Add runbook coverage for REUSE_SURFACE_TOKEN and
REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET in reuse-surface-env, plus an
idempotent make reuse-forgejo-webhook target that wires the coulomb org
push webhook to the hub receiver.
Found while smoke-testing the REUSE-WP-0019-T01/T02 deploy: GET
/v1/federated works (200) but the exact-path /health rule 404s at the
Traefik edge, shadowed by the catch-all / rule to reuse-surface-landing.
Confirmed pod/service-level health is fine (direct port-forward works,
readiness/liveness probes pass, pod is 1/1 Ready) -- this is an ingress
routing config issue affecting external monitoring only, not the API
itself. Not fixed here; needs a Traefik router priority annotation on
charts/reuse-surface/templates/ingress.yaml, a deliberate change to shared
production ingress outside this task's scope.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Use PROTOCOL=smtp+starttls with the EU relay (smtp.ionos.de). Port 587 with
implicit TLS on smtp.ionos.com failed TLS handshake; .com auth also fails for
EU mailboxes. Document OpenBao PASSWD field mapping in operator docs.
Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the
synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.
T07 smoke: migrate all apps; /health/ 200, /ausschreibungen/dashboard/ Übersicht, /admin/login/ Anmelden, static assets (Tailwind, Alpine, htmx, Django admin) all 200. Auth-required smoke and createsuperuser deferred to the operator (interactive credentials not safe through this session); seed_dev deliberately skipped (hardcoded dev user). T08 runbook in docs/vergabe-teilnahme.md: identity, secret rotation recipes, day-to-day make targets, image promotion + rollback, troubleshooting, deferred backup posture, cross-refs.
Workplan status: finished. vergabe-teilnahme is the second S5 application on railiance01 (after Gitea).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
