Point bao-notice at the rapp-openbao copy of the page.

The Application keeps a pinned revision and no automated sync. The cluster
still serves the previous revision until that Application is synced by hand.

Assistant: grok
Assistant-Session: 01a16923-5dc2-7a33-94e9-834572d7bba0

argocd/platform-addons/bao-notice/default.conf

@@ -1,35 +0,0 @@
-# Static notice for bao.coulomb.social (RPF-WP-0047). Serves one page; proxies nothing.
-server {
-    listen 8080;
-    server_name _;
-    server_tokens off;
-    root /usr/share/nginx/html;
-
-    add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'" always;
-    add_header Strict-Transport-Security "max-age=31536000" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "no-referrer" always;
-    add_header Cache-Control "no-store" always;
-    add_header X-Robots-Tag "noindex, nofollow" always;
-
-    location = / {
-        try_files /index.html =404;
-    }
-    location = /robots.txt {
-        default_type text/plain;
-        return 200 "User-agent: *\nDisallow: /\n";
-    }
-    location = /healthz {
-        access_log off;
-        default_type text/plain;
-        return 200 "ok\n";
-    }
-    # Any other path (e.g. /v1/sys/health, /ui/) is 404 with the same notice, never 200.
-    location / {
-        error_page 404 /index.html;
-        return 404;
-    }
-    location = /index.html {
-        internal;
-    }
-}

argocd/platform-addons/bao-notice/index.html

@@ -1,19 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="robots" content="noindex, nofollow">
-<title>Not publicly available</title>
-<style>
-  body { font-family: system-ui, sans-serif; max-width: 36rem; margin: 15vh auto; padding: 0 1rem; color: #222; background: #fff; line-height: 1.5; }
-  @media (prefers-color-scheme: dark) { body { color: #ddd; background: #111; } }
-  h1 { font-size: 1.4rem; }
-</style>
-</head>
-<body>
-<h1>Not publicly available</h1>
-<p>This address belongs to an internal service that is not offered publicly.</p>
-<p>There is nothing to sign in to here. If you were sent to this address, please contact the person who gave it to you.</p>
-</body>
-</html>

argocd/platform-addons/bao-notice/kustomization.yaml

@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-# RPF-WP-0047. Read only by argocd/railiance01/applications/bao-notice.application.yaml.
-
-resources:
-  - manifests.yaml
-
-generatorOptions:
-  disableNameSuffixHash: false
-
-configMapGenerator:
-  - name: bao-notice-conf
-    namespace: bao-notice
-    files: [default.conf]
-  - name: bao-notice-html
-    namespace: bao-notice
-    files: [index.html]

argocd/platform-addons/bao-notice/manifests.yaml

@@ -1,177 +0,0 @@
-# RPF-WP-0047: static "not publicly available" notice for bao.coulomb.social.
-# OpenBao stays non-public (RMASTER-WP-0020-T09). This namespace has no route
-# to OpenBao: ingress only from Traefik, no egress at all.
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: bao-notice
-  labels:
-    app.kubernetes.io/part-of: railiance-platform
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: bao-notice-isolation
-  namespace: bao-notice
-spec:
-  podSelector: {}
-  policyTypes: [Ingress, Egress]
-  ingress:
-  - from:
-    - namespaceSelector:
-        matchLabels:
-          kubernetes.io/metadata.name: kube-system
-      podSelector:
-        matchLabels:
-          app.kubernetes.io/name: traefik
-    ports:
-    - {protocol: TCP, port: 8080}
-  egress: []
----
-# cert-manager HTTP-01 solver pods run in this namespace on 8089 during
-# issuance and renewal; Traefik must reach them or the challenge gets 502.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: bao-notice-acme-solver
-  namespace: bao-notice
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes: [Ingress]
-  ingress:
-  - from:
-    - namespaceSelector:
-        matchLabels:
-          kubernetes.io/metadata.name: kube-system
-      podSelector:
-        matchLabels:
-          app.kubernetes.io/name: traefik
-    ports:
-    - {protocol: TCP, port: 8089}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bao-notice
-  namespace: bao-notice
-  labels:
-    app.kubernetes.io/name: bao-notice
-spec:
-  replicas: 1
-  revisionHistoryLimit: 2
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: bao-notice
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: bao-notice
-    spec:
-      automountServiceAccountToken: false
-      enableServiceLinks: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 101
-        runAsGroup: 101
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-      - name: nginx
-        image: nginxinc/nginx-unprivileged@sha256:65e3e85dbaed8ba248841d9d58a899b6197106c23cb0ff1a132b7bfe0547e4c0
-        ports:
-        - {name: http, containerPort: 8080}
-        securityContext:
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          capabilities:
-            drop: [ALL]
-        resources:
-          requests: {cpu: 5m, memory: 16Mi}
-          limits: {cpu: 100m, memory: 64Mi}
-        readinessProbe:
-          httpGet: {path: /healthz, port: http}
-          periodSeconds: 20
-        livenessProbe:
-          httpGet: {path: /healthz, port: http}
-          periodSeconds: 60
-        volumeMounts:
-        - {name: conf, mountPath: /etc/nginx/conf.d, readOnly: true}
-        - {name: html, mountPath: /usr/share/nginx/html, readOnly: true}
-        - {name: tmp, mountPath: /tmp}
-      volumes:
-      - name: conf
-        configMap:
-          name: bao-notice-conf
-          items: [{key: default.conf, path: default.conf}]
-      - name: html
-        configMap:
-          name: bao-notice-html
-          items: [{key: index.html, path: index.html}]
-      - name: tmp
-        emptyDir: {sizeLimit: 16Mi}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: bao-notice
-  namespace: bao-notice
-spec:
-  selector:
-    app.kubernetes.io/name: bao-notice
-  ports:
-  - {name: http, port: 80, targetPort: http}
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: redirect-https
-  namespace: bao-notice
-spec:
-  redirectScheme:
-    scheme: https
-    permanent: true
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: bao-notice
-  namespace: bao-notice
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  ingressClassName: traefik
-  tls:
-  - hosts: [bao.coulomb.social]
-    secretName: bao-notice-tls
-  rules:
-  - host: bao.coulomb.social
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service: {name: bao-notice, port: {number: 80}}
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: bao-notice-http-redirect
-  namespace: bao-notice
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: web
-    traefik.ingress.kubernetes.io/router.middlewares: bao-notice-redirect-https@kubernetescrd
-    traefik.ingress.kubernetes.io/router.priority: "1"
-spec:
-  ingressClassName: traefik
-  rules:
-  - host: bao.coulomb.social
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service: {name: bao-notice, port: {number: 80}}

argocd/railiance01/applications/bao-notice.application.yaml

@@ -1,6 +1,8 @@
 # railiance01 child Application (RPF-WP-0047, founder request 2026-09-23 via
 # user-engine 7d8982c2). Static notice only; OpenBao stays non-public.
 # No automated sync, no finalizer; targetRevision is the reviewed commit.
+# Manifests moved to rapp-openbao on 2026-10-23. This Application stays the
+# GitOps attachment. Sync it by hand after that commit is on the remote.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -14,9 +16,9 @@ metadata:
 spec:
   project: railiance-tenants
   source:
-    repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git
+    repoURL: https://forgejo.coulomb.social/coulomb/rapp-openbao.git
-    targetRevision: 9ee20967ca7b50a8926c99ae86fa027f8bfb0fa3
+    targetRevision: a1f5851e8ad16df5689ef8c91273d77590863089
-    path: argocd/platform-addons/bao-notice
+    path: manifests/bao-notice
   destination:
     server: https://kubernetes.default.svc
     namespace: bao-notice

workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md

@@ -8,7 +8,7 @@ status: finished
 owner: railiance-platform
 topic_slug: railiance
 created: "2026-09-24"
-updated: "2026-09-24"
+updated: "2026-10-23"
 related: [RPF-WP-0025, RMASTER-WP-0020]
 state_hub_workstream_id: "6ab44339-66d3-522b-9d34-fc9ff6f20d1b"
 ---
@@ -34,7 +34,11 @@ priority: high
 state_hub_task_id: "caa019c6-dfdb-5f17-b860-67e1feaebd51"
 ```
 
-`argocd/platform-addons/bao-notice/` holds:
+Moved on 2026-10-23 to `rapp-openbao` at `manifests/bao-notice/` (commit
+`a1f5851`). This Application still attaches the page. It has not been synced,
+so the cluster keeps rendering the copy from `9ee20967` until a hand sync.
+
+`argocd/platform-addons/bao-notice/` held, until that move:
 
 - A namespace `bao-notice` with a NetworkPolicy: ingress only from Traefik
   (kube-system) on 8080, no egress at all, so there is no path to OpenBao.