tegwick
effd0a3170
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
77 lines
5.3 KiB
Markdown
77 lines
5.3 KiB
Markdown
# Vergabe demo-company deployment binding
|
|
|
|
Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04.
|
|
Native tenant creation is verified; application placement and onboarding remain pending.
|
|
|
|
| Item | Binding / execution status |
|
|
| --- | --- |
|
|
| Tenant | `tenant:trial:demo-company`; display `demo-company`; active, version 1; native operator create/readback verified |
|
|
| Purpose / data | New demo workspace; synthetic data only; no existing data import |
|
|
| Initial accounts | `demo-user1`, `demo-user2`, ordinary members; creation and private credential setup pending |
|
|
| Operator / acceptance | Bernd Worsch via authenticated existing operator path |
|
|
| Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` |
|
|
| Proposed namespace | `vergabe-demo-company`; create separately from historical installations |
|
|
| Helm release | `vergabe-teilnahme` within that namespace |
|
|
| Image source | Tenant-path source `9345a1bb1a92ac0ee3b2dc6443a3d299e6754e70`; CI smoke 43 / publication 44 passed |
|
|
| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68` |
|
|
| Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` |
|
|
| Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi |
|
|
| Selected URL | `https://vergabe-teilnahme.coulomb.social/demo-company/`; one product host, exact tenant path |
|
|
| Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 |
|
|
| Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending |
|
|
| Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet |
|
|
| Media / app state | Separate `vergabe-teilnahme-media` 5Gi and `vergabe-teilnahme-app-state` 1Gi PVCs, local-path; native creation pending |
|
|
| Recovery / support | Existing RAPPS-WP-0014-T03 retains off-host recovery point, isolated restore, rollback and operating responsibility evidence |
|
|
|
|
The target database is a proposed new consumer, not permission to reuse or
|
|
overwrite `vergabe_db`. Refresh managed-consumer count, placement and migration
|
|
demand before applying. Tenant creation itself does not depend on this hostname.
|
|
|
|
## Native tenant and identity execution
|
|
|
|
Use the existing User Engine portal at `https://users.92-205-62-239.nip.io`.
|
|
Its `/login` uses KeyCape and the registered native callback. The authenticated
|
|
platform form creates `tenant:trial:demo-company` through Tenant Engine. Record
|
|
the response and read back the exact tenant before creating memberships. Do not
|
|
substitute a service actor, fabricate verified claims, or bypass policy on denial.
|
|
Native login and operator creation succeeded at 19:03:18 UTC. Tenant Engine
|
|
confirms demo-company active/version 1; User Engine contains the first
|
|
administrator with invited status. A subsequent Create login failed with an
|
|
LLDAP service-login 401. The operator completed NK-WP-0036-T04's attended
|
|
credential-reference repair: provider and consumer login now pass, independently
|
|
verified with a directory read; the provider password and image are unchanged.
|
|
Retry native Create login for the existing intended user and verify password
|
|
setup. No directory identity is inferred from the user-domain record.
|
|
|
|
Create two ordinary memberships through User Engine. Confirm how the identity
|
|
provisioner assigns login names before provisioning the requested demo names;
|
|
do not invent deliverable email addresses or send invitations to third parties.
|
|
The current product uses separately provisioned Django accounts, with no staff
|
|
or superuser flags. Preserve the mapping to this tenant's isolated deployment.
|
|
This establishes a platform tenant and a bounded app pilot, not completed SSO.
|
|
|
|
## Hostname and deployment execution
|
|
|
|
`helm/vergabe-demo-company-values.proposed.yaml` retains 60m resources and the
|
|
selected product host, APP_BASE_PATH=/demo-company and published immutable
|
|
digest. The chart does not create ingress or DNS.
|
|
The edge must match exactly /demo-company or /demo-company/, canonicalize the
|
|
bare path and strip the prefix. It must keep private media on the app route and
|
|
apply TLS and the admitted abuse-control policy. Do not route neighboring paths
|
|
to this instance. Company/data separation remains the dedicated database and
|
|
volumes, not a forwarded header or browser path.
|
|
|
|
On 2026-09-11 the selected product hostname resolves to 80.158.43.29; Railiance01
|
|
is 92.205.62.239. No DNS changes have been made. A single product DNS/certificate
|
|
serves this arrangement; tenants do not need their own subdomains.
|
|
|
|
Complete platform database/Secret provisioning and the source-backed namespace,
|
|
network and public edge manifests before deployment. Then migrate the fresh
|
|
database, deploy, provision the demo app accounts, and perform the two-user
|
|
workflow plus restart/isolated-restore checks in the existing owner tasks.
|
|
Only then record the demo environment as available for use.
|
|
|
|
Validation on 2026-09-11: Helm lint passed. Rendering the proposed values
|
|
produced the pinned digest, one Recreate replica, 60m CPU request, matching
|
|
Django/probe hosts, and two distinct retained PVCs. This is local manifest
|
|
verification; it is not native deployment or tenant-creation evidence.
|