringData:
|
||
# Host ist der In-Cluster-Service aus deploy/k8s/postgres/service.yaml.
|
||
# Anderer Namespace als das Backend? Dann FQDN nutzen:
|
||
# apicore-postgres.<namespace>.svc.cluster.local
|
||
DATABASE_URL: "postgresql://apicore:change-me-postgres-password@apicore-postgres:5432/apicore?schema=public"
|
||
# Mindestens 32 Zeichen (server-seitig erzwungen, Start bricht sonst ab) -
|
||
# signiert jedes Access-/MFA-/SSO-Token UND verschluesselt gespeicherte
|
||
# TOTP-Secrets. Erzeugen z.B. mit: openssl rand -hex 32
|
||
JWT_ACCESS_SECRET: "change-me-to-a-random-value-at-least-32-characters-long"
|
||
JWT_REFRESH_SECRET: "change-me-refresh-secret"
|
||
# Entra ID App-Registrierung (SSO). Siehe configmap.example.yaml
|
||
# fuer OIDC_ISSUER_URL/OIDC_REDIRECT_URI.
|
||
OIDC_CLIENT_ID: "change-me-entra-client-id"
|
||
OIDC_CLIENT_SECRET: "change-me-entra-client-secret"
|
||
# Separate App-Registrierung fuer die M365-Kalender-Synchronisation
|
||
# (Application-Permission "Calendars.ReadWrite", Admin-Consent noetig) -
|
||
# NICHT dieselbe wie OIDC_CLIENT_ID/-SECRET oben.
|
||
M365_CALENDAR_TENANT_ID: "change-me-m365-tenant-id"
|
||
M365_CALENDAR_CLIENT_ID: "change-me-m365-client-id"
|
||
M365_CALENDAR_CLIENT_SECRET: "change-me-m365-client-secret"
|