From af6fdb3305caf3fd4af9dde5688b2d89352c424c Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 4 Sep 2026 00:26:50 +0200 Subject: [PATCH] Repair archived workplan task metadata Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b --- ...-keycape-privacyidea-cluster-deployment.md | 26 ++++++++++++------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/workplans/archived/260603-NK-WP-0003-keycape-privacyidea-cluster-deployment.md b/workplans/archived/260603-NK-WP-0003-keycape-privacyidea-cluster-deployment.md index 4683da1..bd9bf96 100644 --- a/workplans/archived/260603-NK-WP-0003-keycape-privacyidea-cluster-deployment.md +++ b/workplans/archived/260603-NK-WP-0003-keycape-privacyidea-cluster-deployment.md @@ -100,7 +100,8 @@ id: NK-WP-0003-T02 status: done priority: high state_hub_task_id: "a14e3a6b-18ee-4172-8a47-bd531f21e55a" -note: Done 2026-03-25 on RAILIANCE01. Namespaces, NetworkPolicies, cert-manager, ClusterIssuers, +note: >- + Done 2026-03-25 on RAILIANCE01. Namespaces, NetworkPolicies, cert-manager, ClusterIssuers, insecure registry for CoulombCore OCI all applied and verified. Known gotcha: added allow-traefik-to-acme-solver NetworkPolicy to sso + mfa namespaces (default-deny-all blocked ACME HTTP-01 solver pods from receiving Traefik traffic). @@ -162,7 +163,8 @@ id: NK-WP-0003-T04 status: done priority: high state_hub_task_id: "9c9c1ec9-0cf5-4546-a83e-d74dbf3b27af" -note: Done 2026-03-25 on RAILIANCE01. privacyIDEA pod Running, TLS certs issued, +note: >- + Done 2026-03-25 on RAILIANCE01. privacyIDEA pod Running, TLS certs issued, enckey + audit keys bootstrapped (privacyidea-enckey + privacyidea-auditkeys Secrets created), pi-admin + trigger-admin created, trigger-admin-rights policy created via REST API. DEFERRED: pi-admin TOTP enrollment requires an admin realm (SQLresolver pointing to PI's @@ -191,7 +193,8 @@ id: NK-WP-0003-T05 status: done priority: high state_hub_task_id: "82fc90f7-8eb4-4718-b02a-dfd5fa39e5bc" -note: Done 2026-03-25 on RAILIANCE01. LLDAP pod Running, TLS cert issued (lldap.coulomb.social), +note: >- + Done 2026-03-25 on RAILIANCE01. LLDAP pod Running, TLS cert issued (lldap.coulomb.social), groups net-kingdom-users (id=4) + net-kingdom-admins (id=5) created via direct GraphQL. bootstrap-users.sh has a bash set -e / json parse bug (workaround: direct curl). ``` @@ -269,7 +272,8 @@ id: NK-WP-0003-T08 status: done priority: high state_hub_task_id: "0fba3392-c916-43fd-a2c1-24ce39481043" -note: Completed 2026-03-25. All 3 test packages pass (migration, negative, profile). +note: >- + Completed 2026-03-25. All 3 test packages pass (migration, negative, profile). Go 1.22.10 found at ~/go/bin/go. DNS resolves to 92.205.62.239 (all 4 subdomains). Tests run with: cd src && ~/go/bin/go test ./tests/... -v Results: ok keycape/tests/migration, ok keycape/tests/negative, ok keycape/tests/profile @@ -293,10 +297,10 @@ cd "$(git rev-parse --show-toplevel)/../key-cape" go test ./tests/... -run TestProfileBaseline -v ``` -### T08a — Create Cloudflare DNS A records +### T10 — Create Cloudflare DNS A records ```task -id: NK-WP-0003-T08a +id: NK-WP-0003-T10 status: done priority: high state_hub_task_id: "c614f839-61c4-41f6-bfeb-b3f9525a7625" @@ -321,14 +325,15 @@ certs will be issued for all ingresses. Verify: `dig +short kc.coulomb.social @8.8.8.8` → `92.205.62.239` -### T08b — Install Go on RAILIANCE01 +### T11 — Install Go on RAILIANCE01 ```task -id: NK-WP-0003-T08b +id: NK-WP-0003-T11 status: done priority: high state_hub_task_id: "fdfe595a-f5a8-466a-82e9-7cc2ad8e5c3e" -note: Go 1.22.10 already installed at ~/go/bin/go (workstation). Tests ran from workstation. +note: >- + Go 1.22.10 already installed at ~/go/bin/go (workstation). Tests ran from workstation. Also: Go v1.25.6 present on RAILIANCE01 via k3s. ``` @@ -343,7 +348,8 @@ id: NK-WP-0003-T09 status: done priority: medium state_hub_task_id: "a82751d8-4de8-4668-8568-8dc140a6322b" -note: Done 2026-05-02 consolidation. Backup CronJobs are live on RAILIANCE01 and +note: >- + Done 2026-05-02 consolidation. Backup CronJobs are live on RAILIANCE01 and have recent successful runs for LLDAP, Authelia, and privacyIDEA. PVC backup files exist for LLDAP and privacyIDEA enckey; Authelia job logs confirm /data/backups/authelia.backup.2026-05-02. Break-glass and emergency bundle