Venus OS (Victron Cerbo GX) serves Node-RED on :1881 over HTTPS with a
self-signed certificate, so the server cannot reach it without waiving
verification -- it starts fine and then logs "could not detect Node-RED
version" while every tool fails. Exposes upstream's NODERED_INSECURE,
defaulted off.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
MCP server exposing a Node-RED instance's admin API as agent tools.
Single Deployment + Service + Ingress, image tracked off the upstream
releases -- the tags are v-prefixed but the ghcr image tags are not,
hence the version-pattern.
MCP_HTTP_TOKEN is required rather than optional: upstream's listener
binds all container interfaces, so there is no loopback-trust mode. The
chart therefore requires existingSecret instead of defaulting it away.
readOnly defaults on, so an agent cannot deploy flows by accident.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Pocket ID rejects the authorization request outright when its OIDC client
has PKCE required -- "This client requires PKCE, but the 'code_challenge'
parameter is missing" -- which is the default for clients created in recent
Pocket ID versions. Every app behind the portal fails at login, not just
the one being tested.
Upstream supports this via the pocketID provider's enablePKCE flag; the
chart never emitted it, so it stayed at its false default. Adds it to the
normalised portal shape (per-portal override via portals[].pocketID.enablePKCE)
and defaults it on, since PKCE is harmless when the client does not require it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds a standalone chart for Node-RED (Deployment, Service, PVC, Ingress)
with image version tracked via the version-source annotation for
scripts/update-charts.sh.
The secret volume's default file mode (0644) is world-readable, and
Garage refuses to start with rpc_secret_file/admin_token_file/
metrics_token_file at anything looser than 0600. Set defaultMode:
0600 on the secrets volume.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
The dxflrs/garage image ships as a single static binary with no
ENTRYPOINT and no shell, so `args: [server]` alone was exec'd as the
command (crash loop) and the shell-based postStart layout-bootstrap
hook could never run. Set command: [/garage] explicitly, and replace
the automated hook with documented one-time `kubectl exec` steps.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
S3-compatible object store (dxflrs/garage), single-node by default with
hostPath/PVC persistence, existingSecret for rpc/admin/metrics tokens, and
a postStart hook that bootstraps the single-node layout automatically.
Tracks upstream via dockerhub-tags-pattern for scripts/update-charts.sh.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
Bridges eWeLink Wi-Fi and Zigbee devices into Matter (HomeKit,
Google Home, Alexa, Home Assistant). Uses a Multus macvlan interface
instead of hostNetwork, since CUBE OS hardcodes host port 80/1883
which would otherwise collide with Traefik on the same node.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BU7b2w8XZPbD7uXRfjKwcm
rh's shared postgres cluster was upgraded to PostgreSQL 18; the
pg_dump client used for pocket-id's DB backup (and the one-shot
dbInit job) should match the server's major version.
Flux's HelmChart uses reconcileStrategy: ChartVersion, so the
config-mount fix in the previous commit was never actually picked up
without a version bump.
github-actions[bot]
sha