Default railiance01 kubeconfig to config-railiance01

config-hosteurope names port 16443, but the k3s-api-railiance01 ops-bridge tunnel listens on 16444, so every default target failed with connection refused. Switch Makefile, tools and docs to ~/.kube/config-railiance01 and fix the restore recipe to rewrite the API address to the tunnel port. The node-side hostPath in STATE.md is unrelated and unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1031639@bnt-lap001 Assistant-Session: e5073fee-f4ae-4fc3-a75a-6c1fc83e0576
2026-10-17 11:46:40 +02:00 · 2026-10-17 11:46:40 +02:00 · 0da83472c4
commit 0da83472c4
parent 74213d80f0
20 changed files with 52 additions and 50 deletions
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@ -2,24 +2,23 @@
 # Custodian Brief — railiance-apps

 **Domain:** financials  
-**Last synced:** 2026-10-17 09:32 UTC  
+**Last synced:** 2026-10-17 09:42 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*

 ## Active Workstreams

 ### Forgejo sign-in through NetKingdom, before the forge closes
-Progress: 0/5 done  |  workplan_id: `f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b`
+Progress: 1/5 done  |  workplan_id: `f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b`

 **Open tasks:**
 - ! T01 — Make the local administrator a sealed break-glass  `13cd3aec`
-  *(wait: Needs break-glass in place and the NetKingdom client registered with its secret in custody.)*
+  *(wait: Break-glass done (T01); needs the NetKingdom client registered with its secret in custody (KEY-WP-0038-T02).)*
 - ! T02 — Add the NetKingdom authentication source  `81f072aa`
  *(wait: Linking and team mapping follow a working authentication source.)*
 - ! T03 — Link accounts and map groups to teams  `32c54737`
  *(wait: Restricting local password sign-in is a founder decision once NetKingdom sign-in is proven.)*
 - ! T04 — Decide on local password sign-in  `728786c9`
  *(wait: Waits for the NK-WP-0048-T16 option decision and net-kingdom's answer to the Apps needs-change record.)*
- ► Tasks  `98004ed0`

 ### Coulomb-social persistent personal workspace release
 Progress: 3/4 done  |  workplan_id: `79abacf8-361e-51ab-829d-40dec8e142d1`
--- a/2
+++ b/2
@ -50,7 +50,7 @@ POLICY_NEXUS_SOURCE_SET_DIGEST ?= $(shell python3 -c 'import json; print(json.lo
 POLICY_NEXUS_REVISION ?=

 COULOMBCORE_KUBECONFIG ?= $(HOME)/.kube/config
-RAILIANCE01_KUBECONFIG ?= $(HOME)/.kube/config-hosteurope
+RAILIANCE01_KUBECONFIG ?= $(HOME)/.kube/config-railiance01
 PRODUCTION_KUBECONFIG ?= $(COULOMBCORE_KUBECONFIG)
 INTER_HUB_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG)
 REUSE_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG)
--- a/STATE.md
+++ b/STATE.md
@ -44,7 +44,7 @@ export KUBECONFIG=~/.kube/config
 make cnpg-backup-status

 # railiance01 activity
-export KUBECONFIG=~/.kube/config-hosteurope
+export KUBECONFIG=~/.kube/config-railiance01
 kubectl -n activity-core get externalsecret actcore-backup-offsite
 # inventory should list Daily CNPG Option A Backup enabled
 ```
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@ -38,7 +38,7 @@
 | task | RAPPS-WP-0015-T02 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
 | task | RAPPS-WP-0015-T03 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
 | task | RAPPS-WP-0015-T04 | wait | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
-| task | RAPPS-WP-0016-T01 | progress | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0016-T01 | done | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
 | task | RAPPS-WP-0016-T02 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
 | task | RAPPS-WP-0016-T03 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
 | task | RAPPS-WP-0016-T04 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
--- a/docs/cnpg-backup-topology-inventory.md
+++ b/docs/cnpg-backup-topology-inventory.md
@ -9,7 +9,7 @@
 | Host | Kubeconfig (operator workstation) | API |
 | --- | --- | --- |
 | CoulombCore | `~/.kube/config` | tunnel `k3s-api-coulombcore` |
-| railiance01 | `~/.kube/config-hosteurope` | local / hosteurope |
+| railiance01 | `~/.kube/config-railiance01` | local / hosteurope |

 ## Production-of-record (POR) decisions

--- a/docs/credential-routing-railiance-apps.md
+++ b/docs/credential-routing-railiance-apps.md
@ -9,7 +9,7 @@ platform tooling.
 | Host | IP | Kubeconfig | Tunnel |
 | --- | --- | --- | --- |
 | CoulombCore (production apps) | `92.205.130.254` | `~/.kube/config` via `k3s-api-coulombcore` | `bridge up k3s-api-coulombcore` |
-| Railiance01 (Forgejo S5) | `92.205.62.239` | `~/.kube/config-hosteurope` | `bridge up k3s-api-railiance01` if configured |
+| Railiance01 (Forgejo S5) | `92.205.62.239` | `~/.kube/config-railiance01` | `bridge up k3s-api-railiance01` if configured |

 Core Hub, `vergabe-teilnahme`, and `apps-pg` currently run on **CoulombCore**.
 Railiance01 hosts Forgejo and a overlapping subset of platform databases.
--- a/docs/forgejo-on-railiance01.md
+++ b/docs/forgejo-on-railiance01.md
@ -27,7 +27,7 @@ Hostname decision: `the-custodian/docs/forgejo-production-decisions.md`.
 | Chart | `gitea-charts/gitea` **12.5.0** (Forgejo-compatible; 12.6+ needs Gitea 1.26 `config edit-ini`) |
 | Image | `code.forgejo.org/forgejo/forgejo:11.0.3` |
 | Database | `forgejo-db-rw.databases.svc.cluster.local:5432` |
-| Kubeconfig | `~/.kube/config-hosteurope` |
+| Kubeconfig | `~/.kube/config-railiance01` |

 ## Bootstrap (first deploy)

@ -36,8 +36,8 @@ Hostname decision: `the-custodian/docs/forgejo-production-decisions.md`.
 ```bash
 cd ~/railiance-platform
 # One-time: create and SOPS-encrypt helm/forgejo-db-secret.sops.yaml from template
-KUBECONFIG=~/.kube/config-hosteurope make forgejo-db-deploy
-KUBECONFIG=~/.kube/config-hosteurope make forgejo-db-status
+KUBECONFIG=~/.kube/config-railiance01 make forgejo-db-deploy
+KUBECONFIG=~/.kube/config-railiance01 make forgejo-db-status
 ```

 ### 2. Application secrets (apps)
@ -185,10 +185,10 @@ Bootstrap (railiance01):

 ```bash
 cd ~/railiance-apps
-KUBECONFIG=~/.kube/config-hosteurope make forgejo-openbao-eso-token-apply
-KUBECONFIG=~/.kube/config-hosteurope make forgejo-mailer-es-deploy
-KUBECONFIG=~/.kube/config-hosteurope make forgejo-mailer-es-status   # expect SecretSynced
-KUBECONFIG=~/.kube/config-hosteurope make forgejo-deploy
+KUBECONFIG=~/.kube/config-railiance01 make forgejo-openbao-eso-token-apply
+KUBECONFIG=~/.kube/config-railiance01 make forgejo-mailer-es-deploy
+KUBECONFIG=~/.kube/config-railiance01 make forgejo-mailer-es-status   # expect SecretSynced
+KUBECONFIG=~/.kube/config-railiance01 make forgejo-deploy
 ```

 Do not put the SMTP password in `helm/forgejo-secrets.sops.yaml`.
--- a/docs/forgejo-package-registry.md
+++ b/docs/forgejo-package-registry.md
@ -19,7 +19,7 @@ docker push forgejo.coulomb.social/coulomb/REPO:TAG
 Cluster pull (railiance01):

 ```bash
-KUBECONFIG=~/.kube/config-hosteurope crictl pull forgejo.coulomb.social/coulomb/REPO:TAG
+KUBECONFIG=~/.kube/config-railiance01 crictl pull forgejo.coulomb.social/coulomb/REPO:TAG
 ```

 Smoke: `make forgejo-smoke`
--- a/docs/informed-decision-origin.md
+++ b/docs/informed-decision-origin.md
@ -120,7 +120,7 @@ see the correction above.
 ## Redeploy / recovery

 ```bash
-export KUBECONFIG=$HOME/.kube/config-hosteurope
+export KUBECONFIG=$HOME/.kube/config-railiance01
 kubectl apply -f manifests/informed-decision-origin.yaml
 kubectl apply -f manifests/informed-decision-ingress.yaml
 kubectl apply -f manifests/informed-decision-http-redirect.yaml
@ -132,11 +132,10 @@ curl -sSI https://decisions.coulomb.social/ | head -1
 That `curl` succeeded on 2026-09-10, which is the gate `informed-decision` was
 waiting on.

-**Note on the kubeconfig:** `~/.kube/config-hosteurope` names port `16443`, but
-the `k3s-api-railiance01` ops-bridge tunnel currently listens on `16444`.
-Override with `--server https://127.0.0.1:16444` or fix the kubeconfig; `bridge
-check` reports the tunnel healthy either way, so it does not surface the
-mismatch.
+**Note on the kubeconfig:** use `~/.kube/config-railiance01`, which targets the
+`k3s-api-railiance01` ops-bridge tunnel on `16444`. The retired
+`~/.kube/config-hosteurope` names port `16443`; `bridge check` reports the tunnel
+healthy either way, so it does not surface that mismatch.

 ## HTTP → HTTPS

--- a/docs/inter-hub-on-railiance01.md
+++ b/docs/inter-hub-on-railiance01.md
@ -22,7 +22,7 @@ deploy Inter-Hub to production.
 | Values | `helm/inter-hub-values.yaml` |
 | Image | `forgejo.coulomb.social/coulomb/inter-hub:<tag>` |
 | Secret | `inter-hub-env` |
-| Production kubeconfig | `~/.kube/config-hosteurope` |
+| Production kubeconfig | `~/.kube/config-railiance01` |

 ## Current evidence

@ -50,7 +50,7 @@ Read-only checks on 2026-06-15 showed:
 ## Deploy

 Use the Railiance01 kubeconfig. The Makefile defaults to
-`~/.kube/config-hosteurope` and fails fast when it is missing.
+`~/.kube/config-railiance01` and fails fast when it is missing.

 ```bash
 make inter-hub-render-baseline
@ -86,7 +86,7 @@ production trigger. It requires:
 - `image_tag`, the immutable inter-hub image tag to deploy;
 - `confirm`, with the exact value `deploy-inter-hub-production`;
 - an approved self-hosted runner with Railiance01 kubeconfig access at
-  `~/.kube/config-hosteurope` or an equivalent `RAILIANCE01_KUBECONFIG`
+  `~/.kube/config-railiance01` or an equivalent `RAILIANCE01_KUBECONFIG`
  override;
 - registry access through `skopeo`, `crane`, `docker manifest inspect`, or the
  registry HTTP API.
--- a/docs/operator-setup.md
+++ b/docs/operator-setup.md
@ -51,23 +51,27 @@ ambient `kubectl` context for production app deploys.
 The production Makefile targets default to:

 ```text
-~/.kube/config-hosteurope
+~/.kube/config-railiance01
 ```

+It reaches the API through the `k3s-api-railiance01` ops-bridge tunnel on
+`127.0.0.1:16444` (`bridge up k3s-api-railiance01` if it is down). The older
+`~/.kube/config-hosteurope` names port `16443` and is retired.
+
 Restore it from Railiance01 when missing:

 ```bash
 ssh tegwick@92.205.62.239 'sudo cat /etc/rancher/k3s/k3s.yaml' \
-  | sed 's|127.0.0.1|92.205.62.239|' > ~/.kube/config-hosteurope
-chmod 600 ~/.kube/config-hosteurope
-export KUBECONFIG=~/.kube/config-hosteurope
+  | sed 's|127.0.0.1:6443|127.0.0.1:16444|' > ~/.kube/config-railiance01
+chmod 600 ~/.kube/config-railiance01
+export KUBECONFIG=~/.kube/config-railiance01
 ```

 The app-specific targets also accept explicit overrides:

 ```bash
-REUSE_KUBECONFIG=~/.kube/config-hosteurope make reuse-status
-INTER_HUB_KUBECONFIG=~/.kube/config-hosteurope make inter-hub-status
+REUSE_KUBECONFIG=~/.kube/config-railiance01 make reuse-status
+INTER_HUB_KUBECONFIG=~/.kube/config-railiance01 make inter-hub-status
 ```

 ## SOPS Age Key Bootstrap
--- a/docs/reuse-surface-on-railiance01.md
+++ b/docs/reuse-surface-on-railiance01.md
@ -22,7 +22,7 @@ Let's Encrypt HTTP-01 on Railiance01 requires the public A record to reach

 ```bash
 dig +short reuse.coulomb.social A
-KUBECONFIG=~/.kube/config-hosteurope kubectl get certificate -n reuse
+KUBECONFIG=~/.kube/config-railiance01 kubectl get certificate -n reuse
 ```

 If DNS is being changed in the future, use an explicit resolve only during
@ -30,7 +30,7 @@ propagation:

 ```bash
 curl -k --resolve reuse.coulomb.social:443:92.205.62.239 https://reuse.coulomb.social/health
-KUBECONFIG=~/.kube/config-hosteurope kubectl port-forward -n reuse svc/reuse-surface 18001:8000
+KUBECONFIG=~/.kube/config-railiance01 kubectl port-forward -n reuse svc/reuse-surface 18001:8000
 export REUSE_SURFACE_URL=http://127.0.0.1:18001
 ```

@ -65,8 +65,8 @@ Deployment. After patching the Secret, restart the Deployment so new values
 are picked up:

 ```bash
-kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-surface -n reuse
-kubectl --kubeconfig ~/.kube/config-hosteurope rollout status deployment/reuse-surface -n reuse
+kubectl --kubeconfig ~/.kube/config-railiance01 rollout restart deployment/reuse-surface -n reuse
+kubectl --kubeconfig ~/.kube/config-railiance01 rollout status deployment/reuse-surface -n reuse
 ```

 **Rotation** (never commit or paste values into chat):
@ -75,10 +75,10 @@ Full procedure: `railiance-platform/docs/reuse-surface-runtime-secrets-rotation-

 ```bash
 # After updating field(s) in OpenBao — force ESO sync, roll hub, reconcile webhook if needed
-kubectl --kubeconfig ~/.kube/config-hosteurope annotate externalsecret \
+kubectl --kubeconfig ~/.kube/config-railiance01 annotate externalsecret \
  reuse-surface-runtime -n reuse force-sync="$(date +%s)" --overwrite
 make reuse-runtime-es-status
-kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-surface -n reuse
+kubectl --kubeconfig ~/.kube/config-railiance01 rollout restart deployment/reuse-surface -n reuse
 make reuse-forgejo-webhook   # required when REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET changed
 make reuse-webhook-smoke
 ```
@ -153,14 +153,14 @@ the API service.
 ```bash
 # 1. Pin image tag in helm/reuse-surface-values.yaml
 # 2. Ensure reuse-surface-env has both keys (see Runtime secrets above)
-# 3. Production (Railiance01, defaults to ~/.kube/config-hosteurope)
+# 3. Production (Railiance01, defaults to ~/.kube/config-railiance01)
 make reuse-deploy
 make reuse-forgejo-webhook   # after webhook secret is in the cluster Secret
 make reuse-status

 # Restore kubeconfig from the node if missing:
 # ssh tegwick@92.205.62.239 'sudo cat /etc/rancher/k3s/k3s.yaml' \
-#   | sed 's|127.0.0.1|92.205.62.239|' > ~/.kube/config-hosteurope
+#   | sed 's|127.0.0.1:6443|127.0.0.1:16444|' > ~/.kube/config-railiance01
 ```

 ## Smoke checks
@ -172,7 +172,7 @@ curl -fsS https://reuse.coulomb.social/
 curl -fsS https://reuse.coulomb.social/health
 curl -fsS https://reuse.coulomb.social/v1/federated

-export REUSE_SURFACE_TOKEN=$(kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse \
+export REUSE_SURFACE_TOKEN=$(kubectl --kubeconfig ~/.kube/config-railiance01 get secret reuse-surface-env -n reuse \
  -o jsonpath='{.data.REUSE_SURFACE_TOKEN}' | base64 -d)
 export REUSE_SURFACE_URL=https://reuse.coulomb.social
 reuse-surface hub status
@ -212,4 +212,4 @@ make reuse-deploy
 ```

 Bootstrap copy on CoulombCore (`92.205.130.254`) was removed 2026-06-15 — use
-`config-hosteurope` only.
+`config-railiance01` only.
--- a/tools/forgejo-breakglass-seal.sh
+++ b/tools/forgejo-breakglass-seal.sh
@ -8,7 +8,7 @@ set -euo pipefail
 BREAKGLASS_USER="${FORGEJO_BREAKGLASS_USER:-forgejo_admin}"
 BREAKGLASS_PATH="${FORGEJO_BREAKGLASS_PATH:-platform/workloads/forgejo/break-glass-admin}"
 BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
-FORGEJO_KUBECONFIG="${FORGEJO_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+FORGEJO_KUBECONFIG="${FORGEJO_KUBECONFIG:-$HOME/.kube/config-railiance01}"
 FORGEJO_NAMESPACE="${FORGEJO_NAMESPACE:-forgejo}"

 for cmd in bao kubectl openssl; do
--- a/tools/forgejo-helm-secrets.sh
+++ b/tools/forgejo-helm-secrets.sh
@ -4,7 +4,7 @@ set -euo pipefail

 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 SECRETS_FILE="${FORGEJO_SECRETS:-$ROOT_DIR/helm/forgejo-secrets.sops.yaml}"
-KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-railiance01}"

 emit_from_sops() {
  sops -d "$SECRETS_FILE" | python3 -c "
--- a/tools/forgejo-openbao-eso-token-apply.sh
+++ b/tools/forgejo-openbao-eso-token-apply.sh
@ -6,7 +6,7 @@ set -euo pipefail
 POLICY_NAME="${OPENBAO_FORGEJO_POLICY:-workload-kv-read-forgejo-mailer}"
 POLICY_FILE="${OPENBAO_FORGEJO_POLICY_FILE:-$HOME/railiance-platform/openbao/policies/workload-kv-read-forgejo-mailer.hcl}"
 BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
-RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
 SECRET_NAME="${OPENBAO_FORGEJO_ESO_SECRET:-openbao-forgejo-eso-token}"
 SECRET_NS="${OPENBAO_FORGEJO_ESO_NAMESPACE:-external-secrets}"

--- a/tools/forgejo-runner-registration-sops-bootstrap.sh
+++ b/tools/forgejo-runner-registration-sops-bootstrap.sh
@ -5,7 +5,7 @@ set -euo pipefail

 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 OUT="${ROOT}/helm/forgejo-runner-registration.sops.yaml"
-KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-railiance01}"
 FORGEJO_NAMESPACE="${FORGEJO_NAMESPACE:-forgejo}"

 export KUBECONFIG
--- a/tools/forgejo-verify.sh
+++ b/tools/forgejo-verify.sh
@ -4,7 +4,7 @@ set -euo pipefail

 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 BASE_URL="${FORGEJO_BASE_URL:-https://forgejo.coulomb.social}"
-KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-railiance01}"
 FORGEJO_NAMESPACE="${FORGEJO_NAMESPACE:-forgejo}"
 FORGEJO_DB_NAMESPACE="${FORGEJO_DB_NAMESPACE:-databases}"
 FORGEJO_DB_CLUSTER="${FORGEJO_DB_CLUSTER:-forgejo-db}"
--- a/tools/reuse-forgejo-webhook.sh
+++ b/tools/reuse-forgejo-webhook.sh
@ -6,7 +6,7 @@ set -euo pipefail
 FORGEJO_API="${FORGEJO_API:-https://forgejo.coulomb.social/api/v1}"
 FORGEJO_ORG="${FORGEJO_ORG:-coulomb}"
 WEBHOOK_URL="${REUSE_WEBHOOK_URL:-https://reuse.coulomb.social/v1/webhooks/forgejo}"
-KUBECONFIG_PATH="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+KUBECONFIG_PATH="${KUBECONFIG:-$HOME/.kube/config-railiance01}"
 SECRET_NS="${REUSE_SECRET_NAMESPACE:-reuse}"
 SECRET_NAME="${REUSE_SECRET_NAME:-reuse-surface-env}"
 SECRET_KEY="${REUSE_WEBHOOK_SECRET_KEY:-REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET}"
--- a/tools/reuse-openbao-eso-token-apply.sh
+++ b/tools/reuse-openbao-eso-token-apply.sh
@ -6,7 +6,7 @@ set -euo pipefail
 POLICY_NAME="${OPENBAO_REUSE_POLICY:-workload-kv-read-reuse-surface-runtime}"
 POLICY_FILE="${OPENBAO_REUSE_POLICY_FILE:-$HOME/railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime.hcl}"
 BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
-RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
 SECRET_NAME="${OPENBAO_REUSE_ESO_SECRET:-openbao-reuse-eso-token}"
 SECRET_NS="${OPENBAO_REUSE_ESO_NAMESPACE:-external-secrets}"

--- a/tools/reuse-webhook-smoke.sh
+++ b/tools/reuse-webhook-smoke.sh
@ -5,7 +5,7 @@ set -euo pipefail

 REUSE_URL="${REUSE_URL:-https://reuse.coulomb.social}"
 WEBHOOK_PATH="${REUSE_WEBHOOK_PATH:-/v1/webhooks/forgejo}"
-KUBECONFIG_PATH="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+KUBECONFIG_PATH="${KUBECONFIG:-$HOME/.kube/config-railiance01}"
 SECRET_NS="${REUSE_SECRET_NAMESPACE:-reuse}"
 SECRET_NAME="${REUSE_SECRET_NAME:-reuse-surface-env}"
 SECRET_KEY="${REUSE_WEBHOOK_SECRET_KEY:-REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET}"