feature/sso-hardening #9
bstein
commented
Owner
No description provided.
bstein
added 683 commits 2026-01-13 15:53:13 +00:00
jenkins: pin oidc via jcasc
70e1205f5f
flux: track feature/sso-hardening
af411e795c
jenkins: fix oidc jcasc schema
f4fa44c842
jenkins: fix oidc with wellknown config
1357d783de
jenkins: restore harbor robot creds
c3ffde1b1f
jenkins: fix oidc indent and harbor creds
0c5bce93ca
Flux image automation: track main branch for bstein-dev-home
fa44a00d0b
jenkins: drop helm, run via raw manifests
b97b22fc01
jenkins: bind pvc to retained volume
f092f00bff
jenkins: switch healthcheck to deployment/service
f9c4967eed
Point bstein-dev-home to latest images (0.1.1-0)
ba47e00c88
Point bstein-dev-home to latest tags
6405cd823d
vault: drop helm, add raw statefulset
7533cec0ee
mailu: switch relay to postmark
fad7204dfb
vault: fix manifest and disable mlock
524868b05d
vault: fix traefik serversTransport name
3db523335d
vault: pin to worker arm64 nodes
0071f13063
vault: traefik serversTransport must include namespace
303e7e770f
jellyfin: bootstrap oidc plugin
b9144ebb5e
jellyfin: fix oidc installer script
ed868a5faa
jellyfin: upgrade to 10.11 and seed oidc plugin
1b65987dfe
jellyfin: clean old ldap plugin before oidc init
eb0db2ce81
vault: correct serversTransport reference
65f8b7c893
vault: let traefik speak http to service
af3d453e86
vault: add traefik redirect middleware
75b62e5ae2
vault: drop unused redirect middleware
f243be21e6
vault: remove serversTransport, speak http to service
c2dfba67c2
vault: backend over https with serversTransport
d3ca57eabf
vault: run http inside cluster (tls terminated at ingress)
fa977a69f4
vault: keep probes HTTPS, drop ingress backend tweaks
e354f8bc3f
vault: probes use http VAULT_ADDR for http listener
dba8364c74
jellyfin: pull oidc plugin from streaming harbor and fix oidc redirect
5b0fbd344b
jellyfin: fix oidc redirect to api/oidc/callback
f68668f987
ai: add ollama service and wire chat backend
c8adca5a5b
ai: allow ollama to share titan-24 gpu
16ab7a963d
ai-llm: use phi3 mini model
39a914effd
ai-llm: GPU qwen2.5-coder on titan-24; add chat.ai host
9162f5789f
bstein-dev-home: fix ingress indent for chat.ai host
610ef7a552
bstein-dev-home: default chat model to qwen2.5-coder
a99293944a
jenkins: add RBAC serviceaccount and use for agents
1e72f2e371
jenkins: use main service for tunnel
4491a3681a
flux: run bstein-dev-home image automation on sso-hardening
eaab2b7988
flux: let bstein-dev-home automation read policies in app ns
f23641be50
flux: place bstein-dev-home image automation in app namespace
3d19b54b12
flux: fix bstein-dev-home automation template
de317a3396
flux: simplify bstein-dev-home image update message
ba3b3a3d9f
chore(bstein-dev-home): automated image update
05fa473582
bstein-dev-home: fix image tags, pause automation
ba7563b0e5
chore(bstein-dev-home): automated image update
b1ac53e1a1
bstein-dev-home: pin images and stop automation churn
a4a5904201
bstein-dev-home: re-enable image automation
b6acab8ee6
chore(bstein-dev-home): automated image update
204e92c1e8
chore(bstein-dev-home): automated image update
9043d735f1
chore(bstein-dev-home): automated image update
9c90cfcc9c
fix(bstein-dev-home): patch images via policies directly
0d1e3e8666
chore(bstein-dev-home): automated image update
8a4e1993ec
chore(bstein-dev-home): scale to 1 replica and pass ai meta env
ef372bf8f2
chore(bstein-dev-home): automated image update
b519ef08bc
chore(bstein-dev-home): automated image update
05c84daf2a
chore(bstein-dev-home): automated image update
4cf12144e9
chore(bstein-dev-home): automated image update
d6f44330c9
chore(bstein-dev-home): automated image update
60f2c65ad3
chore(bstein-dev-home): automated image update
24532fbdd5
feat(bstein-dev-home): add SA/RBAC for ai pod discovery
de693bafbe
chore(ai-llm): annotate pod with model and gpu
c6bae35bc6
chore(bstein-dev-home): automated image update
b597613dc3
chore(bstein-dev-home): automated image update
85580ea128
fix(ai): ensure backend token mount and annotate ollama pods
f37ce6fb85
chore(bstein-dev-home): automated image update
a9bf9178e6
chore(bstein-dev-home): automated image update
5f64778eeb
fix(ai): increase chat timeout to 60s
e7abd30b1d
chore(bstein-dev-home): automated image update
5a06496fbe
chore(bstein-dev-home): automated image update
11463f63d1
chore(bstein-dev-home): automated image update
b05df744f2
chore(bstein-dev-home): automated image update
8d6d2fc8fc
jitsi: enable pods and fix colibri ws
1526906d7e
jitsi: advertise wss colibri
d436ed73bc
jitsi: use recreate for hostPort rollout
752e75dca4
jitsi: advertise lan and public ips
356f0de253
jitsi: add tcp harvester config for 4443
3330eb75c7
jitsi: add tcp harvester config for 4443 (configmap)
638b37cb37
jitsi: copy tcp custom config via init
5baf62c915
jitsi: fix init container placement
453776967a
jitsi: force tcp harvester via system props
bde4002362
jitsi: add sip-communicator tcp harvester props
25c32da81e
chore(bstein-dev-home): automated image update
0cd6d47940
chore(bstein-dev-home): automated image update
ebebd19a13
jitsi: add tcp harvester config for 4443
e9308b6bd1
jellyfin: drop OIDC plugin and strip injected script
cecde3e197
jellyfin: enforce ldap auth provider on start
cd7ba1e8a8
grafana: allow public overview via oidc
39a8e551eb
jitsi: include sip communicator tcp props
ad79ad0a3c
jitsi: keep tcp config on pvc only
23f5f03047
grafana,jitsi: enable pkce and tcp fallback
0db786c343
crypto: fetch p2pool binary at runtime
7876e4389c
crypto: download p2pool v4.9 arm64 at runtime
b71c145e6e
crypto: fetch p2pool from github with debug
1bbb88d9a3
crypto: handle nested p2pool archive layout
bbe4fb2cff
jitsi: require auth to start rooms; vault ui default oidc
cf2e4c8bb2
jitsi: fix prosody auth init shell
bd21e775ab
vault: revert ui default auth block (not supported)
4d47e2c693
jitsi: enforce auth flags on web/jicofo/jvb
25758b1cd9
ci-demo: fix image tag value
9bbdbb5fab
platform: add vault csi driver
fbe2490ef7
jitsi: use vault jwt via csi
5666eceec7
vault-csi: deploy vault provider daemonset
2acc7a06b2
jitsi: fix secrets-store csi driver name
bb93f730d5
vault: use dedicated service account for k8s auth
77ecf3229e
jitsi: add vault-backed jwt launcher
a55203a909
jitsi-launcher: pull image from docker hub
a8fdcc5931
jitsi-launcher: add health endpoint and readiness
0e3d36a5ae
jitsi-launcher: allow any authenticated user (no group gate)
c9ebcfc869
jitsi-launcher: add oauth2-proxy error middleware for redirects
c0a53e59b5
communication: add Othrys stack via Flux
a6bd6b8cc8
communication: disable livekit room auto-create
71c58ee081
communication: stage guest-helper for prune
6759817518
communication: prune guest-helper and synapse-federation
5ed650d19c
comms: move LiveKit media to UDP 443
a815322f6e
chat.ai: gate root with API key
ee6bcec3c5
comms: avoid Synapse PVC rollout deadlock
aca05266fc
communication: remove plaintext secrets
d8d741bbd9
communication: make pin job mutable
6203faae3f
communication: add matrix-authentication-service
716059d9ac
communication: fix MAS container entrypoint
d9c003ce5a
communication: fix MAS config permissions
45f62bc331
communication: wire MAS secrets via init render
940e0cc613
communication: enable MAS delegated auth
cb82a44e2e
communication: make MAS listen on IPv4
683f495bd8
communication: restart MAS on config change
20df5cfb6e
communication: fix Synapse delegated auth
07ae28e1b1
communication: disable Synapse OIDC under MAS
385df610be
communication: fix Matrix well-known auth JSON
01dcb76966
communication: move LiveKit media to 7882/7881
650d210876
communication: add Synapse msc3861 admin token
2fdcfbfbaf
communication: configure Synapse msc3861 client creds
f869d0ffb9
communication: drop msc3861 config for MAS
214a228bf5
communication: bump MAS to v1.8.0
8b37ba3213
communication: fix MAS image tag
a5112d5f88
communication: route Matrix SSO redirects to MAS
be2c2ba33e
communication: switch atlasbot to MAS login
bfd1c5dd49
communication: suspend flaky bootstrap cronjobs
26d82b3f85
communication: make suspended cronjobs fail-fast
73f577a49a
communication: add MAS syn2mas check job
9658e48a2d
communication: fix syn2mas check db URI arg
805a7215bc
communication: syn2mas check include synapse secret
35770a8b90
communication: scale down MAS and Synapse for syn2mas
06a1cde738
communication: add MAS syn2mas migrate job
af03ac6dbc
communication: syn2mas migrate mount MAS secrets
101fcc18a3
communication: rerun syn2mas migrate job
bbd3815f25
communication: prep syn2mas migrate (bcrypt, disable guests)
c4931c381c
communication: scale MAS/Synapse back up
6c1ff72af6
communication: remove one-shot syn2mas jobs
a260d55826
communication: fix LiveKit udp_port mux syntax
b7b1ffde6c
communication: fix LiveKit udp_port range and expose 7883
db01ab02ef
communication: serve matrix well-known with trailing slash
9c60011261
communication: fix well-known nginx regex escaping
f1ca9d919d
communication: fix well-known trailing slash and reload config
af05370ad7
communication: serve matrix well-known on matrix.live
50c23b592a
communication: set LB traffic policy local
c32d734a69
communication: use Cluster LB traffic policy
04f46ed491
metallb: schedule speaker on rpi4+rpi5
b4ac308af8
metallb: run speaker on all nodes
8e702f14db
metallb: enable speaker debug logs
3a473ff482
metallb: set speaker lb-class
b0bd7c97a5
metallb: restore speaker log level info
3948602c57
communication: advertise TURN over tcp
10f7f3a8c6
communication: set LB externalTrafficPolicy Local
5c59640bf5
communication: render LiveKit TURN creds
beb975182a
sso(openldap): restore in-cluster LDAP
1e64075478
chore(bstein-dev-home): automated image update
8c799faa61
chore(bstein-dev-home): automated image update
9c6889440c
sso(openldap): fix bootstrap ldif mount
a4bcaf8912
sso(openldap): remove bootstrap ldif
671b28b8f4
chore(bstein-dev-home): automated image update
47ac4a8580
chore(bstein-dev-home): automated image update
48d4e9c363
jellyfin: fix LDAP auth provider id
7955d9133c
keycloak: read POSTGRES_* db secret keys
1f554e583a
communication(atlasbot): reduce spam and use atlasbot user
0f1f34c52a
communication: use MAS for internal password logins
554061711c
communication: create comms namespace
32e98a7836
communication: stop staging comms namespace (kustomize conflict)
e503c40417
comms: create namespace via Flux
a48486912b
communication: prune stack for comms cutover
79f99899ee
chore(bstein-dev-home): automated image update
d4a830da88
chore(bstein-dev-home): automated image update
c6089fbf85
communication: deploy into comms namespace
6ddfd394cb
comms(synapse): ensure signing key secret populated
e47e6d6e45
comms(synapse): fix signingkey job image
e82e66091c
comms(synapse): fix signingkey secret patch job
baed4737d9
comms(synapse): fix signing key RBAC + rerun job
dcc5714a8b
communication: drop old namespace manifest
7020d53fd8
gpu: enable time-slicing and refresh dashboards
6a76fc0fa3
monitoring: ensure gpu idle share renders
f18f1df1ce
comms(atlasbot): respond to @atlas mentions and keep context
2d8540907a
comms(atlasbot): rollout on config changes
7c31d25c24
monitoring: per-panel namespace share filters
5093f77c0a
ai-llm: serialize rollout for RWO pvc
0c1989c678
comms: fix atlas mention detection
5da36a38c3
comms: reset othrys room
dca01199ce
comms: reset othrys without synapse admin
f6dba2b8c1
monitoring: drop anonymous folder role
e1e95f9bef
comms: force leave old rooms
8aecb88af3
comms: force leave old rooms (v2)
da972215d3
comms: force leave old rooms (v3)
4a584f538d
comms: delete old test rooms for bstein
b6c955e7da
comms: debug bstein room cleanup
4e701c6340
comms: restart synapse to refresh admin cache
a8149bd993
comms: rerun bstein room cleanup after synapse restart
70059dda33
nextcloud: fix mail sync idempotency
32f78c4f82
nextcloud: flux-manage mail sync
eb3a6824e6
comms(mas): bootstrap admin client secret
ed23d831b9
comms(mas): fix admin client secret job
c72e1e1f9b
monitoring: split overview org
100a11e0de
comms(mas): patch admin secret via stringData
0f36576bac
monitoring: recreate grafana rollouts
353f2e9210
comms(mas): make secret ensure job portable
9d979a69fe
comms(mas): debug admin secret ensure job
ae335fcff2
comms(mas): fix admin secret job permissions
0a7410302d
comms(mas): stop managing admin client secret data
324ee34648
comms(mas): create admin client runtime secret
e1f163253b
comms(mas): drop flux-managed admin client secret
b9dbeb98b0
monitoring: dual-provision overview orgs
32f1532508
comms(mas): enable internal admin API
144467dfe2
comms: leave stuck rooms via MAS admin
d43e40d515
comms(synapse): enable MSC4108 QR login
ce6537a155
chore(bstein-dev-home): automated image update
41d81ee41a
chore(bstein-dev-home): automated image update
335ead9df5
bstein-dev-home: enable Keycloak portal
592539e2d3
chore(bstein-dev-home): automated image update
77761c1e42
chore(bstein-dev-home): automated image update
157c036371
chore(bstein-dev-home): automated image update
d431b04114
chore(bstein-dev-home): automated image update
58d14f1cb6
chore(bstein-dev-home): automated image update
a56235f391
chore(bstein-dev-home): automated image update
90b071566a
nextcloud: make mail sync idempotent
edd2189f3c
chore(bstein-dev-home): automated image update
de8721cbaa
chore(bstein-dev-home): automated image update
a30df479aa
bstein-dev-home: add portal db + relax account gating
1995ba7ec9
chore(bstein-dev-home): automated image update
04c5ee91a0
chore(bstein-dev-home): automated image update
ee9fa7fd36
chore(bstein-dev-home): automated image update
3ab4c866ea
chore(bstein-dev-home): automated image update
6eb3ca1fce
services: scaffold postgres and vaultwarden manifests
7a97aa257b
chore(bstein-dev-home): automated image update
616c82807e
chore(bstein-dev-home): automated image update
0d79c4bcdc
chore(bstein-dev-home): automated image update
20ad6a76ca
chore(bstein-dev-home): automated image update
9daf8b345a
mailu: add wait-mode sync endpoint
b95eab5876
mailu: roll listener on script changes
b7e34865fe
chore(bstein-dev-home): automated image update
05216a972f
chore(bstein-dev-home): automated image update
26f11db285
mailu: store app password as list
5f7ea4544d
chore(bstein-dev-home): automated image update
d46d411154
chore(bstein-dev-home): automated image update
89228d2d5e
keycloak: enable reset password
7e464d3ec8
keycloak: pin realm job to rpi nodes
2ef3b7d45c
keycloak: fix realm job service URL
816abca2df
chore(bstein-dev-home): automated image update
0736c4255e
chore(bstein-dev-home): automated image update
6a155a7a7a
keycloak: switch realm job to kcadm
77beacec53
keycloak: set realm smtp server
9fa081ca36
keycloak: apply realm smtp via api
46d4ab6dc8
chore(bstein-dev-home): automated image update
1ff8c8cdec
chore(bstein-dev-home): automated image update
d44b759f0b
chore(bstein-dev-home): automated image update
d1294a0dc9
chore(bstein-dev-home): automated image update
30373c19e7
chore(bstein-dev-home): automated image update
b06ae2c89d
chore(bstein-dev-home): automated image update
f05a8a2200
chore(bstein-dev-home): automated image update
9c627087eb
chore(bstein-dev-home): automated image update
78afccc53a
chore(bstein-dev-home): automated image update
f9462aae10
chore(bstein-dev-home): automated image update
a9b7f86046
chore(bstein-dev-home): automated image update
750f1a2cbf
chore(bstein-dev-home): automated image update
ee90817040
sso: codify openldap bootstrap and keycloak federation
de14d68fc9
sso: fix openldap bootstrap job
8651ada4d9
sso: make openldap bootstrap POSIX sh
5ae9bf578e
sso: bump openldap bootstrap job
2c86a6d95f
sso: remove openldap bootstrap job
d70b685f27
sso: fix keycloak ldap provider parentId
8a2f3c733e
keycloak: repair ldap federation parentId
1346ccd31b
vaultwarden: add flux kustomization
c36d318d81
vaultwarden: suspend flux kustomization
e5f41cfa2b
keycloak: enable debug logging
e2e76592a0
keycloak: use recreate strategy with pvc
23a9e1ec30
keycloak: clear rollingUpdate for recreate
22b7e7aa66
keycloak: roll update with no surge
2254532642
chore(bstein-dev-home): automated image update
a92a51c6c5
chore(bstein-dev-home): automated image update
ee0aee71f8
bstein-dev-home: read vaultwarden admin token
5e3cfee3d5
bstein-dev-home: allow vaultwarden admin secret read
b509234aee
keycloak: cleanup LDAP federation
503a9264c5
chore(bstein-dev-home): automated image update
82b2c95bf0
chore(bstein-dev-home): automated image update
3f1780daed
keycloak(atlas): harden realm settings job
54d324f555
keycloak(atlas): retry realm settings job
21d8fc3788
keycloak(atlas): disable browser IdP redirector
0f26bd508e
chore(bstein-dev-home): automated image update
4e1ec914f6
chore(bstein-dev-home): automated image update
727d8cfd48
sso: provision vaultwarden users
5437cebb9e
chore(bstein-dev-home): automated image update
efb226fe07
chore(bstein-dev-home): automated image update
bb49d584f5
chore(bstein-dev-home): automated image update
479cb81b3e
portal: fix vaultwarden sync job env
c9d9a28c03
chore(bstein-dev-home): automated image update
c62e142a87
chore(bstein-dev-home): automated image update
14a9a8403a
chore(bstein-dev-home): automated image update
64138ea045
chore(bstein-dev-home): automated image update
c080d39375
keycloak(atlas): default TOTP required action
10e322e853
mailu: sync via mailu_email attribute
e6eff8165a
chore(bstein-dev-home): automated image update
76bb48eac1
chore(bstein-dev-home): automated image update
23ebcbaf92
chore(bstein-dev-home): automated image update
b1706397b6
chore(bstein-dev-home): automated image update
5c618c6560
keycloak: allow mailu_email + groups
0b211520cb
chore(bstein-dev-home): automated image update
335906aafc
chore(bstein-dev-home): automated image update
cc677eb7f3
chore(bstein-dev-home): automated image update
fff9ffbba7
chore(bstein-dev-home): automated image update
6360012155
chore(bstein-dev-home): automated image update
dd3b940ee7
chore(bstein-dev-home): automated image update
a7222878c3
chore(bstein-dev-home): automated image update
25ce112c82
chore(bstein-dev-home): automated image update
034acdaaf2
keycloak: set bstein mailu_email
747b6aacb6
chore(bstein-dev-home): automated image update
2d17d03b3d
chore(bstein-dev-home): automated image update
e82be4955b
chore(bstein-dev-home): automated image update
9d8c113850
fix(nextcloud): dedupe + update mail accounts
51f94194be
chore(bstein-dev-home): automated image update
b06dcb2263
nextcloud-mail-sync: manage CronJob via Flux
a76d944433
fix(nextcloud-mail-sync): portable email parsing
c165087eda
fix(nextcloud-mail-sync): capture occ export output reliably
6cd63b067d
fix(nextcloud-mail-sync): mawk-compatible email regex
c7c2e03ea2
fix(nextcloud-mail-sync): fix bash syntax
caa23e6f1c
nextcloud: delegate mail sync to separate kustomization
51b0a88a62
nextcloud: per-user mail sync + portal RBAC
91106ee298
nextcloud-mail-sync: portal RBAC
565fad4522
chore(bstein-dev-home): automated image update
db17c95ee0
chore(bstein-dev-home): automated image update
73728bcc09
keycloak: allow nextcloud mail profile attrs
c8f9b59e4a
keycloak: enable token exchange
f1d1e1bd7d
keycloak: add portal e2e client
e09589ec35
keycloak: allow token exchange to portal
b21a79dad7
keycloak: enable fine-grained token exchange authz
df959ee17d
keycloak: retry token exchange permissions job
1f2bddc7fe
keycloak: fix token exchange permission patching
cb37756f5f
keycloak: make token exchange permissions job idempotent
3f19d01d00
keycloak: robust policy lookup for token exchange job
e73baa6ecd
keycloak: add token exchange E2E smoke test
70980a2ca9
vaultwarden: disable signups and sync invites
c386ff7c7a
chore(bstein-dev-home): automated image update
db27242ce1
chore(bstein-dev-home): automated image update
6be16eed1d
flux: resume vaultwarden
2ee8f7da88
vaultwarden: use Recreate strategy
c11a663d05
vaultwarden: avoid RWO multi-attach rollout
e1deeb1853
chore(bstein-dev-home): automated image update
dbd14fac8b
chore(bstein-dev-home): automated image update
148bba0fd6
vaultwarden: enable SMTP via Mailu
b7c8b4693d
vaultwarden: allow internal SMTP TLS
12348258fa
vaultwarden: make cred sync idempotent
51a733096f
vaultwarden: skip reinvite when status set
e8fab60d89
keycloak: allow vaultwarden user attributes
ab658fa064
keycloak: rerun realm settings job
b63b724b52
vaultwarden: backfill synced_at
c5fa1b5a38
chore(bstein-dev-home): automated image update
558cab9a0b
chore(bstein-dev-home): automated image update
dd473b8a8c
bstein-dev-home: reduce lab status probe timeout
762164aed4
chore(bstein-dev-home): automated image update
aad5a29986
chore(bstein-dev-home): automated image update
eb560a38fa
chore(bstein-dev-home): automated image update
d2d4b601f3
chore(bstein-dev-home): automated image update
4b52203532
bstein-dev-home: add onboarding e2e job
f628d2768b
bstein-dev-home: fix onboarding e2e job url
8cdd5fa1ba
test: stabilize portal onboarding e2e
6bda606760
bstein-dev-home: relax health probe timeouts
300873f743
chore(bstein-dev-home): automated image update
7407d42f98
chore(bstein-dev-home): automated image update
d21f18d920
tests: add Keycloak email probe
cadb0daba0
keycloak: allow e2e client execute-actions-email
eb11eaff4e
test: fix keycloak execute-actions-email probe
7cbbb7e193
test: send execute-actions-email to existing mailbox
38b4935e1d
test: ensure smtp probe user has email
a7f68ddddb
tests(portal): verify access requests via email
04b730dbab
chore(bstein-dev-home): automated image update
d7c44e65a6
chore(bstein-dev-home): automated image update
d2fa996b8a
tests(portal): rerun onboarding e2e job
d0e088e50a
tests(portal): refresh keycloak token during e2e
4b77f909af
tests(portal): rerun onboarding e2e job (7)
bbb15a6532
fix(bstein-dev-home): harden backend gunicorn
4a841a1660
tests(portal): rerun onboarding e2e job (8)
0b96894e7a
test(portal): approve requests via admin API
c298946ce0
test(portal): improve e2e auth errors
b9d2fa8277
test(portal): use external Keycloak URL
c53d310c59
test(portal): sync e2e client secret
17a9a7e245
fix(portal): pin kubectl image digest
55606e5b70
chore(bstein-dev-home): automated image update
6f784c94a4
chore(bstein-dev-home): automated image update
333481bd67
chore(bstein-dev-home): automated image update
1a8b3ce304
chore(bstein-dev-home): automated image update
20332f7029
test(portal): stop requiring totp
6eeff1271c
chore(bstein-dev-home): automated image update
b82e2b99db
chore(bstein-dev-home): automated image update
b28fdece0a
chore(bstein-dev-home): automated image update
31994f9243
chore(bstein-dev-home): automated image update
9ff8fc9e72
portal: add test user cleanup tool
e66e782e4a
chore(bstein-dev-home): automated image update
58f36edf92
chore(bstein-dev-home): automated image update
291073884a
chore(bstein-dev-home): automated image update
64cdcec364
chore(bstein-dev-home): automated image update
513dce99b6
chore(bstein-dev-home): automated image update
f735dba10d
chore(bstein-dev-home): automated image update
211504d47a
chore(bstein-dev-home): automated image update
cf0e5bfc89
chore(bstein-dev-home): automated image update
70ed083d96
chore(bstein-dev-home): automated image update
4c59fccedf
chore(bstein-dev-home): automated image update
eff9bfb761
test(portal): align onboarding E2E with vaultwarden-first flow
2e52956155
test(portal): tolerate slow approval endpoint
0805dbc5e9
chore(bstein-dev-home): automated image update
010a0b5e22
chore(bstein-dev-home): automated image update
5470002e3e
chore(bstein-dev-home): automated image update
3ede688676
chore(bstein-dev-home): automated image update
38eceaadfa
scripts: add atlas test cleanup
08c54d3d01
chore(bstein-dev-home): automated image update
089e8155ae
chore(bstein-dev-home): automated image update
86c6c5a0f8
chore(bstein-dev-home): automated image update
5358559787
chore(bstein-dev-home): automated image update
9d9c2830f7
chore(bstein-dev-home): automated image update
3e2a90e377
chore(bstein-dev-home): automated image update
ad7ac5b38d
chore(bstein-dev-home): automated image update
5877611b4f
chore(bstein-dev-home): automated image update
55b25fbfd6
scripts: harden atlas cleanup script
89d47cba79
monitoring(dashboards): tune namespace share metrics
28a5d53c98
scripts: add vaultwarden test cleanup
a4105c68db
mailu: disable unauthenticated pod relay
6195005206
mailu: remove pod network relay
ec208fe0f6
monitoring: add Postmark bounce exporter
d132917d9e
monitoring: add Postmark mail dashboard
9be25e16fe
monitoring: add Postmark today window
12b579d951
monitoring: restart postmark exporter
1fb56bae70
monitoring: refine mail stats and add send-limit usage
d5d2fc66b9
monitoring: refine mail overview panels
5fcff4fc8a
mailu: harden relay restrictions
7d64f0d1d9
monitoring: add titan-jh control plane node
a14726350c
nextcloud: default mail html
109c17dd95
titan-jh: enable node exporter
6a4b7f4431
mailu: harden relay + fix postmark exporter
c693e695b4
mailu: enable smtpd sasl auth
4d92263871
nextcloud: set theming via app config
e8cf4070b5
flux: track nextcloud app
bf358bcdfd
nextcloud: call occ via absolute path
8a12c8cdbd
nextcloud: restore app files for maintenance job
37e8e691e2
nextcloud/monitoring: fix perms and mail panels
556b714e50
nextcloud: reset empty config on boot
d4f1d01b9c
nextcloud: ensure data dir and perms
46884bdd0c
nextcloud: install when config missing
7283a740e6
atlasbot: add KB + read-only tools
6728b4f4ae
nextcloud: run install init as root
91d4ecf451
knowledge: add runbooks skeleton
0a8e8e27da
nextcloud: install without runuser
4a5f3d4c92
atlasbot: fix kb loader import
b313569e2f
atlasbot: add PromQL + cluster snapshot
221fda50a6
nextcloud: run install occ as www-data
45563f74b3
nextcloud: add one-time db reset job
c954fb7546
nextcloud: reinstall when config not installed
b9d75d279c
nextcloud: fix install command quoting
e5cb4571d8
nextcloud: fix su command quoting
36552e425f
nextcloud: remove db reset job
39d57613db
nextcloud: ensure oidc/mail/external apps installed
5fe584cc5f
nextcloud: install oidc/mail/external apps from releases
7a7433f824
nextcloud: pin app download URLs
93b219e571
nextcloud: register custom apps path
99e56fe1b4
nextcloud: pin mail/external app versions for 29
f1e94717ed
nextcloud: reinstall custom apps with compatible mail
a15a2ce923
nextcloud: restore mimetype defaults for external app
2d6883eb67
nextcloud: force OIDC login
9d9aa5b64b
nextcloud: enforce OIDC-only config
16dc0e16f1
nextcloud: allow OIDC auto user creation
58bc646621
nextcloud: rebind data pvc to prior volume
8749d8a884
mailu: harden postfix relay restrictions
ef0dfab20c
nextcloud: restore app and user-data volumes
428c2b5435
nextcloud: rebind user data pvc to restore data
da81946771
nextcloud: restore single data volume mount
46c0a4e290
nextcloud: align app/data mounts
7506919394
nextcloud-mail-sync: align data mount
5a92e99c8d
nextcloud: stabilize install guardrails
cb7429a6a1
nextcloud: reset storage mounts and restore office
3db0661a48
nextcloud: fix db reset command
52295538a0
nextcloud: install oidc login via app store
59b719da54
nextcloud: reset external app config and force reinstall
77ce04c562
nextcloud: install oidc app from release tarball
c928b7805c
nextcloud: avoid forcing installed flag
6850f7b2fc
comms: restore Matrix guest join
ff395f7cf2
nextcloud: preserve config merge and stop db reset
9d5ba6adfe
comms: ensure seeder is Synapse admin
1bcb9baba2
comms: implement MAS-backed guest register
a711c450d3
nextcloud: persist web root in pvc
9bb90053a1
comms: add Synapse guest appservice secret job
4a55b39b0d
comms: restore Synapse guest join
7ba578ed21
comms: mint guest sessions via MAS
376cbf6d70
nextcloud: reset storage claims
c111f773b7
comms: add guest register module scaffolding
949995a8a0
comms: restore Element guest registration
44404aa2f2
comms: move guest register module endpoint
eb1cb8cb00
comms: restart synapse + guest proxy
49ec3d1be8
comms: return 405 for GET /register
658e434e65
comms: re-enable guest name randomizer
c950c32e93
comms: set guest displayname at registration
695e1ec322
comms: serve register flows for guest UI
cd4b963db4
comms: issue guest tokens via MAS
70e40b281f
comms: fix guest registration via MAS admin API
e44ee3ab2d
comms: fix guest rename job with MAS admin sessions
47f0ff7c01
comms: fix guest randomizer syntax
ca49c84086
comms: rerun synapse admin seeder job
57e414adc6
comms: rename guests via MAS admin sessions
d3ac4726e2
comms: consolidate stack manifests
660b49bc5d
comms: track local knowledge markdown
9a76680cc4
comms: retry guest rename when MAS restarts
3aa36e87b8
comms: ensure MAS secrets via keycloak admin job
05848223eb
keycloak: retry MAS secret bootstrap
2aea7e3601
keycloak: rerun MAS secrets bootstrap
afce04b9b2
keycloak: allow MAS secret apply read access
e9fb11af40
keycloak: make MAS secret job idempotent
6c99eb452e
keycloak: use create for MAS secrets
6e7118c14d
comms: allow MAS secrets create
1c9efd6808
keycloak: rerun MAS secrets bootstrap
9d3b27e567
comms: grant MAS secret bootstrap cluster role
9a544010fb
keycloak: rerun MAS secrets bootstrap
6e0b3c43bd
comms: restart MAS after secret bootstrap
b95683da2a
comms: ensure mas db secret
0e55dbeaa9
comms: fix mas db ensure rbac
c8fc1dd10a
comms: bootstrap mas db secret
ef064ed2bb
comms: stabilize mas db job
72d4766d68
comms: ensure mas db via postgres exec
0250de8636
comms: allow postgres exec for mas db
e18accc099
comms: keep mas db job logs on failure
8950306c53
comms: add mas db secret stub
df5a5127f1
comms: fix mas db psql exec
3d2f04d672
comms: simplify mas db creation
898a33d8ee
comms: avoid psql vars for mas
e384a9e417
comms: ensure mas password is url-safe
05c2d245b9
comms: verify mas db login
4f462b8fa7
comms: restart mas after db sync
bebb87fcf8
comms: let mas db secret be job-owned
4db5ff68eb
comms: restart mas after secret fix
39d8c9e687
sso: fix mas encryption secret
072af083bc
comms: restart mas after encryption fix
c1e74c1001
sso: strip mas secret newlines
04817691c6
comms: restart mas after secret regen
f8d172c5a2
sso: validate mas encryption length
8d1284412f
sso: recheck mas encryption bytes
d3c3db612d
comms: restart mas after secret cleanup
aa30a34828
comms: ensure core secrets and synapse oidc
76deb9a160
sso: run synapse oidc job with kubectl
220cc1f31a
sso: install kubectl in synapse oidc job
5a23514a30
comms: use synapse auth for bot jobs
85dce4f975
comms: fix auth env indentation
99ed78ea7f
comms: bump othrys reset job
bfe623892a
comms: revert bot auth to mas
12ab281528
comms: enable synapse password login
9172f1e140
comms: switch bot auth back to synapse
ac7217a32c
comms: retry atlasbot login
97e7c69244
comms: rerun bstein room cleanup
52df8094f5
comms: retry mas token for room cleanup
31ca499c04
comms: retry room leave actions
7860003f15
comms: use mas proxy for leave job
6b5deb886f
comms: accept missing rooms in cleanup
0b09f46bb1
comms: retry othrys reset login
a1f1c9ada0
comms: route othrys reset via mas
fce33f02ff
comms: seed synapse bot users
28bcf716d0
comms: fix synapse seed booleans
c05cb414aa
comms: bind synapse to ipv4
acedad02c0
comms: add mas bot users and revert synapse auth
7bea022311
comms: rerun othrys room reset
fa6566ffc8
comms: verify mas bot logins
94c1395c8c
comms: tidy stack and guest naming
2a6f0a8db3
comms: re-run signing key and synapse oidc
d3c6ddeead
keycloak: re-run mas secrets ensure
0fc4b299da
comms: make guest renamer MAS-only
c909d45fda
comms: rerun MAS local user ensure
835146bd5b
comms: set MAS user passwords via set-password
4eb82811b5
comms: use full user IDs for MAS logins
d870e97b38
comms: make room reset a suspended cronjob
ffddd71116
comms: rerun MAS local user ensure (v5)
70a707872e
comms: skip synapse admin list on 403
b86800cd6d
comms: mint guest tokens via MAS login
59305ca27c
comms: rename numeric guests via db
831f368493
comms: fix guest renamer db sql quoting
d8c3bb2f1b
comms: include full_user_id when renaming
1cce304872
comms: update numeric guest rename logic
41a762d6a6
comms: serialize guest renamer inserts
a272a219a4
comms: kick numeric members from Othrys
a57448f074
logging: add loki and fluent-bit
1027fe5ce5
logging: fix loki single-binary mode
1fd4a426b4
logging: fix loki config and fluent-bit output
e5d04f2bcf
logging: drop fluent-bit label_keys
0463c2bf60
logging: keep loki defaults for canary and gateway
19d236ab43
logging: trim loki compactor config
c87a34a0f9
logging: add loki delete_request_store
e305d312b1
logging: disable fluent-bit inotify watcher
19f1060b87
logging: fix fluent-bit loki labels
f8fad8d599
logging: set systemd journal path
c4980b975c
logging: point systemd input at /var/log/journal
3694b8f76e
logging: fix oauth2 scope and pin loki to rpi
9e496cb8d6
logging: shrink loki caches for rpi nodes
0b8caa4c7c
logging: pin loki canary to rpi5 nodes
5004bbd8ec
logging: keep loki canary on rpi5 workers
afb7eb80f2
logging: route oauth2-proxy via loki gateway
719f16c4e3
logging: add opensearch dashboards ui
cac71e4a41
logging: fix dashboards cpu limits
b9383c9709
keycloak: fix logs oauth2 cookie secret
7a9cf1df98
logging: pin opensearch ISM job to rpi
b668e2d29e
logging: pin opensearch to rpi5
8e94038858
logging: fix opensearch ism job yaml
0239f57a84
logging: extend dashboards helm timeout
456677cfbb
logging: remove loki and backfill to opensearch
0b78ec663d
logging: manage opensearch pvc size
ecf28580b9
logging: force opensearch replicas to 0
b40a995225
logging: throttle fluent-bit backfill
087026bd23
logging: force dark theme in dashboards
64ddd73b50
logging: add OpenSearch dashboards generator
a25ddd8082
logging: expand OpenSearch dashboards
dd705aeb4a
chore(bstein-dev-home): automated image update
5072cd0b5a
chore(bstein-dev-home): automated image update
c531c206c5
logging: seed OpenSearch observability
b3e03623bd
chore(bstein-dev-home): automated image update
c60f405846
chore(bstein-dev-home): automated image update
67415e665c
logging: add trace analytics ingestion
af9ab30849
logging: pin otel collector image
a870aa6916
logging: add Jenkins build for data-prepper
c6c7259a71
logging: add rpi5 log retention tuning
f4b1519527
logging: drop timestamps option from data-prepper job
1595898947
logging: use kaniko debug image
de8709bc2e
logging: use streaming repo for data-prepper
5e245caf45
logging: force data-prepper repo override
76f3b3f4ea
logging: add data-prepper pull secret
63f1d902b6
logging: extend fluent-bit helm timeout
753cc5900a
logging: tune kubelet image GC on rpi5
6f8696eb0d
logging: tune rpi4 image gc and rpi5 prune
e2efeeacba
maintenance: sweep unused images on arm workers
99a6b4c054
maintenance: fix image sweeper script indentation
b7e5a04265
maintenance: run image sweeper on all nodes
1517dec30b
monitoring: wire grafana smtp sync and alerting provisioning
b53c7d4a1c
monitoring: fix smtp sync image reference
abb15ddbb4
monitoring: allow smtp sync to get target secret
95c3e2de37
monitoring: fix grafana alerting root policy
1ffcb28be5
Fix Jetson device plugin args
f533443c42
monitoring: add alert rules and include titan-20/21 in dashboards
734a537a28
monitoring: remove titan-16 and add titan-20/21 to worker dashboards
33b89c7dc2
monitoring: maintenance panels, extra alerts, update overview
54358df569
knowledge: add metis recovery notes
cac8506929
knowledge: relocate metis doc; monitoring: add cpu high alert
c13b161171
knowledge: add jetson (titan-20/21) details
c8a2e8caf4
knowledge: add titan-db and titan-jh details
0c0b328a1a
knowledge: add control-plane storage details
35dca13026
knowledge: record k3s versions across node classes
a8e6b575af
mailu: use postmark token for relay auth
3a798ae3b1
monitoring: fix infra scopes and add jetson metrics
fcc0a49369
monitoring: classify logging/postgres/maintenance as infra
21b9129abf
monitoring: regenerate dashboards with expanded infra namespaces
fb2c7b22d5
monitoring: treat cert-manager as infrastructure
13df82e07a
chore: remove ci-demo workload
5f4d9b498e
services: add minio, outline, planka
29192b9e7f
chore(bstein-dev-home): automated image update
9df1eb85c3
chore(bstein-dev-home): automated image update
d87d584992
minio: rerun bucket bootstrap job
d673493f89
services: fix outline pg ssl and planka init
6376beebb1
planka: fix init permissions
7a49e99e62
planka: avoid mounting over assets
5a5766c9b5
chore(bstein-dev-home): automated image update
e12d020c51
chore(bstein-dev-home): automated image update
ed9a41bd70
planka: enable project owners via oidc
1a50f51115
outline: move to local storage
35a19a2f7b
planka: default users to project owners
4d6d0b89b2
chore(bstein-dev-home): automated image update
606718459e
chore(bstein-dev-home): automated image update
4d884bfcb1
chore(bstein-dev-home): automated image update
27460f8dc3
chore(bstein-dev-home): automated image update
b01ac8da25
chore(bstein-dev-home): automated image update
6d213e5b25
chore(bstein-dev-home): automated image update
17b733c65e
iac: externalize ConfigMap scripts
6da576a707
iac: localize configmap scripts
3fc9f7bbdb
postgres: add flux + vault csi
5aeec67bfb
gitea: auto-link oidc accounts
073b44e0c3
bstein
added 1 commit 2026-01-13 15:56:34 +00:00
merge main into sso-hardening
eefaf7df2e
bstein
added 1 commit 2026-01-13 15:57:27 +00:00
chore(bstein-dev-home): automated image update
b09100e787
bstein
merged commit 730b9775a3 into main
bstein
referenced this issue from a commit
Merge pull request 'feature/sso-hardening' (#9) from feature/sso-hardening into main
Loading…
x
Reference in New Issue
Block a user
No description provided.
Delete Branch "feature/sso-hardening"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?