tegwick
9e4e84f9ee
Record T01 package (in-repo k8s/railiance, combined /ui + API app, dedicated CNPG). Add Dockerfile, healthz, migration/bootstrap scripts, kustomize manifests, ArgoCD Application (in railiance-platform), and docs/deployment.md. T05 left open for operator DNS/OpenBao/image push.
4.3 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|
| TREV-WP-0011 | workplan | Deploy Trust Service and Control Plane to the Railiance reef | infotech | target-revenue | active | claude | infotech | 2026-07-30 | 2026-08-05 | f40fa906-9fbc-4445-9ebc-62ec46ac17b5 |
Deploy Trust Service and Control Plane to the Railiance reef
Deploy the hosted Trust Service (service/app.py, WP-0006) and the
Control Plane interactive UI (service/control_plane_app.py, WP-0009-T04)
to Railiance infrastructure-as-code, on a rail hosted in reef-railiance's
grouped home substrate, fronted by the subdomain revenue.coulomb.social.
Operator guide: docs/deployment.md.
Note (2026-08-05): WP-0008-T05 has since accepted the first real Phase
(trsl:phase:info-tech-canon-service-surface). Deployment still does not
by itself declare additional Phases; it hosts the Trust Service the pilot
already uses (local pilot today → public host when this workplan finishes).
id: TREV-WP-0011-T01
status: done
priority: high
human_accept_required: true
human_accepted_by: Bernd
human_accepted_at: "2026-08-05"
state_hub_task_id: "8dffe5e1-6f2b-4020-ac07-a108a8fc2edc"
Decide the deployment pattern (human gate).
Result (2026-08-05): Recommended package recorded and implemented. Maintainer continued with "go on" after declining alternate TUI options — treated as acceptance of the recommended package:
| Bullet | Decision |
|---|---|
| Manifest home | target-revenue/k8s/railiance/ + ArgoCD Application in railiance-platform (issue-core pattern) |
| Process topology | Single process: service/combined.py — Control Plane at /ui, Trust Service at / |
| Database | Dedicated CNPG Cluster target-revenue-pg in namespace target-revenue |
| Secrets | OpenBao ExternalSecret target-revenue-runtime; CNPG role secrets operator-seeded |
| Subdomain / TLS | revenue.coulomb.social + letsencrypt-prod (proven by forgejo.coulomb.social) |
| Founding credential | Idempotent Job + scripts/bootstrap_binky.py |
id: TREV-WP-0011-T02
status: done
priority: high
state_hub_task_id: "d4b3dae4-eb2a-4bed-bc10-5ce90d972cec"
Containerize.
Result: Dockerfile builds .[service], includes migrations/schemas/
policies/profiles, non-root uid 10001, entrypoint
scripts/docker-entrypoint.sh → uvicorn
target_revenue.service.combined:app. Image tag convention:
forgejo.coulomb.social/coulomb/target-revenue:0.1.0. Also: /healthz on
both apps + combined; migrate/bootstrap entry modes via env flags.
id: TREV-WP-0011-T03
status: done
priority: high
state_hub_task_id: "06567eb5-d924-4100-9cd5-19478121c3c7"
Provision the database and secrets (manifests).
Result: k8s/railiance/cnpg-cluster.yaml (dedicated Cluster),
externalsecret.yaml (OpenBao path
workloads/target-revenue/runtime-secrets), migrate-job.yaml (applies
0001–0007 via scripts/apply_migrations.py). Live secret provisioning
and first Cluster bootstrap remain operator steps (OpenBao + CNPG
credential Secrets) — see docs/deployment.md checklist.
id: TREV-WP-0011-T04
status: done
priority: high
state_hub_task_id: "e6ecf3e5-3a9d-4f00-92b1-a05817b19013"
Helm chart, Ingress, and ArgoCD wiring.
Result: Kustomize (not Helm) under k8s/railiance/: Deployment,
Service, Ingress (revenue.coulomb.social, letsencrypt-prod), migrate +
bootstrap Jobs. ArgoCD Application:
railiance-platform/argocd/applications/target-revenue.application.yaml
(project railiance-tenants, automated sync, CreateNamespace).
id: TREV-WP-0011-T05
status: todo
priority: medium
state_hub_task_id: "37847415-19c4-43b5-8b0d-de7a4211bfdd"
Bootstrap and smoke-test the live deployment.
Remaining operator work (not fully automatable from this workstation without cluster credentials + OpenBao write + DNS + image push):
- DNS A/CNAME for
revenue.coulomb.social - Seed OpenBao runtime secrets + CNPG bootstrap Secrets
docker build/pushimage0.1.0- Commit/push Application + app manifests; wait for ArgoCD sync
- Confirm TLS +
/ui/login+/healthz - Migrate pilot Phase ledger from local
trf-pilot-pgif public instance becomes the new authority
Docs ready: docs/deployment.md. No production smoke Phase will be
registered (append-only; pilot Phase already exists).