railiance-apps/docs/informed-decision-origin.md

decisions.coulomb.social — origin for the informed-decision approver surface

Status: applied and live. https://decisions.coulomb.social/ answers 200 over a valid Let's Encrypt certificate as of 2026-09-10 14:32 UTC. Last reviewed: 2026-09-10

Why this host exists before the app does

informed-decision owns the browser-facing approver UI that approval-engine deliberately does not contain. Its workplan task INFD-WP-0001-T07 must publish two strings to key-cape — an OIDC client_id and a full callback URI — and close KEY-WP-0013-T02, which has been blocked on them since 2026-09-08.

Both strings are now fixed except for the host:

Field	Value
client_id	informed-decision-approver
Redirect URI	https://decisions.coulomb.social/auth/callback
Flow	authorization code + S256 PKCE, public client
Scopes	openid, approval:read, approval:approve

Redirect URIs match byte-exactly at /authorize. A registration pointing at a host that does not answer fails closed at first login and presents as a rejected approval rather than as a registration defect — which is exactly the failure approval-engine avoided by refusing to invent these strings. So the origin has to be real before the registration is submitted, and that is S5 work here rather than in informed-decision.

The approver UI itself is INFD-WP-0001-T08, still gated on approval-engine APPROVAL-WP-0002-T01 and on intake INFD-IN-0003 (the evidence copy must reach audit-core independently of this component). This host therefore ships a placeholder first and the real surface later.

What is in the repo

File	Contents
manifests/informed-decision-origin.yaml	Namespace, placeholder nginx ConfigMap/Deployment/Service on informed-decision:80
manifests/informed-decision-ingress.yaml	Traefik Ingress + letsencrypt-prod certificate for decisions.coulomb.social

The placeholder is nginxinc/nginx-unprivileged, read-only root filesystem, non-root, noindex. When the real surface lands it takes over the same Service name and the origin file shrinks to the Namespace.

Deliberate single path rule

The Ingress carries exactly one rule: / Prefix to one backend.

reuse-surface reported on 2026-07-07 that an Ingress declaring an Exact /health rule alongside a catch-all / Prefix rule on the same host had the exact match swallowed by the catch-all — the public health URL returned 404 from the landing container while the pod was 1/1 Ready and its own probes passed. Splitting /auth, /api and / across backends here would reproduce that on a host whose whole purpose is an exact-match redirect URI. If a second backend ever becomes necessary, set traefik.ingress.kubernetes.io/router.priority explicitly rather than relying on rule order.

Preconditions verified 2026-09-10

• DNS decisions.coulomb.social → 92.205.62.239 (same A record as reuse).
• letsencrypt-prod ClusterIssuer Ready=True.
• No existing Ingress claims decisions.coulomb.social.
• Server-side dry-run of all five objects against the live API is clean. The namespaced four were validated against an existing namespace, since a server dry-run cannot create the new one first; see DRY_RUN_CREATE_NAMESPACES in tools/k8s-server-dry-run.sh.

Deployed 2026-09-10

Applied with operator approval. Evidence:

Check	Result
Placeholder pod	1/1 Running, /healthz → ok in-pod
Certificate informed-decision-tls	Ready=True, ACME order valid
Issuer / subject	CN=decisions.coulomb.social, Let's Encrypt YR2
Validity	2026-09-10 → 2026-12-09 (cert-manager renews)
GET https://decisions.coulomb.social/	HTTP/2 200, chain verify 0
GET https://decisions.coulomb.social/auth/callback	200 — the exact redirect URI resolves

/auth/callback currently returns the placeholder page via the SPA try_files fallback. That is the correct behaviour for now: the origin answers, which is what the registration needs. The real surface will handle the path when INFD-WP-0001-T08 ships.

informed-decision is unblocked to submit docs/keycape-client-registration.md to key-cape and close KEY-WP-0013-T02.

Redeploy / recovery

export KUBECONFIG=$HOME/.kube/config-hosteurope
kubectl apply -f manifests/informed-decision-origin.yaml
kubectl apply -f manifests/informed-decision-ingress.yaml
kubectl -n informed-decision get pods,svc,ingress
kubectl -n informed-decision get certificate informed-decision-tls -w
curl -sSI https://decisions.coulomb.social/ | head -1

That curl succeeded on 2026-09-10, which is the gate informed-decision was waiting on.

Note on the kubeconfig: ~/.kube/config-hosteurope names port 16443, but the k3s-api-railiance01 ops-bridge tunnel currently listens on 16444. Override with --server https://127.0.0.1:16444 or fix the kubeconfig; bridge check reports the tunnel healthy either way, so it does not surface the mismatch.

HTTP → HTTPS

The Ingress is websecure-only, following the forgejo and coulomb-social pattern, so port 80 stays free for cert-manager HTTP-01 solvers. Plain http://decisions.coulomb.social/ will not redirect. reuse-surface adds a separate -http-redirect Ingress for this; add one here if a bare-host redirect is wanted. It is not required for the OIDC flow, which is always https.