2026-08-05 - 2026-11-05
Overview
234 Pull requests merged by 2 users
Merged
#574 Require tokens for artifactapi uploads
Merged
#573 Bump artifactapi to v3.25.0
Merged
#572 Bump artifactapi to v3.24.0
Merged
#571 bump artifactapi to v3.23.0
Merged
#570 bump artifactapi to v3.22.0
Merged
#569 bind-resolvers: RBL zones as BindZones
Merged
#568 bump artifactapi to v3.21.0
Merged
#567 Deploy encapi v0.2.0 with Vault OIDC
Merged
#566 Raise puppet-postgres memory
Merged
#565 bump artifactapi to v3.20.0
Merged
#563 bump artifactapi to v3.19.0
Merged
#562 bump artifactapi to v3.18.0
Merged
#561 bump artifactapi to v3.17.1
Merged
#560 bump artifactapi to v3.16.0
Merged
#559 bump artifactapi to v3.15.0
Merged
#558 bind-operator: v0.4.0
Merged
#556 mail: use real edge MTA public IPs
Merged
#557 bind-internal: add mail edge A records
Merged
#555 bind-resolvers: forward to public resolvers, RBLs direct
Merged
#554 Allow the bne dmz vpc in the resolver dmz acl
Merged
#553 bind-resolvers: stop querying IPv6 nameservers
Merged
#552 Enable Vault OIDC auth on artifactapi config writes
Merged
#551 Move resolver DMZ ACL to the RFC 1918 mail VPC ranges
Merged
#548 Verify smarthost edge relays against the internal CA
Merged
#550 Add main.unkin.net as a second mail domain
Merged
#544 Route rspamd-tagged mail to Junk through Stalwart's spam filter
Merged
#545 Allow BinaryLane DMZ VPCs in resolver ACL
Merged
#549 Give stalwart-apply a writable HOME
Merged
#547 Terminate haproxy edge TLS at Traefik
Merged
#539 Deploy Stalwart into the mail namespace
Merged
#546 Recurse from root hints on bind-resolvers
Merged
#542 Add rspamd, ClamAV and sentinel Valkey to the mail namespace
Merged
#541 Add postfix smarthost to the mail namespace
Merged
#543 bind-internal: point mail.unkin.net at 198.18.200.18
Merged
#540 Add internal mail.unkin.net A record
Merged
#538 Add mail namespace with Stalwart backing stores
Merged
#537 Add terraform-binarylane woodpecker service account
Merged
#536 Bump pdbmux to v0.5.0
Merged
#535 add artifactapi image-keeper daemonset
Merged
#534 bump artifactapi to v3.13.1
Merged
#532 pin artifactapi back to v3.12.0
Merged
#529 Bump artifactapi to v3.13.0
Merged
#530 consul: remove standalone k8s consul
Merged
#527 kea: bump to v0.1.7 from docker-internal
Merged
#528 consul: pull chart via artifactapi helm mirror
Merged
#525 logging: expose vlselect on internal traefik
Merged
#526 authentik: raise server cpu request to 500m
Merged
#524 Raise puppetserver compiler requests to match real usage
Merged
#523 feat(bind-internal): publish haproxy edge sites from k8s DNS
Merged
#522 Serve grafana.unkin.net from traefik-external
Merged
#521 Bump artifactapi to v3.12.0
Merged
#520 Set traefik resource requests so HPAs can scale
Merged
#519 Set traefik-external externalTrafficPolicy to Local
Merged
#518 Drop git.unkin.net from k8s gitea gateway and routes
Merged
#517 vmagent: raise kubernetes-apiservers max_scrape_size to 64MiB
Merged
#516 vmagent: fix consul target address relabel
Merged
#515 vmagent: cap consul SD wait time under nginx timeout
Merged
#514 Rename the terraform-infra CI ServiceAccount to terraform-netbox
Merged
#513 Add k8up Grafana dashboard
Merged
#512 Scrape k8up operator metrics
Merged
#511 feat(grafana): sync kubernetes dashboards from victoria-metrics-k8s-stack
Merged
#510 grafana: drop alerting Service and POD_IP env owned by grafana-operator
Merged
#509 grafana: enable unified alerting HA gossip
Merged
#508 grafana: scale to 3 replicas, raise limits
Merged
#507 Give vlogs its own namespace
Merged
#506 Collect pod logs with VLAgent, retire the NATS/ClickHouse chain
Merged
#505 Drop obsolete vector-test CI pipeline
Merged
#503 Promote bind-operator to v0.3.1
Merged
#504 Redirect vlogs root to the VictoriaLogs UI
Merged
#501 Split bind-internal DNSRecords into one file per record
Merged
#500 Split bind-external DNSRecords into one file per record
Merged
#498 Expose VictoriaLogs UI at vlogs.unkin.net behind oauth2-proxy
Merged
#499 Drop the gocache serve Deployment and nginx sidecar
Merged
#488 Add a VictoriaLogs cluster and point logs-ingest at it
Merged
#496 Add gocache serve Deployment with nginx stream sidecar
Merged
#495 Declare the acme.unkin.net nameservers
Merged
#494 Roll bind-operator to v0.3.0
Merged
#493 bump victoria-metrics-operator chart to 0.67.3
Merged
#492 Move the haproxy edge behind the external Traefik
Merged
#491 Drop stalwart mail proxying from the haproxy edge
Merged
#489 Add Ceph RGW bucket for the shared Go build cache
Merged
#490 Add job and start deadlines to the g10k-code CronJob
Merged
#487 Drop dead X-Frame-Options rules from the haproxy edge
Merged
#485 Move the au-syd1 haproxy edge into Kubernetes
Merged
#486 Publish real delegation records for acme.unkin.net
Merged
#484 Add *.main and *.ceph wildcard certificates for haproxy
Merged
#482 Give the puppetserver compilers the Vault cert helpers
Merged
#483 Bump jellyfin-ha to v0.4.0
Merged
#481 Roll jellyfin-ha to v0.3.3 and drop Service session affinity
Merged
#480 Roll bind-operator to v0.2.7 (journal-aware zone seeding)
Merged
#479 Add woodpecker ServiceAccount for jellyfin-plugin-sso CI
Merged
#478 Rewrite slash-less Authentik token endpoint to the canonical path
Merged
#477 Enable PKCE for ArgoCD OIDC login
Merged
#476 Add VMPodScrape for authentik-server metrics
Merged
#475 Enable pg_stat_statements on the authentik postgres cluster
Merged
#474 Raise authentik postgres CPU, memory and buffer sizing
Merged
#473 Enable hot_standby_feedback on the authentik postgres cluster
Merged
#471 Auto-reload cheeztv and fafflix on plugin ConfigMap change
Merged
#470 Point jellyfin SSO at public Authentik hostname
Merged
#468 Pin jellyfin-ha image to v0.3.2
Merged
#467 puppet: install toml into the puppetserver gem path
Merged
#466 Pin pdbmux to v0.4.0
Merged
#465 Revert jellyfin-ha to v0.2.0
Merged
#464 pdbmux: bump image to v0.3.0
Merged
#463 jellyfin: bump fafflix+cheeztv to v0.3.1
Merged
#462 allow catalog-diff to compile catalogs on the puppet compilers
Merged
#461 revert jellyfin-ha to v0.2.0
Merged
#460 bump jellyfin-ha to v0.3.0
Merged
#459 woodpecker: raise agent workspace PVC to 20Gi
Merged
#458 artifactapi: restore combine-certs + PROVIDER_CA_FILES on oauth2-proxy
Merged
#456 Put the artifactapi web UI behind Authentik oauth2-proxy
Merged
#455 pdbmux: bump image to v0.2.0
Merged
#453 Bump artifactapi to v3.11.2
Merged
#452 pdbmux: order backends new-first and drop primary/prefer
Merged
#454 woodpecker: add vimpack-ci ServiceAccount
Merged
#451 puppet: use OPENVOXSERVER_JAVA_ARGS for puppetserver JVM args
Merged
#450 Bump encapi image to v0.1.2
Merged
#449 Set puppetserver environment timeout to 0
Merged
#448 Bump arrproxy images to v0.6.1
Merged
#447 Add golib-ci ServiceAccount for woodpecker
Merged
#446 Bump repospawner to v0.1.1
Merged
#445 Deploy repospawner v0.1.0
Merged
#444 arrproxy: v0.6.0 self-migrating, drop external migrate Job
Merged
#441 mediamark: deploy the media marking app
Merged
#443 arrproxy: bump images to v0.5.0 (per-token method scoping)
Merged
#442 woodpecker: add repospawner-ci ServiceAccount
Merged
#433 logging: use canonical upstream image names
Merged
#437 valkey-operator-system: use canonical ghcr.io registry
Merged
#440 grafana: stop pinning the internal CA for Authentik OAuth
Merged
#439 argocd: drop internal-CA rootCA pin from Authentik oidc.config
Merged
#438 woodpecker: add mediamark-ci service account
Merged
#436 clickhouse-system: use canonical upstream image names
Merged
#435 watchstate: use canonical upstream image name for alpine
Merged
#434 netbox: use canonical upstream image name for redis_exporter
Merged
#432 litellm: use canonical upstream image name for redis_exporter
Merged
#431 gitea: use canonical upstream image name for redis_exporter
Merged
#430 authentik: use canonical upstream image name for redis_exporter
Merged
#429 artifactapi: use canonical upstream image name for redis_exporter
Merged
#428 arrstack,fafflix,cheeztv: provision shared mediastore CephFS volume
Merged
#427 arrstack: use canonical upstream image names
Merged
#424 fafflix,cheeztv: declarative SSO + LDAP plugin auth config
Merged
#426 jellyfin: bump fafflix+cheeztv to v0.2.0
Merged
#425 kea-operator: bump to v0.1.5
Merged
#423 kea-operator: bump to v0.1.4
Merged
#422 authentik: deploy LDAP outpost for in-cluster app-password binds
Merged
#420 watchstate: expose externally at watchstate.unkin.net
Merged
#421 bind-internal: add cheeztv.unkin.net record
Merged
#418 Extend LE *.unkin.net wildcard to arrstack + authentik (reflect into gitea)
Merged
#419 watchstate: deploy admin-gated jellyfin watch-state sync tool
Merged
#417 cheeztv: terminate public cheeztv.unkin.net TLS with the LE *.unkin.net wildcard
Merged
#416 arrstack: wire arrproxy v0.4.0 tier routing (fafflix/cheeztv)
Merged
#415 Replace legacy jellyfin app with fafflix (adult, cheeztv pattern)
Merged
#414 arrstack: rebuild adult tier on the shared-Postgres pattern
Merged
#413 Add cheeztv kids Jellyfin instance + fafflix kids mounts
Merged
#412 arrstack: add kids backend tier (sonarr/radarr/nzbget-kids)
Merged
#411 arrproxy: bump images to v0.3.1
Merged
#410 authentik: ClientIP session affinity on server service
Merged
#379 arrstack: repoint arrproxy oauth2-proxy image off ghcr (fix ImagePullBackOff)
Merged
#409 logging: set clickhouse readonly profile to readonly=2
Merged
#408 arrstack: raise arrstack-postgres resources after OOMKills
Merged
#407 Add Traefik Grafana dashboard
Merged
#406 arrproxy: bump image versions to v0.3.0
Merged
#405 Add logviewer.unkin.net internal DNS record
Merged
#399 observability: fix dropped kubelet/cadvisor metrics, add kube-state-metrics + VMAlert k8s.rules
Merged
#398 Export and scrape metrics from all redis/valkey instances
Merged
#404 logging: deploy logviewer v0.1.0 behind oauth2-proxy
Merged
#403 Bump radarr to v6.4.2-unkin7
Merged
#402 Bump prowlarr to v2.6.2-unkin6
Merged
#400 logging: add read-only clickhouse logreader user + Vault-synced secret
Merged
#401 Bump arrstack image pins: radarr v6.4.2-unkin6, sonarr v5.0.0-unkin6
Merged
#397 Scrape traefik gateway metrics into VictoriaMetrics
Merged
#396 Add Redis/Valkey Grafana dashboard
Merged
#394 Add shared arrstack Valkey and wire arr apps' Redis features
Merged
#395 arrstack: add exportarr metrics sidecars to sonarr and radarr
Merged
#393 Deploy mediamover v0.1.0 into arrstack
Merged
#392 Deploy arrstack S3 TLS-trust fix (arrstack images -unkin4 -> -unkin5)
Merged
#391 Mount mediafs CephFS into arrstack
Merged
#390 arrstack: deploy -unkin4 (Redis SignalR backplane + S3 storage)
Merged
#389 arrstack: S3 buckets + wiring for app backups and sonarr MediaCover
Merged
#388 Deploy arrstack -unkin3 (active-active code)
Merged
#387 arrstack: provision shared Ceph RGW bucket for media assets
Merged
#386 arrstack: use waitfordb initContainer instead of inline psql loop
Merged
#385 arrstack: fix sync-wave deadlock + config multi-attach
Merged
#384 Deploy arrproxy v0.2.0 machine-mint admin route
Merged
#383 arrstack: run sonarr/radarr/prowlarr active-active on shared Postgres
Merged
#382 arrstack: set *arr AuthenticationMethod=External (proxy-trusted)
Merged
#381 arrproxy: allow unverified email in oauth2-proxy (Authentik sets email_verified=false)
Merged
#380 arrproxy: use real quay.io oauth2-proxy address (rke2 mirror)
Merged
#378 arrstack: set *arr UrlBase=/<app> for path-based proxy hosting
Merged
#377 deploy arrproxy (oauth2-gated *arr proxy + per-user API keys)
Merged
#376 woodpecker: add arrproxy-ci service account
Merged
#375 jellyfin: make Valkey HA
Merged
#374 jellyfin: bump image to v0.1.3 (.NET 9 runtime fix)
Merged
#373 jellyfin: bump image to v0.1.2
Merged
#372 ghp: deploy service-token fork image + wire GHP_AUTH_SERVICE_TOKENS
Merged
#371 woodpecker: allow CA-baked docker-buildx plugin as privileged
Merged
#370 arrstack/nzbget: fix nonexistent image tag v26.2 -> version-v26.2
Merged
#369 arrstack: manage sonarr/radarr/prowlarr API keys via Vault
Merged
#368 woodpecker: add plugin-docker-buildx CI ServiceAccount
Merged
#366 arrstack: sonarr/radarr/prowlarr/nzbget on shared CephFS media
Merged
#367 jellyfin: replace redis Deployment with valkey-operator instance
Merged
#237 Deploy jellyfin-ha as a true-HA StatefulSet under a new media project
Merged
#365 Install valkey-operator
Merged
#364 woodpecker: add ghp CI ServiceAccount
Merged
#363 Deploy k8up backup operator (platform, k8up-system)
Merged
#362 woodpecker: add autobackup-operator CI ServiceAccount
Merged
#361 ghp: serve plain HTTP behind the gateway (fix redirect loop)
Merged
#360 ghp: serve at ghp.unkin.net (gateway + cert + httproute + DNS)
Merged
#359 ghp: use direct ghcr.io image + set GHP_ADMINS
Merged
#357 add ghp (GitHub proxy) deployment
Merged
#358 artifactapi: bump image to v3.11.1
Merged
#356 artifactapi: bump image to v3.11.0
Merged
#355 artifactapi: bump image to v3.10.1
Merged
#354 artifactapi: bump images to v3.10.0 (apk repo support + UI)
Merged
#353 artifactapi: bump images to v3.9.1 (deb repo support + UI)
Merged
#352 woodpecker: add jellyfin-ha-src CI ServiceAccount
Merged
#351 Bump artifactapi to v3.8.0
Merged
#349 Force Replace sync for the Recreate puppet master to clear stale rollingUpdate
Merged
#350 Ignore defaulted StatefulSet volumeClaimTemplates TypeMeta
Merged
#347 Fix cert-manager recursive-nameserver ControllerConfiguration field
Merged
#346 Wire API_TOKEN_PEPPERS into NetBox config
Merged
#344 Bump kea images to v0.1.3 (HA peer DNS startup wait)
Merged
#345 traefik-internal: add ldaps :636 entrypoint for authentik LDAPS
Merged
#319 puppet: reduce privilege in namespace workloads (#307)
Merged
#343 Bump kea images to v0.1.2 (socket dir 0750 fix)
Merged
#320 Add Tier-2 per-app Vector transform pipelines (structured logs)
Merged
#342 puppetdb: isolate only the stockpile queue per pod (fix #340 crashloop)
Merged
#340 puppetdb: unique per-pod command-queue directory
Merged
#341 Pin puppet master to a single Recreate replica
Merged
#339 Enable Reloader secret watching, scope existing auto to configmap-only (#326)
Merged
#338 Fix kea CrashLoopBackOff: drop DHCP ntp hostnames, bump to v0.1.1
Merged
#337 Point cert-manager DNS-01 at public recursive nameservers
Merged
#336 artifactapi: serve plain HTTP without HTTPS redirect
Merged
#335 Rename terraform-ipam CI ServiceAccount -> terraform-infra
5 Pull requests proposed by 1 user
Proposed
#472 Pin helm capabilities version to the validation target
Proposed
#502 Drop the redundant acme.unkin.net apex NS DNSRecord
Proposed
#531 consul: add k8s servers joining the au-syd1 VM datacenter
Proposed
#533 forward consul zone to k8s consul DNS LB
Proposed
#564 Add public main.unkin.net and edge.unkin.net zones to bind-external
2 Issues closed from 1 user
Closed
#307 security: reduce privilege in puppet namespace workloads (root init containers, redundant caps, APE)
Closed
#326 CA-rotation runbook for internal PKI rotation
2 Unresolved Conversations
Open
#325
Woodpecker k8s runner: trust the internal CA so buildx can push to artifactapi
Open
#323
Decommission the legacy standalone ceph-csi namespace