railiance-apps/docs/vergabe-demo-company-binding.md

Vergabe demo-company deployment binding

Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04. This is an execution packet; native tenant creation and deployment are pending.

Item	Binding / execution status
Tenant	tenant:trial:demo-company; display demo-company; native creation pending
Purpose / data	New demo workspace; synthetic data only; no existing data import
Initial accounts	demo-user1, demo-user2, ordinary members; creation and private credential setup pending
Operator / acceptance	Bernd Worsch via authenticated existing operator path
Cluster	Railiance01, kube-system UID a553c742-0115-43d4-99a4-a5ca56fe0786
Proposed namespace	vergabe-demo-company; create separately from historical installations
Helm release	vergabe-teilnahme within that namespace
Image source	ccb6d1f8c7abd50f2ef654491bb1aa5861e795cb; live CI 29 / publication 31 passed
Image digest	forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005
Chart baseline	0.2.0 at railiance-apps 9491744e5adab4464070c164d7172a7392ae1e15
Resources	One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi
Proposed URL	https://demo-vergabe.coulomb.social; user preference pending
Public edge	DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239
Proposed database / role	Fresh vergabe_demo_company / vergabe_demo_company on databases/apps-pg; platform provisioning/custody pending
Runtime Secret	vergabe-demo-env in the dedicated namespace; platform delivery pending, no secret values in this packet
Media / app state	Separate vergabe-teilnahme-media 5Gi and vergabe-teilnahme-app-state 1Gi PVCs, local-path; native creation pending
Recovery / support	Existing RAPPS-WP-0014-T03 retains off-host recovery point, isolated restore, rollback and operating responsibility evidence

The target database is a proposed new consumer, not permission to reuse or overwrite vergabe_db. Refresh managed-consumer count, placement and migration demand before applying. Tenant creation itself does not depend on this hostname.

Native tenant and identity execution

Use the existing User Engine portal at https://users.92-205-62-239.nip.io. Its /login uses KeyCape and the registered native callback. The authenticated platform form creates tenant:trial:demo-company through Tenant Engine. Record the response and read back the exact tenant before creating memberships. Do not substitute a service actor, fabricate verified claims, or bypass policy on denial. An operator browser has been opened; native login/creation is not yet confirmed.

Create two ordinary memberships through User Engine. Confirm how the identity provisioner assigns login names before provisioning the requested demo names; do not invent deliverable email addresses or send invitations to third parties. The current product uses separately provisioned Django accounts, with no staff or superuser flags. Preserve the mapping to this tenant's isolated deployment. This establishes a platform tenant and a bounded app pilot, not completed SSO.

Hostname and deployment execution

helm/vergabe-demo-company-values.proposed.yaml pins the published image and 60m resources, and consistently uses the proposed host for Django and probes. The chart does not itself create public ingress or DNS. Confirm the preferred hostname, point its DNS to Railiance01 through the DNS owner, configure the HTTPS route and abuse control through the existing edge lane, and verify TLS. On 2026-09-11 the proposed hostname resolved to 80.158.43.29; the legacy vergabe-teilnahme.whywhynot.de resolved to 92.205.130.254. Neither was the intended Railiance01 address. No DNS changes have been made.

Complete platform database/Secret provisioning and the source-backed namespace, network and public edge manifests before deployment. Then migrate the fresh database, deploy, provision the demo app accounts, and perform the two-user workflow plus restart/isolated-restore checks in the existing owner tasks. Only then record the demo environment as available for use.

Validation on 2026-09-11: Helm lint passed. Rendering the proposed values produced the pinned digest, one Recreate replica, 60m CPU request, matching Django/probe hosts, and two distinct retained PVCs. This is local manifest verification; it is not native deployment or tenant-creation evidence.