tegwick c71fb0fda9 Document and wrap coulomb-social-env secret script

Point operators at railiance-apps create-coulomb-social-env-secret.sh
via scripts/create-env-secret.sh for production Secret assembly.

2026-08-09 02:04:33 +02:00

1.4 KiB

Raw Blame History

Deploy notes (stub — CSOC-WP-0002-T08)

Shape

Standalone service: commit-SHA images → registry gitea.coulomb.social/coulomb/coulomb-social → railiance-apps values → railiance01 (same lane as vergabe-teilnahme).

Runtime secrets (names only)

K8s Secret coulomb-social-env in namespace coulomb-social (chart envFrom):

Key	Source
`SECRET_KEY`	generated by env-secret script
`DATABASE_URL`	cnpg app role secret (URL-encoded password)
`USER_ENGINE_PROXY_SECRET`	`user-engine/user-engine-runtime`

# from railiance-apps:
make coulomb-social-env-secret-dry-run
make coulomb-social-env-secret

# from this repo:
./scripts/create-env-secret.sh --dry-run
./scripts/create-env-secret.sh

Script: railiance-apps/tools/create-coulomb-social-env-secret.sh
OIDC is a public client — no client secret.

Health

GET /healthz → {"status":"ok"}

Build

SHA=$(git rev-parse --short HEAD)
docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .

Runtime env (no secrets in image): SECRET_KEY, DATABASE_URL, OIDC_*, USER_ENGINE_*, DEFAULT_TENANT_ID, ALLOWED_HOSTS.

Status

Dockerfile present (gunicorn, non-root, /healthz check).
railiance-apps Helm values / cluster Service not yet landed.
Local make run + make test remain the default verification path.

1.4 KiB Raw Blame History