Pocket ID rejects the authorization request outright when its OIDC client
has PKCE required -- "This client requires PKCE, but the 'code_challenge'
parameter is missing" -- which is the default for clients created in recent
Pocket ID versions. Every app behind the portal fails at login, not just
the one being tested.
Upstream supports this via the pocketID provider's enablePKCE flag; the
chart never emitted it, so it stayed at its false default. Adds it to the
normalised portal shape (per-portal override via portals[].pocketID.enablePKCE)
and defaults it on, since PKCE is harmless when the client does not require it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds a standalone chart for Node-RED (Deployment, Service, PVC, Ingress)
with image version tracked via the version-source annotation for
scripts/update-charts.sh.
The secret volume's default file mode (0644) is world-readable, and
Garage refuses to start with rpc_secret_file/admin_token_file/
metrics_token_file at anything looser than 0600. Set defaultMode:
0600 on the secrets volume.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
The dxflrs/garage image ships as a single static binary with no
ENTRYPOINT and no shell, so `args: [server]` alone was exec'd as the
command (crash loop) and the shell-based postStart layout-bootstrap
hook could never run. Set command: [/garage] explicitly, and replace
the automated hook with documented one-time `kubectl exec` steps.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
S3-compatible object store (dxflrs/garage), single-node by default with
hostPath/PVC persistence, existingSecret for rpc/admin/metrics tokens, and
a postStart hook that bootstraps the single-node layout automatically.
Tracks upstream via dockerhub-tags-pattern for scripts/update-charts.sh.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
Bridges eWeLink Wi-Fi and Zigbee devices into Matter (HomeKit,
Google Home, Alexa, Home Assistant). Uses a Multus macvlan interface
instead of hostNetwork, since CUBE OS hardcodes host port 80/1883
which would otherwise collide with Traefik on the same node.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BU7b2w8XZPbD7uXRfjKwcm
rh's shared postgres cluster was upgraded to PostgreSQL 18; the
pg_dump client used for pocket-id's DB backup (and the one-shot
dbInit job) should match the server's major version.
Flux's HelmChart uses reconcileStrategy: ChartVersion, so the
config-mount fix in the previous commit was never actually picked up
without a version bump.
The freepeak/db-mcp-server image ships a baked-in CONFIG_PATH pointing
at its own bundled sample config; a same-named env var does not take
priority over an existing file at that path, so DB_CONFIG was
silently ignored and the server came up serving the sample databases
instead of ours. Mount the real config as a file at /app/config.json
instead.
Wraps FreePeak/db-mcp-server: multi-database Postgres MCP driven by a
single JSON connection list, so new databases don't need a new Helm
release. Includes per-connection read_only/max_rows/query_timeout/
masking_rules guardrails and a PVC-backed audit log.
Mounting the whole PVC at /opt/adguardhome hid the AdGuardHome binary
that ships inside the image at that exact path, crash-looping the pod
(exec: /opt/adguardhome/AdGuardHome: no such file or directory). Use
subPath mounts for work/ and conf/ instead, same as the original split
hostPath layout, just backed by one PVC now.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
Replaces raw hostPath (/srv/data/<app>) with a local-path PVC per app,
so these apps get proper PVC lifecycle semantics and can have a PVC
backup CronJob (matching what gitea already has) instead of being
unbacked host directories. local-path already lives on the same disk
these hostPaths did, so this isn't a storage-tier change.
adguardhome specifically: consolidates the previous split work/+conf/
hostPath mounts into a single PVC mounted at /opt/adguardhome (its own
default convention), since a real deployment can't run two hostPath
subtrees off one PVC.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
The image has no gitea-mcp on PATH (binary lives at /app/gitea-mcp),
and the real binary only accepts -t/-port (Go flag style, no --addr
flag exists) — verified against upstream docs which described flags
that don't match the shipped binary.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
shaandClaude Opus 5