Skip to content

SPRINT-3 Gate S3-4 Report — Tunnel + Config (no DNS)

Status: STOP — Ryan review before S3-5 DNS cutover
Date: 2026-08-28
Scope: S3-1 through S3-4 only (per Ryan: SPRINT-3 go through S3-4 only)

Summary

realoutcomes-edge tunnel created and connected from VM 116. cloudflared installed and active. Ingress validated for realoutcomes.app + www.realoutcomes.app → app on :5000. BWS + app env updated for prod PUBLIC_URL and OAuth callback. Stripe webhook signing secret rotated (new endpoint, same URL). DNS not touched. Railway + hosted Supabase untouched.

S3-1 — Tunnel created

Item Value
Name realoutcomes-edge
UUID 643ea255-19c7-4cef-a154-7a2fd6154275
CNAME target (Ryan S3-5) 643ea255-19c7-4cef-a154-7a2fd6154275.cfargotunnel.com
Created via cloudflared tunnel create on lastvet-edge (account cert only; no lastvet-edge ingress change)
BWS REALOUTCOMES_APP_EDGE_TUNNEL_ID, REALOUTCOMES_APP_EDGE_TUNNEL_CNAME, REALOUTCOMES_APP_EDGE_CLOUDFLARED_TUNNEL_CREDENTIALS

S3-2 — cloudflared on VM 116

Check Result
Host realoutcomes-app (192.168.1.99)
Package cloudflared 2026.8.2
systemd cloudflared.service active (running), enabled
Config /etc/cloudflared/config.yml
Credentials /etc/cloudflared/643ea255-19c7-4cef-a154-7a2fd6154275.json
Script scripts/realoutcomes/install-realoutcomes-edge-cloudflared.sh

S3-3 — Ingress validated

ingress:
  - hostname: realoutcomes.app
    service: http://192.168.1.99:5000
  - hostname: www.realoutcomes.app
    service: http://192.168.1.99:5000
  - service: http_status:404
Check Result
cloudflared tunnel ingress validate OK
Connector on VM 116 1 active (lax + san edge)
lastvet-edge config Unchanged (0 realoutcomes routes)
last1id-edge Untouched

Anomaly (fixed): Initial install used 127.0.0.1:5000 but Docker binds 192.168.1.99:5000. Origin updated to LAN bind; local app returns 200.

Note: Tunnel will not serve public traffic until Ryan points DNS (S3-5).

S3-4 — App config + Stripe prep

BWS / env (VM 116 realoutcomes-app)

Variable Value
PUBLIC_URL https://realoutcomes.app
LAST1_OAUTH_REDIRECT_URI https://realoutcomes.app/auth/callback
STRIPE_WEBHOOK_SECRET Rotated (new whsec_… in BWS; not logged here)

OAuth (auth.last1.id)

app_clients for realoutcomes already includes prod callback from Gate A plus LAN + localhost allow-list. No change required for S3-4.

Stripe webhook (GG 29615730)

Item Value
Old endpoint we_1TLT7MJBZ5q5XOPpe8rF3Ukn (deleted)
New endpoint we_1U9Y7mJBZ5q5XOPp4iRBYUfp
Dashboard URL https://realoutcomes.app/api/stripe/webhook (unchanged)
Events checkout.session.completed, customer.subscription.*
BWS REALOUTCOMES_APP_PROD_STRIPE_WEBHOOK_SECRET updated; REALOUTCOMES_APP_PROD_STRIPE_WEBHOOK_ENDPOINT_ID added

Stripe dashboard URL: NOT changed (still realoutcomes.app → currently Railway until DNS cutover).

Anomaly (expected): Secret rotation invalidates the old signing secret. Railway still holds the old secret until teardown; Stripe webhooks to realoutcomes.app will fail signature verification on Railway until S3-5 DNS cutover routes traffic to R940 (which has the new secret). Acceptable in sprint mode (pre-user); no Stripe dashboard URL edit needed at S3-4.

At S3-5/S3-6: No Stripe URL change required (URL already correct). Verify webhook deliveries hit R940 after DNS.

Deploy

deploy-realoutcomes-app.sh re-run after env render. LAN smoke: GET / 200, GET /api/auth/user 401.

Constraints verified

Constraint Status
No DNS changes PASS
No Railway teardown PASS
No hosted Supabase changes PASS
lastvet-edge ingress untouched PASS
last1id-edge untouched PASS
cloudflared on VM 116 only PASS
VM 117 Kong LAN-only PASS (no tunnel route added)

Ready for S3-5 (Ryan action)

When approved for DNS cutover:

  1. Cloudflare DNS (proxied CNAME):
  2. realoutcomes.app → 643ea255-19c7-4cef-a154-7a2fd6154275.cfargotunnel.com
  3. www.realoutcomes.app → same (if www is used)
  4. Reply S3-5 go or DNS ready
  5. Cursor runs PF checks + browser smoke on https://realoutcomes.app

Rollback before DNS: stop cloudflared on VM 116; prod traffic unchanged on Railway.

END S3-4 report