46 lines
3.1 KiB
Markdown
46 lines
3.1 KiB
Markdown
|
# Blocking Decisions
|
|||
|
|
|
|||
|
|
All five must resolve before Phase 1 starts. Source: ADR-0001 review notes.
|
|||
|
|
|
|||
|
|
## 1. Which GitOps repo owns the portfolio?
|
|||
|
|
|
|||
|
|
Two roots exist:
|
|||
|
|
- `homelab-root` → `[email protected]:Riotpiaole/riotpiao.homelab.com.git`, path `k8s/argocd/apps` (31 child Applications, this is the live one)
|
|||
|
|
- This repo's `infra/argocd-apps.yaml` → `forgejo.riotpiao.homelab.com` (`portfolio`/`auth-infra` Applications don't exist in cluster)
|
|||
|
|
|
|||
|
|
**Update (2026-08-18):** `*.riotpiao.homelab.com` is fully retired — confirmed NXDOMAIN across the board (`argocd.riotpiao.homelab.com`, `forgejo.riotpiao.homelab.com`, etc.), not just the forgejo subdomain. Live ingress hosts are all `*.riotpiao.com` now (`forgejo.riotpiao.com` → 200, `argocd.riotpiao.com`, `vault.riotpiao.com`, etc. — 22 hosts total). `infra/argocd-apps.yaml`'s `repoURL: https://forgejo.riotpiao.homelab.com/...` in this repo is pointed at the dead domain; the working equivalent is `forgejo.riotpiao.com`. This doesn't answer which repo is authoritative, but it means 0.2's NXDOMAIN fix is now a known, mechanical domain swap rather than an open diagnosis.
|
|||
|
|
|
|||
|
|
**Decision needed:** GitHub or Forgejo. Blocks Phase 0.1–0.3.
|
|||
|
|
|
|||
|
|
## 2. Apex 403 cause
|
|||
|
|
|
|||
|
|
`riotpiao.com` resolves via Cloudflare (172.67.196.33 / 104.21.60.115) but returns HTTP 403 at the edge, no origin headers.
|
|||
|
|
|
|||
|
|
**Update (2026-08-18):** `kubectl get ingress -A` shows zero ingress objects with host exactly `riotpiao.com` (bare apex) — every rule is a subdomain (`argocd.`, `forgejo.`, `grafana.`, ...). No in-cluster origin is configured for the apex at all, which is consistent with (though not proof of) "no origin configured" as the 403 cause. Still need the Cloudflare tunnel Public Hostnames list / WAF event log to confirm whether the tunnel even has an apex entry, since that's Cloudflare-side config not visible from `kubectl`.
|
|||
|
|
|
|||
|
|
**Decision needed:** tunnel route missing, WAF rule, or no origin configured at all. Check Cloudflare tunnel Public Hostnames list + WAF event log (event log names the blocking rule). Blocks Phase 0.5.
|
|||
|
|
|
|||
|
|
## 3. Is homarr still wanted?
|
|||
|
|
|
|||
|
|
Deployed and healthy, but shipped under the abandoned Homarr+Terraform plan.
|
|||
|
|
|
|||
|
|
**Decision needed:** keep, or decommission via GitOps (remove Application, let Argo prune).
|
|||
|
|
|
|||
|
|
## 4. Does chat (Surface D) stay in v1?
|
|||
|
|
|
|||
|
|
8-slot GPU ceiling (`--max-num-seqs=4` × 2 replicas) means chat queues under real traffic — a visible "please wait" is a worse first impression than no chat.
|
|||
|
|
|
|||
|
|
**Decision needed:** ship B+E+C first and treat D as separate follow-up, or commit to D in v1 with the queue UX as-is.
|
|||
|
|
|
|||
|
|
## 5. Where does atlas live?
|
|||
|
|
|
|||
|
|
This repo (`riotpiao`) or the homelab repo. Follows from decision 1 — whichever repo is authoritative for the portfolio's GitOps should also own atlas's manifests.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
Once answered, update this file with the decisions taken (date + rationale) before starting Phase 0 tasks in [INDEX.md](INDEX.md).
|
|||
|
|
|
|||
|
|
## Hard requirement: Playwright
|
|||
|
|
|
|||
|
|
Every phase shipping a UI surface (Phase 2, 3, 4, 5) requires a passing Playwright e2e spec before merge — not optional, gated in CI alongside `pnpm test`. Setup lands in Phase 0 task 0.6a.
|