---
id: RAILIANCE-WP-0007
type: workplan
title: "Deploy reuse-surface federation service on railiance01"
domain: railiance
repo: railiance-apps
status: active
owner: codex
topic_slug: railiance
created: "2026-06-15"
updated: "2026-06-15"
---

# Deploy reuse-surface federation service on railiance01

Companion to **`reuse-surface` REUSE-WP-0011**. Own the S5 Helm release,
ingress, and operator targets for the federation service on production cluster
node `railiance01` (`92.205.130.254`).

## Goal

Expose the helix_forge federation API at **`https://reuse.coulomb.social`** so
repos can register capability index URLs via `reuse-surface hub` without
per-machine `sources.yaml` maintenance.

Gitea repo: `coulomb/reuse-surface`  
OCI image: `gitea.coulomb.social/coulomb/reuse-surface:<tag>`

## DNS evidence

`reuse.coulomb.social` A → **`92.205.62.239`** (operator confirmed 2026-06-15).
Ingress host configured in `charts/reuse-surface/values.yaml`.

## Upstream dependency

| Upstream | Workplan | Required artifact |
|---|---|---|
| Service + image | `reuse-surface` REUSE-WP-0011 | Image `gitea.coulomb.social/coulomb/reuse-surface:<tag>`, `reuse-surface serve`, `/health` |

Do not deploy until REUSE-WP-0011-T04 publishes a buildable image.

## Placement

Follow the `inter-hub` pattern:

- `charts/reuse-surface/` — Helm chart (Deployment, Service, Ingress, PVC)
- `helm/reuse-surface-values.yaml` — non-secret overrides (image tag)
- Secret `reuse-surface-env` with `REUSE_SURFACE_TOKEN`
- `Makefile` targets: `reuse-dry-run`, `reuse-deploy`, `reuse-status`, `reuse-logs`
- Namespace: `reuse`

## Safety contract

- Do not commit decrypted SOPS values or `REUSE_SURFACE_TOKEN`.
- Pin image tags in `helm/reuse-surface-values.yaml`.
- PVC at `/data` for SQLite (`reuse.db`) and fetch cache.

---

## Scaffold Helm Chart For reuse-surface

```task
id: RAILIANCE-WP-0007-T01
status: done
priority: high
state_hub_task_id: "d296f037-eef6-4bfc-9e00-65d2aefa9338"
```

Create `charts/reuse-surface/` with Deployment (`reuse-surface serve`), Service,
PVC, Ingress, probes on `/health`.

## Add Values, Secret Template, And Makefile Targets

```task
id: RAILIANCE-WP-0007-T02
status: done
priority: high
state_hub_task_id: "5050e2fb-07c0-4a06-a64b-f152f8bdb35d"
```

Add `helm/reuse-surface-values.yaml`, document Secret `reuse-surface-env`, and
Makefile `reuse-*` targets.

## Configure Ingress For reuse.coulomb.social

```task
id: RAILIANCE-WP-0007-T03
status: done
priority: medium
state_hub_task_id: "80dc308a-3c0f-4027-9b40-67df5f17aca7"
```

Ingress enabled in chart values:

- `ingress.host: reuse.coulomb.social`
- `cert-manager.io/cluster-issuer: letsencrypt-prod`
- Traefik annotations matching `inter-hub`

DNS A record live: `reuse.coulomb.social → 92.205.62.239`.

## Deploy Release To railiance01

```task
id: RAILIANCE-WP-0007-T04
status: wait
priority: medium
state_hub_task_id: "14049fd1-7ec1-4762-9a7c-9783f0997016"
```

When image is available:

1. `make reuse-dry-run`
2. Apply Secret `reuse-surface-env`
3. `make reuse-deploy`
4. Verify `https://reuse.coulomb.social/health`

## Post-Deploy Verification And Runbook

```task
id: RAILIANCE-WP-0007-T05
status: progress
priority: low
state_hub_task_id: "30b08789-38bb-409a-b5b1-b3c73ff31a96"
```

Added `docs/reuse-surface-on-railiance01.md`. Complete after first deploy with
live smoke checks:

```bash
export REUSE_SURFACE_URL=https://reuse.coulomb.social
reuse-surface hub status
```