coulomb/railiance-apps
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-apps/docs/coulomb-social.md
tegwick 8eca75735d
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Point coulomb-social Helm and ingress at app.coulomb.social 
Public parallel host; leave apex coulomb.social for Bubble until cutover.
2026-08-09 23:20:31 +02:00

2.4 KiB
Raw Blame History

coulomb.social on Railiance

Source repo: coulomb/coulomb-social
Chart: charts/coulomb-social
Values: helm/coulomb-social-values.yaml
Ingress: manifests/coulomb-social-ingress.yaml

Host strategy (2026-08-09)

Host Serves
app.coulomb.social New Railiance stack (this chart)
coulomb.social Bubble.io until content + self-registration are ready

Do not point apex DNS at the cluster until apex cutover is explicitly decided.

Prerequisites

  • Image published: forgejo.coulomb.social/coulomb/coulomb-social:<sha>
  • KeyCape client coulomb-social registered (includes https://app.coulomb.social/auth/callback/)
  • K8s Secret coulomb-social-env (see Env secret below)
  • DB: apps-pg role coulomb_social / database coulomb_social_db
  • DNS app.coulomb.social A → 92.205.62.239 (DNS-only / grey cloud for HTTP-01)

Env secret

Opaque Secret coulomb-social-env is mounted via envFrom on the Deployment. Never commit values. Create/patch with:

make coulomb-social-env-secret-dry-run
make coulomb-social-env-secret

Script: tools/create-coulomb-social-env-secret.sh
Source-repo wrapper: coulomb-social/scripts/create-env-secret.sh

Key Source
SECRET_KEY generated (or kept if present; --rotate-secret-key forces new)
DATABASE_URL URL-encoded password from coulomb-social-app-credentials
USER_ENGINE_PROXY_SECRET user-engine/user-engine-runtime key proxy-secret

Non-secret OIDC/issuer settings live in helm/coulomb-social-values.yaml, not this Secret. Live app host env:

  • ALLOWED_HOSTS=app.coulomb.social,localhost
  • OIDC_REDIRECT_URI=https://app.coulomb.social/auth/callback/

After updating an existing deploy:

kubectl -n coulomb-social rollout restart deploy/coulomb-social

Deploy

make coulomb-social-env-secret
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-dry-run
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-deploy
make coulomb-social-ingress-deploy
make coulomb-social-status

Identity

  • OIDC issuer: https://kc.coulomb.social
  • user-engine: https://users.92-205-62-239.nip.io (trusted proxy)
  • flex-auth: leave FLEX_AUTH_BASE_URL unset until app PDP Service is ready (local vocabulary in-app)

Probe host

probes.hostHeader must stay in ALLOWED_HOSTS (currently app.coulomb.social).