coulomb/railiance-apps
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: bind the fresh demo-company Vergabe pilot
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-11 20:15:30 +02:00
parent 9491744e5a
commit 32b051e6c2
4 changed files with 118 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

66
docs/vergabe-demo-company-binding.md Normal file
View file

@ -0,0 +1,66 @@
# Vergabe demo-company deployment binding
Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04.
This is an execution packet; native tenant creation and deployment are pending.
| Item | Binding / execution status |
| --- | --- |
| Tenant | `tenant:trial:demo-company`; display `demo-company`; native creation pending |
| Purpose / data | New demo workspace; synthetic data only; no existing data import |
| Initial accounts | `demo-user1`, `demo-user2`, ordinary members; creation and private credential setup pending |
| Operator / acceptance | Bernd Worsch via authenticated existing operator path |
| Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` |
| Proposed namespace | `vergabe-demo-company`; create separately from historical installations |
| Helm release | `vergabe-teilnahme` within that namespace |
| Image source | `ccb6d1f8c7abd50f2ef654491bb1aa5861e795cb`; live CI 29 / publication 31 passed |
| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005` |
| Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` |
| Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi |
| Proposed URL | `https://demo-vergabe.coulomb.social`; user preference pending |
| Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 |
| Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending |
| Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet |
| Media / app state | Separate `vergabe-teilnahme-media` 5Gi and `vergabe-teilnahme-app-state` 1Gi PVCs, local-path; native creation pending |
| Recovery / support | Existing RAPPS-WP-0014-T03 retains off-host recovery point, isolated restore, rollback and operating responsibility evidence |
The target database is a proposed new consumer, not permission to reuse or
overwrite `vergabe_db`. Refresh managed-consumer count, placement and migration
demand before applying. Tenant creation itself does not depend on this hostname.
## Native tenant and identity execution
Use the existing User Engine portal at `https://users.92-205-62-239.nip.io`.
Its `/login` uses KeyCape and the registered native callback. The authenticated
platform form creates `tenant:trial:demo-company` through Tenant Engine. Record
the response and read back the exact tenant before creating memberships. Do not
substitute a service actor, fabricate verified claims, or bypass policy on denial.
An operator browser has been opened; native login/creation is not yet confirmed.
Create two ordinary memberships through User Engine. Confirm how the identity
provisioner assigns login names before provisioning the requested demo names;
do not invent deliverable email addresses or send invitations to third parties.
The current product uses separately provisioned Django accounts, with no staff
or superuser flags. Preserve the mapping to this tenant's isolated deployment.
This establishes a platform tenant and a bounded app pilot, not completed SSO.
## Hostname and deployment execution
`helm/vergabe-demo-company-values.proposed.yaml` pins the published image and
60m resources, and consistently uses the proposed host for Django and probes.
The chart does not itself create public ingress or DNS. Confirm the preferred
hostname, point its DNS to Railiance01 through the DNS owner, configure the
HTTPS route and abuse control through the existing edge lane, and verify TLS.
On 2026-09-11 the proposed hostname resolved to 80.158.43.29; the legacy
`vergabe-teilnahme.whywhynot.de` resolved to 92.205.130.254. Neither was the
intended Railiance01 address. No DNS changes have been made.
Complete platform database/Secret provisioning and the source-backed namespace,
network and public edge manifests before deployment. Then migrate the fresh
database, deploy, provision the demo app accounts, and perform the two-user
workflow plus restart/isolated-restore checks in the existing owner tasks.
Only then record the demo environment as available for use.
Validation on 2026-09-11: Helm lint passed. Rendering the proposed values
produced the pinned digest, one Recreate replica, 60m CPU request, matching
Django/probe hosts, and two distinct retained PVCs. This is local manifest
verification; it is not native deployment or tenant-creation evidence.

9
docs/vergabe-teilnahme-pilot.md
View file

@ -8,8 +8,9 @@ the historical deployment is still live.
## Exact release packet
Before native admission, record the following non-secret values in the company
binding. Company/host/data selection is pending; do not treat example values as
an assigned tenant.
binding. The user selects a fresh `demo-company` workspace; see
[its prepared binding](vergabe-demo-company-binding.md). Native tenant creation
and hostname admission are pending; example values do not create a tenant.
| Binding | Required evidence |
| --- | --- |
@ -136,4 +137,6 @@ Read-only CNPG metadata also reports `vergabe-db` applied for `vergabe_db` owned
by `vergabe`, two managed consumers with 20-connection limits, and the most recent
apps-pg backup successful at 2026-09-11T02:15:11Z. This establishes the declared
database/backup metadata; no customer data was read, selected for reuse or
modified. The tenant/data choice remains open.
modified. The user subsequently selected a new demo-company workspace; the
prepared binding explicitly uses a fresh database and leaves historical data
untouched.