Use-case regression gate / usecase-regressions (push) Failing after 3m48s

Details

Record deployed personal app and remaining Authelia credential rejection

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680

2026-10-06 17:02:16 +02:00

2.6 KiB

Raw Permalink Blame History

Local development

Prerequisites

Python 3.12+
uv

Setup

cd ~/coulomb-social
uv sync
uv run manage.py migrate
uv run manage.py runserver 0.0.0.0:8008

Open http://127.0.0.1:8008/ — Sign in uses dev claims when OIDC_ENABLED=false (default) and DEBUG=true.

Tests

make test
# or
uv run pytest

Environment

See .env.example. Summary:

Variable	Default	Purpose
`SECRET_KEY`	insecure dev default	Django secret
`DATABASE_URL`	sqlite `./db.sqlite3`	DB
`DEFAULT_TENANT_ID`	`tenant:coulomb`	Platform tenant claim (KeyCape default)
`OIDC_ENABLED`	`false`	Use KeyCape / real issuer
`OIDC_ISSUER`		e.g. `https://kc.coulomb.social`
`OIDC_CLIENT_ID`		`coulomb-social`
`OIDC_CLIENT_SECRET`	empty	public client — leave empty
`OIDC_REDIRECT_URI`		`http://127.0.0.1:8008/auth/callback/`
`USER_ENGINE_BASE_URL`	empty (stub)	e.g. `https://users.92-205-62-239.nip.io`
`USER_ENGINE_PROXY_SECRET`	empty	trusted proxy secret (with base URL → HTTP)
`USER_ENGINE_APPLICATION_ID`	`coulomb-social`	App id
`USER_ENGINE_EXPECTED_AUDIENCE`	`user-engine-portal`	required aud for /me
`FLEX_AUTH_BASE_URL`	empty (fail-closed except shell:view)	PDP
`FORGEJO_BASE_URL`	`https://forgejo.coulomb.social`	Space markdown source
`FORGEJO_TOKEN`	empty	Private repo raw reads (secret)
`FORGEJO_WEBHOOK_SECRET`	empty	Push webhook cache bust (secret)
`NETKINGDOM_REGISTRATION_URL`	empty	Landing Create account (when NK ships)

Platform OIDC (KeyCape)

The missing historical client registration was restored with founder approval on 2026-10-06. Inspect through the safe owner wrapper (read-only default):

./scripts/register-keycape-client.sh

Live repair requires exact founder approval; see docs/release/personal-account-2026-10-06.md.

App configuration:

export OIDC_ENABLED=true
export OIDC_ISSUER=https://kc.coulomb.social
export OIDC_CLIENT_ID=coulomb-social
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
export OIDC_SCOPES="openid profile email groups"
make run

Sign-in redirects to Authelia (auth.coulomb.social) + MFA via privacyIDEA.

See docs/adr/ADR-0001-netkingdom-identity.md and docs/identity/.

Cluster env Secret (production)

# dry-run (key names only)
./scripts/create-env-secret.sh --dry-run
# apply (needs kubectl + cluster access)
./scripts/create-env-secret.sh

Delegates to railiance-apps/tools/create-coulomb-social-env-secret.sh.

2.6 KiB Raw Permalink Blame History