jakman85 da0515c8c8 Merge pull request 'fix(vpn): enrol keith-phone-home and admit the WireGuard subnet to PiHole DNS' (#158) from fix/wg-home-peer-pihole-sources into main ...

Reviewed-on: #158

2026-11-09 02:50:04 +00:00

..

admission-policies-actually-applied

fix(sec): the R-SEC-02 admission policy was never applied -- and nothing could tell

2026-09-29 13:23:09 -05:00

alert-metrics-have-scrape-targets

fix(cloudflared): auditable Service+ServiceMonitor scrape; placeholder-only template value

2026-11-08 12:39:56 -06:00

alert-rules-unit-tested

feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages

2026-10-29 23:59:55 -05:00

alert-runbooks-resolvable

fix(conformance): whole-repo checks audited nested agent worktrees as source

2026-09-18 22:14:51 -05:00

auditability-proofs-producible

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

bulk-tier-distinct-from-replicated

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

c2-root-surface

feat(sec): constrain the conformance CI trigger at admission (R-SEC-02)

2026-09-29 03:22:41 -05:00

cloudflared-ingress-rules

fix(cloudflared): fsGroup so uid 65532 can read the 0440 credentials Secret

2026-11-08 15:49:56 -06:00

dev-nodes-provisioned-as-code

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

egress-paths-selected-by-rules

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

flux-postbuild-substitution

test(l0): prove the dollar-collapse guard fires — and name the real envsubst

2026-09-13 16:24:42 -05:00

ha-control-plane-as-code

fix(conformance): one regex made the merge gate take 28 minutes instead of 2

2026-10-18 02:38:23 -05:00

internal-services-publish-no-public-dns

feat(dns): publish public names as proxied CNAMEs to the Cloudflare Tunnel

2026-11-08 17:55:41 -06:00

keycloak-client-secret-reconciler

feat(ci): run L0/L1 offline checks, mutation suites and yamllint in bounded parallel pools

2026-11-08 00:18:57 -06:00

keycloak-passkey-reconciler

feat(ci): run L0/L1 offline checks, mutation suites and yamllint in bounded parallel pools

2026-11-08 00:18:57 -06:00

l2-announced-vips-serve-from-any-node

fix(l4): externalTrafficPolicy Cluster on unifi + crafty L4 VIPs

2026-09-14 01:32:47 -05:00

least-privilege-rbac

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

no-plaintext-secrets

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

oauth2-proxy-api-routes-per-app

feat(auth): declare API paths per service, so --api-route can ship at all

2026-10-01 22:07:08 -05:00

oauth2-proxy-cookie-names-distinct

fix(auth): five oauth2-proxy sidecars shared one cookie and evicted each other

2026-09-30 10:55:06 -05:00

pihole-dns-source-ranges

fix(vpn): enrol keith-phone-home and admit the WireGuard subnet to PiHole DNS

2026-11-08 20:45:48 -06:00

pihole-lan-names

feat(dns): PiHole answers an explicit LAN name list, not a zone wildcard

2026-11-08 19:51:49 -06:00

placeholder-guard-coupling

fix(conformance): whole-repo checks audited nested agent worktrees as source

2026-09-18 22:14:51 -05:00

prod-baremetal-not-dev-surface

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

servicemonitor-ports-resolve

feat(obs): wire the gate-sidecar scrape, and fix the alert that would have gone silent doing it

2026-10-01 21:56:07 -05:00

spec-immutability-enforced

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

tls-lifecycle-automated

fix(conformance): workload-mTLS certificates may use a private CA, if they prove they are workload-internal

2026-10-29 23:59:55 -05:00

whole-repo-invariants-wired

fix(conformance): the meta-check was layer-agnostic and reported failures silently

2026-09-18 22:43:17 -05:00