railiance-apps/docs/vergabe-demo-company-binding.md

Vergabe demo-company deployment binding

Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04. Native tenant creation is verified; application placement and onboarding remain pending.

Item	Binding / execution status
Tenant	tenant:trial:demo-company; display demo-company; active, version 1; native operator create/readback verified
Purpose / data	New demo workspace; synthetic data only; no existing data import
Initial accounts	demo-user1, demo-user2, ordinary members; creation and private credential setup pending
Operator / acceptance	Bernd Worsch via authenticated existing operator path
Cluster	Railiance01, kube-system UID a553c742-0115-43d4-99a4-a5ca56fe0786
Proposed namespace	vergabe-demo-company; create separately from historical installations
Helm release	vergabe-teilnahme within that namespace
Image source	Tenant-path source 9345a1bb1a92ac0ee3b2dc6443a3d299e6754e70; CI smoke 43 / publication 44 passed
Image digest	forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68
Chart baseline	0.2.0 at railiance-apps 9491744e5adab4464070c164d7172a7392ae1e15
Resources	One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi
Selected URL	https://vergabe-teilnahme.coulomb.social/demo-company/; one product host, exact tenant path
Public edge	DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239
Proposed database / role	Fresh vergabe_demo_company / vergabe_demo_company on databases/apps-pg; platform provisioning/custody pending
Runtime Secret	vergabe-demo-env in the dedicated namespace; platform delivery pending, no secret values in this packet
Media / app state	Separate vergabe-teilnahme-media 5Gi and vergabe-teilnahme-app-state 1Gi PVCs, local-path; native creation pending
Recovery / support	Existing RAPPS-WP-0014-T03 retains off-host recovery point, isolated restore, rollback and operating responsibility evidence

The target database is a proposed new consumer, not permission to reuse or overwrite vergabe_db. Refresh managed-consumer count, placement and migration demand before applying. Tenant creation itself does not depend on this hostname.

Native tenant and identity execution

Use the existing User Engine portal at https://users.92-205-62-239.nip.io. Its /login uses KeyCape and the registered native callback. The authenticated platform form creates tenant:trial:demo-company through Tenant Engine. Record the response and read back the exact tenant before creating memberships. Do not substitute a service actor, fabricate verified claims, or bypass policy on denial. Native login and operator creation succeeded at 19:03:18 UTC. Tenant Engine confirms demo-company active/version 1; User Engine contains the first administrator with invited status. A subsequent Create login failed with an LLDAP service-login 401. The operator completed NK-WP-0036-T04's attended credential-reference repair: provider and consumer login now pass, independently verified with a directory read; the provider password and image are unchanged. Retry native Create login for the existing intended user and verify password setup. No directory identity is inferred from the user-domain record.

Create two ordinary memberships through User Engine. Confirm how the identity provisioner assigns login names before provisioning the requested demo names; do not invent deliverable email addresses or send invitations to third parties. The current product uses separately provisioned Django accounts, with no staff or superuser flags. Preserve the mapping to this tenant's isolated deployment. This establishes a platform tenant and a bounded app pilot, not completed SSO.

Hostname and deployment execution

helm/vergabe-demo-company-values.proposed.yaml retains 60m resources and the selected product host, APP_BASE_PATH=/demo-company and published immutable digest. The chart does not create ingress or DNS. The edge must match exactly /demo-company or /demo-company/, canonicalize the bare path and strip the prefix. It must keep private media on the app route and apply TLS and the admitted abuse-control policy. Do not route neighboring paths to this instance. Company/data separation remains the dedicated database and volumes, not a forwarded header or browser path.

On 2026-09-11 the selected product hostname resolves to 80.158.43.29; Railiance01 is 92.205.62.239. No DNS changes have been made. A single product DNS/certificate serves this arrangement; tenants do not need their own subdomains.

Complete platform database/Secret provisioning and the source-backed namespace, network and public edge manifests before deployment. Then migrate the fresh database, deploy, provision the demo app accounts, and perform the two-user workflow plus restart/isolated-restore checks in the existing owner tasks. Only then record the demo environment as available for use.

Validation on 2026-09-11: Helm lint passed. Rendering the proposed values produced the pinned digest, one Recreate replica, 60m CPU request, matching Django/probe hosts, and two distinct retained PVCs. This is local manifest verification; it is not native deployment or tenant-creation evidence.