# Deploying Target Revenue Trust Service + Control Plane

**Workplan:** `workplans/TREV-WP-0011-railiance-reef-deployment.md`  
**Public host (live 2026-08-05):** `https://revenue.coulomb.social`  
**Control Plane UI:** `https://revenue.coulomb.social/ui/`  
**Trust Service API:** `https://revenue.coulomb.social/` (e.g. `/phases/...`, `/public-key`)  
**Cluster:** railiance01 (`KUBECONFIG=~/.kube/config-hosteurope`)  
**Image:** `forgejo.coulomb.social/coulomb/target-revenue:0.1.1`

This deployment does not by itself authorize new Phases beyond what
WP-0008-T05 already recorded. The first pilot Phase is
`trsl:phase:info-tech-canon-service-surface`
(`history/260805-T05-GoLive-info-tech-canon.md`).

---

## T01 decision (2026-08-05)

| Bullet | Decision |
| --- | --- |
| Manifest home | In-repo `k8s/railiance/` (issue-core pattern); ArgoCD Application in `railiance-platform` |
| Process topology | **Single process**: `combined.py` mounts Control Plane at `/ui`, Trust Service at `/` |
| Database | Dedicated CNPG Cluster `target-revenue-pg` in namespace `target-revenue` (not state-hub DB) |
| Secrets | OpenBao + ExternalSecret → `target-revenue-runtime`; CNPG role secrets operator-seeded |
| Subdomain / TLS | `revenue.coulomb.social`, `cert-manager.io/cluster-issuer: letsencrypt-prod` (same as `forgejo.coulomb.social`) |
| Founding credential | Idempotent Job `target-revenue-bootstrap-binky` (`scripts/bootstrap_binky.py`) |

---

## Operator checklist (first bring-up) — completed 2026-08-05

Deployed with **kubectl on railiance01** (forgejo/reuse interim model).
Coulombcore ArgoCD Application exists for future multi-cluster sync but was
**not** the live path for this bring-up.

1. **DNS:** `revenue.coulomb.social` A-record → railiance01 — done.
2. **OpenBao policy + ESO token:**  
   `OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh`  
   + apply `openbao-target-revenue.clustersecretstore.yaml`.
3. **CNPG secrets + Cluster**, then write  
   `platform/workloads/target-revenue/runtime-secrets` (signing key, session secret, DSNs).
4. **Image:** `docker build/push …:0.1.1` (0.1.0 had schema-path bug; fixed).
5. **`kubectl apply -k k8s/railiance/`** on railiance01.
6. **Founding token:** bootstrap Job mints `founding-admin`. Canonical copy
   lives in OpenBao (never commit):

   ```text
   platform/operators/founding-admin/revenue
   fields: token, credential_label, licensor_id, rights, host, ...
   ```

   ```bash
   bao kv get -mount=platform operators/founding-admin/revenue
   ```

   Optional local cache: `~/.config/target-revenue/revenue-coulomb-binky.token`.
7. **Phase POR:** re-registered  
   `trsl:phase:info-tech-canon-service-surface` on the public API; local  
   `trf-pilot-pg` is superseded (ledger was empty, so no entry migration).

---

## Local pilot instance (already used for T05)

| Item | Value |
| --- | --- |
| API | `http://127.0.0.1:8765` |
| Postgres container | `trf-pilot-pg` / volume `trf-pilot-pgdata` / port `55432` |
| Token file | `~/.config/target-revenue/pilot-binky.token` |

```bash
python scripts/trf_onboard.py status \
  --url http://127.0.0.1:8765 \
  --phase-id trsl:phase:info-tech-canon-service-surface
```

---

## Health

- Combined / standalone: `GET /healthz` → `{"status":"ok"}` (no DB dependency)
- Control Plane when mounted: `GET /ui/healthz`