sync dari sicabe-doc/deploy @ bc1a6e6

deploy/config/airflow/dags/example_sicabe_pipeline.py

@@ -93,8 +93,11 @@ default_args = {
     "depends_on_past": False,
     "email_on_failure": True,
     "email_on_retry": False,
-    "retries": 2,
-    "retry_delay": timedelta(minutes=5),
+    # Retries default 2 (produksi). Dapat di-override via env, mis. `-e SICABE_DAG_RETRIES=0`
+    # pada `airflow dags test` — penting agar uji/uji-E2E TIDAK menggantung menunggu retry
+    # saat task GE gagal (mis. DAG #1 pada cold start: entitas gold belum ada di OM).
+    "retries": int(os.getenv("SICABE_DAG_RETRIES", "2")),
+    "retry_delay": timedelta(seconds=int(os.getenv("SICABE_DAG_RETRY_DELAY_SECONDS", "300"))),
     "execution_timeout": timedelta(hours=2),
 }
 

deploy/config/environment.defaults.sh

@@ -210,6 +210,10 @@ export TRINO_SVC_SEED_PASSWORD="${TRINO_SVC_SEED_PASSWORD:-svc_seed_dev}"
 export TRINO_SVC_DBT_PASSWORD="${TRINO_SVC_DBT_PASSWORD:-svc_dbt_dev}"
 export TRINO_SVC_AIRFLOW_PASSWORD="${TRINO_SVC_AIRFLOW_PASSWORD:-svc_airflow_dev}"
 export TRINO_SVC_OM_PASSWORD="${TRINO_SVC_OM_PASSWORD:-svc_om_dev}"
+# Kunci HMAC tetap untuk `state` OAuth2 Trino (HMAC-SHA256). Default Trino = ACAK tiap start
+# → sesi login OAuth2 yg sedang berjalan batal bila coordinator restart. Set tetap (acak per
+# instalasi) agar stabil. Dipakai config-coordinator.properties lewat ${ENV:TRINO_OAUTH_STATE_KEY}.
+export TRINO_OAUTH_STATE_KEY="${TRINO_OAUTH_STATE_KEY:-trino-oauth-state-dev-only}"
 
 # ─── StarRocks (Phase 4 — Serving) ──────────────────────────────────────────
 export STARROCKS_VERSION="${STARROCKS_VERSION:-4.0.13}"

deploy/config/prometheus/targets/node.yml

@@ -23,9 +23,6 @@
 - targets: ["host.docker.internal:9100"]
   labels:
     host: local
-- targets: ["100.123.123.71:9100"]
-  labels:
-    host: darkworld
 
 # Contoh penambahan host (hapus komentar):
 # - targets: ["10.20.0.11:9100"]

deploy/config/trino/config-coordinator.properties

@@ -42,13 +42,19 @@ http-server.process-forwarded=${ENV:TRINO_PROCESS_FORWARDED}
 # Kalau di-hardcode, issuer di klaster multi-host tidak cocok dan token ditolak.
 http-server.authentication.oauth2.issuer=${ENV:KEYCLOAK_PUBLIC_URL}/realms/sicabe
 # Matikan OIDC discovery — Trino tidak bisa mengakses URL publik dari dalam container.
-# Endpoint di-set manual: browser pakai URL publik, server-ke-server pakai keycloak:8080.
+# Endpoint di-set manual: browser pakai URL publik (auth-url); server-ke-server (token/jwks)
+# pakai KEYCLOAK_HOST:INTERNAL_PORT — di multi-host dgn Keycloak EKSTERNAL ini = ALAMAT host
+# pemilik (mis. 100.93.54.108:12080). JANGAN literal `keycloak` (nama container, tak resolve
+# di host lain → penukaran token gagal → "Authentication response could not be verified").
 http-server.authentication.oauth2.oidc.discovery=false
 # Endpoint browser-facing (auth redirect) — harus URL publik juga
 http-server.authentication.oauth2.auth-url=${ENV:KEYCLOAK_PUBLIC_URL}/realms/sicabe/protocol/openid-connect/auth
 # Endpoint server-side (token exchange & JWKS) — reachable dari container
-http-server.authentication.oauth2.token-url=http://keycloak:${ENV:KEYCLOAK_INTERNAL_PORT}/realms/sicabe/protocol/openid-connect/token
-http-server.authentication.oauth2.jwks-url=http://keycloak:${ENV:KEYCLOAK_INTERNAL_PORT}/realms/sicabe/protocol/openid-connect/certs
+http-server.authentication.oauth2.token-url=http://${ENV:KEYCLOAK_HOST}:${ENV:KEYCLOAK_INTERNAL_PORT}/realms/sicabe/protocol/openid-connect/token
+http-server.authentication.oauth2.jwks-url=http://${ENV:KEYCLOAK_HOST}:${ENV:KEYCLOAK_INTERNAL_PORT}/realms/sicabe/protocol/openid-connect/certs
+# Kunci HMAC tetap untuk `state` OAuth2 (default Trino = acak tiap coordinator start →
+# sesi login batal saat restart). Nilai acak-per-instalasi dari .env.
+http-server.authentication.oauth2.state-key=${ENV:TRINO_OAUTH_STATE_KEY}
 http-server.authentication.oauth2.client-id=trino
 http-server.authentication.oauth2.client-secret=${ENV:TRINO_CLIENT_SECRET}
 # Username Trino = preferred_username (bukan 'sub') agar cocok dengan uid LDAP