pal-e-docs

Review: Infra: Dockerfile, pipeline, IaC, Tailscale Funnel, godaddy-tofu DNS, deploy to prod

review-1522-2026-06-20 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- Standalone, follows #1
  • [x] Repo -- ldraney/the-avatar-brothers
  • [x] User Story -- present and well-formed
  • [x] Context -- good background, references three-repo pattern
  • [x] File Targets -- present with create/modify/do-not-touch sections
  • [x] Feature Flag -- none (correct for infra work)
  • [x] Acceptance Criteria -- 6 items, all testable
  • [x] Test Expectations -- present with run command
  • [x] Constraints -- present, references patterns and base images
  • [x] Checklist -- present with multi-repo PR tracking
  • [x] Related -- present
All required sections present. Template is complete.

Traceability

  • [x] story:project-bootstrap label -- present on board item
  • [x] story note verified -- "project-bootstrap" found in project-the-avatar-brothers user-stories section (Key: project-bootstrap, Role: Developer (Lucas), Summary: Docs, infra, and pipeline deployed)
  • [x] arch:iac label -- present on board item
  • [ ] arch note MISSING -- [SCOPE] No "arch-iac" note found in pal-e-docs. Create architecture note arch-iac documenting the IaC component (or confirm a different slug exists for this concern).
  • [x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/the-avatar-brothers/issues/2, state: open

File Targets

In the-avatar-brothers repo (currently only has docs -- CLAUDE.md, README.md, docs/):
  • [x] Dockerfile -- to create (does not exist yet, correct)
  • [x] .woodpecker.yaml -- to create (does not exist yet, correct)
  • [x] docker-compose.yml -- to create (does not exist yet, correct)
  • [x] Gemfile / Gemfile.lock -- to create (does not exist yet, correct)
  • [x] Full Rails app skeleton -- to create (correct, repo is docs-only currently)
  • [x] bin/setup -- to create (does not exist yet, correct)
Reference implementation verified: landscaping-assistant has all four reference files (Dockerfile, .woodpecker.yaml, docker-compose.yml, bin/setup).
In pal-e-services:
  • [ ] k3s.tfvars -- ISSUE: The issue says "k3s.tfvars" but the repo only has terraform/k3s.tfvars.example. The actual k3s.tfvars is gitignored (contains secrets). The service entry is driven by var.services in terraform/services.tf. The agent needs to add the service to the tfvars locally and run tofu apply, not open a PR for this file. [BODY] Clarify: "Add the-avatar-brothers to var.services in k3s.tfvars (local, not PR -- file is gitignored). Run tofu apply to provision Harbor project, robot accounts, namespace, ArgoCD app, and funnel."
In pal-e-deployments:
  • [x] overlays/the-avatar-brothers/prod/ -- to create. Pattern verified: overlays/ directory exists with 12+ existing service overlays. landscaping-assistant/prod/ has deployment-patch.yaml, kustomization.yaml, secrets.enc.yaml as reference.
In pal-e-platform:
  • [x] network-policies.tf -- to modify. File exists at terraform/network-policies.tf. Correct target for postgres access allowlist.
Missing from File Targets:
  • [ ] godaddy-tofu DNS -- ISSUE: The ticket title says "godaddy-tofu DNS" but no godaddy-tofu file targets are listed. The godaddy-tofu repo exists and has DNS record resources. [BODY] Add godaddy-tofu file target or remove DNS from scope (split to separate ticket).

Repo Placement

Issue is filed on ldraney/the-avatar-brothers which is correct as the primary repo. The issue correctly identifies work spanning 4 repos (the-avatar-brothers, pal-e-services, pal-e-deployments, pal-e-platform). However, godaddy-tofu is mentioned in the title but not in File Targets, making it a 5th repo if DNS is in scope.
The Checklist section correctly tracks 4 separate PRs. If godaddy-tofu is in scope, a 5th PR line is needed.

Dependencies

  • [x] #1 (Docs) -- in done column. No blocker.
  • Board item #1541 "Hello world: Meet Lucas & Marcus landing page" (backlog, 3pts) depends on this infra ticket -- it needs the deployed pipeline to serve a page. Not documented in either ticket's scope.
  • Board item #1525 "Spike: iOS app deployment" (backlog, 3pts) depends on infra being deployed. Not documented.
  • pal-e-services tofu apply requires admin access to the k3s cluster and Harbor. Not a code dependency but an operational one.

Acceptance Criteria

6 acceptance criteria. All are testable by an agent:
  • [x] docker compose up on port 7143 -- verifiable
  • [x] Woodpecker pipeline passes -- verifiable via woodpecker MCP
  • [x] Harbor image pushed -- verifiable via Harbor API
  • [x] ArgoCD syncs -- verifiable via ArgoCD
  • [x] Tailscale Funnel URL shows page -- verifiable via curl
  • [x] Health check /up responds 200 -- verifiable via curl
Missing: No AC for godaddy-tofu DNS (theavatarbrothers.com resolving) despite being in the title.

Blast Radius

Low blast radius for existing services. Changes to pal-e-platform network-policies.tf could affect other services if the allowlist is misconfigured, but each service gets its own entry. The pal-e-services tofu apply provisions new resources only (for_each on var.services). No existing services are modified.

Decomposition Assessment

NEEDS DECOMPOSITION -- route to skill-decompose-ticket.
  • File count: 10+ files to create across 4-5 repos (exceeds >3 files across >2 repos threshold)
  • AC count: 6 acceptance criteria (exceeds >5 threshold)
  • Estimated time: Well over 5 minutes -- Rails scaffold + Dockerfile + Woodpecker pipeline + kustomize overlay + network policies + tofu apply + DNS. Each repo needs its own PR.
  • Recommended decomposition:

Recommendations

  • [BODY] Fix file target: "k3s.tfvars" is gitignored. Clarify that the agent should add the service to the local k3s.tfvars and run tofu apply, not open a PR for that file. Or reference terraform/services.tf for the pattern.
  • [BODY] Add godaddy-tofu file targets (DNS record for theavatarbrothers.com) or remove "godaddy-tofu DNS" from scope and split to a separate ticket.
  • [BODY] Add missing AC for DNS resolution if DNS stays in scope.
  • [SCOPE] Create architecture note arch-iac documenting the IaC component across the platform.
  • [DECOMPOSE] 10+ files across 4-5 repos, 6 AC, estimated well over 5 minutes. Route to skill-decompose-ticket for sub-ticket creation.