4791653f2b
Merge pull request 'fix(vpn-ingress): keep the server key in source through SOPS, not as an out-of-band Secret' (#60) from fix/vpn-server-key-in-sops into main
jakman852026-10-06 06:09:04 +00:00
523f482957
Merge pull request 'fix(node): pin gitea to the Gateway VIP — the failing certificate was the router's, not the Gateway's' (#59) from docs/pm-agent-registry-pull-prereq into main
jakman852026-10-06 05:51:22 +00:00
523a463fd7
fix(node): pin gitea to the Gateway VIP — containerd was resolving it to the non-hairpinned WAN
jakman85andClaude Opus 52026-10-06 00:35:18 -05:00
e35612dc7e
fix(vpn-ingress): keep the server key in source through SOPS, not as an out-of-band Secret
jakman85andClaude Opus 52026-10-05 23:42:56 -05:00
a209a618fd
fix(pm-agent): the agent is IN the cluster — one git host, the cluster-local service name
jakman85andClaude Opus 52026-10-05 23:40:55 -05:00
6253d546f8
docs(pm-agent): the registry cannot be pulled from yet — name both prerequisites where the operator reads them
jakman85andClaude Opus 52026-10-05 23:22:52 -05:00
95597bd688
Merge pull request 'feat(pm-agent): an in-cluster AI Program Manager that turns Gitea issues into pull requests' (#57) from feat/pm-agent-issue-to-pr into main
jakman852026-10-06 04:12:31 +00:00
06ca9eeb88
Merge pull request 'fix(runbooks): vpn-remote-access step 1 named a nonexistent script; step 2 cited the wrong gitignore rule' (#58) from fix/vpn-runbook-ansible-command into main
jakman852026-10-06 04:12:27 +00:00
e4a9b02b00
docs(pm-agent): CLAUDE.md §0 is already satisfied in a worker — tell it not to make a worktree
jakman85andClaude Opus 52026-10-05 23:00:50 -05:00
3ee663dbcc
Merge pull request 'docs(agents): one workspace per agent run — the shared checkout is off-limits' (#56) from docs/agents-work-in-their-own-workspace into main
jakman852026-10-06 03:49:28 +00:00
ad3f56eee8
Merge pull request 'feat(vpn-ingress): WireGuard remote access on udp/51820 — hostNetwork, because a pod identity would 403 every Gateway hostname' (#55) from feat/vpn-remote-access-wireguard into main
jakman852026-10-06 03:41:48 +00:00
005e80d38a
docs(pm-agent): record the PR's own CI result, read from the log not the status tick
jakman85andClaude Opus 52026-10-05 22:38:55 -05:00
8b5e950baa
test(pm-agent): a committed negative-path probe for the worker's input guards
jakman85andClaude Opus 52026-10-05 22:34:46 -05:00
c5b5b8672a
feat(pm-agent): an in-cluster AI Program Manager that turns Gitea issues into pull requests
jakman85andClaude Opus 52026-10-05 22:20:02 -05:00
22c94effff
Merge pull request 'feat(cilium): roll the agents when cilium-config changes (merged config was silently inert)' (#53) from feat/cilium-roll-out-on-config-change into main
jakman852026-10-06 02:30:31 +00:00
4386d1453b
Merge pull request 'fix(plex): advertise a resolver-independent plex.direct name again (LAN-wide outage)' (#52) from fix/plex-resolver-independent-advertise into main
jakman852026-10-06 02:06:00 +00:00
bc7095677b
Merge pull request 'fix(plex): unblock the app tier — drop the Certificate that stalled apps-wave-0, advertise http' (#51) from fix/plex-unblock-app-tier into main
jakman852026-10-05 13:53:21 +00:00
c163deaef9
Merge pull request 'feat(plex): one advertised hostname for local+remote, its own LE cert, and a LAN definition so LAN clients stop reading as remote' (#48) from feat/plex-vip-hostname-and-lan-networks into main
jakman852026-10-04 21:47:32 +00:00
642a7752d8
Merge pull request 'feat(cilium): export Plex's pre-SNAT client address via Hubble, scoped to tcp/32400' (#50) from feat/hubble-flow-export-plex into main
jakman852026-10-04 21:47:20 +00:00
21c88b0dc7
Merge pull request 'fix(obs): open 44180 to ns monitoring so the forward-auth gate sidecars are actually scrapable' (#49) from fix/oauth2-sidecar-metrics-scrape-netpol into main
jakman852026-10-04 21:33:28 +00:00
422834d4e2
Merge pull request 'fix(plex): advertise the plex.direct name, not the bare VIP (server vanished from the plex.tv account)' (#47) from fix/plex-advertise-plexdirect into main
jakman852026-10-04 07:59:14 +00:00
c95b1c7121
Merge pull request 'fix(cilium): point cgroup.hostRoot at the host cgroup2 root (socket-LB never covered host processes)' (#42) from fix/cilium-cgroup-hostroot into main
jakman852026-10-04 07:10:31 +00:00
ed6afc3d3f
Merge pull request 'docs(decisions): record that PiHole HA is verified live, failover drill included' (#46) from docs/pihole-ha-verified into main
jakman852026-10-04 07:08:19 +00:00
dce20b7be6
Merge pull request 'feat(pihole): two replicas on different nodes, and fix a PVC mounted where pihole never writes' (#45) from feat/pihole-multi-replica into main
jakman852026-10-04 06:50:56 +00:00
17f0c11403
Merge pull request 'feat(pihole): declare the admin password and adlists in git' (#44) from feat/pihole-declare-state into main
jakman852026-10-04 06:14:47 +00:00
939461120a
Merge pull request 'feat(plex): expose tcp/32400 for remote access via a pinned LoadBalancer VIP' (#43) from feat/plex-remote-access-l4 into main
jakman852026-10-04 04:46:34 +00:00
7ef2af205d
Merge pull request 'fix(node-baseline): pin the OIDC issuer to the Gateway VIP on prod nodes' (#41) from fix/node-keycloak-hosts-pin into main
jakman852026-10-03 22:46:38 +00:00
576e1abb19
Merge pull request 'feat(dns): publish Gateway names to the WAN via in-cluster DDNS' (#40) from feat/public-dns-wan-target into main
jakman852026-10-03 22:25:13 +00:00
bcb8931b4f
Merge pull request 'fix(runbooks): Plex hw transcoding WORKS — the dashboard was never the proof' (#39) from fix/plex-quicksync-verification into main
jakman852026-10-02 06:43:04 +00:00
5ffd0c98bc
Merge pull request 'fix(ci): let an administrator merge their own green PR — required_approvals 1 → 0, plus an attributed /approve-override' (#38) from fix/admin-approval-override into main
jakman852026-10-02 06:17:17 +00:00
f0994c11a0
docs(decisions): record the PR's measured CI result — gitea-settings has drifted
jakman85andClaude Opus 52026-10-02 01:01:13 -05:00
948875aad3
Merge pull request 'Added arr suite ability to connect to plex' (#35) from bugfix/arr-to-plex into main
jakman852026-10-02 05:34:35 +00:00
bdfa72b1c7
Merge pull request 'feat(gpu): satisfy hardware.gpu: intel-quicksync with gpu.intel.com/i915 instead of a /dev/dri hostPath (the hostPath was measured not to work: device-cgroup EPERM)' (#37) from feat/quicksync-via-device-plugin into main
jakman852026-10-02 05:02:23 +00:00
4f16e83eec
Merge pull request 'feat(obs): make oauth2-proxy auth failures visible — the gates emit nothing' (#29) from feat/oauth2-proxy-auth-failure-visible into main
jakman852026-10-02 04:55:43 +00:00
0c7e8dd3ba
Merge pull request 'fix(ci): catalog/render.py's 106 selftest assertions never ran in the gate' (#33) from fix/render-selftest-runs-in-gate into main
jakman852026-10-02 04:33:02 +00:00
8c12a1e525
Merge pull request 'feat(auth): declare API paths per service, so --api-route can ship at all' (#34) from feat/oauth2-proxy-api-route-per-app into main
jakman852026-10-02 04:31:56 +00:00
78bf68493d
feat(gpu): satisfy hardware.gpu: intel-quicksync with gpu.intel.com/i915, not a /dev/dri hostPath
jakman85andClaude Opus 52026-10-01 23:21:28 -05:00
99560c2d22
feat(auth): declare API paths per service, so --api-route can ship at all
jakman85andClaude Opus 52026-10-01 21:36:05 -05:00
bce101d03f
feat(obs): wire the gate-sidecar scrape, and fix the alert that would have gone silent doing it
jakman85andClaude Opus 52026-10-01 21:56:07 -05:00
ba79a1b59b
Merge remote-tracking branch 'origin/main' into feat/oauth2-proxy-auth-failure-visible
jakman852026-10-01 21:40:37 -05:00
cdf3e14e27
Merge pull request 'feat(plex): hardware transcoding via hardware.gpu: intel-quicksync, plus the runbook for the manual last mile' (#32) from feat/plex-quicksync into main
jakman852026-10-02 02:17:48 +00:00
41a20dfd20
Merge pull request 'feat(schema): declare a host hardware capability, hardware.gpu: intel-quicksync' (#27) from feat/sd-hardware-capability into main
jakman852026-10-02 02:17:23 +00:00
0fee584e3a
feat(plex): opt into hardware.gpu: intel-quicksync, and write the runbook for the step GitOps cannot reach
jakman85andClaude Opus 52026-09-30 13:09:20 -05:00
fa4765bb3e
feat(schema): declare a host hardware capability, hardware.gpu: intel-quicksyncjakman85andClaude Opus 52026-09-30 10:48:00 -05:00
08deb208a1
Merge pull request 'fix(jackett): root-cause the oauth2-proxy session loss; the fix cannot be scoped to one app' (#30) from fix/jackett-oauth2-proxy-session into main
jakman852026-10-02 01:47:08 +00:00
b763f11e19
Merge pull request 'feat(node-health): probe the Intel render device, read-only' (#31) from feat/node-health-render-device into main
jakman852026-10-02 01:42:00 +00:00
6caa5f2ee5
Merge pull request 'fix(auth): five oauth2-proxy sidecars shared one cookie, died at 5 minutes, and served no metrics' (#28) from fix/oauth2-proxy-cookie-collision-fleet into main
jakman852026-09-30 21:39:40 +00:00
f4a155a807
docs(decisions): the collision is measured; that it CAUSES the failures is not
jakman85andClaude Opus 52026-09-30 12:56:33 -05:00
0a0adce4d8
docs(auth): bound crafty's post-fix ratio to its own pod; record the metrics gap
jakman85andClaude Opus 52026-09-30 12:52:12 -05:00
6a6fea8151
docs(auth): root-cause jackett's session loss; add the oauth2-proxy-session runbook
jakman85andClaude Opus 52026-09-30 12:47:42 -05:00
75a4029d64
docs(decisions): record the measured gate rc, stage list and touched subset
jakman85andClaude Opus 52026-09-30 12:46:40 -05:00
fc7ec01628
feat(obs): make oauth2-proxy auth failures visible — alert on the gap, not on absent metrics
jakman85andClaude Opus 52026-09-30 10:55:19 -05:00
9a4489b733
fix(auth): five oauth2-proxy sidecars shared one cookie and evicted each other
jakman85andClaude Opus 52026-09-30 10:55:06 -05:00
0fbf544d5e
Merge pull request 'fix(obs): the deploy notification was inhibited before it could send' (#26) from fix/flux-deploy-notification-inhibited into main
jakman852026-09-30 15:18:54 +00:00
64c72fd394
Merge pull request 'feat(obs): notify on Flux deploy start and completion' (#25) from feat/flux-deploy-notifications into main
jakman852026-09-30 04:55:50 +00:00
jakman85
