rock 1f8d254037 fix(paperless-ai): let the token sidecar read its own key ...

A Secret volume is owned by root and the sidecar runs as 65532, so defaultMode 0400
left it unable to open /var/run/llm-key/key: the container restarted with
'permission denied' on every start and never minted a token.

Set mode 0440 and give the pod fsGroup 65532, so the group that owns the volume can
read the key while nothing else on the host can.

2026-10-28 00:09:24 -07:00

..

apps

fix(paperless-ai): let the token sidecar read its own key

2026-10-28 00:09:24 -07:00

argocd

chore(iam): retire the minio OIDC credential from sops

2026-10-27 20:00:15 -07:00

bootstrap

chore(iam): retire Authentik

2026-10-26 03:32:18 -07:00

infra

feat(grafana): provision a Gotify contact point

2026-10-27 12:38:29 -07:00