pal-e-docs

Review: pal-e-platform DNS record + Caddy vhost for dev.intelligentstaffingsystems.ai

review-1870-2026-07-17 Review

review ready
Project

Verdict: READY

Board item #1870 — ldraney/intelligentstaffingsystems#79. Type: Feature. Points: 2. Sprint B, decomp of #1868 (#77).
Issue body was updated during this review to resolve two [BODY] gaps (proxy_target dependency, sibling links). After fixes, scope is solid and implementable.

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — Sub-ticket of #77
  • [x] Repo — ldraney/pal-e-platform
  • [x] User Story
  • [x] Context — updated to include dev-tunnel dependency on #78
  • [x] File Targets — updated: CNAME clarification, proxy_target source documented
  • [x] Feature Flag — none (infrastructure)
  • [x] Acceptance Criteria — 4 items, all testable
  • [x] Test Expectations — terraform plan + dig
  • [x] Constraints — includes blocker on #78
  • [x] Checklist
  • [x] Related — updated: siblings #78 (blocker), #80 linked

Traceability

  • [x] story:project-setup label — verified in project-iss user-stories table ("Repo, docs, infra, and CI exist; sprints can dispatch")
  • [x] story note verified — found in project-iss user-stories section
  • [x] arch:infra label — present on board item
  • [ ] arch note MISSING — no arch-infra note exists in pal-e-docs. [SCOPE] This is a project-wide gap (many tickets use arch:infra), not specific to this ticket. Does not block implementation.
  • [x] Forgejo issue — ldraney/intelligentstaffingsystems#79, open

File Targets

  • [x] terraform/dns.tf — verified: file exists in pal-e-platform. Contains existing ISS records (iss_a apex A record, iss_www CNAME). The www CNAME pattern (name = "www", data = "intelligentstaffingsystems.ai") is the correct reference for the dev subdomain CNAME.
  • [x] salt/pillar/caddy.sls — verified: file exists in pal-e-platform. Contains existing ISS vhost (domain: intelligentstaffingsystems.ai, proxy_target: intelligentstaffingsystems.tail5b443a.ts.net). New dev entry follows same structure; proxy_target comes from #78's dev-tunnel hostname.

Repo Placement

Issue filed on ldraney/intelligentstaffingsystems but all code changes are in ldraney/pal-e-platform. The ### Repo section correctly identifies pal-e-platform, and the checklist says "PR opened on pal-e-platform". This cross-repo filing is consistent with the ISS board tracking all ISS-related work. Acceptable.

Dependencies

  • #77 (parent, board #1868) — deployment overlays umbrella, in todo
  • #78 (sibling, board #1869) — pal-e-deployments dev overlay; blocker — provides the dev-tunnel Tailscale hostname needed as Caddy proxy_target. In backlog.
  • #80 (sibling, board #1871) — ISS repo Makefile + docs. No dependency in either direction.
  • PR #534 (pal-e-platform) — wired apex domain. Done; serves as reference pattern.
  • #4 (board #1783) — service registration in pal-e-services. Done.
Dependencies now documented in issue body (Constraints + Related sections).

Acceptance Criteria

4 criteria, all verifiable:
  • AC1: CNAME record in dns.tf — agent can verify by reading file after edit
  • AC2: Caddy vhost in caddy.sls — agent can verify by reading file after edit
  • AC3: dig resolution — requires post-apply infra access, appropriate for infra ticket
  • AC4: Dev environment accessible — requires runtime verification with dev tunnel active, appropriate for infra ticket

Blast Radius

Low. Adding a DNS CNAME record and a Caddy vhost entry are both additive operations that don't affect existing entries. The 6 existing Caddy sites and all existing DNS records remain unchanged. No downstream consumers affected.

Decomposition Assessment

2 file targets in 1 repo. 4 acceptance criteria. Estimated agent work well under 5 minutes (add one DNS resource block, add one Caddy site entry). No decomposition needed.

Recommendation

  • [SCOPE] Create architecture note arch-infra in pal-e-docs for the infra component. This is a project-wide gap affecting multiple tickets, not specific to #79.
All [BODY] issues resolved during this review. Ticket is implementable once #78 provides the dev-tunnel Tailscale hostname.

Fixes Applied During Review

  • [BODY] Clarified DNS record type: CNAME pointing to apex (follows www pattern in dns.tf)
  • [BODY] Documented that Caddy proxy_target depends on #78's dev-tunnel Tailscale hostname
  • [BODY] Added Context paragraph explaining dev-tunnel dependency
  • [BODY] Added #78 as blocker in Constraints section
  • [BODY] Added #78 (blocker) and #80 (sibling) to Related section
  • [BODY] Updated AC1 to say "CNAME" instead of ambiguous "DNS record"
  • [BODY] Updated AC2 to mention "correct proxy_target"