74 lines
2.4 KiB
Markdown
74 lines
2.4 KiB
Markdown
# coulomb.social on Railiance
|
|
|
|
Source repo: `coulomb/coulomb-social`
|
|
Chart: `charts/coulomb-social`
|
|
Values: `helm/coulomb-social-values.yaml`
|
|
Ingress: `manifests/coulomb-social-ingress.yaml`
|
|
|
|
## Host strategy (2026-08-09)
|
|
|
|
| Host | Serves |
|
|
|------|--------|
|
|
| **`app.coulomb.social`** | New Railiance stack (this chart) |
|
|
| **`coulomb.social`** | Bubble.io until content + self-registration are ready |
|
|
|
|
Do **not** point apex DNS at the cluster until apex cutover is explicitly decided.
|
|
|
|
## Prerequisites
|
|
|
|
- Image published: `forgejo.coulomb.social/coulomb/coulomb-social:<sha>`
|
|
- KeyCape client `coulomb-social` registered (includes `https://app.coulomb.social/auth/callback/`)
|
|
- K8s Secret `coulomb-social-env` (see **Env secret** below)
|
|
- DB: `apps-pg` role `coulomb_social` / database `coulomb_social_db`
|
|
- DNS **`app.coulomb.social` A → `92.205.62.239`** (DNS-only / grey cloud for HTTP-01)
|
|
|
|
## Env secret
|
|
|
|
Opaque Secret `coulomb-social-env` is mounted via `envFrom` on the Deployment.
|
|
**Never commit values.** Create/patch with:
|
|
|
|
```bash
|
|
make coulomb-social-env-secret-dry-run
|
|
make coulomb-social-env-secret
|
|
```
|
|
|
|
Script: `tools/create-coulomb-social-env-secret.sh`
|
|
Source-repo wrapper: `coulomb-social/scripts/create-env-secret.sh`
|
|
|
|
| Key | Source |
|
|
|-----|--------|
|
|
| `SECRET_KEY` | generated (or kept if present; `--rotate-secret-key` forces new) |
|
|
| `DATABASE_URL` | URL-encoded password from `coulomb-social-app-credentials` |
|
|
| `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` key `proxy-secret` |
|
|
|
|
Non-secret OIDC/issuer settings live in `helm/coulomb-social-values.yaml`, not
|
|
this Secret. Live app host env:
|
|
|
|
- `ALLOWED_HOSTS=app.coulomb.social,localhost`
|
|
- `OIDC_REDIRECT_URI=https://app.coulomb.social/auth/callback/`
|
|
|
|
After updating an existing deploy:
|
|
|
|
```bash
|
|
kubectl -n coulomb-social rollout restart deploy/coulomb-social
|
|
```
|
|
|
|
## Deploy
|
|
|
|
```bash
|
|
make coulomb-social-env-secret
|
|
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-dry-run
|
|
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-deploy
|
|
make coulomb-social-ingress-deploy
|
|
make coulomb-social-status
|
|
```
|
|
|
|
## Identity
|
|
|
|
- OIDC issuer: `https://kc.coulomb.social`
|
|
- user-engine: `https://users.92-205-62-239.nip.io` (trusted proxy)
|
|
- flex-auth: leave `FLEX_AUTH_BASE_URL` unset until app PDP Service is ready (local vocabulary in-app)
|
|
|
|
## Probe host
|
|
|
|
`probes.hostHeader` must stay in `ALLOWED_HOSTS` (currently `app.coulomb.social`).
|