Point coulomb-social Helm and ingress at app.coulomb.social

Public parallel host; leave apex coulomb.social for Bubble until cutover.

docs/coulomb-social.md

@@ -5,14 +5,22 @@ Chart: `charts/coulomb-social`
 Values: `helm/coulomb-social-values.yaml`  
 Ingress: `manifests/coulomb-social-ingress.yaml`
 
+## Host strategy (2026-08-09)
+
+| Host | Serves |
+|------|--------|
+| **`app.coulomb.social`** | New Railiance stack (this chart) |
+| **`coulomb.social`** | Bubble.io until content + self-registration are ready |
+
+Do **not** point apex DNS at the cluster until apex cutover is explicitly decided.
+
 ## Prerequisites
 
 - Image published: `forgejo.coulomb.social/coulomb/coulomb-social:<sha>`
-- KeyCape client `coulomb-social` registered (see source repo `scripts/register-keycape-client.sh`)
+- KeyCape client `coulomb-social` registered (includes `https://app.coulomb.social/auth/callback/`)
 - K8s Secret `coulomb-social-env` (see **Env secret** below)
 - DB: `apps-pg` role `coulomb_social` / database `coulomb_social_db`
-  (Secret `coulomb-social-app-credentials` in app + databases namespaces)
+- DNS **`app.coulomb.social` A → `92.205.62.239`** (DNS-only / grey cloud for HTTP-01)
-- DNS `coulomb.social` → cluster ingress IP
 
 ## Env secret
 
@@ -20,16 +28,8 @@ Opaque Secret `coulomb-social-env` is mounted via `envFrom` on the Deployment.
 **Never commit values.** Create/patch with:
 
 ```bash
-# plan only (key names, no values)
 make coulomb-social-env-secret-dry-run
-
-# apply: SECRET_KEY (generate or keep), DATABASE_URL (if DB secret exists),
-# USER_ENGINE_PROXY_SECRET (copied from user-engine/user-engine-runtime)
 make coulomb-social-env-secret
-
-# options via COULOMB_SOCIAL_ENV_SECRET_ARGS:
-make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--rotate-secret-key'
-make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--skip-db'
 ```
 
 Script: `tools/create-coulomb-social-env-secret.sh`  
@@ -42,7 +42,10 @@ Source-repo wrapper: `coulomb-social/scripts/create-env-secret.sh`
 | `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` key `proxy-secret` |
 
 Non-secret OIDC/issuer settings live in `helm/coulomb-social-values.yaml`, not
-this Secret.
+this Secret. Live app host env:
+
+- `ALLOWED_HOSTS=app.coulomb.social,localhost`
+- `OIDC_REDIRECT_URI=https://app.coulomb.social/auth/callback/`
 
 After updating an existing deploy:
 
@@ -68,4 +71,4 @@ make coulomb-social-status
 
 ## Probe host
 
-`probes.hostHeader` must stay in `ALLOWED_HOSTS` (see `docs/django-on-railiance.md`).
+`probes.hostHeader` must stay in `ALLOWED_HOSTS` (currently `app.coulomb.social`).

helm/coulomb-social-values.yaml

@@ -5,20 +5,22 @@ image:
   repository: forgejo.coulomb.social/coulomb/coulomb-social
   tag: "7067145"
 
+# Public host: app.coulomb.social (parallel to Bubble on apex coulomb.social).
+# Apex cutover is deferred until data + self-registration are ready.
 env:
   DJANGO_SETTINGS_MODULE: coulomb_social.settings.prod
-  ALLOWED_HOSTS: coulomb.social,localhost
+  ALLOWED_HOSTS: app.coulomb.social,localhost
-  CSRF_TRUSTED_ORIGINS: https://coulomb.social
+  CSRF_TRUSTED_ORIGINS: https://app.coulomb.social
   DEFAULT_TENANT_ID: "tenant:coulomb"
   OIDC_ENABLED: "true"
   OIDC_ISSUER: https://kc.coulomb.social
   OIDC_CLIENT_ID: coulomb-social
-  OIDC_REDIRECT_URI: https://coulomb.social/auth/callback/
+  OIDC_REDIRECT_URI: https://app.coulomb.social/auth/callback/
   OIDC_SCOPES: "openid profile email groups"
   USER_ENGINE_BASE_URL: https://users.92-205-62-239.nip.io
   USER_ENGINE_APPLICATION_ID: coulomb-social
   USER_ENGINE_EXPECTED_AUDIENCE: user-engine-portal
 
 probes:
-  hostHeader: coulomb.social
+  hostHeader: app.coulomb.social
   path: /healthz

manifests/coulomb-social-ingress.yaml

@@ -1,5 +1,6 @@
-# Ingress for coulomb.social (apply after first chart deploy).
+# Ingress for the Railiance rebuild on app.coulomb.social.
-# Requires cert-manager ClusterIssuer and DNS for coulomb.social → cluster.
+# Apex coulomb.social stays on Bubble until content + self-registration cutover.
+# Requires cert-manager ClusterIssuer and DNS app.coulomb.social → cluster IP.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -12,10 +13,10 @@ metadata:
 spec:
   ingressClassName: traefik
   tls:
-    - hosts: [coulomb.social]
+    - hosts: [app.coulomb.social]
       secretName: coulomb-social-tls
   rules:
-    - host: coulomb.social
+    - host: app.coulomb.social
       http:
         paths:
           - path: /