tegwick edfdd79208 Finish CSOC-WP-0003 and CSOC-WP-0004; residual intakes for Case B

Close self-registration workplan with Case A proven and Create account
entry implemented; park public registration enablement and identity
negatives as CSOC-IN-0001/0002. Complete app-shell workplan with T06
operator runbook (seed, bind, webhook, smoke) and smoke doc updates.

2026-08-12 10:59:25 +02:00

2.4 KiB

Raw Permalink Blame History

Local development

Prerequisites

Python 3.12+
uv

Setup

cd ~/coulomb-social
uv sync
uv run manage.py migrate
uv run manage.py runserver 0.0.0.0:8008

Open http://127.0.0.1:8008/ — Sign in uses dev claims when OIDC_ENABLED=false (default) and DEBUG=true.

Tests

make test
# or
uv run pytest

Environment

See .env.example. Summary:

Variable	Default	Purpose
`SECRET_KEY`	insecure dev default	Django secret
`DATABASE_URL`	sqlite `./db.sqlite3`	DB
`DEFAULT_TENANT_ID`	`tenant:coulomb`	Platform tenant claim (KeyCape default)
`OIDC_ENABLED`	`false`	Use KeyCape / real issuer
`OIDC_ISSUER`		e.g. `https://kc.coulomb.social`
`OIDC_CLIENT_ID`		`coulomb-social`
`OIDC_CLIENT_SECRET`	empty	public client — leave empty
`OIDC_REDIRECT_URI`		`http://127.0.0.1:8008/auth/callback/`
`USER_ENGINE_BASE_URL`	empty (stub)	e.g. `https://users.92-205-62-239.nip.io`
`USER_ENGINE_PROXY_SECRET`	empty	trusted proxy secret (with base URL → HTTP)
`USER_ENGINE_APPLICATION_ID`	`coulomb-social`	App id
`USER_ENGINE_EXPECTED_AUDIENCE`	`user-engine-portal`	required aud for /me
`FLEX_AUTH_BASE_URL`	empty (fail-closed except shell:view)	PDP
`FORGEJO_BASE_URL`	`https://forgejo.coulomb.social`	Space markdown source
`FORGEJO_TOKEN`	empty	Private repo raw reads (secret)
`FORGEJO_WEBHOOK_SECRET`	empty	Push webhook cache bust (secret)
`NETKINGDOM_REGISTRATION_URL`	empty	Landing Create account (when NK ships)

Platform OIDC (KeyCape)

Client is registered on railiance01 KeyCape. Re-apply if redirect URIs change:

./scripts/register-keycape-client.sh

Then:

export OIDC_ENABLED=true
export OIDC_ISSUER=https://kc.coulomb.social
export OIDC_CLIENT_ID=coulomb-social
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
export OIDC_SCOPES="openid profile email groups"
make run

Sign-in redirects to Authelia (auth.coulomb.social) + MFA via privacyIDEA.

See docs/adr/ADR-0001-netkingdom-identity.md and docs/identity/.

Cluster env Secret (production)

# dry-run (key names only)
./scripts/create-env-secret.sh --dry-run
# apply (needs kubectl + cluster access)
./scripts/create-env-secret.sh

Delegates to railiance-apps/tools/create-coulomb-social-env-secret.sh.

2.4 KiB Raw Permalink Blame History