coulomb/railiance-apps
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

deploy: bind demo company to published tenant-path release
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-11 21:43:41 +02:00
parent 8f29af4b63
commit 428d0707e0
4 changed files with 62 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

36
docs/vergabe-demo-company-binding.md
View file

@ -1,22 +1,22 @@
# Vergabe demo-company deployment binding
Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04.
This is an execution packet; native tenant creation and deployment are pending.
Native tenant creation is verified; application placement and onboarding remain pending.
| Item | Binding / execution status |
| --- | --- |
| Tenant | `tenant:trial:demo-company`; display `demo-company`; native creation pending |
| Tenant | `tenant:trial:demo-company`; display `demo-company`; active, version 1; native operator create/readback verified |
| Purpose / data | New demo workspace; synthetic data only; no existing data import |
| Initial accounts | `demo-user1`, `demo-user2`, ordinary members; creation and private credential setup pending |
| Operator / acceptance | Bernd Worsch via authenticated existing operator path |
| Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` |
| Proposed namespace | `vergabe-demo-company`; create separately from historical installations |
| Helm release | `vergabe-teilnahme` within that namespace |
| Image source | `ccb6d1f8c7abd50f2ef654491bb1aa5861e795cb`; live CI 29 / publication 31 passed |
| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005` |
| Image source | Tenant-path source `9345a1bb1a92ac0ee3b2dc6443a3d299e6754e70`; CI smoke 43 / publication 44 passed |
| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68` |
| Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` |
| Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi |
| Proposed URL | `https://demo-vergabe.coulomb.social`; user preference pending |
| Selected URL | `https://vergabe-teilnahme.coulomb.social/demo-company/`; one product host, exact tenant path |
| Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 |
| Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending |
| Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet |
@ -34,7 +34,11 @@ Its `/login` uses KeyCape and the registered native callback. The authenticated
platform form creates `tenant:trial:demo-company` through Tenant Engine. Record
the response and read back the exact tenant before creating memberships. Do not
substitute a service actor, fabricate verified claims, or bypass policy on denial.
An operator browser has been opened; native login/creation is not yet confirmed.
Native login and operator creation succeeded at 19:03:18 UTC. Tenant Engine
confirms demo-company active/version 1; User Engine contains the first
administrator with invited status. A subsequent Create login fails with an
LLDAP service-login 401. NK-WP-0036-T04 owns the attended credential-reference
repair; no directory identity is inferred from the user-domain record.
Create two ordinary memberships through User Engine. Confirm how the identity
provisioner assigns login names before provisioning the requested demo names;
@ -45,14 +49,18 @@ This establishes a platform tenant and a bounded app pilot, not completed SSO.
## Hostname and deployment execution
`helm/vergabe-demo-company-values.proposed.yaml` pins the published image and
60m resources, and consistently uses the proposed host for Django and probes.
The chart does not itself create public ingress or DNS. Confirm the preferred
hostname, point its DNS to Railiance01 through the DNS owner, configure the
HTTPS route and abuse control through the existing edge lane, and verify TLS.
On 2026-09-11 the proposed hostname resolved to 80.158.43.29; the legacy
`vergabe-teilnahme.whywhynot.de` resolved to 92.205.130.254. Neither was the
intended Railiance01 address. No DNS changes have been made.
`helm/vergabe-demo-company-values.proposed.yaml` retains 60m resources and the
selected product host, APP_BASE_PATH=/demo-company and published immutable
digest. The chart does not create ingress or DNS.
The edge must match exactly /demo-company or /demo-company/, canonicalize the
bare path and strip the prefix. It must keep private media on the app route and
apply TLS and the admitted abuse-control policy. Do not route neighboring paths
to this instance. Company/data separation remains the dedicated database and
volumes, not a forwarded header or browser path.
On 2026-09-11 the selected product hostname resolves to 80.158.43.29; Railiance01
is 92.205.62.239. No DNS changes have been made. A single product DNS/certificate
serves this arrangement; tenants do not need their own subdomains.
Complete platform database/Secret provisioning and the source-backed namespace,
network and public edge manifests before deployment. Then migrate the fresh

10
docs/vergabe-teilnahme-pilot.md
View file

@ -140,3 +140,13 @@ database/backup metadata; no customer data was read, selected for reuse or
modified. The user subsequently selected a new demo-company workspace; the
prepared binding explicitly uses a fresh database and leaves historical data
untouched.
2026-09-11 update: the selected customer URL is
https://vergabe-teilnahme.coulomb.social/demo-company/. Native demo-company
creation and first-administrator registration are verified. Identity login
provisioning currently fails its LLDAP service authentication, tracked by
NK-WP-0036-T04. Tenant-path application source 9345a1b passes 98 tests and seven
local browser checks; image publication 44 passed with digest
sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68.
Live edge/data admission remains open. See the updated demo-company binding for execution status.