# Deploy notes

## Shape

Standalone service: commit-SHA images → registry
`forgejo.coulomb.social/coulomb/coulomb-social` → `railiance-apps` Helm values →
railiance01 (same lane as `vergabe-teilnahme`).

Chart/values/ingress live in **`railiance-apps`**
(`helm/coulomb-social-values.yaml`, `docs/coulomb-social.md`).

## Host strategy

| Host | Role |
|------|------|
| **`https://app.coulomb.social`** | **Live** Railiance rebuild (identity shell now; product later) |
| **`https://coulomb.social`** | **Bubble.io** until data + self-registration + content ready |
| `http://127.0.0.1:8008` | Local OIDC/dev |

Apex DNS cutover is **deferred**. Retire Bubble only after an explicit decision.

## Current cluster status

| Item | State |
|------|--------|
| Namespace | `coulomb-social` |
| Public host | **`app.coulomb.social`** |
| OIDC redirect | `https://app.coulomb.social/auth/callback/` |
| Apex Bubble | unchanged |

## Runtime secrets (names only)

K8s Secret `coulomb-social-env` (`SECRET_KEY`, `DATABASE_URL`, `USER_ENGINE_PROXY_SECRET`).

```bash
# railiance-apps:
make coulomb-social-env-secret-dry-run
make coulomb-social-env-secret
```

OIDC is a **public** client — no client secret.

## Health

- `GET /healthz` → `{"status":"ok","service":"coulomb-social"}`
- Probes use `Host: app.coulomb.social`

## Build / deploy

```bash
SHA=$(git rev-parse --short HEAD)
docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .
# COULOMB_SOCIAL_IMAGE_TAG=$SHA make coulomb-social-deploy   # in railiance-apps
# make coulomb-social-ingress-deploy
```

## Parallel host go-live checklist

1. [x] Helm env / ingress use `app.coulomb.social`
2. [x] KeyCape redirects include `https://app.coulomb.social/auth/callback/`
3. [ ] DNS: `app.coulomb.social` **A → `92.205.62.239`** (prefer DNS-only for LE)
4. [ ] `certificate/coulomb-social-tls` Ready for `app.coulomb.social`
5. [ ] `curl -fsS https://app.coulomb.social/healthz`
6. [ ] Browser Sign in as tegwick → `/app/`

## Future apex cutover (not now)

When Bubble can retire:

1. Point `coulomb.social` A at the cluster (or reverse-proxy)
2. Switch Helm `ALLOWED_HOSTS` / `OIDC_REDIRECT_URI` / ingress host if apex becomes canonical
3. Keep or drop `app.` as redirect alias

## Local verification

```bash
make test
make run   # offline or local OIDC redirect
```