Open Decisions

Open decisions and risks

Decided

Decision	Outcome	Record
Control plane language	Rust, one Cargo workspace, one binary	ADR-001
Agent model	One root agent with an operation whitelist	ADR-002
Host OS	Ubuntu 26.04 LTS primary; Fedora and Debian 13 secondary; SELinux-aware generation kept	ADR-008
Panel database	PostgreSQL from day one	ADR-004
API style	ConnectRPC over Protobuf	ADR-005
CLI safety tiers	marik / maurice / maurice-odysseus-stella over token scopes	ADR-007
UI	Solid SPA in the binary, own kit on Kobalte	ADR-006

Still open

Question	Options	Decide by
Caddy vs Traefik	Caddy via admin API is runtime-independent; Traefik is convenient with labels but ties the proxy to Podman	MVP (leaning Caddy)
Is HAProxy L4 needed	Only for DDoS / raw TCP traffic; otherwise an extra component	MVP, based on load
Rootful services (nodes, ClickHouse)	Manage through the panel as external units or keep outside the panel	MVP
Plan storage format	JSON diffs in the DB vs a git repository of generated units	MVP
LLM for log triage	Haiku / provider mini models / local CPU model	Beta
Default tracker	Plane self-hosted (chosen); Jira/Linear as external drivers	Beta

Systemic risks. One server is a single point of failure for everything, including the panel: backups of panel state and a documented manual recovery are mandatory. Rootless Podman is less battle-tested under heavy network load than rootful — such services stay rootful. The Quadlet-panel ecosystem is young (Rookery, quadletman, quadlet_manager, Rivetr); nothing Coolify-grade on Quadlet exists, so much will be built here, with those projects serving as references for the agent and compose import.