| Ticket Hash: | 0a411bae9493a471e0266231397cd8819bd7d41f | ||
| Title: | Chronicle private home on fossil.openbeagle.org: provisioning + privacy invariants (T6) | ||
| Status: | Active | Type: | Task |
| Severity: | Normal | Priority: | Medium |
| Subsystem: | ops | Resolution: | |
| Last Modified: |
2026-09-20 14:42:31 51.7 days ago |
Created: |
2026-07-08 20:30:35 125.5 days ago |
| Version Found In: | |||
| Description: | ||||
|
Per OD-1 resolution (wiki §8): Chronicle lives on fossil.openbeagle.org (Option A) — private repo, relatively easy to relocate later. A future move to slotcar (Option C) is contingent on establishing a WireGuard/Tailscale-class VPN first; not now.
Provisioning checklist (carries wiki §7 invariants): - private .fossil on the fossil node; NEVER in any public repo listing (the no-public-listing invariant is server-wide already) - excluded from the T2 mirror-sync publish lane (allowlist/denylist — Chronicle must never reach forgejo/github) - per-repo clone toggle OFF; access restricted to authenticated operator cred - included in whatever backup story covers the fossil node itself (the backup node needs its own backup for repos that ORIGINATE there — note this asymmetry: everything else on that node is a copy, Chronicle is a primary) That last point is the one new risk Option A introduces; document the Chronicle-specific restore path. | ||||