coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/CONFIG.md
tegwick 2d0681f361
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Adopt shared hourly coordination frame and prepare guarded runtime patches 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
2026-10-15 20:45:06 +02:00

6.3 KiB
Raw Blame History

Config Point Registry

Philosophy

net-kingdom is opinionated: defaults, conventions, and automation are preferred at every level. A config point in this file is a conscious exception — a value that cannot be derived from the system's topology, naming conventions, component defaults, or available automation.

Minimizing this list is a design goal. Before adding a config point, ask:

  • Can the value be derived from a naming convention or topology fact?
  • Can it be auto-generated (e.g. from the Linux user identity, like Local Identity does)?
  • Is the default provided by the upstream component safe to accept?

If yes to any of the above, don't add it here.

Summary

ID Name Value Location(s)
CP-NK-001 ACME contact email bernd.worsch+netkingdom@gmail.com sso-mfa/k8s/cert-manager/issuers.yaml:38
CP-NK-002 privacyIDEA portal hostname pink.coulomb.social sso-mfa/k8s/privacyidea/ingress.yaml
CP-NK-003 privacyIDEA self-service hostname pink-account.coulomb.social sso-mfa/k8s/privacyidea/ingress.yaml
CP-NK-004 KeyCape OIDC hostname kc.coulomb.social sso-mfa/k8s/keycape/ingress.yaml, sso-mfa/k8s/authelia/configmap.yaml, sso-mfa/k8s/keycape/create-secrets.sh
CP-NK-005 Authelia login portal hostname auth.coulomb.social sso-mfa/k8s/authelia/ingress.yaml, sso-mfa/k8s/authelia/configmap.yaml
CP-NK-006 LLDAP admin web UI hostname lldap.coulomb.social sso-mfa/k8s/lldap/ingress.yaml
CP-NK-007 Ecosystem coordination frame f = 1h coordination-engine/config/coordination-frame.json (owner source)

CP-NK-002 — privacyIDEA portal hostname

Value: pink.coulomb.social Set: 2026-03-19 Set by: worsch

Location(s):

  • sso-mfa/k8s/privacyidea/ingress.yaml — all three Ingress host fields

Why non-default: Subdomain prefix must be chosen by the operator; no naming convention existed in the repo before T04. pink = PrivacyIDEA Net Knights (project-specific mnemonic).

Scope: TLS certificate, Traefik routing, and all references to the privacyIDEA public URL (including Keycloak Provider config in T05/T06).

CP-NK-003 — privacyIDEA self-service portal hostname

Value: pink-account.coulomb.social Set: 2026-03-19 Set by: worsch

Location(s):

  • sso-mfa/k8s/privacyidea/ingress.yaml — privacyidea-account Ingress host field

Why non-default: Separate hostname for the self-service portal allows different firewall/allowlist rules from the admin portal. Follows the <service>-account naming convention used in the workplan design.

Scope: TLS certificate and Traefik routing for the user-facing self-service token enrolment portal.

CP-NK-001 — ACME contact email

Value: bernd.worsch+netkingdom@gmail.com Set: 2026-03-02 Set by: worsch

Location(s):

  • sso-mfa/k8s/cert-manager/issuers.yaml:38 — spec.acme.email on the letsencrypt-prod ClusterIssuer

Why non-default: ACME (Let's Encrypt) requires a contact address for certificate lifecycle notifications — expiry warnings, rate-limit alerts, policy announcements. There is no system-level default that qualifies: this must be a real, monitored inbox.

Why not automated: The Linux user GECOS email (via Local Identity) would be a natural source. However, that introduces a runtime dependency between cluster provisioning and the local-identity tool. Deferred; revisit when Local Identity gains a structured "operator contact" concept.

Scope: All TLS certificates issued by the letsencrypt-prod ClusterIssuer across the entire cluster.

CP-NK-004 — KeyCape OIDC hostname

Value: kc.coulomb.social Set: 2026-03-19 Set by: worsch

Location(s):

  • sso-mfa/k8s/keycape/ingress.yaml — Ingress host field
  • sso-mfa/k8s/authelia/configmap.yaml — redirect_uris for the KeyCape OIDC client
  • sso-mfa/k8s/keycape/create-secrets.sh — issuer and redirectURI in config.yaml

Why non-default: Subdomain prefix must be chosen by the operator. kc is retained from the original design (kc = KeyCape) for DNS stability.

Scope: TLS certificate, Traefik routing, KeyCape's OIDC issuer claim, and all redirect URIs registered by downstream applications. Changing this hostname after clients are registered requires updating all registered redirect_uris.

CP-NK-005 — Authelia login portal hostname

Value: auth.coulomb.social Set: 2026-03-19 Set by: worsch

Location(s):

  • sso-mfa/k8s/authelia/ingress.yaml — Ingress host field
  • sso-mfa/k8s/authelia/configmap.yaml — session.domain parent domain comment

Why non-default: Subdomain prefix must be chosen by the operator. auth is the conventional prefix for authentication portals.

Scope: TLS certificate, Traefik routing, and the Authelia login page that users' browsers are redirected to during the OIDC flow. The session cookie domain is set to the parent domain (coulomb.social) so the cookie is valid across both auth.coulomb.social and kc.coulomb.social.

CP-NK-006 — LLDAP admin web UI hostname

Value: lldap.coulomb.social Set: 2026-03-19 Set by: worsch

Location(s):

  • sso-mfa/k8s/lldap/ingress.yaml — Ingress host field

Why non-default: Subdomain prefix must be chosen by the operator.

Scope: TLS certificate and Traefik routing for the LLDAP admin web UI. Access is IP-restricted by the lldap-admin-allowlist Traefik Middleware (VPN/office CIDRs only). The LDAP port (3890) is cluster-internal only and never exposed via Ingress.

CP-NK-007 — Ecosystem coordination frame

Owner: coordination-engine. Initial setting: frame_seconds: 3600. Founder decision 2026-10-15: pace long-term coordination in hourly rather than daily frames. This is an operator-selected pace, not a topology-derived value. The canonical file is coordination-engine/config/coordination-frame.json; NetKingdom keeps no independent editable copy.

Cadence adopters derive heartbeat f, receiver wait 2f and effective deadline 3f (including Audit Core's existing 1.5 grace). Change f once, then run tools/coordination-frame/render.py --write and --check. Generated owner artifacts carry the source digest. Runtime owners deploy reviewed artifacts; source regeneration is not deployment or estate-wide timer adoption.