tegwick
e8a7ff2547
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
36 lines
2.4 KiB
Markdown
36 lines
2.4 KiB
Markdown
# Demo-company deployment receipt
|
|
|
|
2026-09-12 deployment evidence: the operator added A records for
|
|
vergabe-teilnahme.coulomb.social and users.coulomb.social. Authoritative IONOS
|
|
and recursive readback both return 92.205.62.239. Both cert-manager certificates
|
|
are Ready. The portal now uses https://users.coulomb.social/login; its legacy
|
|
nip.io address redirects to the canonical hostname. The exact new callback is
|
|
registered alongside the rollback callback; scopes, public client type and PKCE
|
|
remain unchanged. Canonical authorization succeeds; unapproved callback and
|
|
missing PKCE fail. This supersedes earlier DNS and portal-hostname blockers.
|
|
|
|
Helm release vergabe-teilnahme revision 1 is deployed in vergabe-demo-company,
|
|
chart 0.2.1, pinned product digest cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68.
|
|
Deployment UID 2152014d-a020-4c5e-a3b0-9575e9f21c44 is Ready 1/1. Its init
|
|
migration completed before the web process; both phases share the same 60m CPU /
|
|
256Mi memory request. Node requests now total 3965m of 4000m; the 35m remainder
|
|
matches the accepted prototype allocation. No unrelated resource requests changed.
|
|
|
|
RPF-WP-0039 delivered fresh vergabe_demo_company database/role on apps-pg and
|
|
runtime Secret vergabe-demo-company/vergabe-demo-env. The app's own connection
|
|
confirms that exact database/role. The role is non-superuser, cannot create roles
|
|
or databases, has a 20-connection ceiling and 15-second timeouts, and cannot
|
|
CONNECT to historical vergabe_db, coulomb_social_db or apps_meta. Both dedicated
|
|
PVCs are Bound: 5Gi media and 1Gi issue state. Historical data was not selected
|
|
or overwritten; no credentials are recorded here.
|
|
|
|
Thirteen live Chromium/HTTP checks pass: page and assets, secure tenant-scoped
|
|
CSRF cookie, anonymous login gate and media refusal, private operational path
|
|
refusal, neighboring/root path refusal, canonical slash, HTTPS redirect and
|
|
missing-CSRF POST denial. Migration/app initialization also proves consumer
|
|
connectivity. The empty product has zero accounts, including zero staff accounts.
|
|
The current login is still the interim Django login, not NetKingdom SSO. Native
|
|
recipient login, company welcome and account mapping remain VERGABE-WP-0019-T06.
|
|
RAPPS-WP-0014-T03 retains restart and coherent off-host backup/isolated restore;
|
|
the latest existing apps-pg base backup predates this new database. No pilot-user
|
|
acceptance, shared tenancy, MFA completion or natural factory-worker trace is claimed.
|