ops-warden/wiki/playbooks/coulomb-social-runtime-env.md

coulomb-social runtime env credentials

Date: 2026-08-09
Catalog: coulomb-social-runtime-env
Owner: railiance-platform (apps-pg / OpenBao path when live) · consumer: railiance-apps / coulomb-social
ops-warden role: route + assist — never holds or prints values

Runtime credentials for the coulomb.social Django deployment (coulomb-social-env K8s Secret, mounted via Helm envFrom).

---

What this lane covers

Key	Source of truth (today)	Notes
SECRET_KEY	Generated into K8s Secret	Django session/signing
DATABASE_URL	apps-pg role secret → URL-encoded into env Secret	Needs apps-pg + role coulomb_social
USER_ENGINE_PROXY_SECRET	user-engine/user-engine-runtime key proxy-secret	Trusted proxy for user-engine /api/v1/me

Non-secret OIDC settings (OIDC_ISSUER, OIDC_CLIENT_ID, redirect URI) live in railiance-apps/helm/coulomb-social-values.yaml — not this lane.

OIDC client is public PKCE (coulomb-social on KeyCape) — no client secret.

---

Owner-confirmed handoff (K8s assembly)

Field	Value
Namespace	coulomb-social
Env Secret	coulomb-social-env
App DB credentials Secret	coulomb-social-app-credentials (basic-auth; mirrors into consumer ns)
DB role / database	coulomb_social / coulomb_social_db on apps-pg
user-engine proxy	user-engine/user-engine-runtime
Assembly script	railiance-apps/tools/create-coulomb-social-env-secret.sh
Make targets	make coulomb-social-env-secret · make coulomb-social-env-secret-dry-run
Future OpenBao path	platform/workloads/coulomb/coulomb-social/runtime-env (CCR pending)

---

Worker checklist

1. Route (always first)

warden route find "coulomb social env secret"
warden route show coulomb-social-runtime-env --json
warden access "coulomb social runtime env" --json

ops-warden does not vend these values. It points at the assembly script and owners.

2. Establish / refresh the env Secret (no values printed)

cd ~/railiance-apps
make coulomb-social-env-secret-dry-run    # plan: key names only
make coulomb-social-env-secret            # apply SECRET_KEY + USER_ENGINE_PROXY_SECRET (+ DATABASE_URL if DB secret exists)

From the app repo:

cd ~/coulomb-social
./scripts/create-env-secret.sh --dry-run
./scripts/create-env-secret.sh

3. Database credential (platform)

Until apps-pg is live and the role is present:

1. Platform adds managed role + Database CR (see railiance-platform/helm/apps-pg-*.yaml).
2. Ensure coulomb-social-app-credentials exists in coulomb-social (and databases ns for CNPG).
3. Re-run make coulomb-social-env-secret to fill DATABASE_URL.

4. Verify (capabilities / presence only)

# Key names only — never kubectl get secret -o yaml in logs
kubectl -n coulomb-social get secret coulomb-social-env -o json \
  | python3 -c 'import sys,json; print(sorted((json.load(sys.stdin).get("data") or {}).keys()))'

# Optional fingerprint via warden (no value):
# warden access coulomb-social-runtime-env --fingerprint   # when fetch wired

5. Rotate

# Django SECRET_KEY only
make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--rotate-secret-key'
kubectl -n coulomb-social rollout restart deploy/coulomb-social

# USER_ENGINE_PROXY_SECRET: rotate in user-engine-runtime, then re-run env-secret script
# DATABASE_URL: rotate apps-pg role password (platform), then re-run env-secret script

---

Anti-patterns

• Pasting SECRET_KEY, DSN passwords, or proxy secrets into chat, Git, or State Hub
• kubectl get secret … -o yaml in agent/CI logs
• Storing OIDC client secrets (client is public)
• Asking ops-warden to “give me the password” — use warden access for the path, then the assembly script as yourself

---

See also

• railiance-apps/docs/coulomb-social.md
• railiance-apps/tools/create-coulomb-social-env-secret.sh
• railiance-platform/docs/apps-pg.md
• coulomb-social/docs/deploy.md

---

Established (2026-08-09)

Operator session via warden access coulomb-social-runtime-env routing + assembly script:

Resource	Status
Namespace coulomb-social	present; labeled railiance.io/postgres-client=apps-pg
Secret coulomb-social/coulomb-social-env	keys: SECRET_KEY, DATABASE_URL, USER_ENGINE_PROXY_SECRET
Secret coulomb-social/coulomb-social-app-credentials	basic-auth username/password for role
Secret databases/coulomb-social-app-credentials	same password for future CNPG managed role
Catalog coulomb-social-runtime-env	active in ops-warden routing
apps-pg cluster	healthy (2026-08-09) — primary apps-pg-1
Role coulomb_social / DB coulomb_social_db	present; CNPG Database CR applied
Connectivity smoke	from ns coulomb-social: OK: coulomb_social coulomb_social_db

Re-verify key names only:

warden route show coulomb-social-runtime-env --json
kubectl -n coulomb-social get secret coulomb-social-env -o json \
  | python3 -c 'import sys,json; print(sorted((json.load(sys.stdin).get("data") or {}).keys()))'
kubectl get cluster apps-pg -n databases -o wide