coulomb/target-revenue
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WP-0011 T05: live deploy revenue.coulomb.social on railiance01

Browse source 
Image 0.1.1 (schema path fix), OpenBao ESO store, CNPG cluster, TLS,
pilot Phase re-registered on public API. Founding token local-only.
This commit is contained in:
tegwick 2026-08-05 17:56:38 +02:00
parent 592a75a171
commit ca76fa23a3
13 changed files with 168 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

42
docs/deployment.md
View file

@ -1,9 +1,11 @@
# Deploying Target Revenue Trust Service + Control Plane
**Workplan:** `workplans/TREV-WP-0011-railiance-reef-deployment.md`
**Public host (target):** `https://revenue.coulomb.social`
**Public host (live 2026-08-05):** `https://revenue.coulomb.social`
**Control Plane UI:** `https://revenue.coulomb.social/ui/`
**Trust Service API:** `https://revenue.coulomb.social/` (e.g. `/phases/...`, `/public-key`)
**Trust Service API:** `https://revenue.coulomb.social/` (e.g. `/phases/...`, `/public-key`)
**Cluster:** railiance01 (`KUBECONFIG=~/.kube/config-hosteurope`)
**Image:** `forgejo.coulomb.social/coulomb/target-revenue:0.1.1`
This deployment does not by itself authorize new Phases beyond what
WP-0008-T05 already recorded. The first pilot Phase is
@ -25,25 +27,25 @@ WP-0008-T05 already recorded. The first pilot Phase is
---
## Operator checklist (first bring-up)
## Operator checklist (first bring-up) — completed 2026-08-05
1. **DNS:** point `revenue.coulomb.social` at the Railiance Traefik/ingress (same path as other `*.coulomb.social` hosts on railiance01).
2. **OpenBao:** create KV path `workloads/target-revenue/runtime-secrets` with:
- `TRF_SIGNING_KEY_HEX` (64 hex chars)
- `TRF_CONTROL_PLANE_SECRET_KEY`
- `TRF_DATABASE_URL` (trf_app DSN to `target-revenue-pg-rw`)
- `TRF_MIGRATE_DATABASE_URL` (trf_owner DSN for migrate/bootstrap Jobs)
3. **CNPG bootstrap secrets** in namespace `target-revenue` (before Cluster reconciles):
- `target-revenue-pg-credentials` — keys as required by CNPG for owner `trf_owner`
- `target-revenue-trf-app-credentials` — password for managed role `trf_app`
4. **Image:** build and push
`forgejo.coulomb.social/coulomb/target-revenue:0.1.0`
(see Dockerfile; bump tag in Deployment + Jobs when releasing).
5. **ArgoCD:** apply
`railiance-platform/argocd/applications/target-revenue.application.yaml`
(once `main` contains `k8s/railiance/`).
6. **After migrate + bootstrap Jobs succeed:** pull founding token from bootstrap Job logs (`TOKEN=...`), store offline; sign in at `/ui/login`.
7. **Migrate pilot Phase data** from the local go-live instance (`trf-pilot-pg` / `:8765`) if that instance still holds the authoritative ledger — export Manifest + ledger JSON and re-register/append on the public instance (or promote the pilot DB dump deliberately). Do not leave two competing ledgers.
Deployed with **kubectl on railiance01** (forgejo/reuse interim model).
Coulombcore ArgoCD Application exists for future multi-cluster sync but was
**not** the live path for this bring-up.
1. **DNS:** `revenue.coulomb.social` A-record → railiance01 — done.
2. **OpenBao policy + ESO token:**
`OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh`
+ apply `openbao-target-revenue.clustersecretstore.yaml`.
3. **CNPG secrets + Cluster**, then write
`platform/workloads/target-revenue/runtime-secrets` (signing key, session secret, DSNs).
4. **Image:** `docker build/push …:0.1.1` (0.1.0 had schema-path bug; fixed).
5. **`kubectl apply -k k8s/railiance/`** on railiance01.
6. **Founding token:** bootstrap Job log →
`~/.config/target-revenue/revenue-coulomb-binky.token` (chmod 600; never commit).
7. **Phase POR:** re-registered
`trsl:phase:info-tech-canon-service-surface` on the public API; local
`trf-pilot-pg` is superseded (ledger was empty, so no entry migration).
---