This website requires JavaScript.
f5f52b0b8c
chore(harness): adopt spec pin b633b7f + exempt R-ENV-02/R-GITOPS-01 coverage gaps
jakman85 and Claude Opus 4.8
2026-08-24 20:57:26 -05:00
ce83c6af3b
WIP keycloak stack (gate probe)
jakman85
2026-08-24 19:52:25 -05:00
dbffb8fab8
Phase 5: KubeVirt + CDI IaaS proof (R-PLAT-03/04, R-STATE-01, R-NET-01)
jakman85 and Claude Opus 4.8
2026-08-24 19:43:56 -05:00
254d50a20c
docs: pia-* cluster secrets retired + host vault committed (Phase 3 cleanup complete)
jakman85 and Claude Opus 4.8
2026-08-24 15:04:31 -05:00
509a421d01
Merge chore/retire-pia-cluster-secrets (ADR-0015 cleanup)
jakman85
2026-08-24 15:03:22 -05:00
d920aad74a
Retire unused pia-* cluster SOPS secrets (ADR-0015 cleanup)
jakman85 and Claude Opus 4.8
2026-08-24 15:03:11 -05:00
b4ac1bef5e
Merge chore/commit-vpn-egress-vault (host VPN creds vault, encrypted)
jakman85
2026-08-24 15:01:54 -05:00
e9d738b705
vpn_egress_gateway: commit the ansible-vault host VPN creds vault (ADR-0015)
jakman85 and Claude Opus 4.8
2026-08-24 15:00:58 -05:00
2d85c03e55
docs: gluetun retirement complete (docs merged, banner fixed, worktrees pruned)
jakman85 and Claude Opus 4.8
2026-08-24 14:54:37 -05:00
75a38da374
Merge feature/fix-egress-steering-banner (mark steering datapath live)
jakman85
2026-08-24 14:53:40 -05:00
b6e8adc6c6
docs: mark egress-steering.yaml as live (remove stale NOT-WIRED banner + done TODO)
jakman85 and Claude Opus 4.8
2026-08-24 14:53:39 -05:00
9bc9b07caa
docs: update vpn-egress docs/comments for gluetun retirement (ADR-0015)
jakman85
2026-08-24 14:52:10 -05:00
aafb4ca378
docs(vpn-egress): reflect ADR-0015 node-tunnel egress, retire gluetun narrative
jakman85 and Claude Opus 4.8
2026-08-24 14:50:08 -05:00
05b04b8bc7
docs: record gluetun retirement done + VPN monitoring retargeted to node tun0
jakman85 and Claude Opus 4.8
2026-08-24 14:47:43 -05:00
9927b73a5a
Retire gluetun gateway + retarget VPN tunnel monitoring to the node tunnel (ADR-0015)
jakman85
2026-08-24 14:43:03 -05:00
d519ede4e3
monitoring: retarget VPNTunnelDown to node tun0 presence; drop obsolete EgressGatewayUnhealthy
jakman85 and Claude Opus 4.8
2026-08-24 14:41:20 -05:00
17fc0b7f36
docs: conformance suite green live (both gates); gluetun retirement prepared, pending approval
jakman85 and Claude Opus 4.8
2026-08-24 14:22:52 -05:00
7b7982e28d
Retire gluetun gateway Deployment (ADR-0015: node tunnel validated + conformance-green)
jakman85 and Claude Opus 4.8
2026-08-24 14:21:59 -05:00
0753b2ac96
Merge conformance tests for ADR-0015 egress steering (egress-class + vpn-killswitch)
jakman85
2026-08-24 14:18:02 -05:00
4c21f9f6e3
conformance: fix invalid test-level spec.finally for chainsaw v0.2.12
jakman85 and Claude Opus 4.8
2026-08-24 14:09:28 -05:00
0e69c63b55
conformance: complete vpn-killswitch L3 test + ADR-0015 RBAC/fixtures
jakman85 and Claude Opus 4.8
2026-08-24 13:58:40 -05:00
09569a08e6
docs: kill-switch robustness fix done+validated; conformance tests partial (rate-limited)
jakman85 and Claude Opus 4.8
2026-08-24 13:13:45 -05:00
e7a567db0b
WIP conformance(egress-class): ADR-0015 assertions (partial — killswitch test TODO)
jakman85 and Claude Opus 4.8
2026-08-24 13:12:07 -05:00
b0ff689484
Merge feature/killswitch-explicit-nft-backstop (explicit fail-closed nft backstop)
jakman85
2026-08-24 13:12:07 -05:00
1c4d86319c
vpn_egress_gateway: retain nft src set on tunnel-down (explicit fail-closed backstop)
jakman85 and Claude Opus 4.8
2026-08-24 13:10:40 -05:00
e14048e7fe
docs: record Phase 3 egress steering validated end-to-end on dev (both gates pass)
jakman85 and Claude Opus 4.8
2026-08-24 08:23:57 -05:00
8a555999ee
Merge fix/restore-egress-steering-file into main
jakman85
2026-08-24 08:08:35 -05:00
c74e05bda9
fix: restore egress-steering.yaml (dropped by an earlier branch merge)
jakman85 and Claude Opus 4.8
2026-08-24 08:08:35 -05:00
c9874ca57c
Merge feature/enable-vpn-egress-steering into main
jakman85
2026-08-24 08:07:21 -05:00
54341964fc
Enable ADR-0015 vpn-egress steering (host tunnel validated on k3s-dev-3)
jakman85 and Claude Opus 4.8
2026-08-24 08:07:20 -05:00
83ea050e82
docs: record ADR-0015 impl (merged, not deployed) + escalation ruling + operator prereq
jakman85 and Claude Opus 4.8
2026-08-24 07:32:58 -05:00
33d048d379
Merge feature/vpn-egress-gateway-role into main (ADR-0015 host tunnel role, not yet deployed)
jakman85
2026-08-24 07:31:27 -05:00
af75a6ddc9
Merge feature/vpn-egress-cilium-steering into main (ADR-0015 steering policy, not yet wired)
jakman85
2026-08-24 07:31:27 -05:00
2a2ead8b28
chore: drop egress-steering.yaml from this branch (owned by feature/vpn-egress-cilium-steering; working-tree race)
jakman85 and Claude Opus 4.8
2026-08-24 07:31:26 -05:00
2c109e2a31
feat(vpn): node-level split-tunnel egress gateway Ansible role (ADR-0015)
jakman85 and Claude Opus 4.8
2026-08-24 01:09:19 -05:00
38fcfadbf0
phase3(vpn): author Cilium Egress Gateway steering policy (ADR-0015)
jakman85 and Claude Opus 4.8
2026-08-24 00:59:36 -05:00
272a7d7d2f
Merge feature/phase3-egress-steering-groundwork into main
jakman85
2026-08-24 00:26:27 -05:00
34f41a0fba
phase3(vpn): egress-class conformance fixtures + steering design finding
jakman85 and Claude Opus 4.8
2026-08-24 00:26:26 -05:00
f650a4dc8e
Merge fix/prometheus-oom into main
jakman85
2026-08-24 00:04:18 -05:00
7b619f8bb0
fix(monitoring): Prometheus memory limit 1Gi -> 2Gi (OOMKilled on compaction)
jakman85 and Claude Opus 4.8
2026-08-24 00:04:17 -05:00
03768ff6b0
docs: Phase 3 VPN resolved (working + stable, PIA Stockholm egress)
jakman85 and Claude Opus 4.8
2026-08-24 00:02:47 -05:00
db39879e1c
Merge feature/vpn-liveness-exec into main
jakman85
2026-08-23 23:57:32 -05:00
4a781ace49
fix(vpn): exec (localhost) liveness probe — VPN routing breaks kubelet HTTP probe
jakman85 and Claude Opus 4.8
2026-08-23 23:57:31 -05:00
7e41cc0282
Merge feature/vpn-custom-ovpn-ip into main
jakman85
2026-08-23 01:01:20 -05:00
63f6e15d0e
feat(vpn): new IP-based .ovpn secret + map its key to /config/pia.ovpn
jakman85 and Claude Opus 4.8
2026-08-23 01:01:19 -05:00
c8b9653e33
fix(vpn): custom mode with IP-based .ovpn; gluetun v3.41.0 -> v3.41.3
jakman85 and Claude Opus 4.8
2026-08-23 00:57:01 -05:00
3787644c48
Merge feature/vpn-endpoint-ip into main
jakman85
2026-08-23 00:50:54 -05:00
66a76e6e33
fix(vpn): VPN_ENDPOINT_IP for custom mode (.ovpn hostname not parseable)
jakman85 and Claude Opus 4.8
2026-08-23 00:50:54 -05:00
3c359e2937
Merge feature/vpn-ovpn-keyname into main
jakman85
2026-08-23 00:46:31 -05:00
998b46df3d
fix(vpn): map .ovpn secret key (filename) to /config/pia.ovpn
jakman85 and Claude Opus 4.8
2026-08-23 00:46:31 -05:00
6c34fb636d
Merge feature/vpn-custom-ovpn into main
jakman85
2026-08-23 00:45:39 -05:00
47b6cb6afd
feat(vpn): add operator-provisioned pia-custom-ovpn Secret (SOPS)
jakman85 and Claude Opus 4.8
2026-08-23 00:45:39 -05:00
91aa7acab8
wip(vpn): gluetun custom-provider mode with operator's PIA .ovpn
jakman85 and Claude Opus 4.8
2026-08-23 00:40:08 -05:00
ee349c6d94
Merge feature/vpn-preset-envname into main
jakman85
2026-08-23 00:18:03 -05:00
be1e317456
fix(vpn): correct env name PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET
jakman85 and Claude Opus 4.8
2026-08-23 00:18:03 -05:00
93010a5287
Merge feature/vpn-normal-preset into main
jakman85
2026-08-23 00:09:48 -05:00
6a44d973b4
fix(vpn): PIA normal preset (RSA-2048/AES-128-CBC/SHA1, 1198) for MTU reliability
jakman85 and Claude Opus 4.8
2026-08-23 00:09:47 -05:00
8bcccf518e
Merge feature/vpn-mtu-disc into main
jakman85
2026-08-22 23:56:28 -05:00
772d032d4c
tune(vpn): --mtu-disc no so oversized handshake packets fragment (not drop)
jakman85 and Claude Opus 4.8
2026-08-22 23:56:28 -05:00
605b99409d
Merge feature/vpn-mtu-tune2 into main
jakman85
2026-08-22 23:50:01 -05:00
0e2289a2a8
fix(vpn): valid OpenVPN flags only (--hand-window 120; --tls-mtu invalid in 2.6)
jakman85 and Claude Opus 4.8
2026-08-22 23:50:00 -05:00
bc42c4bee9
Merge feature/vpn-mtu-tune into main
jakman85
2026-08-22 23:46:37 -05:00
b859e52697
tune(vpn): shrink OpenVPN control-channel MTU + widen handshake window
jakman85 and Claude Opus 4.8
2026-08-22 23:46:36 -05:00
49dca0e8bb
Merge feature/vpn-pf-cidr-narrow into main
jakman85
2026-08-22 23:36:51 -05:00
7d2cea8402
fix(vpn): narrow FIREWALL_OUTBOUND_SUBNETS to 10.0.0.0/16 (PF gateway overlap)
jakman85 and Claude Opus 4.8
2026-08-22 23:36:51 -05:00
1899a54c07
Merge feature/vpn-pia-strong-preset into main
jakman85
2026-08-22 23:30:47 -05:00
41234b85f5
fix(vpn): PIA strong encryption preset (RSA-4096/AES-256-CBC/SHA256, port 1197)
jakman85 and Claude Opus 4.8
2026-08-22 23:30:46 -05:00
7bdcd6edda
Merge feature/vpn-port-8080-live into main
jakman85
2026-08-22 23:26:17 -05:00
b76de52b7f
test(vpn): use port 8080 (avoid home 1197 return-path conflict), live servers
jakman85 and Claude Opus 4.8
2026-08-22 23:26:17 -05:00
b4bd18d716
Merge feature/vpn-updater-enduser into main
jakman85
2026-08-22 23:17:16 -05:00
2e5fdd29d7
fix(vpn): gluetun update needs -enduser flag in the init container
jakman85 and Claude Opus 4.8
2026-08-22 23:17:16 -05:00
a735784f94
fix(vpn): initContainer fetches PIA's current server list (bundled list stale)
jakman85 and Claude Opus 4.8
2026-08-22 23:14:42 -05:00
16bf3e3218
Merge feature/vpn-updater-stale-servers into main
jakman85
2026-08-22 23:08:20 -05:00
457edb7a38
fix(vpn): enable gluetun server-list updater (bundled list was stale) + re-enable
jakman85 and Claude Opus 4.8
2026-08-22 23:08:18 -05:00
50a416077c
Merge feature/vpn-network-blocks-pia into main
jakman85
2026-08-22 18:15:14 -05:00
95a55952cc
fix(vpn): disable vpn-egress — network blackholes PIA IPs (not ports/MTU/cluster)
jakman85 and Claude Opus 4.8
2026-08-22 18:15:11 -05:00
9fc117e06d
Merge feature/vpn-openvpn-mtu into main
jakman85
2026-08-22 18:03:47 -05:00
f17c46b767
fix(vpn): shrink OpenVPN tun-mtu/mssfix to 1350 (Cilium VXLAN pod MTU 1450)
jakman85 and Claude Opus 4.8
2026-08-22 18:03:46 -05:00
5a8fd4f20a
Merge feature/vpn-escalate-wireguard into main
jakman85
2026-08-22 16:47:18 -05:00
0aab1702e0
chore(vpn): disable vpn-egress, escalate OpenVPN→WireGuard decision
jakman85 and Claude Opus 4.8
2026-08-22 16:47:18 -05:00
5674458754
Merge feature/vpn-port-8080 into main
jakman85
2026-08-22 16:39:30 -05:00
4cde690008
fix(vpn): PIA OpenVPN port 53 -> 8080 (53 is DNS-intercepted on this network)
jakman85 and Claude Opus 4.8
2026-08-22 16:39:30 -05:00
7a88863f71
Merge feature/vpn-port-string-fix into main
jakman85
2026-08-22 16:33:38 -05:00
734093cf92
fix(vpn): hardcode OPENVPN_ENDPOINT_PORT "53" as string (Flux var int-coercion)
jakman85 and Claude Opus 4.8
2026-08-22 16:33:38 -05:00
f73719a474
Merge feature/vpn-openvpn-port-53 into main
jakman85
2026-08-22 16:28:38 -05:00
ec5ceb328f
fix(vpn): PIA OpenVPN on UDP/53 (avoid home WAN:1197 conflict); re-enable vpn-egress
jakman85 and Claude Opus 4.8
2026-08-22 16:28:37 -05:00
347f7a54b6
Merge feature/vpn-blocked-network into main
jakman85
2026-08-22 15:05:21 -05:00
9d761872ea
fix(vpn): disable vpn-egress — tunnel blocked by home network (env), config kept
jakman85 and Claude Opus 4.8
2026-08-22 15:05:20 -05:00
e4d856fd83
Merge feature/pia-region-fix into main
jakman85
2026-08-22 14:51:29 -05:00
9a108443e8
fix(vpn): PIA_REGION Sweden -> "SE Stockholm" (Gluetun OpenVPN region name)
jakman85 and Claude Opus 4.8
2026-08-22 14:51:29 -05:00
b50433d705
Merge feature/vpn-openvpn-enable into main
jakman85
2026-08-22 14:49:17 -05:00
015b423353
feat(vpn): enable vpn-egress on OpenVPN-UDP; align docs to ADR-0013 amendment
jakman85 and Claude Opus 4.8
2026-08-22 14:49:16 -05:00
41da3d96e5
fix(vpn): Attempting to try OpenVPN protocol with PIA
jakman85
2026-08-21 23:49:49 -05:00
6a2c7c3020
Merge Gluetun v3.41.0 (PIA WireGuard support)
jakman85
2026-08-21 23:10:48 -05:00
13a8df4e4a
fix(vpn): bump Gluetun to v3.41.0 (v3.40.0 lacks PIA WireGuard support)
jakman85 and Claude Opus 4.8
2026-08-21 23:10:47 -05:00
cbcfae01e1
feat(phase3): enable vpn-egress (deploy the Gluetun PIA/WireGuard gateway)
jakman85 and Claude Opus 4.8
2026-08-21 23:06:27 -05:00
643c3225ac
Merge PIA_REGION=Sweden default
jakman85
2026-08-21 23:00:51 -05:00
0d55c793f3
fix(vpn): default PIA_REGION to Sweden (operator choice, PF-capable)
jakman85 and Claude Opus 4.8
2026-08-21 23:00:51 -05:00
9667dce419
Merge VPN cluster-vars definition + pod-CIDR fix
jakman85
2026-08-21 22:56:15 -05:00
6591e11ad1
fix(vpn): define PIA_REGION + CLUSTER_POD_CIDR cluster-vars; correct pod CIDR + doc where
jakman85 and Claude Opus 4.8
2026-08-21 22:56:14 -05:00
jakman85andClaude Opus 4.8