coulomb/railiance-apps
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add coulomb-social-env secret create/patch script
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Builds SECRET_KEY, optional URL-encoded DATABASE_URL from app DB
credentials, and USER_ENGINE_PROXY_SECRET from user-engine-runtime.
Never prints values; Makefile dry-run and apply targets.
This commit is contained in:
tegwick 2026-08-09 02:04:32 +02:00
parent 32610e9090
commit c79f07aadf
3 changed files with 321 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

44
docs/coulomb-social.md
View file

@ -9,15 +9,51 @@ Ingress: `manifests/coulomb-social-ingress.yaml`
- Image published: `forgejo.coulomb.social/coulomb/coulomb-social:<sha>`
- KeyCape client `coulomb-social` registered (see source repo `scripts/register-keycape-client.sh`)
- K8s Secret `coulomb-social-env` in namespace `coulomb-social` with at least:
- `SECRET_KEY`
- `DATABASE_URL` (or platform DB handoff)
- `USER_ENGINE_PROXY_SECRET` (from user-engine-runtime)
- K8s Secret `coulomb-social-env` (see **Env secret** below)
- Optional: DB role Secret `coulomb-social-app-credentials` in the app namespace
(cnpg mirror; same pattern as vergabe) before DATABASE_URL can be filled
- DNS `coulomb.social` → cluster ingress IP
## Env secret
Opaque Secret `coulomb-social-env` is mounted via `envFrom` on the Deployment.
**Never commit values.** Create/patch with:
```bash
# plan only (key names, no values)
make coulomb-social-env-secret-dry-run
# apply: SECRET_KEY (generate or keep), DATABASE_URL (if DB secret exists),
# USER_ENGINE_PROXY_SECRET (copied from user-engine/user-engine-runtime)
make coulomb-social-env-secret
# options via COULOMB_SOCIAL_ENV_SECRET_ARGS:
make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--rotate-secret-key'
make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--skip-db'
```
Script: `tools/create-coulomb-social-env-secret.sh`
Source-repo wrapper: `coulomb-social/scripts/create-env-secret.sh`
| Key | Source |
|-----|--------|
| `SECRET_KEY` | generated (or kept if present; `--rotate-secret-key` forces new) |
| `DATABASE_URL` | URL-encoded password from `coulomb-social-app-credentials` |
| `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` key `proxy-secret` |
Non-secret OIDC/issuer settings live in `helm/coulomb-social-values.yaml`, not
this Secret.
After updating an existing deploy:
```bash
kubectl -n coulomb-social rollout restart deploy/coulomb-social
```
## Deploy
```bash
make coulomb-social-env-secret
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-dry-run
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-deploy
make coulomb-social-ingress-deploy