2026-10-09 - 2026-11-09
Overview
82 Pull requests merged by 4 users
Merged
#156 feat(dns): public names via the Cloudflare Tunnel (Phase 2) — proxied CNAMEs, Plex/Headlamp LAN-only
Merged
#155 chore(cloudflared): rotate tunnel credential (old secret exposed in a transcript)
Merged
#154 fix(cloudflared): fsGroup so uid 65532 can read the 0440 credentials Secret
Merged
#153 Added cloudflare creds and tunnel config
Merged
#152 feat(cloudflared): Cloudflare Tunnel connector, Phase 1 (isolated, no traffic change)
Merged
#151 chore(deps): Update gitea.home.keithjackson.dev/home-network/conformance-runner:main Docker digest to 63e1aa7
Merged
#150 chore(deps): Update gitea.home.keithjackson.dev/home-network/agent-runner:main Docker digest to 89ce7ee
Merged
#131 chore(deps): Update Helm release longhorn to <1.14.0
Merged
#149 feat(ci): run L0/L1 offline checks, mutation suites and yamllint in bounded parallel pools
Merged
#147 feat(ci): run the merge gate inside the CI-built toolbox image, pinned by digest
Merged
#146 feat(gitea-actions): act_runner capacity 2, dind sized for two concurrent jobs
Merged
#136 chore(deps): Update quay.io/oauth2-proxy/oauth2-proxy Docker tag to v7.15.6
Merged
#148 fix(keycloak): one owner for the keycloak ServiceMonitor (26.8 operator 409 loop blocks Flux)
Merged
#145 chore(renovate): hand-migrate docker key, track gitea/runner, keep range lower bounds
Merged
#144 fix(keycloak): install the 26.8.2 operator's new CRDs (operator CrashLoop)
Merged
#121 chore(deps): Update dependency keycloak/keycloak-k8s-resources to v26.8.2
Merged
#142 feat(gitea): upgrade 1.27.3 -> 28.3.0
Merged
#143 feat(devcontainer): bake velero CLI into the toolbox, pinned to prod server v1.18.2
Merged
#113 chore(deps): Update actions/upload-artifact action to v7
Merged
#112 chore(deps): Update actions/checkout action to v7
Merged
#114 chore(deps): Update docker Docker tag to v29
Merged
#124 chore(deps): Update ghcr.io/cloudnative-pg/postgresql Docker tag to v16.15
Merged
#130 chore(deps): Update Helm release headlamp to <0.47.0
Merged
#141 feat(conformance): L0 guard — external-dns annotationPrefix must match the tree (stacked on #140)
Merged
#140 fix(dns): pin external-dns annotationPrefix — v0.23 ignored every alpha annotation
Merged
#129 chore(deps): Update Helm release external-dns to <1.24.0
Merged
#117 feat: PM-Agent also need to look at PR comments
Merged
#135 chore(deps): Update python Docker tag to v3.15.2
Merged
#127 chore(deps): Update gitea/act_runner Docker tag to v0.6.1
Merged
#128 chore(deps): Update gitea/gitea Docker tag to v1.27.3
Merged
#138 chore(deps): Update registry.k8s.io/sig-storage/snapshot-controller Docker tag to v8.7.0
Merged
#137 chore(deps): Update registry.gitlab.com/crafty-controller/crafty-4 Docker tag to v4.11.0
Merged
#134 chore(deps): Update nginxinc/nginx-unprivileged Docker tag to v1.31.7
Merged
#133 chore(deps): Update lscr.io/linuxserver/radarr Docker tag to v5.28.0
Merged
#132 chore(deps): Update lscr.io/linuxserver/qbittorrent Docker tag to v5.3.0
Merged
#126 chore(deps): Update ghcr.io/seerr-team/seerr Docker tag to v3.5.1
Merged
#125 chore(deps): Update ghcr.io/gethomepage/homepage Docker tag to v2.7.0
Merged
#123 chore(deps): Update favonia/cloudflare-ddns Docker tag to v1.18.0
Merged
#122 chore(deps): Update docker.io/library/alpine Docker tag to v3.24
Merged
#120 chore(deps): Update velero/velero-plugin-for-aws Docker tag to v1.14.4
Merged
#119 chore(deps): Update semaphoreui/semaphore Docker tag to v2.19.17
Merged
#118 chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3025-ls29
Merged
#104 chore(deps): Update Helm release cilium to v1.20.4
Merged
#111 chore(deps): Update plexinc/pms-docker Docker tag to v1.43.6.11085-d1e52e169
Merged
#110 chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3009-ls26
Merged
#109 chore(deps): Update pihole/pihole Docker tag to v2026.10.1
Merged
#108 chore(deps): Update docker.io/moby/buildkit Docker tag to v0.34.2
Merged
#107 chore(deps): Update lscr.io/linuxserver/sonarr Docker tag to v4.0.20
Merged
#106 chore(deps): Update kubevirt-cdi
Merged
#105 chore(deps): Update intel/intel-gpu-plugin Docker tag to v0.37.1
Merged
#102 chore(deps): Update dependency intel/intel-device-plugins-for-kubernetes to v0.37.1
Merged
#100 chore(pm-agent): pin agent-runner to the run-394 digest (466f63e, PR #99), bump config-generation
Merged
#99 fix(pm-agent): log the CLI's stdout envelope when triage fails; add PM_DECISION_MAX_TURNS
Merged
#98 chore(pm-agent): take the dispatcher out of dry run (operator-approved), config-generation 4
Merged
#96 chore(pm-agent): pin agent-runner to the run-383 digest (ddd04d4), bump config-generation
Merged
#95 Added the credentials
Merged
#61 feat(pm-agent): pull credential + admission rule 7, first published digest pinned, dry-run first start, token scopes fixed
Merged
#94 feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them
Merged
#89 chore(deps): Pin dependencies
Merged
#92 chore(deps): Update gitea.home.keithjackson.dev/home-network/conformance-runner:main Docker digest to 65cc7c1
Merged
#93 chore(deps): Update gitea.home.keithjackson.dev/home-network/toolbox:main Docker digest to d435fab
Merged
#90 chore(deps): Update gitea.home.keithjackson.dev/home-network/agent-runner:main Docker digest to c4eba5b
Merged
#87 fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version
Merged
#88 feat(renovate): track the Keycloak operator (the real Keycloak version), never auto-merge it
Merged
#86 fix(renovate): edit catalog sources, track CNPG imageName, honour update.range, guard real-run auto-merges
Merged
#85 fix(renovate): document and probe the five token scopes Renovate needs; lint daemon-bound actions
Merged
#84 fix(renovate): run Renovate as the job container; the action needs a Docker daemon jobs do not get
Merged
#82 fix(keycloak-passkey): passkey reconciler with review fixes — bind only on git's say-so (default false), protect real sub-flows, body-id screening, failure alert
Merged
#83 fix(buildkit): allow buildkitd egress to Gitea so the Gateway stops 403ing the registry push
Merged
#81 feat(images): build, verify and publish the three images in CI on rootless BuildKit; Renovate carries the digests
Merged
#80 fix(renovate): the workflow still named renovate.json, so every run since #79 died with ENOENT
Merged
#79 fix(renovate): the config was INVALID, so the first manual run errored out
Merged
#77 fix(renovate): the cron fired outside Renovate's own window, so it would never open a PR
Merged
#78 fix(pihole): make the split-horizon answer cacheable (local-ttl=60)
Merged
#76 fix(conformance): one regex made the merge gate take 28 minutes instead of 2
Merged
#75 fix(unattended-upgrades): Debian has no reboot-sentinel package, so ship the writer
Merged
#73 feat(upgrades): automate node reboots (kured) and wire Renovate, which had never run
Merged
#71 feat(shutdown): configure graceful node shutdown, and never scale a Delete-policy StatefulSet
Merged
#74 fix(coredns): hold in-cluster DNS at 2 replicas via an HPA, because k3s owns the Deployment
Merged
#72 feat(keycloak): add passkey (WebAuthn passwordless) login, additive and optional
Merged
#70 fix(oauth2-proxy): gate startup on Keycloak discovery, or a cold boot CrashLoops the proxy
Merged
#68 Expand plex volume
2 Pull requests proposed by 2 users
Proposed
#101 docs: Massive amounts of historical data
Proposed
#157 feat(dns): PiHole answers an explicit LAN name list, not a zone wildcard
1 Issue closed from 1 user
Closed
#116 PM-Agent also need to look at PR comments
3 Issues created by 2 users
Opened
#91 Dependency Dashboard
Opened
#97 Massive amounts of historical data
Opened
#116 PM-Agent also need to look at PR comments