Point coulomb-social Helm and ingress at app.coulomb.social

Public parallel host; leave apex coulomb.social for Bubble until cutover.

docs/coulomb-social.md

@@ -5,14 +5,22 @@ Chart: `charts/coulomb-social`
 Values: `helm/coulomb-social-values.yaml`  
 Ingress: `manifests/coulomb-social-ingress.yaml`
 
+## Host strategy (2026-08-09)
+
+| Host | Serves |
+|------|--------|
+| **`app.coulomb.social`** | New Railiance stack (this chart) |
+| **`coulomb.social`** | Bubble.io until content + self-registration are ready |
+
+Do **not** point apex DNS at the cluster until apex cutover is explicitly decided.
+
 ## Prerequisites
 
 - Image published: `forgejo.coulomb.social/coulomb/coulomb-social:<sha>`
-- KeyCape client `coulomb-social` registered (see source repo `scripts/register-keycape-client.sh`)
+- KeyCape client `coulomb-social` registered (includes `https://app.coulomb.social/auth/callback/`)
 - K8s Secret `coulomb-social-env` (see **Env secret** below)
 - DB: `apps-pg` role `coulomb_social` / database `coulomb_social_db`
-  (Secret `coulomb-social-app-credentials` in app + databases namespaces)
-- DNS `coulomb.social` → cluster ingress IP
+- DNS **`app.coulomb.social` A → `92.205.62.239`** (DNS-only / grey cloud for HTTP-01)
 
 ## Env secret
 
@@ -20,16 +28,8 @@ Opaque Secret `coulomb-social-env` is mounted via `envFrom` on the Deployment.
 **Never commit values.** Create/patch with:
 
 ```bash
-# plan only (key names, no values)
 make coulomb-social-env-secret-dry-run
-
-# apply: SECRET_KEY (generate or keep), DATABASE_URL (if DB secret exists),
-# USER_ENGINE_PROXY_SECRET (copied from user-engine/user-engine-runtime)
 make coulomb-social-env-secret
-
-# options via COULOMB_SOCIAL_ENV_SECRET_ARGS:
-make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--rotate-secret-key'
-make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--skip-db'
 ```
 
 Script: `tools/create-coulomb-social-env-secret.sh`  
@@ -42,7 +42,10 @@ Source-repo wrapper: `coulomb-social/scripts/create-env-secret.sh`
 | `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` key `proxy-secret` |
 
 Non-secret OIDC/issuer settings live in `helm/coulomb-social-values.yaml`, not
-this Secret.
+this Secret. Live app host env:
+
+- `ALLOWED_HOSTS=app.coulomb.social,localhost`
+- `OIDC_REDIRECT_URI=https://app.coulomb.social/auth/callback/`
 
 After updating an existing deploy:
 
@@ -68,4 +71,4 @@ make coulomb-social-status
 
 ## Probe host
 
-`probes.hostHeader` must stay in `ALLOWED_HOSTS` (see `docs/django-on-railiance.md`).
+`probes.hostHeader` must stay in `ALLOWED_HOSTS` (currently `app.coulomb.social`).