9c0292001e
chore(deps): Update pihole/pihole Docker tag to v2026.10.1
renovate-bot2026-11-04 08:16:12 +00:00
db9416d3b5
chore(deps): Update docker.io/moby/buildkit Docker tag to v0.34.2
renovate-bot2026-11-04 08:15:52 +00:00
cb4a1bf2de
Merge pull request 'chore(deps): Update lscr.io/linuxserver/sonarr Docker tag to v4.0.20' (#107) from renovate/lscr.io-linuxserver-sonarr-4.x into main
renovate-bot2026-11-03 08:22:33 +00:00
028f5229f0
Merge pull request 'chore(deps): Update kubevirt-cdi' (#106) from renovate/kubevirt-cdi into main
renovate-bot2026-11-03 08:19:36 +00:00
44e2cd3c64
chore(deps): Update lscr.io/linuxserver/sonarr Docker tag to v4.0.20
renovate-bot2026-11-03 08:16:12 +00:00
5a3a5f8df2
Merge pull request 'chore(deps): Update intel/intel-gpu-plugin Docker tag to v0.37.1' (#105) from renovate/intel-intel-gpu-plugin-0.x into main
renovate-bot2026-11-02 08:22:07 +00:00
f698bc82a0
chore(deps): Update intel/intel-gpu-plugin Docker tag to v0.37.1
renovate-bot2026-11-02 08:16:06 +00:00
6bc10fb60d
Merge pull request 'chore(deps): Update dependency intel/intel-device-plugins-for-kubernetes to v0.37.1' (#102) from renovate/intel-intel-device-plugins-for-kubernetes-0.x into main
renovate-bot2026-11-01 08:18:56 +00:00
d8c330fb8c
chore(deps): Update dependency intel/intel-device-plugins-for-kubernetes to v0.37.1
renovate-bot2026-11-01 08:15:52 +00:00
a1d89f4a5f
Merge pull request 'chore(pm-agent): pin agent-runner to the run-394 digest (466f63e, PR #99), bump config-generation' (#100) from chore/pm-agent-digest-99 into main
jakman852026-10-31 17:23:18 +00:00
466f63ec3c
Merge pull request 'fix(pm-agent): log the CLI's stdout envelope when triage fails; add PM_DECISION_MAX_TURNS' (#99) from fix/pm-agent-triage-exit into main
jakman852026-10-31 17:12:40 +00:00
95e08da2f0
Merge pull request 'chore(pm-agent): take the dispatcher out of dry run (operator-approved), config-generation 4' (#98) from chore/pm-agent-go-live into main
jakman852026-10-31 16:52:16 +00:00
11267409d7
Merge pull request 'chore(pm-agent): pin agent-runner to the run-383 digest (ddd04d4), bump config-generation' (#96) from chore/pm-agent-runner-digest into main
jakman852026-10-31 16:34:49 +00:00
ddd04d460e
Merge pull request 'feat(pm-agent): pull credential + admission rule 7, first published digest pinned, dry-run first start, token scopes fixed' (#61) from feat/pm-agent-registry-pull-secret into main
jakman852026-10-31 15:46:54 +00:00
f0760d1024
Merge pull request 'feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them' (#94) from feat/pin-pihole-jackett-plex into main
jakman852026-10-31 15:45:17 +00:00
ce849032d5
Merge pull request 'chore(deps): Pin dependencies' (#89) from renovate/pin-dependencies into main
jakman852026-10-31 15:35:30 +00:00
b766130b85
Merge pull request 'chore(deps): Update gitea.home.keithjackson.dev/home-network/conformance-runner:main Docker digest to 65cc7c1' (#92) from renovate/gitea.home.keithjackson.dev-home-network-conformance-runner-main into main
renovate-bot2026-10-31 15:26:58 +00:00
862773f31b
Merge pull request 'chore(deps): Update gitea.home.keithjackson.dev/home-network/toolbox:main Docker digest to d435fab' (#93) from renovate/gitea.home.keithjackson.dev-home-network-toolbox-main into main
renovate-bot2026-10-31 08:25:11 +00:00
db4ba79a1c
Merge pull request 'chore(deps): Update gitea.home.keithjackson.dev/home-network/agent-runner:main Docker digest to c4eba5b' (#90) from renovate/gitea.home.keithjackson.dev-home-network-agent-runner-main into main
renovate-bot2026-10-31 08:22:14 +00:00
a4d5206294
Merge pull request 'fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version' (#87) from fix/renovate-hold-auth-and-self into main
jakman852026-10-30 08:21:22 +00:00
fb45d7441b
Merge pull request 'feat(renovate): track the Keycloak operator (the real Keycloak version), never auto-merge it' (#88) from feat/renovate-track-keycloak-operator into main
jakman852026-10-30 08:14:02 +00:00
24db269ea8
feat(renovate): track the Keycloak operator (the real Keycloak version), never auto-merge it
jakman85andClaude Opus 5.52026-10-30 03:02:25 -05:00
df96be98bf
fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version
jakman85andClaude Opus 5.52026-10-30 02:54:51 -05:00
b4ff2879be
Merge pull request 'fix(renovate): edit catalog sources, track CNPG imageName, honour update.range, guard real-run auto-merges' (#86) from fix/renovate-run-hygiene into main
jakman852026-10-30 07:43:28 +00:00
593d0fad15
Merge pull request 'fix(renovate): document and probe the five token scopes Renovate needs; lint daemon-bound actions' (#85) from fix/renovate-auth into main
jakman852026-10-30 07:10:02 +00:00
d550a501e2
Merge pull request 'fix(renovate): run Renovate as the job container; the action needs a Docker daemon jobs do not get' (#84) from fix/renovate-first-run into main
jakman852026-10-30 06:36:11 +00:00
7f0cbc7ba2
feat(pm-agent): pin the first published agent-runner digest, start dry, and fix the token scopes
jakman85andClaude Opus 5.52026-10-30 01:16:21 -05:00
a7eadd4054
feat(pm-agent): the kubelet's pull credential, and the seventh field admission had not read
jakman85andClaude Opus 52026-10-06 01:03:54 -05:00
dfc432c6ea
Merge pull request 'fix(keycloak-passkey): passkey reconciler with review fixes — bind only on git's say-so (default false), protect real sub-flows, body-id screening, failure alert' (#82) from feat/keycloak-passkey-reconcile into main
jakman852026-10-30 05:59:11 +00:00
523cd9118f
Merge pull request 'fix(buildkit): allow buildkitd egress to Gitea so the Gateway stops 403ing the registry push' (#83) from fix/gitea-admit-buildkit into main
jakman852026-10-30 05:50:12 +00:00
0dd57fbaf0
Merge pull request 'feat(images): build, verify and publish the three images in CI on rootless BuildKit; Renovate carries the digests' (#81) from feat/image-pipeline into main
jakman852026-10-30 05:15:16 +00:00
f65c12b395
feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages
jakman85andClaude Opus 5.52026-10-29 22:21:03 -05:00
8f35234fcc
fix(images): name the measured runner blocker; the job container gets no Docker daemon
jakman85andClaude Opus 5.52026-10-29 21:44:38 -05:00
e539109830
feat(images): build, verify and publish the three images in CI; Renovate carries the digests
jakman85andClaude Opus 5.52026-10-29 21:27:44 -05:00
27da5555a4
Merge pull request 'fix(renovate): the workflow still named renovate.json, so every run since #79 died with ENOENT' (#80) from fix/renovate-config-filename into main
jakman852026-10-30 04:48:42 +00:00
7c4eb439b2
feat(monitoring): alert when the keycloak passkey reconciler's Job fails
jakman85andClaude Opus 5.52026-10-29 21:41:15 -05:00
17eed6e8ae
fix(keycloak-passkey): bind only on git's say-so; protect real sub-flows; screen the requirement PUT by body id
jakman85andClaude Opus 5.52026-10-29 21:41:14 -05:00
f5931944fa
feat(keycloak): reconcile the passkey realm config via GitOps, the browser flow blue/green
jakman85andClaude Opus 52026-10-18 03:03:13 -05:00
aacf361bb8
fix(renovate): the workflow still named renovate.json, so every run since #79 died with ENOENT
jakman85andClaude Opus 5.52026-10-29 20:58:15 -05:00
1301af9a4c
Merge pull request 'fix(renovate): the config was INVALID, so the first manual run errored out' (#79) from fix/renovate-invalid-config into main
jakman852026-10-18 14:29:34 +00:00
42ce001d71
Merge pull request 'fix(renovate): the cron fired outside Renovate's own window, so it would never open a PR' (#77) from fix/renovate-cron-window into main
jakman852026-10-18 14:28:59 +00:00
84bb0f0acd
Merge pull request 'fix(pihole): make the split-horizon answer cacheable (local-ttl=60)' (#78) from fix/pihole-local-ttl into main
jakman852026-10-18 08:19:28 +00:00
a9a529750d
Merge pull request 'fix(unattended-upgrades): Debian has no reboot-sentinel package, so ship the writer' (#75) from fix/unattended-upgrades-debian-sentinel into main
jakman852026-10-18 07:40:20 +00:00
ee196c7bcd
Merge pull request 'feat(upgrades): automate node reboots (kured) and wire Renovate, which had never run' (#73) from feat/automated-upgrades into main
jakman852026-10-18 06:28:30 +00:00
83d3568150
Merge pull request 'feat(shutdown): configure graceful node shutdown, and never scale a Delete-policy StatefulSet' (#71) from feat/graceful-cluster-shutdown into main
jakman852026-10-18 05:51:20 +00:00
24bea918ab
Merge pull request 'fix(coredns): hold in-cluster DNS at 2 replicas via an HPA, because k3s owns the Deployment' (#74) from fix/coredns-ha into main
jakman852026-10-18 05:50:46 +00:00
4d489f2059
Merge pull request 'feat(keycloak): add passkey (WebAuthn passwordless) login, additive and optional' (#72) from feat/keycloak-passkeys into main
jakman852026-10-18 05:44:03 +00:00
a2440a3125
feat(upgrades): automated OS reboots (kured) + security-only unattended-upgrades, and give Renovate a runner
jakman85andClaude Opus 52026-10-18 00:06:16 -05:00
1a0b20857a
Merge pull request 'fix(oauth2-proxy): gate startup on Keycloak discovery, or a cold boot CrashLoops the proxy' (#70) from fix/oauth2-proxy-oidc-startup-race into main
jakman852026-10-18 04:14:52 +00:00
e89df78210
Merge pull request 'fix(bulk-nfs): repoint at the TrueNAS (192.168.2.30); the PVs must be recreated, not reconciled' (#67) from fix/bulk-nfs-truenas into main
jakman852026-10-07 06:26:44 +00:00
ad37acdf53
Merge pull request 'fix(vpn-ingress): content-hash the peer register, or a merged peer never reaches the tunnel' (#66) from fix/peers-configmap-content-hash into main
jakman852026-10-06 07:58:49 +00:00
5928d8153c
Merge pull request 'fix(vpn-ingress): new-peer.sh counted its own commented-out example as an allocated address' (#64) from fix/new-peer-ignores-template-comments into main
jakman852026-10-06 07:31:03 +00:00
d1c07fe021
Merge pull request 'fix(vpn-ingress): stop trying to set net.ipv4.ip_forward — a hostNetwork pod cannot, and wg-quick dies on a failed PostUp' (#63) from fix/vpn-ingress-ip-forward into main
jakman852026-10-06 07:09:34 +00:00
renovate-bot
pm-agent
jakman85