2026-08-01 - 2026-09-01
Overview
123 Pull requests merged by 2 users
Merged
#447 Add golib-ci ServiceAccount for woodpecker
Merged
#446 Bump repospawner to v0.1.1
Merged
#445 Deploy repospawner v0.1.0
Merged
#444 arrproxy: v0.6.0 self-migrating, drop external migrate Job
Merged
#441 mediamark: deploy the media marking app
Merged
#443 arrproxy: bump images to v0.5.0 (per-token method scoping)
Merged
#442 woodpecker: add repospawner-ci ServiceAccount
Merged
#433 logging: use canonical upstream image names
Merged
#437 valkey-operator-system: use canonical ghcr.io registry
Merged
#440 grafana: stop pinning the internal CA for Authentik OAuth
Merged
#439 argocd: drop internal-CA rootCA pin from Authentik oidc.config
Merged
#438 woodpecker: add mediamark-ci service account
Merged
#436 clickhouse-system: use canonical upstream image names
Merged
#435 watchstate: use canonical upstream image name for alpine
Merged
#434 netbox: use canonical upstream image name for redis_exporter
Merged
#432 litellm: use canonical upstream image name for redis_exporter
Merged
#431 gitea: use canonical upstream image name for redis_exporter
Merged
#430 authentik: use canonical upstream image name for redis_exporter
Merged
#429 artifactapi: use canonical upstream image name for redis_exporter
Merged
#428 arrstack,fafflix,cheeztv: provision shared mediastore CephFS volume
Merged
#427 arrstack: use canonical upstream image names
Merged
#424 fafflix,cheeztv: declarative SSO + LDAP plugin auth config
Merged
#426 jellyfin: bump fafflix+cheeztv to v0.2.0
Merged
#425 kea-operator: bump to v0.1.5
Merged
#423 kea-operator: bump to v0.1.4
Merged
#422 authentik: deploy LDAP outpost for in-cluster app-password binds
Merged
#420 watchstate: expose externally at watchstate.unkin.net
Merged
#421 bind-internal: add cheeztv.unkin.net record
Merged
#418 Extend LE *.unkin.net wildcard to arrstack + authentik (reflect into gitea)
Merged
#419 watchstate: deploy admin-gated jellyfin watch-state sync tool
Merged
#417 cheeztv: terminate public cheeztv.unkin.net TLS with the LE *.unkin.net wildcard
Merged
#416 arrstack: wire arrproxy v0.4.0 tier routing (fafflix/cheeztv)
Merged
#415 Replace legacy jellyfin app with fafflix (adult, cheeztv pattern)
Merged
#414 arrstack: rebuild adult tier on the shared-Postgres pattern
Merged
#413 Add cheeztv kids Jellyfin instance + fafflix kids mounts
Merged
#412 arrstack: add kids backend tier (sonarr/radarr/nzbget-kids)
Merged
#411 arrproxy: bump images to v0.3.1
Merged
#410 authentik: ClientIP session affinity on server service
Merged
#379 arrstack: repoint arrproxy oauth2-proxy image off ghcr (fix ImagePullBackOff)
Merged
#409 logging: set clickhouse readonly profile to readonly=2
Merged
#408 arrstack: raise arrstack-postgres resources after OOMKills
Merged
#407 Add Traefik Grafana dashboard
Merged
#406 arrproxy: bump image versions to v0.3.0
Merged
#405 Add logviewer.unkin.net internal DNS record
Merged
#399 observability: fix dropped kubelet/cadvisor metrics, add kube-state-metrics + VMAlert k8s.rules
Merged
#398 Export and scrape metrics from all redis/valkey instances
Merged
#404 logging: deploy logviewer v0.1.0 behind oauth2-proxy
Merged
#403 Bump radarr to v6.4.2-unkin7
Merged
#402 Bump prowlarr to v2.6.2-unkin6
Merged
#400 logging: add read-only clickhouse logreader user + Vault-synced secret
Merged
#401 Bump arrstack image pins: radarr v6.4.2-unkin6, sonarr v5.0.0-unkin6
Merged
#397 Scrape traefik gateway metrics into VictoriaMetrics
Merged
#396 Add Redis/Valkey Grafana dashboard
Merged
#394 Add shared arrstack Valkey and wire arr apps' Redis features
Merged
#395 arrstack: add exportarr metrics sidecars to sonarr and radarr
Merged
#393 Deploy mediamover v0.1.0 into arrstack
Merged
#392 Deploy arrstack S3 TLS-trust fix (arrstack images -unkin4 -> -unkin5)
Merged
#391 Mount mediafs CephFS into arrstack
Merged
#390 arrstack: deploy -unkin4 (Redis SignalR backplane + S3 storage)
Merged
#389 arrstack: S3 buckets + wiring for app backups and sonarr MediaCover
Merged
#388 Deploy arrstack -unkin3 (active-active code)
Merged
#387 arrstack: provision shared Ceph RGW bucket for media assets
Merged
#386 arrstack: use waitfordb initContainer instead of inline psql loop
Merged
#385 arrstack: fix sync-wave deadlock + config multi-attach
Merged
#384 Deploy arrproxy v0.2.0 machine-mint admin route
Merged
#383 arrstack: run sonarr/radarr/prowlarr active-active on shared Postgres
Merged
#382 arrstack: set *arr AuthenticationMethod=External (proxy-trusted)
Merged
#381 arrproxy: allow unverified email in oauth2-proxy (Authentik sets email_verified=false)
Merged
#380 arrproxy: use real quay.io oauth2-proxy address (rke2 mirror)
Merged
#378 arrstack: set *arr UrlBase=/<app> for path-based proxy hosting
Merged
#377 deploy arrproxy (oauth2-gated *arr proxy + per-user API keys)
Merged
#376 woodpecker: add arrproxy-ci service account
Merged
#375 jellyfin: make Valkey HA
Merged
#374 jellyfin: bump image to v0.1.3 (.NET 9 runtime fix)
Merged
#373 jellyfin: bump image to v0.1.2
Merged
#372 ghp: deploy service-token fork image + wire GHP_AUTH_SERVICE_TOKENS
Merged
#371 woodpecker: allow CA-baked docker-buildx plugin as privileged
Merged
#370 arrstack/nzbget: fix nonexistent image tag v26.2 -> version-v26.2
Merged
#369 arrstack: manage sonarr/radarr/prowlarr API keys via Vault
Merged
#368 woodpecker: add plugin-docker-buildx CI ServiceAccount
Merged
#366 arrstack: sonarr/radarr/prowlarr/nzbget on shared CephFS media
Merged
#367 jellyfin: replace redis Deployment with valkey-operator instance
Merged
#237 Deploy jellyfin-ha as a true-HA StatefulSet under a new media project
Merged
#365 Install valkey-operator
Merged
#364 woodpecker: add ghp CI ServiceAccount
Merged
#363 Deploy k8up backup operator (platform, k8up-system)
Merged
#362 woodpecker: add autobackup-operator CI ServiceAccount
Merged
#361 ghp: serve plain HTTP behind the gateway (fix redirect loop)
Merged
#360 ghp: serve at ghp.unkin.net (gateway + cert + httproute + DNS)
Merged
#359 ghp: use direct ghcr.io image + set GHP_ADMINS
Merged
#357 add ghp (GitHub proxy) deployment
Merged
#358 artifactapi: bump image to v3.11.1
Merged
#356 artifactapi: bump image to v3.11.0
Merged
#355 artifactapi: bump image to v3.10.1
Merged
#354 artifactapi: bump images to v3.10.0 (apk repo support + UI)
Merged
#353 artifactapi: bump images to v3.9.1 (deb repo support + UI)
Merged
#352 woodpecker: add jellyfin-ha-src CI ServiceAccount
Merged
#351 Bump artifactapi to v3.8.0
Merged
#349 Force Replace sync for the Recreate puppet master to clear stale rollingUpdate
Merged
#350 Ignore defaulted StatefulSet volumeClaimTemplates TypeMeta
Merged
#347 Fix cert-manager recursive-nameserver ControllerConfiguration field
Merged
#346 Wire API_TOKEN_PEPPERS into NetBox config
Merged
#344 Bump kea images to v0.1.3 (HA peer DNS startup wait)
Merged
#345 traefik-internal: add ldaps :636 entrypoint for authentik LDAPS
Merged
#319 puppet: reduce privilege in namespace workloads (#307)
Merged
#343 Bump kea images to v0.1.2 (socket dir 0750 fix)
Merged
#320 Add Tier-2 per-app Vector transform pipelines (structured logs)
Merged
#342 puppetdb: isolate only the stockpile queue per pod (fix #340 crashloop)
Merged
#340 puppetdb: unique per-pod command-queue directory
Merged
#341 Pin puppet master to a single Recreate replica
Merged
#339 Enable Reloader secret watching, scope existing auto to configmap-only (#326)
Merged
#338 Fix kea CrashLoopBackOff: drop DHCP ntp hostnames, bump to v0.1.1
Merged
#337 Point cert-manager DNS-01 at public recursive nameservers
Merged
#336 artifactapi: serve plain HTTP without HTTPS redirect
Merged
#335 Rename terraform-ipam CI ServiceAccount -> terraform-infra
Merged
#333 Deploy kea DHCP operator to dhcp-system
Merged
#334 Add terraform-ipam CI ServiceAccount
Merged
#332 Add agent-dns RBAC: static SA + ClusterRole + per-namespace RoleBindings
Merged
#331 Add cnameStrategy: Follow to ACME DNS-01 solvers
Merged
#330 Add kea-operator-ci ServiceAccount for Woodpecker CI
Merged
#328 Import live vault-issuer ClusterIssuer into GitOps
Merged
#329 Add bind-external namespace for externally-reachable zones
Merged
#327 Add Let's Encrypt RFC2136/TSIG ClusterIssuers
2 Issues closed from 1 user
Closed
#307 security: reduce privilege in puppet namespace workloads (root init containers, redundant caps, APE)
Closed
#326 CA-rotation runbook for internal PKI rotation
6 Issues created by 1 user
Opened
#322 geoip enrichment for nginx/traefik Vector access-log pipelines
Opened
#321 Gitea git.unkin.net production cutover (VM forge -> k8s)
Opened
#324 Finish the DNS migration off the Puppet zone to in-cluster bind
Opened
#325 Woodpecker k8s runner: trust the internal CA so buildx can push to artifactapi
Opened
#323 Decommission the legacy standalone ceph-csi namespace
Opened
#326 CA-rotation runbook for internal PKI rotation