pal-e-docs

Review: Set up westsidekingsandqueens.com via Hetzner edge proxy

review-1607-2026-06-24 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — references #54, story WS-S7
  • [x] Repo — cross-repo listed
  • [x] User Story — present
  • [x] Context — clear, references landscaping-assistant.app pattern
  • [x] File Targets — present (but inaccurate, see below)
  • [x] Feature Flag — "none" (correct for infra work)
  • [x] Acceptance Criteria — 6 criteria, testable
  • [x] Test Expectations — 4 items with real commands
  • [x] Constraints — present
  • [x] Checklist — present
  • [x] Related — present

Traceability

  • [ ] story:WS-AUTH label — MISSING from project page. The project-westside-basketball user-stories section has no WS-AUTH entry. The issue body references WS-S7, but WS-S7 is "As an admin, I want to send branded email announcements" which does not match this work (public URL/domain setup). [SCOPE] Create a WS-AUTH user story entry on project-westside-basketball user-stories section, or re-map to an existing story that covers public URL access.
  • [x] arch:hetzner-proxy label — present on board item
  • [ ] arch note MISSING — arch-hetzner-proxy note does not exist in pal-e-docs. [SCOPE] Create architecture note arch-hetzner-proxy documenting the GoDaddy DNS → Hetzner edge proxy (Caddy) → Tailscale → k8s pattern.
  • [x] Forgejo issue — ldraney/westside-basketball#56, open

File Targets

  • [ ] godaddy-tofu DNS A record — WRONG REPO. godaddy-tofu is a custom Terraform provider (Go source code at ~/godaddy-tofu/: main.go, provider.go, resource_dns_record.go). DNS A records are managed in pal-e-platform/terraform/dns.tf using godaddy_dns_record resources. The reference implementation is godaddy_dns_record.landscaping_assistant_a at line 12 of that file. [BODY] Fix file target: godaddy-tofu → pal-e-platform/terraform/dns.tf
  • [ ] pal-e-platform Hetzner edge proxy config (nginx/caddy) — INCOMPLETE. The proxy config is managed via Salt, not raw config files. Actual targets are: pal-e-platform/salt/pillar/caddy.sls (add a new site entry matching the landscaping entry pattern) and optionally pal-e-platform/salt/states/caddy/Caddyfile.j2 (no changes needed, template is generic). [BODY] Fix file target: replace vague "Hetzner edge proxy config" with pal-e-platform/salt/pillar/caddy.sls
  • [ ] pal-e-platform TLS cert provisioning — NOT NEEDED as separate target. Caddy handles ACME/Let's Encrypt automatically. No cert-manager or manual TLS config required. The Caddyfile.j2 template auto-provisions TLS for each site block. [BODY] Remove TLS cert provisioning file target — Caddy handles this automatically via ACME
  • [ ] pal-e-deployments ArgoCD overlay — NEEDS CLARIFICATION. The overlay already exists at overlays/westsidekingsandqueens/prod/ with a Tailscale funnel ingress. The prod kustomization.yaml comments out ingress ("ingress.yaml removed — westsidekingsandqueens URL now served by westside-ror namespace"). Unclear what change is needed here — the ingress is already configured for Tailscale funnel. If the intent is to accept the new public hostname, that's a Rails config.hosts change (which the ticket explicitly excludes). [BODY] Clarify what pal-e-deployments change is needed, or remove this file target if no overlay change is required.
  • [ ] pal-e-services service onboarding — NO MECHANISM EXISTS. pal-e-services has no domain onboarding config, no YAML/TF files referencing any domains. The repo contains only terraform/ and docs. [BODY] Remove pal-e-services file target — no domain onboarding mechanism exists in this repo.

Repo Placement

Issue is filed on westside-basketball but the actual work is entirely in pal-e-platform (dns.tf + salt/pillar/caddy.sls). This is acceptable as a cross-repo feature issue filed against the consuming project, but the file targets must be corrected to point to the right repos and paths.
The ticket claims 4 repos (godaddy-tofu, pal-e-platform, pal-e-services, pal-e-deployments). Actual repos affected: 1 (pal-e-platform). godaddy-tofu is the provider, not a target. pal-e-services has no relevant config. pal-e-deployments overlay already exists.

Dependencies

  • depends:godaddy-tofu label is misleading — godaddy-tofu is the Terraform provider (a build dependency), not a blocking ticket. The provider already exists and works (dns.tf uses it for palinks.app and landscaping-assistant.app). [LABEL] Change depends:godaddy-tofu to something more accurate, or remove — there is no blocking dependency.
  • Board item #1608 ("Update Keycloak redirect URIs to westsidekingsandqueens.com") has depends:56 label — correctly depends on this ticket.
  • Board item #1605 ("Add Keycloak auth with admin/parent/player roles") is the story parent (story:WS-AUTH).
  • Issue body references #54 (Keycloak auth needs public URL) and #57 (Keycloak redirect URLs depends on this) — dependency chain is documented in the issue.

Acceptance Criteria

6 criteria, all testable. The test commands are real and verifiable (dig, curl -vI, curl -sI). One gap: no AC for the Salt highstate application (how the Caddy config gets deployed to the Hetzner edge proxy). An agent could verify DNS and TLS after deployment, but needs to know that salt '*edge*' state.highstate (or equivalent) must be run to apply the Caddy config.

Blast Radius

Low blast radius. Adding a new site entry to caddy.sls and a new DNS record to dns.tf follows the exact same pattern as the two existing sites (palinks.app, landscaping-assistant.app). No changes to existing entries. The Caddyfile.j2 template is generic and iterates over pillar data — adding a site entry cannot break existing sites.
One consideration: the ticket mentions ~/secrets/stripe under Constraints ("Reference ~/secrets/stripe for any secrets that need the new domain"). This is irrelevant to DNS/proxy setup and may confuse an agent. This constraint should be removed or moved to the Keycloak redirect ticket (#57).

Decomposition Assessment

Despite claiming 4 repos, the actual work is 2 file edits in 1 repo (pal-e-platform): add a DNS record to terraform/dns.tf and add a site entry to salt/pillar/caddy.sls. Plus terraform apply and Salt highstate. Well within the 5-minute rule. No decomposition needed.

Recommendations

  • [BODY] Fix file target: godaddy-tofu → pal-e-platform/terraform/dns.tf (add godaddy_dns_record.westsidekingsandqueens_a matching the landscaping pattern at line 12-18)
  • [BODY] Fix file target: replace vague "Hetzner edge proxy config (nginx/caddy)" with pal-e-platform/salt/pillar/caddy.sls (add westsidekingsandqueens site entry matching the landscaping pattern)
  • [BODY] Remove TLS cert provisioning file target — Caddy handles this automatically via ACME, no manual config needed
  • [BODY] Clarify or remove pal-e-deployments file target — overlay already exists, unclear what changes
  • [BODY] Remove pal-e-services file target — no domain onboarding mechanism exists in this repo
  • [BODY] Remove misleading Constraints reference to ~/secrets/stripe — not relevant to DNS/proxy setup
  • [BODY] Add AC or constraint: "Run Salt highstate on edge-proxy to deploy Caddy config" and "Run terraform apply in pal-e-platform to create DNS record"
  • [BODY] Fix Lineage: WS-S7 reference is wrong — WS-S7 is "branded email announcements", not public URL access
  • [LABEL] Change or remove depends:godaddy-tofu — godaddy-tofu is a provider dependency, not a blocking ticket
  • [SCOPE] Create user story entry WS-AUTH on project-westside-basketball user-stories section (or map to an existing story covering public URL access)
  • [SCOPE] Create architecture note arch-hetzner-proxy documenting the GoDaddy DNS → Hetzner Caddy edge proxy → Tailscale → k8s pattern