rock 1f8d254037 fix(paperless-ai): let the token sidecar read its own key ...

A Secret volume is owned by root and the sidecar runs as 65532, so defaultMode 0400
left it unable to open /var/run/llm-key/key: the container restarted with
'permission denied' on every start and never minted a token.

Set mode 0440 and give the pod fsGroup 65532, so the group that owns the volume can
read the key while nothing else on the host can.

2026-10-28 00:09:24 -07:00

..

agent-pod

feat: cut api.riotpiao.com over to the Go gateway and retire Kong

2026-08-19 22:51:53 -07:00

api

feat: point api.riotpiao.com at the gateway ahead of Kong removal

2026-08-19 23:34:33 -07:00

cloudflared

chore(iam): retire Authentik

2026-10-26 03:32:18 -07:00

comfyui

fix(comfyui): keep the login path on an ungated ingress

2026-10-27 14:26:49 -07:00

gotify

feat(gotify): bridge Grafana alerts into Gotify

2026-10-27 12:35:44 -07:00

immich

fix(cnpg): scale paperless-db, immich-db, gotify-db to 3 instances (#30)

2026-09-10 22:56:41 +00:00

key-rotation-controller

fix(iam): merge into the consumer Secret, and retry with a backoff

2026-10-27 19:59:23 -07:00

llm-serving

fix(llm-serving): clef-flash asks for memory the node can reserve

2026-10-27 23:59:28 -07:00

llm-token-vendor

feat(paperless-ai): mint the LLM token with a machine key, not an init container

2026-10-27 23:48:45 -07:00

messaging

chore(authentik): finish the retirement in Terraform and messaging

2026-10-27 13:31:02 -07:00

paperless

fix(paperless-ai): let the token sidecar read its own key

2026-10-28 00:09:24 -07:00

poimen-frontend

refactor(poimen): move frontend k8s manifests to poimen-frontend repo

2026-09-28 09:13:02 +08:00

portainer

fix(portainer): pin to az-b (talos-cp-2), the real Longhorn storage node

2026-08-18 15:08:04 -07:00

temporal

Add Temporal worker for production task queue

2026-08-21 16:44:59 -07:00