ONEDB-5 kpi.pensanta.com dashboard on whey (chat-duo-web model): single-file Node .mjs reads telemetry views -> static KPI pages.

ONEDB-5 · one-db · child of #697

kpi.pensanta.com dashboard on whey (chat-duo-web model): single-file Node .mjs reads telemetry views -> static KPI pages.

Ref: ONEDB-5 (#701)
Project: one-db
Parent: backlog #697 one-db: 5 telemetry sqlite -> Postgres17 consolidation (umbrella)
Status: todo
Priority: normal
Type: task
Assigned: coder-chatduo-cc coder
Created by: wi-cli-whey
Blocked reason: Q#47: kpi.pensanta.com exposure: Tailscale-only (bind whey tailnet IP, no TLS/cert ops, no public surface) vs public-TLS subdomain? Team rec = Tailscale-only; built exposure-agnostic so public later = bind+proxy change.
Created: 2026-06-06T03:39:26.539Z
Updated: 2026-06-06T08:45:58.124Z

Sub-items (1/2 done · 50%)

ref	title	status	priority	assignee
ONEDB-6	DECISION (Elazar): kpi.pensanta.com exposure - Tailscale-only (team rec: bind whey tailnet IP, no TLS/cert ops, no public attack surface) vs public-TLS	backlog	high	nw-whey-cc
ONEDB-14	kpi-web MANIFEST: add Track A views (usage.v_kpi_tokens_7d + context.v_kpi_compact_7d) to server.mjs allowlist + restart	done	normal	coder-chatduo-cc

+ Add sub-item

Questions

2026-06-06T03:42:38.551Z · q#47 · asked by wi-cli-whey → elazar · answered 2026-06-06T04:24:28.446Z by wi-cli-whey

kpi.pensanta.com exposure: Tailscale-only (bind whey tailnet IP, no TLS/cert ops, no public surface) vs public-TLS subdomain? Team rec = Tailscale-only; built exposure-agnostic so public later = bind+proxy change.

answer: Converted to standalone WI ONEDB-6 per Elazar (he wants bwis not wiQuestions). Decision still pending Elazar there.

Event log

2026-06-06T03:39:26.539Z · created · wi-cli-whey

parent=#1
2026-06-06T03:42:38.477Z · parentChanged · wi-cli-whey

parent=#697
2026-06-06T03:42:38.503Z · assigned · wi-cli-whey

coder-chatduo-cc / coder
2026-06-06T03:42:38.526Z · blocked · wi-cli-whey

blocked behind ONEDB-4 (needs SELECT* views before a view-reader web UI can be built)
2026-06-06T03:42:38.551Z · blocked · wi-cli-whey

blocked by question #47
2026-06-06T03:42:38.551Z · questionAsked · wi-cli-whey

kpi.pensanta.com exposure: Tailscale-only (bind whey tailnet IP, no TLS/cert ops, no public surface) vs public-TLS subdomain? Team rec = Tailscale-only; built exposure-agnostic so public later = bind+proxy change.
2026-06-06T04:24:28.445Z · questionAnswered · wi-cli-whey

Converted to standalone WI ONEDB-6 per Elazar (he wants bwis not wiQuestions). Decision still pending Elazar there.
2026-06-06T08:45:58.124Z · statusChanged · wi-cli-whey

Unblocked — ONEDB-4 views landed. coder-chatduo-cc may start brainstorm→spec.
2026-06-16T02:05:02.278Z · note · wi-cli-whey

DEPLOYED + LIVE on whey (bin-whey-cc verified 2026-06-15): kpi-web.service enabled+running since 2026-06-11 09:35 ART, /opt/kpi-web/server.mjs (node), LISTEN 127.0.0.1:9876, curl / -> HTTP 200, <title>kpi-web — telemetry</title>. Tailnet-only bind = matches team rec (exposure-agnostic default). Reads pg views via server-side MANIFEST allowlist (network/context/usage/kpi/dbsize, v_latest+v_largest). Status was never advanced past todo. Holding formal close pending ONEDB-6 exposure decision (Elazar), but the build/deploy itself is DONE.