renovate-bot
26c3901bc6
Merge pull request 'chore(deps): Update docker.io/cloudflare/cloudflared Docker tag to v2026.11.0' ( #177 ) from renovate/docker.io-cloudflare-cloudflared-2026.x into main
gate / gate (push) Successful in 47s
gate / conformance (push) Skipped
2026-11-15 08:19:37 +00:00
renovate-bot
ffcdad6cb2
Merge pull request 'chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3065-ls36' ( #176 ) from renovate/lscr.io-linuxserver-jackett-0.x into main
gate / gate (push) Canceled after 1s
gate / conformance (push) Canceled after 0s
2026-11-15 08:18:41 +00:00
renovate-bot
eec8994e0f
chore(deps): Update docker.io/cloudflare/cloudflared Docker tag to v2026.11.0
gate / gate (pull_request) Successful in 56s
gate / conformance (pull_request) Skipped
2026-11-15 08:17:38 +00:00
renovate-bot
e019974c9b
chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3065-ls36
gate / gate (pull_request) Successful in 1m2s
gate / conformance (pull_request) Skipped
2026-11-15 08:16:39 +00:00
jakman85
a4b441f3ad
Merge pull request 'chore(deps): Update docker.io/library/python Docker tag to v3.15.2' ( #171 ) from renovate/docker.io-library-python-3.x into main
...
gate / gate (push) Successful in 46s
gate / conformance (push) Skipped
Reviewed-on: #171
2026-11-14 21:58:51 +00:00
jakman85
8b51b02446
Merge pull request 'chore(deps): Update ghcr.io/aquasecurity/trivy Docker tag to v0.76.2' ( #169 ) from renovate/ghcr.io-aquasecurity-trivy-0.x into main
...
gate / gate (push) Canceled after 31s
gate / conformance (push) Canceled after 0s
Reviewed-on: #169
2026-11-14 21:58:18 +00:00
jakman85
6868e8d9a5
Merge pull request 'fix(storage): bound the caches filling each node's /var' ( #174 ) from fix/bound-var-ephemeral-caches into main
...
gate / gate (push) Successful in 46s
gate / conformance (push) Skipped
Reviewed-on: #174
2026-11-14 21:56:42 +00:00
jakman85 and Claude Opus 5.5
89ed1af282
docs(decisions): record gate result for bound-var-ephemeral-caches
...
gate / gate (pull_request) Successful in 56s
gate / conformance (pull_request) Skipped
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-14 14:16:04 -06:00
jakman85 and Claude Opus 5.5
3ae7fb74f8
fix(storage): bound the caches filling each node's /var
...
The act-runner's Docker cache was an unbounded emptyDir on the 11.6 GiB
/var partition and evicted k3s-prod-2 on 2026-11-12. It moves to a
generic ephemeral volume on longhorn-scratch (off /var, pod-lifetime,
single replica), with a threshold-triggered docker prune and Velero
opt-out. vuln-scanner's cache sizeLimit and ephemeral-storage limit are
cut to fit the partition, and it prefers not to share a node with
buildkitd.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-14 14:15:00 -06:00
renovate-bot
93c4994bf1
Merge pull request 'chore(deps): Update semaphoreui/semaphore Docker tag to v2.20.24' ( #173 ) from renovate/semaphoreui-semaphore-2.x into main
gate / gate (push) Successful in 55s
gate / conformance (push) Skipped
2026-11-14 08:18:46 +00:00
renovate-bot
dd7d996ce4
Merge pull request 'chore(deps): Update ghcr.io/seerr-team/seerr Docker tag to v3.5.2' ( #172 ) from renovate/ghcr.io-seerr-team-seerr-3.x into main
gate / gate (push) Canceled after 1s
gate / conformance (push) Canceled after 0s
2026-11-14 08:17:54 +00:00
renovate-bot
27ecbc7017
chore(deps): Update semaphoreui/semaphore Docker tag to v2.20.24
gate / gate (pull_request) Successful in 52s
gate / conformance (pull_request) Skipped
2026-11-14 08:17:03 +00:00
renovate-bot
90a9b88274
chore(deps): Update ghcr.io/seerr-team/seerr Docker tag to v3.5.2
gate / gate (pull_request) Successful in 53s
gate / conformance (pull_request) Skipped
2026-11-14 08:16:57 +00:00
renovate-bot
1ff2e375bd
Merge pull request 'chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3053-ls34' ( #170 ) from renovate/lscr.io-linuxserver-jackett-0.x into main
gate / gate (push) Successful in 47s
gate / conformance (push) Skipped
2026-11-13 08:19:49 +00:00
renovate-bot
7e612212a0
chore(deps): Update docker.io/library/python Docker tag to v3.15.2
renovate/stability-days Updates have not met minimum release age requirement
gate / gate (pull_request) Successful in 46s
gate / conformance (pull_request) Skipped
2026-11-13 08:17:48 +00:00
renovate-bot
74f31809b6
Merge pull request 'chore(deps): Update python:3.15.2-alpine3.23 Docker digest to 32f0611' ( #168 ) from renovate/python-3.15.2-alpine3.23 into main
gate / gate (push) Successful in 46s
gate / conformance (push) Skipped
2026-11-13 08:17:27 +00:00
renovate-bot
64e221e057
chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3053-ls34
gate / gate (pull_request) Successful in 48s
gate / conformance (pull_request) Skipped
2026-11-13 08:16:41 +00:00
renovate-bot
120913b04e
chore(deps): Update ghcr.io/aquasecurity/trivy Docker tag to v0.76.2
renovate/stability-days Updates have not met minimum release age requirement
gate / gate (pull_request) Successful in 48s
gate / conformance (pull_request) Skipped
2026-11-13 08:16:36 +00:00
renovate-bot
72e820032f
chore(deps): Update python:3.15.2-alpine3.23 Docker digest to 32f0611
gate / gate (pull_request) Successful in 47s
gate / conformance (pull_request) Skipped
2026-11-13 08:16:35 +00:00
jakman85
b4ea0fd643
Merge pull request 'chore(deps): Update ghcr.io/renovatebot/renovate Docker tag to v44.227.4' ( #163 ) from renovate/ghcr.io-renovatebot-renovate-44.x into main
...
gate / gate (push) Successful in 1m12s
gate / conformance (push) Skipped
Reviewed-on: #163
Reviewed-by: Keith Jackson <[email protected]
2026-11-11 17:23:44 +00:00
renovate-bot
7c2a6155a4
chore(deps): Update ghcr.io/renovatebot/renovate Docker tag to v44.227.4
gate / gate (pull_request) Successful in 1m7s
gate / conformance (pull_request) Skipped
2026-11-11 08:16:19 +00:00
jakman85
f38743da2c
Merge pull request 'chore(deps): Update Helm release kube-prometheus-stack to v93' ( #164 ) from renovate/kube-prometheus-stack-93.x into main
...
gate / gate (push) Successful in 53s
gate / conformance (push) Skipped
Reviewed-on: #164
2026-11-10 14:16:51 +00:00
renovate-bot
8c440c15ba
Merge pull request 'chore(deps): Update semaphoreui/semaphore Docker tag to v2.20.23' ( #167 ) from renovate/semaphoreui-semaphore-2.x into main
gate / gate (push) Failing after 1m21s
gate / conformance (push) Skipped
2026-11-10 08:23:09 +00:00
renovate-bot
17e67fdff7
chore(deps): Update Helm release kube-prometheus-stack to v93
gate / gate (pull_request) Successful in 1m21s
gate / conformance (pull_request) Skipped
2026-11-10 08:22:11 +00:00
renovate-bot
d1c99cd116
chore(deps): Update semaphoreui/semaphore Docker tag to v2.20.23
gate / gate (pull_request) Successful in 57s
gate / conformance (pull_request) Skipped
2026-11-10 08:22:01 +00:00
renovate-bot
1c3507d98a
Merge pull request 'chore(deps): Update gitea.home.keithjackson.dev/home-network/toolbox:main Docker digest to 83a3501' ( #161 ) from renovate/gitea.home.keithjackson.dev-home-network-toolbox-main into main
gate / gate (push) Failing after 57s
gate / conformance (push) Skipped
images / images (push) Failing after 42s
2026-11-10 08:17:38 +00:00
renovate-bot
c00d06f103
chore(deps): Update gitea.home.keithjackson.dev/home-network/toolbox:main Docker digest to 83a3501
gate / gate (pull_request) Successful in 1m1s
gate / conformance (pull_request) Skipped
images / images (pull_request) Successful in 4s
2026-11-10 08:16:32 +00:00
jakman85
190cd6b81a
Merge pull request 'feat(vuln): automated CVE visibility for production (R-VULN-*, ADR-0027)' ( #165 ) from feat/vuln-visibility into main
...
gate / gate (push) Successful in 58s
gate / conformance (push) Skipped
Reviewed-on: #165
Reviewed-by: Keith Jackson <[email protected]
2026-11-09 22:41:50 +00:00
jakman85
6680f361a1
Whitespace linting fix
gate / gate (pull_request) Successful in 58s
gate / conformance (pull_request) Skipped
2026-11-09 16:40:21 -06:00
jakman85
fd462a4ede
Updated SPEC_PIN
gate / gate (pull_request) Failing after 59s
gate / conformance (pull_request) Skipped
2026-11-09 16:31:22 -06:00
jakman85
1ace03569c
Added required keycloak config
gate / gate (pull_request) Failing after 1m0s
gate / conformance (pull_request) Skipped
2026-11-09 16:29:29 -06:00
jakman85 and Claude Opus 5.5
e1adc3963c
docs(vuln): handoff for automated CVE visibility
...
gate / gate (pull_request) Successful in 1m5s
gate / conformance (pull_request) Skipped
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 12:40:15 -06:00
jakman85
4ca0ebfac6
Merge branch 'wip/vuln-fixes' into feat/vuln-visibility
2026-11-09 12:38:41 -06:00
jakman85
1ff527f546
Merge branch 'wip/vuln-platform' into feat/vuln-visibility
2026-11-09 12:38:41 -06:00
jakman85 and Claude Opus 5.5
d8b25a67fe
fix(vuln): survive OOM kills, isolate bad upstream strings, label findings per line
...
Review findings on the integrated scanner:
- An OOM kill no longer wedges the loop: inFlight is persisted before each scan, and on restart
that image is marked failed and sits out full runs for 20h.
- One bad upstream string can no longer freeze the report: safe_url requires an exact lowercase
scheme, acceptance reasons are bounded, /triage urls use the same rule, and report.build
repairs or drops any entry the schema would refuse. lastCompleteRunAt advances only after a
report is actually published.
- The private registry reports credential-required, not failed: VULN_PRIVATE_REGISTRIES names
it, and Trivy is not invoked.
- loadError clears after a full run against a good inventory.
- Every image under platform/vuln-scanner stays out of Renovate auto-merge.
- The page labels status and target state per line, and mixed acceptance reads as mixed.
The Keycloak client is still an operator action: its key must go in an existing encrypted file
that an agent must not modify. platform/vuln-scanner/README.md has the exact steps.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 12:28:29 -06:00
jakman85 and Claude Opus 5.5
1763e27859
fix(vuln): metric label extractor handles escaped quotes in f-strings
...
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 12:28:28 -06:00
jakman85 and Claude Opus 5.5
4c82c64b2f
docs(vuln): list the CVE triage workflow in the workflows README
...
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 10:30:43 -06:00
jakman85 and Claude Opus 5.5
d06dff9a19
fix(vuln): no-per-cve-label check also matches escaped-quote label forms
...
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 10:29:05 -06:00
jakman85
b1a6fe6503
Merge branch 'wip/vuln-platform' into feat/vuln-visibility
2026-11-09 10:29:05 -06:00
jakman85
b265d08278
Merge branch 'wip/vuln-bot' into feat/vuln-visibility
2026-11-09 10:29:05 -06:00
jakman85
2b9dcef6c7
Merge branch 'wip/vuln-scanner' into feat/vuln-visibility
2026-11-09 10:29:05 -06:00
jakman85 and Claude Opus 5.5
d4bea8a78c
feat(vuln): encrypted oauth2-proxy credential for the CVE page
...
Generated through pipes and encrypted to the repo's public age recipient; values never echoed.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 09:43:12 -06:00
jakman85 and Claude Opus 5.5
b85d1e3ed7
feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests
...
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 09:42:52 -06:00
jakman85 and Claude Opus 5.5
50ec2297ee
feat(vuln): scanner service and fixture-driven L1 tests
...
Stdlib-only scanner per docs/17: Kubernetes API inventory, Trivy runner,
persisted state, schema-validated report.json, strict acceptances parser,
server-rendered page, aggregate metrics, internal API, and a scan loop
that stays live while scanning.
L1 tests under conformance/tests/l1-rendering/vuln-scanner-* run the
actual modules against recorded fixtures with a fake Trivy runner.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 09:41:23 -06:00
jakman85 and Claude Opus 5.5
ec6b39bb91
feat(vuln): point the triage bot's fallback at the pinned scanner ClusterIP
...
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 09:39:55 -06:00
jakman85 and Claude Opus 5.5
c3c72c47bb
feat(vuln): CVE triage bot workflow, script and L1 tests
...
Scheduled Gitea Actions bot in the Renovate shape: maintains a
counts-only CVE Dashboard issue, derives remediation states from
Renovate's dashboard and PRs, ticks approve rows for exact-matched
images with an unaccepted CRITICAL with a fix, and posts the heartbeat.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 09:39:24 -06:00
renovate-bot
4c3a284cad
Merge pull request 'chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3030-ls30' ( #162 ) from renovate/lscr.io-linuxserver-jackett-0.x into main
gate / gate (push) Successful in 1m3s
gate / conformance (push) Skipped
2026-11-09 08:20:07 +00:00
renovate-bot
4a89aacfbc
chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3030-ls30
gate / gate (pull_request) Successful in 46s
gate / conformance (pull_request) Skipped
2026-11-09 08:16:20 +00:00
jakman85
50c8719b12
Merge pull request 'fix(vpn): default client profiles to MTU 1280; correct the VPN runbook' ( #159 ) from fix/wg-client-mtu-docs into main
...
gate / gate (push) Successful in 57s
gate / conformance (push) Skipped
Reviewed-on: #159
2026-11-09 03:26:02 +00:00
jakman85 and Claude Opus 5.5
8f60e6103a
fix(vpn): default client profiles to MTU 1280; correct the VPN runbook
...
gate / gate (pull_request) Successful in 57s
gate / conformance (pull_request) Skipped
new-peer.sh generated MTU 1420, which stalled traffic on mobile data
despite a healthy handshake (one phone, one carrier, 2026-11-09). Default
to 1280, overridable through WG_MTU.
Correct stale claims in the runbook and the DaemonSet header against
live BPF conntrack: LoadBalancer VIPs see 10.90.0.x as world, not a
SNATed host identity. Add a troubleshooting section.
The DaemonSet render is unchanged, so WireGuard pods do not roll.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-08 21:15:20 -06:00
renovate-bot
jakman85
