diff --git a/docs/vergabe-demo-company-binding.md b/docs/vergabe-demo-company-binding.md new file mode 100644 index 0000000..f6a48a9 --- /dev/null +++ b/docs/vergabe-demo-company-binding.md @@ -0,0 +1,66 @@ +# Vergabe demo-company deployment binding + +Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04. +This is an execution packet; native tenant creation and deployment are pending. + +| Item | Binding / execution status | +| --- | --- | +| Tenant | `tenant:trial:demo-company`; display `demo-company`; native creation pending | +| Purpose / data | New demo workspace; synthetic data only; no existing data import | +| Initial accounts | `demo-user1`, `demo-user2`, ordinary members; creation and private credential setup pending | +| Operator / acceptance | Bernd Worsch via authenticated existing operator path | +| Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` | +| Proposed namespace | `vergabe-demo-company`; create separately from historical installations | +| Helm release | `vergabe-teilnahme` within that namespace | +| Image source | `ccb6d1f8c7abd50f2ef654491bb1aa5861e795cb`; live CI 29 / publication 31 passed | +| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005` | +| Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` | +| Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi | +| Proposed URL | `https://demo-vergabe.coulomb.social`; user preference pending | +| Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 | +| Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending | +| Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet | +| Media / app state | Separate `vergabe-teilnahme-media` 5Gi and `vergabe-teilnahme-app-state` 1Gi PVCs, local-path; native creation pending | +| Recovery / support | Existing RAPPS-WP-0014-T03 retains off-host recovery point, isolated restore, rollback and operating responsibility evidence | + +The target database is a proposed new consumer, not permission to reuse or +overwrite `vergabe_db`. Refresh managed-consumer count, placement and migration +demand before applying. Tenant creation itself does not depend on this hostname. + +## Native tenant and identity execution + +Use the existing User Engine portal at `https://users.92-205-62-239.nip.io`. +Its `/login` uses KeyCape and the registered native callback. The authenticated +platform form creates `tenant:trial:demo-company` through Tenant Engine. Record +the response and read back the exact tenant before creating memberships. Do not +substitute a service actor, fabricate verified claims, or bypass policy on denial. +An operator browser has been opened; native login/creation is not yet confirmed. + +Create two ordinary memberships through User Engine. Confirm how the identity +provisioner assigns login names before provisioning the requested demo names; +do not invent deliverable email addresses or send invitations to third parties. +The current product uses separately provisioned Django accounts, with no staff +or superuser flags. Preserve the mapping to this tenant's isolated deployment. +This establishes a platform tenant and a bounded app pilot, not completed SSO. + +## Hostname and deployment execution + +`helm/vergabe-demo-company-values.proposed.yaml` pins the published image and +60m resources, and consistently uses the proposed host for Django and probes. +The chart does not itself create public ingress or DNS. Confirm the preferred +hostname, point its DNS to Railiance01 through the DNS owner, configure the +HTTPS route and abuse control through the existing edge lane, and verify TLS. +On 2026-09-11 the proposed hostname resolved to 80.158.43.29; the legacy +`vergabe-teilnahme.whywhynot.de` resolved to 92.205.130.254. Neither was the +intended Railiance01 address. No DNS changes have been made. + +Complete platform database/Secret provisioning and the source-backed namespace, +network and public edge manifests before deployment. Then migrate the fresh +database, deploy, provision the demo app accounts, and perform the two-user +workflow plus restart/isolated-restore checks in the existing owner tasks. +Only then record the demo environment as available for use. + +Validation on 2026-09-11: Helm lint passed. Rendering the proposed values +produced the pinned digest, one Recreate replica, 60m CPU request, matching +Django/probe hosts, and two distinct retained PVCs. This is local manifest +verification; it is not native deployment or tenant-creation evidence. diff --git a/docs/vergabe-teilnahme-pilot.md b/docs/vergabe-teilnahme-pilot.md index 0f516ff..b71fdfb 100644 --- a/docs/vergabe-teilnahme-pilot.md +++ b/docs/vergabe-teilnahme-pilot.md @@ -8,8 +8,9 @@ the historical deployment is still live. ## Exact release packet Before native admission, record the following non-secret values in the company -binding. Company/host/data selection is pending; do not treat example values as -an assigned tenant. +binding. The user selects a fresh `demo-company` workspace; see +[its prepared binding](vergabe-demo-company-binding.md). Native tenant creation +and hostname admission are pending; example values do not create a tenant. | Binding | Required evidence | | --- | --- | @@ -136,4 +137,6 @@ Read-only CNPG metadata also reports `vergabe-db` applied for `vergabe_db` owned by `vergabe`, two managed consumers with 20-connection limits, and the most recent apps-pg backup successful at 2026-09-11T02:15:11Z. This establishes the declared database/backup metadata; no customer data was read, selected for reuse or -modified. The tenant/data choice remains open. +modified. The user subsequently selected a new demo-company workspace; the +prepared binding explicitly uses a fresh database and leaves historical data +untouched. diff --git a/helm/vergabe-demo-company-values.proposed.yaml b/helm/vergabe-demo-company-values.proposed.yaml new file mode 100644 index 0000000..5cc48df --- /dev/null +++ b/helm/vergabe-demo-company-values.proposed.yaml @@ -0,0 +1,27 @@ +# Proposed binding only; see docs/vergabe-demo-company-binding.md. +# Native tenant, database/Secret, DNS/TLS and edge admission are still pending. +# Release vergabe-teilnahme; namespace vergabe-demo-company. +pilot: + enabled: true +image: + digest: sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005 +replicaCount: 1 +resources: + requests: + cpu: 60m + memory: 256Mi + limits: + cpu: 1000m + memory: 1Gi +envSecretName: vergabe-demo-env +env: + DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod + ALLOWED_HOSTS: demo-vergabe.coulomb.social,localhost + CSRF_TRUSTED_ORIGINS: https://demo-vergabe.coulomb.social +probes: + hostHeader: demo-vergabe.coulomb.social +persistence: + media: + enabled: true + appState: + enabled: true diff --git a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md index 5d7f765..3c12a0d 100644 --- a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md +++ b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md @@ -45,8 +45,8 @@ state_hub_task_id: "b00958c8-1401-5ebf-bc22-c0252618d897" Consume VERGABE-WP-0019-T02's login-protected release after live CI/publication. Record exact image/chart revision, company, user count, host/TLS, dedicated -namespace, database/role, both PVCs and admitted runtime Secret custody. Obtain -the user's empty-vs-existing-data disposition. Existing vergabe_db is not test +namespace, database/role, both PVCs and admitted runtime Secret custody. The +user now selects a fresh demo-company workspace (2026-09-11). Existing vergabe_db is not test data. Resolve target inventory before using historical runbook names: the checked Railiance cluster has no vergabe-teilnahme namespace or matching Deployment on 2026-09-11. Do not infer data loss or authorization to recreate it. @@ -73,8 +73,23 @@ Use `docs/vergabe-teilnahme-pilot.md` for the review packet. Secret creation, operator access and placement consume existing platform lanes; they do not create a parallel identity framework. The public edge needs an admitted login abuse-control policy and TLS; Django's authentication gate alone is not a rate -limiter. Keep `/media/` behind the app gate. Exact customer identity/host/data -selection is pending user input; source preparation can proceed meanwhile. +limiter. Keep `/media/` behind the app gate. + +The user requests a new `demo-company` tenant with `demo-user1`, etc. Apply +NetKingdom ADR-0013 as `tenant:trial:demo-company` and start with two ordinary +demo users. Fresh data is selected; no historical customer import is authorized. +The exact prepared namespace/database/release and proposed hostname are in +`docs/vergabe-demo-company-binding.md` and +`helm/vergabe-demo-company-values.proposed.yaml`. The suggested hostname is +`demo-vergabe.coulomb.social`; user preference is pending. Its observed DNS +target is not Railiance01 and must be corrected through the edge owner. + +Tenant Engine creation must use the authenticated User Engine operator portal. +An isolated native KeyCape login window has been opened; operator login, +tenant creation/readback, memberships and app account provisioning are not yet +confirmed. Do not substitute a trusted service actor to bypass a denial. +Platform registration does not add SSO to the Django pilot. Continue execution +on T02; company/data choice is no longer missing input. ## Demonstrate restart, isolated restore, rollback and operating ownership