Add two example reverse-proxy configuration files to help operators
deploy pdftract serve with TLS and authentication in front of the
no-auth pdftract server.
- docs/operations/serve-nginx-example.conf: nginx config with Basic Auth,
proxy_pass to localhost:8080, /extract and /health endpoints
- docs/operations/serve-traefik-example.yaml: Traefik dynamic config with
BasicAuth middleware, buffering limits, separate health router
Both configs include top comments explaining the deployment model:
pdftract serve binds to 127.0.0.1:8080 with no auth; the reverse
proxy provides TLS termination and authentication.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Implement the manual release procedure for reproducing milestone
releases locally when Argo Workflows in iad-ci is degraded or
unavailable. This is the PB-13 fallback documented in the plan
(line 567) for the R13 risk register entry.
The runbook includes:
- Prerequisites (hardware, tools, cross-compilation toolchains)
- OpenBao secret paths for all release credentials
- 13-step release procedure covering:
1. Tag verification
2. Full CI suite run
3. Cross-compilation for 5 target triples × 2 feature variants
4. Binary verification
5. SHA-256 checksum generation
6. GPG signing of checksums
7. Python wheel building (maturin)
8. PyPI upload
9. crates.io publishing (pdftract-core → pdftract-cli order)
10. GitHub Release creation
11. mdBook building
12. Cloudflare Pages deployment
13. SLSA Level 2 attestation generation
- Failure mode recovery procedures (triple build failure,
PyPI upload failure, SLSA attestation failure)
- Idempotency and safe re-run rules per step
- Completion criteria (all channels must succeed)
- Continuity plan (written for a stranger)
Acceptance criteria:
- docs/operations/manual-release.md exists with all required sections
- Step-by-step procedure complete (all 13 steps)
- Manual release CHANGELOG record template present
- Failure modes documented for the three most likely partial failures
- Runbook is verbatim-executable by a non-author release lead
Closes: pdftract-4sj0
- Created docs/operations/manual-platform-smoke.md with comprehensive
smoke test runbook for KU-12 quarterly manual platform testing
- Added troubleshooting table covering all 14 doctor checks
- Cross-referenced runbook from installation.md and quickstart.md
- Added CI gate test (doctor_runbook_coverage.rs) to verify
troubleshooting table completeness
Acceptance criteria:
✓ Step 1: pdftract doctor as first section in runbook
✓ Troubleshooting table covers all FAIL-capable checks
✓ installation.md mentions pdftract doctor with runbook link
✓ quickstart.md uses pdftract doctor as first example command
✓ CI gate parses runbook and asserts all checks are present
✓ mdBook build succeeds
✓ No broken internal links
Closes: pdftract-653ah
