This website requires JavaScript.
e2d9717ce1
fix(argocd): allow the Zitadel chart repo in the homelab AppProject
rock
2026-10-24 18:26:21 -07:00
111b19dac2
Merge pull request 'fix(sops): repair the ksops generator list and rotate the Zitadel masterkey' (#66 ) from fix/sops-generator-indent into main
rock
2026-10-25 01:24:43 +00:00
e335694cbb
fix(sops): repair the generator list and rotate the Zitadel masterkey
rock
2026-10-24 18:24:28 -07:00
d1a7d3be6e
fix(oidc): remove the API-server restart Jobs from GitOps
rock
2026-10-24 04:19:05 -07:00
2f664c32d9
fix(cluster): grant queue-operator watches and retire the macOS workload
rock
2026-10-24 04:02:50 -07:00
6c98ca7436
Merge pull request 'fix(sops): drop the orphan forgejo-registry-pat file' (#65 ) from fix/sops-drop-orphan-forgejo-pat into main
rock
2026-10-24 10:47:14 +00:00
6ee22401fd
fix(sops): drop the orphan forgejo-registry-pat file
rock
2026-10-24 03:46:29 -07:00
e9817283e6
Merge pull request 'feat(iam): wire Zitadel as the Authentik replacement' (#63 ) from harness/zitadel-iam-wiring into main
rock
2026-10-24 10:41:17 +00:00
6e9586aa15
Merge pull request 'chore(argocd): delete the azhi-riotpiao Application' (#64 ) from chore/remove-azhi-riotpiao-app into main
rock
2026-10-24 10:41:09 +00:00
979a413a5b
feat(iam): read the Zitadel bootstrap token from .env
rock
2026-10-24 03:21:17 -07:00
2f62351731
feat(iam): one script to provision Zitadel end to end
rock
2026-10-24 03:02:15 -07:00
f81ff0e2fc
feat(iam): declare Zitadel identity objects in Terraform
rock
2026-10-24 02:26:43 -07:00
cb1219bf96
feat(iam): wire Zitadel into namespace iam under ArgoCD
rock
2026-10-24 02:15:36 -07:00
8e9ac37583
chore(argocd): delete the azhi-riotpiao Application
rock
2026-10-24 03:35:52 -07:00
3c851b16c9
Merge branch 'fix/certmanager-dns01'
rock
2026-10-24 02:39:38 -07:00
e93d4ba86c
fix(cert-manager): restore wildcard renewal and drop per-host TLS
rock
2026-10-24 02:30:48 -07:00
7a1213d504
Merge pull request 'fix(longhorn): retire the failed 2TB PERC disk on talos-cp-2' (#62 ) from fix/retire-longhorn-disk4 into main
rock
2026-10-13 00:10:01 +00:00
d21ee9630f
fix(longhorn): retire the failed 2TB PERC disk on talos-cp-2
rock
2026-10-13 08:09:42 +08:00
40aa23dfdf
Merge pull request 'test(argocd): point azhi-riotpiao at the CNPG branch' (#61 ) from feat/azhi-cnpg-test into main
rock
2026-10-12 13:41:38 +00:00
71fce30506
test(argocd): point azhi-riotpiao at the CNPG branch
rock
2026-10-12 21:24:47 +08:00
0666715a5e
Merge pull request 'feat(argocd): reconcile azhi-infra from its private GitHub repo' (#60 ) from feat/azhi-riotpiao-argocd into main
rock
2026-10-12 12:54:43 +00:00
949ae5cb38
feat(argocd): let ArgoCD reconcile azhi-infra from its private GitHub repo
rock
2026-10-12 20:54:00 +08:00
e150969070
Merge pull request #59 from fix/etcd-defrag-main
rock
2026-10-12 12:27:28 +00:00
abfdda5f57
fix(etcd): add a working 15-day defrag CronJob under the backend quota
rock
2026-10-07 17:12:39 +08:00
e4caa7e841
fix(etcd): make the defrag CronJob runnable and 15-day
rock
2026-10-07 17:11:35 +08:00
1ce9f86635
feat(etcd): weekly defrag CronJob to stay under the etcd backend quota
harness
2026-10-07 13:37:45 +08:00
2d9e3abee8
fix(oidc): match /proc/<pid>/comm instead of cmdline when signalling the API server
rock
2026-10-07 04:07:37 +00:00
9fa8d9cf60
fix(oidc): restart the apiservers by signalling the process, not by deleting the mirror pod
rock
2026-10-07 03:59:22 +00:00
2e4fad3bf7
fix(oidc): use curlimages/curl for the bootstrap job (bitnami/kubectl tag did not exist)
rock
2026-10-07 03:52:10 +00:00
5d22691c3e
chore(oidc): one-shot bootstrap - restart apiservers to initialise the OIDC authenticator
rock
2026-10-07 03:46:01 +00:00
4eee161e0f
chore(oidc): one-shot bootstrap - restart apiservers to initialise the OIDC authenticator
rock
2026-10-07 03:45:56 +00:00
719fa77521
Merge pull request 'fix(secrets): populate the empty sops placeholders and drop the unused one' (#55 ) from fix/secrets-placeholders into main
rock
2026-10-06 04:48:51 +00:00
ebb1b9b02d
feat(storage): add local-path-provisioner as the fleet's persistent-storage backend
rock
2026-10-06 12:45:12 +08:00
cc62f74404
feat(storage): add local-path-provisioner as the fleet's persistent-storage backend
rock
2026-10-06 12:45:12 +08:00
64cd1f2c4e
fix(minio): freeze the community image by digest and alert on pull failure (#57 )
rock
2026-10-06 03:43:12 +00:00
d7b96fb29b
fix(minio): freeze the community image by digest and alert on pull failure
rock
2026-10-06 11:38:40 +08:00
71b3cef2eb
fix(minio): replace the dead minio/mc image in the provision hook and backup job
rock
2026-10-06 10:10:56 +08:00
f780e31f9c
Merge origin/main into fix/secrets-placeholders (rebuild ksops file list, fix #54 indent)
rock
2026-10-06 10:05:45 +08:00
75a5961ef2
Revert "fix(secrets): populate the empty sops placeholders and drop the unused one"
rock
2026-10-06 10:03:09 +08:00
c93a24f786
fix(secrets): populate the empty sops placeholders and drop the unused one
rock
2026-10-06 10:02:45 +08:00
f6207ff2b0
fix(secrets): populate the empty sops placeholders and drop the unused one
rock
2026-10-06 10:02:45 +08:00
b6e317b34c
feat(poimen): pi sandbox workspace volume, encrypted api keys, cluster dns rewrite (#54 )
rock
2026-10-06 01:49:12 +00:00
f3015522e3
fix(storage): pin minio tenant to a published image release (#53 )
rock
2026-10-06 01:48:57 +00:00
8bb8851a1f
fix(storage): pin minio tenant to a published image release
rock
2026-10-06 09:45:45 +08:00
d60b520968
Merge pull request 'fix(llm-serving): V1 prefill scheduling + admission observability (#51 )' (#52 ) from harness/51-vllm-prefill-scheduling into main
rock
2026-09-30 11:49:52 +00:00
c7d52b5971
fix(llm-serving): V1 prefill scheduling + admission-control observability (#51 )
rock
2026-09-30 19:49:05 +08:00
3c3b243790
docs(monitoring): correct the gateway latency-metric claim
rock
2026-09-29 22:47:38 +08:00
420b5d6da6
fix(monitoring): drop redundant relabels, resolve ServiceMonitor drift
rock
2026-09-29 22:14:49 +08:00
1f3439c9e0
feat(monitoring): LLM observability dashboard + fix dead CAG rule
rock
2026-09-29 22:11:28 +08:00
6ae36981bb
fix(monitoring): wire llm-serving + api-gateway metric scraping
rock
2026-09-29 22:05:00 +08:00
e6fd6f2b62
fix(prometheus): cut TSDB volume 100Gi -> 25Gi
rock
2026-09-29 21:59:55 +08:00
c83d456ecd
fix(forgejo): disable self-registration
rock
2026-09-29 21:13:18 +08:00
8bd40c5152
feat: poimen-sandbox namespace + security hardening + RBAC
rock
2026-09-28 23:15:25 +08:00
c472a994ce
fix(longhorn): enable worker-1 scheduling, 400Gi reserved
rock
2026-09-28 23:06:22 +08:00
bb24418a2e
feat: remove ArgoCD Image Updater, replaced by Forgejo webhook
rock
2026-09-28 23:06:16 +08:00
797e11ce11
feat(secrets): add forgejo-registry-pat for api namespace
rock
2026-09-28 11:11:06 +08:00
76a3281e80
fix(argocd): image-list comma-separated — updater v0.15.1 treats pipe block as single image name
rock
2026-09-28 09:39:13 +08:00
c04ed6136b
refactor(poimen): move frontend k8s manifests to poimen-frontend repo
rock
2026-09-28 09:13:02 +08:00
fbe8a083bd
fix(poimen-frontend): remove speculative COREPACK env workarounds
rock
2026-09-28 09:10:03 +08:00
066c12463c
fix(poimen-frontend): correct secret key refs, remove unused NextAuth env
rock
2026-09-28 08:57:54 +08:00
227839c27a
feat(poimen): consolidate into single multi-source ArgoCD app
rock
2026-09-28 08:51:31 +08:00
8ed60c8b55
fix(forgejo): allow webhook delivery to api.riotpiao.com
rock
2026-09-27 22:45:13 +08:00
3914c78bc5
feat(argocd): poimen-memory Application — Redis + NetworkPolicy auto-deploy
rock
2026-09-27 19:27:05 +08:00
605bc706e0
feat(cag): PrometheusRule + Grafana panels for KV cache observability
rock
2026-09-27 18:37:03 +08:00
920693df1b
feat: poimen-toolkit ArgoCD app + sourceRepo
rock
2026-09-27 18:03:42 +08:00
dfd5f8dd2d
tmp
rock
2026-09-24 21:24:30 +08:00
f59fb476b8
feat(ornith): bump context length 32K → 64K
rock
2026-09-16 07:21:45 +09:00
e33a2228e1
feat(igotify): deploy igotify server + upgrade gotify to 3.1.0
rock
2026-09-16 06:56:10 +09:00
27bce41bf6
fix(gotify): rollback to 2.9.1 — iGotify stable incompatible with 3.x
rock
2026-09-15 22:34:53 +09:00
1edf1ba7f1
feat(gotify): upgrade to 3.1.0 for /gotifyinfo endpoint (iGotify compat)
rock
2026-09-15 22:22:55 +09:00
44d5207622
fix(gotify): remove configuration-snippet annotation blocking nginx ingress
rock
2026-09-15 18:01:48 +09:00
7a239b2469
feat: add gotify.riotpiao.com coredns rewrite for mobile app access
rock
2026-09-15 17:23:21 +09:00
795cef5a85
feat(prometheus): scale up storage to 100Gi and move to worker-1
rock
2026-09-15 08:16:01 +09:00
c1a2dbf52a
fix(minio): add BROWSER_REDIRECT_URL to enable SSO button in Console
rock
2026-09-15 02:44:09 +09:00
0f854f2bfa
feat(minio): use groups claim for OIDC auth instead of policy
rock
2026-09-15 02:40:02 +09:00
283d30b422
fix(paperless): use correct env var PAPERLESS_SOCIAL_AUTO_SIGNUP for auto-linking
rock
2026-09-15 02:30:12 +09:00
2b2ceab2d1
fix(paperless): enable OIDC auto-linking to existing users by email
rock
2026-09-15 02:00:36 +09:00
6243ac40b7
feat(paperless-ai): enable intelligent timeline tagging with date extraction
rock
2026-09-15 00:53:30 +09:00
d6fca68f33
chore(paperless-ai): switch LLM model to reasoning for document processing
rock
2026-09-15 00:38:37 +09:00
e12327f963
fix(grafana): re-enable org role sync for OAuth groups
rock
2026-09-15 00:37:06 +09:00
b03098aa1c
fix(grafana): skip_org_role_sync on first login
rock
2026-09-15 00:32:41 +09:00
f61e8f1f68
fix(grafana): use preferred_username for OAuth login lookup
rock
2026-09-15 00:17:50 +09:00
7016f764e6
infrastructure(paperless): add paperless-ai production ConfigMap to git
rock
2026-09-15 00:14:42 +09:00
d826510a98
feat(paperless-ai): configure for production with Paperless API + LLM integration
rock
2026-09-15 00:13:02 +09:00
467b3441c9
fix(grafana): use email for OAuth login lookup instead of preferred_username
rock
2026-09-15 00:01:10 +09:00
7e91262257
fix(paperless-ai): write token to /tmp as fallback (PVC mount perms)
rock
2026-09-14 23:58:41 +09:00
0edd6bc73a
fix(paperless-ai): use /app/data mount path consistently for init + main container
rock
2026-09-14 23:57:44 +09:00
4ad0102260
fix(paperless-ai): fix sed token extraction to handle JSON spaces
rock
2026-09-14 23:56:33 +09:00
e0c08a90b3
Grafana OAuth: disable allow_sign_up to debug user.sync failure
rock
2026-09-14 23:56:04 +09:00
dfbe2cc920
fix(paperless-ai): use sed for JWT token extraction (jq not available)
rock
2026-09-14 23:55:53 +09:00
ae93c7ca0d
fix(paperless-ai): use jq for JWT token extraction instead of grep
rock
2026-09-14 23:54:57 +09:00
91ce48ffae
fix(sops): add LLM_AUTH_CLIENT_SECRET for paperless-ai-agent Authentik auth
rock
2026-09-14 23:19:43 +09:00
39036e6ff3
fix(paperless-ai): move LLM auth client secret from plaintext to SOPS
rock
2026-09-14 23:07:52 +09:00
8fa5053aef
fix: allow paperless direct LLM access, bypass gateway JWT
rock
2026-09-14 08:09:26 +09:00
41e894f79e
fix: aggressive 2m cleanup for completed jobs/pods, add PAPERLESS_USERNAME to paperless-ai
rock
2026-09-14 07:56:05 +09:00
86986013d7
fix: use CiliumNetworkPolicy for kube-apiserver egress (#49 )
poimen and rock
2026-09-13 14:04:35 +00:00
4b5ecfcd49
fix: allow CI runner egress to K8s API server (#48 )
poimen and rock
2026-09-13 13:54:31 +00:00
7a5d0a83d5
fix: vendor Tekton release.yaml for proper ArgoCD management
rock
2026-09-13 15:05:26 +09:00
b06ee310b5
fix: use tektoncd/operator for proper K8s-native Tekton installation
rock
2026-09-13 14:51:14 +09:00
5f16d5c6a3
feat: add Tekton Pipelines for CI/CD orchestration (#46 )
poimen and rock
2026-09-13 05:48:06 +00:00
rock
rock
poimenandrock