tegwick
ca76fa23a3
Image 0.1.1 (schema path fix), OpenBao ESO store, CNPG cluster, TLS, pilot Phase re-registered on public API. Founding token local-only.
4.7 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|
| TREV-WP-0011 | workplan | Deploy Trust Service and Control Plane to the Railiance reef | infotech | target-revenue | finished | claude | infotech | 2026-07-30 | 2026-08-05 | f40fa906-9fbc-4445-9ebc-62ec46ac17b5 |
Deploy Trust Service and Control Plane to the Railiance reef
Deploy the hosted Trust Service (service/app.py, WP-0006) and the
Control Plane interactive UI (service/control_plane_app.py, WP-0009-T04)
to Railiance infrastructure-as-code, on a rail hosted in reef-railiance's
grouped home substrate, fronted by the subdomain revenue.coulomb.social.
Operator guide: docs/deployment.md.
Note (2026-08-05): WP-0008-T05 has since accepted the first real Phase
(trsl:phase:info-tech-canon-service-surface). Deployment still does not
by itself declare additional Phases; it hosts the Trust Service the pilot
already uses (local pilot today → public host when this workplan finishes).
id: TREV-WP-0011-T01
status: done
priority: high
human_accept_required: true
human_accepted_by: Bernd
human_accepted_at: "2026-08-05"
state_hub_task_id: "8dffe5e1-6f2b-4020-ac07-a108a8fc2edc"
Decide the deployment pattern (human gate).
Result (2026-08-05): Recommended package recorded and implemented. Maintainer continued with "go on" after declining alternate TUI options — treated as acceptance of the recommended package:
| Bullet | Decision |
|---|---|
| Manifest home | target-revenue/k8s/railiance/ + ArgoCD Application in railiance-platform (issue-core pattern) |
| Process topology | Single process: service/combined.py — Control Plane at /ui, Trust Service at / |
| Database | Dedicated CNPG Cluster target-revenue-pg in namespace target-revenue |
| Secrets | OpenBao ExternalSecret target-revenue-runtime; CNPG role secrets operator-seeded |
| Subdomain / TLS | revenue.coulomb.social + letsencrypt-prod (proven by forgejo.coulomb.social) |
| Founding credential | Idempotent Job + scripts/bootstrap_binky.py |
id: TREV-WP-0011-T02
status: done
priority: high
state_hub_task_id: "d4b3dae4-eb2a-4bed-bc10-5ce90d972cec"
Containerize.
Result: Dockerfile builds .[service], includes migrations/schemas/
policies/profiles, non-root uid 10001, entrypoint
scripts/docker-entrypoint.sh → uvicorn
target_revenue.service.combined:app. Image tag convention:
forgejo.coulomb.social/coulomb/target-revenue:0.1.0. Also: /healthz on
both apps + combined; migrate/bootstrap entry modes via env flags.
id: TREV-WP-0011-T03
status: done
priority: high
state_hub_task_id: "06567eb5-d924-4100-9cd5-19478121c3c7"
Provision the database and secrets (manifests).
Result: k8s/railiance/cnpg-cluster.yaml (dedicated Cluster),
externalsecret.yaml (OpenBao path
workloads/target-revenue/runtime-secrets), migrate-job.yaml (applies
0001–0007 via scripts/apply_migrations.py). Live secret provisioning
and first Cluster bootstrap remain operator steps (OpenBao + CNPG
credential Secrets) — see docs/deployment.md checklist.
id: TREV-WP-0011-T04
status: done
priority: high
state_hub_task_id: "e6ecf3e5-3a9d-4f00-92b1-a05817b19013"
Helm chart, Ingress, and ArgoCD wiring.
Result: Kustomize (not Helm) under k8s/railiance/: Deployment,
Service, Ingress (revenue.coulomb.social, letsencrypt-prod), migrate +
bootstrap Jobs. ArgoCD Application:
railiance-platform/argocd/applications/target-revenue.application.yaml
(project railiance-tenants, automated sync, CreateNamespace).
id: TREV-WP-0011-T05
status: done
priority: medium
state_hub_task_id: "37847415-19c4-43b5-8b0d-de7a4211bfdd"
Bootstrap and smoke-test the live deployment.
Result (2026-08-05): Live on railiance01 (not coulombcore ArgoCD — same interim model as forgejo/reuse; DNS points to Railiance01):
| Check | Result |
|---|---|
| DNS | revenue.coulomb.social → railiance01 (operator) |
| Image | forgejo.coulomb.social/coulomb/target-revenue:0.1.1 |
| OpenBao ESO | ClusterSecretStore/openbao-target-revenue Ready; runtime SecretSynced |
| CNPG | target-revenue-pg healthy |
| Migrations + bootstrap Jobs | complete; founding token local-only at ~/.config/target-revenue/revenue-coulomb-binky.token |
| TLS | cert-manager Ready (target-revenue-tls) |
GET /healthz |
200 |
GET /ui/login |
200 |
| Pilot Phase re-registered | trsl:phase:info-tech-canon-service-surface on public API (empty ledger; public instance is now POR — local trf-pilot-pg is superseded) |
Schema-path fix in 0.1.1 (TRF_SCHEMAS_DIR / validation resolve) after
first image failed package-relative schema loads.