pal-e-docs

Review: Update KEYCLOAK_URL for landscaping-assistant

review-1483-2026-06-17 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type — Feature
  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Feature Flag — None (acceptable)
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related
All required sections for a Feature issue are present. Template is complete.

Traceability

  • [x] story:custom-domains label — present on board item
  • [ ] story note MISSING — story:custom-domains is not listed in the project-pal-e-platform user-stories section. The user stories table only contains story keys: superuser-deploy, superuser-observe, superuser-recover, superuser-onboard-service, superuser-remote-access, superuser-sso, superuser-unified-ui, superuser-docs-frontend. [SCOPE] Create user story entry for story:custom-domains on project-pal-e-platform user-stories section.
  • [x] arch:keycloak label — present on board item
  • [ ] arch note MISSING — search for arch-keycloak in pal-e-docs returned zero results. [SCOPE] Create architecture note arch-keycloak for the Keycloak component.
  • [x] Forgejo issue — ldraney/pal-e-services#121, state: open

File Targets

  • [ ] SOPS-encrypted secret for landscaping-assistant — ISSUE: The issue body states "SOPS-encrypted secret in pal-e-deployments needs to be updated" but no secrets.enc.yaml file exists for landscaping-assistant in pal-e-deployments/overlays/landscaping-assistant/prod/. That directory only contains deployment-patch.yaml and kustomization.yaml. The landscaping-assistant-secrets Kubernetes Secret is referenced via secretKeyRef in the deployment patch but is not managed by any file in this repo or by Terraform in pal-e-services. It appears to have been created manually via kubectl. The fix requires either: (a) creating a new secrets.enc.yaml following the pattern used by believers-elite and palinks, or (b) identifying where the secret is actually managed. [BODY] Fix file target description — the SOPS secret file does not exist; clarify whether the task is to create a new secrets.enc.yaml or to update an existing secret via another mechanism.

Repo Placement

MISMATCH: The Forgejo issue is filed on ldraney/pal-e-services but the actual file change (SOPS secret or deployment patch) lives in ldraney/pal-e-deployments. The deployment-patch.yaml at ~/pal-e-deployments/overlays/landscaping-assistant/prod/deployment-patch.yaml references KEYCLOAK_URL via secretKeyRef from landscaping-assistant-secrets. The fix must happen in pal-e-deployments (or wherever the secret is managed), not pal-e-services. [BODY] Correct the Repo field from ldraney/pal-e-services to ldraney/pal-e-deployments.

Dependencies

  • pal-e-services#120 (CI pipeline) — Forgejo state: open (title says "CLOSED" but state is open; may need cleanup). Documented in Lineage and Constraints.
  • pal-e-platform#454 (Keycloak public ingress IaC — KC_HOSTNAME removal + Caddy config) — Forgejo state: open. Board item #1482, in backlog. This is a hard dependency per Constraints section: "Must be applied AFTER pal-e-platform#454." Both dependencies are still open, so this ticket is blocked.
  • godaddy-tofu#36 — docs, soft dependency, not blocking.
Dependencies are well-documented in the issue. Both hard dependencies (#120 and #454) are still open.

Acceptance Criteria

Four acceptance criteria plus two test expectations. Criteria are verifiable:
  • AC1 (KEYCLOAK_URL value check) — verifiable via secret inspection
  • AC2 (ArgoCD sync) — verifiable via ArgoCD UI/CLI
  • AC3 (login redirect check) — verifiable via curl, as documented in Test Expectations
  • AC4 (internal Tailscale access) — verifiable but vague; should specify which endpoint to test
Test commands in Test Expectations are real and actionable. Overall criteria are adequate for a 1-point ticket.

Blast Radius

westsidekingsandqueens has AUTH_KEYCLOAK_ISSUER hard-coded to https://keycloak.tail5b443a.ts.net/realms/westside-basketball in its deployment-patch.yaml. If the platform goal is to move all Keycloak URLs to the public domain, this service will need a similar update. The issue correctly scopes the change to landscaping-assistant only ("This change only affects landscaping-assistant, not other apps"), but the blast radius note should acknowledge that westside will need a follow-up ticket.

Decomposition Assessment

1 file target (once clarified), 1 repo, 4 acceptance criteria, estimated <5 minutes of agent work. No decomposition needed.

Recommendations

  • [BODY] Fix repo field: ldraney/pal-e-services → ldraney/pal-e-deployments
  • [BODY] Fix file target: the SOPS-encrypted secret file does not exist at pal-e-deployments/overlays/landscaping-assistant/prod/. Clarify whether the task is to (a) create a new secrets.enc.yaml following the believers-elite/palinks pattern, or (b) update the existing manually-created secret via another mechanism. Provide the exact file path.
  • [SCOPE] Create user story entry for story:custom-domains on the project-pal-e-platform user-stories section.
  • [SCOPE] Create architecture note arch-keycloak for the Keycloak component.