tegwick
ca76fa23a3
Image 0.1.1 (schema path fix), OpenBao ESO store, CNPG cluster, TLS, pilot Phase re-registered on public API. Founding token local-only.
71 lines
3 KiB
Markdown
71 lines
3 KiB
Markdown
# Deploying Target Revenue Trust Service + Control Plane
|
|
|
|
**Workplan:** `workplans/TREV-WP-0011-railiance-reef-deployment.md`
|
|
**Public host (live 2026-08-05):** `https://revenue.coulomb.social`
|
|
**Control Plane UI:** `https://revenue.coulomb.social/ui/`
|
|
**Trust Service API:** `https://revenue.coulomb.social/` (e.g. `/phases/...`, `/public-key`)
|
|
**Cluster:** railiance01 (`KUBECONFIG=~/.kube/config-hosteurope`)
|
|
**Image:** `forgejo.coulomb.social/coulomb/target-revenue:0.1.1`
|
|
|
|
This deployment does not by itself authorize new Phases beyond what
|
|
WP-0008-T05 already recorded. The first pilot Phase is
|
|
`trsl:phase:info-tech-canon-service-surface`
|
|
(`history/260805-T05-GoLive-info-tech-canon.md`).
|
|
|
|
---
|
|
|
|
## T01 decision (2026-08-05)
|
|
|
|
| Bullet | Decision |
|
|
| --- | --- |
|
|
| Manifest home | In-repo `k8s/railiance/` (issue-core pattern); ArgoCD Application in `railiance-platform` |
|
|
| Process topology | **Single process**: `combined.py` mounts Control Plane at `/ui`, Trust Service at `/` |
|
|
| Database | Dedicated CNPG Cluster `target-revenue-pg` in namespace `target-revenue` (not state-hub DB) |
|
|
| Secrets | OpenBao + ExternalSecret → `target-revenue-runtime`; CNPG role secrets operator-seeded |
|
|
| Subdomain / TLS | `revenue.coulomb.social`, `cert-manager.io/cluster-issuer: letsencrypt-prod` (same as `forgejo.coulomb.social`) |
|
|
| Founding credential | Idempotent Job `target-revenue-bootstrap-binky` (`scripts/bootstrap_binky.py`) |
|
|
|
|
---
|
|
|
|
## Operator checklist (first bring-up) — completed 2026-08-05
|
|
|
|
Deployed with **kubectl on railiance01** (forgejo/reuse interim model).
|
|
Coulombcore ArgoCD Application exists for future multi-cluster sync but was
|
|
**not** the live path for this bring-up.
|
|
|
|
1. **DNS:** `revenue.coulomb.social` A-record → railiance01 — done.
|
|
2. **OpenBao policy + ESO token:**
|
|
`OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh`
|
|
+ apply `openbao-target-revenue.clustersecretstore.yaml`.
|
|
3. **CNPG secrets + Cluster**, then write
|
|
`platform/workloads/target-revenue/runtime-secrets` (signing key, session secret, DSNs).
|
|
4. **Image:** `docker build/push …:0.1.1` (0.1.0 had schema-path bug; fixed).
|
|
5. **`kubectl apply -k k8s/railiance/`** on railiance01.
|
|
6. **Founding token:** bootstrap Job log →
|
|
`~/.config/target-revenue/revenue-coulomb-binky.token` (chmod 600; never commit).
|
|
7. **Phase POR:** re-registered
|
|
`trsl:phase:info-tech-canon-service-surface` on the public API; local
|
|
`trf-pilot-pg` is superseded (ledger was empty, so no entry migration).
|
|
|
|
---
|
|
|
|
## Local pilot instance (already used for T05)
|
|
|
|
| Item | Value |
|
|
| --- | --- |
|
|
| API | `http://127.0.0.1:8765` |
|
|
| Postgres container | `trf-pilot-pg` / volume `trf-pilot-pgdata` / port `55432` |
|
|
| Token file | `~/.config/target-revenue/pilot-binky.token` |
|
|
|
|
```bash
|
|
python scripts/trf_onboard.py status \
|
|
--url http://127.0.0.1:8765 \
|
|
--phase-id trsl:phase:info-tech-canon-service-surface
|
|
```
|
|
|
|
---
|
|
|
|
## Health
|
|
|
|
- Combined / standalone: `GET /healthz` → `{"status":"ok"}` (no DB dependency)
|
|
- Control Plane when mounted: `GET /ui/healthz`
|