tegwick
c79f07aadf
Builds SECRET_KEY, optional URL-encoded DATABASE_URL from app DB credentials, and USER_ENGINE_PROXY_SECRET from user-engine-runtime. Never prints values; Makefile dry-run and apply targets.
71 lines
2.4 KiB
Markdown
71 lines
2.4 KiB
Markdown
# coulomb.social on Railiance
|
|
|
|
Source repo: `coulomb/coulomb-social`
|
|
Chart: `charts/coulomb-social`
|
|
Values: `helm/coulomb-social-values.yaml`
|
|
Ingress: `manifests/coulomb-social-ingress.yaml`
|
|
|
|
## Prerequisites
|
|
|
|
- Image published: `forgejo.coulomb.social/coulomb/coulomb-social:<sha>`
|
|
- KeyCape client `coulomb-social` registered (see source repo `scripts/register-keycape-client.sh`)
|
|
- K8s Secret `coulomb-social-env` (see **Env secret** below)
|
|
- Optional: DB role Secret `coulomb-social-app-credentials` in the app namespace
|
|
(cnpg mirror; same pattern as vergabe) before DATABASE_URL can be filled
|
|
- DNS `coulomb.social` → cluster ingress IP
|
|
|
|
## Env secret
|
|
|
|
Opaque Secret `coulomb-social-env` is mounted via `envFrom` on the Deployment.
|
|
**Never commit values.** Create/patch with:
|
|
|
|
```bash
|
|
# plan only (key names, no values)
|
|
make coulomb-social-env-secret-dry-run
|
|
|
|
# apply: SECRET_KEY (generate or keep), DATABASE_URL (if DB secret exists),
|
|
# USER_ENGINE_PROXY_SECRET (copied from user-engine/user-engine-runtime)
|
|
make coulomb-social-env-secret
|
|
|
|
# options via COULOMB_SOCIAL_ENV_SECRET_ARGS:
|
|
make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--rotate-secret-key'
|
|
make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--skip-db'
|
|
```
|
|
|
|
Script: `tools/create-coulomb-social-env-secret.sh`
|
|
Source-repo wrapper: `coulomb-social/scripts/create-env-secret.sh`
|
|
|
|
| Key | Source |
|
|
|-----|--------|
|
|
| `SECRET_KEY` | generated (or kept if present; `--rotate-secret-key` forces new) |
|
|
| `DATABASE_URL` | URL-encoded password from `coulomb-social-app-credentials` |
|
|
| `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` key `proxy-secret` |
|
|
|
|
Non-secret OIDC/issuer settings live in `helm/coulomb-social-values.yaml`, not
|
|
this Secret.
|
|
|
|
After updating an existing deploy:
|
|
|
|
```bash
|
|
kubectl -n coulomb-social rollout restart deploy/coulomb-social
|
|
```
|
|
|
|
## Deploy
|
|
|
|
```bash
|
|
make coulomb-social-env-secret
|
|
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-dry-run
|
|
COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-deploy
|
|
make coulomb-social-ingress-deploy
|
|
make coulomb-social-status
|
|
```
|
|
|
|
## Identity
|
|
|
|
- OIDC issuer: `https://kc.coulomb.social`
|
|
- user-engine: `https://users.92-205-62-239.nip.io` (trusted proxy)
|
|
- flex-auth: leave `FLEX_AUTH_BASE_URL` unset until app PDP Service is ready (local vocabulary in-app)
|
|
|
|
## Probe host
|
|
|
|
`probes.hostHeader` must stay in `ALLOWED_HOSTS` (see `docs/django-on-railiance.md`).
|