coulomb/railiance-apps
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Default railiance01 kubeconfig to config-railiance01
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
config-hosteurope names port 16443, but the k3s-api-railiance01
ops-bridge tunnel listens on 16444, so every default target failed
with connection refused. Switch Makefile, tools and docs to
~/.kube/config-railiance01 and fix the restore recipe to rewrite the
API address to the tunnel port. The node-side hostPath in STATE.md is
unrelated and unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1031639@bnt-lap001
Assistant-Session: e5073fee-f4ae-4fc3-a75a-6c1fc83e0576
This commit is contained in:
tegwick 2026-10-17 11:46:40 +02:00
parent 74213d80f0
commit 0da83472c4
20 changed files with 52 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/cnpg-backup-topology-inventory.md
View file

@ -9,7 +9,7 @@
| Host | Kubeconfig (operator workstation) | API |
| --- | --- | --- |
| CoulombCore | `~/.kube/config` | tunnel `k3s-api-coulombcore` |
| railiance01 | `~/.kube/config-hosteurope` | local / hosteurope |
| railiance01 | `~/.kube/config-railiance01` | local / hosteurope |
## Production-of-record (POR) decisions

2
docs/credential-routing-railiance-apps.md
View file

@ -9,7 +9,7 @@ platform tooling.
| Host | IP | Kubeconfig | Tunnel |
| --- | --- | --- | --- |
| CoulombCore (production apps) | `92.205.130.254` | `~/.kube/config` via `k3s-api-coulombcore` | `bridge up k3s-api-coulombcore` |
| Railiance01 (Forgejo S5) | `92.205.62.239` | `~/.kube/config-hosteurope` | `bridge up k3s-api-railiance01` if configured |
| Railiance01 (Forgejo S5) | `92.205.62.239` | `~/.kube/config-railiance01` | `bridge up k3s-api-railiance01` if configured |
Core Hub, `vergabe-teilnahme`, and `apps-pg` currently run on **CoulombCore**.
Railiance01 hosts Forgejo and a overlapping subset of platform databases.

14
docs/forgejo-on-railiance01.md
View file

@ -27,7 +27,7 @@ Hostname decision: `the-custodian/docs/forgejo-production-decisions.md`.
| Chart | `gitea-charts/gitea` **12.5.0** (Forgejo-compatible; 12.6+ needs Gitea 1.26 `config edit-ini`) |
| Image | `code.forgejo.org/forgejo/forgejo:11.0.3` |
| Database | `forgejo-db-rw.databases.svc.cluster.local:5432` |
| Kubeconfig | `~/.kube/config-hosteurope` |
| Kubeconfig | `~/.kube/config-railiance01` |
## Bootstrap (first deploy)
@ -36,8 +36,8 @@ Hostname decision: `the-custodian/docs/forgejo-production-decisions.md`.
```bash
cd ~/railiance-platform
# One-time: create and SOPS-encrypt helm/forgejo-db-secret.sops.yaml from template
KUBECONFIG=~/.kube/config-hosteurope make forgejo-db-deploy
KUBECONFIG=~/.kube/config-hosteurope make forgejo-db-status
KUBECONFIG=~/.kube/config-railiance01 make forgejo-db-deploy
KUBECONFIG=~/.kube/config-railiance01 make forgejo-db-status
```
### 2. Application secrets (apps)
@ -185,10 +185,10 @@ Bootstrap (railiance01):
```bash
cd ~/railiance-apps
KUBECONFIG=~/.kube/config-hosteurope make forgejo-openbao-eso-token-apply
KUBECONFIG=~/.kube/config-hosteurope make forgejo-mailer-es-deploy
KUBECONFIG=~/.kube/config-hosteurope make forgejo-mailer-es-status # expect SecretSynced
KUBECONFIG=~/.kube/config-hosteurope make forgejo-deploy
KUBECONFIG=~/.kube/config-railiance01 make forgejo-openbao-eso-token-apply
KUBECONFIG=~/.kube/config-railiance01 make forgejo-mailer-es-deploy
KUBECONFIG=~/.kube/config-railiance01 make forgejo-mailer-es-status # expect SecretSynced
KUBECONFIG=~/.kube/config-railiance01 make forgejo-deploy
```
Do not put the SMTP password in `helm/forgejo-secrets.sops.yaml`.

2
docs/forgejo-package-registry.md
View file

@ -19,7 +19,7 @@ docker push forgejo.coulomb.social/coulomb/REPO:TAG
Cluster pull (railiance01):
```bash
KUBECONFIG=~/.kube/config-hosteurope crictl pull forgejo.coulomb.social/coulomb/REPO:TAG
KUBECONFIG=~/.kube/config-railiance01 crictl pull forgejo.coulomb.social/coulomb/REPO:TAG
```
Smoke: `make forgejo-smoke`

11
docs/informed-decision-origin.md
View file

@ -120,7 +120,7 @@ see the correction above.
## Redeploy / recovery
```bash
export KUBECONFIG=$HOME/.kube/config-hosteurope
export KUBECONFIG=$HOME/.kube/config-railiance01
kubectl apply -f manifests/informed-decision-origin.yaml
kubectl apply -f manifests/informed-decision-ingress.yaml
kubectl apply -f manifests/informed-decision-http-redirect.yaml
@ -132,11 +132,10 @@ curl -sSI https://decisions.coulomb.social/ | head -1
That `curl` succeeded on 2026-09-10, which is the gate `informed-decision` was
waiting on.
**Note on the kubeconfig:** `~/.kube/config-hosteurope` names port `16443`, but
the `k3s-api-railiance01` ops-bridge tunnel currently listens on `16444`.
Override with `--server https://127.0.0.1:16444` or fix the kubeconfig; `bridge
check` reports the tunnel healthy either way, so it does not surface the
mismatch.
**Note on the kubeconfig:** use `~/.kube/config-railiance01`, which targets the
`k3s-api-railiance01` ops-bridge tunnel on `16444`. The retired
`~/.kube/config-hosteurope` names port `16443`; `bridge check` reports the tunnel
healthy either way, so it does not surface that mismatch.
## HTTP → HTTPS

6
docs/inter-hub-on-railiance01.md
View file

@ -22,7 +22,7 @@ deploy Inter-Hub to production.
| Values | `helm/inter-hub-values.yaml` |
| Image | `forgejo.coulomb.social/coulomb/inter-hub:<tag>` |
| Secret | `inter-hub-env` |
| Production kubeconfig | `~/.kube/config-hosteurope` |
| Production kubeconfig | `~/.kube/config-railiance01` |
## Current evidence
@ -50,7 +50,7 @@ Read-only checks on 2026-06-15 showed:
## Deploy
Use the Railiance01 kubeconfig. The Makefile defaults to
`~/.kube/config-hosteurope` and fails fast when it is missing.
`~/.kube/config-railiance01` and fails fast when it is missing.
```bash
make inter-hub-render-baseline
@ -86,7 +86,7 @@ production trigger. It requires:
- `image_tag`, the immutable inter-hub image tag to deploy;
- `confirm`, with the exact value `deploy-inter-hub-production`;
- an approved self-hosted runner with Railiance01 kubeconfig access at
`~/.kube/config-hosteurope` or an equivalent `RAILIANCE01_KUBECONFIG`
`~/.kube/config-railiance01` or an equivalent `RAILIANCE01_KUBECONFIG`
override;
- registry access through `skopeo`, `crane`, `docker manifest inspect`, or the
registry HTTP API.

16
docs/operator-setup.md
View file

@ -51,23 +51,27 @@ ambient `kubectl` context for production app deploys.
The production Makefile targets default to:
```text
~/.kube/config-hosteurope
~/.kube/config-railiance01
```
It reaches the API through the `k3s-api-railiance01` ops-bridge tunnel on
`127.0.0.1:16444` (`bridge up k3s-api-railiance01` if it is down). The older
`~/.kube/config-hosteurope` names port `16443` and is retired.
Restore it from Railiance01 when missing:
```bash
ssh tegwick@92.205.62.239 'sudo cat /etc/rancher/k3s/k3s.yaml' \
| sed 's|127.0.0.1|92.205.62.239|' > ~/.kube/config-hosteurope
chmod 600 ~/.kube/config-hosteurope
export KUBECONFIG=~/.kube/config-hosteurope
| sed 's|127.0.0.1:6443|127.0.0.1:16444|' > ~/.kube/config-railiance01
chmod 600 ~/.kube/config-railiance01
export KUBECONFIG=~/.kube/config-railiance01
```
The app-specific targets also accept explicit overrides:
```bash
REUSE_KUBECONFIG=~/.kube/config-hosteurope make reuse-status
INTER_HUB_KUBECONFIG=~/.kube/config-hosteurope make inter-hub-status
REUSE_KUBECONFIG=~/.kube/config-railiance01 make reuse-status
INTER_HUB_KUBECONFIG=~/.kube/config-railiance01 make inter-hub-status
```
## SOPS Age Key Bootstrap

20
docs/reuse-surface-on-railiance01.md
View file

@ -22,7 +22,7 @@ Let's Encrypt HTTP-01 on Railiance01 requires the public A record to reach
```bash
dig +short reuse.coulomb.social A
KUBECONFIG=~/.kube/config-hosteurope kubectl get certificate -n reuse
KUBECONFIG=~/.kube/config-railiance01 kubectl get certificate -n reuse
```
If DNS is being changed in the future, use an explicit resolve only during
@ -30,7 +30,7 @@ propagation:
```bash
curl -k --resolve reuse.coulomb.social:443:92.205.62.239 https://reuse.coulomb.social/health
KUBECONFIG=~/.kube/config-hosteurope kubectl port-forward -n reuse svc/reuse-surface 18001:8000
KUBECONFIG=~/.kube/config-railiance01 kubectl port-forward -n reuse svc/reuse-surface 18001:8000
export REUSE_SURFACE_URL=http://127.0.0.1:18001
```
@ -65,8 +65,8 @@ Deployment. After patching the Secret, restart the Deployment so new values
are picked up:
```bash
kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-surface -n reuse
kubectl --kubeconfig ~/.kube/config-hosteurope rollout status deployment/reuse-surface -n reuse
kubectl --kubeconfig ~/.kube/config-railiance01 rollout restart deployment/reuse-surface -n reuse
kubectl --kubeconfig ~/.kube/config-railiance01 rollout status deployment/reuse-surface -n reuse
```
**Rotation** (never commit or paste values into chat):
@ -75,10 +75,10 @@ Full procedure: `railiance-platform/docs/reuse-surface-runtime-secrets-rotation-
```bash
# After updating field(s) in OpenBao — force ESO sync, roll hub, reconcile webhook if needed
kubectl --kubeconfig ~/.kube/config-hosteurope annotate externalsecret \
kubectl --kubeconfig ~/.kube/config-railiance01 annotate externalsecret \
reuse-surface-runtime -n reuse force-sync="$(date +%s)" --overwrite
make reuse-runtime-es-status
kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-surface -n reuse
kubectl --kubeconfig ~/.kube/config-railiance01 rollout restart deployment/reuse-surface -n reuse
make reuse-forgejo-webhook # required when REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET changed
make reuse-webhook-smoke
```
@ -153,14 +153,14 @@ the API service.
```bash
# 1. Pin image tag in helm/reuse-surface-values.yaml
# 2. Ensure reuse-surface-env has both keys (see Runtime secrets above)
# 3. Production (Railiance01, defaults to ~/.kube/config-hosteurope)
# 3. Production (Railiance01, defaults to ~/.kube/config-railiance01)
make reuse-deploy
make reuse-forgejo-webhook # after webhook secret is in the cluster Secret
make reuse-status
# Restore kubeconfig from the node if missing:
# ssh tegwick@92.205.62.239 'sudo cat /etc/rancher/k3s/k3s.yaml' \
# | sed 's|127.0.0.1|92.205.62.239|' > ~/.kube/config-hosteurope
# | sed 's|127.0.0.1:6443|127.0.0.1:16444|' > ~/.kube/config-railiance01
```
## Smoke checks
@ -172,7 +172,7 @@ curl -fsS https://reuse.coulomb.social/
curl -fsS https://reuse.coulomb.social/health
curl -fsS https://reuse.coulomb.social/v1/federated
export REUSE_SURFACE_TOKEN=$(kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse \
export REUSE_SURFACE_TOKEN=$(kubectl --kubeconfig ~/.kube/config-railiance01 get secret reuse-surface-env -n reuse \
-o jsonpath='{.data.REUSE_SURFACE_TOKEN}' | base64 -d)
export REUSE_SURFACE_URL=https://reuse.coulomb.social
reuse-surface hub status
@ -212,4 +212,4 @@ make reuse-deploy
```
Bootstrap copy on CoulombCore (`92.205.130.254`) was removed 2026-06-15 — use
`config-hosteurope` only.
`config-railiance01` only.