feat(bird): swap jq for a pinned kubectl

The init container assembled its config with curl, a hand-managed bearer token and CA path, and jq string interpolation. That is not rendering, it is string building, and it carried the self-exclusion logic as well.

kubectl replaces all three: go-template-file renders from real template files, in-cluster auth needs no token handling, and --field-selector metadata.name!=$NODE_NAME drops the node itself server-side.

Pinned to v1.36.3 with the published checksum, the same shape as ci/images/k8s. Alpine ships 1.33.1, and this API server reports minCompatibilityMinor 35, so the packaged one is out of skew. curl stays for the build download; jq is gone.

Refs #576

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.woodpecker/alert-monitor.yml

@@ -101,7 +101,7 @@ steps:
         bash scripts/ci/make-diag-kubeconfig.sh
 
   - name: alert-triage-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/build-ci-images.yml

@@ -350,17 +350,17 @@ steps:
           --destination gitea.renner.uno/gitea_admin/heating-can:$TAG \
           --destination gitea.renner.uno/gitea_admin/heating-can:latest
 
-  # netbird-service-sync: the controller that reconciles NetBird reverse-proxy
+  # netbird-proxy-services: the controller that reconciles NetBird reverse-proxy
   # services (public Ingress hosts -> TLS passthrough -> Traefik ClusterIP).
   # Runtime artifact like heating-can; same registry so the audit tracks it.
-  - name: build-netbird-service-sync
+  - name: build-netbird-proxy-services
     image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
-    directory: ci/images/netbird-service-sync
+    directory: ci/images/netbird-proxy-services
     depends_on: []
     when:
       - event: deployment
       - event: push
-        path: ["ci/images/netbird-service-sync/**", ".woodpecker/build-ci-images.yml"]
+        path: ["ci/images/netbird-proxy-services/**", ".woodpecker/build-ci-images.yml"]
     environment:
       GITEA_USER: gitea_admin
       GITEA_TOKEN:
@@ -374,39 +374,8 @@ steps:
         /kaniko/executor \
           --context . \
           --dockerfile Containerfile \
-          --destination gitea.renner.uno/gitea_admin/netbird-service-sync:$TAG \
-          --destination gitea.renner.uno/gitea_admin/netbird-service-sync:latest
-
-  # wiki-index: embedding index over the Notes repo's wiki/, fed from Gitea and
-  # queried by ~/Notes/bin/wiki_rank.py. Runtime artifact like netbird-service-sync.
-  - name: build-wiki-index
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
-    directory: ci/images/wiki-index
-    depends_on: []
-    when:
-      - event: deployment
-      - event: push
-        path: ["ci/images/wiki-index/**", ".woodpecker/build-ci-images.yml"]
-    environment:
-      GITEA_USER: gitea_admin
-      GITEA_TOKEN:
-        from_secret: ci_images_token
-    commands:
-      - mkdir -p /kaniko/.docker
-      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
-      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
-      - TAG=$(date +%Y-%m-%d)
-      # Also a per-commit tag: several builds a day (branch pushes and the
-      # merge) all rewrite the dated tag, and the deployment pin raced them
-      # on 2026-09-20. The commit tag is immutable and needs no digest lookup.
-      - SHORT=$(printf '%s' "$CI_COMMIT_SHA" | cut -c1-8)
-      - |
-        /kaniko/executor \
-          --context . \
-          --dockerfile Containerfile \
-          --destination gitea.renner.uno/gitea_admin/wiki-index:$TAG \
-          --destination gitea.renner.uno/gitea_admin/wiki-index:$TAG-$SHORT \
-          --destination gitea.renner.uno/gitea_admin/wiki-index:latest
+          --destination gitea.renner.uno/gitea_admin/netbird-proxy-services:$TAG \
+          --destination gitea.renner.uno/gitea_admin/netbird-proxy-services:latest
 
   # bird: BGP daemon for the pod-network mesh over pod0 (#576). Runtime
   # artifact like heating-can; same registry so the audit tracks it.

.woodpecker/ci-claude-refresh.yml

@@ -14,8 +14,8 @@
 #                 and  ci-claude:latest.  The Containerfile makes this layer
 #                 byte-reproducible, so rebuilding an unchanged version dedups
 #                 in the registry instead of orphaning a fresh ~260 MB copy.
-#   3. bump-pr  — (only when any pin is off the latest version) rewrite every
-#                 consumer pin to  ci-claude:<version>  and open a PR. A human
+#   3. bump-pr  — (only when the version actually changed) rewrite the 5
+#                 consumer pins to  ci-claude:<version>  and open a PR. A human
 #                 reviews and merges it; nothing auto-merges.
 #
 # TAG SCHEME — deliberately version tags (ci-claude:<claude-version>), NOT the dated
@@ -107,22 +107,31 @@ steps:
           [0-9]*.[0-9]*.[0-9]*) : ;;
           *) echo "npm returned an implausible version '$$NEW' — aborting."; exit 1 ;;
         esac
-        # Distinct tags the consumers currently reference. Divergent pins are
-        # normal (a pipeline bumped on its own); the bump rewrites all of them.
-        CUR=$$(grep -hoE 'ci-claude:[0-9][0-9A-Za-z._-]*' $$CONSUMERS | sed 's/^ci-claude://' | sort -u | tr '\n' ' ' | sed 's/ $$//')
-        [ -n "$$CUR" ] || { echo "No ci-claude pin found in the consumers — aborting."; exit 1; }
-        echo "latest=$$NEW  current=[$$CUR]  event=$$CI_PIPELINE_EVENT"
+        # The tag every consumer currently references. They are kept identical,
+        # so this must resolve to EXACTLY ONE non-empty tag; anything else
+        # (no match, or a partial/disagreeing set) aborts rather than risk a
+        # corrupting sed later. Counting with `grep -c .` (non-empty lines)
+        # instead of `wc -l` is deliberate: an empty result yields 0 here but
+        # 1 under wc -l, which would slip past the guard.
+        CUR=$$(grep -hoE 'ci-claude:[0-9A-Za-z._-]+' $$CONSUMERS | sed 's/^ci-claude://' | sort -u)
+        NTAGS=$$(printf '%s' "$$CUR" | grep -c . || true)
+        if [ -z "$$CUR" ] || [ "$$NTAGS" -ne 1 ]; then
+          echo "Expected exactly one ci-claude tag across the consumers, got [$$CUR]."
+          echo "Refusing to guess — fix the pins by hand."; exit 1
+        fi
+        echo "latest=$$NEW  current=$$CUR  event=$$CI_PIPELINE_EVENT"
         printf '%s' "$$NEW" > "$$CI_WORKSPACE/.ci-refresh/version"
         printf '%s' "$$CUR" > "$$CI_WORKSPACE/.ci-refresh/current"
-        # Build when any pin is off latest, or on a push (Containerfile edit must
-        # ship even if the version is unchanged). Bump when any pin is off latest.
+        # Build when the version changed, or on a push (Containerfile edit must
+        # ship even if the version is unchanged). Bump the pins only when the
+        # version the consumers reference is not the latest.
         if [ "$$CUR" != "$$NEW" ] || [ "$$CI_PIPELINE_EVENT" = "push" ]; then
           touch "$$CI_WORKSPACE/.ci-refresh/do-build"; echo "will build $$NEW"
         else
           echo "already on $$NEW — nothing to build"
         fi
         if [ "$$CUR" != "$$NEW" ]; then
-          touch "$$CI_WORKSPACE/.ci-refresh/do-bump"; echo "will open bump PR [$$CUR] -> $$NEW"
+          touch "$$CI_WORKSPACE/.ci-refresh/do-bump"; echo "will open bump PR $$CUR -> $$NEW"
         else
           echo "consumers already pin $$NEW — no PR"
         fi
@@ -166,9 +175,6 @@ steps:
       - |
         [ -f "$$CI_WORKSPACE/.ci-refresh/do-bump" ] || { echo "no version change — no PR"; exit 0; }
         set -eu
-        # Secret values can carry a trailing newline; it breaks the push URL and the auth header.
-        PUSH_TOKEN=$$(printf '%s' "$$PUSH_TOKEN" | tr -d '\r\n')
-        [ -n "$$PUSH_TOKEN" ] || { echo "PUSH_TOKEN is empty — aborting"; exit 1; }
         NEW=$$(cat "$$CI_WORKSPACE/.ci-refresh/version")
         CUR=$$(cat "$$CI_WORKSPACE/.ci-refresh/current")
         # Both were validated non-empty by the decide step; re-assert before a
@@ -184,11 +190,9 @@ steps:
         # is not a maintained list.
         CONSUMERS=$$(grep -rlE 'ci-claude:[0-9]' .woodpecker)
         [ -n "$$CONSUMERS" ] || { echo "No ci-claude consumers found — refusing to continue."; exit 1; }
-        # NEW goes into a sed replacement: allow only a plain x.y.z version.
-        printf '%s' "$$NEW" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$$' || { echo "refusing non-x.y.z version '$$NEW'"; exit 1; }
-        # Every version-pinned tag becomes NEW, whatever it was; consumers only.
+        # Exact-string swap of the current tag for the new one, consumers only.
         for f in $$CONSUMERS; do
-          sed -i "s#ci-claude:[0-9][0-9A-Za-z._-]*#ci-claude:$$NEW#g" "$$f"
+          sed -i "s#ci-claude:$$CUR#ci-claude:$$NEW#g" "$$f"
         done
         # Author is claude-bot (the PAT's account); the commit subject makes
         # the automated-bump nature clear.

.woodpecker/ci-scripts-test.yml

@@ -17,6 +17,6 @@ when:
 
 steps:
   - name: model-selection-tests
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
     commands:
       - sh scripts/ci/test-model-selection.sh

.woodpecker/e2e.yml

@@ -26,7 +26,7 @@ steps:
     # fetch-models.sh response mapping. No cluster, no secrets, no network — the
     # ci-claude image just provides sh + jq. Keeps the flag-injection regression
     # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
     commands:
       - sh scripts/ci/test-model-selection.sh
 

.woodpecker/issue-fix.yml

@@ -62,7 +62,7 @@ steps:
       - bash scripts/ci/make-diag-kubeconfig.sh
 
   - name: issue-fix-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/pr-review.yml

@@ -65,7 +65,7 @@ when:
 
 steps:
   - name: pr-review-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/security-scan.yml

@@ -70,7 +70,7 @@ steps:
     # this step is skipped — otherwise we'd fork-bomb PRs.
     when:
       - branch: master
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/update-audit.yml

@@ -30,7 +30,7 @@ when:
 
 steps:
   - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/wiki-maintenance.yml

@@ -1,119 +0,0 @@
-# Nightly wiki maintenance for the Notes vault (k.renner/notes), replacing the
-# workstation's wiki-maintenance.timer: distill the raw/ backlog into wiki/
-# (a `claude` run of the wiki-distill agent), then audit wiki/ with the vault's
-# own script (structural checks, no model). The pipeline commits and pushes as
-# Claude Bot; the push webhook then refreshes the wiki-index service.
-#
-# The agent and its retrieval scripts address the vault as ~/Notes, so the
-# distill step links $HOME/Notes to the checkout instead of rewriting them.
-when:
-  - event: cron
-    cron: wiki-maintenance
-  # Hand-started runs: `woodpecker pipeline create k.renner/homelab --branch master`.
-  # The typesafe_api_key secret is scoped to cron and manual, not deployment.
-  - event: manual
-
-steps:
-  - name: checkout-notes
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
-    pull: true
-    environment:
-      WIKI_BOT_TOKEN:
-        from_secret: wiki_bot_token
-    commands:
-      - |
-        set -eu
-        # Token only on the wire, never in .git/config. Secrets set from files carry
-        # a trailing newline (run 10220: "could not read Username"); strip CR/LF.
-        TOKEN=$$(printf '%s' "$$WIKI_BOT_TOKEN" | tr -d '\r\n')
-        git -c http.extraheader="AUTHORIZATION: token $$TOKEN" \
-          clone --depth 50 --branch main https://gitea.renner.uno/k.renner/notes.git notes
-        echo "raw backlog: $$(ls notes/raw/*.md | grep -v _index.md | wc -l) file(s)"
-
-  - name: distill
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
-    pull: true
-    environment:
-      CLAUDE_CODE_OAUTH_TOKEN:
-        from_secret: claude_code_oauth_token
-      TYPESAFE_API_KEY:
-        from_secret: typesafe_api_key
-      WIKI_INDEX_BASIC_AUTH:
-        from_secret: wiki_index_basic_auth
-    commands:
-      - |
-        set -eu
-        ln -sfn "$$PWD/notes" "$$HOME/Notes"
-        mkdir -p "$$HOME/.config/wiki-index"
-        printf '%s' "$$WIKI_INDEX_BASIC_AUTH" | tr -d '\r\n' > "$$HOME/.config/wiki-index/basic-auth"
-        chmod 600 "$$HOME/.config/wiki-index/basic-auth"
-        "$$HOME/Notes/bin/wiki_rank.py" --probe-index
-      - |
-        set -eu
-        MODEL=$$(sh scripts/ci/pick-model.sh "distill raw source notes into atomic wiki notes: read sources, check the wiki for existing coverage, write or merge notes; careful writing, moderate reasoning")
-        if [ -n "$$MODEL" ]; then echo "distill: selected model $$MODEL"; else echo "distill: using the CLI default model"; fi
-        cd notes
-        cat ../ci/agents/wiki-maintenance/distill.md | claude $${MODEL:+--model $$MODEL} \
-          --agent wiki-distill \
-          --permission-mode acceptEdits \
-          --allowedTools "Read,Edit,Write,Glob,Grep,Bash(/root/Notes/bin/wiki_rank.py:*),Bash(/root/Notes/bin/wiki_ask.py:*),Bash(mv /root/Notes/raw/:*),Bash(mkdir -p /root/Notes/:*)" \
-          --settings ../ci/agents/wiki-maintenance/settings.json \
-          -p
-
-  - name: audit
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
-    pull: true
-    commands:
-      # Findings are report lines in output/, not a pipeline failure.
-      - python3 -B notes/bin/wiki_audit.py --vault "$$PWD/notes"
-
-  - name: push-notes
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
-    pull: true
-    environment:
-      WIKI_BOT_TOKEN:
-        from_secret: wiki_bot_token
-    commands:
-      - |
-        set -eu
-        cd notes
-        git config user.email "claude-bot@renner.uno"
-        git config user.name "Claude Bot"
-        # Only the vault content is committed; anything an agent leaves elsewhere
-        # in the checkout (run 10362: scratch scripts in the root) stays behind.
-        if [ -z "$$(git status --porcelain -- wiki raw output)" ]; then
-          echo "wiki-maintenance: no changes"
-          exit 0
-        fi
-        # The workstation pushes main on its own (notes-push.path), so main moves
-        # while the agents run (run 10241: non-fast-forward). The run's work goes
-        # to a branch and a PR that this step merges through Gitea; a conflict
-        # leaves the PR open for a human and fails the run.
-        BRANCH="wiki-maintenance/$$(date -u +%F)-$$CI_PIPELINE_NUMBER"
-        git checkout -q -b "$$BRANCH"
-        git add -A -- wiki raw output
-        git commit -q -m "wiki maintenance $$(date -u +%F): distill + audit (CI run $$CI_PIPELINE_NUMBER)"
-        TOKEN=$$(printf '%s' "$$WIKI_BOT_TOKEN" | tr -d '\r\n')
-        git -c http.extraheader="AUTHORIZATION: token $$TOKEN" push origin "HEAD:$$BRANCH"
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/notes"
-        jq -n --arg title "wiki maintenance $$(date -u +%F) (CI run $$CI_PIPELINE_NUMBER)" \
-              --arg body "Nightly distill + audit. Merged by the pipeline; open only if the merge failed." \
-              --arg head "$$BRANCH" '{title: $$title, body: $$body, head: $$head, base: "main"}' > /tmp/pr.json
-        code=$$(curl -s -o /tmp/pr-resp.json -w '%{http_code}' -X POST \
-          -H "Authorization: token $$TOKEN" -H "Content-Type: application/json" --data @/tmp/pr.json "$$API/pulls")
-        echo "POST pull -> HTTP $$code"
-        [ "$$code" -ge 200 ] && [ "$$code" -lt 300 ] || { cat /tmp/pr-resp.json; exit 1; }
-        NUM=$$(jq -r '.number' /tmp/pr-resp.json)
-        # Merge without delete_branch_after_merge: run 10254 got HTTP 500 from that
-        # call although the merge itself had landed. Verify the PR state instead of
-        # trusting the status code, then drop the branch as a separate, best-effort step.
-        code=$$(curl -s -o /tmp/merge-resp.json -w '%{http_code}' -X POST \
-          -H "Authorization: token $$TOKEN" -H "Content-Type: application/json" \
-          --data '{"Do":"merge"}' "$$API/pulls/$$NUM/merge")
-        echo "POST merge #$$NUM -> HTTP $$code"
-        MERGED=$$(curl -s -H "Authorization: token $$TOKEN" "$$API/pulls/$$NUM" | jq -r '.merged')
-        echo "PR #$$NUM merged: $$MERGED"
-        [ "$$MERGED" = "true" ] || { cat /tmp/merge-resp.json; echo "PR #$$NUM left open"; exit 1; }
-        code=$$(curl -s -o /tmp/del-resp.json -w '%{http_code}' -X DELETE -H "Authorization: token $$TOKEN" \
-          "$$API/branches/$$(printf '%s' "$$BRANCH" | sed 's|/|%2F|g')")
-        echo "DELETE branch $$BRANCH -> HTTP $$code (best effort)"

ansible/roles/heating-can/defaults/main.yml

@@ -26,16 +26,8 @@ edge_open3e_poll_seconds: 30
 # entries when added), so the multi-frame read is cheap at a 30 s poll.
 # Records faults/info events only (NormalOperation, LagDeviceDtcReported,
 # LegionellaProtectionTemperatureReached) — NOT setpoint or program changes.
-# onebase.*: the 29 paired ZigBee slots on the One Base gateway (ECU 0x6c3) --
-# 8 radiator valves, 9 climate sensors, 9 underfloor actuators, 3 floor
-# thermostats. Per-device room temperature, active setpoint, humidity, valve
-# opening/demand, battery and RSSI; the local replacement for the ViCare cloud
-# room sensors. Needs the onebase overlay (files/open3e-onebase.py) -- the stock
-# codec declares 57 bytes and a paired slot answers with 68.
-# Only CurrentValues are polled. The room and device registries (1884.., 2084..)
-# are static configuration and are read on demand, not every 30 s.
 edge_open3e_datapoints: >-
-  vitocal.259,vitocal.260,vitocal.268,vitocal.269,vitocal.271,vitocal.274,vitocal.286,vitocal.288,vitocal.318,vitocal.321,vitocal.324,vitocal.335,vitocal.336,vitocal.396,vitocal.402,vitocal.403,vitocal.476,vitocal.477,vitocal.543,vitocal.548,vitocal.565,vitocal.1007,vitocal.1043,vitocal.1190,vitocal.1211,vitocal.1391,vitocal.1416,vitocal.1417,vitocal.2320,vitocal.2346,vitocal.2350,vitocal.2351,vitocal.2352,vitocal.2369,vitocal.2370,vitocal.2486,vitocal.2487,vitocal.2488,vitocal.2543,vitocal.2560,vitocal.2622,vitocal.2624,vitocal.2625,vitocal.2735,vitocal.3016,vx3.266,vx3.378,vx3.379,vx3.380,vx3.535,vx3.1603,vx3.1664,vx3.1690,vx3.1801,vx3.1802,vx3.1810,vx3.1828,vx3.1830,vx3.1577,vx3.1578,vx3.1579,vx3.1580,vx3.1581,vx3.1582,vx3.1834,vx3.1836,vx3.2214,vx3.2240,vx3.3085,vx3.3086,vx3.3087,vx3.3088,vx3.3089,vx3.3090,vcmu.320,vcmu.322,vcmu.325,vcmu.355,vcmu.389,vcmu.391,vcmu.1772,vcmu.1773,vcmu.1775,vcmu.1776,vcmu.2256,vcmu.2259,vcmu.2333,vcmu.2334,vcmu.2569,vcmu.2571,vitocal.2791,onebase.2086,onebase.2089,onebase.2092,onebase.2095,onebase.2098,onebase.2101,onebase.2104,onebase.2107,onebase.2110,onebase.2113,onebase.2116,onebase.2119,onebase.2122,onebase.2125,onebase.2128,onebase.2131,onebase.2134,onebase.2137,onebase.2140,onebase.2143,onebase.2262,onebase.2265,onebase.2268,onebase.2271,onebase.2274,onebase.2277,onebase.2280,onebase.2283,onebase.2286
+  vitocal.259,vitocal.260,vitocal.268,vitocal.269,vitocal.271,vitocal.274,vitocal.286,vitocal.288,vitocal.318,vitocal.321,vitocal.324,vitocal.335,vitocal.336,vitocal.396,vitocal.402,vitocal.403,vitocal.476,vitocal.477,vitocal.543,vitocal.548,vitocal.565,vitocal.1007,vitocal.1043,vitocal.1190,vitocal.1211,vitocal.1391,vitocal.1416,vitocal.1417,vitocal.2320,vitocal.2346,vitocal.2350,vitocal.2351,vitocal.2352,vitocal.2369,vitocal.2370,vitocal.2486,vitocal.2487,vitocal.2488,vitocal.2543,vitocal.2560,vitocal.2622,vitocal.2624,vitocal.2625,vitocal.2735,vitocal.3016,vx3.266,vx3.378,vx3.379,vx3.380,vx3.535,vx3.1603,vx3.1664,vx3.1690,vx3.1801,vx3.1802,vx3.1810,vx3.1828,vx3.1830,vx3.1577,vx3.1578,vx3.1579,vx3.1580,vx3.1581,vx3.1582,vx3.1834,vx3.1836,vx3.2214,vx3.2240,vx3.3085,vx3.3086,vx3.3087,vx3.3088,vx3.3089,vx3.3090,vcmu.320,vcmu.322,vcmu.325,vcmu.355,vcmu.389,vcmu.391,vcmu.1772,vcmu.1773,vcmu.1775,vcmu.1776,vcmu.2256,vcmu.2259,vcmu.2333,vcmu.2334,vcmu.2569,vcmu.2571,vitocal.2791
 # ECU addresses; -dev selects codec set, tx selects the UDS address.
 # vcmu (refrigerant-circuit controller) has no dedicated codec set —
 # omitting dpList makes open3e fall back to the generic datapoint list,
@@ -46,9 +38,6 @@ edge_open3e_devices:
   # files/open3e-vx3plus.py) — die Stock-vx3-Liste filtert sie sonst weg.
   vx3: { tx: "0x6a1", dpList: "/config/vx3plus.py" }
   vcmu: { tx: "0x68c" }
-  # One Base ZigBee gateway. Overlay re-declares the paired ZigBee slots at
-  # their real 68-byte length (see files/open3e-onebase.py).
-  onebase: { tx: "0x6c3", dpList: "/config/onebase.py" }
 
 edge_e3oncan_gap_seconds: 10
 edge_e3oncan_mqtt_format: "{device}_{didNumber:04d}_{didName}"

ansible/roles/heating-can/files/open3e-onebase.py

@@ -1,54 +0,0 @@
-# Managed by ansible (roles/heating-can). Datapoint overlay for the One Base
-# ZigBee gateway on ECU 0x6c3 (BACKENDGATEWAY).
-#
-# Upstream declares ZigBee<N>DeviceCurrentValues as 57 bytes. A PAIRED device
-# slot on this gateway answers with 68: the 57 known bytes plus the parent
-# device serial and three trailing bytes. udsoncan reads only the declared
-# length and then treats the next two bytes -- the first half of that serial --
-# as a foreign data identifier, so every paired slot fails to decode with
-# "Server returned values for data identifier 0x.... that was not requested".
-# The bogus identifier differs per device because the serial does.
-#
-# This overlay re-declares the 29 paired slots at 68 bytes, reusing upstream's
-# sub-type list so the per-device-type O3ESwitch (climate sensor / TRV / floor
-# thermostat / actuator, incl. DeviceTemperatureSetpoint) is inherited rather
-# than copied.
-#
-# EMPTY slots answer with 57 and decode against the stock codec, so they are
-# left alone and are not polled. A slot that is later unpaired therefore starts
-# reporting a decode error on its topic instead of a value.
-#
-# Verified on ECU 0x6c3, 2026-09-17: 29 paired slots, all 68 bytes.
-from open3e.Open3Ecodecs import O3EComplexType, RawCodec
-from open3e.Open3Edatapoints import dataIdentifiers as _master
-
-# ZigBee<N>DeviceCurrentValues of the paired slots: devices 1-20 run 2086..2143
-# in steps of 3, devices 21-29 continue at 2262..2286.
-_PAIRED_CURRENT_VALUES = [2086 + 3 * n for n in range(20)] + [
-    2262 + 3 * n for n in range(9)
-]
-
-
-def _with_parent_serial(did):
-    stock = _master["dids"][did]
-    return O3EComplexType(
-        68,
-        stock.id,
-        list(stock.subTypes)
-        + [
-            RawCodec(8, "ParentDeviceSerialnumber"),
-            RawCodec(2, "Unknown_65_66"),
-            RawCodec(1, "Unknown_67"),
-        ],
-        desc=stock.desc,
-        info=stock.info,
-        acc=stock.acc,
-    )
-
-
-dataIdentifiers = {
-    "dids": {
-        **_master["dids"],
-        **{did: _with_parent_serial(did) for did in _PAIRED_CURRENT_VALUES},
-    }
-}

ansible/roles/heating-can/tasks/main.yml

@@ -129,13 +129,6 @@
     mode: "0644"
   notify: Restart heating-can
 
-- name: Deploy open3e One Base datapoint overlay (68-byte ZigBee slots)
-  ansible.builtin.copy:
-    src: open3e-onebase.py
-    dest: "{{ heating_can_base_dir }}/onebase.py"
-    mode: "0644"
-  notify: Restart heating-can
-
 # --- Compose project ---------------------------------------------------------
 - name: Deploy the broker credential env file
   ansible.builtin.template:

ansible/roles/heating-can/templates/docker-compose.yml.j2

@@ -17,7 +17,6 @@ services:
     volumes:
       - ./devices.json:/config/devices.json:ro
       - ./vx3plus.py:/config/vx3plus.py:ro
-      - ./onebase.py:/config/onebase.py:ro
     env_file:
       # Broker credential, 0600 -- see heating-can.env.j2.
       - heating-can.env

ci/agents/wiki-maintenance/distill.md

@@ -1,7 +0,0 @@
-You are running as the scheduled wiki-maintenance job in CI. The Notes vault is checked out at ~/Notes (the repository k.renner/notes). Do exactly this, nothing else:
-
-Glob ~/Notes/raw/*.md (top level only, never ~/Notes/raw/_processed/). Distill every file you find into ~/Notes/wiki/ following your process, including the ranker check for every concept. Move each fully processed source to ~/Notes/raw/_processed/. If raw/ has no top-level files besides _index.md, say so and stop.
-
-Do not commit or push; the pipeline does that after you finish. Do not touch anything outside ~/Notes/wiki/ and ~/Notes/raw/.
-
-End with one line per file: which wiki notes it produced or merged into, or "nothing distillable".

ci/agents/wiki-maintenance/settings.json

@@ -1,37 +0,0 @@
-{
-  "//": "Permission scope for the wiki-maintenance agent (wiki-distill) in CI.",
-  "//2": "The step's environment holds a Gitea push token, a TypeSafe key and the wiki-index",
-  "//3": "client credential, so the Read tool is kept away from /proc (env dumps), /root outside",
-  "//4": "the vault symlink target, /etc and the checkout's .git/. The vault itself is the work.",
-  "//5": "Mirrors ci/agents/issue-fix/settings.json; absolute globs because the vault is reached",
-  "//6": "through the ~/Notes symlink the pipeline creates.",
-  "permissions": {
-    "allow": [
-      "Read(//root/Notes/**)",
-      "Edit(//root/Notes/wiki/**)",
-      "Edit(//root/Notes/output/**)",
-      "Edit(//root/Notes/raw/**)",
-      "Bash(/root/Notes/bin/wiki_rank.py:*)",
-      "Bash(/root/Notes/bin/wiki_ask.py:*)",
-      "Bash(mv /root/Notes/raw/:*)",
-      "Bash(mkdir -p /root/Notes/:*)",
-      "Bash(ls:*)",
-      "Bash(date:*)",
-      "Bash(wc:*)",
-      "Bash(head:*)",
-      "Bash(tail:*)"
-    ],
-    "deny": [
-      "Read(//proc/**)",
-      "Read(//etc/**)",
-      "Read(//root/.config/**)",
-      "Read(//root/Notes/.git/**)",
-      "Read(//root/Notes/_archive/**)",
-      "Edit(//root/Notes/_archive/**)",
-      "Bash(rm:*)",
-      "Bash(git:*)",
-      "Bash(curl:*)",
-      "Bash(wget:*)"
-    ]
-  }
-}

ci/images/bird/Containerfile

@@ -1,5 +1,9 @@
 FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
 
+# Matches the cluster: the API server reports minCompatibilityMinor 35, and
+# Alpine's kubectl is 1.33. Same pin-and-verify shape as ci/images/k8s.
+ARG KUBECTL_VERSION=v1.36.3
+
 # bird: BGP daemon for the pod-network mesh over pod0. Distro package, no build
 # step — the image is the binary plus its runtime.
 #
@@ -8,12 +12,18 @@ FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc
 #
 # Config is read from /etc/bird/bird.conf, not the package default
 # /etc/bird.conf, so the mount cannot shadow what the package ships.
-#
-# kubectl renders the init container's per-node config: go-template-file for
-# the templating, a field selector for excluding the node itself, in-cluster
-# config for the auth. From the distro, so there is no version literal to drift
-# and no download to trust. It is only ever used to read core/v1 Nodes.
-RUN apk add --no-cache bird2 kubectl
+RUN apk add --no-cache bird2 curl
+
+# kubectl renders the init container's per-node config with go-template and
+# excludes the node itself with a field selector, so nothing has to parse JSON
+# or assemble config text by hand.
+RUN curl -sfL -o /usr/local/bin/kubectl \
+      "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
+ && curl -sfL -o /tmp/kubectl.sha256 \
+      "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256" \
+ && echo "$(cat /tmp/kubectl.sha256)  /usr/local/bin/kubectl" | sha256sum -c - \
+ && rm -f /tmp/kubectl.sha256 \
+ && chmod +x /usr/local/bin/kubectl
 
 # Fails the build rather than the first pod if a binary or its path is wrong.
 RUN /usr/sbin/bird --version \

ci/images/claude/Containerfile

@@ -13,9 +13,7 @@ RUN apk add --no-cache \
       git \
       jq \
       openssh-client \
-      openssl \
-      python3 \
-      py3-yaml
+      openssl
 
 # Install Claude Code, then make the resulting layer byte-stable so that a
 # rebuild of the SAME version DEDUPS in the Gitea registry instead of orphaning

ci/images/netbird-proxy-services/Containerfile

@@ -1,4 +1,4 @@
-# netbird-service-sync: reconciles NetBird reverse-proxy services (public
+# netbird-proxy-services: reconciles NetBird reverse-proxy services (public
 # domains -> TLS passthrough -> Traefik ClusterIP) from Ingresses carrying the
 # public label. Standard library only, so the image is the interpreter plus one
 # file; runs unprivileged as its own user.

ci/images/netbird-proxy-services/controller.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""netbird-service-sync: reconcile NetBird reverse-proxy services from Ingresses.
+"""netbird-proxy-services: reconcile NetBird reverse-proxy services from Ingresses.
 
 Source of truth: every Ingress carrying the public label (dns.renner.uno/public).
 For each host on such an Ingress the NetBird management gets one reverse-proxy
@@ -30,11 +30,11 @@ import urllib.error
 import urllib.parse
 import urllib.request
 
-LOG = logging.getLogger("netbird-service-sync")
+LOG = logging.getLogger("netbird-proxy-services")
 
 NB = os.environ.get("NB_MANAGEMENT_URL", "https://netbird.renner.uno").rstrip("/")
 BAO_ADDR = os.environ.get("BAO_ADDR", "http://openbao.openbao.svc.cluster.local:8200").rstrip("/")
-BAO_ROLE = os.environ.get("BAO_ROLE", "netbird-service-sync")
+BAO_ROLE = os.environ.get("BAO_ROLE", "netbird-proxy-services")
 BAO_PAT_PATH = os.environ.get("BAO_PAT_PATH", "homelab/data/infrastructure/secret-rotators-bootstrap/netbird")
 BAO_PAT_KEY = os.environ.get("BAO_PAT_KEY", "pat")
 SERVICE_CIDR = os.environ.get("SERVICE_CIDR", "10.96.0.0/12")
@@ -156,7 +156,7 @@ def ensure_network(nb):
         if n["name"] == NETWORK_NAME:
             return n["id"]
     n = nb.post("networks", {"name": NETWORK_NAME,
-                             "description": "managed by netbird-service-sync; public ingress via TLS passthrough"})
+                             "description": "managed by netbird-proxy-services; public ingress via TLS passthrough"})
     LOG.info("created network %s (%s)", NETWORK_NAME, n["id"])
     return n["id"]
 
@@ -166,7 +166,7 @@ def ensure_resource(nb, net):
         if r.get("address") == SERVICE_CIDR:
             return r["id"]
     r = nb.post(f"networks/{net}/resources", {"name": "cluster service CIDR", "address": SERVICE_CIDR,
-                                              "description": "managed by netbird-service-sync",
+                                              "description": "managed by netbird-proxy-services",
                                               "enabled": True, "groups": []})
     LOG.info("created subnet resource %s (%s)", SERVICE_CIDR, r["id"])
     return r["id"]

ci/images/wiki-index/Containerfile

@@ -1,10 +0,0 @@
-# wiki-index: embedding index over the Notes repo's wiki/, fed from Gitea,
-# queried by ~/Notes/bin/wiki_rank.py. Standard library only; runs unprivileged.
-FROM python:3.13-slim
-
-RUN useradd --system --no-create-home --shell /usr/sbin/nologin wikiindex
-COPY wiki_index.py /opt/wiki_index.py
-
-ENV PYTHONUNBUFFERED=1
-USER wikiindex
-ENTRYPOINT ["python3", "/opt/wiki_index.py"]

ci/images/wiki-index/test_wiki_index.py

@@ -1,178 +0,0 @@
-#!/usr/bin/env python3
-"""Unit tests for wiki_index. Run: python3 -m unittest test_wiki_index"""
-
-import hashlib
-import hmac
-import json
-import tempfile
-import unittest
-from pathlib import Path
-
-import wiki_index as wi
-
-NOTE = """---
-title: 'UDM intercepts DNS'
-type: wiki
-tags: [dns, unifi]
-aliases: [udm dns interception, dig 1.1.1.1 wrong]
----
-
-# UDM intercepts DNS
-
-The UDM answers every UDP/53 query itself.
-
-## Details
-
-More.
-"""
-
-
-class ParseTests(unittest.TestCase):
-    def test_note_text(self):
-        title, text = wi.note_text("udm-dns", NOTE)
-        self.assertEqual(title, "UDM intercepts DNS")
-        self.assertIn("udm dns UDM intercepts DNS udm dns interception", text)
-        self.assertIn("dns unifi", text)
-        self.assertTrue(text.endswith("The UDM answers every UDP/53 query itself."))
-        self.assertLessEqual(len(text), wi.EMBED_CHARS)
-
-    def test_credentials_are_stripped(self):
-        original = wi.http
-        wi.http = lambda method, url, body=None, headers=None, timeout=60.0: (
-            {"auth": {"client_token": "t"}} if url.endswith("/login")
-            else {"data": {"data": {"gitea_token": "abc\n", "webhook_secret": " s3cret\n"}}})
-        original_sa = wi.SA_TOKEN
-        try:
-            with tempfile.TemporaryDirectory() as d:
-                wi.SA_TOKEN = Path(d) / "token"
-                wi.SA_TOKEN.write_text("jwt\n")
-                self.assertEqual(wi.Credentials().fetch(), {"gitea_token": "abc", "webhook_secret": "s3cret"})
-        finally:
-            wi.http, wi.SA_TOKEN = original, original_sa
-
-    def test_tree_paging_stops_on_short_last_page(self):
-        # Gitea: truncated=true on every page including the last, "tree": null past it.
-        pages = {
-            1: {"tree": [{"path": f"wiki/n{i}.md", "type": "blob", "sha": f"s{i}"} for i in range(1000)], "truncated": True, "total_count": 1192},
-            2: {"tree": [{"path": f"wiki/n{i}.md", "type": "blob", "sha": f"s{i}"} for i in range(1000, 1192)] + [{"path": "raw/x.md", "type": "blob", "sha": "r"}, {"path": "wiki/sub/y.md", "type": "blob", "sha": "y"}], "truncated": True, "total_count": 1192},
-            3: {"tree": None, "truncated": False, "total_count": 1192},
-        }
-        calls = []
-        original = wi.http
-
-        def fake_http(method, url, body=None, headers=None, timeout=60.0):
-            page = int(url.rsplit("page=", 1)[1])
-            calls.append(page)
-            return pages[page]
-
-        wi.http = fake_http
-        try:
-            tree = wi.Gitea("t").tree("abc")
-        finally:
-            wi.http = original
-        self.assertEqual(calls, [1, 2])
-        self.assertEqual(len(tree), 1192)
-        self.assertNotIn("raw/x.md", tree)
-        self.assertNotIn("wiki/sub/y.md", tree)
-        self.assertEqual(tree["wiki/n1191.md"], "s1191")
-
-    def test_signature(self):
-        body = b'{"ref":"refs/heads/master"}'
-        sig = hmac.new(b"s3cret", body, hashlib.sha256).hexdigest()
-        self.assertTrue(wi.verify_signature("s3cret", body, sig))
-        self.assertFalse(wi.verify_signature("other", body, sig))
-        self.assertFalse(wi.verify_signature("s3cret", body, ""))
-
-
-class FakeGitea:
-    def __init__(self, head, tree, files):
-        self._head, self._tree, self.files = head, tree, files
-        self.raw_calls = []
-
-    def head(self):
-        return self._head
-
-    def tree(self, commit):
-        return self._tree
-
-    def raw(self, path, ref):
-        self.raw_calls.append(path)
-        return self.files[path]
-
-
-class IndexTests(unittest.TestCase):
-    def setUp(self):
-        self.tmp = tempfile.TemporaryDirectory()
-        self.path = Path(self.tmp.name) / "index.json"
-        self.original_embed = wi.embed
-        self.embed_calls = []
-
-        def fake_embed(texts, batch=2):
-            self.embed_calls.append(list(texts))
-            return [wi.unit([1.0, float(len(t) % 7)]) for t in texts]
-
-        wi.embed = fake_embed
-
-    def tearDown(self):
-        wi.embed = self.original_embed
-        self.tmp.cleanup()
-
-    def test_sync_is_incremental_and_persists(self):
-        files = {"wiki/udm-dns.md": NOTE, "wiki/ceph.md": "---\ntitle: Ceph\n---\n# Ceph\n\nOSD.\n", "wiki/_index.md": "---\ntitle: Wiki\n---\n"}
-        tree = {"wiki/udm-dns.md": "aaa", "wiki/ceph.md": "bbb", "wiki/_index.md": "ccc"}
-        g = FakeGitea("c1", tree, files)
-        idx = wi.Index(self.path)
-        s = idx.sync(g)
-        self.assertEqual((s["changed"], s["removed"], s["notes"]), (2, 0, 2))
-        self.assertEqual(set(idx.notes), {"udm-dns", "ceph"})
-        self.assertEqual(idx.notes["udm-dns"]["title"], "UDM intercepts DNS")
-        self.assertTrue(self.path.exists())
-
-        # head unchanged: nothing fetched
-        s = idx.sync(g)
-        self.assertEqual(s.get("skipped"), "head unchanged")
-        self.assertEqual(len(g.raw_calls), 2)
-
-        # one note changed, one removed, new head
-        g2 = FakeGitea("c2", {"wiki/udm-dns.md": "aaa2"}, {"wiki/udm-dns.md": NOTE.replace("itself", "itself!")})
-        s = idx.sync(g2)
-        self.assertEqual((s["changed"], s["removed"], s["notes"]), (1, 1, 1))
-        self.assertEqual(g2.raw_calls, ["wiki/udm-dns.md"])
-
-        # restart loads the persisted index
-        idx2 = wi.Index(self.path)
-        self.assertEqual(idx2.commit, "c2")
-        self.assertEqual(set(idx2.notes), {"udm-dns"})
-
-    def test_rank_orders_by_cosine(self):
-        idx = wi.Index(self.path)
-        idx.notes = {"a": {"sha": "1", "title": "A", "vector": wi.unit([1.0, 0.0])},
-                     "b": {"sha": "2", "title": "B", "vector": wi.unit([0.0, 1.0])}}
-        wi.embed = lambda texts, batch=2: [wi.unit([0.2, 1.0])]
-        rows = idx.rank("q", k=5)
-        self.assertEqual([r["slug"] for r in rows], ["b", "a"])
-        self.assertGreater(rows[0]["score"], rows[1]["score"])
-
-    def test_status_reports_age_and_errors(self):
-        idx = wi.Index(self.path)
-        self.assertFalse(idx.status()["ready"])
-        g = FakeGitea("c1", {"wiki/a.md": "x"}, {"wiki/a.md": "---\ntitle: A\n---\n# A\n\nt\n"})
-        idx.sync(g)
-        st = idx.status()
-        self.assertTrue(st["ready"])
-        self.assertEqual(st["notes"], 1)
-        self.assertEqual(st["commit"], "c1")
-
-        class Broken(FakeGitea):
-            def head(self):
-                raise wi.ApiError("gitea down")
-
-        with self.assertRaises(wi.ApiError):
-            idx.sync(Broken("c1", {}, {}))
-        self.assertIn("gitea down", idx.status()["last_error"])
-        self.assertEqual(idx.status()["notes"], 1)  # last good index kept
-        self.assertTrue(idx.status()["ready"])  # and still served
-
-
-if __name__ == "__main__":
-    unittest.main()

ci/images/wiki-index/wiki_index.py

@@ -1,408 +0,0 @@
-#!/usr/bin/env python3
-"""wiki-index: embedding index over the Notes repo's wiki/, fed from Gitea.
-
-Source of truth is the notes repository on Gitea. The index holds, per wiki
-note, the git blob sha, title and a bge-m3 vector of slug/title/aliases/tags/
-first paragraph. A sync fetches the repo tree, embeds every note whose blob sha
-changed (via wiki-embed, in-cluster) and drops notes that left the tree; it
-runs at start, on every push webhook from Gitea, and every RESYNC_SECONDS.
-
-HTTP:
-  POST /rank     {"query": str, "k": int}   -> {"rows": [{"slug","title","score"}], "index": {...}}
-  GET  /health   -> 200 always (liveness) with {"ready", "notes", "commit", "synced_at", "age_s", "syncing", "last_error"}
-  GET  /ready    -> 200 when an index exists, else 503 (readiness)
-  POST /webhook  Gitea push event, HMAC-SHA256 in X-Gitea-Signature -> {"queued": true}
-
-Credentials (Gitea token, webhook secret) are read from OpenBao through the
-Kubernetes auth role on every use; they never land in a Secret or a log line.
-Standard library only.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import hmac
-import json
-import logging
-import os
-import re
-import sys
-import threading
-import time
-import urllib.error
-import urllib.parse
-import urllib.request
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from pathlib import Path
-
-LOG = logging.getLogger("wiki-index")
-
-GITEA_URL = os.environ.get("GITEA_URL", "https://gitea.renner.uno").rstrip("/")
-NOTES_REPO = os.environ.get("NOTES_REPO", "k.renner/notes")
-NOTES_BRANCH = os.environ.get("NOTES_BRANCH", "master")
-WIKI_DIR = os.environ.get("WIKI_DIR", "wiki").strip("/")
-EMBED_URL = os.environ.get("EMBED_URL", "http://wiki-embed.ai.svc.cluster.local:8080").rstrip("/")
-EMBED_MODEL = os.environ.get("EMBED_MODEL", "bge-m3")
-EMBED_CHARS = int(os.environ.get("EMBED_CHARS", "1500"))
-INDEX_PATH = Path(os.environ.get("INDEX_PATH", "/data/index.json"))
-RESYNC_SECONDS = int(os.environ.get("RESYNC_SECONDS", "1800"))
-LISTEN_PORT = int(os.environ.get("LISTEN_PORT", "8080"))
-BAO_ADDR = os.environ.get("BAO_ADDR", "http://openbao.openbao.svc.cluster.local:8200").rstrip("/")
-BAO_ROLE = os.environ.get("BAO_ROLE", "wiki-index")
-BAO_SECRET_PATH = os.environ.get("BAO_SECRET_PATH", "homelab/data/apps/ai/wiki-index")
-SA_TOKEN = Path(os.environ.get("SA_TOKEN", "/var/run/secrets/kubernetes.io/serviceaccount/token"))
-
-
-class ApiError(Exception):
-    pass
-
-
-# ---------------------------------------------------------------- http helpers
-
-
-def http(method: str, url: str, body=None, headers=None, timeout: float = 60.0):
-    data = None
-    hdrs = dict(headers or {})
-    if body is not None:
-        data = json.dumps(body).encode("utf-8")
-        hdrs.setdefault("Content-Type", "application/json")
-    req = urllib.request.Request(url, data=data, method=method, headers=hdrs)
-    try:
-        with urllib.request.urlopen(req, timeout=timeout) as resp:
-            raw = resp.read()
-            ctype = resp.headers.get("Content-Type", "")
-    except urllib.error.HTTPError as e:
-        raise ApiError(f"{method} {url}: HTTP {e.code}: {e.read().decode('utf-8', 'replace')[:300]}") from e
-    except urllib.error.URLError as e:
-        raise ApiError(f"{method} {url}: {e.reason}") from e
-    if "json" in ctype:
-        return json.loads(raw.decode("utf-8"))
-    return raw
-
-
-# ---------------------------------------------------------------- credentials
-
-
-class Credentials:
-    """Gitea token and webhook secret from OpenBao, fetched per use."""
-
-    def __init__(self, static: dict | None = None):
-        self.static = static  # tests / local runs
-
-    def fetch(self) -> dict:
-        if self.static is not None:
-            return self.static
-        jwt = SA_TOKEN.read_text(encoding="utf-8").strip()
-        login = http("POST", f"{BAO_ADDR}/v1/auth/kubernetes/login", {"role": BAO_ROLE, "jwt": jwt})
-        token = login["auth"]["client_token"]
-        kv = http("GET", f"{BAO_ADDR}/v1/{BAO_SECRET_PATH}", headers={"X-Vault-Token": token})
-        data = {k: str(v).strip() for k, v in kv["data"]["data"].items()}  # `bao kv put key=@file` keeps the file's newline
-        for key in ("gitea_token", "webhook_secret"):
-            if not data.get(key):
-                raise ApiError(f"OpenBao {BAO_SECRET_PATH} has no key {key}")
-        return data
-
-
-# ---------------------------------------------------------------- gitea
-
-
-class Gitea:
-    def __init__(self, token: str, base: str = GITEA_URL, repo: str = NOTES_REPO, branch: str = NOTES_BRANCH):
-        self.base, self.repo, self.branch = base, repo, branch
-        self.headers = {"Authorization": f"token {token}"}
-
-    def api(self, path: str, **params):
-        q = ("?" + urllib.parse.urlencode(params)) if params else ""
-        return http("GET", f"{self.base}/api/v1/repos/{self.repo}{path}{q}", headers=self.headers)
-
-    def head(self) -> str:
-        return self.api(f"/branches/{urllib.parse.quote(self.branch, safe='')}")["commit"]["id"]
-
-    def tree(self, commit: str) -> dict[str, str]:
-        """path -> blob sha for every wiki note at that commit."""
-        out: dict[str, str] = {}
-        page, per_page, seen = 1, 1000, 0
-        while True:
-            t = self.api(f"/git/trees/{commit}", recursive="true", per_page=per_page, page=page)
-            entries = t.get("tree") or []  # Gitea answers "tree": null past the last page
-            for e in entries:
-                p = e.get("path", "")
-                if e.get("type") == "blob" and p.startswith(WIKI_DIR + "/") and p.endswith(".md") and "/" not in p[len(WIKI_DIR) + 1:]:
-                    out[p] = e["sha"]
-            seen += len(entries)
-            total = int(t.get("total_count") or 0)
-            if not entries or len(entries) < per_page or (total and seen >= total):
-                break
-            page += 1
-            if page > 50:
-                raise ApiError("tree paging runaway")
-        return out
-
-    def raw(self, path: str, ref: str) -> str:
-        data = http("GET", f"{self.base}/api/v1/repos/{self.repo}/raw/{urllib.parse.quote(path)}?ref={urllib.parse.quote(ref, safe='')}",
-                    headers=self.headers)
-        return data.decode("utf-8") if isinstance(data, bytes) else json.dumps(data)
-
-
-# ---------------------------------------------------------------- notes
-
-
-def parse_frontmatter(text: str) -> tuple[dict, str]:
-    m = re.match(r"^---[ \t]*\n(.*?)\n---[ \t]*(?:\n|$)", text, re.DOTALL)
-    if not m:
-        return {}, text
-    fm: dict = {}
-    for line in m.group(1).splitlines():
-        mm = re.match(r"^([A-Za-z_][\w-]*):\s*(.*)$", line)
-        if mm:
-            fm[mm.group(1)] = mm.group(2).strip()
-    return fm, text[m.end():]
-
-
-def as_list(value: str) -> list[str]:
-    s = (value or "").strip()
-    if s.startswith("[") and s.endswith("]"):
-        s = s[1:-1]
-    return [p.strip().strip("'\"") for p in s.split(",") if p.strip()]
-
-
-def first_paragraph(body: str) -> str:
-    para: list[str] = []
-    seen_h1 = False
-    for line in body.splitlines():
-        if line.startswith("# "):
-            seen_h1 = True
-            continue
-        if not seen_h1:
-            continue
-        if line.strip() == "" or line.startswith("#"):
-            if para:
-                break
-            continue
-        para.append(line.strip())
-    return " ".join(para)
-
-
-def note_text(slug: str, text: str) -> tuple[str, str]:
-    """(title, embedding text) for one note file."""
-    fm, body = parse_frontmatter(text)
-    title = (fm.get("title") or slug).strip().strip("'\"")
-    parts = [slug.replace("-", " "), title, " ".join(as_list(fm.get("aliases", ""))),
-             " ".join(as_list(fm.get("tags", ""))), first_paragraph(body)]
-    return title, " ".join(parts)[:EMBED_CHARS]
-
-
-# ---------------------------------------------------------------- embeddings
-
-
-def embed(texts: list[str], batch: int = 2) -> list[list[float]]:
-    out: list[list[float]] = []
-    for i in range(0, len(texts), batch):
-        resp = http("POST", f"{EMBED_URL}/v1/embeddings", {"model": EMBED_MODEL, "input": texts[i:i + batch]}, timeout=120)
-        rows = sorted(resp["data"], key=lambda d: d["index"])
-        out.extend(unit(d["embedding"]) for d in rows)
-    return out
-
-
-def unit(v: list[float]) -> list[float]:
-    n = sum(x * x for x in v) ** 0.5 or 1.0
-    return [round(x / n, 5) for x in v]
-
-
-# ---------------------------------------------------------------- index
-
-
-class Index:
-    def __init__(self, path: Path):
-        self.path = path
-        self.lock = threading.Lock()
-        self.notes: dict[str, dict] = {}  # slug -> {sha, title, vector}
-        self.commit = ""
-        self.synced_at = 0.0
-        self.syncing = False
-        self.last_error = ""
-        if path.exists():
-            try:
-                d = json.loads(path.read_text(encoding="utf-8"))
-                self.notes, self.commit, self.synced_at = d.get("notes", {}), d.get("commit", ""), d.get("synced_at", 0.0)
-                LOG.info("loaded index: %d notes at %s", len(self.notes), self.commit[:8])
-            except (OSError, ValueError) as e:
-                LOG.warning("index unreadable (%s); starting empty", e)
-
-    def save(self) -> None:
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        tmp = self.path.with_suffix(".tmp")
-        tmp.write_text(json.dumps({"notes": self.notes, "commit": self.commit, "synced_at": self.synced_at}), encoding="utf-8")
-        tmp.replace(self.path)
-
-    def sync(self, gitea: Gitea) -> dict:
-        """Bring the index to the branch head; returns a summary."""
-        with self.lock:
-            self.syncing = True
-        try:
-            head = gitea.head()
-            if head == self.commit and self.notes:
-                summary = {"commit": head, "changed": 0, "removed": 0, "notes": len(self.notes), "skipped": "head unchanged"}
-                self.synced_at = time.time()
-                self.save()
-                return summary
-            tree = gitea.tree(head)
-            slugs = {p[len(WIKI_DIR) + 1:-3]: (p, sha) for p, sha in tree.items() if not p.endswith("/_index.md")}
-            todo = [s for s, (p, sha) in slugs.items() if self.notes.get(s, {}).get("sha") != sha]
-            removed = [s for s in list(self.notes) if s not in slugs]
-            LOG.info("sync %s: %d notes, %d to embed, %d removed", head[:8], len(slugs), len(todo), len(removed))
-            fresh: dict[str, dict] = {}
-            for i in range(0, len(todo), 20):
-                chunk = todo[i:i + 20]
-                texts, titles = [], {}
-                for s in chunk:
-                    title, text = note_text(s, gitea.raw(slugs[s][0], head))
-                    titles[s] = title
-                    texts.append(text)
-                for s, vec in zip(chunk, embed(texts)):
-                    fresh[s] = {"sha": slugs[s][1], "title": titles[s], "vector": vec}
-            with self.lock:
-                for s in removed:
-                    self.notes.pop(s, None)
-                self.notes.update(fresh)
-                self.commit = head
-                self.synced_at = time.time()
-                self.last_error = ""
-                self.save()
-            return {"commit": head, "changed": len(todo), "removed": len(removed), "notes": len(self.notes)}
-        except Exception as e:
-            with self.lock:
-                self.last_error = str(e)[:300]
-            raise
-        finally:
-            with self.lock:
-                self.syncing = False
-
-    def rank(self, query: str, k: int = 60) -> list[dict]:
-        q = embed([query])[0]
-        with self.lock:
-            rows = [(s, n["title"], sum(a * b for a, b in zip(q, n["vector"]))) for s, n in self.notes.items()]
-        rows.sort(key=lambda r: -r[2])
-        return [{"slug": s, "title": t, "score": round(sc, 4)} for s, t, sc in rows[:k]]
-
-    def status(self) -> dict:
-        """`ready` = an index exists and can answer /rank; a failed sync keeps the last good index."""
-        with self.lock:
-            return {"ready": bool(self.notes), "notes": len(self.notes), "commit": self.commit,
-                    "synced_at": self.synced_at, "age_s": round(time.time() - self.synced_at) if self.synced_at else None,
-                    "syncing": self.syncing, "last_error": self.last_error or None}
-
-
-# ---------------------------------------------------------------- syncer
-
-
-class Syncer(threading.Thread):
-    """One worker: syncs on demand (webhook) and every RESYNC_SECONDS."""
-
-    def __init__(self, index: Index, creds: Credentials, interval: int):
-        super().__init__(daemon=True, name="syncer")
-        self.index, self.creds, self.interval = index, creds, interval
-        self.wake = threading.Event()
-
-    def trigger(self) -> None:
-        self.wake.set()
-
-    RETRY_SECONDS = 60
-
-    def run(self) -> None:
-        while True:
-            try:
-                data = self.creds.fetch()
-                summary = self.index.sync(Gitea(data["gitea_token"]))
-                LOG.info("sync done: %s", summary)
-                wait = self.interval
-            except Exception as e:  # keep serving the last good index; retry soon, not next interval
-                LOG.error("sync failed: %s", e)
-                wait = self.RETRY_SECONDS
-            self.wake.wait(wait)
-            self.wake.clear()
-
-
-def verify_signature(secret: str, body: bytes, signature: str) -> bool:
-    digest = hmac.new(secret.encode("utf-8"), body, hashlib.sha256).hexdigest()
-    return hmac.compare_digest(digest, (signature or "").strip())
-
-
-# ---------------------------------------------------------------- server
-
-
-def make_handler(index: Index, syncer: Syncer, creds: Credentials):
-    class Handler(BaseHTTPRequestHandler):
-        def log_message(self, fmt, *args):
-            LOG.info("%s %s", self.address_string(), fmt % args)
-
-        def send_json(self, code: int, obj) -> None:
-            data = json.dumps(obj).encode("utf-8")
-            self.send_response(code)
-            self.send_header("Content-Type", "application/json")
-            self.send_header("Content-Length", str(len(data)))
-            self.end_headers()
-            self.wfile.write(data)
-
-        def body(self) -> bytes:
-            n = int(self.headers.get("Content-Length") or 0)
-            return self.rfile.read(n) if n else b""
-
-        def do_GET(self):
-            if self.path == "/health":  # liveness: the process serves
-                return self.send_json(200, index.status())
-            if self.path == "/ready":  # readiness: an index exists
-                st = index.status()
-                return self.send_json(200 if st["ready"] else 503, st)
-            self.send_json(404, {"error": "not found"})
-
-        def do_POST(self):
-            if self.path == "/rank":
-                try:
-                    req = json.loads(self.body() or b"{}")
-                    query = str(req.get("query", "")).strip()
-                    k = max(1, min(int(req.get("k", 60)), 500))
-                    if not query:
-                        return self.send_json(400, {"error": "query required"})
-                    rows = index.rank(query, k)
-                    return self.send_json(200, {"rows": rows, "index": index.status()})
-                except ApiError as e:
-                    return self.send_json(502, {"error": str(e)})
-                except (ValueError, TypeError) as e:
-                    return self.send_json(400, {"error": str(e)})
-            if self.path == "/webhook":
-                raw = self.body()
-                try:
-                    secret = creds.fetch()["webhook_secret"]
-                except ApiError as e:
-                    return self.send_json(503, {"error": str(e)})
-                if not verify_signature(secret, raw, self.headers.get("X-Gitea-Signature", "")):
-                    return self.send_json(403, {"error": "bad signature"})
-                try:
-                    event = json.loads(raw or b"{}")
-                except ValueError:
-                    return self.send_json(400, {"error": "bad json"})
-                ref = event.get("ref", "")
-                if ref and ref != f"refs/heads/{NOTES_BRANCH}":
-                    return self.send_json(200, {"queued": False, "ref": ref})
-                syncer.trigger()
-                return self.send_json(200, {"queued": True})
-            self.send_json(404, {"error": "not found"})
-
-    return Handler
-
-
-def main() -> int:
-    logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s", stream=sys.stdout)
-    index = Index(INDEX_PATH)
-    creds = Credentials()
-    syncer = Syncer(index, creds, RESYNC_SECONDS)
-    syncer.start()
-    server = ThreadingHTTPServer(("", LISTEN_PORT), make_handler(index, syncer, creds))
-    LOG.info("listening on :%d, repo %s@%s, embed %s", LISTEN_PORT, NOTES_REPO, NOTES_BRANCH, EMBED_URL)
-    server.serve_forever()
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

kubernetes/NETWORK-traffic-classes.md

@@ -1,99 +0,0 @@
-# Traffic classes on the k8s nodes
-
-Issue #576. Five classes, each on its own VLAN.
-
-## Where each class runs
-
-| class | link | mechanism |
-|---|---|---|
-| Ceph replication | `ceph-san`, VLAN 49 | the whole link is handed to the OSD pod (Multus `host-device`) |
-| pod↔pod | `pod0`, VLAN 48 | pod-sourced traffic is routed from table 47; bird puts the peers' pod CIDRs there via `pod0` |
-| world↔pod | `ingress0`, VLAN 47 | BGP session sourced there (next hop of every LoadBalancer VIP); pod egress takes table 47's default |
-| node↔node | `node0`, VLAN 46 | the node InternalIP and etcd live there; so do apiserver↔kubelet, cilium-health and host→remote-pod traffic |
-| world↔node | `mgmt0`, VLAN 40 | API VIP for kubectl, talosctl from outside, node egress (DNS, NTP, image pulls) |
-
-Hard constraint, set by the owner: inter-node and pod traffic never traverses
-the UDM. Everything but world↔node stays on the 10G switch. VLAN 46 and 48 are
-statically addressed, without a gateway; VLAN 46 is isolated in UniFi.
-
-## Pod traffic: one table
-
-Two rules, one per family, send every packet with a pod source to table 47
-(`talos/patches/site-homelab.yaml`, priorities 1000/1001, below main). The
-table decides by longest prefix; no rule carves out exceptions.
-
-bird (`kubernetes/infrastructure/bird/`) owns table 47 and fills it with:
-
-- the node's attached networks — `mgmt0`, `ingress0`, `pod0`, `node0` —
-  taken from the interfaces;
-- the peers' pod CIDRs, learned over an iBGP mesh on `pod0`, next hop the
-  peer's `pod0` address;
-- the node's own pod CIDR via `cilium_host`, originated rather than read back
-  from the kernel (reading it back made BIRD depend on the shape of Cilium's
-  route, and KRT rejects the IPv4 one);
-- the egress default via the UDM on `ingress0`, from the node annotations
-  `net.renner.uno/egress-gw-v4/v6`.
-
-`node0` has to be in the table: a pod reaching a node address — the
-`kubernetes` ClusterIP, which socket LB rewrites to the apiserver's advertise
-address, or a hostNetwork pod — would otherwise take the default to the UDM.
-
-The routing decision runs before Cilium's masquerade hook, so the rule sees the
-pod address and the masquerade then rewrites it to the egress link's.
-
-Node-originated traffic does not match the rules and uses main, where Cilium
-routes each peer's pod CIDR via the peer's InternalIP — on `node0`.
-
-No address is written into this repo twice. Each node publishes its `pod0`
-addresses as `nodeAnnotations` beside the `VLANConfig` that assigns them; the
-pod CIDRs come from the Node objects. bird's init container renders both from
-the API and ends with `bird -p`, so BIRD's own parser gates startup.
-
-## Node↔node
-
-`kubelet.nodeIP.validSubnets` and `cluster.etcd.advertisedSubnets` point at
-VLAN 46. Talos picks one InternalIP per family, IPv4 first — the service CIDR
-is IPv4, and the apiserver's advertise address must match it.
-
-The API VIP stays on `mgmt0` for kubectl. No in-cluster client uses it:
-kubelet, scheduler, controller-manager and Cilium go through KubePrism
-(`localhost:7445`), which balances over every address of every control-plane
-member; pods use the ClusterIP.
-
-Talos never updates an existing etcd member's peer URLs
-(siderolabs/talos#12720). Changing `advertisedSubnets` means, per member:
-stage the config, `talosctl etcd forfeit-leadership`, `talosctl etcd leave`,
-reboot. `leave` removes only `/var/lib/etcd`; the node rejoins as a learner
-and is promoted. EPHEMERAL does not need a wipe.
-
-## Moving node IPs: the mixed state
-
-While some nodes have their InternalIP on the new network and some on the old,
-host→remote-pod traffic leaves with a node address that is not an InternalIP:
-the kernel picks the source from the route to the peer's InternalIP. Cilium
-classifies that as `world`, and every ingress policy that admits only
-`host`/`remote-node` (rook-ceph, monitoring, …) drops it. Kernel Ceph clients
-lose the OSDs on the other side; RBD mounts hang.
-
-Bridge it for the duration with a temporary `CiliumClusterwideNetworkPolicy`
-admitting the node subnets of both networks, both families, with
-`enableDefaultDeny: false` so it restricts nothing else, and delete it once
-every node has moved. Keep all OSD nodes schedulable while one is drained:
-draining two takes Ceph below its data availability.
-
-## Failure behaviour
-
-If bird stops, table 47 empties, the rules find nothing and fall through to
-main: pod traffic returns to the node networks, unseparated rather than
-misrouted. The same holds during a cold rebuild until Gitea serves bird's
-image. The default route lives in table 47, not in the Talos config, so a
-default cannot outlive the specific routes and send pod traffic to the UDM.
-
-## Sources
-
-Cilium v1.20 `pkg/datapath/linux/node.go`; BIRD 2.17 user manual (kernel
-protocol, `strict bind`, `direct`); Talos v1.13 `RoutingRuleConfig`,
-`machine.nodeAnnotations`, configuration patching (lists are appended,
-`$patch: delete`), etcd `LeaveCluster`; KubePrism docs;
-siderolabs/talos#12720. PRs #831, #833, #835, #836, #837, #842, #852, #854,
-#855, #857, #858, #918, #919, #922; closed unmerged: #830, #838, #839.

kubernetes/PROPOSAL-traffic-class-separation.md

@@ -0,0 +1,194 @@
+# Proposal — separate the four traffic classes onto their own VLANs
+
+Status: draft. The question this started with is **answered** — from the Cilium
+source and flag reference, not from a test — and the answer changes the shape
+of the proposal rather than confirming it.
+
+Supersedes the framing in issue #576, which described this as "give node
+management its own NIC, and Ceph public its own VLAN". That was two of four
+classes and one of them turned out already solved.
+
+## The four classes
+
+| class | what it is | where it goes today |
+|---|---|---|
+| **Ceph replication** | OSD-to-OSD heartbeat, replication, recovery | VLAN 49, its own X710 port — **separated** |
+| **cluster-internal** | pod-to-pod east-west, including Ceph client I/O | pod network, VXLAN over `mgmt0` |
+| **cluster-external** | ingress to LoadBalancer VIPs, egress to LAN and internet | `mgmt0` |
+| **management** | Talos API, etcd, kube-apiserver, kubelet | `mgmt0` |
+
+Three of four share one interface. That is not a design decision — until the
+bare-metal conversion there was one NIC to work with.
+
+Ceph client I/O living on the pod network is correct rather than a leftover:
+that traffic *is* cluster-internal. Ceph is done.
+
+## Principle
+
+**Each class gets its own VLAN. Which physical interface a VLAN lands on is a
+separate, changeable decision.**
+
+Defining classes by VLAN means the separation survives recabling, port failures
+and capacity changes, and it does not require one port per class. Defining them
+by interface would freeze a capacity decision into the architecture.
+
+## The finding that shapes everything else
+
+The original open question was whether `nodePort.directRoutingDevice` moves the
+next-hop of Cilium's direct routes, or only selects an interface. It is
+answerable from the source, and the answer is: **only the interface.**
+
+`installDirectRoute` takes the next-hop as a parameter:
+
+```go
+func installDirectRoute(log *slog.Logger, prefix netip.Prefix, nodeIP net.IP,
+    skipUnreachable bool) (routeSpec *netlink.Route, err error)
+```
+
+and `nodeUpdate` supplies it as `newNode.GetNodeIP(false)`. `GetNodeIP` returns,
+in priority order, `NodeInternalIP` → `NodeExternalIP` → anything else. The
+same `newIP4` is what tunnel mode uses as the VXLAN endpoint.
+
+`NodeInternalIP` comes from the Kubernetes Node object. `--ipv4-node` looks like
+an override but is not one: `initFromConfig()` calls `SetNodeInternalIP` and
+`initFromK8s()` runs **after** it and overwrites the value. In a Kubernetes
+cluster there is no path by which Cilium's node IP differs from the kubelet's
+`InternalIP`.
+
+`--direct-routing-device` is documented as "Device name used to connect nodes in
+direct routing mode" — a device, not an address.
+
+**So cluster-internal traffic is welded to the node IP, and the node IP is the
+kubelet InternalIP.** Two consequences:
+
+- The class cannot be moved off whatever VLAN the node IP lives on.
+- **Routing mode is irrelevant to this problem.** Tunnel mode sources the VXLAN
+  from the node IP; native mode uses it as the direct-route next-hop. Native
+  routing buys nothing here, so the disruptive, non-rolling step this proposal
+  previously contained is simply gone.
+
+## Consequence: draw the line the other way
+
+If cluster-internal cannot leave the node IP, then separation has to come from
+moving *management services* off it — and each one has to be checked
+individually, because they do not share a mechanism.
+
+| management service | can it leave the node IP? | lever |
+|---|---|---|
+| etcd | **yes** | `cluster.etcd.advertisedSubnets` (+ `listenSubnets`, which defaults to it) |
+| kube-apiserver endpoint | **yes** | already a VIP — `Layer2VIPConfig` with a `link:` field |
+| Talos API | **n/a** | `apid` answers on every node address (measured); a client and firewall choice, not a bind setting |
+| kubelet | **no** | it *is* the node IP, by definition |
+
+So four VLANs are reachable, but the boundary does not fall where the class
+names suggest: **kubelet stays with cluster-internal.** That is the honest
+result, and it is worth stating plainly rather than filing kubelet under
+management and hoping.
+
+The remaining classes keep the levers established earlier:
+
+- **cluster-external ingress** — `CiliumBGPNodeConfigOverride.spec.bgpInstances[].peers[].localAddress`.
+  For eBGP the session source is the next-hop, so pinning the session pins
+  where return traffic arrives. The session to the UDM has been running for
+  months.
+- **cluster-external egress** — eBPF masquerading follows the output device, so
+  this is a default-route decision plus `enable-masquerade-to-route-source`
+  (today `false`).
+- **Ceph replication** — Multus macvlan on VLAN 49, done.
+
+## The general escape hatch
+
+Ceph is separated because its OSDs got a second interface and stopped using the
+pod network for replication. That is the *only* mechanism that fully detaches a
+workload from the node IP, and it generalises: anything that must not ride the
+node IP gets its own `NetworkAttachmentDefinition`.
+
+It is also expensive per workload — an attachment, an IPAM pool, a pod spec
+change. Worth it for Ceph replication. Not worth it for east-west traffic in
+general.
+
+## Recommended mapping
+
+Two ways to arrange this, and they differ only in which VLAN gets relabelled:
+
+**A — move the node IP to a new cluster VLAN.** VLAN 40 keeps etcd, the API VIP
+and Talos API. Cleanest match to the class names, but it changes every node's
+identity, which is the one address the whole cluster is administered through.
+
+**B (recommended) — leave the node IP on VLAN 40 and move management off it.**
+VLAN 40 becomes the cluster VLAN; a new VLAN carries etcd and the API VIP.
+Identical end state, and no node ever changes its InternalIP.
+
+Under B:
+
+| VLAN | carries |
+|---|---|
+| 49 | Ceph replication |
+| 40 (relabelled *cluster*) | pod east-west, kubelet |
+| new *management* | etcd, kube-apiserver VIP, Talos API by convention |
+| new *external* | LoadBalancer ingress, egress default route |
+
+The property the user asked for — management carries only management traffic —
+holds under B. The label moves; the property is what matters.
+
+## Migration shape
+
+Every step is rolling and reversible. The routing-mode change is gone.
+
+1. **New VLANs** on the switch, trunked to the X710. Nothing uses them.
+2. **Addresses** on the new VLANs via Talos, one node at a time, `--mode=try`.
+   Still unused; this only proves the L2 works.
+3. **etcd** to the management VLAN via `advertisedSubnets`. One node at a time,
+   waiting for a healthy quorum between each.
+4. **API VIP** to the management VLAN via `Layer2VIPConfig.link`. DNS for
+   `k8s.renner.uno` follows.
+5. **cluster-external**: BGP `localAddress`, default route, masquerade flag.
+   Reversible by reverting the override; failure is visible immediately in
+   `cilium-dbg shell -- bgp/peers`.
+6. Verify VLAN 40 by what is *absent* from it, not by what still works.
+
+Step 3 is the one that deserves care — etcd is the only step where a mistake
+costs quorum rather than connectivity.
+
+## What this does not buy
+
+Management currently shares a 10 Gb link and is not contended. Nothing observed
+today is slow because of this. The case for the split is that traffic classes
+with different failure modes and security postures should not be
+indistinguishable — not that something is broken.
+
+## Sources and measurements
+
+Source, Cilium v1.20.1 (the running version):
+
+- `pkg/datapath/linux/node.go` — `installDirectRoute(…, nodeIP net.IP, …)`,
+  fed from `newIP4 = newNode.GetNodeIP(false)`; `createDirectRouteSpec` rejects
+  a next-hop that is not directly reachable.
+- `pkg/node/types/node.go` — `GetNodeIP` prefers `NodeInternalIP`.
+- `pkg/node/sync/local_node_sync.go` — `initFromConfig()` applies
+  `--ipv4-node`, `initFromK8s()` runs afterwards and overwrites it from the
+  Kubernetes Node.
+- `cilium-agent` flag reference — `--direct-routing-device`: "Device name used
+  to connect nodes in direct routing mode".
+
+Talos:
+
+- Multihoming guide — `cluster.etcd.advertisedSubnets`; `listenSubnets`
+  defaults to it. kube-apiserver and Talos API listen addresses are not
+  covered there.
+- `kubernetes/talos/patches/k8s-{1,2,3}.yaml` — `Layer2VIPConfig` for
+  `10.2.40.60` with `link: mgmt0`.
+
+Measured on the cluster:
+
+- `apid` answered on a node address that is not the InternalIP, so the Talos
+  API is not bound to one address.
+- k8s-1 currently holds one routable v4 address plus the VIP on `mgmt0`; its
+  InternalIP had changed since the last session, which is why nothing here
+  names an address as fixed.
+- Cilium runs `routing-mode: tunnel` with `enable-masquerade-to-route-source`
+  unset and no direct-routing device configured.
+
+Not verified: whether the kube-apiserver's `--advertise-address` follows the
+node IP independently of the VIP. It does not affect the recommendation, since
+clients reach the API through the VIP either way.

kubernetes/apps/audiobookshelf/deployment.yaml

@@ -70,7 +70,7 @@ spec:
               mountPath: /ca
       containers:
         - name: audiobookshelf
-          image: ghcr.io/advplyr/audiobookshelf:2.36.1 # {"$imagepolicy": "flux-system:audiobookshelf"}
+          image: ghcr.io/advplyr/audiobookshelf:2.36.0 # {"$imagepolicy": "flux-system:audiobookshelf"}
           ports:
             - name: http
               containerPort: 80

kubernetes/apps/authentik/ldap-outpost-lb.yaml

@@ -40,7 +40,7 @@ metadata:
     # so this Service produces no public record — LDAP stays
     # LAN-internal, which matches the threat model of the cleartext
     # bind on 389.
-    external-dns.kubernetes.io/hostname: ldap.renner.uno
+    external-dns.alpha.kubernetes.io/hostname: ldap.renner.uno
 spec:
   type: LoadBalancer
   externalTrafficPolicy: Local

kubernetes/apps/external-dns/kustomization.yaml

@@ -3,4 +3,3 @@ kind: Kustomization
 resources:
   - externalsecret.yaml
   - helmrelease.yaml
-  - networkpolicy.yaml

kubernetes/apps/external-dns/networkpolicy.yaml

@@ -1,22 +0,0 @@
-# The apps namespace is default-deny-ingress, so the ServiceMonitor added in
-# monitoring-rules/external-dns-servicemonitor.yaml scraped into a timeout.
-# The selector matches both releases — the Cloudflare one deployed here and
-# external-dns-unifi from infrastructure/ — since they share the chart's
-# app.kubernetes.io/name and land in the same namespace.
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: external-dns-allow-metrics-scrape
-  namespace: apps
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: external-dns
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: monitoring
-      toPorts:
-        - ports:
-            - port: "7979"
-              protocol: TCP

kubernetes/apps/gitea/ingress.yaml

@@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: gitea
-  namespace: gitea
+  namespace: apps
   labels:
     app.kubernetes.io/name: gitea
   annotations:

kubernetes/apps/gitea/ingressroute-ssh.yaml

@@ -2,7 +2,7 @@ apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
 metadata:
   name: gitea-ssh
-  namespace: gitea
+  namespace: apps
   labels:
     app.kubernetes.io/name: gitea
 spec:

kubernetes/apps/gitea/networkpolicy.yaml

@@ -1,8 +1,28 @@
-# Prometheus scrape and Traefik are admitted by the namespace baseline in
-# infrastructure/network-policies/gitea-ns.yaml.
-#
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: gitea-allow-metrics-scrape
+  namespace: apps
+spec:
+  # Prometheus (monitoring ns) scrapes gitea's /metrics on :3000. The apps
+  # default-deny-ingress only allows same-ns / home-assistant / host, so the
+  # scrape is dropped (context deadline exceeded). This became necessary only
+  # after the LXC->in-cluster cutover — the old static target was external, so
+  # no in-cluster policy applied. Scoped to the gitea pod + :3000.
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+---
 # Secret rotation: the flux-git rotator (openbao ns) reaches gitea to mint a new
-# flux PAT. It uses the in-cluster Service (gitea.gitea.svc:3000) — the public
+# flux PAT. It uses the in-cluster Service (gitea.apps.svc:3000) — the public
 # gitea.renner.uno name hairpins off the ingress LB from a pod (same failure as
 # pve.renner.uno). Scoped to the gitea pod :3000 and the rotator label; the
 # egress half is rotator-gitea-flux-egress in network-policies/openbao-ns.yaml.
@@ -10,7 +30,7 @@ apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
   name: gitea-allow-flux-rotator
-  namespace: gitea
+  namespace: apps
 spec:
   endpointSelector:
     matchLabels:
@@ -34,7 +54,7 @@ apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
   name: gitea-allow-review-bot-rotator
-  namespace: gitea
+  namespace: apps
 spec:
   endpointSelector:
     matchLabels:

kubernetes/apps/gitea/pdb.yaml

@@ -13,7 +13,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: gitea
-  namespace: gitea
+  namespace: apps
   labels:
     app.kubernetes.io/name: gitea
 spec:

kubernetes/apps/gitea/service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: gitea
-  namespace: gitea
+  namespace: apps
   labels:
     app.kubernetes.io/name: gitea
 spec:

kubernetes/apps/gitea/statefulset.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: gitea
-  namespace: gitea
+  namespace: apps
   labels:
     app.kubernetes.io/name: gitea
 spec:
@@ -152,7 +152,7 @@ spec:
           # NOTE: volumeClaimTemplates is immutable on an existing StatefulSet,
           # so bumping this value cannot be `kubectl apply`-ed in place — Flux
           # will reject the whole object. Landing this size change requires a
-          # one-time `kubectl delete statefulset gitea -n gitea --cascade=orphan`
+          # one-time `kubectl delete statefulset gitea -n apps --cascade=orphan`
           # (pod + PVC keep running) so Flux re-creates the STS from this
           # template and re-adopts them. After the cleanup_packages GC reclaims
           # the ~10G of orphaned blobs, real usage is ~9G, so 40Gi is headroom.

kubernetes/apps/home-assistant/bgp-service.yaml

@@ -18,7 +18,7 @@ metadata:
     lb-pool: bgp
   annotations:
     lbipam.cilium.io/ips: "10.2.99.87,fd99::87"
-    external-dns.kubernetes.io/hostname: ha.renner.uno
+    external-dns.alpha.kubernetes.io/hostname: ha.renner.uno
 spec:
   type: LoadBalancer
   externalTrafficPolicy: Local

kubernetes/apps/home-assistant/deployment.yaml

@@ -95,7 +95,7 @@ spec:
               memory: 32Mi
       containers:
         - name: home-assistant
-          image: ghcr.io/home-assistant/home-assistant:2026.9.3 # {"$imagepolicy": "flux-system:home-assistant"}
+          image: ghcr.io/home-assistant/home-assistant:2026.9.2 # {"$imagepolicy": "flux-system:home-assistant"}
           env:
             - name: TZ
               value: Europe/Berlin

kubernetes/apps/home-assistant/mosquitto-iot-service.yaml

@@ -19,7 +19,7 @@ metadata:
     # LAN can connect with `mqtt.renner.uno` (matches the broker cert
     # SAN) instead of the bare IP. No Cloudflare label — kept off the
     # public DNS; UniFi serves a split-DNS answer for LAN clients.
-    external-dns.kubernetes.io/hostname: mqtt.renner.uno
+    external-dns.alpha.kubernetes.io/hostname: mqtt.renner.uno
 spec:
   type: LoadBalancer
   externalTrafficPolicy: Local

kubernetes/apps/kustomization.yaml

@@ -3,8 +3,8 @@ kind: Kustomization
 resources:
   - gatus/
   - external-dns/
+  - gitea/
   - ical-proxy/
-  # gitea/ has its own `gitea` Kustomization (clusters/homelab/gitea.yaml, #878).
   # woodpecker/ moved to its own dedicated `woodpecker` Kustomization
   # (clusters/homelab/woodpecker.yaml) so its wp-pg CNPG cluster's barman
   # dependency + Cluster health-gating don't contaminate this shared apps KS.

kubernetes/apps/libation/cronjob.yaml

@@ -42,11 +42,9 @@ spec:
               type: RuntimeDefault
           initContainers:
             # Seed the libation-config PVC from the bootstrap secret on
-            # first run only — sentinel file gates re-runs so DB updates
-            # from subsequent liberate passes are preserved. Refreshed
-            # Audible tokens are preserved by the container args, not by
-            # this sentinel: the entrypoint copies AccountsSettings.json
-            # into ephemeral /config-internal rather than symlinking it.
+            # first run only — sentinel file gates re-runs so token
+            # refreshes in AccountsSettings.json and DB updates from
+            # subsequent liberate passes are preserved.
             - name: seed-config
               image: busybox:1.37.0
               command: ["/bin/sh", "-eu", "-c"]
@@ -68,11 +66,6 @@ spec:
                   install -m 660 /bootstrap/AccountsSettings.json /libation-state/AccountsSettings.json
                   install -m 660 /bootstrap/Settings.json          /libation-state/Settings.json
                   install -m 660 /bootstrap/LibationContext.db     /libation-state/LibationContext.db
-                  # Without this key the seeded tokens cannot be decrypted:
-                  # TokenStorageMethod is Encrypted and the container has no
-                  # OS secret store, so a missing key file makes the
-                  # entrypoint mint a throwaway one on every run.
-                  install -m 660 /bootstrap/libation-master.key   /libation-state/libation-master.key
                   touch /libation-state/.bootstrapped
                   ls -la /libation-state
               volumeMounts:
@@ -92,23 +85,7 @@ spec:
                   type: RuntimeDefault
           containers:
             - name: libation
-              # Pinned by digest: Spegel caches mutable tag resolutions, so
-              # :latest stayed on 13.7.11 despite imagePullPolicy Always.
-              image: docker.io/rmcrackan/libation:14.2.1@sha256:6f9d8ba19dc3803dd6ba295ab5a7abfb6ff3bc06286eebf4ecd8ccbe43245888
-              # The entrypoint stages config into ephemeral /config-internal
-              # by copy (only the DB is symlinked to the PVC), so Audible
-              # tokens refreshed during a run are lost at container exit.
-              # Passing args makes the entrypoint set up the environment and
-              # then exec this instead of its own loop; the trap copies the
-              # refreshed file back to the PVC on every exit path.
-              args:
-                - /bin/sh
-                - -c
-                - |
-                  trap 'cp /config-internal/AccountsSettings.json /libation-state/AccountsSettings.json' EXIT
-                  set -e
-                  /libation/LibationCli scan
-                  /libation/LibationCli liberate
+              image: docker.io/rmcrackan/libation:latest
               env:
                 - name: LIBATION_CONFIG_DIR
                   value: /libation-state

kubernetes/apps/llama-server/kustomization.yaml

@@ -6,5 +6,3 @@ resources:
   - embed.yaml
   - gate-service.yaml
   - ingress.yaml
-  - wiki-embed.yaml
-  - wiki-embed-ingress.yaml

kubernetes/apps/llama-server/wiki-embed-ingress.yaml

@@ -1,57 +0,0 @@
----
-# wiki-embed.renner.uno — LAN-only (no dns.renner.uno/public label), consumed by
-# bin/wiki_rank.py on the workstation and the nightly wiki jobs. Machine client,
-# so Traefik BasicAuth instead of the browser-only Authentik gate; same pattern
-# as kubernetes/apps/monitoring/loki-ingress.yaml.
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: wiki-embed-basic-auth
-  namespace: ai
-spec:
-  basicAuth:
-    secret: wiki-embed-basic-auth
-    realm: wiki-embed
----
-# OpenBao key apps/ai/wiki-embed-basic-auth, field `users` = htpasswd line.
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: wiki-embed-basic-auth
-  namespace: ai
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  target:
-    name: wiki-embed-basic-auth
-  dataFrom:
-    - extract:
-        key: apps/ai/wiki-embed-basic-auth
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: wiki-embed
-  namespace: ai
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-cluster
-    traefik.ingress.kubernetes.io/router.middlewares: ai-wiki-embed-basic-auth@kubernetescrd
-spec:
-  ingressClassName: traefik
-  tls:
-    - hosts:
-        - wiki-embed.renner.uno
-      secretName: wiki-embed-tls
-  rules:
-    - host: wiki-embed.renner.uno
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: wiki-embed
-                port:
-                  number: 8080

kubernetes/apps/llama-server/wiki-embed.yaml

@@ -1,117 +0,0 @@
----
-# Embedding endpoint for the ~/Notes wiki ranker (bin/wiki_rank.py). Own
-# Deployment so wiki traffic never queues behind Paperless on llama-embed.
-# Same model and PVC as llama-embed, so no second download.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wiki-embed
-  namespace: ai
-  labels:
-    app.kubernetes.io/name: wiki-embed
-spec:
-  replicas: 1
-  # Above the 600s startupProbe budget; see embed.yaml.
-  progressDeadlineSeconds: 900
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: wiki-embed
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: wiki-embed
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: wiki-embed
-          image: ghcr.io/ggml-org/llama.cpp:server-vulkan-b10731
-          args:
-            - --hf-repo
-            - gpustack/bge-m3-GGUF:Q8_0
-            - --embeddings
-            - --alias
-            - bge-m3
-            # bge-m3 is trained for CLS pooling; the GGUF default is not.
-            - --pooling
-            - cls
-            - --n-gpu-layers
-            - "99"
-            - --threads
-            - "2"
-            # wiki_rank.py caps each note at 1500 chars and sends 2 per request.
-            - --batch-size
-            - "1536"
-            - --ubatch-size
-            - "1536"
-            - --ctx-size
-            - "4096"
-            - --no-webui
-          env:
-            - name: LLAMA_CACHE
-              value: /models
-          ports:
-            - name: http
-              containerPort: 8080
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          # Same sizing as llama-embed: 1.6 GiB measured peak, headroom for slots.
-          resources:
-            requests:
-              cpu: 250m
-              memory: 2Gi
-              gpu.intel.com/i915: "1"
-            limits:
-              cpu: "2"
-              memory: 8Gi
-              gpu.intel.com/i915: "1"
-          startupProbe:
-            httpGet:
-              path: /health
-              port: http
-            periodSeconds: 10
-            failureThreshold: 60
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-            periodSeconds: 30
-            timeoutSeconds: 10
-            failureThreshold: 6
-          volumeMounts:
-            - name: models
-              mountPath: /models
-      volumes:
-        - name: models
-          persistentVolumeClaim:
-            claimName: llama-server-models
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wiki-embed
-  namespace: ai
-  labels:
-    app.kubernetes.io/name: wiki-embed
-spec:
-  selector:
-    app.kubernetes.io/name: wiki-embed
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http

kubernetes/apps/monitoring-rules/external-dns-servicemonitor.yaml

@@ -1,25 +0,0 @@
-# Both external-dns releases (Cloudflare and the UniFi webhook) carry
-# app.kubernetes.io/name: external-dns and differ only by instance, so one
-# monitor covers both. jobLabel keeps them apart as separate job values.
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: external-dns
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: external-dns
-    release: kube-prometheus-stack
-spec:
-  jobLabel: app.kubernetes.io/instance
-  namespaceSelector:
-    matchNames:
-      - apps
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: external-dns
-  endpoints:
-    # The controller's own metrics. Port 8080 on the unifi release is the
-    # webhook sidecar and exports no external_dns_* series.
-    - port: http
-      path: /metrics
-      interval: 60s

kubernetes/apps/monitoring-rules/kustomization.yaml

@@ -21,14 +21,6 @@ resources:
   # alerted if that stopped — HetznerBackupEndpointDown only probes the S3
   # endpoint, which proves reachability, not that anything was written.
   - prometheusrule-cnpg-backup.yaml
-  # DNS publication. Nothing scraped external-dns, so it deleted six LAN
-  # records on 2026-09-12 and stayed silent for five days.
-  - prometheusrule-external-dns.yaml
-  - external-dns-servicemonitor.yaml
-  # Outcome check for the same failure: the names themselves, asked of the
-  # UDM. Catches a cause external-dns cannot see, e.g. records removed there.
-  - prometheusrule-dns-resolution.yaml
-  - probes-dns.yaml
   - alloy-servicemonitor.yaml
   - cilium-servicemonitor.yaml
   - cnpg-podmonitors.yaml

kubernetes/apps/monitoring-rules/probes-dns.yaml

@@ -1,143 +0,0 @@
-# DNS probes for the names external-dns publishes to the UDM from
-# LoadBalancer Services. One Probe per name because the dns prober's
-# query_name is module-scoped; the target is the resolver, queried on both
-# families so a single-stack blip does not read as a missing record.
-#
-# The UDM is queried directly rather than through the cluster resolver:
-# k8s-gateway caches these with `serve_stale 1h immediate`, which would keep
-# a deleted record green for an hour.
-#
-# `release` is load-bearing — probeSelector matches on it.
-apiVersion: monitoring.coreos.com/v1
-kind: Probe
-metadata:
-  name: dns-lan-ha
-  namespace: monitoring
-  labels:
-    release: kube-prometheus-stack
-spec:
-  jobName: blackbox-dns
-  prober:
-    url: blackbox-exporter-prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
-  module: dns_lan_ha
-  interval: 60s
-  scrapeTimeout: 10s
-  targets:
-    staticConfig:
-      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
-      # instance is the resolver and identical across these Probes, so the
-      # queried name has to come from a label.
-      labels:
-        dns_name: ha.renner.uno
----
-apiVersion: monitoring.coreos.com/v1
-kind: Probe
-metadata:
-  name: dns-lan-mqtt
-  namespace: monitoring
-  labels:
-    release: kube-prometheus-stack
-spec:
-  jobName: blackbox-dns
-  prober:
-    url: blackbox-exporter-prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
-  module: dns_lan_mqtt
-  interval: 60s
-  scrapeTimeout: 10s
-  targets:
-    staticConfig:
-      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
-      labels:
-        dns_name: mqtt.renner.uno
----
-apiVersion: monitoring.coreos.com/v1
-kind: Probe
-metadata:
-  name: dns-lan-ldap
-  namespace: monitoring
-  labels:
-    release: kube-prometheus-stack
-spec:
-  jobName: blackbox-dns
-  prober:
-    url: blackbox-exporter-prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
-  module: dns_lan_ldap
-  interval: 60s
-  scrapeTimeout: 10s
-  targets:
-    staticConfig:
-      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
-      labels:
-        dns_name: ldap.renner.uno
----
-apiVersion: monitoring.coreos.com/v1
-kind: Probe
-metadata:
-  name: dns-lan-syslog
-  namespace: monitoring
-  labels:
-    release: kube-prometheus-stack
-spec:
-  jobName: blackbox-dns
-  prober:
-    url: blackbox-exporter-prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
-  module: dns_lan_syslog
-  interval: 60s
-  scrapeTimeout: 10s
-  targets:
-    staticConfig:
-      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
-      labels:
-        dns_name: syslog.renner.uno
----
-apiVersion: monitoring.coreos.com/v1
-kind: Probe
-metadata:
-  name: dns-lan-ftp-scanner
-  namespace: monitoring
-  labels:
-    release: kube-prometheus-stack
-spec:
-  jobName: blackbox-dns
-  prober:
-    url: blackbox-exporter-prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
-  module: dns_lan_ftp_scanner
-  interval: 60s
-  scrapeTimeout: 10s
-  targets:
-    staticConfig:
-      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
-      labels:
-        dns_name: ftp.paperless.renner.uno
----
-apiVersion: monitoring.coreos.com/v1
-kind: Probe
-metadata:
-  name: dns-lan-syncthing
-  namespace: monitoring
-  labels:
-    release: kube-prometheus-stack
-spec:
-  jobName: blackbox-dns
-  prober:
-    url: blackbox-exporter-prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
-  module: dns_lan_syncthing
-  interval: 60s
-  scrapeTimeout: 10s
-  targets:
-    staticConfig:
-      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
-      labels:
-        dns_name: syncthing.paperless.renner.uno

kubernetes/apps/monitoring-rules/prometheusrule-dns-resolution.yaml

@@ -1,49 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: dns-resolution
-  namespace: monitoring
-  labels:
-    # ruleSelector matches on this label; without it the rule is created but
-    # never loaded into Prometheus.
-    release: kube-prometheus-stack
-spec:
-  groups:
-    - name: dns-resolution.rules
-      rules:
-        # min by dns_name: both resolver families are probed, and the record
-        # is only gone when neither answers. A single-family failure is the
-        # UDM's dnsmasq refusing connections in bursts (k8s-gateway carries
-        # the same note), which is why the window is 30m rather than the 10m
-        # used for HTTP probes.
-        - alert: LanDnsRecordMissing
-          expr: min by (dns_name) (probe_success{job="blackbox-dns"}) == 0
-          for: 30m
-          labels:
-            severity: critical
-          annotations:
-            summary: "{{ $labels.dns_name }} no longer resolves to its LAN address"
-            description: >-
-              The UDM stopped answering for a name external-dns publishes from
-              a LoadBalancer Service, or answered with the public
-              *.renner.uno wildcard instead of the record. Clients that use
-              the name rather than the address lose the service while
-              everything in the cluster stays healthy — nothing else in the
-              stack reports this. Check the external-dns alerts first, then
-              the record on the UDM.
-
-        # Dead-man's-switch, mirroring BlackboxProbesAbsent: without probe
-        # results the rule above cannot fire.
-        - alert: LanDnsProbesAbsent
-          expr: absent(probe_success{job="blackbox-dns"})
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            summary: "No LAN DNS probe results are reaching Prometheus"
-            description: >-
-              The blackbox-dns Probes stopped being discovered or the exporter
-              rejects the modules. A 400 from /probe yields no probe_* series
-              at all, which looks the same as no Probe — check that every
-              dns_lan_* module the Probes reference exists in the
-              blackbox-exporter config.

kubernetes/apps/monitoring-rules/prometheusrule-external-dns.yaml

@@ -1,87 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: external-dns
-  namespace: monitoring
-  labels:
-    # ruleSelector matches on this label; without it the rule is created but
-    # never loaded into Prometheus.
-    release: kube-prometheus-stack
-spec:
-  groups:
-    - name: external-dns.rules
-      rules:
-        # The signal that was missing on 2026-09-12: the sources stopped
-        # producing endpoints they had produced before, and policy=sync
-        # deleted the records. 10% below the 24h peak clears a single
-        # retired Ingress (2 of ~48) and catches a whole class of names.
-        - alert: ExternalDNSSourceEndpointsDropped
-          expr: >-
-            external_dns_source_endpoints_total
-              < 0.9 * max_over_time(external_dns_source_endpoints_total[24h])
-          for: 30m
-          labels:
-            severity: critical
-          annotations:
-            summary: "{{ $labels.job }} is publishing {{ $value }} endpoints, below its 24h peak"
-            description: >-
-              external-dns stopped seeing endpoints it had before. With
-              policy=sync the matching DNS records are deleted, so names stop
-              resolving without anything else failing. Compare
-              external_dns_source_endpoints_total against the last 24h, then
-              check whether the resources still carry a hostname annotation
-              the running version understands — a changed annotation prefix
-              default empties the source silently. Deliberate removals also
-              fire this and resolve themselves 24h later.
-
-        # Source errors mean the Kubernetes side failed; registry errors mean
-        # the provider did. Either way desired state is computed from partial
-        # input, which policy=sync acts on.
-        - alert: ExternalDNSSourceErrors
-          expr: increase(external_dns_source_errors_total[15m]) > 0
-          for: 15m
-          labels:
-            severity: warning
-          annotations:
-            summary: "{{ $labels.job }} is failing to read its sources"
-            description: >-
-              external-dns could not list the Kubernetes resources it derives
-              records from. Check the pod log and its RBAC.
-
-        - alert: ExternalDNSRegistryErrors
-          expr: increase(external_dns_registry_errors_total[15m]) > 0
-          for: 15m
-          labels:
-            severity: warning
-          annotations:
-            summary: "{{ $labels.job }} is failing to reach its DNS provider"
-            description: >-
-              external-dns could not read or write records at the provider.
-              For external-dns-unifi that is the UniFi webhook sidecar and the
-              controller behind it; for external-dns it is the Cloudflare API.
-
-        - alert: ExternalDNSDown
-          expr: up{job=~"external-dns.*"} == 0
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            summary: "{{ $labels.job }} is not being scraped"
-            description: >-
-              The external-dns instance is down or unreachable. Records already
-              at the provider keep resolving, but nothing reconciles them any
-              more and every other alert in this group is blind.
-
-        # Dead-man's-switch for the group, mirroring BlackboxProbesAbsent: a
-        # dropped ServiceMonitor makes every rule above evaluate to nothing.
-        - alert: ExternalDNSMetricsMissing
-          expr: absent(external_dns_source_endpoints_total)
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            summary: "No external-dns metrics are reaching Prometheus"
-            description: >-
-              Either both external-dns instances are gone or the ServiceMonitor
-              stopped being discovered. Verify it still carries
-              release=kube-prometheus-stack.

kubernetes/apps/monitoring-rules/prometheusrule-openbao.yaml

@@ -57,14 +57,10 @@ spec:
           # the ClusterSecretStore goes InvalidProviderConfig and no
           # ExternalSecret can refresh.
           #
-          # Short window: readiness is only a proxy for quorum. A one-second
-          # node NotReady flap makes the node lifecycle controller mark that
-          # node's pods not-ready for ~30s while raft keeps its leader and
-          # serves (issue #920, during a rolling reboot with one replica
-          # already evicted). A really sealed or crashed majority persists,
-          # and existing Secrets keep their last values, so 2m costs little.
+          # No window: below quorum the secret store is down and every
+          # ExternalSecret stalls with it, so waiting only delays the page.
           expr: max by (namespace, statefulset) (kube_statefulset_status_replicas_ready{namespace="openbao", statefulset="openbao"}) < 2
-          for: 2m
+          for: 0m
           labels:
             severity: critical
           annotations:

kubernetes/apps/monitoring/helmrelease-alloy-syslog.yaml

@@ -232,7 +232,7 @@ metadata:
     lb-pool: bgp
   annotations:
     io.cilium/lb-ipam-ips: "10.2.99.84,fd99::84"
-    external-dns.kubernetes.io/hostname: syslog.renner.uno
+    external-dns.alpha.kubernetes.io/hostname: syslog.renner.uno
 spec:
   type: LoadBalancer
   externalTrafficPolicy: Local

kubernetes/apps/monitoring/helmrelease-blackbox-exporter.yaml

@@ -72,73 +72,3 @@ spec:
           tcp:
             preferred_ip_protocol: ip6
             ip_protocol_fallback: true
-        # One module per name: the dns prober takes the RESOLVER as its
-        # target and reads query_name from the module, so a name cannot be
-        # passed per scrape. The Probes in monitoring-rules/probes-dns.yaml
-        # point these at the UDM.
-        #
-        # Both answer checks are load-bearing. valid_rcodes alone passes a
-        # deleted record two labels deep (NOERROR, no answer), and the public
-        # *.renner.uno wildcard answers one label deep with a CNAME to
-        # proxy.renner.uno — NOERROR with the WAN proxy behind it. Requiring
-        # an A and rejecting a CNAME separates a real record from both.
-        dns_lan_ha:
-          prober: dns
-          timeout: 5s
-          dns:
-            query_name: ha.renner.uno
-            query_type: A
-            valid_rcodes: [NOERROR]
-            validate_answer_rrs:
-              fail_if_not_matches_regexp: ['\sIN\s+A\s']
-              fail_if_matches_regexp: ['\sIN\s+CNAME\s']
-        dns_lan_mqtt:
-          prober: dns
-          timeout: 5s
-          dns:
-            query_name: mqtt.renner.uno
-            query_type: A
-            valid_rcodes: [NOERROR]
-            validate_answer_rrs:
-              fail_if_not_matches_regexp: ['\sIN\s+A\s']
-              fail_if_matches_regexp: ['\sIN\s+CNAME\s']
-        dns_lan_ldap:
-          prober: dns
-          timeout: 5s
-          dns:
-            query_name: ldap.renner.uno
-            query_type: A
-            valid_rcodes: [NOERROR]
-            validate_answer_rrs:
-              fail_if_not_matches_regexp: ['\sIN\s+A\s']
-              fail_if_matches_regexp: ['\sIN\s+CNAME\s']
-        dns_lan_syslog:
-          prober: dns
-          timeout: 5s
-          dns:
-            query_name: syslog.renner.uno
-            query_type: A
-            valid_rcodes: [NOERROR]
-            validate_answer_rrs:
-              fail_if_not_matches_regexp: ['\sIN\s+A\s']
-              fail_if_matches_regexp: ['\sIN\s+CNAME\s']
-        dns_lan_ftp_scanner:
-          prober: dns
-          timeout: 5s
-          dns:
-            query_name: ftp.paperless.renner.uno
-            query_type: A
-            valid_rcodes: [NOERROR]
-            validate_answer_rrs:
-              fail_if_not_matches_regexp: ['\sIN\s+A\s']
-              fail_if_matches_regexp: ['\sIN\s+CNAME\s']
-        dns_lan_syncthing:
-          prober: dns
-          timeout: 5s
-          dns:
-            query_name: syncthing.paperless.renner.uno
-            query_type: A
-            valid_rcodes: [NOERROR]
-            validate_answer_rrs:
-              fail_if_not_matches_regexp: ['\sIN\s+A\s']
-              fail_if_matches_regexp: ['\sIN\s+CNAME\s']

kubernetes/apps/monitoring/helmrelease-prometheus.yaml

@@ -91,11 +91,12 @@ spec:
         # Additional scrape targets not covered by ServiceMonitors.
         additionalScrapeConfigs:
           # Gitea exposes /metrics anonymously on its main HTTP port. The
-          # `gitea_*` metrics power the gitea-overview dashboard. Scrapes the
-          # ClusterIP Service of the StatefulSet in the gitea namespace.
+          # `gitea_*` metrics power the gitea-overview dashboard. Gitea now runs
+          # in-cluster (StatefulSet in apps ns; LXC 114 retired), so scrape the
+          # ClusterIP Service directly instead of the dead LXC hostname.
           - job_name: gitea
             static_configs:
-              - targets: ["gitea.gitea.svc.cluster.local:3000"]
+              - targets: ["gitea.apps.svc.cluster.local:3000"]
             metrics_path: /metrics
 
     # Grafana

kubernetes/apps/music-assistant/deployment.yaml

@@ -55,7 +55,7 @@ spec:
         # stdlib only; Flux keeps the tag in lockstep via the shared image
         # policy) — no extra dependency.
         - name: reconcile-publish-ip
-          image: ghcr.io/music-assistant/server:2.10.4 # {"$imagepolicy": "flux-system:music-assistant"}
+          image: ghcr.io/music-assistant/server:2.10.3 # {"$imagepolicy": "flux-system:music-assistant"}
           command: ["/app/venv/bin/python", "/scripts/reconcile.py"]
           volumeMounts:
             - name: data
@@ -65,7 +65,7 @@ spec:
               readOnly: true
       containers:
         - name: music-assistant
-          image: ghcr.io/music-assistant/server:2.10.4 # {"$imagepolicy": "flux-system:music-assistant"}
+          image: ghcr.io/music-assistant/server:2.10.3 # {"$imagepolicy": "flux-system:music-assistant"}
           env:
             - name: LOG_LEVEL
               value: info

kubernetes/apps/paperless/ftp-scanner.yaml

@@ -43,7 +43,7 @@ spec:
               mountPath: /consume
       containers:
         - name: vsftpd
-          image: gitea.renner.uno/k.renner/vsftpd:build.1789630783 # {"$imagepolicy": "flux-system:vsftpd"}
+          image: gitea.renner.uno/k.renner/vsftpd:build.1784731469 # {"$imagepolicy": "flux-system:vsftpd"}
           ports:
             - name: ftp-ctrl
               containerPort: 21
@@ -70,19 +70,24 @@ spec:
             - name: consume
               mountPath: /home/scanner
               subPath: scanner
-          # Asserts the control socket is listening without opening an FTP
-          # connection: vsftpd 3.0.5 segfaults its listener on a fraction of
-          # the connections it accepts. The passive range is negotiated per
-          # transfer and is not listening at rest, so it is not probed.
+          # FTP has no health verb, so the control port accepting a connection
+          # is what can be asserted. It is enough for the failure that matters:
+          # if vsftpd dies the scanner cannot deposit anything and nothing else
+          # in the chain notices, because paperless only ever sees an empty
+          # consume directory — which is indistinguishable from nobody having
+          # scanned.
+          #
+          # Only the control port is probed. The passive range is negotiated
+          # per transfer and is not listening at rest.
           livenessProbe:
-            exec:
-              command: ["sh", "-c", "netstat -lnt | grep -q ':21 '"]
+            tcpSocket:
+              port: ftp-ctrl
             initialDelaySeconds: 15
             periodSeconds: 30
             timeoutSeconds: 5
           readinessProbe:
-            exec:
-              command: ["sh", "-c", "netstat -lnt | grep -q ':21 '"]
+            tcpSocket:
+              port: ftp-ctrl
             initialDelaySeconds: 5
             periodSeconds: 10
             timeoutSeconds: 5
@@ -119,7 +124,7 @@ metadata:
     # label — FTP must not be exposed via the cargo tunnel (clear-text
     # protocol, public exposure not appropriate). The brother scanner
     # uses this hostname instead of the LB IP.
-    external-dns.kubernetes.io/hostname: ftp.paperless.renner.uno
+    external-dns.alpha.kubernetes.io/hostname: ftp.paperless.renner.uno
 spec:
   type: LoadBalancer
   externalTrafficPolicy: Local

kubernetes/apps/paperless/kustomization.yaml

@@ -25,15 +25,18 @@ resources:
 configMapGenerator:
   # vsftpd config for the ftp-scanner deployment. The content-hash name
   # suffix is intentionally LEFT ENABLED (unlike home-assistant's nginx
-  # config): vsftpd reads these into vsftpd.conf at container start, so a
-  # changed value must roll the pod, which the renamed ConfigMap does.
-  #
-  # No PASV_ADDRESS: the LB address is declared once, on the Service
-  # (io.cilium/lb-ipam-ips). The image default 0.0.0.0 tells PASV clients
-  # to reuse the control-connection address.
+  # config): vsftpd templates pasv_address from PASV_ADDRESS at container
+  # start, so a changed value must roll the pod. With the hash suffix,
+  # editing any value here renames the generated ConfigMap, which mutates
+  # the Deployment's pod template and triggers an automatic rolling
+  # restart. Without it, an IP change (e.g. an LB re-allocation) silently
+  # leaves the running pod advertising the stale PASV address, which
+  # breaks classic-PASV clients (older Brother scanners) while EPSV
+  # clients keep working.
   - name: ftp-scanner-config
     namespace: paperless
     literals:
+      - PASV_ADDRESS=10.2.99.82
       - PASV_MIN_PORT=21100
       - PASV_MAX_PORT=21104
       - FTP_USER=scanner

kubernetes/apps/paperless/paperless.yaml

@@ -27,8 +27,6 @@ data:
   PAPERLESS_ALLOWED_HOSTS: "*"
   PAPERLESS_TIME_ZONE: "Europe/Berlin"
   PAPERLESS_OCR_LANGUAGE: "deu+eng"
-  # Default is cpu_count / TASK_WORKERS, 20 on k8s-1; OCR memory scales with it.
-  PAPERLESS_THREADS_PER_WORKER: "5"
   PAPERLESS_CONSUMER_RECURSIVE: "true"
   PAPERLESS_CONSUMER_DELETE_DUPLICATES: "true"
   PAPERLESS_CONSUMER_ENABLE_BARCODES: "true"
@@ -185,7 +183,7 @@ spec:
               drop: ["ALL"]
       containers:
         - name: paperless
-          image: ghcr.io/paperless-ngx/paperless-ngx:3.2.1 # {"$imagepolicy": "flux-system:paperless-ngx"}
+          image: ghcr.io/paperless-ngx/paperless-ngx:3.1.3 # {"$imagepolicy": "flux-system:paperless-ngx"}
           ports:
             - name: http
               containerPort: 8000
@@ -275,7 +273,7 @@ spec:
               cpu: 200m
               memory: 512Mi
             limits:
-              memory: 4Gi
+              memory: 2Gi
           securityContext:
             runAsNonRoot: false
             allowPrivilegeEscalation: true

kubernetes/apps/paperless/redis.yaml

@@ -25,7 +25,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: redis
-          image: redis:8.10.2-alpine # {"$imagepolicy": "flux-system:redis-paperless"}
+          image: redis:8.10.1-alpine # {"$imagepolicy": "flux-system:redis-paperless"}
           args:
             - redis-server
             - --save

kubernetes/apps/paperless/syncthing.yaml

@@ -145,7 +145,7 @@ metadata:
     lb-pool: bgp
   annotations:
     io.cilium/lb-ipam-ips: "10.2.99.85,fd99::85"
-    external-dns.kubernetes.io/hostname: syncthing.paperless.renner.uno
+    external-dns.alpha.kubernetes.io/hostname: syncthing.paperless.renner.uno
 spec:
   type: LoadBalancer
   externalTrafficPolicy: Local

kubernetes/apps/trmnl/terminus.yaml

@@ -134,7 +134,7 @@ spec:
         # is a device-bricking class of risk. Bumps are a reviewed, manual
         # act — see kubernetes/infrastructure/image-automation/README.md.
         - name: terminus
-          image: ghcr.io/usetrmnl/terminus:0.74.0 # {"$imagepolicy": "flux-system:terminus"}
+          image: ghcr.io/usetrmnl/terminus:0.73.0 # {"$imagepolicy": "flux-system:terminus"}
           ports:
             - name: http
               containerPort: 2345
@@ -197,7 +197,7 @@ spec:
             capabilities:
               drop: ["ALL"]
         - name: sidekiq
-          image: ghcr.io/usetrmnl/terminus:0.74.0 # {"$imagepolicy": "flux-system:terminus"}
+          image: ghcr.io/usetrmnl/terminus:0.73.0 # {"$imagepolicy": "flux-system:terminus"}
           command: ["bundle", "exec", "sidekiq", "-r", "./config/sidekiq.rb"]
           envFrom:
             - configMapRef:

kubernetes/apps/wiki-index/deployment.yaml

@@ -1,137 +0,0 @@
----
-# ServiceAccount is the OpenBao identity (auth/kubernetes/role/wiki-index); no
-# Kubernetes API access needed.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: wiki-index
-  namespace: ai
-  labels:
-    app.kubernetes.io/name: wiki-index
----
-# Index (~17 MB JSON for 1700 notes). Survives restarts so a pod start does not
-# re-embed the wiki; a lost volume only costs one full sync (~5 min).
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: wiki-index-data
-  namespace: ai
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: ceph-block
-  resources:
-    requests:
-      storage: 1Gi
----
-# Embedding index over the Notes repo's wiki/ (ci/images/wiki-index). Syncs from
-# Gitea on push webhook and every RESYNC_SECONDS, embeds via wiki-embed, serves
-# POST /rank to ~/Notes/bin/wiki_rank.py through wiki-index.renner.uno.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wiki-index
-  namespace: ai
-  labels:
-    app.kubernetes.io/name: wiki-index
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: wiki-index
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: wiki-index
-    spec:
-      serviceAccountName: wiki-index
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
-        runAsGroup: 65534
-        fsGroup: 65534
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: wiki-index
-          # Per-commit tag (build-ci-images.yml): immutable, no same-day overwrite.
-          image: gitea.renner.uno/gitea_admin/wiki-index:2026-09-20-4b529cd1
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-          env:
-            - name: GITEA_URL
-              value: https://gitea.renner.uno
-            - name: NOTES_REPO
-              value: k.renner/notes
-            - name: NOTES_BRANCH
-              value: main
-            - name: EMBED_URL
-              value: http://wiki-embed.ai.svc.cluster.local:8080
-            - name: BAO_ADDR
-              value: http://openbao.openbao.svc.cluster.local:8200
-            - name: BAO_ROLE
-              value: wiki-index
-            - name: BAO_SECRET_PATH
-              value: homelab/data/apps/ai/wiki-index
-            - name: INDEX_PATH
-              value: /data/index.json
-            - name: RESYNC_SECONDS
-              value: "1800"
-          ports:
-            - name: http
-              containerPort: 8080
-          # Pure-Python cosine over 1700 x 1024 floats per query; the index itself is ~60 MB in memory.
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          # /health: the process serves (liveness). /ready: an index exists; a cold
-          # start on an empty PVC embeds every note (~5 min) before traffic arrives.
-          startupProbe:
-            httpGet:
-              path: /health
-              port: http
-            periodSeconds: 5
-            failureThreshold: 12
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: http
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-            periodSeconds: 60
-            timeoutSeconds: 10
-            failureThreshold: 3
-          volumeMounts:
-            - name: data
-              mountPath: /data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: wiki-index-data
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wiki-index
-  namespace: ai
-  labels:
-    app.kubernetes.io/name: wiki-index
-spec:
-  selector:
-    app.kubernetes.io/name: wiki-index
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http

kubernetes/apps/wiki-index/ingress.yaml

@@ -1,56 +0,0 @@
----
-# wiki-index.renner.uno — LAN-only (no dns.renner.uno/public label), machine
-# client (bin/wiki_rank.py), so Traefik BasicAuth like wiki-embed.renner.uno.
-# Gitea's webhook does not pass here; it targets the ClusterIP Service directly.
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: wiki-index-basic-auth
-  namespace: ai
-spec:
-  basicAuth:
-    secret: wiki-index-basic-auth
-    realm: wiki-index
----
-# OpenBao key apps/ai/wiki-index-basic-auth, field `users` = htpasswd line.
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: wiki-index-basic-auth
-  namespace: ai
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  target:
-    name: wiki-index-basic-auth
-  dataFrom:
-    - extract:
-        key: apps/ai/wiki-index-basic-auth
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: wiki-index
-  namespace: ai
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-cluster
-    traefik.ingress.kubernetes.io/router.middlewares: ai-wiki-index-basic-auth@kubernetescrd
-spec:
-  ingressClassName: traefik
-  tls:
-    - hosts:
-        - wiki-index.renner.uno
-      secretName: wiki-index-tls
-  rules:
-    - host: wiki-index.renner.uno
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: wiki-index
-                port:
-                  number: 8080

kubernetes/apps/wiki-index/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - deployment.yaml
-  - ingress.yaml

kubernetes/apps/zone-configurator/deployment.yaml

@@ -21,7 +21,7 @@ spec:
       # Service; nothing on this path needs the host's network namespace.
       containers:
         - name: zone-configurator
-          image: everythingsmarthome/everything-presence-mmwave-configurator:2.2.5 # {"$imagepolicy": "flux-system:mmwave-configurator"}
+          image: everythingsmarthome/everything-presence-mmwave-configurator:2.2.4 # {"$imagepolicy": "flux-system:mmwave-configurator"}
           env:
             - name: HA_BASE_URL
               value: "http://home-assistant:80"

kubernetes/bootstrap.sh

@@ -610,8 +610,8 @@ if [[ "$PHASE" == "hcloudtest" ]]; then
     # Constraints on the choice: cpx11/cpx21 are US-only and cax* are ARM, which
     # would not match the amd64 schematic this cluster installs. That leaves the
     # cx*/cpx*2 families in the German locations.
-    # Two segments only, unlike the homelab's split in
-    # NETWORK-traffic-classes.md: here the node address carries management,
+    # Today's traffic-class split, not the target one in
+    # PROPOSAL-traffic-class-separation.md: the node address carries management,
     # cluster-internal and external alike, and Ceph replication has its own.
     #
     # The order is load-bearing: it decides which kernel interface each segment
@@ -1946,7 +1946,6 @@ if phase_runs wait-apps; then
     # apps waits on infrastructure-ceph-cluster (Ceph mon/mgr/OSD bring-up
     # is genuinely 5–10 min on a fresh OSD-wiped cluster).
     wait_kustomization apps                "apps"                                                90
-    wait_kustomization gitea               "Gitea (incl. data-gitea-0 PVC)"                      90
     wait_kustomization influxdb            "InfluxDB (HR install + token Jobs)"                  600
     wait_kustomization woodpecker          "Woodpecker CI (incl. wp-pg CNPG backend)"            600
     wait_kustomization authentik           "Authentik (incl. ak-pg CNPG backend)"                600

kubernetes/clusters/homelab/gitea.yaml

@@ -1,20 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: gitea
-  namespace: flux-system
-spec:
-  # Gitea in its own `gitea` namespace (#878), formerly under the shared `apps` KS.
-  interval: 10m
-  retryInterval: 2m
-  timeout: 15m
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  path: ./kubernetes/apps/gitea
-  prune: true
-  wait: true
-  dependsOn:
-    - name: infrastructure
-    - name: infrastructure-crds
-    - name: infrastructure-ceph-cluster

kubernetes/clusters/homelab/wiki-index.yaml

@@ -1,22 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: wiki-index
-  namespace: flux-system
-spec:
-  interval: 10m
-  retryInterval: 1m
-  # First start on an empty PVC embeds every note (~5 min) before /health is 200.
-  timeout: 20m
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  path: ./kubernetes/apps/wiki-index
-  prune: true
-  wait: true
-  dependsOn:
-    - name: infrastructure
-    - name: infrastructure-crds
-    - name: infrastructure-ceph-cluster
-    # wiki-embed (the embedding backend) lives in the llama-server app.
-    - name: llama-server

kubernetes/infrastructure/bird/bird.conf

@@ -1,103 +0,0 @@
-# Identical on every node and free of addresses. defines.conf and peers.conf
-# are rendered per node by the init container; the first is included above the
-# templates that reference it, the second below them.
-include "/etc/bird/defines.conf";
-
-router id from "pod0";
-log stderr all;
-
-protocol device { scan time 10; }
-
-# Everything a pod may need to reach, in one table, resolved by longest prefix:
-# the node's attached networks, the peers' pod CIDRs, and a default for the
-# rest. No rule has to carve out exceptions, because the specific routes win on
-# their own.
-#
-# The table is BIRD's alone. If this daemon stops, it empties, the rule finds
-# nothing and falls through to main — pod traffic returns to VLAN 40,
-# unseparated rather than misrouted. That is why the default route lives here
-# and not in the Talos config: a default that outlived the specific routes
-# would send pod traffic to the UDM.
-
-# The node's attached networks, taken from the interfaces rather than written
-# down. The usual advice is not to export these to the kernel because it
-# maintains them itself — true of main, not of a table the kernel never fills.
-protocol direct attached {
-  interface "mgmt0", "ingress0", "pod0", "node0";
-  ipv4 { table master4; };
-  ipv6 { table master6; };
-}
-
-# Pod egress. GW4/GW6 are the UDM on the ingress segment, published as node
-# annotations beside the address that defines them.
-protocol static egress4 {
-  ipv4 { table master4; };
-  route 0.0.0.0/0 via GW4;
-}
-protocol static egress6 {
-  ipv6 { table master6; };
-  route ::/0 via GW6;
-}
-
-# This node's own pod CIDR, via the interface Cilium serves it on. Originated
-# rather than read back out of the kernel: reading it back made BIRD's view
-# depend on the shape of Cilium's route, and the IPv4 one is rejected outright,
-# its next hop sitting inside the prefix it describes.
-#
-# It belongs in the table, not just in the BGP announcement. A reply from a pod
-# on another node is forwarded traffic with a pod source, so the rule matches it
-# too; without this route it would find only the default and leave for the UDM.
-# Measured — cross-node pod traffic, and with it cluster DNS, stopped.
-protocol static own4 {
-  ipv4 { table master4; };
-  route OWN_POD4 via "cilium_host";
-}
-protocol static own6 {
-  ipv6 { table master6; };
-  route OWN_POD6 via "cilium_host";
-}
-
-protocol kernel k4 {
-  kernel table 47;
-  metric 0;
-  ipv4 { table master4; import none; export all; };
-}
-protocol kernel k6 {
-  kernel table 47;
-  metric 0;
-  ipv6 { table master6; import none; export all; };
-}
-
-# iBGP over pod0. 64514 keeps clear of Cilium's 64513, which peers with the UDM
-# from ingress0 and is unrelated.
-#
-# direct is explicit because iBGP defaults to multihop, which makes the gateway
-# recursive — BIRD would try to resolve the peer in the pod RIB. strict bind
-# keeps the listener off mgmt0 and ingress0.
-#
-# Only the node's own CIDR is offered: the export filter drops everything the
-# static protocols and the direct protocol produce.
-template bgp pod4 {
-  local as 64514;
-  source address MY4;
-  direct;
-  strict bind;
-  ipv4 {
-    next hop self;
-    import all;
-    export filter { if net = OWN_POD4 then accept; reject; };
-  };
-}
-template bgp pod6 {
-  local as 64514;
-  source address MY6;
-  direct;
-  strict bind;
-  ipv6 {
-    next hop self;
-    import all;
-    export filter { if net = OWN_POD6 then accept; reject; };
-  };
-}
-
-include "/etc/bird/peers.conf";

kubernetes/infrastructure/bird/daemonset.yaml

@@ -1,115 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: bird
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: bird
-rules:
-  # The peer list is read from the nodes' pod0 annotations, so no address is
-  # written into this repo twice.
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: bird
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: bird
-subjects:
-  - kind: ServiceAccount
-    name: bird
-    namespace: kube-system
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: bird
-  namespace: kube-system
-  labels:
-    tier: node
-    app: bird
-spec:
-  selector:
-    matchLabels:
-      app: bird
-  updateStrategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        tier: node
-        app: bird
-    spec:
-      # Owns table 47, where all pod traffic is routed. Without it the table
-      # stays empty and the rules fall through to main, unseparated.
-      priorityClassName: system-node-critical
-      # Writes host routes and peers on host addresses.
-      hostNetwork: true
-      serviceAccountName: bird
-      # Every node here is a control plane node, so this is not optional.
-      tolerations:
-        - operator: Exists
-          effect: NoSchedule
-      initContainers:
-        - name: render-config
-          # By digest, not by the dated tag: the tag is rebuilt within the day
-          # it names, and the cluster's image path keeps resolving it to the
-          # first build of that day — imagePullPolicy: Always does not help,
-          # because the tag itself resolves stale. Update this when the image
-          # is rebuilt.
-          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -eu
-              cp /config/bird.conf /etc/bird/bird.conf
-              kubectl get node "$NODE_NAME" \
-                -o go-template-file=/config/defines.tmpl > /etc/bird/defines.conf
-              kubectl get nodes --field-selector "metadata.name!=$NODE_NAME" \
-                -o go-template-file=/config/peers.tmpl > /etc/bird/peers.conf
-              # BIRD's own parser is the check: a node whose annotation is
-              # missing renders as <no value> and fails here rather than
-              # crashlooping the daemon or forming a mesh with a hole.
-              bird -p -c /etc/bird/bird.conf
-          env:
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: etc-bird
-              mountPath: /etc/bird
-      containers:
-        - name: bird
-          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
-          resources:
-            requests:
-              cpu: "50m"
-              memory: "32Mi"
-            limits:
-              cpu: "200m"
-              memory: "128Mi"
-          securityContext:
-            capabilities:
-              drop: ["ALL"]
-              # NET_ADMIN writes the routes; NET_BIND_SERVICE binds 179.
-              add: ["NET_ADMIN", "NET_BIND_SERVICE"]
-          volumeMounts:
-            - name: etc-bird
-              mountPath: /etc/bird
-      volumes:
-        - name: config
-          configMap:
-            name: bird-config
-        - name: etc-bird
-          emptyDir: {}

kubernetes/infrastructure/bird/defines.tmpl

@@ -1,9 +0,0 @@
-define MY6 = {{ index .metadata.annotations "net.renner.uno/pod0-v6" }};
-define MY4 = {{ index .metadata.annotations "net.renner.uno/pod0-v4" }};
-define GW6 = {{ index .metadata.annotations "net.renner.uno/egress-gw-v6" }};
-define GW4 = {{ index .metadata.annotations "net.renner.uno/egress-gw-v4" }};
-{{/* podCIDRs follows the cluster's podSubnets order, v4 first. A flip puts an
-     IPv6 prefix into an ipv4 protocol, which fails the parse in the init
-     container rather than passing silently. */}}
-define OWN_POD4 = {{ index .spec.podCIDRs 0 }};
-define OWN_POD6 = {{ index .spec.podCIDRs 1 }};

kubernetes/infrastructure/bird/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - daemonset.yaml
-configMapGenerator:
-  # Hashed name, so editing any of these rolls the DaemonSet.
-  - name: bird-config
-    namespace: kube-system
-    files:
-      - bird.conf
-      - defines.tmpl
-      - peers.tmpl

kubernetes/infrastructure/bird/peers.tmpl

@@ -1,7 +0,0 @@
-{{- range $i, $n := .items -}}
-{{- $v6 := index $n.metadata.annotations "net.renner.uno/pod0-v6" -}}
-{{- $v4 := index $n.metadata.annotations "net.renner.uno/pod0-v4" -}}
-# {{ $n.metadata.name }}
-protocol bgp peer{{ $i }}_v6 from pod6 { neighbor {{ $v6 }} as 64514; }
-protocol bgp peer{{ $i }}_v4 from pod4 { neighbor {{ $v4 }} as 64514; }
-{{ end -}}

kubernetes/infrastructure/cilium/helmrelease.yaml

@@ -118,21 +118,14 @@ spec:
       # traffic out to the VIP and back (which fails with L2 announcements).
       lbExternalClusterIP: true
     cni:
-      # Multus is the only writer of /etc/cni/net.d (#832): Cilium's conflist
-      # goes to /etc/cni/net.d/multus/, which the container runtime does not
-      # read, and Multus delegates to it via clusterNetwork. Without this a
-      # pod created after a reboot, before Multus rewrote 00-multus.conf, came
-      # up with Cilium alone. See kubernetes/infrastructure/multus.
-      confPath: /etc/cni/net.d/multus
-      # The default `exclusive: true` renames other configs in the conf dir to
-      # *.cilium_bak on every reconcile, which kept nuking multus.
+      # Multus (kubernetes/infrastructure/multus) runs alongside Cilium and
+      # writes 00-multus.conf to /etc/cni/net.d so kubelet picks multus
+      # first; multus then delegates to Cilium's 05-cilium.conflist via
+      # clusterNetwork. The default `exclusive: true` makes cilium-cni's
+      # install step rename anything alphabetically before its own config
+      # to *.cilium_bak on every reconcile, which kept nuking multus.
+      # Setting it false lets multus's config coexist.
       exclusive: false
-    # One agent at a time: the chart default of 2 restarts two of three
-    # nodes' datapath at once.
-    updateStrategy:
-      type: RollingUpdate
-      rollingUpdate:
-        maxUnavailable: 1
     # Talos-specific settings
     securityContext:
       capabilities:

kubernetes/infrastructure/k8s-gateway/helmrelease.yaml

@@ -1,16 +1,11 @@
 apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
+kind: HelmRepository
 metadata:
   name: k8s-gateway
   namespace: kube-system
 spec:
   interval: 24h
-  url: oci://codeberg.org/k8s-gateway/charts/k8s-gateway
-  ref:
-    semver: ">=2.4.0"
-  layerSelector:
-    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
-    operation: copy
+  url: https://k8s-gateway.github.io/k8s_gateway/
 ---
 # In-cluster authoritative resolver for renner.uno.
 #
@@ -33,10 +28,14 @@ metadata:
   namespace: kube-system
 spec:
   interval: 30m
-  chartRef:
-    kind: OCIRepository
-    name: k8s-gateway
-    namespace: kube-system
+  chart:
+    spec:
+      chart: k8s-gateway
+      version: ">=2.4.0"
+      sourceRef:
+        kind: HelmRepository
+        name: k8s-gateway
+        namespace: kube-system
   install:
     remediation:
       retries: 3

kubernetes/infrastructure/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - cluster-settings/
   - cilium/
   - multus/
-  - bird/
   - cert-manager/
   - snapshot-controller/
   - metrics-server/
@@ -19,7 +18,7 @@ resources:
   - cloudnative-pg/
   - mariadb-operator/
   - netbird-ingress/
-  - netbird-service-sync/
+  - netbird-proxy-services/
   - coredns-config/
   - k8s-gateway/
   - external-dns-unifi/

kubernetes/infrastructure/multus/multus-daemonset.yaml

@@ -111,18 +111,10 @@ metadata:
   name: multus
   namespace: kube-system
 ---
-# Multus is the only writer of /etc/cni/net.d (#832). Cilium writes its conflist
-# to /etc/cni/net.d/multus/, a subdirectory the container runtime does not read
-# (libcni skips directories); Multus picks it up there via multusAutoconfigDir
-# and writes 00-multus.conf. Until that file exists the runtime has no network
-# config at all, so no pod can be created with Cilium alone after a reboot.
-#
-# The "-subdir" names date from the node-by-node rollout; renaming would roll
-# Multus again for nothing.
 kind: ConfigMap
 apiVersion: v1
 metadata:
-  name: multus-daemon-config-subdir
+  name: multus-daemon-config
   namespace: kube-system
   labels:
     tier: node
@@ -135,7 +127,7 @@ data:
         "logLevel": "verbose",
         "logToStderr": true,
         "cniConfigDir": "/host/etc/cni/net.d",
-        "multusAutoconfigDir": "/host/etc/cni/net.d/multus",
+        "multusAutoconfigDir": "/host/etc/cni/net.d",
         "multusConfigFile": "auto",
         "socketDir": "/host/run/multus/"
     }
@@ -143,16 +135,16 @@ data:
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: kube-multus-ds-subdir
+  name: kube-multus-ds
   namespace: kube-system
   labels:
     tier: node
     app: multus
-    name: multus-subdir
+    name: multus
 spec:
   selector:
     matchLabels:
-      name: multus-subdir
+      name: multus
   updateStrategy:
     type: RollingUpdate
   template:
@@ -160,7 +152,7 @@ spec:
       labels:
         tier: node
         app: multus
-        name: multus-subdir
+        name: multus
     spec:
       # Upstream ships this DaemonSet with no priority class, so it runs at 0
       # and can preempt nothing. Any event that makes the pod need a fresh
@@ -232,10 +224,6 @@ spec:
           volumeMounts:
             - name: cni
               mountPath: /host/etc/cni/net.d
-            # Exists before Multus starts, so it waits for Cilium's conflist
-            # instead of exiting on a missing directory.
-            - name: cni-cilium-conf
-              mountPath: /host/etc/cni/net.d/multus
             # multus-daemon expects that cnibin path must be identical between pod and container host.
             # e.g. if the cni bin is in '/opt/cni/bin' on the container host side, then it should be mount to '/opt/cni/bin' in multus-daemon,
             # not to any other directory, like '/opt/bin' or '/usr/bin'.
@@ -291,10 +279,6 @@ spec:
         - name: cni
           hostPath:
             path: /etc/cni/net.d
-        - name: cni-cilium-conf
-          hostPath:
-            path: /etc/cni/net.d/multus
-            type: DirectoryOrCreate
         - name: cnibin
           hostPath:
             path: /opt/cni/bin
@@ -303,7 +287,7 @@ spec:
             path: /
         - name: multus-daemon-config
           configMap:
-            name: multus-daemon-config-subdir
+            name: multus-daemon-config
             items:
               - key: daemon-config.json
                 path: daemon-config.json

kubernetes/infrastructure/multus/whereabouts-reconciler.yaml

@@ -39,11 +39,9 @@ spec:
         name: whereabouts-reconciler
     spec:
       serviceAccountName: whereabouts
-      # Every node here is a control plane node. Keyed: a keyless Exists would
-      # also tolerate node.kubernetes.io/unschedulable and ignore cordons.
+      # Every node here is a control plane node.
       tolerations:
-        - key: node-role.kubernetes.io/control-plane
-          operator: Exists
+        - operator: Exists
           effect: NoSchedule
       containers:
         - name: whereabouts-reconciler

kubernetes/infrastructure/namespaces/namespaces.yaml

@@ -179,22 +179,6 @@ kind: Namespace
 metadata:
   name: woodpecker
 ---
-# Gitea, moving out of the shared `apps` namespace (issue #878). Declared here
-# like `woodpecker` above, so it exists before infrastructure-crds applies its
-# CiliumNetworkPolicies. No pod-security labels: the cluster default applies.
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitea
----
-# netbird-service-sync, moving out of `openbao` (issue #876). Declared here like
-# `woodpecker` above, so it exists before infrastructure-crds applies its
-# CiliumNetworkPolicies. No pod-security labels: the cluster default applies.
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: netbird-service-sync
----
 # Local LLM inference (kubernetes/apps/llama-server). Declared here, like
 # `woodpecker` above, so the `infrastructure` KS creates it before
 # `infrastructure-crds` applies the namespace's CiliumNetworkPolicies.

kubernetes/infrastructure/netbird-proxy-services/deployment.yaml

@@ -1,28 +1,28 @@
 # Reconciles NetBird reverse-proxy services from Ingresses that carry
 # dns.renner.uno/public: one TLS-passthrough service per host on :443,
 # targeting Traefik's ClusterIP through a subnet resource over the service
-# CIDR (ci/images/netbird-service-sync/controller.py).
+# CIDR (ci/images/netbird-proxy-services/controller.py).
 #
-# Own namespace; its egress (DNS, apiserver, OpenBao, NetBird API) is in
-# network-policies/netbird-service-sync-ns.yaml. The NetBird PAT is read from
-# OpenBao on every pass through the netbird-service-sync role —
-# policies/netbird-service-sync.hcl, applied once by hand like the rotator
-# roles. Until that role exists the pod logs an auth error each minute and does
-# nothing.
+# openbao namespace, like the rotators: its default-deny already allows egress
+# to OpenBao, DNS, the apiserver and `world` (netbird.renner.uno), and the
+# NetBird PAT is read from OpenBao on every pass through the
+# netbird-proxy-services role — policies/netbird-proxy-services.hcl, applied
+# once by hand like the rotator roles. Until that role exists the pod logs an
+# auth error each minute and does nothing.
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: netbird-service-sync
-  namespace: netbird-service-sync
+  name: netbird-proxy-services
+  namespace: openbao
   labels:
-    app.kubernetes.io/name: netbird-service-sync
+    app.kubernetes.io/name: netbird-proxy-services
 ---
 # Read-only, cluster-wide: public Ingresses live in many namespaces, the
 # Traefik Service in ingress/.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: netbird-service-sync-read
+  name: netbird-proxy-services-read
 rules:
   - apiGroups: ["networking.k8s.io"]
     resources: ["ingresses"]
@@ -34,23 +34,23 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: netbird-service-sync-read
+  name: netbird-proxy-services-read
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: netbird-service-sync-read
+  name: netbird-proxy-services-read
 subjects:
   - kind: ServiceAccount
-    name: netbird-service-sync
-    namespace: netbird-service-sync
+    name: netbird-proxy-services
+    namespace: openbao
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: netbird-service-sync
-  namespace: netbird-service-sync
+  name: netbird-proxy-services
+  namespace: openbao
   labels:
-    app.kubernetes.io/name: netbird-service-sync
+    app.kubernetes.io/name: netbird-proxy-services
 spec:
   replicas: 1
   # One writer against the management API at a time.
@@ -58,13 +58,13 @@ spec:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: netbird-service-sync
+      app.kubernetes.io/name: netbird-proxy-services
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: netbird-service-sync
+        app.kubernetes.io/name: netbird-proxy-services
     spec:
-      serviceAccountName: netbird-service-sync
+      serviceAccountName: netbird-proxy-services
       securityContext:
         runAsNonRoot: true
         # Numeric, or the kubelet refuses the image's named user with
@@ -80,7 +80,7 @@ spec:
           # image directory (branch and master alike) and the registry keeps
           # only the newest manifest per tag, so the digest must come from
           # the MASTER build of the code change.
-          image: gitea.renner.uno/gitea_admin/netbird-service-sync:2026-09-23@sha256:64f6057c508640e1dbc50457dc26e9b2de058a111fd46ca096021d7444b5bbff
+          image: gitea.renner.uno/gitea_admin/netbird-proxy-services:2026-09-07@sha256:caffa308d802c6fcc6aea919ac94657c08b993651baa6b8d18de395bcc40523e
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -92,7 +92,7 @@ spec:
             - name: BAO_ADDR
               value: http://openbao.openbao.svc.cluster.local:8200
             - name: BAO_ROLE
-              value: netbird-service-sync
+              value: netbird-proxy-services
             # Must match cluster.network.serviceSubnets in talos/patches/cluster.yaml.
             - name: SERVICE_CIDR
               value: "10.96.0.0/12"

kubernetes/infrastructure/network-policies/ai-ns.yaml

@@ -126,59 +126,3 @@ spec:
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
             - { type: 143, family: IPv6 }
----
-# wiki-embed is the one ai pod Traefik may reach: it sits behind BasicAuth
-# (apps/llama-server/wiki-embed-ingress.yaml), not behind the Authentik gate.
-# Scoped to this pod so the default-deny above keeps Traefik off llama-server.
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: wiki-embed-from-traefik
-  namespace: ai
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: wiki-embed
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ingress
-            app.kubernetes.io/name: traefik
-      toPorts:
-        - ports:
-            - port: "8080"
-              protocol: TCP
----
-# wiki-index: Traefik (LAN clients behind BasicAuth) and Gitea (push webhook)
-# may reach it; it reaches OpenBao for its credentials. Gitea itself is reached
-# through Traefik, which the namespace egress above already allows.
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: wiki-index
-  namespace: ai
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: wiki-index
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ingress
-            app.kubernetes.io/name: traefik
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": gitea
-            app.kubernetes.io/name: gitea
-      toPorts:
-        - ports:
-            - port: "8080"
-              protocol: TCP
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": openbao
-            app.kubernetes.io/name: openbao
-      toPorts:
-        - ports:
-            - port: "8200"
-              protocol: TCP

kubernetes/infrastructure/network-policies/gitea-ns.yaml

@@ -1,104 +0,0 @@
----
-# Baseline policy for the `gitea` namespace (issue #878).
-#
-# endpointSelector: {} — every rule applies to every pod in the namespace.
-# Workload-scoped grants go in their own policy with their own selector.
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: default-deny
-  namespace: gitea
-spec:
-  endpointSelector: {}
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": gitea
-    # Prometheus scrape of /metrics.
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": monitoring
-    # Kubelet probes and hostNetwork siblings.
-    - fromEntities:
-        - host
-        - remote-node
-    # ICMP from any cluster pod; required once an L4 policy selects the pod.
-    # See woodpecker-ns.yaml for the rationale. INGRESS ONLY.
-    - fromEndpoints:
-        - matchExpressions:
-            - key: io.kubernetes.pod.namespace
-              operator: Exists
-      icmps:
-        - fields:
-            - { type: 0,   family: IPv4 }
-            - { type: 3,   family: IPv4 }
-            - { type: 8,   family: IPv4 }
-            - { type: 11,  family: IPv4 }
-            - { type: 12,  family: IPv4 }
-            - { type: 1,   family: IPv6 }
-            - { type: 2,   family: IPv6 }
-            - { type: 3,   family: IPv6 }
-            - { type: 4,   family: IPv6 }
-            - { type: 128, family: IPv6 }
-            - { type: 129, family: IPv6 }
-            - { type: 133, family: IPv6 }
-            - { type: 134, family: IPv6 }
-            - { type: 135, family: IPv6 }
-            - { type: 136, family: IPv6 }
-            - { type: 143, family: IPv6 }
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": gitea
-    # Webhooks to hosts served by Traefik (ci.renner.uno).
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ingress
-            app.kubernetes.io/name: traefik
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-            - port: "53"
-              protocol: TCP
-    # Push webhook of the notes repo to wiki-index.
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ai
-            app.kubernetes.io/name: wiki-index
-      toPorts:
-        - ports:
-            - port: "8080"
-              protocol: TCP
-    # Push mirror to GitHub and other external targets.
-    - toEntities:
-        - host
-        - remote-node
-        - world
----
-# Traefik serves git.renner.uno / gitea.renner.uno (:3000) and the gitea-ssh
-# entrypoint (:2222). Lives beside the baseline so both land in one reconcile.
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: gitea-allow-traefik
-  namespace: gitea
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: gitea
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ingress
-            app.kubernetes.io/name: traefik
-      toPorts:
-        - ports:
-            - port: "3000"
-              protocol: TCP
-            - port: "2222"
-              protocol: TCP

kubernetes/infrastructure/network-policies/kustomization.yaml

@@ -22,8 +22,6 @@ resources:
   - external-secrets-ns.yaml
   - woodpecker-ci-ns.yaml
   - woodpecker-ns.yaml
-  - gitea-ns.yaml
-  - netbird-service-sync-ns.yaml
   - trmnl-ns.yaml
   - wordpress-ns.yaml
   - ai-ns.yaml

kubernetes/infrastructure/network-policies/netbird-service-sync-ns.yaml

@@ -1,43 +0,0 @@
----
-# Baseline policy for the `netbird-service-sync` namespace (issue #876).
-# The controller serves nothing; it only calls out: the Kubernetes API
-# (Ingress/Service reads), OpenBao (NetBird PAT) and the NetBird management API.
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: default-deny
-  namespace: netbird-service-sync
-spec:
-  endpointSelector: {}
-  ingress:
-    - fromEntities:
-        - host
-        - remote-node
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-            - port: "53"
-              protocol: TCP
-    - toEntities:
-        - kube-apiserver
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": openbao
-            app.kubernetes.io/name: openbao
-      toPorts:
-        - ports:
-            - port: "8200"
-              protocol: TCP
-    # NetBird management API (netbird.renner.uno).
-    - toEntities:
-        - world
-      toPorts:
-        - ports:
-            - port: "443"
-              protocol: TCP

kubernetes/infrastructure/network-policies/openbao-ns.yaml

@@ -31,26 +31,6 @@ spec:
         - ports:
             - port: "8200"
               protocol: TCP
-    # wiki-index (ns ai) logs in via auth/kubernetes/role/wiki-index and reads
-    # its Gitea token and webhook secret on every sync.
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ai
-            app.kubernetes.io/name: wiki-index
-      toPorts:
-        - ports:
-            - port: "8200"
-              protocol: TCP
-    # netbird-service-sync logs in via auth/kubernetes/role/netbird-service-sync
-    # and reads the NetBird PAT on every pass.
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": netbird-service-sync
-            app.kubernetes.io/name: netbird-service-sync
-      toPorts:
-        - ports:
-            - port: "8200"
-              protocol: TCP
     # (Secret-rotation CronJobs run in THIS namespace since 2026-07-18, so their
     # OpenBao access is covered by the intra-namespace ingress rule above — no
     # per-app rule needed.)
@@ -137,7 +117,7 @@ spec:
 # Egress complement to gitea-allow-flux-rotator (apps/gitea/networkpolicy.yaml).
 # The flux-git rotator mints a PAT against the in-cluster gitea Service; the
 # openbao default-deny only permits TCP egress to openbao/kube-dns/apiserver/
-# world, and gitea (gitea ns) is in-cluster, so it needs an explicit allow.
+# world, and gitea (apps ns) is in-cluster, so it needs an explicit allow.
 # Scoped to the flux-git rotator label and gitea :3000.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
@@ -152,7 +132,7 @@ spec:
   egress:
     - toEndpoints:
         - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": gitea
+            "k8s:io.kubernetes.pod.namespace": apps
             app.kubernetes.io/name: gitea
       toPorts:
         - ports:
@@ -160,10 +140,10 @@ spec:
               protocol: TCP
 ---
 # Egress for the review-bot rotator. Its CronJob has two steps: the init step
-# mints review-bot's PAT against gitea (gitea :3000), the main step upserts the
+# mints review-bot's PAT against gitea (apps :3000), the main step upserts the
 # Woodpecker org secret against the woodpecker server (woodpecker :8000). Both run
 # under the same pod labels, so one egress policy covers both hops. Complements
-# gitea-allow-review-bot-rotator (gitea) + woodpecker-allow-rotators (woodpecker).
+# gitea-allow-review-bot-rotator (apps) + woodpecker-allow-rotators (woodpecker).
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -177,7 +157,7 @@ spec:
   egress:
     - toEndpoints:
         - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": gitea
+            "k8s:io.kubernetes.pod.namespace": apps
             app.kubernetes.io/name: gitea
       toPorts:
         - ports:

kubernetes/infrastructure/openbao/policies/netbird-proxy-services.hcl

@@ -0,0 +1,23 @@
+# OpenBao policy: netbird-proxy-services
+#
+# The reverse-proxy-services controller (Deployment netbird-proxy-services in
+# the openbao namespace) reads the NetBird PAT on every reconcile pass and
+# calls the management API with it. Read-only on that one path; it shares the
+# bootstrap credential with rotator-netbird but not that role's PATCH rights.
+#
+# NOT applied by Flux. Apply ONCE with an admin token:
+#
+#   bao policy write netbird-proxy-services kubernetes/infrastructure/openbao/policies/netbird-proxy-services.hcl
+#   bao write auth/kubernetes/role/netbird-proxy-services \
+#     bound_service_account_names=netbird-proxy-services \
+#     bound_service_account_namespaces=openbao \
+#     policies=netbird-proxy-services ttl=15m
+#
+# The PAT itself is the one rotator-netbird already uses
+# (homelab/infrastructure/secret-rotators-bootstrap/netbird, key `pat`).
+#
+# Do NOT set token_no_default_policy=true (kv-v2 preflight needs the default policy).
+
+path "homelab/data/infrastructure/secret-rotators-bootstrap/netbird" {
+  capabilities = ["read"]
+}

kubernetes/infrastructure/openbao/policies/netbird-service-sync.hcl

@@ -1,24 +0,0 @@
-# OpenBao policy: netbird-service-sync
-#
-# The controller that syncs public Ingresses into NetBird reverse-proxy services
-# (Deployment netbird-service-sync in the netbird-service-sync namespace) reads
-# the NetBird PAT on every reconcile pass and calls the management API with it.
-# Read-only on that one path; it shares the bootstrap credential with
-# rotator-netbird but not that role's PATCH rights.
-#
-# NOT applied by Flux. Apply ONCE with an admin token:
-#
-#   bao policy write netbird-service-sync kubernetes/infrastructure/openbao/policies/netbird-service-sync.hcl
-#   bao write auth/kubernetes/role/netbird-service-sync \
-#     bound_service_account_names=netbird-service-sync \
-#     bound_service_account_namespaces=netbird-service-sync \
-#     policies=netbird-service-sync ttl=15m
-#
-# The PAT itself is the one rotator-netbird already uses
-# (homelab/infrastructure/secret-rotators-bootstrap/netbird, key `pat`).
-#
-# Do NOT set token_no_default_policy=true (kv-v2 preflight needs the default policy).
-
-path "homelab/data/infrastructure/secret-rotators-bootstrap/netbird" {
-  capabilities = ["read"]
-}

kubernetes/infrastructure/openbao/policies/wiki-index.hcl

@@ -1,21 +0,0 @@
-# OpenBao policy: wiki-index
-#
-# The wiki-index Deployment (namespace ai) reads its Gitea token and the
-# webhook HMAC secret on every use. Read-only on that one path.
-#
-# NOT applied by Flux. Apply ONCE with an admin token:
-#
-#   bao policy write wiki-index kubernetes/infrastructure/openbao/policies/wiki-index.hcl
-#   bao write auth/kubernetes/role/wiki-index \
-#     bound_service_account_names=wiki-index \
-#     bound_service_account_namespaces=ai \
-#     policies=wiki-index ttl=15m
-#
-# Secret: homelab/apps/ai/wiki-index, keys `gitea_token` (read:repository on
-# the notes repo) and `webhook_secret` (the Gitea webhook's secret).
-#
-# Do NOT set token_no_default_policy=true (kv-v2 preflight needs the default policy).
-
-path "homelab/data/apps/ai/wiki-index" {
-  capabilities = ["read"]
-}

kubernetes/infrastructure/openbao/rotation/flux-git.yaml

@@ -6,7 +6,7 @@
 # newest. A token that fails verification is deleted and the run aborts without
 # storing, so Flux is never stranded.
 #
-# gitea is reached at the in-cluster Service gitea.gitea.svc:3000 — the public
+# gitea is reached at the in-cluster Service gitea.apps.svc:3000 — the public
 # name hairpins off the ingress LB from a pod. Needs BOTH netpol halves
 # (gitea-allow-flux-rotator + rotator-gitea-flux-egress).
 #
@@ -76,7 +76,7 @@ spec:
                 - name: BAO_PATH
                   value: homelab/infrastructure/flux-git
                 - name: GITEA_URL
-                  value: http://gitea.gitea.svc.cluster.local:3000
+                  value: http://gitea.apps.svc.cluster.local:3000
                 - name: GITEA_VERIFY_REPO
                   value: k.renner/homelab
                 - name: GITEA_SCOPES

kubernetes/infrastructure/openbao/rotation/review-bot.yaml

@@ -24,7 +24,7 @@
 # synced. Quarterly cadence + backoffLimit:1 makes a two-cycle failure unlikely,
 # but a failed sync should be fixed before the next run rather than left.
 #
-# gitea is reached in-cluster at gitea.gitea.svc:3000, woodpecker at
+# gitea is reached in-cluster at gitea.apps.svc:3000, woodpecker at
 # woodpecker.woodpecker.svc:8000 (it moved out of `apps` in the namespace
 # migration — see kubernetes/apps/woodpecker/MIGRATION-namespace.md). Needs
 # the netpol halves: gitea-allow-review-bot-rotator + woodpecker-allow-rotators
@@ -99,7 +99,7 @@ spec:
                 - name: BAO_PATH
                   value: homelab/infrastructure/review-bot
                 - name: GITEA_URL
-                  value: http://gitea.gitea.svc.cluster.local:3000
+                  value: http://gitea.apps.svc.cluster.local:3000
                 # Private repo review-bot collaborates on: the pull check is a
                 # real access verification (git-upload-pack on a PRIVATE repo
                 # needs a token with access), not the "any valid token" weakness

kubernetes/infrastructure/post-crds/openbao-clustersecretstore.yaml

@@ -14,7 +14,6 @@ spec:
   # ClusterSecretStore" and the secret never syncs. Keep this list sorted.
   conditions:
     - namespaces:
-        - ai # wiki-embed-basic-auth (apps/llama-server/wiki-embed-ingress.yaml)
         - apps
         - audiobookshelf
         - authentik

kubernetes/infrastructure/post-crds/velero-schedules.yaml

@@ -225,8 +225,15 @@ metadata:
   labels:
     app.kubernetes.io/part-of: homelab-backup
 spec:
-  # Daily at 07:15 local. Every PVC in the shared `apps` namespace (gatus-data).
-  # No CNPG cluster runs here, so no labelSelector exclusion is needed.
+  # Daily at 07:15 local (next free stagger slot after home-assistant-daily
+  # at 06:45). Covers every stateful workload in the shared `apps`
+  # namespace — currently Gitea (data-gitea-0, the Flux GitOps source of
+  # truth) and Woodpecker (data-woodpecker-server-0), plus gatus-data.
+  # Added 2026-07-14 (issue #186): the apps namespace had no Velero
+  # schedule at all, so the in-cluster Gitea/Woodpecker PVCs migrated from
+  # the legacy LXCs (see MIGRATION-gitea-woodpecker.md) were unprotected.
+  # No CNPG cluster runs in this namespace (both Gitea and Woodpecker use
+  # SQLite), so no labelSelector exclusion is needed.
   schedule: "15 7 * * *"
   useOwnerReferencesInBackup: false
   template:
@@ -240,26 +247,6 @@ spec:
 ---
 apiVersion: velero.io/v1
 kind: Schedule
-metadata:
-  name: gitea-daily
-  namespace: velero
-  labels:
-    app.kubernetes.io/part-of: homelab-backup
-spec:
-  # Daily at 07:45 local. data-gitea-0 (SQLite, repos, LFS, packages).
-  schedule: "45 7 * * *"
-  useOwnerReferencesInBackup: false
-  template:
-    includedNamespaces:
-      - gitea
-    includedResources:
-      - persistentvolumeclaims
-    storageLocation: default
-    ttl: 720h0m0s
-    snapshotMoveData: true
----
-apiVersion: velero.io/v1
-kind: Schedule
 metadata:
   name: trmnl-daily
   namespace: velero

kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml

@@ -126,16 +126,6 @@ spec:
     addressRanges:
       cluster:
         - 10.99.0.0/29
-  # Reads go to the OSD in the client's own CRUSH location. crushLocationLabels
-  # is unset, so Rook's default list applies; of those the nodes carry
-  # topology.kubernetes.io/zone, one zone per node, matching the zone buckets
-  # the OSDs are created under.
-  #
-  # Passed as a krbd/mount option at map time, so a volume keeps its current
-  # behaviour until it is remounted.
-  csi:
-    readAffinity:
-      enabled: true
   # Nodes listed explicitly, not useAllNodes: under useAllNodes the operator
   # re-provisions an OSD on any node whose device still carries a BlueStore
   # signature, so purging an OSD before pulling its drive is impossible — it

kubernetes/infrastructure/traefik/helmrelease.yaml

@@ -96,7 +96,7 @@ spec:
         # that traffic is always a pod IP — collapsing all external clients
         # to one source. The NetBird reverse-proxy services are TLS
         # passthrough and carry the WAN client address in a PROXY protocol
-        # v2 header (options.proxy_protocol, set by netbird-service-sync);
+        # v2 header (options.proxy_protocol, set by netbird-proxy-services);
         # X-Forwarded-For stays trusted for HTTP-mode services. Both are
         # accepted from the pod CIDRs only; connections without a header
         # (direct LAN/mesh) keep their RemoteAddr.

kubernetes/talos/patches/cluster.yaml

@@ -58,12 +58,6 @@ machine:
       imageGCHighThresholdPercent: 70
       imageGCLowThresholdPercent: 60
 cluster:
-  # etcd peers on node0, VLAN 46 (#576). Pinned: Talos never updates an
-  # existing member's peer URLs, so changing this subnet means leave + rejoin
-  # per member (talosctl etcd leave, reboot).
-  etcd:
-    advertisedSubnets:
-      - 10.2.46.0/24
   # controlPlane.endpoint is NOT here: `talosctl gen config` takes it as its
   # second argument, and bootstrap.sh already passes https://k8s.renner.uno:6443
   # there. Setting it again in this patch restated the same value in a second

kubernetes/talos/patches/k8s-1.yaml

@@ -17,8 +17,6 @@ machine:
     # pod0 is a closed L2 fabric between the three nodes: statically
     # addressed, no gateway, nothing to learn from an RA.
     net.ipv6.conf.pod0.accept_ra: "0"
-    # node0 is closed the same way.
-    net.ipv6.conf.node0.accept_ra: "0"
     # ingress0 keeps RAs, at the default accept_ra of 2: an IPv6 default
     # router is a link-local address learned only from the RA, and with
     # net.ipv6.conf.all.forwarding=1 — which Cilium sets — Linux ignores RAs
@@ -54,12 +52,6 @@ machine:
     # this label instead of listing hostnames, so which boxes carry storage is
     # stated once, here, by the machine that knows.
     storage.renner.uno/ceph-osd: "true"
-  # Publishes this node's pod0 addresses, declared below in its VLANConfig, so
-  # the bird DaemonSet reads its peers from the node list rather than from a
-  # copy. Annotations, not labels: a label value cannot contain a colon.
-  nodeAnnotations:
-    net.renner.uno/pod0-v6: fd02:48::11
-    net.renner.uno/pod0-v4: 10.2.48.11
   udev:
     # Renames every port this node uses to its role at boot, matched by
     # burned-in MAC — kernel names derive from PCI topology and shift when
@@ -124,8 +116,8 @@ kind: LinkConfig
 name: uplink
 up: true
 ---
-# Management, VLAN 40: world↔node. The API VIP, admin access to the nodes, and
-# node egress (DNS, NTP, image pulls). Node↔node traffic is on node0 (#576).
+# Management, VLAN 40. Carries the node IP, etcd, the API and Ceph's public
+# network.
 apiVersion: v1alpha1
 kind: VLANConfig
 name: mgmt0
@@ -179,19 +171,6 @@ addresses:
   - address: 10.2.48.11/24
   - address: fd02:48::11/64
 ---
-# Node network, VLAN 46: traffic among the three nodes themselves (#576) — the
-# node IP, etcd, apiserver↔kubelet. Closed like pod0: statically addressed, no
-# gateway, never routed via the UDM.
-apiVersion: v1alpha1
-kind: VLANConfig
-name: node0
-vlanID: 46
-parent: uplink
-up: true
-addresses:
-  - address: fd02:46::11/64
-  - address: 10.2.46.11/24
----
 # Ingress network, VLAN 47. World-to-pod: the BGP session, the next hop for
 # every advertised LoadBalancer VIP, and the masquerade source for pod egress.
 # Publicly routed, which is what separates it from pod0.
@@ -203,13 +182,14 @@ addresses:
 # network's clients selectively, so the client goes rather than the record.
 # DHCP is off on VLAN 47 for the same reason.
 #
-# No route here. Table 47 belongs to bird, which fills it with this node's
-# attached networks, the peers' pod CIDRs and the egress default, and empties it
-# if it stops — leaving the rule to fall through to main. A default declared
-# here would outlive the specific routes and send pod traffic to the UDM.
+# Both defaults live in table 47, not in main, so only the pod-source rules in
+# site-homelab.yaml reach them. mgmt0 keeps main's default and with it every
+# reply the node sends from its own addresses.
 #
-# accept_ra_defrtr stays 0 on this link so the RA default does not land in main,
-# where mgmt0 owns it.
+# The v6 gateway is the UDM's configured ULA on this segment, the same address
+# BGP peers with. The RA-learned link-local would be the alternative and is not
+# a value to write down. accept_ra_defrtr stays 0 for that reason: the RA
+# default would land in main, where it does not belong.
 apiVersion: v1alpha1
 kind: VLANConfig
 name: ingress0
@@ -218,6 +198,11 @@ parent: uplink
 up: true
 addresses:
   - address: 10.2.47.11/24
+routes:
+  - gateway: fd02:47::1
+    table: "47"
+  - gateway: 10.2.47.1
+    table: "47"
 ---
 # Dedicated Ceph cluster network on X710 port 1, VLAN 49, untagged on the
 # wire. OSD-to-OSD replication and nothing else. The udev rule in the machine

kubernetes/talos/patches/k8s-2.yaml

@@ -16,7 +16,6 @@ machine:
     # ingress0 keeps RAs: it learns its IPv6 router and its address from them,
     # and only the default route is held back — see k8s-1.yaml.
     net.ipv6.conf.pod0.accept_ra: "0"
-    net.ipv6.conf.node0.accept_ra: "0"
     net.ipv6.conf.ingress0.accept_ra_defrtr: "0"
     # Answer ARP only on the link that owns the address — see k8s-1.yaml (#793).
     net.ipv4.conf.all.arp_ignore: "1"
@@ -34,10 +33,6 @@ machine:
     topology.kubernetes.io/zone: saturn
     # Holds a Ceph OSD drive — see k8s-1.yaml.
     storage.renner.uno/ceph-osd: "true"
-  # pod0 addresses for the bird peer list — see k8s-1.yaml.
-  nodeAnnotations:
-    net.renner.uno/pod0-v6: fd02:48::12
-    net.renner.uno/pod0-v4: 10.2.48.12
   udev:
     # Renames every port to its role at boot — see k8s-1.yaml.
     rules:
@@ -83,7 +78,7 @@ kind: LinkConfig
 name: uplink
 up: true
 ---
-# Management, VLAN 40: world↔node — see k8s-1.yaml.
+# Management, VLAN 40. Node IP, etcd, the API and Ceph's public network.
 apiVersion: v1alpha1
 kind: VLANConfig
 name: mgmt0
@@ -123,17 +118,6 @@ addresses:
   - address: 10.2.48.12/24
   - address: fd02:48::12/64
 ---
-# Node network, VLAN 46 — see k8s-1.yaml.
-apiVersion: v1alpha1
-kind: VLANConfig
-name: node0
-vlanID: 46
-parent: uplink
-up: true
-addresses:
-  - address: fd02:46::12/64
-  - address: 10.2.46.12/24
----
 # Ingress network, VLAN 47. World-to-pod, publicly routed, statically
 # addressed — see k8s-1.yaml for why it is not leased.
 apiVersion: v1alpha1
@@ -144,6 +128,11 @@ parent: uplink
 up: true
 addresses:
   - address: 10.2.47.12/24
+routes:
+  - gateway: fd02:47::1
+    table: "47"
+  - gateway: 10.2.47.1
+    table: "47"
 ---
 # Dedicated Ceph cluster network on X710 port 1, VLAN 49, untagged on the
 # wire. OSD-to-OSD replication only, not routed off its own segment.

kubernetes/talos/patches/k8s-3.yaml

@@ -12,7 +12,6 @@ machine:
     # ingress0 keeps RAs: it learns its IPv6 router and its address from them,
     # and only the default route is held back — see k8s-1.yaml.
     net.ipv6.conf.pod0.accept_ra: "0"
-    net.ipv6.conf.node0.accept_ra: "0"
     net.ipv6.conf.ingress0.accept_ra_defrtr: "0"
     # Answer ARP only on the link that owns the address — see k8s-1.yaml (#793).
     net.ipv4.conf.all.arp_ignore: "1"
@@ -30,10 +29,6 @@ machine:
     topology.kubernetes.io/zone: neptune
     # Holds a Ceph OSD drive — see k8s-1.yaml.
     storage.renner.uno/ceph-osd: "true"
-  # pod0 addresses for the bird peer list — see k8s-1.yaml.
-  nodeAnnotations:
-    net.renner.uno/pod0-v6: fd02:48::13
-    net.renner.uno/pod0-v4: 10.2.48.13
   udev:
     # Renames every port to its role at boot — see k8s-1.yaml.
     rules:
@@ -110,17 +105,6 @@ addresses:
   - address: 10.2.48.13/24
   - address: fd02:48::13/64
 ---
-# Node network, VLAN 46 — see k8s-1.yaml.
-apiVersion: v1alpha1
-kind: VLANConfig
-name: node0
-vlanID: 46
-parent: uplink
-up: true
-addresses:
-  - address: fd02:46::13/64
-  - address: 10.2.46.13/24
----
 # Ingress network, VLAN 47. World-to-pod, publicly routed, statically
 # addressed — see k8s-1.yaml for why it is not leased.
 apiVersion: v1alpha1
@@ -131,6 +115,11 @@ parent: uplink
 up: true
 addresses:
   - address: 10.2.47.13/24
+routes:
+  - gateway: fd02:47::1
+    table: "47"
+  - gateway: 10.2.47.1
+    table: "47"
 ---
 # Dedicated Ceph cluster network — see k8s-1.yaml. The node holds NO address
 # here on purpose; the link is handed whole to the OSD pod (host-device).

kubernetes/talos/patches/site-homelab.yaml

@@ -7,41 +7,54 @@
 # part of the config that could not be true anywhere but here.
 machine:
   kubelet:
-    # The node IP lives on node0, VLAN 46: the closed node↔node network (#576).
-    # Both families are listed so the Node object carries an IPv6 InternalIP at
-    # all; without one Cilium detects the node's IPv6 itself and picks a SLAAC
-    # address from the dynamic provider prefix (#789). Talos picks one address
-    # per family, IPv4 first, whatever the order here.
+    # Constrain kubelet's auto-picked node IP to the mgmt LAN. Without this,
+    # kubelet picks the first non-loopback IP, which could land on the v30iot
+    # NIC (ens19, 10.2.30.0/24). Control-plane traffic and hostNetwork pod IPs
+    # must stay on mgmt LAN.
+    # fd40::/64 is the mgmt LAN ULA, and it is listed so the Node object carries
+    # an IPv6 InternalIP at all. Without one, Cilium falls back to detecting the
+    # node's IPv6 from mgmt0 and picks the SLAAC address from the dynamic
+    # provider prefix, which it then probes until the agent restarts (#789).
+    # The GUA is not a control-plane address: BGP peers on fd40::/64 too.
     nodeIP:
       validSubnets:
-        - fd02:46::/64
-        - 10.2.46.0/24
-  # The UDM on the ingress segment. Published here rather than as a route
-  # because bird owns table 47 and originates the default from it; this is the
-  # one place the address is stated.
-  nodeAnnotations:
-    net.renner.uno/egress-gw-v6: fd02:47::1
-    net.renner.uno/egress-gw-v4: 10.2.47.1
+        - 10.2.40.0/24
+        - fd40::/64
 ---
-# All pod traffic goes to table 47, and the table decides — longest prefix
-# match, no exceptions to carve out. bird fills it with the node's attached
-# networks, the peers' pod CIDRs and the egress default, so a packet to a node
-# on the mgmt segment takes the connected route, a packet to a pod on another
-# node takes pod0, and anything else takes the default over ingress0.
+# Pod egress leaves over ingress0. Matching on the pod source prefix is what
+# keeps the node's own traffic out of it: the node IP, the API VIP and apid all
+# answer on mgmt0, and a reply that left over ingress0 would carry an mgmt0
+# source onto VLAN 47.
 #
-# Matching the source is what keeps the node's own traffic out: it answers on
-# mgmt0, and a reply leaving over ingress0 would carry an mgmt0 source onto
-# VLAN 47. The routing decision runs before Cilium's masquerade hook, so the
-# rule sees the pod address and the masquerade then rewrites it.
+# The routing decision runs before Cilium's masquerade hook, so the rule sees
+# the pod address and the masquerade then rewrites it to ingress0's.
 #
-# If bird stops, table 47 empties, the lookup misses and the rule falls through
-# to main — pod traffic returns to VLAN 40, unseparated rather than misrouted.
+# Table 47 holds nothing but the two default routes, so the destination rules
+# below have to run first: without them a pod's packet to a service or to a pod
+# on another node also matches the source rule, finds only the default, and
+# leaves for the UDM. Measured — in-cluster DNS stopped resolving.
+#
+# They send everything inside the cluster and the local networks back to main.
+# The prefixes are Cilium's ipv4/ipv6NativeRoutingCIDR, which already mark what
+# is not foreign traffic.
 #
 # Priorities are below main (32766) and clear of the rule Cilium installs at 9.
 # The two families are separate rule tables, so the priorities need not match;
 # the document name is the priority and must be unique.
 apiVersion: v1alpha1
 kind: RoutingRuleConfig
+name: "990"
+dst: fd00::/8
+table: main
+---
+apiVersion: v1alpha1
+kind: RoutingRuleConfig
+name: "991"
+dst: 10.0.0.0/8
+table: main
+---
+apiVersion: v1alpha1
+kind: RoutingRuleConfig
 name: "1000"
 src: fd10:244::/48
 table: "47"

scripts/ci/choose-model.sh

@@ -1,30 +0,0 @@
-#!/bin/sh
-# Turn the TypeSafe picker's probability distribution into one model id.
-#
-# The judgment (how well each catalog model fits the task) comes from the
-# model; the policy lives here, in code: among the candidates whose probability
-# is within MARGIN of the best one, take the most recently released. Several
-# same-family models (Sonnet 4.5 / 4.6 / 5) split the probability for a
-# mid-weight task, and the newest of a comparable set is the one to run.
-#
-# Usage: choose-model.sh <catalog-table-file> < <systemone-response.json>
-#   The table is fetch-models.sh --table output: id \t name \t released=YYYY-MM-DD ...
-#   Prints the chosen id, or nothing when the answer is NONE / unusable.
-# Env: CHOOSE_MODEL_MARGIN (default 0.7): candidate if p >= MARGIN * p_best.
-
-set -eu
-TABLE_FILE="${1:?usage: choose-model.sh <catalog-table-file> < response.json}"
-MARGIN="${CHOOSE_MODEL_MARGIN:-0.7}"
-
-jq -r --rawfile table "$TABLE_FILE" --argjson margin "$MARGIN" '
-  ($table | split("\n") | map(select(length > 0) | split("\t")
-     | {key: .[0], value: ((.[2:] | map(select(startswith("released="))) | .[0] // "released=") | ltrimstr("released="))})
-   | from_entries) as $released
-  | (.answers.model.probabilities // {}) | to_entries
-  | map(select(.key != "NONE")) | sort_by(-.value)
-  | if length == 0 then empty
-    else (.[0].value) as $best
-      | map(select(.value >= $margin * $best))
-      | sort_by([($released[.key] // ""), .value])
-      | .[-1].key
-    end' 2>&1

scripts/ci/pick-model.sh

@@ -33,42 +33,6 @@ none() { log "$1"; exit 0; }            # emit nothing -> caller uses CLI defaul
 TABLE="$(sh "$HERE/fetch-models.sh" --table || true)"
 [ -n "$TABLE" ] || none "no catalog available — caller will use the CLI default model"
 
-# First choice: one TypeSafe (System One) Choice over the catalog. The task and
-# the catalog rows are state, every model id is an option with its catalog row
-# as the criterion, and the answer is typed — no prompt, no JSON parsing, and a
-# request that takes a fraction of a second instead of a claude run. The id is
-# still validated against the pristine catalog. Falls through to the claude
-# picker when the key is absent or the request fails.
-if [ -n "${TYPESAFE_API_KEY:-}" ]; then
-  REQ="$(printf '%s\n' "$TABLE" | jq -R -s --arg task "$GUIDANCE" '
-    split("\n") | map(select(length > 0) | split("\t") | {id: .[0], name: .[1], info: (.[2:] | join(", "))})
-    | {model: "jev-latest",
-       state: {task: $task, models: .},
-       questions: {model: {
-         type: "choice",
-         instructions: "Which model in `models` should run `task`? Match the model to the task: not the largest or newest flagship for trivial or mechanical work, not a minimal model for hard, multi-step or security-sensitive work; prefer a newer model when otherwise comparable. Consider every listed model, including unfamiliar ones. Pick NONE only if no listed model fits.",
-         criteria: ((map({key: .id, value: "\(.name); \(.info)"}) | from_entries) + {NONE: "No listed model fits the task"})}}}')"
-  if [ -n "${PICK_MODEL_TYPESAFE_DRYRUN:-}" ]; then printf '%s\n' "$REQ"; exit 0; fi
-  RESP="$(printf '%s' "$REQ" | curl -sS --max-time 30 -X POST https://api.typesafe.ai/v1/systemone \
-           -H "Authorization: Bearer $TYPESAFE_API_KEY" -H 'Content-Type: application/json' --data-binary @- || true)"
-  # Policy in code (choose-model.sh): among candidates within a margin of the
-  # best probability, the most recently released wins. Same-family models split
-  # the probability for mid-weight tasks (live catalog: Sonnet 4.5 chosen at
-  # 0.23 over Sonnet 4.6).
-  TABLE_FILE="$(mktemp)"
-  printf '%s\n' "$TABLE" > "$TABLE_FILE"
-  CHOICE="$(printf '%s' "$RESP" | sh "$HERE/choose-model.sh" "$TABLE_FILE" | head -1)"
-  rm -f "$TABLE_FILE"
-  TOP="$(printf '%s' "$RESP" | jq -r '(.answers.model.probabilities // {}) | to_entries | sort_by(-.value) | .[0:4] | map("\(.key)=\(.value)") | join(" ")' 2>&1 | head -1)"
-  VALID="$(printf '%s\n' "$TABLE" | sh "$HERE/valid-model.sh" "$CHOICE")"
-  if [ -n "$VALID" ]; then
-    log "typesafe chose '$VALID' (top: ${TOP:-?}) for: $GUIDANCE"
-    printf '%s\n' "$VALID"
-    exit 0
-  fi
-  log "typesafe picker returned '${CHOICE:-<empty>}' (rejected, NONE, or request failed) — falling back to the claude picker"
-fi
-
 PROMPT="$(cat <<EOF
 You are a model-selection agent for an automated CI job. From the models
 currently available (listed below with their capabilities), choose the single