jakman85andClaude Opus 5.5 f13d336630 fix(vpn): enrol keith-phone-home and admit the WireGuard subnet to PiHole DNS ...

Add the at-home peer (10.90.0.3) and list ${WG_CLIENT_CIDR} in the PiHole
DNS frontends' loadBalancerSourceRanges. wg0 is a Cilium device, so tunnel
clients reach the source-range check untranslated; a LAN-only list is
predicted to drop their DNS. Adds an L0 guard that both ranges are present
and every range is RFC1918, and corrects the README's SNAT and IPv6 claims.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-08 20:45:48 -06:00

..

admission-policies-actually-applied

fix(sec): the R-SEC-02 admission policy was never applied -- and nothing could tell

2026-09-29 13:23:09 -05:00

alert-metrics-have-scrape-targets

fix(cloudflared): auditable Service+ServiceMonitor scrape; placeholder-only template value

2026-11-08 12:39:56 -06:00

alert-rules-unit-tested

feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages

2026-10-29 23:59:55 -05:00

alert-runbooks-resolvable

fix(conformance): whole-repo checks audited nested agent worktrees as source

2026-09-18 22:14:51 -05:00

auditability-proofs-producible

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

bulk-tier-distinct-from-replicated

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

c2-root-surface

feat(sec): constrain the conformance CI trigger at admission (R-SEC-02)

2026-09-29 03:22:41 -05:00

cloudflared-ingress-rules

fix(cloudflared): fsGroup so uid 65532 can read the 0440 credentials Secret

2026-11-08 15:49:56 -06:00

dev-nodes-provisioned-as-code

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

egress-paths-selected-by-rules

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

flux-postbuild-substitution

test(l0): prove the dollar-collapse guard fires — and name the real envsubst

2026-09-13 16:24:42 -05:00

ha-control-plane-as-code

fix(conformance): one regex made the merge gate take 28 minutes instead of 2

2026-10-18 02:38:23 -05:00

internal-services-publish-no-public-dns

feat(dns): publish public names as proxied CNAMEs to the Cloudflare Tunnel

2026-11-08 17:55:41 -06:00

keycloak-client-secret-reconciler

feat(ci): run L0/L1 offline checks, mutation suites and yamllint in bounded parallel pools

2026-11-08 00:18:57 -06:00

keycloak-passkey-reconciler

feat(ci): run L0/L1 offline checks, mutation suites and yamllint in bounded parallel pools

2026-11-08 00:18:57 -06:00

l2-announced-vips-serve-from-any-node

fix(l4): externalTrafficPolicy Cluster on unifi + crafty L4 VIPs

2026-09-14 01:32:47 -05:00

least-privilege-rbac

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

no-plaintext-secrets

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

oauth2-proxy-api-routes-per-app

feat(auth): declare API paths per service, so --api-route can ship at all

2026-10-01 22:07:08 -05:00

oauth2-proxy-cookie-names-distinct

fix(auth): five oauth2-proxy sidecars shared one cookie and evicted each other

2026-09-30 10:55:06 -05:00

pihole-dns-source-ranges

fix(vpn): enrol keith-phone-home and admit the WireGuard subnet to PiHole DNS

2026-11-08 20:45:48 -06:00

placeholder-guard-coupling

fix(conformance): whole-repo checks audited nested agent worktrees as source

2026-09-18 22:14:51 -05:00

prod-baremetal-not-dev-surface

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

servicemonitor-ports-resolve

feat(obs): wire the gate-sidecar scrape, and fix the alert that would have gone silent doing it

2026-10-01 21:56:07 -05:00

spec-immutability-enforced

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

tls-lifecycle-automated

fix(conformance): workload-mTLS certificates may use a private CA, if they prove they are workload-internal

2026-10-29 23:59:55 -05:00

whole-repo-invariants-wired

fix(conformance): the meta-check was layer-agnostic and reported failures silently

2026-09-18 22:43:17 -05:00