--- id: CORE-WP-0011 type: workplan title: "Relocate Core Hub production from CoulombCore to railiance01" domain: infotech repo: core-hub status: active owner: codex topic_slug: infotech created: "2026-08-20" updated: "2026-08-20" parent_project: prj-state-hub-retirement parent_workplan: SHR-WP-0002 related: - CORE-WP-0005 - CORE-WP-0007 - CORE-WP-0010 - HUB-WP-0004 --- # Relocate Core Hub production from CoulombCore to railiance01 ## Goal Move the existing Core Hub production service at `hub.coulomb.social` from CoulombCore to railiance01 before CoulombCore is decommissioned. Preserve the current `/api/v2` contract, data, hostname, credentials boundary, and rollback evidence. Do not make runtime absorption into hub-core a prerequisite. ## Decision and constraints - Use the interim-move shape requested by `SHR-WP-0002-T03`: package and move Core Hub as-is, then resolve long-term absorption under `CORE-WP-0010` and `HUB-WP-0004` on their own architecture schedule. - Use the governed Repo Manager rapp path. Because the live deployment truth is a Helm chart, initialize a managed package instead of asking `rapp wrap` to invent or ingest Helm content; retain this repo's manifests as source evidence until the package is verified. - Treat the CoulombCore decommission date as a scheduling input, not as a reason to collapse the hub-core library-vs-thin-host decision. - Any traffic flip, final data freeze/transfer, or old-runtime removal requires explicit operator approval and a rehearsed rollback. ## Inventory source and target runtime ```task id: CORE-WP-0011-T01 status: progress priority: high ``` Capture the live CoulombCore image, Deployment, Service, Ingress, database, secret references, resource policy, and tunnel/DNS ownership. Compare them to railiance01 and the checked-in `k8s/railiance-production/` manifests. Local review on 2026-08-20 confirms that the repo already carries a namespace, migration Job, API Deployment, Service, Ingress, health probes, and the historical migration/cutover runbook. The manifests need a live-state diff and modern platform-policy review before reuse. The retirement project reports no `core-hub` namespace or Deployment on railiance01. A read-only preflight on 2026-08-20 confirmed the current Kubernetes context reaches the Ready k3s node `239.62.205.92.host.secureserver.net` (`92.205.62.239`, Kubernetes `v1.35.1+k3s1`), has no `core-hub` namespace or resources, and retains an `inter-hub` namespace. Pin the CoulombCore decommission date while this task is in progress so later gates have explicit deadlines. The retirement deadline is now pinned to **2026-08-31** (11 days from workplan creation). Source-cluster live state and target platform-policy comparison remain open. The registry audit found that production/staging manifests, runbooks, and Forgejo CI already publish and pull `forgejo.coulomb.social/coulomb/core-hub`, but the local Makefile default and deployed-smoke evidence still named the CoulombCore-hosted Gitea registry. Those two active references were changed to Forgejo on 2026-08-20. The only remaining Gitea image reference is historical evidence in finished `CORE-WP-0004`; confirm the live source Deployment image and digest before declaring the dependency closed. An attended source-cluster inventory remains required. On 2026-08-20 the CoulombCore kubeconfig pointed at the documented local API port `16443`, but the tunnel was down; the current ops-bridge config no longer contains `k3s-api-coulombcore`. The sanctioned warden signer route was followed, but its credential broker requires an operator-held OpenBao issuer login unavailable to this non-interactive session. No alternate credential path was attempted. After operator login, collect metadata-only Deployment/Service/Ingress, image digest, Secret names and keys (never values), database target, resource policy, and Helm revision evidence before closing this task. ## Build the relocatable application package ```task id: CORE-WP-0011-T02 status: done priority: high ``` Wrap the current service through the governed rapp path. Pin the source revision and image digest, express namespace/runtime/database/secret dependencies without credential values, and add render/package checks. Reuse the current container and `/healthz`, `/readyz`, and deployed-smoke surfaces. Done when the package renders deterministically, policy checks pass, and its rendered workload is equivalent to the live service except for documented railiance01 platform adaptations. Completed locally on 2026-08-20 in `/home/worsch/rapp-core-hub`. Repo Manager initialized a Helm-managed package because the live deployment truth is the existing `railiance-apps/charts/core-hub` chart; `rmgr rapp wrap` deliberately refuses to invent or ingest Helm charts. The package absorbs that chart and adds an immutable Forgejo digest pin, safe-private Ingress default, non-root/read-only security contexts, ServiceAccount hardening, default-deny/DNS/Postgres/Traefik NetworkPolicies, deterministic render, Alembic migration, live smoke, and Helm rollback surfaces. Evidence: - package tests: 5 passed; - Helm lint: passed; - family validator: 4 declarations ok; - railiance01 Helm/Kubernetes server dry-run: passed; - current image pin: `sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c`. Published and registered on 2026-08-20 after the operator created the Forgejo stub. Local history was attached without discarding either root. Private Forgejo `main` now includes credential-contract release commit `03effc8`. Chart `0.3.0` separates the static API-token Secret from runtime and migration database lease Secrets and supervises the application through mounted-file rotation; seven tests prove separation, safe URL construction, no credential output, and restart signaling. State Hub registers active repo `rapp-core-hub` as `445ea292-70bb-435c-8c69-c4cb57a6985b`, with the `bnt-lap001:/home/worsch/rapp-core-hub` host path, the canonical stub-root Git fingerprint, and Core Hub's topic ID. The package uses registered workplan prefix `RAPPCOREHUB-WP-`; consistency passes with only the expected warning that this workstation is not the production workplan-UUID registrar. ## Deploy shadow runtime and rehearse data transfer ```task id: CORE-WP-0011-T03 status: todo priority: high ``` Provision the railiance01 namespace, database role/database, governed secret delivery, migration Job, Deployment, and Service without moving production traffic. Rehearse backup/restore or logical transfer from CoulombCore, compare table and row counts, and run public plus authenticated consumer smokes against the private target endpoint. Done when the shadow runtime is healthy, data reconciliation is repeatable, and ops-hub plus activity-core smokes pass against railiance01. ## Cut over production traffic ```task id: CORE-WP-0011-T04 status: todo priority: high ``` With explicit operator approval, freeze writes for the bounded final-transfer window, transfer and reconcile the final data, then move `hub.coulomb.social` and the active ops-bridge tunnel from CoulombCore to railiance01. Verify TLS, health/readiness, public catalogs, protected routes, operator console, consumer smokes, and the first post-cutover write. Rollback must restore the prior traffic/tunnel target and database write path; the old runtime stays intact until stabilization closes. ## Stabilize and release CoulombCore dependencies ```task id: CORE-WP-0011-T05 status: todo priority: high ``` Run a time-bounded stabilization window with scheduled health and consumer checks. After operator sign-off, remove Core Hub from the CoulombCore shutdown critical path, retire `core-hub-staging` and any obsolete tunnel there, and record retained backup/rollback evidence and residual owners. Do not archive this repo unless the separate absorption workplan has also completed. ## Acceptance - [ ] Decommission deadline and live source/target inventory are recorded - [x] Governed rapp package renders and passes policy checks - [ ] Shadow restore/reconciliation and consumer smokes pass on railiance01 - [ ] Production traffic and tunnel move with explicit approval and rollback - [ ] Stabilization passes and CoulombCore no longer hosts Core Hub dependencies - [ ] `CORE-WP-0010` remains independently sequenced behind `HUB-WP-0004`