2026-09-29 Order Ledger

TL;DR

Order Ledger is wired as an infra-services app at orders.infra.realemail.app. The dashboard and Telegram bot are not live until the owner encrypts SOPS, recreates periphery, and connects Gmail. Komodo builds the private app repo after the rest of deploy-infra.

Phase status

Item	Status
App image source	Private spadoople/gmail-order-tracker-bot
Homelab stack	Compose, inventory, alerts, and backup policy in git
Live containers	Waiting on owner secrets and periphery mounts
Authentik	Dashboard uses authentik@file; OAuth callback bypasses it

What shipped

• Container-ready app: public origin, /healthz, /metrics, bot heartbeat.
• services/orders/ plus Komodo repo orders-source and procedure deploy-orders.
• Ansible SOPS render, tier-1 SQLite backup, Prometheus alerts, and a Grafana dashboard.

Known gaps / drift

• .env.sops.yaml is not in git yet. Predeploy will fail closed until it is encrypted and rendered.
• komodo-periphery does not see /opt/orders until that stack is recreated. Komodo is self-managed, so deploy-infra will not do it.

What remains

1. Owner: Google OAuth client, 17TRACK token, Telegram bot token, and allowed chat id in encrypted services/orders/.env.sops.yaml.
2. Owner: merge, recreate periphery, render secrets, run deploy-orders.
3. Owner: sign in, connect Gmail, and confirm the bot replies.

flowchart LR
  komodo[deploy-orders] --> source["/opt/orders"]
  source --> web[orders]
  source --> bot[orders-bot]
  web --> volume["/var/lib/homelab/orders"]
  bot --> volume