Config review: record Gitea answers on issues 2 and 12 #50

Merged

spencerm merged 3 commits from config-review into main 2026-10-27 20:55:47 +00:00

Conversation 0 Commits 3 Files Changed 3

+4 -3

spencerm commented 2026-10-27 19:25:33 +00:00

Owner

Copy Link

Copy Source

Targets phase-9, not main: PR 49 is still open, so this branch starts from phase-9 to avoid conflicts. Merge PR 49 first, then this one (or retarget it to main after 49 lands).

Reviewed all 44 issues and every comment for configuration and setup answers. Docs only. No code default changed.

Applied

• Issue 2 (Q4, SethD 2026-10-26): the PIN is enough for every sign-off, Q.C. accept and filing included. Recorded in docs/PLAN.md Q4, docs/SECURITY.md (signatures control) and CHANGELOG.md. The build already does this.
• Issue 12 (Q13, SethD 2026-10-26): Seth left the two-run gone confirmation and the 10 percent suspect-batch guard to Spencer. docs/PLAN.md Q13 records that the defaults stay unless Spencer changes them.

Already applied earlier and checked again: issues 3, 19, 20, 38 (test layout), 45 (60 min idle for Admin and Clerical).

Questions asked on the issues

• Issue 7 (retention): is "keep everything" confirmed, or is there a minimum period; where an outside copy lives, since Packet Station cannot write to M-Files.
• Issue 13 (pause scope): explained the Pause switch and asked "keep as built" or "pause only the feed".

Still open, needs Spencer or IT (not run)

• Issue 38: production stack folder, /home/spencerm/packetstation/prod or /etc/packetstation/prod. Asked 2026-10-19, no answer. Blocks the production stack.
• Issue 37 (root on docker-1): add {"default-address-pools":[{"base":"10.200.0.0/16","size":24}]} to /etc/docker/daemon.json, then sudo systemctl restart docker off-hours (every stack restarts). Count bridge networks first. Steps in docs/DEPLOY.md.
• Issue 5 (IT, on vsql): issue a 2048-bit SHA-256 certificate from PESCO-PSYLOCKE-CA with SAN vsql.pesco.com and vsql, bind it to the DEV and production instances, restart them off-hours. Then the image gets the CA in its OpenSSL trust and the stacks switch to VISUAL_ENCRYPT=yes. Production can go live with VISUAL_ENCRYPT=no (LAN only) if this waits.

Seth's policy answers from 2026-10-26 (issues 1, 4, 6, 8 to 11, 14 to 18, 21 to 34, 36) are not configuration and are not applied here.

🤖 Generated with Claude Code

Targets **phase-9**, not main: PR 49 is still open, so this branch starts from phase-9 to avoid conflicts. Merge PR 49 first, then this one (or retarget it to main after 49 lands). Reviewed all 44 issues and every comment for configuration and setup answers. Docs only. No code default changed. ## Applied - Issue 2 (Q4, SethD 2026-10-26): the PIN is enough for every sign-off, Q.C. accept and filing included. Recorded in docs/PLAN.md Q4, docs/SECURITY.md (signatures control) and CHANGELOG.md. The build already does this. - Issue 12 (Q13, SethD 2026-10-26): Seth left the two-run gone confirmation and the 10 percent suspect-batch guard to Spencer. docs/PLAN.md Q13 records that the defaults stay unless Spencer changes them. Already applied earlier and checked again: issues 3, 19, 20, 38 (test layout), 45 (60 min idle for Admin and Clerical). ## Questions asked on the issues - Issue 7 (retention): is "keep everything" confirmed, or is there a minimum period; where an outside copy lives, since Packet Station cannot write to M-Files. - Issue 13 (pause scope): explained the Pause switch and asked "keep as built" or "pause only the feed". ## Still open, needs Spencer or IT (not run) - Issue 38: production stack folder, /home/spencerm/packetstation/prod or /etc/packetstation/prod. Asked 2026-10-19, no answer. Blocks the production stack. - Issue 37 (root on docker-1): add `{"default-address-pools":[{"base":"10.200.0.0/16","size":24}]}` to /etc/docker/daemon.json, then `sudo systemctl restart docker` off-hours (every stack restarts). Count bridge networks first. Steps in docs/DEPLOY.md. - Issue 5 (IT, on vsql): issue a 2048-bit SHA-256 certificate from PESCO-PSYLOCKE-CA with SAN vsql.pesco.com and vsql, bind it to the DEV and production instances, restart them off-hours. Then the image gets the CA in its OpenSSL trust and the stacks switch to VISUAL_ENCRYPT=yes. Production can go live with VISUAL_ENCRYPT=no (LAN only) if this waits. Seth's policy answers from 2026-10-26 (issues 1, 4, 6, 8 to 11, 14 to 18, 21 to 34, 36) are not configuration and are not applied here. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

spencerm changed target branch from phase-9 to main 2026-10-27 20:54:48 +00:00

spencerm added 3 commits 2026-10-27 20:54:48 +00:00

docs: record config answers from Gitea issues 2 and 12 ... 9cbfe4b996

Issue 2 (SethD, 2026-10-26): the PIN is enough for every sign-off,
Q.C. accept and filing included. Issue 12: SethD left the gone and
suspect-batch numbers to Spencer; the defaults stay.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge branch 'phase-9' into config-review f15d8c5fb0

Merge branch 'phase-9' into config-review 13e948ebea

spencerm merged commit 9764e5d11c into main 2026-10-27 20:55:47 +00:00

spencerm deleted branch config-review 2026-10-27 20:55:47 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

decision: Clerical

decision: IT

decision: Q.C.

decision: Seth

phase 10

phase 3

phase 4

phase 5

phase 6

phase 7

phase 8

phase 9

production

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

SethD (Seth Dostaler) spencerm (Spencer McGuire)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spencerm/PacketStation#50