jakman85 and Claude Opus 4.8
70a98675ac
Phase 0 clarifications: resolve 5 ambiguities surfaced by implementation
...
- docs/07: correct plaintext-secret enforcement — CI-time ciphertext check vs
admission SOPS-provenance (Flux decrypts before the API server, so an admitted
Secret carries no ciphertext; a 'reject plaintext' admission rule is impossible).
- docs/13: add Contract clarifications (v1.1) — source exactly-one-of; longhorn⇒size
(L0 policy); backup is a {policy} ref; update.channel free-string/stable default;
auth.groups required for oidc|forward-auth; public⇒auth.mode≠none (schema);
irreplaceable⇒off-cluster-backup (L0 policy).
- docs/02: Cilium install ownership — Ansible bootstraps, Flux adopts config, value-parity contract.
- docs/03: platform label-key convention (homelab.keithjackson.dev/{egress-class,auth-mode,...}).
- docs/14: ServiceDefinition validation is two complementary L0 gates (JSON Schema shape + Kyverno invariants).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]
2026-08-16 00:27:24 -05:00
jakman85 and Claude Opus 4.8
fb153f0bb5
Add Keycloak IdP / SSO (ADR-0014, docs/15, R-IDP-*)
...
New identity subsystem, and resolves the C2 auth open question:
- docs/15-identity-and-access.md + ADR-0014: Keycloak as central IdP; native
OIDC where supported (Gitea, Nextcloud, Grafana, Kasm, Semaphore, Headlamp)
and oauth2-proxy forward-auth for bare UIs (PiHole, *arr, qBittorrent,
Homepage, Prometheus, Alertmanager, Hubble). Group-based authz + MFA;
declarative realm/clients (GitOps); PostgreSQL on Longhorn, DR-critical +
break-glass; hardened public exposure. Plex/Seerr use Plex auth; Minecraft N/A.
- Requirements R-IDP-01..06; ServiceDefinition gains an block.
- Onboarded early (with Gitea) so services adopt SSO as they come up.
- Threaded through: docs 00,01,07,10,12,13; roadmap phases+workstreams;
task board (T-6.1c/T-6.1d); glossary; ADR index; README.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]
2026-08-15 23:33:49 -05:00
jakman85 and Claude Opus 4.8
de26a53d4b
Establish dev workflow (feature-branch→main) and pull Gitea bootstrap earlier
...
- Add CONTRIBUTING.md: interim local-git rules (no work on main; every change
a feature branch merged into main) and the target state (Gitea-hosted repos,
GitOps source cutover, CI/CD via Gitea Actions running the Kyverno gate +
Chainsaw conformance Job, PR merge gate). Note the self-hosted-git
bootstrapping circularity + off-cluster mirror/backup mitigation.
- AGENTS.md: add section 12 (version-control workflow).
- docs/05: source-of-truth migration (local bootstrap -> self-hosted Gitea).
- docs/13 + roadmap: reprioritize Gitea as bootstrapping-critical, onboarded
early (WS-APPS step 2); nextcloud onboarding split out.
- task-board: T-6.1a (gitea early), T-6.1b (source+CI migration to Gitea).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]
2026-08-15 22:40:11 -05:00
jakman85 and Claude Opus 4.8
e8c555cfeb
Initial baseline: home platform (k3s + Longhorn) specification repository
...
Greenfield spec set for a GitOps-driven PaaS+IaaS home platform: vision &
requirements (R-* IDs), architecture, 14 domain specs, 11 ADRs, roadmap
(phases + workstreams), and AI-agent coordination (roles, protocol,
definition-of-done, task board).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]
2026-08-15 22:37:56 -05:00
jakman85andClaude Opus 4.8