feat(wiki): API key "paperclip" for the Paperclip agents

Second named key in apps/ai/wiki-api-keys (OpenBao version 4), mapped to
Auth__ApiKeys__paperclip; writes through the API are attributed to it.
Reloader rolls the pod when the Secret changes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.woodpecker/build-ci-images.yml

@@ -377,37 +377,6 @@ steps:
           --destination gitea.renner.uno/gitea_admin/netbird-service-sync:$TAG \
           --destination gitea.renner.uno/gitea_admin/netbird-service-sync:latest
 
-  # wiki-index: embedding index over the Notes repo's wiki/, fed from Gitea and
-  # queried by ~/Notes/bin/wiki_rank.py. Runtime artifact like netbird-service-sync.
-  - name: build-wiki-index
-    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
-    directory: ci/images/wiki-index
-    depends_on: []
-    when:
-      - event: deployment
-      - event: push
-        path: ["ci/images/wiki-index/**", ".woodpecker/build-ci-images.yml"]
-    environment:
-      GITEA_USER: gitea_admin
-      GITEA_TOKEN:
-        from_secret: ci_images_token
-    commands:
-      - mkdir -p /kaniko/.docker
-      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
-      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
-      - TAG=$(date +%Y-%m-%d)
-      # Also a per-commit tag: several builds a day (branch pushes and the
-      # merge) all rewrite the dated tag, and the deployment pin raced them
-      # on 2026-09-20. The commit tag is immutable and needs no digest lookup.
-      - SHORT=$(printf '%s' "$CI_COMMIT_SHA" | cut -c1-8)
-      - |
-        /kaniko/executor \
-          --context . \
-          --dockerfile Containerfile \
-          --destination gitea.renner.uno/gitea_admin/wiki-index:$TAG \
-          --destination gitea.renner.uno/gitea_admin/wiki-index:$TAG-$SHORT \
-          --destination gitea.renner.uno/gitea_admin/wiki-index:latest
-
   # bird: BGP daemon for the pod-network mesh over pod0 (#576). Runtime
   # artifact like heating-can; same registry so the audit tracks it.
   - name: build-bird

.woodpecker/deploy-netbird-server.yml

@@ -4,9 +4,6 @@ when:
     branch: master
     path:
       - "ansible/roles/netbird-server/**"
-      # install-netbird-server.yml also applies the netbird-proxy-watchdog role,
-      # so changes to it must redeploy this host too.
-      - "ansible/roles/netbird-proxy-watchdog/**"
       - "ansible/plays/install-netbird-server.yml"
       - ".woodpecker/deploy-netbird-server.yml"
   - event: deployment

.woodpecker/wiki-maintenance.yml

@@ -1,12 +1,13 @@
 # Nightly wiki maintenance for the Notes vault (k.renner/notes), replacing the
-# workstation's wiki-maintenance.timer: distill the raw/ backlog into wiki/,
-# then audit wiki/. Each agent is its own `claude` run, not a subagent of an
-# orchestrator, so nothing depends on background tasks in print mode (the
-# workstation job died on their 600 s ceiling). The pipeline commits and pushes
-# as Claude Bot; the push webhook then refreshes the wiki-index service.
+# workstation's wiki-maintenance and wiki-consolidate timers: distill the raw/
+# backlog into wiki/ (wiki-distill agent), audit wiki/ with the vault's own
+# script (structural checks, no model), then consolidate (wiki-consolidate
+# agent: verifies a cohort of notes against sources, repos and the live
+# cluster and edits them). The pipeline commits and pushes as Claude Bot; the
+# push webhook then refreshes the wiki service.
 #
-# The agents and their retrieval scripts address the vault as ~/Notes, so each
-# agent step links $HOME/Notes to the checkout instead of rewriting them.
+# The agents address the vault as ~/Notes and the repos as ~/source/<repo>, so
+# each agent step links those into the workspace instead of rewriting them.
 when:
   - event: cron
     cron: wiki-maintenance
@@ -30,6 +31,27 @@ steps:
         git -c http.extraheader="AUTHORIZATION: token $$TOKEN" \
           clone --depth 50 --branch main https://gitea.renner.uno/k.renner/notes.git notes
         echo "raw backlog: $$(ls notes/raw/*.md | grep -v _index.md | wc -l) file(s)"
+        # Full history for the consolidate agent's `git log` checks; the
+        # workspace clone is shallow and tree-filtered.
+        mkdir -p sources
+        git clone --quiet https://gitea.renner.uno/k.renner/homelab.git sources/homelab
+        git -c http.extraheader="AUTHORIZATION: token $$TOKEN" \
+          clone --quiet https://gitea.renner.uno/k.renner/homeassistant.git sources/homeassistant
+
+  - name: fetch-diag
+    # Read-only live-cluster access for the consolidate agent, same mechanism
+    # as issue-fix.yml: ./.ci-diag/kubectl plus a 1h ci-diagnostics token.
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-09-08
+    environment:
+      SOPS_AGE_KEY:
+        from_secret: sops_age_key
+      S3_ACCESS_KEY_ID:
+        from_secret: hetzner_s3_access_key
+      S3_SECRET_ACCESS_KEY:
+        from_secret: hetzner_s3_secret_key
+    commands:
+      - bash scripts/ci/fetch-kubeconfig.sh
+      - bash scripts/ci/make-diag-kubeconfig.sh
 
   - name: distill
     image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
@@ -44,24 +66,36 @@ steps:
     commands:
       - |
         set -eu
+        # An empty queue must not start the agent: its startup context alone
+        # costs more than the whole audit.
+        BACKLOG=$$(ls notes/raw/*.md | grep -v _index.md | wc -l)
+        if [ "$$BACKLOG" -eq 0 ]; then
+          echo "distill: raw/ is empty, skipping the agent"
+          exit 0
+        fi
         ln -sfn "$$PWD/notes" "$$HOME/Notes"
         mkdir -p "$$HOME/.config/wiki-index"
         printf '%s' "$$WIKI_INDEX_BASIC_AUTH" | tr -d '\r\n' > "$$HOME/.config/wiki-index/basic-auth"
         chmod 600 "$$HOME/.config/wiki-index/basic-auth"
         "$$HOME/Notes/bin/wiki_rank.py" --probe-index
-      - |
-        set -eu
         MODEL=$$(sh scripts/ci/pick-model.sh "distill raw source notes into atomic wiki notes: read sources, check the wiki for existing coverage, write or merge notes; careful writing, moderate reasoning")
         if [ -n "$$MODEL" ]; then echo "distill: selected model $$MODEL"; else echo "distill: using the CLI default model"; fi
         cd notes
         cat ../ci/agents/wiki-maintenance/distill.md | claude $${MODEL:+--model $$MODEL} \
           --agent wiki-distill \
           --permission-mode acceptEdits \
-          --allowedTools "Read,Edit,Write,Glob,Grep,Bash(/root/Notes/bin/wiki_rank.py:*),Bash(/root/Notes/bin/wiki_ask.py:*),Bash(mv /root/Notes/raw/:*),Bash(mkdir -p /root/Notes/:*)" \
+          --allowedTools "Read,Edit,Write,Glob,Grep,Bash(/root/Notes/bin/wiki_rank.py:*),Bash(/root/Notes/bin/wiki_ask.py:*),Bash(mv /root/Notes/raw/:*),Bash(mkdir -p /root/Notes/:*),Bash(~/Notes/bin/wiki_rank.py:*),Bash(~/Notes/bin/wiki_ask.py:*),Bash(mv ~/Notes/raw/:*),Bash(mkdir -p ~/Notes/:*)" \
           --settings ../ci/agents/wiki-maintenance/settings.json \
           -p
 
   - name: audit
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    pull: true
+    commands:
+      # Findings are report lines in output/, not a pipeline failure.
+      - python3 -B notes/bin/wiki_audit.py --vault "$$PWD/notes"
+
+  - name: consolidate
     image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
     pull: true
     environment:
@@ -75,20 +109,40 @@ steps:
       - |
         set -eu
         ln -sfn "$$PWD/notes" "$$HOME/Notes"
+        ln -sfn "$$PWD/sources" "$$HOME/source"
         mkdir -p "$$HOME/.config/wiki-index"
         printf '%s' "$$WIKI_INDEX_BASIC_AUTH" | tr -d '\r\n' > "$$HOME/.config/wiki-index/basic-auth"
         chmod 600 "$$HOME/.config/wiki-index/basic-auth"
-      - |
-        set -eu
-        MODEL=$$(sh scripts/ci/pick-model.sh "structural audit of ~1700 markdown notes: frontmatter completeness, broken links, orphans; mechanical checks, little reasoning")
-        if [ -n "$$MODEL" ]; then echo "audit: selected model $$MODEL"; else echo "audit: using the CLI default model"; fi
+        if [ -f .ci-diag/kubeconfig ]; then
+          ln -sf "$$PWD/.ci-diag/kubectl" /usr/local/bin/kubectl
+          export KUBECONFIG="$$PWD/.ci-diag/kubeconfig"
+        else
+          echo "consolidate: no ci-diag kubeconfig, live cluster checks unavailable"
+        fi
         cd notes
-        cat ../ci/agents/wiki-maintenance/audit.md | claude $${MODEL:+--model $$MODEL} \
-          --agent wiki-audit \
+        # JSON output: the agent's report and the run's cost come out of one
+        # record at the end instead of a 45-minute silent log.
+        # One source for the Bash allowlist: the settings file (run 10608: the
+        # agent writes ~/Notes, the rules carried only /root/Notes).
+        BASH_RULES=$$(jq -r '[.permissions.allow[] | select(startswith("Bash("))] | join(",")' ../ci/agents/wiki-maintenance/consolidate-settings.json)
+        rc=0
+        cat ../ci/agents/wiki-maintenance/consolidate.md | claude \
+          --agent wiki-consolidate \
           --permission-mode acceptEdits \
-          --allowedTools "Read,Write,Glob,Grep,Bash(/root/Notes/bin/wiki_rank.py:*),Bash(/root/Notes/bin/wiki_ask.py:*)" \
-          --settings ../ci/agents/wiki-maintenance/settings.json \
-          -p
+          --allowedTools "Read,Edit,Write,Glob,Grep,Agent,$$BASH_RULES" \
+          --settings ../ci/agents/wiki-maintenance/consolidate-settings.json \
+          --output-format json \
+          -p > /tmp/consolidate.json || rc=$$?
+        # A killed or crashed claude leaves no valid JSON; report rc, not a jq error.
+        if [ -s /tmp/consolidate.json ] && jq -e . /tmp/consolidate.json > /dev/null; then
+          jq -r '.result // empty' /tmp/consolidate.json
+          jq -c '{duration_ms, num_turns, total_cost_usd, is_error}' /tmp/consolidate.json
+        else
+          echo "consolidate: no result record (exit $$rc)"; head -c 2000 /tmp/consolidate.json || true
+        fi
+        echo "consolidate: git log --oneline of the run:"
+        git log --oneline origin/main..HEAD
+        exit $$rc
 
   - name: push-notes
     image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
@@ -102,7 +156,13 @@ steps:
         cd notes
         git config user.email "claude-bot@renner.uno"
         git config user.name "Claude Bot"
-        if git diff --quiet && git diff --cached --quiet && [ -z "$$(git ls-files --others --exclude-standard)" ]; then
+        # Only the vault content is committed; anything an agent leaves elsewhere
+        # in the checkout (run 10362: scratch scripts in the root) stays behind.
+        # The consolidate agent commits its own snapshots, so HEAD may already be
+        # ahead of origin/main with a clean tree.
+        git add -A -- wiki raw output .wiki-consolidation-state.json
+        git diff --cached --quiet || git commit -q -m "wiki maintenance $$(date -u +%F): distill + audit + consolidate (CI run $$CI_PIPELINE_NUMBER)"
+        if [ "$$(git rev-list --count origin/main..HEAD)" -eq 0 ]; then
           echo "wiki-maintenance: no changes"
           exit 0
         fi
@@ -112,13 +172,11 @@ steps:
         # leaves the PR open for a human and fails the run.
         BRANCH="wiki-maintenance/$$(date -u +%F)-$$CI_PIPELINE_NUMBER"
         git checkout -q -b "$$BRANCH"
-        git add -A
-        git commit -q -m "wiki maintenance $$(date -u +%F): distill + audit (CI run $$CI_PIPELINE_NUMBER)"
         TOKEN=$$(printf '%s' "$$WIKI_BOT_TOKEN" | tr -d '\r\n')
         git -c http.extraheader="AUTHORIZATION: token $$TOKEN" push origin "HEAD:$$BRANCH"
         API="https://gitea.renner.uno/api/v1/repos/k.renner/notes"
         jq -n --arg title "wiki maintenance $$(date -u +%F) (CI run $$CI_PIPELINE_NUMBER)" \
-              --arg body "Nightly distill + audit. Merged by the pipeline; open only if the merge failed." \
+              --arg body "Nightly distill + audit + consolidate. Merged by the pipeline; open only if the merge failed." \
               --arg head "$$BRANCH" '{title: $$title, body: $$body, head: $$head, base: "main"}' > /tmp/pr.json
         code=$$(curl -s -o /tmp/pr-resp.json -w '%{http_code}' -X POST \
           -H "Authorization: token $$TOKEN" -H "Content-Type: application/json" --data @/tmp/pr.json "$$API/pulls")

ansible/plays/install-netbird-proxy.yml

@@ -1,5 +1,5 @@
 ---
-# Deploy a NetBird reverse-proxy HA cluster member (a second proxy host).
+# Deploy the NetBird reverse-proxy HA cluster members (the public edge).
 # Usage: ansible-playbook -i inventory/ plays/install-netbird-proxy.yml
 #
 # Prerequisites:
@@ -7,12 +7,11 @@
 #   listed under [netbird_proxy] in inventory/pve_hosts.yml. Docker is
 #   installed by the (Arch-aware) docker-install role.
 # - DNS A/AAAA for the host's own name (e.g. proxy-1.renner.uno) -> its IP.
-# - Uses the existing vault_netbird_proxy_token (shared with VPS-1) — no new
-#   token to generate; a shared token + same NB_PROXY_DOMAIN forms the cluster.
-# - AFTER deploy + verify: add this host's IP to the proxy domain so traffic
-#   round-robins across the cluster. Repoint proxy.renner.uno away from its
-#   CNAME to netbird.renner.uno (management host) to A/AAAA records listing
-#   BOTH proxy IPs (VPS-1 + this host).
+# - Uses the existing vault_netbird_proxy_token (shared by every member) — no
+#   new token to generate; a shared token + same NB_PROXY_DOMAIN forms the
+#   cluster.
+# - AFTER deploy + verify: add this host's A/AAAA to proxy.renner.uno so
+#   traffic round-robins across the cluster.
 
 - name: Deploy NetBird reverse-proxy cluster member
   hosts: netbird_proxy

ansible/plays/install-netbird-server.yml

@@ -18,4 +18,3 @@
     - common
     - docker-install
     - netbird-server
-    - netbird-proxy-watchdog

ansible/plays/rotate-netbird-secrets.yml

@@ -43,10 +43,10 @@
 #
 # WHAT IS NOT, and must not be added:
 #
-#   vault_netbird_proxy_token    LOOKS symmetric — it is in proxy.env on both
-#                                the server and the proxies, all Ansible
-#                                templates — but the management server does not
-#                                validate it from any of them. It is registered
+#   vault_netbird_proxy_token    LOOKS symmetric — it is in proxy.env on the
+#                                proxies, an Ansible template — but the
+#                                management server does not validate it from
+#                                any file. It is registered
 #                                in the management DATABASE. Rotating it changes
 #                                only what the proxies present, so every proxy
 #                                is locked out: "proxy auth failed: too many

ansible/roles/netbird-proxy-watchdog/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-# Self-healing watchdog for the NetBird reverse proxy (VPS-1 and proxy-1).
+# Self-healing watchdog for the NetBird reverse proxy on the proxy hosts.
 #
 # Why it exists: the proxy's embedded NetBird client pins each proxied
 # domain's route to a specific routing-peer identity. The netbird-ingress
@@ -20,9 +20,7 @@ netbird_watchdog_probe_hosts:
   - home.renner.uno
   - immich.renner.uno
 
-# Address the probe connects to. 127.0.0.1 reaches the local proxy on both
-# members: VPS-1 routes it via Traefik's HostSNI(*) TCP passthrough, proxy-1
-# binds :443 directly.
+# Address the probe connects to. The proxy binds :443 on the host directly.
 netbird_watchdog_probe_address: 127.0.0.1
 
 netbird_watchdog_container: netbird-proxy

ansible/roles/netbird-proxy-watchdog/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 # Deploys the reverse-proxy watchdog (see defaults/main.yml for why).
 
-- name: Ensure curl is installed (probe dependency; proxy-1 is Arch, VPS-1 Debian)
+- name: Ensure curl is installed (probe dependency)
   ansible.builtin.package:
     name: curl
     state: present

ansible/roles/netbird-proxy/defaults/main.yml

@@ -1,8 +1,8 @@
 ---
 # NetBird reverse-proxy HA cluster member (proxy-only host, e.g. proxy-1).
-# Joins the same proxy cluster as the VPS-1 proxy: identical NB_PROXY_DOMAIN
-# + the same token. NetBird load-balances/fails the cluster over via DNS
-# round-robin on the proxy domain (see plays/install-netbird-proxy.yml).
+# Every member uses the same NB_PROXY_DOMAIN + token. NetBird load-balances/
+# fails the cluster over via DNS round-robin on the proxy domain (see
+# plays/install-netbird-proxy.yml).
 
 # MUST match the netbird-server role's netbird_version — the reverse-proxy
 # release line has to track the management server it enrolls against.
@@ -11,11 +11,13 @@ netbird_version: "0.73.2"
 # Management server this proxy enrolls against (public API, TLS).
 netbird_server_host: netbird.renner.uno
 
-# Proxy domain — MUST be identical across every cluster member.
+# Proxy domain — MUST be identical across every cluster member, and must NOT
+# be a subdomain of the management domain (netbird.renner.uno) per NetBird
+# docs (TLS/routing conflicts).
 netbird_proxy_domain: "proxy.renner.uno"
 
-# Reuse VPS-1's proxy token — a shared NB_PROXY_TOKEN across members with the
-# same NB_PROXY_DOMAIN is a valid HA cluster, so no separate token is needed.
+# A shared NB_PROXY_TOKEN across members with the same NB_PROXY_DOMAIN is a
+# valid HA cluster, so one token serves every member.
 netbird_proxy_token: "{{ vault_netbird_proxy_token }}"
 
 # Relay auth secret — MUST be identical across every relay instance and the

ansible/roles/netbird-proxy/templates/docker-compose.yml.j2

@@ -1,8 +1,7 @@
 # NetBird reverse-proxy — HA cluster member on a proxy-only host.
-# Just the reverse-proxy container, bound directly to :443. No Traefik:
-# unlike VPS-1 (where the proxy shares :443 with management/signal/relay via
-# SNI routing), this host runs nothing else, so the proxy owns the port and
-# terminates TLS + answers its own tls-alpn-01 ACME challenges directly.
+# Just the reverse-proxy container, bound directly to :443. No Traefik: the
+# proxy owns the port and terminates TLS + answers its own tls-alpn-01 ACME
+# challenges directly.
 services:
   proxy:
     image: netbirdio/reverse-proxy:{{ netbird_version }}

ansible/roles/netbird-server/defaults/main.yml

@@ -23,9 +23,3 @@ netbird_datastore_key: "{{ vault_netbird_datastore_key }}"
 
 # Relay secret for WebSocket relay authentication
 netbird_relay_secret: "{{ vault_netbird_relay_secret }}"
-
-# Reverse proxy configuration
-# IMPORTANT: Proxy domain must NOT be a subdomain of the management domain
-# (netbird.renner.uno) per NetBird docs - causes TLS/routing conflicts
-netbird_proxy_domain: "proxy.renner.uno"
-netbird_proxy_token: "{{ vault_netbird_proxy_token }}"

ansible/roles/netbird-server/handlers/main.yml

@@ -16,7 +16,3 @@
 - name: Restart netbird coturn
   ansible.builtin.shell: |
     cd /opt/netbird && docker compose up -d --force-recreate coturn
-
-- name: Restart netbird proxy
-  ansible.builtin.shell: |
-    cd /opt/netbird && docker compose up -d --force-recreate proxy

ansible/roles/netbird-server/tasks/main.yml

@@ -36,7 +36,6 @@
     - /opt/netbird/management
     - /opt/netbird/signal
     - /opt/netbird/letsencrypt
-    - /opt/netbird/proxy/certs
 
 - name: Deploy docker-compose.yml
   ansible.builtin.template:
@@ -59,23 +58,83 @@
     mode: "0644"
   notify: Restart netbird coturn
 
-- name: Deploy proxy.env
-  ansible.builtin.template:
-    src: proxy.env.j2
-    dest: /opt/netbird/proxy.env
-    mode: "0644"
-  notify: Restart netbird proxy
+# The public edge is the proxy hosts (plays/install-netbird-proxy.yml); this
+# host runs no reverse proxy. The tasks below remove the one it used to run,
+# its watchdogs first so they cannot restart it mid-removal, and can go once
+# the role has run against every host that ever carried it.
+- name: Check for reverse-proxy watchdog units
+  ansible.builtin.stat:
+    path: "/etc/systemd/system/{{ item }}"
+  loop:
+    - netbird-proxy-watchdog.timer
+    - netbird-proxy-flood-watchdog.service
+  register: _proxy_watchdog_units
+
+- name: Stop and disable reverse-proxy watchdogs
+  ansible.builtin.systemd:
+    name: "{{ item.item }}"
+    state: stopped
+    enabled: false
+  loop: "{{ _proxy_watchdog_units.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: item.stat.exists
+
+- name: Remove reverse-proxy watchdog units and scripts
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /etc/systemd/system/netbird-proxy-watchdog.timer
+    - /etc/systemd/system/netbird-proxy-watchdog.service
+    - /etc/systemd/system/netbird-proxy-flood-watchdog.service
+    - /usr/local/bin/netbird-proxy-watchdog
+    - /usr/local/bin/netbird-proxy-flood-watchdog
+    - /run/netbird-proxy-watchdog
+  register: _proxy_watchdog_files
+
+- name: Reload systemd after removing the watchdog units
+  ansible.builtin.systemd:
+    daemon_reload: true
+  when: _proxy_watchdog_files.changed
 
 - name: Pull NetBird container images
   ansible.builtin.shell: |
     cd /opt/netbird && docker compose pull
   changed_when: false
 
+# --remove-orphans removes containers of services no longer in the compose
+# file (the reverse proxy).
 - name: Start NetBird containers
   ansible.builtin.shell: |
-    cd /opt/netbird && docker compose up -d
+    cd /opt/netbird && docker compose up -d --remove-orphans
   register: docker_compose_result
-  changed_when: "'Started' in docker_compose_result.stdout or 'Creating' in docker_compose_result.stdout"
+  changed_when: >-
+    'Started' in docker_compose_result.stdout or
+    'Creating' in docker_compose_result.stdout or
+    'Removed' in docker_compose_result.stdout or
+    'Removed' in docker_compose_result.stderr
+
+- name: Remove reverse-proxy volumes
+  ansible.builtin.shell: |
+    set -eu
+    for v in netbird_netbird_proxy_certs netbird_netbird_proxy_data netbird_netbird_proxy_state; do
+      if [ -n "$(docker volume ls -q --filter "name=^${v}$")" ]; then
+        docker volume rm "$v"
+        echo "removed $v"
+      fi
+    done
+  register: _proxy_volumes
+  changed_when: "'removed' in _proxy_volumes.stdout"
+
+- name: Remove reverse-proxy config and state
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /opt/netbird/proxy.env
+    - /opt/netbird/proxy
+    - /opt/netbird/proxy-state
 
 # The management store has no cluster-side backup. Pulling one put a root
 # key on this host that the cluster held, and this server's own state is

ansible/roles/netbird-server/templates/docker-compose.yml.j2

@@ -187,10 +187,9 @@ services:
       - "traefik.http.routers.netbird-management.service=netbird-management"
       - "traefik.http.services.netbird-management.loadbalancer.server.port=33073"
       - "traefik.http.services.netbird-management.loadbalancer.server.scheme=h2c"
-      # gRPC reverse-proxy service — remote reverse-proxy instances (e.g.
-      # proxy-1) connect here via NB_PROXY_MANAGEMENT_ADDRESS=https://host:443.
-      # The local proxy uses management:33073 directly, so it never needed
-      # this route; remote ones get a 404 without it. Same backend (h2c 33073).
+      # gRPC reverse-proxy service — the proxy hosts (proxy-1, proxy-2)
+      # connect here via NB_PROXY_MANAGEMENT_ADDRESS=https://host:443 and get
+      # a 404 without it. Same backend (h2c 33073).
       - "traefik.http.routers.netbird-proxyservice.rule=Host(`{{ netbird_server_host }}`) && PathPrefix(`/management.ProxyService/`)"
       - "traefik.http.routers.netbird-proxyservice.entrypoints=websecure"
       - "traefik.http.routers.netbird-proxyservice.tls=true"
@@ -221,37 +220,6 @@ services:
         max-size: "500m"
         max-file: "2"
 
-  # Reverse Proxy Service (per docs.netbird.io/selfhosted/migration/enable-reverse-proxy)
-  proxy:
-    image: netbirdio/reverse-proxy:{{ netbird_version }}
-    container_name: netbird-proxy
-    restart: unless-stopped
-    networks:
-      - netbird
-    depends_on:
-      - management
-    env_file:
-      - ./proxy.env
-    volumes:
-      - netbird_proxy_certs:/certs
-      - /opt/netbird/proxy-state:/var/lib/netbird
-    labels:
-      - "traefik.enable=true"
-      - "traefik.tcp.routers.proxy-passthrough.entrypoints=websecure"
-      - "traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`)"
-      - "traefik.tcp.routers.proxy-passthrough.tls.passthrough=true"
-      - "traefik.tcp.routers.proxy-passthrough.service=proxy-tls"
-      - "traefik.tcp.routers.proxy-passthrough.priority=1"
-      - "traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443"
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
 networks:
   netbird:
     driver: bridge
-
-volumes:
-  netbird_proxy_certs:

ansible/roles/netbird-server/templates/proxy.env.j2

@@ -1,8 +0,0 @@
-NB_PROXY_DOMAIN={{ netbird_proxy_domain }}
-NB_PROXY_TOKEN={{ netbird_proxy_token }}
-NB_PROXY_MANAGEMENT_ADDRESS=http://management:33073
-NB_PROXY_ALLOW_INSECURE=true
-NB_PROXY_ADDRESS=:8443
-NB_PROXY_ACME_CERTIFICATES=true
-NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01
-NB_PROXY_CERTIFICATE_DIRECTORY=/certs

ci/agents/wiki-maintenance/audit.md

@@ -1,5 +0,0 @@
-You are running as the scheduled wiki-maintenance job in CI. The Notes vault is checked out at ~/Notes (the repository k.renner/notes).
-
-Run the standard audit pass over ~/Notes/wiki/ and write the dated report to ~/Notes/output/. Do not modify any wiki note. Do not commit or push; the pipeline does that.
-
-End with two lines: notes scanned, and issues found by category.

ci/agents/wiki-maintenance/consolidate-settings.json

@@ -0,0 +1,120 @@
+{
+  "//": "Permission scope for the wiki-consolidate agent in CI: read the vault and the",
+  "//2": "source repos cloned under /root/source, read the live cluster through the",
+  "//3": "ci-diagnostics kubeconfig, edit wiki/, output/ and the rotation state only.",
+  "//4": "Deny rules win; git and kubectl are read-only subcommands, no network tools.",
+  "permissions": {
+    "allow": [
+      "Read(//root/Notes/**)",
+      "Read(//root/source/**)",
+      "Edit(//root/Notes/wiki/**)",
+      "Edit(//root/Notes/output/**)",
+      "Edit(//root/Notes/.wiki-consolidation-state.json)",
+      "Bash(/root/Notes/bin/wiki-snapshot.sh:*)",
+      "Bash(/root/Notes/bin/wiki_rank.py:*)",
+      "Bash(/root/Notes/bin/wiki_ask.py:*)",
+      "Bash(~/Notes/bin/wiki-snapshot.sh:*)",
+      "Bash(~/Notes/bin/wiki_rank.py:*)",
+      "Bash(~/Notes/bin/wiki_ask.py:*)",
+      "Bash(~/Notes/bin/wiki-delete.sh:*)",
+      "Bash(git -C /root/Notes log:*)",
+      "Bash(git -C /root/Notes show:*)",
+      "Bash(git -C /root/Notes diff:*)",
+      "Bash(git -C /root/Notes status:*)",
+      "Bash(git -C /root/Notes rev-parse:*)",
+      "Bash(git -C /root/Notes ls-files:*)",
+      "Bash(git -C ~/Notes log:*)",
+      "Bash(git -C ~/Notes show:*)",
+      "Bash(git -C ~/Notes diff:*)",
+      "Bash(git -C ~/Notes status:*)",
+      "Bash(git -C ~/Notes rev-parse:*)",
+      "Bash(git -C ~/Notes ls-files:*)",
+      "Bash(kubectl get:*)",
+      "Bash(kubectl describe:*)",
+      "Bash(kubectl version:*)",
+      "Bash(kubectl api-resources:*)",
+      "Bash(kubectl explain:*)",
+      "Bash(git log:*)",
+      "Bash(git show:*)",
+      "Bash(git status:*)",
+      "Bash(git diff:*)",
+      "Bash(git rev-parse:*)",
+      "Bash(git ls-files:*)",
+      "Bash(git -C /root/source/homelab log:*)",
+      "Bash(git -C /root/source/homelab show:*)",
+      "Bash(git -C /root/source/homelab diff:*)",
+      "Bash(git -C /root/source/homelab status:*)",
+      "Bash(git -C /root/source/homelab rev-parse:*)",
+      "Bash(git -C /root/source/homelab ls-files:*)",
+      "Bash(git -C /root/source/homeassistant log:*)",
+      "Bash(git -C /root/source/homeassistant show:*)",
+      "Bash(git -C /root/source/homeassistant diff:*)",
+      "Bash(git -C /root/source/homeassistant status:*)",
+      "Bash(git -C /root/source/homeassistant rev-parse:*)",
+      "Bash(git -C /root/source/homeassistant ls-files:*)",
+      "Bash(git -C ~/source/homelab log:*)",
+      "Bash(git -C ~/source/homelab show:*)",
+      "Bash(git -C ~/source/homelab diff:*)",
+      "Bash(git -C ~/source/homelab status:*)",
+      "Bash(git -C ~/source/homelab rev-parse:*)",
+      "Bash(git -C ~/source/homelab ls-files:*)",
+      "Bash(git -C ~/source/homeassistant log:*)",
+      "Bash(git -C ~/source/homeassistant show:*)",
+      "Bash(git -C ~/source/homeassistant diff:*)",
+      "Bash(git -C ~/source/homeassistant status:*)",
+      "Bash(git -C ~/source/homeassistant rev-parse:*)",
+      "Bash(git -C ~/source/homeassistant ls-files:*)",
+      "Bash(/root/Notes/bin/wiki-delete.sh:*)",
+      "Bash(ls:*)",
+      "Bash(date:*)",
+      "Bash(wc:*)",
+      "Bash(stat:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)"
+    ],
+    "deny": [
+      "Read(//proc/**)",
+      "Read(//etc/**)",
+      "Read(//root/.config/**)",
+      "Read(//root/.kube/**)",
+      "Read(//woodpecker/**/.ci-diag/**)",
+      "Read(//root/Notes/.git/**)",
+      "Read(//root/source/*/.git/**)",
+      "Read(//root/Notes/_archive/**)",
+      "Edit(//root/Notes/raw/**)",
+      "Edit(//root/Notes/_archive/**)",
+      "Edit(//root/source/**)",
+      "Bash(kubectl apply:*)",
+      "Bash(kubectl delete:*)",
+      "Bash(kubectl patch:*)",
+      "Bash(kubectl edit:*)",
+      "Bash(kubectl scale:*)",
+      "Bash(kubectl rollout:*)",
+      "Bash(kubectl exec:*)",
+      "Bash(kubectl cp:*)",
+      "Bash(kubectl drain:*)",
+      "Bash(kubectl cordon:*)",
+      "Bash(kubectl label:*)",
+      "Bash(kubectl annotate:*)",
+      "Bash(git push:*)",
+      "Bash(git reset:*)",
+      "Bash(git checkout:*)",
+      "Bash(git clean:*)",
+      "Bash(git rebase:*)",
+      "Bash(git config:*)",
+      "Bash(git -C /root/Notes config:*)",
+      "Bash(git -C ~/Notes config:*)",
+      "Bash(git -C /root/source/homelab config:*)",
+      "Bash(git -C /root/source/homeassistant config:*)",
+      "Bash(git -C ~/source/homelab config:*)",
+      "Bash(git -C ~/source/homeassistant config:*)",
+      "Bash(rm:*)",
+      "Bash(rm -rf:*)",
+      "Bash(curl:*)",
+      "Bash(wget:*)",
+      "Bash(ssh:*)",
+      "Bash(tea:*)",
+      "Bash(woodpecker:*)"
+    ]
+  }
+}

ci/agents/wiki-maintenance/consolidate.md

@@ -0,0 +1,5 @@
+You are running as the scheduled wiki-maintenance job in CI. The Notes vault is checked out at ~/Notes (the repository k.renner/notes); the homelab and homeassistant repositories are checked out under ~/source/. `kubectl` reads the live cluster with a read-only identity.
+
+Run the wiki-consolidate agent now for today's scheduled consolidation pass. Follow its instructions exactly: snapshot the vault to git first, abort if that fails, select today's rotating cohort of 20 from the state file, verify claims against both their sources and the live systems, act on the verdicts, write the dated report to ~/Notes/output/, update the state file, and snapshot again at the end. Do not push; the pipeline pushes the run's commits.
+
+Report the counts and the coverage progress when you are done.

ci/agents/wiki-maintenance/settings.json

@@ -1,5 +1,5 @@
 {
-  "//": "Permission scope for the wiki-maintenance agents (wiki-distill, wiki-audit) in CI.",
+  "//": "Permission scope for the wiki-maintenance agent (wiki-distill) in CI.",
   "//2": "The step's environment holds a Gitea push token, a TypeSafe key and the wiki-index",
   "//3": "client credential, so the Read tool is kept away from /proc (env dumps), /root outside",
   "//4": "the vault symlink target, /etc and the checkout's .git/. The vault itself is the work.",
@@ -15,6 +15,10 @@
       "Bash(/root/Notes/bin/wiki_ask.py:*)",
       "Bash(mv /root/Notes/raw/:*)",
       "Bash(mkdir -p /root/Notes/:*)",
+      "Bash(~/Notes/bin/wiki_rank.py:*)",
+      "Bash(~/Notes/bin/wiki_ask.py:*)",
+      "Bash(mv ~/Notes/raw/:*)",
+      "Bash(mkdir -p ~/Notes/:*)",
       "Bash(ls:*)",
       "Bash(date:*)",
       "Bash(wc:*)",

ci/images/k8s/Containerfile

@@ -1,6 +1,6 @@
 FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
 
-ARG TALOS_VERSION=v1.13.9
+ARG TALOS_VERSION=v1.13.10
 ARG VELERO_VERSION=v1.16.0
 ARG KUBECTL_VERSION=v1.36.3
 ARG FLUX_VERSION=2.9.5
@@ -18,7 +18,7 @@ RUN apk add --no-cache \
 
 RUN curl -sfL -o /usr/local/bin/talosctl \
       "https://github.com/siderolabs/talos/releases/download/${TALOS_VERSION}/talosctl-linux-amd64" \
- && echo "7e1d4b7d5846964bdcf63a794e3c8161bb6ef2983d5ace58ea5322f3bf32a27e  /usr/local/bin/talosctl" | sha256sum -c - \
+ && echo "28e9ccd9aebd690fa03d8cf2582221d87ea38b2a1704f411d75a03589c58f2aa  /usr/local/bin/talosctl" | sha256sum -c - \
  && chmod +x /usr/local/bin/talosctl
 
 RUN curl -sfL -o /usr/local/bin/kubectl \

ci/images/vmtest/Containerfile

@@ -14,7 +14,7 @@ FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d650
 # kubernetes/talos/patches/cluster.yaml. The phase reads the version from that
 # file at run time and passes it to the provisioner; this pin only decides which
 # client talks to it.
-ARG TALOS_VERSION=v1.13.9
+ARG TALOS_VERSION=v1.13.10
 ARG KUBECTL_VERSION=v1.36.2
 ARG FLUX_VERSION=2.9.2
 ARG KOPIA_VERSION=0.23.1
@@ -49,7 +49,7 @@ RUN apk add --no-cache \
 
 RUN curl -sfL -o /usr/local/bin/talosctl \
       "https://github.com/siderolabs/talos/releases/download/${TALOS_VERSION}/talosctl-linux-amd64" \
- && echo "7e1d4b7d5846964bdcf63a794e3c8161bb6ef2983d5ace58ea5322f3bf32a27e  /usr/local/bin/talosctl" | sha256sum -c - \
+ && echo "28e9ccd9aebd690fa03d8cf2582221d87ea38b2a1704f411d75a03589c58f2aa  /usr/local/bin/talosctl" | sha256sum -c - \
  && chmod +x /usr/local/bin/talosctl
 
 RUN curl -sfL -o /usr/local/bin/kubectl \

ci/images/wiki-index/Containerfile

@@ -1,10 +0,0 @@
-# wiki-index: embedding index over the Notes repo's wiki/, fed from Gitea,
-# queried by ~/Notes/bin/wiki_rank.py. Standard library only; runs unprivileged.
-FROM python:3.13-slim
-
-RUN useradd --system --no-create-home --shell /usr/sbin/nologin wikiindex
-COPY wiki_index.py /opt/wiki_index.py
-
-ENV PYTHONUNBUFFERED=1
-USER wikiindex
-ENTRYPOINT ["python3", "/opt/wiki_index.py"]

ci/images/wiki-index/test_wiki_index.py

@@ -1,178 +0,0 @@
-#!/usr/bin/env python3
-"""Unit tests for wiki_index. Run: python3 -m unittest test_wiki_index"""
-
-import hashlib
-import hmac
-import json
-import tempfile
-import unittest
-from pathlib import Path
-
-import wiki_index as wi
-
-NOTE = """---
-title: 'UDM intercepts DNS'
-type: wiki
-tags: [dns, unifi]
-aliases: [udm dns interception, dig 1.1.1.1 wrong]
----
-
-# UDM intercepts DNS
-
-The UDM answers every UDP/53 query itself.
-
-## Details
-
-More.
-"""
-
-
-class ParseTests(unittest.TestCase):
-    def test_note_text(self):
-        title, text = wi.note_text("udm-dns", NOTE)
-        self.assertEqual(title, "UDM intercepts DNS")
-        self.assertIn("udm dns UDM intercepts DNS udm dns interception", text)
-        self.assertIn("dns unifi", text)
-        self.assertTrue(text.endswith("The UDM answers every UDP/53 query itself."))
-        self.assertLessEqual(len(text), wi.EMBED_CHARS)
-
-    def test_credentials_are_stripped(self):
-        original = wi.http
-        wi.http = lambda method, url, body=None, headers=None, timeout=60.0: (
-            {"auth": {"client_token": "t"}} if url.endswith("/login")
-            else {"data": {"data": {"gitea_token": "abc\n", "webhook_secret": " s3cret\n"}}})
-        original_sa = wi.SA_TOKEN
-        try:
-            with tempfile.TemporaryDirectory() as d:
-                wi.SA_TOKEN = Path(d) / "token"
-                wi.SA_TOKEN.write_text("jwt\n")
-                self.assertEqual(wi.Credentials().fetch(), {"gitea_token": "abc", "webhook_secret": "s3cret"})
-        finally:
-            wi.http, wi.SA_TOKEN = original, original_sa
-
-    def test_tree_paging_stops_on_short_last_page(self):
-        # Gitea: truncated=true on every page including the last, "tree": null past it.
-        pages = {
-            1: {"tree": [{"path": f"wiki/n{i}.md", "type": "blob", "sha": f"s{i}"} for i in range(1000)], "truncated": True, "total_count": 1192},
-            2: {"tree": [{"path": f"wiki/n{i}.md", "type": "blob", "sha": f"s{i}"} for i in range(1000, 1192)] + [{"path": "raw/x.md", "type": "blob", "sha": "r"}, {"path": "wiki/sub/y.md", "type": "blob", "sha": "y"}], "truncated": True, "total_count": 1192},
-            3: {"tree": None, "truncated": False, "total_count": 1192},
-        }
-        calls = []
-        original = wi.http
-
-        def fake_http(method, url, body=None, headers=None, timeout=60.0):
-            page = int(url.rsplit("page=", 1)[1])
-            calls.append(page)
-            return pages[page]
-
-        wi.http = fake_http
-        try:
-            tree = wi.Gitea("t").tree("abc")
-        finally:
-            wi.http = original
-        self.assertEqual(calls, [1, 2])
-        self.assertEqual(len(tree), 1192)
-        self.assertNotIn("raw/x.md", tree)
-        self.assertNotIn("wiki/sub/y.md", tree)
-        self.assertEqual(tree["wiki/n1191.md"], "s1191")
-
-    def test_signature(self):
-        body = b'{"ref":"refs/heads/master"}'
-        sig = hmac.new(b"s3cret", body, hashlib.sha256).hexdigest()
-        self.assertTrue(wi.verify_signature("s3cret", body, sig))
-        self.assertFalse(wi.verify_signature("other", body, sig))
-        self.assertFalse(wi.verify_signature("s3cret", body, ""))
-
-
-class FakeGitea:
-    def __init__(self, head, tree, files):
-        self._head, self._tree, self.files = head, tree, files
-        self.raw_calls = []
-
-    def head(self):
-        return self._head
-
-    def tree(self, commit):
-        return self._tree
-
-    def raw(self, path, ref):
-        self.raw_calls.append(path)
-        return self.files[path]
-
-
-class IndexTests(unittest.TestCase):
-    def setUp(self):
-        self.tmp = tempfile.TemporaryDirectory()
-        self.path = Path(self.tmp.name) / "index.json"
-        self.original_embed = wi.embed
-        self.embed_calls = []
-
-        def fake_embed(texts, batch=2):
-            self.embed_calls.append(list(texts))
-            return [wi.unit([1.0, float(len(t) % 7)]) for t in texts]
-
-        wi.embed = fake_embed
-
-    def tearDown(self):
-        wi.embed = self.original_embed
-        self.tmp.cleanup()
-
-    def test_sync_is_incremental_and_persists(self):
-        files = {"wiki/udm-dns.md": NOTE, "wiki/ceph.md": "---\ntitle: Ceph\n---\n# Ceph\n\nOSD.\n", "wiki/_index.md": "---\ntitle: Wiki\n---\n"}
-        tree = {"wiki/udm-dns.md": "aaa", "wiki/ceph.md": "bbb", "wiki/_index.md": "ccc"}
-        g = FakeGitea("c1", tree, files)
-        idx = wi.Index(self.path)
-        s = idx.sync(g)
-        self.assertEqual((s["changed"], s["removed"], s["notes"]), (2, 0, 2))
-        self.assertEqual(set(idx.notes), {"udm-dns", "ceph"})
-        self.assertEqual(idx.notes["udm-dns"]["title"], "UDM intercepts DNS")
-        self.assertTrue(self.path.exists())
-
-        # head unchanged: nothing fetched
-        s = idx.sync(g)
-        self.assertEqual(s.get("skipped"), "head unchanged")
-        self.assertEqual(len(g.raw_calls), 2)
-
-        # one note changed, one removed, new head
-        g2 = FakeGitea("c2", {"wiki/udm-dns.md": "aaa2"}, {"wiki/udm-dns.md": NOTE.replace("itself", "itself!")})
-        s = idx.sync(g2)
-        self.assertEqual((s["changed"], s["removed"], s["notes"]), (1, 1, 1))
-        self.assertEqual(g2.raw_calls, ["wiki/udm-dns.md"])
-
-        # restart loads the persisted index
-        idx2 = wi.Index(self.path)
-        self.assertEqual(idx2.commit, "c2")
-        self.assertEqual(set(idx2.notes), {"udm-dns"})
-
-    def test_rank_orders_by_cosine(self):
-        idx = wi.Index(self.path)
-        idx.notes = {"a": {"sha": "1", "title": "A", "vector": wi.unit([1.0, 0.0])},
-                     "b": {"sha": "2", "title": "B", "vector": wi.unit([0.0, 1.0])}}
-        wi.embed = lambda texts, batch=2: [wi.unit([0.2, 1.0])]
-        rows = idx.rank("q", k=5)
-        self.assertEqual([r["slug"] for r in rows], ["b", "a"])
-        self.assertGreater(rows[0]["score"], rows[1]["score"])
-
-    def test_status_reports_age_and_errors(self):
-        idx = wi.Index(self.path)
-        self.assertFalse(idx.status()["ready"])
-        g = FakeGitea("c1", {"wiki/a.md": "x"}, {"wiki/a.md": "---\ntitle: A\n---\n# A\n\nt\n"})
-        idx.sync(g)
-        st = idx.status()
-        self.assertTrue(st["ready"])
-        self.assertEqual(st["notes"], 1)
-        self.assertEqual(st["commit"], "c1")
-
-        class Broken(FakeGitea):
-            def head(self):
-                raise wi.ApiError("gitea down")
-
-        with self.assertRaises(wi.ApiError):
-            idx.sync(Broken("c1", {}, {}))
-        self.assertIn("gitea down", idx.status()["last_error"])
-        self.assertEqual(idx.status()["notes"], 1)  # last good index kept
-        self.assertTrue(idx.status()["ready"])  # and still served
-
-
-if __name__ == "__main__":
-    unittest.main()

ci/images/wiki-index/wiki_index.py

@@ -1,408 +0,0 @@
-#!/usr/bin/env python3
-"""wiki-index: embedding index over the Notes repo's wiki/, fed from Gitea.
-
-Source of truth is the notes repository on Gitea. The index holds, per wiki
-note, the git blob sha, title and a bge-m3 vector of slug/title/aliases/tags/
-first paragraph. A sync fetches the repo tree, embeds every note whose blob sha
-changed (via wiki-embed, in-cluster) and drops notes that left the tree; it
-runs at start, on every push webhook from Gitea, and every RESYNC_SECONDS.
-
-HTTP:
-  POST /rank     {"query": str, "k": int}   -> {"rows": [{"slug","title","score"}], "index": {...}}
-  GET  /health   -> 200 always (liveness) with {"ready", "notes", "commit", "synced_at", "age_s", "syncing", "last_error"}
-  GET  /ready    -> 200 when an index exists, else 503 (readiness)
-  POST /webhook  Gitea push event, HMAC-SHA256 in X-Gitea-Signature -> {"queued": true}
-
-Credentials (Gitea token, webhook secret) are read from OpenBao through the
-Kubernetes auth role on every use; they never land in a Secret or a log line.
-Standard library only.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import hmac
-import json
-import logging
-import os
-import re
-import sys
-import threading
-import time
-import urllib.error
-import urllib.parse
-import urllib.request
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from pathlib import Path
-
-LOG = logging.getLogger("wiki-index")
-
-GITEA_URL = os.environ.get("GITEA_URL", "https://gitea.renner.uno").rstrip("/")
-NOTES_REPO = os.environ.get("NOTES_REPO", "k.renner/notes")
-NOTES_BRANCH = os.environ.get("NOTES_BRANCH", "master")
-WIKI_DIR = os.environ.get("WIKI_DIR", "wiki").strip("/")
-EMBED_URL = os.environ.get("EMBED_URL", "http://wiki-embed.ai.svc.cluster.local:8080").rstrip("/")
-EMBED_MODEL = os.environ.get("EMBED_MODEL", "bge-m3")
-EMBED_CHARS = int(os.environ.get("EMBED_CHARS", "1500"))
-INDEX_PATH = Path(os.environ.get("INDEX_PATH", "/data/index.json"))
-RESYNC_SECONDS = int(os.environ.get("RESYNC_SECONDS", "1800"))
-LISTEN_PORT = int(os.environ.get("LISTEN_PORT", "8080"))
-BAO_ADDR = os.environ.get("BAO_ADDR", "http://openbao.openbao.svc.cluster.local:8200").rstrip("/")
-BAO_ROLE = os.environ.get("BAO_ROLE", "wiki-index")
-BAO_SECRET_PATH = os.environ.get("BAO_SECRET_PATH", "homelab/data/apps/ai/wiki-index")
-SA_TOKEN = Path(os.environ.get("SA_TOKEN", "/var/run/secrets/kubernetes.io/serviceaccount/token"))
-
-
-class ApiError(Exception):
-    pass
-
-
-# ---------------------------------------------------------------- http helpers
-
-
-def http(method: str, url: str, body=None, headers=None, timeout: float = 60.0):
-    data = None
-    hdrs = dict(headers or {})
-    if body is not None:
-        data = json.dumps(body).encode("utf-8")
-        hdrs.setdefault("Content-Type", "application/json")
-    req = urllib.request.Request(url, data=data, method=method, headers=hdrs)
-    try:
-        with urllib.request.urlopen(req, timeout=timeout) as resp:
-            raw = resp.read()
-            ctype = resp.headers.get("Content-Type", "")
-    except urllib.error.HTTPError as e:
-        raise ApiError(f"{method} {url}: HTTP {e.code}: {e.read().decode('utf-8', 'replace')[:300]}") from e
-    except urllib.error.URLError as e:
-        raise ApiError(f"{method} {url}: {e.reason}") from e
-    if "json" in ctype:
-        return json.loads(raw.decode("utf-8"))
-    return raw
-
-
-# ---------------------------------------------------------------- credentials
-
-
-class Credentials:
-    """Gitea token and webhook secret from OpenBao, fetched per use."""
-
-    def __init__(self, static: dict | None = None):
-        self.static = static  # tests / local runs
-
-    def fetch(self) -> dict:
-        if self.static is not None:
-            return self.static
-        jwt = SA_TOKEN.read_text(encoding="utf-8").strip()
-        login = http("POST", f"{BAO_ADDR}/v1/auth/kubernetes/login", {"role": BAO_ROLE, "jwt": jwt})
-        token = login["auth"]["client_token"]
-        kv = http("GET", f"{BAO_ADDR}/v1/{BAO_SECRET_PATH}", headers={"X-Vault-Token": token})
-        data = {k: str(v).strip() for k, v in kv["data"]["data"].items()}  # `bao kv put key=@file` keeps the file's newline
-        for key in ("gitea_token", "webhook_secret"):
-            if not data.get(key):
-                raise ApiError(f"OpenBao {BAO_SECRET_PATH} has no key {key}")
-        return data
-
-
-# ---------------------------------------------------------------- gitea
-
-
-class Gitea:
-    def __init__(self, token: str, base: str = GITEA_URL, repo: str = NOTES_REPO, branch: str = NOTES_BRANCH):
-        self.base, self.repo, self.branch = base, repo, branch
-        self.headers = {"Authorization": f"token {token}"}
-
-    def api(self, path: str, **params):
-        q = ("?" + urllib.parse.urlencode(params)) if params else ""
-        return http("GET", f"{self.base}/api/v1/repos/{self.repo}{path}{q}", headers=self.headers)
-
-    def head(self) -> str:
-        return self.api(f"/branches/{urllib.parse.quote(self.branch, safe='')}")["commit"]["id"]
-
-    def tree(self, commit: str) -> dict[str, str]:
-        """path -> blob sha for every wiki note at that commit."""
-        out: dict[str, str] = {}
-        page, per_page, seen = 1, 1000, 0
-        while True:
-            t = self.api(f"/git/trees/{commit}", recursive="true", per_page=per_page, page=page)
-            entries = t.get("tree") or []  # Gitea answers "tree": null past the last page
-            for e in entries:
-                p = e.get("path", "")
-                if e.get("type") == "blob" and p.startswith(WIKI_DIR + "/") and p.endswith(".md") and "/" not in p[len(WIKI_DIR) + 1:]:
-                    out[p] = e["sha"]
-            seen += len(entries)
-            total = int(t.get("total_count") or 0)
-            if not entries or len(entries) < per_page or (total and seen >= total):
-                break
-            page += 1
-            if page > 50:
-                raise ApiError("tree paging runaway")
-        return out
-
-    def raw(self, path: str, ref: str) -> str:
-        data = http("GET", f"{self.base}/api/v1/repos/{self.repo}/raw/{urllib.parse.quote(path)}?ref={urllib.parse.quote(ref, safe='')}",
-                    headers=self.headers)
-        return data.decode("utf-8") if isinstance(data, bytes) else json.dumps(data)
-
-
-# ---------------------------------------------------------------- notes
-
-
-def parse_frontmatter(text: str) -> tuple[dict, str]:
-    m = re.match(r"^---[ \t]*\n(.*?)\n---[ \t]*(?:\n|$)", text, re.DOTALL)
-    if not m:
-        return {}, text
-    fm: dict = {}
-    for line in m.group(1).splitlines():
-        mm = re.match(r"^([A-Za-z_][\w-]*):\s*(.*)$", line)
-        if mm:
-            fm[mm.group(1)] = mm.group(2).strip()
-    return fm, text[m.end():]
-
-
-def as_list(value: str) -> list[str]:
-    s = (value or "").strip()
-    if s.startswith("[") and s.endswith("]"):
-        s = s[1:-1]
-    return [p.strip().strip("'\"") for p in s.split(",") if p.strip()]
-
-
-def first_paragraph(body: str) -> str:
-    para: list[str] = []
-    seen_h1 = False
-    for line in body.splitlines():
-        if line.startswith("# "):
-            seen_h1 = True
-            continue
-        if not seen_h1:
-            continue
-        if line.strip() == "" or line.startswith("#"):
-            if para:
-                break
-            continue
-        para.append(line.strip())
-    return " ".join(para)
-
-
-def note_text(slug: str, text: str) -> tuple[str, str]:
-    """(title, embedding text) for one note file."""
-    fm, body = parse_frontmatter(text)
-    title = (fm.get("title") or slug).strip().strip("'\"")
-    parts = [slug.replace("-", " "), title, " ".join(as_list(fm.get("aliases", ""))),
-             " ".join(as_list(fm.get("tags", ""))), first_paragraph(body)]
-    return title, " ".join(parts)[:EMBED_CHARS]
-
-
-# ---------------------------------------------------------------- embeddings
-
-
-def embed(texts: list[str], batch: int = 2) -> list[list[float]]:
-    out: list[list[float]] = []
-    for i in range(0, len(texts), batch):
-        resp = http("POST", f"{EMBED_URL}/v1/embeddings", {"model": EMBED_MODEL, "input": texts[i:i + batch]}, timeout=120)
-        rows = sorted(resp["data"], key=lambda d: d["index"])
-        out.extend(unit(d["embedding"]) for d in rows)
-    return out
-
-
-def unit(v: list[float]) -> list[float]:
-    n = sum(x * x for x in v) ** 0.5 or 1.0
-    return [round(x / n, 5) for x in v]
-
-
-# ---------------------------------------------------------------- index
-
-
-class Index:
-    def __init__(self, path: Path):
-        self.path = path
-        self.lock = threading.Lock()
-        self.notes: dict[str, dict] = {}  # slug -> {sha, title, vector}
-        self.commit = ""
-        self.synced_at = 0.0
-        self.syncing = False
-        self.last_error = ""
-        if path.exists():
-            try:
-                d = json.loads(path.read_text(encoding="utf-8"))
-                self.notes, self.commit, self.synced_at = d.get("notes", {}), d.get("commit", ""), d.get("synced_at", 0.0)
-                LOG.info("loaded index: %d notes at %s", len(self.notes), self.commit[:8])
-            except (OSError, ValueError) as e:
-                LOG.warning("index unreadable (%s); starting empty", e)
-
-    def save(self) -> None:
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        tmp = self.path.with_suffix(".tmp")
-        tmp.write_text(json.dumps({"notes": self.notes, "commit": self.commit, "synced_at": self.synced_at}), encoding="utf-8")
-        tmp.replace(self.path)
-
-    def sync(self, gitea: Gitea) -> dict:
-        """Bring the index to the branch head; returns a summary."""
-        with self.lock:
-            self.syncing = True
-        try:
-            head = gitea.head()
-            if head == self.commit and self.notes:
-                summary = {"commit": head, "changed": 0, "removed": 0, "notes": len(self.notes), "skipped": "head unchanged"}
-                self.synced_at = time.time()
-                self.save()
-                return summary
-            tree = gitea.tree(head)
-            slugs = {p[len(WIKI_DIR) + 1:-3]: (p, sha) for p, sha in tree.items() if not p.endswith("/_index.md")}
-            todo = [s for s, (p, sha) in slugs.items() if self.notes.get(s, {}).get("sha") != sha]
-            removed = [s for s in list(self.notes) if s not in slugs]
-            LOG.info("sync %s: %d notes, %d to embed, %d removed", head[:8], len(slugs), len(todo), len(removed))
-            fresh: dict[str, dict] = {}
-            for i in range(0, len(todo), 20):
-                chunk = todo[i:i + 20]
-                texts, titles = [], {}
-                for s in chunk:
-                    title, text = note_text(s, gitea.raw(slugs[s][0], head))
-                    titles[s] = title
-                    texts.append(text)
-                for s, vec in zip(chunk, embed(texts)):
-                    fresh[s] = {"sha": slugs[s][1], "title": titles[s], "vector": vec}
-            with self.lock:
-                for s in removed:
-                    self.notes.pop(s, None)
-                self.notes.update(fresh)
-                self.commit = head
-                self.synced_at = time.time()
-                self.last_error = ""
-                self.save()
-            return {"commit": head, "changed": len(todo), "removed": len(removed), "notes": len(self.notes)}
-        except Exception as e:
-            with self.lock:
-                self.last_error = str(e)[:300]
-            raise
-        finally:
-            with self.lock:
-                self.syncing = False
-
-    def rank(self, query: str, k: int = 60) -> list[dict]:
-        q = embed([query])[0]
-        with self.lock:
-            rows = [(s, n["title"], sum(a * b for a, b in zip(q, n["vector"]))) for s, n in self.notes.items()]
-        rows.sort(key=lambda r: -r[2])
-        return [{"slug": s, "title": t, "score": round(sc, 4)} for s, t, sc in rows[:k]]
-
-    def status(self) -> dict:
-        """`ready` = an index exists and can answer /rank; a failed sync keeps the last good index."""
-        with self.lock:
-            return {"ready": bool(self.notes), "notes": len(self.notes), "commit": self.commit,
-                    "synced_at": self.synced_at, "age_s": round(time.time() - self.synced_at) if self.synced_at else None,
-                    "syncing": self.syncing, "last_error": self.last_error or None}
-
-
-# ---------------------------------------------------------------- syncer
-
-
-class Syncer(threading.Thread):
-    """One worker: syncs on demand (webhook) and every RESYNC_SECONDS."""
-
-    def __init__(self, index: Index, creds: Credentials, interval: int):
-        super().__init__(daemon=True, name="syncer")
-        self.index, self.creds, self.interval = index, creds, interval
-        self.wake = threading.Event()
-
-    def trigger(self) -> None:
-        self.wake.set()
-
-    RETRY_SECONDS = 60
-
-    def run(self) -> None:
-        while True:
-            try:
-                data = self.creds.fetch()
-                summary = self.index.sync(Gitea(data["gitea_token"]))
-                LOG.info("sync done: %s", summary)
-                wait = self.interval
-            except Exception as e:  # keep serving the last good index; retry soon, not next interval
-                LOG.error("sync failed: %s", e)
-                wait = self.RETRY_SECONDS
-            self.wake.wait(wait)
-            self.wake.clear()
-
-
-def verify_signature(secret: str, body: bytes, signature: str) -> bool:
-    digest = hmac.new(secret.encode("utf-8"), body, hashlib.sha256).hexdigest()
-    return hmac.compare_digest(digest, (signature or "").strip())
-
-
-# ---------------------------------------------------------------- server
-
-
-def make_handler(index: Index, syncer: Syncer, creds: Credentials):
-    class Handler(BaseHTTPRequestHandler):
-        def log_message(self, fmt, *args):
-            LOG.info("%s %s", self.address_string(), fmt % args)
-
-        def send_json(self, code: int, obj) -> None:
-            data = json.dumps(obj).encode("utf-8")
-            self.send_response(code)
-            self.send_header("Content-Type", "application/json")
-            self.send_header("Content-Length", str(len(data)))
-            self.end_headers()
-            self.wfile.write(data)
-
-        def body(self) -> bytes:
-            n = int(self.headers.get("Content-Length") or 0)
-            return self.rfile.read(n) if n else b""
-
-        def do_GET(self):
-            if self.path == "/health":  # liveness: the process serves
-                return self.send_json(200, index.status())
-            if self.path == "/ready":  # readiness: an index exists
-                st = index.status()
-                return self.send_json(200 if st["ready"] else 503, st)
-            self.send_json(404, {"error": "not found"})
-
-        def do_POST(self):
-            if self.path == "/rank":
-                try:
-                    req = json.loads(self.body() or b"{}")
-                    query = str(req.get("query", "")).strip()
-                    k = max(1, min(int(req.get("k", 60)), 500))
-                    if not query:
-                        return self.send_json(400, {"error": "query required"})
-                    rows = index.rank(query, k)
-                    return self.send_json(200, {"rows": rows, "index": index.status()})
-                except ApiError as e:
-                    return self.send_json(502, {"error": str(e)})
-                except (ValueError, TypeError) as e:
-                    return self.send_json(400, {"error": str(e)})
-            if self.path == "/webhook":
-                raw = self.body()
-                try:
-                    secret = creds.fetch()["webhook_secret"]
-                except ApiError as e:
-                    return self.send_json(503, {"error": str(e)})
-                if not verify_signature(secret, raw, self.headers.get("X-Gitea-Signature", "")):
-                    return self.send_json(403, {"error": "bad signature"})
-                try:
-                    event = json.loads(raw or b"{}")
-                except ValueError:
-                    return self.send_json(400, {"error": "bad json"})
-                ref = event.get("ref", "")
-                if ref and ref != f"refs/heads/{NOTES_BRANCH}":
-                    return self.send_json(200, {"queued": False, "ref": ref})
-                syncer.trigger()
-                return self.send_json(200, {"queued": True})
-            self.send_json(404, {"error": "not found"})
-
-    return Handler
-
-
-def main() -> int:
-    logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s", stream=sys.stdout)
-    index = Index(INDEX_PATH)
-    creds = Credentials()
-    syncer = Syncer(index, creds, RESYNC_SECONDS)
-    syncer.start()
-    server = ThreadingHTTPServer(("", LISTEN_PORT), make_handler(index, syncer, creds))
-    LOG.info("listening on :%d, repo %s@%s, embed %s", LISTEN_PORT, NOTES_REPO, NOTES_BRANCH, EMBED_URL)
-    server.serve_forever()
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

docs/superpowers/plans/2026-09-25-paperclip.md

@@ -0,0 +1,976 @@
+# Paperclip Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Deploy Paperclip (server-local agent runs, option B) into the homelab cluster behind an Authentik gate, with CNPG Postgres and OpenBao-sourced secrets.
+
+**Architecture:** One Flux `Kustomization` (`paperclip`) applies `kubernetes/apps/paperclip/`: a single-replica Deployment on a ceph-block PVC, CNPG `pclp-pg` (PG17) with barman backups to Hetzner, and a Traefik Ingress that backends only the `paperclip-gate` Authentik outpost. Namespace, baseline CNP, ClusterSecretStore allowlist and image automation live in the existing `infrastructure` tree.
+
+**Tech Stack:** Flux v2 (kustomize-controller, image-reflector v1.2.5), CNPG + barman-cloud plugin, External Secrets → OpenBao, Cilium CNP, Traefik, Authentik blueprints.
+
+**Spec:** `docs/superpowers/specs/2026-09-25-paperclip-design.md`
+
+## Global Constraints
+
+- Worktree: `/home/krenner/source/homelab-worktrees/paperclip`, branch `feat/paperclip`. Never edit the main checkout.
+- Commits as claude-bot: `git -c user.name='Claude Bot' -c user.email='claude-bot@renner.uno' commit …`, message ends with `Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>`.
+- Push: `git -c credential.helper='store --file=/home/krenner/.config/claude-bot/creds' push …`. PR via `tea pr create --login claude-bot`. Never self-merge.
+- One Bash command per call: no `&&`, `;`, `|` chaining, no `2>/dev/null`, no `python -c`.
+- Namespace `paperclip`; hostname `paperclip.renner.uno`; LAN-only (no `dns.renner.uno/public` label).
+- Image `ghcr.io/paperclipai/paperclip`, tag `nightly`, digest-pinned, `digestReflectionPolicy: Always`.
+- Postgres: CNPG `pclp-pg`, `ghcr.io/cloudnative-pg/postgresql:17`, 2 instances, `ceph-block`.
+- PVC `paperclip-data`, `ceph-block`, 20Gi, mounted at `/paperclip`.
+- OpenBao key `apps/paperclip` with fields `BETTER_AUTH_SECRET`, `PAPERCLIP_TOOL_ACTION_SIGNING_SECRET`, `PAPERCLIP_SECRETS_MASTER_KEY` (64-char hex), `CLAUDE_CODE_OAUTH_TOKEN`.
+- Env: `PAPERCLIP_DEPLOYMENT_MODE=authenticated`, `PAPERCLIP_DEPLOYMENT_EXPOSURE=private`, `PAPERCLIP_PUBLIC_URL=https://paperclip.renner.uno`, `HOST=0.0.0.0`, `PORT=3100`.
+- Manifest comments: one terse factual line; rationale goes in commit messages/PR.
+- No `kubectl apply`/`exec`/`rollout restart` against the live cluster; Flux applies after merge. Server-side `--dry-run=server` is allowed.
+
+## Review Focus
+
+1. **Pod replaced mid agent run** (image bump, secret rotation via Reloader, node drain) — `Recreate` kills in-flight runs; expected: Paperclip marks them failed/recoverable on restart, not wedged. Covered in Task 9 Step 6.
+2. **Shared OAuth token expired or missing** — expected: agent runs fail with a visible auth error in Paperclip, server stays healthy. Covered in Task 9 Step 7.
+3. **Direct access bypassing the gate** from another namespace pod — expected: connection refused/dropped by CNP. Covered in Task 9 Step 4.
+4. **Unauthenticated LAN request** to `paperclip.renner.uno` — expected: redirect to Authentik, never Paperclip's UI. Covered in Task 9 Step 3.
+5. **Nightly image with a breaking DB migration** — expected: a base backup exists before the first bump lands. Covered in Task 9 Step 5.
+
+---
+
+### Task 1: Upstream facts that decide two manifest values
+
+No repo changes; produces two decisions consumed by Task 6.
+
+**Interfaces:**
+- Produces: `SIGNUP_DISABLED` (`"true"` or `"false"`), `CONFIG_PARTIAL_OK` (yes/no), `ENTRYPOINT_NEEDS_ROOT` (yes/no).
+
+- [ ] **Step 1: Sign-up vs instance claim.** Read upstream `server/src/auth/better-auth.ts`, `server/src/routes/auth.ts`, and the claim flow for `authenticated`+`private` (search `claim` under `server/src`):
+
+Run: `gh api repos/paperclipai/paperclip/contents/server/src/routes/auth.ts -H "Accept: application/vnd.github.raw"`
+
+Decide: if the first-admin claim creates the account through a path that ignores `disableSignUp` (e.g. invite/claim token handler calling the adapter directly), `SIGNUP_DISABLED="true"`. Otherwise `SIGNUP_DISABLED="false"` — the Authentik gate is the access control, and a follow-up PR flips it to `"true"` after the admin is claimed.
+
+- [ ] **Step 2: Partial config.json.** Read `server/src/config.ts` and the config-file loader it calls (search `PAPERCLIP_CONFIG` / `readConfigFile`).
+
+Run: `gh api repos/paperclipai/paperclip/contents/server/src/config.ts -H "Accept: application/vnd.github.raw"`
+
+Decide `CONFIG_PARTIAL_OK=yes` if a file containing only `{"telemetry":{"enabled":false}}` parses (every other section optional/defaulted). If not, stop and report to the user — do not invent config fields.
+
+- [ ] **Step 3: Entrypoint privilege.**
+
+Run: `gh api repos/paperclipai/paperclip/contents/docker-entrypoint.sh -H "Accept: application/vnd.github.raw"`
+
+`ENTRYPOINT_NEEDS_ROOT=yes` if it calls `usermod`/`groupmod`/`chown`/`gosu`. Record the result for Task 6.
+
+- [ ] **Step 4: Anonymous health response.**
+
+Run: `gh api repos/paperclipai/paperclip/contents/server/src/routes/health.ts -H "Accept: application/vnd.github.raw"`
+
+Confirm `GET /api/health` returns HTTP 200 to an anonymous caller when healthy (probes use it). If it returns 401 anonymously, use a `tcpSocket` probe on 3100 in Task 6 instead.
+
+---
+
+### Task 2: Namespace, baseline CNP, ClusterSecretStore allowlist
+
+**Files:**
+- Modify: `kubernetes/infrastructure/namespaces/namespaces.yaml` (append)
+- Create: `kubernetes/infrastructure/network-policies/paperclip-ns.yaml`
+- Modify: `kubernetes/infrastructure/network-policies/kustomization.yaml`
+- Modify: `kubernetes/infrastructure/post-crds/openbao-clustersecretstore.yaml` (sorted list)
+
+**Interfaces:**
+- Produces: namespace `paperclip`; ESO may reference `openbao` from it.
+
+- [ ] **Step 1: Append the namespace** to the end of `namespaces.yaml`:
+
+```yaml
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: paperclip
+```
+
+- [ ] **Step 2: Create `paperclip-ns.yaml`** (copy of `paperless-ns.yaml`'s `default-deny-ingress`, ns renamed, paperless-only CNPs dropped):
+
+```yaml
+# Traefik is not admitted: the only entry is the paperclip-gate outpost (apps/paperclip/network-policy.yaml).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: paperclip
+spec:
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": database
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+    - fromEntities:
+        - host
+        - remote-node
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": authentik
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": rook-ceph
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+    - toEntities:
+        - host
+        - remote-node
+        - world
+    - toEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+```
+
+- [ ] **Step 3: Register it** — in `network-policies/kustomization.yaml` add `  - paperclip-ns.yaml` directly after `  - paperless-ns.yaml`.
+
+- [ ] **Step 4: Allowlist the namespace** — in `openbao-clustersecretstore.yaml` insert `        - paperclip` between `        - monitoring` and `        - paperless` (list is sorted).
+
+- [ ] **Step 5: Render check.**
+
+Run: `kubectl kustomize kubernetes/infrastructure/network-policies`
+Expected: output contains `namespace: paperclip`, exit 0.
+
+Run: `kubectl apply --dry-run=server -f kubernetes/infrastructure/post-crds/openbao-clustersecretstore.yaml`
+Expected: `clustersecretstore.external-secrets.io/openbao configured (server dry run)`.
+
+- [ ] **Step 6: Commit** `feat(paperclip): namespace, baseline CNP and OpenBao allowlist`.
+
+---
+
+### Task 3: OpenBao secret `apps/paperclip`
+
+Out-of-repo; must exist before merge or the ExternalSecret never becomes Ready.
+
+**Interfaces:**
+- Produces: OpenBao KV `apps/paperclip` with the four fields in Global Constraints.
+
+- [ ] **Step 1:** Ask wiki-synth for the claude-bot OpenBao write procedure (note `claude-bot-openbao-write-only-identity`): login method, KV mount, exact `bao kv put`/`patch` syntax for an `apps/<name>` key. Use exactly what it returns.
+
+- [ ] **Step 2: Write the generated fields** as claude-bot (write-only identity — never read values back). Values generated inline by the command:
+
+`BETTER_AUTH_SECRET` = `openssl rand -hex 32`, `PAPERCLIP_TOOL_ACTION_SIGNING_SECRET` = `openssl rand -hex 32`, `PAPERCLIP_SECRETS_MASTER_KEY` = `openssl rand -hex 32` (64 hex chars = 32 bytes, accepted format).
+
+Generate each with a separate `openssl rand -hex 32` call and pass it directly into the `bao kv put` from Step 1; do not echo or log them.
+
+- [ ] **Step 3: Ask the user** to add the shared token themselves (never handle it): "Run `claude setup-token`, then `bao kv patch <mount>/apps/paperclip CLAUDE_CODE_OAUTH_TOKEN=<token>`." Wait for confirmation.
+
+- [ ] **Step 4: Verify field names only** (no values): `bao kv metadata get <mount>/apps/paperclip` shows a current version ≥2. If claude-bot cannot read metadata, ask the user to confirm the four keys exist.
+
+---
+
+### Task 4: Image automation + initial digest
+
+**Files:**
+- Create: `kubernetes/infrastructure/image-automation/paperclip.yaml`
+- Modify: `kubernetes/infrastructure/image-automation/kustomization.yaml`
+
+**Interfaces:**
+- Produces: ImagePolicy `flux-system:paperclip`; `INITIAL_DIGEST` (`sha256:…`) for Task 6.
+
+- [ ] **Step 1: Create `paperclip.yaml`:**
+
+```yaml
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: paperclip
+  namespace: flux-system
+spec:
+  image: ghcr.io/paperclipai/paperclip
+  interval: 1h
+---
+# Upstream publishes no semver tags; track the nightly tag by digest.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: paperclip
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: paperclip
+  digestReflectionPolicy: Always
+  filterTags:
+    pattern: '^nightly$'
+  policy:
+    alphabetical:
+      order: asc
+```
+
+- [ ] **Step 2: Register** — add `  - paperclip.yaml` after `  - paperless-ngx.yaml` in `image-automation/kustomization.yaml`.
+
+- [ ] **Step 3: Server dry-run.**
+
+Run: `kubectl apply --dry-run=server -f kubernetes/infrastructure/image-automation/paperclip.yaml`
+Expected: both objects `created (server dry run)`; no `unknown field "digestReflectionPolicy"` error.
+
+- [ ] **Step 4: Resolve the current nightly digest.**
+
+The workstation has `docker` only (no skopeo/crane/buildx, checked 2026-09-25); `docker manifest inspect` lists per-platform digests but not the index digest, so pull once:
+
+Run: `docker pull ghcr.io/paperclipai/paperclip:nightly`
+Run: `docker image inspect --format '{{index .RepoDigests 0}}' ghcr.io/paperclipai/paperclip:nightly`
+Expected: `ghcr.io/paperclipai/paperclip@sha256:<64 hex>`. Record the `sha256:…` part as `INITIAL_DIGEST`.
+Run: `docker image rm ghcr.io/paperclipai/paperclip:nightly`
+
+- [ ] **Step 5: Commit** `feat(paperclip): Flux image automation tracks the nightly digest`.
+
+---
+
+### Task 5: Postgres (CNPG) and secrets in the app directory
+
+**Files:**
+- Create: `kubernetes/apps/paperclip/cluster.yaml`, `objectstore.yaml`, `scheduled-backup.yaml`, `hetzner-creds-externalsecret.yaml`, `externalsecret.yaml`
+
+**Interfaces:**
+- Produces: Secret `pclp-pg-app` (CNPG, key `uri`), Service `pclp-pg-rw`, Secret `paperclip-secrets`.
+
+- [ ] **Step 1: `cluster.yaml`:**
+
+```yaml
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: pclp-pg
+  namespace: paperclip
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled # data guard
+spec:
+  instances: 2
+  smartShutdownTimeout: 10
+  stopDelay: 60
+  # PG17: upstream's external Postgres target (docker/docker-compose.yml).
+  imageName: ghcr.io/cloudnative-pg/postgresql:17
+  storage:
+    storageClass: ceph-block
+    size: 10Gi
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: pclp-pg-store
+  bootstrap:
+    initdb:
+      database: paperclip
+      owner: paperclip
+  postgresql:
+    parameters:
+      shared_buffers: "256MB"
+      max_connections: "200"
+      checkpoint_timeout: "15min"
+      max_wal_size: "2GB"
+      wal_compression: "zstd"
+      archive_timeout: "30min"
+    synchronous:
+      method: any
+      number: 1
+      dataDurability: preferred
+  resources:
+    requests:
+      cpu: 200m
+      memory: 512Mi
+    limits:
+      memory: 1Gi
+```
+
+- [ ] **Step 2: `objectstore.yaml`:**
+
+```yaml
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: pclp-pg-store
+  namespace: paperclip
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled # backup target
+spec:
+  configuration:
+    destinationPath: s3://renner-uno-k8s-cnpg/pclp-pg
+    endpointURL: https://fsn1.your-objectstorage.com
+    s3Credentials:
+      accessKeyId:
+        name: hetzner-s3-creds
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: hetzner-s3-creds
+        key: ACCESS_SECRET_KEY
+      region:
+        name: hetzner-s3-creds
+        key: REGION
+    wal:
+      compression: gzip
+    data:
+      compression: gzip
+  retentionPolicy: "30d"
+```
+
+- [ ] **Step 3: `scheduled-backup.yaml`:**
+
+```yaml
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pclp-pg-daily
+  namespace: paperclip
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled # backup schedule
+spec:
+  schedule: "0 45 2 * * *"
+  immediate: true
+  backupOwnerReference: self
+  cluster:
+    name: pclp-pg
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io
+```
+
+- [ ] **Step 4: `hetzner-creds-externalsecret.yaml`:**
+
+```yaml
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hetzner-s3-creds
+  namespace: paperclip
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled # barman S3 creds
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: hetzner-s3-creds
+  dataFrom:
+    - extract:
+        key: infrastructure/hetzner-s3
+```
+
+- [ ] **Step 5: `externalsecret.yaml`:**
+
+```yaml
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: paperclip-secrets
+  namespace: paperclip
+spec:
+  refreshInterval: 10m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: paperclip-secrets
+  dataFrom:
+    - extract:
+        key: apps/paperclip
+```
+
+- [ ] **Step 6: Commit** `feat(paperclip): CNPG pclp-pg with barman backups and OpenBao secrets`. (Rendered together with Task 6's kustomization.)
+
+---
+
+### Task 6: Server workload, storage, ingress, network policy
+
+**Files:**
+- Create: `kubernetes/apps/paperclip/pvc.yaml`, `paperclip.yaml`, `gate-service.yaml`, `ingress.yaml`, `network-policy.yaml`, `kustomization.yaml`
+
+**Interfaces:**
+- Consumes: `pclp-pg-app` (`uri`), `paperclip-secrets`, ImagePolicy `flux-system:paperclip`, `INITIAL_DIGEST` (Task 4), `SIGNUP_DISABLED` / `ENTRYPOINT_NEEDS_ROOT` / probe choice (Task 1).
+- Produces: pods labelled `app.kubernetes.io/name: paperclip` listening on 3100; Service `paperclip:3100`; ExternalName `ak-outpost-paperclip-gate:9000`.
+
+- [ ] **Step 1: `pvc.yaml`:**
+
+```yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: paperclip-data
+  namespace: paperclip
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled # data guard
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: ceph-block
+  resources:
+    requests:
+      storage: 20Gi
+```
+
+- [ ] **Step 2: `paperclip.yaml`** — replace `<INITIAL_DIGEST>` with the Task 4 value and `<SIGNUP_DISABLED>` with the Task 1 value. If Task 1 found `ENTRYPOINT_NEEDS_ROOT=no`, replace the container `securityContext` with `runAsNonRoot: true`, `runAsUser: 1000`, `runAsGroup: 1000`, `allowPrivilegeEscalation: false`, `capabilities: {drop: ["ALL"]}`. If Task 1 chose `tcpSocket`, replace each `httpGet` block with `tcpSocket: {port: http}`.
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperclip
+  namespace: paperclip
+  labels:
+    app.kubernetes.io/name: paperclip
+  annotations:
+    secret.reloader.stakater.com/reload: paperclip-secrets
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: paperclip
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: paperclip
+    spec:
+      enableServiceLinks: false
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # Telemetry is only configurable in config.json.
+        - name: disable-telemetry
+          image: ghcr.io/paperclipai/paperclip:nightly@<INITIAL_DIGEST> # {"$imagepolicy": "flux-system:paperclip"}
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              f=/paperclip/instances/default/config.json
+              mkdir -p "$(dirname "$f")"
+              if [ -s "$f" ]; then
+                jq '.telemetry.enabled = false' "$f" > "$f.tmp"
+              else
+                printf '%s\n' '{"telemetry":{"enabled":false}}' > "$f.tmp"
+              fi
+              mv "$f.tmp" "$f"
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: data
+              mountPath: /paperclip
+      containers:
+        - name: paperclip
+          image: ghcr.io/paperclipai/paperclip:nightly@<INITIAL_DIGEST> # {"$imagepolicy": "flux-system:paperclip"}
+          ports:
+            - name: http
+              containerPort: 3100
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: pclp-pg-app
+                  key: uri
+            - name: HOST
+              value: "0.0.0.0"
+            - name: PORT
+              value: "3100"
+            - name: PAPERCLIP_DEPLOYMENT_MODE
+              value: authenticated
+            - name: PAPERCLIP_DEPLOYMENT_EXPOSURE
+              value: private
+            - name: PAPERCLIP_PUBLIC_URL
+              value: https://paperclip.renner.uno
+            - name: PAPERCLIP_AUTH_DISABLE_SIGN_UP
+              value: "<SIGNUP_DISABLED>"
+          envFrom:
+            - secretRef:
+                name: paperclip-secrets
+          volumeMounts:
+            - name: data
+              mountPath: /paperclip
+          startupProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 60
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 30
+            timeoutSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 250m
+              memory: 1Gi
+            limits:
+              memory: 4Gi
+          securityContext:
+            runAsNonRoot: false
+            allowPrivilegeEscalation: true
+            capabilities:
+              drop: ["ALL"]
+              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: paperclip-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  selector:
+    app.kubernetes.io/name: paperclip
+  ports:
+    - name: http
+      port: 3100
+      targetPort: http
+```
+
+- [ ] **Step 3: `gate-service.yaml`:**
+
+```yaml
+# ExternalName mirror so the Ingress can backend the paperclip-gate outpost in the authentik namespace.
+apiVersion: v1
+kind: Service
+metadata:
+  name: ak-outpost-paperclip-gate
+  namespace: paperclip
+spec:
+  type: ExternalName
+  externalName: ak-outpost-paperclip-gate.authentik.svc.cluster.local
+  ports:
+    - port: 9000
+      targetPort: 9000
+```
+
+- [ ] **Step 4: `ingress.yaml`:**
+
+```yaml
+# LAN-only (no dns.renner.uno/public label); backends the gate outpost, never the Service.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: paperclip
+  namespace: paperclip
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - paperclip.renner.uno
+      secretName: paperclip-tls
+  rules:
+    - host: paperclip.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ak-outpost-paperclip-gate
+                port:
+                  number: 9000
+```
+
+- [ ] **Step 5: `network-policy.yaml`** (Traefik pod-side port is 8443, verified via `kubectl get pods -n ingress -l app.kubernetes.io/name=traefik`):
+
+```yaml
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: paperclip-gate-ingress
+  namespace: paperclip
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: paperclip
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": authentik
+            goauthentik.io/outpost-name: paperclip-gate
+      toPorts:
+        - ports:
+            - port: "3100"
+              protocol: TCP
+---
+# Covers the server and every agent it spawns (same pod).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: paperclip-egress
+  namespace: paperclip
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: paperclip
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip
+            cnpg.io/cluster: pclp-pg
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    # Gitea, Woodpecker, HA, Loki via their *.renner.uno names.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+      toPorts:
+        - ports:
+            - port: "8443"
+              protocol: TCP
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+```
+
+- [ ] **Step 6: `kustomization.yaml`:**
+
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - externalsecret.yaml
+  - hetzner-creds-externalsecret.yaml
+  - cluster.yaml
+  - objectstore.yaml
+  - scheduled-backup.yaml
+  - pvc.yaml
+  - paperclip.yaml
+  - gate-service.yaml
+  - ingress.yaml
+  - network-policy.yaml
+```
+
+- [ ] **Step 7: Render check.**
+
+Run: `kubectl kustomize kubernetes/apps/paperclip`
+Expected: exit 0; output contains `kind: Cluster`, `kind: Deployment`, `claimName: paperclip-data`, and no literal `<INITIAL_DIGEST>` or `<SIGNUP_DISABLED>`.
+
+Run: `grep -rn "<INITIAL_DIGEST>\|<SIGNUP_DISABLED>" kubernetes/apps/paperclip`
+Expected: no output, exit 1.
+
+- [ ] **Step 8: Commit** `feat(paperclip): server Deployment, PVC, gated Ingress and CNPs`.
+
+---
+
+### Task 7: Authentik gate
+
+**Files:**
+- Modify: `kubernetes/apps/authentik/blueprints-configmap.yaml` (insert before the line `      # navidrome-gate: the Navidrome web UI.`)
+- Create: `kubernetes/apps/authentik/paperclip-gate-egress.yaml`
+- Modify: `kubernetes/apps/authentik/kustomization.yaml`
+
+**Interfaces:**
+- Produces: outpost pods labelled `goauthentik.io/outpost-name: paperclip-gate`, Service `ak-outpost-paperclip-gate.authentik:9000`.
+
+- [ ] **Step 1: Insert blueprint entries** (same indentation as the neighbouring `wiki-gate` block):
+
+```yaml
+      # paperclip-gate: Paperclip UI; the CNP admits only this outpost. Paperclip keeps its own login behind it.
+      - id: paperclip-users-group
+        model: authentik_core.group
+        identifiers:
+          name: Paperclip Users
+        state: present
+        attrs:
+          is_superuser: false
+          users:
+            - !Find [authentik_core.user, [username, k.renner]]
+
+      - id: paperclip-gate-provider
+        model: authentik_providers_proxy.proxyprovider
+        identifiers:
+          name: paperclip-gate
+        state: present
+        attrs:
+          authentication_flow: !Find [authentik_flows.flow, [slug, passkey-passwordless-authentication]]
+          authorization_flow: !Find [authentik_flows.flow, [slug, passkey-stepup-authorization]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: proxy
+          internal_host: http://paperclip.paperclip.svc.cluster.local:3100
+          internal_host_ssl_validation: false
+          external_host: https://paperclip.renner.uno
+          cookie_domain: renner.uno
+          access_token_validity: hours=24
+          refresh_token_validity: days=30
+          intercept_header_auth: true
+
+      - model: authentik_core.application
+        identifiers:
+          slug: paperclip-gate
+        state: present
+        attrs:
+          name: Paperclip
+          slug: paperclip-gate
+          provider: !KeyOf paperclip-gate-provider
+          meta_launch_url: https://paperclip.renner.uno
+          meta_description: "Paperclip agent orchestration"
+
+      - model: authentik_policies.policybinding
+        identifiers:
+          target: !Find [authentik_core.application, [slug, paperclip-gate]]
+          group: !KeyOf paperclip-users-group
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+
+      - model: authentik_outposts.outpost
+        identifiers:
+          name: paperclip-gate
+        state: present
+        attrs:
+          type: proxy
+          service_connection: !KeyOf k8s-conn
+          providers:
+            - !KeyOf paperclip-gate-provider
+          config:
+            log_level: info
+            authentik_host: "http://authentik-server.authentik.svc.cluster.local"
+            authentik_host_insecure: false
+            authentik_host_browser: "https://auth.renner.uno/"
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 1
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: ["ingress"]
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_json_patches: null
+
+```
+
+- [ ] **Step 2: `paperclip-gate-egress.yaml`:**
+
+```yaml
+# Lets the paperclip-gate outpost reach the Paperclip server; scoped to this outpost's pods.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: paperclip-gate-egress
+  namespace: authentik
+spec:
+  endpointSelector:
+    matchLabels:
+      goauthentik.io/outpost-name: paperclip-gate
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip
+            app.kubernetes.io/name: paperclip
+      toPorts:
+        - ports:
+            - port: "3100"
+              protocol: TCP
+```
+
+- [ ] **Step 3: Register** — add `  - paperclip-gate-egress.yaml` after `  - paperless-gate-egress.yaml` in `apps/authentik/kustomization.yaml`.
+
+- [ ] **Step 4: Render + dry-run.**
+
+Run: `kubectl kustomize kubernetes/apps/authentik`
+Expected: exit 0 (valid YAML incl. the blueprint ConfigMap).
+
+Run: `kubectl apply --dry-run=server -f kubernetes/apps/authentik/paperclip-gate-egress.yaml`
+Expected: `ciliumnetworkpolicy.cilium.io/paperclip-gate-egress created (server dry run)`.
+
+- [ ] **Step 5: Commit** `feat(authentik): paperclip-gate outpost and Paperclip Users group`.
+
+---
+
+### Task 8: Flux Kustomization
+
+**Files:**
+- Create: `kubernetes/clusters/homelab/paperclip.yaml`
+
+- [ ] **Step 1:**
+
+```yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: paperclip
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 1m
+  timeout: 20m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./kubernetes/apps/paperclip
+  prune: true
+  wait: true
+  dependsOn:
+    - name: infrastructure
+    - name: infrastructure-crds
+    - name: infrastructure-ceph-cluster
+    - name: infrastructure-cnpg-barman
+  healthCheckExprs:
+    - apiVersion: postgresql.cnpg.io/v1
+      kind: Cluster
+      failed: "has(status.phase) && status.phase.startsWith('Failed')"
+      current: "has(status.phase) && (status.phase == 'Cluster in healthy state' || status.readyInstances > 0)"
+```
+
+- [ ] **Step 2: Server dry-run.**
+
+Run: `kubectl apply --dry-run=server -f kubernetes/clusters/homelab/paperclip.yaml`
+Expected: `kustomization.kustomize.toolkit.fluxcd.io/paperclip created (server dry run)`.
+
+- [ ] **Step 3: Commit** `feat(paperclip): Flux Kustomization`.
+
+---
+
+### Task 9: PR, merge by user, live verification
+
+- [ ] **Step 1: Push and open the PR** (Task 3 must be complete).
+
+Run: `git -c credential.helper='store --file=/home/krenner/.config/claude-bot/creds' push -u origin feat/paperclip`
+Run: `tea pr create --login claude-bot --base master --head feat/paperclip --title "feat(paperclip): deploy Paperclip (server-local runs, trial)" --description "<summary of spec decisions + link to spec + bootstrap steps>\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)"`
+Then wait for the user to merge. Do not merge.
+
+- [ ] **Step 2: Reconciliation.** After merge:
+
+Run: `flux get kustomizations paperclip`
+Expected: `Ready True`. If False, read `kubectl describe kustomization paperclip -n flux-system` and the failing object's events; diagnose, don't poke.
+
+Run: `kubectl get cluster -n paperclip pclp-pg`
+Expected: `Cluster in healthy state`, 2 ready instances.
+
+Run: `kubectl get pods -n paperclip -l app.kubernetes.io/name=paperclip`
+Expected: `1/1 Running`.
+
+- [ ] **Step 3: Gate enforced (Review Focus 4).**
+
+Run: `curl -sS -o /dev/null -w '%{http_code} %{redirect_url}\n' https://paperclip.renner.uno/`
+Expected: `302` redirecting to `https://paperclip.renner.uno/outpost.goauthentik.io/…` or `auth.renner.uno`, never `200`.
+
+- [ ] **Step 4: Gate not bypassable (Review Focus 3).**
+
+`default` has no CNPs (verified 2026-09-25), so its egress is open and only paperclip's ingress policy can block the probe.
+
+Run: `kubectl get ciliumnetworkpolicies -n default`
+Expected: `No resources found` (else pick another CNP-free namespace).
+
+Run: `kubectl run cnp-probe -n default --rm -i --restart=Never --image=curlimages/curl:8.10.1 -- curl -sS -m 5 http://paperclip.paperclip.svc.cluster.local:3100/api/health`
+Expected: timeout (exit 28), no HTTP response.
+
+- [ ] **Step 5: First backup (Review Focus 5).**
+
+Run: `kubectl get backup -n paperclip`
+Expected: one `pclp-pg-daily-…` with phase `completed`.
+
+- [ ] **Step 6: Image policy.**
+
+Run: `kubectl get imagepolicy -n flux-system paperclip -o jsonpath='{.status.latestRef}'`
+Expected: `nightly` tag with a `sha256:` digest.
+
+- [ ] **Step 7: Hand-over to the user (browser steps, theirs):**
+  1. Open `https://paperclip.renner.uno`, pass Authentik, claim the instance as admin.
+  2. Create a test agent with the `claude-local` adapter and a trivial task ("reply with OK"); it must complete with the shared token (Review Focus 2: if it fails, report the run's error text — an expired token must show as an auth error, not a hang).
+  3. If `SIGNUP_DISABLED` was `"false"`, open the follow-up PR flipping `PAPERCLIP_AUTH_DISABLE_SIGN_UP` to `"true"` once the admin is claimed.
+  4. Review Focus 1 is observed on the first nightly bump: check the interrupted-run status in the UI.
+
+- [ ] **Step 8: Wiki.** Route the verified Paperclip facts (execution topology, env vars, image tags, digest-reflection usage) through wiki-ingest → wiki-distill once the deployment has proven out.

docs/superpowers/specs/2026-09-25-paperclip-design.md

@@ -0,0 +1,181 @@
+# Paperclip in the homelab cluster — design
+
+Date: 2026-09-25
+Status: draft, awaiting review
+
+## Goal
+
+Run [Paperclip](https://github.com/paperclipai/paperclip) (MIT, agent-orchestration
+server + UI) in the homelab cluster for real use: its agents do actual work against
+homelab systems. This spec covers the **platform** only. Bot identities and their
+credentials are out of scope (see "Deferred").
+
+## Decisions
+
+| Topic | Decision |
+|---|---|
+| Execution model | **B — server-local runs** (upstream default): agent CLIs are child processes of the server, in the server container. Trial only. |
+| Upgrade path | If Paperclip is kept: **C** — `@paperclipai/plugin-kubernetes` sandbox provider + kubernetes-sigs agent-sandbox controller (`agents.x-k8s.io`), per-run Pods and Secrets. Separate spec. |
+| Claude auth | **One shared Claude subscription AI connection**, created once via Paperclip's local sign-in (`claude auth login` into `ai-local-logins/<id>`); Paperclip stores and refreshes it. Server-env `CLAUDE_CODE_OAUTH_TOKEN` is not used: `stripAiAuthBindings` blanks it for managed runs, and upstream accepts no pasted setup-token (the device-code flow needs a Daytona sandbox). |
+| Bot credentials | Out of scope. Future "AIR-Manager" Paperclip role handles permission requests. |
+| Exposure | LAN-only, behind an Authentik forward-auth gate, then Paperclip's own login. |
+
+### Known trade-off of B (accepted for the trial)
+
+Upstream `runChildProcess()` spawns every local adapter with
+`{...sanitizeInheritedPaperclipEnv(process.env), ...opts.env}`; the sanitizer strips only
+`PAPERCLIP_*` keys. Every agent therefore sees `DATABASE_URL`, `BETTER_AUTH_SECRET`,
+the shared filesystem (including every other agent's workspace and the
+`ai-local-logins` credentials) and every agent-scoped secret it can read from disk. Under B, no bot may hold
+a credential we would not tolerate any other bot using. Per-bot isolation is C's job.
+
+## Architecture
+
+```
+LAN client ─▶ Traefik ─▶ ExternalName svc ─▶ ak-outpost-paperclip-gate (authentik ns)
+                                                   │ forward-auth OK
+                                                   ▼
+                                  paperclip Deployment (ns paperclip, 1 replica)
+                                   ├─ server :3100  (+ agent CLIs as child processes)
+                                   ├─ PVC /paperclip  (ceph-block)
+                                   └─▶ pclp-pg-rw (CNPG, PG17, 2 instances) ─▶ barman ▶ Hetzner S3
+```
+
+## Components
+
+All modeled on `kubernetes/apps/paperless/` unless stated.
+
+### Namespace and baseline policy
+- `Namespace paperclip` in `kubernetes/infrastructure/namespaces/namespaces.yaml`.
+- Baseline default-deny CNP `kubernetes/infrastructure/network-policies/paperclip-ns.yaml`
+  (copy of `paperless-ns.yaml`, renamed).
+- Add `paperclip` to the `openbao` ClusterSecretStore namespace allowlist.
+
+### Flux
+- `kubernetes/clusters/homelab/paperclip.yaml`: Flux `Kustomization`,
+  `path: ./kubernetes/apps/paperclip`, `prune: true`, `wait: true`, same `dependsOn` and
+  CNPG `healthCheckExprs` as `paperless.yaml`.
+- `kubernetes/apps/paperclip/kustomization.yaml`: plain resource list.
+
+### Server Deployment (`paperclip.yaml`)
+- Image `ghcr.io/paperclipai/paperclip:nightly@sha256:<digest>` with the Flux
+  image-automation marker for digest updates.
+- `replicas: 1`, `strategy: Recreate` (single writer on an RWO PVC).
+- Starts as root: upstream `docker-entrypoint.sh` remaps the `node` user, chowns
+  `/paperclip`, then drops to uid 1000 via `gosu`. Caps limited to CHOWN,
+  DAC_OVERRIDE, FOWNER, SETGID, SETUID; `fsGroup: 1000`.
+- `automountServiceAccountToken: false` (all agents share the pod filesystem).
+- Port 3100; `Service paperclip` ClusterIP :3100.
+- Probes: startup and readiness on `GET /api/health` with `Host: localhost` (the
+  private-hostname guard rejects the pod IP); liveness is a TCP check, since
+  `/api/health` runs `SELECT 1` and a DB outage must not restart the server.
+- Env:
+  - `DATABASE_URL` assembled from CNPG `pclp-pg-app` Secret (`uri` key).
+  - `HOST=0.0.0.0`, `PORT=3100`
+  - `PAPERCLIP_DEPLOYMENT_MODE=authenticated`
+  - `PAPERCLIP_DEPLOYMENT_EXPOSURE=private`
+  - `PAPERCLIP_PUBLIC_URL=https://paperclip.renner.uno`
+  - `PAPERCLIP_AUTH_DISABLE_SIGN_UP=false` until the first admin is claimed: the
+    claim (`/bootstrap/claim`) requires an already signed-in Better Auth account.
+    A follow-up flips it to `true`.
+  - `PAPERCLIP_TELEMETRY_DISABLED=1` (read by `resolveTelemetryConfig`).
+  - `PAPERCLIP_API_URL=http://paperclip.paperclip.svc.cluster.local:3100` plus
+    `PAPERCLIP_ALLOWED_HOSTNAMES=paperclip.paperclip.svc.cluster.local`: upstream
+    otherwise hands agents the public URL, and the gate (`intercept_header_auth`)
+    rejects their bearer tokens. The Service name also works for sandbox pods under
+    option C; agent JWTs still authenticate each call.
+  - `envFrom: secretRef paperclip-secrets`
+- Reloader: `secret.reloader.stakater.com/reload: paperclip-secrets`.
+
+### Storage
+- `PVC paperclip-data`, `ceph-block`, 20Gi, mounted at `/paperclip` (`PAPERCLIP_HOME`
+  and `HOME`): instance config, workspaces, repo checkouts, per-agent `claude-runtime`
+  dirs.
+
+### Postgres
+- CNPG `Cluster pclp-pg`: 2 instances, `imageName: ghcr.io/cloudnative-pg/postgresql:17`,
+  `ceph-block` 10Gi, `bootstrap.initdb {database: paperclip, owner: paperclip}`,
+  barman-cloud plugin as WAL archiver.
+- `ObjectStore pclp-pg-store` → `s3://renner-uno-k8s-cnpg/pclp-pg`, creds via the
+  existing `hetzner-s3-creds` ExternalSecret pattern.
+- `ScheduledBackup` nightly, `method: plugin`, `backupOwnerReference: self`.
+- `kustomize.toolkit.fluxcd.io/prune: disabled` on Cluster, ObjectStore, ScheduledBackup.
+- PG17 deviates from the cluster-wide PG16 convention because upstream's external
+  Postgres target is `postgres:17` (`docker/docker-compose.yml`) and its embedded default
+  is PG18.
+
+### Secrets
+One ExternalSecret `paperclip-secrets` ← OpenBao `apps/paperclip` (whole-object
+extract):
+- `BETTER_AUTH_SECRET`
+- `PAPERCLIP_TOOL_ACTION_SIGNING_SECRET`
+- `PAPERCLIP_SECRETS_MASTER_KEY` (64-char hex). Held in OpenBao, not on the PVC, so
+  encrypted agent secrets in Postgres survive PVC loss.
+
+### Ingress and SSO
+- Hostname `paperclip.renner.uno`, Traefik `Ingress`, `cert-manager.io/cluster-issuer:
+  letsencrypt-cluster`, **no** `dns.renner.uno/public` label (LAN-only).
+- Authentik gate, per the paperless pattern:
+  - blueprint entries in `kubernetes/apps/authentik/blueprints-configmap.yaml`:
+    proxy provider `paperclip-gate` (`internal_host:
+    http://paperclip.paperclip.svc.cluster.local:3100`, `external_host:
+    https://paperclip.renner.uno`), application, group "Paperclip Users", policy binding;
+  - outpost `ak-outpost-paperclip-gate`;
+  - `kubernetes/apps/authentik/paperclip-gate-egress.yaml` (no `auth.renner.uno`
+    outpost Ingress: like wiki/shelly gates, the outpost serves its own callback on
+    `paperclip.renner.uno`);
+  - `ExternalName` Service in `paperclip` ns pointing at the outpost; the app Ingress
+    targets it on :9000.
+- Paperclip's own email/password login stays on (no header/OIDC login upstream).
+
+### Network policy (`kubernetes/apps/paperclip/network-policy.yaml`)
+Covers the server **and every agent** (same pod under B).
+- Ingress to the app pod: only from the `paperclip-gate` outpost (by label) on 3100.
+- Egress from the app pod:
+  - `pclp-pg` pods :5432
+  - kube-dns :53
+  - `ingress` namespace (Traefik) :8443 (pod-side websecure port) — reaches Gitea, Woodpecker, HA, Loki by their
+    `*.renner.uno` names
+  - `kube-apiserver` entity :6443
+  - `world` TCP :443 (Anthropic API, GitHub, npm)
+- No SSH egress; git over HTTPS only. The namespace baseline
+  (`paperclip-ns.yaml`) also restricts `world` to TCP 443 — Cilium unions allows
+  across CNPs, so an unrestricted baseline would override this list.
+- Known gap (house baseline): pods in `monitoring`/`database` and other pods in
+  `paperclip` can reach :3100 without the gate; Paperclip's own login still applies.
+
+### Image automation
+`kubernetes/infrastructure/image-automation/paperclip.yaml`: `ImageRepository`
+(`ghcr.io/paperclipai/paperclip`) + `ImagePolicy` filtering tag `^nightly$` with
+`digestReflectionPolicy: Always` (image-reflector-controller v1.2.5 in cluster; field
+available since v0.35.0). First use of digest reflection in this repo.
+
+## Guardrails
+- No bot receives cluster-admin or any binding in `flux-system`, `authentik`, `openbao`.
+- Git work goes through PRs; bots get no merge rights on protected branches.
+- Nothing is granted under B that we would not tolerate any agent misusing.
+
+## Bootstrap (one-time)
+1. Place `apps/paperclip` values in OpenBao (the three generated secrets).
+2. Merge; Flux deploys with sign-up enabled.
+3. Sign up through the gate and claim the instance as admin; then set
+   `PAPERCLIP_AUTH_DISABLE_SIGN_UP=true`.
+4. In onboarding "Connect a model", choose Claude subscription and run the shown login
+   **as the node user** (the entrypoint makes exec sessions root, and root-owned 0600
+   credentials are unreadable to the server):
+   `kubectl exec -it -n paperclip deploy/paperclip -- gosu node sh -c 'export CLAUDE_CONFIG_DIR=<shown path> && mkdir -p "$CLAUDE_CONFIG_DIR" && claude auth login'`
+   Repeat after loss of the PVC or database.
+
+## Verification
+- Flux Kustomization `paperclip` Ready; CNPG `pclp-pg` healthy; first ScheduledBackup
+  completes.
+- `curl https://paperclip.renner.uno/api/health` through the gate returns healthy after
+  Authentik login; unauthenticated request redirects to `auth.renner.uno`.
+- Direct pod access from another namespace is denied (CNP).
+- A test agent (claude-local) completes a trivial task using the shared Claude connection.
+- Flux ImagePolicy reports a `nightly@sha256:` digest.
+
+## Deferred
+- **Option C** (sandboxed runs) — required before any per-bot credential isolation.
+- **AIR-Manager** role and all bot identities/credentials.
+- Public exposure.

kubernetes/PROPOSAL-wiki-web-api.md

@@ -0,0 +1,315 @@
+# Wiki: local web interface and agent API, as a modular .NET solution
+
+## Goal
+
+A web interface for the Notes wiki that runs entirely in the cluster, and an
+HTTP API through which agents ask the wiki typed questions and deposit facts.
+Built as one C# solution with a MudBlazor front end, and built so that every
+external dependency is replaceable: where the notes live, which model embeds
+them, what judges a typed question, what runs an agent, how the vector index
+is stored. The first adapters are what the homelab uses today. The point of
+the design is that the next one is a project and a config line, not a
+rewrite.
+
+## Where we are
+
+- `wiki-index` (Python, ns `ai`) syncs `wiki/` from `k.renner/notes` by blob
+  SHA, embeds through `wiki-embed` (bge-m3 on llama-server), answers
+  `POST /rank`. It keeps slug, title and vector, not the text. LAN-only behind
+  Traefik BasicAuth; the Gitea webhook hits the ClusterIP.
+- `~/Notes/bin/wiki_rank.py` and `wiki_ask.py` rank through the index, build a
+  document context from a local vault checkout, send it with typed questions
+  to TypeSafe, gate on `covered`. The wiki-synth agent composes answers from
+  those judgements.
+- New knowledge enters as a file in `raw/` (facts with provenance, never
+  hypotheses), distilled nightly in CI.
+- The house C# project, shelly-manager, sets the conventions: net10.0, an
+  `.slnx` with `src/` and `test/`, xUnit, MudBlazor 9, Blazor Web App with
+  interactive server rendering, minimal APIs, an Authentik proxy-header
+  authentication handler for humans and an API-key handler for machines, a
+  multi-stage Dockerfile, `dotnet test` on every push and a kaniko release
+  pipeline to the Gitea registry. Human-facing apps sit behind an Authentik
+  outpost (`<app>-gate`) with a CNP that admits only that outpost.
+
+## Architecture: ports in the core, adapters around it
+
+```
+                 ┌──────────────────────────────────────────┐
+                 │  Wiki.Host  (ASP.NET Core + Blazor/Mud)  │  composition root,
+                 │  /api/v1, /rank, /webhook, UI pages      │  config, auth
+                 └───────────────┬──────────────────────────┘
+                                 │ uses
+                 ┌───────────────▼──────────────────────────┐
+                 │  Wiki.Application  (use cases)           │  Sync, Rank, Ask,
+                 │                                          │  DepositFact, Queue-
+                 └───────────────┬──────────────────────────┘  Question, Evaluate
+                                 │ depends only on
+                 ┌───────────────▼──────────────────────────┐
+                 │  Wiki.Core  (domain + ports)             │  Note, RawSource,
+                 │  no package references                   │  Report, LinkGraph,
+                 └──────────────────────────────────────────┘  the interfaces
+   implemented by ▲            ▲            ▲            ▲            ▲
+   Adapters.Gitea  Adapters.LlamaCpp  Adapters.TypeSafe  Adapters.FileIndex  Adapters.Anthropic
+   (later: Database, Ollama/Onnx, local Jev, pgvector/Qdrant, OpenAI-compatible answer models)
+```
+
+Rules that keep it modular, enforced by project references and a test:
+
+- `Wiki.Core` references nothing. It holds the domain types and the port
+  interfaces. Adapters reference Core only; they never reference each other
+  or the host. `Wiki.Host` is the only project that knows which adapters
+  exist.
+- Every port has a **contract test suite** in `test/Wiki.Contracts` that
+  runs against every adapter of that port. A new adapter is done when the
+  suite is green. That is what makes "swap the storage" a safe operation.
+- Adapters are selected by configuration and registered by name (keyed
+  services), so several can be active at once. The UI's lab page and the
+  evaluator use that to compare, the API uses the one marked active.
+- Nothing in Core or Application knows about HTTP, Gitea, TypeSafe, files or
+  Kubernetes.
+
+### Ports
+
+| port | what it abstracts | first adapter | examples of the next ones |
+|---|---|---|---|
+| `INoteStore` | read notes, raw sources and reports at a head; create a new document (a fact becomes a raw note in the application layer, the store only moves text) | Gitea repository API (`k.renner/notes`, blob SHA) | git checkout on a volume; a database (CNPG Postgres) with the vault imported; an Obsidian sync folder |
+| `IEmbeddingModel` | text → vector, with a model id and dimension | llama-server `/v1/embeddings` (bge-m3 via wiki-embed, the model that won the German-document comparison on accuracy per cost) | the qwen3 embedding variants from that comparison; ONNX in-process; any OpenAI-compatible endpoint |
+| `IVectorIndex` | store vectors per (model id, document), query top-k | in-memory cosine with a file snapshot per model, as today | pgvector in the database; Qdrant |
+| `IChunker` | split a document into addressable units for typed questions | paragraph splitter (headings, fences), as in `wiki_ask.py` | sentence windows; semantic chunks |
+| `IJudge` | typed questions over a state: Choice, Noul, Score, with probabilities | TypeSafe System One (`jev-latest`, cloud; the wiki records no locally hosted Jev today) | a locally hosted Jev with the same request shape, should TypeSafe offer one; a constrained-output local LLM adapter, flagged as uncalibrated |
+| `IAnswerModel` | prose from a question plus evidence: the selected paragraphs with their notes and the judgements; must cite by slug; streaming | Anthropic Messages API (Claude, model from config, Sonnet by default) | any OpenAI-compatible endpoint, including the local llama-server; a different Claude model per question |
+| `IEvaluator` | measure a retrieval or judge configuration against the labelled set (questions and cited sources in `output/`) | recall@k, hit rate, MRR, as `wiki_rank_eval.py` | judge accuracy against hand-labelled paragraphs |
+| `IIdentity` | who is calling, for attribution of facts and saved answers | Authentik proxy headers (humans), API key (machines), as in shelly-manager | OIDC bearer tokens |
+
+Two ports deserve a sentence of scope each. The judge returns judgements
+with probabilities, never prose, and the UI never presents its output as an
+answer, only as ranked, quoted evidence. The answer model turns that
+evidence into words and is allowed nothing else: it sees the selected
+paragraphs and the judgements, not the whole context, and its output is
+shown next to the evidence it was given. Both are single model calls inside
+the request. The service runs no agent: no tool loop, no vault edits. The
+wiki-synth agent in a Claude session remains the path for artifacts and for
+multi-question synthesis, and it can call `/questions` itself.
+
+### Solution layout
+
+```
+Wiki.slnx
+src/
+  Wiki.Core/               domain types, ports, frontmatter and link parsing
+  Wiki.Application/        use cases; depends on Core only
+  Wiki.Adapters.Gitea/     INoteStore (read at a head, create)
+  Wiki.Adapters.LlamaCpp/  IEmbeddingModel (OpenAI-compatible embeddings)
+  Wiki.Adapters.TypeSafe/  IJudge (System One client)
+  Wiki.Adapters.FileIndex/ IVectorIndex (memory + snapshot per model)
+  Wiki.Adapters.Anthropic/ IAnswerModel (Messages API, streaming)
+  Wiki.Host/               ASP.NET Core: API, webhook, MudBlazor UI, auth,
+                           composition root, appsettings
+test/
+  Wiki.Core.Tests/         parsing, link graph, chunker
+  Wiki.Contracts/          one suite per port, parameterised over adapters
+  Wiki.Application.Tests/  use cases with fake ports
+  Wiki.Host.Tests/         API surface, auth handlers
+```
+
+Own repository `k.renner/wiki`, same shape as shelly-manager: `Dockerfile`,
+`.woodpecker/test.yml` on pull requests, `.woodpecker/release.yml` building
+the image with kaniko into the Gitea registry on push to `main`, tagged
+`build.<unix-ts>` plus the commit SHA so Flux image automation can follow
+it. The homelab repo holds only the manifests. `claude-bot` needs write
+access to the new repository.
+
+Two things the shelly-manager history settles in advance: the TypeSafe
+client is written from the documented field contract (endpoint, bearer key,
+`jev-latest`, Noul/Choice/Score, 255-option cap, 32k-token state budget),
+there is no prior C# client to copy; and the UI needs no login page, because
+identity comes from the outpost's headers, which avoids the Blazor-circuit
+sign-in constraint shelly-manager ran into.
+
+### Configuration
+
+Adapters are declared in `appsettings` and selected by name; secrets come
+through environment variables, filled by ExternalSecret, never from the file.
+
+```json
+"Wiki": {
+  "NoteStore": { "Active": "gitea", "gitea": { "Repository": "k.renner/notes", "Branch": "main" } },
+  "Embeddings": {
+    "Active": "bge-m3",
+    "Models": {
+      "bge-m3":   { "Adapter": "LlamaCpp", "Url": "http://wiki-embed.ai.svc:8080", "Model": "bge-m3" },
+      "e5-large": { "Adapter": "Ollama",   "Url": "http://ollama.ai.svc:11434",    "Model": "multilingual-e5-large" }
+    }
+  },
+  "Judges": {
+    "Active": "typesafe",
+    "Models": {
+      "typesafe":  { "Adapter": "TypeSafe", "Url": "https://api.typesafe.ai/v1/systemone", "Model": "jev-latest" },
+      "jev-local": { "Adapter": "TypeSafe", "Url": "http://jev.ai.svc:8080/v1/systemone",  "Model": "jev" }   // illustration: same adapter, other endpoint
+    }
+  },
+  "Index": { "Active": "file", "file": { "Path": "/data/index" } },
+  "AnswerModels": {
+    "Active": "claude-sonnet",
+    "Models": {
+      "claude-sonnet": { "Adapter": "Anthropic", "Model": "claude-sonnet-5" },
+      "qwen-local":    { "Adapter": "OpenAI",    "Url": "http://llama-server.ai.svc:8080/v1", "Model": "qwen3.6-35b-a3b" }
+    }
+  }
+}
+```
+
+Every embedding model gets its own index namespace. Switching the active
+model is a config change after the new index has been built in the
+background; until then both exist and can be compared. Nothing is
+re-embedded in place.
+
+## The web interface (MudBlazor)
+
+Blazor Web App, interactive server rendering, hosted in `Wiki.Host`. Static
+assets vendored into the image, no CDN. Pages:
+
+1. **Search**: a query box, results ranked by the active index with score and
+   tags; for a phrased question, optionally the paragraph-level hits from the
+   judge with their probabilities, shown as quoted evidence.
+2. **Note**: frontmatter, rendered body with `[[wikilinks]]` resolved,
+   backlinks, sources linking to their raw file.
+3. **Browse**: by tag, by `updated`, recently changed, orphans.
+4. **Answers**: a question box. The answer streams in within seconds: rank,
+   judge, compose, all in the request. Below it the evidence: the paragraphs
+   the judge selected with their notes and probabilities, and the `covered`
+   gate; a low gate is shown as "the wiki does not cover this" instead of an
+   answer. A save button writes the answer to `output/` with the wiki-synth
+   frontmatter (`question`, `sources`, `confidence`), so it joins the
+   labelled set. Underneath, the saved answers, newest first, including the
+   ones the wiki-synth agent wrote from a session.
+5. **Maintenance**: the raw queue with ages, the last consolidation and audit
+   reports, index and sync status.
+6. **Lab**: pick any registered embedding model and judge, run the same query
+   through them side by side, and run the evaluator on the labelled set to
+   get recall@k per configuration. This is the page for "play around with
+   different models".
+7. **Settings**: read-only view of the active adapters and their health.
+
+No editing of notes in the browser. The vault stays a git repository edited
+by the consolidate agent and by hand.
+
+## API v1
+
+Reads are authenticated by the hostname's gate (humans) or API key
+(machines); writes always need an API key so a fact carries its author.
+
+| method and path | purpose |
+|---|---|
+| `GET /api/v1/status` | index commit and age, counts, active adapters |
+| `GET /api/v1/notes?q=&tag=&limit=` | list; `q` ranks through the active index |
+| `GET /api/v1/notes/{slug}` | frontmatter, body, links, backlinks, sources |
+| `GET /api/v1/tags` | tags with counts |
+| `POST /api/v1/rank` | `{question, k, model?}` → ranked slugs; also served at `/rank` for the existing scripts |
+| `POST /api/v1/ask` | `{queries, questions, k, judge?, model?}` → context, typed judgements with the answering paragraphs verbatim, `covered`. For agents and code. |
+| `POST /api/v1/questions` | `{question, k?, judge?, model?, answerModel?, save?}` → the answer text with `[[slug]]` citations, the evidence (paragraphs, probabilities), `covered`, model and token usage; streamed as server-sent events when requested; with `save`, the `output/` path and commit |
+| `POST /api/v1/facts` | deposit a raw source: title, source, `kind: fact`, observed_at, content, tags → path and commit |
+| `GET /api/v1/raw` | the distill queue with ages |
+| `GET /api/v1/reports` | `output/` documents by type, newest first |
+| `POST /api/v1/lab/eval` | run the evaluator for a (model, judge) pair |
+| `POST /webhook` | Gitea push, HMAC as today |
+
+`POST /api/v1/facts` is rejected without `source`, with a `kind` other than
+`fact`, or with content under a minimum length. The raw rule is enforced by
+shape: there is no field for a hypothesis. The file gets the vault's
+provenance frontmatter with `captured_by` set from the API key's identity.
+
+`POST /api/v1/ask` is `wiki_ask.py` moved server-side, so the scripts become
+thin clients and agents no longer need a vault checkout. Its result is
+judgements and quotations, never prose.
+
+`POST /api/v1/questions` is `/ask` plus one answer-model call, in process:
+rank the question, build the context, run the default typed questions
+(answered, where, covered), hand the selected paragraphs and judgements to
+the answer model, stream the prose back. Below the `covered` threshold it
+returns the gap instead of an answer. Time is the sum of the parts, about
+0.2 s rank, 1 to 4 s judge, a few seconds of generation. Cost is one model
+call over a few thousand tokens, a few cents on Sonnet, against a quarter
+dollar for a full agent run.
+
+## Auth and network
+
+- Humans: `wiki.renner.uno`, LAN-only (no `dns.renner.uno/public` label),
+  Ingress backend `ak-outpost-wiki-gate:9000`, a `wiki-gate-egress` CNP in
+  `authentik`, the proxy-header handler trusts `X-Authentik-*` only from that
+  outpost.
+- Machines: `wiki-index.renner.uno` with the API-key handler; the workstation
+  key stays where it is. CI reaches the ClusterIP.
+- Secrets (Gitea token, webhook secret, API keys, TypeSafe key, Anthropic
+  key) reach the
+  pod as environment variables from Kubernetes Secrets filled by
+  ExternalSecret from the `openbao` ClusterSecretStore. The pod itself has
+  no OpenBao access. The Python service fetched its secrets from OpenBao
+  directly through its own Kubernetes-auth role; that role, its policy and
+  the `ai` → `openbao` CNP entry are retired with it.
+- Egress from the pod: Gitea, wiki-embed, `api.typesafe.ai:443`,
+  `api.anthropic.com:443`. Every
+  further adapter that talks to a new endpoint gets its own CNP line, which
+  is the one place adding an adapter touches the cluster.
+
+## Health endpoints
+
+Three endpoints with three different meanings, wired to the .NET health
+checks with tags so that the probes and the humans see the right thing:
+
+| endpoint | meaning | probe |
+|---|---|---|
+| `GET /health` | the process serves HTTP. Always 200 once Kestrel listens; no dependency checks. | liveness |
+| `GET /ready` | the active note store has synced at least once and the active index is loaded; 503 while the first sync or index build runs. A failed later sync keeps the last good state and stays ready. | readiness, plus a startup probe with enough budget for the first sync (the Python service was killed mid-build when its `/health` returned 503 during the initial sync) |
+| `GET /api/v1/status` | the full picture for humans and the Settings page: index commit and age, counts, queue lengths, and one entry per registered adapter with its last check result and latency. | none |
+
+Adapter checks (Gitea reachable, embeddings endpoint answering, judge
+endpoint answering, answer model answering) are reported in `/status` and
+on the Settings page and are never part of `/ready`: a judge outage must not
+take the reader down. Their failures show up as red entries, not as
+restarts.
+
+## Phases
+
+One PR each, verified before the next. The Python `wiki-index` keeps running
+until phase 3 proves parity.
+
+0. **Skeleton.** Repository, solution, `Wiki.Core` with the ports and domain
+   types, `Wiki.Contracts` with the suites, `Wiki.Host` serving `/health`,
+   `/ready` and `/api/v1/status`. CI: test and release pipelines. Verify:
+   image in the registry, pipeline green, the Deployment's three probes
+   wired and the pod Ready.
+1. **Parity with the Python service.** Gitea, LlamaCpp and FileIndex
+   adapters, the sync use case, `/rank` and `/webhook`. Verify: the 40-query
+   recall eval gives the same numbers as the Python service on the same
+   commit; `wiki_rank.py --probe-index` against the new service passes.
+2. **Read API and UI.** Notes, tags, raw, reports; Search, Note, Browse,
+   Maintenance pages; `wiki-gate`. Verify: a note renders with resolved
+   links; an unauthenticated request is redirected to Authentik.
+3. **Ask.** Chunker, TypeSafe adapter, `/api/v1/ask`, scripts as clients.
+   Verify: `test_wiki_ask.py` passes against the API; a wiki-synth run with
+   the definition unchanged. Then the Python service is retired and the
+   `wiki-index` hostname points at the new one.
+4. **Facts.** API keys as an ExternalSecret, the deposit-fact use case, `/api/v1/facts`. Verify:
+   a fact posted from the workstation shows as a `claude-bot` commit and in
+   the next distill.
+5. **Questions.** Anthropic adapter, `/api/v1/questions` with streaming,
+   the Answers page with save. Verify: a question answered in under ten
+   seconds with citations that resolve to the shown evidence; a question the
+   wiki does not cover returns the gap; a saved answer appears in `output/`
+   with the wiki-synth frontmatter and is picked up by the evaluator.
+6. **Lab.** Evaluator, a second embedding model and a second answer model
+   registered, the Lab page. Verify: two models compared on the labelled set
+   from the UI.
+
+## Not in scope
+
+- Editing notes in the browser.
+- Replacing Obsidian; the vault stays a git repository and `notes-push.path`
+  keeps pushing.
+- Public exposure; LAN and VPN only.
+- Running or triggering agents. The service makes single model calls inside
+  a request; it never runs a tool loop or edits the vault. Distill,
+  consolidate and multi-question synthesis stay Claude processes in CI or in
+  a session; the service shows their inputs and outputs and serves their API
+  calls.

kubernetes/RUNBOOK-cold-rebuild.md

@@ -107,7 +107,7 @@ config, and the nodes are addressed by name.
 ## Step 1b — boot all three machines from install media
 
 ```
-https://factory.talos.dev/image/0f6fb8bd8bb53013e9743b7c7b099d96fb9c32fd2464ced32693c2dc0ea5feb9/v1.13.9/metal-amd64.iso
+https://factory.talos.dev/image/0f6fb8bd8bb53013e9743b7c7b099d96fb9c32fd2464ced32693c2dc0ea5feb9/v1.13.10/metal-amd64.iso
 ```
 
 Write it to a USB stick and boot each MS-01 from it. Each comes up in

kubernetes/apps/audiobookshelf/deployment.yaml

@@ -122,7 +122,7 @@ spec:
             claimName: audiobookshelf-metadata
         - name: books
           persistentVolumeClaim:
-            claimName: audiobookshelf-books
+            claimName: audiobookshelf-books-bulk
         - name: le-ca
           emptyDir:
             medium: Memory

kubernetes/apps/audiobookshelf/pvcs.yaml

@@ -35,14 +35,14 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: audiobookshelf-books
+  name: audiobookshelf-books-bulk
   namespace: audiobookshelf
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   accessModes:
     - ReadWriteMany
-  storageClassName: ceph-filesystem
+  storageClassName: ceph-filesystem-bulk
   resources:
     requests:
       storage: 300Gi

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -976,6 +976,201 @@ data:
             kubernetes_ingress_secret_name: "authentik-outpost-tls"
             kubernetes_json_patches: null
 
+      # wiki-gate: the wiki service (ns ai) behind the same passkey flows as
+      # llama-gate. The service trusts X-Authentik-Username only from pod
+      # addresses, and its CNP admits only this outpost, so the gate is the
+      # whole access control for wiki.renner.uno.
+      - id: wiki-gate-provider
+        model: authentik_providers_proxy.proxyprovider
+        identifiers:
+          name: wiki-gate
+        state: present
+        attrs:
+          authentication_flow: !Find [authentik_flows.flow, [slug, passkey-passwordless-authentication]]
+          authorization_flow: !Find [authentik_flows.flow, [slug, passkey-stepup-authorization]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: proxy
+          internal_host: http://wiki.ai.svc.cluster.local:8080
+          internal_host_ssl_validation: false
+          external_host: https://wiki.renner.uno
+          cookie_domain: renner.uno
+          access_token_validity: hours=24
+          refresh_token_validity: days=30
+          intercept_header_auth: true
+
+      - model: authentik_core.application
+        identifiers:
+          slug: wiki-gate
+        state: present
+        attrs:
+          name: Wiki
+          slug: wiki-gate
+          provider: !KeyOf wiki-gate-provider
+          meta_launch_url: https://wiki.renner.uno
+          meta_description: "Notes wiki: search, notes, answers, maintenance"
+
+      - model: authentik_outposts.outpost
+        identifiers:
+          name: wiki-gate
+        state: present
+        attrs:
+          type: proxy
+          service_connection: !KeyOf k8s-conn
+          providers:
+            - !KeyOf wiki-gate-provider
+          config:
+            log_level: info
+            authentik_host: "http://authentik-server.authentik.svc.cluster.local"
+            authentik_host_insecure: false
+            authentik_host_browser: "https://auth.renner.uno/"
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 1
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: ["ingress"]
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_json_patches: null
+
+      # paperclip-gate: Paperclip UI; the CNP admits only this outpost. Paperclip keeps its own login behind it.
+      - id: paperclip-users-group
+        model: authentik_core.group
+        identifiers:
+          name: Paperclip Users
+        state: present
+        attrs:
+          is_superuser: false
+          users:
+            - !Find [authentik_core.user, [username, k.renner]]
+
+      - id: paperclip-gate-provider
+        model: authentik_providers_proxy.proxyprovider
+        identifiers:
+          name: paperclip-gate
+        state: present
+        attrs:
+          authentication_flow: !Find [authentik_flows.flow, [slug, passkey-passwordless-authentication]]
+          authorization_flow: !Find [authentik_flows.flow, [slug, passkey-stepup-authorization]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: proxy
+          internal_host: http://paperclip.paperclip.svc.cluster.local:3100
+          internal_host_ssl_validation: false
+          external_host: https://paperclip.renner.uno
+          cookie_domain: renner.uno
+          access_token_validity: hours=24
+          refresh_token_validity: days=30
+          intercept_header_auth: true
+
+      - model: authentik_core.application
+        identifiers:
+          slug: paperclip-gate
+        state: present
+        attrs:
+          name: Paperclip
+          slug: paperclip-gate
+          provider: !KeyOf paperclip-gate-provider
+          meta_launch_url: https://paperclip.renner.uno
+          meta_description: "Paperclip agent orchestration"
+
+      - model: authentik_policies.policybinding
+        identifiers:
+          target: !Find [authentik_core.application, [slug, paperclip-gate]]
+          group: !KeyOf paperclip-users-group
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+
+      - model: authentik_outposts.outpost
+        identifiers:
+          name: paperclip-gate
+        state: present
+        attrs:
+          type: proxy
+          service_connection: !KeyOf k8s-conn
+          providers:
+            - !KeyOf paperclip-gate-provider
+          config:
+            log_level: info
+            authentik_host: "http://authentik-server.authentik.svc.cluster.local"
+            authentik_host_insecure: false
+            authentik_host_browser: "https://auth.renner.uno/"
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 1
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: ["ingress"]
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_json_patches: null
+
+      # navidrome-gate: the Navidrome web UI. Navidrome auto-creates the
+      # X-Authentik-Username user on first login; the first user is admin.
+      # /rest and /share bypass the gate at the Traefik router.
+      - id: navidrome-gate-provider
+        model: authentik_providers_proxy.proxyprovider
+        identifiers:
+          name: navidrome-gate
+        state: present
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: proxy
+          internal_host: http://navidrome.navidrome.svc.cluster.local
+          internal_host_ssl_validation: false
+          external_host: https://navidrome.renner.uno
+          cookie_domain: renner.uno
+          access_token_validity: hours=24
+          refresh_token_validity: days=30
+          intercept_header_auth: true
+
+      - model: authentik_core.application
+        identifiers:
+          slug: navidrome-gate
+        state: present
+        attrs:
+          name: Navidrome
+          slug: navidrome-gate
+          provider: !KeyOf navidrome-gate-provider
+          meta_launch_url: https://navidrome.renner.uno
+          meta_description: "Music streaming (Subsonic)"
+
+      - model: authentik_outposts.outpost
+        identifiers:
+          name: navidrome-gate
+        state: present
+        attrs:
+          type: proxy
+          service_connection: !KeyOf k8s-conn
+          providers:
+            - !KeyOf navidrome-gate-provider
+          config:
+            log_level: info
+            authentik_host: "http://authentik-server.authentik.svc.cluster.local"
+            authentik_host_insecure: false
+            authentik_host_browser: "https://auth.renner.uno/"
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 1
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: ["ingress"]
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_json_patches: null
+
       - model: authentik_outposts.outpost
         identifiers:
           name: authentik Embedded Outpost

kubernetes/apps/authentik/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - helmrelease.yaml
   - paperless-gate-ingress.yaml
   - paperless-gate-egress.yaml
+  - paperclip-gate-egress.yaml
   - vscode-gate-egress.yaml
   - shelly-manager-gate-egress.yaml
   - esphome-gate-egress.yaml
@@ -16,6 +17,8 @@ resources:
   - prometheus-gate-egress.yaml
   - wordpress-gate-egress.yaml
   - llama-gate-egress.yaml
+  - wiki-gate-egress.yaml
+  - navidrome-gate-egress.yaml
   - ldap-outpost-cert.yaml
   - ldap-outpost-lb.yaml
   - ldap-outpost-cnp.yaml

kubernetes/apps/authentik/navidrome-gate-egress.yaml

@@ -0,0 +1,20 @@
+# Lets the navidrome-gate outpost reach Navidrome; the matching ingress rule
+# is in network-policies/navidrome-ns.yaml.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: navidrome-gate-egress
+  namespace: authentik
+spec:
+  endpointSelector:
+    matchLabels:
+      goauthentik.io/outpost-name: navidrome-gate
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": navidrome
+            app.kubernetes.io/name: navidrome
+      toPorts:
+        - ports:
+            - port: "4533"
+              protocol: TCP

kubernetes/apps/authentik/paperclip-gate-egress.yaml

@@ -0,0 +1,19 @@
+# Lets the paperclip-gate outpost reach the Paperclip server; scoped to this outpost's pods.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: paperclip-gate-egress
+  namespace: authentik
+spec:
+  endpointSelector:
+    matchLabels:
+      goauthentik.io/outpost-name: paperclip-gate
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip
+            app.kubernetes.io/name: paperclip
+      toPorts:
+        - ports:
+            - port: "3100"
+              protocol: TCP

kubernetes/apps/authentik/wiki-gate-egress.yaml

@@ -0,0 +1,21 @@
+# Lets the wiki-gate outpost reach the wiki service. The authentik namespace
+# baseline CNP otherwise stops any authentik pod from entering ai. Scoped to
+# this outpost's pod label; the matching ingress rule is in ai-ns.yaml.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: wiki-gate-egress
+  namespace: authentik
+spec:
+  endpointSelector:
+    matchLabels:
+      goauthentik.io/outpost-name: wiki-gate
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ai
+            app.kubernetes.io/name: wiki
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP

kubernetes/apps/gatus/deployment.yaml

@@ -46,7 +46,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: gatus
-          image: twinproduction/gatus:v5.36.0 # {"$imagepolicy": "flux-system:gatus"}
+          image: twinproduction/gatus:v5.37.0 # {"$imagepolicy": "flux-system:gatus"}
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

kubernetes/apps/gitea/kustomization.yaml

@@ -6,7 +6,6 @@ kind: Kustomization
 # and verified. See MIGRATION-gitea-woodpecker.md.
 resources:
   - statefulset.yaml
-  - pdb.yaml
   - service.yaml
   - ingressroute-ssh.yaml
   - ingress.yaml

kubernetes/apps/gitea/pdb.yaml

@@ -1,23 +0,0 @@
----
-# Eviction protection for the single-replica Gitea StatefulSet.
-#
-# Gitea runs on SQLite (single writer) and its repos + DB live on a single
-# ReadWriteOnce PVC, so it is deliberately replicas:1 and cannot fail over.
-# With no PDB, a node drain / maintenance evicts the pod abruptly, mid-write,
-# with zero coordination. minAvailable:1 on a 1-replica workload makes the
-# eviction API refuse *voluntary* evictions: `kubectl drain` blocks and
-# surfaces this pod, forcing a conscious decision (drain with
-# --disable-eviction, or scale down first) instead of yanking the live DB.
-# It does NOT block involuntary disruptions (node crash, OOM).
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: gitea
-  namespace: gitea
-  labels:
-    app.kubernetes.io/name: gitea
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: gitea

kubernetes/apps/grafana-db/postgres.yaml

@@ -4,7 +4,9 @@ metadata:
   name: gf-pg
   namespace: monitoring
 spec:
-  instances: 1
+  instances: 2
+  smartShutdownTimeout: 10
+  stopDelay: 60
   imageName: ghcr.io/cloudnative-pg/postgresql:16
   storage:
     storageClass: ceph-block

kubernetes/apps/home-assistant/ha-pg-cluster.yaml

@@ -30,7 +30,9 @@ metadata:
   name: ha-pg
   namespace: home-assistant
 spec:
-  instances: 1
+  instances: 2
+  smartShutdownTimeout: 10
+  stopDelay: 60
   imageName: ghcr.io/cloudnative-pg/postgresql:16
   storage:
     storageClass: ceph-block
@@ -124,8 +126,7 @@ spec:
       # padding rather than data.
       #
       # The cost is RPO: up to 30min of WAL is unrecoverable if this cluster and
-      # its volume are lost outright. This is a single-instance cluster, so the
-      # archive is the only off-node copy.
+      # its volumes are lost outright.
       archive_timeout: "30min"
       # Fewer checkpoints => fewer full-page writes, since a page is only
       # fully-logged on its first modification after a checkpoint.

kubernetes/apps/home-assistant/kustomization.yaml

@@ -16,6 +16,9 @@ resources:
   # health broker credential: OpenBao-backed + Class-A rotated (first of the
   # eight users to migrate off mosquitto-bootstrap.yaml).
   - mosquitto-health-credentials-externalsecret.yaml
+  # open3e-int broker credential: open3e-esp32 gateway on the Vitocal internal
+  # CAN; OpenBao-backed + Class-A rotated.
+  - mosquitto-open3e-int-credentials-externalsecret.yaml
   - mosquitto-config.yaml
   - mosquitto-certificate.yaml
   - mosquitto-service.yaml

kubernetes/apps/home-assistant/mosquitto-deployment.yaml

@@ -12,7 +12,7 @@ metadata:
     #
     # Listed per-Secret rather than with the blanket auto annotation, so that
     # enrolling another broker user is a visible edit to this line.
-    secret.reloader.stakater.com/reload: mosquitto-health-credentials
+    secret.reloader.stakater.com/reload: mosquitto-health-credentials,mosquitto-open3e-int-credentials
 spec:
   replicas: 1
   strategy:
@@ -78,6 +78,7 @@ spec:
               mosquitto_passwd -b /mosquitto/auth/passwd admin "$ADMIN_PASSWORD"
               mosquitto_passwd -b /mosquitto/auth/passwd sml2mqtt "$SML2MQTT_PASSWORD"
               mosquitto_passwd -b /mosquitto/auth/passwd open3e "$OPEN3E_PASSWORD"
+              mosquitto_passwd -b /mosquitto/auth/passwd open3e-int "$OPEN3E_INT_PASSWORD"
               mosquitto_passwd -b /mosquitto/auth/passwd evcc "$EVCC_PASSWORD"
               mosquitto_passwd -b /mosquitto/auth/passwd health "$HEALTH_PASSWORD"
               mosquitto_passwd -b /mosquitto/auth/passwd zigbee2mqtt "$ZIGBEE2MQTT_PASSWORD"
@@ -124,6 +125,12 @@ spec:
               user open3e
               topic readwrite open3e/#
 
+              # open3e-esp32 gateway on the Vitocal internal CAN: own subtree
+              # under open3e/ so edge-1's listener on open3e/cmnd never sees
+              # its commands.
+              user open3e-int
+              topic readwrite open3e/int/#
+
               user evcc
               topic read open3e/#
               topic readwrite evcc/#
@@ -187,6 +194,13 @@ spec:
                 secretKeyRef:
                   name: mosquitto-open3e-credentials
                   key: password
+            # open3e-int: OpenBao-backed + Class-A rotated (see
+            # mosquitto-open3e-int-credentials-externalsecret.yaml).
+            - name: OPEN3E_INT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mosquitto-open3e-int-credentials
+                  key: password
             - name: EVCC_PASSWORD
               valueFrom:
                 secretKeyRef:

kubernetes/apps/home-assistant/mosquitto-open3e-int-credentials-externalsecret.yaml

@@ -0,0 +1,21 @@
+# Projects the mosquitto `open3e-int` broker credential (open3e-esp32 gateway
+# on the Vitocal internal CAN) from OpenBao into the Secret the broker
+# consumes. Rotator: kubernetes/infrastructure/openbao/rotation/mosquitto-open3e-int.yaml.
+#
+# creationPolicy is implicitly Owner: deleting this ExternalSecret deletes the
+# live Secret. Set creationPolicy: Orphan first to detach without destroying.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: mosquitto-open3e-int-credentials
+  namespace: home-assistant
+spec:
+  refreshInterval: 10m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: mosquitto-open3e-int-credentials
+  dataFrom:
+    - extract:
+        key: apps/home-assistant/mosquitto-open3e-int-credentials

kubernetes/apps/immich/cluster.yaml

@@ -59,8 +59,7 @@ spec:
       # padding rather than data.
       #
       # The cost is RPO: up to 30min of WAL is unrecoverable if this cluster and
-      # its volume are lost outright. This is a single-instance cluster, so the
-      # archive is the only off-node copy.
+      # its volumes are lost outright.
       archive_timeout: "30min"
       # Write-reduction tuning. These databases are largely idle, and the
       # Postgres defaults favour throughput over storage that wears out.

kubernetes/apps/immich/pvcs.yaml

@@ -28,6 +28,38 @@ spec:
     requests:
       storage: 300Gi
 ---
+# Media root on the EC 2+1 bulk pool; thumbs mount separately below.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: immich-library-bulk
+  namespace: immich
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ceph-filesystem-bulk
+  resources:
+    requests:
+      storage: 300Gi
+---
+# Thumbnails stay replicated: read affinity serves them from the local OSD.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: immich-thumbs
+  namespace: immich
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ceph-filesystem
+  resources:
+    requests:
+      storage: 30Gi
+---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:

kubernetes/apps/immich/server.yaml

@@ -110,6 +110,8 @@ spec:
           volumeMounts:
             - name: library
               mountPath: /data
+            - name: thumbs
+              mountPath: /data/thumbs
             - name: immich-config-file
               mountPath: /config
               readOnly: true
@@ -145,7 +147,10 @@ spec:
       volumes:
         - name: library
           persistentVolumeClaim:
-            claimName: immich-library
+            claimName: immich-library-bulk
+        - name: thumbs
+          persistentVolumeClaim:
+            claimName: immich-thumbs
         - name: immich-config-file
           secret:
             secretName: immich-secrets

kubernetes/apps/influxdb/helmrelease.yaml

@@ -61,6 +61,9 @@ spec:
       enabled: true
       storageClass: ceph-block
       size: 50Gi
+    # A minAvailable:1 PDB on a single replica blocks every node drain.
+    pdb:
+      create: false
     # Bootstrap admin/org/bucket on the fresh PVC. Admin password + token come
     # from the influxdb-bootstrap Secret (OpenBao via ESO), deterministic across
     # rebuilds so the bootstrap token is the live admin token. `influx setup`

kubernetes/apps/libation/cronjob.yaml

@@ -4,7 +4,7 @@
 # the entrypoint exit after one pass instead of looping internally —
 # the CronJob handles scheduling.
 #
-# Books land in /audiobooks (the audiobookshelf-books PVC, shared
+# Books land in /audiobooks (the audiobookshelf-books-bulk PVC, shared
 # with the audiobookshelf Deployment). Config + DB live on
 # libation-config (RWO ceph-block, seeded once from
 # libation-bootstrap secret).
@@ -107,6 +107,9 @@ spec:
                 - |
                   trap 'cp /config-internal/AccountsSettings.json /libation-state/AccountsSettings.json' EXIT
                   set -e
+                  # Strip the Audible intro/outro; re-liberated books replace their file instead of gaining a " (1)" copy.
+                  jq '.StripAudibleBrandAudio = true | .OverwriteExisting = true' /config-internal/Settings.json > /config-internal/Settings.json.tmp
+                  mv /config-internal/Settings.json.tmp /config-internal/Settings.json
                   /libation/LibationCli scan
                   /libation/LibationCli liberate
               env:
@@ -135,7 +138,7 @@ spec:
                 claimName: libation-config
             - name: books
               persistentVolumeClaim:
-                claimName: audiobookshelf-books
+                claimName: audiobookshelf-books-bulk
             - name: bootstrap
               secret:
                 secretName: libation-bootstrap

kubernetes/apps/libation/pvc.yaml

@@ -5,7 +5,7 @@
 # SOPS-encrypted Secret on first boot (sentinel file gate); after that
 # Libation reads and writes it directly so token rotation persists.
 #
-# Books are written to the audiobookshelf-books PVC (already provisioned
+# Books are written to the audiobookshelf-books-bulk PVC (already provisioned
 # by the audiobookshelf seed Kustomization, RWX ceph-filesystem). We
 # share the same namespace so the PVC reference is direct — k8s PVCs
 # are namespace-scoped.

kubernetes/apps/monitoring-rules/prometheusrule-openbao.yaml

@@ -57,10 +57,14 @@ spec:
           # the ClusterSecretStore goes InvalidProviderConfig and no
           # ExternalSecret can refresh.
           #
-          # No window: below quorum the secret store is down and every
-          # ExternalSecret stalls with it, so waiting only delays the page.
+          # Short window: readiness is only a proxy for quorum. A one-second
+          # node NotReady flap makes the node lifecycle controller mark that
+          # node's pods not-ready for ~30s while raft keeps its leader and
+          # serves (issue #920, during a rolling reboot with one replica
+          # already evicted). A really sealed or crashed majority persists,
+          # and existing Secrets keep their last values, so 2m costs little.
           expr: max by (namespace, statefulset) (kube_statefulset_status_replicas_ready{namespace="openbao", statefulset="openbao"}) < 2
-          for: 0m
+          for: 2m
           labels:
             severity: critical
           annotations:

kubernetes/apps/monitoring/helmrelease-prometheus.yaml

@@ -304,6 +304,10 @@ spec:
             - matchers:
                 - alertname = "KubeCPUOvercommit"
               receiver: 'null'
+            # Helper alert that only drives the info inhibit rule below.
+            - matchers:
+                - alertname = "InfoInhibitor"
+              receiver: 'null'
             # Flux notification-controller posts info-severity events
             # here (e.g. image-automation commits). Keep them visible
             # but don't repeat-spam every 12h on the same event.
@@ -313,6 +317,23 @@ spec:
               group_wait: 1m
               group_interval: 10m
               repeat_interval: 24h
+        # From kube-prometheus manifests/alertmanager-secret.yaml.
+        inhibit_rules:
+          - source_matchers:
+              - severity = "critical"
+            target_matchers:
+              - severity =~ "warning|info"
+            equal: ['namespace', 'alertname']
+          - source_matchers:
+              - severity = "warning"
+            target_matchers:
+              - severity = "info"
+            equal: ['namespace', 'alertname']
+          - source_matchers:
+              - alertname = "InfoInhibitor"
+            target_matchers:
+              - severity = "info"
+            equal: ['namespace']
         receivers:
           - name: email
             email_configs:

kubernetes/apps/navidrome/deployment.yaml

@@ -0,0 +1,104 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: navidrome-config
+  namespace: navidrome
+data:
+  TZ: "Europe/Berlin"
+  ND_LOGLEVEL: "info"
+  ND_SCANNER_SCHEDULE: "0 * * * *"
+  ND_ENABLEINSIGHTSCOLLECTOR: "false"
+  # Identity from the navidrome-gate outpost; the CNP admits only the outpost
+  # and Traefik, and Traefik strips this header on the ungated routes.
+  ND_EXTAUTH_USERHEADER: "X-Authentik-Username"
+  ND_EXTAUTH_TRUSTEDSOURCES: "fd10:244::/48,10.244.0.0/16"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: navidrome
+  namespace: navidrome
+  labels:
+    app.kubernetes.io/name: navidrome
+  annotations:
+    configmap.reloader.stakater.com/reload: navidrome-config
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: navidrome
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: navidrome
+    spec:
+      enableServiceLinks: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: navidrome
+          image: deluan/navidrome:0.64.2 # {"$imagepolicy": "flux-system:navidrome"}
+          ports:
+            - name: http
+              containerPort: 4533
+          envFrom:
+            - configMapRef:
+                name: navidrome-config
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: music
+              mountPath: /music
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              memory: 1Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: navidrome-data
+        - name: music
+          persistentVolumeClaim:
+            claimName: navidrome-music-bulk
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: navidrome
+  namespace: navidrome
+spec:
+  selector:
+    app.kubernetes.io/name: navidrome
+  ports:
+    - name: http
+      port: 80
+      targetPort: http

kubernetes/apps/navidrome/gate-service.yaml

@@ -0,0 +1,13 @@
+# ExternalName mirror so the navidrome-namespace Ingress can backend to the
+# navidrome-gate outpost in the authentik namespace.
+apiVersion: v1
+kind: Service
+metadata:
+  name: ak-outpost-navidrome-gate
+  namespace: navidrome
+spec:
+  type: ExternalName
+  externalName: ak-outpost-navidrome-gate.authentik.svc.cluster.local
+  ports:
+    - port: 9000
+      targetPort: 9000

kubernetes/apps/navidrome/ingress.yaml

@@ -0,0 +1,69 @@
+# Web UI behind the navidrome-gate outpost.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: navidrome
+  namespace: navidrome
+  labels:
+    dns.renner.uno/public: "true"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: navidrome.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ak-outpost-navidrome-gate
+                port:
+                  number: 9000
+  tls:
+    - secretName: navidrome-tls
+      hosts:
+        - navidrome.renner.uno
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: navidrome-strip-identity
+  namespace: navidrome
+spec:
+  headers:
+    customRequestHeaders:
+      X-Authentik-Username: ""
+---
+# Subsonic API and public shares bypass the gate; clients authenticate with
+# their Navidrome password.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: navidrome-subsonic
+  namespace: navidrome
+  labels:
+    dns.renner.uno/public: "true"
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: navidrome-navidrome-strip-identity@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: navidrome.renner.uno
+      http:
+        paths:
+          - path: /rest
+            pathType: Prefix
+            backend:
+              service:
+                name: navidrome
+                port:
+                  number: 80
+          - path: /share
+            pathType: Prefix
+            backend:
+              service:
+                name: navidrome
+                port:
+                  number: 80

kubernetes/apps/navidrome/kustomization.yaml

@@ -1,5 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - pvcs.yaml
   - deployment.yaml
+  - gate-service.yaml
   - ingress.yaml

kubernetes/apps/navidrome/pvcs.yaml

@@ -0,0 +1,31 @@
+# SQLite database + artwork/transcode cache; single writer.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: navidrome-data
+  namespace: navidrome
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ceph-block
+  resources:
+    requests:
+      storage: 10Gi
+---
+# Music library on the EC bulk pool.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: navidrome-music-bulk
+  namespace: navidrome
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ceph-filesystem-bulk
+  resources:
+    requests:
+      storage: 300Gi

kubernetes/apps/paperclip/cluster.yaml

@@ -0,0 +1,43 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: pclp-pg
+  namespace: paperclip
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled # data guard
+spec:
+  instances: 2
+  smartShutdownTimeout: 10
+  stopDelay: 60
+  # PG17: upstream's external Postgres target (docker/docker-compose.yml).
+  imageName: ghcr.io/cloudnative-pg/postgresql:17
+  storage:
+    storageClass: ceph-block
+    size: 10Gi
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: pclp-pg-store
+  bootstrap:
+    initdb:
+      database: paperclip
+      owner: paperclip
+  postgresql:
+    parameters:
+      shared_buffers: "256MB"
+      max_connections: "200"
+      checkpoint_timeout: "15min"
+      max_wal_size: "2GB"
+      wal_compression: "zstd"
+      archive_timeout: "30min"
+    synchronous:
+      method: any
+      number: 1
+      dataDurability: preferred
+  resources:
+    requests:
+      cpu: 200m
+      memory: 512Mi
+    limits:
+      memory: 1Gi

kubernetes/apps/paperclip/externalsecret.yaml

@@ -0,0 +1,15 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: paperclip-secrets
+  namespace: paperclip
+spec:
+  refreshInterval: 10m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: paperclip-secrets
+  dataFrom:
+    - extract:
+        key: apps/paperclip

kubernetes/apps/paperclip/gate-service.yaml

@@ -0,0 +1,12 @@
+# ExternalName mirror so the Ingress can backend the paperclip-gate outpost in the authentik namespace.
+apiVersion: v1
+kind: Service
+metadata:
+  name: ak-outpost-paperclip-gate
+  namespace: paperclip
+spec:
+  type: ExternalName
+  externalName: ak-outpost-paperclip-gate.authentik.svc.cluster.local
+  ports:
+    - port: 9000
+      targetPort: 9000

kubernetes/apps/paperclip/hetzner-creds-externalsecret.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hetzner-s3-creds
+  namespace: paperclip
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled # barman S3 creds
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: hetzner-s3-creds
+  dataFrom:
+    - extract:
+        key: infrastructure/hetzner-s3

kubernetes/apps/paperclip/ingress.yaml

@@ -0,0 +1,25 @@
+# LAN-only (no dns.renner.uno/public label); backends the gate outpost, never the Service.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: paperclip
+  namespace: paperclip
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - paperclip.renner.uno
+      secretName: paperclip-tls
+  rules:
+    - host: paperclip.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ak-outpost-paperclip-gate
+                port:
+                  number: 9000

kubernetes/apps/paperclip/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - externalsecret.yaml
+  - hetzner-creds-externalsecret.yaml
+  - cluster.yaml
+  - objectstore.yaml
+  - scheduled-backup.yaml
+  - pvc.yaml
+  - paperclip.yaml
+  - gate-service.yaml
+  - ingress.yaml
+  - network-policy.yaml

kubernetes/apps/paperclip/network-policy.yaml

@@ -0,0 +1,69 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: paperclip-gate-ingress
+  namespace: paperclip
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: paperclip
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": authentik
+            goauthentik.io/outpost-name: paperclip-gate
+      toPorts:
+        - ports:
+            - port: "3100"
+              protocol: TCP
+---
+# Covers the server and every agent it spawns (same pod).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: paperclip-egress
+  namespace: paperclip
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: paperclip
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip
+            cnpg.io/cluster: pclp-pg
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    # Gitea, Woodpecker, HA, Loki via their *.renner.uno names.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+      toPorts:
+        - ports:
+            - port: "8443"
+              protocol: TCP
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP

kubernetes/apps/paperclip/objectstore.yaml

@@ -0,0 +1,26 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: pclp-pg-store
+  namespace: paperclip
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled # backup target
+spec:
+  configuration:
+    destinationPath: s3://renner-uno-k8s-cnpg/pclp-pg
+    endpointURL: https://fsn1.your-objectstorage.com
+    s3Credentials:
+      accessKeyId:
+        name: hetzner-s3-creds
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: hetzner-s3-creds
+        key: ACCESS_SECRET_KEY
+      region:
+        name: hetzner-s3-creds
+        key: REGION
+    wal:
+      compression: gzip
+    data:
+      compression: gzip
+  retentionPolicy: "30d"

kubernetes/apps/paperclip/paperclip.yaml

@@ -0,0 +1,122 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperclip
+  namespace: paperclip
+  labels:
+    app.kubernetes.io/name: paperclip
+  annotations:
+    secret.reloader.stakater.com/reload: paperclip-secrets
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: paperclip
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: paperclip
+    spec:
+      enableServiceLinks: false
+      # Every agent shares this filesystem; bots bring their own cluster credentials.
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: paperclip
+          image: ghcr.io/paperclipai/paperclip:nightly@sha256:9222efbf11863160669e13d5559e6a1be881886dd1758650b74c3993dc3ef2a6 # {"$imagepolicy": "flux-system:paperclip"}
+          ports:
+            - name: http
+              containerPort: 3100
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: pclp-pg-app
+                  key: uri
+            - name: HOST
+              value: "0.0.0.0"
+            - name: PORT
+              value: "3100"
+            - name: PAPERCLIP_DEPLOYMENT_MODE
+              value: authenticated
+            - name: PAPERCLIP_DEPLOYMENT_EXPOSURE
+              value: private
+            - name: PAPERCLIP_PUBLIC_URL
+              value: https://paperclip.renner.uno
+            # Agents reach the API via the Service, not through the Authentik gate.
+            - name: PAPERCLIP_API_URL
+              value: http://paperclip.paperclip.svc.cluster.local:3100
+            - name: PAPERCLIP_ALLOWED_HOSTNAMES
+              value: paperclip.paperclip.svc.cluster.local
+            - name: PAPERCLIP_AUTH_DISABLE_SIGN_UP
+              value: "true"
+            - name: PAPERCLIP_TELEMETRY_DISABLED
+              value: "1"
+          envFrom:
+            - secretRef:
+                name: paperclip-secrets
+          volumeMounts:
+            - name: data
+              mountPath: /paperclip
+          # The private-hostname guard 403s any Host but loopback and the public URL; the kubelet sends the pod IP.
+          startupProbe:
+            httpGet:
+              path: /api/health
+              port: http
+              httpHeaders:
+                - name: Host
+                  value: localhost
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 60
+          # /api/health runs SELECT 1; liveness stays DB-independent so a Postgres outage doesn't restart the server.
+          livenessProbe:
+            tcpSocket:
+              port: http
+            periodSeconds: 30
+            timeoutSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+              httpHeaders:
+                - name: Host
+                  value: localhost
+            periodSeconds: 10
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 250m
+              memory: 1Gi
+            limits:
+              memory: 4Gi
+          # Entrypoint remaps the node user and chowns /paperclip as root, then drops to it via gosu.
+          securityContext:
+            runAsNonRoot: false
+            allowPrivilegeEscalation: true
+            capabilities:
+              drop: ["ALL"]
+              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: paperclip-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  selector:
+    app.kubernetes.io/name: paperclip
+  ports:
+    - name: http
+      port: 3100
+      targetPort: http

kubernetes/apps/paperclip/pvc.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: paperclip-data
+  namespace: paperclip
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled # data guard
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: ceph-block
+  resources:
+    requests:
+      storage: 20Gi

kubernetes/apps/paperclip/scheduled-backup.yaml

@@ -0,0 +1,16 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pclp-pg-daily
+  namespace: paperclip
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled # backup schedule
+spec:
+  schedule: "0 45 2 * * *"
+  immediate: true
+  backupOwnerReference: self
+  cluster:
+    name: pclp-pg
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io

kubernetes/apps/paperless/kustomization.yaml

@@ -11,7 +11,6 @@ resources:
   - protonmail-bridge.yaml
   - ftp-scanner.yaml
   - syncthing.yaml
-  - pdb.yaml
   - network-policy.yaml
   # pprl-pg CNPG Postgres + data/media/consume/redis PVCs (moved here from the
   # retired seed-paperless KS; each carries prune: disabled so ownership

kubernetes/apps/paperless/pdb.yaml

@@ -1,37 +0,0 @@
----
-# Eviction protection for the single-replica stateful paperless sidecars.
-#
-# protonmail-bridge and syncthing each hold state on a single RWO PVC and run
-# replicas:1. minAvailable:1 makes the eviction API refuse voluntary evictions,
-# so a node drain blocks and surfaces these pods instead of evicting them
-# abruptly. Involuntary disruptions (node crash) are not affected.
-#
-# NOTE: the other single-replica paperless pods (paperless, redis, gotenberg,
-# tika, ftp-scanner) are intentionally omitted — they are caches / stateless
-# converters where a blocking PDB would only wedge node drains with no
-# recoverability benefit.
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: protonmail-bridge
-  namespace: paperless
-  labels:
-    app.kubernetes.io/name: protonmail-bridge
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: protonmail-bridge
----
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: syncthing
-  namespace: paperless
-  labels:
-    app.kubernetes.io/name: syncthing
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: syncthing

kubernetes/apps/trmnl/cluster.yaml

@@ -4,7 +4,7 @@ metadata:
   name: tr-pg
   namespace: trmnl
 spec:
-  instances: 1
+  instances: 2
   smartShutdownTimeout: 10
   stopDelay: 60
   # PG 18, NOT the repo-standard 16. Terminus ships a committed
@@ -47,8 +47,7 @@ spec:
       # padding rather than data.
       #
       # The cost is RPO: up to 30min of WAL is unrecoverable if this cluster and
-      # its volume are lost outright. This is a single-instance cluster, so the
-      # archive is the only off-node copy.
+      # its volumes are lost outright.
       archive_timeout: "30min"
       # Write-reduction tuning. These databases are largely idle, and the
       # Postgres defaults favour throughput over storage that wears out.

kubernetes/apps/trmnl/terminus.yaml

@@ -134,7 +134,7 @@ spec:
         # is a device-bricking class of risk. Bumps are a reviewed, manual
         # act — see kubernetes/infrastructure/image-automation/README.md.
         - name: terminus
-          image: ghcr.io/usetrmnl/terminus:0.74.0 # {"$imagepolicy": "flux-system:terminus"}
+          image: ghcr.io/usetrmnl/terminus:0.75.0 # {"$imagepolicy": "flux-system:terminus"}
           ports:
             - name: http
               containerPort: 2345
@@ -197,7 +197,7 @@ spec:
             capabilities:
               drop: ["ALL"]
         - name: sidekiq
-          image: ghcr.io/usetrmnl/terminus:0.74.0 # {"$imagepolicy": "flux-system:terminus"}
+          image: ghcr.io/usetrmnl/terminus:0.75.0 # {"$imagepolicy": "flux-system:terminus"}
           command: ["bundle", "exec", "sidekiq", "-r", "./config/sidekiq.rb"]
           envFrom:
             - configMapRef:

kubernetes/apps/wiki-index/deployment.yaml

@@ -1,137 +0,0 @@
----
-# ServiceAccount is the OpenBao identity (auth/kubernetes/role/wiki-index); no
-# Kubernetes API access needed.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: wiki-index
-  namespace: ai
-  labels:
-    app.kubernetes.io/name: wiki-index
----
-# Index (~17 MB JSON for 1700 notes). Survives restarts so a pod start does not
-# re-embed the wiki; a lost volume only costs one full sync (~5 min).
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: wiki-index-data
-  namespace: ai
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: ceph-block
-  resources:
-    requests:
-      storage: 1Gi
----
-# Embedding index over the Notes repo's wiki/ (ci/images/wiki-index). Syncs from
-# Gitea on push webhook and every RESYNC_SECONDS, embeds via wiki-embed, serves
-# POST /rank to ~/Notes/bin/wiki_rank.py through wiki-index.renner.uno.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wiki-index
-  namespace: ai
-  labels:
-    app.kubernetes.io/name: wiki-index
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: wiki-index
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: wiki-index
-    spec:
-      serviceAccountName: wiki-index
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
-        runAsGroup: 65534
-        fsGroup: 65534
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: wiki-index
-          # Per-commit tag (build-ci-images.yml): immutable, no same-day overwrite.
-          image: gitea.renner.uno/gitea_admin/wiki-index:2026-09-20-4b529cd1
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-          env:
-            - name: GITEA_URL
-              value: https://gitea.renner.uno
-            - name: NOTES_REPO
-              value: k.renner/notes
-            - name: NOTES_BRANCH
-              value: main
-            - name: EMBED_URL
-              value: http://wiki-embed.ai.svc.cluster.local:8080
-            - name: BAO_ADDR
-              value: http://openbao.openbao.svc.cluster.local:8200
-            - name: BAO_ROLE
-              value: wiki-index
-            - name: BAO_SECRET_PATH
-              value: homelab/data/apps/ai/wiki-index
-            - name: INDEX_PATH
-              value: /data/index.json
-            - name: RESYNC_SECONDS
-              value: "1800"
-          ports:
-            - name: http
-              containerPort: 8080
-          # Pure-Python cosine over 1700 x 1024 floats per query; the index itself is ~60 MB in memory.
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          # /health: the process serves (liveness). /ready: an index exists; a cold
-          # start on an empty PVC embeds every note (~5 min) before traffic arrives.
-          startupProbe:
-            httpGet:
-              path: /health
-              port: http
-            periodSeconds: 5
-            failureThreshold: 12
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: http
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-            periodSeconds: 60
-            timeoutSeconds: 10
-            failureThreshold: 3
-          volumeMounts:
-            - name: data
-              mountPath: /data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: wiki-index-data
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wiki-index
-  namespace: ai
-  labels:
-    app.kubernetes.io/name: wiki-index
-spec:
-  selector:
-    app.kubernetes.io/name: wiki-index
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http

kubernetes/apps/wiki-index/ingress.yaml

@@ -1,56 +0,0 @@
----
-# wiki-index.renner.uno — LAN-only (no dns.renner.uno/public label), machine
-# client (bin/wiki_rank.py), so Traefik BasicAuth like wiki-embed.renner.uno.
-# Gitea's webhook does not pass here; it targets the ClusterIP Service directly.
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: wiki-index-basic-auth
-  namespace: ai
-spec:
-  basicAuth:
-    secret: wiki-index-basic-auth
-    realm: wiki-index
----
-# OpenBao key apps/ai/wiki-index-basic-auth, field `users` = htpasswd line.
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: wiki-index-basic-auth
-  namespace: ai
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  target:
-    name: wiki-index-basic-auth
-  dataFrom:
-    - extract:
-        key: apps/ai/wiki-index-basic-auth
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: wiki-index
-  namespace: ai
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-cluster
-    traefik.ingress.kubernetes.io/router.middlewares: ai-wiki-index-basic-auth@kubernetescrd
-spec:
-  ingressClassName: traefik
-  tls:
-    - hosts:
-        - wiki-index.renner.uno
-      secretName: wiki-index-tls
-  rules:
-    - host: wiki-index.renner.uno
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: wiki-index
-                port:
-                  number: 8080

kubernetes/apps/wiki/deployment.yaml

@@ -0,0 +1,141 @@
+# Index snapshots per embedding model and the document catalog. A lost volume
+# costs one full sync from Gitea (~10 min).
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: wiki-data
+  namespace: ai
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ceph-block
+  resources:
+    requests:
+      storage: 1Gi
+---
+# Wiki service (konairius/Wiki): mirrors the Notes repo from Gitea, embeds
+# wiki/ via wiki-embed, serves /rank, /api/v1 and the MudBlazor UI. Adapters
+# are selected in appsettings (Wiki__* env overrides); secrets arrive as env
+# from ExternalSecrets, the pod has no OpenBao access.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wiki
+  namespace: ai
+  annotations:
+    # Keys, tokens and the Anthropic key arrive via envFrom; a rotated Secret rolls the pod.
+    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-typesafe,wiki-anthropic
+  labels:
+    app.kubernetes.io/name: wiki
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: wiki
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: wiki
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        fsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: wiki
+          image: gitea.renner.uno/konairius/wiki:build.1790322994 # {"$imagepolicy": "flux-system:wiki"}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          env:
+            - name: HOME
+              value: /tmp
+            - name: Wiki__Index__File__Directory
+              value: /data
+            - name: Wiki__NoteStore__Gitea__BaseUrl
+              value: https://gitea.renner.uno
+            - name: Wiki__NoteStore__Gitea__Repository
+              value: k.renner/notes
+            - name: Wiki__NoteStore__Gitea__Branch
+              value: main
+            - name: Wiki__Embeddings__Models__bge-m3__Url
+              value: http://wiki-embed.ai.svc.cluster.local:8080
+            # Pod networks: the CNP admits only the wiki-gate outpost and Gitea.
+            - name: Auth__ReverseProxy__TrustedProxies__0
+              value: fd10:244::/48
+            - name: Auth__ReverseProxy__TrustedProxies__1
+              value: 10.244.0.0/16
+          envFrom:
+            - secretRef:
+                name: wiki-gitea
+            - secretRef:
+                name: wiki-api-keys
+            - secretRef:
+                name: wiki-typesafe
+            - secretRef:
+                name: wiki-anthropic
+                optional: true
+          ports:
+            - name: http
+              containerPort: 8080
+          resources:
+            requests:
+              cpu: 200m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          # /health: the process serves (liveness). /ready: catalog synced once and the
+          # active index loaded; a cold start syncs the whole vault first (~10 min).
+          startupProbe:
+            httpGet:
+              path: /ready
+              port: http
+            periodSeconds: 10
+            failureThreshold: 120
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: http
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 60
+            timeoutSeconds: 10
+            failureThreshold: 3
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: wiki-data
+        - name: tmp
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wiki
+  namespace: ai
+  labels:
+    app.kubernetes.io/name: wiki
+spec:
+  selector:
+    app.kubernetes.io/name: wiki
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http

kubernetes/apps/wiki/externalsecrets.yaml

@@ -0,0 +1,104 @@
+---
+# Gitea token (claude-bot, write:repository: the service creates raw/ files for
+# deposited facts) and the notes webhook secret. Secret keys are the
+# configuration paths the host reads.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wiki-gitea
+  namespace: ai
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: wiki-gitea
+  data:
+    - secretKey: Wiki__NoteStore__Gitea__Token
+      remoteRef:
+        key: apps/ai/wiki-service
+        property: gitea_token
+    - secretKey: Wiki__Webhook__Secret
+      remoteRef:
+        key: apps/ai/wiki-index
+        property: webhook_secret
+---
+# One API key per machine identity: OpenBao apps/ai/wiki-api-keys, field = name.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wiki-api-keys
+  namespace: ai
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: wiki-api-keys
+  data:
+    - secretKey: Auth__ApiKeys__workstation
+      remoteRef:
+        key: apps/ai/wiki-api-keys
+        property: workstation
+    - secretKey: Auth__ApiKeys__paperclip
+      remoteRef:
+        key: apps/ai/wiki-api-keys
+        property: paperclip
+---
+# TypeSafe System One key for the judge adapter (Wiki:Judges:Models:typesafe).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wiki-typesafe
+  namespace: ai
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: wiki-typesafe
+  data:
+    - secretKey: Wiki__Judges__Models__typesafe__ApiKey
+      remoteRef:
+        key: apps/ai/wiki-typesafe
+        property: api_key
+---
+# Answer model: Wiki:AnswerModels:Models:claude-sonnet. The pod starts without it (optional
+# secretRef); the questions endpoint answers 503 until the key is placed.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wiki-anthropic
+  namespace: ai
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: wiki-anthropic
+  data:
+    - secretKey: Wiki__AnswerModels__Models__claude-sonnet__ApiKey
+      remoteRef:
+        key: apps/ai/wiki-anthropic
+        property: api_key
+---
+# BasicAuth users for the machine door; same OpenBao key as the Python service used.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wiki-api-basic-auth
+  namespace: ai
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: wiki-api-basic-auth
+  dataFrom:
+    - extract:
+        key: apps/ai/wiki-index-basic-auth

kubernetes/apps/wiki/gate-service.yaml

@@ -0,0 +1,20 @@
+# ExternalName mirror so the ai-namespace Ingress can backend to the wiki-gate
+# outpost in the authentik namespace.
+#
+#   browser → traefik (wiki.renner.uno)
+#           → ak-outpost-wiki-gate (ExternalName → authentik ns)
+#           → outpost validates the session + passkey step-up, sets X-Authentik-Username
+#           → http://wiki.ai.svc.cluster.local:8080
+#
+# In-cluster clients (CI agents, the Gitea webhook) address the Service directly.
+apiVersion: v1
+kind: Service
+metadata:
+  name: ak-outpost-wiki-gate
+  namespace: ai
+spec:
+  type: ExternalName
+  externalName: ak-outpost-wiki-gate.authentik.svc.cluster.local
+  ports:
+    - port: 9000
+      targetPort: 9000

kubernetes/apps/wiki/ingress.yaml

@@ -0,0 +1,75 @@
+# wiki.renner.uno — LAN-only (no dns.renner.uno/public label). Traefik backends
+# the wiki-gate outpost, never the Service; the ai CNP admits only that outpost.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wiki
+  namespace: ai
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - wiki.renner.uno
+      secretName: wiki-tls
+  rules:
+    - host: wiki.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ak-outpost-wiki-gate
+                port:
+                  number: 9000
+---
+# wiki-index.renner.uno — the machine door (bin/wiki_rank.py, wiki_ask.py):
+# Traefik BasicAuth, and the identity header stripped so only the outpost path
+# can carry X-Authentik-Username to the service.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: wiki-api-basic-auth
+  namespace: ai
+spec:
+  basicAuth:
+    secret: wiki-api-basic-auth
+    realm: wiki
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: wiki-api-strip-identity
+  namespace: ai
+spec:
+  headers:
+    customRequestHeaders:
+      X-Authentik-Username: ""
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wiki-api
+  namespace: ai
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+    traefik.ingress.kubernetes.io/router.middlewares: ai-wiki-api-strip-identity@kubernetescrd,ai-wiki-api-basic-auth@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - wiki-index.renner.uno
+      secretName: wiki-api-tls
+  rules:
+    - host: wiki-index.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wiki
+                port:
+                  number: 8080

kubernetes/apps/wiki/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - externalsecrets.yaml
+  - deployment.yaml
+  - gate-service.yaml
+  - ingress.yaml

kubernetes/apps/woodpecker/cluster.yaml

@@ -22,7 +22,9 @@ metadata:
     # migration deliberately withheld this while a rollback still existed.
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
-  instances: 1
+  instances: 2
+  smartShutdownTimeout: 10
+  stopDelay: 60
   imageName: ghcr.io/cloudnative-pg/postgresql:16
   storage:
     storageClass: ceph-block
@@ -91,8 +93,7 @@ spec:
       # padding rather than data.
       #
       # The cost is RPO: up to 30min of WAL is unrecoverable if this cluster and
-      # its volume are lost outright. This is a single-instance cluster, so the
-      # archive is the only off-node copy.
+      # its volumes are lost outright.
       archive_timeout: "30min"
   resources:
     requests:

kubernetes/apps/woodpecker/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 resources:
   - rbac.yaml
   - server.yaml
-  - pdb.yaml
   - agent.yaml
   - service.yaml
   - ingress.yaml
@@ -22,7 +21,7 @@ resources:
   # OpenBao access, no NetworkPolicy needed. server.yaml/agent.yaml keep their
   # Reloader annotations; externalsecret.yaml keeps the 10m refreshInterval.
   # --- namespace migration, stages 1-2 (issue #433) ---
-  # Stage 2 has moved the workloads above (server, agent, service, ingress, pdb,
+  # Stage 2 has moved the workloads above (server, agent, service, ingress,
   # rbac, secrets, policies) into the `woodpecker` namespace and pointed the
   # server's DSN at wp-pg-rw.woodpecker.svc. Stage 3 retired the `apps`
   # originals; these four now describe the surviving cluster. History and the

kubernetes/apps/woodpecker/pdb.yaml

@@ -1,27 +0,0 @@
----
-# Eviction protection for the single-replica Woodpecker server StatefulSet.
-#
-# The server is SQLite-backed (single writer) on a single RWO PVC, so it is
-# deliberately replicas:1. minAvailable:1 makes the eviction API refuse
-# voluntary evictions so a node drain blocks and surfaces this pod rather
-# than yanking the live CI DB mid-write. Involuntary disruptions are not
-# affected.
-#
-# The selector MUST include app.kubernetes.io/component: server: the agent
-# Deployment in this same namespace shares app.kubernetes.io/name: woodpecker
-# (component: agent), and a name-only selector would wrongly also cover the
-# stateless, disposable agents.
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: woodpecker-server
-  namespace: woodpecker
-  labels:
-    app.kubernetes.io/name: woodpecker
-    app.kubernetes.io/component: server
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: woodpecker
-      app.kubernetes.io/component: server

kubernetes/bootstrap.sh

@@ -1955,6 +1955,7 @@ if phase_runs wait-apps; then
     wait_kustomization paperless           "Paperless (incl. pprl-pg CNPG + data PVCs)"          600
     wait_kustomization home-assistant      "Home Assistant (HAOS backup → native restore)"       180
     wait_kustomization audiobookshelf      "Audiobookshelf (incl. library/metadata PVCs)"        900
+    wait_kustomization navidrome           "Navidrome (incl. data + music library PVCs)"         600
     wait_kustomization immich              "Immich (incl. im-pg CNPG + library PVC)"             1800
 
     # Wait for cert-manager to finish issuing every Certificate. Kustomization

kubernetes/clusters/homelab/libation.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: flux-system
 spec:
   # Headless Libation CronJob that downloads new Audible books into
-  # the audiobookshelf-books PVC. Lives in the audiobookshelf namespace
+  # the audiobookshelf-books-bulk PVC. Lives in the audiobookshelf namespace
   # because k8s PVCs are namespace-scoped and we share the books volume
   # with the audiobookshelf Deployment. Depends on audiobookshelf so
   # the books PVC exists before the libation-bootstrap secret/CronJob

kubernetes/clusters/homelab/navidrome.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: navidrome
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 1m
+  timeout: 15m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./kubernetes/apps/navidrome
+  prune: true
+  wait: true
+  dependsOn:
+    - name: infrastructure
+    - name: infrastructure-crds
+    - name: infrastructure-ceph-cluster

kubernetes/clusters/homelab/paperclip.yaml

@@ -0,0 +1,25 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: paperclip
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 1m
+  timeout: 20m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./kubernetes/apps/paperclip
+  prune: true
+  wait: true
+  dependsOn:
+    - name: infrastructure
+    - name: infrastructure-crds
+    - name: infrastructure-ceph-cluster
+    - name: infrastructure-cnpg-barman
+  healthCheckExprs:
+    - apiVersion: postgresql.cnpg.io/v1
+      kind: Cluster
+      failed: "has(status.phase) && status.phase.startsWith('Failed')"
+      current: "has(status.phase) && (status.phase == 'Cluster in healthy state' || status.readyInstances > 0)"

kubernetes/clusters/homelab/wiki.yaml

@@ -1,17 +1,17 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: wiki-index
+  name: wiki
   namespace: flux-system
 spec:
   interval: 10m
   retryInterval: 1m
-  # First start on an empty PVC embeds every note (~5 min) before /health is 200.
-  timeout: 20m
+  # First start on an empty PVC syncs and embeds the whole vault before /ready is 200.
+  timeout: 25m
   sourceRef:
     kind: GitRepository
     name: flux-system
-  path: ./kubernetes/apps/wiki-index
+  path: ./kubernetes/apps/wiki
   prune: true
   wait: true
   dependsOn:

kubernetes/infrastructure/image-automation/kustomization.yaml

@@ -12,8 +12,10 @@ resources:
   - matter-server.yaml
   - mmwave-configurator.yaml
   - music-assistant.yaml
+  - navidrome.yaml
   - netbird-ingress.yaml
   - paperless-ngx.yaml
+  - paperclip.yaml
   - protonmail-bridge.yaml
   - mosquitto.yaml
   - redis.yaml
@@ -24,5 +26,6 @@ resources:
   - valkey.yaml
   - velero-plugin-for-aws.yaml
   - vsftpd.yaml
+  - wiki.yaml
   - woodpecker.yaml
   - wyoming.yaml

kubernetes/infrastructure/image-automation/navidrome.yaml

@@ -0,0 +1,20 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: navidrome
+  namespace: flux-system
+spec:
+  image: deluan/navidrome
+  interval: 1h
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: navidrome
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: navidrome
+  policy:
+    semver:
+      range: ">=0.64.0"

kubernetes/infrastructure/image-automation/paperclip.yaml

@@ -0,0 +1,25 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: paperclip
+  namespace: flux-system
+spec:
+  image: ghcr.io/paperclipai/paperclip
+  interval: 1h
+---
+# Upstream publishes no semver tags; track the nightly tag by digest.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: paperclip
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: paperclip
+  digestReflectionPolicy: Always
+  interval: 1h
+  filterTags:
+    pattern: '^nightly$'
+  policy:
+    alphabetical:
+      order: asc

kubernetes/infrastructure/image-automation/wiki.yaml

@@ -0,0 +1,24 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: wiki
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/konairius/wiki
+  interval: 10m
+---
+# The Wiki release pipeline tags every main build `build.<unix-ts>`; latest push wins.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: wiki
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: wiki
+  filterTags:
+    pattern: '^build\.(?P<ts>\d+)$'
+    extract: '$ts'
+  policy:
+    numerical:
+      order: asc

kubernetes/infrastructure/k8s-gateway/helmrelease.yaml

@@ -1,11 +1,16 @@
 apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
+kind: OCIRepository
 metadata:
   name: k8s-gateway
   namespace: kube-system
 spec:
   interval: 24h
-  url: https://k8s-gateway.github.io/k8s_gateway/
+  url: oci://codeberg.org/k8s-gateway/charts/k8s-gateway
+  ref:
+    semver: ">=2.4.0"
+  layerSelector:
+    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
+    operation: copy
 ---
 # In-cluster authoritative resolver for renner.uno.
 #
@@ -28,14 +33,10 @@ metadata:
   namespace: kube-system
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: k8s-gateway
-      version: ">=2.4.0"
-      sourceRef:
-        kind: HelmRepository
-        name: k8s-gateway
-        namespace: kube-system
+  chartRef:
+    kind: OCIRepository
+    name: k8s-gateway
+    namespace: kube-system
   install:
     remediation:
       retries: 3

kubernetes/infrastructure/namespaces/namespaces.yaml

@@ -78,6 +78,11 @@ metadata:
 ---
 apiVersion: v1
 kind: Namespace
+metadata:
+  name: navidrome
+---
+apiVersion: v1
+kind: Namespace
 metadata:
   name: immich
 ---
@@ -234,3 +239,8 @@ metadata:
   labels:
     app.kubernetes.io/name: woodpecker
     pod-security.kubernetes.io/enforce: privileged
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: paperclip

kubernetes/infrastructure/network-policies/ai-ns.yaml

@@ -149,20 +149,24 @@ spec:
             - port: "8080"
               protocol: TCP
 ---
-# wiki-index: Traefik (LAN clients behind BasicAuth) and Gitea (push webhook)
-# may reach it; it reaches OpenBao for its credentials. Gitea itself is reached
-# through Traefik, which the namespace egress above already allows.
+# wiki: the wiki-gate outpost (humans, after Authentik), Traefik (the machine
+# door wiki-index.renner.uno, BasicAuth with X-Authentik-Username stripped) and
+# Gitea (push webhook) may reach it. Gitea and wiki-embed are reached through
+# the namespace egress above; no OpenBao access.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
-  name: wiki-index
+  name: wiki
   namespace: ai
 spec:
   endpointSelector:
     matchLabels:
-      app.kubernetes.io/name: wiki-index
+      app.kubernetes.io/name: wiki
   ingress:
     - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": authentik
+            goauthentik.io/outpost-name: wiki-gate
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": ingress
             app.kubernetes.io/name: traefik
@@ -173,12 +177,3 @@ spec:
         - ports:
             - port: "8080"
               protocol: TCP
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": openbao
-            app.kubernetes.io/name: openbao
-      toPorts:
-        - ports:
-            - port: "8200"
-              protocol: TCP

kubernetes/infrastructure/network-policies/gitea-ns.yaml

@@ -65,11 +65,11 @@ spec:
               protocol: UDP
             - port: "53"
               protocol: TCP
-    # Push webhook of the notes repo to wiki-index.
+    # Push webhook of the notes repo to the wiki service.
     - toEndpoints:
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": ai
-            app.kubernetes.io/name: wiki-index
+            app.kubernetes.io/name: wiki
       toPorts:
         - ports:
             - port: "8080"

kubernetes/infrastructure/network-policies/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - ingress-isolation.yaml
   - authentik-ns.yaml
   - paperless-ns.yaml
+  - paperclip-ns.yaml
   - audiobookshelf-ns.yaml
   - home-assistant-ns.yaml
   - spegel-ns.yaml
@@ -27,4 +28,5 @@ resources:
   - trmnl-ns.yaml
   - wordpress-ns.yaml
   - ai-ns.yaml
+  - navidrome-ns.yaml
   - allow-cilium-health.yaml

kubernetes/infrastructure/network-policies/navidrome-ns.yaml

@@ -0,0 +1,92 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: navidrome
+spec:
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": navidrome
+    # Traefik: the ungated /rest and /share routes (identity header stripped).
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": authentik
+            goauthentik.io/outpost-name: navidrome-gate
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+    - fromEntities:
+        - host
+        - remote-node
+    # ICMP — see home-assistant-ns.yaml.
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": navidrome
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    # Metadata/artwork agents (Last.fm, Deezer, ListenBrainz).
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+    - toEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }

kubernetes/infrastructure/network-policies/openbao-ns.yaml

@@ -31,16 +31,6 @@ spec:
         - ports:
             - port: "8200"
               protocol: TCP
-    # wiki-index (ns ai) logs in via auth/kubernetes/role/wiki-index and reads
-    # its Gitea token and webhook secret on every sync.
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ai
-            app.kubernetes.io/name: wiki-index
-      toPorts:
-        - ports:
-            - port: "8200"
-              protocol: TCP
     # netbird-service-sync logs in via auth/kubernetes/role/netbird-service-sync
     # and reads the NetBird PAT on every pass.
     - fromEndpoints:

kubernetes/infrastructure/network-policies/paperclip-ns.yaml

@@ -0,0 +1,97 @@
+# Traefik is not admitted: the only entry is the paperclip-gate outpost (apps/paperclip/network-policy.yaml).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: paperclip
+spec:
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": database
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+    - fromEntities:
+        - host
+        - remote-node
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": authentik
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": rook-ceph
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+    - toEntities:
+        - host
+        - remote-node
+    # Cilium unions allows across CNPs, so world stays :443-only here too.
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+    - toEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }

kubernetes/infrastructure/openbao/policies/rotator-mosquitto-open3e-int.hcl

@@ -0,0 +1,30 @@
+# OpenBao policy: rotator-mosquitto-open3e-int
+#
+# Least-privilege policy for the mosquitto `open3e-int` broker-credential
+# rotation CronJob (kubernetes auth role `rotator-mosquitto-open3e-int`).
+# Per-secret isolation, same template as rotator-mosquitto-health.
+#
+# NOT applied by Flux. Apply ONCE with an admin token:
+#
+#   bao policy write rotator-mosquitto-open3e-int \
+#     kubernetes/infrastructure/openbao/policies/rotator-mosquitto-open3e-int.hcl
+#
+#   bao write auth/kubernetes/role/rotator-mosquitto-open3e-int \
+#     bound_service_account_names=mosquitto-open3e-int-secret-rotator \
+#     bound_service_account_namespaces=openbao \
+#     policies=rotator-mosquitto-open3e-int ttl=15m
+#
+# Do NOT set token_no_default_policy=true (kv-v2 patch preflight needs default).
+#
+# BOOTSTRAP: `random` mode rotates an existing field and never creates one.
+# Seed the path once with a `password` field before the first rotation:
+#
+#   bao kv put -mount=homelab apps/home-assistant/mosquitto-open3e-int-credentials \
+#     password=<generated>
+#
+# The consumer is the open3e-esp32 gateway on the heat pump's internal CAN
+# (NVS key mq_pass); a rotation takes effect on the device only after its
+# MQTT settings are updated (web UI or NVS image).
+path "homelab/data/apps/home-assistant/mosquitto-open3e-int-credentials" {
+  capabilities = ["read", "patch"]
+}

kubernetes/infrastructure/openbao/policies/wiki-index.hcl

@@ -1,21 +0,0 @@
-# OpenBao policy: wiki-index
-#
-# The wiki-index Deployment (namespace ai) reads its Gitea token and the
-# webhook HMAC secret on every use. Read-only on that one path.
-#
-# NOT applied by Flux. Apply ONCE with an admin token:
-#
-#   bao policy write wiki-index kubernetes/infrastructure/openbao/policies/wiki-index.hcl
-#   bao write auth/kubernetes/role/wiki-index \
-#     bound_service_account_names=wiki-index \
-#     bound_service_account_namespaces=ai \
-#     policies=wiki-index ttl=15m
-#
-# Secret: homelab/apps/ai/wiki-index, keys `gitea_token` (read:repository on
-# the notes repo) and `webhook_secret` (the Gitea webhook's secret).
-#
-# Do NOT set token_no_default_policy=true (kv-v2 preflight needs the default policy).
-
-path "homelab/data/apps/ai/wiki-index" {
-  capabilities = ["read"]
-}