0 Fork 0

Files

T

jakman85andClaude Opus 4.8 de26a53d4b Establish dev workflow (feature-branch→main) and pull Gitea bootstrap earlier

- Add CONTRIBUTING.md: interim local-git rules (no work on main; every change
  a feature branch merged into main) and the target state (Gitea-hosted repos,
  GitOps source cutover, CI/CD via Gitea Actions running the Kyverno gate +
  Chainsaw conformance Job, PR merge gate). Note the self-hosted-git
  bootstrapping circularity + off-cluster mirror/backup mitigation.
- AGENTS.md: add section 12 (version-control workflow).
- docs/05: source-of-truth migration (local bootstrap -> self-hosted Gitea).
- docs/13 + roadmap: reprioritize Gitea as bootstrapping-critical, onboarded
  early (WS-APPS step 2); nextcloud onboarding split out.
- task-board: T-6.1a (gitea early), T-6.1b (source+CI migration to Gitea).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-08-15 22:40:11 -05:00

7.9 KiB

Raw Blame History

Task Board

The live who's-doing-what. Agents claim an item (set Owner + Status) before starting, respect Blocked-by, and mark done only after its automated, reproducible behavior test passes green (definition-of-done.md, ../docs/14-testing-and-conformance.md). Seeded from ../roadmap/phases.md + ../roadmap/workstreams.md.

This board is the one working surface agents may edit (claim items, update status, add items/escalations). The specs, ADRs, and roadmap are not editable by agents (R-TEST-06) — raise spec problems here as an OQ-* escalation for the human. Every "Prove …" task below is an automated conformance test (co-owned with WS-TEST), not a manual demo.

Status values: todo · in-progress · blocked · review · done Add new items at the bottom of the relevant phase; keep IDs stable.

Phase 0 — Foundations

ID	Task	WS	Serves	Blocked-by	Owner	Status
T-0.1	Create implementation repo structure (platform/apps/catalog/clusters)	WS-GITOPS	R-GITOPS-02	—	—	todo
T-0.2	CI: lint + schema validation + build/dry-run gates	WS-GITOPS	R-GITOPS-01	T-0.1	—	todo
T-0.3	Author ServiceDefinition schema + renderer contract	WS-GITOPS	R-GITOPS-02	T-0.1	—	todo
T-0.4	Conformance harness: Chainsaw runner + reproducibility contract + JUnit + coverage report + CI merge gate	WS-TEST	R-TEST-01/02/03/04	T-0.1	—	todo
T-0.5	L0 Kyverno policy gate (default-deny present, no plaintext secrets, schema-valid ServiceDefinitions)	WS-TEST	R-TEST-01, R-NET-01, R-SEC-01	T-0.4	—	todo

Phase 1 — dev/test Cluster Bring-up

ID	Task	WS	Serves	Blocked-by	Owner	Status
T-1.1	OpenTofu libvirt module for 3 node VMs (+ Longhorn data disk)	WS-INFRA	R-ENV-01	—	—	todo
T-1.2	cloud-init baseline (users, SSH, sysctls, virt/Longhorn prereqs)	WS-INFRA	R-ENV-01	T-1.1	—	todo
T-1.3	Ansible: k3s HA install, Cilium CNI, disable flannel/kube-proxy/Traefik	WS-INFRA	R-PLAT-01	T-1.2	—	todo
T-1.4	Bootstrap Flux + SOPS age key	WS-GITOPS/WS-SEC	R-GITOPS-01, R-SEC-01	T-1.3	—	todo
T-1.5	Prove node destroy/rebuild from IaC (no data loss)	WS-INFRA	R-ENV-01, R-STATE-01	T-1.4	—	todo

Phase 2 — Platform Core (net/storage/TLS/DNS/ingress)

ID	Task	WS	Serves	Blocked-by	Owner	Status
T-2.1	Longhorn (3-replica StorageClass) + bulk-tier plan (OQ-2)	WS-STORAGE	R-STATE-02/04	T-1.4	—	todo
T-2.2	Default-deny network baseline (per-namespace) + Hubble	WS-NET	R-NET-01/03	T-1.3	—	todo
T-2.3	Render `dependencies` → CiliumNetworkPolicy from ServiceDefinition	WS-NET/WS-GITOPS	R-NET-02	T-0.3, T-2.2	—	todo
T-2.4	cert-manager + Let's Encrypt DNS-01 wildcard `*.home.keithjackson.dev`	WS-SEC	R-TLS-01/02/03	T-1.4	—	todo
T-2.5	ExternalDNS + Gateway API listeners + split-horizon (PiHole) foundation	WS-NET	R-DNS-01/02/03	T-2.4	—	todo
T-2.6	Prove: default-deny (DNS-only probe), PVC survives rebuild, trusted cert, auto-DNS	WS-NET/STORAGE/SEC	R-NET/STATE/TLS/DNS	T-2.1..2.5	—	todo
T-2.7	Deploy Kyverno in-cluster as admission enforcer (same policies as the CI L0 gate)	WS-TEST/WS-SEC	R-SEC-02, R-NET-01, R-SEC-01	T-1.4, T-0.5	—	todo

Phase 3 — Egress, VPN & Multi-WAN

ID	Task	WS	Serves	Blocked-by	Owner	Status
T-3.1	Egress classes; Cilium Egress Gateway wiring	WS-NET	R-NET-04/05	T-2.2	—	todo
T-3.2	VPN egress (Gluetun sidecar) + kill-switch (ADR-0008)	WS-NET	R-NET-05/06	T-3.1, OQ-3	—	todo
T-3.3	Edge-router multi-WAN split for `internet` class (OQ-1)	WS-NET	R-NET-04	OQ-1	—	todo
T-3.0	L3 fault-injection harness — in-cluster Chainsaw Job (CI-triggered, scoped test SA) using `script`/`try`/`finally` (force tunnel down, kill node, inject bad image, trigger restore)	WS-TEST	R-TEST-05, R-SEC-02	T-0.4	—	todo
T-3.4	Prove: VPN IP egress, kill-switch fail-closed, egress-class flip via git	WS-NET	R-NET-05/06/07	T-3.0, T-3.2	—	todo

Phase 4 — Observability, Backup/DR & Updates

ID	Task	WS	Serves	Blocked-by	Owner	Status
T-4.1	kube-prometheus-stack + Loki + Alloy + Alertmanager(email)	WS-OBS	R-OBS-01/02/03	T-2.1	—	todo
T-4.2	Platform-health alerts (node/Longhorn/Flux/cert/VPN/backup)	WS-OBS	R-OBS-04	T-4.1	—	todo
T-4.3	Velero + Longhorn off-cluster backup schedule	WS-STORAGE	R-STATE-03	T-2.1, OQ-2	—	todo
T-4.4	DR drill: restore namespace + volumes from off-cluster backup	WS-STORAGE	R-STATE-03	T-4.3	—	todo
T-4.5	Flux image-automation + Renovate + per-service update policy	WS-UPDATE	R-UPD-01/02/03	T-0.3, T-4.1	—	todo
T-4.6	Prove: auto stable update on schedule, bad-update auto-rollback+alert, pin holds	WS-UPDATE	R-UPD-*	T-4.5	—	todo

Phase 5 — IaaS Proof (KubeVirt)

ID	Task	WS	Serves	Blocked-by	Owner	Status
T-5.1	Install KubeVirt + CDI; Longhorn-backed VM disks	WS-VM	R-PLAT-03	T-2.1, T-2.2	—	todo
T-5.2	`kind: vm` ServiceDefinition path; run one representative VM	WS-VM/WS-GITOPS	R-PLAT-03/04	T-5.1, T-0.3	—	todo
T-5.3	Prove: VM lifecycle via kubectl/virtctl, rebuild w/o data loss, default-deny+egress, guest auto-update	WS-VM	R-PLAT-03, R-NET-, R-UPD-	T-5.2	—	todo

Phase 6 — Service Onboarding + C2

ID	Task	WS	Serves	Blocked-by	Owner	Status
T-6.1	Onboard pihole (DNS underpinning)	WS-APPS	R-DNS-03	T-2.5	—	todo
T-6.1a	Onboard gitea early (bootstrapping-critical; self-hosts GitOps source + CI/CD)	WS-APPS	R-STATE-03	T-4.4	—	todo
T-6.1b	Migrate GitOps source local→Gitea; move CI to Gitea Actions (Kyverno gate + Chainsaw Job trigger; PR merge gate); off-cluster repo mirror	WS-GITOPS	R-GITOPS-01, R-TEST-03	T-6.1a	—	todo
T-6.2	Onboard plex (bulk tier + public exposure)	WS-APPS	R-STATE-04	T-2.6, T-6.1	—	todo
T-6.3	Onboard qbittorrent, jackett (VPN + kill-switch)	WS-APPS	R-NET-05/06	T-3.4	—	todo
T-6.4	Onboard sonarr, radarr (VPN + arr↔downloader allows)	WS-APPS	R-NET-02/05	T-6.3	—	todo
T-6.5	Onboard seerr (allows to arr + plex)	WS-APPS	R-NET-02	T-6.2, T-6.4	—	todo
T-6.6	Onboard nextcloud (DR-critical + backups)	WS-APPS	R-STATE-03	T-4.4	—	todo
T-6.7	Onboard minecraft, unifi, semaphore, kasm	WS-APPS	app reqs	T-2.6	—	todo
T-6.8	C2 UI: Homepage root + Grafana + Headlamp + Flux status + auth	WS-C2	R-C2-01/02	T-4.2, T-6.*	—	todo

Phase 7 — Production Readiness (CLOSED until operator opens it)

ID	Task	WS	Serves	Blocked-by	Owner	Status
T-7.1	Bare-metal provisioning checklist (design-only)	WS-INFRA	R-ENV-03	—	—	todo
T-7.2	prod overlay (no base edits) + cutover plan	WS-INFRA/WS-GITOPS	R-ENV-02	Phases 1–6 done	—	blocked
T-7.3	Full prod DR drill	WS-STORAGE	R-STATE-03	T-7.2	—	blocked

Open questions (resolve to unblock)

OQ	Question	Blocks	Owner
OQ-1	WAN uplink count + edge-router product	T-3.3	—
OQ-2	Bulk-media home + backup posture	T-2.1, T-4.3	—
OQ-3	VPN provider/protocol + concurrent-tunnel limits	T-3.2	—
OQ-4	DNS provider API (Cloudflare) token for DNS-01 + ExternalDNS	T-2.4, T-2.5	—

7.9 KiB Raw Blame History Unescape Escape