Gate reef web ports on exposure grants

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

docs/deploy-stack.md

@@ -8,7 +8,8 @@
 
 Before starting, verify you have:
 
-- [ ] SSH access to the target server (COULOMBCORE: 92.205.130.254, user: tegwick, key: `~/.ssh/id_ops`)
+- [ ] SSH access to the selected inventory host. `Railiance01` is the current
+      primary; `CoulombCore` is legacy/frozen and is not a default deployment target.
 - [ ] SOPS age private key available (`~/.config/sops/age/keys.txt` or `SOPS_AGE_KEY` env)
 - [ ] ops-bridge running on the workstation (needed for state hub MCP): `make mcp-http` in `~/the-custodian/state-hub/`
 - [ ] Forgejo accessible (git pull on remote): SSH via `forgejo-remote:coulomb/<repo>.git`
@@ -27,12 +28,11 @@ cd ~/railiance-infra
 make tf-plan        # review Terraform plan
 make tf-apply       # create/update server
 
-# Converge OS baseline
-# NOTE: Ansible runs locally on CoulombCore (workstation has no Ansible installed)
-ssh -i ~/.ssh/id_ops tegwick@92.205.130.254 \
+# Converge OS baseline on the selected inventory host
+ssh -i ~/.ssh/id_ops tegwick@92.205.62.239 \
   'cd ~/railiance-infra && git pull && \
    cd ansible && ansible-playbook playbooks/bootstrap.yaml \
-     -c local --become -l CoulombCore'
+     -c local --become -l Railiance01'
 
 # Verify OS baseline
 make verify
@@ -46,15 +46,15 @@ SOPS/age installed.
 ## S2 — Cluster Runtime (`railiance-cluster`)
 
 ```bash
-# On CoulombCore (SSH in first)
-ssh -i ~/.ssh/id_ops tegwick@92.205.130.254
+# On the selected cluster host (Railiance01 for the current primary)
+ssh -i ~/.ssh/id_ops tegwick@92.205.62.239
 
 cd ~/railiance-cluster
-make converge       # installs k3s, Helm, cert-manager, nginx ingress, cnpg operator
+make converge       # installs k3s, Helm, cert-manager, Traefik, cnpg operator
 make smoke          # runs cluster health assertions
 ```
 
-**Checkpoint:** k3s running, Helm available, cert-manager and nginx-ingress pods Running,
+**Checkpoint:** k3s running, Helm available, cert-manager and Traefik pods Running,
 cnpg-system namespace active.
 
 ---
@@ -62,7 +62,7 @@ cnpg-system namespace active.
 ## S3 — Platform Services (`railiance-platform`)
 
 ```bash
-# On CoulombCore (kubectl available after S2)
+# On the current primary (kubectl available after S2)
 cd ~/railiance-platform && git pull
 
 # Deploy Forgejo database cluster (production on railiance01)
@@ -73,39 +73,36 @@ make forgejo-db-status
 # Legacy coulombcore Gitea DB (read-only fallback — retain until T12 retires Gitea)
 # make db-deploy && make db-status
 
-# Deploy Valkey cache if required by workloads
-# Requires: helm/valkey-values.sops.yaml with encrypted password
-make valkey-deploy
-make valkey-status
+# Deploy an optional cache only when a named workload requirement and custody
+# path exist. Cache installation is not an unconditional S3 baseline step.
 ```
 
-**Checkpoint:** `kubectl get cluster -n databases` shows `forgejo-db` healthy on
-railiance01; Valkey pod Running if deployed.
+**Checkpoint:** `kubectl get cluster -n databases` shows `forgejo-db` healthy
+on Railiance01; optional services are present only when explicitly required.
 
 ---
 
 ## S4 — Developer Enablement (`railiance-enablement`)
 
-No formal workplan yet. ArgoCD is currently deployed at cluster level (S2 boundary
-violation, tracked in RAIL-HO-WP-0004). No S4-specific steps required at this time.
+Validate the consumer-facing paved paths; S4 does not deploy the forge runtime:
+
+```bash
+cd ~/railiance-enablement && git pull
+make check
+make test
+```
 
 ---
 
 ## S5 — Workloads & Experience (`railiance-apps`)
 
 ```bash
-# On CoulombCore
-cd ~/railiance-apps && git pull
+# Verify the forge through its operational owner.
+cd ~/railiance-forge && git pull
+make gitea-status
 
-# Deploy Forgejo (production source forge on railiance01)
-# See railiance-apps/docs/forgejo-on-railiance01.md
-make forgejo-deploy
-make forgejo-verify
-
-# Legacy Gitea on coulombcore — read-only fallback; do not use for new repos
-# make gitea-deploy && make gitea-status
-
-# Deploy state-hub, activity-core, and other workloads per railiance-apps Makefile
+# Deploy each application through its owning rapp/release runbook. S5 does not
+# own the forge runtime or generic rail/template behavior.
 ```
 
 **Checkpoint:** `https://forgejo.coulomb.social` serves HTTPS; git clone/push via
@@ -124,7 +121,7 @@ bridge up k3s-api-coulombcore         # CoulombCore k3s API (port 16443 local)
 bridge up k3s-api-railiance01         # Railiance01 k3s API (port 16444 local)
 ```
 
-Verify: `bridge status` shows all three connected.
+Verify: `bridge status` shows the tunnels needed for the selected host connected.
 
 ---