Merge pull request 'fix(review-bot): mint the review token with read:issue' (#1507 ) from review-bot-token-read-issue into main

Reviewed-on: #1507
fix(review-bot): mint the review token with read:issue
2026-10-28 00:27:23 +00:00 · 2026-10-28 01:26:10 +01:00 · 2026-10-28 00:11:57 +00:00 · 2026-10-28 00:11:00 +00:00 · 2026-10-27 23:18:44 +00:00 · 2026-10-27 23:16:09 +00:00
517 changed files with 21117 additions and 5567 deletions
@@ -20,11 +20,5 @@ kubernetes/access-staging/
 trivy-iac.json
 trivy-image-*.json

-# Alert-monitor pipeline workspace (generated in CI, never commit)
-.ci-alert-monitor/
-
-# CI diagnostic kubeconfig + kubectl for the agent steps (generated, never commit)
-.ci-diag/
-
 # Plaintext secret templates awaiting SOPS encryption (never commit)
 *.plaintext.yaml
@@ -1,298 +0,0 @@
-# Alert monitor — every 15 minutes, read the active alerts from Alertmanager.
-# When a NEW alert is firing, an AI agent triages it against the repo and the
-# cluster context gathered here; alerts it confirms as real problems become
-# Gitea issues, which the issue-fix pipeline (issue-fix.yml) later turns into
-# PRs. Alerts it classifies as noise are recorded in a persistent "Alert
-# monitor: noise log" issue so they are never re-triaged (delete a line from
-# that issue to un-suppress an alert).
-#
-# Alertmanager access: the woodpecker-ci namespace cannot reach monitoring
-# ClusterIPs directly (Cilium default-deny-ingress on monitoring, see
-# kubernetes/infrastructure/network-policies/monitoring-ns.yaml), and the
-# public hostname alerts.renner.uno sits behind the Authentik gate. The
-# apiserver *service proxy* path works: apiserver→pod traffic arrives with
-# host/remote-node identity, which that policy explicitly allows. Verified
-# 2026-07-16 with `kubectl get --raw .../services/kube-prometheus-stack-
-# alertmanager:9093/proxy/api/v2/alerts`.
-#
-# Step split: the ci-k8s image has kubectl/flux but NO jq; the ci-claude image
-# has jq but no kubectl. So the fetch step only talks to the cluster and dumps
-# raw files into the workspace, and every JSON decision (heartbeat filter,
-# dedup, gating) lives in the agent step.
-#
-# Dedup contract (what makes 15-minute re-runs cheap): an alert is dropped
-# before the agent ever sees it when EITHER
-#   - an open issue titled exactly "[alert] <alertname> (<namespace|job|cluster>)"
-#     exists (namespace first, job as fallback for aggregate alerts), OR
-#   - its Alertmanager fingerprint appears in the noise-log issue body.
-# Runs where nothing new is firing stop before the agent — no tokens spent.
-#
-# Triggering:
-#   - cron   : a cron NAMED exactly "alert-monitor" (name filter, same
-#              mechanism as update-audit.yml):
-#                woodpecker repo cron add --repo k.renner/homelab \
-#                  --name alert-monitor --branch master --schedule '*/15 * * * *'
-#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> alert-monitor
-#              where <n> is an existing pipeline to promote.
-when:
-  - event: cron
-    cron: alert-monitor
-  - event: deployment
-    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "alert-monitor"'
-
-steps:
-  - name: fetch-alerts
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-09-08
-    environment:
-      SOPS_AGE_KEY:
-        from_secret: sops_age_key
-      S3_ACCESS_KEY_ID:
-        from_secret: hetzner_s3_access_key
-      S3_SECRET_ACCESS_KEY:
-        from_secret: hetzner_s3_secret_key
-    commands:
-      - bash scripts/ci/fetch-kubeconfig.sh
-      - |
-        # Active, unsilenced, uninhibited alerts — raw dump; filtering happens
-        # in the agent step (no jq in this image).
-        set -eu
-        mkdir -p .ci-alert-monitor
-        AM="/api/v1/namespaces/monitoring/services/kube-prometheus-stack-alertmanager:9093/proxy"
-        kubectl get --raw "$$AM/api/v2/alerts?active=true&silenced=false&inhibited=false" \
-          > .ci-alert-monitor/alerts-raw.json
-        head -c 400 .ci-alert-monitor/alerts-raw.json; echo
-      - |
-        # Blip lookback: an alert that fires and resolves BETWEEN ticks is
-        # invisible to the live snapshot (a 17-minute KubeHpaMaxedOut escaped
-        # exactly this way on 2026-07-16). Scan Prometheus's ALERTS history
-        # over ~2 tick intervals + jitter; the overlap between runs is
-        # deduped downstream like everything else.
-        set -eu
-        PROM="/api/v1/namespaces/monitoring/services/kube-prometheus-stack-prometheus:9090/proxy"
-        kubectl get --raw "$$PROM/api/v1/query?query=max%20by%20(alertname,namespace,job,severity)%20(max_over_time(ALERTS%7Balertstate%3D%22firing%22,alertname!~%22Watchdog%7CInfoInhibitor%22%7D%5B35m%5D))" \
-          > .ci-alert-monitor/blips-raw.json \
-          || printf '{"data":{"result":[]}}' > .ci-alert-monitor/blips-raw.json
-        # (no jq in this image — counting happens in the agent step)
-        head -c 300 .ci-alert-monitor/blips-raw.json; echo
-      - |
-        # Cluster context for the triage agent — gathered here because the
-        # agent itself gets NO cluster access (no Bash, no kubeconfig). Runs
-        # unconditionally (a handful of read-only calls every 15 min is
-        # cheaper than teaching this jq-less step to gate on the JSON).
-        set -eu
-        {
-          echo "=== nodes ==="
-          kubectl get nodes -o wide
-          echo "=== pods not Running/Succeeded ==="
-          kubectl get pods -A --no-headers | grep -Ev 'Running|Completed|Succeeded' || echo "(none)"
-          echo "=== warning events (most recent last, tail 100) ==="
-          kubectl get events -A --field-selector type=Warning --sort-by=.lastTimestamp | tail -100
-          echo "=== flux kustomizations not ready ==="
-          flux get kustomizations -A --status-selector ready=false 2>&1 || true
-          echo "=== flux helmreleases not ready ==="
-          flux get helmreleases -A --status-selector ready=false 2>&1 || true
-        } > .ci-alert-monitor/context.txt
-        wc -l .ci-alert-monitor/context.txt
-      - |
-        # Least-privilege live-diagnostics kubeconfig (+ kubectl binary — the
-        # ci-claude image ships none) so the triage agent can VERIFY instead
-        # of hypothesize. Degrades to snapshot-only if the ServiceAccount
-        # isn't reconciled yet.
-        bash scripts/ci/make-diag-kubeconfig.sh
-
-  - name: alert-triage-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
-    environment:
-      CLAUDE_CODE_OAUTH_TOKEN:
-        from_secret: claude_code_oauth_token
-      # Dedicated identity: alert-monitor-bot, PAT scoped to write:issue ONLY.
-      # This step runs an LLM agent over untrusted input (alert annotations,
-      # cluster event text) and its output is published verbatim as a public
-      # issue body, so the credential it holds must not be able to do anything
-      # but write issues. The account is a write collaborator, but the PAT
-      # scope is the real cap: verified 403 on /user/repos and /admin/users.
-      # Replaces the admin-owned gitea_token that used to sit here (#330).
-      GITEA_TOKEN:
-        from_secret: alert_monitor_bot_token
-    commands:
-      - |
-        # Filter + dedup + gate. Drops the always-firing heartbeats
-        # (Watchdog, InfoInhibitor), alerts routed ONLY to the `null`
-        # receiver (the owner already declared those unactionable in the
-        # Alertmanager route config — triaging them re-litigates a settled
-        # decision; found via #252/KubeCPUOvercommit), alerts that already
-        # have an open "[alert] ..." issue, and fingerprints recorded in the
-        # noise log. The repo is public, so these reads need no token. Exits
-        # the step — agent never starts — when nothing new is firing.
-        set -eu
-        jq '[.[]
-             | select(.labels.alertname != "Watchdog" and .labels.alertname != "InfoInhibitor")
-             | select([.receivers[]?.name] | (length == 0) or any(. != "null"))]' \
-          .ci-alert-monitor/alerts-raw.json > .ci-alert-monitor/alerts-active.json
-        echo "Active alerts (after heartbeat filter): $$(jq length .ci-alert-monitor/alerts-active.json)"
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
-        curl -sfL "$$API/issues?state=open&type=issues&limit=100" > .ci-alert-monitor/open-issues.json
-        TITLES=$$(jq -c '[.[].title]' .ci-alert-monitor/open-issues.json)
-        NOISE_BODY=$$(jq -r 'map(select(.title == "Alert monitor: noise log")) | .[0].body // ""' \
-          .ci-alert-monitor/open-issues.json)
-        # Suppression entries are exactly the structured lines the write-back
-        # step emits: "- <fp> <ALERTNAME> — <YYYY-MM-DD>: <reason>". Parse THAT
-        # shape rather than grepping the whole body for 16-hex tokens. A reason
-        # routinely cites another alert's fingerprint in prose ("see the issue
-        # filed for fingerprint <fp>"), and the body-wide grep turned every such
-        # citation into a silent, permanent suppression of an alert that was
-        # never classified as noise — verified against the live noise log, which
-        # yielded 22 fingerprints for 21 real entries, the extra one being
-        # 2ddc41edb689fc33, an alert that HAD been filed as a genuine issue.
-        #
-        # Entries also expire after NOISE_TTL_DAYS. A noise verdict says "this
-        # occurrence was benign", not "this alert can never be interesting
-        # again" — but the fingerprint is sha256(alertname|scope) and therefore
-        # stable across recurrences, so without an expiry a single blip mutes
-        # that alertname+scope pair forever. Re-triaging a recurrence weeks
-        # later is cheap; missing a real outage because a July blip muted
-        # openbao's KubePodNotReady is not.
-        #
-        # Lines that fail to parse are simply dropped, i.e. they stop
-        # suppressing — this fails toward MORE alerting, never less.
-        #
-        # date is BusyBox here, not GNU: `date -d '30 days ago'` errors out, so
-        # the cutoff goes through epoch arithmetic and `date -d @<epoch>`, which
-        # this image does support.
-        NOISE_TTL_DAYS=$${NOISE_TTL_DAYS:-30}
-        CUTOFF=$$(date -u -d @$$(( $$(date -u +%s) - NOISE_TTL_DAYS * 86400 )) +%F)
-        FPS=$$(printf '%s\n' "$$NOISE_BODY" \
-          | sed -nE 's/^- ([0-9a-f]{16}) [^ ]+ — ([0-9]{4}-[0-9]{2}-[0-9]{2}):.*/\2 \1/p' \
-          | awk -v c="$$CUTOFF" 'BEGIN{gsub(/-/,"",c)} { d=$$1; gsub(/-/,"",d); if (d+0 >= c+0) print $$2 }' \
-          | jq -R -s -c 'split("\n") | map(select(length > 0))')
-        echo "Noise suppressions in effect: $$(printf '%s' "$${FPS:-[]}" | jq length)" \
-             "(TTL $${NOISE_TTL_DAYS}d, entries dated >= $$CUTOFF)"
-        # Synthesize pseudo-alerts for BLIPS: lookback series whose label set
-        # is not currently firing at all (checked against the PRE-filter raw
-        # snapshot, so live-but-null-routed alerts don't reappear as blips).
-        # Pseudo-fingerprint = sha256(alertname|scope)[:16] — STABLE across
-        # recurrences, so one noise verdict suppresses a flappy alert
-        # permanently via the noise log.
-        : > .ci-alert-monitor/blips-new.jsonl
-        jq -c '.data.result[]?.metric // empty' .ci-alert-monitor/blips-raw.json | while IFS= read -r M; do
-          NAME=$$(printf '%s' "$$M" | jq -r '.alertname')
-          SCOPE=$$(printf '%s' "$$M" | jq -r '.namespace // .job // "cluster"')
-          if jq -e --arg n "$$NAME" --arg s "$$SCOPE" \
-               '[.[] | select(.labels.alertname == $$n and ((.labels.namespace // .labels.job // "cluster") == $$s))] | length > 0' \
-               .ci-alert-monitor/alerts-raw.json > /dev/null; then
-            continue
-          fi
-          FP=$$(printf '%s|%s' "$$NAME" "$$SCOPE" | sha256sum | cut -c1-16)
-          jq -n --arg fp "$$FP" --argjson m "$$M" \
-            '{labels: $$m, fingerprint: $$fp, blip: true,
-              annotations: {summary: "BLIP: fired within the lookback window (~35 min) and already resolved — caught by the ALERTS history scan, not currently active."}}' \
-            >> .ci-alert-monitor/blips-new.jsonl
-        done
-        jq -s '.' .ci-alert-monitor/blips-new.jsonl > .ci-alert-monitor/blips-candidates.json
-        # Title key: namespace, else job, else "cluster". The job fallback
-        # exists because aggregate alerts like TargetDown carry no namespace
-        # — with only "(cluster)" two simultaneous TargetDowns for different
-        # jobs (pve and dns-servers, 2026-07-16) collapsed into ONE issue
-        # and the second root cause was never triaged.
-        jq -s 'add' .ci-alert-monitor/alerts-active.json .ci-alert-monitor/blips-candidates.json \
-          > .ci-alert-monitor/alerts-combined.json
-        jq --argjson titles "$$TITLES" --argjson fps "$${FPS:-[]}" '
-          [ .[]
-            | ("[alert] " + .labels.alertname + " (" + (.labels.namespace // .labels.job // "cluster") + ")") as $$t
-            | select( ($$t | IN($$titles[]) | not) and (.fingerprint | IN($$fps[]) | not) )
-            | . + {issue_title: $$t} ]' \
-          .ci-alert-monitor/alerts-combined.json > .ci-alert-monitor/alerts-new.json
-        NEW=$$(jq length .ci-alert-monitor/alerts-new.json)
-        jq -r '.[] | "\(.fingerprint)\t\(.issue_title)"' .ci-alert-monitor/alerts-new.json
-        if [ "$$NEW" -eq 0 ]; then
-          echo "No new alerts — agent not started."
-          exit 0
-        fi
-      - |
-        # Headless triage run. Same auth model as security-scan.yml
-        # (subscription OAuth, prompt piped via stdin — see the comments
-        # there). Tool allowlist is read-only on the repo plus Write for the
-        # /tmp verdict file, plus EXACTLY ONE live command: the RBAC-scoped
-        # kubectl from make-diag-kubeconfig.sh (read-only ClusterRole, no
-        # Secrets). The prefix match means no pipes/redirects and no other
-        # binaries — the agent verifies cluster state, it cannot mutate it,
-        # fetch the web, or read secrets.
-        export KUBECONFIG="$$PWD/.ci-diag/kubeconfig"
-        # Model chosen live from the catalog (not hardcoded, no family assumed) —
-        # see the header of scripts/ci/pick-model.sh. Empty MODEL -> CLI default.
-        MODEL=$$(sh scripts/ci/pick-model.sh "triage firing Prometheus/Alertmanager alerts against read-only live cluster state and classify each as a real problem or noise; careful diagnostic reasoning, no changes")
-        if [ -n "$$MODEL" ]; then echo "alert-monitor: selected model $$MODEL"; else echo "alert-monitor: no live catalog — using the CLI default model"; fi
-        cat ci/agents/alert-monitor/prompt.md | claude $${MODEL:+--model $$MODEL} \
-          --permission-mode acceptEdits \
-          --allowedTools "Read,Glob,Grep,Write,Bash(./.ci-diag/kubectl:*)" \
-          --settings ci/agents/alert-monitor/settings.json \
-          -p
-      - |
-        # Post the verdicts: one Gitea issue per confirmed problem, and one
-        # appended line in the persistent noise log per noise verdict. Every
-        # write checks its HTTP status explicitly (see update-audit.yml for
-        # why piping into `curl -sf | jq` is not enough).
-        set -eu
-        if [ ! -s /tmp/alert-verdicts.json ]; then
-          echo "Agent wrote no verdicts (/tmp/alert-verdicts.json missing) — nothing to post."
-          exit 0
-        fi
-        jq . /tmp/alert-verdicts.json > /dev/null   # fail loudly on malformed output
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
-        STAMP=$$(date -u +%Y-%m-%d)
-
-        gitea_write() {
-          code=$$(curl -s -o /tmp/gitea-resp.json -w '%{http_code}' \
-            -X "$$1" -H "Authorization: token $$GITEA_TOKEN" \
-            -H "Content-Type: application/json" --data @"$$3" "$$2")
-          echo "$$1 $$2 -> HTTP $$code"
-          if [ "$$code" -lt 200 ] || [ "$$code" -ge 300 ]; then
-            echo "Gitea API error body:"; cat /tmp/gitea-resp.json; echo
-            return 1
-          fi
-        }
-
-        N=$$(jq length /tmp/alert-verdicts.json)
-        i=0
-        : > /tmp/noise-lines.txt
-        while [ "$$i" -lt "$$N" ]; do
-          VERDICT=$$(jq -r ".[$$i].verdict" /tmp/alert-verdicts.json)
-          TITLE=$$(jq -r ".[$$i].title" /tmp/alert-verdicts.json)
-          FP=$$(jq -r ".[$$i].fingerprint" /tmp/alert-verdicts.json)
-          NAME=$$(jq -r ".[$$i].alertname" /tmp/alert-verdicts.json)
-          REASON=$$(jq -r ".[$$i].reason" /tmp/alert-verdicts.json)
-          if [ "$$VERDICT" = "problem" ]; then
-            # Safety re-check: never double-file if a parallel run won the race.
-            EXISTS=$$(curl -sfL "$$API/issues?state=open&type=issues&limit=100" \
-              | jq -r --arg t "$$TITLE" 'map(select(.title == $$t)) | length')
-            if [ "$$EXISTS" -gt 0 ]; then
-              echo "Issue already open for '$$TITLE' — skipping."
-            else
-              jq --arg footer "$$(printf '\n\n---\n<!-- alert-monitor:fingerprint=%s -->\n_Filed automatically by the alert-monitor pipeline (%s). The issue-fix pipeline may pick this up and open a PR._' "$$FP" "$$STAMP")" \
-                 --argjson idx "$$i" \
-                 '.[$$idx] | {title: .title, body: (.body + $$footer)}' \
-                 /tmp/alert-verdicts.json > /tmp/gitea-create.json
-              gitea_write POST "$$API/issues" /tmp/gitea-create.json
-              jq '{number, html_url, title}' /tmp/gitea-resp.json
-            fi
-          else
-            printf -- '- %s %s — %s: %s\n' "$$FP" "$$NAME" "$$STAMP" "$$REASON" >> /tmp/noise-lines.txt
-          fi
-          i=$$((i+1))
-        done
-
-        if [ -s /tmp/noise-lines.txt ]; then
-          NOISE_NUM=$$(curl -sfL "$$API/issues?state=open&type=issues&limit=100" \
-            | jq -r 'map(select(.title == "Alert monitor: noise log")) | .[0].number // empty')
-          if [ -n "$$NOISE_NUM" ]; then
-            curl -sfL "$$API/issues/$$NOISE_NUM" | jq -r '.body // ""' > /tmp/noise-old.txt
-            jq -n --rawfile old /tmp/noise-old.txt --rawfile add /tmp/noise-lines.txt \
-              '{body: ($$old + "\n" + $$add)}' > /tmp/gitea-patch.json
-            gitea_write PATCH "$$API/issues/$$NOISE_NUM" /tmp/gitea-patch.json
-          else
-            printf '%s\n\n' "Fingerprints the alert-monitor triage agent classified as noise. The dedup step skips any alert whose fingerprint appears below — delete a line to make that alert eligible for triage again. Keep this issue open; it is the suppression state. Entries EXPIRE after NOISE_TTL_DAYS (default 30) counted from the date in the line, so a one-off blip stops suppressing its alertname+scope pair once the window passes; re-add happens automatically if it is triaged as noise again. Only lines in the exact '- <fingerprint> <ALERTNAME> — <YYYY-MM-DD>: <reason>' form suppress anything — a fingerprint mentioned in prose does not." > /tmp/noise-header.txt
-            jq -n --rawfile hdr /tmp/noise-header.txt --rawfile add /tmp/noise-lines.txt \
-              '{title: "Alert monitor: noise log", body: ($$hdr + $$add)}' > /tmp/gitea-create.json
-            gitea_write POST "$$API/issues" /tmp/gitea-create.json
-          fi
-        fi
@@ -27,7 +27,7 @@
 # Note this pipeline runs no LLM agent, so the exfil path that motivated the
 # other cutovers does not apply to it.
 #
-# Push builds run on master only. Without the branch filter a feature branch
+# Push builds run on main only. Without the branch filter a feature branch
 # that touches this file started all steps at once: it pushed unreviewed
 # images and used the whole woodpecker-ci-quota, so the PR checks could not
 # get a pod (REN-286).
@@ -36,7 +36,7 @@
 # image, and in parallel they exceed the woodpecker-ci-quota.
 when:
  - event: push
-    branch: master
+    branch: main
    path:
      - "ci/images/**"
      - "secret-rotator/**"
@@ -454,6 +454,32 @@ steps:
          --destination gitea.renner.uno/gitea_admin/kuma-sync:$TAG \
          --destination gitea.renner.uno/gitea_admin/kuma-sync:latest

+  # cloudflare-lb-sync: reconciles CloudflareLoadBalancer resources into
+  # Cloudflare. Its unit tests run as a stage of the image build.
+  - name: build-cloudflare-lb-sync
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    directory: ci/images/cloudflare-lb-sync
+    when:
+      - event: deployment
+      - event: push
+        path: ["ci/images/cloudflare-lb-sync/**", ".woodpecker/build-ci-images.yml"]
+    environment:
+      GITEA_USER: gitea_admin
+      GITEA_TOKEN:
+        from_secret: ci_images_token
+    commands:
+      - mkdir -p /kaniko/.docker
+      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+      # YYYY-MM-DD-HHMM: the image-automation ImagePolicy picks the newest.
+      - TAG=$(date +%Y-%m-%d-%H%M)
+      - |
+        /kaniko/executor \
+          --context . \
+          --dockerfile Containerfile \
+          --destination gitea.renner.uno/gitea_admin/cloudflare-lb-sync:$TAG \
+          --destination gitea.renner.uno/gitea_admin/cloudflare-lb-sync:latest
+
  # bird: BGP daemon for the pod-network mesh over pod0 (#576). Runtime
  # artifact like heating-can; same registry so the audit tracks it.
  - name: build-bird
@@ -46,20 +46,20 @@
 #                                push/cron/manual events this pipeline fires on.
 #
 # OWNER SETUP — the token + secret above are already provisioned. The one
-# remaining step, to be run AFTER this merges to master (a cron references a
+# remaining step, to be run AFTER this merges to main (a cron references a
 # pipeline that must exist on the target branch), is to register the schedule:
-#   woodpecker repo cron add --repo k.renner/homelab \
-#     --name ci-claude-refresh --branch master --schedule '@weekly'
+#   woodpecker repo cron add --repo konairius/homelab \
+#     --name ci-claude-refresh --branch main --schedule '@weekly'
 # Weekly is plenty; the pipelines tolerate being a few days behind a release.
 #
 # Triggering:
 #   - cron   : the cron NAMED exactly "ci-claude-refresh" (see above).
-#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> ci-claude-refresh
+#   - deploy : woodpecker-cli pipeline deploy konairius/homelab <n> ci-claude-refresh
 #              where <n> is an existing pipeline to promote.
-#   - push   : a change to the Containerfile (or this file) ON master forces a
+#   - push   : a change to the Containerfile (or this file) ON main forces a
 #              rebuild of the current latest version so Containerfile fixes ship
-#              promptly. Restricted to master ON PURPOSE — a feature branch must
-#              never build/push an image or open a bump PR (only master pushes
+#              promptly. Restricted to main ON PURPOSE — a feature branch must
+#              never build/push an image or open a bump PR (only main pushes
 #              images), and without this filter every PR that edits these paths
 #              would do exactly that from its own branch.
 when:
@@ -68,7 +68,7 @@ when:
  - event: deployment
    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "ci-claude-refresh"'
  - event: push
-    branch: master
+    branch: main
    path:
      - "ci/images/claude/**"
      - ".woodpecker/ci-claude-refresh.yml"
@@ -174,9 +174,9 @@ steps:
        # Both were validated non-empty by the decide step; re-assert before a
        # sed that would corrupt every pin if either were blank.
        [ -n "$$NEW" ] && [ -n "$$CUR" ] || { echo "empty version/current sentinel — aborting"; exit 1; }
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
+        API="https://gitea.renner.uno/api/v1/repos/konairius/homelab"
        BRANCH="ci-image/claude-$$NEW"
-        if git ls-remote --heads "https://gitea.renner.uno/k.renner/homelab.git" "$$BRANCH" | grep -q .; then
+        if git ls-remote --heads "https://gitea.renner.uno/konairius/homelab.git" "$$BRANCH" | grep -q .; then
          echo "Branch $$BRANCH already exists — a PR for $$NEW is already open. Nothing to do."
          exit 0
        fi
@@ -197,7 +197,7 @@ steps:
        git checkout -b "$$BRANCH"
        git add $$CONSUMERS
        git commit -m "chore(ci): bump ci-claude image to $$NEW"
-        git push "https://$$PUSH_TOKEN@gitea.renner.uno/k.renner/homelab.git" HEAD:"$$BRANCH"
+        git push "https://$$PUSH_TOKEN@gitea.renner.uno/konairius/homelab.git" HEAD:"$$BRANCH"
        {
          printf 'Automated bump of the ci-claude agent image from `%s` to `%s`.\n\n' "$$CUR" "$$NEW"
          printf 'The refresh pipeline built and pushed `ci-claude:%s` (and `:latest`) from the\n' "$$NEW"
@@ -208,7 +208,7 @@ steps:
        jq -n --arg title "chore(ci): bump ci-claude image to $$NEW" \
              --rawfile body /tmp/pr-body.md \
              --arg head "$$BRANCH" \
-          '{title: $$title, body: $$body, head: $$head, base: "master"}' > /tmp/pr.json
+          '{title: $$title, body: $$body, head: $$head, base: "main"}' > /tmp/pr.json
        code=$$(curl -s -o /tmp/resp.json -w '%{http_code}' \
          -X POST -H "Authorization: token $$PUSH_TOKEN" \
          -H "Content-Type: application/json" --data @/tmp/pr.json "$$API/pulls")
@@ -66,9 +66,9 @@ steps:
  # Verified green across every kustomization in the tree when this was added,
  # so this gates new breakage rather than pre-existing debt.
  #
-  # ci-k8s TAG SPLIT: this file pins a newer dated tag than e2e.yml, e2e-test.yml,
-  # alert-monitor.yml and issue-fix.yml, which still sit on an older one. That is
-  # staleness in those four, not a deliberate split here — everything should be on
+  # ci-k8s TAG SPLIT: this file pins a newer dated tag than e2e.yml and
+  # e2e-test.yml, which still sit on an older one. That is
+  # staleness in those two, not a deliberate split here — everything should be on
  # the newest dated tag. They are not bumped here because none of them are
  # triggered by this PR, so it would ship untested changes under cover of a green
  # run that never touched them. Tracked in #461.
@@ -319,7 +319,7 @@ steps:
  # writes its stripped mirror under mktemp and never into the workspace.
  - name: promtool
    depends_on: [] # see note above `steps:`
-    image: prom/prometheus:v3.15.0@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e
+    image: prom/prometheus:v3.15.1@sha256:fa3302279710be2f21a8301ec17a8b4f2301fd829bd113839b3b6b02b6f191a2
    commands:
      - sh scripts/ci/promtool-rules.sh

@@ -35,28 +35,40 @@ when:
 steps:
  - name: model-selection-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    commands:
      - sh scripts/ci/test-model-selection.sh

  - name: pr-review-mistral-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    commands:
      - sh scripts/ci/test-pr-review-mistral.sh

  - name: promtool-rules-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    commands:
      - sh scripts/ci/test-promtool-rules.sh

  - name: yaml-citations-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    commands:
      - sh scripts/ci/test-yaml-citations.sh

+  # Offline unittests for the Hermes skill scripts
+  # (kubernetes/apps/hermes/skills/): the [alert] title, noise-log and blip
+  # fingerprint contract the alert-monitor dedup depends on, the issue->card
+  # bridge, and the secret guard.
+  - name: hermes-skill-tests
+    depends_on: []
+    image: python:3.15-alpine@sha256:d44b1254cb92329418d164b22b20d86bbd3869d48e80e09e476531a409a728bb
+    environment:
+      PYTHONDONTWRITEBYTECODE: "1"
+    commands:
+      - python3 -m unittest discover -s kubernetes/apps/hermes/skills/tests -v
+
  - name: backup-verify-tests
    depends_on: []
    image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-10
@@ -1,33 +0,0 @@
-when:
-  # Deploy only on master (merge) + manual — never auto-deploy from a branch.
-  - event: push
-    branch: master
-    path:
-      - "ansible/roles/claude-workstation/**"
-      - "ansible/plays/install-claude-workstation.yml"
-      - ".woodpecker/deploy-claude-workstation.yml"
-  - event: deployment
-    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-claude-workstation"'
-
-timeout: 30
-
-steps:
-  - name: deploy-claude-workstation
-    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
-    environment:
-      ANSIBLE_FORCE_COLOR: "true"
-      ANSIBLE_HOST_KEY_CHECKING: "false"
-      ANSIBLE_ROLES_PATH: "../roles:./roles"
-      SSH_PRIVATE_KEY:
-        from_secret: ssh_private_key
-      VAULT_PASS:
-        from_secret: vault_pass
-    commands:
-      - mkdir -p ~/.ssh
-      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
-      - chmod 600 ~/.ssh/id_ed25519
-      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
-      - cd ansible
-      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
-      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
-      - ansible-playbook -i inventory/ plays/install-claude-workstation.yml -v
@@ -1,36 +0,0 @@
-when:
-  # Deploy only on master (merge) + manual — never auto-deploy from a branch.
-  - event: push
-    branch: master
-    path:
-      - "ansible/roles/mqtt-bridge/**"
-      - "ansible/plays/edge-mqtt-bridge.yml"
-      - "ansible/inventory/group_vars/edge_host/**"
-      - ".woodpecker/deploy-edge-mqtt-bridge.yml"
-  - event: deployment
-    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-edge-mqtt-bridge"'
-
-timeout: 30
-
-steps:
-  - name: deploy-edge-mqtt-bridge
-    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
-    environment:
-      ANSIBLE_FORCE_COLOR: "true"
-      ANSIBLE_HOST_KEY_CHECKING: "false"
-      ANSIBLE_ROLES_PATH: "../roles:./roles"
-      SSH_PRIVATE_KEY:
-        from_secret: ssh_private_key
-      VAULT_PASS:
-        from_secret: vault_pass
-    commands:
-      - mkdir -p ~/.ssh
-      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
-      - chmod 600 ~/.ssh/id_ed25519
-      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
-      - cd ansible
-      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
-      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
-      # Local MQTT bridge on the edge hosts only (REN-1307); restarts only the
-      # local mosquitto on edge-1, never the cluster broker.
-      - ansible-playbook -i inventory/ plays/edge-mqtt-bridge.yml -v
@@ -1,10 +1,10 @@
 when:
-  # Plan only on master (merge) + manual — a push trigger without this gate
+  # Plan only on main (merge) + manual — a push trigger without this gate
  # would run `tofu plan` (which evaluates provider/data-source code) with
  # all proxmox/hetzner/unifi secrets mounted for any pushed branch,
  # including malicious feature-branch .tf.
  - event: push
-    branch: master
+    branch: main
    path:
      - "opentofu/**"
      - ".woodpecker/deploy-infrastructure.yml"
@@ -13,7 +13,7 @@ when:

 steps:
  - name: validate-secrets
-    image: alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+    image: alpine:3.24.3@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
    environment:
      TF_VAR_proxmox_api_url:
        from_secret: proxmox_api_url
@@ -109,8 +109,6 @@ steps:
        from_secret: hetzner_s3_access_key
      TF_VAR_hetzner_s3_secret_key:
        from_secret: hetzner_s3_secret_key
-      SSH_PRIVATE_KEY:
-        from_secret: ssh_private_key
      PROXMOX_TOKEN_ID:
        from_secret: proxmox_token_id
      PROXMOX_TOKEN_SECRET:
@@ -121,11 +119,6 @@ steps:
      ANSIBLE_ROLES_PATH: "../roles:./roles"
      ANSIBLE_FORCE_COLOR: "true"
    commands:
-      - mkdir -p ~/.ssh
-      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
-      - chmod 600 ~/.ssh/id_ed25519
-      - export TF_VAR_ssh_private_key="$(cat ~/.ssh/id_ed25519)"
-      - printf "Host *\n\tStrictHostKeyChecking no\n" > ~/.ssh/config
      - echo "$VAULT_PASS" > /tmp/.vault_pass && chmod 600 /tmp/.vault_pass
      - export ANSIBLE_VAULT_PASSWORD_FILE=/tmp/.vault_pass
      - tofu init -upgrade -backend-config="access_key=$AWS_ACCESS_KEY_ID" -backend-config="secret_key=$AWS_SECRET_ACCESS_KEY"
@@ -1,35 +0,0 @@
-when:
-  # Deploy only on master (merge) + manual — never auto-deploy from a branch.
-  - event: push
-    branch: master
-    path:
-      - "ansible/roles/netbird-client/**"
-      - "ansible/plays/install-netbird-client.yml"
-      - "ansible/inventory/group_vars/claude_workstation/**"
-      - ".woodpecker/deploy-netbird-client.yml"
-  - event: deployment
-    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-client"'
-
-timeout: 30
-
-steps:
-  - name: deploy-netbird-client
-    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
-    environment:
-      ANSIBLE_FORCE_COLOR: "true"
-      ANSIBLE_HOST_KEY_CHECKING: "false"
-      ANSIBLE_ROLES_PATH: "../roles:./roles"
-      SSH_PRIVATE_KEY:
-        from_secret: ssh_private_key
-      VAULT_PASS:
-        from_secret: vault_pass
-    commands:
-      - mkdir -p ~/.ssh
-      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
-      - chmod 600 ~/.ssh/id_ed25519
-      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
-      - cd ansible
-      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
-      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
-      # Enrol only the off-site Claude workstation into the Netbird mesh.
-      - ansible-playbook -i inventory/ plays/install-netbird-client.yml --limit claude_workstation -v
@@ -1,54 +0,0 @@
-when:
-  # Deploy only on master (merge) + manual — never auto-deploy from a branch.
-  - event: push
-    branch: master
-    path:
-      - "ansible/roles/netbird-proxy/**"
-      # install-netbird-proxy.yml also applies the netbird-proxy-watchdog role,
-      # so changes to it must redeploy this host too.
-      - "ansible/roles/netbird-proxy-watchdog/**"
-      # install-netbird-proxy.yml also applies the edge bouncer.
-      - "ansible/roles/crowdsec-edge-bouncer/**"
-      - "ansible/plays/install-netbird-proxy.yml"
-      # The variables that steer those roles, not just the roles themselves.
-      # Without these two, a change that only touches inventory never deploys
-      # and nothing says so: arming the bouncer lives in host_vars, and its
-      # LAPI key lives in group_vars, so both would sit in git looking applied
-      # while the hosts kept running the previous configuration.
-      #
-      # pve_hosts.yml is deliberately NOT listed. It is the single inventory
-      # file for the whole fleet, so listing it would redeploy the proxies for
-      # any unrelated host edit. The cost is that a change to [netbird_proxy]
-      # group membership needs a manual deployment run.
-      - "ansible/inventory/host_vars/proxy-*.yml"
-      - "ansible/inventory/group_vars/netbird_proxy/**"
-      - ".woodpecker/deploy-netbird-proxy.yml"
-  - event: deployment
-    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-proxy"'
-
-timeout: 30
-
-steps:
-  - name: deploy-netbird-proxy
-    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
-    environment:
-      ANSIBLE_FORCE_COLOR: "true"
-      ANSIBLE_HOST_KEY_CHECKING: "false"
-      ANSIBLE_ROLES_PATH: "../roles:./roles"
-      SSH_PRIVATE_KEY:
-        from_secret: ssh_private_key
-      VAULT_PASS:
-        from_secret: vault_pass
-      PROXMOX_TOKEN_ID:
-        from_secret: proxmox_token_id
-      PROXMOX_TOKEN_SECRET:
-        from_secret: proxmox_token_secret
-    commands:
-      - mkdir -p ~/.ssh
-      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
-      - chmod 600 ~/.ssh/id_ed25519
-      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
-      - cd ansible
-      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
-      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
-      - ansible-playbook -i inventory/ plays/install-netbird-proxy.yml -v
@@ -1,37 +0,0 @@
-when:
-  # Deploy only on master (merge) + manual — never auto-deploy from a branch.
-  - event: push
-    branch: master
-    path:
-      - "ansible/roles/netbird-server/**"
-      - "ansible/plays/install-netbird-server.yml"
-      - ".woodpecker/deploy-netbird-server.yml"
-  - event: deployment
-    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-server"'
-
-timeout: 30
-
-steps:
-  - name: deploy-netbird-server
-    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
-    environment:
-      ANSIBLE_FORCE_COLOR: "true"
-      ANSIBLE_HOST_KEY_CHECKING: "false"
-      ANSIBLE_ROLES_PATH: "../roles:./roles"
-      SSH_PRIVATE_KEY:
-        from_secret: ssh_private_key
-      VAULT_PASS:
-        from_secret: vault_pass
-      PROXMOX_TOKEN_ID:
-        from_secret: proxmox_token_id
-      PROXMOX_TOKEN_SECRET:
-        from_secret: proxmox_token_secret
-    commands:
-      - mkdir -p ~/.ssh
-      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
-      - chmod 600 ~/.ssh/id_ed25519
-      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
-      - cd ansible
-      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
-      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
-      - ansible-playbook -i inventory/ plays/install-netbird-server.yml -v
@@ -1,47 +0,0 @@
-when:
-  # Deploy only on master (merge) + manual — never auto-deploy from a branch.
-  - event: push
-    branch: master
-    path:
-      - "ansible/roles/uptime-kuma/**"
-      - "ansible/plays/install-uptime-kuma.yml"
-      - ".woodpecker/deploy-uptime-kuma.yml"
-  - event: deployment
-    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-uptime-kuma"'
-  - event: cron
-    cron: uptime-kuma-token-renew
-
-timeout: 30
-
-steps:
-  - name: renew-openbao-token
-    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-10-18
-    environment:
-      VAULT_TOKEN:
-        from_secret: openbao_uptime_kuma_token
-    commands:
-      - 'curl -sSf -X POST -H "X-Vault-Token: $VAULT_TOKEN" https://openbao.renner.uno/v1/auth/token/renew-self -o /dev/null'
-
-  - name: deploy-uptime-kuma
-    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-10-18
-    when:
-      - event: [push, deployment]
-    environment:
-      ANSIBLE_FORCE_COLOR: "true"
-      ANSIBLE_HOST_KEY_CHECKING: "false"
-      ANSIBLE_ROLES_PATH: "../roles:./roles"
-      SSH_PRIVATE_KEY:
-        from_secret: ssh_private_key
-      VAULT_PASS:
-        from_secret: vault_pass
-      VAULT_TOKEN:
-        from_secret: openbao_uptime_kuma_token
-    commands:
-      - mkdir -p ~/.ssh
-      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
-      - chmod 600 ~/.ssh/id_ed25519
-      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
-      - cd ansible
-      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
-      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
-      - ansible-playbook -i inventory/ plays/install-uptime-kuma.yml -v
@@ -4,10 +4,10 @@
 # Triggers:
 #   - cron     : scoped to the named daily/weekly crons below. This used to be
 #                a bare `event: cron` (run on EVERY cron of this repo), which
-#                was harmless at daily/weekly cadence — but alert-monitor.yml
-#                fires every 15 minutes, so piggybacking must be opt-in now.
+#                was harmless at daily/weekly cadence but not with hourly
+#                crons, so piggybacking must be opt-in.
 #                A new cron that SHOULD also run e2e gets its name added here.
-#   - deploy   : `woodpecker-cli pipeline deploy k.renner/homelab <n> e2e`, where
+#   - deploy   : `woodpecker-cli pipeline deploy konairius/homelab <n> e2e`, where
 #                <n> is an existing pipeline to promote.

 when:
@@ -26,7 +26,7 @@ steps:
    # fetch-models.sh response mapping. No cluster, no secrets, no network — the
    # ci-claude image just provides sh + jq. Keeps the flag-injection regression
    # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    commands:
      - sh scripts/ci/test-model-selection.sh

@@ -0,0 +1,29 @@
+# Builds ci/images/hermes (nousresearch/hermes-agent plus the agent's CLIs) as
+# gitea.renner.uno/konairius/hermes:build.<unix-ts> and :latest.
+when:
+  - event: push
+    branch: main
+    path:
+      - "ci/images/hermes/**"
+      - ".woodpecker/hermes-image.yml"
+  - event: manual
+
+steps:
+  - name: build
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    directory: ci/images/hermes
+    environment:
+      # registry-bot write:package PAT (konairius org secret).
+      GITEA_TOKEN:
+        from_secret: registry_bot_token
+    commands:
+      - mkdir -p /kaniko/.docker
+      - AUTH=$(printf '%s:%s' registry-bot "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+      - TAG="build.$(date +%s)"
+      - |
+        /kaniko/executor \
+          --context . \
+          --dockerfile Containerfile \
+          --destination gitea.renner.uno/konairius/hermes:$TAG \
+          --destination gitea.renner.uno/konairius/hermes:latest
@@ -1,217 +0,0 @@
-# Issue fixer — hourly, pick the oldest open "[alert] ..." Gitea issue (filed
-# by the alert-monitor pipeline, alert-monitor.yml) that nobody has worked on
-# yet, hand it to an AI agent, and open a PR with the fix. One issue per run
-# keeps runs bounded and PRs reviewable.
-#
-# "Not worked on yet" means BOTH:
-#   - no alert-fix/issue-<n> branch exists on origin (a branch means a PR was
-#     already opened — or is being opened by a concurrent run), and
-#   - no issue comment contains "<!-- alert-fix:assessed -->" (the marker this
-#     pipeline leaves when the agent concluded the problem is NOT fixable in
-#     the repo, so we don't burn an agent run on it every hour) — UNLESS a
-#     TRUSTED_AUTHORS comment is newer than the latest marker: an owner reply
-#     re-opens the issue for the agent, with the reply passed to it as
-#     pipeline-verified guidance (see below).
-#
-# Trusted owner guidance: comments by TRUSTED_AUTHORS are appended to the
-# agent's issue.md under "Verified owner guidance". The trust anchor is the
-# hardcoded author list in THIS file (reviewed via PR; agents cannot edit
-# .woodpecker/). Deliberately NOT the Gitea permission API: this pipeline's
-# own comments post as issue-fix-bot, which is itself a write collaborator,
-# so "has write access" cannot distinguish the human from the pipeline — and
-# an injected instruction inside an agent-authored comment must never be able
-# to masquerade as owner guidance (the #259 lesson, in both directions: the
-# agent rightly refused unauthenticated body text, but then had no channel
-# for the owner's authentic reply).
-#
-# Tokens: a single dedicated identity, issue-fix-bot, for both the issue
-# comments and the push/PR. Its PAT is scoped to write:issue +
-# write:repository and nothing else. It deliberately does NOT reuse
-# security_bot_token (that identity belongs to the security-review pipeline)
-# nor the admin-owned gitea_token — see #330.
-#
-# Triggering:
-#   - cron   : a cron NAMED exactly "issue-fix":
-#                woodpecker repo cron add --repo k.renner/homelab \
-#                  --name issue-fix --branch master --schedule '41 * * * *'
-#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> issue-fix
-#              where <n> is an existing pipeline to promote.
-when:
-  - event: cron
-    cron: issue-fix
-  - event: deployment
-    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "issue-fix"'
-
-steps:
-  - name: fetch-diag
-    # Least-privilege live-diagnostics kubeconfig (+ kubectl binary) for the
-    # fix agent, same mechanism as alert-monitor.yml. Runs unconditionally
-    # (the issue-pick logic needs jq, which only the ci-claude image has);
-    # minting a 1h read-only token per run is cheap. Degrades to
-    # snapshot-only if the ci-diagnostics ServiceAccount isn't reconciled.
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-09-08
-    environment:
-      SOPS_AGE_KEY:
-        from_secret: sops_age_key
-      S3_ACCESS_KEY_ID:
-        from_secret: hetzner_s3_access_key
-      S3_SECRET_ACCESS_KEY:
-        from_secret: hetzner_s3_secret_key
-    commands:
-      - bash scripts/ci/fetch-kubeconfig.sh
-      - bash scripts/ci/make-diag-kubeconfig.sh
-
-  - name: issue-fix-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
-    environment:
-      CLAUDE_CODE_OAUTH_TOKEN:
-        from_secret: claude_code_oauth_token
-      # Dedicated identity: issue-fix-bot, PAT scoped to write:issue +
-      # write:repository (it comments, pushes a branch, and opens a PR).
-      # One identity for both roles — the previous split borrowed
-      # security_bot_token, which belongs to the security-review pipeline
-      # and has no business in this trust domain (#330).
-      GITEA_TOKEN:
-        from_secret: issue_fix_bot_token
-      PUSH_TOKEN:
-        from_secret: issue_fix_bot_token
-    commands:
-      - |
-        # Pick the oldest unhandled [alert] issue. The repo is public, so the
-        # candidate reads are unauthenticated; only writes need tokens.
-        set -eu
-        TRUSTED_AUTHORS="k.renner"   # space-separated; the trust anchor (see header)
-        mkdir -p /tmp/alert-fix
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
-        curl -sfL "$$API/issues?state=open&type=issues&limit=100" \
-          | jq '[.[] | select(.title | startswith("[alert] "))] | sort_by(.number)' \
-          > /tmp/alert-fix/candidates.json
-        COUNT=$$(jq length /tmp/alert-fix/candidates.json)
-        echo "Open [alert] issues: $$COUNT"
-        TRUSTED_JSON=$$(printf '%s\n' $$TRUSTED_AUTHORS | jq -R . | jq -s -c .)
-        i=0
-        while [ "$$i" -lt "$$COUNT" ]; do
-          NUM=$$(jq -r ".[$$i].number" /tmp/alert-fix/candidates.json)
-          curl -sfL "$$API/issues/$$NUM/comments" > /tmp/alert-fix/comments.json
-          # Eligibility in jq (ISO timestamps compare lexically; shell test
-          # has no portable string-< in busybox ash): eligible unless an
-          # assessed marker exists with no NEWER trusted-author comment.
-          STATE=$$(jq -r --argjson t "$$TRUSTED_JSON" '
-            ([.[] | select(.body | contains("alert-fix:assessed")) | .created_at] | max // "") as $$mark
-            | ([.[] | select(.user.login as $$u | $$t | index($$u)) | .created_at] | max // "") as $$trust
-            | if $$mark == "" then "fresh"
-              elif $$trust > $$mark then "retry"
-              else "skip" end' /tmp/alert-fix/comments.json)
-          if git ls-remote --heads origin "alert-fix/issue-$$NUM" | grep -q .; then
-            echo "#$$NUM: branch alert-fix/issue-$$NUM already exists — skipping."
-          elif [ "$$STATE" = "skip" ]; then
-            echo "#$$NUM: assessed and no newer owner comment — skipping."
-          else
-            if [ "$$STATE" = "retry" ]; then echo "#$$NUM: owner replied after assessment — retrying with guidance."; fi
-            echo "Picking issue #$$NUM."
-            jq ".[$$i]" /tmp/alert-fix/candidates.json > /tmp/alert-fix/issue.json
-            {
-              printf '# %s\n\n' "$$(jq -r '.title' /tmp/alert-fix/issue.json)"
-              printf 'Issue number: %s\n\n' "$$NUM"
-              jq -r '.body' /tmp/alert-fix/issue.json
-              # Owner comments, authorship checked against TRUSTED_AUTHORS
-              # above. Everything in the section is authentic owner input;
-              # agent-authored comments never match (they post as
-              # issue-fix-bot) and marker comments are excluded regardless.
-              if [ "$$(jq -r --argjson t "$$TRUSTED_JSON" '[.[] | select((.user.login as $$u | $$t | index($$u)) and (.body | contains("alert-fix:") | not))] | length' /tmp/alert-fix/comments.json)" -gt 0 ]; then
-                printf '\n\n## Verified owner guidance (authorship checked by the pipeline)\n'
-                jq -r --argjson t "$$TRUSTED_JSON" '.[] | select((.user.login as $$u | $$t | index($$u)) and (.body | contains("alert-fix:") | not)) | "\n### \(.user.login), \(.created_at)\n\n\(.body)"' /tmp/alert-fix/comments.json
-              fi
-            } > /tmp/alert-fix/issue.md
-            break
-          fi
-          i=$$((i+1))
-        done
-        [ -f /tmp/alert-fix/issue.json ] || echo "Nothing to fix — all [alert] issues handled."
-      - |
-        # Branch + git identity. The bot user owns the commits so PRs are
-        # visibly machine-authored, and the identity names THIS pipeline —
-        # previously these commits and PRs were attributed to security-bot,
-        # which made alert fixes look like security-review output (#330).
-        [ -f /tmp/alert-fix/issue.json ] || exit 0
-        set -eu
-        NUM=$$(jq -r '.number' /tmp/alert-fix/issue.json)
-        BRANCH="alert-fix/issue-$$NUM"
-        git config user.email "issue-fix-bot@renner.uno"
-        git config user.name "Alert Fix Agent"
-        git checkout -b "$$BRANCH"
-        echo "$$BRANCH" > /tmp/alert-fix/branch
-      - |
-        # Headless fix run. Prompt piped via stdin, subscription OAuth, file
-        # tools plus EXACTLY ONE live command: the RBAC-scoped read-only
-        # kubectl from fetch-diag (no Secrets readable, prefix match forbids
-        # pipes and other binaries). No web (see security-scan.yml).
-        [ -f /tmp/alert-fix/issue.json ] || exit 0
-        export KUBECONFIG="$$PWD/.ci-diag/kubeconfig"
-        # Model chosen live from the catalog (not hardcoded, no family assumed) —
-        # see the header of scripts/ci/pick-model.sh. Empty MODEL -> CLI default.
-        MODEL=$$(sh scripts/ci/pick-model.sh "diagnose an [alert] issue against read-only live cluster state and fix the root cause by editing repo manifests; multi-step reasoning that changes infrastructure code and needs a capable model")
-        if [ -n "$$MODEL" ]; then echo "issue-fix: selected model $$MODEL"; else echo "issue-fix: no live catalog — using the CLI default model"; fi
-        cat ci/agents/issue-fix/prompt.md | claude $${MODEL:+--model $$MODEL} \
-          --permission-mode acceptEdits \
-          --allowedTools "Read,Edit,Write,Glob,Grep,Bash(./.ci-diag/kubectl:*)" \
-          --settings ci/agents/issue-fix/settings.json \
-          -p
-      - |
-        # No edits → the agent judged this not fixable in the repo. Post its
-        # summary (with the assessed-marker) as an issue comment so the next
-        # run skips this issue, and stop cleanly.
-        [ -f /tmp/alert-fix/issue.json ] || exit 0
-        set -eu
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
-        NUM=$$(jq -r '.number' /tmp/alert-fix/issue.json)
-        if git diff --quiet && git diff --cached --quiet \
-           && [ -z "$$(git ls-files --others --exclude-standard)" ]; then
-          echo "Agent made no edits — commenting assessment on issue #$$NUM."
-          [ -s /tmp/alert-fix/summary.md ] \
-            || echo "Agent made no edits and wrote no summary." > /tmp/alert-fix/summary.md
-          printf '\n\n<!-- alert-fix:assessed -->\n_Assessed by the issue-fix pipeline: no repo change proposed. Remove this comment to make the pipeline retry._\n' \
-            >> /tmp/alert-fix/summary.md
-          jq -n --rawfile body /tmp/alert-fix/summary.md '{body: $$body}' > /tmp/gitea-comment.json
-          code=$$(curl -s -o /tmp/gitea-resp.json -w '%{http_code}' \
-            -X POST -H "Authorization: token $$GITEA_TOKEN" \
-            -H "Content-Type: application/json" --data @/tmp/gitea-comment.json \
-            "$$API/issues/$$NUM/comments")
-          echo "POST comment -> HTTP $$code"
-          [ "$$code" -ge 200 ] && [ "$$code" -lt 300 ] || { cat /tmp/gitea-resp.json; exit 1; }
-          touch /tmp/alert-fix/no-edits
-        fi
-      - |
-        # Edits → commit, push, open the PR (Closes #<n> so the merge closes
-        # the issue), and link the PR from the issue.
-        [ -f /tmp/alert-fix/issue.json ] || exit 0
-        if [ -f /tmp/alert-fix/no-edits ]; then exit 0; fi
-        set -eu
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
-        NUM=$$(jq -r '.number' /tmp/alert-fix/issue.json)
-        BRANCH=$$(cat /tmp/alert-fix/branch)
-        TITLE="fix: $$(jq -r '.title' /tmp/alert-fix/issue.json) (#$$NUM)"
-        [ -s /tmp/alert-fix/summary.md ] \
-          || echo "Agent-proposed fix (no summary written by the agent)." > /tmp/alert-fix/summary.md
-        printf '\n\nCloses #%s\n' "$$NUM" >> /tmp/alert-fix/summary.md
-        git add -A
-        git commit -m "$$TITLE"
-        git push "https://$$PUSH_TOKEN@gitea.renner.uno/k.renner/homelab.git" HEAD:"$$BRANCH"
-        jq -n --arg title "$$TITLE" --rawfile body /tmp/alert-fix/summary.md \
-          --arg head "$$BRANCH" \
-          '{title: $$title, body: $$body, head: $$head, base: "master"}' > /tmp/gitea-pr.json
-        code=$$(curl -s -o /tmp/gitea-resp.json -w '%{http_code}' \
-          -X POST -H "Authorization: token $$PUSH_TOKEN" \
-          -H "Content-Type: application/json" --data @/tmp/gitea-pr.json \
-          "$$API/pulls")
-        echo "POST pull -> HTTP $$code"
-        [ "$$code" -ge 200 ] && [ "$$code" -lt 300 ] || { cat /tmp/gitea-resp.json; exit 1; }
-        jq '{number, html_url, title}' /tmp/gitea-resp.json
-        PR_URL=$$(jq -r '.html_url' /tmp/gitea-resp.json)
-        jq -n --arg body "🤖 Opened $$PR_URL with a proposed fix." '{body: $$body}' > /tmp/gitea-comment.json
-        code=$$(curl -s -o /tmp/gitea-resp.json -w '%{http_code}' \
-          -X POST -H "Authorization: token $$GITEA_TOKEN" \
-          -H "Content-Type: application/json" --data @/tmp/gitea-comment.json \
-          "$$API/issues/$$NUM/comments")
-        echo "POST comment -> HTTP $$code"
-        [ "$$code" -ge 200 ] && [ "$$code" -lt 300 ] || { cat /tmp/gitea-resp.json; exit 1; }
@@ -2,9 +2,9 @@
 # pull requests. This pipeline only starts when triggered by hand and is kept for reference.
 #
 # PR review bot — per-repo STUB. All logic lives centrally in
-# k.renner/homelab: ci/agents/pr-review/run.sh (plus prompt.md,
+# konairius/homelab: ci/agents/pr-review/run.sh (plus prompt.md,
 # settings.json and scripts/ci/). This file is deployed byte-identical into every
-# reviewed repo (k.renner/homelab, shelly-manager, authentik-samba-bridge,
+# reviewed repo (konairius/homelab, shelly-manager, authentik-samba-bridge,
 # homeassistant) and holds NO logic, so the copies cannot drift apart: change the
 # review in homelab and every repo picks it up on its next PR event. Only edit this
 # stub if the trigger, the image or the secrets change — then change all copies in
@@ -13,7 +13,7 @@
 # Triggers on pull_request: PR opened AND new commits pushed to an open PR.
 # Approves only when the review found nothing red/yellow (see run.sh); humans merge.
 #
-# The central code is cloned from public homelab@master on every run, never taken
+# The central code is cloned from public homelab@main on every run, never taken
 # from the PR checkout, so a PR cannot alter the rubric or helper scripts it is
 # reviewed with.
 #
@@ -43,5 +43,5 @@ steps:
        from_secret: review_bot_token
    commands:
      - rm -rf /tmp/pr-review-central
-      - git clone --quiet --depth 1 https://gitea.renner.uno/k.renner/homelab /tmp/pr-review-central
+      - git clone --quiet --depth 1 https://gitea.renner.uno/konairius/homelab /tmp/pr-review-central
      - sh /tmp/pr-review-central/ci/agents/pr-review/run.sh
@@ -6,7 +6,7 @@ when:

 steps:
  - name: go-test
-    image: golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61
+    image: golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
    commands:
      - test -z "$(gofmt -l review-bot)"
      - go -C review-bot vet ./...
@@ -5,7 +5,7 @@
 #   - cron       : the named `daily-security-scan` cron, matched by NAME.
 #                  Crons cannot carry variables — `woodpecker-cli repo cron add`
 #                  has no --var — so a variable gate can never match a cron.
-#   - deployment : woodpecker-cli pipeline deploy k.renner/homelab <n> security-scan
+#   - deployment : woodpecker-cli pipeline deploy konairius/homelab <n> security-scan
 #                  The target rides in pipeline metadata as
 #                  CI_PIPELINE_DEPLOY_TARGET, which the workflow-root filter
 #                  does see, unlike manual-run variables on Woodpecker 3.18
@@ -18,12 +18,12 @@ when:

 steps:
  - name: iac-scan
-    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
+    image: aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
    commands:
      - trivy fs --format json -o trivy-iac.json --severity CRITICAL,HIGH --ignore-unfixed .

  - name: image-scans
-    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
+    image: aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
    commands:
      - trivy image --download-db-only
      - |
@@ -65,12 +65,12 @@ steps:
    failure: ignore

  - name: security-fix-agent
-    # Auto-fix run: only on master (cron / manual / direct push). On the
+    # Auto-fix run: only on main (cron / manual / direct push). On the
    # bot's own PR branches, the scans re-run as a re-validation gate but
    # this step is skipped — otherwise we'd fork-bomb PRs.
    when:
-      - branch: master
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
+      - branch: main
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -147,15 +147,15 @@ steps:
        TITLE="security: agent-proposed fixes ($$(date +%Y-%m-%d))"
        git add -A
        git commit -m "$$TITLE"
-        git push "https://$$GITEA_TOKEN@gitea.renner.uno/k.renner/homelab.git" HEAD:"$$BRANCH"
+        git push "https://$$GITEA_TOKEN@gitea.renner.uno/konairius/homelab.git" HEAD:"$$BRANCH"
        jq -n \
          --arg title "$$TITLE" \
          --arg body  "$$BODY"  \
          --arg head  "$$BRANCH" \
-          '{title: $$title, body: $$body, head: $$head, base: "master"}' \
+          '{title: $$title, body: $$body, head: $$head, base: "main"}' \
        | curl -sfL -X POST \
            -H "Authorization: token $$GITEA_TOKEN" \
            -H "Content-Type: application/json" \
            --data @- \
-            https://gitea.renner.uno/api/v1/repos/k.renner/homelab/pulls \
+            https://gitea.renner.uno/api/v1/repos/konairius/homelab/pulls \
        | jq '{number, html_url, title}'
@@ -14,9 +14,9 @@
 #              `repo cron add` takes name, branch, schedule and enabled — so the
 #              name filter is the only thing that can select a workflow for a
 #              scheduled run:
-#                woodpecker repo cron add --repo k.renner/homelab \
-#                  --name update-audit --branch master --schedule '@weekly'
-#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> update-audit
+#                woodpecker repo cron add --repo konairius/homelab \
+#                  --name update-audit --branch main --schedule '@weekly'
+#   - deploy : woodpecker-cli pipeline deploy konairius/homelab <n> update-audit
 #              where <n> is an existing pipeline to promote.
 #
 # NOTE: e2e.yml runs on an explicit list of cron names that includes this one,
@@ -30,7 +30,7 @@ when:

 steps:
  - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -111,7 +111,7 @@ steps:
        set -eu
        TITLE="Infrastructure update audit"
        STAMP=$$(date -u +%Y-%m-%dT%H:%M:%SZ)
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
+        API="https://gitea.renner.uno/api/v1/repos/konairius/homelab"

        # write <method> <url> <payload-file>  -> prints HTTP code, fails non-2xx
        gitea_write() {
@@ -1,6 +1,6 @@
 # homelab

-GitOps source for the Renner homelab cluster. Flux applies `master` to
+GitOps source for the Renner homelab cluster. Flux applies `main` to
 production, so every merge is a production change. Changes go in by pull
 request only; see [CONTRIBUTING.md](CONTRIBUTING.md) for YAML conventions.

@@ -33,6 +33,12 @@ fully automatic by owner decision. If one breaks Home Assistant, roll it
 back with [RUNBOOK-home-assistant-image-rollback.md](kubernetes/RUNBOOK-home-assistant-image-rollback.md).
 An incident rollback is not planned work; the owner decides its timing.

+Also not covered, by owner decision: the Hermes `ha-updates` job
+(`kubernetes/apps/hermes/skills/ha-updates/`) installs HACS and device-firmware
+updates that Home Assistant offers, and restarts Home Assistant for them, on
+its own inside the 02:00–05:00 window (UniFi and SMLIGHT firmware excluded;
+reported only). The window is enforced by its `ha.py`, not only by the prompt.
+
 ### 2. HA-impact review before merge

 Every PR that touches `kubernetes/apps/home-assistant/`, or makes a
@@ -42,7 +48,7 @@ Assistant will notice (restart, lost integration, lost history, none) and
 approves.

 - Reviewer: Hestia, the Home Assistant maintainer.
- Until Hestia exists: the owner does the HA-impact review.
+- Until the owner hands this review to Hestia (the `hestia` Hermes profile, which today only states the expected impact in its PRs): the owner does the HA-impact review.

 This is in addition to the normal review and merge by Argus. Argus does
 not merge such a PR without the HA-impact approval.
@@ -112,7 +112,7 @@

 # (string) This setting controls the default policy of fact gathering (facts discovered about remote systems).
 # This option can be useful for those wishing to save fact gathering time. Both 'smart' and 'explicit' will use the cache plugin.
-;gathering=implicit
+gathering=smart

 # (list) Set the `gather_subset` option for the :ref:`ansible_collections.ansible.builtin.setup_module` task in the implicit fact gathering. See the module documentation for specifics.
 # It does **not** apply to user defined ``ansible.builtin.setup`` tasks.
@@ -134,7 +134,7 @@
 ;hash_behaviour=replace

 # (pathlist) Comma separated list of Ansible inventory sources
-inventory=~/source/homelab/ansible/inventory
+inventory=inventory

 # (pathspec) Colon separated paths in which Ansible will search for HttpApi Plugins.
 ;httpapi_plugins={{ ANSIBLE_HOME ~ "/plugins/httpapi:/usr/share/ansible/plugins/httpapi" }}
@@ -206,7 +206,7 @@ inventory=~/source/homelab/ansible/inventory
 ;poll_interval=15

 # (path) Option for connections using a certificate or key file to authenticate, rather than an agent or passwords, you can set the default value here to avoid re-specifying --private-key with every invocation.
-private_key_file=~/.ssh/id_ed25519
+;private_key_file=

 # (boolean) By default, imported roles publish their variables to the play and other roles, this setting can avoid that.
 # This was introduced as a way to reset role variables to default values if a role is used more than once in a playbook.
@@ -274,7 +274,7 @@ roles_path=../roles:./roles

 # (path) The vault password file to use. Equivalent to --vault-password-file or --vault-id
 # If executable, it will be run and the resulting stdout will be used as the password.
-vault_password_file=~/source/homelab/ansible/vault-password.sh
+vault_password_file=vault-password.sh

 # (integer) Sets the default verbosity, equivalent to the number of ``-v`` passed in the command line.
 ;verbosity=0
@@ -484,7 +484,7 @@ vault_password_file=~/source/homelab/ansible/vault-password.sh
 # It can result in a very significant performance improvement when enabled.
 # However this conflicts with privilege escalation (become). For example, when using 'sudo:' operations you must first disable 'requiretty' in /etc/sudoers on all managed hosts, which is why it is disabled by default.
 # This setting will be disabled if ``ANSIBLE_KEEP_REMOTE_FILES`` is enabled.
-;pipelining=False
+pipelining=True


 [colors]
@@ -694,3 +694,8 @@ vault_password_file=~/source/homelab/ansible/vault-password.sh
 # (list) default list of tags to skip in your plays, has precedence over Run Tags
 ;skip=

+
+[ssh_connection]
+# Connections stay open across the plays of a run, so each host costs one
+# YubiKey PIN; plays/close-connections.yml closes them at the end of a run.
+ssh_args=-C -o ControlMaster=auto -o ControlPersist=30m
@@ -41,13 +41,11 @@ Build and boot the dedicated installer image — see
 4. Add the host to `[edge_host]` in `inventory/pve_hosts.yml`, by name.
   That group is the base: every edge thin client belongs to it, and it
   assumes no peripherals.
-5. From the workstation:
+5. From the workstation, in `ansible/`:
   ```
-   ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml
+   ansible-playbook site.yml
   ```
-   One unrestricted run over the whole group. The play is self-contained --
-   it carries `certificates` and `common` itself, so there is no second
-   command and no `--limit`. Running it converges every edge host, which is
+   One unrestricted run, no `--limit`. It converges every host, which is
   the point: a run that touches only the new box tells you nothing about
   the others.

@@ -72,14 +70,14 @@ none of these commands.

 ## Secrets (before first play run)

-Create `inventory/group_vars/edge_host/vault.yml` with ansible-vault; the
-current live values come straight out of the cluster:
+Create `inventory/group_vars/edge_host/vault.yml` with ansible-vault. The
+cluster broker has no `open3e` user: edge-1 logs in only as the register
+account `edge-1` (see "MQTT bridge" below), so
+`vault_edge_open3e_mqtt_password` reaches only the loopback broker, which
+allows anonymous clients; any random value works (`openssl rand -hex 24`).
+The zwave-js value comes out of the cluster:

 ```
-# sml2mqtt broker password
-kubectl -n home-assistant get secret mosquitto-sml2mqtt-credentials -o jsonpath='{.data.password}' | base64 -d
-# open3e broker password
-kubectl -n home-assistant get secret mosquitto-open3e-credentials -o jsonpath='{.data.password}' | base64 -d
 # zwave-js session secret
 kubectl -n home-assistant get secret zwave-js-session -o jsonpath='{.data.session-secret}' | base64 -d
 ```
@@ -230,15 +228,14 @@ They connect to a **local mosquitto on loopback** (`127.0.0.1:1883`,
  broker is briefly unreachable, and flushes on reconnect — edge-1 no longer
  hard-depends on cluster/network uptime for every publish.

-Two bridge `connection`s preserve the existing cluster identities, so **no
-cluster-side change was needed**: one authenticates as the `open3e` user
-(carries `open3e/#` out + `open3e/cmnd` back), one as `sml2mqtt` (`sml2mqtt/#`
-out). The local broker is `allow_anonymous` on loopback — the trust boundary
-is the host; nothing off-host can reach it.
+The local broker is `allow_anonymous` on loopback — the trust boundary is the
+host; nothing off-host can reach it.

-**Bridge credential (REN-1307).** The two vault-password bridges are being
-replaced by one bridge as the register account `edge-1`
-(`kubernetes/apps/home-assistant/mqtt-accounts.yaml`). Its password is pushed
+**Bridge credential (REN-1307).** One bridge `connection` logs in as the
+register account `edge-1` (`kubernetes/apps/home-assistant/mqtt-accounts.yaml`)
+and carries `open3e/#` out and `open3e/cmnd` back. The cluster broker does not
+accept the vault-password bridges in `bridge.d/legacy.conf`, which exists only
+until the first push. Its password is pushed
 by mqtt-account-controller to `edge-mqtt-cred` (`:8443`, the controller's
 esp32 API over HTTPS). That endpoint accepts only a client certificate from
 the MQTT CA with CN `mqtt-account-controller`; edge-1 holds the public CA and
@@ -246,8 +243,7 @@ its own server key, nothing else. On a push it writes
 `/etc/mosquitto/bridge.d/edge-1.conf`, deletes `bridge.d/legacy.conf` and
 restarts the local mosquitto. The controller sets a new password whenever the
 bridge reports "not connected" (also after a reinstall), so no play run is
-needed for a rotation. `.woodpecker/deploy-edge-mqtt-bridge.yml` runs
-`plays/edge-mqtt-bridge.yml` on merge. Diagnosis: `journalctl -u
+needed for a rotation. Diagnosis: `journalctl -u
 edge-mqtt-cred`, and `mosquitto_sub -t '$SYS/broker/connection/edge-1/state'`
 (retained `1` = connected).

@@ -1,67 +0,0 @@
-#!/usr/bin/env python3
-"""
-Discover Shelly devices on the network via HTTP API
-Returns JSON array of discovered devices
-"""
-
-import sys
-import json
-import ipaddress
-import concurrent.futures
-import urllib.request
-import urllib.error
-
-def check_shelly(ip):
-    """Check if IP is a Shelly device and return info"""
-    try:
-        url = f"http://{ip}/shelly"
-        req = urllib.request.Request(url, headers={'User-Agent': 'Ansible-Shelly-Discovery'})
-        with urllib.request.urlopen(req, timeout=2) as response:
-            data = json.loads(response.read().decode())
-            # Gen1 devices don't have 'gen' field, default to 1
-            gen = data.get('gen', 1)
-            if gen is None:
-                gen = 1
-            return {
-                'ip': str(ip),
-                'type': data.get('type', 'unknown'),
-                'mac': data.get('mac', ''),
-                'gen': gen,
-                'name': data.get('name', data.get('id', str(ip))),
-                'fw_id': data.get('fw_id', data.get('fw', 'unknown'))
-            }
-    except (urllib.error.URLError, urllib.error.HTTPError, OSError, json.JSONDecodeError):
-        return None
-    except Exception:
-        return None
-
-def main():
-    if len(sys.argv) < 2:
-        print("Usage: discover_shelly.py <network1> [network2] ...")
-        print("Example: discover_shelly.py 10.2.30.0/24 10.2.20.0/24")
-        sys.exit(1)
-
-    networks = sys.argv[1:]
-    devices = []
-
-    # Collect all IPs to scan
-    all_ips = []
-    for network in networks:
-        try:
-            all_ips.extend(ipaddress.IPv4Network(network).hosts())
-        except ValueError as e:
-            print(f"Invalid network: {network} - {e}", file=sys.stderr)
-            continue
-
-    # Scan in parallel
-    with concurrent.futures.ThreadPoolExecutor(max_workers=100) as executor:
-        results = executor.map(check_shelly, all_ips)
-        for result in results:
-            if result:
-                devices.append(result)
-
-    # Output JSON
-    print(json.dumps(devices, indent=2))
-
-if __name__ == "__main__":
-    main()
@@ -5,27 +5,10 @@ pve_token_id: "ansible"
 ansible_user: "ladmin"
 ansible_python_interpreter: /usr/bin/python3

-# SSH Public Keys for Cloud-Init
-# ansible-runner@ci-new removed (issue #184): dead key, no such host exists.
-common_ssh_public_keys: |
-  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPzFNBP3bq2m/6JqDqod9w+FP/uxXxHMolqhq3Ojflr1 krenner@fortress
-  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyNnX1I4W9jyDvCJ1DJauHSmbo1ZXSyBxVhSAwMWgen woodpecker-ci@homelab
-
-# Network-of-origin restriction for the woodpecker-ci@homelab CI key
-# (issue #184). Consumed by plays/configure-ssh-keys.yml as the authorized_key
-# `from=` option so the CI key only authenticates from within the cluster's
-# pod network — NOT from any host-pinned IP.
-#
-# The in-cluster Woodpecker step pods SSH to fleet hosts using their POD IP as
-# source, not a node IP: Cilium runs `ipv4-native-routing-cidr=10.0.0.0/8` +
-# `ipv6-native-routing-cidr=fd00::/8` with masquerade enabled, so pod egress to
-# any 10.x / fd.. LAN destination is NOT SNAT'd, and each node's PodCIDR is
-# advertised to the UDM over BGP (kubernetes/infrastructure/post-crds/
-# cilium-bgp.yaml) so return traffic L3-routes back to the pod. Hosts therefore
-# see the real pod source IP.
-#
-# The cluster pod subnets (kubernetes/talos/patches/cluster.yaml podSubnets)
-# are the stable boundary — they survive node DHCP-lease churn and pod
-# rescheduling across k8s-1/2/3, unlike pinning any node's current IP.
-# v6 is included because some SSH targets (edge IoT hosts) are IPv6-only.
-ci_ssh_from_cidrs: '10.244.0.0/16,fd10:244::/48'
+# The only plain key the admin logins accept on [ssh_keys_managed] hosts
+# (ssh-ca role, tasks/authorized_keys.yml). People log in with OpenBao SSH CA
+# certificates; this one is for when that path is unavailable.
+#   breakglass-neo: PIV key (slot 9a, PIN) on the offline YubiKey NEO.
+#     ssh -I /usr/lib/opensc-pkcs11.so root@<host>
+ssh_admin_authorized_keys:
+  - key: "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKvSl9LUP8u3S2Sq5YTWpW0Jxbue8cJhD7/LMFQbEsa3xo145HVR7pBzRxW71MUy+jgrgmpSlDhIb606Hswhvoo= breakglass-neo-6532348"
@@ -1,16 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-35646538363164363061366433343963623166336630376233333033646637336266343337343230
-3233356135323762636439336466663430366238363338650a633762623366643137303333383634
-62623739363132303335636261626263333332623066303161633466306431623930666166323833
-6439663964353338350a656435626664646666363831363164393335386666356637613037323838
-63653461656366613331353064656161346263356131346437666632386166623037373363333534
-37323435623366643534633333303534313434613135653237303966656162633266623433363934
-36343133393834393765353338383764303664363431653865633764306138376366623832346262
-36303766623331666632613639366139333661636665363631326565653938343637323861653064
-37393465383263376337376639613162306563653365623036376662303030613264653534353332
-66363030356363373439306164386561363734353631363738656236633164633062613437663366
-62386430396262366336316166353366383233316333333234666538643962336361363630363762
-31653963303032373531386566336632336130383034343430303964396538663237346434613737
-39643765623766373639306132316635376434643232336163303066393736313130323065666232
-39393038616162666666383837326137376233613437636361636238663566336365653863643933
-353338646134383038323134323034653564
@@ -50,3 +50,11 @@ edge_mqtt_host: 127.0.0.1
 edge_mqtt_port: 1883
 edge_open3e_mqtt_user: open3e
 edge_open3e_mqtt_topic: open3e
+
+# Units claude-bot may restart (ssh-ca role); the containers go through docker.
+ssh_ca_claude_sudo_units:
+  - mosquitto
+  - edge-mqtt-cred
+  - edge-alloy
+  - keepalived
+  - chronyd
@@ -0,0 +1,9 @@
+---
+# The host NetBird client (wt0) must not take over DNS: resolv.conf is pinned to
+# the systemd-resolved stub by the netbird-proxy role.
+netbird_disable_dns: true
+
+ssh_ca_claude_sudo_units:
+  - netbird
+  - netbird-proxy-flood-watchdog
+  - crowdsec-firewall-bouncer
@@ -2,3 +2,6 @@
 # NetBird server - VPS not managed by Proxmox
 # Enable Docker monitoring (cAdvisor) for container metrics
 docker_monitoring_enabled: true
+
+ssh_ca_claude_sudo_units:
+  - netbird
@@ -13,11 +13,11 @@
 # Their hosts no longer resolve, except the three that resolve to Talos nodes.

 [netbird_server]
-netbird.renner.uno ansible_user=root
+netbird.renner.uno ansible_host=netbird.nb.renner.uno ansible_user=root

 [netbird_proxy]
-proxy-1.renner.uno ansible_user=root
-proxy-2.renner.uno ansible_user=root
+proxy-1.renner.uno ansible_host=proxy-1.nb.renner.uno ansible_user=root
+proxy-2.renner.uno ansible_host=proxy-2.nb.renner.uno ansible_user=root

 # Every bare-metal edge thin client. Gets the host-generic roles only:
 # flash-wear handling, the log shipper, the MQTT bridge, the VLAN
@@ -62,10 +62,28 @@ heating_can
 [ntp_cluster:children]
 edge_host

-# Off-site Debian VM (Synology VMM on nas-2, 10.3.40.0/24) running Claude Code.
-# Reached over the site-to-site tunnel at its current DHCP lease. Switch
-# ansible_host to the stable Netbird mesh IP once the host is enrolled — the
-# obg.renner.uno FQDN is split-horizon and resolves to the public proxy from
-# home, so it must NOT be used as ansible_host.
-[claude_workstation]
-claude-ws ansible_host=10.3.40.78 ansible_user=root
+# Hosts that trust the OpenBao SSH user CA (plays/configure-ssh-ca.yml).
+# Rolled out one host at a time: add the next host after the previous one
+# was verified.
+[ssh_ca]
+proxy-1.renner.uno
+proxy-2.renner.uno
+netbird.renner.uno
+edge-1.iot.renner.uno
+
+# Hosts whose admin logins accept only ssh_admin_authorized_keys (break-glass);
+# everything else needs a CA certificate. Members must be in [ssh_ca].
+# Added one host at a time after the [ssh_ca] report was reviewed.
+[ssh_keys_managed]
+proxy-1.renner.uno
+proxy-2.renner.uno
+netbird.renner.uno
+edge-1.iot.renner.uno
+
+# Internet hosts whose sshd listens on the NetBird interface only
+# (plays/configure-ssh-mesh-only.yml). Members need the host NetBird client.
+# Added one host at a time after the previous one was verified.
+[ssh_mesh_only]
+proxy-1.renner.uno
+proxy-2.renner.uno
+netbird.renner.uno
@@ -0,0 +1,11 @@
+---
+# Last play of every playbook that is run directly (site.yml and the one-off
+# actions). SSH connections stay open for 30 minutes (ansible.cfg) so a run
+# costs one YubiKey PIN per host; closing them at the end leaves nothing that
+# another process of the same user could reuse.
+- name: Close the SSH connections
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Close the connection
+      ansible.builtin.meta: reset_connection
@@ -13,4 +13,5 @@

  roles:
    - common
-    - qemu-guest-agent
+    - role: qemu-guest-agent
+      when: ansible_facts['virtualization_role'] == 'guest'
@@ -1,125 +0,0 @@
---
-# Configure NTP server on all Shelly devices
-# Discovers Shelly devices via network scan and configures them to use local NTP server
-#
-# Usage:
-#   ansible-playbook plays/configure-shelly-ntp.yml
-#   ansible-playbook plays/configure-shelly-ntp.yml -e "shelly_ntp_server=10.2.40.4"
-#   ansible-playbook plays/configure-shelly-ntp.yml -e "shelly_networks=10.2.30.0/24,10.2.20.0/24"
-
- name: Configure Shelly NTP Settings
-  hosts: localhost
-  connection: local
-  gather_facts: no
-
-  vars:
-    shelly_ntp_server: "ntp.renner.uno"
-    shelly_networks: "10.2.30.0/24 10.2.20.0/24"
-    shelly_timeout: 5
-
-  tasks:
-    - name: Discover Shelly devices on network
-      script: "{{ playbook_dir }}/../files/discover_shelly.py {{ shelly_networks }}"
-      args:
-        executable: python3
-      register: discovered_devices
-      changed_when: false
-
-    - name: Parse discovered devices
-      set_fact:
-        shelly_devices: "{{ discovered_devices.stdout | from_json }}"
-
-    - name: Display discovered Shelly devices
-      debug:
-        msg: "Found {{ shelly_devices | length }} Shelly devices"
-
-    - name: Show device list
-      debug:
-        msg: "{{ item.name }} ({{ item.type }}) - {{ item.ip }} - Gen{{ item.gen }}"
-      loop: "{{ shelly_devices }}"
-      when: shelly_devices | length > 0
-
-    - name: Configure NTP on Gen1 devices
-      uri:
-        url: "http://{{ item.ip }}/settings?sntp_server={{ shelly_ntp_server }}"
-        method: GET
-        timeout: "{{ shelly_timeout }}"
-        return_content: yes
-      loop: "{{ shelly_devices | selectattr('gen', 'equalto', 1) | list }}"
-      register: gen1_results
-      ignore_errors: yes
-      when: shelly_devices | length > 0
-
-    - name: Configure NTP on Gen2+ devices
-      uri:
-        url: "http://{{ item.ip }}/rpc/Sys.SetConfig"
-        method: POST
-        body_format: json
-        body:
-          config:
-            sntp:
-              server: "{{ shelly_ntp_server }}"
-        timeout: "{{ shelly_timeout }}"
-        return_content: yes
-      loop: "{{ shelly_devices | selectattr('gen', 'greaterthan', 1) | list }}"
-      register: gen2_results
-      ignore_errors: yes
-      when: shelly_devices | length > 0
-
-    - name: Verify Gen1 NTP configuration
-      uri:
-        url: "http://{{ item.ip }}/settings"
-        method: GET
-        timeout: "{{ shelly_timeout }}"
-        return_content: yes
-      loop: "{{ shelly_devices | selectattr('gen', 'equalto', 1) | list }}"
-      register: gen1_verify
-      ignore_errors: yes
-      when: shelly_devices | length > 0
-
-    - name: Verify Gen2+ NTP configuration
-      uri:
-        url: "http://{{ item.ip }}/rpc/Sys.GetConfig"
-        method: GET
-        timeout: "{{ shelly_timeout }}"
-        return_content: yes
-      loop: "{{ shelly_devices | selectattr('gen', 'greaterthan', 1) | list }}"
-      register: gen2_verify
-      ignore_errors: yes
-      when: shelly_devices | length > 0
-
-    - name: Summary - Gen1 devices configured
-      debug:
-        msg: "{{ item.item.name }} ({{ item.item.ip }}): NTP={{ item.json.sntp.server | default('unknown') }}"
-      loop: "{{ gen1_verify.results | default([]) }}"
-      when:
-        - gen1_verify is defined
-        - gen1_verify.results is defined
-        - item.json is defined
-        - item.json.sntp is defined
-      loop_control:
-        label: "{{ item.item.name | default(item.item.ip) }}"
-
-    - name: Summary - Gen2+ devices configured
-      debug:
-        msg: "{{ item.item.name }} ({{ item.item.ip }}): NTP={{ item.json.sntp.server | default('unknown') }}"
-      loop: "{{ gen2_verify.results | default([]) }}"
-      when:
-        - gen2_verify is defined
-        - gen2_verify.results is defined
-        - item.json is defined
-        - item.json.sntp is defined
-      loop_control:
-        label: "{{ item.item.name | default(item.item.ip) }}"
-
-    - name: Final summary
-      debug:
-        msg: |
-          ==========================================
-          Shelly NTP Configuration Complete
-          ==========================================
-          Total devices found: {{ shelly_devices | length }}
-          Gen1 devices: {{ shelly_devices | selectattr('gen', 'equalto', 1) | list | length }}
-          Gen2+ devices: {{ shelly_devices | selectattr('gen', 'greaterthan', 1) | list | length }}
-          NTP Server: {{ shelly_ntp_server }}
-          ==========================================
@@ -0,0 +1,23 @@
+---
+# Trust the OpenBao SSH user CA (ssh-client-signer) on the hosts in [ssh_ca]:
+# owner certificates (principal k.renner) for root/ladmin, Claude's 1h
+# certificates (principal claude-bot) for its own claude-bot account with
+# limited sudo. The role reports the admin logins' authorized_keys; on
+# [ssh_keys_managed] they are then reduced to ssh_admin_authorized_keys.
+#
+# serial: 1 so a host whose sshd rejects the change stops the run before the
+# next host is touched. One play, so each host needs one login (one YubiKey
+# PIN from a workstation).
+- name: Configure the SSH user CA
+  hosts: ssh_ca
+  become: true
+  gather_facts: true
+  serial: 1
+  roles:
+    - ssh-ca
+  tasks:
+    - name: Reduce authorized_keys to the break-glass key
+      ansible.builtin.include_role:
+        name: ssh-ca
+        tasks_from: authorized_keys
+      when: inventory_hostname in groups['ssh_keys_managed']
@@ -1,48 +0,0 @@
---
- name: Deploy authorized SSH keys to all hosts
-  hosts: all:!localhost
-  become: true
-  gather_facts: false
-  # Authorized keys deployed to root and ladmin on every managed host.
-  #
-  # - krenner@fortress (human): unrestricted.
-  # - woodpecker-ci@homelab (CI): restricted with from= to the cluster's pod
-  #   network (ci_ssh_from_cidrs in group_vars/all/vars.yml). The in-cluster
-  #   Woodpecker step pods SSH to fleet hosts presenting their POD IP as source
-  #   (Cilium native-routing-cidr covers the LAN, so no SNAT; PodCIDRs are
-  #   BGP-advertised). This is a network-of-origin restriction, NOT host-pinned,
-  #   so it survives node DHCP churn and pod rescheduling. See vars.yml for the
-  #   full derivation.
-  # - ansible-runner@ci-new: removed — dead key, no such host exists.
-  vars:
-    authorized_keys:
-      - key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPzFNBP3bq2m/6JqDqod9w+FP/uxXxHMolqhq3Ojflr1 krenner@fortress"
-      - key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyNnX1I4W9jyDvCJ1DJauHSmbo1ZXSyBxVhSAwMWgen woodpecker-ci@homelab"
-        options: 'from="{{ ci_ssh_from_cidrs }}"'
-  tasks:
-    - name: Check SSH connectivity
-      ansible.builtin.wait_for_connection:
-        timeout: 5
-      ignore_errors: true
-      register: ssh_check
-
-    - name: Skip unreachable hosts
-      ansible.builtin.meta: end_host
-      when: ssh_check is failed
-
-    - name: Deploy authorized keys to root
-      ansible.builtin.authorized_key:
-        user: root
-        key: "{{ item.key }}"
-        key_options: "{{ item.options | default(omit) }}"
-        state: present
-      loop: "{{ authorized_keys }}"
-
-    - name: Deploy authorized keys to ladmin
-      ansible.builtin.authorized_key:
-        user: ladmin
-        key: "{{ item.key }}"
-        key_options: "{{ item.options | default(omit) }}"
-        state: present
-      loop: "{{ authorized_keys }}"
-      ignore_errors: true
@@ -0,0 +1,15 @@
+---
+# sshd on the hosts in [ssh_mesh_only] accepts connections only on the NetBird
+# interface; nothing listens on their public addresses. Run from a workstation
+# in the mesh. A switchover reverts by itself unless the play logs in again
+# through the new listener.
+#
+# serial: 1 so a host that does not come back stops the run before the next
+# host is touched.
+- name: Restrict sshd to the mesh interface
+  hosts: ssh_mesh_only
+  become: true
+  gather_facts: true
+  serial: 1
+  roles:
+    - ssh-mesh-only
@@ -29,6 +29,7 @@
    - name: Check if systemd-timesyncd is installed
      command: systemctl list-unit-files systemd-timesyncd.service
      register: timesyncd_installed
+      check_mode: false
      failed_when: false
      changed_when: false

@@ -56,6 +57,7 @@
    - name: Verify time sync status
      command: timedatectl show --property=NTPSynchronized
      register: timesync_status
+      check_mode: false
      changed_when: false
      failed_when: false

@@ -1,33 +0,0 @@
---
-# Local MQTT bridge and its credential receiver only (REN-1307). Run by
-# .woodpecker/deploy-edge-mqtt-bridge.yml on merge, so a change to this role
-# reaches edge-1 without a play run by hand. The full base play
-# (install-edge-host.yml) carries the same role.
- name: Converge the edge MQTT bridge
-  hosts: edge_host
-  become: true
-
-  # The SML power-meter reader (sml2mqtt) is retired for good: owner decision
-  # 2026-09-19, grid data comes from the E380 on the CAN bus. Its role and
-  # play are gone; this removes the leftover compose project from edge-1 on
-  # the next pipeline run. Idempotent: a no-op once the directory is gone.
-  pre_tasks:
-    - name: Check for the retired sml2mqtt compose project
-      ansible.builtin.stat:
-        path: /opt/edge-host/sml2mqtt/docker-compose.yml
-      register: edge_sml2mqtt_compose
-
-    - name: Stop the retired sml2mqtt container
-      ansible.builtin.command:
-        cmd: docker compose down --remove-orphans
-        chdir: /opt/edge-host/sml2mqtt
-      when: edge_sml2mqtt_compose.stat.exists
-      changed_when: true
-
-    - name: Remove the retired sml2mqtt directory
-      ansible.builtin.file:
-        path: /opt/edge-host/sml2mqtt
-        state: absent
-
-  roles:
-    - mqtt-bridge
@@ -1,20 +0,0 @@
---
-# Off-site Debian VM running Claude Code — reattachable interactive sessions
-# plus an unattended notes-distill timer. Host creation (Synology VMM), the
-# Netbird dashboard route and secret material are manual prerequisites; see
-# roles/claude-workstation/README.md and docs/claude-workstation.md.
-#
-# CI reaches this off-site host over the site-to-site tunnel (home -> off-site
-# works), same as it reaches every other inventory host.
-
- name: Deploy the Claude Code workstation
-  hosts: claude_workstation
-  become: true
-  # qemu-guest-agent is applied
-  # to every inventory host by the umbrella plays/common.yml, same as for the
-  # netbird-proxy host — run that against this host too (see RUNBOOK Step 5).
-  roles:
-    - common
-    - role: netbird-client       # mesh enrolment (needs netbird_setup_key in vault)
-      when: netbird_setup_key is defined
-    - claude-workstation
@@ -6,26 +6,25 @@
 #   - host_vars/<hostname>/vars.yml - per-host key (overrides group)
 #   - group_vars/all/vault.yml - encrypted keys
 #
-# Usage:
-#   ansible-playbook -i inventory/ plays/setup-netbird-client.yml
-#
-# Limit to specific hosts:
-#   ansible-playbook -i inventory/ plays/setup-netbird-client.yml --limit caddy_servers
+# Applied by site.yml.

 - name: Install NetBird client on hosts with setup key defined
  hosts: all
  become: true
-  gather_facts: true
+  # One host at a time: from a workstation every new SSH session asks for the
+  # YubiKey PIN and a touch, and parallel hosts would prompt at once.
+  serial: 1
+  # Facts only after the skip: gathering them first opens an SSH session (a
+  # YubiKey touch from a workstation) to every host, including skipped ones.
+  gather_facts: false

  pre_tasks:
-    - name: Check if netbird_setup_key is defined
-      ansible.builtin.debug:
-        msg: "NetBird setup key is defined for {{ inventory_hostname }}"
-      when: netbird_setup_key is defined
-
    - name: Skip hosts without netbird_setup_key
      ansible.builtin.meta: end_host
      when: netbird_setup_key is not defined

+    - name: Gather facts
+      ansible.builtin.setup:
+
  roles:
    - netbird-client
@@ -1,6 +1,6 @@
 ---
 # Deploy the NetBird reverse-proxy HA cluster members (the public edge).
-# Usage: ansible-playbook -i inventory/ plays/install-netbird-proxy.yml
+# Applied by site.yml.
 #
 # Prerequisites:
 # - Proxy VPS provisioned (proxy-1 is Arch Linux), root SSH reachable, and
@@ -1,6 +1,6 @@
 ---
 # Deploy NetBird Server to VPS
-# Usage: ansible-playbook -i inventory/ plays/install-netbird-server.yml
+# Applied by site.yml.
 #
 # Prerequisites:
 # - VPS provisioned with Ubuntu 22.04/24.04
@@ -1,22 +0,0 @@
---
-# Install Node Exporter on all managed hosts
-# Usage: ansible-playbook -i inventory/ plays/install-node-exporter.yml
-
- name: Install Node Exporter
-  hosts: all
-  become: yes
-  gather_facts: yes
-
-  roles:
-    - node-exporter
-
-  post_tasks:
-    - name: Verify node-exporter is running
-      uri:
-        url: "http://127.0.0.1:9100/metrics"
-        status_code: 200
-      register: exporter_health
-      retries: 3
-      delay: 5
-      until: exporter_health.status == 200
-      ignore_errors: yes
@@ -102,32 +102,45 @@
      ansible.builtin.pause:
        seconds: 5

-    - name: Verify chrony is serving NTP
-      ansible.builtin.shell: chronyc clients | head -10
-      register: chrony_clients
+    - name: Verify chronyd answers
+      ansible.builtin.command:
+        argv:
+          - chronyc
+          - -n
+          - tracking
+      check_mode: false
      changed_when: false

-    - name: Check NTP port is listening
-      ansible.builtin.shell: ss -lun | grep ':123 '
+    - name: Verify chronyd listens on udp/123
+      ansible.builtin.command:
+        argv:
+          - ss
+          - -Hlunp
+          - sport = :123
      register: ntp_port
-      failed_when: false
+      check_mode: false
      changed_when: false
-
-    - name: Display NTP port status
-      ansible.builtin.debug:
-        msg: "NTP port 123: {{ 'LISTENING' if ntp_port.rc == 0 else 'NOT LISTENING' }}"
+      failed_when: "'chronyd' not in ntp_port.stdout"

    - name: Check if this server has the VIP
-      ansible.builtin.shell: ip addr show | grep {{ ntp_vip }}
+      ansible.builtin.command:
+        argv:
+          - ip
+          - -4
+          - addr
+          - show
+          - to
+          - "{{ ntp_vip }}"
      register: vip_check
-      failed_when: false
+      check_mode: false
+      failed_when: vip_check.rc != 0
      changed_when: false
      when: ntp_keepalived_enabled | default(false)

    - name: Display VIP status
      ansible.builtin.debug:
        msg: >
-          {% if vip_check.rc == 0 %}
+          {% if vip_check.stdout | default('') | length > 0 %}
          This server ({{ inventory_hostname }}) is MASTER and holds the VIP {{ ntp_vip }}
          {% else %}
          This server ({{ inventory_hostname }}) is BACKUP
@@ -159,7 +172,8 @@
          - to
          - "{{ ntp_vip6 }}"
      register: vip6_check
-      failed_when: false
+      check_mode: false
+      failed_when: vip6_check.rc != 0
      changed_when: false
      when: ntp_keepalived_enabled | default(false)

@@ -184,18 +198,28 @@
          (keepalived not enabled on this host).
      when: not (ntp_keepalived_enabled | default(false))

-    - name: Test NTP via VIP (only on master)
-      ansible.builtin.shell: |
-        chronyc -h {{ ntp_vip }} tracking 2>&1 || echo "Cannot connect to VIP (may need to wait for failover)"
+    # chronyc talks to the command port, which is loopback-only; this is a real
+    # NTP query. Directives on the command line mean no config file and no
+    # pidfile, and -Q opens no server or command port, so it runs alongside
+    # the live daemon.
+    - name: Query NTP through the VIP (only on master)
+      ansible.builtin.command:
+        argv:
+          - chronyd
+          - -Q
+          - -t
+          - "10"
+          - "server {{ ntp_vip }} iburst maxsamples 1"
      register: ntp_vip_test
+      check_mode: false
      when:
        - ntp_keepalived_enabled | default(false)
-        - vip_check.rc == 0
+        - vip_check.stdout | default('') | length > 0
      changed_when: false

    - name: Display VIP NTP test result
      ansible.builtin.debug:
-        msg: "{{ ntp_vip_test.stdout_lines | default(['Not master, skipping VIP test']) }}"
+        msg: "{{ ntp_vip_test.stderr_lines + ntp_vip_test.stdout_lines }}"
      when:
        - ntp_keepalived_enabled | default(false)
-        - vip_check.rc == 0
+        - vip_check.stdout | default('') | length > 0
@@ -1,11 +1,14 @@
 ---
 # Deploy Uptime Kuma to the NetBird VPS
-# Usage: ansible-playbook -i inventory/ plays/install-uptime-kuma.yml
+# Applied by site.yml.
 #
 # Prerequisites:
 # - netbird-server play applied (docker, Traefik on netbird_netbird)
 # - OpenBao homelab/infrastructure/uptime-kuma with keys username, password
-# - VAULT_TOKEN in the environment (policy: uptime-kuma-vps)
+# - OpenBao homelab/infrastructure/uptime-kuma/smtp with keys server, port, username, token
+# - homelab/infrastructure/uptime-kuma-metrics (key api_key) is written by the role
+# - an OpenBao token with policy uptime-kuma-vps: `bao login -method=oidc`
+#   (role owner) or VAULT_TOKEN
 # - DNS for kuma.renner.uno pointing at the VPS

 - name: Deploy Uptime Kuma
@@ -248,3 +248,6 @@
          - "Commit inventory/group_vars/all/netbird-rotatable.yml — it is encrypted."
          - "NOT rotated: datastore_key (needs dump/restore), auth_client_secret (Authentik side)."
          - "OpenBao is unaffected by design — its NetBird credentials are separate ones."
+
+- name: Close the SSH connections
+  ansible.builtin.import_playbook: close-connections.yml
@@ -43,7 +43,6 @@
            - ubuntu_upgrade.rc != 0 
            - "'No new release found' not in ubuntu_upgrade.stdout"
            - "'No new release found' not in ubuntu_upgrade.stderr"
-          ignore_errors: true

        - name: Display Upgrade Result
          ansible.builtin.debug:
@@ -111,3 +110,6 @@
      when: 
        - (ansible_distribution == 'Ubuntu' and reboot_required.stat.exists) or
          (ansible_distribution == 'Debian')
+
+- name: Close the SSH connections
+  ansible.builtin.import_playbook: close-connections.yml
@@ -0,0 +1,33 @@
+---
+# Package upgrade + reboot for netbird_proxy, edge_host and netbird_server,
+# one host at a time.
+# Usage (from ansible/): ansible-playbook plays/update-os.yml
+#
+# Plays run in order; a failed host stops the whole run (max_fail_percentage: 0).
+
+- name: Update NetBird proxies
+  hosts: netbird_proxy
+  serial: 1
+  max_fail_percentage: 0
+  become: true
+  roles:
+    - os-update
+
+- name: Update edge hosts
+  hosts: edge_host
+  serial: 1
+  max_fail_percentage: 0
+  become: true
+  roles:
+    - os-update
+
+- name: Update NetBird server
+  hosts: netbird_server
+  serial: 1
+  max_fail_percentage: 0
+  become: true
+  roles:
+    - os-update
+
+- name: Close the SSH connections
+  ansible.builtin.import_playbook: close-connections.yml
@@ -18,6 +18,7 @@
 - name: Get installed version
  command: "{{ chrony_exporter_binary }} --version"
  register: installed_version
+  check_mode: false
  when: chrony_exporter_installed.stat.exists
  changed_when: false
  failed_when: false
@@ -1,57 +0,0 @@
-# claude-workstation
-
-An always-on, **off-site** headless Claude Code host (Debian 12 VM under Synology
-VMM on nas-2). It runs (a) reattachable interactive `tmux` sessions and (b) an
-unattended notes-distill timer. It deliberately holds the **least** privilege
-that still does the job.
-
-## What lives here vs. what's manual
-
-This role configures everything **inside** the VM. Three things are **manual**
-(no IaC path) and precede/accompany it — see [`RUNBOOK.md`](RUNBOOK.md) for the
-full step-by-step:
-
-1. **VM creation** in Synology VMM (`ladmin` has no sudo; the DSM API is
-   root-only), with a cloud-init drive that installs the CI SSH key.
-2. **Netbird dashboard route** advertising the k8s API to the mesh, and the
-   **site-to-site return route** on the off-site gateway (backup path).
-3. **Secret material**: `claude setup-token` (subscription OAuth), the claude-bot
-   creds, and the read-only SA kubeconfig — encrypted into the group vault.
-
-## Credential isolation
-
-Two Unix users with separate credential stores so an unattended job cannot read
-the interactive session's secrets:
-
-| User | Holds | Runs |
-|------|-------|------|
-| `claude` | OAuth token, claude-bot creds, **read-only** SA kubeconfig | interactive tmux |
-| `claude-job` | its **own** OAuth token, claude-bot creds (no kubeconfig) | notes-distill timer |
-
-**No talosconfig, no SOPS age key** ever land here (Fable review #1). The
-kubeconfig is a read-only `view` ServiceAccount (`kubernetes/apps/claude-workstation/`).
-
-## Egress lockdown (staged)
-
-`claude_ws_egress_enforce` ships **`false`** so a fresh host is never bricked.
-The deny-default nftables ruleset, the DNS-resolver, and its refresh timer are
-installed regardless. Flip to `true` (in host/group vars) only after confirming
-`claude_ws_egress_allow_fqdns` / `claude_ws_egress_allow_cidrs*` cover real
-traffic — watch the `claude-egress-dropped` counter first.
-
-## Vault keys (encrypt into `inventory/group_vars/claude_workstation/vault.yml`)
-
-```
-netbird_setup_key                  # from the Netbird dashboard
-claude_ws_oauth_token_interactive  # `claude setup-token` (interactive user)
-claude_ws_oauth_token_job          # `claude setup-token` (job user, separate)
-claude_ws_gitea_token              # claude-bot PAT
-claude_ws_gitea_git_credentials    # https://claude-bot:<pat>@gitea.renner.uno
-claude_ws_kubeconfig               # read-only SA kubeconfig (literal YAML)
-```
-
-## Kill switch
-
-Everything unattended hangs off systemd timers; `systemctl disable --now
-claude-notes-distill.timer` (and the egress refresh) stops it. Every credential
-is independently revocable (SA token, claude-bot PAT, OAuth token, Netbird peer).
@@ -1,222 +0,0 @@
-# Runbook — off-site Claude Code workstation (nas-2)
-
-Operator guide for the manual steps around the `claude-workstation` role. The
-role automates everything **inside** the VM; this covers what it can't:
-VM creation, networking, secret material, egress cutover, rotation and DR.
-
-## Architecture (scope)
-
-An always-on **Debian 13 VM under Synology VMM on the off-site nas-2**
-(DS1522+, 10.3.40.0/24, reached over the site-to-site VPN, ~55 ms). It runs:
-
- **Reattachable interactive sessions** (`tmux` over SSH as user `claude`).
- **Unattended notes-distill timer** (as user `claude-job`).
- **A thin is-home-up signal** (the existing external Gatus on the Netbird VPS
-  already covers this — don't duplicate it).
-
-**Out of scope (runs in-cluster instead):** scheduled repo-automation and
-cluster-reports go in as Woodpecker cron / CronJobs with an in-cluster
-ServiceAccount — *not* on this VM, so the VM holds no cluster-write creds.
-
-Credentials on the VM are minimal: a **read-only** `view` SA kubeconfig,
-claude-bot (non-admin) gitea creds, and a Claude subscription OAuth token.
-**No talosconfig, no SOPS age key.**
-
---
-
-## Step 1 — Create + install the VM (Synology VMM)
-
-`ladmin` has no sudo and the DSM API is root-only, so VMM is driven through the
-DSM **web UI**. Two hard facts dictate the method (all confirmed 2026-07-16, as
-built): **VMM has no cloud-init**, and its ISO-install wizard only creates blank
-disks. So the OS is installed from a **remastered Debian netinst ISO that
-auto-boots a preseed** — no console interaction, no boot-menu race.
-
-VMM gotchas that shape this (see the wiki build-record):
- VMM refuses to change/unmount a VM's ISO while it is **running** ("Failed to
-  replace ISO files"). Do all ISO/boot-device edits with the VM **off**.
- A **guest reboot does not re-read** VMM's boot-device/ISO config — only a full
-  VMM power-cycle applies it. So an auto-booting install ISO **loops** (reboot →
-  CD → reinstall, wiping the disk). Break it by preseeding the installer to
-  **power off** at the end: `d-i debian-installer/exit/poweroff boolean true`.
- Attach the NIC to the **untagged `Default VM Network`** — the VLAN-40
-  `40_Server` network is isolated (no DHCP, no network). The LAN has DHCP.
-
-Procedure (build the ISO on a host with `xorriso`):
-1. Download the current Debian **netinst** (`.../debian-cd/current/amd64/iso-cd/`).
-2. Remaster it — add `/preseed.cfg` and replace `/isolinux/isolinux.cfg` with a
-   minimal one (`default preseed`, `timeout 1`, one label:
-   `kernel /install.amd/vmlinuz` /
-   `append auto=true priority=critical preseed/file=/cdrom/preseed.cfg vga=788 initrd=/install.amd/initrd.gz --- quiet`):
-   `xorriso -indev in.iso -outdev out.iso -boot_image any replay -map preseed.cfg /preseed.cfg -map isolinux.cfg /isolinux/isolinux.cfg`.
-   The preseed uses **DHCP** (`netcfg/dhcp_timeout 120` — the virtual-switch port
-   is slow to link), disk **`/dev/sda`** (VirtIO SCSI), **no user** + a locked
-   random root hash (key-only via `PermitRootLogin prohibit-password`), packages
-   `openssh-server sudo qemu-guest-agent python3`, and a `late_command` that
-   injects the SSH keys (`krenner@fortress`, `woodpecker-ci@homelab`, your
-   workstation key) into `/root/.ssh/authorized_keys`, plus the `poweroff` line.
-3. Upload to nas-2 via `ssh 'cat > /volume1/Install/<iso>' < <iso>` — **scp /
-   sftp / rsync are blocked on DSM**. Then VMM → Image → Add → From Synology NAS
-   → import (VMM **copies** it; re-import if you change the source file).
-4. Create VM: 2 vCPU, 4 GB, 50 GB on `/volume1`, **Default VM Network**, Legacy
-   BIOS, **Autostart: Yes**; attach the ISO, **Boot from DVD/CD-ROM**, power on.
-5. It installs unattended and **powers off**. Then (VM off) set **ISO =
-   Unmounted**, **Boot from = Virtual Disk**, power on → boots the installed
-   Debian. `qemu-guest-agent` reports the DHCP lease in VMM's IP column.
-6. **Pin a DSM update window** (Control Panel → Update & Restore) so an
-   auto-reboot doesn't kill tmux/jobs.
-
-> As built 2026-07-16: Debian 13 (trixie), got DHCP `10.3.40.78`, all three keys
-> injected, packages present. Freeing RAM required powering off the pre-existing
-> `pbs1` PBS VM (kept its 3.4 TB backup disk).
-
-> **At-rest encryption (Fable #6).** Off-site physical custody is weaker than
-> home. For true at-rest protection of the VM's secrets *with* unattended
-> autostart, use **network-bound decryption** (clevis + a Tang server at home):
-> a stolen disk off-site can't unlock because it can't reach Tang. Full-disk
-> LUKS with a manual passphrase would break autostart. Until Tang is stood up,
-> secrets rely on 0600 perms + VM access control — documented gap, not a fix.
-
---
-
-## Step 2 — Networking (two paths)
-
-**Netbird mesh (done via CI):** mint a setup key in the dashboard
-(`https://netbird.renner.uno`), vault it as `netbird_setup_key` under
-`group_vars/claude_workstation/`, and run `.woodpecker/deploy-netbird-client.yml`
-(`install-netbird-client.yml --limit claude_workstation`). As built 2026-07-16
-the VM enrolled as `claude-ws-190-112.nb.renner.uno` / `100.96.190.112` (+ IPv6).
-
-> **Mesh reachability caveat.** The mesh IP (`100.96.x`) is only reachable from
-> **other Netbird peers**. The home workstation and the Woodpecker CI agent are
-> **not** peers — they reach the VM only via the site-to-site tunnel at its DHCP
-> lease. So a *stable* mesh-based `ansible_host` needs CI (or a home host) on the
-> mesh first, or a Netbird routing peer bridging tunnel↔mesh. Until then the
-> inventory targets the tunnel DHCP IP.
-
-> **DNS trap.** `claude-ws.obg.renner.uno` resolves to the VM's lease **only at
-> the off-site DNS** (`@10.3.40.1`). The home resolver catch-alls `*.renner.uno`
-> to the public proxy (`162.55.50.97`, the Netbird VPS) — so from home the FQDN
-> lands on `root@netbird`, **not** the VM. Never use it as `ansible_host`.
-
-**Optional — mesh route to the k8s API (redundant read path):** to reach the API
-over the mesh too, add a Netbird dashboard **network route** advertising the
-apiserver's ClusterIP to the `netbird-ingress` peer group, and add an egress
-rule to the `netbird-ingress-egress` CiliumNetworkPolicy
-(`kubernetes/infrastructure/network-policies/ingress-isolation.yaml`) permitting
-`app: netbird-ingress` pods to reach `kube-apiserver:443`. Deferred from this PR
-because it edits a security-critical CNP that can't be validated offline — do it
-as a follow-up when you want the redundant API path.
-
---
-
-## Step 3 — Read-only SA kubeconfig
-
-After the `kubernetes/apps/claude-workstation/` PR merges and Flux reconciles:
-
-```sh
-NS=apps
-TOKEN=$(kubectl -n $NS get secret claude-workstation-token -o jsonpath='{.data.token}' | base64 -d)
-kubectl -n $NS get secret claude-workstation-token -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt
-# server = the cluster's stable API endpoint (kubernetes/talos/patches/cluster.yaml).
-# Use the name, not an address: it is what the API server certificate carries as a
-# SAN, so an IP here fails TLS verification even when it is reachable. It must
-# resolve from the workstation over the site-to-site route.
-kubectl config set-cluster homelab --server=https://k8s.renner.uno:6443 \
-  --certificate-authority=/tmp/ca.crt --embed-certs=true --kubeconfig=/tmp/claude-ws.kubeconfig
-kubectl config set-credentials claude-workstation --token="$TOKEN" --kubeconfig=/tmp/claude-ws.kubeconfig
-kubectl config set-context homelab --cluster=homelab --user=claude-workstation --kubeconfig=/tmp/claude-ws.kubeconfig
-kubectl config use-context homelab --kubeconfig=/tmp/claude-ws.kubeconfig
-# verify read-only:
-KUBECONFIG=/tmp/claude-ws.kubeconfig kubectl get nodes        # works
-KUBECONFIG=/tmp/claude-ws.kubeconfig kubectl get secrets -A   # Forbidden (view excludes secrets)
-```
-
-The resulting file becomes the `claude_ws_kubeconfig` vault value.
-
---
-
-## Step 4 — Secret material → vault
-
-```sh
-# Two independent OAuth tokens so job jobs can't impersonate the interactive user:
-claude setup-token   # -> claude_ws_oauth_token_interactive
-claude setup-token   # -> claude_ws_oauth_token_job  (run again / separate session)
-```
-
-Encrypt into `ansible/inventory/group_vars/claude_workstation/vault.yml`
-(ansible-vault; same VAULT_PASS the CI uses):
-
-```yaml
-netbird_setup_key: "..."
-claude_ws_oauth_token_interactive: "..."
-claude_ws_oauth_token_job: "..."
-claude_ws_gitea_token: "..."                # claude-bot PAT
-claude_ws_gitea_git_credentials: "https://claude-bot:<PAT>@gitea.renner.uno"
-claude_ws_kubeconfig: |
-  apiVersion: v1
-  ...                                        # the file from Step 3
-```
-
-> **Never run `claude` with `--bare`** here or on the VM — bare mode silently
-> ignores `CLAUDE_CODE_OAUTH_TOKEN` and the jobs will fail auth.
-
---
-
-## Step 5 — Deploy
-
-Merge the PR, then trigger the pipeline (Woodpecker → Run → `PIPELINE ==
-"deploy-claude-workstation"`), or push a change under the role's paths. CI SSHes
-to `10.3.40.60` over the tunnel and applies `common`, `netbird-client`, and this
-role. Also run the umbrella `plays/common.yml` against the new host once, so it
-picks up `qemu-guest-agent` like every other inventory host.
-
---
-
-## Step 6 — Egress cutover (staged)
-
-The nftables allowlist ships **disabled**. To enforce:
-
-1. Leave it off for a few days; watch what the box actually talks to.
-2. Confirm `claude_ws_egress_allow_fqdns` + `claude_ws_egress_allow_cidrs*`
-   (home Prometheus/Loki/API) cover it.
-3. Set `claude_ws_egress_enforce: true` in host/group vars, redeploy.
-4. Watch the `claude-egress-dropped` nft counter (`nft list ruleset`) and Loki
-   for anything legitimate being dropped; widen the allowlist as needed.
-
---
-
-## Step 7 — Notes (Syncthing pairing)
-
-The role installs Syncthing for `claude-job` and starts
-`syncthing@claude-job`. Pair it once (manual): from the VM's GUI (SSH tunnel to
-`127.0.0.1:8384`) add your existing vault's device ID and accept the shared
-`Notes` folder pointed at `{{ claude_ws_notes_dir }}`. The distill timer runs
-daily at 04:30 and only ever **creates** new atomic notes.
-
---
-
-## Rotation
-
- **OAuth token** (expires/can be revoked): re-run `claude setup-token` on your
-  laptop, update the two vault keys, redeploy. Headless auth failures surface in
-  Loki (the wrapper logs `result=failure`) — don't let them go quiet.
- **claude-bot PAT**: rotate in Gitea, update `claude_ws_gitea_*`, redeploy.
- **SA token**: `kubectl -n apps delete secret claude-workstation-token` (Flux
-  recreates it), re-assemble the kubeconfig (Step 3), update vault, redeploy.
-
-## Kill switch
-
-```sh
-systemctl disable --now claude-notes-distill.timer claude-egress-refresh.timer
-```
-
-Every credential is independently revocable: delete the SA, revoke the PAT,
-revoke the OAuth token, or remove the Netbird peer — no shared blast radius.
-
-## Disaster recovery (cattle, not pet)
-
-The VM holds no unique state — the only real state is the Notes replica, which
-re-syncs from Syncthing. To rebuild: redo **Step 1** (VM + cloud-init), then
-**Step 5** (pipeline). No VMM snapshots needed (they'd bloat the 86%-full
-`/volume1`).
@@ -1,68 +0,0 @@
---
-# claude-workstation role defaults
-#
-# An always-on headless host that runs Claude Code for (a) reattachable
-# interactive sessions and (b) unattended notes/wiki timers. It deliberately
-# holds the LEAST privilege that still lets it do its job: a read-only k8s
-# ServiceAccount kubeconfig, claude-bot (non-admin) gitea creds, and a Claude
-# subscription OAuth token — NO talosconfig and NO SOPS age key. See README.
-
-# --- Users -----------------------------------------------------------------
-# Two Unix users with separate credential stores so an unattended (timer) job
-# cannot read the interactive session's OAuth token / kube / gitea creds.
-claude_ws_interactive_user: claude          # human tmux sessions
-claude_ws_job_user: claude-job              # unattended systemd-timer jobs
-
-claude_ws_base_dir: /opt/claude-workstation
-
-# --- Toolchain -------------------------------------------------------------
-claude_ws_node_major: 22                     # matches the ci-claude image
-claude_ws_claude_code_pkg: "@anthropic-ai/claude-code"
-claude_ws_base_packages:
-  - git
-  - tmux
-  - jq
-  - curl
-  - ca-certificates
-  - ripgrep
-  - unzip
-  - nftables
-  - python3
-  - python3-venv
-
-# --- Egress allowlist ------------------------------------------------------
-# Deny-default OUTPUT is the target end-state, but it can brick a fresh host if
-# an allowed destination is missed, so it ships DISABLED and is tightened after
-# observing real egress (staged rollout). Flip claude_ws_egress_enforce to true
-# once the allowlist below is confirmed complete. See templates/nftables.conf.j2.
-claude_ws_egress_enforce: false
-# Static destinations the host must always reach. CDN-backed hosts (Anthropic,
-# npm, apt) are matched by name at apply time via the fqdn set; home services
-# are matched by IP. Tune in host_vars.
-claude_ws_egress_allow_fqdns:
-  - api.anthropic.com
-  - statsig.anthropic.com
-  - gitea.renner.uno
-  - fsn1.your-objectstorage.com          # Hetzner Object Storage (SOPS bundle)
-  - deb.debian.org
-  - security.debian.org
-  - deb.nodesource.com
-  - pkgs.netbird.io
-  - registry.npmjs.org
-claude_ws_egress_allow_cidrs: []          # home Prometheus/Loki/API (v4), per-host
-claude_ws_egress_allow_cidrs6: []         # same (v6) — IPv6-first, prefer these
-
-# --- Notes / wiki pipeline -------------------------------------------------
-# The Obsidian vault syncs onto this host via Syncthing (matches the user's
-# existing multi-device setup). Unattended pipeline jobs must CREATE new atomic
-# files rather than rewrite existing ones, to keep Syncthing conflicts rare.
-claude_ws_notes_enabled: true
-claude_ws_notes_dir: "/home/{{ claude_ws_job_user }}/Notes"
-claude_ws_syncthing_gui_bind: "127.0.0.1:8384"
-
-# --- Secrets (populated from the ansible-vault'd group_vars — see README) ---
-# claude_ws_oauth_token_interactive : CLAUDE_CODE_OAUTH_TOKEN for the human user
-# claude_ws_oauth_token_job         : CLAUDE_CODE_OAUTH_TOKEN for timer jobs
-# claude_ws_gitea_token             : claude-bot PAT
-# claude_ws_gitea_git_credentials   : https://claude-bot:<pat>@gitea.renner.uno line
-# claude_ws_kubeconfig              : read-only SA kubeconfig (base64 or literal)
@@ -1,22 +0,0 @@
-You are running unattended as a scheduled job on the claude-workstation host.
-Your job is a conservative distillation pass over the Obsidian wiki vault.
-
-Scope and rules (follow exactly — you have only Read, Write, Glob, Grep):
-
-1. Look at `~/Notes/raw/` (ignore `~/Notes/raw/_processed/` and `~/Notes/_archive/`
-   entirely) for source material.
-2. For each raw source, check whether `~/Notes/wiki/` already contains a note
-   grounded in it (Grep the wiki for the source filename / its `sources:` slug).
-   If a note already exists, SKIP that source — do not rewrite or duplicate it.
-3. For raw sources with NO corresponding wiki note yet, create new atomic
-   concept notes in `~/Notes/wiki/`: one concept per file, self-contained,
-   tagged, cross-linked with `[[wikilinks]]`, every claim grounded in a
-   `sources:` entry. Never invent facts not present in the source.
-4. CREATE new files only. Never rewrite, move, delete, or truncate an existing
-   file in `~/Notes/` — appending a missing cross-link to a note you created
-   THIS run is fine; touching pre-existing notes is not.
-5. If there is nothing new to distill, do nothing and stop. Do not manufacture
-   work.
-
-Preserve disagreement: if sources conflict, surface the conflict in the note
-rather than silently picking a winner. Keep each note short and single-purpose.
@@ -1,8 +0,0 @@
-# claude-workstation shared tmux config — reattachable long-running sessions.
-set -g history-limit 100000
-set -g mouse on
-set -g base-index 1
-setw -g pane-base-index 1
-set -g status-right "#H  %Y-%m-%d %H:%M"
-# Keep sessions alive across client disconnects (the whole point of this host).
-set -g destroy-unattached off
@@ -1,10 +0,0 @@
---
- name: Reload systemd
-  ansible.builtin.systemd:
-    daemon_reload: true
-
- name: Reload nftables
-  ansible.builtin.systemd:
-    name: nftables.service
-    state: reloaded
-  when: claude_ws_egress_enforce | bool
@@ -1,42 +0,0 @@
---
-# Deny-default egress allowlist. Ships DISABLED (claude_ws_egress_enforce:
-# false) so a fresh host is never bricked by a missed destination; the ruleset,
-# the FQDN-resolver, and its refresh timer are installed regardless, and the
-# operator flips the toggle to true once egress is confirmed complete against
-# real traffic (staged rollout). CDN-backed hosts are matched via nft named
-# sets that the refresh unit repopulates from DNS; static home services are
-# matched by claude_ws_egress_allow_cidrs.
-
- name: Deploy the egress-refresh resolver
-  ansible.builtin.template:
-    src: claude-egress-refresh.sh.j2
-    dest: "{{ claude_ws_base_dir }}/claude-egress-refresh.sh"
-    mode: "0755"
-
- name: Deploy the egress-refresh service + timer
-  ansible.builtin.template:
-    src: "{{ item }}.j2"
-    dest: "/etc/systemd/system/{{ item }}"
-    mode: "0644"
-  loop:
-    - claude-egress-refresh.service
-    - claude-egress-refresh.timer
-  notify: Reload systemd
-
- name: Deploy the nftables ruleset
-  ansible.builtin.template:
-    src: nftables.conf.j2
-    dest: /etc/nftables.conf
-    mode: "0644"
-    validate: "nft -c -f %s"
-  notify: Reload nftables
-
- name: Enforce or relax egress lockdown
-  ansible.builtin.systemd:
-    name: "{{ item }}"
-    enabled: "{{ claude_ws_egress_enforce | bool }}"
-    state: "{{ 'started' if (claude_ws_egress_enforce | bool) else 'stopped' }}"
-    daemon_reload: true
-  loop:
-    - nftables.service
-    - claude-egress-refresh.timer
@@ -1,183 +0,0 @@
---
-# claude-workstation: an always-on headless Claude Code host.
-# Debian 12 VM on the off-site nas-2 (Synology VMM). See README for the manual
-# bootstrap (VM creation, Netbird route, secret material) that precedes this.
-#
-# common.yml already applies `common` and `qemu-guest-agent`
-# to every inventory host, so this role owns only the
-# Claude-specific surface: toolchain, the two credential-isolated users, the
-# read-only creds, notes sync, the unattended timers, and egress lockdown.
-
- name: Assert we are on Debian (role is apt-only)
-  ansible.builtin.assert:
-    that:
-      - ansible_facts['os_family'] == 'Debian'
-    fail_msg: "claude-workstation targets Debian; got {{ ansible_facts['os_family'] }}."
-
-# --- Base packages ---------------------------------------------------------
- name: Install base packages
-  ansible.builtin.apt:
-    name: "{{ claude_ws_base_packages }}"
-    state: present
-    update_cache: true
-
-# --- Node.js 22 + Claude Code (matches the ci-claude image toolchain) -------
- name: Add NodeSource signing key
-  ansible.builtin.get_url:
-    url: https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key
-    dest: /usr/share/keyrings/nodesource.gpg
-    mode: "0644"
-    force: false
-
- name: Add NodeSource apt repository
-  ansible.builtin.apt_repository:
-    repo: "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_{{ claude_ws_node_major }}.x nodistro main"
-    state: present
-    filename: nodesource
-
- name: Install Node.js
-  ansible.builtin.apt:
-    name: nodejs
-    state: present
-    update_cache: true
-
-# NodeSource installs Node under /usr, so global npm modules land in
-# /usr/lib/node_modules and `claude` is on PATH for every user/timer. `creates`
-# keeps it idempotent (re-run `npm install -g` manually to bump the version).
- name: Install Claude Code globally
-  ansible.builtin.command:
-    cmd: "npm install -g {{ claude_ws_claude_code_pkg }}"
-    creates: /usr/lib/node_modules/@anthropic-ai/claude-code
-
-# --- Credential-isolated users --------------------------------------------
- name: Create Claude users
-  ansible.builtin.user:
-    name: "{{ item }}"
-    shell: /bin/bash
-    create_home: true
-  loop:
-    - "{{ claude_ws_interactive_user }}"
-    - "{{ claude_ws_job_user }}"
-
- name: Create the role base directory (scripts, prompts)
-  ansible.builtin.file:
-    path: "{{ claude_ws_base_dir }}"
-    state: directory
-    mode: "0755"
-
-# Let the interactive user's tmux server survive SSH logout / reboot.
- name: Enable lingering for the interactive user
-  ansible.builtin.command: "loginctl enable-linger {{ claude_ws_interactive_user }}"
-  args:
-    creates: "/var/lib/systemd/linger/{{ claude_ws_interactive_user }}"
-
- name: Deploy shared tmux config
-  ansible.builtin.copy:
-    src: tmux.conf
-    dest: "/home/{{ item }}/.tmux.conf"
-    owner: "{{ item }}"
-    group: "{{ item }}"
-    mode: "0644"
-  loop:
-    - "{{ claude_ws_interactive_user }}"
-    - "{{ claude_ws_job_user }}"
-
-# --- Secrets: each user gets only what its role needs ----------------------
-# The interactive user gets gitea + OAuth + read-only kubeconfig. The job user
-# gets its OWN OAuth token + gitea (to open PRs) but NO kubeconfig.
- name: Create ~/.config/claude-bot for the interactive user
-  ansible.builtin.file:
-    path: "/home/{{ item }}/.config/claude-bot"
-    state: directory
-    owner: "{{ item }}"
-    group: "{{ item }}"
-    mode: "0700"
-  loop:
-    - "{{ claude_ws_interactive_user }}"
-    - "{{ claude_ws_job_user }}"
-
- name: Deploy claude-bot gitea token
-  ansible.builtin.copy:
-    content: "{{ claude_ws_gitea_token }}\n"
-    dest: "/home/{{ item }}/.config/claude-bot/gitea-token"
-    owner: "{{ item }}"
-    group: "{{ item }}"
-    mode: "0600"
-  loop:
-    - "{{ claude_ws_interactive_user }}"
-    - "{{ claude_ws_job_user }}"
-  no_log: true
-
- name: Deploy claude-bot git-credentials
-  ansible.builtin.copy:
-    content: "{{ claude_ws_gitea_git_credentials }}\n"
-    dest: "/home/{{ item }}/.config/claude-bot/git-credentials"
-    owner: "{{ item }}"
-    group: "{{ item }}"
-    mode: "0600"
-  loop:
-    - "{{ claude_ws_interactive_user }}"
-    - "{{ claude_ws_job_user }}"
-  no_log: true
-
-# CLAUDE_CODE_OAUTH_TOKEN is delivered as an EnvironmentFile so both interactive
-# shells and timer units can source it without it landing in shell history.
-# NEVER run claude with --bare here: bare mode silently ignores this token.
- name: Deploy per-user Claude OAuth environment file
-  ansible.builtin.copy:
-    content: "CLAUDE_CODE_OAUTH_TOKEN={{ item.token }}\n"
-    dest: "/home/{{ item.user }}/.config/claude-code.env"
-    owner: "{{ item.user }}"
-    group: "{{ item.user }}"
-    mode: "0600"
-  loop:
-    - { user: "{{ claude_ws_interactive_user }}", token: "{{ claude_ws_oauth_token_interactive }}" }
-    - { user: "{{ claude_ws_job_user }}", token: "{{ claude_ws_oauth_token_job }}" }
-  loop_control:
-    label: "{{ item.user }}"
-  no_log: true
-
- name: Create ~/.kube for the interactive user
-  ansible.builtin.file:
-    path: "/home/{{ claude_ws_interactive_user }}/.kube"
-    state: directory
-    owner: "{{ claude_ws_interactive_user }}"
-    group: "{{ claude_ws_interactive_user }}"
-    mode: "0700"
-
- name: Deploy read-only SA kubeconfig (interactive user only)
-  ansible.builtin.copy:
-    content: "{{ claude_ws_kubeconfig }}"
-    dest: "/home/{{ claude_ws_interactive_user }}/.kube/config"
-    owner: "{{ claude_ws_interactive_user }}"
-    group: "{{ claude_ws_interactive_user }}"
-    mode: "0600"
-  no_log: true
-
-# This VM's only git identity IS claude-bot (unlike the shared human
-# workstation, where a global credential.helper is forbidden), so a per-user
-# ~/.gitconfig pointing at each user's own claude-bot store is appropriate.
- name: Configure git identity + credential store for the Claude users
-  ansible.builtin.copy:
-    dest: "/home/{{ item }}/.gitconfig"
-    owner: "{{ item }}"
-    group: "{{ item }}"
-    mode: "0644"
-    content: |
-      [user]
-      	name = Claude Bot
-      	email = claude-bot@renner.uno
-      [credential]
-      	helper = store --file=/home/{{ item }}/.config/claude-bot/git-credentials
-  loop:
-    - "{{ claude_ws_interactive_user }}"
-    - "{{ claude_ws_job_user }}"
-
-# --- Notes / wiki pipeline (Syncthing + timers) ----------------------------
- name: Notes pipeline
-  ansible.builtin.include_tasks: notes.yml
-  when: claude_ws_notes_enabled | bool
-
-# --- Egress lockdown -------------------------------------------------------
- name: Egress firewall
-  ansible.builtin.include_tasks: firewall.yml
@@ -1,48 +0,0 @@
---
-# Notes/wiki pipeline: the Obsidian vault syncs onto this host via Syncthing
-# (matching the user's existing multi-device setup), and a hardened, bounded
-# systemd timer runs an unattended `claude -p` distill pass over it as the
-# credential-isolated job user. Device pairing is a one-time manual step (see
-# README) — this only installs Syncthing and the timer.
-
- name: Install Syncthing
-  ansible.builtin.apt:
-    name: syncthing
-    state: present
-    update_cache: true
-
- name: Enable Syncthing for the job user
-  ansible.builtin.systemd:
-    name: "syncthing@{{ claude_ws_job_user }}.service"
-    enabled: true
-    state: started
-    daemon_reload: true
-
- name: Deploy the notes-distill prompt
-  ansible.builtin.copy:
-    src: claude-notes-distill-prompt.md
-    dest: "{{ claude_ws_base_dir }}/claude-notes-distill-prompt.md"
-    mode: "0644"
-
- name: Deploy the notes-distill wrapper
-  ansible.builtin.template:
-    src: claude-notes-distill.sh.j2
-    dest: "{{ claude_ws_base_dir }}/claude-notes-distill.sh"
-    mode: "0755"
-
- name: Deploy the notes-distill service + timer
-  ansible.builtin.template:
-    src: "{{ item }}.j2"
-    dest: "/etc/systemd/system/{{ item }}"
-    mode: "0644"
-  loop:
-    - claude-notes-distill.service
-    - claude-notes-distill.timer
-  notify: Reload systemd
-
- name: Enable the notes-distill timer
-  ansible.builtin.systemd:
-    name: claude-notes-distill.timer
-    enabled: true
-    state: started
-    daemon_reload: true
@@ -1,10 +0,0 @@
-[Unit]
-# {{ ansible_managed }}
-Description=Refresh claude-workstation egress allowlist from DNS
-After=nftables.service network-online.target
-Wants=network-online.target
-Requires=nftables.service
-
-[Service]
-Type=oneshot
-ExecStart={{ claude_ws_base_dir }}/claude-egress-refresh.sh
@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-# {{ ansible_managed }}
-# Resolve the egress FQDN allowlist to current IPs and load them into the
-# nftables @allow4/@allow6 sets. CDN IPs rotate, so this runs on a timer.
-# No-op unless the claude_egress table is loaded (i.e. enforcement is on).
-set -euo pipefail
-
-TABLE="inet claude_egress"
-FQDNS=(
-{% for fqdn in claude_ws_egress_allow_fqdns %}
-    "{{ fqdn }}"
-{% endfor %}
-)
-
-nft list table $TABLE >/dev/null 2>&1 || { echo "claude_egress table not loaded; enforcement off"; exit 0; }
-
-v4=(); v6=()
-for host in "${FQDNS[@]}"; do
-    while read -r ip; do [ -n "$ip" ] && v4+=("$ip"); done < <(getent ahostsv4 "$host" | awk '{print $1}' | sort -u)
-    while read -r ip; do [ -n "$ip" ] && v6+=("$ip"); done < <(getent ahostsv6 "$host" | awk '{print $1}' | sort -u)
-done
-
-nft flush set $TABLE allow4
-nft flush set $TABLE allow6
-[ ${#v4[@]} -gt 0 ] && nft add element $TABLE allow4 "{ $(IFS=,; echo "${v4[*]}") }"
-[ ${#v6[@]} -gt 0 ] && nft add element $TABLE allow6 "{ $(IFS=,; echo "${v6[*]}") }"
-echo "claude-egress-refresh: ${#v4[@]} v4 + ${#v6[@]} v6 addresses loaded"
@@ -1,10 +0,0 @@
-[Unit]
-# {{ ansible_managed }}
-Description=Periodically refresh the claude-workstation egress allowlist
-
-[Timer]
-OnBootSec=30s
-OnUnitActiveSec=15min
-
-[Install]
-WantedBy=timers.target
@@ -1,32 +0,0 @@
-[Unit]
-# {{ ansible_managed }}
-Description=Claude Code unattended notes-distill pass
-After=network-online.target syncthing@{{ claude_ws_job_user }}.service
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-User={{ claude_ws_job_user }}
-Group={{ claude_ws_job_user }}
-EnvironmentFile=/home/{{ claude_ws_job_user }}/.config/claude-code.env
-ExecStart={{ claude_ws_base_dir }}/claude-notes-distill.sh
-# Hard wall-clock kill — the runaway/kill switch for this unattended agent.
-TimeoutStartSec=1800
-
-# --- Hardening: an unattended LLM job on internet-influenced input ----------
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ReadWritePaths=/home/{{ claude_ws_job_user }}
-# Credential isolation: cannot read the interactive session's tokens/kubeconfig.
-InaccessiblePaths=/home/{{ claude_ws_interactive_user }}
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-RestrictSUIDSGID=true
-RestrictNamespaces=true
-LockPersonality=true
-MemoryDenyWriteExecute=false
-
-[Install]
-WantedBy=multi-user.target
@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-# {{ ansible_managed }}
-# Unattended notes-distill pass. Prompt via stdin (never shell-substituted),
-# tool-allowlisted, no --bare (bare silently drops CLAUDE_CODE_OAUTH_TOKEN).
-# Bounded by the unit's TimeoutStartSec, not a CLI flag (--max-turns is absent
-# in the installed Claude Code). Emits a terminal state line to the journal on
-# EVERY outcome so a Loki alert can catch silent failures (dead-man switch).
-set -euo pipefail
-
-export HOME="/home/{{ claude_ws_job_user }}"
-NOTES="{{ claude_ws_notes_dir }}"
-PROMPT="{{ claude_ws_base_dir }}/claude-notes-distill-prompt.md"
-
-log() { logger -t claude-notes-distill -- "$*"; echo "claude-notes-distill: $*"; }
-
-if [ ! -d "$NOTES/raw" ]; then
-  log "result=skipped reason=no-vault path=$NOTES"
-  exit 0
-fi
-
-log "result=start"
-if claude -p \
-     --add-dir "$NOTES" \
-     --allowedTools "Read,Write,Glob,Grep" \
-     --model sonnet \
-     < "$PROMPT"; then
-  log "result=success"
-else
-  rc=$?
-  log "result=failure rc=$rc"
-  exit "$rc"
-fi
@@ -1,11 +0,0 @@
-[Unit]
-# {{ ansible_managed }}
-Description=Run the Claude Code notes-distill pass daily
-
-[Timer]
-OnCalendar=*-*-* 04:30:00
-Persistent=true
-RandomizedDelaySec=900
-
-[Install]
-WantedBy=timers.target
@@ -1,55 +0,0 @@
-#!/usr/sbin/nft -f
-# {{ ansible_managed }}
-# Deny-default egress for the claude-workstation. CDN-backed destinations are
-# matched via the @allow4/@allow6 named sets, repopulated from DNS by
-# claude-egress-refresh. Static home services are matched by the @static* sets.
-# Only loaded when claude_ws_egress_enforce is true.
-flush ruleset
-
-table inet claude_egress {
-    set allow4 { type ipv4_addr; flags interval; }
-    set allow6 { type ipv6_addr; flags interval; }
-
-    set static4 {
-        type ipv4_addr
-        flags interval
-{% if (claude_ws_egress_allow_cidrs | default([])) | length > 0 %}
-        elements = { {{ claude_ws_egress_allow_cidrs | join(', ') }} }
-{% endif %}
-    }
-    set static6 {
-        type ipv6_addr
-        flags interval
-{% if (claude_ws_egress_allow_cidrs6 | default([])) | length > 0 %}
-        elements = { {{ claude_ws_egress_allow_cidrs6 | join(', ') }} }
-{% endif %}
-    }
-
-    chain output {
-        type filter hook output priority 0; policy drop;
-
-        oif "lo" accept
-        ct state established,related accept
-
-        # DNS — required to resolve the allowlist itself.
-        udp dport 53 accept
-        tcp dport 53 accept
-
-        # Diagnostics + DHCP lease renewal on the bridged interface.
-        ip protocol icmp accept
-        ip6 nexthdr icmpv6 accept
-        udp dport { 67, 68 } accept
-
-        # NetBird / WireGuard control + data plane (initial handshakes).
-        udp dport { 3478, 51820 } accept
-
-        # Allowed destinations.
-        ip  daddr @allow4  accept
-        ip6 daddr @allow6  accept
-        ip  daddr @static4 accept
-        ip6 daddr @static6 accept
-
-        # Everything else is dropped and counted for inspection.
-        counter comment "claude-egress-dropped"
-    }
-}
@@ -51,10 +51,8 @@
 # -------------------------------------------------------
 # 4. SSH Configuration
 # -------------------------------------------------------
-# Authorized keys (human + woodpecker-ci, the latter from=-restricted) are
-# managed by the dedicated ansible/plays/configure-ssh-keys.yml play. The old
-# "Add Ansible Runner SSH Key" task deployed ansible-runner@ci-new, a dead key
-# for a host that no longer exists — removed (issue #184).
+# SSH access (CA trust, admin authorized_keys) is managed by the ssh-ca role
+# via plays/configure-ssh-ca.yml.

 # -------------------------------------------------------
 # 5. Disable NTP on VMs/LXC (use host time)
@@ -3,7 +3,7 @@
 #
 # Enforces the decisions the in-cluster CrowdSec already detects, at the point
 # where public traffic actually enters: these hosts terminate TLS for every
-# *.renner.uno name. A drop here never reaches the mesh, the relay or the
+# public renner.uno name. A drop here never reaches the mesh, the relay or the
 # cluster.
 #
 # Detection stays in the cluster. The reverse-proxy produces no parseable
@@ -29,9 +29,11 @@
 # upstream ships no container image for this bouncer, which is expected —
 # it manipulates host netfilter.
 #
-# The CI runner has v4, so it does the fetching. The checksum is verified
-# there, before anything is copied to a host.
+# The controller has v4, so it does the fetching. The checksum is verified
+# there, before anything is copied to a host. Also in check mode: the fetch
+# only writes on the controller, and the copy below needs the file.
 - name: Fetch the pinned bouncer release on the controller
+  check_mode: false
  ansible.builtin.get_url:
    url: >-
      https://github.com/crowdsecurity/cs-firewall-bouncer/releases/download/{{
@@ -87,6 +87,7 @@
  ansible.builtin.command:
    argv: [pgrep, -af, "edge-host/(open3e|e3oncan)"]
  register: heating_can_survivors
+  check_mode: false
  changed_when: false
  failed_when: false

@@ -65,6 +65,7 @@
      - /etc/network/interfaces
      - /etc/network/interfaces.d/
  register: keepalived_ntp_static6_ifupdown
+  check_mode: false
  changed_when: false
  failed_when: false
  when:
@@ -123,6 +124,7 @@
      - "{{ keepalived_ntp_vip6.split('/')[0] }}\\b"
      - /etc/systemd/network/
  register: keepalived_ntp_static6_networkd
+  check_mode: false
  changed_when: false
  failed_when: false
  when:
@@ -140,9 +142,8 @@
      Handing the address to keepalived while networkd also assigns it means
      it would NOT be withdrawn when check_ntp fails -- the host would keep
      serving time on an address VRRP believes it has released.
-      Re-apply the edge-vlan role first, whose template no longer carries the
-      [Address] block:
-      ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml
+      Re-apply the edge-vlan role first (site.yml runs it before this play),
+      whose template no longer carries the [Address] block.
    success_msg: >-
      No static networkd assignment of {{ keepalived_ntp_vip6 }}; safe for
      keepalived to own it.
@@ -6,3 +6,13 @@ netbird_management_url: "https://netbird.renner.uno"

 # Setup key - should be defined in group_vars or host_vars
 # netbird_setup_key: ""
+
+# Release installed on hosts without a NetBird package repository (Arch).
+# Debian/Ubuntu follow the apt repository instead.
+netbird_client_version: "0.75.0"
+netbird_release_url: "https://github.com/netbirdio/netbird/releases/download/v{{ netbird_client_version }}"
+# On the controller; the archive is copied from there to the hosts.
+netbird_download_dir: "{{ lookup('ansible.builtin.env', 'HOME') }}/.cache/ansible/netbird"
+
+# Leave the host's DNS configuration alone (hosts with a pinned resolv.conf).
+netbird_disable_dns: false
@@ -2,47 +2,79 @@
 # NetBird Client Installation Role
 # Installs and configures NetBird client on hosts with netbird_setup_key defined

- name: Install required packages
-  ansible.builtin.apt:
-    name:
-      - curl
-      - ca-certificates
-      - gnupg
-    state: present
-    update_cache: true
+- name: Install NetBird from the NetBird apt repository
+  when: ansible_facts['os_family'] == 'Debian'
+  block:
+    - name: Install required packages
+      ansible.builtin.apt:
+        name:
+          - curl
+          - ca-certificates
+          - gnupg
+        state: present
+        update_cache: true

- name: Add NetBird repository key
-  ansible.builtin.shell:
-    cmd: |
-      curl -sSL https://pkgs.netbird.io/debian/public.key | gpg --dearmor -o /usr/share/keyrings/netbird-archive-keyring.gpg
-    creates: /usr/share/keyrings/netbird-archive-keyring.gpg
+    - name: Add NetBird repository key
+      ansible.builtin.shell:
+        cmd: |
+          curl -sSL https://pkgs.netbird.io/debian/public.key | gpg --dearmor -o /usr/share/keyrings/netbird-archive-keyring.gpg
+        creates: /usr/share/keyrings/netbird-archive-keyring.gpg

- name: Add NetBird repository
-  ansible.builtin.apt_repository:
-    repo: "deb [signed-by=/usr/share/keyrings/netbird-archive-keyring.gpg] https://pkgs.netbird.io/debian stable main"
-    state: present
-    filename: netbird
+    - name: Add NetBird repository
+      ansible.builtin.apt_repository:
+        repo: "deb [signed-by=/usr/share/keyrings/netbird-archive-keyring.gpg] https://pkgs.netbird.io/debian stable main"
+        state: present
+        filename: netbird

- name: Install NetBird client
-  ansible.builtin.apt:
-    name: netbird
-    state: present
-    update_cache: true
+    - name: Install NetBird client
+      ansible.builtin.apt:
+        name: netbird
+        state: present
+        update_cache: true

- name: Check if NetBird is already connected
-  ansible.builtin.command: netbird status
-  register: netbird_status
-  changed_when: false
-  failed_when: false
+# Arch has no netbird package in its repositories; the release binary is
+# verified against the release's checksums file. It is downloaded on the
+# controller and copied over: github.com has no IPv6 address, and proxy-1 is
+# IPv6-only. The controller steps also run in check mode: they only write on
+# the controller, and the install step needs the archive.
+- name: Install NetBird from the release tarball
+  when: ansible_facts['os_family'] == 'Archlinux'
+  block:
+    - name: Create the controller download directory
+      ansible.builtin.file:
+        path: "{{ netbird_download_dir }}"
+        state: directory
+        mode: "0755"
+      delegate_to: localhost
+      become: false
+      run_once: true
+      check_mode: false

- name: Connect NetBird to management server
-  ansible.builtin.command: >
-    netbird up
-    --management-url {{ netbird_management_url }}
-    --setup-key {{ netbird_setup_key }}
-  when: "'Connected' not in netbird_status.stdout"
-  register: netbird_connect
-  changed_when: netbird_connect.rc == 0
+    - name: Download the NetBird release on the controller
+      check_mode: false
+      ansible.builtin.get_url:
+        url: "{{ netbird_release_url }}/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
+        dest: "{{ netbird_download_dir }}/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
+        checksum: "sha256:{{ netbird_release_url }}/netbird_{{ netbird_client_version }}_checksums.txt"
+        mode: "0644"
+      delegate_to: localhost
+      become: false
+      run_once: true
+
+    - name: Install the NetBird binary
+      ansible.builtin.unarchive:
+        src: "{{ netbird_download_dir }}/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
+        dest: /usr/local/bin
+        include:
+          - netbird
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Install the NetBird service
+      ansible.builtin.command: netbird service install
+      args:
+        creates: /etc/systemd/system/netbird.service

 - name: Enable NetBird service
  ansible.builtin.service:
@@ -50,9 +82,29 @@
    state: started
    enabled: true

+- name: Check if NetBird is already connected
+  ansible.builtin.command: netbird status
+  register: netbird_status
+  check_mode: false
+  changed_when: false
+  failed_when: false
+
+# "Disconnected" contains "Connected", so match the management line.
+- name: Connect NetBird to management server
+  ansible.builtin.command: >
+    netbird up
+    --management-url {{ netbird_management_url }}
+    --setup-key {{ netbird_setup_key }}
+    {{ '--disable-dns' if netbird_disable_dns else '' }}
+  when: "'Management: Connected' not in netbird_status.stdout"
+  register: netbird_connect
+  changed_when: netbird_connect.rc == 0
+  no_log: true
+
 - name: Get NetBird status
  ansible.builtin.command: netbird status
  register: netbird_final_status
+  check_mode: false
  changed_when: false

 - name: Display NetBird status
@@ -136,27 +136,41 @@
    - /opt/netbird/proxy
    - /opt/netbird/proxy-state

-# The management store has no cluster-side backup. Pulling one put a root
-# key on this host that the cluster held, and this server's own state is
-# its own business to protect rather than the cluster's. Dropping the two
-# tasks that placed them would only stop ansible managing the key and the
-# script — the pair below revokes them instead, and can go once the role
-# has run against every host that ever carried them.
+# The management store has no cluster-side backup; the cluster's backup
+# key is gone with the managed authorized_keys (ssh-ca role).
 - name: Remove the backup dump script
  ansible.builtin.file:
    path: /usr/local/bin/netbird-backup-dump
    state: absent

- name: Revoke the cluster backup key
-  ansible.posix.authorized_key:
-    user: root
-    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeW/L9bHMTSa5/Qb0ClppCf4Z0hL39JwzI6tBmKd2FG netbird-backup@homelab-cluster"
-    state: absent
-
 - name: Wait for management container to be ready
  ansible.builtin.pause:
    seconds: 10

+# The host's mesh client must not manage DNS: containers here resolve through
+# the host stub, and the renner.uno nameserver group is unreachable from it.
+- name: Check for the host NetBird client
+  ansible.builtin.stat:
+    path: /usr/bin/netbird
+  register: _netbird_client
+
+- name: Read the host NetBird client config
+  ansible.builtin.command: netbird debug config
+  register: _netbird_client_config
+  check_mode: false
+  changed_when: false
+  when: _netbird_client.stat.exists
+
+# disable-dns is only applied on a fresh `up`, not to a connected client.
+- name: Reconnect the host NetBird client with DNS management disabled
+  ansible.builtin.shell: |
+    set -eu
+    netbird down
+    netbird up --disable-dns
+  when:
+    - _netbird_client.stat.exists
+    - not (_netbird_client_config.stdout | from_json).disableDns
+
 - name: Display deployment status
  ansible.builtin.debug:
    msg: |
@@ -61,6 +61,10 @@ services:
      - AUTH_AUDIENCE={{ netbird_auth_audience }}
      - AUTH_CLIENT_ID={{ netbird_auth_client_id }}
      - AUTH_AUTHORITY={{ netbird_auth_issuer }}
+      # The CSP allows AUTH_AUTHORITY only as a path (/application/o/netbird/);
+      # Authentik's token/userinfo endpoints sit outside it, so the browser
+      # would block the code exchange and every token refresh.
+      - NETBIRD_CSP={{ netbird_auth_issuer | urlsplit('scheme') }}://{{ netbird_auth_issuer | urlsplit('netloc') }}
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email
      - NETBIRD_TOKEN_SOURCE=idToken
@@ -1,20 +0,0 @@
---
-# Node Exporter defaults
-
-node_exporter_version: "1.8.2"
-node_exporter_port: 9100
-node_exporter_user: node-exporter
-node_exporter_group: node-exporter
-
-# Installation paths
-node_exporter_install_dir: /opt/node-exporter
-node_exporter_binary: "{{ node_exporter_install_dir }}/node_exporter"
-
-# Collectors to enable (defaults are usually sufficient)
-node_exporter_enabled_collectors:
-  - systemd
-  - processes
-  - timex
-
-# Collectors to disable
-node_exporter_disabled_collectors: []
@@ -1,62 +0,0 @@
-#!/bin/bash
-# Generate Prometheus metrics from chronyc tracking output
-# Runs as a cron job and outputs to textfile collector directory
-
-OUTPUT_FILE="${1:-/var/lib/node-exporter/chrony.prom}"
-
-# Get chrony tracking info
-tracking=$(chronyc tracking 2>/dev/null)
-
-if [ -z "$tracking" ]; then
-    echo "chrony_up 0" > "$OUTPUT_FILE.tmp"
-    mv "$OUTPUT_FILE.tmp" "$OUTPUT_FILE"
-    exit 0
-fi
-
-# Parse values
-stratum=$(echo "$tracking" | grep "^Stratum" | awk '{print $3}')
-system_time=$(echo "$tracking" | grep "^System time" | awk '{print $4}')
-root_delay=$(echo "$tracking" | grep "^Root delay" | awk '{print $4}')
-root_dispersion=$(echo "$tracking" | grep "^Root dispersion" | awk '{print $4}')
-last_offset=$(echo "$tracking" | grep "^Last offset" | awk '{print $4}')
-rms_offset=$(echo "$tracking" | grep "^RMS offset" | awk '{print $4}')
-frequency=$(echo "$tracking" | grep "^Frequency" | awk '{print $3}')
-ref_id=$(echo "$tracking" | grep "^Reference ID" | awk '{print $4}' | tr -d '()')
-
-# Handle negative offsets (remove leading + or keep -)
-system_time=$(echo "$system_time" | sed 's/^+//')
-last_offset=$(echo "$last_offset" | sed 's/^+//')
-rms_offset=$(echo "$rms_offset" | sed 's/^+//')
-
-# Output Prometheus metrics
-cat > "$OUTPUT_FILE.tmp" << EOF
-# HELP chrony_stratum Current stratum of the NTP server
-# TYPE chrony_stratum gauge
-chrony_stratum ${stratum:-0}
-# HELP chrony_system_time_offset_seconds System time offset from NTP time
-# TYPE chrony_system_time_offset_seconds gauge
-chrony_system_time_offset_seconds ${system_time:-0}
-# HELP chrony_root_delay_seconds Total round-trip delay to the primary reference clock
-# TYPE chrony_root_delay_seconds gauge
-chrony_root_delay_seconds ${root_delay:-0}
-# HELP chrony_root_dispersion_seconds Total dispersion to the primary reference clock
-# TYPE chrony_root_dispersion_seconds gauge
-chrony_root_dispersion_seconds ${root_dispersion:-0}
-# HELP chrony_last_offset_seconds Estimated offset of the last update
-# TYPE chrony_last_offset_seconds gauge
-chrony_last_offset_seconds ${last_offset:-0}
-# HELP chrony_rms_offset_seconds RMS offset
-# TYPE chrony_rms_offset_seconds gauge
-chrony_rms_offset_seconds ${rms_offset:-0}
-# HELP chrony_frequency_ppm Frequency offset in parts per million
-# TYPE chrony_frequency_ppm gauge
-chrony_frequency_ppm ${frequency:-0}
-# HELP chrony_up Whether chrony is running and synchronized
-# TYPE chrony_up gauge
-chrony_up 1
-# HELP chrony_reference_info Reference clock information
-# TYPE chrony_reference_info gauge
-chrony_reference_info{reference="${ref_id:-unknown}"} 1
-EOF
-
-mv "$OUTPUT_FILE.tmp" "$OUTPUT_FILE"
@@ -1,9 +0,0 @@
---
- name: Reload systemd
-  systemd:
-    daemon_reload: yes
-
- name: Restart node-exporter
-  systemd:
-    name: node-exporter
-    state: restarted
@@ -1,88 +0,0 @@
---
-# Install and configure Node Exporter
-
- name: Create node-exporter system group
-  group:
-    name: "{{ node_exporter_group }}"
-    system: yes
-    state: present
-
- name: Create node-exporter system user
-  user:
-    name: "{{ node_exporter_user }}"
-    group: "{{ node_exporter_group }}"
-    system: yes
-    shell: /usr/sbin/nologin
-    home: "{{ node_exporter_install_dir }}"
-    createhome: no
-
- name: Create installation directory
-  file:
-    path: "{{ node_exporter_install_dir }}"
-    state: directory
-    owner: "{{ node_exporter_user }}"
-    group: "{{ node_exporter_group }}"
-    mode: '0755'
-
- name: Check if node_exporter is already installed
-  stat:
-    path: "{{ node_exporter_binary }}"
-  register: node_exporter_installed
-
- name: Get installed version
-  command: "{{ node_exporter_binary }} --version"
-  register: installed_version
-  when: node_exporter_installed.stat.exists
-  changed_when: false
-  failed_when: false
-
- name: Download node_exporter
-  get_url:
-    url: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/node_exporter-{{ node_exporter_version }}.linux-amd64.tar.gz"
-    dest: /tmp/node_exporter.tar.gz
-    mode: '0644'
-  when: not node_exporter_installed.stat.exists or (installed_version.stdout is defined and node_exporter_version not in installed_version.stdout)
-
- name: Extract node_exporter
-  unarchive:
-    src: /tmp/node_exporter.tar.gz
-    dest: /tmp
-    remote_src: yes
-  when: not node_exporter_installed.stat.exists or (installed_version.stdout is defined and node_exporter_version not in installed_version.stdout)
-
- name: Install node_exporter binary
-  copy:
-    src: "/tmp/node_exporter-{{ node_exporter_version }}.linux-amd64/node_exporter"
-    dest: "{{ node_exporter_binary }}"
-    owner: "{{ node_exporter_user }}"
-    group: "{{ node_exporter_group }}"
-    mode: '0755'
-    remote_src: yes
-  when: not node_exporter_installed.stat.exists or (installed_version.stdout is defined and node_exporter_version not in installed_version.stdout)
-  notify: Restart node-exporter
-
- name: Create systemd service
-  template:
-    src: node_exporter.service.j2
-    dest: /etc/systemd/system/node-exporter.service
-    owner: root
-    group: root
-    mode: '0644'
-  notify:
-    - Reload systemd
-    - Restart node-exporter
-
- name: Enable and start node-exporter service
-  systemd:
-    name: node-exporter
-    enabled: yes
-    state: started
-    daemon_reload: yes
-
- name: Clean up downloaded files
-  file:
-    path: "{{ item }}"
-    state: absent
-  loop:
-    - /tmp/node_exporter.tar.gz
-    - "/tmp/node_exporter-{{ node_exporter_version }}.linux-amd64"
@@ -1,38 +0,0 @@
-[Unit]
-Description=Prometheus Node Exporter
-Documentation=https://github.com/prometheus/node_exporter
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User={{ node_exporter_user }}
-Group={{ node_exporter_group }}
-ExecStart={{ node_exporter_binary }} \
-  --web.listen-address=:{{ node_exporter_port }} \
-{% for collector in node_exporter_enabled_collectors %}
-  --collector.{{ collector }} \
-{% endfor %}
-{% for collector in node_exporter_disabled_collectors %}
-  --no-collector.{{ collector }} \
-{% endfor %}
-{% if node_exporter_textfile_dir is defined %}
-  --collector.textfile \
-  --collector.textfile.directory={{ node_exporter_textfile_dir }} \
-{% endif %}
-  --collector.filesystem.mount-points-exclude='^/(sys|proc|dev|host|etc)($$|/)'
-Restart=on-failure
-RestartSec=10s
-
-# Security hardening
-NoNewPrivileges=yes
-ProtectSystem=strict
-ProtectHome=yes
-PrivateTmp=yes
-ReadOnlyPaths=/
-{% if node_exporter_textfile_dir is defined %}
-ReadWritePaths={{ node_exporter_textfile_dir }}
-{% endif %}
-
-[Install]
-WantedBy=multi-user.target
@@ -0,0 +1,142 @@
+---
+- name: Fail on unsupported distribution
+  ansible.builtin.fail:
+    msg: >-
+      os-update supports Debian and Archlinux only;
+      this host reports os_family={{ ansible_facts['os_family'] }}
+  when: ansible_facts['os_family'] not in ['Debian', 'Archlinux']
+
+# --- Baseline: what is healthy before the upgrade must be healthy after ---
+- name: Record failed units before upgrade
+  ansible.builtin.command: systemctl list-units --state=failed --plain --no-legend --no-pager
+  register: os_update_failed_before
+  changed_when: false
+  check_mode: false
+
+- name: Check for docker
+  ansible.builtin.stat:
+    path: /usr/bin/docker
+  register: os_update_docker
+
+- name: Record running containers before upgrade
+  ansible.builtin.command: docker ps --format "{{ '{{' }}.Names{{ '}}' }}"
+  register: os_update_containers_before
+  changed_when: false
+  check_mode: false
+  when: os_update_docker.stat.exists
+
+- name: Assert at least 1 GiB free on /
+  ansible.builtin.assert:
+    that: >-
+      (ansible_facts['mounts'] | selectattr('mount', 'equalto', '/') | first)['size_available']
+      >= 1073741824
+    fail_msg: "Less than 1 GiB free on / -- free space before upgrading"
+
+# --- Arch Linux ---
+- name: Upgrade keyring first (Arch)
+  community.general.pacman:
+    name: archlinux-keyring
+    state: latest
+    update_cache: true
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Upgrade all packages (Arch)
+  community.general.pacman:
+    upgrade: true
+  register: os_update_pacman
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+# --- Debian/Ubuntu ---
+- name: Upgrade all packages (Debian)
+  ansible.builtin.apt:
+    update_cache: true
+    upgrade: full
+    autoremove: true
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+  when: ansible_facts['os_family'] == 'Debian'
+
+- name: Check reboot-required flag (Debian)
+  ansible.builtin.stat:
+    path: /var/run/reboot-required
+  register: os_update_reboot_flag
+  when: ansible_facts['os_family'] == 'Debian'
+
+# --- Reboot ---
+- name: Read running kernel before reboot (Arch)
+  ansible.builtin.command: uname -r
+  register: os_update_kernel_before
+  changed_when: false
+  check_mode: false
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+# Missing modules dir: a newer kernel is installed but not booted, including
+# from an earlier interrupted run where pacman now reports no change.
+- name: Check running kernel is still installed (Arch)
+  ansible.builtin.stat:
+    path: "/usr/lib/modules/{{ os_update_kernel_before.stdout }}/vmlinuz"
+  register: os_update_kernel_present
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Reboot
+  ansible.builtin.reboot:
+    msg: "Rebooting after package upgrade"
+    reboot_timeout: 900
+    post_reboot_delay: 30
+  when: >-
+    (ansible_facts['os_family'] == 'Archlinux' and
+      (os_update_pacman is changed or not os_update_kernel_present.stat.exists)) or
+    (ansible_facts['os_family'] == 'Debian' and os_update_reboot_flag.stat.exists)
+
+# --- Verify ---
+- name: Read running kernel
+  ansible.builtin.command: uname -r
+  register: os_update_kernel
+  changed_when: false
+  check_mode: false
+
+# Arch keeps only the installed kernel's modules; the directory existing means
+# the host booted the kernel pacman installed.
+- name: Assert running kernel is the installed one (Arch)
+  ansible.builtin.stat:
+    path: "/usr/lib/modules/{{ os_update_kernel.stdout }}/vmlinuz"
+  register: os_update_kernel_installed
+  failed_when: not os_update_kernel_installed.stat.exists
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Assert no reboot pending (Debian)
+  ansible.builtin.stat:
+    path: /var/run/reboot-required
+  register: os_update_reboot_flag_after
+  failed_when: os_update_reboot_flag_after.stat.exists
+  when: ansible_facts['os_family'] == 'Debian'
+
+- name: Wait for previously running containers
+  ansible.builtin.command: docker ps --format "{{ '{{' }}.Names{{ '}}' }}"
+  register: os_update_containers_after
+  changed_when: false
+  check_mode: false
+  until: >-
+    os_update_containers_before.stdout_lines
+    | difference(os_update_containers_after.stdout_lines)
+    | length == 0
+  retries: 20
+  delay: 15
+  when: os_update_docker.stat.exists
+
+- name: Wait for no new failed units
+  ansible.builtin.command: systemctl list-units --state=failed --plain --no-legend --no-pager
+  register: os_update_failed_after
+  changed_when: false
+  check_mode: false
+  until: >-
+    os_update_failed_after.stdout_lines
+    | map('split') | map('first')
+    | difference(os_update_failed_before.stdout_lines | map('split') | map('first'))
+    | length == 0
+  retries: 10
+  delay: 15
+
+- name: Report kernel
+  ansible.builtin.debug:
+    msg: "{{ inventory_hostname }} runs {{ os_update_kernel.stdout }}"
@@ -0,0 +1,18 @@
+---
+# SSH user CA (OpenBao ssh-client-signer). Hosts trust certificates signed by
+# it; the public key is fetched from OpenBao on the controller at run time.
+ssh_ca_public_key_url: "https://openbao.renner.uno/v1/ssh-client-signer/public_key"
+
+# Owner certificates (role owner) carry this principal. It is accepted for
+# whichever admin login the distro has; users that do not exist are skipped.
+ssh_ca_owner_principal: k.renner
+ssh_ca_owner_users:
+  - root
+  - ladmin
+
+# Claude's own account. Certificates (role claude, 1h) carry the principal.
+ssh_ca_claude_user: claude-bot
+ssh_ca_claude_principal: claude-bot
+
+# Units claude-bot may restart/reload via sudo on this host, e.g. [netbird].
+ssh_ca_claude_sudo_units: []
@@ -0,0 +1,2 @@
+# Public keys whose certificates sshd must reject (one per line, OpenSSH format).
+# Revoking a key also revokes every certificate issued for it.
@@ -0,0 +1,23 @@
+---
+# Replaces the admin logins' authorized_keys with ssh_admin_authorized_keys
+# (break-glass + CI). Everything else logs in with a CA certificate.
+- name: Look up the admin logins
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ item }}"
+    fail_key: false
+  loop: "{{ ssh_ca_owner_users }}"
+  register: ssh_ca_admin_lookup
+
+- name: Set the admin logins' authorized_keys to the managed list
+  ansible.posix.authorized_key:
+    user: "{{ item.item }}"
+    key: |
+      {% for k in ssh_admin_authorized_keys %}
+      {{ (k.options ~ ' ') if (k.options | default('')) else '' }}{{ k.key }}
+      {% endfor %}
+    exclusive: true
+  loop: "{{ ssh_ca_admin_lookup.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: (item.ansible_facts.getent_passwd | default({})).get(item.item) is not none
@@ -0,0 +1,167 @@
+---
+- name: Fetch the SSH CA public key from OpenBao
+  ansible.builtin.uri:
+    url: "{{ ssh_ca_public_key_url }}"
+    return_content: true
+  delegate_to: localhost
+  become: false
+  run_once: true
+  register: ssh_ca_key
+  check_mode: false
+
+- name: Check the fetched CA key is an SSH public key
+  ansible.builtin.assert:
+    that:
+      - ssh_ca_key.content is match('^ssh-ed25519 AAAA')
+    fail_msg: "Unexpected CA key from {{ ssh_ca_public_key_url }}"
+  run_once: true
+
+- name: Install the trusted user CA key
+  ansible.builtin.copy:
+    content: "{{ ssh_ca_key.content | trim }}\n"
+    dest: /etc/ssh/trusted_user_ca_keys
+    owner: root
+    group: root
+    mode: "0644"
+
+# sshd refuses all public key logins when RevokedKeys is set but unreadable,
+# so the file is always deployed, even when empty.
+- name: Install the revoked keys list
+  ansible.builtin.copy:
+    src: revoked_keys
+    dest: /etc/ssh/revoked_keys
+    owner: root
+    group: root
+    mode: "0644"
+
+# systemd-journal: read every journal without sudo (see sudoers-claude.j2).
+- name: Create the Claude account
+  ansible.builtin.user:
+    name: "{{ ssh_ca_claude_user }}"
+    shell: /bin/bash
+    create_home: true
+    password: "!"
+    groups: systemd-journal
+    append: true
+
+- name: Look up the owner admin logins
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ item }}"
+    fail_key: false
+  loop: "{{ ssh_ca_owner_users }}"
+  register: ssh_ca_owner_lookup
+
+- name: Create the principals directory
+  ansible.builtin.file:
+    path: /etc/ssh/auth_principals
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Accept the owner principal for the existing admin logins
+  ansible.builtin.copy:
+    content: "{{ ssh_ca_owner_principal }}\n"
+    dest: "/etc/ssh/auth_principals/{{ item.item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ ssh_ca_owner_lookup.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: (item.ansible_facts.getent_passwd | default({})).get(item.item) is not none
+
+- name: Accept the Claude principal for the Claude account
+  ansible.builtin.copy:
+    content: "{{ ssh_ca_claude_principal }}\n"
+    dest: "/etc/ssh/auth_principals/{{ ssh_ca_claude_user }}"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Install the Claude sudo rules
+  ansible.builtin.template:
+    src: sudoers-claude.j2
+    dest: "/etc/sudoers.d/{{ ssh_ca_claude_user }}"
+    owner: root
+    group: root
+    mode: "0440"
+    validate: visudo -cf %s
+
+# A broken drop-in only bites on the next sshd restart, so it is tested here
+# and removed again if the full config does not parse.
+- name: Configure sshd for the user CA
+  block:
+    - name: Install the sshd drop-in
+      ansible.builtin.template:
+        src: ssh-ca.conf.j2
+        dest: /etc/ssh/sshd_config.d/50-ssh-ca.conf
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Test the full sshd config
+      ansible.builtin.command: sshd -t
+      changed_when: false
+  rescue:
+    - name: Remove the drop-in that broke sshd -t
+      ansible.builtin.file:
+        path: /etc/ssh/sshd_config.d/50-ssh-ca.conf
+        state: absent
+
+    - name: Fail the host
+      ansible.builtin.fail:
+        msg: "sshd -t failed with the SSH CA drop-in; it was removed again"
+
+- name: Read the effective sshd settings
+  ansible.builtin.command: sshd -T
+  changed_when: false
+  register: ssh_ca_effective
+
+# Keyword case in sshd -T output differs between OpenSSH versions (mixed case
+# on 10.6), so the lines are compared lowercased. Not in check mode: sshd -T
+# reads the files on disk, which check mode has not written.
+- name: Check sshd uses the CA, principals and revocation list
+  when: not ansible_check_mode
+  vars:
+    ssh_ca_effective_lines: "{{ ssh_ca_effective.stdout_lines | map('lower') | list }}"
+  ansible.builtin.assert:
+    that:
+      - "'trustedusercakeys /etc/ssh/trusted_user_ca_keys' in ssh_ca_effective_lines"
+      - "'authorizedprincipalsfile /etc/ssh/auth_principals/%u' in ssh_ca_effective_lines"
+      - "'revokedkeys /etc/ssh/revoked_keys' in ssh_ca_effective_lines"
+      - "'passwordauthentication no' in ssh_ca_effective_lines"
+      - "'kbdinteractiveauthentication no' in ssh_ca_effective_lines"
+    fail_msg: "sshd -T does not show the SSH CA settings; another config line takes precedence"
+
+# The unit is sshd.service on Arch and RedHat, ssh.service on Debian/Ubuntu,
+# where sshd.service is an alias that resolves to it. sshd -T only parses the
+# files, so the running daemon is reloaded on every run; a reload keeps open
+# sessions. None runs when sshd is socket activated and stopped, or per
+# connection (ssh-mesh-only role); the next start reads the config.
+# systemctl directly: service_facts took 3-12 s per host.
+- name: Find the running sshd unit
+  ansible.builtin.command: systemctl list-units --state=running --plain --no-legend --type=service sshd.service ssh.service
+  changed_when: false
+  register: ssh_ca_sshd_running
+  check_mode: false
+
+- name: Reload the running sshd unit
+  vars:
+    ssh_ca_sshd_units: "{{ ssh_ca_sshd_running.stdout_lines | map('split') | map('first') | unique | list }}"
+  block:
+    - name: Check at most one sshd unit is running
+      ansible.builtin.assert:
+        that:
+          - ssh_ca_sshd_units | length <= 1
+        fail_msg: "Expected at most one running sshd.service or ssh.service, found {{ ssh_ca_sshd_units }}"
+
+    - name: Reload sshd so the running daemon uses the CA config
+      ansible.builtin.systemd:
+        name: "{{ ssh_ca_sshd_units | first }}"
+        state: reloaded
+      when: ssh_ca_sshd_units | length == 1
+
+- name: Report the admin logins' authorized keys
+  ansible.builtin.include_tasks: report.yml
@@ -0,0 +1,27 @@
+---
+# Read-only: what the admin logins accept besides certificates. Hosts in
+# [ssh_keys_managed] have this reduced to ssh_admin_authorized_keys.
+- name: Find the admin logins' authorized_keys
+  ansible.builtin.stat:
+    path: "{{ item.ansible_facts.getent_passwd[item.item][4] }}/.ssh/authorized_keys"
+  loop: "{{ ssh_ca_owner_lookup.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: (item.ansible_facts.getent_passwd | default({})).get(item.item) is not none
+  register: ssh_ca_keyfiles
+
+- name: Fingerprint the admin logins' authorized keys
+  ansible.builtin.command: ssh-keygen -lf {{ item.stat.path }}
+  loop: "{{ ssh_ca_keyfiles.results | selectattr('stat', 'defined') | selectattr('stat.exists') | list }}"
+  loop_control:
+    label: "{{ item.stat.path }}"
+  changed_when: false
+  register: ssh_ca_fingerprints
+  check_mode: false
+
+- name: Report the admin logins' authorized keys
+  ansible.builtin.debug:
+    msg: "{{ item.item.stat.path }}: {{ item.stdout_lines }}"
+  loop: "{{ ssh_ca_fingerprints.results }}"
+  loop_control:
+    label: "{{ item.item.stat.path }}"
@@ -0,0 +1,6 @@
+# {{ ansible_managed }}
+TrustedUserCAKeys /etc/ssh/trusted_user_ca_keys
+AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u
+RevokedKeys /etc/ssh/revoked_keys
+PasswordAuthentication no
+KbdInteractiveAuthentication no
@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+# Logs and unit status come from the systemd-journal group, not sudo:
+# journalctl as root would also allow --vacuum-*/--rotate.
+# Commands are listed for both the Arch and the Debian/Ubuntu path.
+# nft only with fixed arguments: it joins argv into one command line, so a
+# wildcard would admit "; flush ruleset". No docker start: -a/-i attach to a
+# container's stdin; docker restart also starts stopped containers.
+{{ ssh_ca_claude_user }} ALL=(root) NOPASSWD:NOEXEC: /usr/bin/ss -tulpn, /usr/sbin/sshd -T, /usr/bin/nft list ruleset, /usr/sbin/nft list ruleset, /usr/bin/netbird status, /usr/bin/netbird status *, /usr/local/bin/netbird status, /usr/local/bin/netbird status *
+{{ ssh_ca_claude_user }} ALL=(root) NOPASSWD:NOEXEC: /usr/bin/docker ps, /usr/bin/docker ps *, /usr/bin/docker logs *, /usr/bin/docker stats --no-stream, /usr/bin/docker restart *
+{% for unit in ssh_ca_claude_sudo_units %}
+{{ ssh_ca_claude_user }} ALL=(root) NOPASSWD:NOEXEC: /usr/bin/systemctl restart {{ unit }}, /usr/bin/systemctl reload {{ unit }}
+{% endfor %}
@@ -0,0 +1,9 @@
+---
+# The only interface sshd accepts connections on.
+ssh_mesh_interface: wt0
+
+# Minutes until a switchover reverts to the distro listener, unless a new
+# login through the mesh-only listener confirms it first.
+ssh_mesh_revert_minutes: 5
+
+ssh_mesh_udev_rule: /etc/udev/rules.d/90-ssh-mesh-only.rules
@@ -0,0 +1,114 @@
+---
+- name: Load the distro's sshd unit names
+  ansible.builtin.include_vars: "{{ ansible_facts['os_family'] }}.yml"
+
+- name: Look for the mesh interface
+  ansible.builtin.stat:
+    path: "/sys/class/net/{{ ssh_mesh_interface }}"
+  register: ssh_mesh_iface
+
+- name: Check the mesh interface exists
+  ansible.builtin.assert:
+    that:
+      - ssh_mesh_iface.stat.exists
+    fail_msg: "No {{ ssh_mesh_interface }}: sshd would be unreachable. Install the NetBird client first."
+
+- name: Create the socket unit directory
+  ansible.builtin.file:
+    path: "{{ ssh_mesh_socket_file | dirname }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install the mesh-only socket
+  ansible.builtin.template:
+    src: "{{ ssh_mesh_socket_template }}"
+    dest: "{{ ssh_mesh_socket_file }}"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Bind the sshd service to the socket
+  when: ssh_mesh_service_dropin | length > 0
+  block:
+    - name: Create the service drop-in directory
+      ansible.builtin.file:
+        path: "{{ ssh_mesh_service_dropin | dirname }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Install the service drop-in
+      ansible.builtin.template:
+        src: ssh.service-dropin.conf.j2
+        dest: "{{ ssh_mesh_service_dropin }}"
+        owner: root
+        group: root
+        mode: "0644"
+
+- name: Install the udev rule that starts the socket with the interface
+  ansible.builtin.template:
+    src: udev.rules.j2
+    dest: "{{ ssh_mesh_udev_rule }}"
+    owner: root
+    group: root
+    mode: "0644"
+  register: ssh_mesh_udev
+
+- name: Reload the udev rules
+  ansible.builtin.command: udevadm control --reload
+  when: ssh_mesh_udev is changed
+  changed_when: true
+
+- name: Install the switch and revert scripts
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/usr/local/sbin/{{ item }}"
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - ssh-mesh-switch
+    - ssh-mesh-revert
+
+- name: Reload systemd units
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Read the sshd listeners
+  ansible.builtin.command: ss -Htln 'sport = :22'
+  changed_when: false
+  register: ssh_mesh_listeners
+  check_mode: false
+
+# Each run that finds a listener outside the interface switches over. An
+# include, because meta reset_connection ignores when: and a reconnect costs a
+# YubiKey PIN from a workstation.
+- name: Switch sshd to the mesh-only socket
+  ansible.builtin.include_tasks: switch.yml
+  when: >-
+    ssh_mesh_listeners.stdout_lines | length == 0 or
+    ssh_mesh_listeners.stdout_lines | reject('search', '%' ~ ssh_mesh_interface ~ ':22\s') | list | length > 0
+
+- name: Check sshd listens on the mesh interface only
+  ansible.builtin.assert:
+    that:
+      - ssh_mesh_listeners.stdout_lines | length > 0
+      - ssh_mesh_listeners.stdout_lines | reject('search', '%' ~ ssh_mesh_interface ~ ':22\s') | list | length == 0
+    fail_msg: "Listeners outside {{ ssh_mesh_interface }}: {{ ssh_mesh_listeners.stdout_lines }}"
+
+- name: Cancel the revert timer
+  ansible.builtin.command: systemctl stop ssh-mesh-revert.timer
+  changed_when: false
+  failed_when: false
+
+- name: Check the public name refuses SSH
+  ansible.builtin.wait_for:
+    host: "{{ inventory_hostname }}"
+    port: 22
+    state: stopped
+    timeout: 15
+  delegate_to: localhost
+  become: false
@@ -0,0 +1,27 @@
+---
+# The revert timer runs in its own unit, so a switch that locks the play out is
+# undone after ssh_mesh_revert_minutes. main.yml cancels it after checking the
+# listeners read through the new one.
+- name: Clear a revert timer left by an earlier run
+  ansible.builtin.command: systemctl stop ssh-mesh-revert.timer ssh-mesh-revert.service
+  changed_when: false
+  failed_when: false
+
+- name: Arm the revert timer
+  ansible.builtin.command: >-
+    systemd-run --unit=ssh-mesh-revert --collect
+    --on-active={{ ssh_mesh_revert_minutes }}min
+    /usr/local/sbin/ssh-mesh-revert
+  changed_when: true
+
+- name: Switch the listener
+  ansible.builtin.command: systemd-run --unit=ssh-mesh-switch --collect --wait /usr/local/sbin/ssh-mesh-switch
+  changed_when: true
+
+- name: Reconnect through the new listener
+  ansible.builtin.meta: reset_connection
+
+- name: Read the sshd listeners after reconnecting
+  ansible.builtin.command: ss -Htln 'sport = :22'
+  changed_when: false
+  register: ssh_mesh_listeners
@@ -0,0 +1,9 @@
+#!/bin/sh
+# {{ ansible_managed }}
+# Restores the distro listener on all addresses. Armed as a timer by every
+# switchover; the play cancels it after a login through the new listener.
+systemctl stop {{ ssh_mesh_service }} {{ ssh_mesh_socket }}
+rm -f {{ ssh_mesh_udev_rule }} {{ ssh_mesh_socket_file }}{{ (' ' ~ ssh_mesh_service_dropin) if ssh_mesh_service_dropin else '' }}
+udevadm control --reload
+systemctl daemon-reload
+systemctl enable --now {{ ssh_mesh_distro_listener }}
@@ -0,0 +1,11 @@
+#!/bin/sh
+# {{ ansible_managed }}
+# Replaces the distro listener with the {{ ssh_mesh_interface }}-only socket.
+# Open sessions survive: they run in logind scopes and the sshd units use
+# KillMode=process. Any failure restores the distro listener at once.
+set -eu
+trap '/usr/local/sbin/ssh-mesh-revert' EXIT
+systemctl disable {{ ssh_mesh_disable_units }}
+systemctl stop {{ ssh_mesh_service }} {{ ssh_mesh_socket }}
+systemctl start {{ ssh_mesh_socket }}
+trap - EXIT
@@ -0,0 +1,7 @@
+# {{ ansible_managed }}
+# sshd holds the socket's listener; it stops with the socket, so it never keeps
+# a listener on a removed {{ ssh_mesh_interface }}. Replaces the Requires= that
+# enabling {{ ssh_mesh_socket }} would add.
+[Unit]
+BindsTo={{ ssh_mesh_socket }}
+After={{ ssh_mesh_socket }}
@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+# Listen on {{ ssh_mesh_interface }} only. The unit is disabled; the udev rule
+# starts it whenever {{ ssh_mesh_interface }} appears.
+[Socket]
+ListenStream=
+ListenStream=22
+BindToDevice={{ ssh_mesh_interface }}
+BindIPv6Only=both
@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+# Started by the udev rule whenever {{ ssh_mesh_interface }} appears; BindToDevice
+# stops it when the interface goes away. No [Install]: waiting for the device
+# from sockets.target would hold up boot until NetBird is up.
+[Unit]
+Description=OpenSSH on {{ ssh_mesh_interface }} only
+
+[Socket]
+ListenStream=22
+BindToDevice={{ ssh_mesh_interface }}
+BindIPv6Only=both
+Accept=yes
@@ -0,0 +1,3 @@
+# {{ ansible_managed }}
+# NetBird deletes and recreates {{ ssh_mesh_interface }} on every engine restart.
+SUBSYSTEM=="net", KERNEL=="{{ ssh_mesh_interface }}", ENV{SYSTEMD_WANTS}+="{{ ssh_mesh_socket }}"
@@ -0,0 +1,10 @@
+---
+# No packaged socket; sshd.socket (Accept=yes) pairs with the packaged
+# per-connection sshd@.service, since sshd -D cannot take a listening fd.
+ssh_mesh_socket: sshd.socket
+ssh_mesh_service: sshd.service
+ssh_mesh_distro_listener: sshd.service
+ssh_mesh_disable_units: sshd.service
+ssh_mesh_socket_file: /etc/systemd/system/sshd.socket
+ssh_mesh_socket_template: sshd.socket.j2
+ssh_mesh_service_dropin: ""
@@ -0,0 +1,10 @@
+---
+# Ubuntu's ssh.socket (Accept=no) hands its listener to ssh.service. The
+# drop-in is named like sshd-socket-generator's output so it masks it.
+ssh_mesh_socket: ssh.socket
+ssh_mesh_service: ssh.service
+ssh_mesh_distro_listener: ssh.socket
+ssh_mesh_disable_units: ssh.service ssh.socket
+ssh_mesh_socket_file: /etc/systemd/system/ssh.socket.d/addresses.conf
+ssh_mesh_socket_template: ssh.socket-addresses.conf.j2
+ssh_mesh_service_dropin: /etc/systemd/system/ssh.service.d/ssh-mesh-only.conf
@@ -1,11 +1,21 @@
 ---
 uptime_kuma_version: "2.5.6"
 uptime_kuma_host: kuma.renner.uno
-# Not routed yet; reserved for the public status page.
-uptime_kuma_status_host: uptime.renner.uno
+uptime_kuma_base_url: "https://{{ uptime_kuma_host }}"
 uptime_kuma_dir: /opt/uptime-kuma
 uptime_kuma_traefik_network: netbird_netbird

+uptime_kuma_smtp_from: uptime@renner.uno
+# Alertmanager email receiver in kubernetes/apps/monitoring/helmrelease-prometheus.yaml.
+uptime_kuma_smtp_to: admin@renner.uno
+
 uptime_kuma_openbao_url: https://openbao.renner.uno
 uptime_kuma_openbao_mount: homelab
 uptime_kuma_openbao_path: infrastructure/uptime-kuma
+uptime_kuma_openbao_smtp_path: infrastructure/uptime-kuma/smtp
+uptime_kuma_openbao_metrics_path: infrastructure/uptime-kuma-metrics
+# Token with policy uptime-kuma-vps, looked up like the bao CLI does:
+# VAULT_TOKEN, else the token helper file written by `bao login -method=oidc`.
+uptime_kuma_openbao_token: >-
+  {{ lookup('ansible.builtin.env', 'VAULT_TOKEN')
+     or (lookup('ansible.builtin.file', '~/.vault-token', errors='ignore') | default('', true)) }}
@@ -1,46 +1,179 @@
-// Creates the Uptime Kuma admin user on first start; exits 0 if already set up.
-// Credentials come from KUMA_SETUP_USERNAME / KUMA_SETUP_PASSWORD only.
+// Bootstraps Uptime Kuma: admin user, general settings, SMTP notification,
+// and (when KUMA_METRICS_ROTATE=true) a fresh Prometheus API key written to KUMA_METRICS_KEY_FILE.
+// All input comes from environment variables; secrets are never printed.
+// Output lines: "admin user created" / "already set up", then "changed: <step>" or "ok: <step>".
+const fs = require("fs");
 const { io } = require("socket.io-client");

-const username = process.env.KUMA_SETUP_USERNAME;
-const password = process.env.KUMA_SETUP_PASSWORD;
-if (!username || !password) {
-    console.error("KUMA_SETUP_USERNAME and KUMA_SETUP_PASSWORD must be set");
+const KUMA_URL = "http://127.0.0.1:3001";
+const EMIT_TIMEOUT_MS = 30000;
+const TOTAL_TIMEOUT_MS = 180000;
+// Defaults the Kuma settings page applies to unset keys before saving (src/pages/Settings.vue).
+const SETTINGS_DEFAULTS = {
+    checkUpdate: true,
+    searchEngineIndex: false,
+    entryPage: "dashboard",
+    nscd: true,
+    keepDataPeriodDays: 180,
+    tlsExpiryNotifyDays: [7, 14, 21],
+    domainExpiryNotifyDays: [7, 14, 21],
+    trustProxy: false,
+};
+
+const REQUIRED = [
+    "KUMA_SETUP_USERNAME",
+    "KUMA_SETUP_PASSWORD",
+    "KUMA_BASE_URL",
+    "KUMA_SMTP_HOST",
+    "KUMA_SMTP_PORT",
+    "KUMA_SMTP_USERNAME",
+    "KUMA_SMTP_PASSWORD",
+    "KUMA_SMTP_FROM",
+    "KUMA_SMTP_TO",
+];
+const missing = REQUIRED.filter((name) => !process.env[name]);
+const rotateMetricsKey = process.env.KUMA_METRICS_ROTATE === "true";
+if (rotateMetricsKey && !process.env.KUMA_METRICS_KEY_FILE) {
+    missing.push("KUMA_METRICS_KEY_FILE");
+}
+if (missing.length > 0) {
+    console.error(`missing environment variables: ${missing.join(", ")}`);
    process.exit(2);
 }
+const env = process.env;

-const socket = io("http://127.0.0.1:3001", { transports: ["websocket"], reconnection: false });
-const timer = setTimeout(() => {
-    console.error("timeout: no response from Uptime Kuma within 30s");
-    process.exit(1);
-}, 30000);
+const socket = io(KUMA_URL, { transports: ["websocket"], reconnection: false });
+const lists = {};
+const LIST_EVENTS = ["notificationList", "apiKeyList"];
+for (const event of LIST_EVENTS) {
+    socket.on(event, (data) => {
+        lists[event] = data;
+    });
+}

 let finished = false;
 function done(code, msg) {
    if (finished) return;
    finished = true;
-    clearTimeout(timer);
-    (code === 0 ? console.log : console.error)(msg);
+    clearTimeout(watchdog);
+    if (msg) (code === 0 ? console.log : console.error)(msg);
    socket.close();
    process.exit(code);
 }

+const watchdog = setTimeout(() => done(1, `timeout: bootstrap did not finish within ${TOTAL_TIMEOUT_MS / 1000}s`), TOTAL_TIMEOUT_MS);
 socket.on("connect_error", (err) => done(1, `connect_error: ${err.message}`));
-socket.on("disconnect", (reason) => done(1, `disconnected before setup finished: ${reason}`));
+socket.on("disconnect", (reason) => done(1, `disconnected before bootstrap finished: ${reason}`));

-// Kuma registers socket handlers only after emitting info.
-socket.once("info", () => {
-    socket.emit("needSetup", (needSetup) => {
-        if (!needSetup) {
-            done(0, "already set up");
-            return;
-        }
-        socket.emit("setup", username, password, (res) => {
-            if (res && res.ok) {
-                done(0, "admin user created");
-            } else {
-                done(1, `setup failed: ${res && res.msg ? res.msg : JSON.stringify(res)}`);
-            }
+function call(event, ...args) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error(`timeout waiting for ${event}`)), EMIT_TIMEOUT_MS);
+        socket.emit(event, ...args, (res) => {
+            clearTimeout(timer);
+            resolve(res);
        });
    });
-});
+}
+
+async function callOk(event, ...args) {
+    const res = await call(event, ...args);
+    if (!res || !res.ok) {
+        throw new Error(`${event} failed: ${res && res.msg ? res.msg : JSON.stringify(res)}`);
+    }
+    return res;
+}
+
+function report(step, changed) {
+    console.log(`${changed ? "changed" : "ok"}: ${step}`);
+}
+
+// Kuma registers socket handlers only after emitting info.
+function waitForInfo() {
+    return new Promise((resolve) => socket.once("info", resolve));
+}
+
+async function setupAdmin() {
+    const needSetup = await call("needSetup");
+    if (!needSetup) {
+        console.log("already set up");
+        return;
+    }
+    await callOk("setup", env.KUMA_SETUP_USERNAME, env.KUMA_SETUP_PASSWORD);
+    console.log("admin user created");
+}
+
+async function login() {
+    await callOk("login", { username: env.KUMA_SETUP_USERNAME, password: env.KUMA_SETUP_PASSWORD, token: "" });
+    // afterLogin sends the lists before the login ack but swallows send failures.
+    for (const event of LIST_EVENTS) {
+        if (lists[event] === undefined) {
+            throw new Error(`${event} not received after login`);
+        }
+    }
+}
+
+async function ensureSettings() {
+    const { data } = await callOk("getSettings");
+    if (data.trustProxy === true && data.primaryBaseURL === env.KUMA_BASE_URL) {
+        report("settings", false);
+        return;
+    }
+    const updated = { ...SETTINGS_DEFAULTS, ...data, trustProxy: true, primaryBaseURL: env.KUMA_BASE_URL };
+    await callOk("setSettings", updated, "");
+    report("settings", true);
+}
+
+async function ensureNotification() {
+    const port = Number(env.KUMA_SMTP_PORT);
+    const desired = {
+        name: "email",
+        type: "smtp",
+        isDefault: true,
+        smtpHost: env.KUMA_SMTP_HOST,
+        smtpPort: port,
+        // 465 is implicit TLS; any other port uses STARTTLS.
+        smtpSecure: port === 465,
+        smtpIgnoreSTARTTLS: false,
+        smtpUsername: env.KUMA_SMTP_USERNAME,
+        smtpPassword: env.KUMA_SMTP_PASSWORD,
+        smtpFrom: env.KUMA_SMTP_FROM,
+        smtpTo: env.KUMA_SMTP_TO,
+    };
+    const existing = (lists.notificationList || []).filter((n) => n.name === desired.name).sort((a, b) => a.id - b.id)[0];
+    const current = existing ? JSON.parse(existing.config || "{}") : {};
+    const upToDate =
+        existing && existing.isDefault === true && Object.keys(desired).every((key) => current[key] === desired[key]);
+    if (upToDate) {
+        report("notification", false);
+        return;
+    }
+    await callOk("addNotification", { ...current, ...desired, applyExisting: true }, existing ? existing.id : null);
+    report("notification", true);
+}
+
+async function rotateMetricsApiKey() {
+    if (!rotateMetricsKey) {
+        report("metrics api key", false);
+        return;
+    }
+    for (const key of (lists.apiKeyList || []).filter((k) => k.name === "prometheus")) {
+        await callOk("deleteAPIKey", key.id);
+    }
+    const res = await callOk("addAPIKey", { name: "prometheus", expires: null, active: 1 });
+    fs.writeFileSync(env.KUMA_METRICS_KEY_FILE, res.key, { mode: 0o600 });
+    report("metrics api key", true);
+}
+
+async function main() {
+    await waitForInfo();
+    await setupAdmin();
+    await login();
+    await ensureSettings();
+    await ensureNotification();
+    await rotateMetricsApiKey();
+}
+
+main().then(
+    () => done(0),
+    (err) => done(1, err.message)
+);
--- a/Show More
+++ b/Show More