Finish CSOC-WP-0003 and CSOC-WP-0004; residual intakes for Case B
Close self-registration workplan with Case A proven and Create account entry implemented; park public registration enablement and identity negatives as CSOC-IN-0001/0002. Complete app-shell workplan with T06 operator runbook (seed, bind, webhook, smoke) and smoke doc updates.
This commit is contained in:
parent
61de4a8165
commit
edfdd79208
13 changed files with 440 additions and 105 deletions
|
|
@ -26,3 +26,9 @@ USER_ENGINE_EXPECTED_AUDIENCE=user-engine-portal
|
|||
# USER_ENGINE_BASE_URL=https://users.92-205-62-239.nip.io
|
||||
# USER_ENGINE_PROXY_SECRET= # from OpenBao / kubectl user-engine-runtime — never commit
|
||||
# FLEX_AUTH_BASE_URL=
|
||||
|
||||
# --- Space content (Forgejo / ADR-0002) ---
|
||||
# FORGEJO_BASE_URL=https://forgejo.coulomb.social
|
||||
# FORGEJO_TOKEN= # optional; private repos only — never commit
|
||||
# FORGEJO_WEBHOOK_SECRET= # optional push webhook — never commit
|
||||
# SPACE_CONTENT_FIXTURE_ROOT= # optional offline fixture root for tests
|
||||
|
|
|
|||
|
|
@ -71,12 +71,14 @@ The rebuild is deliberately **product-faithful first**: UI and content parity ma
|
|||
|
||||
- `GOAL.md` — operator bootstrap note for this repo
|
||||
- `SCOPE.md` — in/out boundaries and orientation
|
||||
- `workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md` — **done**: identity shell on app.coulomb.social
|
||||
- `workplans/CSOC-WP-0004-app-shell-and-space-content.md` — **current path**: leave login shell; spaces + Forgejo markdown
|
||||
- `workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md` — **finished**: identity shell on app.coulomb.social
|
||||
- `workplans/CSOC-WP-0003-self-registration-and-assurance.md` — **finished**: Case A + Create account entry; Case B residuals `CSOC-IN-0001`/`0002`
|
||||
- `workplans/CSOC-WP-0004-app-shell-and-space-content.md` — **finished**: app home, spaces, Forgejo markdown, operator runbook
|
||||
- `docs/adr/ADR-0001-netkingdom-identity.md` — accepted identity decision
|
||||
- `docs/adr/ADR-0002-space-content-forgejo-markdown.md` — space content as markdown in Forgejo
|
||||
- `docs/deploy.md` — deploy + spaces operator runbook
|
||||
- `workplans/CSOC-WP-0001-bubble-io-exit-assessment.md` — Bubble inventory/migration **after** product foundation
|
||||
- `workplans/CSOC-WP-0003-self-registration-and-assurance.md` — public registration when NetKingdom mail path lands
|
||||
- `workplans/CSOC-WP-0005-resource-demand-and-cost-evidence.md` — resource evidence for platform cost control
|
||||
- `the-custodian/docs/coulomb-social-rebuild-seed.md` — original workplan seed (CUST-WP-0058-T08)
|
||||
- `the-custodian/canon/standards/business-app-service-contract_v0.1.md`
|
||||
- NetKingdom: IAM Profile, user-engine boundary, KeyCape/Keycloak modes
|
||||
|
|
|
|||
|
|
@ -6,9 +6,10 @@ exiting the stalled bubble.io product.
|
|||
**Hosts:** rebuild at [`app.coulomb.social`](https://app.coulomb.social);
|
||||
apex [`coulomb.social`](https://coulomb.social) remains Bubble until cutover.
|
||||
|
||||
**Current focus:** app shell + spaces with Forgejo-backed markdown content
|
||||
(`CSOC-WP-0004`). Identity shell is done (`CSOC-WP-0002`). Bulk Bubble
|
||||
migration is deferred (`CSOC-WP-0001`).
|
||||
**Current state:** identity + app shell + Forgejo-backed spaces on
|
||||
`app.coulomb.social` (`CSOC-WP-0002`–`0004` finished). Operator runbook:
|
||||
`docs/deploy.md`. Bulk Bubble migration deferred (`CSOC-WP-0001`); public
|
||||
registration Case B waits on NetKingdom (`docs/intakes/csoc-residuals.md`).
|
||||
|
||||
## Quick start
|
||||
|
||||
|
|
|
|||
11
SCOPE.md
11
SCOPE.md
|
|
@ -65,13 +65,14 @@ coulomb.social connects people around shared projects and complementary capabili
|
|||
|
||||
## Current State
|
||||
|
||||
- Status: **parallel hosts** — identity live; product content under construction
|
||||
- **`https://app.coulomb.social`**: Railiance rebuild (OIDC, shell); spaces/content next
|
||||
- Status: **parallel hosts** — identity + app shell + Forgejo spaces live on app.*
|
||||
- **`https://app.coulomb.social`**: Railiance rebuild (OIDC, app home, spaces markdown)
|
||||
- **`https://coulomb.social`**: Bubble.io full product until cutover decision
|
||||
- Active path: **`CSOC-WP-0004`** (spaces metadata + Forgejo markdown content)
|
||||
- Finished product path: **`CSOC-WP-0004`** (spaces + Forgejo markdown + runbook)
|
||||
- Finished identity path: **`CSOC-WP-0002`**, **`CSOC-WP-0003`** (Case A; Case B residual intakes)
|
||||
- Content ADR: `docs/adr/ADR-0002-space-content-forgejo-markdown.md`
|
||||
- Deferred: bulk Bubble migration (`CSOC-WP-0001`); public self-registration (`CSOC-WP-0003` / NK)
|
||||
- Prior art: design extract; CSOC-WP-0002 identity acceptance (2026-08-10)
|
||||
- Operator: `docs/deploy.md` runbook; residuals `docs/intakes/csoc-residuals.md`
|
||||
- Open: bulk Bubble migration (`CSOC-WP-0001`); resource evidence (`CSOC-WP-0005`); public registration residuals (`CSOC-IN-0001`/`0002`, NK-WP-0025)
|
||||
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -9,8 +9,10 @@
|
|||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | CSOC-WP-0001 | active | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md |
|
||||
| workplan | CSOC-WP-0002 | active | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
|
||||
| workplan | CSOC-WP-0003 | active | — | workplans/CSOC-WP-0003-self-registration-and-assurance.md |
|
||||
| workplan | CSOC-WP-0002 | done | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
|
||||
| workplan | CSOC-WP-0003 | finished | — | workplans/CSOC-WP-0003-self-registration-and-assurance.md |
|
||||
| workplan | CSOC-WP-0004 | finished | — | workplans/CSOC-WP-0004-app-shell-and-space-content.md |
|
||||
| workplan | CSOC-WP-0005 | ready | — | workplans/CSOC-WP-0005-resource-demand-and-cost-evidence.md |
|
||||
| task | CSOC-WP-0001-T01 | todo | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md |
|
||||
| task | CSOC-WP-0001-T02 | todo | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md |
|
||||
| task | CSOC-WP-0001-T03 | wait | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md |
|
||||
|
|
@ -24,6 +26,18 @@
|
|||
| task | CSOC-WP-0002-T07 | done | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
|
||||
| task | CSOC-WP-0002-T08 | done | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
|
||||
| task | CSOC-WP-0003-T01 | done | — | workplans/CSOC-WP-0003-self-registration-and-assurance.md |
|
||||
| task | CSOC-WP-0003-T02 | progress | — | workplans/CSOC-WP-0003-self-registration-and-assurance.md |
|
||||
| task | CSOC-WP-0003-T02 | done | — | workplans/CSOC-WP-0003-self-registration-and-assurance.md |
|
||||
| task | CSOC-WP-0003-T03 | done | — | workplans/CSOC-WP-0003-self-registration-and-assurance.md |
|
||||
| task | CSOC-WP-0003-T04 | todo | — | workplans/CSOC-WP-0003-self-registration-and-assurance.md |
|
||||
| task | CSOC-WP-0003-T04 | done | — | workplans/CSOC-WP-0003-self-registration-and-assurance.md |
|
||||
| task | CSOC-WP-0004-T01 | done | — | workplans/CSOC-WP-0004-app-shell-and-space-content.md |
|
||||
| task | CSOC-WP-0004-T02 | done | — | workplans/CSOC-WP-0004-app-shell-and-space-content.md |
|
||||
| task | CSOC-WP-0004-T03 | done | — | workplans/CSOC-WP-0004-app-shell-and-space-content.md |
|
||||
| task | CSOC-WP-0004-T04 | done | — | workplans/CSOC-WP-0004-app-shell-and-space-content.md |
|
||||
| task | CSOC-WP-0004-T05 | done | — | workplans/CSOC-WP-0004-app-shell-and-space-content.md |
|
||||
| task | CSOC-WP-0004-T06 | done | — | workplans/CSOC-WP-0004-app-shell-and-space-content.md |
|
||||
| task | CSOC-WP-0004-T07 | done | — | workplans/CSOC-WP-0004-app-shell-and-space-content.md |
|
||||
| task | CSOC-WP-0005-T01 | todo | — | workplans/CSOC-WP-0005-resource-demand-and-cost-evidence.md |
|
||||
| task | CSOC-WP-0005-T02 | todo | — | workplans/CSOC-WP-0005-resource-demand-and-cost-evidence.md |
|
||||
| task | CSOC-WP-0005-T03 | todo | — | workplans/CSOC-WP-0005-resource-demand-and-cost-evidence.md |
|
||||
| intake | CSOC-IN-0001 | open | blue | docs/intakes/csoc-residuals.md |
|
||||
| intake | CSOC-IN-0002 | open | green | docs/intakes/csoc-residuals.md |
|
||||
|
|
|
|||
157
docs/deploy.md
157
docs/deploy.md
|
|
@ -13,7 +13,7 @@ Chart/values/ingress live in **`railiance-apps`**
|
|||
|
||||
| Host | Role |
|
||||
|------|------|
|
||||
| **`https://app.coulomb.social`** | **Live** Railiance rebuild (identity shell now; product later) |
|
||||
| **`https://app.coulomb.social`** | **Live** Railiance rebuild (app home + spaces) |
|
||||
| **`https://coulomb.social`** | **Bubble.io** until data + self-registration + content ready |
|
||||
| `http://127.0.0.1:8008` | Local OIDC/dev |
|
||||
|
||||
|
|
@ -30,7 +30,16 @@ Apex DNS cutover is **deferred**. Retire Bubble only after an explicit decision.
|
|||
|
||||
## Runtime secrets (names only)
|
||||
|
||||
K8s Secret `coulomb-social-env` (`SECRET_KEY`, `DATABASE_URL`, `USER_ENGINE_PROXY_SECRET`).
|
||||
K8s Secret `coulomb-social-env` (mounted via `envFrom`).
|
||||
|
||||
| Key | Required | Purpose |
|
||||
|-----|----------|---------|
|
||||
| `SECRET_KEY` | yes | Django secret |
|
||||
| `DATABASE_URL` | yes | Postgres URL |
|
||||
| `USER_ENGINE_PROXY_SECRET` | yes (live UE) | trusted proxy to user-engine |
|
||||
| `FORGEJO_TOKEN` | no | private Forgejo raw/API reads |
|
||||
| `FORGEJO_WEBHOOK_SECRET` | no | push webhook HMAC / shared secret |
|
||||
| `NETKINGDOM_REGISTRATION_URL` | no | enable landing **Create account** when NK ships |
|
||||
|
||||
```bash
|
||||
# railiance-apps:
|
||||
|
|
@ -38,7 +47,9 @@ make coulomb-social-env-secret-dry-run
|
|||
make coulomb-social-env-secret
|
||||
```
|
||||
|
||||
OIDC is a **public** client — no client secret.
|
||||
OIDC is a **public** client — no client secret. Non-secret OIDC / Forgejo base
|
||||
URL settings live in Helm values (`FORGEJO_BASE_URL` defaults to
|
||||
`https://forgejo.coulomb.social` in app settings).
|
||||
|
||||
## Health
|
||||
|
||||
|
|
@ -58,10 +69,10 @@ docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .
|
|||
|
||||
1. [x] Helm env / ingress use `app.coulomb.social`
|
||||
2. [x] KeyCape redirects include `https://app.coulomb.social/auth/callback/`
|
||||
3. [ ] DNS: `app.coulomb.social` **A → `92.205.62.239`** (prefer DNS-only for LE)
|
||||
4. [ ] `certificate/coulomb-social-tls` Ready for `app.coulomb.social`
|
||||
5. [ ] `curl -fsS https://app.coulomb.social/healthz`
|
||||
6. [ ] Browser Sign in as tegwick → `/app/`
|
||||
3. [x] DNS: `app.coulomb.social` resolves; HTTPS live (healthz 200)
|
||||
4. [x] `curl -fsS https://app.coulomb.social/healthz`
|
||||
5. [x] Browser Sign in as tegwick → `/app/` (Case A; see `docs/identity/smoke.md`)
|
||||
6. [ ] Seed demo space + open rendered markdown (operator; steps below)
|
||||
|
||||
## Future apex cutover (not now)
|
||||
|
||||
|
|
@ -76,21 +87,135 @@ When Bubble can retire:
|
|||
```bash
|
||||
make test
|
||||
make run # offline or local OIDC redirect
|
||||
uv run manage.py seed_demo_space
|
||||
# Sign in (dev login) → /app/ → Demo space → rendered markdown
|
||||
```
|
||||
|
||||
## Space content (Forgejo)
|
||||
---
|
||||
|
||||
See `docs/spaces-content.md`. Demo:
|
||||
## Operator runbook — spaces on app.coulomb.social
|
||||
|
||||
Product path for **CSOC-WP-0004**. Content model: **ADR-0002**. Detail on
|
||||
read/write/webhook: `docs/spaces-content.md`. Identity smoke:
|
||||
`docs/identity/smoke.md`.
|
||||
|
||||
### A. Prerequisites
|
||||
|
||||
1. Image includes spaces app (`spaces` migrations + Forgejo client) and is
|
||||
deployed to namespace `coulomb-social`.
|
||||
2. Member can Sign in (existing LLDAP/KeyCape user, e.g. tegwick).
|
||||
3. Forgejo reachable from the pod (`FORGEJO_BASE_URL`, default
|
||||
`https://forgejo.coulomb.social`). Public raw needs **no** token; private
|
||||
repos need `FORGEJO_TOKEN` in `coulomb-social-env`.
|
||||
|
||||
### B. Demo seed (fastest smoke — uses this repo as content)
|
||||
|
||||
In-repo fixture (already on `main`):
|
||||
|
||||
```text
|
||||
docs/space-fixtures/demo/pages/index.md
|
||||
```
|
||||
|
||||
Public raw check (no auth):
|
||||
|
||||
```bash
|
||||
kubectl -n coulomb-social exec deploy/coulomb-social -- python manage.py seed_demo_space
|
||||
curl -fsS \
|
||||
"https://forgejo.coulomb.social/coulomb/coulomb-social/raw/branch/main/docs/space-fixtures/demo/pages/index.md" \
|
||||
| head
|
||||
```
|
||||
|
||||
Optional webhook secret (when configured in cluster env):
|
||||
Seed metadata in the app DB (binds `demo` → that path):
|
||||
|
||||
| Key | Purpose |
|
||||
|-----|---------|
|
||||
| `FORGEJO_WEBHOOK_SECRET` | Push webhook cache bust |
|
||||
| `FORGEJO_TOKEN` | Private repo raw/API reads |
|
||||
```bash
|
||||
kubectl -n coulomb-social exec deploy/coulomb-social -- \
|
||||
python manage.py seed_demo_space
|
||||
# optional: --slug demo --title "Demo space" --tenant tenant:coulomb
|
||||
```
|
||||
|
||||
Webhook URL: `https://app.coulomb.social/app/spaces/hooks/forgejo/`
|
||||
Browser:
|
||||
|
||||
1. https://app.coulomb.social/ → **Sign in** (tegwick)
|
||||
2. Land on `/app/` — **Spaces** lists **Demo space**
|
||||
3. Open `/app/spaces/demo/` — see rendered markdown from Forgejo
|
||||
4. Profile menu → **Session details** (`/account/session/`) still works
|
||||
5. **Edit in Forgejo** / **View source** open the bound file; after a commit,
|
||||
**Refresh content** re-fetches (or configure webhook, section D)
|
||||
|
||||
### C. Production-shaped space (dedicated Forgejo repo)
|
||||
|
||||
ADR-0002: **one repo per space**.
|
||||
|
||||
1. In Forgejo, create org (recommended) `coulomb-spaces` (or tenant org later).
|
||||
2. Create repo e.g. `space-my-space` with branch `main` and layout:
|
||||
|
||||
```text
|
||||
pages/
|
||||
index.md # default landing page
|
||||
<page-slug>.md # optional extra pages
|
||||
assets/ # optional images
|
||||
README.md # optional
|
||||
```
|
||||
|
||||
3. Bind in the app (Django admin, or shell):
|
||||
|
||||
```bash
|
||||
kubectl -n coulomb-social exec -it deploy/coulomb-social -- python manage.py shell
|
||||
```
|
||||
|
||||
```python
|
||||
from coulomb_social.apps.spaces.models import Space
|
||||
Space.objects.update_or_create(
|
||||
tenant_id="tenant:coulomb",
|
||||
slug="my-space",
|
||||
defaults={
|
||||
"title": "My space",
|
||||
"forgejo_owner": "coulomb-spaces",
|
||||
"forgejo_repo": "space-my-space",
|
||||
"default_branch": "main",
|
||||
"content_root": "pages",
|
||||
"is_active": True,
|
||||
},
|
||||
)
|
||||
```
|
||||
|
||||
4. If the repo is private, set `FORGEJO_TOKEN` (read-only deploy token) via
|
||||
`railiance-apps` env-secret tooling — **never** commit the token.
|
||||
5. Open `https://app.coulomb.social/app/spaces/my-space/` as a signed-in member
|
||||
of that tenant.
|
||||
|
||||
### D. Optional push webhook (auto cache bust)
|
||||
|
||||
1. Put a random secret in cluster env as `FORGEJO_WEBHOOK_SECRET`.
|
||||
2. Forgejo repo → **Settings → Webhooks → Add webhook → Gitea**:
|
||||
- URL: `https://app.coulomb.social/app/spaces/hooks/forgejo/`
|
||||
- Method POST, content type JSON
|
||||
- Secret: same value as env
|
||||
- Trigger: **Push**
|
||||
3. Push a commit; confirm response JSON includes `cache_entries_cleared` /
|
||||
`spaces_matched`. Authors can still use **Refresh content** without a webhook.
|
||||
|
||||
### E. Env names quick reference
|
||||
|
||||
| Variable | Secret? | Where |
|
||||
|----------|---------|--------|
|
||||
| `FORGEJO_BASE_URL` | no | settings default / Helm |
|
||||
| `FORGEJO_TOKEN` | yes | `coulomb-social-env` |
|
||||
| `FORGEJO_WEBHOOK_SECRET` | yes | `coulomb-social-env` |
|
||||
| `FORGEJO_TIMEOUT_SECONDS` | no | optional |
|
||||
| `NETKINGDOM_REGISTRATION_URL` | no | enable Create account (residual; NK-WP-0025) |
|
||||
|
||||
### F. Smoke checklist (app.coulomb.social)
|
||||
|
||||
| # | Check | Pass criteria |
|
||||
|---|--------|----------------|
|
||||
| 1 | `GET /healthz` | `{"status":"ok","service":"coulomb-social"}` |
|
||||
| 2 | Landing | Sign in visible; Create account only if registration URL set |
|
||||
| 3 | OIDC login (known user) | tegwick → `/app/` app home (not principal dump) |
|
||||
| 4 | Spaces list | empty state or seeded spaces |
|
||||
| 5 | Space detail | markdown rendered from Forgejo (or clear fail-closed error) |
|
||||
| 6 | Session details | profile menu → `/account/session/` shows issuer/subject/UE id |
|
||||
| 7 | Sign out | session cleared; `/app/` requires login |
|
||||
| 8 | (optional) Edit in Forgejo + Refresh | new commit visible without redeploy |
|
||||
|
||||
Identity detail and historical evidence: `docs/identity/smoke.md`.
|
||||
Content mechanics: `docs/spaces-content.md`.
|
||||
|
|
|
|||
|
|
@ -44,6 +44,10 @@ See `.env.example`. Summary:
|
|||
| `USER_ENGINE_APPLICATION_ID` | `coulomb-social` | App id |
|
||||
| `USER_ENGINE_EXPECTED_AUDIENCE` | `user-engine-portal` | required aud for /me |
|
||||
| `FLEX_AUTH_BASE_URL` | empty (fail-closed except shell:view) | PDP |
|
||||
| `FORGEJO_BASE_URL` | `https://forgejo.coulomb.social` | Space markdown source |
|
||||
| `FORGEJO_TOKEN` | empty | Private repo raw reads (secret) |
|
||||
| `FORGEJO_WEBHOOK_SECRET` | empty | Push webhook cache bust (secret) |
|
||||
| `NETKINGDOM_REGISTRATION_URL` | empty | Landing Create account (when NK ships) |
|
||||
|
||||
### Platform OIDC (KeyCape)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Identity smoke checklist
|
||||
|
||||
Evidence updated: **2026-08-09**.
|
||||
Evidence updated: **2026-08-12**.
|
||||
|
||||
## Offline (dev claims) — **passed**
|
||||
|
||||
|
|
@ -13,47 +13,84 @@ uv sync && uv run manage.py migrate && make run
|
|||
|------|--------|
|
||||
| Open `/` → **Sign in** | → `/auth/dev-login/` |
|
||||
| Dev form subject `smoke-1` | 302 → `/app/` |
|
||||
| Shell shows display name + subject | OK |
|
||||
| App home shows Spaces + profile chrome | OK (principal dump is under Session details) |
|
||||
| Profile menu → Session details | issuer / subject / user-engine id |
|
||||
| **Sign out** | session cleared |
|
||||
| `/app/` after logout | 302 → login |
|
||||
| Second login same subject | single `Member` row (idempotent) |
|
||||
| `make test` | **15 passed** |
|
||||
| `make test` | green |
|
||||
|
||||
Automated POST probe (2026-08-09):
|
||||
Automated POST probe:
|
||||
|
||||
```text
|
||||
dev_login_post → /app/ 200 with subject smoke-1
|
||||
logout → app 302 to /auth/login/?next=/app/
|
||||
```
|
||||
|
||||
## Cluster in-cluster (port-forward) — **passed (start of OIDC)**
|
||||
## Public host app.coulomb.social — **Case A passed**
|
||||
|
||||
DNS for `coulomb.social` still points at Cloudflare/Bubble; TLS ACME is
|
||||
blocked until cutover. Smoke via:
|
||||
**Strategy:** live Railiance app on **`app.coulomb.social`**; apex
|
||||
**`coulomb.social`** stays Bubble until content + self-registration cutover.
|
||||
|
||||
| Check | Detail |
|
||||
|-------|--------|
|
||||
| Cluster host | `app.coulomb.social` (Helm + ingress) |
|
||||
| OIDC redirect | `https://app.coulomb.social/auth/callback/` |
|
||||
| Health | `curl -fsS https://app.coulomb.social/healthz` → ok |
|
||||
| Landing | 200; **Sign in** present |
|
||||
| Case A — known LLDAP user | **done** (tegwick, AAL1, no MFA forced) → `/app/` |
|
||||
| Create account | hidden until `NETKINGDOM_REGISTRATION_URL` is set |
|
||||
| Case B — public registration → OIDC → Member | **blocked** on NK mailbox verification (`NK-WP-0025` / residual intakes) |
|
||||
| Apex | **do not** repoint until Bubble retirement |
|
||||
|
||||
### Product smoke (spaces — after deploy + seed)
|
||||
|
||||
Operator runbook: `docs/deploy.md` § Operator runbook. Short path:
|
||||
|
||||
```bash
|
||||
kubectl -n coulomb-social port-forward svc/coulomb-social 18088:80
|
||||
curl -H 'Host: coulomb.social' http://127.0.0.1:18088/healthz
|
||||
# {"status": "ok", "service": "coulomb-social"}
|
||||
# fixture raw (public)
|
||||
curl -fsS \
|
||||
"https://forgejo.coulomb.social/coulomb/coulomb-social/raw/branch/main/docs/space-fixtures/demo/pages/index.md" \
|
||||
| head
|
||||
# seed in cluster
|
||||
kubectl -n coulomb-social exec deploy/coulomb-social -- \
|
||||
python manage.py seed_demo_space
|
||||
```
|
||||
|
||||
| Check | Result |
|
||||
|-------|--------|
|
||||
| Image | `forgejo.coulomb.social/coulomb/coulomb-social:7067145` |
|
||||
| `OIDC_ENABLED` | `true` (values) |
|
||||
| `GET /healthz` + Host | 200 JSON ok |
|
||||
| `GET /` + Host | 200 landing shell |
|
||||
| `GET /auth/login/` + Host | **302** → `https://kc.coulomb.social/authorize?...` with `client_id=coulomb-social`, `redirect_uri=https://coulomb.social/auth/callback/`, PKCE S256 |
|
||||
| Session cookie | `HttpOnly; Secure; SameSite=Lax` (prod settings) |
|
||||
| Step | Expected |
|
||||
|------|----------|
|
||||
| Sign in tegwick | `/app/` Spaces list |
|
||||
| Open Demo space | rendered markdown from Forgejo |
|
||||
| Session details | profile menu diagnostics (no secrets) |
|
||||
| Refresh content | re-fetch after git edit (or webhook) |
|
||||
|
||||
Full browser login against the **cluster** redirect URI requires public HTTPS
|
||||
on `coulomb.social` (Secure cookie + callback host). Use **local OIDC** below
|
||||
before DNS cutover, or complete browser MFA after cutover.
|
||||
## Case matrix (CSOC-WP-0003-T04)
|
||||
|
||||
## Platform OIDC (local redirect) — **ready for human MFA**
|
||||
| Case | Status |
|
||||
|------|--------|
|
||||
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
|
||||
| B — brand-new public registration → OIDC → Member | **deferred** → residual `CSOC-IN-0001` / NK-WP-0025 |
|
||||
|
||||
Client registration and authorize handoff verified; **human Authelia + MFA**
|
||||
is the remaining interactive step.
|
||||
### Negatives to run when Case B unblocks (or ad-hoc)
|
||||
|
||||
Record results here or in residual notes; residual `CSOC-IN-0002`.
|
||||
|
||||
| Negative | Intent |
|
||||
|----------|--------|
|
||||
| State / nonce replay | callback with recycled `state` fails closed |
|
||||
| Subject collision | same issuer+subject always one Member |
|
||||
| Email-only collision | email must not take over another subject |
|
||||
| Step-up ACR | when `OIDC_STEP_UP_ACR` requested, insufficient acr rejected |
|
||||
| Registration open redirect | `/auth/register/` ignores `?next=` host; only configured URL |
|
||||
|
||||
App registration entry (when URL configured):
|
||||
|
||||
```bash
|
||||
# only after NetKingdom publishes public registration URL
|
||||
# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git)
|
||||
```
|
||||
|
||||
## Platform OIDC (local redirect) — optional
|
||||
|
||||
```bash
|
||||
export OIDC_ENABLED=true
|
||||
|
|
@ -61,28 +98,14 @@ export OIDC_ISSUER=https://kc.coulomb.social
|
|||
export OIDC_CLIENT_ID=coulomb-social
|
||||
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
|
||||
export OIDC_SCOPES="openid profile email groups"
|
||||
# optional live user-engine (else stub):
|
||||
# export USER_ENGINE_BASE_URL=https://users.92-205-62-239.nip.io
|
||||
# export USER_ENGINE_PROXY_SECRET="$(kubectl -n user-engine get secret user-engine-runtime \
|
||||
# -o jsonpath='{.data.proxy-secret}' | base64 -d)"
|
||||
make run
|
||||
```
|
||||
|
||||
| Step | Expected |
|
||||
|------|----------|
|
||||
| Open http://127.0.0.1:8008/ → Sign in | redirect KeyCape → Authelia |
|
||||
| Complete MFA | callback → `/app/` with subject / display name |
|
||||
| Complete MFA if prompted | callback → `/app/` |
|
||||
| Sign out | landing; `/app/` requires login |
|
||||
| Second login | same Member / user_engine user_id |
|
||||
|
||||
Authorize probe (no browser) 2026-08-09:
|
||||
|
||||
| redirect_uri | KeyCape |
|
||||
|--------------|---------|
|
||||
| `http://127.0.0.1:8008/auth/callback/` | **302** → Authelia OIDC |
|
||||
| `https://coulomb.social/auth/callback/` | **302** → Authelia OIDC |
|
||||
|
||||
Unregistered redirects still fail with `invalid_profile_usage` (T03).
|
||||
|
||||
## Automated
|
||||
|
||||
|
|
@ -90,15 +113,4 @@ Unregistered redirects still fail with `invalid_profile_usage` (T03).
|
|||
make test
|
||||
```
|
||||
|
||||
## Public host (parallel to Bubble)
|
||||
|
||||
**Strategy:** live Railiance app on **`app.coulomb.social`**; apex **`coulomb.social`** stays Bubble until content + self-registration cutover.
|
||||
|
||||
| Check | Detail |
|
||||
|-------|--------|
|
||||
| Cluster host | `app.coulomb.social` (Helm + ingress) |
|
||||
| OIDC redirect | `https://app.coulomb.social/auth/callback/` |
|
||||
| DNS | operator: `app.coulomb.social` A → `92.205.62.239` |
|
||||
| Apex | **do not** repoint until Bubble retirement |
|
||||
|
||||
See `docs/deploy.md`.
|
||||
See also: `docs/deploy.md`, `docs/spaces-content.md`, `docs/adr/ADR-0001-netkingdom-identity.md`.
|
||||
|
|
|
|||
73
docs/intakes/csoc-residuals.md
Normal file
73
docs/intakes/csoc-residuals.md
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
# coulomb-social residual intakes
|
||||
|
||||
File-backed intakes for leftovers from finished workplans. Canon: work-record
|
||||
types § Residuals (`origin: residual`, `origin_ref: <WP-id>`).
|
||||
|
||||
---
|
||||
|
||||
## CSOC-IN-0001 — Enable public Create account + Case B smoke
|
||||
|
||||
```yaml
|
||||
id: CSOC-IN-0001
|
||||
kind: intake
|
||||
title: "Enable Create account and Case B registration smoke on app.coulomb.social"
|
||||
lane: blue
|
||||
status: open
|
||||
priority: medium
|
||||
owner: coulomb-social
|
||||
repo: coulomb-social
|
||||
origin: residual
|
||||
origin_ref: CSOC-WP-0003
|
||||
description: |
|
||||
App entry for Create account is implemented (NETKINGDOM_REGISTRATION_URL,
|
||||
/auth/register/, landing button). Public enablement waits on NetKingdom
|
||||
mailbox verification and published registration URL (NK-WP-0025 / USER-WP-0022).
|
||||
|
||||
When the platform registration URL is live:
|
||||
|
||||
1. Set NETKINGDOM_REGISTRATION_URL on coulomb-social-env (names only in git;
|
||||
example shape in .env.example).
|
||||
2. Confirm landing shows Create account and /auth/register/ redirects only to
|
||||
that URL (no open redirect via ?next=).
|
||||
3. Run Case B: brand-new public registration → verified mail → OIDC → first
|
||||
Member JIT on app.coulomb.social.
|
||||
4. Record evidence under docs/identity/smoke.md.
|
||||
|
||||
DoC-Ok: residual of finished CSOC-WP-0003; platform dependency explicit.
|
||||
notes: |
|
||||
Depends on NK-WP-0025 (registration orchestration + mail path).
|
||||
Related: CSOC-IN-0002 (identity negatives after Case B).
|
||||
state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## CSOC-IN-0002 — Identity negative matrix after Case B
|
||||
|
||||
```yaml
|
||||
id: CSOC-IN-0002
|
||||
kind: intake
|
||||
title: "Record identity negatives: state replay, collision, step-up"
|
||||
lane: green
|
||||
status: open
|
||||
priority: low
|
||||
owner: coulomb-social
|
||||
repo: coulomb-social
|
||||
origin: residual
|
||||
origin_ref: CSOC-WP-0003
|
||||
description: |
|
||||
CSOC-WP-0003 Case A (known LLDAP login) is proven. Remaining negatives listed
|
||||
in docs/identity/smoke.md should be executed when Case B unblocks (or sooner
|
||||
offline/dev if useful):
|
||||
|
||||
- OIDC state/nonce replay
|
||||
- issuer+subject collision (single Member)
|
||||
- email-only must not take over another subject
|
||||
- step-up ACR rejection when assurance insufficient
|
||||
- registration redirect allow-list only
|
||||
|
||||
Capture pass/fail in docs/identity/smoke.md; close this intake when recorded.
|
||||
notes: |
|
||||
Pulls from CSOC-IN-0001 for live registration path; some checks can run offline.
|
||||
state_hub_intake_id: "019ff532-3ade-7d75-acb7-2bbfa264fcb8"
|
||||
```
|
||||
|
|
@ -2,6 +2,9 @@
|
|||
|
||||
See **ADR-0002**. App DB holds metadata; page bodies are markdown in Forgejo.
|
||||
|
||||
**Operator runbook (seed, bind, cluster smoke):** `docs/deploy.md`
|
||||
§ Operator runbook — spaces on app.coulomb.social.
|
||||
|
||||
## Read (T04)
|
||||
|
||||
1. Space row has `forgejo_owner`, `forgejo_repo`, `default_branch`, `content_root`.
|
||||
|
|
|
|||
|
|
@ -4,11 +4,11 @@ type: workplan
|
|||
title: "Add NetKingdom self-registration and profile-aware assurance"
|
||||
domain: communication
|
||||
repo: coulomb-social
|
||||
status: active
|
||||
status: finished
|
||||
owner: bernd
|
||||
topic_slug: coulomb-social
|
||||
created: "2026-08-09"
|
||||
updated: "2026-08-10"
|
||||
updated: "2026-08-12"
|
||||
depends_on:
|
||||
- CSOC-WP-0002
|
||||
- NK-WP-0025
|
||||
|
|
@ -22,10 +22,10 @@ state_hub_workstream_id: "7cd7d6b8-e01d-4b34-8680-3c0cac68d80e"
|
|||
Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account
|
||||
creation entry point and optional profile/action step-up.
|
||||
|
||||
**2026-08-10 posture:** existing-user login on **`app.coulomb.social`** is proven
|
||||
(tegwick, AAL1, no MFA). Public **Create account** remains blocked on NetKingdom
|
||||
mailbox verification (NK-WP-0025 / USER-WP-0022). Product work proceeds via
|
||||
`CSOC-WP-0004` without waiting on public registration.
|
||||
**Finished 2026-08-12:** app-side work complete. Existing-user login on
|
||||
**`app.coulomb.social`** is proven (tegwick, AAL1). Landing **Create account**
|
||||
is implemented and gated on `NETKINGDOM_REGISTRATION_URL`. Public Case B waits
|
||||
on NetKingdom mailbox verification (`NK-WP-0025`) — residuals below.
|
||||
|
||||
## T01 - Preserve and prove first-login JIT profile creation
|
||||
|
||||
|
|
@ -46,14 +46,15 @@ user-engine id; image `:f5537d8` uses id_token when `/userinfo` 401s.
|
|||
|
||||
```task
|
||||
id: CSOC-WP-0003-T02
|
||||
status: progress
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "aaf2d2cb-6ba9-42cb-9271-aacc414e947a"
|
||||
```
|
||||
|
||||
Landing-page **Create account** using configured `NETKINGDOM_REGISTRATION_URL`.
|
||||
App entry is implemented; remains disabled until NetKingdom public registration
|
||||
URL + verified-mail flow ship.
|
||||
App entry implemented (`/auth/register/`, context processor, tests). Button
|
||||
hidden until env URL is set. **Enablement residual:** `CSOC-IN-0001` after
|
||||
NK-WP-0025 publishes registration + verified-mail flow.
|
||||
|
||||
## T03 - Support profile/action step-up
|
||||
|
||||
|
|
@ -71,7 +72,7 @@ client uses `mfaRequired: false`.
|
|||
|
||||
```task
|
||||
id: CSOC-WP-0003-T04
|
||||
status: progress
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
|
||||
```
|
||||
|
|
@ -79,7 +80,16 @@ state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
|
|||
| Case | Status |
|
||||
|------|--------|
|
||||
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
|
||||
| B — brand-new public registration → OIDC → Member | **blocked** on NK mailbox verification |
|
||||
| B — brand-new public registration → OIDC → Member | residual **CSOC-IN-0001** (NK mailbox) |
|
||||
|
||||
Record remaining negatives (state replay, collision, step-up) when Case B unblocks
|
||||
or in a short follow-up smoke note under `docs/identity/smoke.md`.
|
||||
Negatives checklist parked in `docs/identity/smoke.md`; execution residual
|
||||
**CSOC-IN-0002**.
|
||||
|
||||
## Residuals (live records)
|
||||
|
||||
| Id | Role |
|
||||
|----|------|
|
||||
| `CSOC-IN-0001` | Enable Create account + Case B smoke when NK registration URL ships |
|
||||
| `CSOC-IN-0002` | Record identity negatives (replay, collision, step-up) |
|
||||
|
||||
Source: `docs/intakes/csoc-residuals.md`.
|
||||
|
|
|
|||
|
|
@ -4,11 +4,11 @@ type: workplan
|
|||
title: "App shell entry and Forgejo-backed space content"
|
||||
domain: communication
|
||||
repo: coulomb-social
|
||||
status: active
|
||||
status: finished
|
||||
owner: bernd
|
||||
topic_slug: coulomb-social
|
||||
created: "2026-08-10"
|
||||
updated: "2026-08-10"
|
||||
updated: "2026-08-12"
|
||||
# note: T07 added same day — principal diagnostics via profile menu
|
||||
depends_on:
|
||||
- CSOC-WP-0002
|
||||
|
|
@ -38,11 +38,14 @@ cutover.
|
|||
|
||||
Migration of all Bubble spaces is **explicitly later** (`CSOC-WP-0001`).
|
||||
|
||||
**Finished 2026-08-12:** T01–T07 complete. Operator runbook and smoke pointers
|
||||
in `docs/deploy.md` and `docs/identity/smoke.md`.
|
||||
|
||||
## Out of scope (this plan)
|
||||
|
||||
- Apex DNS cutover / Bubble retirement
|
||||
- Full Bubble inventory or bulk import
|
||||
- Public self-registration (CSOC-WP-0003 / NetKingdom)
|
||||
- Public self-registration (CSOC-WP-0003 residuals / NetKingdom)
|
||||
- Full UI parity (Research, marketplace matching, …) beyond space content MVP
|
||||
|
||||
---
|
||||
|
|
@ -168,7 +171,7 @@ detail; repo-scoped cache invalidate; optional push webhook
|
|||
|
||||
```task
|
||||
id: CSOC-WP-0004-T06
|
||||
status: todo
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "40a880d0-62b9-4ae4-ab3e-074e8901462a"
|
||||
```
|
||||
|
|
@ -177,6 +180,11 @@ Document operator steps: create Forgejo org/repo, bind space, credentials env
|
|||
names, smoke checklist on app.coulomb.social. Update `docs/deploy.md` and
|
||||
`docs/identity/smoke.md` pointers as needed.
|
||||
|
||||
2026-08-12: Full operator runbook in `docs/deploy.md` (demo seed, dedicated
|
||||
repo, webhook, env table, smoke table). Product smoke section in
|
||||
`docs/identity/smoke.md`. FORGEJO_* names in `.env.example` and `docs/dev.md`.
|
||||
Content detail remains `docs/spaces-content.md`.
|
||||
|
||||
## T07 — Principal diagnostics via user profile menu
|
||||
|
||||
```task
|
||||
|
|
@ -232,11 +240,6 @@ T01 app home entry ──┬─► T07 profile menu principal diagnostics
|
|||
└─► T06 runbook
|
||||
```
|
||||
|
||||
T01 (+ T07) can ship alone to fix the “stuck on login confirmation” UX while
|
||||
keeping identity diagnostics one click away. T03 should land before large T04
|
||||
investment if write-model choices are unclear; a **provisional** ADR is enough
|
||||
to start T04 against a single seed repo.
|
||||
|
||||
## Acceptance (workplan)
|
||||
|
||||
1. Post-login journey is product-shaped (app home + spaces), not identity-debug-only.
|
||||
|
|
@ -245,10 +248,11 @@ to start T04 against a single seed repo.
|
|||
4. Space page content is markdown backed by Forgejo with a working read path.
|
||||
5. Bubble migration is still not required for demos on app.coulomb.social.
|
||||
6. CSOC-WP-0001 can map Bubble pages onto the ADR layout when migration starts.
|
||||
7. Operator runbook documents seed, bind, secrets (names), and smoke (T06).
|
||||
|
||||
## Related
|
||||
|
||||
- Live host: `docs/deploy.md` (app.coulomb.social parallel to Bubble)
|
||||
- Identity: CSOC-WP-0002 (done), CSOC-WP-0003 (registration later)
|
||||
- Identity: CSOC-WP-0002 (done), CSOC-WP-0003 residuals for public registration
|
||||
- Migration later: CSOC-WP-0001
|
||||
- Design tokens: `docs/design-extract/`
|
||||
|
|
|
|||
80
workplans/CSOC-WP-0005-resource-demand-and-cost-evidence.md
Normal file
80
workplans/CSOC-WP-0005-resource-demand-and-cost-evidence.md
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
---
|
||||
id: CSOC-WP-0005
|
||||
type: workplan
|
||||
title: "Publish Coulomb Social resource demand and cost evidence"
|
||||
domain: communication
|
||||
repo: coulomb-social
|
||||
status: ready
|
||||
owner: codex
|
||||
topic_slug: coulomb-social
|
||||
created: "2026-08-11"
|
||||
updated: "2026-08-11"
|
||||
related:
|
||||
- CSOC-WP-0004
|
||||
- RESOURCE-WP-0003
|
||||
state_hub_workstream_id: "00de1578-6150-40d3-b193-e852666ed945"
|
||||
---
|
||||
|
||||
# CSOC-WP-0005 — resource demand and cost evidence
|
||||
|
||||
## Goal
|
||||
|
||||
Publish workload-owned requirements and observations for
|
||||
`resource:tenant:coulomb:coulomb-social` without moving deployment, platform,
|
||||
or financial authority into this repository. Origin: `RESOURCE-WP-0003-T04`
|
||||
delegated evidence gap.
|
||||
|
||||
## T01 — Declare low, base, and high workload demand
|
||||
|
||||
```task
|
||||
id: CSOC-WP-0005-T01
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "d22e42e7-186e-4206-9cf4-c533d6388b13"
|
||||
```
|
||||
|
||||
Define forecast proxies for active tenants/users, requests, background work,
|
||||
database size/growth, stored media, ingress/egress, and required CPU/memory.
|
||||
Preserve assumptions and distinguish current Coulomb use from future external
|
||||
multi-tenant scenarios.
|
||||
|
||||
Done when resource-control can produce falsifiable monthly demand forecasts.
|
||||
|
||||
## T02 — Publish service objectives and usage observations
|
||||
|
||||
```task
|
||||
id: CSOC-WP-0005-T02
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "ac078211-3cd9-49d8-baac-c0a1b60278fb"
|
||||
```
|
||||
|
||||
Declare availability, latency, recovery, retention, and tenant-isolation
|
||||
requirements. Publish timestamped non-secret observations for the demand
|
||||
proxies available to the application while leaving cluster telemetry to its
|
||||
owners.
|
||||
|
||||
Done when infrastructure options can be evaluated against application-owned
|
||||
requirements and forecast error can be measured.
|
||||
|
||||
## T03 — Record workload operations labor
|
||||
|
||||
```task
|
||||
id: CSOC-WP-0005-T03
|
||||
status: todo
|
||||
priority: medium
|
||||
state_hub_task_id: "a15e630c-6bec-4c50-9622-bce16e1ce418"
|
||||
```
|
||||
|
||||
Identify setup and recurring application labor for releases, migrations,
|
||||
tenant operations, incident response, and recovery exercises. Separate it from
|
||||
cluster, database, identity, and provider labor.
|
||||
|
||||
Done when resource-control can include workload labor without double counting
|
||||
platform operations.
|
||||
|
||||
## Acceptance
|
||||
|
||||
- [ ] Demand forecasts distinguish current, growth, and external-tenant cases.
|
||||
- [ ] Service objectives and observations have stable units and provenance.
|
||||
- [ ] Workload labor is separated from delegated infrastructure labor.
|
||||
Loading…
Add table
Add a link
Reference in a new issue