2026-04-30 - 2026-10-30
Overview
45 Pull requests merged by 2 users
Merged
#84 feat(iam): a KeyRotation for every consumer except poimen-memory
Merged
#83 fix(comfyui): keep the login path on an ungated ingress
Merged
#82 fix(comfyui): drop the snippet that made nginx reject the whole ingress
Merged
#81 fix(comfyui): one ingress for the app and the login path
Merged
#80 feat(comfyui): put ComfyUI behind ZITADEL single sign-on
Merged
#79 feat(iam): KeyRotation CRD and controller for credential rotation
Merged
#78 chore(authentik): finish the retirement in Terraform and messaging
Merged
#77 fix(iam): stop rotating client secrets on every apply, repair Grafana OIDC
Merged
#76 feat(grafana): provision a Gotify contact point
Merged
#75 feat(gotify): bridge Grafana alerts into Gotify
Merged
#74 feat(igotify): wire the assist bridge with a Gotify client token
Merged
#73 revert(gotify): remove the ZITADEL proxy, keep Gotify's own auth
Merged
#72 feat(gotify): put the Gotify UI behind ZITADEL single sign-on
Merged
#71 feat(iam): wire all 9 consumer manifests to Zitadel OIDC
Merged
#70 integration: merge minio-client fix, local-path backend, and local cloudflared ingress
Merged
#68 fix(monitoring): cap Prometheus retention below the PVC size
Merged
#67 fix(argocd): allow the Zitadel chart repo in the homelab AppProject
Merged
#66 fix(sops): repair the ksops generator list and rotate the Zitadel masterkey
Merged
#65 fix(sops): drop the orphan forgejo-registry-pat file
Merged
#63 feat(iam): wire Zitadel as the Authentik replacement
Merged
#64 chore(argocd): delete the azhi-riotpiao Application
Merged
#62 fix(longhorn): retire the failed 2TB PERC disk on talos-cp-2
Merged
#61 test(argocd): point azhi-riotpiao at the CNPG branch
Merged
#60 feat(argocd): reconcile azhi-infra from its private GitHub repo
Merged
#59 fix(etcd): deploy the defrag CronJob so etcd cannot fill the backend quota
Merged
#55 fix(secrets): populate the empty sops placeholders and drop the unused one
Merged
#57 fix(minio): freeze the community image by digest and alert on pull failure
Merged
#54 feat(poimen): pi sandbox workspace volume, encrypted api keys, cluster dns rewrite
Merged
#53 fix(storage): pin minio tenant to a published image release
Merged
#52 fix(llm-serving): V1 prefill scheduling + admission observability (#51)
Merged
#50 fix: aggressive 2m cleanup for completed jobs/pods, add PAPERLESS_USERNAME to paperless-ai
Merged
#49 fix: use CiliumNetworkPolicy for kube-apiserver egress
Merged
#48 fix: allow CI runner egress to K8s API server
Merged
#46 feat: add Tekton Pipelines for CI/CD orchestration
Merged
#45 fix: add PAPERLESS_USERNAME env var to paperless-ai
Merged
#44 fix(comfyui): correct port 8188->18188, add TLS ingress at comfyui.riotpiao.com
Merged
#30 fix(cnpg): scale paperless-db, immich-db, gotify-db to 3 instances
Merged
#29 fix(argocd): update repoURL after org transfer
Merged
#19 feat(gotify): push notification server + SMTP email relay
Merged
#18 fix(comfyui): port 8888, emptyDir storage, liveness probe
Merged
#17 feat: add ComfyUI + rebalance GPU allocation
Merged
#15 P3.8: Restrict llm-serving ingress to api-gateway only
Merged
#4 ci: revert runners to public images (no custom registry needed)
Merged
#2 fix: always re-register runner to keep labels in sync
Merged
#1 fix: add CoreDNS api.riotpiao.com rewrite + fix runner Alpine base image
9 Issues closed from 2 users
Closed
#51 [Infra] reasoning: vLLM prefill scheduling flags + admission-control dashboard panels (homelab-frontend#64)
Closed
#10 P3.5: Implement RFC 8693 OAuth2 Token Exchange endpoint
Closed
#8 P3.3: Add /auth/refresh endpoint (token renewal)
Closed
#6 P3.1: Add /auth/token endpoint (password grant proxy)
Closed
#12 P3.7: Wire auth config (tokenUrl, clientId, clientSecret) into gateway deployment
Closed
#11 P3.6: Enforce JWT auth on X-Service adapter dispatch
Closed
#9 P3.4: Inject X-Forwarded-User identity headers after JWT validation
Closed
#13 P3.8: Audit NetworkPolicy — downstream must only accept gateway traffic
Closed
#7 P3.2: Enable password grant on local-llm Authentik provider
32 Issues created by 2 users
Opened
#6 P3.1: Add /auth/token endpoint (password grant proxy)
Opened
#7 P3.2: Enable password grant on local-llm Authentik provider
Opened
#8 P3.3: Add /auth/refresh endpoint (token renewal)
Opened
#9 P3.4: Inject X-Forwarded-User identity headers after JWT validation
Opened
#10 P3.5: Implement RFC 8693 OAuth2 Token Exchange endpoint
Opened
#11 P3.6: Enforce JWT auth on X-Service adapter dispatch
Opened
#12 P3.7: Wire auth config (tokenUrl, clientId, clientSecret) into gateway deployment
Opened
#13 P3.8: Audit NetworkPolicy — downstream must only accept gateway traffic
Opened
#14 P3.9: End-to-end integration test — full auth flow
Opened
#20 [Event-Bus P0] Deploy Gotify notification server
Opened
#21 [Event-Bus P1] Core event router — POST /v1/events endpoint
Opened
#22 [Event-Bus P2] Source adapters — Forgejo, ArgoCD, Gotify webhooks
Opened
#23 [Event-Bus P3] Target dispatchers — Gotify, SQS, Temporal, webhook
Opened
#24 [Observer P1] ObserverWorkflow — long-running event evaluator in Temporal
Opened
#25 [Observer P2] LLM-powered pattern detection + anomaly analysis
Opened
#26 [Event-Bus P4] Dead letter queue + Prometheus metrics + Grafana dashboard
Opened
#27 [Gateway] Audit trail — log successful JWT auth with identity
Opened
#28 [Event-Bus E2E] Forgejo PR → event bus → Gotify push + email + observer goal evaluation
Opened
#31 [Network] TCP backpressure for streaming LLM responses
Opened
#32 [Network] HTTP/2 multiplexing for concurrent streams
Opened
#33 [Network] Disable proxy buffering for SSE
Opened
#34 [GPU] KV Cache VRAM monitoring + PagedAttention
Opened
#35 [GPU] Enable prefix caching for RAG contexts
Opened
#36 [GPU] Preemption swapping for concurrency spikes
Opened
#37 [Observability] vLLM Prometheus metrics scraping
Opened
#38 [Observability] Grafana dashboard for TTFT + ITL
Opened
#39 [Observability] HPA driven by GPU KV Cache usage
Opened
#40 [Infra] Local PV on NVMe for model weight cold starts
Opened
#41 [Infra] NVIDIA runtime declarative config for Talos
Opened
#42 [Workflow] Structured output enforcement (JSON grammar)
Opened
#43 [Workflow] Circuit breaker with model degradation
Opened
#51 [Infra] reasoning: vLLM prefill scheduling flags + admission-control dashboard panels (homelab-frontend#64)