coulomb/railiance-apps
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-apps/docs/coulomb-social.md
tegwick 2ab6662142
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Note apps-pg DB ready for coulomb-social deploy path 
Role coulomb_social and database coulomb_social_db are live on apps-pg.
2026-08-09 02:18:22 +02:00

2.4 KiB
Raw Blame History

coulomb.social on Railiance

Source repo: coulomb/coulomb-social
Chart: charts/coulomb-social
Values: helm/coulomb-social-values.yaml
Ingress: manifests/coulomb-social-ingress.yaml

Prerequisites

  • Image published: forgejo.coulomb.social/coulomb/coulomb-social:<sha>
  • KeyCape client coulomb-social registered (see source repo scripts/register-keycape-client.sh)
  • K8s Secret coulomb-social-env (see Env secret below)
  • DB: apps-pg role coulomb_social / database coulomb_social_db (Secret coulomb-social-app-credentials in app + databases namespaces)
  • DNS coulomb.social → cluster ingress IP

Env secret

Opaque Secret coulomb-social-env is mounted via envFrom on the Deployment. Never commit values. Create/patch with:

# plan only (key names, no values)
make coulomb-social-env-secret-dry-run

# apply: SECRET_KEY (generate or keep), DATABASE_URL (if DB secret exists),
# USER_ENGINE_PROXY_SECRET (copied from user-engine/user-engine-runtime)
make coulomb-social-env-secret

# options via COULOMB_SOCIAL_ENV_SECRET_ARGS:
make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--rotate-secret-key'
make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--skip-db'

Script: tools/create-coulomb-social-env-secret.sh
Source-repo wrapper: coulomb-social/scripts/create-env-secret.sh

Key Source
SECRET_KEY generated (or kept if present; --rotate-secret-key forces new)
DATABASE_URL URL-encoded password from coulomb-social-app-credentials
USER_ENGINE_PROXY_SECRET user-engine/user-engine-runtime key proxy-secret

Non-secret OIDC/issuer settings live in helm/coulomb-social-values.yaml, not this Secret.

After updating an existing deploy:

kubectl -n coulomb-social rollout restart deploy/coulomb-social

Deploy

make coulomb-social-env-secret
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-dry-run
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-deploy
make coulomb-social-ingress-deploy
make coulomb-social-status

Identity

  • OIDC issuer: https://kc.coulomb.social
  • user-engine: https://users.92-205-62-239.nip.io (trusted proxy)
  • flex-auth: leave FLEX_AUTH_BASE_URL unset until app PDP Service is ready (local vocabulary in-app)

Probe host

probes.hostHeader must stay in ALLOWED_HOSTS (see docs/django-on-railiance.md).