# Bilko Environment Topology — Corrected Canonical Reference (2026-06-09)

# Bilko Environment Topology — Corrected Canonical Reference

**As of:** 2026-06-09 | **Authority:** MC #103300 C7 (ZAKON PLAN docs) | **Source:** Tool-verified facts only — no inferred data

---

## 1. Production — Customer-Facing

**CEO Decision (2026-06-09):** Demo Cloud Run services reused as production ($0 new infra). There is no separate prod Cloud Run deployment.

<table id="bkmrk-domaincloud-run-serv"><thead><tr><th>Domain</th><th>Cloud Run Service</th><th>DNS</th><th>TLS</th><th>Database</th></tr></thead><tbody><tr><td>`app.bilko.cloud`</td><td>`bilko-web-demo`</td><td>Cloudflare CNAME → `ghs.googlehosted.com` (grey/DNS-only)</td><td>Google-managed cert (provisioned)</td><td rowspan="2">bilko-demo-db (PostgreSQL 15)</td></tr><tr><td>`app-api.bilko.cloud`</td><td>`bilko-api-demo`</td><td>Cloudflare CNAME → `ghs.googlehosted.com` (grey/DNS-only)</td><td>Google-managed cert (provisioned)</td></tr></tbody></table>

### Self-Serve Onboarding

- Prospect signs up via **Entra External ID (CIAM)** — email OTP flow.
- On first login: JIT provisioning creates an empty RLS tenant + 7-day trial (MC #103232).
- No manual admin action required for new trial sign-ups.

### AI Chatbot

- Tier-router: **Groq → Ollama → Anthropic** (primary → fallback → fallback).
- `GROQ_API_KEY` bound to `bilko-api-demo` Cloud Run service (fixed 2026-06-09).

---

## 2. Marketing Landings (Cloudflare Pages)

<table id="bkmrk-domainapp-%2F-pathcta-"><thead><tr><th>Domain</th><th>App / Path</th><th>CTA destination</th></tr></thead><tbody><tr><td>`bilko.cloud`</td><td>`apps/landing-hr`</td><td>`app.bilko.cloud`</td></tr><tr><td>`bilko.io`</td><td>`apps/landing-io`</td><td>`app.bilko.cloud`</td></tr><tr><td>`bilko.company`</td><td>`apps/landing-ba`</td><td>`app.bilko.cloud`</td></tr></tbody></table>

- Verified live: all register/login CTAs point to `app.bilko.cloud` — zero references to `bilko-demo.alai.no` or legacy domains.
- **Known issue MC #103308 (deploy-dir caveat):** Cloudflare Pages workflow currently deploys the repo root `index.html`, not the Next.js `out/` directory. A manual `wrangler deploy out/` was executed 2026-06-09 as a workaround. Permanent fix tracked in MC #103308.

---

## 3. Stage — UAT + Seed / Demo

<table id="bkmrk-domaincloud-run-serv-1"><thead><tr><th>Domain</th><th>Cloud Run Service</th><th>Database</th><th>Role</th></tr></thead><tbody><tr><td>`bilko-demo.alai.no`</td><td>`bilko-web-stage`</td><td rowspan="2">bilko-staging-db (PostgreSQL 16)</td><td rowspan="2">UAT, internal QA, seeded demo data</td></tr><tr><td>`bilko-demo-api.alai.no`</td><td>`bilko-api-stage`</td></tr></tbody></table>

**Note:** The `bilko-demo.alai.no` and `bilko-demo-api.alai.no` domain mappings remain live and now serve the stage/UAT role (not production-customer-facing).

---

## 4. CI/CD Pipeline

<table id="bkmrk-triggercloud-build-c"><thead><tr><th>Trigger</th><th>Cloud Build Config</th><th>Deploys to</th></tr></thead><tbody><tr><td>Push to `main` branch</td><td>`cloudbuild-stage.yaml`</td><td>Stage (`bilko-web-stage`, `bilko-api-stage`, `bilko-staging-db`)</td></tr><tr><td>Semver tag `vX.Y.Z`</td><td>`cloudbuild.yaml`</td><td>Demo/Prod (`bilko-web-demo`, `bilko-api-demo`, `bilko-demo-db`)</td></tr></tbody></table>

**Known issue MC #103304:** GitHub Actions is currently DOWN due to billing. This affects any workflows running in GitHub Actions; Cloud Build triggers (above) are unaffected.

---

## 5. Known Issues &amp; Orphaned Resources

<table id="bkmrk-mc-%2F-refissuestatus-"><thead><tr><th>MC / Ref</th><th>Issue</th><th>Status</th></tr></thead><tbody><tr><td>MC #103304</td><td>GitHub Actions billing — Actions disabled</td><td>Open</td></tr><tr><td>MC #103308</td><td>Landing deploy-dir: workflow deploys root, not `out/`; manual wrangler deploy applied 2026-06-09</td><td>Open</td></tr><tr><td>MC #103296</td><td>Orphaned OAuth brand / project 762788903040 — not linked to any active service</td><td>Open</td></tr><tr><td>Retired</td><td>`api.bilko.cloud` legacy domain — retired, no active Cloud Run mapping</td><td>Retired 2026-06-09</td></tr><tr><td>Avoided</td><td>Two-V70 migration collision — resolved, no duplicate V70 migration in flight</td><td>Resolved 2026-06-09</td></tr></tbody></table>

---

## 6. Architecture Diagram

```

┌─────────────────────────────────────────────────────────────────────┐
│  PRODUCTION (customer-facing)                                       │
│                                                                     │
│  bilko.cloud ─────┐                                                 │
│  bilko.io ────────┼──► Cloudflare Pages (landing-hr/io/ba)         │
│  bilko.company ───┘         │ CTA                                   │
│                             ▼                                       │
│  app.bilko.cloud ──► [CF DNS-only CNAME] ──► bilko-web-demo        │
│  app-api.bilko.cloud ─► [CF DNS-only CNAME] ──► bilko-api-demo     │
│                                        │              │             │
│                                   Google TLS    bilko-demo-db      │
│                                                   (PG15, RLS)      │
│                                                                     │
│  Entra External ID (CIAM) → email OTP → JIT tenant + 7-day trial  │
│  AI: Groq → Ollama → Anthropic (tier-router)                       │
└─────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────┐
│  STAGE (UAT / internal demo / seeded data)                         │
│                                                                     │
│  bilko-demo.alai.no ────► bilko-web-stage                          │
│  bilko-demo-api.alai.no ─► bilko-api-stage                         │
│                                        │                            │
│                                bilko-staging-db (PG16)             │
└─────────────────────────────────────────────────────────────────────┘

CI/CD:
  push main → cloudbuild-stage.yaml → STAGE
  tag vX.Y.Z → cloudbuild.yaml → DEMO/PROD

```

---

## 7. Decision Log

<table id="bkmrk-datedecisionauthorit"><thead><tr><th>Date</th><th>Decision</th><th>Authority</th></tr></thead><tbody><tr><td>2026-06-09</td><td>Reuse `bilko-web-demo` / `bilko-api-demo` as production endpoints ($0 new infra)</td><td>CEO (Alem Basic)</td></tr><tr><td>2026-06-09</td><td>GROQ\_API\_KEY bound to `bilko-api-demo` (was missing, broke AI chatbot)</td><td>MC #103300 fix</td></tr><tr><td>2026-06-09</td><td>All landing CTA hrefs verified pointing to `app.bilko.cloud`</td><td>MC #103300 C7 verification</td></tr><tr><td>2026-06-09</td><td>Legacy `api.bilko.cloud` domain retired</td><td>MC #103300</td></tr></tbody></table>

---

*Generated by Skillforge (MC #103300 C7). Facts tool-verified in session 2026-06-09. Next review: on any topology change or new domain mapping.*