jakman85andClaude Opus 5.5 183bca6897 feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them ...

pihole/pihole (no tag)               -> 2026.10.0               sha256:d3413471...
lscr.io/linuxserver/jackett:latest   -> v0.24.2865-ls7          sha256:4fcf3cc2...
plexinc/pms-docker:latest            -> 1.43.4.10903-e5521bd8c  sha256:e0ab2739...

Each tag was resolved against its registry and matched the pods' imageID, so the image is
unchanged (the pod template string does change, so Flux rolls the three workloads).

renovate.json5: regex versioning for jackett (-lsN) and plex (build-hex); jackett is looked
up on ghcr.io via overridePackageName, because lscr.io is capped at dockerMaxPages=20 pages
and jackett's 32k tags put the running one at #31,980 (dry run proposed nothing without it);
jackett weekly (13 builds in 12 days); pihole deliberately unheld, year rollover = major.
Stale "publishes only latest" prose fixed in renovate.json5 and three runbooks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-31 10:38:07 -05:00

..

tests

feat(pihole): two replicas on different nodes, and fix a PVC mounted where pihole never writes

2026-10-04 01:34:52 -05:00

gitea-bootstrap-secret.sops.yaml

feat(gitea): wire native Keycloak OIDC SSO (break-glass admin retained)

2026-08-27 17:01:46 -05:00

gitea.yaml

feat(pm-agent): an in-cluster AI Program Manager that turns Gitea issues into pull requests

2026-10-05 22:28:10 -05:00

jackett-oauth2-proxy-credentials.sops.yaml

feat(auth): gate jackett/qbittorrent/radarr/sonarr UIs with oauth2-proxy sidecar (rollout)

2026-08-31 08:45:46 -05:00

jackett.yaml

feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them

2026-10-31 10:38:07 -05:00

kustomization.yaml

fix(plex): unblock the app tier — drop the Certificate that stalled apps-wave-0, advertise http

2026-10-04 17:10:25 -05:00

nextcloud-db-app.sops.yaml

refactor(apps): split monolithic apps Kustomization into dependency waves

2026-08-26 12:19:00 -05:00

nextcloud-db-backup-credentials-prod.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

nextcloud-db-backup-credentials.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

nextcloud-db.yaml

fix(cnpg): the grant reconciler died on every Flux-managed run

2026-09-13 00:19:49 -05:00

pihole-bootstrap-secret.sops.yaml

feat(pihole): declare the admin password and adlists in git

2026-10-04 01:07:30 -05:00

pihole-dns.yaml

feat(pihole): authoritative LAN DNS for the zone on udp/53 + tcp/53 at a pinned VIP

2026-09-14 00:57:58 -05:00

pihole-oauth2-proxy-credentials.sops.yaml

feat(auth): gate pihole UI with per-app oauth2-proxy sidecar (canary)

2026-08-31 08:36:03 -05:00

pihole.yaml

feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them

2026-10-31 10:38:07 -05:00

plex-claim-secret.sops.yaml

docs: correct CI/platform documentation that was stale, wrong, or load-bearing

2026-09-29 02:14:26 -05:00

plex-remote.yaml

feat(plex): expose tcp/32400 for remote access via a pinned LoadBalancer VIP

2026-10-03 23:30:46 -05:00

plex.yaml

feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them

2026-10-31 10:38:07 -05:00

qbittorrent-bootstrap-secret.sops.yaml

WIP: durable qBittorrent WebUI credential

2026-09-13 15:57:42 -05:00

qbittorrent-oauth2-proxy-credentials.sops.yaml

feat(auth): gate jackett/qbittorrent/radarr/sonarr UIs with oauth2-proxy sidecar (rollout)

2026-08-31 08:45:46 -05:00

qbittorrent.yaml

fix(obs): open 44180 to ns monitoring so the forward-auth gate sidecars are actually scrapable

2026-10-04 16:05:44 -05:00

semaphore-db-app.sops.yaml

refactor(apps): split monolithic apps Kustomization into dependency waves

2026-08-26 12:19:00 -05:00

semaphore-db-backup-credentials-prod.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

semaphore-db-backup-credentials.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

semaphore-db.yaml

feat(cnpg): synchronous replication, quorum of 1, dataDurability preferred

2026-09-07 23:54:19 -05:00

vm-demo.yaml

fix(obs): twelve app SLI rules read a signal that exists; kill the dead ServiceMonitors

2026-09-13 17:11:30 -05:00