jakman85andClaude Opus 5.5 b855b6b294 feat(gitea): require sign-in to read anything; Flux and CI authenticate first ...

Gitea stays public on the Cloudflare Tunnel, but anonymous crawlers have kept
the pod at 2-6 cores since PR #156. Operator decision 2026-11-14: reading
anything requires a (Keycloak) login.

- catalog/gitea.yaml (+ re-rendered apps/wave-0/gitea.yaml):
  GITEA__service__REQUIRE_SIGNIN_VIEW=true (strict: web, API, git pull,
  registry /v2/token), and a postStart-written robots.txt (Disallow: /).
- clusters/prod: flux-system GitRepository gets secretRef flux-gitea-read,
  an OUT-OF-BAND read:repository token the operator must create BEFORE merge.
- gate.yml / cve-triage.yaml: the toolbox job image was pulled anonymously
  from the Gitea registry; it now uses container.credentials with the
  existing RENOVATE_TOKEN (read:package, proven by renovate.yaml preflight).

Anonymous-reader inventory and operator steps:
decisions/2026-11-14-gitea-require-signin.md

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-14 14:16:50 -06:00

..

tests

feat(pihole): two replicas on different nodes, and fix a PVC mounted where pihole never writes

2026-10-04 01:34:52 -05:00

gitea-bootstrap-secret.sops.yaml

feat(gitea): wire native Keycloak OIDC SSO (break-glass admin retained)

2026-08-27 17:01:46 -05:00

gitea.yaml

feat(gitea): require sign-in to read anything; Flux and CI authenticate first

2026-11-14 14:16:50 -06:00

jackett-oauth2-proxy-credentials.sops.yaml

feat(auth): gate jackett/qbittorrent/radarr/sonarr UIs with oauth2-proxy sidecar (rollout)

2026-08-31 08:45:46 -05:00

jackett.yaml

chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3053-ls34

2026-11-13 08:16:41 +00:00

kustomization.yaml

fix(plex): unblock the app tier — drop the Certificate that stalled apps-wave-0, advertise http

2026-10-04 17:10:25 -05:00

nextcloud-db-app.sops.yaml

refactor(apps): split monolithic apps Kustomization into dependency waves

2026-08-26 12:19:00 -05:00

nextcloud-db-backup-credentials-prod.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

nextcloud-db-backup-credentials.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

nextcloud-db.yaml

chore(deps): Update ghcr.io/cloudnative-pg/postgresql Docker tag to v16.15

2026-11-07 08:17:11 +00:00

pihole-bootstrap-secret.sops.yaml

feat(pihole): declare the admin password and adlists in git

2026-10-04 01:07:30 -05:00

pihole-dns.yaml

fix(vpn): enrol keith-phone-home and admit the WireGuard subnet to PiHole DNS

2026-11-08 20:45:48 -06:00

pihole-oauth2-proxy-credentials.sops.yaml

feat(auth): gate pihole UI with per-app oauth2-proxy sidecar (canary)

2026-08-31 08:36:03 -05:00

pihole.yaml

feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

2026-11-09 09:42:52 -06:00

plex-claim-secret.sops.yaml

docs: correct CI/platform documentation that was stale, wrong, or load-bearing

2026-09-29 02:14:26 -05:00

plex-remote.yaml

feat(plex): expose tcp/32400 for remote access via a pinned LoadBalancer VIP

2026-10-03 23:30:46 -05:00

plex.yaml

feat(dns): publish public names as proxied CNAMEs to the Cloudflare Tunnel

2026-11-08 17:55:41 -06:00

qbittorrent-bootstrap-secret.sops.yaml

WIP: durable qBittorrent WebUI credential

2026-09-13 15:57:42 -05:00

qbittorrent-oauth2-proxy-credentials.sops.yaml

feat(auth): gate jackett/qbittorrent/radarr/sonarr UIs with oauth2-proxy sidecar (rollout)

2026-08-31 08:45:46 -05:00

qbittorrent.yaml

Merge pull request 'chore(deps): Update quay.io/oauth2-proxy/oauth2-proxy Docker tag to v7.15.6' (#136) from renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x into main

2026-11-08 06:45:31 +00:00

semaphore-db-app.sops.yaml

refactor(apps): split monolithic apps Kustomization into dependency waves

2026-08-26 12:19:00 -05:00

semaphore-db-backup-credentials-prod.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

semaphore-db-backup-credentials.sops.yaml

feat(backup): the four backup credentials become TWO objects each, one per environment

2026-09-07 01:38:22 -05:00

semaphore-db.yaml

chore(deps): Update ghcr.io/cloudnative-pg/postgresql Docker tag to v16.15

2026-11-07 08:17:11 +00:00

vm-demo.yaml

fix(obs): twelve app SLI rules read a signal that exists; kill the dead ServiceMonitors

2026-09-13 17:11:30 -05:00