Skip to content

docs: add per-service setup guides with least-privilege credentials - #144

Merged
EraPartner merged 3 commits into
mainfrom
claude/project-thread-osfbko
Oct 28, 2026
Merged

EraPartner merged 3 commits into
mainfrom
claude/project-thread-osfbko

Conversation

@EraPartner

@EraPartner EraPartner commented Oct 28, 2026 •

Copy link
Copy Markdown
Owner

Requested by EraPartner · project thread

What

New docs/guides/service-setup/ with an index and one guide per service kind (13). Each guide covers:

  1. What to enable on the service.
  2. Which credential to create, using the narrowest one the service offers. Examples: a Bitcoin rpcauth user with an rpcwhitelist of exactly the methods Watchman calls, an Alby Hub readonly token, a read-only SNMP community limited to the subtrees Watchman walks, SNMPv3 for Synology, and non-admin SSH users with restrict,from= keys.
  3. What to enter in each Watchman form field.
  4. How to check that it works, and a troubleshooting table based on the error strings in the code.

Every "what Watchman reads" list was taken from the service code (apps/backend/src/domain/services/*, bootstrap/registerServices.ts, config/schemas/fieldMetadata.ts).

Doc drift fixed along the way

  • integrations/adguard.md: removed the claim about "protection toggle control" (Watchman is read-only, ADR-032).
  • integrations/homebridge.md: the health probe is statusPath (/api/status/server-information), not /api/status/homebridge.
  • integrations/bitcoin.md: removed "optionally through Tor" (no proxy support in code). Marked zmqRawtxEndpoint as stored but unused.
  • guides/index.md: rebuilt the broken guide table.
  • components/use-service-health.md: rewritten from apps/frontend/src/hooks/useServiceHealth.ts. It described useAdGuardProtectionToggle and useClearCache hooks that don't exist, and old signatures. (api/adguard.md and components/optimized-service-card.md also mention them, but they are already marked superseded/deprecated, so I left them.)

Links

Each integration page links to its guide. The guides are also linked from integrations/index.md, guides/index.md, INDEX.md and getting-started.md. I added a CHANGELOG entry.

Decisions (picked per the project's best-option rule)

Decision Choice Why
Where the guides live A new docs/guides/service-setup/ folder, not new sections in docs/integrations/* The integration pages are developer reference. Users need short step-by-step pages. Each guide and integration page link to each other.
Claims I couldn't test (third-party config syntax, permissions) Marked inline with [!warning] Unverified There was no live service and limited network access. Project rule: never overstate.
Test connection Documented as fixed: OK when the service answers, Failed: <reason> when it doesn't #146 (merged) makes the editor read snapshot.reachable (apps/frontend/src/lib/connectionTest.ts). The earlier "known issue" callout is removed.

Bugs found, not fixed here (reported to the bug threads)

Validation

  • Docs-only change, so CI doesn't run (paths-ignore: docs/**, *.md).
  • A local script checked that the new and changed pages have the required frontmatter fields (title, type, status, date, tags, description, aliases) and that every docs/ wikilink in the new guides resolves: 0 problems.
  • Rebased onto main at f0a6fd2 (fix(frontend): UI bug pass (enable toggle, test result, detail sheet, nav, errors) #146).
  • Prettier isn't available in the cloud environment, so it wasn't run.
  • No OpenAPI, PlantUML or flow-visualizer changes are needed: there are no behaviour, API or architecture changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_018QJtaHZGu52MpwGvKuHP8x

@EraPartner EraPartner self-assigned this Oct 28, 2026
@EraPartner
EraPartner marked this pull request as ready for review October 28, 2026 08:13
@EraPartner
EraPartner enabled auto-merge (squash) October 28, 2026 08:13
@EraPartner
EraPartner disabled auto-merge October 28, 2026 08:22
@EraPartner
EraPartner force-pushed the claude/project-thread-osfbko branch from 60333f5 to 951677f Compare October 28, 2026 08:23
@EraPartner
EraPartner enabled auto-merge (squash) October 28, 2026 08:23
Add docs/guides/service-setup/ with an index and one guide for each of
the 13 service kinds: what to enable on the service, which read-only or
least-privilege credentials to create, what to enter in Watchman, and
troubleshooting keyed to the error messages in the code.

Link the guides from the integration pages and indexes, and fix doc
drift found while checking against the code: AdGuard no longer claims
toggle control, the Homebridge health probe path, Bitcoin's Tor claim,
and the unused zmqRawtxEndpoint.
#146 made Test connection report an unreachable service as Failed, so
the setup guides no longer need the known-issue callout.

docs/components/use-service-health.md described a protection-toggle
mutation hook and a cache-clear hook that don't exist; rewrite it from
apps/frontend/src/hooks/useServiceHealth.ts (read-only, ADR-032).
Rebased onto #145/#147/#148: document SSH host-key pinning (Mac Mini,
Pi), the DSM certificate fingerprint and DSM-only health, the now-used
Bitcoin rawtx ZMQ endpoint, Roon pairing state in DATA_DIR, and the
new error messages and login backoffs.
@EraPartner
EraPartner force-pushed the claude/project-thread-osfbko branch from 951677f to 281a7ed Compare October 28, 2026 11:49
@EraPartner
EraPartner merged commit 09f5f9a into main Oct 28, 2026
1 check passed
@EraPartner
EraPartner deleted the claude/project-thread-osfbko branch October 28, 2026 11:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants