MCP server exposing a Node-RED instance's admin API as agent tools.
Single Deployment + Service + Ingress, image tracked off the upstream
releases -- the tags are v-prefixed but the ghcr image tags are not,
hence the version-pattern.
MCP_HTTP_TOKEN is required rather than optional: upstream's listener
binds all container interfaces, so there is no loopback-trust mode. The
chart therefore requires existingSecret instead of defaulting it away.
readOnly defaults on, so an agent cannot deploy flows by accident.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Pocket ID rejects the authorization request outright when its OIDC client
has PKCE required -- "This client requires PKCE, but the 'code_challenge'
parameter is missing" -- which is the default for clients created in recent
Pocket ID versions. Every app behind the portal fails at login, not just
the one being tested.
Upstream supports this via the pocketID provider's enablePKCE flag; the
chart never emitted it, so it stayed at its false default. Adds it to the
normalised portal shape (per-portal override via portals[].pocketID.enablePKCE)
and defaults it on, since PKCE is harmless when the client does not require it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds a standalone chart for Node-RED (Deployment, Service, PVC, Ingress)
with image version tracked via the version-source annotation for
scripts/update-charts.sh.
The secret volume's default file mode (0644) is world-readable, and
Garage refuses to start with rpc_secret_file/admin_token_file/
metrics_token_file at anything looser than 0600. Set defaultMode:
0600 on the secrets volume.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
The dxflrs/garage image ships as a single static binary with no
ENTRYPOINT and no shell, so `args: [server]` alone was exec'd as the
command (crash loop) and the shell-based postStart layout-bootstrap
hook could never run. Set command: [/garage] explicitly, and replace
the automated hook with documented one-time `kubectl exec` steps.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
S3-compatible object store (dxflrs/garage), single-node by default with
hostPath/PVC persistence, existingSecret for rpc/admin/metrics tokens, and
a postStart hook that bootstraps the single-node layout automatically.
Tracks upstream via dockerhub-tags-pattern for scripts/update-charts.sh.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH
Bridges eWeLink Wi-Fi and Zigbee devices into Matter (HomeKit,
Google Home, Alexa, Home Assistant). Uses a Multus macvlan interface
instead of hostNetwork, since CUBE OS hardcodes host port 80/1883
which would otherwise collide with Traefik on the same node.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BU7b2w8XZPbD7uXRfjKwcm
rh's shared postgres cluster was upgraded to PostgreSQL 18; the
pg_dump client used for pocket-id's DB backup (and the one-shot
dbInit job) should match the server's major version.
Flux's HelmChart uses reconcileStrategy: ChartVersion, so the
config-mount fix in the previous commit was never actually picked up
without a version bump.
The freepeak/db-mcp-server image ships a baked-in CONFIG_PATH pointing
at its own bundled sample config; a same-named env var does not take
priority over an existing file at that path, so DB_CONFIG was
silently ignored and the server came up serving the sample databases
instead of ours. Mount the real config as a file at /app/config.json
instead.
Wraps FreePeak/db-mcp-server: multi-database Postgres MCP driven by a
single JSON connection list, so new databases don't need a new Helm
release. Includes per-connection read_only/max_rows/query_timeout/
masking_rules guardrails and a PVC-backed audit log.
Mounting the whole PVC at /opt/adguardhome hid the AdGuardHome binary
that ships inside the image at that exact path, crash-looping the pod
(exec: /opt/adguardhome/AdGuardHome: no such file or directory). Use
subPath mounts for work/ and conf/ instead, same as the original split
hostPath layout, just backed by one PVC now.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
Replaces raw hostPath (/srv/data/<app>) with a local-path PVC per app,
so these apps get proper PVC lifecycle semantics and can have a PVC
backup CronJob (matching what gitea already has) instead of being
unbacked host directories. local-path already lives on the same disk
these hostPaths did, so this isn't a storage-tier change.
adguardhome specifically: consolidates the previous split work/+conf/
hostPath mounts into a single PVC mounted at /opt/adguardhome (its own
default convention), since a real deployment can't run two hostPath
subtrees off one PVC.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
The image has no gitea-mcp on PATH (binary lives at /app/gitea-mcp),
and the real binary only accepts -t/-port (Go flag style, no --addr
flag exists) — verified against upstream docs which described flags
that don't match the shipped binary.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01566weDFku8TaRC2CJUPVM1
A session cookie scoped to one registrable domain is never sent to a host under
another, so an app on a second domain could not be protected by this instance at
all. It failed with a 500 naming the cause: "return URL host does not match any
configured cookie domain".
`domains` is now a list of {domain, authHost}, matching the upstream
`server.domains` schema. The chart previously emitted `server.hostname` and
`cookies.domain`, which are not in 4.14.1's documented options — a deprecated
form that still worked. The single-domain values remain as shorthand and fold
into one entry, so an existing release renders the same protection it did before.
`portals` is a list too. A portal is one OAuth2 client, chosen by the middleware
address, so two portals means two Pocket ID applications — which is how access
can be separated per domain rather than merely shared across them. Each portal
gets its own Middleware and its own mounted secret, under
/var/run/secrets/traefik-forward-auth/<portal>/.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replaces the Bitnami OCI chart wrapper previously used directly from
the k3s repo (apps/redis). Standalone Deployment, password auth via
existingSecret, optional persistence (defaults to emptyDir to match
current usage as an ephemeral cache/session store).
HA core has migrated the http: config (server_port, ip_ban_enabled,
login_attempts_threshold, use_x_forwarded_for, trusted_proxies) out of
configuration.yaml, causing "already been migrated and is now being
ignored" warnings. Disable http.enabled by default on home-assistant-dev,
mark the section deprecated in both charts, and document removal planned
for appVersion 2027.7.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
v10.11.11 has a broken UpdateNormalizedUsername migration that queries
a column that was never added to the schema. Pin to v10.11.10 and add
version-exclude support to the update script so the daily bot skips
the broken version until upstream fixes it.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Image tags are v10.11.x not 10.11.x — the version-pattern stripping v
caused the pulled tag to not exist. Drop version-pattern and keep v prefix
in both appVersion and image.tag so hs node can pull the image again.
- HOME=/config makes rtorrent read /config/.rtorrent.rc and use /config/session/
- flood --auth none disables login requirement
- flood --rtsocket points to socket path from rtorrent.rc
- rtorrentSocket value used consistently in both configmap and command args
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
hotio/rflood bundles rtorrent with a scheduler assertion bug that fires
on torrent delete and shutdown. jesec/rtorrent-flood uses an actively
maintained rtorrent fork with this fixed.
Changes:
- Image: hotio/rflood → jesec/rtorrent-flood:4.14.2
- webuiPort: 3000 → 3001
- Add ConfigMap for .rtorrent.rc (jesec requires explicit config)
- Replace PUID/PGID env vars with pod securityContext (runAsUser/Group 1001)
- Liveness probe: exec rtxmlrpc → httpGet on webui port
- Remove TCP RPC port from service (jesec uses Unix socket)
- Update version-source to dockerhub-tags-pattern for jesec tags
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
rtorrent periodically freezes blocking Flood's XMLRPC calls (activity-stream
and client/settings hang). Root causes: pieces.memory.max=1800M near the 2Gi
container limit; no liveness probe to trigger pod restart on hang.
- Liveness probe: exec rtxmlrpc system.time_seconds with 10s timeout; restart
pod after 3 consecutive failures (every 30s check)
- Default memory limit raised from 2Gi to 4Gi
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Upstream cut a v7.4.1 GitHub release but never published the matching
ghcr.io/homeassistant-ai/ha-mcp:7.4.1 image, so the auto-bumped chart
broke every consumer with ImagePullBackOff. Roll back to 7.4.0 which
is the latest image actually published.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Recreate strategy caused full downtime when a chart appVersion bump
referenced an unpublished image tag. Switch to RollingUpdate with
maxUnavailable=0 so the old pod stays up until the new one is Running,
and add an image.tag override so consumers can pin to a working tag
when appVersion races ahead of the published image.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
shaandClaude Opus 5