Replaces raw hostPath (/srv/data/<app>) with a local-path PVC per app,
so these apps get proper PVC lifecycle semantics and can have a PVC
backup CronJob (matching what gitea already has) instead of being
unbacked host directories. local-path already lives on the same disk
these hostPaths did, so this isn't a storage-tier change.
adguardhome specifically: consolidates the previous split work/+conf/
hostPath mounts into a single PVC mounted at /opt/adguardhome (its own
default convention), since a real deployment can't run two hostPath
subtrees off one PVC.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
The image has no gitea-mcp on PATH (binary lives at /app/gitea-mcp),
and the real binary only accepts -t/-port (Go flag style, no --addr
flag exists) — verified against upstream docs which described flags
that don't match the shipped binary.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
A session cookie scoped to one registrable domain is never sent to a host under
another, so an app on a second domain could not be protected by this instance at
all. It failed with a 500 naming the cause: "return URL host does not match any
configured cookie domain".
`domains` is now a list of {domain, authHost}, matching the upstream
`server.domains` schema. The chart previously emitted `server.hostname` and
`cookies.domain`, which are not in 4.14.1's documented options — a deprecated
form that still worked. The single-domain values remain as shorthand and fold
into one entry, so an existing release renders the same protection it did before.
`portals` is a list too. A portal is one OAuth2 client, chosen by the middleware
address, so two portals means two Pocket ID applications — which is how access
can be separated per domain rather than merely shared across them. Each portal
gets its own Middleware and its own mounted secret, under
/var/run/secrets/traefik-forward-auth/<portal>/.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replaces the Bitnami OCI chart wrapper previously used directly from
the k3s repo (apps/redis). Standalone Deployment, password auth via
existingSecret, optional persistence (defaults to emptyDir to match
current usage as an ephemeral cache/session store).
HA core has migrated the http: config (server_port, ip_ban_enabled,
login_attempts_threshold, use_x_forwarded_for, trusted_proxies) out of
configuration.yaml, causing "already been migrated and is now being
ignored" warnings. Disable http.enabled by default on home-assistant-dev,
mark the section deprecated in both charts, and document removal planned
for appVersion 2027.7.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
v10.11.11 has a broken UpdateNormalizedUsername migration that queries
a column that was never added to the schema. Pin to v10.11.10 and add
version-exclude support to the update script so the daily bot skips
the broken version until upstream fixes it.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Image tags are v10.11.x not 10.11.x — the version-pattern stripping v
caused the pulled tag to not exist. Drop version-pattern and keep v prefix
in both appVersion and image.tag so hs node can pull the image again.
- HOME=/config makes rtorrent read /config/.rtorrent.rc and use /config/session/
- flood --auth none disables login requirement
- flood --rtsocket points to socket path from rtorrent.rc
- rtorrentSocket value used consistently in both configmap and command args
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
hotio/rflood bundles rtorrent with a scheduler assertion bug that fires
on torrent delete and shutdown. jesec/rtorrent-flood uses an actively
maintained rtorrent fork with this fixed.
Changes:
- Image: hotio/rflood → jesec/rtorrent-flood:4.14.2
- webuiPort: 3000 → 3001
- Add ConfigMap for .rtorrent.rc (jesec requires explicit config)
- Replace PUID/PGID env vars with pod securityContext (runAsUser/Group 1001)
- Liveness probe: exec rtxmlrpc → httpGet on webui port
- Remove TCP RPC port from service (jesec uses Unix socket)
- Update version-source to dockerhub-tags-pattern for jesec tags
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
rtorrent periodically freezes blocking Flood's XMLRPC calls (activity-stream
and client/settings hang). Root causes: pieces.memory.max=1800M near the 2Gi
container limit; no liveness probe to trigger pod restart on hang.
- Liveness probe: exec rtxmlrpc system.time_seconds with 10s timeout; restart
pod after 3 consecutive failures (every 30s check)
- Default memory limit raised from 2Gi to 4Gi
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Upstream cut a v7.4.1 GitHub release but never published the matching
ghcr.io/homeassistant-ai/ha-mcp:7.4.1 image, so the auto-bumped chart
broke every consumer with ImagePullBackOff. Roll back to 7.4.0 which
is the latest image actually published.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Recreate strategy caused full downtime when a chart appVersion bump
referenced an unpublished image tag. Switch to RollingUpdate with
maxUnavailable=0 so the old pod stays up until the new one is Running,
and add an image.tag override so consumers can pin to a working tag
when appVersion races ahead of the published image.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
shaandClaude Sonnet 5