[Bakhomious]

Lead brief: deploy-facts

Goal

The plan records how Bakhyard runs on the laptop now that deploy-apps is in (codedogapp/homelab#16, then codedogapp/homelab#17 and codedogapp/homelab#18), so the plan matches what runs there, and marks deploy-apps and deploy-k3s done.

Scope (docs only)

1. §0: a row deploy-facts, Done (docs: record how Bakhyard runs on the laptop #136).
2. §8.2: deploy-k3s done; deploy-apps done, with its homelab PRs.
3. Decision 170, the lead's choices from those PRs, for the user's review, as nested bullets:
   • the pods' security settings and the Secrets' mode 0440 with fsGroup (amends 154);
   • one role and database per service, sslmode=require (encrypted, unverified), the start-up race;
   • git-sync's flags, safe.directory (Don't set safe.dir=* in main app kubernetes/git-sync#993);
   • the vault mirror's two read-only tokens;
   • the registry credential kept, the user's choice (amends 156);
   • the image automation's timing, the homelab's Renovate rule, the mirror's owner;
   • Jira and Bitbucket on the laptop, and the order for a change that adds Secrets;
   • what the laptop starts with: empty todos, a new pin, no name.
4. §1 and §12: the user answered "work tokens on the laptop" by wiring them (2026-10-28); the Jira token gets in from home; the laptop's todos started empty.
5. §0 ideas: pulls finds its workspaces through GET /2.0/user/workspaces; sslmode=verify-full with the cluster's CA.
6. README: it runs on the laptop now.

Out of scope

• The nudge session's rows and decisions (nudge-merge's status, decision 157's indentation).
• Any change in the homelab repo or the cluster.
• The name the Home greets, a personal setting that stays out of this public repo.

Acceptance criteria

1. Every fact in decision 170 matches the homelab repo at 32a5ed0, the live cluster (read-only) or the upstream docs and source it cites.
2. No personal identifier: no tailnet name, no account or vault repository name, no work site.
3. Decision 170 says which decisions it amends; its sub-bullets nest (5 spaces).
4. §0, §1, §8.2, §12 and the README agree with decision 170.
5. mise run --jobs 1 check passes; the PR's CI check is green.

What changed

• docs/plan.md: decision 170, with fifteen bullets: the pods; the secrets, 0440, amending 154; the databases; TLS to Postgres; the first start's 3D000 race; git-sync; safe.directory; the vault's tokens; the registry credential, amending 156; the rollout's timing; Renovate; the mirror's owner; Jira and Bitbucket; Secrets made after the merge; what the laptop started with. Also a §0 row and two ideas, §1's work tokens, §8.2's deploy-k3s and deploy-apps marked done, and §12 reworded.
• README.md: Bakhyard now runs on the laptop's k3s, and on a Mac for development.

QA

• Each fact was checked against these sources:
  • the homelab repo at 32a5ed0;
  • the live cluster, through read-only kubectl get and kubectl logs;
  • pgx v5.11.0's pgconn/config.go;
  • Flux's ImageUpdateAutomation docs ("The delay starts at the first policy change and is not extended by later changes");
  • Gitea's checkContextUser: without ?org=, the migration form's owner is the signed-in user.
• Gitea's registry hands out an anonymous pull token that lists the tags (200, and 401 without a token). So "Gitea serves the organisation's images to anyone on the tailnet today" holds.
• todos and pulls are Running, with 0 restarts and no log lines. Their API settings are never empty, so a missing site, email or workspace list would stop them. The empty logs therefore mean every poll has passed.
• The diff has no tailnet name, account, vault repository or work site. Decision 170's bullets nest at 5 spaces.
• caffeinate -s -i mise run --jobs 1 check is green. It ran build, gen:check, fmt:check, lint, lint:actions, lint:compose, test, cover and vuln, then the web app's install, lint, typecheck, test, unused, audit and build, and E2E: 288 passed, 8 skipped.

Review

No blocking findings. Non-blocking:

• Not checked: which CloudNativePG release added the DatabaseRole kind that runs today.
• home-sources' 24 minutes is one sample, and the decision says so.
• Left for the nudge session: nudge-merge's §0 status, and decision 157's sub-bullets at 4 spaces.

For the user

• Decision 170 is the lead's, for your review. The registry credential, and Jira and Bitbucket on the laptop, are your choices.
• §12: should the Mac's todos move to the laptop with pg_dump, or stay behind? And please check that the Todos and PRs pages list just your tickets and PRs.

Merged by the lead under the user's standing OK (2026-10-26) once CI's check is green.