pal-e-docs

Review: Set up westsidekingsandqueens.com via Hetzner edge proxy

review-1607-2026-06-24-r2 Review

review approved
Project

Verdict: APPROVED

Re-review of board item #1607. Prior review (review-1607-2026-06-24) returned NEEDS_REFINEMENT with 8 BODY fixes, 1 LABEL fix, 2 SCOPE items. All 9 BODY+LABEL issues have been resolved. The issue has been completely rewritten with correct file targets, correct repo scope, and accurate patterns. Two SCOPE items (backing notes) remain as non-blocking documentation recommendations.

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — references #54, story WS-AUTH
  • [x] Repo — forgejo_admin/pal-e-platform (minor: actual org is ldraney, not forgejo_admin)
  • [x] User Story — present, clear actor/want/so-that
  • [x] Context — clear, references landscaping-assistant.app pattern, explains architecture
  • [x] File Targets — 2 targets verified, plus explicit "should NOT touch" list
  • [x] Feature Flag — "none" (correct for infra work)
  • [x] Acceptance Criteria — 6 criteria, all testable
  • [x] Test Expectations — 4 items with real commands
  • [x] Constraints — present, accurate
  • [x] Checklist — present, includes terraform plan and salt state
  • [x] Related — present, references #54 and #57

Traceability

  • [x] story:WS-AUTH label — present on board item
  • [ ] story note MISSING — WS-AUTH does not exist in project-westside-basketball user-stories section. The concept is valid (public URL enables auth flow), but no formal entry exists. [SCOPE] Create WS-AUTH user story entry on project-westside-basketball user-stories section.
  • [x] arch:hetzner-proxy label — present on board item
  • [ ] arch note MISSING — arch-hetzner-proxy note does not exist in pal-e-docs. [SCOPE] Create architecture note arch-hetzner-proxy documenting the GoDaddy DNS → Hetzner Caddy edge proxy → Tailscale → k8s pattern.
  • [x] Forgejo issue — ldraney/westside-basketball#56, open

File Targets

  • [x] pal-e-platform/terraform/dns.tf — verified: godaddy_dns_record.landscaping_assistant_a at line 12 is the exact pattern to follow. File exists, pattern confirmed.
  • [x] pal-e-platform/salt/pillar/caddy.sls — verified: landscaping site entry at line 17-20 is the exact pattern to follow. File exists, pattern confirmed.
  • [x] "Should NOT touch" list — correctly excludes godaddy-tofu/ (provider repo), pal-e-services/, and pal-e-deployments/.

Prior Review Issues — Resolution Status

  • [x] [BODY] godaddy-tofu → pal-e-platform/terraform/dns.tf — FIXED
  • [x] [BODY] vague proxy config → salt/pillar/caddy.sls — FIXED
  • [x] [BODY] remove TLS cert provisioning target — FIXED (Caddy handles ACME)
  • [x] [BODY] clarify/remove pal-e-deployments target — FIXED (moved to "should NOT touch")
  • [x] [BODY] remove pal-e-services target — FIXED (moved to "should NOT touch")
  • [x] [BODY] remove ~/secrets/stripe constraint — FIXED
  • [x] [BODY] add Salt highstate / terraform apply AC — FIXED (in AC and Checklist)
  • [x] [BODY] fix WS-S7 lineage reference — FIXED (now says WS-AUTH)
  • [x] [LABEL] remove depends:godaddy-tofu — FIXED (label removed from board item)

Repo Placement

Issue filed on westside-basketball, actual work in pal-e-platform. Acceptable as a cross-repo feature issue filed against the consuming project. The issue now correctly identifies only pal-e-platform as the target repo. Minor note: Repo field says forgejo_admin/pal-e-platform but actual owner is ldraney — cosmetic, not blocking.

Dependencies

  • Board item #1608 ("Update Keycloak redirect URIs") has depends:56 — correctly depends on this ticket.
  • Board item #1605 ("Add Keycloak auth") is the story parent (story:WS-AUTH).
  • No blocking dependencies for this ticket — it can proceed independently.
  • Dependency chain documented in Related section (#54, #57).

Acceptance Criteria

6 criteria, all agent-verifiable. Test commands are real (dig, curl -vI, curl -sI). Salt state application is covered in AC #6. Terraform plan is covered in Checklist. Complete and testable.

Blast Radius

Low. Adding a new DNS record and a new Caddy site entry follows the exact pattern of 2 existing sites (palinks.app, landscaping-assistant.app). Caddyfile.j2 template iterates over pillar data — new entries cannot break existing sites. No changes to existing entries.

Decomposition Assessment

2 file edits in 1 repo. 6 AC (within limit). Estimated agent time: 2-3 minutes. Well within 5-minute rule. No decomposition needed.

Recommendations

  • [BODY] Minor: Fix Repo field from forgejo_admin/pal-e-platform to ldraney/pal-e-platform (cosmetic, non-blocking)
  • [SCOPE] Create user story entry WS-AUTH on project-westside-basketball user-stories section — the concept is valid but no formal entry exists yet. Can be done in parallel with or after this ticket.
  • [SCOPE] Create architecture note arch-hetzner-proxy documenting the GoDaddy DNS → Hetzner Caddy edge proxy → Tailscale → k8s pattern. Can be done in parallel with or after this ticket.