tegwick
f5537d8365
Document parallel-host strategy: Railiance on app.*, Bubble remains on coulomb.social until data and self-registration are ready.
79 lines
2.3 KiB
Markdown
79 lines
2.3 KiB
Markdown
# Deploy notes
|
|
|
|
## Shape
|
|
|
|
Standalone service: commit-SHA images → registry
|
|
`forgejo.coulomb.social/coulomb/coulomb-social` → `railiance-apps` Helm values →
|
|
railiance01 (same lane as `vergabe-teilnahme`).
|
|
|
|
Chart/values/ingress live in **`railiance-apps`**
|
|
(`helm/coulomb-social-values.yaml`, `docs/coulomb-social.md`).
|
|
|
|
## Host strategy
|
|
|
|
| Host | Role |
|
|
|------|------|
|
|
| **`https://app.coulomb.social`** | **Live** Railiance rebuild (identity shell now; product later) |
|
|
| **`https://coulomb.social`** | **Bubble.io** until data + self-registration + content ready |
|
|
| `http://127.0.0.1:8008` | Local OIDC/dev |
|
|
|
|
Apex DNS cutover is **deferred**. Retire Bubble only after an explicit decision.
|
|
|
|
## Current cluster status
|
|
|
|
| Item | State |
|
|
|------|--------|
|
|
| Namespace | `coulomb-social` |
|
|
| Public host | **`app.coulomb.social`** |
|
|
| OIDC redirect | `https://app.coulomb.social/auth/callback/` |
|
|
| Apex Bubble | unchanged |
|
|
|
|
## Runtime secrets (names only)
|
|
|
|
K8s Secret `coulomb-social-env` (`SECRET_KEY`, `DATABASE_URL`, `USER_ENGINE_PROXY_SECRET`).
|
|
|
|
```bash
|
|
# railiance-apps:
|
|
make coulomb-social-env-secret-dry-run
|
|
make coulomb-social-env-secret
|
|
```
|
|
|
|
OIDC is a **public** client — no client secret.
|
|
|
|
## Health
|
|
|
|
- `GET /healthz` → `{"status":"ok","service":"coulomb-social"}`
|
|
- Probes use `Host: app.coulomb.social`
|
|
|
|
## Build / deploy
|
|
|
|
```bash
|
|
SHA=$(git rev-parse --short HEAD)
|
|
docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .
|
|
# COULOMB_SOCIAL_IMAGE_TAG=$SHA make coulomb-social-deploy # in railiance-apps
|
|
# make coulomb-social-ingress-deploy
|
|
```
|
|
|
|
## Parallel host go-live checklist
|
|
|
|
1. [x] Helm env / ingress use `app.coulomb.social`
|
|
2. [x] KeyCape redirects include `https://app.coulomb.social/auth/callback/`
|
|
3. [ ] DNS: `app.coulomb.social` **A → `92.205.62.239`** (prefer DNS-only for LE)
|
|
4. [ ] `certificate/coulomb-social-tls` Ready for `app.coulomb.social`
|
|
5. [ ] `curl -fsS https://app.coulomb.social/healthz`
|
|
6. [ ] Browser Sign in as tegwick → `/app/`
|
|
|
|
## Future apex cutover (not now)
|
|
|
|
When Bubble can retire:
|
|
|
|
1. Point `coulomb.social` A at the cluster (or reverse-proxy)
|
|
2. Switch Helm `ALLOWED_HOSTS` / `OIDC_REDIRECT_URI` / ingress host if apex becomes canonical
|
|
3. Keep or drop `app.` as redirect alias
|
|
|
|
## Local verification
|
|
|
|
```bash
|
|
make test
|
|
make run # offline or local OIDC redirect
|
|
```
|