Decision Log

Last updated: 2026-06-22

Entries

Decision: LAN-only, single-user internal apps may run without per-app authentication by default.
Rationale: Per-app auth on every internal tool creates operational drag and usually bad credential sprawl. The correct control boundary is network access.
Future direction: If an app moves toward edge/public exposure, centralize access with Authelia/Traefik or a trusted remote access path such as Tailscale/Zero Trust, not random per-app passwords bolted on afterward.
Status: Accepted.

Decision: WikiDocs organization uses YAML-style frontmatter such as category: infrastructure or category: projects; do not create nested document folders for sidebar grouping.
Rationale: Nested filesystem subfolders under /home/docker/wikidocs/datasets/documents/ previously caused bullet-list/sidebar rendering bugs. The live WikiDocs container was patched to hide categorized pages from top-level navigation and show them under the matching category page.
Impact: New category pages remain as top-level document directories and carry category frontmatter.
Status: Accepted.

Decision: Watchtower remains monitor-only on Docker hosts and must not auto-update containers.
Rationale: Automatic container upgrades in a homelab with production-ish services are an availability incident pretending to be convenience.
Implementation: Use ghcr.io/nicholas-fedor/watchtower; alerts go to Gotify on 10.10.10.237:10143.
Status: Accepted.

Decision: WikiDocs dataset is exported/backed up into the mdziegiel/wikidocs GitHub repository and refreshed by scheduled automation.
Rationale: Flat-file wiki content needs versioned recovery outside the running container.
Status: Accepted.

Dates for decisions made before 2026-06-22 should be backfilled from session history or Michael confirmation.
Confirm whether the Authelia/Traefik phrasing should include Cloudflare Access as an equal future edge-auth option.