# Deploy notes (stub — CSOC-WP-0002-T08)

## Shape

Standalone service: commit-SHA images → registry
`gitea.coulomb.social/coulomb/coulomb-social` → `railiance-apps` values →
railiance01 (same lane as `vergabe-teilnahme`).

## Runtime secrets (names only)

| Secret | Consumer |
|--------|----------|
| `SECRET_KEY` | Django |
| `DATABASE_URL` | Django |
| `OIDC_CLIENT_SECRET` | identity app |
| future DB password | OpenBao dynamic/KV |

## Health

- `GET /healthz` → `{"status":"ok"}`

## Build

```bash
SHA=$(git rev-parse --short HEAD)
docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .
```

Runtime env (no secrets in image): `SECRET_KEY`, `DATABASE_URL`,
`OIDC_*`, `USER_ENGINE_*`, `DEFAULT_TENANT_ID`, `ALLOWED_HOSTS`.

## Status

- Dockerfile present (gunicorn, non-root, `/healthz` check).
- railiance-apps Helm values / cluster Service **not** yet landed.
- Local `make run` + `make test` remain the default verification path.