pal-e-docs

Story: Dashboard Reachable from Phone

story-westside-streamlit-reachable Doc

active user-story
Project

Story: Dashboard Reachable from Phone

Key: reachable · Label: story:reachable · Role: Platform operator (Lucas) + Head coach (Marcus)

Story

As the platform operator and head coach, I need the westside-streamlit dashboard to be reachable on a stable HTTPS URL from any device — including Marcus's phone, with no Tailscale client installed — so that Marcus can check contract and jersey status at practice without calling Lucas, and so the dashboard moves from "a tool only Lucas can run" to "shared ops infrastructure."

Why

Today, the dashboard is a local Python process on Lucas's machine. Every time Marcus has a question, he either calls Lucas or waits until the next time they're together. That's the opposite of what an ops dashboard is for. Making it reachable is the single most important step toward the dashboard being useful, not just built.
"Reachable" is a bundle of infrastructure work, not one ticket. All the deployment-stack tickets (Dockerfile, Woodpecker pipeline, kustomize overlay, read-only DB role, Tailscale funnel, Keycloak OIDC) trace to this single story. Each ticket is a necessary step; this story is the user-facing outcome.

Acceptance criteria

  • Marcus can open https://westside-ops.tail5b443a.ts.net/ on his phone, log in with his Keycloak credentials, and see the dashboard — without installing Tailscale.
  • The deployment is managed via the standard platform pipeline: git push → Woodpecker build → Harbor push → ArgoCD sync. Manual kubectl touches are not part of the steady-state loop.
  • The database connection uses a dedicated read-only role, not the basketball-api credentials.
  • Unauthenticated requests are redirected to Keycloak. Authenticated users without the westside-ops role see a 403.
  • Dashboard response time < 3 seconds from cold cache over 4G on Marcus's phone.

Supporting tickets

All of these trace to story:reachable:
  • Add Dockerfile
  • Add Woodpecker CI pipeline
  • Add kustomize overlay in pal-e-deployments
  • Create read-only Postgres role for westside-streamlit
  • Expose via Tailscale funnel on dedicated hostname
  • Wrap dashboard in Keycloak OIDC before public exposure

Out of scope

  • Per-user audit logging (who viewed what, when). Nice to have, separate future story.
  • Role-based feature gating (e.g., Marcus sees only Jerseys, Lucas sees everything). Start with all-or-nothing.
  • Mobile-first UI redesign. Streamlit is responsive enough for v1; custom mobile styling can come later.