Vertex — open items

Tracked before prod is provisioned. Rollout order: prod first, then stage; every step needs the operator's explicit go.

Prerequisites

• AWS account on the paid plan (the Free plan caps RDS backup retention at 1 day)
• GHCR read-only token for image pulls (vertex-<env>/ghcr)
• Prod Cloudflare Tunnel created; token available
• Prod Google Cloud project + OAuth client; decide Internal vs External
• Prod subdomain on thetaxgraph.com chosen
• Repository access review (tracked privately)

Design questions

• Reminders cron — legacy used a host cron calling POST /internal/run-due-reminders. Proposed (no code change): a small cron sidecar container in the task calling localhost:8020 every 15 minutes with the internal token.
• cloudflared egress ports — confirm from the tunnel configuration to tighten vertex-<env>-task-sg.
• Vendor IPs — collect vendor_cidrs for IAM and the Cloudflare rule on the stage hostname.

Provisioning steps (prod)

1. Network + NAT
2. RDS
3. Secrets
4. IAM
5. ECS cluster + service (desired 0)
6. Build prod images from a chosen SHA
7. Service desired 1
8. Tunnel + Worker vertex-prod
9. Smoke test

Stage repeats the same steps with the same modules.