e6ada95b39
fix(api): retire Kong key-auth on model routes; agent-pod builds agent-manager fork + ships coordinator.js
Story Crater Bot2026-08-18 15:36:18 -07:00
afb9b35292
fix(agent-pod): remote tui session for multi-agent
Story Crater Bot2026-08-18 14:23:55 -07:00
0fe3d25936
fix(ci): make the hardcoded-secret scan blocking and close the .gitignore/.sops.yaml gaps that let a plaintext deploy key through — also untracks tfplan binaries and skills-lock.json
Story Crater Bot2026-08-13 18:02:59 -07:00
5f16f16f0f
fix(argocd): clone the public GitHub seed anonymously over HTTPS and delete the SSH deploy-key Secret — its private half had been committed in plaintext to a public remote, and a public repo needs no credential at all
Story Crater Bot2026-08-13 18:02:52 -07:00
ee1bbed921
fix(forgejo): strategy Recreate for RWO data PVC — RollingUpdate deadlocked (new pod Multi-Attach error on the RWO gitea PVC held by the old pod, stuck Init forever)
Story Crater Bot2026-08-13 10:47:57 -07:00
1ad52bf89c
fix(authentik): label argocd oidc-secret part-of=argocd — argocd's $secret substitution only reads labelled Secrets; without it OIDC login failed with oauth2 invalid_client (empty client_secret to IdP)
Story Crater Bot2026-08-13 08:56:37 -07:00
78d2c18a3c
feat(argocd): wire Authentik OIDC + local rock/cicd accounts + RBAC — adds oidc.config (homelab-admins->admin SSO), url, accounts.rock (login+apiKey) and accounts.cicd (apiKey for CD pipeline token), all role:admin
Story Crater Bot2026-08-13 08:45:20 -07:00
2f6698edbe
fix(homarr): raise CPU limit 500m->2 + disable analytics cron — Next.js aborted with exit 134 (SIGABRT) under CPU throttle during icon-updater/analytics, self-restarting in a loop and 502ing at the ingress
Story Crater Bot2026-08-13 08:03:22 -07:00
2866a2aa93
fix(cilium): restrict L2 announcement to control-plane nodes — GPU worker lacks eno1 (Mellanox enp28s0f*), so when it won the .160 lease it couldn't ARP the VIP, black-holing all ingress (flapped on reboots)
Story Crater Bot2026-08-13 07:58:12 -07:00
5467d2ff6a
fix(api): label Kong pods llm-client=true so llm-serving NetworkPolicy admits them — chat/embeddings/rerank/score routes silently hung until the client timeout because Cilium dropped Kong's packets
Story Crater Bot2026-08-13 07:55:21 -07:00
b7809cb58b
feat(api): add DeepSeek-shaped LLM API on Kong — /v1/models, per-model chat completions, embeddings, rerank, score; disable Kong response buffering so stream:true actually streams
Story Crater Bot2026-08-13 07:47:45 -07:00
5c63cac46e
fix(ingress): remove stale ingress-nginx-controller-alias Service — its selfHeal kept clobbering the helm LoadBalancer Service (same name, dead ingress-nginx-bootstrap selector, 0 endpoints), unannouncing LB IP .160 and taking down all ingress
Story Crater Bot2026-08-13 07:40:23 -07:00
c3ffc611f4
fix(homarr): add AUTH_OIDC_URI + email account linking — homarr hides the Authentik sign-in button unless AUTH_OIDC_URI (authorize endpoint) is set alongside AUTH_OIDC_ISSUER (per authentik/homarr SSO docs); was the missing var
Story Crater Bot2026-08-13 07:26:59 -07:00
fc10a9871a
refactor(ingress): drop redundant ArgoCD ingress-nginx app — chart 4.15.1 was double-managed by both the helm-bootstrap release and this ArgoCD app (same chart), fighting over the controller/LB service (ingress-config drift). ingress-nginx is bootstrap-critical (ArgoCD's own reachability path), so helm-bootstrap is the single owner
Story Crater Bot2026-08-13 07:20:06 -07:00
71fb7e9826
feat(sms): add BlueBubbles iMessage delivery (Docker-OSX macOS VM pinned to worker-2) + ArgoCD app + dedicated longhorn-imessage-local SC — default longhorn SC can't schedule a 3-replica 200Gi volume (only worker-1 has 200Gi free at 100% over-provisioning) and Immediate binding would pin the qcow2 to the wrong node
Story Crater Bot2026-08-13 07:15:02 -07:00
61b906cce1
feat(monitoring): enable Alertmanager (null receiver, longhorn PVC, az-a) + fix forgejo-rules ns forgejo->cicd — alerting delivery was disabled; forgejo PrometheusRule targeted a nonexistent namespace
Story Crater Bot2026-08-13 07:10:03 -07:00
9e0a83f8ca
fix(prometheus): use longhorn StorageClass, drop nonexistent longhorn-wffc — Prometheus CR requested storageClass longhorn-wffc which doesn't exist (deprecated), so operator never created the StatefulSet (Reconciled=False, no metrics server)
Story Crater Bot2026-08-13 06:37:53 -07:00
8c6e0800c3
fix(homarr): tune probes via chart values, drop fragile fix-probes-job — first-boot icon updater blocks health endpoint ~50s; default 10s×3 liveness SIGTERMs the pod (247 restarts, 503); chart exposes probes so the PostSync patch-job was unnecessary and reverted on every rollout
Story Crater Bot2026-08-13 06:33:34 -07:00
d4d51bf5b4
fix(authentik): add minio policy scope mapping (homelab-admins->consoleAdmin else readonly) + set rock email — MinIO CLAIM_NAME=policy got no claim (no MinIO access); empty rock email broke Grafana OIDC (GitHub-style /emails 404)
Story Crater Bot2026-08-12 20:31:13 -07:00
72f24165cc
fix(grafana): add email/login/name_attribute_path for Authentik OIDC — Grafana was falling back to GitHub-style <api_url>/emails (404 'Error getting email address'), breaking OAuth login; read identity from userinfo claims instead
Story Crater Bot2026-08-12 16:46:57 -07:00
b863b6974e
fix(forgejo-runner): cicd ns PSS privileged (dind needs it) + mount homelab-ca as ConfigMap not Secret — runner RS created 0 pods under baseline PSS, then FailedMount because homelab-ca is a ConfigMap trust bundle, not a Secret
Story Crater Bot2026-08-12 16:25:18 -07:00
6401652aa8
feat(forgejo): add runner-token Secret via ksops — forgejo-runner register initContainer needs the registration token (from gitea actions generate-runner-token); was missing so runner deploy stuck 0/1
Story Crater Bot2026-08-12 16:19:38 -07:00
650fcf1b61
fix(coredns): own Corefile+hostname rewrites via Talos inlineManifest (single-source terraform/files/coredns/Corefile), drop ArgoCD coredns-config app — in-cluster *.riotpiao.com now resolves to nginx ingress so MinIO/OIDC discovery works; update cp-2 IP .213->.214
Story Crater Bot2026-08-12 16:16:44 -07:00
78c9946cf6
feat(reloader): enable autoReloadAll + reloadOnCreate — watch all workloads without per-Deployment annotations (charts like homarr don't expose them); auto-restart pods when ksops secrets are created/rotated
Story Crater Bot2026-08-12 14:15:42 -07:00
1a1edcfc27
fix(homarr): add auth-oidc-secret + db-encryption Secrets via ksops — homarr chart's envSecrets expect these exact names (oidc-client-id/secret, db-encryption-key); were never created so homarr CreateContainerConfigError
Story Crater Bot2026-08-12 14:08:18 -07:00
51d938d13a
chore(duckdns): remove duckdns updater entirely — superseded by cloudflared tunnel; drop app-def, manifests, kube-system Deployment
Story Crater Bot2026-08-12 14:01:01 -07:00
6057b64509
fix(cert-manager): regenerate homelab-ca cert with basicConstraints CA:TRUE — old self-signed cert lacked CA:TRUE so the homelab-ca ClusterIssuer rejected it ('certificate is not a CA'); regen keypair Secret + trust-bundle ConfigMaps (4 ns) with matching CA cert
Story Crater Bot2026-08-12 13:56:37 -07:00
b66c5f4916
fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)
Story Crater Bot2026-08-18 15:08:04 -07:00
13ebfe158a
fix(cert-manager): cert-manager-issuers directory.include renders empty — switch to explicit resources list, restore automated sync
Story Crater Bot2026-08-18 15:08:04 -07:00
8ff3060ff0
refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments
Story Crater Bot2026-08-12 13:16:15 -07:00
e650bf792c
fix(cert-manager): add homelab-ca.crt key to homelab-ca ConfigMaps — authentik init merge-ca-certs cats /homelab-ca/homelab-ca.crt which was missing, causing Init:Error and 503
Story Crater Bot2026-08-12 09:13:15 -07:00
4cc08a05eb
fix(argocd): resolve 502 on argocd.riotpiao.com, dedupe Ingress and TLS mode mismatch
Story Crater Bot2026-08-11 21:03:59 -07:00
b99eeac0e8
fix(argocd): use comma-separated include list, not brace expansion
Story Crater Bot2026-08-11 20:51:05 -07:00
2458da8e91
fix(forgejo): remove nodeSelector now that Longhorn runs on all nodes
Story Crater Bot2026-07-22 08:48:08 -07:00
e2fcfe1fa8
feat(storage): enable Longhorn on all 3 control-plane nodes for true HA
Story Crater Bot2026-07-22 08:46:57 -07:00
86f5603063
fix(sso): complete forgejo OAuth2 integration + force pods to storage node
Story Crater Bot2026-07-22 08:41:25 -07:00
368e4a020a
fix(iam): Authentik OAuth2 provisioning — grant_types/groups claim, idempotent script, skip PATCH on existing apps
Story Crater Bot2026-08-18 15:08:03 -07:00
a9800c7a3e
fix(authentik): widen server probe timeouts (3s->15s) — slow-but-200 health checks under DB contention triggered a liveness kill loop, dropping the pod from Service endpoints and breaking OAuth provisioning
Story Crater Bot2026-07-21 22:31:48 -07:00
51c07a845f
fix(temporal): provision schema via CNPG temporal_visibility DB + drop mysql-only tx_isolation param
Story Crater Bot2026-08-18 15:08:03 -07:00
e2781c72e2
chore(terraform): remove leftover terraform state-backup script and env example — repo is pure GitOps, terraform fully retired
Story Crater Bot2026-07-21 21:03:45 -07:00
ae4f683850
fix(temporal): switch server to sprig configMapsToMount + setConfigFilePath — dockerize path removed in server 1.30.3, config was not loaded so it fell back to Cassandra and crashed
Story Crater Bot2026-07-21 21:03:45 -07:00
4c9610f86f
fix(minio): set HOME=/tmp in policy-setup PostSync hook — mc could not create /.mc as non-root, hanging the job in an endless wait loop
Story Crater Bot2026-07-21 21:03:44 -07:00
5a8e5ae3fe
docs: rewrite CLAUDE.md for ArgoCD GitOps, track in git
Story Crater Bot2026-08-18 15:08:03 -07:00
Story Crater Bot