# Origin holder for decisions.coulomb.social.
#
# `informed-decision` (INFD-WP-0001-T07) must publish an exact OIDC redirect URI
# to key-cape: https://decisions.coulomb.social/auth/callback. Redirect URIs match
# byte-exactly at /authorize, so the origin has to be real before the registration
# is submitted — a host that resolves but does not answer over TLS fails the same
# way a wrong hostname does, only later and less legibly.
#
# The approver UI itself does not exist yet (INFD-WP-0001-T08, the walking
# skeleton, is still gated on approval-engine and on intake INFD-IN-0003). This
# placeholder exists solely so the host answers and cert-manager can issue.
# When the real surface lands it replaces this Deployment/Service behind the same
# Service name, and this file shrinks to the Namespace.
apiVersion: v1
kind: Namespace
metadata:
name: informed-decision
labels:
app.kubernetes.io/part-of: informed-decision
---
apiVersion: v1
kind: ConfigMap
metadata:
name: informed-decision-placeholder
namespace: informed-decision
labels:
app.kubernetes.io/name: informed-decision
app.kubernetes.io/component: placeholder
data:
index.html: |
Decisions — Railiance
Railiance
Decisions
This host is reserved for the informed-decision
approver surface. The service is not deployed yet.
The origin is live so that its OIDC redirect URI can be registered
against a host that actually answers.
# nginx serves the page on 8080 so the container needs no root.
default.conf: |
server {
listen 8080;
server_name _;
root /usr/share/nginx/html;
index index.html;
location = /healthz {
access_log off;
add_header Content-Type text/plain;
return 200 'ok';
}
location / {
try_files $uri $uri/ /index.html;
}
}
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: informed-decision
namespace: informed-decision
labels:
app.kubernetes.io/name: informed-decision
app.kubernetes.io/component: placeholder
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: informed-decision
template:
metadata:
labels:
app.kubernetes.io/name: informed-decision
app.kubernetes.io/component: placeholder
spec:
securityContext:
runAsNonRoot: true
runAsUser: 101
runAsGroup: 101
seccompProfile:
type: RuntimeDefault
containers:
- name: nginx
image: nginxinc/nginx-unprivileged:1.27-alpine
ports:
- name: http
containerPort: 8080
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
readinessProbe:
httpGet: { path: /healthz, port: http }
initialDelaySeconds: 2
periodSeconds: 10
livenessProbe:
httpGet: { path: /healthz, port: http }
initialDelaySeconds: 10
periodSeconds: 30
resources:
requests: { cpu: 10m, memory: 24Mi }
limits: { memory: 64Mi }
volumeMounts:
- name: content
mountPath: /usr/share/nginx/html/index.html
subPath: index.html
readOnly: true
- name: content
mountPath: /etc/nginx/conf.d/default.conf
subPath: default.conf
readOnly: true
- name: cache
mountPath: /var/cache/nginx
- name: run
mountPath: /tmp
volumes:
- name: content
configMap:
name: informed-decision-placeholder
- name: cache
emptyDir: {}
- name: run
emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
name: informed-decision
namespace: informed-decision
labels:
app.kubernetes.io/name: informed-decision
spec:
type: ClusterIP
selector:
app.kubernetes.io/name: informed-decision
ports:
- name: http
port: 80
targetPort: http