tegwick 3f30bcd340 Add Forgejo edit/refresh sync path for space content (T05)

Keep git as source of truth: deep-link to Forgejo editor, manual refresh to
drop cache, and optional signed push webhook for automatic invalidation.

2026-08-12 03:29:26 +02:00

2.7 KiB

Raw Blame History

Deploy notes

Shape

Standalone service: commit-SHA images → registry forgejo.coulomb.social/coulomb/coulomb-social → railiance-apps Helm values → railiance01 (same lane as vergabe-teilnahme).

Chart/values/ingress live in railiance-apps (helm/coulomb-social-values.yaml, docs/coulomb-social.md).

Host strategy

Host	Role
`https://app.coulomb.social`	Live Railiance rebuild (identity shell now; product later)
`https://coulomb.social`	Bubble.io until data + self-registration + content ready
`http://127.0.0.1:8008`	Local OIDC/dev

Apex DNS cutover is deferred. Retire Bubble only after an explicit decision.

Current cluster status

Item	State
Namespace	`coulomb-social`
Public host	`app.coulomb.social`
OIDC redirect	`https://app.coulomb.social/auth/callback/`
Apex Bubble	unchanged

Runtime secrets (names only)

K8s Secret coulomb-social-env (SECRET_KEY, DATABASE_URL, USER_ENGINE_PROXY_SECRET).

# railiance-apps:
make coulomb-social-env-secret-dry-run
make coulomb-social-env-secret

OIDC is a public client — no client secret.

Health

GET /healthz → {"status":"ok","service":"coulomb-social"}
Probes use Host: app.coulomb.social

Build / deploy

SHA=$(git rev-parse --short HEAD)
docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .
# COULOMB_SOCIAL_IMAGE_TAG=$SHA make coulomb-social-deploy   # in railiance-apps
# make coulomb-social-ingress-deploy

Parallel host go-live checklist

Helm env / ingress use app.coulomb.social
KeyCape redirects include https://app.coulomb.social/auth/callback/
DNS: app.coulomb.social A → 92.205.62.239 (prefer DNS-only for LE)
certificate/coulomb-social-tls Ready for app.coulomb.social
curl -fsS https://app.coulomb.social/healthz
Browser Sign in as tegwick → /app/

Future apex cutover (not now)

When Bubble can retire:

Point coulomb.social A at the cluster (or reverse-proxy)
Switch Helm ALLOWED_HOSTS / OIDC_REDIRECT_URI / ingress host if apex becomes canonical
Keep or drop app. as redirect alias

Local verification

make test
make run   # offline or local OIDC redirect

Space content (Forgejo)

See docs/spaces-content.md. Demo:

kubectl -n coulomb-social exec deploy/coulomb-social -- python manage.py seed_demo_space

Optional webhook secret (when configured in cluster env):

Key	Purpose
`FORGEJO_WEBHOOK_SECRET`	Push webhook cache bust
`FORGEJO_TOKEN`	Private repo raw/API reads

Webhook URL: https://app.coulomb.social/app/spaces/hooks/forgejo/

2.7 KiB Raw Blame History