The secret volume's default file mode (0644) is world-readable, and
Garage refuses to start with rpc_secret_file/admin_token_file/
metrics_token_file at anything looser than 0600. Set defaultMode:
0600 on the secrets volume.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
The dxflrs/garage image ships as a single static binary with no
ENTRYPOINT and no shell, so `args: [server]` alone was exec'd as the
command (crash loop) and the shell-based postStart layout-bootstrap
hook could never run. Set command: [/garage] explicitly, and replace
the automated hook with documented one-time `kubectl exec` steps.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
S3-compatible object store (dxflrs/garage), single-node by default with
hostPath/PVC persistence, existingSecret for rpc/admin/metrics tokens, and
a postStart hook that bootstraps the single-node layout automatically.
Tracks upstream via dockerhub-tags-pattern for scripts/update-charts.sh.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
Bridges eWeLink Wi-Fi and Zigbee devices into Matter (HomeKit,
Google Home, Alexa, Home Assistant). Uses a Multus macvlan interface
instead of hostNetwork, since CUBE OS hardcodes host port 80/1883
which would otherwise collide with Traefik on the same node.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BU7b2w8XZPbD7uXRfjKwcm
rh's shared postgres cluster was upgraded to PostgreSQL 18; the
pg_dump client used for pocket-id's DB backup (and the one-shot
dbInit job) should match the server's major version.
Flux's HelmChart uses reconcileStrategy: ChartVersion, so the
config-mount fix in the previous commit was never actually picked up
without a version bump.
The freepeak/db-mcp-server image ships a baked-in CONFIG_PATH pointing
at its own bundled sample config; a same-named env var does not take
priority over an existing file at that path, so DB_CONFIG was
silently ignored and the server came up serving the sample databases
instead of ours. Mount the real config as a file at /app/config.json
instead.
Wraps FreePeak/db-mcp-server: multi-database Postgres MCP driven by a
single JSON connection list, so new databases don't need a new Helm
release. Includes per-connection read_only/max_rows/query_timeout/
masking_rules guardrails and a PVC-backed audit log.
Mounting the whole PVC at /opt/adguardhome hid the AdGuardHome binary
that ships inside the image at that exact path, crash-looping the pod
(exec: /opt/adguardhome/AdGuardHome: no such file or directory). Use
subPath mounts for work/ and conf/ instead, same as the original split
hostPath layout, just backed by one PVC now.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
Replaces raw hostPath (/srv/data/<app>) with a local-path PVC per app,
so these apps get proper PVC lifecycle semantics and can have a PVC
backup CronJob (matching what gitea already has) instead of being
unbacked host directories. local-path already lives on the same disk
these hostPaths did, so this isn't a storage-tier change.
adguardhome specifically: consolidates the previous split work/+conf/
hostPath mounts into a single PVC mounted at /opt/adguardhome (its own
default convention), since a real deployment can't run two hostPath
subtrees off one PVC.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
The image has no gitea-mcp on PATH (binary lives at /app/gitea-mcp),
and the real binary only accepts -t/-port (Go flag style, no --addr
flag exists) — verified against upstream docs which described flags
that don't match the shipped binary.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
A session cookie scoped to one registrable domain is never sent to a host under
another, so an app on a second domain could not be protected by this instance at
all. It failed with a 500 naming the cause: "return URL host does not match any
configured cookie domain".
`domains` is now a list of {domain, authHost}, matching the upstream
`server.domains` schema. The chart previously emitted `server.hostname` and
`cookies.domain`, which are not in 4.14.1's documented options — a deprecated
form that still worked. The single-domain values remain as shorthand and fold
into one entry, so an existing release renders the same protection it did before.
`portals` is a list too. A portal is one OAuth2 client, chosen by the middleware
address, so two portals means two Pocket ID applications — which is how access
can be separated per domain rather than merely shared across them. Each portal
gets its own Middleware and its own mounted secret, under
/var/run/secrets/traefik-forward-auth/<portal>/.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replaces the Bitnami OCI chart wrapper previously used directly from
the k3s repo (apps/redis). Standalone Deployment, password auth via
existingSecret, optional persistence (defaults to emptyDir to match
current usage as an ephemeral cache/session store).
shaandClaude Sonnet 5