Record deployed Vergabe pilot chart and company sign-in evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

helm/vergabe-demo-company-foundation.yaml

@@ -0,0 +1,94 @@
+# RAPPS-WP-0014: admitted empty demo workspace; no credentials or database data.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vergabe-demo-company
+  labels:
+    railiance.io/workload-class: application
+    railiance.io/postgres-client: apps-pg
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: vergabe-demo-company
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vergabe-runtime
+  namespace: vergabe-demo-company
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: vergabe-teilnahme
+      app.kubernetes.io/instance: vergabe-teilnahme
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: TCP
+      port: 8000
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: databases
+      podSelector:
+        matchLabels:
+          cnpg.io/cluster: apps-pg
+    ports:
+    - protocol: TCP
+      port: 5432
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-acme-http01
+  namespace: vergabe-demo-company
+spec:
+  podSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: 'true'
+  policyTypes:
+  - Ingress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: TCP
+      port: 8089
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vergabe-demo-tls
+  namespace: vergabe-demo-company
+spec:
+  secretName: vergabe-demo-tls
+  dnsNames:
+  - vergabe-teilnahme.coulomb.social
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod

helm/vergabe-demo-company-ingress.yaml

@@ -0,0 +1,116 @@
+# Exact product hostname and isolated company path. Private media stays in Django.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-security
+  namespace: vergabe-demo-company
+spec:
+  chain:
+    middlewares:
+    - name: vergabe-rate-limit
+    - name: vergabe-headers
+    - name: vergabe-canonical-path
+    - name: vergabe-strip-tenant
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-rate-limit
+  namespace: vergabe-demo-company
+spec:
+  rateLimit:
+    average: 60
+    period: 1m
+    burst: 20
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-headers
+  namespace: vergabe-demo-company
+spec:
+  headers:
+    stsSeconds: 31536000
+    contentTypeNosniff: true
+    frameDeny: true
+    referrerPolicy: same-origin
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-canonical-path
+  namespace: vergabe-demo-company
+spec:
+  redirectRegex:
+    regex: ^(https?://vergabe-teilnahme\.coulomb\.social/demo-company)(\?.*)?$
+    replacement: ${1}/${2}
+    permanent: false
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-strip-tenant
+  namespace: vergabe-demo-company
+spec:
+  stripPrefix:
+    prefixes:
+    - /demo-company
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-https
+  namespace: vergabe-demo-company
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vergabe-demo-company
+  namespace: vergabe-demo-company
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: 'true'
+    traefik.ingress.kubernetes.io/router.middlewares: vergabe-demo-company-vergabe-security@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: vergabe-teilnahme.coulomb.social
+    http:
+      paths:
+      - path: /demo-company
+        pathType: Prefix
+        backend:
+          service:
+            name: vergabe-teilnahme
+            port:
+              number: 80
+  tls:
+  - secretName: vergabe-demo-tls
+    hosts:
+    - vergabe-teilnahme.coulomb.social
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: vergabe-demo-company-vergabe-https@kubernetescrd
+  name: vergabe-demo-company-http
+  namespace: vergabe-demo-company
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: vergabe-teilnahme.coulomb.social
+    http:
+      paths:
+      - backend:
+          service:
+            name: vergabe-teilnahme
+            port:
+              number: 80
+        path: /demo-company
+        pathType: Prefix

helm/vergabe-demo-company-values.proposed.yaml

@@ -1,10 +1,12 @@
-# Proposed binding only; see docs/vergabe-demo-company-binding.md.
-# Tenant and published image are verified; database/Secret and DNS/TLS admission are pending.
+# Admitted demo binding; see docs/vergabe-demo-company-binding.md.
+# Fresh database only. Init migration shares the application scheduling envelope.
 # Release vergabe-teilnahme; namespace vergabe-demo-company.
 pilot:
   enabled: true
 image:
-  digest: sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68
+  digest: sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e
+migrations:
+  enabled: true
 replicaCount: 1
 resources:
   requests:
@@ -15,6 +17,12 @@ resources:
     memory: 1Gi
 envSecretName: vergabe-demo-env
 env:
+  NETKINGDOM_ENABLED: "true"
+  NETKINGDOM_ISSUER: https://kc.coulomb.social
+  NETKINGDOM_CLIENT_ID: vergabe-demo-company
+  NETKINGDOM_CALLBACK: https://vergabe-teilnahme.coulomb.social/demo-company/accounts/oidc/callback/
+  NETKINGDOM_TENANT: tenant:trial:demo-company
+  COMPANY_DISPLAY_NAME: Demo Company
   APP_BASE_PATH: /demo-company
   DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod
   ALLOWED_HOSTS: vergabe-teilnahme.coulomb.social,localhost