Inventory what each live Application needs and what blocks its handover #343

Activity

1. ExtraToast

   added

   type: docsDocumentation-only change.Documentation-only change.

   area: deployhomelab-deploy, deploy-v2, manifests, and rollout flow.homelab-deploy, deploy-v2, manifests, and rollout flow.

   wayfinder:researchWayfinder ticket resolved by reading primary sources (AFK)Wayfinder ticket resolved by reading primary sources (AFK)

   on Oct 9, 2026
2. ExtraToast

   added a parent issue on Oct 9, 2026

   • Map: re-establish deploy-kit's goals, rewrite its spec, and order the work until the estate is handed over #341
3. ExtraToast

   marked this as blocking 2 issues on Oct 9, 2026

   • Decide what is cut, merged or deferred from the spec and the register #346
   • Order the Project handovers and what the spec must settle before each #349
4. ExtraToast

   self-assigned this

   on Oct 9, 2026
5. ExtraToast commented on Oct 9, 2026

   

   ExtraToast

   on Oct 9, 2026

   ContributorAuthor

   More actions

   Findings: https://github.com/JorisJonkers-dev/deploy-kit/blob/research/live-estate-needs/docs/research/live-estate-needs.md

   • The deploy-config-schema descriptors deploy nothing. The nine platform/deployment.yml files state only the namespace, workloads, health, routes and rollback retention, and fleet-infra only checks its tree against them (fragment-drift.sh). Every live object is hand-written in fleet-infra, so the needs had to be read from there.
   • The handover ledger names 13 Projects, but grimoire, tribelt, overleaf (latex) and the knowledge platform are live and not on it. Six HelmRelease foundation components (cert-manager, external-dns, MetalLB, Reloader, NVIDIA device plugin, VSO) are declared by no platform project.
   • <project>-system does not match seven live namespaces, and <project>_db would rename the databases of notes (outline), automation (n8n) and knowledge-platform. For these, handover is a move, not an in-place takeover.
   • Live Postgres credentials reach grimoire, tribelt, outline and n8n through VSO VaultDynamicSecrets. The spec delivers an edge credential self (ch. 10, while ch. 16 says VSO), and src/ renders no VaultDynamicSecret. agents-api uses a RabbitMQ Vault engine that the grant union does not have.
   • Four refusals would fire on today's shapes: E_DUPLICATE_HOST (one host on both the public and LAN tiers: 8 media hosts, hermes, agents-ws), E_HARDENING_UNMET, E_PRIVILEGED_PORT_UNDER_NONROOT (stalwart, adguard, auth-ui, agents-ui) and E_PROCESS_RBAC_GRANT (agents-api, kubernetes-mcp-server).
   • Ten needs appear in no chapter: host paths, host ports and LoadBalancers, GPU device requests, app CronJobs, init containers, Pods created at runtime, internet egress, Mongo and S3 engines, priority classes, and a Service for an off-cluster host.
   • No order is recommended; that is Order the Project handovers and what the spec must settle before each #349.
6. ExtraToast commented on Oct 9, 2026

   

   ExtraToast

   on Oct 9, 2026

   ContributorAuthor

   More actions

   Resolved: the inventory is in docs/research/live-estate-needs.md on branch research/live-estate-needs. The gist is in the comment above. The needs no chapter covers are carried forward as their own decision ticket on the map.
7. ExtraToast

   closed this as completedon Oct 9, 2026