# Deploy notes (stub — CSOC-WP-0002-T08)

## Shape

Standalone service: commit-SHA images → registry
`gitea.coulomb.social/coulomb/coulomb-social` → `railiance-apps` values →
railiance01 (same lane as `vergabe-teilnahme`).

## Runtime secrets (names only)

K8s Secret `coulomb-social-env` in namespace `coulomb-social` (chart `envFrom`):

| Key | Source |
|-----|--------|
| `SECRET_KEY` | generated by env-secret script |
| `DATABASE_URL` | cnpg app role secret (URL-encoded password) |
| `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` |

```bash
# from railiance-apps:
make coulomb-social-env-secret-dry-run
make coulomb-social-env-secret

# from this repo:
./scripts/create-env-secret.sh --dry-run
./scripts/create-env-secret.sh
```

Script: `railiance-apps/tools/create-coulomb-social-env-secret.sh`  
OIDC is a **public** client — no client secret.
## Health

- `GET /healthz` → `{"status":"ok"}`

## Build

```bash
SHA=$(git rev-parse --short HEAD)
docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .
```

Runtime env (no secrets in image): `SECRET_KEY`, `DATABASE_URL`,
`OIDC_*`, `USER_ENGINE_*`, `DEFAULT_TENANT_ID`, `ALLOWED_HOSTS`.

## Status

- Dockerfile present (gunicorn, non-root, `/healthz` check).
- railiance-apps Helm values / cluster Service **not** yet landed.
- Local `make run` + `make test` remain the default verification path.