coulomb/railiance-apps
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Wave-2 right-sizing and inter-hub removal (RAPPS-WP-0018, CSOC-WP-0017, REUSE-WP-0026)

Browse source 
- coulomb-social: requests 100m/256Mi -> 15m/176Mi (limits unchanged)
- reuse-surface: main 100m/256Mi -> 5m/64Mi, landing 10m/32Mi -> 5m/16Mi
- vergabe-demo-company: memory request 256Mi -> 512Mi, CPU 60m kept
- inter-hub (retired, CORE-WP-0007): delete chart, values, Make targets,
  smoke script and production deploy workflow; release to be uninstalled

Full renders vs live: resources only, except the vergabe release-unit label
from 64530e1 not yet on its Service and PVCs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
This commit is contained in:
tegwick 2026-10-22 00:03:48 +02:00
parent 1dd7387cbc
commit b7fb7b226f
18 changed files with 41 additions and 426 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.claude/rules/stack-and-commands.md
View file

@ -1,7 +1,7 @@
## Stack ## Stack
- **Language:** Helm values + Kubernetes manifests, Bash Make targets - **Language:** Helm values + Kubernetes manifests, Bash Make targets
- **Key deps:** vergabe-teilnahme (Django) and inter-hub releases, shared apps-pg cnpg cluster, SOPS/age; runs against the S2 cluster on railiance01 - **Key deps:** vergabe-teilnahme (Django), coulomb-social and reuse-surface releases (inter-hub retired and removed), shared apps-pg cnpg cluster, SOPS/age; runs against the S2 cluster on railiance01
## Dev Commands ## Dev Commands
@ -13,7 +13,7 @@ make vergabe-dry-run # helm template render, no apply
make vergabe-status # pod / svc / ingress / cert state (read-only) make vergabe-status # pod / svc / ingress / cert state (read-only)
make vergabe-deploy # production-touching make vergabe-deploy # production-touching
make vergabe-migrate | vergabe-seed # production-touching (Django management) make vergabe-migrate | vergabe-seed # production-touching (Django management)
make check-inter-hub-image-tag # gate: explicit image tag for prod deploys make check-vergabe-image-tag # gate: explicit image tag for prod deploys
``` ```
`*-deploy` / `*-migrate` / `*-seed` change production workloads — operator `*-deploy` / `*-migrate` / `*-seed` change production workloads — operator

50
.gitea/workflows/inter-hub-production-deploy.yaml
View file

@ -1,50 +0,0 @@
name: Inter-Hub production deploy
on:
workflow_dispatch:
inputs:
image_tag:
description: "Immutable inter-hub image tag to deploy, for example 5101eb5"
required: true
confirm:
description: "Type deploy-inter-hub-production to confirm Railiance01 production deploy"
required: true
jobs:
deploy:
runs-on: [self-hosted, haskelseed, linux_amd64]
timeout-minutes: 20
env:
INTER_HUB_IMAGE_TAG: ${{ inputs.image_tag }}
steps:
- name: Check out repository
uses: actions/checkout@v4
- name: Validate dispatch inputs
env:
CONFIRM: ${{ inputs.confirm }}
run: |
set -euo pipefail
if [ "$CONFIRM" != "deploy-inter-hub-production" ]; then
echo "Refusing deploy: confirmation text did not match." >&2
exit 1
fi
if ! [[ "$INTER_HUB_IMAGE_TAG" =~ ^[A-Za-z0-9._-]+$ ]]; then
echo "Refusing deploy: image_tag contains unsupported characters." >&2
exit 1
fi
- name: Verify image manifest exists
run: make check-inter-hub-image
- name: Helm server dry-run
run: make inter-hub-server-dry-run
- name: Deploy Inter-Hub
run: make inter-hub-deploy
- name: Show release status
run: make inter-hub-status
- name: Run public smoke checks
run: make inter-hub-smoke

60
Makefile
View file

@ -24,14 +24,6 @@ COULOMB_SOCIAL_IMAGE_REPOSITORY ?= forgejo.coulomb.social/coulomb/coulomb-social
COULOMB_SOCIAL_INGRESS ?= manifests/coulomb-social-ingress.yaml COULOMB_SOCIAL_INGRESS ?= manifests/coulomb-social-ingress.yaml
COULOMB_SOCIAL_ENV_SECRET ?= coulomb-social-env COULOMB_SOCIAL_ENV_SECRET ?= coulomb-social-env
INTER_HUB_RELEASE ?= inter-hub
INTER_HUB_NAMESPACE ?= inter-hub
INTER_HUB_CHART ?= charts/inter-hub
INTER_HUB_VALUES ?= helm/inter-hub-values.yaml
INTER_HUB_IMAGE_REPOSITORY ?= forgejo.coulomb.social/coulomb/inter-hub
INTER_HUB_IMAGE_TAG ?=
INTER_HUB_BASE_URL ?= https://hub.coulomb.social
REUSE_RELEASE ?= reuse REUSE_RELEASE ?= reuse
REUSE_NAMESPACE ?= reuse REUSE_NAMESPACE ?= reuse
REUSE_CHART ?= charts/reuse-surface REUSE_CHART ?= charts/reuse-surface
@ -52,7 +44,6 @@ POLICY_NEXUS_REVISION ?=
COULOMBCORE_KUBECONFIG ?= $(HOME)/.kube/config COULOMBCORE_KUBECONFIG ?= $(HOME)/.kube/config
RAILIANCE01_KUBECONFIG ?= $(HOME)/.kube/config-railiance01 RAILIANCE01_KUBECONFIG ?= $(HOME)/.kube/config-railiance01
PRODUCTION_KUBECONFIG ?= $(COULOMBCORE_KUBECONFIG) PRODUCTION_KUBECONFIG ?= $(COULOMBCORE_KUBECONFIG)
INTER_HUB_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG)
REUSE_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG) REUSE_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG)
FORGEJO_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG) FORGEJO_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG)
FORGEJO_RELEASE ?= forgejo FORGEJO_RELEASE ?= forgejo
@ -75,8 +66,6 @@ FORGEJO_MAILER_EXTERNAL_SECRET ?= manifests/forgejo-mailer-externalsecret.yaml
REUSE_RUNTIME_EXTERNAL_SECRET ?= manifests/reuse-surface-runtime-externalsecret.yaml REUSE_RUNTIME_EXTERNAL_SECRET ?= manifests/reuse-surface-runtime-externalsecret.yaml
PLATFORM_REPO ?= $(HOME)/railiance-platform PLATFORM_REPO ?= $(HOME)/railiance-platform
ESO_CHART_VERSION ?= 0.16.1 ESO_CHART_VERSION ?= 0.16.1
INTER_HUB_IMAGE_REF = $(INTER_HUB_IMAGE_REPOSITORY):$(INTER_HUB_IMAGE_TAG)
INTER_HUB_IMAGE_SET_ARG = $(if $(strip $(INTER_HUB_IMAGE_TAG)),--set image.tag=$(INTER_HUB_IMAGE_TAG),)
CORE_HUB_RELEASE ?= core-hub CORE_HUB_RELEASE ?= core-hub
CORE_HUB_NAMESPACE ?= core-hub CORE_HUB_NAMESPACE ?= core-hub
@ -139,16 +128,6 @@ check-coulombcore-kubeconfig: ## Verify CoulombCore kubeconfig and k3s API tunne
check-production-kubeconfig: check-coulombcore-kubeconfig ## Verify production app cluster API (CoulombCore) check-production-kubeconfig: check-coulombcore-kubeconfig ## Verify production app cluster API (CoulombCore)
check-inter-hub-image-tag: ## Require an explicit inter-hub image tag for production deploys
@test -n "$(INTER_HUB_IMAGE_TAG)" || { \
echo "Set INTER_HUB_IMAGE_TAG=<sha> for inter-hub production deploys." >&2; \
echo "Example: INTER_HUB_IMAGE_TAG=91037a4 make inter-hub-deploy" >&2; \
exit 1; \
}
check-inter-hub-image: check-inter-hub-image-tag ## Verify the inter-hub OCI image tag exists before deploy
tools/check-oci-image.sh "$(INTER_HUB_IMAGE_REF)"
check-core-hub-image-tag: ## Require an explicit core-hub image tag for production deploys check-core-hub-image-tag: ## Require an explicit core-hub image tag for production deploys
@test -n "$(CORE_HUB_IMAGE_TAG)" || { \ @test -n "$(CORE_HUB_IMAGE_TAG)" || { \
echo "Set CORE_HUB_IMAGE_TAG=<sha> for core-hub production deploys." >&2; \ echo "Set CORE_HUB_IMAGE_TAG=<sha> for core-hub production deploys." >&2; \
@ -315,43 +294,6 @@ coulomb-social-env-secret: ## Create/patch coulomb-social-env (SECRET_KEY, DATAB
coulomb-social-env-secret-dry-run: ## Plan coulomb-social-env keys without applying coulomb-social-env-secret-dry-run: ## Plan coulomb-social-env keys without applying
@bash tools/create-coulomb-social-env-secret.sh --dry-run $(COULOMB_SOCIAL_ENV_SECRET_ARGS) @bash tools/create-coulomb-social-env-secret.sh --dry-run $(COULOMB_SOCIAL_ENV_SECRET_ARGS)
##@ Inter-Hub
inter-hub-render-baseline: ## Render checked-in inter-hub values for chart validation only
helm template $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \
--namespace $(INTER_HUB_NAMESPACE) \
-f $(INTER_HUB_VALUES)
inter-hub-dry-run: check-railiance01-kubeconfig check-inter-hub-image-tag ## helm template render with an explicit production image tag
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm template $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \
--namespace $(INTER_HUB_NAMESPACE) \
-f $(INTER_HUB_VALUES) $(INTER_HUB_IMAGE_SET_ARG)
inter-hub-server-dry-run: check-railiance01-kubeconfig check-inter-hub-image ## Helm server dry-run inter-hub upgrade on Railiance01
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm upgrade --install $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \
--namespace $(INTER_HUB_NAMESPACE) --create-namespace \
-f $(INTER_HUB_VALUES) $(INTER_HUB_IMAGE_SET_ARG) --dry-run=server --timeout 5m
inter-hub-deploy: check-railiance01-kubeconfig check-inter-hub-image ## Deploy / upgrade inter-hub Helm release on Railiance01
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm upgrade --install $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \
--namespace $(INTER_HUB_NAMESPACE) --create-namespace \
-f $(INTER_HUB_VALUES) $(INTER_HUB_IMAGE_SET_ARG) --wait --timeout 5m
inter-hub-status: check-railiance01-kubeconfig ## Show inter-hub pod / svc / ingress / cert state on Railiance01
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl get pods,svc,ingress,certificate -n $(INTER_HUB_NAMESPACE) -l app=$(INTER_HUB_RELEASE) --ignore-not-found
inter-hub-release-info: check-railiance01-kubeconfig ## Show inter-hub Helm history, values, deployment, and pods
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm history $(INTER_HUB_RELEASE) -n $(INTER_HUB_NAMESPACE)
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm get values $(INTER_HUB_RELEASE) -n $(INTER_HUB_NAMESPACE)
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl describe deploy/$(INTER_HUB_RELEASE) -n $(INTER_HUB_NAMESPACE)
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl get pods -n $(INTER_HUB_NAMESPACE) -o wide
inter-hub-smoke: ## Verify public inter-hub v2 route and OpenAPI surface after rollout
INTER_HUB_BASE_URL="$(INTER_HUB_BASE_URL)" tools/inter-hub-smoke.sh
inter-hub-logs: check-railiance01-kubeconfig ## Tail inter-hub app logs from Railiance01
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl logs -n $(INTER_HUB_NAMESPACE) -l app=$(INTER_HUB_RELEASE) -f --tail=50
##@ Core Hub ##@ Core Hub
core-hub-helm-adopt: check-production-kubeconfig ## Annotate live Core Hub resources for Helm ownership core-hub-helm-adopt: check-production-kubeconfig ## Annotate live Core Hub resources for Helm ownership
@ -652,7 +594,7 @@ help: ## Show this help
/^[a-zA-Z0-9_-]+:.*?##/ { printf " \033[36m%-20s\033[0m %s\n", $$1, $$2 } \ /^[a-zA-Z0-9_-]+:.*?##/ { printf " \033[36m%-20s\033[0m %s\n", $$1, $$2 } \
/^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST) /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)
.PHONY: check-tools check-sops k8s-server-dry-run apps-pg-status apps-pg-restore-drill check-railiance01-kubeconfig check-inter-hub-image-tag check-inter-hub-image check-vergabe-image-tag check-vergabe-image vergabe-dry-run vergabe-deploy vergabe-ingress-deploy vergabe-status vergabe-migrate vergabe-seed vergabe-superuser vergabe-logs vergabe-db-url-secret check-coulomb-social-image-tag coulomb-social-dry-run coulomb-social-deploy coulomb-social-ingress-deploy coulomb-social-status coulomb-social-logs coulomb-social-env-secret coulomb-social-env-secret-dry-run eso-deploy forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy forgejo-mailer-es-deploy forgejo-mailer-es-status forgejo-dry-run forgejo-server-dry-run forgejo-deploy forgejo-ingress-deploy forgejo-ssh-nodeport-deploy forgejo-status forgejo-smoke forgejo-npm-smoke forgejo-verify forgejo-operator-bootstrap forgejo-runner-registration-sops-bootstrap forgejo-secrets-check forgejo-logs forgejo-runner-registration-deploy forgejo-runner-deploy forgejo-runner-status forgejo-runner-logs inter-hub-render-baseline inter-hub-dry-run inter-hub-server-dry-run inter-hub-deploy inter-hub-status inter-hub-release-info inter-hub-smoke inter-hub-logs reuse-dry-run reuse-deploy reuse-status reuse-smoke reuse-logs reuse-forgejo-webhook reuse-openbao-eso-token-apply reuse-openbao-store-deploy reuse-runtime-es-deploy reuse-runtime-es-status reuse-webhook-smoke policy-nexus-check-binding policy-nexus-check-image policy-nexus-render policy-nexus-server-dry-run policy-nexus-deploy policy-nexus-status policy-nexus-smoke policy-nexus-rollback help .PHONY: check-tools check-sops k8s-server-dry-run apps-pg-status apps-pg-restore-drill check-railiance01-kubeconfig check-vergabe-image-tag check-vergabe-image vergabe-dry-run vergabe-deploy vergabe-ingress-deploy vergabe-status vergabe-migrate vergabe-seed vergabe-superuser vergabe-logs vergabe-db-url-secret check-coulomb-social-image-tag coulomb-social-dry-run coulomb-social-deploy coulomb-social-ingress-deploy coulomb-social-status coulomb-social-logs coulomb-social-env-secret coulomb-social-env-secret-dry-run eso-deploy forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy forgejo-mailer-es-deploy forgejo-mailer-es-status forgejo-dry-run forgejo-server-dry-run forgejo-deploy forgejo-ingress-deploy forgejo-ssh-nodeport-deploy forgejo-status forgejo-smoke forgejo-npm-smoke forgejo-verify forgejo-operator-bootstrap forgejo-runner-registration-sops-bootstrap forgejo-secrets-check forgejo-logs forgejo-runner-registration-deploy forgejo-runner-deploy forgejo-runner-status forgejo-runner-logs reuse-dry-run reuse-deploy reuse-status reuse-smoke reuse-logs reuse-forgejo-webhook reuse-openbao-eso-token-apply reuse-openbao-store-deploy reuse-runtime-es-deploy reuse-runtime-es-status reuse-webhook-smoke policy-nexus-check-binding policy-nexus-check-image policy-nexus-render policy-nexus-server-dry-run policy-nexus-deploy policy-nexus-status policy-nexus-smoke policy-nexus-rollback help
.PHONY: forgejo-secret-scan-template-deploy .PHONY: forgejo-secret-scan-template-deploy

16
charts/inter-hub/Chart.yaml
View file

@ -1,16 +0,0 @@
apiVersion: v2
name: inter-hub
description: |
Interaction Hub Framework reference deployment for Railiance01.
type: application
version: 0.1.0
appVersion: "0.2.0-alpha.1"
keywords:
- ihf
- inter-hub
- railiance
home: https://forgejo.coulomb.social/coulomb/inter-hub-haskell
sources:
- https://forgejo.coulomb.social/coulomb/inter-hub-haskell
maintainers:
- name: railiance-apps

28
charts/inter-hub/templates/_helpers.tpl
View file

@ -1,28 +0,0 @@
{{/*
Chart name + release name produce a unique resource name.
*/}}
{{- define "interhub.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s" $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- define "interhub.labels" -}}
app: {{ include "interhub.fullname" . }}
app.kubernetes.io/name: {{ include "interhub.fullname" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
app.kubernetes.io/part-of: railiance-apps
helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
{{- end -}}
{{- define "interhub.selectorLabels" -}}
app: {{ include "interhub.fullname" . }}
{{- end -}}
{{- define "interhub.image" -}}
{{- if not .Values.image.tag -}}
{{- fail "image.tag is required - pin it in helm/inter-hub-values.yaml or pass --set image.tag=<sha>" -}}
{{- end -}}
{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
{{- end -}}

59
charts/inter-hub/templates/deployment.yaml
View file

@ -1,59 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "interhub.fullname" . }}
labels: {{- include "interhub.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.replicaCount }}
selector:
matchLabels: {{- include "interhub.selectorLabels" . | nindent 6 }}
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
template:
metadata:
labels: {{- include "interhub.labels" . | nindent 8 }}
spec:
securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: inter-hub
image: {{ include "interhub.image" . | quote }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
securityContext: {{- toYaml .Values.securityContext | nindent 12 }}
ports:
- name: http
containerPort: {{ .Values.service.targetPort }}
protocol: TCP
envFrom:
- secretRef:
name: {{ .Values.envSecretName | quote }}
{{- if .Values.probes.enabled }}
readinessProbe:
httpGet:
path: {{ .Values.probes.path }}
port: {{ .Values.probes.port }}
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
livenessProbe:
httpGet:
path: {{ .Values.probes.path }}
port: {{ .Values.probes.port }}
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
{{- end }}
resources: {{- toYaml .Values.resources | nindent 12 }}
{{- with .Values.nodeSelector }}
nodeSelector: {{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity: {{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations: {{- toYaml . | nindent 8 }}
{{- end }}

28
charts/inter-hub/templates/ingress.yaml
View file

@ -1,28 +0,0 @@
{{- if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ include "interhub.fullname" . }}
labels: {{- include "interhub.labels" . | nindent 4 }}
annotations:
{{- toYaml .Values.ingress.annotations | nindent 4 }}
spec:
ingressClassName: {{ .Values.ingress.className }}
{{- if .Values.ingress.tls }}
tls:
- hosts:
- {{ .Values.ingress.host }}
secretName: {{ include "interhub.fullname" . }}-tls
{{- end }}
rules:
- host: {{ .Values.ingress.host }}
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: {{ include "interhub.fullname" . }}
port:
number: {{ .Values.service.port }}
{{- end }}

13
charts/inter-hub/templates/service.yaml
View file

@ -1,13 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "interhub.fullname" . }}
labels: {{- include "interhub.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: {{ .Values.service.targetPort }}
protocol: TCP
name: http
selector: {{- include "interhub.selectorLabels" . | nindent 4 }}

55
charts/inter-hub/values.yaml
View file

@ -1,55 +0,0 @@
image:
repository: forgejo.coulomb.social/coulomb/inter-hub
tag: "" # required; pinned via helm/inter-hub-values.yaml or --set image.tag=<sha>
pullPolicy: IfNotPresent
replicaCount: 1
service:
type: ClusterIP
port: 8000
targetPort: 8000
resources:
requests:
cpu: 250m
memory: 512Mi
limits:
cpu: 1000m
memory: 2Gi
# Env from the K8s Secret created from inter-hub's SOPS handoff file:
# deploy/railiance/secrets/inter-hub.env.sops.yaml
envSecretName: inter-hub-env
ingress:
enabled: true
className: traefik
host: hub.coulomb.social
tls: true
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
cert-manager.io/cluster-issuer: letsencrypt-prod
probes:
enabled: true
path: /
port: 8000
liveness:
initialDelaySeconds: 30
periodSeconds: 30
timeoutSeconds: 5
failureThreshold: 3
readiness:
initialDelaySeconds: 15
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
podSecurityContext: {}
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}

8
docs/inter-hub-on-railiance01.md
View file

@ -7,6 +7,14 @@ deployments on CoulombCore and railiance01 are scaled to `0`.
This document preserves the Railiance01 Helm surface for audit only. Do not This document preserves the Railiance01 Helm surface for audit only. Do not
deploy Inter-Hub to production. deploy Inter-Hub to production.
**Removed 2026-10-21 (`RAPPS-WP-0018`, founder-approved wave 2).** The
`charts/inter-hub` chart, `helm/inter-hub-values.yaml`, the `inter-hub-*` Make
targets, `tools/inter-hub-smoke.sh` and the
`.gitea/workflows/inter-hub-production-deploy.yaml` workflow are deleted. The
release (0 replicas, latent 250m/512Mi request) is uninstalled with
`helm uninstall inter-hub -n inter-hub`. The commands below no longer exist;
recover them from git history if ever needed.
## Hosts and release surface ## Hosts and release surface
| Server | IP | Role | | Server | IP | Role |

1
docs/operator-setup.md
View file

@ -71,7 +71,6 @@ The app-specific targets also accept explicit overrides:
```bash ```bash
REUSE_KUBECONFIG=~/.kube/config-railiance01 make reuse-status REUSE_KUBECONFIG=~/.kube/config-railiance01 make reuse-status
INTER_HUB_KUBECONFIG=~/.kube/config-railiance01 make inter-hub-status
``` ```
## SOPS Age Key Bootstrap ## SOPS Age Key Bootstrap

10
helm/coulomb-social-values.yaml
View file

@ -38,3 +38,13 @@ persistence:
size: 2Gi size: 2Gi
mountPath: /app/var/content mountPath: /app/var/content
retain: true retain: true
# Wave-2 right-sizing (CSOC-WP-0017-T01, 2026-10-21 node budget): 7d p95
# 0.4m CPU / 146Mi. Limits stay at the chart defaults (1000m/1Gi).
resources:
requests:
cpu: 15m
memory: 176Mi
limits:
cpu: 1000m
memory: 1Gi

6
helm/inter-hub-values.yaml
View file

@ -1,6 +0,0 @@
# Production overrides for the inter-hub Helm chart.
# Non-secret values only; DATABASE_URL and IHP_SESSION_SECRET come from the
# Secret 'inter-hub-env' in the inter-hub namespace.
image:
tag: "fde5525" # Render baseline only; production deploy requires INTER_HUB_IMAGE_TAG=<sha>.

18
helm/reuse-surface-values.yaml
View file

@ -15,8 +15,26 @@ image:
repository: forgejo.coulomb.social/coulomb/reuse-surface repository: forgejo.coulomb.social/coulomb/reuse-surface
digest: sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0 digest: sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0
# Wave-2 right-sizing (REUSE-WP-0026-T01, 2026-10-21 node budget): pod
# aggregate 110m/288Mi -> 10m/80Mi; 7d p95 2.1m CPU; split by
# per-pod p95 x1.15 (main ~51Mi -> 64Mi, landing ~5Mi -> 16Mi). Limits unchanged.
resources:
requests:
cpu: 5m
memory: 64Mi
limits:
cpu: 500m
memory: 512Mi
landing: landing:
enabled: true enabled: true
resources:
requests:
cpu: 5m
memory: 16Mi
limits:
cpu: 50m
memory: 64Mi
title: "REUSE federation endpoint" title: "REUSE federation endpoint"
eyebrow: "reuse.coulomb.social" eyebrow: "reuse.coulomb.social"
body: "This is the Railiance REUSE capability federation service. It is an API endpoint for automated clients and operators; there is no browser login for this service." body: "This is the Railiance REUSE capability federation service. It is an API endpoint for automated clients and operators; there is no browser login for this service."

3
helm/vergabe-demo-company-values.proposed.yaml
View file

@ -11,7 +11,8 @@ replicaCount: 1
resources: resources:
requests: requests:
cpu: 60m cpu: 60m
memory: 256Mi # Wave-2 (RAPPS-WP-0018-T01): target replay loaded working set 320-480MiB.
memory: 512Mi
limits: limits:
cpu: 1000m cpu: 1000m
memory: 1Gi memory: 1Gi

1
registry/capabilities/capability.railiance.workload-deployment-tooling.md
View file

@ -78,7 +78,6 @@ evidence:
- SCOPE.md - SCOPE.md
tests: tests:
- tools/forgejo-smoke.sh - tools/forgejo-smoke.sh
- tools/inter-hub-smoke.sh
- tools/k8s-server-dry-run.sh - tools/k8s-server-dry-run.sh
consumer_feedback: [] consumer_feedback: []
bug_reports: [] bug_reports: []

87
tools/inter-hub-smoke.sh
View file

@ -1,87 +0,0 @@
#!/usr/bin/env bash
set -euo pipefail
base_url="${INTER_HUB_BASE_URL:-https://hub.coulomb.social}"
base_url="${base_url%/}"
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
request() {
local name="$1"
local url="$2"
local expected_status="$3"
local body="$tmpdir/${name}.json"
local status
status="$(curl -sS -o "$body" -w "%{http_code}" "$url")"
if [[ "$status" != "$expected_status" ]]; then
echo "ERROR: expected $url to return $expected_status, got $status" >&2
cat "$body" >&2
echo >&2
exit 1
fi
echo "$body"
}
hubs_body="$(request hubs "${base_url}/api/v2/hubs" 200)"
python3 - "$hubs_body" <<'PY'
import json
import sys
with open(sys.argv[1], encoding="utf-8") as fh:
payload = json.load(fh)
if not isinstance(payload, dict) or not isinstance(payload.get("data"), list):
raise SystemExit("/api/v2/hubs did not return a paginated data list")
print("ok: /api/v2/hubs returned public discovery JSON")
PY
widgets_body="$(request widgets "${base_url}/api/v2/widgets" 401)"
hub_registry_body="$(request hub-registry "${base_url}/api/v2/hub-registry" 401)"
python3 - "$widgets_body" "$hub_registry_body" <<'PY'
import json
import sys
for path, filename in (
("/api/v2/widgets", sys.argv[1]),
("/api/v2/hub-registry", sys.argv[2]),
):
with open(filename, encoding="utf-8") as fh:
payload = json.load(fh)
code = payload.get("code") if isinstance(payload, dict) else None
if code != "invalid_api_key":
raise SystemExit(f"{path} returned 401 but not invalid_api_key JSON")
print(f"ok: {path} requires an API key")
PY
openapi_body="$(request openapi "${base_url}/api/v2/openapi.json" 200)"
python3 - "$openapi_body" <<'PY'
import json
import sys
required_paths = {
"/hubs",
"/hub-capability-manifests",
"/api-consumers",
"/policy-scopes",
"/widgets",
"/hub-registry",
}
with open(sys.argv[1], encoding="utf-8") as fh:
payload = json.load(fh)
paths = payload.get("paths")
if not isinstance(paths, dict):
raise SystemExit("/api/v2/openapi.json did not include an OpenAPI paths object")
missing = sorted(required_paths - set(paths))
if missing:
raise SystemExit("OpenAPI missing paths: " + ", ".join(missing))
print("ok: /api/v2/openapi.json lists expected v2 resources")
PY

20
tools/k8s-server-dry-run.sh
View file

@ -8,11 +8,6 @@ VERGABE_RELEASE="${VERGABE_RELEASE:-vergabe-teilnahme}"
VERGABE_NAMESPACE="${VERGABE_NAMESPACE:-vergabe-teilnahme}" VERGABE_NAMESPACE="${VERGABE_NAMESPACE:-vergabe-teilnahme}"
VERGABE_CHART="${VERGABE_CHART:-charts/vergabe-teilnahme}" VERGABE_CHART="${VERGABE_CHART:-charts/vergabe-teilnahme}"
VERGABE_VALUES="${VERGABE_VALUES:-helm/vergabe-teilnahme-values.yaml}" VERGABE_VALUES="${VERGABE_VALUES:-helm/vergabe-teilnahme-values.yaml}"
INTER_HUB_RELEASE="${INTER_HUB_RELEASE:-inter-hub}"
INTER_HUB_NAMESPACE="${INTER_HUB_NAMESPACE:-inter-hub}"
INTER_HUB_CHART="${INTER_HUB_CHART:-charts/inter-hub}"
INTER_HUB_VALUES="${INTER_HUB_VALUES:-helm/inter-hub-values.yaml}"
INTER_HUB_IMAGE_TAG="${INTER_HUB_IMAGE_TAG:-}"
DRY_RUN_CREATE_NAMESPACES="${DRY_RUN_CREATE_NAMESPACES:-false}" DRY_RUN_CREATE_NAMESPACES="${DRY_RUN_CREATE_NAMESPACES:-false}"
for cmd in kubectl helm; do for cmd in kubectl helm; do
@ -33,33 +28,18 @@ fi
if [[ "$DRY_RUN_CREATE_NAMESPACES" == "true" ]]; then if [[ "$DRY_RUN_CREATE_NAMESPACES" == "true" ]]; then
echo "server dry-run: ensuring namespace $VERGABE_NAMESPACE exists" echo "server dry-run: ensuring namespace $VERGABE_NAMESPACE exists"
kubectl create namespace "$VERGABE_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f - kubectl create namespace "$VERGABE_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
echo "server dry-run: ensuring namespace $INTER_HUB_NAMESPACE exists"
kubectl create namespace "$INTER_HUB_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
fi fi
tmpdir="$(mktemp -d)" tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT trap 'rm -rf "$tmpdir"' EXIT
inter_hub_image_args=()
if [[ -n "$INTER_HUB_IMAGE_TAG" ]]; then
inter_hub_image_args=(--set "image.tag=$INTER_HUB_IMAGE_TAG")
fi
helm template "$VERGABE_RELEASE" "$VERGABE_CHART" \ helm template "$VERGABE_RELEASE" "$VERGABE_CHART" \
--namespace "$VERGABE_NAMESPACE" \ --namespace "$VERGABE_NAMESPACE" \
-f "$VERGABE_VALUES" \ -f "$VERGABE_VALUES" \
> "$tmpdir/vergabe-teilnahme.yaml" > "$tmpdir/vergabe-teilnahme.yaml"
helm template "$INTER_HUB_RELEASE" "$INTER_HUB_CHART" \
--namespace "$INTER_HUB_NAMESPACE" \
-f "$INTER_HUB_VALUES" \
"${inter_hub_image_args[@]}" \
> "$tmpdir/inter-hub.yaml"
echo "server dry-run: committed manifests" echo "server dry-run: committed manifests"
kubectl apply --dry-run=server -f manifests kubectl apply --dry-run=server -f manifests
echo "server dry-run: rendered $VERGABE_RELEASE chart" echo "server dry-run: rendered $VERGABE_RELEASE chart"
kubectl apply --dry-run=server -n "$VERGABE_NAMESPACE" -f "$tmpdir/vergabe-teilnahme.yaml" kubectl apply --dry-run=server -n "$VERGABE_NAMESPACE" -f "$tmpdir/vergabe-teilnahme.yaml"
echo "server dry-run: rendered $INTER_HUB_RELEASE chart"
kubectl apply --dry-run=server -n "$INTER_HUB_NAMESPACE" -f "$tmpdir/inter-hub.yaml"