2026-06-01 - 2026-09-01
Overview
253 Pull requests merged by 3 users
Merged
#447 Add golib-ci ServiceAccount for woodpecker
Merged
#446 Bump repospawner to v0.1.1
Merged
#445 Deploy repospawner v0.1.0
Merged
#444 arrproxy: v0.6.0 self-migrating, drop external migrate Job
Merged
#441 mediamark: deploy the media marking app
Merged
#443 arrproxy: bump images to v0.5.0 (per-token method scoping)
Merged
#442 woodpecker: add repospawner-ci ServiceAccount
Merged
#433 logging: use canonical upstream image names
Merged
#437 valkey-operator-system: use canonical ghcr.io registry
Merged
#440 grafana: stop pinning the internal CA for Authentik OAuth
Merged
#439 argocd: drop internal-CA rootCA pin from Authentik oidc.config
Merged
#438 woodpecker: add mediamark-ci service account
Merged
#436 clickhouse-system: use canonical upstream image names
Merged
#435 watchstate: use canonical upstream image name for alpine
Merged
#434 netbox: use canonical upstream image name for redis_exporter
Merged
#432 litellm: use canonical upstream image name for redis_exporter
Merged
#431 gitea: use canonical upstream image name for redis_exporter
Merged
#430 authentik: use canonical upstream image name for redis_exporter
Merged
#429 artifactapi: use canonical upstream image name for redis_exporter
Merged
#428 arrstack,fafflix,cheeztv: provision shared mediastore CephFS volume
Merged
#427 arrstack: use canonical upstream image names
Merged
#424 fafflix,cheeztv: declarative SSO + LDAP plugin auth config
Merged
#426 jellyfin: bump fafflix+cheeztv to v0.2.0
Merged
#425 kea-operator: bump to v0.1.5
Merged
#423 kea-operator: bump to v0.1.4
Merged
#422 authentik: deploy LDAP outpost for in-cluster app-password binds
Merged
#420 watchstate: expose externally at watchstate.unkin.net
Merged
#421 bind-internal: add cheeztv.unkin.net record
Merged
#418 Extend LE *.unkin.net wildcard to arrstack + authentik (reflect into gitea)
Merged
#419 watchstate: deploy admin-gated jellyfin watch-state sync tool
Merged
#417 cheeztv: terminate public cheeztv.unkin.net TLS with the LE *.unkin.net wildcard
Merged
#416 arrstack: wire arrproxy v0.4.0 tier routing (fafflix/cheeztv)
Merged
#415 Replace legacy jellyfin app with fafflix (adult, cheeztv pattern)
Merged
#414 arrstack: rebuild adult tier on the shared-Postgres pattern
Merged
#413 Add cheeztv kids Jellyfin instance + fafflix kids mounts
Merged
#412 arrstack: add kids backend tier (sonarr/radarr/nzbget-kids)
Merged
#411 arrproxy: bump images to v0.3.1
Merged
#410 authentik: ClientIP session affinity on server service
Merged
#379 arrstack: repoint arrproxy oauth2-proxy image off ghcr (fix ImagePullBackOff)
Merged
#409 logging: set clickhouse readonly profile to readonly=2
Merged
#408 arrstack: raise arrstack-postgres resources after OOMKills
Merged
#407 Add Traefik Grafana dashboard
Merged
#406 arrproxy: bump image versions to v0.3.0
Merged
#405 Add logviewer.unkin.net internal DNS record
Merged
#399 observability: fix dropped kubelet/cadvisor metrics, add kube-state-metrics + VMAlert k8s.rules
Merged
#398 Export and scrape metrics from all redis/valkey instances
Merged
#404 logging: deploy logviewer v0.1.0 behind oauth2-proxy
Merged
#403 Bump radarr to v6.4.2-unkin7
Merged
#402 Bump prowlarr to v2.6.2-unkin6
Merged
#400 logging: add read-only clickhouse logreader user + Vault-synced secret
Merged
#401 Bump arrstack image pins: radarr v6.4.2-unkin6, sonarr v5.0.0-unkin6
Merged
#397 Scrape traefik gateway metrics into VictoriaMetrics
Merged
#396 Add Redis/Valkey Grafana dashboard
Merged
#394 Add shared arrstack Valkey and wire arr apps' Redis features
Merged
#395 arrstack: add exportarr metrics sidecars to sonarr and radarr
Merged
#393 Deploy mediamover v0.1.0 into arrstack
Merged
#392 Deploy arrstack S3 TLS-trust fix (arrstack images -unkin4 -> -unkin5)
Merged
#391 Mount mediafs CephFS into arrstack
Merged
#390 arrstack: deploy -unkin4 (Redis SignalR backplane + S3 storage)
Merged
#389 arrstack: S3 buckets + wiring for app backups and sonarr MediaCover
Merged
#388 Deploy arrstack -unkin3 (active-active code)
Merged
#387 arrstack: provision shared Ceph RGW bucket for media assets
Merged
#386 arrstack: use waitfordb initContainer instead of inline psql loop
Merged
#385 arrstack: fix sync-wave deadlock + config multi-attach
Merged
#384 Deploy arrproxy v0.2.0 machine-mint admin route
Merged
#383 arrstack: run sonarr/radarr/prowlarr active-active on shared Postgres
Merged
#382 arrstack: set *arr AuthenticationMethod=External (proxy-trusted)
Merged
#381 arrproxy: allow unverified email in oauth2-proxy (Authentik sets email_verified=false)
Merged
#380 arrproxy: use real quay.io oauth2-proxy address (rke2 mirror)
Merged
#378 arrstack: set *arr UrlBase=/<app> for path-based proxy hosting
Merged
#377 deploy arrproxy (oauth2-gated *arr proxy + per-user API keys)
Merged
#376 woodpecker: add arrproxy-ci service account
Merged
#375 jellyfin: make Valkey HA
Merged
#374 jellyfin: bump image to v0.1.3 (.NET 9 runtime fix)
Merged
#373 jellyfin: bump image to v0.1.2
Merged
#372 ghp: deploy service-token fork image + wire GHP_AUTH_SERVICE_TOKENS
Merged
#371 woodpecker: allow CA-baked docker-buildx plugin as privileged
Merged
#370 arrstack/nzbget: fix nonexistent image tag v26.2 -> version-v26.2
Merged
#369 arrstack: manage sonarr/radarr/prowlarr API keys via Vault
Merged
#368 woodpecker: add plugin-docker-buildx CI ServiceAccount
Merged
#366 arrstack: sonarr/radarr/prowlarr/nzbget on shared CephFS media
Merged
#367 jellyfin: replace redis Deployment with valkey-operator instance
Merged
#237 Deploy jellyfin-ha as a true-HA StatefulSet under a new media project
Merged
#365 Install valkey-operator
Merged
#364 woodpecker: add ghp CI ServiceAccount
Merged
#363 Deploy k8up backup operator (platform, k8up-system)
Merged
#362 woodpecker: add autobackup-operator CI ServiceAccount
Merged
#361 ghp: serve plain HTTP behind the gateway (fix redirect loop)
Merged
#360 ghp: serve at ghp.unkin.net (gateway + cert + httproute + DNS)
Merged
#359 ghp: use direct ghcr.io image + set GHP_ADMINS
Merged
#357 add ghp (GitHub proxy) deployment
Merged
#358 artifactapi: bump image to v3.11.1
Merged
#356 artifactapi: bump image to v3.11.0
Merged
#355 artifactapi: bump image to v3.10.1
Merged
#354 artifactapi: bump images to v3.10.0 (apk repo support + UI)
Merged
#353 artifactapi: bump images to v3.9.1 (deb repo support + UI)
Merged
#352 woodpecker: add jellyfin-ha-src CI ServiceAccount
Merged
#351 Bump artifactapi to v3.8.0
Merged
#349 Force Replace sync for the Recreate puppet master to clear stale rollingUpdate
Merged
#350 Ignore defaulted StatefulSet volumeClaimTemplates TypeMeta
Merged
#347 Fix cert-manager recursive-nameserver ControllerConfiguration field
Merged
#346 Wire API_TOKEN_PEPPERS into NetBox config
Merged
#344 Bump kea images to v0.1.3 (HA peer DNS startup wait)
Merged
#345 traefik-internal: add ldaps :636 entrypoint for authentik LDAPS
Merged
#319 puppet: reduce privilege in namespace workloads (#307)
Merged
#343 Bump kea images to v0.1.2 (socket dir 0750 fix)
Merged
#320 Add Tier-2 per-app Vector transform pipelines (structured logs)
Merged
#342 puppetdb: isolate only the stockpile queue per pod (fix #340 crashloop)
Merged
#340 puppetdb: unique per-pod command-queue directory
Merged
#341 Pin puppet master to a single Recreate replica
Merged
#339 Enable Reloader secret watching, scope existing auto to configmap-only (#326)
Merged
#338 Fix kea CrashLoopBackOff: drop DHCP ntp hostnames, bump to v0.1.1
Merged
#337 Point cert-manager DNS-01 at public recursive nameservers
Merged
#336 artifactapi: serve plain HTTP without HTTPS redirect
Merged
#335 Rename terraform-ipam CI ServiceAccount -> terraform-infra
Merged
#333 Deploy kea DHCP operator to dhcp-system
Merged
#334 Add terraform-ipam CI ServiceAccount
Merged
#332 Add agent-dns RBAC: static SA + ClusterRole + per-namespace RoleBindings
Merged
#331 Add cnameStrategy: Follow to ACME DNS-01 solvers
Merged
#330 Add kea-operator-ci ServiceAccount for Woodpecker CI
Merged
#328 Import live vault-issuer ClusterIssuer into GitOps
Merged
#329 Add bind-external namespace for externally-reachable zones
Merged
#327 Add Let's Encrypt RFC2136/TSIG ClusterIssuers
Merged
#318 Add Tier-1 per-app Vector transform pipelines (structured logs)
Merged
#317 gitea: use git.k8s ROOT_URL for testing
Merged
#310 Pull in-estate service images from artifactapi docker-internal
Merged
#309 Add k8s Gitea deployment (migration target for git.unkin.net)
Merged
#316 cephrgw: recreate cnpg backup buckets on ec placement (step 3)
Merged
#315 cephrgw: remove cnpg backup buckets (ec migration step 2)
Merged
#314 Trust internal CA for Authentik SSO; canonical identity.unkin.net for NetBox
Merged
#313 cephrgw: allow purge-on-delete for cnpg backup buckets
Merged
#312 cephrgw v0.4.0; move CNPG backup buckets to ec placement
Merged
#311 Fix nats-bootstrap: run from /tmp so the nats CLI works under readOnlyRootFS
Merged
#308 Replace vector-archiver with logarchiver
Merged
#306 Fix NATS auth: wrap env-var passwords in << >> so the server expands them
Merged
#301 Fix logging deploy: enable Vector env interpolation; operator watches logging ns
Merged
#305 certificates: restore the validly-signed intermediate in vault-ca-cert
Merged
#304 Use full postgres image on minimal CNPG clusters so WAL archiving works
Merged
#303 Trust internal unkin.net CA for ArgoCD OIDC egress
Merged
#297 Bump Woodpecker CI to v3.16.0
Merged
#296 Add ClickHouse + Vector + NATS JetStream centralized logging (with S3 raw archive)
Merged
#300 authentik: raise CNPG postgres memory to stop replica OOMKills
Merged
#299 Deploy NetBox (CNPG Postgres, Valkey, Authentik SSO)
Merged
#298 Add S3 backups to all CNPG Postgres clusters
Merged
#295 Add PTR to external-dns managed record types
Merged
#294 Fix external-dns PTR flag (--create-ptr)
Merged
#292 Enable PTR synthesis in external-dns
Merged
#293 Roll bind-operator to v0.2.6 (loop-free TSIG-keyed NOTIFY)
Merged
#291 Revert bind-operator to v0.2.4 (v0.2.5 rolling-restart loop)
Merged
#288 Flip resolver forwarding for k8s zones to the in-cluster bind
Merged
#290 Roll cephrgw-operator to v0.3.1 (CRD staleness warning)
Merged
#289 Roll bind-operator to v0.2.5 (intra-cluster NOTIFY fix)
Merged
#287 Repoint external-dns at the in-cluster bind-externaldns primary
Merged
#285 Reflect externaldns TSIG key into the externaldns namespace
Merged
#286 Bump cephrgw-operator CRDs to v0.3.0
Merged
#283 Add advise-mode VPA for every workload
Merged
#281 Add vpa-system: VPA CRDs + recommender (advise mode)
Merged
#282 Route consul API hostname to the HTTP API (8500)
Merged
#284 Add VPA CRDs and kubeconform schemas
Merged
#280 Enable ACLs on k8s consul with Vault-sourced bootstrap token
Merged
#279 Roll cephrgw-operator to v0.3.0 (safe adoption)
Merged
#278 Roll artifactapi to v3.7.7
Merged
#277 Swap puppet compiler ENC to the encapic Go binary
Merged
#272 Switch puppet compiler ENC from Cobbler to encapi
Merged
#275 pdbmux: deploy the merging PuppetDB proxy in-cluster
Merged
#276 Trust internal CA in cephrgw-operator (fix radosgw TLS)
Merged
#274 Add terraform-enc woodpecker ServiceAccount
Merged
#273 Roll cephrgw-operator to v0.2.0 (radosgw-native)
Merged
#268 Wire LiteLLM SSO to Authentik (generic OIDC)
Merged
#271 bind-internal: allow k8s pod network to query the resolvers
Merged
#270 Bump bind-operator to v0.2.4
Merged
#269 TEMP: forward k8s.syd1.au.unkin.net to external external-dns service
Merged
#267 bind-internal: allow localhost to query the authoritative cluster
Merged
#266 bind-internal: add dashboard.ceph.unkin.net + lb1.unkin.net records
Merged
#262 cephrgw-system: source cephrgw-credentials from Vault via VSO
Merged
#265 bind-internal: add s3.ceph.unkin.net CNAME -> radosgw.service.consul
Merged
#264 Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin
Merged
#263 Wire ArgoCD RBAC to Authentik ak_groups / akP-argocd-admin
Merged
#261 Deploy cephrgw-operator to cephrgw-system
Merged
#260 bind-internal: add ceph.unkin.net authoritative zone
Merged
#259 bind-internal: allow admin workstation to query the resolver
Merged
#258 bind-internal: allow admin workstation + router to query authoritative
Merged
#257 Add terraform-rancher woodpecker ServiceAccount
Merged
#256 Add identity.unkin.net internal DNS record
Merged
#255 Bump bind-operator to v0.2.3 (deterministic render)
Merged
#253 Wire ArgoCD to Authentik OIDC
Merged
#254 Bump bind-operator to v0.2.2 (config-hash rolling restart)
Merged
#252 Fix validate-except syntax (resolver crash-loop)
Merged
#251 Exempt internal split-horizon zones from resolver DNSSEC validation
Merged
#250 Bump bind-operator to v0.2.1 (secondary replication fix)
Merged
#249 Bump bind-operator to v0.2.0 and deploy companion TSIG API
Merged
#248 reduce CPU requests across observability, authentik, bind, woodpecker
Merged
#247 cnpg: reduce cluster CPU requests to 50m
Merged
#245 chore: remove paperclip
Merged
#246 chore: reduce resource requirements of puppet
Merged
#244 Authoritative zones: accept puppet client dynamic updates
Merged
#243 grafana: add CloudNativePG dashboard (follow-up to #239)
Merged
#242 observability: scrape CloudNativePG postgres metrics (follow-up to #239)
Merged
#241 cert-manager: scrape metrics (follow-up to #239)
Merged
#240 vmagent: set consul datacenter (fix 0 discovered targets)
Merged
#239 observability: scrape existing app metrics (audit + ceph-csi batch)
Merged
#238 grafana: deploy Grafana instance, datasource and dashboards
Merged
#236 schemas: add grafana.integreatly.org CRD schemas
Merged
#235 grafana-system: deploy grafana-operator
Merged
#234 observability: migrate VictoriaMetrics to operator CRDs + Consul SD
Merged
#233 chore: add encapi to platform project
Merged
#232 bump artifactapi to 3.7.6
Merged
#230 deploy encapi to au-syd1
Merged
#231 chore: bump artifactapi to v3.7.5
Merged
#229 Add primary (write) Services to authoritative + externaldns
Merged
#228 Use externalTrafficPolicy: Local on the DNS services
Merged
#227 Restrict authoritative queries to internal networks
Merged
#226 Configure resolvers like puppet (openforwarder view + forward zones)
Merged
#225 Consolidate BIND DNS into one bind-internal namespace
Merged
#222 Deploy binddns-externaldns (RFC2136 dynamic cluster)
Merged
#221 Deploy binddns-resolver (recursive resolver cluster)
Merged
#224 Bump bind-operator image to v0.1.2
Merged
#220 Deploy binddns-auth (authoritative BIND cluster)
Merged
#223 Rename bind DNS namespaces to ns-*
Merged
#219 Deploy bind-operator (operator + CRDs)
Merged
#218 chore(artifactapi): deploy v3.7.4
Merged
#215 chore(artifactapi): deploy v3.7.3
Merged
#214 feat: add woodpecker service accounts for media terraform repos
Merged
#213 fix: update TLSRoute to v1
Merged
#211 Add Authentik identity provider deployment
Merged
#212 Add JSON schema generation for kubeconform CRD validation
Merged
#210 Add age-api deployment
Merged
#209 chore: source schema source for kubeconform
Merged
#208 chore: bump artifactapi + ui to v3.6.5
Merged
#207 chore: bump artifactapi + ui to v3.6.4
Merged
#206 chore: bump artifactapi + ui to v3.6.3
Merged
#205 chore: bump artifactapi + ui to v3.6.2
Merged
#204 chore: bump artifactapi + ui to v3.6.1
Merged
#203 chore: bump artifactapi + ui to v3.6.0
Merged
#202 fix: update UI health check paths to /ui
Merged
#201 refactor: simplify artifactapi routes
Merged
#200 fix: route /v2 and /health to artifactapi API service
Merged
#199 fix: rename environment2 to environment
Merged
#198 feat: artifactapi route change
Merged
#197 feat: migrate to artifactapi 3+
Merged
#196 chore: cleanup artifactory3 mess
Merged
#195 🤦
Merged
#194 feat: manage postgres-credentials for artifactapi3
Merged
#193 chore: remove middleware resource
Merged
#192 feat: deploy artifactapi3
Merged
#191 fix: update woodpecker kustomization
Merged
#190 feat: enable terraform-artifactapi jobs
Merged
#189 feat: add terraform-git service account for woodpecker CI
Merged
#188 chore: bump almalinux9 image tags
Merged
#187 benvin/gitea
Merged
#186 chore: add almalinux-vault repos
Merged
#185 feat(kanidm): scale down to single replica, remove replication
Merged
#184 feat: add sessionaffinity to kanidm service
2 Issues closed from 1 user
Closed
#307 security: reduce privilege in puppet namespace workloads (root init containers, redundant caps, APE)
Closed
#326 CA-rotation runbook for internal PKI rotation
7 Issues created by 1 user
Opened
#307 security: reduce privilege in puppet namespace workloads (root init containers, redundant caps, APE)
Opened
#322 geoip enrichment for nginx/traefik Vector access-log pipelines
Opened
#321 Gitea git.unkin.net production cutover (VM forge -> k8s)
Opened
#324 Finish the DNS migration off the Puppet zone to in-cluster bind
Opened
#325 Woodpecker k8s runner: trust the internal CA so buildx can push to artifactapi
Opened
#323 Decommission the legacy standalone ceph-csi namespace
Opened
#326 CA-rotation runbook for internal PKI rotation