feat(wiki-index): roll out every build via Flux image automation

Replaces the per-commit tag pin with the house pattern: the build publishes build.<unix-ts>, an ImageRepository/ImagePolicy pair tracks it (numerical, newest wins), and the deployment carries the $imagepolicy marker so the shared ImageUpdateAutomation bumps it. No more hand-pinned digests, no same-day tag races. The reflector reads the package anonymously like the other Gitea-hosted images. The deployment keeps the verified 2026-09-20-4b529cd1 tag as its starting value; the first build.* tag after merge replaces it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-20 11:04:04 +02:00
62 changed files with 331 additions and 795 deletions
@@ -101,7 +101,7 @@ steps:
        bash scripts/ci/make-diag-kubeconfig.sh

  - name: alert-triage-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -350,17 +350,17 @@ steps:
          --destination gitea.renner.uno/gitea_admin/heating-can:$TAG \
          --destination gitea.renner.uno/gitea_admin/heating-can:latest

-  # netbird-service-sync: the controller that reconciles NetBird reverse-proxy
+  # netbird-proxy-services: the controller that reconciles NetBird reverse-proxy
  # services (public Ingress hosts -> TLS passthrough -> Traefik ClusterIP).
  # Runtime artifact like heating-can; same registry so the audit tracks it.
-  - name: build-netbird-service-sync
+  - name: build-netbird-proxy-services
    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
-    directory: ci/images/netbird-service-sync
+    directory: ci/images/netbird-proxy-services
    depends_on: []
    when:
      - event: deployment
      - event: push
-        path: ["ci/images/netbird-service-sync/**", ".woodpecker/build-ci-images.yml"]
+        path: ["ci/images/netbird-proxy-services/**", ".woodpecker/build-ci-images.yml"]
    environment:
      GITEA_USER: gitea_admin
      GITEA_TOKEN:
@@ -374,11 +374,11 @@ steps:
        /kaniko/executor \
          --context . \
          --dockerfile Containerfile \
-          --destination gitea.renner.uno/gitea_admin/netbird-service-sync:$TAG \
-          --destination gitea.renner.uno/gitea_admin/netbird-service-sync:latest
+          --destination gitea.renner.uno/gitea_admin/netbird-proxy-services:$TAG \
+          --destination gitea.renner.uno/gitea_admin/netbird-proxy-services:latest

  # wiki-index: embedding index over the Notes repo's wiki/, fed from Gitea and
-  # queried by ~/Notes/bin/wiki_rank.py. Runtime artifact like netbird-service-sync.
+  # queried by ~/Notes/bin/wiki_rank.py. Runtime artifact like netbird-proxy-services.
  - name: build-wiki-index
    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
    directory: ci/images/wiki-index
@@ -396,16 +396,17 @@ steps:
      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
      - TAG=$(date +%Y-%m-%d)
-      # Also a per-commit tag: several builds a day (branch pushes and the
-      # merge) all rewrite the dated tag, and the deployment pin raced them
-      # on 2026-09-20. The commit tag is immutable and needs no digest lookup.
-      - SHORT=$(printf '%s' "$CI_COMMIT_SHA" | cut -c1-8)
+      # `build.<unix-ts>` is the tag Flux image automation tracks
+      # (infrastructure/image-automation/wiki-index.yaml): unique per build, so
+      # every push rolls out without a hand-pinned digest. The dated tag is
+      # rewritten several times a day and is kept for humans only.
+      - BUILD=build.$(date +%s)
      - |
        /kaniko/executor \
          --context . \
          --dockerfile Containerfile \
          --destination gitea.renner.uno/gitea_admin/wiki-index:$TAG \
-          --destination gitea.renner.uno/gitea_admin/wiki-index:$TAG-$SHORT \
+          --destination gitea.renner.uno/gitea_admin/wiki-index:$BUILD \
          --destination gitea.renner.uno/gitea_admin/wiki-index:latest

  # bird: BGP daemon for the pod-network mesh over pod0 (#576). Runtime
@@ -14,8 +14,8 @@
 #                 and  ci-claude:latest.  The Containerfile makes this layer
 #                 byte-reproducible, so rebuilding an unchanged version dedups
 #                 in the registry instead of orphaning a fresh ~260 MB copy.
-#   3. bump-pr  — (only when any pin is off the latest version) rewrite every
-#                 consumer pin to  ci-claude:<version>  and open a PR. A human
+#   3. bump-pr  — (only when the version actually changed) rewrite the 5
+#                 consumer pins to  ci-claude:<version>  and open a PR. A human
 #                 reviews and merges it; nothing auto-merges.
 #
 # TAG SCHEME — deliberately version tags (ci-claude:<claude-version>), NOT the dated
@@ -107,22 +107,31 @@ steps:
          [0-9]*.[0-9]*.[0-9]*) : ;;
          *) echo "npm returned an implausible version '$$NEW' — aborting."; exit 1 ;;
        esac
-        # Distinct tags the consumers currently reference. Divergent pins are
-        # normal (a pipeline bumped on its own); the bump rewrites all of them.
-        CUR=$$(grep -hoE 'ci-claude:[0-9][0-9A-Za-z._-]*' $$CONSUMERS | sed 's/^ci-claude://' | sort -u | tr '\n' ' ' | sed 's/ $$//')
-        [ -n "$$CUR" ] || { echo "No ci-claude pin found in the consumers — aborting."; exit 1; }
-        echo "latest=$$NEW  current=[$$CUR]  event=$$CI_PIPELINE_EVENT"
+        # The tag every consumer currently references. They are kept identical,
+        # so this must resolve to EXACTLY ONE non-empty tag; anything else
+        # (no match, or a partial/disagreeing set) aborts rather than risk a
+        # corrupting sed later. Counting with `grep -c .` (non-empty lines)
+        # instead of `wc -l` is deliberate: an empty result yields 0 here but
+        # 1 under wc -l, which would slip past the guard.
+        CUR=$$(grep -hoE 'ci-claude:[0-9A-Za-z._-]+' $$CONSUMERS | sed 's/^ci-claude://' | sort -u)
+        NTAGS=$$(printf '%s' "$$CUR" | grep -c . || true)
+        if [ -z "$$CUR" ] || [ "$$NTAGS" -ne 1 ]; then
+          echo "Expected exactly one ci-claude tag across the consumers, got [$$CUR]."
+          echo "Refusing to guess — fix the pins by hand."; exit 1
+        fi
+        echo "latest=$$NEW  current=$$CUR  event=$$CI_PIPELINE_EVENT"
        printf '%s' "$$NEW" > "$$CI_WORKSPACE/.ci-refresh/version"
        printf '%s' "$$CUR" > "$$CI_WORKSPACE/.ci-refresh/current"
-        # Build when any pin is off latest, or on a push (Containerfile edit must
-        # ship even if the version is unchanged). Bump when any pin is off latest.
+        # Build when the version changed, or on a push (Containerfile edit must
+        # ship even if the version is unchanged). Bump the pins only when the
+        # version the consumers reference is not the latest.
        if [ "$$CUR" != "$$NEW" ] || [ "$$CI_PIPELINE_EVENT" = "push" ]; then
          touch "$$CI_WORKSPACE/.ci-refresh/do-build"; echo "will build $$NEW"
        else
          echo "already on $$NEW — nothing to build"
        fi
        if [ "$$CUR" != "$$NEW" ]; then
-          touch "$$CI_WORKSPACE/.ci-refresh/do-bump"; echo "will open bump PR [$$CUR] -> $$NEW"
+          touch "$$CI_WORKSPACE/.ci-refresh/do-bump"; echo "will open bump PR $$CUR -> $$NEW"
        else
          echo "consumers already pin $$NEW — no PR"
        fi
@@ -166,9 +175,6 @@ steps:
      - |
        [ -f "$$CI_WORKSPACE/.ci-refresh/do-bump" ] || { echo "no version change — no PR"; exit 0; }
        set -eu
-        # Secret values can carry a trailing newline; it breaks the push URL and the auth header.
-        PUSH_TOKEN=$$(printf '%s' "$$PUSH_TOKEN" | tr -d '\r\n')
-        [ -n "$$PUSH_TOKEN" ] || { echo "PUSH_TOKEN is empty — aborting"; exit 1; }
        NEW=$$(cat "$$CI_WORKSPACE/.ci-refresh/version")
        CUR=$$(cat "$$CI_WORKSPACE/.ci-refresh/current")
        # Both were validated non-empty by the decide step; re-assert before a
@@ -184,11 +190,9 @@ steps:
        # is not a maintained list.
        CONSUMERS=$$(grep -rlE 'ci-claude:[0-9]' .woodpecker)
        [ -n "$$CONSUMERS" ] || { echo "No ci-claude consumers found — refusing to continue."; exit 1; }
-        # NEW goes into a sed replacement: allow only a plain x.y.z version.
-        printf '%s' "$$NEW" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$$' || { echo "refusing non-x.y.z version '$$NEW'"; exit 1; }
-        # Every version-pinned tag becomes NEW, whatever it was; consumers only.
+        # Exact-string swap of the current tag for the new one, consumers only.
        for f in $$CONSUMERS; do
-          sed -i "s#ci-claude:[0-9][0-9A-Za-z._-]*#ci-claude:$$NEW#g" "$$f"
+          sed -i "s#ci-claude:$$CUR#ci-claude:$$NEW#g" "$$f"
        done
        # Author is claude-bot (the PAT's account); the commit subject makes
        # the automated-bump nature clear.
@@ -17,6 +17,6 @@ when:

 steps:
  - name: model-selection-tests
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
    commands:
      - sh scripts/ci/test-model-selection.sh
@@ -26,7 +26,7 @@ steps:
    # fetch-models.sh response mapping. No cluster, no secrets, no network — the
    # ci-claude image just provides sh + jq. Keeps the flag-injection regression
    # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
    commands:
      - sh scripts/ci/test-model-selection.sh

@@ -62,7 +62,7 @@ steps:
      - bash scripts/ci/make-diag-kubeconfig.sh

  - name: issue-fix-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -65,7 +65,7 @@ when:

 steps:
  - name: pr-review-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -70,7 +70,7 @@ steps:
    # this step is skipped — otherwise we'd fork-bomb PRs.
    when:
      - branch: master
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -30,7 +30,7 @@ when:

 steps:
  - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -1,119 +0,0 @@
-# Nightly wiki maintenance for the Notes vault (k.renner/notes), replacing the
-# workstation's wiki-maintenance.timer: distill the raw/ backlog into wiki/
-# (a `claude` run of the wiki-distill agent), then audit wiki/ with the vault's
-# own script (structural checks, no model). The pipeline commits and pushes as
-# Claude Bot; the push webhook then refreshes the wiki-index service.
-#
-# The agent and its retrieval scripts address the vault as ~/Notes, so the
-# distill step links $HOME/Notes to the checkout instead of rewriting them.
-when:
-  - event: cron
-    cron: wiki-maintenance
-  # Hand-started runs: `woodpecker pipeline create k.renner/homelab --branch master`.
-  # The typesafe_api_key secret is scoped to cron and manual, not deployment.
-  - event: manual
-
-steps:
-  - name: checkout-notes
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
-    pull: true
-    environment:
-      WIKI_BOT_TOKEN:
-        from_secret: wiki_bot_token
-    commands:
-      - |
-        set -eu
-        # Token only on the wire, never in .git/config. Secrets set from files carry
-        # a trailing newline (run 10220: "could not read Username"); strip CR/LF.
-        TOKEN=$$(printf '%s' "$$WIKI_BOT_TOKEN" | tr -d '\r\n')
-        git -c http.extraheader="AUTHORIZATION: token $$TOKEN" \
-          clone --depth 50 --branch main https://gitea.renner.uno/k.renner/notes.git notes
-        echo "raw backlog: $$(ls notes/raw/*.md | grep -v _index.md | wc -l) file(s)"
-
-  - name: distill
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
-    pull: true
-    environment:
-      CLAUDE_CODE_OAUTH_TOKEN:
-        from_secret: claude_code_oauth_token
-      TYPESAFE_API_KEY:
-        from_secret: typesafe_api_key
-      WIKI_INDEX_BASIC_AUTH:
-        from_secret: wiki_index_basic_auth
-    commands:
-      - |
-        set -eu
-        ln -sfn "$$PWD/notes" "$$HOME/Notes"
-        mkdir -p "$$HOME/.config/wiki-index"
-        printf '%s' "$$WIKI_INDEX_BASIC_AUTH" | tr -d '\r\n' > "$$HOME/.config/wiki-index/basic-auth"
-        chmod 600 "$$HOME/.config/wiki-index/basic-auth"
-        "$$HOME/Notes/bin/wiki_rank.py" --probe-index
-      - |
-        set -eu
-        MODEL=$$(sh scripts/ci/pick-model.sh "distill raw source notes into atomic wiki notes: read sources, check the wiki for existing coverage, write or merge notes; careful writing, moderate reasoning")
-        if [ -n "$$MODEL" ]; then echo "distill: selected model $$MODEL"; else echo "distill: using the CLI default model"; fi
-        cd notes
-        cat ../ci/agents/wiki-maintenance/distill.md | claude $${MODEL:+--model $$MODEL} \
-          --agent wiki-distill \
-          --permission-mode acceptEdits \
-          --allowedTools "Read,Edit,Write,Glob,Grep,Bash(/root/Notes/bin/wiki_rank.py:*),Bash(/root/Notes/bin/wiki_ask.py:*),Bash(mv /root/Notes/raw/:*),Bash(mkdir -p /root/Notes/:*)" \
-          --settings ../ci/agents/wiki-maintenance/settings.json \
-          -p
-
-  - name: audit
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
-    pull: true
-    commands:
-      # Findings are report lines in output/, not a pipeline failure.
-      - python3 -B notes/bin/wiki_audit.py --vault "$$PWD/notes"
-
-  - name: push-notes
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
-    pull: true
-    environment:
-      WIKI_BOT_TOKEN:
-        from_secret: wiki_bot_token
-    commands:
-      - |
-        set -eu
-        cd notes
-        git config user.email "claude-bot@renner.uno"
-        git config user.name "Claude Bot"
-        # Only the vault content is committed; anything an agent leaves elsewhere
-        # in the checkout (run 10362: scratch scripts in the root) stays behind.
-        if [ -z "$$(git status --porcelain -- wiki raw output)" ]; then
-          echo "wiki-maintenance: no changes"
-          exit 0
-        fi
-        # The workstation pushes main on its own (notes-push.path), so main moves
-        # while the agents run (run 10241: non-fast-forward). The run's work goes
-        # to a branch and a PR that this step merges through Gitea; a conflict
-        # leaves the PR open for a human and fails the run.
-        BRANCH="wiki-maintenance/$$(date -u +%F)-$$CI_PIPELINE_NUMBER"
-        git checkout -q -b "$$BRANCH"
-        git add -A -- wiki raw output
-        git commit -q -m "wiki maintenance $$(date -u +%F): distill + audit (CI run $$CI_PIPELINE_NUMBER)"
-        TOKEN=$$(printf '%s' "$$WIKI_BOT_TOKEN" | tr -d '\r\n')
-        git -c http.extraheader="AUTHORIZATION: token $$TOKEN" push origin "HEAD:$$BRANCH"
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/notes"
-        jq -n --arg title "wiki maintenance $$(date -u +%F) (CI run $$CI_PIPELINE_NUMBER)" \
-              --arg body "Nightly distill + audit. Merged by the pipeline; open only if the merge failed." \
-              --arg head "$$BRANCH" '{title: $$title, body: $$body, head: $$head, base: "main"}' > /tmp/pr.json
-        code=$$(curl -s -o /tmp/pr-resp.json -w '%{http_code}' -X POST \
-          -H "Authorization: token $$TOKEN" -H "Content-Type: application/json" --data @/tmp/pr.json "$$API/pulls")
-        echo "POST pull -> HTTP $$code"
-        [ "$$code" -ge 200 ] && [ "$$code" -lt 300 ] || { cat /tmp/pr-resp.json; exit 1; }
-        NUM=$$(jq -r '.number' /tmp/pr-resp.json)
-        # Merge without delete_branch_after_merge: run 10254 got HTTP 500 from that
-        # call although the merge itself had landed. Verify the PR state instead of
-        # trusting the status code, then drop the branch as a separate, best-effort step.
-        code=$$(curl -s -o /tmp/merge-resp.json -w '%{http_code}' -X POST \
-          -H "Authorization: token $$TOKEN" -H "Content-Type: application/json" \
-          --data '{"Do":"merge"}' "$$API/pulls/$$NUM/merge")
-        echo "POST merge #$$NUM -> HTTP $$code"
-        MERGED=$$(curl -s -H "Authorization: token $$TOKEN" "$$API/pulls/$$NUM" | jq -r '.merged')
-        echo "PR #$$NUM merged: $$MERGED"
-        [ "$$MERGED" = "true" ] || { cat /tmp/merge-resp.json; echo "PR #$$NUM left open"; exit 1; }
-        code=$$(curl -s -o /tmp/del-resp.json -w '%{http_code}' -X DELETE -H "Authorization: token $$TOKEN" \
-          "$$API/branches/$$(printf '%s' "$$BRANCH" | sed 's|/|%2F|g')")
-        echo "DELETE branch $$BRANCH -> HTTP $$code (best effort)"
@@ -1,7 +0,0 @@
-You are running as the scheduled wiki-maintenance job in CI. The Notes vault is checked out at ~/Notes (the repository k.renner/notes). Do exactly this, nothing else:
-
-Glob ~/Notes/raw/*.md (top level only, never ~/Notes/raw/_processed/). Distill every file you find into ~/Notes/wiki/ following your process, including the ranker check for every concept. Move each fully processed source to ~/Notes/raw/_processed/. If raw/ has no top-level files besides _index.md, say so and stop.
-
-Do not commit or push; the pipeline does that after you finish. Do not touch anything outside ~/Notes/wiki/ and ~/Notes/raw/.
-
-End with one line per file: which wiki notes it produced or merged into, or "nothing distillable".
@@ -1,37 +0,0 @@
-{
-  "//": "Permission scope for the wiki-maintenance agent (wiki-distill) in CI.",
-  "//2": "The step's environment holds a Gitea push token, a TypeSafe key and the wiki-index",
-  "//3": "client credential, so the Read tool is kept away from /proc (env dumps), /root outside",
-  "//4": "the vault symlink target, /etc and the checkout's .git/. The vault itself is the work.",
-  "//5": "Mirrors ci/agents/issue-fix/settings.json; absolute globs because the vault is reached",
-  "//6": "through the ~/Notes symlink the pipeline creates.",
-  "permissions": {
-    "allow": [
-      "Read(//root/Notes/**)",
-      "Edit(//root/Notes/wiki/**)",
-      "Edit(//root/Notes/output/**)",
-      "Edit(//root/Notes/raw/**)",
-      "Bash(/root/Notes/bin/wiki_rank.py:*)",
-      "Bash(/root/Notes/bin/wiki_ask.py:*)",
-      "Bash(mv /root/Notes/raw/:*)",
-      "Bash(mkdir -p /root/Notes/:*)",
-      "Bash(ls:*)",
-      "Bash(date:*)",
-      "Bash(wc:*)",
-      "Bash(head:*)",
-      "Bash(tail:*)"
-    ],
-    "deny": [
-      "Read(//proc/**)",
-      "Read(//etc/**)",
-      "Read(//root/.config/**)",
-      "Read(//root/Notes/.git/**)",
-      "Read(//root/Notes/_archive/**)",
-      "Edit(//root/Notes/_archive/**)",
-      "Bash(rm:*)",
-      "Bash(git:*)",
-      "Bash(curl:*)",
-      "Bash(wget:*)"
-    ]
-  }
-}
@@ -13,9 +13,7 @@ RUN apk add --no-cache \
      git \
      jq \
      openssh-client \
-      openssl \
-      python3 \
-      py3-yaml
+      openssl

 # Install Claude Code, then make the resulting layer byte-stable so that a
 # rebuild of the SAME version DEDUPS in the Gitea registry instead of orphaning
@@ -1,4 +1,4 @@
-# netbird-service-sync: reconciles NetBird reverse-proxy services (public
+# netbird-proxy-services: reconciles NetBird reverse-proxy services (public
 # domains -> TLS passthrough -> Traefik ClusterIP) from Ingresses carrying the
 # public label. Standard library only, so the image is the interpreter plus one
 # file; runs unprivileged as its own user.
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""netbird-service-sync: reconcile NetBird reverse-proxy services from Ingresses.
+"""netbird-proxy-services: reconcile NetBird reverse-proxy services from Ingresses.

 Source of truth: every Ingress carrying the public label (dns.renner.uno/public).
 For each host on such an Ingress the NetBird management gets one reverse-proxy
@@ -30,11 +30,11 @@ import urllib.error
 import urllib.parse
 import urllib.request

-LOG = logging.getLogger("netbird-service-sync")
+LOG = logging.getLogger("netbird-proxy-services")

 NB = os.environ.get("NB_MANAGEMENT_URL", "https://netbird.renner.uno").rstrip("/")
 BAO_ADDR = os.environ.get("BAO_ADDR", "http://openbao.openbao.svc.cluster.local:8200").rstrip("/")
-BAO_ROLE = os.environ.get("BAO_ROLE", "netbird-service-sync")
+BAO_ROLE = os.environ.get("BAO_ROLE", "netbird-proxy-services")
 BAO_PAT_PATH = os.environ.get("BAO_PAT_PATH", "homelab/data/infrastructure/secret-rotators-bootstrap/netbird")
 BAO_PAT_KEY = os.environ.get("BAO_PAT_KEY", "pat")
 SERVICE_CIDR = os.environ.get("SERVICE_CIDR", "10.96.0.0/12")
@@ -156,7 +156,7 @@ def ensure_network(nb):
        if n["name"] == NETWORK_NAME:
            return n["id"]
    n = nb.post("networks", {"name": NETWORK_NAME,
-                             "description": "managed by netbird-service-sync; public ingress via TLS passthrough"})
+                             "description": "managed by netbird-proxy-services; public ingress via TLS passthrough"})
    LOG.info("created network %s (%s)", NETWORK_NAME, n["id"])
    return n["id"]

@@ -166,7 +166,7 @@ def ensure_resource(nb, net):
        if r.get("address") == SERVICE_CIDR:
            return r["id"]
    r = nb.post(f"networks/{net}/resources", {"name": "cluster service CIDR", "address": SERVICE_CIDR,
-                                              "description": "managed by netbird-service-sync",
+                                              "description": "managed by netbird-proxy-services",
                                              "enabled": True, "groups": []})
    LOG.info("created subnet resource %s (%s)", SERVICE_CIDR, r["id"])
    return r["id"]
@@ -1,99 +1,117 @@
 # Traffic classes on the k8s nodes

-Issue #576. Five classes, each on its own VLAN.
+Issue #576. Three of the four classes are separated; management is not.

 ## Where each class runs

 | class | link | mechanism |
 |---|---|---|
 | Ceph replication | `ceph-san`, VLAN 49 | the whole link is handed to the OSD pod (Multus `host-device`) |
-| pod↔pod | `pod0`, VLAN 48 | pod-sourced traffic is routed from table 47; bird puts the peers' pod CIDRs there via `pod0` |
-| world↔pod | `ingress0`, VLAN 47 | BGP session sourced there (next hop of every LoadBalancer VIP); pod egress takes table 47's default |
-| node↔node | `node0`, VLAN 46 | the node InternalIP and etcd live there; so do apiserver↔kubelet, cilium-health and host→remote-pod traffic |
-| world↔node | `mgmt0`, VLAN 40 | API VIP for kubectl, talosctl from outside, node egress (DNS, NTP, image pulls) |
+| world→pod | `ingress0`, VLAN 47 | BGP session sourced there, so the advertised next hop is that address |
+| pod→world | `ingress0`, VLAN 47 | routing rule on the pod source prefix → table 47 |
+| pod↔pod | `pod0`, VLAN 48 | routing rule on pod source **and** destination → table 48 |
+| management | `mgmt0`, VLAN 40 | not started |

 Hard constraint, set by the owner: inter-node and pod traffic never traverses
-the UDM. Everything but world↔node stays on the 10G switch. VLAN 46 and 48 are
-statically addressed, without a gateway; VLAN 46 is isolated in UniFi.
+the UDM. Everything above stays on the 10G switch.

-## Pod traffic: one table
+## Why policy routing rather than moving the node IP

-Two rules, one per family, send every packet with a pod source to table 47
-(`talos/patches/site-homelab.yaml`, priorities 1000/1001, below main). The
-table decides by longest prefix; no rule carves out exceptions.
+Cilium reaches a peer's pods at that peer's Kubernetes InternalIP, in native
+and tunnel mode alike. `--ipv4-node` is overwritten from the Node object, and
+`nodePort.directRoutingDevice` selects the BPF NodePort device, not a next hop.
+Both were established by test (#837, #838), not by reading.

-bird (`kubernetes/infrastructure/bird/`) owns table 47 and fills it with:
+So the InternalIP decides where pod traffic goes — unless the lookup happens in
+a different table. The rules do that, and nothing about the node's identity
+moves. The routing decision runs before Cilium's masquerade hook, so a rule
+matching the pod source sees the pod address, and the masquerade then rewrites
+it to the egress link's.

- the node's attached networks — `mgmt0`, `ingress0`, `pod0`, `node0` —
-  taken from the interfaces;
- the peers' pod CIDRs, learned over an iBGP mesh on `pod0`, next hop the
-  peer's `pod0` address;
- the node's own pod CIDR via `cilium_host`, originated rather than read back
-  from the kernel (reading it back made BIRD depend on the shape of Cilium's
-  route, and KRT rejects the IPv4 one);
- the egress default via the UDM on `ingress0`, from the node annotations
-  `net.renner.uno/egress-gw-v4/v6`.
+## Rule order

-`node0` has to be in the table: a pod reaching a node address — the
-`kubernetes` ClusterIP, which socket LB rewrites to the apiserver's advertise
-address, or a hostNetwork pod — would otherwise take the default to the UDM.
+Lower priority runs first.

-The routing decision runs before Cilium's masquerade hook, so the rule sees the
-pod address and the masquerade then rewrites it to the egress link's.
+| prio | match | table |
+|---|---|---|
+| 980 | src pod, dst pod | 48 |
+| 981 | src pod, dst pod (v4) | 48 |
+| 990 | dst `fd00::/8` | main |
+| 991 | dst `10.0.0.0/8` | main |
+| 1000 | src pod | 47 |
+| 1001 | src pod (v4) | 47 |

-Node-originated traffic does not match the rules and uses main, where Cilium
-routes each peer's pod CIDR via the peer's InternalIP — on `node0`.
+980/981 match source **and** destination. Source alone would also catch the
+node's own traffic to a pod, which would then leave with a `pod0` source — an
+address `CiliumNode.spec.addresses` does not list, so Cilium classifies it as
+`world` rather than `host`.
+
+990/991 are Cilium's `ipv4/ipv6NativeRoutingCIDR`, and they are what keeps
+cluster-internal traffic out of table 47. Without them a pod's packet to a
+service matches the source rule, finds only a default route, and leaves for the
+UDM — measured, in-cluster DNS stopped resolving.
+
+Traffic to a pod on the same node falls through on its own: table 48 holds only
+the peers' CIDRs, so the lookup misses and 990/991 send it to main.
+
+## Where each table comes from
+
+- **47** — two default routes declared per node in `talos/patches/k8s-*.yaml`.
+  The IPv6 gateway is the UDM's configured address on the segment, not the
+  RA-learned link-local; `accept_ra_defrtr` stays `0` on `ingress0` so the RA
+  default does not land in main.
+- **48** — filled by the `bird` DaemonSet: an iBGP mesh over `pod0`, one route
+  per peer pod CIDR with the peer's `pod0` address as next hop.
+
+## The bird mesh
+
+`kubernetes/infrastructure/bird/`. Each node advertises only its own pod CIDR
+and installs what it learns into table 48. Cilium's routes in main are
+untouched, which is why the two coexist.

 No address is written into this repo twice. Each node publishes its `pod0`
-addresses as `nodeAnnotations` beside the `VLANConfig` that assigns them; the
-pod CIDRs come from the Node objects. bird's init container renders both from
-the API and ends with `bird -p`, so BIRD's own parser gates startup.
+addresses as `nodeAnnotations`, beside the `VLANConfig` that assigns them; the
+pod CIDRs come from the Node objects. An init container renders both from the
+API with `kubectl -o go-template-file`, excludes the node itself with a field
+selector, and ends with `bird -p` so BIRD's own parser gates startup.

-## Node↔node
-
-`kubelet.nodeIP.validSubnets` and `cluster.etcd.advertisedSubnets` point at
-VLAN 46. Talos picks one InternalIP per family, IPv4 first — the service CIDR
-is IPv4, and the apiserver's advertise address must match it.
-
-The API VIP stays on `mgmt0` for kubectl. No in-cluster client uses it:
-kubelet, scheduler, controller-manager and Cilium go through KubePrism
-(`localhost:7445`), which balances over every address of every control-plane
-member; pods use the ClusterIP.
-
-Talos never updates an existing etcd member's peer URLs
-(siderolabs/talos#12720). Changing `advertisedSubnets` means, per member:
-stage the config, `talosctl etcd forfeit-leadership`, `talosctl etcd leave`,
-reboot. `leave` removes only `/var/lib/etcd`; the node rejoins as a learner
-and is promoted. EPHEMERAL does not need a wipe.
-
-## Moving node IPs: the mixed state
-
-While some nodes have their InternalIP on the new network and some on the old,
-host→remote-pod traffic leaves with a node address that is not an InternalIP:
-the kernel picks the source from the route to the peer's InternalIP. Cilium
-classifies that as `world`, and every ingress policy that admits only
-`host`/`remote-node` (rook-ceph, monitoring, …) drops it. Kernel Ceph clients
-lose the OSDs on the other side; RBD mounts hang.
-
-Bridge it for the duration with a temporary `CiliumClusterwideNetworkPolicy`
-admitting the node subnets of both networks, both families, with
-`enableDefaultDeny: false` so it restricts nothing else, and delete it once
-every node has moved. Keep all OSD nodes schedulable while one is drained:
-draining two takes Ceph below its data availability.
+The node's own CIDR is **originated**, not read back from the kernel. Reading
+it back made BIRD depend on the shape Cilium installs, and the IPv4 route is
+rejected outright: its next hop sits inside the prefix it describes, which KRT
+refuses with `strange next-hop`. The IPv6 route is a device route and passed,
+so the failure was silent on one family only.

 ## Failure behaviour

-If bird stops, table 47 empties, the rules find nothing and fall through to
-main: pod traffic returns to the node networks, unseparated rather than
-misrouted. The same holds during a cold rebuild until Gitea serves bird's
-image. The default route lives in table 47, not in the Talos config, so a
-default cannot outlive the specific routes and send pod traffic to the UDM.
+Benign at every layer. An empty or absent table 48 makes 980/981 fall through
+to main, and pod traffic returns to VLAN 40 — unseparated, not broken. The same
+holds if the DaemonSet cannot start, which is the case during a cold rebuild
+until Gitea serves its image.
+
+## Management, the remaining class
+
+Not started. The levers differ per service and none of them is the node IP:
+
+| service | can leave the node IP? | lever |
+|---|---|---|
+| etcd | yes | `cluster.etcd.advertisedSubnets`; needs a reboot per node |
+| kube-apiserver endpoint | yes | it is a VIP — `Layer2VIPConfig.link` |
+| Talos API | n/a | `apid` answers on every node address; a firewall question |
+| kubelet | no | it *is* the node IP |
+
+Two approaches were rejected by the owner and are not to be proposed again:
+moving the node IP and etcd to `pod0` (#838), and relabelling VLAN 40 as the
+cluster VLAN while moving etcd and the API VIP to a new management VLAN.
+Replacing the CNI (#839, Antrea) was shelved.
+
+Note that the reasoning which produced that list also concluded pod↔pod was
+blocked, which policy routing disproved. Treat it as a record of decisions, not
+as an exhaustive analysis.

 ## Sources

-Cilium v1.20 `pkg/datapath/linux/node.go`; BIRD 2.17 user manual (kernel
-protocol, `strict bind`, `direct`); Talos v1.13 `RoutingRuleConfig`,
-`machine.nodeAnnotations`, configuration patching (lists are appended,
-`$patch: delete`), etcd `LeaveCluster`; KubePrism docs;
-siderolabs/talos#12720. PRs #831, #833, #835, #836, #837, #842, #852, #854,
-#855, #857, #858, #918, #919, #922; closed unmerged: #830, #838, #839.
+Cilium v1.20.1 `pkg/datapath/linux/node.go`, `pkg/node/types/node.go`,
+`pkg/node/sync/local_node_sync.go`; BIRD 2.17 user manual (kernel protocol,
+`learn all`, `strict bind`, `direct`); Talos v1.13 `RoutingRuleConfig` and
+`machine.nodeAnnotations`. PRs #831, #833, #835, #836, #837, #842, #852, #854,
+#855; closed unmerged: #830, #838, #839.
@@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: gitea
-  namespace: gitea
+  namespace: apps
  labels:
    app.kubernetes.io/name: gitea
  annotations:
@@ -2,7 +2,7 @@ apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
 metadata:
  name: gitea-ssh
-  namespace: gitea
+  namespace: apps
  labels:
    app.kubernetes.io/name: gitea
 spec:
@@ -1,8 +1,28 @@
-# Prometheus scrape and Traefik are admitted by the namespace baseline in
-# infrastructure/network-policies/gitea-ns.yaml.
-#
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: gitea-allow-metrics-scrape
+  namespace: apps
+spec:
+  # Prometheus (monitoring ns) scrapes gitea's /metrics on :3000. The apps
+  # default-deny-ingress only allows same-ns / home-assistant / host, so the
+  # scrape is dropped (context deadline exceeded). This became necessary only
+  # after the LXC->in-cluster cutover — the old static target was external, so
+  # no in-cluster policy applied. Scoped to the gitea pod + :3000.
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+---
 # Secret rotation: the flux-git rotator (openbao ns) reaches gitea to mint a new
-# flux PAT. It uses the in-cluster Service (gitea.gitea.svc:3000) — the public
+# flux PAT. It uses the in-cluster Service (gitea.apps.svc:3000) — the public
 # gitea.renner.uno name hairpins off the ingress LB from a pod (same failure as
 # pve.renner.uno). Scoped to the gitea pod :3000 and the rotator label; the
 # egress half is rotator-gitea-flux-egress in network-policies/openbao-ns.yaml.
@@ -10,7 +30,7 @@ apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: gitea-allow-flux-rotator
-  namespace: gitea
+  namespace: apps
 spec:
  endpointSelector:
    matchLabels:
@@ -34,7 +54,7 @@ apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: gitea-allow-review-bot-rotator
-  namespace: gitea
+  namespace: apps
 spec:
  endpointSelector:
    matchLabels:
@@ -13,7 +13,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
  name: gitea
-  namespace: gitea
+  namespace: apps
  labels:
    app.kubernetes.io/name: gitea
 spec:
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: gitea
-  namespace: gitea
+  namespace: apps
  labels:
    app.kubernetes.io/name: gitea
 spec:
@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  name: gitea
-  namespace: gitea
+  namespace: apps
  labels:
    app.kubernetes.io/name: gitea
 spec:
@@ -152,7 +152,7 @@ spec:
          # NOTE: volumeClaimTemplates is immutable on an existing StatefulSet,
          # so bumping this value cannot be `kubectl apply`-ed in place — Flux
          # will reject the whole object. Landing this size change requires a
-          # one-time `kubectl delete statefulset gitea -n gitea --cascade=orphan`
+          # one-time `kubectl delete statefulset gitea -n apps --cascade=orphan`
          # (pod + PVC keep running) so Flux re-creates the STS from this
          # template and re-adopts them. After the cleanup_packages GC reclaims
          # the ~10G of orphaned blobs, real usage is ~9G, so 40Gi is headroom.
@@ -3,8 +3,8 @@ kind: Kustomization
 resources:
  - gatus/
  - external-dns/
+  - gitea/
  - ical-proxy/
-  # gitea/ has its own `gitea` Kustomization (clusters/homelab/gitea.yaml, #878).
  # woodpecker/ moved to its own dedicated `woodpecker` Kustomization
  # (clusters/homelab/woodpecker.yaml) so its wp-pg CNPG cluster's barman
  # dependency + Cluster health-gating don't contaminate this shared apps KS.
@@ -57,14 +57,10 @@ spec:
          # the ClusterSecretStore goes InvalidProviderConfig and no
          # ExternalSecret can refresh.
          #
-          # Short window: readiness is only a proxy for quorum. A one-second
-          # node NotReady flap makes the node lifecycle controller mark that
-          # node's pods not-ready for ~30s while raft keeps its leader and
-          # serves (issue #920, during a rolling reboot with one replica
-          # already evicted). A really sealed or crashed majority persists,
-          # and existing Secrets keep their last values, so 2m costs little.
+          # No window: below quorum the secret store is down and every
+          # ExternalSecret stalls with it, so waiting only delays the page.
          expr: max by (namespace, statefulset) (kube_statefulset_status_replicas_ready{namespace="openbao", statefulset="openbao"}) < 2
-          for: 2m
+          for: 0m
          labels:
            severity: critical
          annotations:
@@ -91,11 +91,12 @@ spec:
        # Additional scrape targets not covered by ServiceMonitors.
        additionalScrapeConfigs:
          # Gitea exposes /metrics anonymously on its main HTTP port. The
-          # `gitea_*` metrics power the gitea-overview dashboard. Scrapes the
-          # ClusterIP Service of the StatefulSet in the gitea namespace.
+          # `gitea_*` metrics power the gitea-overview dashboard. Gitea now runs
+          # in-cluster (StatefulSet in apps ns; LXC 114 retired), so scrape the
+          # ClusterIP Service directly instead of the dead LXC hostname.
          - job_name: gitea
            static_configs:
-              - targets: ["gitea.gitea.svc.cluster.local:3000"]
+              - targets: ["gitea.apps.svc.cluster.local:3000"]
            metrics_path: /metrics

    # Grafana
@@ -27,8 +27,6 @@ data:
  PAPERLESS_ALLOWED_HOSTS: "*"
  PAPERLESS_TIME_ZONE: "Europe/Berlin"
  PAPERLESS_OCR_LANGUAGE: "deu+eng"
-  # Default is cpu_count / TASK_WORKERS, 20 on k8s-1; OCR memory scales with it.
-  PAPERLESS_THREADS_PER_WORKER: "5"
  PAPERLESS_CONSUMER_RECURSIVE: "true"
  PAPERLESS_CONSUMER_DELETE_DUPLICATES: "true"
  PAPERLESS_CONSUMER_ENABLE_BARCODES: "true"
@@ -185,7 +183,7 @@ spec:
              drop: ["ALL"]
      containers:
        - name: paperless
-          image: ghcr.io/paperless-ngx/paperless-ngx:3.2.1 # {"$imagepolicy": "flux-system:paperless-ngx"}
+          image: ghcr.io/paperless-ngx/paperless-ngx:3.2.0 # {"$imagepolicy": "flux-system:paperless-ngx"}
          ports:
            - name: http
              containerPort: 8000
@@ -275,7 +273,7 @@ spec:
              cpu: 200m
              memory: 512Mi
            limits:
-              memory: 4Gi
+              memory: 2Gi
          securityContext:
            runAsNonRoot: false
            allowPrivilegeEscalation: true
@@ -25,7 +25,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: redis
-          image: redis:8.10.2-alpine # {"$imagepolicy": "flux-system:redis-paperless"}
+          image: redis:8.10.1-alpine # {"$imagepolicy": "flux-system:redis-paperless"}
          args:
            - redis-server
            - --save
@@ -56,8 +56,8 @@ spec:
          type: RuntimeDefault
      containers:
        - name: wiki-index
-          # Per-commit tag (build-ci-images.yml): immutable, no same-day overwrite.
-          image: gitea.renner.uno/gitea_admin/wiki-index:2026-09-20-4b529cd1
+          # Flux image automation bumps this to the newest build.<unix-ts> tag.
+          image: gitea.renner.uno/gitea_admin/wiki-index:2026-09-20-4b529cd1 # {"$imagepolicy": "flux-system:wiki-index"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -1946,7 +1946,6 @@ if phase_runs wait-apps; then
    # apps waits on infrastructure-ceph-cluster (Ceph mon/mgr/OSD bring-up
    # is genuinely 5–10 min on a fresh OSD-wiped cluster).
    wait_kustomization apps                "apps"                                                90
-    wait_kustomization gitea               "Gitea (incl. data-gitea-0 PVC)"                      90
    wait_kustomization influxdb            "InfluxDB (HR install + token Jobs)"                  600
    wait_kustomization woodpecker          "Woodpecker CI (incl. wp-pg CNPG backend)"            600
    wait_kustomization authentik           "Authentik (incl. ak-pg CNPG backend)"                600
@@ -1,20 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: gitea
-  namespace: flux-system
-spec:
-  # Gitea in its own `gitea` namespace (#878), formerly under the shared `apps` KS.
-  interval: 10m
-  retryInterval: 2m
-  timeout: 15m
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  path: ./kubernetes/apps/gitea
-  prune: true
-  wait: true
-  dependsOn:
-    - name: infrastructure
-    - name: infrastructure-crds
-    - name: infrastructure-ceph-cluster
@@ -23,7 +23,7 @@ protocol device { scan time 10; }
 # down. The usual advice is not to export these to the kernel because it
 # maintains them itself — true of main, not of a table the kernel never fills.
 protocol direct attached {
-  interface "mgmt0", "ingress0", "pod0", "node0";
+  interface "mgmt0", "ingress0", "pod0";
  ipv4 { table master4; };
  ipv6 { table master6; };
 }
@@ -48,8 +48,8 @@ spec:
        tier: node
        app: bird
    spec:
-      # Owns table 47, where all pod traffic is routed. Without it the table
-      # stays empty and the rules fall through to main, unseparated.
+      # Carries pod east-west once the routing rules land. Without it table 48
+      # stays empty and the rules fall through to main, i.e. back to VLAN 40.
      priorityClassName: system-node-critical
      # Writes host routes and peers on host addresses.
      hostNetwork: true
@@ -118,21 +118,14 @@ spec:
      # traffic out to the VIP and back (which fails with L2 announcements).
      lbExternalClusterIP: true
    cni:
-      # Multus is the only writer of /etc/cni/net.d (#832): Cilium's conflist
-      # goes to /etc/cni/net.d/multus/, which the container runtime does not
-      # read, and Multus delegates to it via clusterNetwork. Without this a
-      # pod created after a reboot, before Multus rewrote 00-multus.conf, came
-      # up with Cilium alone. See kubernetes/infrastructure/multus.
-      confPath: /etc/cni/net.d/multus
-      # The default `exclusive: true` renames other configs in the conf dir to
-      # *.cilium_bak on every reconcile, which kept nuking multus.
+      # Multus (kubernetes/infrastructure/multus) runs alongside Cilium and
+      # writes 00-multus.conf to /etc/cni/net.d so kubelet picks multus
+      # first; multus then delegates to Cilium's 05-cilium.conflist via
+      # clusterNetwork. The default `exclusive: true` makes cilium-cni's
+      # install step rename anything alphabetically before its own config
+      # to *.cilium_bak on every reconcile, which kept nuking multus.
+      # Setting it false lets multus's config coexist.
      exclusive: false
-    # One agent at a time: the chart default of 2 restarts two of three
-    # nodes' datapath at once.
-    updateStrategy:
-      type: RollingUpdate
-      rollingUpdate:
-        maxUnavailable: 1
    # Talos-specific settings
    securityContext:
      capabilities:
@@ -24,5 +24,6 @@ resources:
  - valkey.yaml
  - velero-plugin-for-aws.yaml
  - vsftpd.yaml
+  - wiki-index.yaml
  - woodpecker.yaml
  - wyoming.yaml
@@ -0,0 +1,26 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: wiki-index
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/gitea_admin/wiki-index
+  interval: 10m
+---
+# build-ci-images.yml publishes `build.<unix-ts>` alongside the dated tag so
+# every build rolls out on its own; the dated tag is rewritten several times a
+# day and cannot be tracked.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: wiki-index
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: wiki-index
+  filterTags:
+    pattern: '^build\.(?P<ts>\d+)$'
+    extract: '$ts'
+  policy:
+    numerical:
+      order: asc
@@ -1,16 +1,11 @@
 apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
+kind: HelmRepository
 metadata:
  name: k8s-gateway
  namespace: kube-system
 spec:
  interval: 24h
-  url: oci://codeberg.org/k8s-gateway/charts/k8s-gateway
-  ref:
-    semver: ">=2.4.0"
-  layerSelector:
-    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
-    operation: copy
+  url: https://k8s-gateway.github.io/k8s_gateway/
 ---
 # In-cluster authoritative resolver for renner.uno.
 #
@@ -33,10 +28,14 @@ metadata:
  namespace: kube-system
 spec:
  interval: 30m
-  chartRef:
-    kind: OCIRepository
-    name: k8s-gateway
-    namespace: kube-system
+  chart:
+    spec:
+      chart: k8s-gateway
+      version: ">=2.4.0"
+      sourceRef:
+        kind: HelmRepository
+        name: k8s-gateway
+        namespace: kube-system
  install:
    remediation:
      retries: 3
@@ -19,7 +19,7 @@ resources:
  - cloudnative-pg/
  - mariadb-operator/
  - netbird-ingress/
-  - netbird-service-sync/
+  - netbird-proxy-services/
  - coredns-config/
  - k8s-gateway/
  - external-dns-unifi/
@@ -111,18 +111,10 @@ metadata:
  name: multus
  namespace: kube-system
 ---
-# Multus is the only writer of /etc/cni/net.d (#832). Cilium writes its conflist
-# to /etc/cni/net.d/multus/, a subdirectory the container runtime does not read
-# (libcni skips directories); Multus picks it up there via multusAutoconfigDir
-# and writes 00-multus.conf. Until that file exists the runtime has no network
-# config at all, so no pod can be created with Cilium alone after a reboot.
-#
-# The "-subdir" names date from the node-by-node rollout; renaming would roll
-# Multus again for nothing.
 kind: ConfigMap
 apiVersion: v1
 metadata:
-  name: multus-daemon-config-subdir
+  name: multus-daemon-config
  namespace: kube-system
  labels:
    tier: node
@@ -135,7 +127,7 @@ data:
        "logLevel": "verbose",
        "logToStderr": true,
        "cniConfigDir": "/host/etc/cni/net.d",
-        "multusAutoconfigDir": "/host/etc/cni/net.d/multus",
+        "multusAutoconfigDir": "/host/etc/cni/net.d",
        "multusConfigFile": "auto",
        "socketDir": "/host/run/multus/"
    }
@@ -143,16 +135,16 @@ data:
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: kube-multus-ds-subdir
+  name: kube-multus-ds
  namespace: kube-system
  labels:
    tier: node
    app: multus
-    name: multus-subdir
+    name: multus
 spec:
  selector:
    matchLabels:
-      name: multus-subdir
+      name: multus
  updateStrategy:
    type: RollingUpdate
  template:
@@ -160,7 +152,7 @@ spec:
      labels:
        tier: node
        app: multus
-        name: multus-subdir
+        name: multus
    spec:
      # Upstream ships this DaemonSet with no priority class, so it runs at 0
      # and can preempt nothing. Any event that makes the pod need a fresh
@@ -232,10 +224,6 @@ spec:
          volumeMounts:
            - name: cni
              mountPath: /host/etc/cni/net.d
-            # Exists before Multus starts, so it waits for Cilium's conflist
-            # instead of exiting on a missing directory.
-            - name: cni-cilium-conf
-              mountPath: /host/etc/cni/net.d/multus
            # multus-daemon expects that cnibin path must be identical between pod and container host.
            # e.g. if the cni bin is in '/opt/cni/bin' on the container host side, then it should be mount to '/opt/cni/bin' in multus-daemon,
            # not to any other directory, like '/opt/bin' or '/usr/bin'.
@@ -291,10 +279,6 @@ spec:
        - name: cni
          hostPath:
            path: /etc/cni/net.d
-        - name: cni-cilium-conf
-          hostPath:
-            path: /etc/cni/net.d/multus
-            type: DirectoryOrCreate
        - name: cnibin
          hostPath:
            path: /opt/cni/bin
@@ -303,7 +287,7 @@ spec:
            path: /
        - name: multus-daemon-config
          configMap:
-            name: multus-daemon-config-subdir
+            name: multus-daemon-config
            items:
              - key: daemon-config.json
                path: daemon-config.json
@@ -39,11 +39,9 @@ spec:
        name: whereabouts-reconciler
    spec:
      serviceAccountName: whereabouts
-      # Every node here is a control plane node. Keyed: a keyless Exists would
-      # also tolerate node.kubernetes.io/unschedulable and ignore cordons.
+      # Every node here is a control plane node.
      tolerations:
-        - key: node-role.kubernetes.io/control-plane
-          operator: Exists
+        - operator: Exists
          effect: NoSchedule
      containers:
        - name: whereabouts-reconciler
@@ -179,22 +179,6 @@ kind: Namespace
 metadata:
  name: woodpecker
 ---
-# Gitea, moving out of the shared `apps` namespace (issue #878). Declared here
-# like `woodpecker` above, so it exists before infrastructure-crds applies its
-# CiliumNetworkPolicies. No pod-security labels: the cluster default applies.
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitea
---
-# netbird-service-sync, moving out of `openbao` (issue #876). Declared here like
-# `woodpecker` above, so it exists before infrastructure-crds applies its
-# CiliumNetworkPolicies. No pod-security labels: the cluster default applies.
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: netbird-service-sync
---
 # Local LLM inference (kubernetes/apps/llama-server). Declared here, like
 # `woodpecker` above, so the `infrastructure` KS creates it before
 # `infrastructure-crds` applies the namespace's CiliumNetworkPolicies.
@@ -1,28 +1,28 @@
 # Reconciles NetBird reverse-proxy services from Ingresses that carry
 # dns.renner.uno/public: one TLS-passthrough service per host on :443,
 # targeting Traefik's ClusterIP through a subnet resource over the service
-# CIDR (ci/images/netbird-service-sync/controller.py).
+# CIDR (ci/images/netbird-proxy-services/controller.py).
 #
-# Own namespace; its egress (DNS, apiserver, OpenBao, NetBird API) is in
-# network-policies/netbird-service-sync-ns.yaml. The NetBird PAT is read from
-# OpenBao on every pass through the netbird-service-sync role —
-# policies/netbird-service-sync.hcl, applied once by hand like the rotator
-# roles. Until that role exists the pod logs an auth error each minute and does
-# nothing.
+# openbao namespace, like the rotators: its default-deny already allows egress
+# to OpenBao, DNS, the apiserver and `world` (netbird.renner.uno), and the
+# NetBird PAT is read from OpenBao on every pass through the
+# netbird-proxy-services role — policies/netbird-proxy-services.hcl, applied
+# once by hand like the rotator roles. Until that role exists the pod logs an
+# auth error each minute and does nothing.
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: netbird-service-sync
-  namespace: netbird-service-sync
+  name: netbird-proxy-services
+  namespace: openbao
  labels:
-    app.kubernetes.io/name: netbird-service-sync
+    app.kubernetes.io/name: netbird-proxy-services
 ---
 # Read-only, cluster-wide: public Ingresses live in many namespaces, the
 # Traefik Service in ingress/.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: netbird-service-sync-read
+  name: netbird-proxy-services-read
 rules:
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
@@ -34,23 +34,23 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: netbird-service-sync-read
+  name: netbird-proxy-services-read
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
-  name: netbird-service-sync-read
+  name: netbird-proxy-services-read
 subjects:
  - kind: ServiceAccount
-    name: netbird-service-sync
-    namespace: netbird-service-sync
+    name: netbird-proxy-services
+    namespace: openbao
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: netbird-service-sync
-  namespace: netbird-service-sync
+  name: netbird-proxy-services
+  namespace: openbao
  labels:
-    app.kubernetes.io/name: netbird-service-sync
+    app.kubernetes.io/name: netbird-proxy-services
 spec:
  replicas: 1
  # One writer against the management API at a time.
@@ -58,13 +58,13 @@ spec:
    type: Recreate
  selector:
    matchLabels:
-      app.kubernetes.io/name: netbird-service-sync
+      app.kubernetes.io/name: netbird-proxy-services
  template:
    metadata:
      labels:
-        app.kubernetes.io/name: netbird-service-sync
+        app.kubernetes.io/name: netbird-proxy-services
    spec:
-      serviceAccountName: netbird-service-sync
+      serviceAccountName: netbird-proxy-services
      securityContext:
        runAsNonRoot: true
        # Numeric, or the kubelet refuses the image's named user with
@@ -80,7 +80,7 @@ spec:
          # image directory (branch and master alike) and the registry keeps
          # only the newest manifest per tag, so the digest must come from
          # the MASTER build of the code change.
-          image: gitea.renner.uno/gitea_admin/netbird-service-sync:2026-09-23@sha256:64f6057c508640e1dbc50457dc26e9b2de058a111fd46ca096021d7444b5bbff
+          image: gitea.renner.uno/gitea_admin/netbird-proxy-services:2026-09-07@sha256:caffa308d802c6fcc6aea919ac94657c08b993651baa6b8d18de395bcc40523e
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -92,7 +92,7 @@ spec:
            - name: BAO_ADDR
              value: http://openbao.openbao.svc.cluster.local:8200
            - name: BAO_ROLE
-              value: netbird-service-sync
+              value: netbird-proxy-services
            # Must match cluster.network.serviceSubnets in talos/patches/cluster.yaml.
            - name: SERVICE_CIDR
              value: "10.96.0.0/12"
@@ -167,7 +167,7 @@ spec:
            "k8s:io.kubernetes.pod.namespace": ingress
            app.kubernetes.io/name: traefik
        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": gitea
+            "k8s:io.kubernetes.pod.namespace": apps
            app.kubernetes.io/name: gitea
      toPorts:
        - ports:
@@ -45,6 +45,16 @@ spec:
        - ports:
            - port: "1883"
              protocol: TCP
+    # gitea delivers the notes repo's push webhook to wiki-index (ai ns) on :8080.
+    # wiki-index's own ingress policy scopes this to the gitea pod.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ai
+            app.kubernetes.io/name: wiki-index
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
    - toEntities:
        - host
        - remote-node
@@ -1,104 +0,0 @@
---
-# Baseline policy for the `gitea` namespace (issue #878).
-#
-# endpointSelector: {} — every rule applies to every pod in the namespace.
-# Workload-scoped grants go in their own policy with their own selector.
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: default-deny
-  namespace: gitea
-spec:
-  endpointSelector: {}
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": gitea
-    # Prometheus scrape of /metrics.
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": monitoring
-    # Kubelet probes and hostNetwork siblings.
-    - fromEntities:
-        - host
-        - remote-node
-    # ICMP from any cluster pod; required once an L4 policy selects the pod.
-    # See woodpecker-ns.yaml for the rationale. INGRESS ONLY.
-    - fromEndpoints:
-        - matchExpressions:
-            - key: io.kubernetes.pod.namespace
-              operator: Exists
-      icmps:
-        - fields:
-            - { type: 0,   family: IPv4 }
-            - { type: 3,   family: IPv4 }
-            - { type: 8,   family: IPv4 }
-            - { type: 11,  family: IPv4 }
-            - { type: 12,  family: IPv4 }
-            - { type: 1,   family: IPv6 }
-            - { type: 2,   family: IPv6 }
-            - { type: 3,   family: IPv6 }
-            - { type: 4,   family: IPv6 }
-            - { type: 128, family: IPv6 }
-            - { type: 129, family: IPv6 }
-            - { type: 133, family: IPv6 }
-            - { type: 134, family: IPv6 }
-            - { type: 135, family: IPv6 }
-            - { type: 136, family: IPv6 }
-            - { type: 143, family: IPv6 }
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": gitea
-    # Webhooks to hosts served by Traefik (ci.renner.uno).
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ingress
-            app.kubernetes.io/name: traefik
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-            - port: "53"
-              protocol: TCP
-    # Push webhook of the notes repo to wiki-index.
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ai
-            app.kubernetes.io/name: wiki-index
-      toPorts:
-        - ports:
-            - port: "8080"
-              protocol: TCP
-    # Push mirror to GitHub and other external targets.
-    - toEntities:
-        - host
-        - remote-node
-        - world
---
-# Traefik serves git.renner.uno / gitea.renner.uno (:3000) and the gitea-ssh
-# entrypoint (:2222). Lives beside the baseline so both land in one reconcile.
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: gitea-allow-traefik
-  namespace: gitea
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: gitea
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ingress
-            app.kubernetes.io/name: traefik
-      toPorts:
-        - ports:
-            - port: "3000"
-              protocol: TCP
-            - port: "2222"
-              protocol: TCP
@@ -22,8 +22,6 @@ resources:
  - external-secrets-ns.yaml
  - woodpecker-ci-ns.yaml
  - woodpecker-ns.yaml
-  - gitea-ns.yaml
-  - netbird-service-sync-ns.yaml
  - trmnl-ns.yaml
  - wordpress-ns.yaml
  - ai-ns.yaml
@@ -1,43 +0,0 @@
---
-# Baseline policy for the `netbird-service-sync` namespace (issue #876).
-# The controller serves nothing; it only calls out: the Kubernetes API
-# (Ingress/Service reads), OpenBao (NetBird PAT) and the NetBird management API.
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: default-deny
-  namespace: netbird-service-sync
-spec:
-  endpointSelector: {}
-  ingress:
-    - fromEntities:
-        - host
-        - remote-node
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-            - port: "53"
-              protocol: TCP
-    - toEntities:
-        - kube-apiserver
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": openbao
-            app.kubernetes.io/name: openbao
-      toPorts:
-        - ports:
-            - port: "8200"
-              protocol: TCP
-    # NetBird management API (netbird.renner.uno).
-    - toEntities:
-        - world
-      toPorts:
-        - ports:
-            - port: "443"
-              protocol: TCP
@@ -41,16 +41,6 @@ spec:
        - ports:
            - port: "8200"
              protocol: TCP
-    # netbird-service-sync logs in via auth/kubernetes/role/netbird-service-sync
-    # and reads the NetBird PAT on every pass.
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": netbird-service-sync
-            app.kubernetes.io/name: netbird-service-sync
-      toPorts:
-        - ports:
-            - port: "8200"
-              protocol: TCP
    # (Secret-rotation CronJobs run in THIS namespace since 2026-07-18, so their
    # OpenBao access is covered by the intra-namespace ingress rule above — no
    # per-app rule needed.)
@@ -137,7 +127,7 @@ spec:
 # Egress complement to gitea-allow-flux-rotator (apps/gitea/networkpolicy.yaml).
 # The flux-git rotator mints a PAT against the in-cluster gitea Service; the
 # openbao default-deny only permits TCP egress to openbao/kube-dns/apiserver/
-# world, and gitea (gitea ns) is in-cluster, so it needs an explicit allow.
+# world, and gitea (apps ns) is in-cluster, so it needs an explicit allow.
 # Scoped to the flux-git rotator label and gitea :3000.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
@@ -152,7 +142,7 @@ spec:
  egress:
    - toEndpoints:
        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": gitea
+            "k8s:io.kubernetes.pod.namespace": apps
            app.kubernetes.io/name: gitea
      toPorts:
        - ports:
@@ -160,10 +150,10 @@ spec:
              protocol: TCP
 ---
 # Egress for the review-bot rotator. Its CronJob has two steps: the init step
-# mints review-bot's PAT against gitea (gitea :3000), the main step upserts the
+# mints review-bot's PAT against gitea (apps :3000), the main step upserts the
 # Woodpecker org secret against the woodpecker server (woodpecker :8000). Both run
 # under the same pod labels, so one egress policy covers both hops. Complements
-# gitea-allow-review-bot-rotator (gitea) + woodpecker-allow-rotators (woodpecker).
+# gitea-allow-review-bot-rotator (apps) + woodpecker-allow-rotators (woodpecker).
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -177,7 +167,7 @@ spec:
  egress:
    - toEndpoints:
        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": gitea
+            "k8s:io.kubernetes.pod.namespace": apps
            app.kubernetes.io/name: gitea
      toPorts:
        - ports:
@@ -0,0 +1,23 @@
+# OpenBao policy: netbird-proxy-services
+#
+# The reverse-proxy-services controller (Deployment netbird-proxy-services in
+# the openbao namespace) reads the NetBird PAT on every reconcile pass and
+# calls the management API with it. Read-only on that one path; it shares the
+# bootstrap credential with rotator-netbird but not that role's PATCH rights.
+#
+# NOT applied by Flux. Apply ONCE with an admin token:
+#
+#   bao policy write netbird-proxy-services kubernetes/infrastructure/openbao/policies/netbird-proxy-services.hcl
+#   bao write auth/kubernetes/role/netbird-proxy-services \
+#     bound_service_account_names=netbird-proxy-services \
+#     bound_service_account_namespaces=openbao \
+#     policies=netbird-proxy-services ttl=15m
+#
+# The PAT itself is the one rotator-netbird already uses
+# (homelab/infrastructure/secret-rotators-bootstrap/netbird, key `pat`).
+#
+# Do NOT set token_no_default_policy=true (kv-v2 preflight needs the default policy).
+
+path "homelab/data/infrastructure/secret-rotators-bootstrap/netbird" {
+  capabilities = ["read"]
+}
@@ -1,24 +0,0 @@
-# OpenBao policy: netbird-service-sync
-#
-# The controller that syncs public Ingresses into NetBird reverse-proxy services
-# (Deployment netbird-service-sync in the netbird-service-sync namespace) reads
-# the NetBird PAT on every reconcile pass and calls the management API with it.
-# Read-only on that one path; it shares the bootstrap credential with
-# rotator-netbird but not that role's PATCH rights.
-#
-# NOT applied by Flux. Apply ONCE with an admin token:
-#
-#   bao policy write netbird-service-sync kubernetes/infrastructure/openbao/policies/netbird-service-sync.hcl
-#   bao write auth/kubernetes/role/netbird-service-sync \
-#     bound_service_account_names=netbird-service-sync \
-#     bound_service_account_namespaces=netbird-service-sync \
-#     policies=netbird-service-sync ttl=15m
-#
-# The PAT itself is the one rotator-netbird already uses
-# (homelab/infrastructure/secret-rotators-bootstrap/netbird, key `pat`).
-#
-# Do NOT set token_no_default_policy=true (kv-v2 preflight needs the default policy).
-
-path "homelab/data/infrastructure/secret-rotators-bootstrap/netbird" {
-  capabilities = ["read"]
-}
@@ -6,7 +6,7 @@
 # newest. A token that fails verification is deleted and the run aborts without
 # storing, so Flux is never stranded.
 #
-# gitea is reached at the in-cluster Service gitea.gitea.svc:3000 — the public
+# gitea is reached at the in-cluster Service gitea.apps.svc:3000 — the public
 # name hairpins off the ingress LB from a pod. Needs BOTH netpol halves
 # (gitea-allow-flux-rotator + rotator-gitea-flux-egress).
 #
@@ -76,7 +76,7 @@ spec:
                - name: BAO_PATH
                  value: homelab/infrastructure/flux-git
                - name: GITEA_URL
-                  value: http://gitea.gitea.svc.cluster.local:3000
+                  value: http://gitea.apps.svc.cluster.local:3000
                - name: GITEA_VERIFY_REPO
                  value: k.renner/homelab
                - name: GITEA_SCOPES
@@ -24,7 +24,7 @@
 # synced. Quarterly cadence + backoffLimit:1 makes a two-cycle failure unlikely,
 # but a failed sync should be fixed before the next run rather than left.
 #
-# gitea is reached in-cluster at gitea.gitea.svc:3000, woodpecker at
+# gitea is reached in-cluster at gitea.apps.svc:3000, woodpecker at
 # woodpecker.woodpecker.svc:8000 (it moved out of `apps` in the namespace
 # migration — see kubernetes/apps/woodpecker/MIGRATION-namespace.md). Needs
 # the netpol halves: gitea-allow-review-bot-rotator + woodpecker-allow-rotators
@@ -99,7 +99,7 @@ spec:
                - name: BAO_PATH
                  value: homelab/infrastructure/review-bot
                - name: GITEA_URL
-                  value: http://gitea.gitea.svc.cluster.local:3000
+                  value: http://gitea.apps.svc.cluster.local:3000
                # Private repo review-bot collaborates on: the pull check is a
                # real access verification (git-upload-pack on a PRIVATE repo
                # needs a token with access), not the "any valid token" weakness
@@ -225,8 +225,15 @@ metadata:
  labels:
    app.kubernetes.io/part-of: homelab-backup
 spec:
-  # Daily at 07:15 local. Every PVC in the shared `apps` namespace (gatus-data).
-  # No CNPG cluster runs here, so no labelSelector exclusion is needed.
+  # Daily at 07:15 local (next free stagger slot after home-assistant-daily
+  # at 06:45). Covers every stateful workload in the shared `apps`
+  # namespace — currently Gitea (data-gitea-0, the Flux GitOps source of
+  # truth) and Woodpecker (data-woodpecker-server-0), plus gatus-data.
+  # Added 2026-07-14 (issue #186): the apps namespace had no Velero
+  # schedule at all, so the in-cluster Gitea/Woodpecker PVCs migrated from
+  # the legacy LXCs (see MIGRATION-gitea-woodpecker.md) were unprotected.
+  # No CNPG cluster runs in this namespace (both Gitea and Woodpecker use
+  # SQLite), so no labelSelector exclusion is needed.
  schedule: "15 7 * * *"
  useOwnerReferencesInBackup: false
  template:
@@ -240,26 +247,6 @@ spec:
 ---
 apiVersion: velero.io/v1
 kind: Schedule
-metadata:
-  name: gitea-daily
-  namespace: velero
-  labels:
-    app.kubernetes.io/part-of: homelab-backup
-spec:
-  # Daily at 07:45 local. data-gitea-0 (SQLite, repos, LFS, packages).
-  schedule: "45 7 * * *"
-  useOwnerReferencesInBackup: false
-  template:
-    includedNamespaces:
-      - gitea
-    includedResources:
-      - persistentvolumeclaims
-    storageLocation: default
-    ttl: 720h0m0s
-    snapshotMoveData: true
---
-apiVersion: velero.io/v1
-kind: Schedule
 metadata:
  name: trmnl-daily
  namespace: velero
@@ -96,7 +96,7 @@ spec:
        # that traffic is always a pod IP — collapsing all external clients
        # to one source. The NetBird reverse-proxy services are TLS
        # passthrough and carry the WAN client address in a PROXY protocol
-        # v2 header (options.proxy_protocol, set by netbird-service-sync);
+        # v2 header (options.proxy_protocol, set by netbird-proxy-services);
        # X-Forwarded-For stays trusted for HTTP-mode services. Both are
        # accepted from the pod CIDRs only; connections without a header
        # (direct LAN/mesh) keep their RemoteAddr.
@@ -58,12 +58,6 @@ machine:
      imageGCHighThresholdPercent: 70
      imageGCLowThresholdPercent: 60
 cluster:
-  # etcd peers on node0, VLAN 46 (#576). Pinned: Talos never updates an
-  # existing member's peer URLs, so changing this subnet means leave + rejoin
-  # per member (talosctl etcd leave, reboot).
-  etcd:
-    advertisedSubnets:
-      - 10.2.46.0/24
  # controlPlane.endpoint is NOT here: `talosctl gen config` takes it as its
  # second argument, and bootstrap.sh already passes https://k8s.renner.uno:6443
  # there. Setting it again in this patch restated the same value in a second
@@ -17,8 +17,6 @@ machine:
    # pod0 is a closed L2 fabric between the three nodes: statically
    # addressed, no gateway, nothing to learn from an RA.
    net.ipv6.conf.pod0.accept_ra: "0"
-    # node0 is closed the same way.
-    net.ipv6.conf.node0.accept_ra: "0"
    # ingress0 keeps RAs, at the default accept_ra of 2: an IPv6 default
    # router is a link-local address learned only from the RA, and with
    # net.ipv6.conf.all.forwarding=1 — which Cilium sets — Linux ignores RAs
@@ -124,8 +122,8 @@ kind: LinkConfig
 name: uplink
 up: true
 ---
-# Management, VLAN 40: world↔node. The API VIP, admin access to the nodes, and
-# node egress (DNS, NTP, image pulls). Node↔node traffic is on node0 (#576).
+# Management, VLAN 40. Carries the node IP, etcd, the API and Ceph's public
+# network.
 apiVersion: v1alpha1
 kind: VLANConfig
 name: mgmt0
@@ -179,19 +177,6 @@ addresses:
  - address: 10.2.48.11/24
  - address: fd02:48::11/64
 ---
-# Node network, VLAN 46: traffic among the three nodes themselves (#576) — the
-# node IP, etcd, apiserver↔kubelet. Closed like pod0: statically addressed, no
-# gateway, never routed via the UDM.
-apiVersion: v1alpha1
-kind: VLANConfig
-name: node0
-vlanID: 46
-parent: uplink
-up: true
-addresses:
-  - address: fd02:46::11/64
-  - address: 10.2.46.11/24
---
 # Ingress network, VLAN 47. World-to-pod: the BGP session, the next hop for
 # every advertised LoadBalancer VIP, and the masquerade source for pod egress.
 # Publicly routed, which is what separates it from pod0.
@@ -16,7 +16,6 @@ machine:
    # ingress0 keeps RAs: it learns its IPv6 router and its address from them,
    # and only the default route is held back — see k8s-1.yaml.
    net.ipv6.conf.pod0.accept_ra: "0"
-    net.ipv6.conf.node0.accept_ra: "0"
    net.ipv6.conf.ingress0.accept_ra_defrtr: "0"
    # Answer ARP only on the link that owns the address — see k8s-1.yaml (#793).
    net.ipv4.conf.all.arp_ignore: "1"
@@ -83,7 +82,7 @@ kind: LinkConfig
 name: uplink
 up: true
 ---
-# Management, VLAN 40: world↔node — see k8s-1.yaml.
+# Management, VLAN 40. Node IP, etcd, the API and Ceph's public network.
 apiVersion: v1alpha1
 kind: VLANConfig
 name: mgmt0
@@ -123,17 +122,6 @@ addresses:
  - address: 10.2.48.12/24
  - address: fd02:48::12/64
 ---
-# Node network, VLAN 46 — see k8s-1.yaml.
-apiVersion: v1alpha1
-kind: VLANConfig
-name: node0
-vlanID: 46
-parent: uplink
-up: true
-addresses:
-  - address: fd02:46::12/64
-  - address: 10.2.46.12/24
---
 # Ingress network, VLAN 47. World-to-pod, publicly routed, statically
 # addressed — see k8s-1.yaml for why it is not leased.
 apiVersion: v1alpha1
@@ -12,7 +12,6 @@ machine:
    # ingress0 keeps RAs: it learns its IPv6 router and its address from them,
    # and only the default route is held back — see k8s-1.yaml.
    net.ipv6.conf.pod0.accept_ra: "0"
-    net.ipv6.conf.node0.accept_ra: "0"
    net.ipv6.conf.ingress0.accept_ra_defrtr: "0"
    # Answer ARP only on the link that owns the address — see k8s-1.yaml (#793).
    net.ipv4.conf.all.arp_ignore: "1"
@@ -110,17 +109,6 @@ addresses:
  - address: 10.2.48.13/24
  - address: fd02:48::13/64
 ---
-# Node network, VLAN 46 — see k8s-1.yaml.
-apiVersion: v1alpha1
-kind: VLANConfig
-name: node0
-vlanID: 46
-parent: uplink
-up: true
-addresses:
-  - address: fd02:46::13/64
-  - address: 10.2.46.13/24
---
 # Ingress network, VLAN 47. World-to-pod, publicly routed, statically
 # addressed — see k8s-1.yaml for why it is not leased.
 apiVersion: v1alpha1
@@ -7,15 +7,19 @@
 # part of the config that could not be true anywhere but here.
 machine:
  kubelet:
-    # The node IP lives on node0, VLAN 46: the closed node↔node network (#576).
-    # Both families are listed so the Node object carries an IPv6 InternalIP at
-    # all; without one Cilium detects the node's IPv6 itself and picks a SLAAC
-    # address from the dynamic provider prefix (#789). Talos picks one address
-    # per family, IPv4 first, whatever the order here.
+    # Constrain kubelet's auto-picked node IP to the mgmt LAN. Without this,
+    # kubelet picks the first non-loopback IP, which could land on the v30iot
+    # NIC (ens19, 10.2.30.0/24). Control-plane traffic and hostNetwork pod IPs
+    # must stay on mgmt LAN.
+    # fd40::/64 is the mgmt LAN ULA, and it is listed so the Node object carries
+    # an IPv6 InternalIP at all. Without one, Cilium falls back to detecting the
+    # node's IPv6 from mgmt0 and picks the SLAAC address from the dynamic
+    # provider prefix, which it then probes until the agent restarts (#789).
+    # The GUA is not a control-plane address: BGP peers on fd40::/64 too.
    nodeIP:
      validSubnets:
-        - fd02:46::/64
-        - 10.2.46.0/24
+        - 10.2.40.0/24
+        - fd40::/64
  # The UDM on the ingress segment. Published here rather than as a route
  # because bird owns table 47 and originates the default from it; this is the
  # one place the address is stated.
@@ -1,30 +0,0 @@
-#!/bin/sh
-# Turn the TypeSafe picker's probability distribution into one model id.
-#
-# The judgment (how well each catalog model fits the task) comes from the
-# model; the policy lives here, in code: among the candidates whose probability
-# is within MARGIN of the best one, take the most recently released. Several
-# same-family models (Sonnet 4.5 / 4.6 / 5) split the probability for a
-# mid-weight task, and the newest of a comparable set is the one to run.
-#
-# Usage: choose-model.sh <catalog-table-file> < <systemone-response.json>
-#   The table is fetch-models.sh --table output: id \t name \t released=YYYY-MM-DD ...
-#   Prints the chosen id, or nothing when the answer is NONE / unusable.
-# Env: CHOOSE_MODEL_MARGIN (default 0.7): candidate if p >= MARGIN * p_best.
-
-set -eu
-TABLE_FILE="${1:?usage: choose-model.sh <catalog-table-file> < response.json}"
-MARGIN="${CHOOSE_MODEL_MARGIN:-0.7}"
-
-jq -r --rawfile table "$TABLE_FILE" --argjson margin "$MARGIN" '
-  ($table | split("\n") | map(select(length > 0) | split("\t")
-     | {key: .[0], value: ((.[2:] | map(select(startswith("released="))) | .[0] // "released=") | ltrimstr("released="))})
-   | from_entries) as $released
-  | (.answers.model.probabilities // {}) | to_entries
-  | map(select(.key != "NONE")) | sort_by(-.value)
-  | if length == 0 then empty
-    else (.[0].value) as $best
-      | map(select(.value >= $margin * $best))
-      | sort_by([($released[.key] // ""), .value])
-      | .[-1].key
-    end' 2>&1
@@ -33,42 +33,6 @@ none() { log "$1"; exit 0; }            # emit nothing -> caller uses CLI defaul
 TABLE="$(sh "$HERE/fetch-models.sh" --table || true)"
 [ -n "$TABLE" ] || none "no catalog available — caller will use the CLI default model"

-# First choice: one TypeSafe (System One) Choice over the catalog. The task and
-# the catalog rows are state, every model id is an option with its catalog row
-# as the criterion, and the answer is typed — no prompt, no JSON parsing, and a
-# request that takes a fraction of a second instead of a claude run. The id is
-# still validated against the pristine catalog. Falls through to the claude
-# picker when the key is absent or the request fails.
-if [ -n "${TYPESAFE_API_KEY:-}" ]; then
-  REQ="$(printf '%s\n' "$TABLE" | jq -R -s --arg task "$GUIDANCE" '
-    split("\n") | map(select(length > 0) | split("\t") | {id: .[0], name: .[1], info: (.[2:] | join(", "))})
-    | {model: "jev-latest",
-       state: {task: $task, models: .},
-       questions: {model: {
-         type: "choice",
-         instructions: "Which model in `models` should run `task`? Match the model to the task: not the largest or newest flagship for trivial or mechanical work, not a minimal model for hard, multi-step or security-sensitive work; prefer a newer model when otherwise comparable. Consider every listed model, including unfamiliar ones. Pick NONE only if no listed model fits.",
-         criteria: ((map({key: .id, value: "\(.name); \(.info)"}) | from_entries) + {NONE: "No listed model fits the task"})}}}')"
-  if [ -n "${PICK_MODEL_TYPESAFE_DRYRUN:-}" ]; then printf '%s\n' "$REQ"; exit 0; fi
-  RESP="$(printf '%s' "$REQ" | curl -sS --max-time 30 -X POST https://api.typesafe.ai/v1/systemone \
-           -H "Authorization: Bearer $TYPESAFE_API_KEY" -H 'Content-Type: application/json' --data-binary @- || true)"
-  # Policy in code (choose-model.sh): among candidates within a margin of the
-  # best probability, the most recently released wins. Same-family models split
-  # the probability for mid-weight tasks (live catalog: Sonnet 4.5 chosen at
-  # 0.23 over Sonnet 4.6).
-  TABLE_FILE="$(mktemp)"
-  printf '%s\n' "$TABLE" > "$TABLE_FILE"
-  CHOICE="$(printf '%s' "$RESP" | sh "$HERE/choose-model.sh" "$TABLE_FILE" | head -1)"
-  rm -f "$TABLE_FILE"
-  TOP="$(printf '%s' "$RESP" | jq -r '(.answers.model.probabilities // {}) | to_entries | sort_by(-.value) | .[0:4] | map("\(.key)=\(.value)") | join(" ")' 2>&1 | head -1)"
-  VALID="$(printf '%s\n' "$TABLE" | sh "$HERE/valid-model.sh" "$CHOICE")"
-  if [ -n "$VALID" ]; then
-    log "typesafe chose '$VALID' (top: ${TOP:-?}) for: $GUIDANCE"
-    printf '%s\n' "$VALID"
-    exit 0
-  fi
-  log "typesafe picker returned '${CHOICE:-<empty>}' (rejected, NONE, or request failed) — falling back to the claude picker"
-fi
-
 PROMPT="$(cat <<EOF
 You are a model-selection agent for an automated CI job. From the models
 currently available (listed below with their capabilities), choose the single
@@ -84,40 +84,9 @@ else
  printf 'FAIL  recorded fixture: opus=[%s] haiku=[%s]\n' "$opusline" "$haikuline"; fails=$((fails + 1))
 fi

-
-# TypeSafe path of pick-model.sh: the request offers exactly the catalog ids plus
-# NONE as options, carries the task as state, and never sends anything else.
-printf '%s' '{"data":[{"type":"model","id":"claude-opus-5","display_name":"Claude Opus 5","created_at":"2026-07-24T00:00:00Z","max_input_tokens":1000000,"max_tokens":128000},{"type":"model","id":"claude-haiku-4-5-20251001","display_name":"Claude Haiku 4.5","created_at":"2025-10-15T00:00:00Z","max_input_tokens":200000,"max_tokens":64000}],"has_more":false}' > "$FX"
-req="$(FETCH_MODELS_BODY_FILE="$FX" TYPESAFE_API_KEY=dry PICK_MODEL_TYPESAFE_DRYRUN=1 sh "$HERE/pick-model.sh" "a task; with \"quotes\" and $ signs" 2>/dev/null || true)"
-keys="$(printf '%s' "$req" | jq -r '.questions.model.criteria | keys | join(",")' 2>/dev/null || true)"
-task="$(printf '%s' "$req" | jq -r '.state.task' 2>/dev/null || true)"
-if [ "$keys" = "NONE,claude-haiku-4-5-20251001,claude-opus-5" ] && [ "$task" = 'a task; with "quotes" and $ signs' ]; then
-  printf 'ok    typesafe request offers catalog ids + NONE and carries the task verbatim\n'
-else
-  printf 'FAIL  typesafe request: keys [%s] task [%s]\n' "$keys" "$task"; fails=$((fails + 1))
-fi
-
-# choose-model.sh: newest among comparable candidates, best otherwise, NONE -> nothing.
-TB="$(mktemp)"
-printf '%s\n' 'claude-sonnet-4-5	Claude Sonnet 4.5	released=2025-09-29	context=200000' \
-              'claude-sonnet-4-6	Claude Sonnet 4.6	released=2026-02-17	context=200000' \
-              'claude-opus-5	Claude Opus 5	released=2026-07-24	context=1000000' \
-              'claude-haiku-4-5	Claude Haiku 4.5	released=2025-10-15	context=200000' > "$TB"
-choose() { printf '%s' "$1" | sh "$HERE/choose-model.sh" "$TB" || true; }
-got="$(choose '{"answers":{"model":{"probabilities":{"claude-sonnet-4-5":0.30,"claude-sonnet-4-6":0.25,"claude-opus-5":0.10,"NONE":0.05}}}}')"
-if [ "$got" = "claude-sonnet-4-6" ]; then printf 'ok    newer sibling within margin wins\n'; else printf 'FAIL  comparable: got [%s]\n' "$got"; fails=$((fails + 1)); fi
-got="$(choose '{"answers":{"model":{"probabilities":{"claude-opus-5":0.90,"claude-haiku-4-5":0.05,"claude-sonnet-4-6":0.04,"NONE":0.01}}}}')"
-if [ "$got" = "claude-opus-5" ]; then printf 'ok    clear best is kept\n'; else printf 'FAIL  clear best: got [%s]\n' "$got"; fails=$((fails + 1)); fi
-got="$(choose '{"answers":{"model":{"probabilities":{"claude-haiku-4-5":0.60,"claude-sonnet-4-5":0.35,"NONE":0.05}}}}')"
-if [ "$got" = "claude-haiku-4-5" ]; then printf 'ok    older best outside margin is kept\n'; else printf 'FAIL  margin: got [%s]\n' "$got"; fails=$((fails + 1)); fi
-got="$(choose '{"answers":{"model":{"probabilities":{"NONE":1.0}}}}')"
-if [ -z "$got" ]; then printf 'ok    NONE yields nothing\n'; else printf 'FAIL  NONE: got [%s]\n' "$got"; fails=$((fails + 1)); fi
-rm -f "$TB"
-
 if [ "$fails" -eq 0 ]; then
  echo "All model-selection tests passed."
 else
  echo "$fails test(s) FAILED."
  exit 1
 fi
-