0 Fork 0

T

jakman85andClaude Opus 4.8 4a781ace49 fix(vpn): exec (localhost) liveness probe — VPN routing breaks kubelet HTTP probe

Once the tunnel redirects the pod default route via tun0, the pod's response to the
kubelet's httpGet liveness probe egresses the tunnel and never returns → probe times
out → pod restarts ~every 2min despite the tunnel being up (PIA egress IP confirmed).
Switch to a local wget exec probe (stays on lo).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-08-23 23:57:31 -05:00

.gitea/workflows

Phase 0 clarification follow-ups + reconcile CI integration seams

2026-08-16 00:42:43 -05:00

apps

Initial skeleton: home-network-k3s implementation repo

2026-08-15 23:41:43 -05:00

bootstrap

wip(vpn): gluetun custom-provider mode with operator's PIA .ovpn

2026-08-23 00:40:08 -05:00

catalog

T-0.3 ServiceDefinition schema + renderer contract + examples (R-GITOPS-02)

2026-08-16 00:08:30 -05:00

wire Cloudflare DNS token secrets + exempt *.sops.yaml from yamllint

2026-08-17 00:35:45 -05:00

clusters

fix(vpn): narrow FIREWALL_OUTBOUND_SUBNETS to 10.0.0.0/16 (PF gateway overlap)

2026-08-22 23:36:51 -05:00

conformance

feat(conformance): implement L3 default-deny-failclosed (R-NET-01/02, fault injection)

2026-08-17 17:42:34 -05:00

infra

fix(k3s): disable local-storage so Longhorn is the sole default StorageClass

2026-08-17 07:34:31 -05:00

platform

fix(vpn): exec (localhost) liveness probe — VPN routing breaks kubelet HTTP probe

2026-08-23 23:57:31 -05:00

platform-config

fix(monitoring): move PrometheusRule alerts to platform-config (CRD ordering)

2026-08-21 22:30:01 -05:00

schemas

Phase 0 clarification follow-ups + reconcile CI integration seams

2026-08-16 00:42:43 -05:00

.gitignore

Initial skeleton: home-network-k3s implementation repo

2026-08-15 23:41:43 -05:00

.sops.yaml

Added fixes before token usage cutoff. Added required credentials for dns api for cert-manager and external-dns

2026-08-16 23:12:25 -05:00

DECISIONS-LOG.md

wip(vpn): gluetun custom-provider mode with operator's PIA .ovpn

2026-08-23 00:40:08 -05:00

README.md

Initial skeleton: home-network-k3s implementation repo

2026-08-15 23:41:43 -05:00

README.md

home-network-k3s-impl

Implementation of the home k3s + Longhorn platform. This repo holds the reconciled artifacts (Flux config, Kustomize overlays, KubeVirt/Helm manifests, ServiceDefinitions, Kyverno policies, Chainsaw conformance tests, CI). It is driven by — and subordinate to — the read-only specification at ../home-network-k3s.

Rules (from the spec — non-negotiable)

The spec is read-only. Never modify anything under ../home-network-k3s. Implement against it; escalate spec problems, don't edit them (spec AGENTS.md §11, R-TEST-06).
Done = a green, reproducible, requirement-tagged conformance test — never "merged," never a manual demo (spec docs/14, agents/definition-of-done.md).
No work on main. Every change is a feature branch merged into main (spec CONTRIBUTING.md).
No plaintext secrets — SOPS-encrypted only (spec docs/07).
Phase discipline — only build what the active roadmap phase authorizes (spec roadmap/phases.md).

Layout

platform/     platform services (Flux HelmReleases/Kustomizations): cilium, longhorn,
              cert-manager, externaldns, gateway, monitoring, velero, kubevirt,
              image-automation, keycloak, oauth2-proxy, kyverno/
apps/         application workloads, one dir per catalog service
catalog/      ServiceDefinition entries (the onboarding surface)
schemas/      ServiceDefinition JSON Schema + renderer contract
clusters/     Flux entrypoints + dev/ and prod/ overlays
conformance/  Chainsaw behavior/conformance suite + harness + coverage report
.gitea/       Gitea Actions CI (lint · schema · Kyverno L0 · Chainsaw trigger · merge gate)

Current phase: Phase 0 — Foundations (repo, CI, ServiceDefinition schema, conformance harness, Kyverno L0 gate). No cluster exists yet; Phase 1 (cluster bring-up) is not authorized.