# Requirement Verification Questions — atheos-blog-lxc

**Project**: Alpine LXC running Atheos, wired to Gitea, with `armistace/blog` cloned and ready.
**Stage**: INCEPTION — Requirements Analysis
**Date**: 2026-09-29

Answer each question by writing your choice after the `[Answer]:` tag (e.g. `[Answer]: B`).
Option **X) Other** is always available — describe it after the tag.

---

## 0. CRITICAL FINDING — please read before answering Q1

Reconnaissance found that **`armistace/blog` is a Pelican static site, not a folder of markdown**:

```
src/content/*.md          ← ~20 posts (the actual writing)
src/themes/cleanblog/     ← theme
src/pelicanconf.py        ← build config
src/Makefile              ← `make html`, `make serve-global`, `make github`
requirements.txt          ← pelican[markdown], markdown-markup-emoji
```

So there are two different needs, and they need different tools:

- **Atheos** = a browser editor. It edits files and does git (its `codegit` component).
  It can edit the `.md`, commit and push — but it **cannot build or publish** the site.
- **Publishing the site** = running `make html` (+ `make github` / `pelican`), which needs
  **Python + pelican**, not PHP.

**Q1. How important is it that this box can also BUILD/PUBLISH the site?**
- A) **Editor only** — I'll build/publish elsewhere (CI or another box). Atheos just edits + commits.
- B) **Also include Pelican** — install Python + pelican + make so I can run `make html` /
  `make serve` on this box to preview and regenerate the site.
- C) **Also include Pelican AND a local preview server** — so I can click through the built site
  from the browser on this LXC before pushing.
- X) Other (please describe after [Answer]: tag below)

[Answer]:

---

**Q2. Does Atheos's git integration need to work non-interactively (credentials pre-wired),
or will you supply them when you first push?**
- A) **Bake in the git identity + let me push over HTTPS with a Gitea token** (I'll give you /
  you use an existing scoped token) so push works immediately without a prompt.
- B) **Clone read-only / leave push to me** — set up the clone and git config, but leave the
  credential to me (e.g. via SSH key I install myself, per my point 4).
- C) **Use SSH from the start** — configure the remote as `git@git.aridgwayweb.com:armistace/blog.git`
  and just wait for the key I'll add.
- X) Other (please describe after [Answer]: tag below)

[Answer]:

---

**Q3. Which PVE node should host the LXC, and on which storage?**
- A) **janeway (.225)** — 3.3 GB RAM free, `extra` storage 874 GB free. (Recommended: roomy.)
- B) **data (.42)** — only ~0.95 GB RAM free and no swap; a 20 GB guest is fine on disk but the
  node is tight. (Not recommended.)
- C) **You pick** whatever is healthiest at build time.
- X) Other (please describe after [Answer]: tag below)

[Answer]:

---

**Q4. Should the container be reachable only on the LAN, or exposed via NPM
(nginx proxy manager) with a hostname like `blog-ide.aridgwayweb.com`?**
- A) **LAN only** — browse to `http://<lxc-ip>/`. Simplest, nothing new exposed.
- B) **Add an NPM proxy host** — I get a hostname; you add the proxy host + DNS (you own NPM).
- C) **LAN now, NPM later** — build LAN-only, leave a RUNBOOK section for adding NPM.
- X) Other (please describe after [Answer]: tag below)

[Answer]:

---

**Q5. Extensions (AI-DLC security/resiliency baseline). Your usual choice is to opt OUT for a
LAN-only PoC, and I document the "what to do if this ever moves external" TODOs instead. Confirm?**
- A) **Opt out of both, document the TODOs** (your standing preference).
- B) **Enable security-baseline** too.
- C) **Enable resiliency-baseline** too.
- D) **Enable both.**
- X) Other (please describe after [Answer]: tag below)

[Answer]:

---

## Notes / assumptions I'll carry unless you say otherwise

- **Q6 (implicit, shout if wrong):** "downloads … ready for me to use" = the repo is cloned to a
  path Atheos can open as a **project**, on the correct branch, with git identity configured —
  not that the container does anything to the blog's remote. The blog stays a separate repo; this
  project's repo holds the **provisioning**.
- LXC defaults I propose: **2 vCPU, 1 GB RAM, 20 GB root**, Alpine 3.23, `onboot=1`, unprivileged.
- I will **not** touch `armistace` SSH keys — that's your point 4.