KNEL/PFVCluster
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[#769] retire questions files — open items ticketed in Redmine (NeedsInput)

Browse Source 
v10/v11 archived under archive/questions/; carried opens mapped to
tickets #800-#807.
https://projects.knownelement.com/issues/769
This commit is contained in:
mrcharles
2026-09-05 05:28:25 -05:00
parent 080f5c9291
commit 2161ce64c2
3 changed files with 39 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
questions-v10.md → archive/questions/questions-v10.md
View File
archive/questions/questions-v11.md
+21
View File
@@ -0,0 +1,21 @@
# Questions — v11 (current round)
New round opened by the 09-04 night grind (monitoring wiring t/335 EXECUTED;
apt-satellite lane LIVE; CA/ACME pilot done). Two gating questions for the
next phase. One-line answers fine. (v10 + history: archive/questions/)
## CA/ACME phase B (t/327 design)
**Q1 (DNS-01 for the fleet ACME).** The prod ACME endpoint on tsys-ca (phase
B) needs to validate knel.net identifiers. Recommended: **DNS-01 via
Technitium** — may I generate a TSIG key scoped to `_acme-challenge.*`
updates and load it on tsys-dns (one config edit + git SoR sync), or prefer
HTTP-01 only for now?
A: approved
**Q2 (step-ca go on tsys-ca).** Deploy the prod ACME container on the tsys-ca
VM (new container, intermediate signed by the existing fleet root, bound to
the Tailscale IP :8443) — approve to start, or pick a window?
A: approved.
questions-v11.md
+18 -17
View File
@@ -1,21 +1,22 @@
# Questions — v11 (current round)
# Questions — RETIRED MODEL (was v11)
New round opened by the 09-04 night grind (monitoring wiring t/335 EXECUTED;
apt-satellite lane LIVE; CA/ACME pilot done). Two gating questions for the
next phase. One-line answers fine. (v10 + history: archive/questions/)
Questions are Redmine tickets now. Open questions carry status
**NeedsInput** and surface on the NeedsInput report:
https://projects.knownelement.com/queries/11
## CA/ACME phase B (t/327 design)
Historical rounds (v4-v11, questions-09022206): [archive/questions/](archive/questions/)
**Q1 (DNS-01 for the fleet ACME).** The prod ACME endpoint on tsys-ca (phase
B) needs to validate knel.net identifiers. Recommended: **DNS-01 via
Technitium** — may I generate a TSIG key scoped to `_acme-challenge.*`
updates and load it on tsys-dns (one config edit + git SoR sync), or prefer
HTTP-01 only for now?
Carried opens from the archived rounds, now ticketed (Discourse index:
https://community.turnsys.com/t/297):
A: approved
**Q2 (step-ca go on tsys-ca).** Deploy the prod ACME container on the tsys-ca
VM (new container, intermediate signed by the existing fleet root, bound to
the Tailscale IP :8443) — approve to start, or pick a window?
A: approved.
| was | now |
|---|---|
| v11 Q1+Q2 (prod ACME: DNS-01 TSIG + step-ca window) | [#800](https://projects.knownelement.com/issues/800) |
| v10 OQ6 (preprod 531xx soak/promote model) | tracked under [#769](https://projects.knownelement.com/issues/769) |
| v10 OQ8 (KNELBMS rename scope + token) | [#805](https://projects.knownelement.com/issues/805) |
| v10 PQ11 (pfv-relay Cloudron user) | [#803](https://projects.knownelement.com/issues/803) |
| v10 Q4 (second human approver, Gitea) | [#804](https://projects.knownelement.com/issues/804) |
| old file: CMDB rulings C1-C3 | [#801](https://projects.knownelement.com/issues/801) |
| old file: PBS scheduling confirm | [#802](https://projects.knownelement.com/issues/802) |
| old file: home-lane batch (10 items) | [#806](https://projects.knownelement.com/issues/806) |
| old file: bot identity (attribution) | [#807](https://projects.knownelement.com/issues/807) |