aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

fix(ansible): update mgmt VM docs and config for admin user #224

Closed
aaron wants to merge 314 commits from plane/HOMELAB-1099-fix-mgmt-vm-docs into main
pull from: plane/HOMELAB-1099-fix-mgmt-vm-docs
merge into: aaron:main
Conversation 1 Commits 314 Files changed 106 +9438 -360
aaron commented 2026-06-12 01:50:46 +00:00
Owner
Copy link

What

Fixes the management VM (VM 110) documentation and Ansible configuration to reflect the actual state:

  • The VM is created with ciuser=admin via Proxmox cloud-init
  • The actual IP is 192.168.1.10 (management LAN), not 10.10.10.110
  • The paperclip-operator user is the dedicated user for Paperclip

Changes

  • Ansible inventory: Changed operator → admin user
  • mgmt-base role: Updated to use admin instead of operator
  • sshd_config template: Added admin and paperclip-operator to AllowUsers
  • forgejo-runner service: Changed to use admin user
  • mgmt-vm-setup runbook: Updated with correct IPs (192.168.1.10) and user (admin)

Verification

  • paperclip-operator user created on VM 110
  • SSH access verified: ssh paperclip-operator@192.168.1.10
  • pi, kubectl, sops, talosctl all working
  • Repos cloned (infra-core, prod, agent-config)

Refs: HOMELAB-1099

## What Fixes the management VM (VM 110) documentation and Ansible configuration to reflect the actual state: - The VM is created with `ciuser=admin` via Proxmox cloud-init - The actual IP is `192.168.1.10` (management LAN), not `10.10.10.110` - The `paperclip-operator` user is the dedicated user for Paperclip ## Changes - **Ansible inventory**: Changed `operator` → `admin` user - **mgmt-base role**: Updated to use `admin` instead of `operator` - **sshd_config template**: Added `admin` and `paperclip-operator` to AllowUsers - **forgejo-runner service**: Changed to use `admin` user - **mgmt-vm-setup runbook**: Updated with correct IPs (`192.168.1.10`) and user (`admin`) ## Verification - [x] `paperclip-operator` user created on VM 110 - [x] SSH access verified: `ssh paperclip-operator@192.168.1.10` - [x] pi, kubectl, sops, talosctl all working - [x] Repos cloned (infra-core, prod, agent-config) Refs: [HOMELAB-1099](/HOMELAB/issues/HOMELAB-1099)
aaron added 314 commits 2026-06-12 01:50:47 +00:00
HOMELAB-276: feat(eso): add ExternalSecret for Lab Director ArgoCD token
Some checks failed
CI Review / pr-title (pull_request) Successful in 0s
Details
0/0 projects applied successfully.
CI Review / helm-validate (pull_request) Failing after 2s
Details
CI Review / ai-review (pull_request) Failing after 1s
Details
Lint & Validate / terraform-validate (pull_request) Failing after 1s
Details
Lint & Validate / yaml-lint (pull_request) Failing after 1s
Details
Lint & Validate / shellcheck (pull_request) Failing after 1s
Details
be0e6068b4 
Syncs ArgoCD API token from secrets namespace to lab-director namespace.
Used by operator's devenv manager to create per-ticket ArgoCD Applications.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-274: fix(lab-director): add /auth route to backend + healthz probe path
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Successful in 0s
Details
CI Review / helm-validate (pull_request) Failing after 2s
Details
CI Review / ai-review (pull_request) Failing after 1s
Details
Lint & Validate / terraform-validate (pull_request) Failing after 1s
Details
Lint & Validate / yaml-lint (pull_request) Failing after 1s
Details
Lint & Validate / shellcheck (pull_request) Failing after 1s
Details
97eef1e9a9 
HTTPRoute was missing /auth PathPrefix match for backend rule — browser
requests to /auth/login hit the SvelteKit frontend (404) instead of the
Go backend's OIDC handler.

Frontend probe path changed from / to /healthz — the root path triggers
auth redirect which breaks liveness checks (HTTPS mismatch on redirect).
HOMELAB-284: feat(scheduling): workload rebalancing — Longhorn auto-balance, Descheduler, PriorityClasses, LimitRanges
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Failing after 0s
Details
CI Review / helm-validate (pull_request) Failing after 2s
Details
CI Review / ai-review (pull_request) Failing after 1s
Details
Lint & Validate / terraform-validate (pull_request) Failing after 1s
Details
Lint & Validate / yaml-lint (pull_request) Failing after 1s
Details
Lint & Validate / shellcheck (pull_request) Failing after 1s
Details
6604dfc327 
- Enable Longhorn replica-auto-balance (best-effort) + data-locality
- Add Descheduler chart (LowNodeUtilization + RemoveDuplicates)
- Create PriorityClasses: cluster-critical (1M), standard (500K), low-priority (100K)
- Create LimitRanges for harbor, monitoring, management, zitadel, forgejo namespaces
- Add resource requests/limits to Cilium agent, operator, Hubble relay/UI
- Add config-reloader resources to kube-prometheus-stack

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-284: fix(descheduler): use DefaultEvictor for namespace exclusion
Some checks failed
CI Review / pr-title (pull_request) Failing after 0s
Details
CI Review / helm-validate (pull_request) Failing after 2s
Details
CI Review / ai-review (pull_request) Failing after 2s
Details
Lint & Validate / terraform-validate (pull_request) Failing after 2s
Details
Lint & Validate / yaml-lint (pull_request) Failing after 2s
Details
Lint & Validate / shellcheck (pull_request) Failing after 2s
Details
Plan failed.
a78699dc2d 
evictableNamespaces is not valid in descheduler v1alpha2 API.
Use DefaultEvictor plugin's namespaces.exclude instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-284: fix(descheduler): remove invalid namespace fields from policy
Some checks failed
CI Review / pr-title (pull_request) Failing after 1s
Details
CI Review / helm-validate (pull_request) Failing after 2s
Details
CI Review / ai-review (pull_request) Failing after 1s
Details
Lint & Validate / terraform-validate (pull_request) Failing after 2s
Details
Lint & Validate / yaml-lint (pull_request) Failing after 2s
Details
Lint & Validate / shellcheck (pull_request) Failing after 2s
Details
Plan failed.
4053ae5b8c 
v0.32.2 DefaultEvictor only supports ignorePvcPods + evictLocalStoragePods.
Namespace exclusion is not available in this API version. System pods are
protected by DaemonSet immunity, PDBs, and priority classes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-285: feat(monitoring): add capacity alerting PrometheusRules
Some checks failed
CI Review / pr-title (pull_request) Successful in 1s
Details
CI Review / helm-validate (pull_request) Failing after 3s
Details
CI Review / ai-review (pull_request) Failing after 2s
Details
Lint & Validate / terraform-validate (pull_request) Failing after 1s
Details
Lint & Validate / yaml-lint (pull_request) Failing after 1s
Details
Lint & Validate / shellcheck (pull_request) Failing after 2s
Details
Plan failed.
0e23ca665f 
8 early-warning alerts for resource capacity: NodeMemoryHigh (70%),
NodeCPUHigh (80%), PodCountImbalance, request saturation (memory/CPU),
NodeMemoryOvercommit (200%), OOMKillRateHigh, ClusterMemoryHeadroom
(4GiB warning, 2GiB critical). All PromQL validated against live
Prometheus.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-319: feat(runner): K8s Forgejo runner with DinD sidecar
Some checks failed
CI Review / pr-title (pull_request) Successful in 0s
Details
Plan failed.
CI Review / helm-validate (pull_request) Failing after 2s
Details
CI Review / ai-review (pull_request) Failing after 1s
Details
Lint & Validate / terraform-validate (pull_request) Failing after 1s
Details
Lint & Validate / yaml-lint (pull_request) Failing after 1s
Details
Lint & Validate / shellcheck (pull_request) Failing after 1s
Details
66b8c6d8e6 
Custom runner image with Go, Node.js, golangci-lint, crane, Docker CLI.
DinD sidecar for container builds. Registers with 'infra' label to
replace VM 110 runner.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-319: fix(runner): mount docker-certs at /certs for TLS
Some checks failed
Plan failed.
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
af6b4bffa2 
Runner needs certs at /certs/client (DOCKER_CERT_PATH), so mount the
shared emptyDir at /certs root, not /certs/client.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-319: fix(runner): disable DinD TLS + add namespace PodSecurity
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
f081558629 
- Disable TLS for DinD sidecar (same-pod localhost, no security benefit)
- Remove docker-certs volume entirely (eliminates cert race condition)
- Add namespace.yaml with privileged PodSecurity labels
- Use tcp://localhost:2375 (non-TLS) standard CI pattern

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-319: fix(harbor): increase LimitRange to 1Gi for registry push
Some checks failed
Plan failed.
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
35b9ea2165 
Harbor nginx and core OOM during large image pushes with 512Mi limit.
Registry processes multi-hundred-MB image layers — needs more headroom.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-324: security: scope dev-agent credentials for production
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
557767b5ea 
- Remove SOPS age key (master decryption key) from dev-environment chart
  entirely — volume mount, volume definition, and values.yaml reference
- Add scoped RBAC manifest: ClusterRole with read-only cluster access +
  RoleBinding with admin within dev-agents namespace only
- Replaces over-privileged cluster-admin kubeconfig pattern

Addresses critical findings #2 (SOPS key) and #1 (kubeconfig scope) from
HOMELAB-312 security audit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-304: fix(images): pin all :latest tags to specific versions
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
c46a98917c 
Replace :latest with SHA-based tags for custom images and pinned
releases for external images. Prevents stale deployments when CI
fails silently.

- lab-director backend/frontend: seed with current Harbor SHAs
- dev-environment: seed with pinned-20260324 tag
- minio: pin to RELEASE.2025-09-07T16-13-09Z
- minio/mc: pin to RELEASE.2025-08-13T08-35-41Z
- forgejo-runner: pin to SHA digest
- playwright-mcp: pin to SHA digest
- docker dind: pin to 27.5.1-dind
HOMELAB-316: fix(runner): register K8s runner with k8s-runner label
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
4683d4a05f 
Change Forgejo runner registration from --labels "infra:host" to
"k8s-runner:host" so workflows using runs-on: k8s-runner are picked
up by the K8s runner (DinD), not the management VM runner.

The emptyDir volume for /data means the pod re-registers on restart,
automatically picking up the new label via ArgoCD self-heal.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-304: fix(outline): pin minio/mc in Helm template to specific version
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
b5255237e7 
Missed hardcoded minio/mc:latest in outline minio.yaml template.
Pin to RELEASE.2025-08-13T08-35-41Z to match values.yaml.
HOMELAB-378: feat: Temporal Server base Helm values
Some checks failed
Plan failed.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
e83d631a05 
Adds base configuration for Temporal Server Helm chart deployment:
- numHistoryShards: 4 (permanent, homelab-appropriate)
- 1 replica per service (frontend, history, matching, worker)
- PostgreSQL backend (postgres12 plugin), external CNPG
- Web UI enabled on port 8080
- Resource limits: ~450m CPU / 448Mi RAM total
- Cassandra, MySQL, Elasticsearch disabled

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-378: fix: correct Temporal Helm chart persistence structure
Some checks failed
Plan failed.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
0f48b3e5ec 
Chart expects server.config.persistence.default.driver = "sql" with
nested sql block — not a datastores wrapper. Fixes "Please specify
cassandra port" error during helm template.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add worker-deployment.yaml and worker-pvc.yaml templates to the
lab-director chart. Worker deployment mounts the same credentials
as dev-environment pods (SSH, kubeconfig, ArgoCD, Claude OAuth, MCP).
Disabled by default — enabled via prod overrides.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-379: feat(lab-director): add worker ExternalSecrets, SA, and RBAC
Some checks failed
Plan failed.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
e3e3134f24 
Create ExternalSecrets for lab-director namespace (synced by existing
ArgoCD external-secrets-config app) to provision dev-agent credentials.
Add ServiceAccount and RBAC templates to the lab-director Helm chart
binding to the existing dev-agent-scoped ClusterRole.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Allows individual workers to use different storage backends for boot
disks and different data disk sizes. Needed for prod-wk-03 which uses
HDD storage (hdd-mirror) instead of SSD (local-lvm) due to SSD capacity
constraints.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-378: fix: disable schema createDatabase — CNPG handles DB creation
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
5defa6dcec 
Schema init job fails with "permission denied to create database" because
CNPG already creates the temporal and temporal_visibility databases.
Set schema.createDatabase.enabled: false to skip DB creation and only
run table schema setup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-397: fix(rbac): add claude-agent SA to dev-agent-scoped bindings
Some checks failed
Plan failed.
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
3c82abba68 
The claude-agent ServiceAccount in dev-agents namespace was missing
from the ClusterRoleBinding and RoleBinding, causing kubectl access
failures across all namespaces.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-395: feat(lab-director): add worker ConfigMap templates
Some checks failed
Plan failed.
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
604601c433 
Provision dev-agent ConfigMaps (gitconfig, claude-settings, env, mcp-config)
in the lab-director namespace via the Helm chart. Required for worker pod
to start — volume mounts reference these ConfigMaps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-395: feat(temporal): enable auto-registration of default namespace
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
b242b55ca5 
The Temporal worker fails with "Namespace default is not found" because
the namespace was never registered after server deployment. Enable the
chart's built-in namespace creation via server.config.namespaces.create
with 3-day retention.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat(rbac): grant claude-agent cluster-admin access
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
6fef6bcc16 
The claude-agent SA was bound to dev-agent-scoped (read-only) which
blocked investigation of cross-namespace issues like Plane 503s.
Elevate to cluster-admin for autonomous infrastructure operations.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-404: switch lab-director worker to devenv-homelab image + MODE=temporal
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
fbb9178774 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-406: fix cluster health — Talos version, Loki config, Prometheus resources
Some checks failed
Plan failed.
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
fe8d40ff29 
- Update Talos default version v1.11.3 → v1.12.5 (IaC drift fix)
- Add Loki compactor.delete_request_store: filesystem (required for retention)
- Increase Prometheus limits: CPU 1→2, memory 2Gi→4Gi (OOM/throttle fix)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-404: delete worker deployment — DispatcherWorkflow moves into backend
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
5447e7999f 
The separate lab-director-worker deployment is removed. The DispatcherWorkflow
now runs inside the Lab Director backend process (manager/employee model):
- Lab Director pod = manager (HTTP + Temporal Client + Dispatcher)
- Dev-env pods = employees (PipelineWorkflow + Activities)

Removed: worker-deployment.yaml, worker-pvc.yaml, worker-rbac.yaml,
worker-serviceaccount.yaml, worker-configmaps.yaml, worker-mcp-config.yaml,
and worker section from values.yaml.

Added TEMPORAL_HOST_PORT and TEMPORAL_NAMESPACE to backend env config.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-404: feat(lab-director): add Temporal env vars to backend Helm chart
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
2627d0cb1c 
Add TEMPORAL_HOST_PORT and TEMPORAL_NAMESPACE to configmap and
deployment templates (conditional — only rendered when set in values).
Required for the embedded Dispatcher to connect to Temporal.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-404: fix(dev-environment): default MODE to worker instead of interactive
Some checks failed
Plan failed.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
feef9dc364 
The dev-env pod is a unified environment + worker. Default behavior
(empty MODE) starts the Temporal worker. Interactive mode must be
explicitly requested via MODE=interactive.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-416: refactor(dev-environment): use single devenv image
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
6dbec4f9bc 
Update default image repository from devenv-homelab to devenv.
All projects now use the same consolidated image.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
HOMELAB-419: update Talos nameserver default to OPNsense (10.10.10.1)
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
fef63538c5 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
HOMELAB-433: fix(temporal): set explicit prometheus storageClass to resolve ArgoCD sync
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
f0b1703d3b 
The temporal-prometheus-server PVC was created with storageClass "longhorn"
(cluster default), but the Helm chart renders nil when not explicitly set.
This immutable field mismatch blocked ArgoCD sync. Setting it explicitly
makes desired state match actual state.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-434: add HTTPRoute for Temporal Web UI
Some checks failed
0/0 projects applied successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
463828e29a 
Exposes temporal-web service at temporal.aaron.reynoza.org via
the existing homelab-gateway (Cilium Gateway API + wildcard TLS).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- PVC: 25 GiB Longhorn with helm.sh/resource-policy: keep
- ServiceAccount: dedicated SA, no cluster role bindings
- LimitRange: container resource caps (6 CPU / 12 Gi max)
- CiliumNetworkPolicy: D16 egress allowlist (DNS, Temporal, Lab Director,
  Forgejo, Harbor, Langfuse, OTel, Grafana, internet:443, DinD:2376)
- Deployment: main sandbox container + DinD sidecar (privileged)
  with workspace PVC, SSH keys, git credentials, Claude OAuth,
  Claude settings, and MCP config mounts
- No kubeconfig or ArgoCD secrets mounted (D8 security boundary)
HOMELAB-424: fix(sandbox): align chart values with Supervisor ArgoCD parameters
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
f0daefd0d6 
Restructure values.yaml to match the --set parameters the Supervisor sends:
- profileId -> sandbox.profileId, sandbox.name, sandbox.profileName
- workspace.storageSize -> persistence.size
- Add persistence.existingClaim support (skip PVC creation when set)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-433: fix(temporal): add alertmanager storageClass to match existing PVC
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
6dbae09c41 
Same immutable PVC issue as prometheus-server — the alertmanager StatefulSet
VCT renders without storageClass, causing persistent OutOfSync drift.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-437: disable bundled node-exporter in temporal chart
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
4a7a75eb0b 
temporal namespace uses PodSecurity baseline:latest which blocks node-exporter
(hostNetwork, hostPID, hostPath volumes, hostPort 9100). The bundled DaemonSet
was stuck at 0/3 pods causing ArgoCD to show Progressing health.

kube-prometheus-stack already provides cluster-wide node-exporter coverage,
so the bundled one is redundant.

Key: prometheus.prometheus-node-exporter.enabled (prometheus sub-chart key,
NOT temporal's unused prometheus.nodeExporter.enabled wrapper)
HOMELAB-439: fix(sandbox): fix SSH key permissions + add SANDBOX_MODE env var
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
4d270f88fc 
Replace subPath SSH secret mount with full directory mount at .ssh-secret/
and add fsGroup: 1000 to pod securityContext so claude-agent (uid 1000)
can read the keys. Add SANDBOX_MODE=true env var so worker starts in
sandbox mode by default.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-447: add SANDBOX_MODE and SANDBOX_NAME env vars to sandbox chart
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
62d816103b 
Worker exits on startup without SANDBOX_NAME (needed for LifecycleWorkflow
ID: sandbox-lifecycle-{name}). SANDBOX_MODE was also missing from the base
chart. SANDBOX_NAME is derived from the existing sandbox.name value field.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Merge pull request 'HOMELAB-447: add SANDBOX_MODE and SANDBOX_NAME env vars to sandbox chart' (#81) from homelab-447-sandbox-env-vars into live
Some checks are pending
CI Review / pr-title (pull_request) Waiting to run
Details
CI Review / helm-validate (pull_request) Waiting to run
Details
CI Review / ai-review (pull_request) Waiting to run
Details
Lint & Validate / terraform-validate (pull_request) Waiting to run
Details
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
0/0 projects applied successfully.
5b13630b38
feat(sso): add Temporal UI OIDC app in Zitadel — HOMELAB-448
Some checks failed
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
eb2adad74d 
Register Temporal as an OIDC application in Zitadel and create a K8s
secret with client credentials for the Temporal UI native auth.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(sso): enable id_token_userinfo_assertion for Temporal OIDC — HOMELAB-448
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
0db48031e7 
Include user profile info (name, email) in the ID token so the
Temporal UI can display the logged-in user.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-460: feat(sandbox): add LiteLLM egress rule to CiliumNetworkPolicy for Ollama model routing
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
99d144ff25
HOMELAB-462: increase Cilium memory limits, enable BPF LB acceleration and bandwidth manager
Some checks failed
0/0 projects applied successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
05f968fe7b 
- Agent memory: 512Mi → 768Mi (workers at 72-74% before)
- Agent memory request: 128Mi → 256Mi
- Operator memory: 256Mi → 512Mi (11 restarts in 8h)
- Operator memory request: 64Mi → 128Mi
- Enable loadBalancer.acceleration: native (XDP for LB traffic)
- Enable bandwidthManager for EDT-based pacing
HOMELAB-463: add Zookeeper soft pod anti-affinity to spread across workers
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
0166494cb6 
Spreads 3 Zookeeper replicas across prod-wk-01 and prod-wk-02 to reduce
I/O concentration on prod-wk-02. Root cause of high CPU is ClickHouse data
volume I/O via Longhorn instance-manager (structural, follows data locality).
HOMELAB-464: remove Mimir — never deployed, stop remote_write spam
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
79dfe6818c 
Mimir's monolithic StatefulSet was never rendered by the mimir-distributed
chart (deploymentMode: monolithic misconfiguration). Prometheus has been
logging DNS lookup errors every 60s for 14 days with no data stored.

Remove:
- Prometheus remoteWrite to mimir.monitoring.svc.cluster.local:9009
- Grafana Mimir datasource (pointing to same broken endpoint)

Prometheus 15d retention is sufficient for this homelab. Mimir can be
re-added when long-term retention becomes a requirement.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
HOMELAB-465: reset Longhorn rebuild limit to 2 (from temp 3 set in HOMELAB-462)
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
fc9464134a 
concurrentReplicaRebuildPerNodeLimit: 1 → 2

Was set to 3 as a temporary measure during HOMELAB-462 to accelerate
volume rebuild backlog. Setting 2 provides faster parallel rebuilds than
the original 1 while not flooding the nodes the way 3 did.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
HOMELAB-449: feat(lab-director): consolidate to single-binary Helm chart
Some checks failed
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
4114c20556 
Remove separate frontend Deployment and Service — lab-director now deploys
as a single pod serving both API and embedded SvelteKit frontend. Backend
image tag updated for unified build. Template names cleaned up (backend- prefix
removed). All traffic routed to single service.
fix: add cilium-secrets to reflector allowed namespaces (HOMELAB-468)
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
7260efc4bd 
Cilium Gateway API syncs TLS secrets to cilium-secrets namespace with
inherited reflector annotations. Reflector detected these as unauthorized
reflections and entered a tight delete loop (~10/sec), causing liveness
probe failures and continuous restarts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-469: fix(lab-director): bump image tag to 6a72f10 (embedded frontend)
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
11a3066c2c 
The base values had image tag 6192621 which predates the frontend
embedding work (PR #76). Update to 6a72f10 which includes all 7 UI
phases built into the single Go binary.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-469: chore(lab-director): bump image to c11df5f (Phase 7 + WS fix)
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
0253831158 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-469: fix(lab-director): bump to 2fd90c5 — WS routing + missing handlers
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
8adc63675b 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-470: bump lab-director image to ab2dec6 — Temporal-native chat sessions
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
5def617729 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-473: perf(forgejo-runner): persistent Docker cache and resource bump
Some checks failed
0/0 projects applied successfully.
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
7250f36ef7 
- Replace emptyDir with 30Gi Longhorn PVC for /var/lib/docker — Docker layer
  cache now survives pod restarts
- Increase DinD resources: 1 CPU / 1Gi request, 4 CPU / 4Gi limit — allows
  Go compiler and npm to use more parallelism during builds

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-474: add Plane, Outline, Forgejo config to lab-director chart
Some checks failed
0/0 projects applied successfully.
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
4c4b6121c5 
Adds configmap entries for API URLs and workspace/project identifiers,
plus secretKeyRef entries for API tokens from dev-agent-credentials
(managed by ESO). Enables Lab Director's chat tool executor to query
live service APIs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-471: feat(chart): manager execution capability — PVC, env vars, secret mounts
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
35fec32d8d 
- execution.enabled feature flag (default false)
- 5Gi workspace PVC for pipeline run isolation
- MANAGER_EXECUTION_ENABLED + WORKSPACE_DIR env vars
- Claude OAuth credentials mount (~/.claude/.credentials.json)
- SSH key mount for Forgejo git operations
- Resource bump: 250m/2CPU, 512Mi/4Gi

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-471: fix(chart): use Recreate strategy when execution PVC is mounted
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
9550564227 
RWO PVC can't be shared between old and new pods during rolling update.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-476: fix(chart): clear rollingUpdate when strategy is Recreate
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
2a1947a1ee
HOMELAB-476: fix(chart): add fsGroup for workspace PVC write access
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
48cdeef600 
Workspace PVC mounts as root-owned, but container runs as appuser (uid
1000). Without fsGroup, QueryChat activity cannot create session dirs
under /workspace/chat-sessions/. Only applied when execution is enabled.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-477: feat(helm): add token-refresh CronJob templates to lab-director chart
Some checks failed
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
1469f72c78 
Add Helm templates for the Claude OAuth token-refresh CronJob:
- CronJob template with hardened security context (non-root, read-only fs, drop all caps)
- Cross-namespace RBAC (ServiceAccount, Role in secrets ns, RoleBinding)
- tokenRefresh values section (disabled by default, enabled via prod overrides)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-477: fix(helm): add seccompProfile to token-refresh CronJob
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
3facf84d5d 
Fixes PodSecurity "restricted:latest" violation warning.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-478: fix(cert): remove cilium-secrets from Reflector namespaces
Some checks failed
Plan failed.
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
c91b897af4 
Reflector and Cilium's gateway secret-syncer both writing to
cilium-secrets creates an infinite reconciliation loop (89 operator
restarts). Remove cilium-secrets from Reflector — Cilium's syncer
handles that namespace natively. Reflector still reflects to
cilium-system where the Gateway references the cert.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-476: add Langfuse env vars to lab-director Helm chart
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
60c45af716 
- Add LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY from serviceCredentials secret
- Add LANGFUSE_HOST configmap entry for MCP server URL

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-420: feat(modules): add per-worker overrides and GPU passthrough
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
083ed3ceee 
Cherry-pick of b3bf989 (HOMELAB-280) from main to live, resolving
conflicts with boot_datastore_id support added on live.

- talos-cluster: workers now support per-node cpu_cores, memory_mb,
  boot_disk_gb, data_disk_gb, and gpu_pci_id overrides (falling back
  to global defaults via coalesce)
- proxmox-vm: add GPU PCI passthrough support with dynamic hostpci
  block and automatic q35 machine type when GPU is present

Resolves Terraform drift on prod-wk-01: disk size, machine type, hostpci.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-510: fix(gateway): route Harbor traffic to port 443 (SSL listener)
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
e1bf6381a1 
INCIDENT: All build pipelines blocked — docker login fails with redirect loop.

Cilium Gateway terminates TLS and forwards plain HTTP to Harbor port 80,
which maps to nginx port 8080. Harbor's nginx returns 301 to HTTPS on 8080,
creating an infinite redirect loop. Route to port 443 (→ nginx 8443) instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-510: fix(gateway): remove Harbor HTTPRoute — use direct LB instead
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
52d5bbc195 
Harbor has its own LoadBalancer service (10.10.10.223) with TLS
configured. The HTTPRoute through Cilium Gateway creates a redirect
loop because the Gateway terminates TLS and forwards plain HTTP to
Harbor's port 80, which redirects back to HTTPS.

Harbor needs TLS on its own service for kubelet image pulls, so we
can't disable Harbor's TLS. The simplest fix is to remove the
HTTPRoute and let all traffic go through Harbor's LoadBalancer IP
directly. ControlD DNS should resolve harbor.aaron.reynoza.org to
10.10.10.223 (the LB IP) instead of 10.10.10.228 (the Gateway IP).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-510: fix(gateway): Harbor backend TLS via appProtocol + dedicated Service
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
dfc08cb05e 
Harbor requires TLS on its backend (nginx 8443). The Gateway terminates
external TLS then re-encrypts to Harbor using Cilium's appProtocol support
(enable-gateway-api-app-protocol is already enabled).

Creates harbor-gateway Service with appProtocol: https targeting Harbor's
nginx SSL port (8443). HTTPRoute points to this service on port 443.

Traffic flow: Client → Gateway (TLS terminated) → Envoy (re-encrypts) →
harbor-gateway:443 → nginx:8443 → Harbor core

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-510: fix(gateway): simplify Harbor route — TLS disabled in prod
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
887cb58e71 
Now that Harbor's internal TLS is disabled (prod PR #128), nginx serves
plain HTTP on port 8080. Simplify route back to harbor:80 and remove
the harbor-gateway Service workaround.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-516: fix(sandbox): hardcode SANDBOX_MODE=true in deployment template
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
7bb9f46e6f 
SANDBOX_MODE should always be "true" for sandbox deployments — remove from
values.yaml env section and hardcode in deployment.yaml to prevent accidental
override. SANDBOX_NAME already correctly sourced from sandbox.name.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat(lab-director): add ArgoCD env vars for sandbox provisioning
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
7eedce449b 
Adds argocd.* values block to wire ARGOCD_SERVER_URL, ARGOCD_AUTH_TOKEN,
ARGOCD_CHART_REPO_URL, ARGOCD_CHART_PATH, ARGOCD_CHART_REVISION, and
ARGOCD_NAMESPACE into the lab-director deployment. Required for
Supervisor.SpawnSandbox() to create ArgoCD Applications.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat(argocd): grant lab-director RBAC for dev-agents project
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
eebf8f07c6 
lab-director account needs create/delete/get/sync on dev-agents/*
to manage sandbox ArgoCD Applications via the provisioning API.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(sandbox): correct LAB_DIRECTOR_API_URL service name
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
eb81d615c1 
The lab-director service is named "lab-director", not
"lab-director-backend". Fixes DNS resolution failure in sandbox pods.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(lab-director): prevent token refresh CronJob from hammering OAuth endpoint
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
a75b7b9285 
Set backoffLimit: 0 and restartPolicy: Never so failed refresh attempts
don't retry with exponential backoff. Each CronJob run gets exactly one
attempt — if it fails, wait for the next scheduled run in 6 hours.

Previous backoffLimit: 2 caused up to 3 retries per failed job, which
combined with the 6-hour CronJob schedule would hit rate limits when the
OAuth endpoint was temporarily unavailable.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(sandbox): correct lab-director pod label in egress network policy
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
6e08c5afce 
The CiliumNetworkPolicy matched app.kubernetes.io/name: lab-director-backend
but the actual pod label is app.kubernetes.io/name: lab-director, blocking
sandbox→manager API traffic and causing CrashLoopBackOff (profile fetch timeout).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
k3s --docker uses cri-dockerd which hardcodes /var/run/docker.sock.
The DinD sidecar was exposing Docker over TLS (tcp://localhost:2376)
which cri-dockerd can't use.

Switch to Unix socket by setting DOCKER_TLS_CERTDIR="" on DinD sidecar
and sharing /var/run between containers via emptyDir volume.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(sandbox): share /var/lib/docker with sandbox container for kubelet
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
c85568a1f4 
kubelet's filesystem info check needs Docker's data directory visible.
Mount dind-storage (emptyDir) as read-only at /var/lib/docker in the
sandbox container.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(sandbox): mount /dev/kmsg from host for k3s kubelet
Some checks failed
0/0 projects applied successfully.
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
546f52ecf2 
k3s kubelet requires /dev/kmsg which doesn't exist in containers.
Mount the host's /dev/kmsg as a CharDevice hostPath volume.

Ticket: HOMELAB-519

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(sandbox): run sandbox container as privileged for k3s kubelet
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
2ca1f8e9e1 
k3s kubelet requires /dev/kmsg access which is blocked in unprivileged
containers. The sandbox is already network-isolated via CiliumNetworkPolicy.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(sandbox): make /var/lib/docker writable for kubelet pod creation
Some checks failed
0/0 projects applied successfully.
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
f2bd43472b 
kubelet writes resolv.conf inside /var/lib/docker/containers/ when
creating pod sandboxes. readOnly: true was causing all pod creation
to fail with "read-only file system".

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-533: feat(talos): add nvidia kernel modules for GPU workers
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
7451ff0230 
Workers with gpu_pci_id set now get machine.kernel.modules config
for nvidia, nvidia_uvm, nvidia_drm, nvidia_modeset. Without this,
Talos doesn't load the nvidia kernel modules at boot despite the
extension providing the .ko files on disk.

Root cause of Ollama being unable to schedule — node reported
nvidia.com/gpu: 0 because the device plugin couldn't initialize
NVML without loaded drivers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-540: feat(otel): route lab-director spans to Langfuse
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
618f77cc8e 
Update OTel Collector filter/langfuse to accept spans from both
agent-harness and lab-director service names.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: resolve critical alerts — Talos compat, ArgoCD OOM, Longhorn replicas
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
6b072273bf 
- Disable kubeControllerManager, kubeScheduler, kubeProxy ServiceMonitors
  in kube-prometheus-stack — Talos binds these to localhost (unscrappable)
  and uses Cilium instead of kube-proxy, eliminating false critical alerts
- Bump ArgoCD application-controller memory limit 1Gi → 2Gi to prevent
  OOMKills under load (125 restarts observed)
- Set Longhorn defaultReplicaCount to 2 (matches 2-node storage topology)
  and bump concurrent rebuild limit 2 → 5

Part of HOMELAB-542 infrastructure alerts triage.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: change token-refresh CronJob default to every 2 hours
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
83e6859d97 
Claude OAuth tokens have ~4h TTL. A 6h schedule guarantees the token
expires between runs. Changed to 2h with a 2h refresh buffer in the
token-refresh binary.

HOMELAB-538

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: add startup probe to kube-state-metrics to stop restart loop (HOMELAB-544)
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
f4d06af6b1 
KSM lists/watches 30+ resource types on startup. Default liveness probe
(initialDelay=5s) kills the container at ~35s before caches are built,
causing 499 restarts in 6 days. Startup probe gives up to 185s for
initialization before liveness takes over.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: enable startupProbe for kube-state-metrics (HOMELAB-544)
Some checks are pending
CI Review / pr-title (pull_request) Waiting to run
Details
CI Review / helm-validate (pull_request) Waiting to run
Details
CI Review / ai-review (pull_request) Waiting to run
Details
Lint & Validate / terraform-validate (pull_request) Waiting to run
Details
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
0/0 projects applied successfully.
09e5cc7441 
The kube-state-metrics subchart requires startupProbe.enabled: true —
without it the probe definition is ignored.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: bump plane worker memory limit 1000Mi → 1500Mi
Some checks failed
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
9b0de56de3 
Celery worker baseline footprint is ~970Mi, leaving only 3% headroom
at the current 1000Mi limit. Increasing to 1500Mi gives ~35% headroom.

Ticket: HOMELAB-545

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: bump memory limits for reflector and langfuse zookeeper
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
644a3a005d 
Reflector: 117Mi/128Mi (91%) with 76 OOMKill restarts → bump to 256Mi
Langfuse Zookeeper: 357Mi/384Mi (93%) on zk-0 → explicit 512Mi limit
(was using Bitnami subchart defaults of 384Mi)

Ticket: HOMELAB-545

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: add shareProcessNamespace to sandbox pod for CNI loopback access
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
c39911e5c7 
The sandbox and dind containers had separate PID namespaces, so the K3s
kubelet couldn't access /proc/<pid>/ns/net for containers created by
dockerd. This caused every inner kube-system pod to fail CNI loopback
setup in a tight retry loop (~12k error lines in 8h, burning 1+ CPU).

HOMELAB-546

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat(lab-director): replace CronJob token refresh with in-process manager
Some checks failed
0/0 projects applied successfully.
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
b436b6d355 
- Add token-manager-rbac.yaml (SA + cross-namespace Role/RoleBinding)
- Add serviceAccountName + TOKEN_* env vars to deployment
- Replace tokenRefresh values with tokenManager values
- Delete token-refresh-cronjob.yaml and token-refresh-rbac.yaml

HOMELAB-558

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-584: feat(tempo): increase memory limits to fix OOMKilled events
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
9045a2187d 
- Memory request: 256Mi → 512Mi
- Memory limit: 1Gi → 2Gi
- Fixes OOMKilled alerts for tempo-0 pod in monitoring namespace
- Tempo running in monolithic mode with 72h retention requires more memory for in-memory trace buffering

Resolves: PodOOMKilled alerts affecting observability stack
fix(backups): reduce B2 API usage to stay within free tier (HOMELAB-590)
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
b22c7d07b7 
- Velero: backupSyncPeriod + storeValidationFrequency 30m → 24h
  (saves ~1,200 wasted Class C calls/day from broken sync loop)
- CNPG: retentionPolicy 30d → 7d (reduces stored objects + LIST calls)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-698: fix(monitoring): guard CNPGLastBackupOld alert for clusters without active archiving
Some checks failed
0/0 projects applied successfully.
CI Review / ai-review (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
181f01c4dc 
Merges PR #150 which adds guard clause to CNPGLastBackupOld alert to prevent false positives on clusters without backup archiving configured.
- Add condition to exclude job =~ "outline/.*" from CNPGLastBackupOld alert
- Prevents false alerts for outline cluster where B2 backups are intentionally disabled
- Outline cluster relies on Longhorn snapshots instead of WAL archival (HOMELAB-590)
- Use label selector {namespace!="outline"} instead of complex expressions
- Excludes metrics from outline namespace to prevent false alerts
- Resolves HOMELAB-705 WAL archive delay alert for intentionally disabled backups
- Increase terminationGracePeriodSeconds from 60s to 300s for proper DinD cleanup
- Add graceful preStop hooks for both sandbox and dind containers
- Add node affinity configuration support for RWO volume placement
- Prevent FailedKillPod errors when stopping nested Docker containers

Resolves: HOMELAB-713

Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>
fix(lab-director): remove subPath mount for claude OAuth credentials
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
71ff164de0 
K8s subPath mounts never auto-update when the underlying secret changes.
The token manager now writes credentials directly to the local filesystem,
making the volume mount unnecessary.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat(lab-director): wire OUTLINE_COLLECTION_ID into Helm chart — HOMELAB-793
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
42a58944ce 
OUTLINE_COLLECTION_ID was missing from the configmap and deployment
templates, so CreateDocument always returned early with
"OUTLINE_COLLECTION_ID not set". Planner stage docs never reached Outline.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
feat(terraform): add boot disk I/O tuning and etcd auto-compaction (HOMELAB-811)
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
1569db193b 
Post-power-outage incident revealed Kingston A400 (DRAM-less SSD) with
cache=none causes ~194ms etcd fsync latency, leading to controller
crash loops. Adds configurable boot disk cache/iothread/discard settings
to proxmox-vm module, and etcd auto-compaction config patch to
talos-cluster module.

Changes:
- proxmox-vm: boot_disk_cache, boot_disk_iothread, boot_disk_discard vars
- talos-cluster: CP disk tuning pass-through + etcd_auto_compaction vars
- Defaults unchanged (cache=none) to avoid breaking existing deployments

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
remove redundant PodOOMKilled alert rule (HOMELAB-819)
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
7cad3c550f 
OOMKillRateHigh in capacity-alerts.yaml already covers OOM detection
with a smarter rate-based expression. The per-pod PodOOMKilled rule
fires indefinitely on any historical OOM, generating constant noise.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat(lab-director): add claudeSetupToken support — 1-year token via env var
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
91e7fe1765 
Adds CLAUDE_CODE_OAUTH_TOKEN env var from K8s secret when
claudeSetupToken.enabled is true. Replaces the OAuth token refresh
approach (14 fix commits, still broken) with a static 1-year
setup token from `claude setup-token`.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-817: fix(etcd): replace narrow compaction vars with generic etcd_extra_args map
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
3dc656b128 
The previous etcd_auto_compaction_mode/retention variables only supported 2 args
and gated on mode != null, which meant a null default silently disabled the entire
patch. Replace with a generic map(string) that supports any etcd extraArgs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-817: fix(talos-cluster): add static IP to machine config patches
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
be85d9611a 
Talos was relying on Proxmox cloud-init for IP assignment, which broke
after a config apply/reboot — the CP node got DHCP address 10.10.10.66
instead of the expected 10.10.10.10, taking the entire cluster offline.

Add explicit machine.network.interfaces config patch for both CP and
worker nodes using the IP from the control_planes/workers variables.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-817: fix(talos-cluster): add hostname to machine config patches
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
c3eac7349d 
After config apply/reboot, Talos generated a random hostname (talos-8a7-y35)
instead of the expected prod-cp-01. This caused stale kubelet registrations
and etcd member hostname mismatches. Set hostname explicitly from node name.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-817: revert hostname from machine config patches
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
c05351975b 
Talos HostnameConfig document conflicts with machine.network.hostname —
terraform apply fails. Hostname fix needs separate investigation (follow-up
ticket). Static IP remains in place.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: add hostname to Talos machine config patches
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
80b8dd4913 
After a Talos config apply/reboot, nodes lose the Proxmox-inherited
hostname and fall back to auto-generated names (e.g. talos-8a7-y35).
This caused ghost node registrations, broken Cilium L2 announcements,
and a full cluster outage.

Sets machine.network.hostname explicitly for both control planes and
workers using the node name from variables.

Refs: HOMELAB-817

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(eso): add ExternalSecrets for claude-setup-token and litellm-master-key
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
ab02b25ead 
Both secrets were manually created and got pruned by ArgoCD.
Now managed via ESO from the secrets namespace like all other credentials.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: increase ClickHouse resource limits to resolve Langfuse outage
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
5e335afbc1 
ClickHouse was pegged at CPU/memory ceiling (992m/1000m CPU, 1434Mi/1536Mi RAM),
causing readiness probe timeouts and preventing langfuse-web from completing
migrations. Doubled limits to give ClickHouse breathing room.

HOMELAB-845

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-846: fix(langfuse): increase ClickHouse memory limits to prevent OOM
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
d6376a1f1d 
ClickHouse was OOMing during MergeTree merge operations on system log
tables (trace_log grew to 6.3GB/302M rows). This caused cascading
failures: CH crashes → langfuse-web migration fails → crash loop
(82 restarts in 8 days).

Bump CH memory: requests 1Gi→2Gi, limits 3Gi→5Gi. Also truncated
accumulated system log tables (~8GB freed) as immediate relief.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: prevent PG crash cascade from MinIO OOMKill disk saturation
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
5dbcea18dd 
MinIO (langfuse-s3) was OOMKilled repeatedly due to chart-default 384Mi
memory limit. Each restart triggered 112 MB/s overlay reads on vda,
saturating the system disk on prod-wk-02. This caused Longhorn write
latencies to spike to 12+ seconds, flipping ext4 WAL filesystems
read-only and crashing all three CNPG clusters (forgejo, temporal,
zitadel) for 9 hours.

- Bump MinIO memory limit from 384Mi to 1Gi
- Bump CNPG WAL storage from 2Gi to 4Gi for additional headroom

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Reviewed-on: #171
JetStream enabled, 256Mi in-memory storage, single-replica homelab config.
ClusterIP service — Mac connects via port-forward or WireGuard tunnel.
Environment-specific overrides (external access, TLS) go in prod repo.

Refs: HOMELAB-847
HOMELAB-847: feat(chart): add NATS_URL and Langfuse key env vars to lab-director
Some checks are pending
CI Review / pr-title (pull_request) Waiting to run
Details
CI Review / helm-validate (pull_request) Waiting to run
Details
CI Review / ai-review (pull_request) Waiting to run
Details
Lint & Validate / terraform-validate (pull_request) Waiting to run
Details
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
0/0 projects applied successfully.
70660ed891 
Adds NATS_URL placeholder (enables server-side NATS handlers in MODE=full
when set) and LANGFUSE_PUBLIC_KEY / LANGFUSE_SECRET_KEY for the Langfuse
HTTP ingester wired in server_handlers.go.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Merge branch 'live' into plane/HOMELAB-847-nats-k8s-deployment
Some checks failed
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
5027294ed2 
Reviewed-on: #172
HOMELAB-854: feat(nats): add base Helm values for NATS JetStream
Some checks failed
0/0 projects applied successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
1bb1aaed14 
Deploy NATS as Lab Director transport layer. JetStream enabled with
file storage, Prometheus metrics, and NATS Box for debugging.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: remove hostname from talos config patches — already in v1alpha1
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
1feb8dd5fa 
Talos rejects config patches that set machine.network.hostname when
the v1alpha1 base config already has it. Remove from patches since
existing nodes already have static hostnames configured.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-857: feat(lab-director chart): wire NATS_URL env var
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
a0e6f6e675 
Adds NATS_URL to configmap + deployment templates.
Set via prod overrides to connect to in-namespace NATS.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Expand CiliumLoadBalancerIPPool from 10.10.10.220-250 (31 IPs) to
  10.10.10.100-250 (151 IPs)
- Add temporal-frontend-lb (10.10.10.109:7233) for VPN access
- Add cnpg-lab-director-lb (10.10.10.110:5432) for VPN access
- Eliminates need for kubectl port-forward from Mac

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Pool expansion must keep the original range (.220-.250) as the first
block to preserve existing IP assignments. New services pinned to the
expansion range (.100-.219) to avoid conflicts.

- Temporal LB: 10.10.10.100
- PG LB: 10.10.10.101

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HOMELAB-954: feat(workadventure): add base values, HTTPRoute, ExternalSecret
Some checks failed
0/0 projects applied successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
4de42e7f73 
Adds the infra-core side of the WorkAdventure deploy:
- core/charts/apps/workadventure/values.yaml: base Helm values for the
  upstream workadventure/workadventure v1.30.5 chart (singleDomain,
  bundled Redis + Longhorn PVC, mapstorage Longhorn PVC, root ingress
  disabled in favour of a sibling HTTPRoute, externalSecretName wired
  to ESO-managed Secret).
- core/manifests/apps/workadventure/httproute.yaml: HTTPRoute on
  homelab-gateway (cilium-system), single host play.aaron.reynoza.org,
  path rules mirroring the chart's nginx Ingress (/api, /uploader,
  /icon, /map-storage, /ws, /).
- core/manifests/apps/workadventure/eso.yaml: ExternalSecret pulling
  workadventure_map_storage_api_token + workadventure_map_storage_password
  from the shared app-credentials Secret in the secrets namespace.

Companion ArgoCD Applications + env overrides ship in the prod repo.

Plan: docs/superpowers/plans/2026-04-19-workadventure-hubs-eval.md
HOMELAB-956: feat(talos): raise worker kubelet maxPods to 150
Some checks failed
0/0 projects applied successfully.
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
a2714ffa6a 
wk-01 is capped at the kubelet default (110 pods/node) and, with wk-02
cordoned pending HDD replacement, new deploys (observed on HOMELAB-954
WorkAdventure) hit FailedScheduling / "Too many pods". Raise the cap via
the worker config patch so there's headroom for the current stack
(harbor, temporal, longhorn, monitoring, etc.) plus new workloads.

Adds `kubelet.extraConfig.maxPods = 150` to the worker_config_patch
local. Applies to every worker via the existing
talos_machine_configuration_apply.worker loop. Talos reloads kubelet
in place — no full node reboot.

Apply path (Atlantis is offline, manual for now):
  cd prod/terraform && terraform plan -out=956.tfplan
  terraform apply 956.tfplan

Verify after apply:
  kubectl get node prod-wk-01 -o jsonpath='{.status.capacity.pods}{"\n"}'
  # expect: 150

Unblocks HOMELAB-954 (WorkAdventure pods currently Pending).
Reviewed-on: #177
HOMELAB-968: feat(intellimation): static posters site behind menu
Some checks failed
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
e9dfa897a6 
Host 3 Claude Design posters (Pipeline, Homelab v2, What Maps to What)
at intellimation.aaron.reynoza.org. nginx serves content from a kustomize-
generated ConfigMap; wrapper index.html provides a top-bar menu that swaps
an iframe between the three posters. HTTPRoute attaches to homelab-gateway.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HOMELAB-969: fix(pangolin): set sso=false on resource create
Some checks failed
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
e5da1c0b73 
Pangolin's API defaults new public resources to sso=true (auth wall).
All existing homelab resources are sso=false; new ones require a manual
follow-up POST to flip the flag. Passing sso=false in the create payload
makes resource creation match established intent without the extra step.

Discovered while shipping HOMELAB-968 (intellimation).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HOMELAB-954: fix(workadventure): use correct chart schema for mapstorage PVC
Some checks failed
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
5c5390b337 
The upstream workadventure chart v1.30.5 expects `mapstorage.persistence.*`
(with `storageSize`), not `mapstorage.persistentVolume.*` (with `size`) — the
wrong keys were silently ignored, so the Deployment fell through to the
chart's default emptyDir volume. This meant map uploads didn't survive a pod
restart, violating the plan's acceptance criterion.

Rename to the chart's real schema so Longhorn provisions a 10Gi RWO PVC
(workadventure-mapstorage) and the pod mounts it at /maps. Upstream template
annotates the PVC with helm.sh/resource-policy: keep so a future uninstall
won't drop the data.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HOMELAB-971: fix(intellimation): blend poster letterbox with grid + bg
Some checks failed
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
9b30ab400b 
The 1920x1080 posters scale contain-style; on a 16:10 viewport this
letterboxes top/bottom. Stage was #05080c while the poster is #0a0e14
with a 48px grid + 0.8 overlay, so the letterbox read as jet-black
bars framing the poster. Extend the poster's exact background (color
+ grid + overlay) onto the stage and iframe surfaces so the letterbox
disappears visually. Applied to all 3 posters and the index shell.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Skipping CI per user direction; CSS-only configmap change.
HOMELAB-973: fix(outline): add startupProbe to prevent liveness race during migrations
Some checks failed
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
9407a0aad5 
Outline's master process runs sequelize migrations + data-migration
checks + sponsor message before throng forks a worker that reloads
plugins and binds port 3000. On a cold boot this easily takes 45–90s.

The previous probe config (liveness initialDelay=30s, readiness
initialDelay=10s, both 3×10s failureThreshold) triggered SIGTERM
mid-worker-fork, causing the container to exit 0 (graceful shutdown)
and CrashLoopBackOff repeatedly without the web service ever listening.

Add a startupProbe with a 5-minute window (30 × 10s failureThreshold)
so Kubernetes suppresses liveness/readiness until the server actually
listens. Once startupProbe succeeds, liveness/readiness take over with
short periods to catch real post-startup failures fast.

Root cause diagnosed from pod logs: OIDC plugin registered → migrations
run → sponsor message → exit 0 (never reached "Listening on port 3000").
Autonomous-merge: harmless additive change to Helm chart template. Template rendered cleanly with helm template against prod values. CI pipeline is currently blocked on HOMELAB-972 (Forgejo Actions queue). Per parent approval, merging without CI; safety validated by helm template.
Adds langfuse.extraInitContainers with busybox nc -z wait-loop on langfuse-clickhouse:9000 and :8123. Fixes CrashLoopBackOff race on node disruption. Chart-level key applies to both web and worker pods.
HOMELAB-966: feat(sops-operator): Helm values + age-key bootstrap runbook (#185)
Some checks failed
Build & Deploy Docs / build-and-push (push) Failing after 1m26s
Details
c4b797f685
HOMELAB-966: docs(adr-004): amend — declarative SOPS decryption via operator (#186)
Some checks failed
Build & Deploy Docs / build-and-push (push) Failing after 17s
Details
dbc5ff92b4
HOMELAB-994: feat(es-cnpg-b2): add ExternalSecret for apexdirector-timescale
Some checks failed
0/0 projects applied successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
580fc2a8e8 
Adds the 7th cnpg-b2-credentials ExternalSecret entry so the
cnpg-cluster-timescale CNPG cluster can mount B2 credentials and emit
WAL/base backups. Mirrors the existing 6 entries' shape exactly; only
the namespace differs.

Re-arms backups for the 4 CNPG clusters whose backups were disabled
(HOMELAB-590) or never enabled (apexdirector-timescale, which lacked
the secret entirely). Companion change in prod repo flips
backups.enabled true on the 4 values.yaml files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Merge branch 'live' into plane/HOMELAB-276-argocd
Some checks failed
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
14bdeb4617 
Reviewed-on: #37
HOMELAB-958: revert maxPods=150 from worker_config_patch
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
35eaa790bc 
HOMELAB-956 added maxPods=150 as a workaround when wk-02 was cordoned
and all density landed on wk-01 (single-worker risk of hitting kubelet's
default 110 cap). With wk-03 joined as a 3rd active worker (HOMELAB-958
completion), workload spreads across 3 nodes and the default 110 is
sufficient. Reverting avoids an unnecessary kubelet restart on next apply.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
feat(longhorn): default StorageClass to 2-way replication
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
6d706258c2 
Set persistence.defaultClassReplicaCount=2 so the auto-created `longhorn`
StorageClass provisions PVCs at numberOfReplicas=2, matching `longhorn-db`
and defaultSettings.defaultReplicaCount.

Single Proxmox host topology means Longhorn 3-way replication adds no
cross-host fault tolerance — host failure takes out all 3 VMs and all 3
replicas. The ZFS mirror at the storage layer already handles single-disk
failure, and CNPG B2 backups handle durability. 3-way only triples write
I/O on the shared SSD/HDD pool with no real availability gain.

Existing volumes provisioned before this change remain at 3-way (SC
parameters bind only at provisioning time) — those are migrated separately
by patching their volume.longhorn.io spec.numberOfReplicas in-cluster.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
fix(longhorn): throttle rebuild concurrency to 1 + disable auto-balance
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
8bdfe9f72f 
Today's EROFS storm: with both ZFS pools degraded on daytona (hdd-mirror
single-disk after HOMELAB-860 sdb detach, ssd-mirror has one UNAVAIL Bestoss
SSD), the underlying disk sustains ~30 MB/s. concurrentReplicaRebuildPerNodeLimit=5
saturated the hdd-mirror spindle, engine sync writes timed out, kernel marked
multiple PVCs read-only (postgres CNPGs, harbor-redis, plane-rabbitmq Mnesia).

Throttle to 1 in-flight rebuild per node so the disk can serve foreground
sync writes alongside replica rebuilds. Disable auto-balance during the
recovery window — it's already inert while volumes are degraded
("Cannot auto-balance volume in degraded state" log spam) but remove
the controller pressure entirely.

Restore to concurrency=2 + replicaAutoBalance=best-effort once both ZFS
pools are resilvered and the rebuild backlog has drained.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
fix(longhorn): restore throttle to 2/node + best-effort auto-balance
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
93f21c61cb 
Both ZFS pools healthy (ssd-mirror resilvered 2026-04-28 with both Bestoss
disks ONLINE, hdd-mirror redundancy work tracked separately). Lifts the
emergency 1/node + auto-balance=disabled cap from 8bdfe9f.

Settles at 2/node (chart default is 5) because daytona's ZFS-backed pools
sustain ~30 MB/s sequential — the 2026-04-27 incident proved 5 saturates
the spindle and triggers an EROFS storm.
fix(longhorn): single-replica defaults + restore salvage lever
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
fc8d5e2ced 
After 2026-04-30 plane recovery: 4 postgres restore attempts on a 17 GB
pg_dumpall failed with EROFS partway, on bitnami AND CNPG storage classes.
Root cause is structural: 2-replica Longhorn on top of a single ZFS
mirror doubles write I/O for zero fault tolerance gain (single Proxmox
host). Replica rebuilds during the writes saturate the SSDs and cause
guest filesystems to remount read-only.

Changes (per Longhorn specialist + architect review):
- defaultReplicaCount: 2 -> 1, persistence.defaultClassReplicaCount: 2 -> 1
  (kills phantom redundancy)
- replicaAutoBalance: best-effort -> disabled
  (rebalances trigger I/O storms; ZFS handles physical layout)
- concurrentReplicaRebuildPerNodeLimit: 2 -> 1
  (postgres can keep WAL flushed during rebuild)
- disableRevisionCounter: implicit-true -> explicit false
  (restores salvage lever lost during plane-pgdb 2026-04-29)
- engineReplicaTimeout: 8 -> 15
  (tolerates fsync stalls under SSD-mirror saturation)
- longhorn-db SC: numberOfReplicas 2 -> 1, disableRevisionCounter false

This is forward-only on Longhorn-managed defaults. Existing volumes
keep their current spec.numberOfReplicas; we'll bulk-patch them in a
follow-up step after these settings sync.

Refs HOMELAB-1003 (postmortem).
cnpg-cluster: disable WAL archiving to stay under B2 transaction cap
Some checks failed
0/0 projects applied successfully.
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
151bb46764 
Continuous WAL shipping across 7+ CNPG clusters was exhausting the
Backblaze B2 free tier Class C transaction cap (2,500/day). Daily
base backups via ScheduledBackup still run — PITR is now limited
to the last base backup instead of any point in time.
Revert "cnpg-cluster: disable WAL archiving to stay under B2 transaction cap"
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
01aaad86bb 
This reverts commit 151bb46764.
fix(langfuse): increase ClickHouse memory 5Gi → 8Gi
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
6e0af920c9 
Dashboard queries (traces FINAL LEFT JOIN observation_stats) still OOM
after OPTIMIZE TABLE compaction. The query materializes ~4.5 GiB intermediate
results. Observations ARE being ingested successfully (verified last write
2026-05-10 20:18 UTC). Only the query needs more headroom.

Refs: HOMELAB-1052
HOMELAB-1053: remove lab-director — chart, manifests, ESO, ArgoCD RBAC, OTel + dormant refs
Some checks are pending
CI Review / pr-title (pull_request) Waiting to run
Details
CI Review / helm-validate (pull_request) Waiting to run
Details
CI Review / ai-review (pull_request) Waiting to run
Details
Lint & Validate / terraform-validate (pull_request) Waiting to run
Details
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
0/0 projects applied successfully.
de38095e02 
- Delete lab-director Helm chart (core/charts/apps/lab-director/)
- Delete orphan LB Service manifest (lab-director-pg-lb.yaml)
- Delete worker ExternalSecrets (es-lab-director-worker.yaml)
- Remove lab-director ExternalSecret doc from es-cnpg-b2.yaml (6 remaining namespaces)
- Remove lab-director ArgoCD RBAC policy.csv entries (4 lines)
- Remove lab-director from OTel collector span filter
- Clean dormant sandbox chart refs: LAB_DIRECTOR_API_URL, image registry, CNP egress allow
- Clean dormant dev-environment chart ref: Harbor image path

MUST be merged AFTER prod PR has merged AND ArgoCD has pruned lab-director/cnpg-cluster-lab-director.
Confirm 'argocd app list | grep lab-director' returns empty before merging.
HOMELAB-1053: amend — retire NATS chart, delete missed ExternalSecret
Some checks failed
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
3e3031562e 
- Delete core/manifests/external-secrets/es-lab-director-argocd.yaml (missed in initial scan; would cause external-secrets-config app to go Degraded after ns deletion)
- Delete core/charts/apps/nats/values.yaml (NATS retired alongside lab-director)
- Delete core/charts/platform/nats/values.yaml (duplicate NATS values overlay)
Reviewed-on: #203
feat(forgejo): enable SSH access on port 22
Some checks failed
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
b9746f9af3 
Enable Forgejo SSH service, configure SSH_DOMAIN and SSH_PORT in Helm
values, add TCP listener on port 22 to the homelab gateway, and create
a TCPRoute to route SSH traffic to the forgejo-ssh service.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-on: #204
Reviewed-by: Aaron Reynoza <aaron@reynoza.org>
HOMELAB-1056: add data_disk_discard, ignore image size drift
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
a19cbf2551
feat(alerts): add CNPGWALArchiveFailing + remove outline exclusion
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
46b589d5a4 
Adds CNPGWALArchiveFailing alert that fires when WAL archiving
is retrying but continuously failing (e.g. barman exit status 4
due to B2 storage cap). The existing CNPGBackupFailing only
catches when archiving is completely stopped (is_archiving==0).

Also removes the arbitrary namespace!="outline" exclusion from
CNPGLastBackupOld so Outline clusters are monitored too.

Refs: incident 2026-05-12 B2 cap depletion
HOMELAB-1056: switch overwrite=false, remove ignore_changes on Talos images
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
be0ec14f9c 
Setting overwrite=false stops the perpetual force-replacement cycle caused
by the provider comparing compressed URL Content-Length against decompressed
datastore size. ignore_changes=[size] was ineffective (size is provider-computed).
feat(paperclip): add infrastructure manifests for HOM-7
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
55bcf95fab 
- Add paperclip Helm chart (PVC, CiliumNetworkPolicy, secrets, service, deployment stub)
- Add HTTPRoute for paperclip.aaron.reynoza.org in gateway routes

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Infrastructure prep for Paperclip on Homelab (HOM-7).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
fix(paperclip): correct CiliumNetworkPolicy template syntax (HOM-7)
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
0abd2cd0de 
- Simplify template to hardcoded rules matching sandbox pattern
- Remove over-templating that produced invalid YAML
- Clean up values.yaml to match simplified template

Co-Authored-By: Paperclip <noreply@paperclip.ing>
fix(paperclip): use fromEntities: cluster for cross-namespace ingress (HOM-8)
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
685893229f 
The CiliumNetworkPolicy CRD rejects '*' as a value for
io.kubernetes.pod.namespace in matchLabels. Switch to
fromEntities: - cluster to allow all in-cluster pods to reach
the Paperclip API on port 3100.

Refs: HOM-8
- Change app port from 3100 to 8080 (lab-director backend listens on 8080)
- Update CiliumNetworkPolicy ingress port to 8080
- Fix DATABASE_URL env var name (was PAPERCLIP_DATABASE_URL)
- Remove unused PAPERCLIP_AGENT_JWT_SECRET env var
- Update HTTPRoute backend port to 8080

Refs: HOM-13
feat(paperclip): complete Helm chart for HOM-14
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
660acb574f 
- Revert HOM-13 incorrect port changes (8080 → 3100) in HTTPRoute and CiliumNetworkPolicy
- Parameterize CiliumNetworkPolicy ingress port via .Values.port
- Add ServiceAccount template and helper
- Rewrite deployment with:
  - Proper security contexts (pod and container level)
  - Liveness, readiness, and startup probes on /api/health
  - Complete Paperclip env vars (deployment mode, public URL, storage, etc.)
  - DATABASE_URL from CNPG secret
  - PAPERCLIP_AGENT_JWT_SECRET and BETTER_AUTH_SECRET support
  - Correct volume mount: /paperclip (was /data)
  - Master key secret mounted as file at /paperclip/instances/default/secrets/master.key
  - Recreate strategy for RWO PVC safety
- Update service to use .Values.service.type and .Values.service.port
- Add betterAuthSecret placeholder to secret template
- Chart metadata: version 0.2.0, appVersion v2026.529.0
fix(paperclip): add rollingUpdate: null to Recreate strategy
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
d37ca1dd84 
Kubernetes requires explicit rollingUpdate: null when switching
a Deployment from RollingUpdate to Recreate strategy.

Refs: HOM-15
Co-Authored-By: Paperclip <noreply@paperclip.ing>
feat(observability): connect pi-otel-telemetry to homelab stack
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
e05c29f559 
- Add Gateway API HTTPRoute for otel.aaron.reynoza.org -> otel-collector:4318
- Add Agent Telemetry Grafana dashboard (TraceQL panels)
- Add Tempo datasource uid 'tempo' and search.hide=false
- Add metrics_generator to Tempo for TraceQL metrics support
- Refs: HOMELAB-1092
fix(tempo): remove broken metricsGenerator config that caused CrashLoopBackOff
Some checks failed
0/0 projects applied successfully.
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
bf74eee8ba 
The overrides.defaults.metrics_generator field is not valid for Tempo v2.6.1,
causing all modules to fail. Removing the metricsGenerator block restores
Tempo to working order. TraceQL basic queries work without metrics_generator;
span-metrics aggregation will be added in a follow-up.

Refs: HOMELAB-1092
HOMELAB-1096: add Pi Sessions Grafana dashboard
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
Release / release (pull_request) Has been cancelled
Details
f287a4b7a0
HOMELAB-1096: add Pi Tools, Pi LLM & Performance dashboards; fix Agent Telemetry
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
06dccf136c
HOMELAB-1096: fix Prometheus remote-write-receiver config
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
6a5ab352b0
HOMELAB-1096: rewrite dashboards with PromQL for stats/time series
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
db2110b2da
HOMELAB-1096: fix dashboard YAML indentation
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
6e5c990892
fix(ansible): create operator user, populate inventory, allow package downgrades
Some checks failed
0/0 projects applied successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
Release / release (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
5d0358b1cf
fix(paperclip): use exec probes to avoid CSRF 403, add TCPRoute CRD
Some checks are pending
CI Review / pr-title (pull_request) Waiting to run
Details
CI Review / helm-validate (pull_request) Waiting to run
Details
CI Review / ai-review (pull_request) Waiting to run
Details
Lint & Validate / terraform-validate (pull_request) Waiting to run
Details
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
0/0 projects applied successfully.
49031011d9 
- Switch health probes from httpGet to exec (curl localhost)
  Paperclip's authenticated mode CSRF validation rejects kubelet
  HTTP probes that use pod IP as Host header → returns 403.
  exec probes using curl localhost bypass the origin check.

- Add TCPRoute CRD (gateway.networking.k8s.io)
  The forgejo-ssh TCPRoute was blocking the gateway ArgoCD sync
  because the CRD was never installed. Added tcproutes.yaml from
  upstream Gateway API experimental channel.

- Bump forgejo-ssh TCPRoute from v1alpha2 to v1
  Matches the storage version served by the CRD.

Ref: HOMELAB-1097
Merge branch 'live' into plane/HOMELAB-1097-fix-db-permissions
Some checks failed
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
56219545ac 
Reviewed-on: #223
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add comprehensive analysis of OpenTelemetry trace identification
for multi-host pi deployments. Evaluates 4 approaches, recommends
auto-detecting hostname via custom NodeTracerProvider passed to
Openlit.init().

Refs: HOMELAB-1102
fix(ansible): update mgmt VM docs and config for admin user
Some checks failed
0/0 projects applied successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Release / release (pull_request) Has been cancelled
Details
302539028b 
- Change Ansible inventory from operator to admin
- Update mgmt-base role to use admin instead of operator
- Update sshd_config to allow admin and paperclip-operator
- Update forgejo-runner service to use admin
- Update mgmt-vm-setup runbook with correct IPs and user

Refs: HOMELAB-1099
aaron commented 2026-06-12 01:55:31 +00:00
Author
Owner
Copy link

Closing — recreated as #225 targeting live branch.

Closing — recreated as #225 targeting `live` branch.
aaron closed this pull request 2026-06-18 04:31:59 +00:00
Some checks failed
0/0 projects applied successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Release / release (pull_request) Has been cancelled
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!224
No description provided.