pal-e-docs

Review: westsidekingsandqueens.com TLS handshake fails (re-review)

review-1614-2026-06-25-r2 Review

review ready
Project

Verdict: APPROVED

Note: Both READY and APPROVED are accepted as passing verdicts by the check-board-advance hook.
Re-review of review-1614-2026-06-25. All 6 previous findings have been addressed.

Previous Findings Resolution

  • Root cause misidentified -- FIXED. Issue body now correctly describes the Caddy edge-proxy to Tailscale funnel chain: DNS A record to Hetzner edge-proxy, Caddy TLS termination via Let's Encrypt, reverse-proxy to tailnet hostname. The root cause section in "What Broke" accurately identifies the missing funnel ingress for the hostname Caddy targets.
  • Missing prod ingress in pal-e-deployments -- FIXED. Issue body now includes a "Scope" section covering both pal-e-platform (Caddy/Salt verification) and pal-e-deployments (prod funnel ingress). The Repo field also lists both repos.
  • Multi-repo scope not documented -- FIXED. Repo field now lists ldraney/pal-e-platform and ldraney/pal-e-deployments. Scope section has separate subsections for each repo's work.
  • arch-tailscale note missing -- FIXED. Note arch-tailscale now exists in pal-e-docs (created 2026-06-26), tagged architecture, networking, tailscale. Covers public domain architecture, funnel ingress pattern, two-hop TLS, and DNS conventions.
  • story label wrong -- FIXED. Board item #1614 now has story:WS-S1 ("As superadmin, I want to deploy platform changes via IaC so that infrastructure is reproducible and auditable") instead of WS-S9 (payment tracking). Confirmed in project-westside-basketball user-stories section under Superadmin.
  • Co-dependency with #1613 documented -- FIXED. Related section now references pal-e-services#148 as a co-dependency with explanation that both bugs must resolve for Sprint 4/5 auth changes to go live.

Template Completeness

  • [x] Type -- Bug
  • [x] Lineage -- Related to pal-e-platform#463 (Sprint 3 proxy setup)
  • [x] Repo -- ldraney/pal-e-platform AND ldraney/pal-e-deployments (both listed)
  • [x] What Broke -- TLS handshake fails with clear error output and accurate root cause chain
  • [x] Repro Steps -- 3 curl commands provided
  • [x] Expected Behavior -- stated clearly
  • [x] Environment -- DNS, edge-proxy, k8s ingresses documented
  • [x] Scope -- file targets for both repos listed with specific paths
  • [x] Acceptance Criteria -- 5 criteria, all testable
  • [x] Related -- project, original issue, co-dependency, arch note all referenced
All required bug template sections present and complete.

Traceability

  • [x] story:WS-S1 label -- "As superadmin, I want to deploy platform changes via IaC so that infrastructure is reproducible and auditable" (Superadmin tier)
  • [x] story note verified -- found in project-westside-basketball user-stories section under Superadmin (Lucas)
  • [x] arch:tailscale label -- Tailscale networking component
  • [x] arch note verified -- arch-tailscale note exists in pal-e-docs (id: 2179, created 2026-06-26). Covers public domain architecture, funnel ingress pattern, two-hop TLS, DNS.
  • [x] Forgejo issue -- ldraney/pal-e-platform#464, state: open

File Targets

  • [x] salt/pillar/caddy.sls (pal-e-platform) -- verified: westside entry exists at HEAD (commit 34fd30d, PR #463) with proxy_target: westside-basketball.tail5b443a.ts.net and www_redirect: true
  • [x] salt/states/caddy/Caddyfile.j2 (pal-e-platform) -- verified: template generates site blocks from pillar data, reverse-proxies to {proxy_target}:443 with TLS server name header
  • [x] salt/states/caddy/init.sls (pal-e-platform) -- verified: manages Caddyfile rendering via Jinja template and Caddy service lifecycle
  • [x] overlays/westside-ror/dev/ingress.yaml (pal-e-deployments) -- verified: dev overlay has funnel ingress pattern with westside-ror hostname, port 3000, tailscale.com/funnel annotation
  • [x] overlays/westside-ror/prod/ (pal-e-deployments) -- verified: prod overlay has kustomization.yaml and deployment-patch.yaml only, NO ingress file. This confirms the scope: a new ingress.yaml needs to be created here.
Additional finding (informational): A separate overlay at overlays/westsidekingsandqueens/prod/ingress.yaml exists with hostname westsidekingsandqueens (resolves to westsidekingsandqueens.tail5b443a.ts.net). This is the "wrong hostname" funnel the issue mentions -- Caddy targets westside-basketball.tail5b443a.ts.net but this ingress serves westsidekingsandqueens.tail5b443a.ts.net. The fix should either add a matching ingress in westside-ror/prod/ with hostname westside-basketball, or update the Caddy pillar to target the existing funnel hostname. The issue's scope correctly identifies this discrepancy.

Repo Placement

CORRECT. Issue is filed on ldraney/pal-e-platform (primary repo for Caddy/Salt/DNS). Scope section explicitly documents work in ldraney/pal-e-deployments as well. A single issue covering both repos is appropriate since the fix is coordinated and small (2 points).

Dependencies

  • Board item #1613 (pal-e-services#148) -- Harbor pull creds bug. Also sprint:5, type:bug, story:WS-S1. Co-dependent: even if TLS/funnel fix lands, pods may be running stale code until Harbor creds are fixed. Documented in issue's Related section.
  • PR #463 (merged, commit 34fd30d) -- Added Caddy pillar entry. Pillar is correct at HEAD. Salt highstate verification is in scope.
  • No blockers preventing this ticket from starting. Both #1613 and #1614 can be worked in parallel.

Acceptance Criteria

5 criteria, all testable:
  • AC #1 ("loads with valid TLS cert") -- verifiable: curl -sv https://westsidekingsandqueens.com 2>&1 | grep "SSL certificate verify ok"
  • AC #2 ("response matches tailnet URL content") -- verifiable: diff response bodies
  • AC #3 ("Caddy config verified") -- verifiable: inspect Caddyfile on edge-proxy
  • AC #4 ("funnel ingress exists in k8s") -- verifiable: kubectl get ingress -n westside-ror
  • AC #5 ("no regression in tailnet URL access") -- verifiable: curl https://westside-ror.tail5b443a.ts.net
Previous review's missing AC (www redirect) was not explicitly added, but the Caddy pillar has www_redirect: true and the template handles it. This is implicitly covered by AC #1 (the Caddy config is data-driven). Not a blocking concern.

Blast Radius

Two other domains use the same Caddy edge-proxy pattern:
  • palinks.app -- proxy_target: palinks.tail5b443a.ts.net. No prod funnel ingress in kustomize overlay either, but palinks works because its funnel ingress is likely managed by Terraform (platform services) or was created manually. Not affected by this fix.
  • landscaping-assistant.app -- proxy_target: landscaping-assistant.tail5b443a.ts.net. Same pattern. Not affected.
The westside-ror case is unique because it has a separate westsidekingsandqueens overlay with a mismatched hostname. No blast radius beyond westside.

Decomposition Assessment

2-3 file changes across 2 repos (ingress.yaml in pal-e-deployments, possible kustomization.yaml update, Salt highstate verification on pal-e-platform). 5 acceptance criteria. Estimated agent work under 5 minutes. No decomposition needed.

Recommendation

No action needed. All previous NEEDS_REFINEMENT findings have been addressed. Scope is solid, traceability complete (story note and arch note both verified), file targets confirmed, multi-repo scope documented, dependencies clear. Ready for todo.