fix/wordpress-php85-php2shell
3
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 claude-bot
|
469cdbc2ee |
feat: give the remaining unprobed workloads a health check
Continues the paperless change. Under the split where gatus watches from
outside and Kubernetes watches the pods, a container with no probe at all is
the hole: it stays Ready while dead, and nothing downstream can tell.
Not every one of them got a probe, and the ones that did not are the more
interesting half.
Added:
whisper, openwakeword tcpSocket on the wyoming port. These speak a raw
speech-to-phrase TCP protocol with no HTTP surface and no health
verb, so accepting a connection is all that can
be asserted from outside the process. Weak, but
the previous state was nothing at all, and a dead
server kept being routed speech.
speech-to-phrase gets a startupProbe rather than
a long liveness delay: it runs --retrain-on-start
and retraining takes as long as it takes. The
gate allows 10 minutes and only then hands over,
so a slow retrain is not mistaken for a hang
while a real hang is still caught in a minute.
ftp-scanner tcpSocket on the FTP control port. This is the
failure that hides best: if vsftpd dies, the
scanner cannot deposit anything and paperless
just sees an empty consume directory, which looks
exactly like nobody having scanned.
code-server httpGet /healthz. Answers 200 whenever the server
is up; its body reports session heartbeat, which
is not health — an idle editor reports "expired"
and is fine.
external-secrets livenessProbe/readinessProbe enabled through the
chart's own values, which is also what starts its
health server: without them the controller
exposes nothing but a metrics port. A wedged
reconciler stayed Ready while every ExternalSecret
silently stopped refreshing.
Deliberately left alone:
protonmail-bridge Already carries a rationale: the bridge can be
offline while the user re-authenticates, and
paperless retries mail fetches itself. A liveness
probe would restart it mid-re-auth. That is a
considered decision, not an omission.
bridge-tls-proxy socat binds 127.0.0.1:11143. Probes are dialled
by the kubelet against the pod IP, so there is
nothing for it to reach.
mariadb-operator Its chart exposes no probe values and no health
bind address. Forcing them through a postRenderer
would break on the next chart bump, so it stays
unprobed and this records why.
ak-outpost-* (11) Pod specs are owned by the goauthentik.io
operator; nothing here can add to them.
Validated with Flux's field manager against the live cluster.
|
||
  k.rennerandClaude Opus 4.7
|
4f6f90280c |
feat(image-automation): enroll 10 apps in Flux image automation
Pins images that were on `latest` / `release` / `stable` to specific
versions so Flux's image-policy can compare against them, and adds
ImageRepository + ImagePolicy + marker comments for each.
Pinned (was → now):
- immich-server release → v2.7.5
- immich-machine-learning release → v2.7.5
- home-assistant stable → 2026.4.4 (calver)
- matter-server stable → 8.1.0
- zwave-js-ui latest → 11.16.2
- wyoming-whisper latest → 3.1.0
- wyoming-openwakeword latest → 2.1.0
- wyoming-speech-to-phrase latest → 1.4.3
- cloudflared latest → 2026.3.0 (calver)
Already pinned, marker added only:
- audiobookshelf (2.x)
- music-assistant (2.x)
- gatus (5.x, v-prefix filtered)
- paperless-ngx (already in pilot commit)
Tag-pattern handling:
- Plain semver: range-only ImagePolicy.
- v-prefix (gatus): filterTags strips v before semver compares;
written tag retains the v.
- Calver (home-assistant, cloudflared): same 3-component compare;
range needs a yearly bump.
- Pre-release filter (matter-server): pattern excludes 8.x.0bN
pre-release tags.
ImageUpdateAutomation will pick these up on its next pass and bump
any image whose policy resolves to a newer in-range tag.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
k.rennerandClaude Opus 4.7
|
ca75e7d08b |
feat(home-assistant): scaffold matter-server, otbr, voice + zone-configurator
Six sibling Deployments under the home-assistant namespace, plus six
Flux Kustomizations wired into clusters/homelab/home-assistant.yaml:
matter-server — ghcr.io/home-assistant-libs/python-matter-server
hostNetwork on edge for mDNS, PVC for fabric data
otbr — openthread/otbr; RADIO_URL placeholder for the 2nd
SLZB (TBD-SLZB-HOSTNAME); hostNetwork + NET_ADMIN
zone-configurator — Everything Presence Lite zone setup web UI
whisper — rhasspy/wyoming-whisper, model PVC, German default
openwakeword — rhasspy/wyoming-openwakeword, ok_nabu preload
speech-to-phrase — Wyoming STP; consumes HA token from existing
prometheus-token Secret + WS to home-assistant svc
FIXMEs marked inline for: zone-configurator image path, speech-to-phrase
image path, otbr SLZB hostname. Several Kustomizations land with
wait:false until those are confirmed so they don't block the chain.
Hostnames left as-is (whisper, openwakeword, etc.) — HA's restored
.storage references the old core-* names; user reconfigures via UI
post-migration per discussion.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|