coulomb/railiance-apps
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: bind the fresh demo-company Vergabe pilot
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-11 20:15:30 +02:00
parent 9491744e5a
commit 32b051e6c2
4 changed files with 118 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

66
docs/vergabe-demo-company-binding.md Normal file
View file

@ -0,0 +1,66 @@
# Vergabe demo-company deployment binding
Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04.
This is an execution packet; native tenant creation and deployment are pending.
| Item | Binding / execution status |
| --- | --- |
| Tenant | `tenant:trial:demo-company`; display `demo-company`; native creation pending |
| Purpose / data | New demo workspace; synthetic data only; no existing data import |
| Initial accounts | `demo-user1`, `demo-user2`, ordinary members; creation and private credential setup pending |
| Operator / acceptance | Bernd Worsch via authenticated existing operator path |
| Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` |
| Proposed namespace | `vergabe-demo-company`; create separately from historical installations |
| Helm release | `vergabe-teilnahme` within that namespace |
| Image source | `ccb6d1f8c7abd50f2ef654491bb1aa5861e795cb`; live CI 29 / publication 31 passed |
| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005` |
| Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` |
| Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi |
| Proposed URL | `https://demo-vergabe.coulomb.social`; user preference pending |
| Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 |
| Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending |
| Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet |
| Media / app state | Separate `vergabe-teilnahme-media` 5Gi and `vergabe-teilnahme-app-state` 1Gi PVCs, local-path; native creation pending |
| Recovery / support | Existing RAPPS-WP-0014-T03 retains off-host recovery point, isolated restore, rollback and operating responsibility evidence |
The target database is a proposed new consumer, not permission to reuse or
overwrite `vergabe_db`. Refresh managed-consumer count, placement and migration
demand before applying. Tenant creation itself does not depend on this hostname.
## Native tenant and identity execution
Use the existing User Engine portal at `https://users.92-205-62-239.nip.io`.
Its `/login` uses KeyCape and the registered native callback. The authenticated
platform form creates `tenant:trial:demo-company` through Tenant Engine. Record
the response and read back the exact tenant before creating memberships. Do not
substitute a service actor, fabricate verified claims, or bypass policy on denial.
An operator browser has been opened; native login/creation is not yet confirmed.
Create two ordinary memberships through User Engine. Confirm how the identity
provisioner assigns login names before provisioning the requested demo names;
do not invent deliverable email addresses or send invitations to third parties.
The current product uses separately provisioned Django accounts, with no staff
or superuser flags. Preserve the mapping to this tenant's isolated deployment.
This establishes a platform tenant and a bounded app pilot, not completed SSO.
## Hostname and deployment execution
`helm/vergabe-demo-company-values.proposed.yaml` pins the published image and
60m resources, and consistently uses the proposed host for Django and probes.
The chart does not itself create public ingress or DNS. Confirm the preferred
hostname, point its DNS to Railiance01 through the DNS owner, configure the
HTTPS route and abuse control through the existing edge lane, and verify TLS.
On 2026-09-11 the proposed hostname resolved to 80.158.43.29; the legacy
`vergabe-teilnahme.whywhynot.de` resolved to 92.205.130.254. Neither was the
intended Railiance01 address. No DNS changes have been made.
Complete platform database/Secret provisioning and the source-backed namespace,
network and public edge manifests before deployment. Then migrate the fresh
database, deploy, provision the demo app accounts, and perform the two-user
workflow plus restart/isolated-restore checks in the existing owner tasks.
Only then record the demo environment as available for use.
Validation on 2026-09-11: Helm lint passed. Rendering the proposed values
produced the pinned digest, one Recreate replica, 60m CPU request, matching
Django/probe hosts, and two distinct retained PVCs. This is local manifest
verification; it is not native deployment or tenant-creation evidence.

9
docs/vergabe-teilnahme-pilot.md
View file

@ -8,8 +8,9 @@ the historical deployment is still live.
## Exact release packet
Before native admission, record the following non-secret values in the company
binding. Company/host/data selection is pending; do not treat example values as
an assigned tenant.
binding. The user selects a fresh `demo-company` workspace; see
[its prepared binding](vergabe-demo-company-binding.md). Native tenant creation
and hostname admission are pending; example values do not create a tenant.
| Binding | Required evidence |
| --- | --- |
@ -136,4 +137,6 @@ Read-only CNPG metadata also reports `vergabe-db` applied for `vergabe_db` owned
by `vergabe`, two managed consumers with 20-connection limits, and the most recent
apps-pg backup successful at 2026-09-11T02:15:11Z. This establishes the declared
database/backup metadata; no customer data was read, selected for reuse or
modified. The tenant/data choice remains open.
modified. The user subsequently selected a new demo-company workspace; the
prepared binding explicitly uses a fresh database and leaves historical data
untouched.

27
helm/vergabe-demo-company-values.proposed.yaml Normal file
View file

@ -0,0 +1,27 @@
# Proposed binding only; see docs/vergabe-demo-company-binding.md.
# Native tenant, database/Secret, DNS/TLS and edge admission are still pending.
# Release vergabe-teilnahme; namespace vergabe-demo-company.
pilot:
enabled: true
image:
digest: sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005
replicaCount: 1
resources:
requests:
cpu: 60m
memory: 256Mi
limits:
cpu: 1000m
memory: 1Gi
envSecretName: vergabe-demo-env
env:
DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod
ALLOWED_HOSTS: demo-vergabe.coulomb.social,localhost
CSRF_TRUSTED_ORIGINS: https://demo-vergabe.coulomb.social
probes:
hostHeader: demo-vergabe.coulomb.social
persistence:
media:
enabled: true
appState:
enabled: true

23
workplans/RAPPS-WP-0014-vergabe-invited-pilot.md
View file

@ -45,8 +45,8 @@ state_hub_task_id: "b00958c8-1401-5ebf-bc22-c0252618d897"
Consume VERGABE-WP-0019-T02's login-protected release after live CI/publication.
Record exact image/chart revision, company, user count, host/TLS, dedicated
namespace, database/role, both PVCs and admitted runtime Secret custody. Obtain
the user's empty-vs-existing-data disposition. Existing vergabe_db is not test
namespace, database/role, both PVCs and admitted runtime Secret custody. The
user now selects a fresh demo-company workspace (2026-09-11). Existing vergabe_db is not test
data. Resolve target inventory before using historical runbook names: the
checked Railiance cluster has no vergabe-teilnahme namespace or matching
Deployment on 2026-09-11. Do not infer data loss or authorization to recreate it.
@ -73,8 +73,23 @@ Use `docs/vergabe-teilnahme-pilot.md` for the review packet. Secret creation,
operator access and placement consume existing platform lanes; they do not
create a parallel identity framework. The public edge needs an admitted login
abuse-control policy and TLS; Django's authentication gate alone is not a rate
limiter. Keep `/media/` behind the app gate. Exact customer identity/host/data
selection is pending user input; source preparation can proceed meanwhile.
limiter. Keep `/media/` behind the app gate.
The user requests a new `demo-company` tenant with `demo-user1`, etc. Apply
NetKingdom ADR-0013 as `tenant:trial:demo-company` and start with two ordinary
demo users. Fresh data is selected; no historical customer import is authorized.
The exact prepared namespace/database/release and proposed hostname are in
`docs/vergabe-demo-company-binding.md` and
`helm/vergabe-demo-company-values.proposed.yaml`. The suggested hostname is
`demo-vergabe.coulomb.social`; user preference is pending. Its observed DNS
target is not Railiance01 and must be corrected through the edge owner.
Tenant Engine creation must use the authenticated User Engine operator portal.
An isolated native KeyCape login window has been opened; operator login,
tenant creation/readback, memberships and app account provisioning are not yet
confirmed. Do not substitute a trusted service actor to bypass a denial.
Platform registration does not add SSO to the Django pilot. Continue execution
on T02; company/data choice is no longer missing input.
## Demonstrate restart, isolated restore, rollback and operating ownership