coulomb/target-revenue
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
target-revenue/docs/deployment.md
tegwick 9e4e84f9ee WP-0011: deploy scaffolding for revenue.coulomb.social 
Record T01 package (in-repo k8s/railiance, combined /ui + API app,
dedicated CNPG). Add Dockerfile, healthz, migration/bootstrap scripts,
kustomize manifests, ArgoCD Application (in railiance-platform), and
docs/deployment.md. T05 left open for operator DNS/OpenBao/image push.
2026-08-05 16:41:00 +02:00

3.3 KiB
Raw Blame History

Deploying Target Revenue Trust Service + Control Plane

Workplan: workplans/TREV-WP-0011-railiance-reef-deployment.md
Public host (target): https://revenue.coulomb.social
Control Plane UI: https://revenue.coulomb.social/ui/
Trust Service API: https://revenue.coulomb.social/ (e.g. /phases/..., /public-key)

This deployment does not by itself authorize new Phases beyond what WP-0008-T05 already recorded. The first pilot Phase is trsl:phase:info-tech-canon-service-surface (history/260805-T05-GoLive-info-tech-canon.md).

T01 decision (2026-08-05)

Bullet Decision
Manifest home In-repo k8s/railiance/ (issue-core pattern); ArgoCD Application in railiance-platform
Process topology Single process: combined.py mounts Control Plane at /ui, Trust Service at /
Database Dedicated CNPG Cluster target-revenue-pg in namespace target-revenue (not state-hub DB)
Secrets OpenBao + ExternalSecret → target-revenue-runtime; CNPG role secrets operator-seeded
Subdomain / TLS revenue.coulomb.social, cert-manager.io/cluster-issuer: letsencrypt-prod (same as forgejo.coulomb.social)
Founding credential Idempotent Job target-revenue-bootstrap-binky (scripts/bootstrap_binky.py)

Operator checklist (first bring-up)

  1. DNS: point revenue.coulomb.social at the Railiance Traefik/ingress (same path as other *.coulomb.social hosts on railiance01).
  2. OpenBao: create KV path workloads/target-revenue/runtime-secrets with:
    • TRF_SIGNING_KEY_HEX (64 hex chars)
    • TRF_CONTROL_PLANE_SECRET_KEY
    • TRF_DATABASE_URL (trf_app DSN to target-revenue-pg-rw)
    • TRF_MIGRATE_DATABASE_URL (trf_owner DSN for migrate/bootstrap Jobs)
  3. CNPG bootstrap secrets in namespace target-revenue (before Cluster reconciles):
    • target-revenue-pg-credentials — keys as required by CNPG for owner trf_owner
    • target-revenue-trf-app-credentials — password for managed role trf_app
  4. Image: build and push
    forgejo.coulomb.social/coulomb/target-revenue:0.1.0
    (see Dockerfile; bump tag in Deployment + Jobs when releasing).
  5. ArgoCD: apply
    railiance-platform/argocd/applications/target-revenue.application.yaml
    (once main contains k8s/railiance/).
  6. After migrate + bootstrap Jobs succeed: pull founding token from bootstrap Job logs (TOKEN=...), store offline; sign in at /ui/login.
  7. Migrate pilot Phase data from the local go-live instance (trf-pilot-pg / :8765) if that instance still holds the authoritative ledger — export Manifest + ledger JSON and re-register/append on the public instance (or promote the pilot DB dump deliberately). Do not leave two competing ledgers.

Local pilot instance (already used for T05)

Item Value
API http://127.0.0.1:8765
Postgres container trf-pilot-pg / volume trf-pilot-pgdata / port 55432
Token file ~/.config/target-revenue/pilot-binky.token 
python scripts/trf_onboard.py status \
  --url http://127.0.0.1:8765 \
  --phase-id trsl:phase:info-tech-canon-service-surface

Health

  • Combined / standalone: GET /healthz → {"status":"ok"} (no DB dependency)
  • Control Plane when mounted: GET /ui/healthz