Mounting the whole PVC at /opt/adguardhome hid the AdGuardHome binary
that ships inside the image at that exact path, crash-looping the pod
(exec: /opt/adguardhome/AdGuardHome: no such file or directory). Use
subPath mounts for work/ and conf/ instead, same as the original split
hostPath layout, just backed by one PVC now.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
Replaces raw hostPath (/srv/data/<app>) with a local-path PVC per app,
so these apps get proper PVC lifecycle semantics and can have a PVC
backup CronJob (matching what gitea already has) instead of being
unbacked host directories. local-path already lives on the same disk
these hostPaths did, so this isn't a storage-tier change.
adguardhome specifically: consolidates the previous split work/+conf/
hostPath mounts into a single PVC mounted at /opt/adguardhome (its own
default convention), since a real deployment can't run two hostPath
subtrees off one PVC.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
The image has no gitea-mcp on PATH (binary lives at /app/gitea-mcp),
and the real binary only accepts -t/-port (Go flag style, no --addr
flag exists) — verified against upstream docs which described flags
that don't match the shipped binary.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
A session cookie scoped to one registrable domain is never sent to a host under
another, so an app on a second domain could not be protected by this instance at
all. It failed with a 500 naming the cause: "return URL host does not match any
configured cookie domain".
`domains` is now a list of {domain, authHost}, matching the upstream
`server.domains` schema. The chart previously emitted `server.hostname` and
`cookies.domain`, which are not in 4.14.1's documented options — a deprecated
form that still worked. The single-domain values remain as shorthand and fold
into one entry, so an existing release renders the same protection it did before.
`portals` is a list too. A portal is one OAuth2 client, chosen by the middleware
address, so two portals means two Pocket ID applications — which is how access
can be separated per domain rather than merely shared across them. Each portal
gets its own Middleware and its own mounted secret, under
/var/run/secrets/traefik-forward-auth/<portal>/.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replaces the Bitnami OCI chart wrapper previously used directly from
the k3s repo (apps/redis). Standalone Deployment, password auth via
existingSecret, optional persistence (defaults to emptyDir to match
current usage as an ephemeral cache/session store).
HA core has migrated the http: config (server_port, ip_ban_enabled,
login_attempts_threshold, use_x_forwarded_for, trusted_proxies) out of
configuration.yaml, causing "already been migrated and is now being
ignored" warnings. Disable http.enabled by default on home-assistant-dev,
mark the section deprecated in both charts, and document removal planned
for appVersion 2027.7.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
shaandClaude Sonnet 5