deploy #10

bstein · 2026-01-19T18:56:30Z

bstein commented

2026-01-19 18:56:30 +00:00

This stuff shouldn't have been in this branch

bstein added 270 commits 2026-01-19 18:56:32 +00:00

ops: prepare vault-consumption branch 8ee7d046d2

vault: prep helm releases and image pins 4602656578

comms: bump ensure job names for new images bbe5ded0a6

comms: drop legacy synapse configmaps 4332ded0c3

fix(bstein-dev-home): drop invalid image overrides fbde129d4c

harbor: enable keycloak oidc settings bcef167b50

comms: seed synapse signing key for helm 098a06e723

comms: retry synapse signing key job 47f0d1736e

comms: add debug logging for signing key job fa8ec588a8

comms: fix signing key job permissions 71fd00d845

comms: restore MAS and OIDC secrets in synapse e6a3ae5f7b

comms: fix synapse runtime config injection b710f45e5c

comms: disable synapse password auth with MAS 928b9379d8

comms: disable synapse oidc with MAS b97146f4d1

comms: rerun mas local user seed 98554e5fa4

comms: restart atlasbot after MAS fixes 46777f9ec9

monitoring: align victoria-metrics PVC size 0b5dcde3a3

monitoring: allow grafana upgrade remediation bcc15c3e0a

feat: add harbor/vault oidc automation 4a1c4766b8

chore: refresh knowledge catalog headers 8fa38268d9

keycloak: ensure harbor oidc scope e776f004c9

keycloak: bump harbor oidc job 537d304b36

keycloak: fix harbor oidc job 1d894ea80f

feat: start vault consumption for outline and planka b82195f2d7

fix: run vault k8s auth config with sh 5a9ceeab24

fix: make vault k8s auth script posix cb5796cb71

fix: detect vault initialized state correctly 50aec198a4

vault: align oidc roles with keycloak 55234f8536

vault: run oidc config with sh c3541b72c3

vault: fix oidc scopes parsing 8a358832f3

vault: wire more services to CSI fd2ae6bdd5

vault: write bound_claims as file 4111fb079f

fix: resolve gitea mounts and bump portal job 3384533acd

fix(gitea): inline vault secrets bb2a3ba904

vault: send oidc role payload as json 8d526e383f

vault(consumption): sync secrets via CSI de3db3133b

mailu: bump sync job name 96a7c67674

jobs: bump names for immutability 35369d53d8

comms: restore livekit token env 6898641b0a

jobs: drop apk in kubectl image 9ec08e1dc2

jobs: bump names after vault tweaks 5683b3f941

vault: add remaining secret syncs 37302664c2

monitoring: move grafana smtp to vault b8e50bb0a6

vault: sync harbor pulls b1f9df4d83

infra: add vault injector 1add32e683

vault: move core apps to injector 16c62d5a4a

bstein-dev-home: bump onboarding job 36fb225cbd

gitea: run vault init first 0aa16757e9

nextcloud: fix vault template keys 92fbde08eb

keycloak: switch jobs to vault injector 58c880d9ce

vault: stabilize injector templates and add health apps 89f4b0dbdf

keycloak: bump job names 9c16d0fbc0

gitea: trim vault secret newlines ab50780f49

gitea: tolerate oidc init failures 6ba509dbe1

keycloak: schedule on arm64 workers d559aeb464

vault: move comms and mailu workloads to injector e92cfa7dba

comms: shorten vault inject file names 393916ded9

comms: add vault-secrets emptyDir for mas f6fc250fe1

vault: prepopulate injector for jobs 98d67293bc

vault: bump job names for injector 4f1fb62ab3

vault: inject monitoring exporter and health jobs fb9578b624

vault: inject remaining services with wrappers fb671865e5

longhorn: read oauth2-proxy secrets from vault bb9a4e6d8b

jenkins: escape vault env values 4ff2f3e889

jenkins: load vault env via env c98d24e91e

harbor: move secrets to vault sidecars 713fedfe73

harbor: mount vault entrypoint script eeeb69fb7a

harbor: fix vault secretKey file path 8a750ac3ab

vault: keep copy loop from clobbering args 9743064ad3

harbor: preserve required volume mounts 22e3004b0a

health: escape wger env vars and fix nginx temp paths 9652d9d3cf

harbor: fix vault env templates 71f533ca1f

health: load wger secrets without shell expansion 349a6cca3b

health: avoid surge rollout for wger e391a78f25

health: fix wger env template newlines 4bb6c7e212

vault: inject comms and grafana secrets c38f77302f

comms: fix synapse vault patch e8d004c1b9

vault: fix hyphenated key templates 0b21c8f40d

comms: keep redis env while injecting vault 98cdafb162

comms: mount vault signing key volume 52cc04dee9

comms: mount synapse signing key d898c71c08

jellyfin: read LDAP config from vault 6c8d3b24f2

vault: read oidc config from vault 82090c1953

vault: sync oidc and wger env 0733127039

health: stabilize wger startup 3af97973e0

jellyfin: trim vault ldap template 81e79fd19a

health: fix nginx pid path e94ea272ce

jellyfin: schedule on nvidia accelerators c1b771298a

health: run nginx directly 35dcc5d66c

health: add nginx main config 88be97d860

jellyfin: prefer gpu nodes by hostname 836ce605b6

bstein-dev-home: bump portal images 139ca78c3d

comms: move synapse secrets to vault 7f96daa7b8

health: allow portal wger sync 8fed4a08c5

bstein-dev-home: bump portal images 511403c4a6

mailu: use vault sidecar env f5a3894c2b

health: run wger sync with python3 cd14e70d02

vault: finalize sidecar migration 85c3d9c2f7

vault: add admin role for config jobs 86c9951cc4

vault: allow vault-admin token review e885c7d6ce

flux: auto-update portal images on feature branch 84ccf35c44

vault: use static token reviewer 74a2b3e28d

vault: allow oidc tuning 756a1af2e6

vault: harden oidc claims type d69545cdb5

vault: default oidc claims type 9e6673d02e

vault: prepopulate oidc job feb9d6997c

crypto: fix wallet rpc image 2ecd274f28

crypto: drop wallet rpc bootstrap job f9fa6dcbb4

keycloak: stop writing oauth2-proxy secret 53da4c20ab

logging: move data-prepper pipeline to configmap fb992f0cff

nextcloud: fix cronjob shell flags 72d49f88fe

bstein-dev-home: restore image automation setters a7998fc0bf

logging: patch data-prepper volume to configmap 9a9ecc4903

logging: replace pipeline volume with configmap 4dba510d6f

logging: switch data-prepper volume to configmap 88f862e18a

logging: use strategic patch for pipeline volume c7fa52ab27

logging: simplify data-prepper patch 76151a082c

logging: drop namespace from data-prepper patch 760c9cbe6b

logging: patch data-prepper volume via json 2ccc33b105

vault: fix data-prepper pipeline and portal admin secret job 69cee91dda

fix: bump keycloak and portal e2e job names bf9a24681c

vault: allow sso role to read portal admin secret c30f1fc587

smtp: point services at mailu relay e6210644c2

smtp: use mail.bstein.dev for app relays de6665c450

vault: allow admin policy to update shared secrets 5899c9acb3

keycloak: rerun realm smtp config c0d0e64bc6

logging: fix data-prepper post-render patch c759fb1dbb

bstein-dev-home: rerun onboarding e2e job 70a52dec06

keycloak: rerun execute-actions email e2e 8db4b4f0b5

keycloak: align smtp probe user a2b2c7db9d

logging: disable wait for data-prepper helmrelease 9993b501a6

traefik: wire LB service to custom deployment 7817248eb9

core: add bstein.dev coredns overrides 66e7e6acc5

gitea: expose ssh via metallb shared IP d90950b82e

comms: fix mas vault file paths 5816d4f399

fix logging pipeline secret and scheduling b1489a8dd9

fix ingress tls routing bb1bf3c017

vault: allow UI mount listing for admins f5231d282b

vault: allow admin kv browse 8ad9f0a664

vault/keycloak: restore kv access and wger sync rbac 5cd196e043

jellyfin: set traefik tls annotations cf5d7dfa00

maintenance: disable k3s traefik; keycloak portal admin roles 9474ab97f2

maintenance: cleanup k3s traefik and wger attrs 671d4d5dce

maintenance: allow traefik cleanup watch ef504eea80

maintenance: avoid blocking on k3s traefik cleanup 4faa039a8e

jellyfin: move cache to emptyDir beb646f78f

platform: add cert-manager and align postgres vault path 9f3d2db63d

traefik: add CRDs 7c3006736c

longhorn: add helm repo and adopt workflow 4406724da5

longhorn: use harbor mirrors and vault pull secret 401df4d68c

keycloak: enforce bstein group membership 1eb7d58259

longhorn: allow kustomization to apply without waiting d9d31f7701

longhorn: pin vault sync to rpi workers b07f32e7c8

keycloak: rerun realm and user overrides 1fb7b27de4

planka: allow project creation for all users 2f176d5a36

cert-manager: pin webhook and cainjector to rpi nodes dc62b4998b

longhorn: force image pulls during migration 8535d50faa

longhorn: move images to infra project f8ffa830b7

longhorn: ensure settings via job 71a1a55a01

longhorn: apply settings via api job 42e987f4ee

longhorn: make settings job idempotent 55992ea48f

core: scale coredns replicas d9fabbf353

core: manage coredns deployment e1bd962956

core: use harbor coredns image 368dd81c5e

core: fix coredns tag 354a803ff4

finance: add actual budget and firefly 3e3061fe5b

finance: seed vault secrets 62fa6ef371

keycloak: bump realm settings job f4c6827c8c

jobs: drop apk installs and prefer arm64 a9351bc737

finance: fix vault seed job 8f990031f1

jobs: rerun keycloak realm + mas db ensure 622c7acaa4

maintenance: add k3s agent restart daemonset 5eff31595e

sso: rerun realm settings and vault oidc job 1b4f46bb41

sso: harden keycloak jobs and rerun 33e35193fb

jobs: prefer arm64 workers 6ec0414fcd

jobs: bump names after affinity update 86ea701ff0

keycloak: bump portal admin secret job 7b009caf97

comms: bump mas admin secret job 928b2a8706

mailu: bump sync job cd60ebc982

finance: decouple from mailu readiness 64d0a70191

finance: ensure vault init ordering 9eedcad520

mailu: retry sync and rerun job 9dd2a72063

finance: rerun secrets seed job 9047dfa3b5

finance: switch vault seed to python 1a3d35094e

comms: restart mas after db sync 3274b9257c

comms: rerun mas-dependent jobs 1cc1b9bea5

finance: expand actual openid env 6028d82aa3

comms: retry mas jobs and rerun c5b8396bd8

finance: bump actual server image 3cf34b53e9

finance: drop dependency gating 343165b2fa

comms: retry mas local users and rerun b0ac30e719

finance: harden actual openid bootstrap cee565892b

finance: roll actual bootstrap 36d0df817a

vault: retry status checks in config jobs 9a3c3a3d3e

finance: prepare actual data dirs 84fa9e7dbc

portal: retry vaultwarden cred sync ba546bf63f

finance: migrate actual db before bootstrap 376eae3fa1

finance: roll firefly after secrets 008130f8d0

vault: retry vault cli operations a9c2d3c5e8

finance: source firefly env in shell ee622cbb0b

vault: make retry helper resilient ef5ac62544

vault: pin cronjobs to service IP 728f2cd2ee

sso: retry keycloak secret jobs acfab6a150

sso: retry mas secret lookup 268a1d9449

core: add finance hosts to coredns 356dba3a33

comms: fix matrix login routing and prune guests 71bab17665

platform: restore cert-manager and encrypt budget storage 8192dfeebe

finance: let firefly init nginx config 16b7fcd120

core: point internal dns at traefik service 6cf46cf789

finance: run firefly entrypoint after vault env 309931f7a5

core: route budget and money to traefik df3a56656d

comms: add default server name to element config f15b80872e

comms: harden guest register provisioning 931e41a76f

comms: make guest register server threaded 69d67b39a5

comms: pin mas/synapse host aliases for DNS 1293ffe0a5

comms: prune stale guests after 14 days f9830c6678

comms: use guest-tools image for guest rename 6997d5e202

comms: add harbor pull secret to vault serviceaccount 0e3c8ef952

comms: pin guest rename job to rpi5 nodes 5f1b61d25e

comms: serve host-specific Element config alias be10e01c2f

comms: mount host-specific Element config file ebb300b939

comms: add Element host-config entrypoint script 578ef5e830

comms: use sh for Element host-config script 96b93a1687

comms: drop livekit token host alias e729adc6ef

comms: restart livekit to reload vault keys f91459e55a

comms: pin livekit token hostnames b576da53c2

core: pin coredns to rpi workers 758610dff0

comms: re-run mas db ensure e64ba4ca3c

comms: restart mas after db ensure 0ddbb5ec79

comms: rerun mas local users and secrets jobs 792b7b1417

comms: route live host login to mas a9b94c87be

bstein-dev-home: bump images to 0.1.1-101 74f089dc21

bstein-dev-home: bump images to 0.1.1-102 f753f114c7

mailu: gate sync to approved users 418d201da0

mailu: preserve keycloak profile fields 9c2cb1b037

bstein-dev-home: add smtp env for access requests 4c4c0867a7

vault: allow portal to read postmark relay 7cd2f3c587

keycloak: rerun realm settings job c9cb088198

mailu: backfill mailu_enabled for legacy users 0d27107411

nextcloud-mail-sync: harden keycloak fetch a6ac0c363e

monitoring: add glue dashboard and tag cronjobs 343d41ecc7

vaultwarden: add retry safeguards and db tuning 8b8d2c4aa8

vaultwarden: pin to arm64 workers 4874ccda4d

monitoring: add glue row and fix mail dns d7812623cd

monitoring: add testing dashboard and switch postmark apikey 1fb3d179ef

keycloak: bump jobs for postmark change 435ed5d426

monitoring: disable grafana persistence to recover 0b15007e2c

monitoring: restore grafana persistence 6e3faeb9fd

monitoring: avoid titan-22 for core pods a5bec3e543

monitoring: keep postmark exporter off titan-22 084242746e

monitoring: add atlas testing dashboard folder c70054a30e

monitoring: label cronjob metrics and move grafana to arm64 0eb526c907

nextcloud-mail-sync: harden auth, bump portal backend ae3b0afbff

monitoring: fix glue dashboard queries da200235bb

ci: add glue tests and deploy gate 979470eeb8

jenkins: restart to load new jobs 73c829c81f

glue: fix portal smtp host and mail sync export b6609a9706

portal: use mailu smtp secret fe9132e45e

portal: use mailu sender mailbox 6935de7a6c

nextcloud-mail-sync: pin to arm64 workers 67203d1147

portal: allow firefly sync jobs aaf7e23603

mailu: add portal sender mailbox f4b08b93eb

portal-e2e: add readiness checks d5a19ca9c3

mailu-sync: cap wait in listener bed3563ae6

portal: tune vaultwarden backoff 21899b8a79

mailu-sync: restart listener for update d943359606

vaultwarden: use mailu smtp creds 2802c1e8b6

vault: allow vaultwarden mailu secret 35816115f8

vaultwarden: use mail hostname 89316a5901

mailu-sync: bump job b09679a812

bstein added 1 commit 2026-01-19 19:03:44 +00:00

Merge main into deploy 2c546f8eae

bstein merged commit c4ce7e3981 into main

2026-01-19 19:04:01 +00:00

bstein referenced this issue from a commit

2026-01-19 19:04:03 +00:00

Merge pull request 'deploy' (#10) from deploy into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/titan-iac#10