coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
119 commits 1 branch 0 tags 472 KiB
Commit graph

17 commits

Author SHA1 Message Date
tegwick
e9ee577d03 WP-0014: Helm adopt and deploy Core Hub on CoulombCore; backup auth tooling
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 20s
Details 
Adopt live Core Hub resources, align prod ConfigMap naming, default production
image registry to gitea, and install Helm release core-hub rev 1 (smoke passed).
Add apps-pg-backup and check-backup-lane-auth targets; document OIDC login
requirement now that OpenBao is unsealed.
 2026-07-10 21:47:14 +02:00
tegwick
a689270f18 WP-0013/0014: warden credential routing, CoulombCore kubeconfig, apps-pg backup dry-run
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 13s
Details 
Document OpenBao/warden paths for the offsite backup lane and flag the sealed
Vault blocker. Point production Makefile targets at CoulombCore, auto-discover
CNPG clusters in backup status, add apps-pg pg_dump dry-run tooling, and
record Core Hub Helm cutover findings (live gitea image, adopt required).
 2026-07-10 15:46:02 +02:00
tegwick
df7225dd3e RAILIANCE-WP-0012/0013/0014: Core Hub S5 release, CNPG observability, and follow-up workplans
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details 
Deliver the inbox-suggestion implementation from WP-0012: Core Hub Helm chart
and Makefile targets, CNPG backup status tooling, and updated backup handoff
docs. Archive the finished WP-0012 workplan and register ready follow-ups
WP-0013 (CNPG backup wiring + restore drill) and WP-0014 (Core Hub Helm
cutover and vergabe-teilnahme image refresh).
 2026-07-10 15:14:20 +02:00
tegwick
0968f1d5d5 Add reuse-webhook-smoke and rotation runbook links
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
RAILIANCE-WP-0011-T04: smoke checks unsigned 401, signed no-op 200, ESO Ready,
and /v1/federated; point operator docs at platform rotation runbook.
 2026-07-08 00:01:21 +02:00
tegwick
40f0cb741d Deploy reuse-surface runtime secrets via OpenBao External Secrets
All checks were successful
CI Smoke / host-smoke (push) Successful in 3s
Details
CI Smoke / container-smoke (push) Successful in 48s
Details 
Add openbao-reuse ClusterSecretStore handoff, reuse-surface-runtime
ExternalSecret, ESO token bootstrap script, and Makefile targets for
CCR-2026-0005 / RAILIANCE-WP-0011.
 2026-07-07 22:34:34 +02:00
tegwick
3a9236148a Add Forgejo T05 verify, operator bootstrap, and security hardening
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Introduce forgejo-verify acceptance checks, idempotent operator bootstrap,
runner registration SOPS capture helper, and session/security Helm values.
 2026-07-07 22:09:53 +02:00
tegwick
9b31f229e8 Document reuse-surface runtime secrets and Forgejo org webhook
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Add runbook coverage for REUSE_SURFACE_TOKEN and
REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET in reuse-surface-env, plus an
idempotent make reuse-forgejo-webhook target that wires the coulomb org
push webhook to the hub receiver.
 2026-07-07 21:28:46 +02:00
tegwick
d61173d66e Fix Forgejo mailer ESO field mapping and token bootstrap env
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details 
Map OpenBao key PASSWD to Secret MAILER_PASSWD so ExternalSecret syncs
against the live coulombcore path. Allow non-interactive bootstrap via
OPENBAO_TOKEN_FILE for make forgejo-openbao-eso-token-apply.
 2026-07-07 15:21:40 +02:00
tegwick
844a3503bb Add interim coulombcore OpenBao token bootstrap for Forgejo mailer ESO 
Document two OpenBao instances and add forgejo-openbao-eso-token-apply for
ClusterSecretStore openbao-forgejo on bao.coulomb.social.
 2026-07-07 14:35:49 +02:00
tegwick
d5bb4f66f2 Wire Forgejo SMTP password from OpenBao via External Secrets
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details 
Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the
synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.
 2026-07-07 14:30:02 +02:00
tegwick
75698636c6 Deploy Forgejo on railiance01 using gitea-charts/gitea 12.5.0 
Pin chart to 12.5.0 because 12.6+ calls `gitea config edit-ini`, which
Forgejo 11 lacks. Ingress targets forgejo-gitea-http (Helm release naming).
Smoke test uses GET for /v2/ registry challenge (HEAD returns 405).
 2026-07-03 21:28:37 +02:00
tegwick
6abf75365b Harden inter-hub production deploy trigger 2026-06-15 22:44:13 +02:00
tegwick
c7d49d3102 Handle app deployment guardrail suggestions 2026-06-15 22:07:03 +02:00
tegwick
1bd852d177 feat(inter-hub): add Railiance app chart handoff 2026-06-14 16:47:36 +02:00
tegwick
9c2713f9c4 Close S5 app readiness workplan 2026-06-05 17:59:35 +02:00
tegwick
0ae9bca830 Decommission forge compatibility pointers 2026-06-05 17:33:52 +02:00
tegwick
934770cb68 Implement app deployment improvements 2026-05-22 22:25:40 +02:00