diff --git a/docs/vergabe-demo-company-binding.md b/docs/vergabe-demo-company-binding.md index f6a48a9..21245be 100644 --- a/docs/vergabe-demo-company-binding.md +++ b/docs/vergabe-demo-company-binding.md @@ -1,22 +1,22 @@ # Vergabe demo-company deployment binding Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04. -This is an execution packet; native tenant creation and deployment are pending. +Native tenant creation is verified; application placement and onboarding remain pending. | Item | Binding / execution status | | --- | --- | -| Tenant | `tenant:trial:demo-company`; display `demo-company`; native creation pending | +| Tenant | `tenant:trial:demo-company`; display `demo-company`; active, version 1; native operator create/readback verified | | Purpose / data | New demo workspace; synthetic data only; no existing data import | | Initial accounts | `demo-user1`, `demo-user2`, ordinary members; creation and private credential setup pending | | Operator / acceptance | Bernd Worsch via authenticated existing operator path | | Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` | | Proposed namespace | `vergabe-demo-company`; create separately from historical installations | | Helm release | `vergabe-teilnahme` within that namespace | -| Image source | `ccb6d1f8c7abd50f2ef654491bb1aa5861e795cb`; live CI 29 / publication 31 passed | -| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005` | +| Image source | Tenant-path source `9345a1bb1a92ac0ee3b2dc6443a3d299e6754e70`; CI smoke 43 / publication 44 passed | +| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68` | | Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` | | Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi | -| Proposed URL | `https://demo-vergabe.coulomb.social`; user preference pending | +| Selected URL | `https://vergabe-teilnahme.coulomb.social/demo-company/`; one product host, exact tenant path | | Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 | | Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending | | Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet | @@ -34,7 +34,11 @@ Its `/login` uses KeyCape and the registered native callback. The authenticated platform form creates `tenant:trial:demo-company` through Tenant Engine. Record the response and read back the exact tenant before creating memberships. Do not substitute a service actor, fabricate verified claims, or bypass policy on denial. -An operator browser has been opened; native login/creation is not yet confirmed. +Native login and operator creation succeeded at 19:03:18 UTC. Tenant Engine +confirms demo-company active/version 1; User Engine contains the first +administrator with invited status. A subsequent Create login fails with an +LLDAP service-login 401. NK-WP-0036-T04 owns the attended credential-reference +repair; no directory identity is inferred from the user-domain record. Create two ordinary memberships through User Engine. Confirm how the identity provisioner assigns login names before provisioning the requested demo names; @@ -45,14 +49,18 @@ This establishes a platform tenant and a bounded app pilot, not completed SSO. ## Hostname and deployment execution -`helm/vergabe-demo-company-values.proposed.yaml` pins the published image and -60m resources, and consistently uses the proposed host for Django and probes. -The chart does not itself create public ingress or DNS. Confirm the preferred -hostname, point its DNS to Railiance01 through the DNS owner, configure the -HTTPS route and abuse control through the existing edge lane, and verify TLS. -On 2026-09-11 the proposed hostname resolved to 80.158.43.29; the legacy -`vergabe-teilnahme.whywhynot.de` resolved to 92.205.130.254. Neither was the -intended Railiance01 address. No DNS changes have been made. +`helm/vergabe-demo-company-values.proposed.yaml` retains 60m resources and the +selected product host, APP_BASE_PATH=/demo-company and published immutable +digest. The chart does not create ingress or DNS. +The edge must match exactly /demo-company or /demo-company/, canonicalize the +bare path and strip the prefix. It must keep private media on the app route and +apply TLS and the admitted abuse-control policy. Do not route neighboring paths +to this instance. Company/data separation remains the dedicated database and +volumes, not a forwarded header or browser path. + +On 2026-09-11 the selected product hostname resolves to 80.158.43.29; Railiance01 +is 92.205.62.239. No DNS changes have been made. A single product DNS/certificate +serves this arrangement; tenants do not need their own subdomains. Complete platform database/Secret provisioning and the source-backed namespace, network and public edge manifests before deployment. Then migrate the fresh diff --git a/docs/vergabe-teilnahme-pilot.md b/docs/vergabe-teilnahme-pilot.md index b71fdfb..0b6e381 100644 --- a/docs/vergabe-teilnahme-pilot.md +++ b/docs/vergabe-teilnahme-pilot.md @@ -140,3 +140,13 @@ database/backup metadata; no customer data was read, selected for reuse or modified. The user subsequently selected a new demo-company workspace; the prepared binding explicitly uses a fresh database and leaves historical data untouched. + + +2026-09-11 update: the selected customer URL is +https://vergabe-teilnahme.coulomb.social/demo-company/. Native demo-company +creation and first-administrator registration are verified. Identity login +provisioning currently fails its LLDAP service authentication, tracked by +NK-WP-0036-T04. Tenant-path application source 9345a1b passes 98 tests and seven +local browser checks; image publication 44 passed with digest +sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68. +Live edge/data admission remains open. See the updated demo-company binding for execution status. diff --git a/helm/vergabe-demo-company-values.proposed.yaml b/helm/vergabe-demo-company-values.proposed.yaml index 5cc48df..0b1067a 100644 --- a/helm/vergabe-demo-company-values.proposed.yaml +++ b/helm/vergabe-demo-company-values.proposed.yaml @@ -1,10 +1,10 @@ # Proposed binding only; see docs/vergabe-demo-company-binding.md. -# Native tenant, database/Secret, DNS/TLS and edge admission are still pending. +# Tenant and published image are verified; database/Secret and DNS/TLS admission are pending. # Release vergabe-teilnahme; namespace vergabe-demo-company. pilot: enabled: true image: - digest: sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005 + digest: sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68 replicaCount: 1 resources: requests: @@ -15,11 +15,12 @@ resources: memory: 1Gi envSecretName: vergabe-demo-env env: + APP_BASE_PATH: /demo-company DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod - ALLOWED_HOSTS: demo-vergabe.coulomb.social,localhost - CSRF_TRUSTED_ORIGINS: https://demo-vergabe.coulomb.social + ALLOWED_HOSTS: vergabe-teilnahme.coulomb.social,localhost + CSRF_TRUSTED_ORIGINS: https://vergabe-teilnahme.coulomb.social probes: - hostHeader: demo-vergabe.coulomb.social + hostHeader: vergabe-teilnahme.coulomb.social persistence: media: enabled: true diff --git a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md index 2dda6dd..80ba328 100644 --- a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md +++ b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md @@ -39,7 +39,7 @@ values template prepare the deployment; no live resources were changed. id: RAPPS-WP-0014-T02 status: progress needs_human: true -intervention_note: "Company and fresh data are selected. Await native User Engine operator login for demo-company creation; proposed hostname preference and DNS/TLS setup remain open. No new approval for the accepted 60m prototype is needed." +intervention_note: "Native demo-company exists; product host/path is selected. Identity-provisioner LLDAP login returns 401 after credential reload; NK-WP-0036-T04 holds attended consumer credential reconciliation. DNS/TLS, new database/Secret, app deployment and ordinary demo accounts remain. No new approval for the 60m prototype is needed." priority: high assignee: the-custodian state_hub_task_id: "b00958c8-1401-5ebf-bc22-c0252618d897" @@ -80,18 +80,31 @@ limiter. Keep `/media/` behind the app gate. The user requests a new `demo-company` tenant with `demo-user1`, etc. Apply NetKingdom ADR-0013 as `tenant:trial:demo-company` and start with two ordinary demo users. Fresh data is selected; no historical customer import is authorized. -The exact prepared namespace/database/release and proposed hostname are in +The prepared namespace/database/release and current execution status are in `docs/vergabe-demo-company-binding.md` and -`helm/vergabe-demo-company-values.proposed.yaml`. The suggested hostname is -`demo-vergabe.coulomb.social`; user preference is pending. Its observed DNS -target is not Railiance01 and must be corrected through the edge owner. +`helm/vergabe-demo-company-values.proposed.yaml`. The user chose +`https://vergabe-teilnahme.coulomb.social/demo-company`. DNS/TLS is per product +host; the exact company prefix selects its isolated application instance. +The chosen hostname currently resolves to 80.158.43.29 and needs the admitted +Railiance01 route (92.205.62.239) through the edge owner. -Tenant Engine creation must use the authenticated User Engine operator portal. -An isolated native KeyCape login window has been opened; operator login, -tenant creation/readback, memberships and app account provisioning are not yet -confirmed. Do not substitute a trusted service actor to bypass a denial. -Platform registration does not add SSO to the Django pilot. Continue execution -on T02; company/data choice is no longer missing input. +Native operator authentication as platform-root succeeded. At 19:03:18 UTC the +operator created demo-company through the native User Engine form; Tenant +Engine readback confirms active, version 1. The chosen first administrator is +present with invited status. A subsequent user was created, but Create login +fails in identity-provisioner at the LLDAP admin authentication step, before +directory mutation. Reloading the existing credential reference preserves this +401. NK-WP-0036-T04 owns the prepared attended consumer-only reconciliation; +T05 retains the functional dependency preflight/error-reporting improvement. +No provider password has been changed, and no failed login create was replayed. + +Vergabe source 9345a1b supports APP_BASE_PATH=/demo-company, prefix-aware URL +reversing and cookie scope. All 98 application tests, Vite build and seven +local Chromium path/edge checks pass. CI smoke 43 and publication 44 passed; the proposed values now pin +sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68 +and APP_BASE_PATH=/demo-company. The previous root-path image is superseded. Ordinary demo memberships and +Django accounts remain separate from platform tenant existence. No product SSO +is claimed. The selected URL and successful tenant creation are resolved inputs. ## Demonstrate restart, isolated restore, rollback and operating ownership