railiance-platform/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
RPF-WP-0047	workplan	bao.coulomb.social: static not-publicly-available page with a trusted certificate	financials	railiance-platform	active	railiance-platform	railiance	2026-09-24	2026-09-24	RPF-WP-0025 RMASTER-WP-0020	6ab44339-66d3-522b-9d34-fc9ff6f20d1b

Why

The founder decided on 2026-09-23 (relayed by user-engine, hub message 7d8982c2) that OpenBao stays non-public. The RMASTER-WP-0020-T09 / RPF-WP-0025-T03 retraction stands. But the published name must not present a self-signed Traefik certificate and a bare 404. Requested end state: a static page saying the resource is not publicly available, over a trusted certificate. It names no internal host, port, tunnel or version, offers no login form or redirect, and proxies nothing to OpenBao. This reverses the DNS withdrawal handed to railiance-infra on 2026-09-22; a hold was sent (a4bca724). A static notice is not an exposure grant under ADR-0008.

T01 Build the page and manifests

id: RPF-WP-0047-T01
status: done
priority: high
state_hub_task_id: "caa019c6-dfdb-5f17-b860-67e1feaebd51"

argocd/platform-addons/bao-notice/ holds:

• A namespace bao-notice with a NetworkPolicy: ingress only from Traefik (kube-system) on 8080, no egress at all, so there is no path to OpenBao.
• Nginx nginxinc/nginx-unprivileged pinned by digest (already running in the cluster), running non-root with a read-only root filesystem and all capabilities dropped.
• / returns 200 with the notice. Every other path returns 404 with the same notice, so a probe of /v1/sys/health is never a false 200.
• server_tokens off, CSP default-src 'none', noindex, no-store.
• An Ingress on websecure with letsencrypt-prod, and an HTTP→HTTPS redirect at priority 1, so ACME HTTP-01 still wins.

Verified on 2026-09-24:

• Local container probe: / 200, /v1/sys/health and /ui/ 404 with the notice, Server: nginx with no version.
• Server-side dry run on railiance01: all eight objects valid.
• No existing Ingress claims the host.
• The railiance-tenants AppProject already whitelists every kind.

T02 Adopt through ArgoCD (live, founder go-ahead)

id: RPF-WP-0047-T02
status: todo
priority: high
state_hub_task_id: "3af7f95f-4689-547e-90dc-529e65c7b9e2"

The Application is argocd/railiance01/applications/bao-notice.application.yaml, pinned to 960ed09. Sync the root by hand to create it, then sync bao-notice by hand. cert-manager issues bao-notice-tls over HTTP-01.

T03 Verify from outside and close the loop

id: RPF-WP-0047-T03
status: todo
priority: high
state_hub_task_id: "26bf3291-e74e-51dd-89e5-c38169d471b0"

From the workstation: curl -sv https://bao.coulomb.social/ must show a trusted chain with no -k, HTTP 200 and the notice. https://bao.coulomb.social/v1/sys/health must return 404, and http://bao.coulomb.social/ must redirect to https. Record the evidence, then tell user-engine, railiance-infra (keep the A record) and railiance-master (T09 posture unchanged).

Rollback

Delete the bao-notice Application with prune. That restores today's state: the Traefik default certificate and a 404.