2026-08-09 - 2026-11-09
Overview
147 Pull requests merged by 4 users
Merged
#156 feat(dns): public names via the Cloudflare Tunnel (Phase 2) — proxied CNAMEs, Plex/Headlamp LAN-only
Merged
#155 chore(cloudflared): rotate tunnel credential (old secret exposed in a transcript)
Merged
#154 fix(cloudflared): fsGroup so uid 65532 can read the 0440 credentials Secret
Merged
#153 Added cloudflare creds and tunnel config
Merged
#152 feat(cloudflared): Cloudflare Tunnel connector, Phase 1 (isolated, no traffic change)
Merged
#151 chore(deps): Update gitea.home.keithjackson.dev/home-network/conformance-runner:main Docker digest to 63e1aa7
Merged
#150 chore(deps): Update gitea.home.keithjackson.dev/home-network/agent-runner:main Docker digest to 89ce7ee
Merged
#131 chore(deps): Update Helm release longhorn to <1.14.0
Merged
#149 feat(ci): run L0/L1 offline checks, mutation suites and yamllint in bounded parallel pools
Merged
#147 feat(ci): run the merge gate inside the CI-built toolbox image, pinned by digest
Merged
#146 feat(gitea-actions): act_runner capacity 2, dind sized for two concurrent jobs
Merged
#136 chore(deps): Update quay.io/oauth2-proxy/oauth2-proxy Docker tag to v7.15.6
Merged
#148 fix(keycloak): one owner for the keycloak ServiceMonitor (26.8 operator 409 loop blocks Flux)
Merged
#145 chore(renovate): hand-migrate docker key, track gitea/runner, keep range lower bounds
Merged
#144 fix(keycloak): install the 26.8.2 operator's new CRDs (operator CrashLoop)
Merged
#121 chore(deps): Update dependency keycloak/keycloak-k8s-resources to v26.8.2
Merged
#142 feat(gitea): upgrade 1.27.3 -> 28.3.0
Merged
#143 feat(devcontainer): bake velero CLI into the toolbox, pinned to prod server v1.18.2
Merged
#113 chore(deps): Update actions/upload-artifact action to v7
Merged
#112 chore(deps): Update actions/checkout action to v7
Merged
#114 chore(deps): Update docker Docker tag to v29
Merged
#124 chore(deps): Update ghcr.io/cloudnative-pg/postgresql Docker tag to v16.15
Merged
#130 chore(deps): Update Helm release headlamp to <0.47.0
Merged
#141 feat(conformance): L0 guard — external-dns annotationPrefix must match the tree (stacked on #140)
Merged
#140 fix(dns): pin external-dns annotationPrefix — v0.23 ignored every alpha annotation
Merged
#129 chore(deps): Update Helm release external-dns to <1.24.0
Merged
#117 feat: PM-Agent also need to look at PR comments
Merged
#135 chore(deps): Update python Docker tag to v3.15.2
Merged
#127 chore(deps): Update gitea/act_runner Docker tag to v0.6.1
Merged
#128 chore(deps): Update gitea/gitea Docker tag to v1.27.3
Merged
#138 chore(deps): Update registry.k8s.io/sig-storage/snapshot-controller Docker tag to v8.7.0
Merged
#137 chore(deps): Update registry.gitlab.com/crafty-controller/crafty-4 Docker tag to v4.11.0
Merged
#134 chore(deps): Update nginxinc/nginx-unprivileged Docker tag to v1.31.7
Merged
#133 chore(deps): Update lscr.io/linuxserver/radarr Docker tag to v5.28.0
Merged
#132 chore(deps): Update lscr.io/linuxserver/qbittorrent Docker tag to v5.3.0
Merged
#126 chore(deps): Update ghcr.io/seerr-team/seerr Docker tag to v3.5.1
Merged
#125 chore(deps): Update ghcr.io/gethomepage/homepage Docker tag to v2.7.0
Merged
#123 chore(deps): Update favonia/cloudflare-ddns Docker tag to v1.18.0
Merged
#122 chore(deps): Update docker.io/library/alpine Docker tag to v3.24
Merged
#120 chore(deps): Update velero/velero-plugin-for-aws Docker tag to v1.14.4
Merged
#119 chore(deps): Update semaphoreui/semaphore Docker tag to v2.19.17
Merged
#118 chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3025-ls29
Merged
#104 chore(deps): Update Helm release cilium to v1.20.4
Merged
#111 chore(deps): Update plexinc/pms-docker Docker tag to v1.43.6.11085-d1e52e169
Merged
#110 chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3009-ls26
Merged
#109 chore(deps): Update pihole/pihole Docker tag to v2026.10.1
Merged
#108 chore(deps): Update docker.io/moby/buildkit Docker tag to v0.34.2
Merged
#107 chore(deps): Update lscr.io/linuxserver/sonarr Docker tag to v4.0.20
Merged
#106 chore(deps): Update kubevirt-cdi
Merged
#105 chore(deps): Update intel/intel-gpu-plugin Docker tag to v0.37.1
Merged
#102 chore(deps): Update dependency intel/intel-device-plugins-for-kubernetes to v0.37.1
Merged
#100 chore(pm-agent): pin agent-runner to the run-394 digest (466f63e, PR #99), bump config-generation
Merged
#99 fix(pm-agent): log the CLI's stdout envelope when triage fails; add PM_DECISION_MAX_TURNS
Merged
#98 chore(pm-agent): take the dispatcher out of dry run (operator-approved), config-generation 4
Merged
#96 chore(pm-agent): pin agent-runner to the run-383 digest (ddd04d4), bump config-generation
Merged
#95 Added the credentials
Merged
#61 feat(pm-agent): pull credential + admission rule 7, first published digest pinned, dry-run first start, token scopes fixed
Merged
#94 feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them
Merged
#89 chore(deps): Pin dependencies
Merged
#92 chore(deps): Update gitea.home.keithjackson.dev/home-network/conformance-runner:main Docker digest to 65cc7c1
Merged
#93 chore(deps): Update gitea.home.keithjackson.dev/home-network/toolbox:main Docker digest to d435fab
Merged
#90 chore(deps): Update gitea.home.keithjackson.dev/home-network/agent-runner:main Docker digest to c4eba5b
Merged
#87 fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version
Merged
#88 feat(renovate): track the Keycloak operator (the real Keycloak version), never auto-merge it
Merged
#86 fix(renovate): edit catalog sources, track CNPG imageName, honour update.range, guard real-run auto-merges
Merged
#85 fix(renovate): document and probe the five token scopes Renovate needs; lint daemon-bound actions
Merged
#84 fix(renovate): run Renovate as the job container; the action needs a Docker daemon jobs do not get
Merged
#82 fix(keycloak-passkey): passkey reconciler with review fixes — bind only on git's say-so (default false), protect real sub-flows, body-id screening, failure alert
Merged
#83 fix(buildkit): allow buildkitd egress to Gitea so the Gateway stops 403ing the registry push
Merged
#81 feat(images): build, verify and publish the three images in CI on rootless BuildKit; Renovate carries the digests
Merged
#80 fix(renovate): the workflow still named renovate.json, so every run since #79 died with ENOENT
Merged
#79 fix(renovate): the config was INVALID, so the first manual run errored out
Merged
#77 fix(renovate): the cron fired outside Renovate's own window, so it would never open a PR
Merged
#78 fix(pihole): make the split-horizon answer cacheable (local-ttl=60)
Merged
#76 fix(conformance): one regex made the merge gate take 28 minutes instead of 2
Merged
#75 fix(unattended-upgrades): Debian has no reboot-sentinel package, so ship the writer
Merged
#73 feat(upgrades): automate node reboots (kured) and wire Renovate, which had never run
Merged
#71 feat(shutdown): configure graceful node shutdown, and never scale a Delete-policy StatefulSet
Merged
#74 fix(coredns): hold in-cluster DNS at 2 replicas via an HPA, because k3s owns the Deployment
Merged
#72 feat(keycloak): add passkey (WebAuthn passwordless) login, additive and optional
Merged
#70 fix(oauth2-proxy): gate startup on Keycloak discovery, or a cold boot CrashLoops the proxy
Merged
#68 Expand plex volume
Merged
#67 fix(bulk-nfs): repoint at the TrueNAS (192.168.2.30); the PVs must be recreated, not reconciled
Merged
#66 fix(vpn-ingress): content-hash the peer register, or a merged peer never reaches the tunnel
Merged
#65 Added my phone to peers
Merged
#64 fix(vpn-ingress): new-peer.sh counted its own commented-out example as an allocated address
Merged
#63 fix(vpn-ingress): stop trying to set net.ipv4.ip_forward — a hostNetwork pod cannot, and wg-quick dies on a failed PostUp
Merged
#62 Changed secret
Merged
#60 fix(vpn-ingress): keep the server key in source through SOPS, not as an out-of-band Secret
Merged
#59 fix(node): pin gitea to the Gateway VIP — the failing certificate was the router's, not the Gateway's
Merged
#57 feat(pm-agent): an in-cluster AI Program Manager that turns Gitea issues into pull requests
Merged
#58 fix(runbooks): vpn-remote-access step 1 named a nonexistent script; step 2 cited the wrong gitignore rule
Merged
#56 docs(agents): one workspace per agent run — the shared checkout is off-limits
Merged
#55 feat(vpn-ingress): WireGuard remote access on udp/51820 — hostNetwork, because a pod identity would 403 every Gateway hostname
Merged
#53 feat(cilium): roll the agents when cilium-config changes (merged config was silently inert)
Merged
#52 fix(plex): advertise a resolver-independent plex.direct name again (LAN-wide outage)
Merged
#51 fix(plex): unblock the app tier — drop the Certificate that stalled apps-wave-0, advertise http
Merged
#48 feat(plex): one advertised hostname for local+remote, its own LE cert, and a LAN definition so LAN clients stop reading as remote
Merged
#50 feat(cilium): export Plex's pre-SNAT client address via Hubble, scoped to tcp/32400
Merged
#49 fix(obs): open 44180 to ns monitoring so the forward-auth gate sidecars are actually scrapable
Merged
#47 fix(plex): advertise the plex.direct name, not the bare VIP (server vanished from the plex.tv account)
Merged
#42 fix(cilium): point cgroup.hostRoot at the host cgroup2 root (socket-LB never covered host processes)
Merged
#46 docs(decisions): record that PiHole HA is verified live, failover drill included
Merged
#45 feat(pihole): two replicas on different nodes, and fix a PVC mounted where pihole never writes
Merged
#44 feat(pihole): declare the admin password and adlists in git
Merged
#43 feat(plex): expose tcp/32400 for remote access via a pinned LoadBalancer VIP
Merged
#41 fix(node-baseline): pin the OIDC issuer to the Gateway VIP on prod nodes
Merged
#40 feat(dns): publish Gateway names to the WAN via in-cluster DDNS
Merged
#39 fix(runbooks): Plex hw transcoding WORKS — the dashboard was never the proof
Merged
#38 fix(ci): let an administrator merge their own green PR — required_approvals 1 → 0, plus an attributed /approve-override
Merged
#35 Added arr suite ability to connect to plex
Merged
#37 feat(gpu): satisfy hardware.gpu: intel-quicksync with gpu.intel.com/i915 instead of a /dev/dri hostPath (the hostPath was measured not to work: device-cgroup EPERM)
Merged
#29 feat(obs): make oauth2-proxy auth failures visible — the gates emit nothing
Merged
#33 fix(ci): catalog/render.py's 106 selftest assertions never ran in the gate
Merged
#34 feat(auth): declare API paths per service, so --api-route can ship at all
Merged
#36 feat(gpu): Intel GPU device plugin v0.37.0 — nodes advertise gpu.intel.com/i915
Merged
#32 feat(plex): hardware transcoding via hardware.gpu: intel-quicksync, plus the runbook for the manual last mile
Merged
#27 feat(schema): declare a host hardware capability, hardware.gpu: intel-quicksync
Merged
#30 fix(jackett): root-cause the oauth2-proxy session loss; the fix cannot be scoped to one app
Merged
#31 feat(node-health): probe the Intel render device, read-only
Merged
#28 fix(auth): five oauth2-proxy sidecars shared one cookie, died at 5 minutes, and served no metrics
Merged
#26 fix(obs): the deploy notification was inhibited before it could send
Merged
#25 feat(obs): notify on Flux deploy start and completion
Merged
#17 feat(ci): the pipeline is the approver
Merged
#20 feat(conformance): the in-cluster Job can now run a named commit and get its results out
Merged
#18 feat(conformance): build the runner image the in-cluster L2/L3 Job could never have run
Merged
#19 feat(sec): provision the narrow conformance CI trigger credential -- and refuse to arm a fake green
Merged
#22 fix(crafty): the Keycloak gate works — Crafty's own login was the wall
Merged
#24 chore(log): the handoff log was serialising every parallel branch
Merged
#21 docs(ci): the wiring comment named a secret Gitea cannot accept
Merged
#23 docs(crafty): Bedrock on 19132 RESOLVED — a player has joined; the wall was an empty allowlist
Merged
#16 fix(sec): the R-SEC-02 admission policy was never applied
Merged
#14 docs(decisions-log): end-of-session PM handoff
Merged
#13 feat(sec): constrain the conformance CI trigger at admission
Merged
#12 fix(ci): CLUSTER_AVAILABLE=true would have faked a green
Merged
#15 fix(ci): the settings token could never have been stored
Merged
#11 feat(ci): detect Gitea settings drift
Merged
#10 fix(gitea): admins could override the gate
Merged
#9 docs(ci): close out the hardening; correct a claim that shipped wrong
Merged
#7 fix(ci): convert dind to a native sidecar; delete both wait loops
Merged
#6 fix(ci): delete the per-branch push triggers instead of adding feat/**
Merged
#5 docs(runbooks): the PR flow, not git push origin main
Merged
#8 docs: correct CI/platform documentation that was stale or wrong
Merged
#4 chore(plex): fresh plex.tv claim token
Merged
#1 feat(plex): wire PLEX_CLAIM from a SOPS Secret (placeholder value)
Merged
#3 docs(gitea): a skipped job reports SUCCESS, not pending
Merged
#2 docs: delivery contract for agents + record that the merge gate does not exist
2 Pull requests proposed by 2 users
Proposed
#101 docs: Massive amounts of historical data
Proposed
#157 feat(dns): PiHole answers an explicit LAN name list, not a zone wildcard
1 Issue closed from 1 user
Closed
#116 PM-Agent also need to look at PR comments
3 Issues created by 2 users
Opened
#91 Dependency Dashboard
Opened
#97 Massive amounts of historical data
Opened
#116 PM-Agent also need to look at PR comments