Overview
Status: living document. This section is the canonical record of how a Cogrion region is actually deployed, kept current as regions are stood up and reworked. It links out to the repos that own each piece rather than duplicating their detail — when something here and the linked repo disagree, the repo is correct and this section needs an update. It describes current behavior and known gaps, not a session-by-session log of changes — for progress/status on any item, see the open items index or the linked tracking issue.
Terraform Infrastructure
Global prerequisites (one-time, not per-region)
Networking
Each region's VPC (infra/modules/region-deployment/main.tf, via terraform-aws-modules/vpc) follows the same shape across dev-sgp and prod-sgp. This page describes that shape and the NACL behavior that governs it — see Troubleshooting for the incident that made the NACL's behavior worth documenting explicitly.
GitOps
Once Terraform's root Application exists and points at argocd/apps/, ArgoCD reconciles everything automatically — no further manual steps. Full detail
Control Plane Setup
The API and the UI ship through two entirely different pipelines, which trips people up when they go looking for "the cplane deploy" in one place.
Secret Management
3 items
Authentication
1 item
Troubleshooting
Stale DB credentials after a secret rotation
Teardown
Status: thin, carried over from an earlier draft, not verified against current dev-sgp/prod-sgp state. Flagged in the open items index — treat as a starting checklist, not a confirmed procedure, until someone runs it against a real region.