This website requires JavaScript.
814f96040f
Merge pull request 'fix(forgejo): keep 60Gi storage, revert CPU limit to 1000m' (#96 ) from fix/forgejo-storage-60gi-cpu-revert into main
rock
2026-11-02 05:43:06 +00:00
b7de85e01e
fix(forgejo): resolve merge conflict — keep 60Gi, revert CPU to 1000m
rock
2026-11-02 13:42:46 +08:00
aa992872cb
fix(forgejo): revert CPU limit 3000m->1000m, keep 60Gi storage
rock
2026-11-02 13:40:16 +08:00
1fd5f25932
feat(longhorn): one-shot destructive disk health scan job (#95 )
rock
2026-11-02 04:32:30 +00:00
747a6fb9cb
fix(forgejo): raise the shared storage to 60Gi, the registry outgrew 20Gi
rock
2026-11-01 13:54:17 -07:00
8f9bf6ee8d
fix(forgejo): raise the shared storage to 60Gi, the registry outgrew 20Gi
rock
2026-11-01 13:54:17 -07:00
ce4434286c
fix(forgejo): raise Gitea CPU limit — it was throttled 16% of the time (#93 )
rock
2026-11-01 03:27:56 +00:00
f81db119f4
fix(forgejo): raise Gitea CPU limit, it was throttled 16% of the time
rock
2026-10-31 20:25:04 -07:00
2c5f510951
feat(llm-serving): give the chat model a stable client-facing name
rock
2026-10-31 19:43:03 -07:00
d821718375
chore(llm-serving): park clef-serve to free a V100 for candle-vllm
rock
2026-10-31 19:40:27 -07:00
871bb8bfd4
feat(llm-serving): also serve the 30B-A3B as reasoning-long
rock
2026-10-31 19:38:26 -07:00
42617fbd7c
feat(coder): serve 256K context on TP=2, disable custom all-reduce
rock
2026-10-31 17:21:54 -07:00
dc5ec40c7d
feat(llm-serving): add coder, serving Qwen3-Coder-30B-A3B on one V100
rock
2026-10-31 15:26:08 -07:00
a234451548
fix(llm-serving): allow poimen namespace ingress so memory ingest works
rock
2026-10-31 14:58:39 -07:00
3afb7b1a65
chore(comfyui): retire to 0 replicas and free the 4th V100 (#89 )
rock
2026-11-01 00:01:25 +00:00
d5487c708a
feat(talos): authenticate kube-apiserver against ZITADEL (#87 )
rock
2026-11-01 00:01:05 +00:00
1714b99b71
feat(cloudflared): publish the kube-apiserver at k8s.riotpiao.com
rock
2026-10-31 15:10:21 -07:00
894d746b0d
fix(paperless): align stale client-secret with the live OIDC secret (#86 )
rock
2026-10-31 21:10:26 +00:00
4e84571f0c
fix(iam): make ZITADEL OIDC secrets and identity links IaC-owned (#85 )
rock
2026-10-31 20:53:53 +00:00
41dcda819e
feat(llm-serving): manage clef-serve in git, generated from app.py
rock
2026-10-29 23:23:03 -07:00
3eb6a91311
feat(llm-serving): serve Qwen3-30B-A3B int4 as reasoning, on one card
rock
2026-10-29 03:56:17 -07:00
ad2720a724
fix(llm-serving): stop shipping clef-flash, it cannot run on a V100
rock
2026-10-28 10:29:24 -07:00
695f03a0ab
feat(forgejo): record the CNPG-generated database password
rock
2026-10-28 03:14:38 -07:00
15a22abb1f
fix(llm-serving): clef-flash cannot run on a V100
rock
2026-10-28 02:41:47 -07:00
569eb84737
fix(llm-serving): call the sglang CLI by its full path
rock
2026-10-28 02:34:42 -07:00
13343976e4
fix(forgejo): the chart key is gitea.podAnnotations, not podAnnotations
rock
2026-10-28 02:18:29 -07:00
86cdcade36
fix(forgejo): restart the pod when the database password changes
rock
2026-10-28 02:13:31 -07:00
d8ef81e9af
fix(paperless-ai): ask for no project audience, so aud names the caller
rock
2026-10-28 01:34:23 -07:00
1f8d254037
fix(paperless-ai): let the token sidecar read its own key
rock
2026-10-28 00:09:24 -07:00
f6e569c0e8
fix(llm-serving): clef-flash asks for memory the node can reserve
rock
2026-10-27 23:59:28 -07:00
a0d2859c1d
fix(llm-serving): podMetadata is not a field on this KServe CRD
rock
2026-10-27 23:55:54 -07:00
62857c5fcb
fix(llm-serving): let the kustomization build again
rock
2026-10-27 23:54:19 -07:00
9aec1b3e30
feat(llm-serving): serve clef-flash
rock
2026-10-27 23:51:45 -07:00
4d23c983ab
feat(paperless-ai): mint the LLM token with a machine key, not an init container
rock
2026-10-27 23:48:45 -07:00
bd81503e33
feat(iam): a role and a machine user for each cross-service caller
rock
2026-10-27 23:40:54 -07:00
e599c12f91
chore(iam): retire the minio OIDC credential from sops
rock
2026-10-27 20:00:15 -07:00
c5058dadc6
fix(iam): merge into the consumer Secret, and retry with a backoff
rock
2026-10-27 19:59:23 -07:00
e800e2cf1c
fix(iam): make a rotation attempt survive a failure
rock
2026-10-27 18:39:59 -07:00
3630721366
feat(iam): run the controller with the RBAC and image it needs
rock
2026-10-27 17:46:25 -07:00
7cd7e8808c
ci(iam): move the workflow where this Forgejo reads it
rock
2026-10-27 17:27:49 -07:00
280bbdf600
feat(iam): register the poimen /auth/callback redirect
rock
2026-10-27 14:54:30 -07:00
60931fbba1
ci(iam): build and push the key-rotation-controller image
rock
2026-10-27 14:50:33 -07:00
306c68e7ea
chore(iam): retire the .enc files whose values rotation invalidated
rock
2026-10-27 14:47:48 -07:00
36d6dad956
feat(iam): script that rotates an OIDC client secret end to end
rock
2026-10-27 14:42:27 -07:00
c2071da9d8
feat(iam): define a KeyRotation for every consumer except poimen-memory
rock
2026-10-27 14:28:28 -07:00
2485b5f165
fix(comfyui): keep the login path on an ungated ingress
rock
2026-10-27 14:26:49 -07:00
056964075e
fix(comfyui): drop the snippet that made nginx reject the whole ingress
rock
2026-10-27 14:24:06 -07:00
a1bb64dd98
fix(comfyui): one ingress for the app and the login path
rock
2026-10-27 14:19:22 -07:00
438fcbe9fe
feat(comfyui): put ComfyUI behind ZITADEL single sign-on
rock
2026-10-27 14:17:21 -07:00
afec7e9867
feat(iam): KeyRotation CRD and controller for credential rotation
rock
2026-10-27 13:52:36 -07:00
fc63acbcc9
chore(authentik): finish the retirement in Terraform and messaging
rock
2026-10-27 13:31:02 -07:00
ac73035c9e
fix(iam): stop rotating client secrets on every apply, repair Grafana OIDC
rock
2026-10-27 12:45:13 -07:00
12c66fb612
feat(grafana): provision a Gotify contact point
rock
2026-10-27 12:38:29 -07:00
50a751de44
feat(gotify): bridge Grafana alerts into Gotify
rock
2026-10-27 12:35:44 -07:00
863c11d75f
feat(igotify): wire the assist bridge with a Gotify client token
rock
2026-10-27 12:14:28 -07:00
a525a52580
Revert "feat(gotify): put the Gotify UI behind ZITADEL single sign-on"
rock
2026-10-27 12:12:22 -07:00
3e92f34153
Revert "fix(gotify): use a 32-byte cookie secret for oauth2-proxy"
rock
2026-10-27 12:12:22 -07:00
549e0be502
fix(gotify): use a 32-byte cookie secret for oauth2-proxy
rock
2026-10-27 12:08:13 -07:00
03cebb0aeb
feat(gotify): put the Gotify UI behind ZITADEL single sign-on
rock
2026-10-27 12:06:00 -07:00
cc7c30ee20
fix(iam): actually enforce MFA
rock
2026-10-27 00:14:42 -07:00
6768d1c762
feat(iam): require password + 2FA at login
rock
2026-10-27 00:12:32 -07:00
80af9b1fd0
feat(iam): provision and activate the SMTP provider
rock
2026-10-27 00:11:50 -07:00
7f29d640fd
feat(iam): own the ZITADEL core objects in GitOps
rock
2026-10-26 23:54:57 -07:00
9c3b2bfbbe
feat(iam): wire ZITADEL SMTP through envVarsSecret
rock
2026-10-26 23:45:59 -07:00
81e6e9bc03
Revert "feat(iam): send ZITADEL notifications to the Gotify relay"
rock
2026-10-26 23:41:01 -07:00
aa1f224349
feat(iam): send ZITADEL notifications to the Gotify relay
rock
2026-10-26 23:39:53 -07:00
37933de756
fix(iam): give the SMTP->Gotify relay a writable /tmp
rock
2026-10-26 23:38:29 -07:00
468ed16737
revert(iam): back out the SMTP values block that dropped the config ConfigMap
rock
2026-10-26 23:32:50 -07:00
ab9c2b444b
fix(iam): make the SMTP->Gotify relay actually push
rock
2026-10-26 23:28:44 -07:00
b6e1e0c591
fix(iam): give the IAM support manifests an ArgoCD app again
rock
2026-10-26 23:24:55 -07:00
701d79deac
feat(iam): deliver ZITADEL notifications through Gotify
rock
2026-10-26 23:24:33 -07:00
fbc1b6a33d
feat(iam): manage the Forgejo OAuth login source from a script
rock
2026-10-26 23:17:03 -07:00
3f93ddc002
feat(iam): provision the built-in login page
rock
2026-10-26 23:12:53 -07:00
eaf9804374
fix(iam): use the built-in ZITADEL login page
rock
2026-10-26 23:08:20 -07:00
903a72a6fd
feat(iam): provision the LLM inference roles and assert project roles
rock
2026-10-26 10:26:54 -07:00
81883a8ea1
chore(iam): retire Authentik
rock
2026-10-26 03:32:18 -07:00
7f96da880f
fix(ingress): restore the authentik.riotpiao.com route
rock
2026-10-26 03:12:26 -07:00
f37e5f32cb
fix(paperless): use Recreate strategy for paperless-ai RWO PVC deadlock
rock
2026-10-26 00:35:59 -07:00
8c4a900b40
feat(vault): wire Zitadel OIDC login via postStart auth/oidc config
rock
2026-10-26 00:28:19 -07:00
e6ba83cd38
feat(iam): wire all 9 consumer manifests to Zitadel OIDC
rock
2026-10-26 00:14:51 -07:00
a02bee50e2
feat(iam): wire all 9 consumer manifests to Zitadel OIDC
rock
2026-10-26 04:34:51 +00:00
990e312825
feat(iam): wire all 9 consumer manifests to Zitadel OIDC
rock
2026-10-25 21:08:23 -07:00
f9af686c36
Merge pull request 'integration: merge minio-client fix, local-path backend, and local cloudflared ingress' (#70 ) from integration/merge-56-58-69 into main
rock
2026-10-26 03:24:32 +00:00
3ec46d26f0
merge: harness/zitadel-iam-wiring
rock
2026-10-25 20:20:54 -07:00
52bca6b1b6
merge: feat/local-path-backend
rock
2026-10-25 20:20:40 -07:00
3e079b1cf7
merge: fix/minio-mc-image (keep digest pin + comment)
rock
2026-10-25 20:20:22 -07:00
227a67a8c1
feat(cloudflared): manage tunnel ingress locally via ConfigMap
rock
2026-10-25 19:57:37 -07:00
d4e9dbf350
refactor(iam): retire terraform/zitadel, provision through the API
pi
2026-10-25 19:35:01 -07:00
be44a576d4
fix(iam): own the Zitadel login keypair through ksops
pi
2026-10-25 19:16:18 -07:00
39081222a3
fix(iam): stop the setup hook running after first boot
pi
2026-10-25 19:10:32 -07:00
7e5b793670
fix(iam,edge): freeze first-boot and wire the WireGuard CIDR variable
pi
2026-10-25 18:48:15 -07:00
354814a531
security: stop tracking Talos secret backup; rotate edge WireGuard key
pi
2026-10-25 18:15:48 -07:00
54fac02783
fix(cloudflared): pin tunnel protocol to http2
pi
2026-10-25 18:04:53 -07:00
eb83aa6290
refactor(edge,iam): apply best practices to relay and Zitadel config
pi
2026-10-25 18:03:55 -07:00
6ebecec1c4
fix(zitadel): raise setup job deadline to 20m
pi
2026-10-25 09:47:33 -07:00
091ecdd7bb
feat(edge): Terraform for the China-facing relay and Cloudflare DNS
rock
2026-10-24 22:49:48 -07:00
7251032081
Merge pull request 'fix(monitoring): cap Prometheus retention below the PVC size' (#68 ) from fix/prometheus-retention-size into main
rock
2026-10-25 04:43:21 +00:00
b7fc6ed60b
fix(monitoring): cap Prometheus retention below the PVC size
rock
2026-10-24 21:43:01 -07:00
6312674058
chore(sms): retire the stuck macOS namespace
rock
2026-10-24 20:05:19 -07:00
2fe6d50ffd
Merge pull request 'fix(argocd): allow the Zitadel chart repo in the homelab AppProject' (#67 ) from fix/allow-zitadel-chart-repo into main
rock
2026-10-25 01:26:38 +00:00
rock
pi