feat(dashboard api): user/team provisioning handlers

.env.gcp.template

@@ -77,6 +77,10 @@ CLICKHOUSE_CLUSTER_SIZE=1
 
 # Dashboard API instance count (default: 0)
 DASHBOARD_API_COUNT=
+# Additional non-reserved dashboard-api env vars passed directly to the Nomad job (default: {})
+# Reserved keys managed by the module cannot be overridden here.
+# Example: '{"AUTH_USER_SYNC_BACKGROUND_WORKER_ENABLED":"true"}'
+DASHBOARD_API_ENV_VARS=
 
 # Filestore cache for builds shared across cluster (default:false)
 FILESTORE_CACHE_ENABLED=

iac/modules/job-dashboard-api/jobs/dashboard-api.hcl

@@ -71,20 +71,9 @@ job "dashboard-api" {
       }
 
       env {
-        GIN_MODE                               = "release"
-        ENVIRONMENT                            = "${environment}"
-        NODE_ID                                = "$${node.unique.id}"
-        PORT                                   = "$${NOMAD_PORT_api}"
-        POSTGRES_CONNECTION_STRING             = "${postgres_connection_string}"
-        AUTH_DB_CONNECTION_STRING              = "${auth_db_connection_string}"
-        AUTH_DB_READ_REPLICA_CONNECTION_STRING = "${auth_db_read_replica_connection_string}"
-        CLICKHOUSE_CONNECTION_STRING           = "${clickhouse_connection_string}"
-        SUPABASE_JWT_SECRETS                   = "${supabase_jwt_secrets}"
-        REDIS_URL                              = "${redis_url}"
-        REDIS_CLUSTER_URL                      = "${redis_cluster_url}"
-        REDIS_TLS_CA_BASE64                    = "${redis_tls_ca_base64}"
-        OTEL_COLLECTOR_GRPC_ENDPOINT           = "${otel_collector_grpc_endpoint}"
-        LOGS_COLLECTOR_ADDRESS                 = "${logs_collector_address}"
+        %{ for key in sort(keys(env)) ~}
+        ${key} = "${env[key]}"
+        %{ endfor ~}
       }
 
       config {

iac/modules/job-dashboard-api/main.tf

@@ -1,27 +1,54 @@
+locals {
+  base_env = {
+    GIN_MODE                               = "release"
+    ENVIRONMENT                            = var.environment
+    NODE_ID                                = "$${node.unique.id}"
+    PORT                                   = "$${NOMAD_PORT_api}"
+    POSTGRES_CONNECTION_STRING             = var.postgres_connection_string
+    AUTH_DB_CONNECTION_STRING              = var.auth_db_connection_string
+    AUTH_DB_READ_REPLICA_CONNECTION_STRING = var.auth_db_read_replica_connection_string
+    CLICKHOUSE_CONNECTION_STRING           = var.clickhouse_connection_string
+    SUPABASE_JWT_SECRETS                   = var.supabase_jwt_secrets
+    REDIS_URL                              = var.redis_url
+    REDIS_CLUSTER_URL                      = var.redis_cluster_url
+    REDIS_TLS_CA_BASE64                    = var.redis_tls_ca_base64
+    OTEL_COLLECTOR_GRPC_ENDPOINT           = "localhost:${var.otel_collector_grpc_port}"
+    LOGS_COLLECTOR_ADDRESS                 = "http://localhost:${var.logs_proxy_port.port}"
+  }
+
+  extra_env = {
+    for key, value in var.extra_env : key => value
+    if value != null && trimspace(value) != ""
+  }
+
+  conflicting_extra_env_keys = sort(tolist(setintersection(
+    toset(keys(local.base_env)),
+    toset(keys(local.extra_env)),
+  )))
+
+  env = merge(local.base_env, local.extra_env)
+}
+
 resource "nomad_job" "dashboard_api" {
   jobspec = templatefile("${path.module}/jobs/dashboard-api.hcl", {
     update_stanza = var.update_stanza
     node_pool     = var.node_pool
     image_name    = var.image
-    environment   = var.environment
 
     count = var.count_instances
 
     memory_mb = 512
     cpu_count = 1
 
-    postgres_connection_string             = var.postgres_connection_string
-    auth_db_connection_string              = var.auth_db_connection_string
-    auth_db_read_replica_connection_string = var.auth_db_read_replica_connection_string
-    clickhouse_connection_string           = var.clickhouse_connection_string
-    supabase_jwt_secrets                   = var.supabase_jwt_secrets
-    redis_url                              = var.redis_url
-    redis_cluster_url                      = var.redis_cluster_url
-    redis_tls_ca_base64                    = var.redis_tls_ca_base64
+    env = local.env
 
     subdomain = "dashboard-api"
-
-    otel_collector_grpc_endpoint = "localhost:${var.otel_collector_grpc_port}"
-    logs_collector_address       = "http://localhost:${var.logs_proxy_port.port}"
   })
+
+  lifecycle {
+    precondition {
+      condition     = length(local.conflicting_extra_env_keys) == 0
+      error_message = "dashboard-api extra_env contains reserved keys: ${join(", ", local.conflicting_extra_env_keys)}"
+    }
+  }
 }

iac/modules/job-dashboard-api/variables.tf

@@ -44,6 +44,11 @@ variable "supabase_jwt_secrets" {
   sensitive = true
 }
 
+variable "extra_env" {
+  type    = map(string)
+  default = {}
+}
+
 variable "otel_collector_grpc_port" {
   type    = number
   default = 4317

iac/provider-gcp/Makefile

@@ -76,6 +76,7 @@ tf_vars := \
 	$(call tfvar, LOKI_BOOT_DISK_TYPE) \
 	$(call tfvar, LOKI_USE_V13_SCHEMA_FROM) \
 	$(call tfvar, DASHBOARD_API_COUNT) \
+	$(call tfvar, DASHBOARD_API_ENV_VARS) \
 	$(call tfvar, DEFAULT_PERSISTENT_VOLUME_TYPE) \
 	$(call tfvar, PERSISTENT_VOLUME_TYPES) \
 	$(call tfvar, DB_MAX_OPEN_CONNECTIONS) \

iac/provider-gcp/main.tf

@@ -264,7 +264,8 @@ module "nomad" {
   otel_collector_resources_cpu_count = var.otel_collector_resources_cpu_count
 
   # Dashboard API
-  dashboard_api_count = var.dashboard_api_count
+  dashboard_api_count    = var.dashboard_api_count
+  dashboard_api_env_vars = var.dashboard_api_env_vars
 
   # Docker reverse proxy
   docker_reverse_proxy_port                = var.docker_reverse_proxy_port

iac/provider-gcp/nomad/main.tf

@@ -138,6 +138,7 @@ module "dashboard_api" {
   redis_url                              = local.redis_url
   redis_cluster_url                      = local.redis_cluster_url
   redis_tls_ca_base64                    = trimspace(data.google_secret_manager_secret_version.redis_tls_ca_base64.secret_data)
+  extra_env                              = var.dashboard_api_env_vars
 
   otel_collector_grpc_port = var.otel_collector_grpc_port
   logs_proxy_port          = var.logs_proxy_port

iac/provider-gcp/nomad/variables.tf

@@ -453,6 +453,11 @@ variable "dashboard_api_count" {
   default = 0
 }
 
+variable "dashboard_api_env_vars" {
+  type    = map(string)
+  default = {}
+}
+
 variable "volume_token_issuer" {
   type = string
 }

iac/provider-gcp/variables.tf

@@ -228,6 +228,11 @@ variable "dashboard_api_count" {
   default = 0
 }
 
+variable "dashboard_api_env_vars" {
+  type    = map(string)
+  default = {}
+}
+
 variable "docker_reverse_proxy_port" {
   type = object({
     name        = string

packages/api/go.mod

@@ -35,7 +35,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/grafana/loki/v3 v3.6.4
 	github.com/hashicorp/nomad/api v0.0.0-20251216171439-1dee0671280e
-	github.com/jackc/pgx/v5 v5.7.5
+	github.com/jackc/pgx/v5 v5.9.1
 	github.com/launchdarkly/go-sdk-common/v3 v3.3.0
 	github.com/launchdarkly/go-server-sdk/v7 v7.13.0
 	github.com/oapi-codegen/gin-middleware v1.0.2
@@ -381,7 +381,7 @@ require (
 	golang.org/x/crypto v0.48.0 // indirect
 	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
 	golang.org/x/image v0.38.0 // indirect
-	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/text v0.35.0 // indirect

packages/auth/go.mod

@@ -62,7 +62,7 @@ require (
 	github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.7.5 // indirect
+	github.com/jackc/pgx/v5 v5.9.1 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jellydator/ttlcache/v3 v3.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect

packages/clickhouse/go.mod

@@ -39,7 +39,7 @@ require (
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.7.5 // indirect
+	github.com/jackc/pgx/v5 v5.9.1 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
@@ -93,7 +93,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/crypto v0.48.0 // indirect
 	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
-	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/net v0.50.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect

packages/client-proxy/go.mod

@@ -65,7 +65,7 @@ require (
 	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
-	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/net v0.50.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect

packages/dashboard-api/Makefile

@@ -13,32 +13,35 @@ endif
 HOSTNAME := $(shell hostname 2> /dev/null || hostnamectl hostname 2> /dev/null)
 $(if $(HOSTNAME),,$(error Failed to determine hostname: both 'hostname' and 'hostnamectl' failed))
 
+define export_extra_env
+export $$(printf '%s' "$$DASHBOARD_API_ENV_VARS" | jq -r '(if .=="" then empty elif type=="string" then (fromjson? // empty) else . end) | to_entries? // [] | map("\(.key)=\(.value|tostring)") | .[]' 2>/dev/null) 2>/dev/null;
+endef
+
 .PHONY: generate
 generate:
 	go generate ./...
 
 .PHONY: build
 build:
-	# Allow for passing commit sha directly for docker builds
 	$(eval COMMIT_SHA ?= $(shell git rev-parse --short HEAD))
 	$(eval EXPECTED_MIGRATION_TIMESTAMP ?= $(expectedMigration))
 	CGO_ENABLED=0 go build -o bin/dashboard-api -ldflags "-X=main.commitSHA=$(COMMIT_SHA) -X=main.expectedMigrationTimestamp=$(EXPECTED_MIGRATION_TIMESTAMP)" .
 
 .PHONY: build-and-upload
 build-and-upload:
-		$(eval COMMIT_SHA := $(shell git rev-parse --short HEAD))
-		$(eval EXPECTED_MIGRATION_TIMESTAMP := $(expectedMigration))
-		@ docker build --platform linux/amd64 --tag $(IMAGE_REGISTRY) --push --build-arg COMMIT_SHA="$(COMMIT_SHA)" --build-arg EXPECTED_MIGRATION_TIMESTAMP="$(EXPECTED_MIGRATION_TIMESTAMP)"  -f ./Dockerfile ..
+	$(eval COMMIT_SHA := $(shell git rev-parse --short HEAD))
+	$(eval EXPECTED_MIGRATION_TIMESTAMP := $(expectedMigration))
+	@docker build --platform linux/amd64 --tag $(IMAGE_REGISTRY) --push --build-arg COMMIT_SHA="$(COMMIT_SHA)" --build-arg EXPECTED_MIGRATION_TIMESTAMP="$(EXPECTED_MIGRATION_TIMESTAMP)" -f ./Dockerfile ..
 
 .PHONY: run
 run:
 	make build
-	./bin/dashboard-api
+	@$(export_extra_env) ./bin/dashboard-api
 
 .PHONY: run-local
 run-local:
 	make build
-	NODE_ID=$(HOSTNAME) ./bin/dashboard-api
+	@$(export_extra_env) NODE_ID=$(HOSTNAME) ./bin/dashboard-api
 
 .PHONY: test
 test: