fix(endpoint-exposer): make install usable and spec tenant-agnostic

[jcastiarena]

Summary

Three related fixes so any tenant can register and use endpoint-exposer by following install/installation.md verbatim. Today the install flow is broken in two independent ways and the spec locks every tenant to an example FQDN. Details below.

Current broken state

1. install/tofu/main.tf doesn't compile against current tofu-modules

The module call uses input names that were removed from nullplatform/tofu-modules in v1.52.x:

Old (used by this PR's parent commit)	Current API
git_repo	repository_org + repository_name
git_ref	repository_branch
git_service_path	service_path
use_tpl_files	(removed — the module no longer renders templates)
git_password	repository_token

Reproduction (exactly what installation.md tells tenants to do):

git clone https://github.com/nullplatform/services /root/.np/nullplatform/services
git clone https://github.com/nullplatform/tofu-modules /root/.np/nullplatform/tofu-modules
cd /root/.np/nullplatform/services/endpoint-exposer/install/tofu
cp terraform.tfvars.example terraform.tfvars  # fill in values
tofu init -backend-config=...
tofu plan

Result:

Error: Unsupported argument
  on main.tf line 13, in module "service_definition":
  13:   git_repo = var.git_repo
An argument named "git_repo" is not expected here.

…repeated for git_ref, git_service_path, use_tpl_files, git_password. Five errors, zero successful plans.

Additionally, install/tofu/main.tf passed agent_command and workflow_override_path to service_definition_agent_association — neither is accepted by that module today. The module constructs the cmdline automatically as ${base_clone_path}/${repository_service_spec_repo}/${service_path}/entrypoint/entrypoint and exposes agent_arguments for flags.

2. Hardcoded domain enums in the spec lock every tenant to an example FQDN

install/specs/service-spec.json.tpl had:

"publicDomain": {
  "enum": ["hello.idp.poc.nullapps.io"],
  "type": "string",
  ...
}

…repeated for privateDomain and across the duplicated schemas in each action specification (10 enum blocks total). This FQDN is a leftover example from another tenant's POC. With the enum present, the nullplatform UI offered it as the only selectable value — any other tenant (us for galicia, or anyone else) cannot create a scope through the UI because their real FQDN isn't in the enum.

The reorganization of endpoint-exposer under install/ (#3) carried this over unchanged from the previous branch.

3. {{ env.Getenv }} in the spec is dead code

The spec ships with:

"name": "{{ env.Getenv \"SERVICE_NAME\" | default \"Endpoint Exposer\" }}",
"visible_to": ["{{ env.Getenv \"NRN\" }}"],

suggesting those two fields are parametrizable at tofu apply via env vars. They are not. The current service_definition module reads the spec with data "http" + jsondecode() — no template engine anywhere in the pipeline. These fields "work" only because the module overrides them explicitly from TF variables:

resource "nullplatform_service_specification" "from_template" {
  name       = var.service_name                        # not from spec
  visible_to = concat([var.nrn], var.extra_visibile_to_nrns)  # not from spec
  ...
}

Any future author who adds a {{ env.Getenv "MY_FIELD" }} to a field that is not overridden at the TF layer will ship a spec with the literal template string as its value — silently, until a developer opens the scope creation form and sees {{ env.Getenv "MY_FIELD" }} in the UI.

Changes

Spec (install/specs/service-spec.json.tpl)

• Remove the 10 hardcoded domain enums (5 × publicDomain, 5 × privateDomain across the main schema + action specifications).
• Add "description" on both domain fields so developers know what kind of value to provide. Fields are now "type": "string" free-text; the FQDN is typed at scope creation time.
• Replace the {{ env.Getenv "SERVICE_NAME" ... }} template with the literal "Endpoint Exposer" (the TF layer overrides it regardless).
• Replace "visible_to": ["{{ env.Getenv \"NRN\" }}"] with "visible_to": [] (same reasoning; the TF layer sets it from var.nrn).

Install (install/tofu/)

• Migrate main.tf to the current nullplatform/tofu-modules API (repository_org/_name/_branch/service_path/repository_token).
• Drop unsupported args (agent_command, workflow_override_path, service_description) from the agent association module call. Forward --overrides-path=<path> via agent_arguments when overrides are enabled.
• Rename variables to match: split git_repo into repository_org + repository_name, rename git_branch → repository_branch and git_service_path → spec_path. Add agent_service_path so the specs path (includes install/ for this service) and runtime path (just endpoint-exposer) can differ.
• Make github_token optional (default null) — nullplatform/services is public, token is only needed when pointing at a private fork.
• Update terraform.tfvars.example to match.
• Regenerate .terraform.lock.hcl — hashicorp/external and hashicorp/null are no longer transitive dependencies (the old module used them; the new one doesn't).

Docs

• installation.md: new variables table, note on optional github_token, corrected cmdline example (was missing the trailing /entrypoint), new "Domains" section explaining the free-text contract.
• prerequisites.md: updated path-override guidance to the new variable names; clarify github_token is optional for the default spec repo.

Test plan

• tofu fmt -check clean
• tofu init -backend=false && tofu validate succeeds with local clone of current nullplatform/tofu-modules main
• jq -e . install/specs/service-spec.json.tpl parses (no unclosed template braces)
• gomplate -f install/specs/service-spec.json.tpl | jq . produces byte-identical output (idempotent — no templates remain)
• Full end-to-end: apply in a clean nullplatform account and create a scope through the UI. Will be validated on the Banco Galicia POC once this PR is merged (or via apply against the feature branch if we need to unblock sooner).

Notes for reviewers

• The three fixes are independent but share the same root cause: the install flow was designed around a nullplatform/tofu-modules generation that is no longer current, and nobody has exercised the install guide end-to-end since the API changed.
• Commits are split by concern (spec vs. install/docs) to make review easier. Either can be cherry-picked in isolation.
• Removing the domain enum was discussed with @feature/endpoint-exposer authors; the longer-term direction of "reading hosts dynamically from a provider" stays an open design item — this PR just stops pinning the field to an example value in the meantime.

🤖 Generated with Claude Code

[sebastiancorrea81]

lgtm