renovate-bot
e019974c9b
chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3065-ls36
gate / gate (pull_request) Successful in 1m2s
gate / conformance (pull_request) Skipped
2026-11-15 08:16:39 +00:00
jakman85
a4b441f3ad
Merge pull request 'chore(deps): Update docker.io/library/python Docker tag to v3.15.2' ( #171 ) from renovate/docker.io-library-python-3.x into main
...
gate / gate (push) Successful in 46s
gate / conformance (push) Skipped
Reviewed-on: #171
2026-11-14 21:58:51 +00:00
jakman85
8b51b02446
Merge pull request 'chore(deps): Update ghcr.io/aquasecurity/trivy Docker tag to v0.76.2' ( #169 ) from renovate/ghcr.io-aquasecurity-trivy-0.x into main
...
gate / gate (push) Canceled after 31s
gate / conformance (push) Canceled after 0s
Reviewed-on: #169
2026-11-14 21:58:18 +00:00
jakman85
6868e8d9a5
Merge pull request 'fix(storage): bound the caches filling each node's /var' ( #174 ) from fix/bound-var-ephemeral-caches into main
...
gate / gate (push) Successful in 46s
gate / conformance (push) Skipped
Reviewed-on: #174
2026-11-14 21:56:42 +00:00
jakman85 and Claude Opus 5.5
89ed1af282
docs(decisions): record gate result for bound-var-ephemeral-caches
...
gate / gate (pull_request) Successful in 56s
gate / conformance (pull_request) Skipped
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-14 14:16:04 -06:00
jakman85 and Claude Opus 5.5
3ae7fb74f8
fix(storage): bound the caches filling each node's /var
...
The act-runner's Docker cache was an unbounded emptyDir on the 11.6 GiB
/var partition and evicted k3s-prod-2 on 2026-11-12. It moves to a
generic ephemeral volume on longhorn-scratch (off /var, pod-lifetime,
single replica), with a threshold-triggered docker prune and Velero
opt-out. vuln-scanner's cache sizeLimit and ephemeral-storage limit are
cut to fit the partition, and it prefers not to share a node with
buildkitd.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-14 14:15:00 -06:00
renovate-bot
93c4994bf1
Merge pull request 'chore(deps): Update semaphoreui/semaphore Docker tag to v2.20.24' ( #173 ) from renovate/semaphoreui-semaphore-2.x into main
gate / gate (push) Successful in 55s
gate / conformance (push) Skipped
2026-11-14 08:18:46 +00:00
renovate-bot
dd7d996ce4
Merge pull request 'chore(deps): Update ghcr.io/seerr-team/seerr Docker tag to v3.5.2' ( #172 ) from renovate/ghcr.io-seerr-team-seerr-3.x into main
gate / gate (push) Canceled after 1s
gate / conformance (push) Canceled after 0s
2026-11-14 08:17:54 +00:00
renovate-bot
27ecbc7017
chore(deps): Update semaphoreui/semaphore Docker tag to v2.20.24
gate / gate (pull_request) Successful in 52s
gate / conformance (pull_request) Skipped
2026-11-14 08:17:03 +00:00
renovate-bot
90a9b88274
chore(deps): Update ghcr.io/seerr-team/seerr Docker tag to v3.5.2
gate / gate (pull_request) Successful in 53s
gate / conformance (pull_request) Skipped
2026-11-14 08:16:57 +00:00
renovate-bot
1ff2e375bd
Merge pull request 'chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3053-ls34' ( #170 ) from renovate/lscr.io-linuxserver-jackett-0.x into main
gate / gate (push) Successful in 47s
gate / conformance (push) Skipped
2026-11-13 08:19:49 +00:00
renovate-bot
7e612212a0
chore(deps): Update docker.io/library/python Docker tag to v3.15.2
renovate/stability-days Updates have not met minimum release age requirement
gate / gate (pull_request) Successful in 46s
gate / conformance (pull_request) Skipped
2026-11-13 08:17:48 +00:00
renovate-bot
74f31809b6
Merge pull request 'chore(deps): Update python:3.15.2-alpine3.23 Docker digest to 32f0611' ( #168 ) from renovate/python-3.15.2-alpine3.23 into main
gate / gate (push) Successful in 46s
gate / conformance (push) Skipped
2026-11-13 08:17:27 +00:00
renovate-bot
64e221e057
chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3053-ls34
gate / gate (pull_request) Successful in 48s
gate / conformance (pull_request) Skipped
2026-11-13 08:16:41 +00:00
renovate-bot
120913b04e
chore(deps): Update ghcr.io/aquasecurity/trivy Docker tag to v0.76.2
renovate/stability-days Updates have not met minimum release age requirement
gate / gate (pull_request) Successful in 48s
gate / conformance (pull_request) Skipped
2026-11-13 08:16:36 +00:00
renovate-bot
72e820032f
chore(deps): Update python:3.15.2-alpine3.23 Docker digest to 32f0611
gate / gate (pull_request) Successful in 47s
gate / conformance (pull_request) Skipped
2026-11-13 08:16:35 +00:00
jakman85
b4ea0fd643
Merge pull request 'chore(deps): Update ghcr.io/renovatebot/renovate Docker tag to v44.227.4' ( #163 ) from renovate/ghcr.io-renovatebot-renovate-44.x into main
...
gate / gate (push) Successful in 1m12s
gate / conformance (push) Skipped
Reviewed-on: #163
Reviewed-by: Keith Jackson <[email protected]
2026-11-11 17:23:44 +00:00
renovate-bot
7c2a6155a4
chore(deps): Update ghcr.io/renovatebot/renovate Docker tag to v44.227.4
gate / gate (pull_request) Successful in 1m7s
gate / conformance (pull_request) Skipped
2026-11-11 08:16:19 +00:00
jakman85
f38743da2c
Merge pull request 'chore(deps): Update Helm release kube-prometheus-stack to v93' ( #164 ) from renovate/kube-prometheus-stack-93.x into main
...
gate / gate (push) Successful in 53s
gate / conformance (push) Skipped
Reviewed-on: #164
2026-11-10 14:16:51 +00:00
renovate-bot
8c440c15ba
Merge pull request 'chore(deps): Update semaphoreui/semaphore Docker tag to v2.20.23' ( #167 ) from renovate/semaphoreui-semaphore-2.x into main
gate / gate (push) Failing after 1m21s
gate / conformance (push) Skipped
2026-11-10 08:23:09 +00:00
renovate-bot
17e67fdff7
chore(deps): Update Helm release kube-prometheus-stack to v93
gate / gate (pull_request) Successful in 1m21s
gate / conformance (pull_request) Skipped
2026-11-10 08:22:11 +00:00
renovate-bot
d1c99cd116
chore(deps): Update semaphoreui/semaphore Docker tag to v2.20.23
gate / gate (pull_request) Successful in 57s
gate / conformance (pull_request) Skipped
2026-11-10 08:22:01 +00:00
renovate-bot
1c3507d98a
Merge pull request 'chore(deps): Update gitea.home.keithjackson.dev/home-network/toolbox:main Docker digest to 83a3501' ( #161 ) from renovate/gitea.home.keithjackson.dev-home-network-toolbox-main into main
gate / gate (push) Failing after 57s
gate / conformance (push) Skipped
images / images (push) Failing after 42s
2026-11-10 08:17:38 +00:00
renovate-bot
c00d06f103
chore(deps): Update gitea.home.keithjackson.dev/home-network/toolbox:main Docker digest to 83a3501
gate / gate (pull_request) Successful in 1m1s
gate / conformance (pull_request) Skipped
images / images (pull_request) Successful in 4s
2026-11-10 08:16:32 +00:00
jakman85
190cd6b81a
Merge pull request 'feat(vuln): automated CVE visibility for production (R-VULN-*, ADR-0027)' ( #165 ) from feat/vuln-visibility into main
...
gate / gate (push) Successful in 58s
gate / conformance (push) Skipped
Reviewed-on: #165
Reviewed-by: Keith Jackson <[email protected]
2026-11-09 22:41:50 +00:00
jakman85
6680f361a1
Whitespace linting fix
gate / gate (pull_request) Successful in 58s
gate / conformance (pull_request) Skipped
2026-11-09 16:40:21 -06:00
jakman85
fd462a4ede
Updated SPEC_PIN
gate / gate (pull_request) Failing after 59s
gate / conformance (pull_request) Skipped
2026-11-09 16:31:22 -06:00
jakman85
1ace03569c
Added required keycloak config
gate / gate (pull_request) Failing after 1m0s
gate / conformance (pull_request) Skipped
2026-11-09 16:29:29 -06:00
jakman85 and Claude Opus 5.5
e1adc3963c
docs(vuln): handoff for automated CVE visibility
...
gate / gate (pull_request) Successful in 1m5s
gate / conformance (pull_request) Skipped
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 12:40:15 -06:00
jakman85
4ca0ebfac6
Merge branch 'wip/vuln-fixes' into feat/vuln-visibility
2026-11-09 12:38:41 -06:00
jakman85
1ff527f546
Merge branch 'wip/vuln-platform' into feat/vuln-visibility
2026-11-09 12:38:41 -06:00
jakman85 and Claude Opus 5.5
d8b25a67fe
fix(vuln): survive OOM kills, isolate bad upstream strings, label findings per line
...
Review findings on the integrated scanner:
- An OOM kill no longer wedges the loop: inFlight is persisted before each scan, and on restart
that image is marked failed and sits out full runs for 20h.
- One bad upstream string can no longer freeze the report: safe_url requires an exact lowercase
scheme, acceptance reasons are bounded, /triage urls use the same rule, and report.build
repairs or drops any entry the schema would refuse. lastCompleteRunAt advances only after a
report is actually published.
- The private registry reports credential-required, not failed: VULN_PRIVATE_REGISTRIES names
it, and Trivy is not invoked.
- loadError clears after a full run against a good inventory.
- Every image under platform/vuln-scanner stays out of Renovate auto-merge.
- The page labels status and target state per line, and mixed acceptance reads as mixed.
The Keycloak client is still an operator action: its key must go in an existing encrypted file
that an agent must not modify. platform/vuln-scanner/README.md has the exact steps.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 12:28:29 -06:00
jakman85 and Claude Opus 5.5
1763e27859
fix(vuln): metric label extractor handles escaped quotes in f-strings
...
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 12:28:28 -06:00
jakman85 and Claude Opus 5.5
4c82c64b2f
docs(vuln): list the CVE triage workflow in the workflows README
...
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 10:30:43 -06:00
jakman85 and Claude Opus 5.5
d06dff9a19
fix(vuln): no-per-cve-label check also matches escaped-quote label forms
...
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 10:29:05 -06:00
jakman85
b1a6fe6503
Merge branch 'wip/vuln-platform' into feat/vuln-visibility
2026-11-09 10:29:05 -06:00
jakman85
b265d08278
Merge branch 'wip/vuln-bot' into feat/vuln-visibility
2026-11-09 10:29:05 -06:00
jakman85
2b9dcef6c7
Merge branch 'wip/vuln-scanner' into feat/vuln-visibility
2026-11-09 10:29:05 -06:00
jakman85 and Claude Opus 5.5
d4bea8a78c
feat(vuln): encrypted oauth2-proxy credential for the CVE page
...
Generated through pipes and encrypted to the repo's public age recipient; values never echoed.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 09:43:12 -06:00
jakman85 and Claude Opus 5.5
b85d1e3ed7
feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests
...
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 09:42:52 -06:00
jakman85 and Claude Opus 5.5
50ec2297ee
feat(vuln): scanner service and fixture-driven L1 tests
...
Stdlib-only scanner per docs/17: Kubernetes API inventory, Trivy runner,
persisted state, schema-validated report.json, strict acceptances parser,
server-rendered page, aggregate metrics, internal API, and a scan loop
that stays live while scanning.
L1 tests under conformance/tests/l1-rendering/vuln-scanner-* run the
actual modules against recorded fixtures with a fake Trivy runner.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 09:41:23 -06:00
jakman85 and Claude Opus 5.5
ec6b39bb91
feat(vuln): point the triage bot's fallback at the pinned scanner ClusterIP
...
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 09:39:55 -06:00
jakman85 and Claude Opus 5.5
c3c72c47bb
feat(vuln): CVE triage bot workflow, script and L1 tests
...
Scheduled Gitea Actions bot in the Renovate shape: maintains a
counts-only CVE Dashboard issue, derives remediation states from
Renovate's dashboard and PRs, ticks approve rows for exact-matched
images with an unaccepted CRITICAL with a fix, and posts the heartbeat.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-09 09:39:24 -06:00
renovate-bot
4c3a284cad
Merge pull request 'chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3030-ls30' ( #162 ) from renovate/lscr.io-linuxserver-jackett-0.x into main
gate / gate (push) Successful in 1m3s
gate / conformance (push) Skipped
2026-11-09 08:20:07 +00:00
renovate-bot
4a89aacfbc
chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3030-ls30
gate / gate (pull_request) Successful in 46s
gate / conformance (pull_request) Skipped
2026-11-09 08:16:20 +00:00
jakman85
50c8719b12
Merge pull request 'fix(vpn): default client profiles to MTU 1280; correct the VPN runbook' ( #159 ) from fix/wg-client-mtu-docs into main
...
gate / gate (push) Successful in 57s
gate / conformance (push) Skipped
Reviewed-on: #159
2026-11-09 03:26:02 +00:00
jakman85 and Claude Opus 5.5
8f60e6103a
fix(vpn): default client profiles to MTU 1280; correct the VPN runbook
...
gate / gate (pull_request) Successful in 57s
gate / conformance (pull_request) Skipped
new-peer.sh generated MTU 1420, which stalled traffic on mobile data
despite a healthy handshake (one phone, one carrier, 2026-11-09). Default
to 1280, overridable through WG_MTU.
Correct stale claims in the runbook and the DaemonSet header against
live BPF conntrack: LoadBalancer VIPs see 10.90.0.x as world, not a
SNATed host identity. Add a troubleshooting section.
The DaemonSet render is unchanged, so WireGuard pods do not roll.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-08 21:15:20 -06:00
jakman85
da0515c8c8
Merge pull request 'fix(vpn): enrol keith-phone-home and admit the WireGuard subnet to PiHole DNS' ( #158 ) from fix/wg-home-peer-pihole-sources into main
...
gate / gate (push) Successful in 55s
gate / conformance (push) Skipped
Reviewed-on: #158
2026-11-09 02:50:04 +00:00
jakman85
3a2ec5a12c
Merge pull request 'feat(dns): PiHole answers an explicit LAN name list, not a zone wildcard' ( #157 ) from feat/pihole-explicit-lan-names into main
...
gate / gate (push) Canceled after 25s
gate / conformance (push) Canceled after 0s
Reviewed-on: #157
Reviewed-by: Keith Jackson <[email protected]
2026-11-09 02:49:39 +00:00
jakman85 and Claude Opus 5.5
f13d336630
fix(vpn): enrol keith-phone-home and admit the WireGuard subnet to PiHole DNS
...
gate / gate (pull_request) Successful in 1m12s
gate / conformance (pull_request) Skipped
Add the at-home peer (10.90.0.3) and list ${WG_CLIENT_CIDR} in the PiHole
DNS frontends' loadBalancerSourceRanges. wg0 is a Cilium device, so tunnel
clients reach the source-range check untranslated; a LAN-only list is
predicted to drop their DNS. Adds an L0 guard that both ranges are present
and every range is RFC1918, and corrects the README's SNAT and IPv6 claims.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-11-08 20:45:48 -06:00
renovate-bot
jakman85
