docs: plan PSD server deployment program

2026-08-20 00:57:47 +02:00
parent 3fd177b6c4
commit 21caaa22e3
11 changed files with 2154 additions and 2 deletions
@@ -0,0 +1,108 @@
+# PSD Server Project B — Acceptance Report
+
+> Template only. Store raw Authentik exports, database backups, browser traces, and server topology
+> only in protected server storage. Never retain passwords, provider/client secrets, API tokens,
+> cookies, raw claims, callback query strings, private keys, patient-identifying data, or unbounded
+> logs in this report.
+
+## Decision
+
+- Result: `PROJECT_B_PASS` / `PROJECT_B_FAIL` / `PROJECT_B_PENDING`
+- Decision timestamp UTC:
+- Owner/reviewer:
+- Protected evidence path:
+- Evidence manifest SHA-256:
+- Accepted Project A report digest:
+
+## Frozen candidate
+
+- ThothII source SHA:
+- Workspace SHA:
+- Core/frontend image identities:
+- Qdrant/Ollama image identities:
+- Pi provider/model:
+- Public origin:
+- Aritmolab source/deployment revision:
+
+## Authentik
+
+- Installed version:
+- Pre-change export reference/checksum:
+- Application name/ID:
+- Provider name/ID:
+- Issuer:
+- Callback path verified:
+- Grant types/scopes verified:
+- Direct groups claim shape verified:
+- User group name/ID:
+- Admin group name/ID:
+- Group-catalog service account name/ID:
+- Least-privilege result:
+- `auth check --json` result:
+- Interactive device check: PASS/FAIL/PENDING
+- No secret/raw claim in evidence: PASS/FAIL
+
+## Supabase session storage
+
+- Existing database name:
+- Session schema: thoth_sessions
+- Backup reference/checksum:
+- Migration result (`pending=[]`, `drifted=[]`):
+- Migration idempotency:
+- Runtime role security/RLS result:
+- Migrator absent from core:
+- PostgREST exposed schemas proof:
+- `thoth_sessions` not REST-exposed: PASS/FAIL
+- DWH `datawarehouse` privileges unchanged: PASS/FAIL
+
+## Nginx, TLS, load balancer, and Aritmolab
+
+- Nginx configuration file/revision:
+- `nginx -t` result:
+- Certificate subject/SAN/expiry metadata:
+- Certificate trust result:
+- Load-balancer route/health result:
+- Same-origin API/callback result:
+- SSE unbuffered result:
+- No double `auth_request`: PASS/FAIL
+- Sidebar source/link result:
+- Other virtual hosts unchanged: PASS/FAIL
+
+## Human SSO and authorization
+
+- Aritmolab login → sidebar → ThothII without second credential prompt:
+- Ordinary user permissions:
+- Administrator permissions:
+- No-role user result:
+- Extra unrelated group result:
+- Missing/malformed group negative result:
+- Forged-header result:
+- ThothII logout result:
+- Authentik SSO session behavior documented:
+- Provider/catalog controlled failure and recovery:
+- Manual guide result and reviewer:
+
+## OIDC F1-F8 session and ownership
+
+- Approved sanitized question reference:
+- Session ID:
+- OIDC principal reference (non-identifying):
+- F1-F8/final SQL result:
+- PostgreSQL manifest/artifact/decision persistence:
+- Resume/restart result:
+- Cross-user isolation result:
+- Admin cross-user result:
+- Chat/SSE ephemeral boundary:
+
+## Rollback, cleanup, and hygiene
+
+- Ingress-first rollback rehearsal:
+- Project A protected configuration available:
+- Authentik disable plan verified:
+- Additive schema rollback boundary verified:
+- Project A temporary endpoint removed:
+- Legacy stack stopped/unexposed:
+- Core/Qdrant/Ollama private:
+- Secret scan result:
+- Unrelated failures or pending items:
+- Reason for final decision: