Add login alias and record CoulombCore DNS inventory

sso-mfa/k8s/authelia/ingress.yaml

@@ -1,7 +1,7 @@
 # Ingress — Authelia login portal (namespace: sso)
 #
-# auth.coulomb.social — Authelia login page; browsers are redirected here
+# auth.coulomb.social — canonical Authelia OIDC endpoint used by KeyCape.
-#                       by KeyCape during the OIDC authorization flow.
+# login.coulomb.social — user-facing alias for the same login portal.
 #
 # This hostname MUST be publicly reachable: users' browsers redirect here
 # to enter their password. (MFA happens at the KeyCape layer, not here.)
@@ -33,7 +33,18 @@ spec:
                 name: authelia
                 port:
                   number: 9091
+    - host: login.coulomb.social
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: authelia
+                port:
+                  number: 9091
   tls:
     - secretName: auth-tls
       hosts:
         - auth.coulomb.social
+        - login.coulomb.social

workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-27"
-updated: "2026-07-27"
+updated: "2026-07-28"
 depends_on:
   - USER-WP-0020
   - NK-WP-0023
@@ -38,7 +38,7 @@ before state migration or retirement begins.
 
 ```task
 id: NK-WP-0022-T01
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "fe55a2c2-8613-4190-a0b9-07eff4a58146"
 ```
@@ -54,6 +54,15 @@ Done when every component and state owner has a source, destination,
 verification method, rollback source, and explicit decision on whether
 railiance01 is already equivalent or requires migration.
 
+2026-07-28 DNS inventory: public resolvers show `auth.coulomb.social` and the
+new `login.coulomb.social` alias at railiance01 (`92.205.62.239`). The
+following names remain explicitly on CoulombCore (`92.205.130.254`):
+`bao`, `gitea`, `hub`, `lldap`, `pink-account`, and `pink` under
+`coulomb.social`. The last three are identity-cutover scope; Bao, Gitea, and
+Hub must be handed to their owning workload cutovers before CoulombCore host
+retirement. Local resolver caches may temporarily retain the former
+`auth.coulomb.social` address.
+
 ## T02 - Prove recoverable backups before changing state
 
 ```task
@@ -132,7 +141,7 @@ machine-readable.
 
 ```task
 id: NK-WP-0022-T06
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "00bfa48b-28de-4b8e-b3da-715c797beae5"
 ```
@@ -147,6 +156,11 @@ window. Roll back DNS if critical authentication or MFA gates fail.
 Done when normal DNS consistently resolves to railiance01 and the observation
 window passes without fallback traffic or state divergence.
 
+2026-07-28: authoritative/public recursive DNS now returns railiance01 for
+`auth.coulomb.social`; `login.coulomb.social` was added as an Authelia ingress
+and certificate alias. LLDAP and both privacyIDEA names remain intentionally
+on CoulombCore pending the state and conformance gates above.
+
 ## T07 - Retire CoulombCore identity workloads reversibly
 
 ```task