4 Commits

Include renames

Author	SHA1	Message	Date
bmr_bluecap	a76a6da26c	docs: replace section 1.1 with a verified cutover runbook ... The old entry assumed the cluster could be pointed at directly and that DNS-01 removed the certificate ordering problem. Both were wrong once the real traffic path was checked. Public traffic has to transit the Pangolin VPS, so two certificates are needed from two different systems: the edge cert from Pangolin's own Traefik resolver, and the internal-hop cert from cert-manager, because every k3s-backed Pangolin resource proxies to https:443 (the pattern Authentik, paperless, immich and dav all follow). Pangolin's resolver uses HTTP-01 on entrypoint web, not DNS-01, so the edge cert cannot be pre-issued and a short window at cutover is unavoidable. cert-manager can still pre-issue the internal cert. There is also only one Cloudflare token, not two: Pangolin holds no Cloudflare credentials at all. Records the proxied-vs-DNS-only decision, which earlier advice got backwards (this zone is already orange-clouded while the homelab zones are not), the Flexible-SSL redirect-loop risk, the ~5 minute rollback from ttl=auto, and that mail is unaffected because the MX records are not proxied. Cloudflare token now covers bluecapstrategies.com.	2026-10-09 08:01:20 -04:00
bmr_bluecap	120ffb7445	docs: correct section 1.4 - the form endpoint is a build-time value, not runtime ... The entry said to set PUBLIC_CONTACT_FORM_ENDPOINT in the ConfigMap. That ConfigMap is not consumed by the Deployment, and a static Astro build inlines PUBLIC_* at image build time regardless, so there is no runtime knob to set. Record the build-arg wiring that replaced it and the two steps that still need the owner: creating the Formspree form and adding the CONTACT_FORM_ENDPOINT Actions secret.	2026-10-09 07:04:59 -04:00
bmr_bluecap	5bfc5981cd	docs: record contact/draft fixes, staging URL, and DNS-01 cutover finding ... Marks sections 1.3 and 1.5 fixed, adds section 2.6 for the staging URL, and records that letsencrypt-prod solves via DNS-01 against Cloudflare - which removes the HTTP-01 ordering problem from section 1.1, leaving only the question of whether bluecapstrategies.com is reachable by the cert-manager Cloudflare token. Adds section 2.5 for developer-facing copy found on the /insights/ index while fixing the draft leak. Left unfixed on purpose: what that page should say depends on the owner decision in section 1.5.	2026-09-23 09:48:40 -04:00
bmr_bluecap	79e7fd4b2b	docs: add maintained launch checklist; de-duplicate stale task lists ... Cutover tasks were scattered across three sources that disagreed with each other and with reality: planning/parity-checklist.md (git-ignored, content only), docs/seo-aeo-optimization.md (SEO only, listed the Zod schema, seo-lint and breadcrumbs as open when all three are done, and called for Uptime Kuma which ADR-0004 replaced with monylog), and session notes. Add docs/launch-checklist.md as the single source of truth, verified against the working tree, the cluster and ArgoCD rather than inherited from the older docs. Point the SEO doc's two checkbox blocks at it and keep only reference detail there. Also records blockers that were not tracked anywhere: TLS never wired on the ingress, developer-facing copy rendered on the contact page, the contact form having no endpoint, and the draft insight post building into the sitemap because the draft flag is declared in Zod but never filtered on.	2026-09-22 15:45:48 -04:00