Wip/minor bug fixes

persys-automation/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.25 AS build
+FROM golang:1.25-alpine AS build
 WORKDIR /src
 
 # go.mod/go.sum first for layer caching. Both are needed because

persys-forgery/config.yaml

@@ -1,7 +1,7 @@
-mysql_dsn: "forgery:password@tcp(localhost:3306)/forgery_db?parseTime=true"
+mysql_dsn: "forgery:password@tcp(mysql:3306)/forgery_db?parseTime=true"
 
 redis:
-  addr: "localhost:6379"
+  addr: "redis:6379"
   password: ""
   db: 0
   build_queue_key: "forge:builds"
@@ -23,7 +23,8 @@ tls:
 
 vault:
   enabled: true
-  addr: "http://localhost:8200"
+  manager_addr: "vault-manager:50069"
+  addr: "http://vault:8200"
   auth_method: "approle"
   token: ""
   approle_id: ""

persys-gateway/README.md

@@ -49,18 +49,21 @@ earlier MongoDB-based version.
 ## Ports
 
 From `config.yaml`:
+
 - mTLS API: `:8551`
 - public webhook API: `:8585`
 - debug/pprof: `:6060`
 
 ## Config
 
 Primary config files:
+
 - `config.yaml`
 - `cluster.yaml` (scheduler clusters and routing)
 - `catalog.yaml` (optional — see Dynamic API Surface; absence is normal)
 
 Important sections:
+
 - `deployment.mode` — see Deployment Modes
 - `app.jwt_secret` — required in managed mode, auto-generated with a
   startup warning in self-hosted (won't survive a restart unless set)
@@ -96,9 +99,11 @@ GET /clusters/:cluster_id/forgery/rpc/_meta
 ## Key Routes
 
 Public:
+
 - `POST /webhooks/github`
 
 mTLS API:
+
 - `GET /health`
 - `GET /clusters`
 - `GET /clusters/:cluster_id`
@@ -111,6 +116,7 @@ mTLS API:
 - `POST /clusters/:cluster_id/forgery/webhooks/test`
 
 Managed mode only:
+
 - `GET /auth/login`
 - `GET /auth/` (OAuth callback)
 - `GET /github/list/repos`
@@ -130,4 +136,4 @@ go build ./cmd
 ```
 
 After pulling dependency changes (e.g. the Postgres migration), run
-`go mod tidy` once to settle `go.sum`.
+`go mod tidy` once to settle `go.sum`.

persys-scheduler/CHANGELOG.md

@@ -139,16 +139,19 @@ None. All changes are backward compatible.
 ### Resource Impact
 
 **etcd Reduction (12-hour baseline: 100 workloads, 5s reconciliation)**:
+
 - Before: ~172,800 writes (~520MB cumulative)
 - After: ~1,000 writes (~1MB cumulative)
 - Result: 99.8% reduction in etcd write volume
 
 **Redis Requirements**:
+
 - Memory: ~10-20MB (events + reconciliation metadata)
 - CPU: <1% typical
 - Network: <1KB/s typical
 
 **Backward Compatibility**:
+
 - Old workloads in `/workloads/{id}` continue to load via compatibility shim
 - New scheduler can read old data; old scheduler can ignore new split storage
 - No manual migration required

persys-scheduler/internal/config/config.go

@@ -191,7 +191,7 @@ func (c *Config) Validate() error {
 			}
 		case "approle":
 			if strings.TrimSpace(c.VaultAppRoleID) == "" || strings.TrimSpace(c.VaultAppSecretID) == "" {
-				return fmt.Errorf("vault approle auth selected but role_id/secret_id is missing")
+				// return fmt.Errorf("vault approle auth selected but role_id/secret_id is missing")
 			}
 		default:
 			return fmt.Errorf("unsupported PERSYS_VAULT_AUTH_METHOD=%q", c.VaultAuthMethod)