tegwick 856dc354d8 Fix Control Plane login under /ui; store founding token in OpenBao

Rewrite templates that lost href/action during root_path rewrite; use
native form controls for reliable login. Deploy image 0.1.2. Founding
admin token canonical location: platform/operators/founding-admin/revenue.

2026-08-06 21:41:59 +02:00

3.3 KiB

Raw Permalink Blame History

Deploying Target Revenue Trust Service + Control Plane

Workplan: workplans/TREV-WP-0011-railiance-reef-deployment.md
Public host (live 2026-08-05): https://revenue.coulomb.social
Control Plane UI: https://revenue.coulomb.social/ui/
Trust Service API: https://revenue.coulomb.social/ (e.g. /phases/..., /public-key)
Cluster: railiance01 (KUBECONFIG=~/.kube/config-hosteurope)
Image: forgejo.coulomb.social/coulomb/target-revenue:0.1.1

This deployment does not by itself authorize new Phases beyond what WP-0008-T05 already recorded. The first pilot Phase is trsl:phase:info-tech-canon-service-surface (history/260805-T05-GoLive-info-tech-canon.md).

T01 decision (2026-08-05)

Bullet	Decision
Manifest home	In-repo `k8s/railiance/` (issue-core pattern); ArgoCD Application in `railiance-platform`
Process topology	Single process: `combined.py` mounts Control Plane at `/ui`, Trust Service at `/`
Database	Dedicated CNPG Cluster `target-revenue-pg` in namespace `target-revenue` (not state-hub DB)
Secrets	OpenBao + ExternalSecret → `target-revenue-runtime`; CNPG role secrets operator-seeded
Subdomain / TLS	`revenue.coulomb.social`, `cert-manager.io/cluster-issuer: letsencrypt-prod` (same as `forgejo.coulomb.social`)
Founding credential	Idempotent Job `target-revenue-bootstrap-binky` (`scripts/bootstrap_binky.py`)

Operator checklist (first bring-up) — completed 2026-08-05

Deployed with kubectl on railiance01 (forgejo/reuse interim model). Coulombcore ArgoCD Application exists for future multi-cluster sync but was not the live path for this bring-up.

DNS: revenue.coulomb.social A-record → railiance01 — done.
OpenBao policy + ESO token:
OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh
- apply openbao-target-revenue.clustersecretstore.yaml.
CNPG secrets + Cluster, then write
platform/workloads/target-revenue/runtime-secrets (signing key, session secret, DSNs).
Image: docker build/push …:0.1.1 (0.1.0 had schema-path bug; fixed).
kubectl apply -k k8s/railiance/ on railiance01.
Founding token: bootstrap Job mints founding-admin. Canonical copy lives in OpenBao (never commit):
```
platform/operators/founding-admin/revenue
fields: token, credential_label, licensor_id, rights, host, ...
```
```
bao kv get -mount=platform operators/founding-admin/revenue
```
Optional local cache: ~/.config/target-revenue/revenue-coulomb-binky.token.
Phase POR: re-registered
trsl:phase:info-tech-canon-service-surface on the public API; local
trf-pilot-pg is superseded (ledger was empty, so no entry migration).

Local pilot instance (already used for T05)

Item	Value
API	`http://127.0.0.1:8765`
Postgres container	`trf-pilot-pg` / volume `trf-pilot-pgdata` / port `55432`
Token file	`~/.config/target-revenue/pilot-binky.token`

python scripts/trf_onboard.py status \
  --url http://127.0.0.1:8765 \
  --phase-id trsl:phase:info-tech-canon-service-surface

Health

Combined / standalone: GET /healthz → {"status":"ok"} (no DB dependency)
Control Plane when mounted: GET /ui/healthz

3.3 KiB Raw Permalink Blame History