Re-Review: Infra: Dockerfile, pipeline, IaC, Tailscale Funnel, godaddy-tofu DNS, deploy to prod

Verdict: NEEDS_REFINEMENT

Previous Findings Disposition

• [x] [BODY] k3s.tfvars clarification -- RESOLVED. Issue now explicitly states "local tofu apply, NOT a PR" and specifies full path ~/secrets/pal-e-services/k3s.tfvars with what tofu apply provisions.
• [x] [BODY] godaddy-tofu file targets -- RESOLVED. DNS targets now listed under pal-e-platform: terraform/dns.tf with godaddy_dns_record for theavatarbrothers.com pointing to module.hetzner_edge.server_ipv4. Also added salt/pillar/caddy.sls reverse proxy entry.
• [x] [BODY] Missing AC for DNS -- RESOLVED. AC now includes "theavatarbrothers.com resolves and serves the app via Caddy reverse proxy" and "CNPG databases created (primary, cache, queue, cable)". Total: 8 AC.
• [ ] [SCOPE] Create arch-iac note -- STILL MISSING. No arch-iac note exists in pal-e-docs. Carried forward.
• [ ] [DECOMPOSE] Decomposition needed -- STILL APPLIES. Issue now has 8 AC (up from 6) across 4 repos with 10+ files. Exceeds all 5-minute rule thresholds.

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- Standalone, follows docs ticket (#1)
• [x] Repo -- ldraney/the-avatar-brothers (primary), with pal-e-deployments, pal-e-platform, pal-e-services identified
• [x] User Story -- well-formed (developer wants CI/CD + prod deployment)
• [x] Context -- excellent: references three-repo IaC pattern, explains no Keycloak, lists all infrastructure components
• [x] File Targets -- comprehensive with create/modify/do-not-touch sections across all 4 repos
• [x] Feature Flag -- none (correct for infra work)
• [x] Acceptance Criteria -- 8 items, all testable
• [x] Test Expectations -- present with run command (bundle exec rspec)
• [x] Constraints -- present, references patterns, base images, port convention
• [x] Checklist -- present with multi-repo PR tracking (4 items: 3 PRs + 1 local tofu apply)
• [x] Related -- present (the-avatar-brothers, landscaping-assistant reference)

Traceability

• [x] story:project-bootstrap label -- present on board item
• [x] story note verified -- "project-bootstrap" found in project-the-avatar-brothers user-stories section (Key: project-bootstrap, Role: Developer (Lucas), Summary: "Docs, infra, and pipeline deployed", Metric: "theavatarbrothers.com serves a page, CI/CD works")
• [x] arch:iac label -- present on board item
• [ ] arch note MISSING -- [SCOPE] No arch-iac note found in pal-e-docs. Create architecture note arch-iac documenting the IaC component.
• [x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/the-avatar-brothers/issues/2, state: open

File Targets

• [x] Dockerfile -- to create. Harbor base images confirmed: harbor.tail5b443a.ts.net/library/ruby-rails-build:latest and ruby-rails-runtime:latest
• [x] .woodpecker.yaml -- to create
• [x] docker-compose.yml -- to create
• [x] Gemfile / Gemfile.lock -- to create
• [x] Full Rails app skeleton -- to create
• [x] bin/setup -- to create

• [x] ~/secrets/pal-e-services/k3s.tfvars -- correctly identified as local-only (gitignored). Add to services map and service_databases map. Run tofu apply -var-file=k3s.tfvars.

• [x] overlays/the-avatar-brothers/prod/kustomization.yaml -- to create. Reference verified: landscaping-assistant/prod/ has kustomization.yaml, deployment-patch.yaml, secrets.enc.yaml.
• [x] overlays/the-avatar-brothers/prod/deployment-patch.yaml -- to create
• [x] overlays/the-avatar-brothers/prod/secrets.enc.yaml -- to create (SOPS-encrypted)

• [x] terraform/network-policies.tf -- verified exists. Contains per-namespace NetworkPolicy resources with explicit ingress allowlists. Correct target.
• [x] terraform/dns.tf -- verified exists. Contains godaddy_dns_record resources for palinks.app and landscaping-assistant.app with module.hetzner_edge.server_ipv4. Pattern matches what the issue describes.
• [x] salt/pillar/caddy.sls -- verified exists. Contains site entries with domain, proxy_target (Tailscale hostname), and www_redirect. Pattern matches what the issue describes for theavatarbrothers.com.

Repo Placement

Dependencies

• [x] #1 (Docs) -- in done column. No blocker.
• #1541 "Hello world: Meet Lucas & Marcus landing page" (backlog, 3pts) -- depends on this infra ticket (needs deployed pipeline to serve a page). Not documented in either ticket but implicit from the project-bootstrap story.
• #1525 "Spike: iOS app deployment" (backlog, 3pts) -- depends on infra being deployed. Not documented.
• Operational: tofu apply requires admin access to k3s cluster and Harbor. Not a code dependency.

Acceptance Criteria

• [x] docker compose up on port 7143 -- verifiable locally
• [x] Woodpecker pipeline passes (lint, test, build) -- verifiable via Woodpecker MCP
• [x] Harbor image pushed on main merge -- verifiable via Harbor API
• [x] ArgoCD syncs and deploys -- verifiable via ArgoCD
• [x] Tailscale Funnel URL shows page -- verifiable via curl
• [x] theavatarbrothers.com resolves and serves via Caddy -- verifiable via curl/dig
• [x] Health check /up responds 200 -- verifiable via curl
• [x] CNPG databases created (primary, cache, queue, cable) -- verifiable via kubectl/psql

Blast Radius

Decomposition Assessment

• File count: 10+ files to create/modify across 4 repos (exceeds >3 files across >2 repos)
• AC count: 8 acceptance criteria (exceeds >5 threshold)
• Estimated time: Well over 5 minutes -- Rails scaffold + Dockerfile + Woodpecker + kustomize overlay + network policies + DNS + Caddy + tofu apply
• Recommended decomposition:

Recommendations

• [SCOPE] Create architecture note arch-iac documenting the IaC component across the platform. This is a cross-project concern (not specific to this ticket) but the arch:iac label on multiple board items across multiple projects needs a backing note.
• [DECOMPOSE] 10+ files across 4 repos, 8 AC, estimated well over 5 minutes. Route to skill-decompose-ticket for sub-ticket creation. Recommended 4-way split above.