Declarative config: seed org integrations, projects and roles from server config

[0x0f0f0f]

Our self-hosted hub gets config almost entirely from env vars (MARIMOHUB_*), which works well with our deployment setup, but three things still require a signed-in super admin clicking the UI (or driving the API with a personal PAT): org integrations, projects + member roles, and initial git-source notebooks.

Current options that need manual interaction break infra-as-code deployments, a fresh marimohub deploy (disaster recovery, new stage, ephemeral envs) cannot converge to a working state without a human in the loop.

(the PAT alternative is not automation-safe, PATs are minted in browser, user-bound and unscoped (same as #184 chat).

Proposal: a seed applied at boot, e.g. env vars for all the values, or a yaml file, or config extensions declaring:

• org integrations (kind, name, config, secrets by env-var so the file stays committable),
• projects with member roles (emails, same resolution as MARIMOHUB_SUPER_ADMINS),
• optionally git-source notebooks (repo/branch/entry/sync_mode).

For our use case we would really want marimohub to scan and pick up all the notebooks in all the (whitelisted/not blacklisted) repos in our github org!

It should probably be an idempotent upsert on each boot

(Claude suggsts: ETag-aware, like the documented If-Match automation flow); seed-owned objects marked as such; UI edits to seed-owned objects either blocked or drift-flagged — maintainer's call. MARIMOHUB_SUPER_ADMINS is already exactly this pattern for one role; this generalizes it.)

Happy to contribute the PR if you agree!

[mscolnick]

Going through the endpoints is probably the safest and most correct. I think a self-owned seed-script is the most ideal, but you are right getting a token is not doable programatically.

Is there any prior art for other platforms? I feel like building this inside marimohub is a hard one-size-fits-all model and probably better to just run a script to make http requests to the running server

[0x0f0f0f]

i see.

maybe doing this via the marimohub cli?

so the seed script becomes a shell script?

[0x0f0f0f]

For integrations i think a JSON/YAML would be of the highest value (bc a user-level script shouldn't have the idempotent upsert logic, too easy to break)

integrations:
  - kind: iceberg_rest
    name: lake          # load_catalog("lake") — renaming breaks notebooks
    config:
      uri: https://…/catalog
      warehouse: …
      auth:
        method: bearer_token
        token:
          $secret: { kind: reference, backend: env, locator: MARIMOHUB_LAKE_CATALOG_TOKEN }
      access_delegation: vended_credentials

[0x0f0f0f]

Also an explicit git source list would be cool (possibly to glob all repos in an org? e.g. github.com/org/*)

notebooks:
  - project: wiki
    repo: our-org/wiki
    branch: main
    entry: content/foo/bar.md
    sync_mode: pull