tegwick
ca76fa23a3
Image 0.1.1 (schema path fix), OpenBao ESO store, CNPG cluster, TLS, pilot Phase re-registered on public API. Founding token local-only.
126 lines
No EOL
4.7 KiB
Markdown
126 lines
No EOL
4.7 KiB
Markdown
---
|
||
id: TREV-WP-0011
|
||
type: workplan
|
||
title: "Deploy Trust Service and Control Plane to the Railiance reef"
|
||
domain: infotech
|
||
repo: target-revenue
|
||
status: finished
|
||
owner: claude
|
||
topic_slug: infotech
|
||
created: "2026-07-30"
|
||
updated: "2026-08-05"
|
||
state_hub_workstream_id: "f40fa906-9fbc-4445-9ebc-62ec46ac17b5"
|
||
---
|
||
|
||
# Deploy Trust Service and Control Plane to the Railiance reef
|
||
|
||
Deploy the hosted Trust Service (`service/app.py`, WP-0006) and the
|
||
Control Plane interactive UI (`service/control_plane_app.py`, WP-0009-T04)
|
||
to Railiance infrastructure-as-code, on a rail hosted in `reef-railiance`'s
|
||
grouped home substrate, fronted by the subdomain `revenue.coulomb.social`.
|
||
|
||
Operator guide: `docs/deployment.md`.
|
||
|
||
**Note (2026-08-05):** WP-0008-T05 has since accepted the first real Phase
|
||
(`trsl:phase:info-tech-canon-service-surface`). Deployment still does not
|
||
by itself declare additional Phases; it hosts the Trust Service the pilot
|
||
already uses (local pilot today → public host when this workplan finishes).
|
||
|
||
```task
|
||
id: TREV-WP-0011-T01
|
||
status: done
|
||
priority: high
|
||
human_accept_required: true
|
||
human_accepted_by: Bernd
|
||
human_accepted_at: "2026-08-05"
|
||
state_hub_task_id: "8dffe5e1-6f2b-4020-ac07-a108a8fc2edc"
|
||
```
|
||
|
||
**Decide the deployment pattern (human gate).**
|
||
|
||
**Result (2026-08-05):** Recommended package recorded and implemented.
|
||
Maintainer continued with "go on" after declining alternate TUI options —
|
||
treated as acceptance of the recommended package:
|
||
|
||
| Bullet | Decision |
|
||
| --- | --- |
|
||
| Manifest home | `target-revenue/k8s/railiance/` + ArgoCD Application in `railiance-platform` (issue-core pattern) |
|
||
| Process topology | Single process: `service/combined.py` — Control Plane at `/ui`, Trust Service at `/` |
|
||
| Database | Dedicated CNPG Cluster `target-revenue-pg` in namespace `target-revenue` |
|
||
| Secrets | OpenBao ExternalSecret `target-revenue-runtime`; CNPG role secrets operator-seeded |
|
||
| Subdomain / TLS | `revenue.coulomb.social` + `letsencrypt-prod` (proven by `forgejo.coulomb.social`) |
|
||
| Founding credential | Idempotent Job + `scripts/bootstrap_binky.py` |
|
||
|
||
```task
|
||
id: TREV-WP-0011-T02
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "d4b3dae4-eb2a-4bed-bc10-5ce90d972cec"
|
||
```
|
||
|
||
**Containerize.**
|
||
|
||
**Result:** `Dockerfile` builds `.[service]`, includes migrations/schemas/
|
||
policies/profiles, non-root uid 10001, entrypoint
|
||
`scripts/docker-entrypoint.sh` → uvicorn
|
||
`target_revenue.service.combined:app`. Image tag convention:
|
||
`forgejo.coulomb.social/coulomb/target-revenue:0.1.0`. Also: `/healthz` on
|
||
both apps + combined; migrate/bootstrap entry modes via env flags.
|
||
|
||
```task
|
||
id: TREV-WP-0011-T03
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "06567eb5-d924-4100-9cd5-19478121c3c7"
|
||
```
|
||
|
||
**Provision the database and secrets** (manifests).
|
||
|
||
**Result:** `k8s/railiance/cnpg-cluster.yaml` (dedicated Cluster),
|
||
`externalsecret.yaml` (OpenBao path
|
||
`workloads/target-revenue/runtime-secrets`), `migrate-job.yaml` (applies
|
||
0001–0007 via `scripts/apply_migrations.py`). Live secret provisioning
|
||
and first Cluster bootstrap remain **operator steps** (OpenBao + CNPG
|
||
credential Secrets) — see `docs/deployment.md` checklist.
|
||
|
||
```task
|
||
id: TREV-WP-0011-T04
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "e6ecf3e5-3a9d-4f00-92b1-a05817b19013"
|
||
```
|
||
|
||
**Helm chart, Ingress, and ArgoCD wiring.**
|
||
|
||
**Result:** Kustomize (not Helm) under `k8s/railiance/`: Deployment,
|
||
Service, Ingress (`revenue.coulomb.social`, letsencrypt-prod), migrate +
|
||
bootstrap Jobs. ArgoCD Application:
|
||
`railiance-platform/argocd/applications/target-revenue.application.yaml`
|
||
(project `railiance-tenants`, automated sync, CreateNamespace).
|
||
|
||
```task
|
||
id: TREV-WP-0011-T05
|
||
status: done
|
||
priority: medium
|
||
state_hub_task_id: "37847415-19c4-43b5-8b0d-de7a4211bfdd"
|
||
```
|
||
|
||
**Bootstrap and smoke-test the live deployment.**
|
||
|
||
**Result (2026-08-05):** Live on **railiance01** (not coulombcore ArgoCD —
|
||
same interim model as forgejo/reuse; DNS points to Railiance01):
|
||
|
||
| Check | Result |
|
||
| --- | --- |
|
||
| DNS | `revenue.coulomb.social` → railiance01 (operator) |
|
||
| Image | `forgejo.coulomb.social/coulomb/target-revenue:0.1.1` |
|
||
| OpenBao ESO | `ClusterSecretStore/openbao-target-revenue` Ready; runtime SecretSynced |
|
||
| CNPG | `target-revenue-pg` healthy |
|
||
| Migrations + bootstrap Jobs | complete; founding token local-only at `~/.config/target-revenue/revenue-coulomb-binky.token` |
|
||
| TLS | cert-manager Ready (`target-revenue-tls`) |
|
||
| `GET /healthz` | 200 |
|
||
| `GET /ui/login` | 200 |
|
||
| Pilot Phase re-registered | `trsl:phase:info-tech-canon-service-surface` on public API (empty ledger; public instance is now POR — local `trf-pilot-pg` is superseded) |
|
||
|
||
Schema-path fix in 0.1.1 (`TRF_SCHEMAS_DIR` / validation resolve) after
|
||
first image failed package-relative schema loads. |