Commit Graph

Select branches

Hide Pull Requests

bugfix/arr-to-plex

chore/adopt-spec-sync

chore/cilium-split-merge2

chore/decisions-log-conflict-free

chore/pm-agent-digest-99

chore/pm-agent-go-live

chore/pm-agent-runner-digest

chore/renovate-config-cleanup

chore/rotate-cloudflared-tunnel

docs/agents-work-in-their-own-workspace

docs/ci-delivery-flow-for-agents

docs/ci-reality-vs-phase-0

docs/close-out-ci-hardening

docs/handoff-2026-09-29

docs/memattr-6-12-backport

docs/node2-memory-refine

docs/oauth2-sidecar-scrape-verified

docs/phase-7-open-prod-node-1

docs/pihole-ha-verified

docs/pm-agent-registry-pull-prereq

docs/poststart-incident

docs/reconcile-with-reality

docs/runbooks-pr-flow

docs/source-comment-audit

feat/automated-upgrades

feat/ci-is-the-approver

feat/cilium-own-kustomization

feat/cilium-roll-out-on-config-change

feat/cloudflare-tunnel

feat/conformance-job-template

feat/conformance-run-ledger

feat/conformance-runner-image

feat/conformance-trigger-admission-boundary

feat/conformance-trigger-kubeconfig

feat/devcontainer-velero-cli

feat/dns-via-cloudflare-tunnel

feat/flux-deploy-notifications

feat/gate-toolbox-container

feat/gitea-28

feat/gitea-settings-drift-check

feat/graceful-cluster-shutdown

feat/hubble-flow-export-plex

feat/image-pipeline

feat/intel-gpu-device-plugin

feat/keycloak-passkey-reconcile

feat/keycloak-passkeys

feat/l0-externaldns-annotation-prefix

feat/ledger-section-parsing

feat/node-health-render-device

feat/oauth2-proxy-api-route-per-app

feat/oauth2-proxy-auth-failure-visible

feat/parallel-l0-checks

feat/pihole-declare-state

feat/pihole-explicit-lan-names

feat/pihole-multi-replica

feat/pin-pihole-jackett-plex

feat/plex-claim-sops-secret

feat/plex-claim-token-013124

feat/plex-quicksync

feat/plex-remote-access-l4

feat/plex-vip-hostname-and-lan-networks

feat/pm-agent-issue-to-pr

feat/pm-agent-pr-mentions

feat/pm-agent-registry-pull-secret

feat/prod-hardening

feat/prod-memattr-and-nodes

feat/prod-node-2

feat/public-dns-wan-target

feat/quicksync-via-device-plugin

feat/r-state-03-proven

feat/renovate-track-keycloak-operator

feat/runner-capacity-2

feat/sd-hardware-capability

feat/vpn-remote-access-wireguard

feature/add-private-key-for-wireguard

feature/cloudflare-tunnel-config

feature/pm-agent-credentials

fix/admin-approval-override

fix/bulk-nfs-truenas

fix/cilium-cgroup-hostroot

fix/cloudflared-creds-permission

fix/cluster-available-would-fake-a-green

fix/conformance-context-is-fail-open

fix/coredns-ha

fix/crafty-bedrock-19132

fix/crafty-oauth2-proxy-signin

fix/dind-native-sidecar

fix/flux-deploy-notification-inhibited

fix/gate-push-trigger-matches-feat-prefix

fix/gitea-admins-could-override-the-gate

fix/gitea-admit-buildkit

fix/gitea-settings-comment-names-impossible-secret

fix/ha-check-catastrophic-regex

fix/jackett-oauth2-proxy-session

fix/keycloak-operator-crds

fix/keycloak-servicemonitor-owner

fix/kyverno-policy-was-never-applied

fix/new-peer-ignores-template-comments

fix/node-keycloak-hosts-pin

fix/oauth2-proxy-cookie-collision-fleet

fix/oauth2-proxy-oidc-startup-race

fix/oauth2-sidecar-metrics-scrape-netpol

fix/peers-configmap-content-hash

fix/pihole-local-ttl

fix/plex-advertise-plexdirect

fix/plex-quicksync-verification

fix/plex-resolver-independent-advertise

fix/plex-unblock-app-tier

fix/pm-agent-triage-exit

fix/poststart-exit-status

fix/public-dns-wan-a-record

fix/render-selftest-runs-in-gate

fix/renovate-auth

fix/renovate-config-filename

fix/renovate-cron-window

fix/renovate-first-run

fix/renovate-hold-auth-and-self

fix/renovate-invalid-config

fix/renovate-run-hygiene

fix/secret-name-and-require-gitea-settings

fix/strict-postbuild-substitutions

fix/unattended-upgrades-debian-sentinel

fix/vpn-ingress-ip-forward

fix/vpn-ingress-l2-lease-collision

fix/vpn-runbook-ansible-command

fix/vpn-server-key-in-sops

fix/wg-client-mtu-docs

fix/wg-home-peer-pihole-sources

main

migration/dns-apex-inversion

plex/volume-expamsion

prod/deliver-fixes

rescued/fix/act-runner-dind-readiness

rescued/fix/node-dns-resilient-upstream

sync-39-onto-main

vpn/add-keith-phone

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#109

#11

#110

#111

#112

#113

#114

#115

#117

#118

#119

#12

#120

#121

#122

#123

#124

#125

#126

#127

#128

#129

#13

#130

#131

#132

#133

#134

#135

#136

#137

#138

#139

#14

#140

#141

#142

#143

#144

#145

#146

#147

#148

#149

#15

#150

#151

#152

#153

#154

#155

#156

#157

#158

#159

#16

#160

#17

#18

#19

#2

#20

#21

#22

#23

#24

#25

#26

#27

#28

#29

#3

#30

#31

#32

#33

#34

#35

#36

#37

#38

#39

#4

#40

#41

#42

#43

#44

#45

#46

#47

#48

#49

#5

#50

#51

#52

#53

#54

#55

#56

#57

#58

#59

#6

#60

#61

#62

#63

#64

#65

#66

#67

#68

#69

#7

#70

#71

#72

#73

#74

#75

#76

#77

#78

#79

#8

#80

#81

#82

#83

#84

#85

#86

#87

#88

#89

#9

#90

#92

#93

#94

#95

#96

#98

#99

Mono Color

• 23ea72d01e feat(keycloak): reconcile client redirect URIs, not just client secrets jakman85andClaude Opus 5 2026-09-12 21:09:04 -05:00
• 51d8676f90 feat(keycloak): render the client-URL desired state from the realm import jakman85andClaude Opus 5 2026-09-12 20:57:39 -05:00
• fa4deac877 fix(conformance): the dirty-tree assertion must judge HONOURED evidence jakman85andClaude Opus 5 2026-09-12 21:12:55 -05:00
• a317493bca merge: R-NET-06 re-proven on prod (recovery in <=3s) jakman85 2026-09-12 21:10:57 -05:00
• c66a7e29e9 fix(conformance): the harness contradicted itself in two places jakman85andClaude Opus 5 2026-09-12 21:10:38 -05:00
• 155df8ee3f test(conformance): R-NET-06 PROVEN on prod — vpn-killswitch re-run from a clean tree jakman85andClaude Opus 5 2026-09-12 20:52:47 -05:00
• 9d0814ae61 test(conformance): R-NET-06 run against prod — L1 proven, L3 pass recorded -dirty jakman85andClaude Opus 5 2026-09-12 20:48:55 -05:00
• 16c6234696 feat(monitoring): alert when egress steering goes stale, not just when tun0 dies jakman85andClaude Opus 5 2026-09-12 20:46:56 -05:00
• 19fc8bcb27 merge: VPN egress gateway on prod, plus three datapath fixes jakman85 2026-09-12 18:15:02 -05:00
• 53e09a2610 docs(vpn): dev recovered the minute prod left the shared PIA server jakman85andClaude Opus 5 2026-09-12 18:12:46 -05:00
• 9b97e073e2 merge: main (velero R2 + arr config PVC) into feat/vpn-egress-prod jakman85 2026-09-12 18:11:18 -05:00
• 38e4bf1459 docs(vpn): record the PIA server collision, and the accidental proof it handed us jakman85andClaude Opus 5 2026-09-12 18:09:31 -05:00
• 37a6c94168 fix(vpn): two gateways on one pinned PIA server evict each other every 2 minutes jakman85andClaude Opus 5 2026-09-12 18:05:49 -05:00
• 04606d48b2 docs(vpn): stop crediting the nftables kill-switch for a drop it never makes jakman85andClaude Opus 5 2026-09-12 17:57:52 -05:00
• 60e3f09c67 feat(vpn): prod egress-gateway group — k3s-prod-3, singleton, opt-in only jakman85andClaude Opus 5 2026-09-12 17:38:46 -05:00
• 6f698f59af fix(vpn): Cilium never re-resolves tun0 — the gateway dies on every reconnect jakman85andClaude Opus 5 2026-09-12 17:38:27 -05:00
• 839f7fed4a merge: velero works against R2 — plugin pin, NFS volume policy, metrics jakman85 2026-09-12 17:20:55 -05:00
• 2d5171e064 feat(velero): scrape the backup controller — three critical alerts could never fire jakman85andClaude Opus 5 2026-09-12 17:17:06 -05:00
• 2e259a808f fix(velero): prod backups could not write metadata to R2, and opt-out FSB would have shipped 8.6 TiB jakman85andClaude Opus 5 2026-09-12 17:12:37 -05:00
• 3ec67bafdd merge: platform-admins may reach the media app UIs jakman85 2026-09-12 17:15:14 -05:00
• 5da116b34d fix(oauth2-proxy): platform-admins may reach the media UIs — the immediate 403 jakman85andClaude Opus 5 2026-09-12 17:12:05 -05:00
• 6b953cc56b fix(arrs): the config PVC was mounted where the app never looks jakman85andClaude Opus 5 2026-09-12 16:35:18 -05:00
• f5e62d9169 merge: bulk NFS volumes for plex, sonarr, radarr and nextcloud jakman85 2026-09-12 16:26:31 -05:00
• daac05e7e8 feat(bulk): prod mounts the NFS export through pfSense's WAN address jakman85andClaude Opus 5 2026-09-12 16:25:20 -05:00
• da8a0eac04 test(l0): R-STATE-04 gets a real check — bulk storage provably is not the replicated tier jakman85andClaude Opus 5 2026-09-08 00:03:34 -05:00
• cac413e87a feat(cnpg): synchronous replication, quorum of 1, dataDurability preferred jakman85 2026-09-07 23:36:46 -05:00
• 82aff4d053 feat(apps): attach the media library and the legacy Nextcloud dataset over NFS jakman85andClaude Opus 5 2026-09-07 23:54:13 -05:00
• e8d8601ca6 feat(cnpg): required pod anti-affinity + switchover primary rolls jakman85 2026-09-07 23:35:47 -05:00
• 2590bc4317 feat(env): BULK_NFS_SERVER — the one knob prod cannot answer yet, and why it is a placeholder jakman85andClaude Opus 5 2026-09-07 23:47:39 -05:00
• cec550045b feat(storage): the bulk tier becomes real — static NFS PVs, authored once per environment jakman85andClaude Opus 5 2026-09-07 23:45:09 -05:00
• f338e91770 feat(cnpg): instances 3 on all three Clusters — a standby to fail over to jakman85 2026-09-07 23:33:40 -05:00
• a624c638ef merge: docs/node-1-drive-replaced jakman85 2026-09-07 23:05:59 -05:00
• 90b39de527 merge: fix/swap-off-persists-across-reboot jakman85 2026-09-07 23:05:59 -05:00
• 0247d796a3 merge: fix/founder-moved-to-node-2 jakman85 2026-09-07 23:05:59 -05:00
• c9e9dcf960 merge: fix/r-env-03-overlay-selected-credentials jakman85 2026-09-07 23:05:59 -05:00
• 89cf59ffb7 docs(conformance): the GIVEN/WHEN/THEN header states the exception it now allows jakman85 2026-09-07 23:04:39 -05:00
• e319777849 docs(pm): draft the R-ENV-03 amendment, and name the gate hole that hid it jakman85 2026-09-07 23:02:56 -05:00
• 730d12ddc4 fix(conformance): R-ENV-03 shared-path rule tests the harm, not the filename jakman85 2026-09-07 22:55:58 -05:00
• df1d2ab44d docs(prod): node 1's drive was replaced — and §2's exit condition still is not met jakman85andClaude Opus 5 2026-09-07 22:50:45 -05:00
• 69a25cff82 fix(node_health): say 'active via <unit>', not a bare parenthetical jakman85andClaude Opus 5 2026-09-07 22:42:38 -05:00
• c1e36d9353 docs(node_baseline): say why the Longhorn claim guard's swap list is now always empty jakman85andClaude Opus 5 2026-09-07 22:39:39 -05:00
• 9d00a3fcd3 fix(node_health): memory.swap blamed the wrong thing, and could not see the defect jakman85andClaude Opus 5 2026-09-07 22:35:31 -05:00
• 0e92d258dd fix(node_baseline): swap-off now survives a reboot — mask swap.target jakman85andClaude Opus 5 2026-09-07 22:35:16 -05:00
• 08fbe85638 fix(ansible): move the founder designation to node 2 jakman85andClaude Opus 5 2026-09-07 21:41:54 -05:00
• 863af01062 docs: the §2 shared-device measurement came back, and it does not hold jakman85 2026-09-07 02:41:22 -05:00
• f7a9229d81 fix(ansible): the NVMe node would have died on an undefined variable jakman85 2026-09-07 02:44:03 -05:00
• a819c50ffe feat(ansible): arbitrate the shared etcd/Longhorn device — and prove it landed jakman85 2026-09-07 02:39:04 -05:00
• efc6db6c1f feat(obs): alert on I/O pressure — the metric that missed the prod-1 outage jakman85 2026-09-07 02:28:26 -05:00
• 09265e0381 merge: OIDC issuer/callback URLs become per-environment jakman85 2026-09-07 02:12:15 -05:00
• e65a76dc51 docs(log): record the prod OIDC-URL outage and the rule it establishes jakman85andClaude Opus 5 2026-09-07 02:10:10 -05:00
• bc9c93d2ab fix(keycloak): the reconciler could not read its own Secret jakman85andClaude Opus 5 2026-09-07 02:07:28 -05:00
• 6548f9a89c fix(semaphore): per-environment OIDC URLs — same latent break as Headlamp jakman85andClaude Opus 5 2026-09-07 02:06:52 -05:00
• bfa39bc5d0 fix(headlamp): per-environment OIDC URLs — prod was dialing DEV's Keycloak jakman85andClaude Opus 5 2026-09-07 02:06:38 -05:00
• 3ca4ad6011 merge: R2 off-cluster backups + per-environment backup credentials jakman85 2026-09-07 01:55:14 -05:00
• 708a05dfc1 fix(devcontainer): restore multi-cluster kubeconfig selection jakman85andClaude Opus 5 2026-09-07 01:55:14 -05:00
• 161430d915 feat(backup): the overlay picks the credential — BACKUP_CREDENTIALS_SUFFIX jakman85andClaude Opus 5 2026-09-07 01:41:56 -05:00
• e7c4a95c2d feat(backup): the four backup credentials become TWO objects each, one per environment jakman85andClaude Opus 5 2026-09-07 01:38:22 -05:00
• 0a0527e7db feat(backup): prod's off-cluster DR lands on R2 — and stops the WAL clock jakman85andClaude Opus 5 2026-09-07 01:11:39 -05:00
• dc2d1ce17e fix(conformance): the R-NET-04 scan descended into nested agent worktrees jakman85andClaude Opus 5 2026-09-07 01:01:53 -05:00
• 6a8953e288 feat(prod): observability for the two failure modes that went unseen, plus OIDC self-healing jakman85andClaude Opus 5 2026-09-07 00:59:22 -05:00
• 9739e9be91 chore(backup): R2 credentials for the off-cluster DR target jakman85andClaude Opus 5 2026-09-07 00:58:23 -05:00
• d1a6628a97 feat(ha): the CNI dials the control-plane VIP — kube-vip becomes a CNI prerequisite jakman85andClaude Opus 5 2026-09-06 20:24:51 -05:00
• f178d85c71 fix(kyverno): unblock CDI imports by SATISFYING the label requirement, not exempting it jakman85andClaude Opus 5 2026-09-06 08:41:05 -05:00
• f21e89d9d2 fix(gitops): CDI cold-start deadlock repaired IN THE GRAPH, not by a pre-apply jakman85andClaude Opus 5 2026-09-05 11:53:45 -05:00
• 2d7d302c7e feat(prod): cut prod's GitOps source over to prod's OWN in-cluster Gitea jakman85andClaude Opus 5 2026-09-06 22:04:07 -05:00
• f341a9b744 Revert "feat(dns): INVERT to operator's simpler layout — dev to subdomain, prod to apex" feat/prod-hardening jakman85 2026-09-06 20:27:41 -05:00
• 422e1dc7e8 feat(ha): the CNI dials the control-plane VIP — kube-vip becomes a CNI prerequisite prod/deliver-fixes jakman85andClaude Opus 5 2026-09-06 20:24:51 -05:00
• 6f61c9622d feat(ha): the CNI dials the control-plane VIP — kube-vip becomes a CNI prerequisite docs/memattr-6-12-backport jakman85andClaude Opus 5 2026-09-06 20:24:51 -05:00
• 3ade1d440f fix(conformance): status.py read its own detection vocabulary as a TODO marker jakman85andClaude Opus 5 2026-09-06 20:24:22 -05:00
• cb1916f092 feat(conformance): cover R-PLAT-01, R-NET-04, R-SEC-03 — 88.2% -> 94.1%, and fix an unrecordable-proof defect jakman85andClaude Opus 5 2026-09-06 19:35:18 -05:00
• 5ec1460532 docs: DECISIONS-LOG — prod solidified, four cold-start bugs of one shape jakman85andClaude Opus 5 2026-09-06 18:51:00 -05:00
• a984442cae harden: pin node timezone to UTC, and TEST the guard/value coupling that bit us jakman85andClaude Opus 5 2026-09-06 08:47:08 -05:00
• b7d6ba3d5f fix(kyverno): unblock CDI imports by SATISFYING the label requirement, not exempting it jakman85andClaude Opus 5 2026-09-06 08:41:05 -05:00
• da3e9cc3f3 fix(kyverno): unblock CDI imports by SATISFYING the label requirement, not exempting it jakman85andClaude Opus 5 2026-09-06 08:41:05 -05:00
• 834928c237 fix(gitops): CDI cold-start deadlock repaired IN THE GRAPH, not by a pre-apply jakman85andClaude Opus 5 2026-09-05 11:53:45 -05:00
• 04569abd78 docs(prod): node-maintenance runbook — a failed drain leaves a cordon that stops self-healing jakman85andClaude Opus 5 2026-09-06 08:35:41 -05:00
• 21e111b08c feat(devcontainer): dev.sh can target prod — and cannot silently target the wrong cluster jakman85andClaude Opus 5 2026-09-05 16:38:32 -05:00
• 577c62136b docs: DECISIONS-LOG — PM autonomous session handoff jakman85andClaude Opus 5 2026-09-05 14:17:41 -05:00
• fe45d0f5c5 feat(conformance): cover R-TLS-02, R-ENV-01, R-ENV-03 — 42/51 -> 45/51, and find a real gap jakman85andClaude Opus 5 2026-09-05 14:17:03 -05:00
• 8f9b2e4270 feat(backup): s3check proves a real round trip — and revives a guard I had killed jakman85andClaude Opus 5 2026-09-05 13:24:26 -05:00
• 59ffbaf11a feat(conformance): L2 tests derive their environment from the cluster, not a literal jakman85andClaude Opus 5 2026-09-05 12:05:05 -05:00
• 765ad032db fix(gitops): CDI cold-start deadlock repaired IN THE GRAPH, not by a pre-apply jakman85andClaude Opus 5 2026-09-05 11:53:45 -05:00
• 32d67660a6 feat(backup): move off-cluster DR to Cloudflare R2 (operator decision 2026-09-05) jakman85andClaude Opus 5 2026-09-05 11:29:22 -05:00
• 9063e53ce2 docs(prod): prod verified end-to-end through the real resolver — dnsmasq profile installed jakman85andClaude Opus 5 2026-09-05 11:11:53 -05:00
• 6d62aca0d2 feat(workstation): prod dnsmasq profile — and CORRECT the topology I had wrong jakman85andClaude Opus 5 2026-09-05 11:08:54 -05:00
• b80e8eef82 feat(backup): prod shares dev's MinIO — plus the path tenancy that makes it survivable jakman85andClaude Opus 5 2026-09-05 10:59:50 -05:00
• e6bcecc78c docs: DECISIONS-LOG — overnight prod standup handoff jakman85andClaude Opus 5 2026-09-05 10:06:42 -05:00
• acb5cabdad fix(standup): preflight must always report — it was an env fork in disguise jakman85andClaude Opus 5 2026-09-05 10:06:01 -05:00
• 4f37fc375e feat(prod): STANDUP COMPLETE — 12/13 tiers Ready, LE wildcard issued, dev untouched jakman85andClaude Opus 5 2026-09-05 10:02:20 -05:00
• 1b056dc9d9 fix(prod): break the CDI cold-start deadlock, and make preflight catch its class jakman85andClaude Opus 5 2026-09-05 08:05:46 -05:00
• 4160fee6ce feat(prod): standup.sh + PROD-STANDUP.md — the complete standup sequence, in git jakman85andClaude Opus 5 2026-09-05 00:37:48 -05:00
• 7432012713 docs(prod): platform tier up 8/9 — and TWO blockers, one of them an armed footgun jakman85andClaude Opus 5 2026-09-04 23:54:33 -05:00
• 6b88670129 docs(prod): D0/D1 as executed, and CORRECT the P1 gate — it guards the apex, not prod jakman85andClaude Opus 5 2026-09-04 23:39:02 -05:00
• 13081a863f feat(bootstrap): automate the Kyverno CRD pre-apply — the last cold-start blocker jakman85andClaude Opus 5 2026-09-04 23:32:10 -05:00
• 9137bbd0c3 feat(dns): INVERT to operator's simpler layout — dev to subdomain, prod to apex migration/dns-apex-inversion jakman85andClaude Opus 5 2026-09-04 23:08:50 -05:00
• c8c1d2935d feat(dns): per-environment BASE_DOMAIN — prod moves to its own subdomain jakman85andClaude Opus 5 2026-09-04 22:43:54 -05:00
• 9b8979a427 feat(prod): temp Gitea source + wireless disabled + flux bootstrap path jakman85andClaude Opus 5 2026-09-04 18:53:17 -05:00
• 05baae90ec feat(prod): kernel fix + disk layout — prod nodes ready for k3s feat/prod-memattr-and-nodes jakman85andClaude Opus 5 2026-09-04 00:39:10 -05:00
• 8e913fdd7b fix(node_health): "Failed to map" does NOT mean memory lost — plus survey results jakman85andClaude Opus 5 2026-09-03 23:50:59 -05:00
• b19c5db9ae feat(prod): node 3 onboarded — and it is NOT immune; BIOS-setting hypothesis disproven jakman85andClaude Opus 5 2026-09-03 22:32:25 -05:00