Ebbe BaßandClaude Sonnet 5.5
24de5878ed
Includes the BMAD install config, the initiative ticket tree, the portal context-resources scripts, and the .gitignore change that tracks BMAD files (generated _bmad/render/ is ignored). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt
64 lines
4.3 KiB
Markdown
64 lines
4.3 KiB
Markdown
---
|
|
tracker_id: ""
|
|
key: ""
|
|
type: initiative
|
|
title: "Users run their own account and the admin has one announcement channel"
|
|
parent: none
|
|
covers: [CAP-1, CAP-2, CAP-3, CAP-4, CAP-5, CAP-6, CAP-7, CAP-8, CAP-9, CAP-10]
|
|
after: []
|
|
assignee: ""
|
|
risk: high
|
|
---
|
|
|
|
# Users run their own account and the admin has one announcement channel
|
|
|
|
## Description
|
|
|
|
The ping-mee Self-Service Portal lets about ten homelab users change their own password, details and profile picture, and lets the admin announce planned downtime by e-mail and on a page. The spec owns the capabilities, constraints and non-goals; this initiative delivers them to production, internet-facing, in a form that can later be deployed elsewhere.
|
|
|
|
## Outcome
|
|
|
|
Family and friends change their own password, details and picture without the admin, and every planned downtime reaches opted-in users by e-mail and banner; the spec's success signal is the measure.
|
|
|
|
## Requirements
|
|
|
|
The numbered spec is the requirement source: CAP-1 to CAP-10 in `_bmad-output/specs/spec-ping-mee-self-service-platform/SPEC.md`. Requirement-level detail (FR-1 to FR-32) is in its PRD companion.
|
|
|
|
## Done when
|
|
|
|
1. A family member changes their own password, name, phone number and picture in the live portal with no admin help.
|
|
2. A scheduled downtime announcement reaches every opted-in user by e-mail and shows as a banner on the dashboard.
|
|
3. Injection, cross-user access and brute-force attempts against the live portal fail and appear in the audit log.
|
|
4. The portal runs from one Docker image configured only by environment variables on the Linux host behind the reverse proxy.
|
|
5. Consistent database backup files appear in the backup folder and the status page shows their age.
|
|
6. Every capability CAP-1 to CAP-10 is live for all users, not behind a flag.
|
|
|
|
## Boundaries
|
|
|
|
The portal and its adapters. Not an Active Directory admin console, not a password-reset flow, not a replacement for the PowerShell picture scripts or the identity provider; see the spec's non-goals. Tracer path: sign in through authentik, look up the user in the test OU, and see their name in the new page shell.
|
|
|
|
- Touch point: Active Directory (LDAPS) — the portal reads and writes through a service account; owner: epic-platform-and-sign-in
|
|
- Touch point: authentik (production) — a dedicated OIDC application for the portal; owner: epic-platform-and-sign-in
|
|
- Touch point: Zoraxy reverse proxy — trusted-proxy and client-IP settings; owner: epic-platform-and-sign-in
|
|
- Touch point: IONOS mail — SMTP credentials for the outbox; owner: epic-platform-and-sign-in
|
|
- Touch point: picture file share and the PowerShell sync task — write source files, read processed hashes, no script changes; owner: epic-account-self-service
|
|
- Touch point: Veeam copy job — copies the backup folder; owner: epic-announcements-and-administration
|
|
|
|
## References
|
|
|
|
- spec — _bmad-output/specs/spec-ping-mee-self-service-platform/SPEC.md, section Capabilities
|
|
- spec companion — _bmad-output/prds/prd-ping-mee-self-service-platform-2026-10-15/prd.md, sections Features and Cross-Cutting Requirements
|
|
- architecture — _bmad-output/architecture/architecture-ping-mee-self-service-platform-2026-10-15/ARCHITECTURE-SPINE.md, section Invariants & Rules (the decisions every epic adopts: AD-1 to AD-19)
|
|
- design — _bmad-output/ux-designs/ux-ping-mee-self-service-platform-2026-10-15/DESIGN.md and EXPERIENCE.md, with the mock-ups in mockups/
|
|
- constraint — SPEC.md, section Constraints
|
|
|
|
## Notes
|
|
|
|
- Decision: three epics cut by "usable early": platform and sign-in, then account self-service, then announcements and administration (user, 2026-10-15).
|
|
- Decision: the spec stays in `_bmad-output/specs/spec-ping-mee-self-service-platform/` and is cited by path, because its companions use relative links.
|
|
- Decision: the epic rule "split only for a distinct outcome, owner or a part usable early" is saved for later slicing (user, 2026-10-15).
|
|
- Decision: no spike; the user is not worried about any one area (2026-10-15).
|
|
- Assumption: the test environment is a test OU in the production AD with a scoped service account, and a dedicated OIDC application in the production authentik restricted to test users; there is no staging environment.
|
|
- Parked: nothing from the spec is deferred.
|
|
- Waits on epic-platform-and-sign-in because: every other epic uses its sign-in, directory adapter, sessions and mail outbox.
|