# coulomb.social on Railiance

Source repo: `coulomb/coulomb-social`  
Chart: `charts/coulomb-social`  
Values: `helm/coulomb-social-values.yaml`  
Ingress: `manifests/coulomb-social-ingress.yaml`

## Host strategy (2026-08-09)

| Host | Serves |
|------|--------|
| **`app.coulomb.social`** | New Railiance stack (this chart) |
| **`coulomb.social`** | Bubble.io until content + self-registration are ready |

Do **not** point apex DNS at the cluster until apex cutover is explicitly decided.

## Prerequisites

- Image published: `forgejo.coulomb.social/coulomb/coulomb-social:<sha>`
- KeyCape client `coulomb-social` registered (includes `https://app.coulomb.social/auth/callback/`)
- K8s Secret `coulomb-social-env` (see **Env secret** below)
- DB: `apps-pg` role `coulomb_social` / database `coulomb_social_db`
- DNS **`app.coulomb.social` A → `92.205.62.239`** (DNS-only / grey cloud for HTTP-01)

## Env secret

Opaque Secret `coulomb-social-env` is mounted via `envFrom` on the Deployment.
**Never commit values.** Create/patch with:

```bash
make coulomb-social-env-secret-dry-run
make coulomb-social-env-secret
```

Script: `tools/create-coulomb-social-env-secret.sh`  
Source-repo wrapper: `coulomb-social/scripts/create-env-secret.sh`

| Key | Source |
|-----|--------|
| `SECRET_KEY` | generated (or kept if present; `--rotate-secret-key` forces new) |
| `DATABASE_URL` | URL-encoded password from `coulomb-social-app-credentials` |
| `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` key `proxy-secret` |

Non-secret OIDC/issuer settings live in `helm/coulomb-social-values.yaml`, not
this Secret. Live app host env:

- `ALLOWED_HOSTS=app.coulomb.social,localhost`
- `OIDC_REDIRECT_URI=https://app.coulomb.social/auth/callback/`

After updating an existing deploy:

```bash
kubectl -n coulomb-social rollout restart deploy/coulomb-social
```

## Deploy

```bash
make coulomb-social-env-secret
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-dry-run
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-deploy
make coulomb-social-ingress-deploy
make coulomb-social-status
```

## Identity

- OIDC issuer: `https://kc.coulomb.social`
- user-engine: `https://users.92-205-62-239.nip.io` (trusted proxy)
- flex-auth: leave `FLEX_AUTH_BASE_URL` unset until app PDP Service is ready (local vocabulary in-app)

## Probe host

`probes.hostHeader` must stay in `ALLOWED_HOSTS` (currently `app.coulomb.social`).