pal-e-docs

Review: Update terraform refs westside-app to westside-landing

review-588-2026-03-28 Doc

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type
  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related
All 11 sections present.

Traceability

  • [x] story:WS-S26 label
  • [x] arch:landing-site label
  • [x] Forgejo issue -- forgejo_admin/pal-e-services#41, open

File Targets -- ISSUES FOUND

  • [ ] terraform/k3s.tfvars line 41 -- WRONG. Line 41 is the keycloak_clients map key westside-app = {, NOT a service key. The ticket explicitly says "Do NOT rename Keycloak client_id" but then targets the keycloak_clients map key which IS the client_id key. Renaming this map key would require tofu state mv for the Keycloak client resource and would functionally rename the client reference.
  • [x] terraform/k3s.tfvars line 130 -- CORRECT. forgejo_repo = "forgejo_admin/westside-app" in the westsidekingsandqueens ArgoCD apps map. This is the actual rename target.
  • [ ] terraform/keycloak-import.sh lines 13, 28-29 -- WRONG. These references are Keycloak terraform resource keys: keycloak_openid_client.this["westside-app"] and keycloak_openid_user_realm_role_protocol_mapper.realm_roles["westside-app"]. These are keyed by client_id, NOT repo name. Renaming these would break the import script and is inconsistent with the constraint "Do NOT rename Keycloak client_id."
  • [x] terraform/services.tf line 173 -- CORRECT. Comment referencing westside-app-funnel. Cosmetic consistency fix.

Repo Placement

OK -- correctly filed on pal-e-services.

Dependencies

  • [x] Depends on sub-ticket 1 (Forgejo rename) -- documented

Acceptance Criteria

6 criteria. The first criterion ("tfvars service key renamed from westside-app to westside-landing") is wrong -- the service key is westsidekingsandqueens, not westside-app. The keycloak_clients key should NOT be renamed per the ticket's own constraints.

Blast Radius

HIGH if the keycloak_clients map key is renamed. Would require state migration and break the import script. The ticket contradicts itself -- constraints say don't rename client_id, but file targets say rename the keycloak_clients map key.

Decomposition

Once corrected, the actual scope is small: 1 line change in k3s.tfvars (forgejo_repo) + 1 comment in services.tf. Well under 5 minutes.

Recommendation

  • [BODY] Remove k3s.tfvars line 41 from file targets -- this is the keycloak_clients map key, not a service key. The actual rename target is line 130 only.
  • [BODY] Remove keycloak-import.sh (lines 13, 28-29) from file targets -- these are Keycloak resource keys tied to client_id, not repo names. Renaming them contradicts the "Do NOT rename Keycloak client_id" constraint.
  • [BODY] Fix AC #1: remove "tfvars service key renamed" criterion. The service map key is westsidekingsandqueens (unchanged). Only forgejo_repo value changes.
  • [BODY] Add keycloak-import.sh to "Files the agent should NOT touch" with explanation that these are Keycloak resource keys.