Story: Infrastructure Overhaul
Story: Infrastructure Overhaul
Migrate pal-enterprises from Debian-based Ruby images to Arch Linux rolling-release base images, establish proper dev/prod deployment separation, and add CI quality gates.
Motivation
Every Ruby version bump is a manual ticket. Dev environment points to prod URL with hardcoded secrets. No CI test gates. ArgoCD app not wired up. This story fixes the entire pipeline from image → build → deploy → dev.
Tickets
| Wave | Ticket | Repo | Pts | Issue |
|---|---|---|---|---|
| 1 | T1: Keycloak dev redirect + ArgoCD | pal-e-services | 3 | <a href="https://forgejo.tail5b443a.ts.net/ldraney/pal-e-services/issues/75">#75</a> |
| 1 | T3: Arch Ruby base image in Harbor | pal-e-platform | 5 | <a href="https://forgejo.tail5b443a.ts.net/ldraney/pal-e-platform/issues/360">#360</a> |
| 2 | T2: Dev overlay + local mount | pal-e-deployments | 3 | <a href="https://forgejo.tail5b443a.ts.net/ldraney/pal-e-deployments/issues/158">#158</a> |
| 2 | T4: Dockerfile migration to Arch | pal-enterprises | 3 | <a href="https://forgejo.tail5b443a.ts.net/ldraney/pal-enterprises/issues/18">#18</a> |
| 3 | T5: CI pipeline with test gates | pal-enterprises | 3 | <a href="https://forgejo.tail5b443a.ts.net/ldraney/pal-enterprises/issues/19">#19</a> |
Outcome
- Weekly Arch base image rebuild → no manual Ruby/gem version tickets
- Prod via ArgoCD, dev via local mount at pal-enterprises-dev.tail5b443a.ts.net
- CI runs brakeman + rubocop + bundle-audit on every PR
- Keycloak accepts both prod and dev OAuth callbacks
Tickets Killed
#14(Ruby 4.0 upgrade) — unnecessary, Arch rolling release handles this- Future Ruby/gem version bump tickets — eliminated as a class of work