Running devops-app locally
Start the console against a local devops-service, and understand what it can and cannot reach from a laptop.
devops-app is a Next.js app with no backend of its own. Every view is a devops-service call, so
the console declares that service as a dependency and starting one starts both.
./localenv up devops-appThat serves the console on http://localhost:3500 and devops-service on 3800, with
DEVOPS_SERVICE_URL already pointing at it. DEV_AUTH=1 on the service side skips Cloudflare
verification and treats the caller as an admin, and DEVOPS_PG_US_CORE points at the local Docker
Postgres. Both are set in services/devops/process-compose.yaml;
make dev-devops sets the same values for the service on its own.
Safari and Chrome can install the console on the home screen. The icon and splash screens live under frontend/devops-app/public/image/pwa.
Kubernetes login is an AKS URL plus an Azure AD service principal per subscription, which is not part of the local defaults. See services/devops/.env.example and how environment variables map to a scope.
Before opening a pull request:
cd frontend/devops-app
pnpm lint
pnpm buildWhat works from a laptop
A scope only works if the machine running devops-service can reach its infrastructure.
| View | Needs |
|---|---|
| Services | Nothing — the catalog is a committed file |
| Resources | Nothing — the links are a committed YAML file |
| Outbox, Database | A reachable Postgres for that subscription |
| Containers, Deployments | A kubeconfig that can reach that cluster |
| Service Bus | An Azure login with read and peek on that namespace |
A subscription whose credentials are not provisioned is still listed, marked as not ready. Each view says what it could not reach rather than rendering an empty page, so a missing credential looks like a missing credential.
Authentication
In a deployment, both the app and the service sit behind the same Cloudflare Access application and
the Access cookie is the credential. Locally, DEV_AUTH=1 on the service side stands in for it and
grants the admin role, which is what makes the terminal and rollback reachable in development.
Because it always grants admin, the two narrower roles cannot be reproduced locally. The engineer
role is the address lists in config.<env>.yaml, and a viewer is an authenticated address on
neither list — both only resolve behind real Cloudflare Access. To see what a viewer sees, read the
gate in the code or the role tables on the
service architecture page.