Block a user
docs(agents): one workspace per agent run — the shared checkout is off-limits
feat(vpn-ingress): WireGuard remote access on udp/51820 — hostNetwork, because a pod identity would 403 every Gateway hostname
docs(obs): record that the gate-sidecar scrape works — four places still said it did not
feat(cilium): roll the agents when cilium-config changes (merged config was silently inert)
fix(plex): advertise a resolver-independent plex.direct name again (LAN-wide outage)
fix(plex): unblock the app tier — drop the Certificate that stalled apps-wave-0, advertise http
feat(plex): one advertised hostname for local+remote, its own LE cert, and a LAN definition so LAN clients stop reading as remote
feat(cilium): export Plex's pre-SNAT client address via Hubble, scoped to tcp/32400
fix(obs): open 44180 to ns monitoring so the forward-auth gate sidecars are actually scrapable