jakman85andClaude Opus 5.5 8a9baa92bc feat(gitea): upgrade 1.27.3 -> 28.3.0 ...

Gitea dropped the "1." prefix; 28.x is the successor of 1.27.
- image 28.3.0, update.range >=28.0.0 <29.0.0, Renovate ceiling <29.0.0
- drop GITEA__server__DOMAIN (no longer read in 28, ROOT_URL is the source)
- declare RUN_RETENTION_DAYS=400, EGRESS_MODE=lax (no allow list: the OIDC
  login source is not gated by the egress policy in 28.3.0), and
  DISABLE_REGISTRATION=true (28's new default)
- document autoRollbackOnFailedHealth as inert (no ImagePolicy is rendered);
  rollback is a PVC restore because the DB migration is one-way

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-07 22:55:06 -06:00

..

tests

feat(pihole): two replicas on different nodes, and fix a PVC mounted where pihole never writes

2026-10-04 01:34:52 -05:00

gitea-bootstrap-secret.sops.yaml

feat(gitea): wire native Keycloak OIDC SSO (break-glass admin retained)

2026-08-27 17:01:46 -05:00

gitea.yaml

feat(gitea): upgrade 1.27.3 -> 28.3.0

2026-11-07 22:55:06 -06:00

jackett-oauth2-proxy-credentials.sops.yaml

feat(auth): gate jackett/qbittorrent/radarr/sonarr UIs with oauth2-proxy sidecar (rollout)

2026-08-31 08:45:46 -05:00

jackett.yaml

chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3025-ls29

2026-11-07 08:15:48 +00:00

kustomization.yaml

fix(plex): unblock the app tier — drop the Certificate that stalled apps-wave-0, advertise http

2026-10-04 17:10:25 -05:00

nextcloud-db-app.sops.yaml

refactor(apps): split monolithic apps Kustomization into dependency waves

2026-08-26 12:19:00 -05:00

nextcloud-db-backup-credentials-prod.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

nextcloud-db-backup-credentials.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

nextcloud-db.yaml

chore(deps): Update ghcr.io/cloudnative-pg/postgresql Docker tag to v16.15

2026-11-07 08:17:11 +00:00

pihole-bootstrap-secret.sops.yaml

feat(pihole): declare the admin password and adlists in git

2026-10-04 01:07:30 -05:00

pihole-dns.yaml

feat(pihole): authoritative LAN DNS for the zone on udp/53 + tcp/53 at a pinned VIP

2026-09-14 00:57:58 -05:00

pihole-oauth2-proxy-credentials.sops.yaml

feat(auth): gate pihole UI with per-app oauth2-proxy sidecar (canary)

2026-08-31 08:36:03 -05:00

pihole.yaml

chore(deps): Update pihole/pihole Docker tag to v2026.10.1

2026-11-04 08:16:12 +00:00

plex-claim-secret.sops.yaml

docs: correct CI/platform documentation that was stale, wrong, or load-bearing

2026-09-29 02:14:26 -05:00

plex-remote.yaml

feat(plex): expose tcp/32400 for remote access via a pinned LoadBalancer VIP

2026-10-03 23:30:46 -05:00

plex.yaml

chore(deps): Update plexinc/pms-docker Docker tag to v1.43.6.11085-d1e52e169

2026-11-05 08:17:16 +00:00

qbittorrent-bootstrap-secret.sops.yaml

WIP: durable qBittorrent WebUI credential

2026-09-13 15:57:42 -05:00

qbittorrent-oauth2-proxy-credentials.sops.yaml

feat(auth): gate jackett/qbittorrent/radarr/sonarr UIs with oauth2-proxy sidecar (rollout)

2026-08-31 08:45:46 -05:00

qbittorrent.yaml

chore(deps): Update lscr.io/linuxserver/qbittorrent Docker tag to v5.3.0

2026-11-07 08:17:42 +00:00

semaphore-db-app.sops.yaml

refactor(apps): split monolithic apps Kustomization into dependency waves

2026-08-26 12:19:00 -05:00

semaphore-db-backup-credentials-prod.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

semaphore-db-backup-credentials.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

semaphore-db.yaml

chore(deps): Update ghcr.io/cloudnative-pg/postgresql Docker tag to v16.15

2026-11-07 08:17:11 +00:00

vm-demo.yaml

fix(obs): twelve app SLI rules read a signal that exists; kill the dead ServiceMonitors

2026-09-13 17:11:30 -05:00