coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document and wrap coulomb-social-env secret script

Browse source 
Point operators at railiance-apps create-coulomb-social-env-secret.sh
via scripts/create-env-secret.sh for production Secret assembly.
This commit is contained in:
tegwick 2026-08-09 02:04:33 +02:00
parent 44439f8d8d
commit c71fb0fda9
3 changed files with 40 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/deploy.md
View file

@ -8,13 +8,26 @@ railiance01 (same lane as `vergabe-teilnahme`).
## Runtime secrets (names only)
| Secret | Consumer |
|--------|----------|
| `SECRET_KEY` | Django |
| `DATABASE_URL` | Django |
| `OIDC_CLIENT_SECRET` | identity app |
| future DB password | OpenBao dynamic/KV |
K8s Secret `coulomb-social-env` in namespace `coulomb-social` (chart `envFrom`):
| Key | Source |
|-----|--------|
| `SECRET_KEY` | generated by env-secret script |
| `DATABASE_URL` | cnpg app role secret (URL-encoded password) |
| `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` |
```bash
# from railiance-apps:
make coulomb-social-env-secret-dry-run
make coulomb-social-env-secret
# from this repo:
./scripts/create-env-secret.sh --dry-run
./scripts/create-env-secret.sh
```
Script: `railiance-apps/tools/create-coulomb-social-env-secret.sh`
OIDC is a **public** client — no client secret.
## Health
- `GET /healthz` → `{"status":"ok"}`

11
docs/dev.md
View file

@ -67,3 +67,14 @@ make run
Sign-in redirects to Authelia (`auth.coulomb.social`) + MFA via privacyIDEA.
See `docs/adr/ADR-0001-netkingdom-identity.md` and `docs/identity/`.
### Cluster env Secret (production)
```bash
# dry-run (key names only)
./scripts/create-env-secret.sh --dry-run
# apply (needs kubectl + cluster access)
./scripts/create-env-secret.sh
```
Delegates to `railiance-apps/tools/create-coulomb-social-env-secret.sh`.

10
scripts/create-env-secret.sh Executable file
View file

@ -0,0 +1,10 @@
#!/usr/bin/env bash
# Thin wrapper: env-secret lives in railiance-apps (operator deploy surface).
set -euo pipefail
SCRIPT="${RAILIANCE_APPS_DIR:-$HOME/railiance-apps}/tools/create-coulomb-social-env-secret.sh"
if [[ ! -f "$SCRIPT" ]]; then
echo "ERROR: not found: $SCRIPT" >&2
echo "Clone railiance-apps or set RAILIANCE_APPS_DIR." >&2
exit 1
fi
exec bash "$SCRIPT" "$@"