tegwick
c71fb0fda9
Point operators at railiance-apps create-coulomb-social-env-secret.sh via scripts/create-env-secret.sh for production Secret assembly.
49 lines
1.4 KiB
Markdown
49 lines
1.4 KiB
Markdown
# Deploy notes (stub — CSOC-WP-0002-T08)
|
|
|
|
## Shape
|
|
|
|
Standalone service: commit-SHA images → registry
|
|
`gitea.coulomb.social/coulomb/coulomb-social` → `railiance-apps` values →
|
|
railiance01 (same lane as `vergabe-teilnahme`).
|
|
|
|
## Runtime secrets (names only)
|
|
|
|
K8s Secret `coulomb-social-env` in namespace `coulomb-social` (chart `envFrom`):
|
|
|
|
| Key | Source |
|
|
|-----|--------|
|
|
| `SECRET_KEY` | generated by env-secret script |
|
|
| `DATABASE_URL` | cnpg app role secret (URL-encoded password) |
|
|
| `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` |
|
|
|
|
```bash
|
|
# from railiance-apps:
|
|
make coulomb-social-env-secret-dry-run
|
|
make coulomb-social-env-secret
|
|
|
|
# from this repo:
|
|
./scripts/create-env-secret.sh --dry-run
|
|
./scripts/create-env-secret.sh
|
|
```
|
|
|
|
Script: `railiance-apps/tools/create-coulomb-social-env-secret.sh`
|
|
OIDC is a **public** client — no client secret.
|
|
## Health
|
|
|
|
- `GET /healthz` → `{"status":"ok"}`
|
|
|
|
## Build
|
|
|
|
```bash
|
|
SHA=$(git rev-parse --short HEAD)
|
|
docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .
|
|
```
|
|
|
|
Runtime env (no secrets in image): `SECRET_KEY`, `DATABASE_URL`,
|
|
`OIDC_*`, `USER_ENGINE_*`, `DEFAULT_TENANT_ID`, `ALLOWED_HOSTS`.
|
|
|
|
## Status
|
|
|
|
- Dockerfile present (gunicorn, non-root, `/healthz` check).
|
|
- railiance-apps Helm values / cluster Service **not** yet landed.
|
|
- Local `make run` + `make test` remain the default verification path.
|