Ebbe BaßandClaude Sonnet 5.5
24de5878ed
Includes the BMAD install config, the initiative ticket tree, the portal context-resources scripts, and the .gitignore change that tracks BMAD files (generated _bmad/render/ is ignored). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt
4.3 KiB
tracker_id, key, type, title, parent, covers, after, assignee, risk
| tracker_id | key | type | title | parent | covers | after | assignee | risk | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| initiative | Users run their own account and the admin has one announcement channel | none |
|
high |
Users run their own account and the admin has one announcement channel
Description
The ping-mee Self-Service Portal lets about ten homelab users change their own password, details and profile picture, and lets the admin announce planned downtime by e-mail and on a page. The spec owns the capabilities, constraints and non-goals; this initiative delivers them to production, internet-facing, in a form that can later be deployed elsewhere.
Outcome
Family and friends change their own password, details and picture without the admin, and every planned downtime reaches opted-in users by e-mail and banner; the spec's success signal is the measure.
Requirements
The numbered spec is the requirement source: CAP-1 to CAP-10 in _bmad-output/specs/spec-ping-mee-self-service-platform/SPEC.md. Requirement-level detail (FR-1 to FR-32) is in its PRD companion.
Done when
- A family member changes their own password, name, phone number and picture in the live portal with no admin help.
- A scheduled downtime announcement reaches every opted-in user by e-mail and shows as a banner on the dashboard.
- Injection, cross-user access and brute-force attempts against the live portal fail and appear in the audit log.
- The portal runs from one Docker image configured only by environment variables on the Linux host behind the reverse proxy.
- Consistent database backup files appear in the backup folder and the status page shows their age.
- Every capability CAP-1 to CAP-10 is live for all users, not behind a flag.
Boundaries
The portal and its adapters. Not an Active Directory admin console, not a password-reset flow, not a replacement for the PowerShell picture scripts or the identity provider; see the spec's non-goals. Tracer path: sign in through authentik, look up the user in the test OU, and see their name in the new page shell.
- Touch point: Active Directory (LDAPS) — the portal reads and writes through a service account; owner: epic-platform-and-sign-in
- Touch point: authentik (production) — a dedicated OIDC application for the portal; owner: epic-platform-and-sign-in
- Touch point: Zoraxy reverse proxy — trusted-proxy and client-IP settings; owner: epic-platform-and-sign-in
- Touch point: IONOS mail — SMTP credentials for the outbox; owner: epic-platform-and-sign-in
- Touch point: picture file share and the PowerShell sync task — write source files, read processed hashes, no script changes; owner: epic-account-self-service
- Touch point: Veeam copy job — copies the backup folder; owner: epic-announcements-and-administration
References
- spec — _bmad-output/specs/spec-ping-mee-self-service-platform/SPEC.md, section Capabilities
- spec companion — _bmad-output/prds/prd-ping-mee-self-service-platform-2026-10-15/prd.md, sections Features and Cross-Cutting Requirements
- architecture — _bmad-output/architecture/architecture-ping-mee-self-service-platform-2026-10-15/ARCHITECTURE-SPINE.md, section Invariants & Rules (the decisions every epic adopts: AD-1 to AD-19)
- design — _bmad-output/ux-designs/ux-ping-mee-self-service-platform-2026-10-15/DESIGN.md and EXPERIENCE.md, with the mock-ups in mockups/
- constraint — SPEC.md, section Constraints
Notes
- Decision: three epics cut by "usable early": platform and sign-in, then account self-service, then announcements and administration (user, 2026-10-15).
- Decision: the spec stays in
_bmad-output/specs/spec-ping-mee-self-service-platform/and is cited by path, because its companions use relative links. - Decision: the epic rule "split only for a distinct outcome, owner or a part usable early" is saved for later slicing (user, 2026-10-15).
- Decision: no spike; the user is not worried about any one area (2026-10-15).
- Assumption: the test environment is a test OU in the production AD with a scoped service account, and a dedicated OIDC application in the production authentik restricted to test users; there is no staging environment.
- Parked: nothing from the spec is deferred.
- Waits on epic-platform-and-sign-in because: every other epic uses its sign-in, directory adapter, sessions and mail outbox.