# coulomb.social on Railiance

Source repo: `coulomb/coulomb-social`  
Chart: `charts/coulomb-social`  
Values: `helm/coulomb-social-values.yaml`  
Ingress: `manifests/coulomb-social-ingress.yaml`

## Prerequisites

- Image published: `forgejo.coulomb.social/coulomb/coulomb-social:<sha>`
- KeyCape client `coulomb-social` registered (see source repo `scripts/register-keycape-client.sh`)
- K8s Secret `coulomb-social-env` (see **Env secret** below)
- Optional: DB role Secret `coulomb-social-app-credentials` in the app namespace
  (cnpg mirror; same pattern as vergabe) before DATABASE_URL can be filled
- DNS `coulomb.social` → cluster ingress IP

## Env secret

Opaque Secret `coulomb-social-env` is mounted via `envFrom` on the Deployment.
**Never commit values.** Create/patch with:

```bash
# plan only (key names, no values)
make coulomb-social-env-secret-dry-run

# apply: SECRET_KEY (generate or keep), DATABASE_URL (if DB secret exists),
# USER_ENGINE_PROXY_SECRET (copied from user-engine/user-engine-runtime)
make coulomb-social-env-secret

# options via COULOMB_SOCIAL_ENV_SECRET_ARGS:
make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--rotate-secret-key'
make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--skip-db'
```

Script: `tools/create-coulomb-social-env-secret.sh`  
Source-repo wrapper: `coulomb-social/scripts/create-env-secret.sh`

| Key | Source |
|-----|--------|
| `SECRET_KEY` | generated (or kept if present; `--rotate-secret-key` forces new) |
| `DATABASE_URL` | URL-encoded password from `coulomb-social-app-credentials` |
| `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` key `proxy-secret` |

Non-secret OIDC/issuer settings live in `helm/coulomb-social-values.yaml`, not
this Secret.

After updating an existing deploy:

```bash
kubectl -n coulomb-social rollout restart deploy/coulomb-social
```

## Deploy

```bash
make coulomb-social-env-secret
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-dry-run
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-deploy
make coulomb-social-ingress-deploy
make coulomb-social-status
```

## Identity

- OIDC issuer: `https://kc.coulomb.social`
- user-engine: `https://users.92-205-62-239.nip.io` (trusted proxy)
- flex-auth: leave `FLEX_AUTH_BASE_URL` unset until app PDP Service is ready (local vocabulary in-app)

## Probe host

`probes.hostHeader` must stay in `ALLOWED_HOSTS` (see `docs/django-on-railiance.md`).