railiance-apps/docs/vergabe-demo-company-binding.md

Vergabe demo-company deployment binding

Updated 2026-09-12 under RAPPS-WP-0014 and VERGABE-WP-0019. Application placement is live; native product sign-in and recovery acceptance remain open.

Item	Current binding
Tenant	tenant:trial:demo-company, active/version 1; three native memberships and one linked directory identity
Data	Fresh synthetic demo workspace; no historical import
Portal	https://users.coulomb.social/login
Product	https://vergabe-teilnahme.coulomb.social/demo-company/
DNS / TLS	Both hostnames resolve to 92.205.62.239; certificates Ready
Cluster	Railiance01, kube-system UID a553c742-0115-43d4-99a4-a5ca56fe0786
Namespace / release	vergabe-demo-company / vergabe-teilnahme, revision 2
Source / image	8be281025bf57a7aefd1fe98a7e060f2173df5ef; image 51 / acceptance 52 / smoke 53; sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e
Chart / rollout	0.2.1; one Recreate replica; init migration before serving; Ready 1/1
Resources	60m CPU / 256Mi memory request; 1000m CPU / 1Gi memory limit
Database / role	Fresh vergabe_demo_company / vergabe_demo_company, databases/apps-pg
Runtime custody	vergabe-demo-company/vergabe-demo-env; platform helper receipt in RPF-WP-0039
Media / issue state	Separate Bound local-path PVCs, 5Gi / 1Gi; UID/GID/fsGroup 999
Authentication	NetKingdom company welcome and OIDC deployed; initial readback zero accounts. Actual recipient login/MFA pending
Remaining handoffs	VERGABE-WP-0019-T06 welcome/SSO; RAPPS-WP-0014-T03 recovery; VERGABE-WP-0019-T04 pilot acceptance

Current SSO rollout

2026-09-12 attended rollout executed after explicit operator approval. KeyCape and password setup are Ready on the prepared digests; exact public client registration was CAS-applied (config resourceVersion 60123977) with unrelated config bytes/Secret data preserved. Existing portal and product client both pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks). Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain, and requests remain 60m CPU/256Mi memory. Eleven live product checks pass: company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only login start, native issuer redirect, private company/media protection and invalid callback/confirmation rejection. Initial readback showed zero accounts, identity mappings and staff accounts. Native invited-user sign-in/MFA and confirmation are now requested from the operator; no user credential was used by the agent. Recovery and two-user acceptance remain their existing tasks. Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.

Initial deployment verification

2026-09-12 deployment evidence: the operator added A records for vergabe-teilnahme.coulomb.social and users.coulomb.social. Authoritative IONOS and recursive readback both return 92.205.62.239. Both cert-manager certificates are Ready. The portal now uses https://users.coulomb.social/login; its legacy nip.io address redirects to the canonical hostname. The exact new callback is registered alongside the rollback callback; scopes, public client type and PKCE remain unchanged. Canonical authorization succeeds; unapproved callback and missing PKCE fail. This supersedes earlier DNS and portal-hostname blockers.

Helm release vergabe-teilnahme revision 1 is deployed in vergabe-demo-company, chart 0.2.1, pinned product digest cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68. Deployment UID 2152014d-a020-4c5e-a3b0-9575e9f21c44 is Ready 1/1. Its init migration completed before the web process; both phases share the same 60m CPU / 256Mi memory request. Node requests now total 3965m of 4000m; the 35m remainder matches the accepted prototype allocation. No unrelated resource requests changed.

RPF-WP-0039 delivered fresh vergabe_demo_company database/role on apps-pg and runtime Secret vergabe-demo-company/vergabe-demo-env. The app's own connection confirms that exact database/role. The role is non-superuser, cannot create roles or databases, has a 20-connection ceiling and 15-second timeouts, and cannot CONNECT to historical vergabe_db, coulomb_social_db or apps_meta. Both dedicated PVCs are Bound: 5Gi media and 1Gi issue state. Historical data was not selected or overwritten; no credentials are recorded here.

Thirteen live Chromium/HTTP checks pass: page and assets, secure tenant-scoped CSRF cookie, anonymous login gate and media refusal, private operational path refusal, neighboring/root path refusal, canonical slash, HTTPS redirect and missing-CSRF POST denial. Migration/app initialization also proves consumer connectivity. The empty product has zero accounts, including zero staff accounts. The current login is still the interim Django login, not NetKingdom SSO. Native recipient login, company welcome and account mapping remain VERGABE-WP-0019-T06. RAPPS-WP-0014-T03 retains restart and coherent off-host backup/isolated restore; the latest existing apps-pg base backup predates this new database. No pilot-user acceptance, shared tenancy, MFA completion or natural factory-worker trace is claimed.

Source and rollback

helm/vergabe-demo-company-foundation.yaml owns namespace/network policies and certificate. helm/vergabe-demo-company-ingress.yaml owns the exact host and company-prefix route, canonical slash, prefix stripping, headers and rate limit (60 requests/minute/IP, burst 20). Private media stays behind Django. The existing proposed-values filename now records the admitted binding.

railiance-platform/tools/provision-vergabe-demo.py owns the fixed fresh credential/database lane. It captures all child output and passes values only on stdin; the durable credential copies are the two exact Kubernetes Secrets. OpenBao automation remains a later owner improvement. Never rerun historical bootstrap helpers or substitute apps_admin credentials.

This is the first release in the fresh namespace; there is no previously accepted application image to roll back to. On a failed next upgrade, stop public traffic and reconcile schema/image compatibility before reverting. Retain the claims and database; namespace deletion is not rollback. Pod replacement and isolated restore must still be proven with matched PostgreSQL/media/SQLite data.