From 0da83472c4b0fdb76a9ccf60a7eaf8d64958ac53 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 17 Oct 2026 11:46:40 +0200 Subject: [PATCH] Default railiance01 kubeconfig to config-railiance01 config-hosteurope names port 16443, but the k3s-api-railiance01 ops-bridge tunnel listens on 16444, so every default target failed with connection refused. Switch Makefile, tools and docs to ~/.kube/config-railiance01 and fix the restore recipe to rewrite the API address to the tunnel port. The node-side hostPath in STATE.md is unrelated and unchanged. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 1031639@bnt-lap001 Assistant-Session: e5073fee-f4ae-4fc3-a75a-6c1fc83e0576 --- .custodian-brief.md | 7 +++---- Makefile | 2 +- STATE.md | 2 +- WORK-RECORDS.md | 2 +- docs/cnpg-backup-topology-inventory.md | 2 +- docs/credential-routing-railiance-apps.md | 2 +- docs/forgejo-on-railiance01.md | 14 ++++++------- docs/forgejo-package-registry.md | 2 +- docs/informed-decision-origin.md | 11 +++++----- docs/inter-hub-on-railiance01.md | 6 +++--- docs/operator-setup.md | 16 +++++++++------ docs/reuse-surface-on-railiance01.md | 20 +++++++++---------- tools/forgejo-breakglass-seal.sh | 2 +- tools/forgejo-helm-secrets.sh | 2 +- tools/forgejo-openbao-eso-token-apply.sh | 2 +- ...gejo-runner-registration-sops-bootstrap.sh | 2 +- tools/forgejo-verify.sh | 2 +- tools/reuse-forgejo-webhook.sh | 2 +- tools/reuse-openbao-eso-token-apply.sh | 2 +- tools/reuse-webhook-smoke.sh | 2 +- 20 files changed, 52 insertions(+), 50 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 4be7fc6..b12bc98 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,24 +2,23 @@ # Custodian Brief — railiance-apps **Domain:** financials -**Last synced:** 2026-10-17 09:32 UTC +**Last synced:** 2026-10-17 09:42 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Forgejo sign-in through NetKingdom, before the forge closes -Progress: 0/5 done | workplan_id: `f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b` +Progress: 1/5 done | workplan_id: `f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b` **Open tasks:** - ! T01 — Make the local administrator a sealed break-glass `13cd3aec` - *(wait: Needs break-glass in place and the NetKingdom client registered with its secret in custody.)* + *(wait: Break-glass done (T01); needs the NetKingdom client registered with its secret in custody (KEY-WP-0038-T02).)* - ! T02 — Add the NetKingdom authentication source `81f072aa` *(wait: Linking and team mapping follow a working authentication source.)* - ! T03 — Link accounts and map groups to teams `32c54737` *(wait: Restricting local password sign-in is a founder decision once NetKingdom sign-in is proven.)* - ! T04 — Decide on local password sign-in `728786c9` *(wait: Waits for the NK-WP-0048-T16 option decision and net-kingdom's answer to the Apps needs-change record.)* -- ► Tasks `98004ed0` ### Coulomb-social persistent personal workspace release Progress: 3/4 done | workplan_id: `79abacf8-361e-51ab-829d-40dec8e142d1` diff --git a/Makefile b/Makefile index a1cb302..da70a3a 100644 --- a/Makefile +++ b/Makefile @@ -50,7 +50,7 @@ POLICY_NEXUS_SOURCE_SET_DIGEST ?= $(shell python3 -c 'import json; print(json.lo POLICY_NEXUS_REVISION ?= COULOMBCORE_KUBECONFIG ?= $(HOME)/.kube/config -RAILIANCE01_KUBECONFIG ?= $(HOME)/.kube/config-hosteurope +RAILIANCE01_KUBECONFIG ?= $(HOME)/.kube/config-railiance01 PRODUCTION_KUBECONFIG ?= $(COULOMBCORE_KUBECONFIG) INTER_HUB_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG) REUSE_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG) diff --git a/STATE.md b/STATE.md index 29a4baf..8b954df 100644 --- a/STATE.md +++ b/STATE.md @@ -44,7 +44,7 @@ export KUBECONFIG=~/.kube/config make cnpg-backup-status # railiance01 activity -export KUBECONFIG=~/.kube/config-hosteurope +export KUBECONFIG=~/.kube/config-railiance01 kubectl -n activity-core get externalsecret actcore-backup-offsite # inventory should list Daily CNPG Option A Backup enabled ``` diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index f56782b..89c6d25 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -38,7 +38,7 @@ | task | RAPPS-WP-0015-T02 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md | | task | RAPPS-WP-0015-T03 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md | | task | RAPPS-WP-0015-T04 | wait | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md | -| task | RAPPS-WP-0016-T01 | progress | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md | +| task | RAPPS-WP-0016-T01 | done | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md | | task | RAPPS-WP-0016-T02 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md | | task | RAPPS-WP-0016-T03 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md | | task | RAPPS-WP-0016-T04 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md | diff --git a/docs/cnpg-backup-topology-inventory.md b/docs/cnpg-backup-topology-inventory.md index d189798..37f7bfd 100644 --- a/docs/cnpg-backup-topology-inventory.md +++ b/docs/cnpg-backup-topology-inventory.md @@ -9,7 +9,7 @@ | Host | Kubeconfig (operator workstation) | API | | --- | --- | --- | | CoulombCore | `~/.kube/config` | tunnel `k3s-api-coulombcore` | -| railiance01 | `~/.kube/config-hosteurope` | local / hosteurope | +| railiance01 | `~/.kube/config-railiance01` | local / hosteurope | ## Production-of-record (POR) decisions diff --git a/docs/credential-routing-railiance-apps.md b/docs/credential-routing-railiance-apps.md index b43444b..8fe4f40 100644 --- a/docs/credential-routing-railiance-apps.md +++ b/docs/credential-routing-railiance-apps.md @@ -9,7 +9,7 @@ platform tooling. | Host | IP | Kubeconfig | Tunnel | | --- | --- | --- | --- | | CoulombCore (production apps) | `92.205.130.254` | `~/.kube/config` via `k3s-api-coulombcore` | `bridge up k3s-api-coulombcore` | -| Railiance01 (Forgejo S5) | `92.205.62.239` | `~/.kube/config-hosteurope` | `bridge up k3s-api-railiance01` if configured | +| Railiance01 (Forgejo S5) | `92.205.62.239` | `~/.kube/config-railiance01` | `bridge up k3s-api-railiance01` if configured | Core Hub, `vergabe-teilnahme`, and `apps-pg` currently run on **CoulombCore**. Railiance01 hosts Forgejo and a overlapping subset of platform databases. diff --git a/docs/forgejo-on-railiance01.md b/docs/forgejo-on-railiance01.md index fae7ee2..aa5c795 100644 --- a/docs/forgejo-on-railiance01.md +++ b/docs/forgejo-on-railiance01.md @@ -27,7 +27,7 @@ Hostname decision: `the-custodian/docs/forgejo-production-decisions.md`. | Chart | `gitea-charts/gitea` **12.5.0** (Forgejo-compatible; 12.6+ needs Gitea 1.26 `config edit-ini`) | | Image | `code.forgejo.org/forgejo/forgejo:11.0.3` | | Database | `forgejo-db-rw.databases.svc.cluster.local:5432` | -| Kubeconfig | `~/.kube/config-hosteurope` | +| Kubeconfig | `~/.kube/config-railiance01` | ## Bootstrap (first deploy) @@ -36,8 +36,8 @@ Hostname decision: `the-custodian/docs/forgejo-production-decisions.md`. ```bash cd ~/railiance-platform # One-time: create and SOPS-encrypt helm/forgejo-db-secret.sops.yaml from template -KUBECONFIG=~/.kube/config-hosteurope make forgejo-db-deploy -KUBECONFIG=~/.kube/config-hosteurope make forgejo-db-status +KUBECONFIG=~/.kube/config-railiance01 make forgejo-db-deploy +KUBECONFIG=~/.kube/config-railiance01 make forgejo-db-status ``` ### 2. Application secrets (apps) @@ -185,10 +185,10 @@ Bootstrap (railiance01): ```bash cd ~/railiance-apps -KUBECONFIG=~/.kube/config-hosteurope make forgejo-openbao-eso-token-apply -KUBECONFIG=~/.kube/config-hosteurope make forgejo-mailer-es-deploy -KUBECONFIG=~/.kube/config-hosteurope make forgejo-mailer-es-status # expect SecretSynced -KUBECONFIG=~/.kube/config-hosteurope make forgejo-deploy +KUBECONFIG=~/.kube/config-railiance01 make forgejo-openbao-eso-token-apply +KUBECONFIG=~/.kube/config-railiance01 make forgejo-mailer-es-deploy +KUBECONFIG=~/.kube/config-railiance01 make forgejo-mailer-es-status # expect SecretSynced +KUBECONFIG=~/.kube/config-railiance01 make forgejo-deploy ``` Do not put the SMTP password in `helm/forgejo-secrets.sops.yaml`. diff --git a/docs/forgejo-package-registry.md b/docs/forgejo-package-registry.md index ba38fb0..99440ad 100644 --- a/docs/forgejo-package-registry.md +++ b/docs/forgejo-package-registry.md @@ -19,7 +19,7 @@ docker push forgejo.coulomb.social/coulomb/REPO:TAG Cluster pull (railiance01): ```bash -KUBECONFIG=~/.kube/config-hosteurope crictl pull forgejo.coulomb.social/coulomb/REPO:TAG +KUBECONFIG=~/.kube/config-railiance01 crictl pull forgejo.coulomb.social/coulomb/REPO:TAG ``` Smoke: `make forgejo-smoke` diff --git a/docs/informed-decision-origin.md b/docs/informed-decision-origin.md index 6c35e31..6d62535 100644 --- a/docs/informed-decision-origin.md +++ b/docs/informed-decision-origin.md @@ -120,7 +120,7 @@ see the correction above. ## Redeploy / recovery ```bash -export KUBECONFIG=$HOME/.kube/config-hosteurope +export KUBECONFIG=$HOME/.kube/config-railiance01 kubectl apply -f manifests/informed-decision-origin.yaml kubectl apply -f manifests/informed-decision-ingress.yaml kubectl apply -f manifests/informed-decision-http-redirect.yaml @@ -132,11 +132,10 @@ curl -sSI https://decisions.coulomb.social/ | head -1 That `curl` succeeded on 2026-09-10, which is the gate `informed-decision` was waiting on. -**Note on the kubeconfig:** `~/.kube/config-hosteurope` names port `16443`, but -the `k3s-api-railiance01` ops-bridge tunnel currently listens on `16444`. -Override with `--server https://127.0.0.1:16444` or fix the kubeconfig; `bridge -check` reports the tunnel healthy either way, so it does not surface the -mismatch. +**Note on the kubeconfig:** use `~/.kube/config-railiance01`, which targets the +`k3s-api-railiance01` ops-bridge tunnel on `16444`. The retired +`~/.kube/config-hosteurope` names port `16443`; `bridge check` reports the tunnel +healthy either way, so it does not surface that mismatch. ## HTTP → HTTPS diff --git a/docs/inter-hub-on-railiance01.md b/docs/inter-hub-on-railiance01.md index 98234e8..482d96d 100644 --- a/docs/inter-hub-on-railiance01.md +++ b/docs/inter-hub-on-railiance01.md @@ -22,7 +22,7 @@ deploy Inter-Hub to production. | Values | `helm/inter-hub-values.yaml` | | Image | `forgejo.coulomb.social/coulomb/inter-hub:` | | Secret | `inter-hub-env` | -| Production kubeconfig | `~/.kube/config-hosteurope` | +| Production kubeconfig | `~/.kube/config-railiance01` | ## Current evidence @@ -50,7 +50,7 @@ Read-only checks on 2026-06-15 showed: ## Deploy Use the Railiance01 kubeconfig. The Makefile defaults to -`~/.kube/config-hosteurope` and fails fast when it is missing. +`~/.kube/config-railiance01` and fails fast when it is missing. ```bash make inter-hub-render-baseline @@ -86,7 +86,7 @@ production trigger. It requires: - `image_tag`, the immutable inter-hub image tag to deploy; - `confirm`, with the exact value `deploy-inter-hub-production`; - an approved self-hosted runner with Railiance01 kubeconfig access at - `~/.kube/config-hosteurope` or an equivalent `RAILIANCE01_KUBECONFIG` + `~/.kube/config-railiance01` or an equivalent `RAILIANCE01_KUBECONFIG` override; - registry access through `skopeo`, `crane`, `docker manifest inspect`, or the registry HTTP API. diff --git a/docs/operator-setup.md b/docs/operator-setup.md index 5596735..687e8bc 100644 --- a/docs/operator-setup.md +++ b/docs/operator-setup.md @@ -51,23 +51,27 @@ ambient `kubectl` context for production app deploys. The production Makefile targets default to: ```text -~/.kube/config-hosteurope +~/.kube/config-railiance01 ``` +It reaches the API through the `k3s-api-railiance01` ops-bridge tunnel on +`127.0.0.1:16444` (`bridge up k3s-api-railiance01` if it is down). The older +`~/.kube/config-hosteurope` names port `16443` and is retired. + Restore it from Railiance01 when missing: ```bash ssh tegwick@92.205.62.239 'sudo cat /etc/rancher/k3s/k3s.yaml' \ - | sed 's|127.0.0.1|92.205.62.239|' > ~/.kube/config-hosteurope -chmod 600 ~/.kube/config-hosteurope -export KUBECONFIG=~/.kube/config-hosteurope + | sed 's|127.0.0.1:6443|127.0.0.1:16444|' > ~/.kube/config-railiance01 +chmod 600 ~/.kube/config-railiance01 +export KUBECONFIG=~/.kube/config-railiance01 ``` The app-specific targets also accept explicit overrides: ```bash -REUSE_KUBECONFIG=~/.kube/config-hosteurope make reuse-status -INTER_HUB_KUBECONFIG=~/.kube/config-hosteurope make inter-hub-status +REUSE_KUBECONFIG=~/.kube/config-railiance01 make reuse-status +INTER_HUB_KUBECONFIG=~/.kube/config-railiance01 make inter-hub-status ``` ## SOPS Age Key Bootstrap diff --git a/docs/reuse-surface-on-railiance01.md b/docs/reuse-surface-on-railiance01.md index 665c01e..8264dd0 100644 --- a/docs/reuse-surface-on-railiance01.md +++ b/docs/reuse-surface-on-railiance01.md @@ -22,7 +22,7 @@ Let's Encrypt HTTP-01 on Railiance01 requires the public A record to reach ```bash dig +short reuse.coulomb.social A -KUBECONFIG=~/.kube/config-hosteurope kubectl get certificate -n reuse +KUBECONFIG=~/.kube/config-railiance01 kubectl get certificate -n reuse ``` If DNS is being changed in the future, use an explicit resolve only during @@ -30,7 +30,7 @@ propagation: ```bash curl -k --resolve reuse.coulomb.social:443:92.205.62.239 https://reuse.coulomb.social/health -KUBECONFIG=~/.kube/config-hosteurope kubectl port-forward -n reuse svc/reuse-surface 18001:8000 +KUBECONFIG=~/.kube/config-railiance01 kubectl port-forward -n reuse svc/reuse-surface 18001:8000 export REUSE_SURFACE_URL=http://127.0.0.1:18001 ``` @@ -65,8 +65,8 @@ Deployment. After patching the Secret, restart the Deployment so new values are picked up: ```bash -kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-surface -n reuse -kubectl --kubeconfig ~/.kube/config-hosteurope rollout status deployment/reuse-surface -n reuse +kubectl --kubeconfig ~/.kube/config-railiance01 rollout restart deployment/reuse-surface -n reuse +kubectl --kubeconfig ~/.kube/config-railiance01 rollout status deployment/reuse-surface -n reuse ``` **Rotation** (never commit or paste values into chat): @@ -75,10 +75,10 @@ Full procedure: `railiance-platform/docs/reuse-surface-runtime-secrets-rotation- ```bash # After updating field(s) in OpenBao — force ESO sync, roll hub, reconcile webhook if needed -kubectl --kubeconfig ~/.kube/config-hosteurope annotate externalsecret \ +kubectl --kubeconfig ~/.kube/config-railiance01 annotate externalsecret \ reuse-surface-runtime -n reuse force-sync="$(date +%s)" --overwrite make reuse-runtime-es-status -kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-surface -n reuse +kubectl --kubeconfig ~/.kube/config-railiance01 rollout restart deployment/reuse-surface -n reuse make reuse-forgejo-webhook # required when REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET changed make reuse-webhook-smoke ``` @@ -153,14 +153,14 @@ the API service. ```bash # 1. Pin image tag in helm/reuse-surface-values.yaml # 2. Ensure reuse-surface-env has both keys (see Runtime secrets above) -# 3. Production (Railiance01, defaults to ~/.kube/config-hosteurope) +# 3. Production (Railiance01, defaults to ~/.kube/config-railiance01) make reuse-deploy make reuse-forgejo-webhook # after webhook secret is in the cluster Secret make reuse-status # Restore kubeconfig from the node if missing: # ssh tegwick@92.205.62.239 'sudo cat /etc/rancher/k3s/k3s.yaml' \ -# | sed 's|127.0.0.1|92.205.62.239|' > ~/.kube/config-hosteurope +# | sed 's|127.0.0.1:6443|127.0.0.1:16444|' > ~/.kube/config-railiance01 ``` ## Smoke checks @@ -172,7 +172,7 @@ curl -fsS https://reuse.coulomb.social/ curl -fsS https://reuse.coulomb.social/health curl -fsS https://reuse.coulomb.social/v1/federated -export REUSE_SURFACE_TOKEN=$(kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse \ +export REUSE_SURFACE_TOKEN=$(kubectl --kubeconfig ~/.kube/config-railiance01 get secret reuse-surface-env -n reuse \ -o jsonpath='{.data.REUSE_SURFACE_TOKEN}' | base64 -d) export REUSE_SURFACE_URL=https://reuse.coulomb.social reuse-surface hub status @@ -212,4 +212,4 @@ make reuse-deploy ``` Bootstrap copy on CoulombCore (`92.205.130.254`) was removed 2026-06-15 — use -`config-hosteurope` only. +`config-railiance01` only. diff --git a/tools/forgejo-breakglass-seal.sh b/tools/forgejo-breakglass-seal.sh index 091164a..5adce66 100755 --- a/tools/forgejo-breakglass-seal.sh +++ b/tools/forgejo-breakglass-seal.sh @@ -8,7 +8,7 @@ set -euo pipefail BREAKGLASS_USER="${FORGEJO_BREAKGLASS_USER:-forgejo_admin}" BREAKGLASS_PATH="${FORGEJO_BREAKGLASS_PATH:-platform/workloads/forgejo/break-glass-admin}" BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}" -FORGEJO_KUBECONFIG="${FORGEJO_KUBECONFIG:-$HOME/.kube/config-hosteurope}" +FORGEJO_KUBECONFIG="${FORGEJO_KUBECONFIG:-$HOME/.kube/config-railiance01}" FORGEJO_NAMESPACE="${FORGEJO_NAMESPACE:-forgejo}" for cmd in bao kubectl openssl; do diff --git a/tools/forgejo-helm-secrets.sh b/tools/forgejo-helm-secrets.sh index 4aba1af..f5c1f7f 100755 --- a/tools/forgejo-helm-secrets.sh +++ b/tools/forgejo-helm-secrets.sh @@ -4,7 +4,7 @@ set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" SECRETS_FILE="${FORGEJO_SECRETS:-$ROOT_DIR/helm/forgejo-secrets.sops.yaml}" -KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}" +KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-railiance01}" emit_from_sops() { sops -d "$SECRETS_FILE" | python3 -c " diff --git a/tools/forgejo-openbao-eso-token-apply.sh b/tools/forgejo-openbao-eso-token-apply.sh index 40d8be6..a02249e 100755 --- a/tools/forgejo-openbao-eso-token-apply.sh +++ b/tools/forgejo-openbao-eso-token-apply.sh @@ -6,7 +6,7 @@ set -euo pipefail POLICY_NAME="${OPENBAO_FORGEJO_POLICY:-workload-kv-read-forgejo-mailer}" POLICY_FILE="${OPENBAO_FORGEJO_POLICY_FILE:-$HOME/railiance-platform/openbao/policies/workload-kv-read-forgejo-mailer.hcl}" BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}" -RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}" +RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}" SECRET_NAME="${OPENBAO_FORGEJO_ESO_SECRET:-openbao-forgejo-eso-token}" SECRET_NS="${OPENBAO_FORGEJO_ESO_NAMESPACE:-external-secrets}" diff --git a/tools/forgejo-runner-registration-sops-bootstrap.sh b/tools/forgejo-runner-registration-sops-bootstrap.sh index b639013..2a40d83 100755 --- a/tools/forgejo-runner-registration-sops-bootstrap.sh +++ b/tools/forgejo-runner-registration-sops-bootstrap.sh @@ -5,7 +5,7 @@ set -euo pipefail ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" OUT="${ROOT}/helm/forgejo-runner-registration.sops.yaml" -KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}" +KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-railiance01}" FORGEJO_NAMESPACE="${FORGEJO_NAMESPACE:-forgejo}" export KUBECONFIG diff --git a/tools/forgejo-verify.sh b/tools/forgejo-verify.sh index 1843d5f..d17791e 100755 --- a/tools/forgejo-verify.sh +++ b/tools/forgejo-verify.sh @@ -4,7 +4,7 @@ set -euo pipefail ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" BASE_URL="${FORGEJO_BASE_URL:-https://forgejo.coulomb.social}" -KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}" +KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-railiance01}" FORGEJO_NAMESPACE="${FORGEJO_NAMESPACE:-forgejo}" FORGEJO_DB_NAMESPACE="${FORGEJO_DB_NAMESPACE:-databases}" FORGEJO_DB_CLUSTER="${FORGEJO_DB_CLUSTER:-forgejo-db}" diff --git a/tools/reuse-forgejo-webhook.sh b/tools/reuse-forgejo-webhook.sh index 15b7320..2ce77cb 100755 --- a/tools/reuse-forgejo-webhook.sh +++ b/tools/reuse-forgejo-webhook.sh @@ -6,7 +6,7 @@ set -euo pipefail FORGEJO_API="${FORGEJO_API:-https://forgejo.coulomb.social/api/v1}" FORGEJO_ORG="${FORGEJO_ORG:-coulomb}" WEBHOOK_URL="${REUSE_WEBHOOK_URL:-https://reuse.coulomb.social/v1/webhooks/forgejo}" -KUBECONFIG_PATH="${KUBECONFIG:-$HOME/.kube/config-hosteurope}" +KUBECONFIG_PATH="${KUBECONFIG:-$HOME/.kube/config-railiance01}" SECRET_NS="${REUSE_SECRET_NAMESPACE:-reuse}" SECRET_NAME="${REUSE_SECRET_NAME:-reuse-surface-env}" SECRET_KEY="${REUSE_WEBHOOK_SECRET_KEY:-REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET}" diff --git a/tools/reuse-openbao-eso-token-apply.sh b/tools/reuse-openbao-eso-token-apply.sh index d1c8c15..ad5bc11 100755 --- a/tools/reuse-openbao-eso-token-apply.sh +++ b/tools/reuse-openbao-eso-token-apply.sh @@ -6,7 +6,7 @@ set -euo pipefail POLICY_NAME="${OPENBAO_REUSE_POLICY:-workload-kv-read-reuse-surface-runtime}" POLICY_FILE="${OPENBAO_REUSE_POLICY_FILE:-$HOME/railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime.hcl}" BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}" -RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}" +RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}" SECRET_NAME="${OPENBAO_REUSE_ESO_SECRET:-openbao-reuse-eso-token}" SECRET_NS="${OPENBAO_REUSE_ESO_NAMESPACE:-external-secrets}" diff --git a/tools/reuse-webhook-smoke.sh b/tools/reuse-webhook-smoke.sh index f7a48a0..e406267 100755 --- a/tools/reuse-webhook-smoke.sh +++ b/tools/reuse-webhook-smoke.sh @@ -5,7 +5,7 @@ set -euo pipefail REUSE_URL="${REUSE_URL:-https://reuse.coulomb.social}" WEBHOOK_PATH="${REUSE_WEBHOOK_PATH:-/v1/webhooks/forgejo}" -KUBECONFIG_PATH="${KUBECONFIG:-$HOME/.kube/config-hosteurope}" +KUBECONFIG_PATH="${KUBECONFIG:-$HOME/.kube/config-railiance01}" SECRET_NS="${REUSE_SECRET_NAMESPACE:-reuse}" SECRET_NAME="${REUSE_SECRET_NAME:-reuse-surface-env}" SECRET_KEY="${REUSE_WEBHOOK_SECRET_KEY:-REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET}"