-
4c334d3cc9
Merge: Headlamp OIDC secret keys renamed to OIDC_* (fix empty-scheme login)
jakman85andClaude Opus 4.8
2026-08-29 17:12:18 -05:00
-
-
be3b4f7e8e
Merge: Longhorn concurrent-replica-rebuild-per-node-limit=1 (HDD etcd protection)
jakman85andClaude Opus 4.8
2026-08-29 17:12:12 -05:00
-
-
-
-
071123ae43
fix(headlamp): rename OIDC secret keys to OIDC_* so chart args expand
jakman85andClaude Opus 4.8
2026-08-29 15:05:42 -05:00
-
-
-
5c64e06354
fix(longhorn): cap concurrent-replica-rebuild-per-node-limit=1 (HDD etcd protection)
jakman85andClaude Opus 4.8
2026-08-29 15:03:03 -05:00
-
-
7910128675
Merge: tofu memory_mib 16384→24576 (k3s node RAM bump target)
jakman85
2026-08-29 14:58:15 -05:00
-
-
a60d34a4c3
tofu: bump k3s node memory_mib default 16384 -> 24576 (24 GiB)
jakman85andClaude Opus 4.8
2026-08-29 12:55:45 -05:00
-
-
178d130dc3
fix(velero): disable CRD-upgrade hook instead of pinning bitnami/kubectl
jakman85andClaude Opus 4.8
2026-08-29 11:09:45 -05:00
-
8fdd2a3f60
fix(velero): repoint CRD-hook kubectl image off the removed bitnami mirror
jakman85andClaude Opus 4.8
2026-08-29 11:01:17 -05:00
-
7a34590b19
fix(dns): add resilient fallback resolver to k3s nodes (PiHole primary + pfSense fallback)
rescued/fix/node-dns-resilient-upstream
jakman85andClaude Opus 4.8
2026-08-28 23:30:59 -05:00
-
-
b5d65e9bc8
Merge: Velero (kopia FSB) + CNPG Barman backups → S3 target (resolves OQ-BKP)
jakman85
2026-08-28 22:50:23 -05:00
-
-
6739339f53
Replace MinIO backup target with versitygw (s3_backup_target role)
jakman85andClaude Opus 4.8
2026-08-28 22:48:38 -05:00
-
d1248e6778
feat(backup): wire Velero + CNPG Barman to the live MinIO S3 target
jakman85andClaude Opus 4.8
2026-08-28 22:37:17 -05:00
-
-
1bee2554f8
Merge: MinIO S3 backup target on Proxmox (ansible role + live) + SOPS creds
jakman85
2026-08-28 22:16:25 -05:00
-
-
ac32f01f7b
feat(backup): MinIO S3 backup target on Proxmox host for Velero + CNPG
jakman85andClaude Opus 4.8
2026-08-28 22:15:05 -05:00
-
-
748e9ca55d
fix(oauth2-proxy): --allowed-groups → --allowed-group (correct oauth2-proxy v7.8.1 flag)
jakman85andClaude Opus 4.8
2026-08-28 15:57:55 -05:00
-
d5773c780d
Merge: Crafty Controller (Minecraft panel) behind Keycloak oauth2-proxy reverse-proxy + L4 game-port VIP
jakman85
2026-08-28 15:40:55 -05:00
-
-
0437871807
Onboard Crafty Controller (Minecraft panel) with Keycloak-gated web UI
jakman85andClaude Opus 4.8
2026-08-28 15:39:51 -05:00
-
-
a207103c7b
Merge: oauth2-proxy forward-auth hardening (platform-admins floor, skip-button) + ext_authz mechanism research/template
jakman85
2026-08-28 15:20:38 -05:00
-
-
3e7e9386a0
feat(oauth2-proxy): forward-auth ext_authz enforcement mechanism + group floor
jakman85andClaude Opus 4.8
2026-08-28 15:18:47 -05:00
-
-
3c7d7e0a1b
Merge: Prometheus retentionSize cap + dev PVC 5Gi→8Gi (fixes full-disk false alerts)
jakman85
2026-08-28 14:39:51 -05:00
-
-
eb31d2ef58
fix(monitoring): cap Prometheus TSDB by size to stop false absent()/==0 alerts
jakman85andClaude Opus 4.8
2026-08-28 14:38:12 -05:00
-
-
96a5db9ed7
Merge: plex env vars (UID/GID/TZ/ALLOWED_NETWORKS) + Homepage Overseerr→Seerr rename
jakman85
2026-08-28 13:21:19 -05:00
-
-
cde2cd138f
plex: add env vars (PLEX_UID/GID, TZ, ALLOWED_NETWORKS); homepage: rename Overseerr->Seerr
jakman85andClaude Opus 4.8
2026-08-28 13:20:34 -05:00
-
-
6fddca726b
Merge: offline_access scope on kubernetes client (long-lived kubectl OIDC sessions)
jakman85
2026-08-28 13:04:33 -05:00
-
-
330c99eb8b
feat(keycloak): enable offline_access for kubernetes OIDC client
jakman85andClaude Opus 4.8
2026-08-28 13:01:37 -05:00
-
-
b6a48203bc
fix(homepage): add required proxmox.yaml config to stop CrashLoopBackOff
jakman85andClaude Opus 4.8
2026-08-28 12:59:09 -05:00
-
099c1408b8
Merge: Homepage apex landing dashboard (non-gating tier; forward-auth deferred)
jakman85
2026-08-28 12:18:40 -05:00
-
-
1749603f87
feat(homepage): apex landing dashboard at home.keithjackson.dev
jakman85andClaude Opus 4.8
2026-08-28 12:17:25 -05:00
-
-
ebe0371b1b
platform: move Headlamp out of the gating platform tier + fix -session-ttl crashloop
jakman85andClaude Opus 4.8
2026-08-28 12:01:01 -05:00
-
d8883e4481
Merge: Headlamp k8s dashboard with Keycloak OIDC + per-user RBAC (audience-mapper)
jakman85
2026-08-28 11:46:15 -05:00
-
-
5fb097d019
platform: deploy Headlamp dashboard with Keycloak OIDC + per-user RBAC
jakman85andClaude Opus 4.8
2026-08-28 11:43:48 -05:00
-
-
b243c753b1
Merge: migrate proxmox_virtual_environment_download_file -> proxmox_download_file (ADR-007, moved block)
jakman85
2026-08-28 11:23:06 -05:00
-
-
0cf0c669f4
tofu: migrate to non-deprecated proxmox_download_file (ADR-007)
jakman85andClaude Opus 4.8
2026-08-28 11:22:06 -05:00
-
-
ffb439d59e
Merge fix/reconcile-apps-goldens: reconcile goldens to --no-image-automation + enforcing render-golden gate stage
jakman85
2026-08-28 11:13:07 -05:00
-
-
fe0ee698c4
fix(apps): reconcile goldens to one canonical render + enforce render==golden gate
jakman85andClaude Opus 4.8
2026-08-28 11:11:52 -05:00
-
-
85338a8144
Merge fix/nextcloud-logout-admin: post-logout redirect URI + hardened admin-promotion hook
jakman85
2026-08-27 20:19:51 -05:00
-
-
14521d37d3
fix(nextcloud-sso): apply step-(d) retry hardening at SOURCE (catalog)
jakman85andClaude Opus 4.8
2026-08-27 20:18:51 -05:00
-
7f86e1099b
fix(nextcloud-sso): register post-logout redirect URI + harden admin promotion
jakman85andClaude Opus 4.8
2026-08-27 20:13:45 -05:00
-
-
7d93decd61
tofu: fill encrypted secrets
jakman85
2026-08-27 19:53:46 -05:00
-
0996c1da0d
Merge feature/tofu-sops-secrets: SOPS-encrypted tofu secrets + tf.sh wrapper
jakman85
2026-08-27 19:09:57 -05:00
-
-
216bea2a16
tofu: move secrets into committed SOPS/age file + tf.sh wrapper
jakman85andClaude Opus 4.8
2026-08-27 19:07:52 -05:00
-
01f3dd0044
Merge fix/nextcloud-oidc-reach: allow_local_remote_servers for private-IP IdP + platform-admins→admin (#2,#5)
jakman85
2026-08-27 19:03:30 -05:00
-
-
-
-
7f92adfac6
fix(nextcloud): allow SSRF to private IdP + promote platform-admins to admin
jakman85andClaude Opus 4.8
2026-08-27 19:00:09 -05:00
-
318f85de11
Merge fix/plex-config-mountpath: mount config PVC at /config (Plex was writing ephemeral /config, unclaimed)
jakman85
2026-08-27 18:54:44 -05:00
-
-
-
-
d835a27875
fix(plex): mount config PVC at /config (image's real config dir)
jakman85andClaude Opus 4.8
2026-08-27 18:53:46 -05:00
-
-
13b1f1d9a4
docs(decisions): record 2026-08-27 session (R2 state, seerr, app-SSO, oauth2-proxy tier, R-STATE-02)
jakman85andClaude Opus 4.8
2026-08-27 18:24:14 -05:00
-
0fcbf32742
Merge fix/oauth2-proxy-post-platform-tier: move oauth2-proxy to post-platform tier (breaks cold-start deadlock)
jakman85
2026-08-27 18:15:25 -05:00
-
-
1f67a8ae72
Merge feature/conformance-r-state-02-node-loss: L3 node-loss test (R-STATE-02, closes last safety-critical gap)
jakman85
2026-08-27 18:13:33 -05:00
-
-
960cab937b
fix(flux): move oauth2-proxy to a post-platform tier (dependsOn platform-config)
jakman85andClaude Opus 4.8
2026-08-27 18:12:43 -05:00
-
-
-
fdf5c69adc
test(conformance): add L3 node-loss test for R-STATE-02 (Longhorn node-loss resilience)
jakman85andClaude Opus 4.8
2026-08-27 18:12:33 -05:00
-
-
d34c639269
fix(oidc): make gitea + nextcloud OIDC login-source registration persist
jakman85andClaude Opus 4.8
2026-08-27 17:41:54 -05:00
-
2919a1d72e
chore: gitignore .claude/ (agent worktrees pollute lint + git add -A)
jakman85andClaude Opus 4.8
2026-08-27 17:19:42 -05:00
-
76ba88a51e
Merge feature/oidc-sso-apps: native Keycloak OIDC SSO for gitea, nextcloud, semaphore
jakman85
2026-08-27 17:19:01 -05:00
-
-
f163026954
feat(nextcloud,semaphore): wire native Keycloak OIDC SSO (break-glass admins retained)
jakman85andClaude Opus 4.8
2026-08-27 17:17:13 -05:00
-
87388712f0
feat(gitea): wire native Keycloak OIDC SSO (break-glass admin retained)
jakman85andClaude Opus 4.8
2026-08-27 17:01:46 -05:00
-
7b8777c1e1
fix(seerr): add fsGroup podSecurityContext to resolve non-root PVC CrashLoop
jakman85andClaude Opus 4.8
2026-08-27 16:58:17 -05:00
-
-
df947b33d0
infra(tofu): fix backend.tf HCL header + document encryption-adoption migration
jakman85andClaude Opus 4.8
2026-08-27 16:31:23 -05:00
-
7b16621585
Merge feature/tofu-remote-state-r2: off-cluster R2 encrypted tofu state scaffolding
jakman85
2026-08-27 16:20:26 -05:00
-
-
8b0dcbf33b
fix(seerr): move to maintained Seerr image and correct config mountPath
jakman85andClaude Opus 4.8
2026-08-27 16:15:00 -05:00
-
485b9e3888
infra(tofu): scaffold off-cluster R2 remote state (encrypted)
jakman85andClaude Opus 4.8
2026-08-27 15:57:12 -05:00
-
-
91c82d2756
Merge docs/reconcile-with-reality: docs match reality; merge gate green again
jakman85
2026-08-27 00:12:02 -05:00
-
-
9e8b694ba9
docs(conformance): record that the matcher debt is half paid
docs/reconcile-with-reality
jakman85andClaude Opus 5
2026-08-27 00:08:16 -05:00
-
f7d3884ad2
fix(ci): scope the requirement matcher to the diff and to non-doc files
jakman85andClaude Opus 5
2026-08-27 00:04:25 -05:00
-
12c40d8c9c
docs: reconcile the documentation with the deployed reality
jakman85andClaude Opus 5
2026-08-27 00:00:05 -05:00
-
4cf9572c58
fix(vms): normalize comma spacing in unifi manifests — unblock the lint gate
jakman85andClaude Opus 5
2026-08-26 23:59:02 -05:00
-
-
3472f1d161
feat(auth): Keycloak OIDC login + RBAC for kubectl (cert kubeconfig stays break-glass)
jakman85andClaude Opus 4.8
2026-08-26 17:37:05 -05:00
-
ab592028f6
fix(vms): actually apply inline userData + drop secretGenerator (amend
760084e)
jakman85andClaude Opus 4.8
2026-08-26 16:59:03 -05:00
-
760084ea8c
fix(vms): revert UniFi cloud-init to minimal inline userData (1112B)
jakman85andClaude Opus 4.8
2026-08-26 16:42:04 -05:00
-
e99e3d1666
fix(vms): deliver UniFi cloud-init via Secret (userDataSecretRef) — 2048B limit
jakman85andClaude Opus 4.8
2026-08-26 16:34:55 -05:00
-
da1f833de7
fix(vms): drop postBuild substituteFrom on apps-vms — it corrupted VM cloud-init
jakman85andClaude Opus 4.8
2026-08-26 16:26:27 -05:00
-
d5f8212415
feat(vms): add SSH key + qemu-guest-agent to UniFi VM for ops/debugging
jakman85andClaude Opus 4.8
2026-08-26 16:17:11 -05:00
-
7a3da96d9f
fix(cdi): single-replica scratch class + 40Gi UniFi disk (fix insufficient-storage import)
jakman85andClaude Opus 4.8
2026-08-26 15:47:02 -05:00
-
d8101bca38
chore(ansible): set private_key_file for k3s node connectivity
jakman85andClaude Opus 4.8
2026-08-26 15:27:29 -05:00
-
df5979fceb
fix(k3s): enable nonroot-devices so CDI can import to Block-mode PVCs
jakman85andClaude Opus 4.8
2026-08-26 15:24:07 -05:00
-
317b3f02f1
feat(vms): onboard UniFi OS Server as a KubeVirt VM on a non-gating track
jakman85andClaude Opus 4.8
2026-08-26 15:05:05 -05:00
-
36a1a4e1f9
refactor(apps): split monolithic apps Kustomization into dependency waves
jakman85andClaude Opus 4.8
2026-08-26 12:19:00 -05:00
-
1bfb0db6f1
chore(flux): cutover step 1 — disable prune on
apps before wave split
jakman85andClaude Opus 4.8
2026-08-26 12:14:59 -05:00
-
3586769460
feat(storage): CSI snapshots + smart-clone + migratable RWX for KubeVirt live-migration
jakman85andClaude Opus 4.8
2026-08-26 12:06:15 -05:00
-
b57b3e9d71
fix(kubevirt): correct KubeVirtControlPlaneDown expr — wrong metric name + job label
jakman85andClaude Opus 4.8
2026-08-26 10:45:23 -05:00
-
6a7e9d15e7
fix(kubevirt): drop broken http CDI ServiceMonitor causing false CDIOperatorDown
jakman85andClaude Opus 4.8
2026-08-26 10:20:48 -05:00
-
948c390272
conformance: serialize heavy L2/L3 tests + author alerting SMTP sink
jakman85andClaude Opus 4.8
2026-08-26 02:56:56 -05:00
-
a02c0e2d1a
apps: re-enable semaphore — both crashloop root causes fixed
jakman85andClaude Opus 4.8
2026-08-26 02:12:13 -05:00
-
41d696e9fe
fix(apps): semaphore SEMAPHORE_PORT — shadow kubelet service-link injection
jakman85andClaude Opus 4.8
2026-08-26 02:09:22 -05:00
-
0abadd3131
apps: temp-disable semaphore (interactive-setup crashloop blocked apps reconcile)
jakman85andClaude Opus 4.8
2026-08-26 02:04:26 -05:00
-
28498f1099
fix(apps): semaphore fsGroup — schema 1.3.0 podSecurityContext for non-root PVC write
jakman85andClaude Opus 4.8
2026-08-26 02:00:45 -05:00
-
77496f9a8e
feat(apps): onboard semaphore (Phase 6) — second CNPG-DB + OIDC-target app
jakman85andClaude Opus 4.8
2026-08-26 01:47:22 -05:00
-
4be6752c71
feat(apps): onboard nextcloud (Phase 6) — first CNPG-DB + OIDC-target patterns
jakman85andClaude Opus 4.8
2026-08-26 01:32:00 -05:00
-
c8dd4f3f9d
feat(catalog): add SD env/envFrom/lifecycle; retire gitea bootstrap patch
jakman85andClaude Opus 4.8
2026-08-26 01:13:52 -05:00
-
b871877c1b
fix(render): namespace-pin east-west selectors so declared deps actually connect
jakman85andClaude Opus 4.8
2026-08-26 01:01:56 -05:00
-
14beb85b65
fix(render): emit reciprocal ingress-allow for declared dependencies (R-NET-02)
jakman85andClaude Opus 4.8
2026-08-26 00:54:12 -05:00
-
b6f72eab0c
feat(apps): onboard seerr (Overseerr request UI) — completes arr↔seerr↔plex graph
jakman85andClaude Opus 4.8
2026-08-26 00:27:47 -05:00
-
67bc3175f5
fix(ci): drop upload-artifact@v4 (unsupported by Gitea Actions/GHES)
jakman85andClaude Opus 4.8
2026-08-26 00:09:04 -05:00
-
0f75fa29ca
fix(ci): call spec-immutability.sh directly in gate (make masks exit 3 as 2)
jakman85andClaude Opus 4.8
2026-08-26 00:06:47 -05:00
-
79e7f92315
fix(ci): kyverno CLI arch x86_64 in install-tools; wait for dind certs
jakman85andClaude Opus 4.8
2026-08-26 00:04:04 -05:00
-
bc4519bc4c
Phase-6: enable Gitea Actions, in-cluster act_runner, static CI gate
jakman85andClaude Opus 4.8
2026-08-25 23:51:52 -05:00
-
81ef78295a
infra: direct kube-API access via kube-vip VIP + NAT (retire SSH tunnel)
jakman85andClaude Opus 4.8
2026-08-25 22:10:27 -05:00
-
60a58f01ad
feat(infra): kube-vip control-plane HA VIP (192.168.1.49) + API tls-san
jakman85andClaude Opus 4.8
2026-08-25 21:52:43 -05:00
-
d99d171468
Phase-6: repoint Flux source to in-cluster Gitea
jakman85andClaude Opus 4.8
2026-08-25 18:50:19 -05:00
-
d32b5c4ec0
fix(renderer): Recreate strategy for Deployments mounting RWO PVCs
jakman85andClaude Opus 4.8
2026-08-25 18:14:45 -05:00
-
73c4475d34
fix(gitea): mount PVC at /data + headless-install bootstrap (Phase 6)
jakman85andClaude Opus 4.8
2026-08-25 18:07:56 -05:00