tegwick
3f30bcd340
Keep git as source of truth: deep-link to Forgejo editor, manual refresh to drop cache, and optional signed push webhook for automatic invalidation.
96 lines
No EOL
2.7 KiB
Markdown
96 lines
No EOL
2.7 KiB
Markdown
# Deploy notes
|
|
|
|
## Shape
|
|
|
|
Standalone service: commit-SHA images → registry
|
|
`forgejo.coulomb.social/coulomb/coulomb-social` → `railiance-apps` Helm values →
|
|
railiance01 (same lane as `vergabe-teilnahme`).
|
|
|
|
Chart/values/ingress live in **`railiance-apps`**
|
|
(`helm/coulomb-social-values.yaml`, `docs/coulomb-social.md`).
|
|
|
|
## Host strategy
|
|
|
|
| Host | Role |
|
|
|------|------|
|
|
| **`https://app.coulomb.social`** | **Live** Railiance rebuild (identity shell now; product later) |
|
|
| **`https://coulomb.social`** | **Bubble.io** until data + self-registration + content ready |
|
|
| `http://127.0.0.1:8008` | Local OIDC/dev |
|
|
|
|
Apex DNS cutover is **deferred**. Retire Bubble only after an explicit decision.
|
|
|
|
## Current cluster status
|
|
|
|
| Item | State |
|
|
|------|--------|
|
|
| Namespace | `coulomb-social` |
|
|
| Public host | **`app.coulomb.social`** |
|
|
| OIDC redirect | `https://app.coulomb.social/auth/callback/` |
|
|
| Apex Bubble | unchanged |
|
|
|
|
## Runtime secrets (names only)
|
|
|
|
K8s Secret `coulomb-social-env` (`SECRET_KEY`, `DATABASE_URL`, `USER_ENGINE_PROXY_SECRET`).
|
|
|
|
```bash
|
|
# railiance-apps:
|
|
make coulomb-social-env-secret-dry-run
|
|
make coulomb-social-env-secret
|
|
```
|
|
|
|
OIDC is a **public** client — no client secret.
|
|
|
|
## Health
|
|
|
|
- `GET /healthz` → `{"status":"ok","service":"coulomb-social"}`
|
|
- Probes use `Host: app.coulomb.social`
|
|
|
|
## Build / deploy
|
|
|
|
```bash
|
|
SHA=$(git rev-parse --short HEAD)
|
|
docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .
|
|
# COULOMB_SOCIAL_IMAGE_TAG=$SHA make coulomb-social-deploy # in railiance-apps
|
|
# make coulomb-social-ingress-deploy
|
|
```
|
|
|
|
## Parallel host go-live checklist
|
|
|
|
1. [x] Helm env / ingress use `app.coulomb.social`
|
|
2. [x] KeyCape redirects include `https://app.coulomb.social/auth/callback/`
|
|
3. [ ] DNS: `app.coulomb.social` **A → `92.205.62.239`** (prefer DNS-only for LE)
|
|
4. [ ] `certificate/coulomb-social-tls` Ready for `app.coulomb.social`
|
|
5. [ ] `curl -fsS https://app.coulomb.social/healthz`
|
|
6. [ ] Browser Sign in as tegwick → `/app/`
|
|
|
|
## Future apex cutover (not now)
|
|
|
|
When Bubble can retire:
|
|
|
|
1. Point `coulomb.social` A at the cluster (or reverse-proxy)
|
|
2. Switch Helm `ALLOWED_HOSTS` / `OIDC_REDIRECT_URI` / ingress host if apex becomes canonical
|
|
3. Keep or drop `app.` as redirect alias
|
|
|
|
## Local verification
|
|
|
|
```bash
|
|
make test
|
|
make run # offline or local OIDC redirect
|
|
```
|
|
|
|
## Space content (Forgejo)
|
|
|
|
See `docs/spaces-content.md`. Demo:
|
|
|
|
```bash
|
|
kubectl -n coulomb-social exec deploy/coulomb-social -- python manage.py seed_demo_space
|
|
```
|
|
|
|
Optional webhook secret (when configured in cluster env):
|
|
|
|
| Key | Purpose |
|
|
|-----|---------|
|
|
| `FORGEJO_WEBHOOK_SECRET` | Push webhook cache bust |
|
|
| `FORGEJO_TOKEN` | Private repo raw/API reads |
|
|
|
|
Webhook URL: `https://app.coulomb.social/app/spaces/hooks/forgejo/` |