tegwick
9e4e84f9ee
Record T01 package (in-repo k8s/railiance, combined /ui + API app, dedicated CNPG). Add Dockerfile, healthz, migration/bootstrap scripts, kustomize manifests, ArgoCD Application (in railiance-platform), and docs/deployment.md. T05 left open for operator DNS/OpenBao/image push.
69 lines
3.3 KiB
Markdown
69 lines
3.3 KiB
Markdown
# Deploying Target Revenue Trust Service + Control Plane
|
|
|
|
**Workplan:** `workplans/TREV-WP-0011-railiance-reef-deployment.md`
|
|
**Public host (target):** `https://revenue.coulomb.social`
|
|
**Control Plane UI:** `https://revenue.coulomb.social/ui/`
|
|
**Trust Service API:** `https://revenue.coulomb.social/` (e.g. `/phases/...`, `/public-key`)
|
|
|
|
This deployment does not by itself authorize new Phases beyond what
|
|
WP-0008-T05 already recorded. The first pilot Phase is
|
|
`trsl:phase:info-tech-canon-service-surface`
|
|
(`history/260805-T05-GoLive-info-tech-canon.md`).
|
|
|
|
---
|
|
|
|
## T01 decision (2026-08-05)
|
|
|
|
| Bullet | Decision |
|
|
| --- | --- |
|
|
| Manifest home | In-repo `k8s/railiance/` (issue-core pattern); ArgoCD Application in `railiance-platform` |
|
|
| Process topology | **Single process**: `combined.py` mounts Control Plane at `/ui`, Trust Service at `/` |
|
|
| Database | Dedicated CNPG Cluster `target-revenue-pg` in namespace `target-revenue` (not state-hub DB) |
|
|
| Secrets | OpenBao + ExternalSecret → `target-revenue-runtime`; CNPG role secrets operator-seeded |
|
|
| Subdomain / TLS | `revenue.coulomb.social`, `cert-manager.io/cluster-issuer: letsencrypt-prod` (same as `forgejo.coulomb.social`) |
|
|
| Founding credential | Idempotent Job `target-revenue-bootstrap-binky` (`scripts/bootstrap_binky.py`) |
|
|
|
|
---
|
|
|
|
## Operator checklist (first bring-up)
|
|
|
|
1. **DNS:** point `revenue.coulomb.social` at the Railiance Traefik/ingress (same path as other `*.coulomb.social` hosts on railiance01).
|
|
2. **OpenBao:** create KV path `workloads/target-revenue/runtime-secrets` with:
|
|
- `TRF_SIGNING_KEY_HEX` (64 hex chars)
|
|
- `TRF_CONTROL_PLANE_SECRET_KEY`
|
|
- `TRF_DATABASE_URL` (trf_app DSN to `target-revenue-pg-rw`)
|
|
- `TRF_MIGRATE_DATABASE_URL` (trf_owner DSN for migrate/bootstrap Jobs)
|
|
3. **CNPG bootstrap secrets** in namespace `target-revenue` (before Cluster reconciles):
|
|
- `target-revenue-pg-credentials` — keys as required by CNPG for owner `trf_owner`
|
|
- `target-revenue-trf-app-credentials` — password for managed role `trf_app`
|
|
4. **Image:** build and push
|
|
`forgejo.coulomb.social/coulomb/target-revenue:0.1.0`
|
|
(see Dockerfile; bump tag in Deployment + Jobs when releasing).
|
|
5. **ArgoCD:** apply
|
|
`railiance-platform/argocd/applications/target-revenue.application.yaml`
|
|
(once `main` contains `k8s/railiance/`).
|
|
6. **After migrate + bootstrap Jobs succeed:** pull founding token from bootstrap Job logs (`TOKEN=...`), store offline; sign in at `/ui/login`.
|
|
7. **Migrate pilot Phase data** from the local go-live instance (`trf-pilot-pg` / `:8765`) if that instance still holds the authoritative ledger — export Manifest + ledger JSON and re-register/append on the public instance (or promote the pilot DB dump deliberately). Do not leave two competing ledgers.
|
|
|
|
---
|
|
|
|
## Local pilot instance (already used for T05)
|
|
|
|
| Item | Value |
|
|
| --- | --- |
|
|
| API | `http://127.0.0.1:8765` |
|
|
| Postgres container | `trf-pilot-pg` / volume `trf-pilot-pgdata` / port `55432` |
|
|
| Token file | `~/.config/target-revenue/pilot-binky.token` |
|
|
|
|
```bash
|
|
python scripts/trf_onboard.py status \
|
|
--url http://127.0.0.1:8765 \
|
|
--phase-id trsl:phase:info-tech-canon-service-surface
|
|
```
|
|
|
|
---
|
|
|
|
## Health
|
|
|
|
- Combined / standalone: `GET /healthz` → `{"status":"ok"}` (no DB dependency)
|
|
- Control Plane when mounted: `GET /ui/healthz`
|