fix(wordpress): move to PHP 8.5.12 for PHP2Shell

CVE-2026-109618 and CVE-2026-109619 (BSI BITS-H 2026-297981-1132) allow unauthenticated RCE on every PHP before 8.5.12/8.4.27/8.3.36/8.2.35; mod_php is the highest-risk variant. The running pod reports PHP 8.3.35 and www.renner.uno serves / to the internet without the Authentik gate. Switch to the php8.5-apache variant of the same WordPress release, pinned to the index digest rebuilt on 2026-10-22 after the PHP fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'chore: follow homelab to konairius/homelab (merge inside Cut-over 1 only)' (#1372 ) from claude/homelab-konairius into master
2026-10-22 11:57:02 +02:00 · 2026-10-19 08:52:21 +00:00 · 2026-10-19 08:50:17 +00:00 · 2026-10-19 10:43:23 +02:00 · 2026-10-19 10:42:20 +02:00 · 2026-10-19 08:31:56 +00:00
98 changed files with 2438 additions and 215 deletions
@@ -30,9 +30,9 @@
 # Triggering:
 #   - cron   : a cron NAMED exactly "alert-monitor" (name filter, same
 #              mechanism as update-audit.yml):
-#                woodpecker repo cron add --repo k.renner/homelab \
+#                woodpecker repo cron add --repo konairius/homelab \
 #                  --name alert-monitor --branch master --schedule '*/15 * * * *'
-#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> alert-monitor
+#   - deploy : woodpecker-cli pipeline deploy konairius/homelab <n> alert-monitor
 #              where <n> is an existing pipeline to promote.
 when:
  - event: cron
@@ -101,7 +101,7 @@ steps:
        bash scripts/ci/make-diag-kubeconfig.sh

  - name: alert-triage-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -130,7 +130,7 @@ steps:
             | select([.receivers[]?.name] | (length == 0) or any(. != "null"))]' \
          .ci-alert-monitor/alerts-raw.json > .ci-alert-monitor/alerts-active.json
        echo "Active alerts (after heartbeat filter): $$(jq length .ci-alert-monitor/alerts-active.json)"
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
+        API="https://gitea.renner.uno/api/v1/repos/konairius/homelab"
        curl -sfL "$$API/issues?state=open&type=issues&limit=100" > .ci-alert-monitor/open-issues.json
        TITLES=$$(jq -c '[.[].title]' .ci-alert-monitor/open-issues.json)
        NOISE_BODY=$$(jq -r 'map(select(.title == "Alert monitor: noise log")) | .[0].body // ""' \
@@ -238,7 +238,7 @@ steps:
          exit 0
        fi
        jq . /tmp/alert-verdicts.json > /dev/null   # fail loudly on malformed output
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
+        API="https://gitea.renner.uno/api/v1/repos/konairius/homelab"
        STAMP=$$(date -u +%Y-%m-%d)

        gitea_write() {
@@ -48,13 +48,13 @@
 # OWNER SETUP — the token + secret above are already provisioned. The one
 # remaining step, to be run AFTER this merges to master (a cron references a
 # pipeline that must exist on the target branch), is to register the schedule:
-#   woodpecker repo cron add --repo k.renner/homelab \
+#   woodpecker repo cron add --repo konairius/homelab \
 #     --name ci-claude-refresh --branch master --schedule '@weekly'
 # Weekly is plenty; the pipelines tolerate being a few days behind a release.
 #
 # Triggering:
 #   - cron   : the cron NAMED exactly "ci-claude-refresh" (see above).
-#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> ci-claude-refresh
+#   - deploy : woodpecker-cli pipeline deploy konairius/homelab <n> ci-claude-refresh
 #              where <n> is an existing pipeline to promote.
 #   - push   : a change to the Containerfile (or this file) ON master forces a
 #              rebuild of the current latest version so Containerfile fixes ship
@@ -174,9 +174,9 @@ steps:
        # Both were validated non-empty by the decide step; re-assert before a
        # sed that would corrupt every pin if either were blank.
        [ -n "$$NEW" ] && [ -n "$$CUR" ] || { echo "empty version/current sentinel — aborting"; exit 1; }
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
+        API="https://gitea.renner.uno/api/v1/repos/konairius/homelab"
        BRANCH="ci-image/claude-$$NEW"
-        if git ls-remote --heads "https://gitea.renner.uno/k.renner/homelab.git" "$$BRANCH" | grep -q .; then
+        if git ls-remote --heads "https://gitea.renner.uno/konairius/homelab.git" "$$BRANCH" | grep -q .; then
          echo "Branch $$BRANCH already exists — a PR for $$NEW is already open. Nothing to do."
          exit 0
        fi
@@ -197,7 +197,7 @@ steps:
        git checkout -b "$$BRANCH"
        git add $$CONSUMERS
        git commit -m "chore(ci): bump ci-claude image to $$NEW"
-        git push "https://$$PUSH_TOKEN@gitea.renner.uno/k.renner/homelab.git" HEAD:"$$BRANCH"
+        git push "https://$$PUSH_TOKEN@gitea.renner.uno/konairius/homelab.git" HEAD:"$$BRANCH"
        {
          printf 'Automated bump of the ci-claude agent image from `%s` to `%s`.\n\n' "$$CUR" "$$NEW"
          printf 'The refresh pipeline built and pushed `ci-claude:%s` (and `:latest`) from the\n' "$$NEW"
@@ -35,25 +35,25 @@ when:
 steps:
  - name: model-selection-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
    commands:
      - sh scripts/ci/test-model-selection.sh

  - name: pr-review-mistral-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
    commands:
      - sh scripts/ci/test-pr-review-mistral.sh

  - name: promtool-rules-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
    commands:
      - sh scripts/ci/test-promtool-rules.sh

  - name: yaml-citations-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
    commands:
      - sh scripts/ci/test-yaml-citations.sh

@@ -7,7 +7,7 @@
 #                was harmless at daily/weekly cadence — but alert-monitor.yml
 #                fires every 15 minutes, so piggybacking must be opt-in now.
 #                A new cron that SHOULD also run e2e gets its name added here.
-#   - deploy   : `woodpecker-cli pipeline deploy k.renner/homelab <n> e2e`, where
+#   - deploy   : `woodpecker-cli pipeline deploy konairius/homelab <n> e2e`, where
 #                <n> is an existing pipeline to promote.

 when:
@@ -26,7 +26,7 @@ steps:
    # fetch-models.sh response mapping. No cluster, no secrets, no network — the
    # ci-claude image just provides sh + jq. Keeps the flag-injection regression
    # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
    commands:
      - sh scripts/ci/test-model-selection.sh

@@ -0,0 +1,29 @@
+# Builds ci/images/hermes (nousresearch/hermes-agent plus the agent's CLIs) as
+# gitea.renner.uno/konairius/hermes:build.<unix-ts> and :latest.
+when:
+  - event: push
+    branch: master
+    path:
+      - "ci/images/hermes/**"
+      - ".woodpecker/hermes-image.yml"
+  - event: manual
+
+steps:
+  - name: build
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    directory: ci/images/hermes
+    environment:
+      # registry-bot write:package PAT (konairius org secret).
+      GITEA_TOKEN:
+        from_secret: registry_bot_token
+    commands:
+      - mkdir -p /kaniko/.docker
+      - AUTH=$(printf '%s:%s' registry-bot "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+      - TAG="build.$(date +%s)"
+      - |
+        /kaniko/executor \
+          --context . \
+          --dockerfile Containerfile \
+          --destination gitea.renner.uno/konairius/hermes:$TAG \
+          --destination gitea.renner.uno/konairius/hermes:latest
@@ -32,9 +32,9 @@
 #
 # Triggering:
 #   - cron   : a cron NAMED exactly "issue-fix":
-#                woodpecker repo cron add --repo k.renner/homelab \
+#                woodpecker repo cron add --repo konairius/homelab \
 #                  --name issue-fix --branch master --schedule '41 * * * *'
-#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> issue-fix
+#   - deploy : woodpecker-cli pipeline deploy konairius/homelab <n> issue-fix
 #              where <n> is an existing pipeline to promote.
 when:
  - event: cron
@@ -62,7 +62,7 @@ steps:
      - bash scripts/ci/make-diag-kubeconfig.sh

  - name: issue-fix-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -82,7 +82,7 @@ steps:
        set -eu
        TRUSTED_AUTHORS="k.renner"   # space-separated; the trust anchor (see header)
        mkdir -p /tmp/alert-fix
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
+        API="https://gitea.renner.uno/api/v1/repos/konairius/homelab"
        curl -sfL "$$API/issues?state=open&type=issues&limit=100" \
          | jq '[.[] | select(.title | startswith("[alert] "))] | sort_by(.number)' \
          > /tmp/alert-fix/candidates.json
@@ -163,7 +163,7 @@ steps:
        # run skips this issue, and stop cleanly.
        [ -f /tmp/alert-fix/issue.json ] || exit 0
        set -eu
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
+        API="https://gitea.renner.uno/api/v1/repos/konairius/homelab"
        NUM=$$(jq -r '.number' /tmp/alert-fix/issue.json)
        if git diff --quiet && git diff --cached --quiet \
           && [ -z "$$(git ls-files --others --exclude-standard)" ]; then
@@ -187,7 +187,7 @@ steps:
        [ -f /tmp/alert-fix/issue.json ] || exit 0
        if [ -f /tmp/alert-fix/no-edits ]; then exit 0; fi
        set -eu
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
+        API="https://gitea.renner.uno/api/v1/repos/konairius/homelab"
        NUM=$$(jq -r '.number' /tmp/alert-fix/issue.json)
        BRANCH=$$(cat /tmp/alert-fix/branch)
        TITLE="fix: $$(jq -r '.title' /tmp/alert-fix/issue.json) (#$$NUM)"
@@ -196,7 +196,7 @@ steps:
        printf '\n\nCloses #%s\n' "$$NUM" >> /tmp/alert-fix/summary.md
        git add -A
        git commit -m "$$TITLE"
-        git push "https://$$PUSH_TOKEN@gitea.renner.uno/k.renner/homelab.git" HEAD:"$$BRANCH"
+        git push "https://$$PUSH_TOKEN@gitea.renner.uno/konairius/homelab.git" HEAD:"$$BRANCH"
        jq -n --arg title "$$TITLE" --rawfile body /tmp/alert-fix/summary.md \
          --arg head "$$BRANCH" \
          '{title: $$title, body: $$body, head: $$head, base: "master"}' > /tmp/gitea-pr.json
@@ -2,9 +2,9 @@
 # pull requests. This pipeline only starts when triggered by hand and is kept for reference.
 #
 # PR review bot — per-repo STUB. All logic lives centrally in
-# k.renner/homelab: ci/agents/pr-review/run.sh (plus prompt.md,
+# konairius/homelab: ci/agents/pr-review/run.sh (plus prompt.md,
 # settings.json and scripts/ci/). This file is deployed byte-identical into every
-# reviewed repo (k.renner/homelab, shelly-manager, authentik-samba-bridge,
+# reviewed repo (konairius/homelab, shelly-manager, authentik-samba-bridge,
 # homeassistant) and holds NO logic, so the copies cannot drift apart: change the
 # review in homelab and every repo picks it up on its next PR event. Only edit this
 # stub if the trigger, the image or the secrets change — then change all copies in
@@ -43,5 +43,5 @@ steps:
        from_secret: review_bot_token
    commands:
      - rm -rf /tmp/pr-review-central
-      - git clone --quiet --depth 1 https://gitea.renner.uno/k.renner/homelab /tmp/pr-review-central
+      - git clone --quiet --depth 1 https://gitea.renner.uno/konairius/homelab /tmp/pr-review-central
      - sh /tmp/pr-review-central/ci/agents/pr-review/run.sh
@@ -5,7 +5,7 @@
 #   - cron       : the named `daily-security-scan` cron, matched by NAME.
 #                  Crons cannot carry variables — `woodpecker-cli repo cron add`
 #                  has no --var — so a variable gate can never match a cron.
-#   - deployment : woodpecker-cli pipeline deploy k.renner/homelab <n> security-scan
+#   - deployment : woodpecker-cli pipeline deploy konairius/homelab <n> security-scan
 #                  The target rides in pipeline metadata as
 #                  CI_PIPELINE_DEPLOY_TARGET, which the workflow-root filter
 #                  does see, unlike manual-run variables on Woodpecker 3.18
@@ -18,12 +18,12 @@ when:

 steps:
  - name: iac-scan
-    image: aquasec/trivy:latest@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa
+    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
    commands:
      - trivy fs --format json -o trivy-iac.json --severity CRITICAL,HIGH --ignore-unfixed .

  - name: image-scans
-    image: aquasec/trivy:latest@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa
+    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
    commands:
      - trivy image --download-db-only
      - |
@@ -70,7 +70,7 @@ steps:
    # this step is skipped — otherwise we'd fork-bomb PRs.
    when:
      - branch: master
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -147,7 +147,7 @@ steps:
        TITLE="security: agent-proposed fixes ($$(date +%Y-%m-%d))"
        git add -A
        git commit -m "$$TITLE"
-        git push "https://$$GITEA_TOKEN@gitea.renner.uno/k.renner/homelab.git" HEAD:"$$BRANCH"
+        git push "https://$$GITEA_TOKEN@gitea.renner.uno/konairius/homelab.git" HEAD:"$$BRANCH"
        jq -n \
          --arg title "$$TITLE" \
          --arg body  "$$BODY"  \
@@ -157,5 +157,5 @@ steps:
            -H "Authorization: token $$GITEA_TOKEN" \
            -H "Content-Type: application/json" \
            --data @- \
-            https://gitea.renner.uno/api/v1/repos/k.renner/homelab/pulls \
+            https://gitea.renner.uno/api/v1/repos/konairius/homelab/pulls \
        | jq '{number, html_url, title}'
@@ -14,9 +14,9 @@
 #              `repo cron add` takes name, branch, schedule and enabled — so the
 #              name filter is the only thing that can select a workflow for a
 #              scheduled run:
-#                woodpecker repo cron add --repo k.renner/homelab \
+#                woodpecker repo cron add --repo konairius/homelab \
 #                  --name update-audit --branch master --schedule '@weekly'
-#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> update-audit
+#   - deploy : woodpecker-cli pipeline deploy konairius/homelab <n> update-audit
 #              where <n> is an existing pipeline to promote.
 #
 # NOTE: e2e.yml runs on an explicit list of cron names that includes this one,
@@ -30,7 +30,7 @@ when:

 steps:
  - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -111,7 +111,7 @@ steps:
        set -eu
        TITLE="Infrastructure update audit"
        STAMP=$$(date -u +%Y-%m-%dT%H:%M:%SZ)
-        API="https://gitea.renner.uno/api/v1/repos/k.renner/homelab"
+        API="https://gitea.renner.uno/api/v1/repos/konairius/homelab"

        # write <method> <url> <payload-file>  -> prints HTTP code, fails non-2xx
        gitea_write() {
@@ -5,6 +5,8 @@
 # Prerequisites:
 # - netbird-server play applied (docker, Traefik on netbird_netbird)
 # - OpenBao homelab/infrastructure/uptime-kuma with keys username, password
+# - OpenBao homelab/infrastructure/uptime-kuma/smtp with keys server, port, username, token
+# - homelab/infrastructure/uptime-kuma-metrics (key api_key) is written by the role
 # - VAULT_TOKEN in the environment (policy: uptime-kuma-vps)
 # - DNS for kuma.renner.uno pointing at the VPS

@@ -1,11 +1,20 @@
 ---
 uptime_kuma_version: "2.5.6"
 uptime_kuma_host: kuma.renner.uno
-# Not routed yet; reserved for the public status page.
+uptime_kuma_base_url: "https://{{ uptime_kuma_host }}"
+# Custom domain of the status page; not routed by Traefik yet.
 uptime_kuma_status_host: uptime.renner.uno
+uptime_kuma_status_slug: renner
+uptime_kuma_status_title: Renner
 uptime_kuma_dir: /opt/uptime-kuma
 uptime_kuma_traefik_network: netbird_netbird

+uptime_kuma_smtp_from: uptime@renner.uno
+# Alertmanager email receiver in kubernetes/apps/monitoring/helmrelease-prometheus.yaml.
+uptime_kuma_smtp_to: admin@renner.uno
+
 uptime_kuma_openbao_url: https://openbao.renner.uno
 uptime_kuma_openbao_mount: homelab
 uptime_kuma_openbao_path: infrastructure/uptime-kuma
+uptime_kuma_openbao_smtp_path: infrastructure/uptime-kuma/smtp
+uptime_kuma_openbao_metrics_path: infrastructure/uptime-kuma-metrics
@@ -1,46 +1,225 @@
-// Creates the Uptime Kuma admin user on first start; exits 0 if already set up.
-// Credentials come from KUMA_SETUP_USERNAME / KUMA_SETUP_PASSWORD only.
+// Bootstraps Uptime Kuma: admin user, general settings, SMTP notification, status page,
+// and (when KUMA_METRICS_ROTATE=true) a fresh Prometheus API key written to KUMA_METRICS_KEY_FILE.
+// All input comes from environment variables; secrets are never printed.
+// Output lines: "admin user created" / "already set up", then "changed: <step>" or "ok: <step>".
+const fs = require("fs");
 const { io } = require("socket.io-client");

-const username = process.env.KUMA_SETUP_USERNAME;
-const password = process.env.KUMA_SETUP_PASSWORD;
-if (!username || !password) {
-    console.error("KUMA_SETUP_USERNAME and KUMA_SETUP_PASSWORD must be set");
+const KUMA_URL = "http://127.0.0.1:3001";
+const EMIT_TIMEOUT_MS = 30000;
+const TOTAL_TIMEOUT_MS = 180000;
+// Defaults the Kuma settings page applies to unset keys before saving (src/pages/Settings.vue).
+const SETTINGS_DEFAULTS = {
+    checkUpdate: true,
+    searchEngineIndex: false,
+    entryPage: "dashboard",
+    nscd: true,
+    keepDataPeriodDays: 180,
+    tlsExpiryNotifyDays: [7, 14, 21],
+    domainExpiryNotifyDays: [7, 14, 21],
+    trustProxy: false,
+};
+
+const REQUIRED = [
+    "KUMA_SETUP_USERNAME",
+    "KUMA_SETUP_PASSWORD",
+    "KUMA_BASE_URL",
+    "KUMA_SMTP_HOST",
+    "KUMA_SMTP_PORT",
+    "KUMA_SMTP_USERNAME",
+    "KUMA_SMTP_PASSWORD",
+    "KUMA_SMTP_FROM",
+    "KUMA_SMTP_TO",
+    "KUMA_STATUS_SLUG",
+    "KUMA_STATUS_TITLE",
+    "KUMA_STATUS_DOMAIN",
+];
+const missing = REQUIRED.filter((name) => !process.env[name]);
+const rotateMetricsKey = process.env.KUMA_METRICS_ROTATE === "true";
+if (rotateMetricsKey && !process.env.KUMA_METRICS_KEY_FILE) {
+    missing.push("KUMA_METRICS_KEY_FILE");
+}
+if (missing.length > 0) {
+    console.error(`missing environment variables: ${missing.join(", ")}`);
    process.exit(2);
 }
+const env = process.env;

-const socket = io("http://127.0.0.1:3001", { transports: ["websocket"], reconnection: false });
-const timer = setTimeout(() => {
-    console.error("timeout: no response from Uptime Kuma within 30s");
-    process.exit(1);
-}, 30000);
+const socket = io(KUMA_URL, { transports: ["websocket"], reconnection: false });
+const lists = {};
+const LIST_EVENTS = ["notificationList", "apiKeyList", "statusPageList"];
+for (const event of LIST_EVENTS) {
+    socket.on(event, (data) => {
+        lists[event] = data;
+    });
+}

 let finished = false;
 function done(code, msg) {
    if (finished) return;
    finished = true;
-    clearTimeout(timer);
-    (code === 0 ? console.log : console.error)(msg);
+    clearTimeout(watchdog);
+    if (msg) (code === 0 ? console.log : console.error)(msg);
    socket.close();
    process.exit(code);
 }

+const watchdog = setTimeout(() => done(1, `timeout: bootstrap did not finish within ${TOTAL_TIMEOUT_MS / 1000}s`), TOTAL_TIMEOUT_MS);
 socket.on("connect_error", (err) => done(1, `connect_error: ${err.message}`));
-socket.on("disconnect", (reason) => done(1, `disconnected before setup finished: ${reason}`));
+socket.on("disconnect", (reason) => done(1, `disconnected before bootstrap finished: ${reason}`));

-// Kuma registers socket handlers only after emitting info.
-socket.once("info", () => {
-    socket.emit("needSetup", (needSetup) => {
-        if (!needSetup) {
-            done(0, "already set up");
-            return;
-        }
-        socket.emit("setup", username, password, (res) => {
-            if (res && res.ok) {
-                done(0, "admin user created");
-            } else {
-                done(1, `setup failed: ${res && res.msg ? res.msg : JSON.stringify(res)}`);
-            }
+function call(event, ...args) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error(`timeout waiting for ${event}`)), EMIT_TIMEOUT_MS);
+        socket.emit(event, ...args, (res) => {
+            clearTimeout(timer);
+            resolve(res);
        });
    });
-});
+}
+
+async function callOk(event, ...args) {
+    const res = await call(event, ...args);
+    if (!res || !res.ok) {
+        throw new Error(`${event} failed: ${res && res.msg ? res.msg : JSON.stringify(res)}`);
+    }
+    return res;
+}
+
+function report(step, changed) {
+    console.log(`${changed ? "changed" : "ok"}: ${step}`);
+}
+
+// Kuma registers socket handlers only after emitting info.
+function waitForInfo() {
+    return new Promise((resolve) => socket.once("info", resolve));
+}
+
+async function setupAdmin() {
+    const needSetup = await call("needSetup");
+    if (!needSetup) {
+        console.log("already set up");
+        return;
+    }
+    await callOk("setup", env.KUMA_SETUP_USERNAME, env.KUMA_SETUP_PASSWORD);
+    console.log("admin user created");
+}
+
+async function login() {
+    await callOk("login", { username: env.KUMA_SETUP_USERNAME, password: env.KUMA_SETUP_PASSWORD, token: "" });
+    // afterLogin sends the lists before the login ack but swallows send failures.
+    for (const event of LIST_EVENTS) {
+        if (lists[event] === undefined) {
+            throw new Error(`${event} not received after login`);
+        }
+    }
+}
+
+async function ensureSettings() {
+    const { data } = await callOk("getSettings");
+    if (data.trustProxy === true && data.primaryBaseURL === env.KUMA_BASE_URL) {
+        report("settings", false);
+        return;
+    }
+    const updated = { ...SETTINGS_DEFAULTS, ...data, trustProxy: true, primaryBaseURL: env.KUMA_BASE_URL };
+    await callOk("setSettings", updated, "");
+    report("settings", true);
+}
+
+async function ensureNotification() {
+    const port = Number(env.KUMA_SMTP_PORT);
+    const desired = {
+        name: "email",
+        type: "smtp",
+        isDefault: true,
+        smtpHost: env.KUMA_SMTP_HOST,
+        smtpPort: port,
+        // 465 is implicit TLS; any other port uses STARTTLS.
+        smtpSecure: port === 465,
+        smtpIgnoreSTARTTLS: false,
+        smtpUsername: env.KUMA_SMTP_USERNAME,
+        smtpPassword: env.KUMA_SMTP_PASSWORD,
+        smtpFrom: env.KUMA_SMTP_FROM,
+        smtpTo: env.KUMA_SMTP_TO,
+    };
+    const existing = (lists.notificationList || []).filter((n) => n.name === desired.name).sort((a, b) => a.id - b.id)[0];
+    const current = existing ? JSON.parse(existing.config || "{}") : {};
+    const upToDate =
+        existing && existing.isDefault === true && Object.keys(desired).every((key) => current[key] === desired[key]);
+    if (upToDate) {
+        report("notification", false);
+        return;
+    }
+    await callOk("addNotification", { ...current, ...desired, applyExisting: true }, existing ? existing.id : null);
+    report("notification", true);
+}
+
+async function fetchPublicGroupList(slug) {
+    const res = await fetch(`${KUMA_URL}/api/status-page/${encodeURIComponent(slug)}`);
+    if (!res.ok) {
+        throw new Error(`GET /api/status-page/${slug} returned ${res.status}`);
+    }
+    const body = await res.json();
+    return (body.publicGroupList || []).map((group) => ({
+        id: group.id,
+        name: group.name,
+        monitorList: (group.monitorList || []).map((monitor) => {
+            const entry = { id: monitor.id };
+            if (monitor.sendUrl !== undefined) entry.sendUrl = monitor.sendUrl;
+            if (monitor.url !== undefined) entry.url = monitor.url;
+            return entry;
+        }),
+    }));
+}
+
+async function ensureStatusPage() {
+    const slug = env.KUMA_STATUS_SLUG;
+    let changed = false;
+    const pages = Object.values(lists.statusPageList || {});
+    if (!pages.some((page) => page.slug === slug)) {
+        await callOk("addStatusPage", env.KUMA_STATUS_TITLE, slug);
+        changed = true;
+    }
+    const { config } = await callOk("getStatusPage", slug);
+    const domains = config.domainNameList || [];
+    if (config.title !== env.KUMA_STATUS_TITLE || !domains.includes(env.KUMA_STATUS_DOMAIN)) {
+        // saveStatusPage replaces all groups, so the current ones are sent back unchanged.
+        const publicGroupList = await fetchPublicGroupList(slug);
+        const updated = {
+            ...config,
+            title: env.KUMA_STATUS_TITLE,
+            domainNameList: domains.includes(env.KUMA_STATUS_DOMAIN) ? domains : [...domains, env.KUMA_STATUS_DOMAIN],
+        };
+        await callOk("saveStatusPage", slug, updated, config.icon, publicGroupList);
+        changed = true;
+    }
+    report("status page", changed);
+}
+
+async function rotateMetricsApiKey() {
+    if (!rotateMetricsKey) {
+        report("metrics api key", false);
+        return;
+    }
+    for (const key of (lists.apiKeyList || []).filter((k) => k.name === "prometheus")) {
+        await callOk("deleteAPIKey", key.id);
+    }
+    const res = await callOk("addAPIKey", { name: "prometheus", expires: null, active: 1 });
+    fs.writeFileSync(env.KUMA_METRICS_KEY_FILE, res.key, { mode: 0o600 });
+    report("metrics api key", true);
+}
+
+async function main() {
+    await waitForInfo();
+    await setupAdmin();
+    await login();
+    await ensureSettings();
+    await ensureNotification();
+    await ensureStatusPage();
+    await rotateMetricsApiKey();
+}
+
+main().then(
+    () => done(0),
+    (err) => done(1, err.message)
+);
@@ -14,6 +14,33 @@
  register: _uptime_kuma_secret
  no_log: true

+- name: Read SMTP credentials from OpenBao
+  community.hashi_vault.vault_kv2_get:
+    url: "{{ uptime_kuma_openbao_url }}"
+    engine_mount_point: "{{ uptime_kuma_openbao_mount }}"
+    path: "{{ uptime_kuma_openbao_smtp_path }}"
+    auth_method: token
+  delegate_to: localhost
+  become: false
+  run_once: true
+  register: _uptime_kuma_smtp
+  no_log: true
+
+- name: Read metrics API key from OpenBao
+  community.hashi_vault.vault_kv2_get:
+    url: "{{ uptime_kuma_openbao_url }}"
+    engine_mount_point: "{{ uptime_kuma_openbao_mount }}"
+    path: "{{ uptime_kuma_openbao_metrics_path }}"
+    auth_method: token
+  delegate_to: localhost
+  become: false
+  run_once: true
+  register: _uptime_kuma_metrics_secret
+  failed_when:
+    - _uptime_kuma_metrics_secret.failed | default(false)
+    - "'Invalid or missing path' not in (_uptime_kuma_metrics_secret.msg | default(''))"
+  no_log: true
+
 - name: Ensure Uptime Kuma directories exist
  ansible.builtin.file:
    path: "{{ item }}"
@@ -22,11 +49,12 @@
  loop:
    - "{{ uptime_kuma_dir }}"
    - "{{ uptime_kuma_dir }}/data"
+    - "{{ uptime_kuma_dir }}/setup"

 - name: Deploy kuma-setup.js
  ansible.builtin.copy:
    src: kuma-setup.js
-    dest: "{{ uptime_kuma_dir }}/kuma-setup.js"
+    dest: "{{ uptime_kuma_dir }}/setup/kuma-setup.js"
    mode: "0644"

 - name: Check for setup marker
@@ -54,6 +82,11 @@
    chdir: "{{ uptime_kuma_dir }}"
  changed_when: false

+- name: Remove the script from its former single-file mount path
+  ansible.builtin.file:
+    path: "{{ uptime_kuma_dir }}/kuma-setup.js"
+    state: absent
+
 - name: Wait for Uptime Kuma on loopback
  ansible.builtin.uri:
    url: http://127.0.0.1:3001
@@ -63,15 +96,80 @@
  retries: 30
  delay: 5

- name: Create the admin user if Uptime Kuma is not set up
-  ansible.builtin.command: docker compose exec -T -e KUMA_SETUP_USERNAME -e KUMA_SETUP_PASSWORD uptime-kuma node /app/kuma-setup.js
+- name: Check the stored metrics API key against Uptime Kuma
+  ansible.builtin.uri:
+    url: http://127.0.0.1:3001/metrics
+    headers:
+      Authorization: "Basic {{ (':' ~ _uptime_kuma_metrics_key) | b64encode }}"
+    status_code: [200, 401]
+  vars:
+    _uptime_kuma_metrics_key: "{{ (_uptime_kuma_metrics_secret.secret | default({})).api_key | default('') }}"
+  when: _uptime_kuma_metrics_key | length > 0
+  register: _uptime_kuma_metrics_check
+  no_log: true
+
+- name: Remove a leftover metrics API key handoff file
+  ansible.builtin.file:
+    path: "{{ uptime_kuma_dir }}/data/.metrics-api-key"
+    state: absent
+
+- name: Bootstrap Uptime Kuma
+  ansible.builtin.command:
+    argv:
+      - docker
+      - compose
+      - exec
+      - -T
+      - -e
+      - KUMA_SETUP_USERNAME
+      - -e
+      - KUMA_SETUP_PASSWORD
+      - -e
+      - KUMA_BASE_URL
+      - -e
+      - KUMA_SMTP_HOST
+      - -e
+      - KUMA_SMTP_PORT
+      - -e
+      - KUMA_SMTP_USERNAME
+      - -e
+      - KUMA_SMTP_PASSWORD
+      - -e
+      - KUMA_SMTP_FROM
+      - -e
+      - KUMA_SMTP_TO
+      - -e
+      - KUMA_STATUS_SLUG
+      - -e
+      - KUMA_STATUS_TITLE
+      - -e
+      - KUMA_STATUS_DOMAIN
+      - -e
+      - KUMA_METRICS_ROTATE
+      - -e
+      - KUMA_METRICS_KEY_FILE
+      - uptime-kuma
+      - node
+      - /app/setup/kuma-setup.js
  args:
    chdir: "{{ uptime_kuma_dir }}"
  environment:
    KUMA_SETUP_USERNAME: "{{ _uptime_kuma_secret.secret.username }}"
    KUMA_SETUP_PASSWORD: "{{ _uptime_kuma_secret.secret.password }}"
+    KUMA_BASE_URL: "{{ uptime_kuma_base_url }}"
+    KUMA_SMTP_HOST: "{{ _uptime_kuma_smtp.secret.server }}"
+    KUMA_SMTP_PORT: "{{ _uptime_kuma_smtp.secret.port }}"
+    KUMA_SMTP_USERNAME: "{{ _uptime_kuma_smtp.secret.username }}"
+    KUMA_SMTP_PASSWORD: "{{ _uptime_kuma_smtp.secret.token }}"
+    KUMA_SMTP_FROM: "{{ uptime_kuma_smtp_from }}"
+    KUMA_SMTP_TO: "{{ uptime_kuma_smtp_to }}"
+    KUMA_STATUS_SLUG: "{{ uptime_kuma_status_slug }}"
+    KUMA_STATUS_TITLE: "{{ uptime_kuma_status_title }}"
+    KUMA_STATUS_DOMAIN: "{{ uptime_kuma_status_host }}"
+    KUMA_METRICS_ROTATE: "{{ 'false' if (_uptime_kuma_metrics_check.status | default(0)) == 200 else 'true' }}"
+    KUMA_METRICS_KEY_FILE: /app/data/.metrics-api-key
  register: _uptime_kuma_setup
-  changed_when: "'admin user created' in _uptime_kuma_setup.stdout"
+  changed_when: "'admin user created' in _uptime_kuma_setup.stdout or 'changed:' in _uptime_kuma_setup.stdout"
  failed_when: false
  no_log: true

@@ -80,6 +178,33 @@
    msg: "kuma-setup.js failed: rc={{ _uptime_kuma_setup.rc | default('undefined') }} stdout={{ _uptime_kuma_setup.stdout | default('') }} stderr={{ _uptime_kuma_setup.stderr | default('') }}"
  when: (_uptime_kuma_setup.rc | default(1)) != 0

+- name: Store the new metrics API key in OpenBao
+  when: "'changed: metrics api key' in _uptime_kuma_setup.stdout"
+  block:
+    - name: Read the new metrics API key
+      ansible.builtin.slurp:
+        src: "{{ uptime_kuma_dir }}/data/.metrics-api-key"
+      register: _uptime_kuma_new_metrics_key
+      no_log: true
+
+    - name: Write the metrics API key to OpenBao
+      community.hashi_vault.vault_kv2_write:
+        url: "{{ uptime_kuma_openbao_url }}"
+        engine_mount_point: "{{ uptime_kuma_openbao_mount }}"
+        path: "{{ uptime_kuma_openbao_metrics_path }}"
+        auth_method: token
+        data:
+          api_key: "{{ _uptime_kuma_new_metrics_key.content | b64decode }}"
+      delegate_to: localhost
+      become: false
+      run_once: true
+      no_log: true
+  always:
+    - name: Remove the metrics API key handoff file
+      ansible.builtin.file:
+        path: "{{ uptime_kuma_dir }}/data/.metrics-api-key"
+        state: absent
+
 - name: Record setup completion
  ansible.builtin.copy:
    content: ""
@@ -9,7 +9,8 @@ services:
      - "127.0.0.1:3001:3001"
    volumes:
      - {{ uptime_kuma_dir }}/data:/app/data
-      - {{ uptime_kuma_dir }}/kuma-setup.js:/app/kuma-setup.js:ro
+      # Directory mount: a single-file bind mount keeps the inode from container start.
+      - {{ uptime_kuma_dir }}/setup:/app/setup:ro
    labels:
      - "traefik.enable={{ uptime_kuma_route_enabled | lower }}"
      - "traefik.http.routers.uptime-kuma.rule=Host(`{{ uptime_kuma_host }}`)"
@@ -1,6 +1,6 @@
 #!/bin/sh
 # PR review bot — the ONE implementation, run by every reviewed repo's
-# .woodpecker/pr-review.yml stub (k.renner/homelab, shelly-manager,
+# .woodpecker/pr-review.yml stub (konairius/homelab, shelly-manager,
 # authentik-samba-bridge, homeassistant). Edit it here only; the stubs hold no
 # logic. Design notes (event-driven trigger, dedup marker, tokens, model
 # selection, posture) are in the stub and in prompt.md.
@@ -129,7 +129,7 @@ while IFS= read -r ITEM; do
  # # Cross-repo context for the review agent: shallow, UNAUTHENTICATED clones of
  # # the other fleet repos at ./.pr-review/context/<name>.
  # CTX="$D/context"; mkdir -p "$CTX"
-  # for REPO in k.renner/homelab k.renner/homeassistant konairius/shelly-manager k.renner/authentik-samba-bridge; do
+  # for REPO in konairius/homelab konairius/homeassistant konairius/shelly-manager konairius/authentik-samba-bridge; do
  #   [ "$REPO" = "$SLUG" ] && continue
  #   GIT_TERMINAL_PROMPT=0 git clone --quiet --depth 1 "https://gitea.renner.uno/$REPO" "$CTX/${REPO#*/}" 2>/dev/null \
  #     || echo "No public context clone of $REPO (skipped)."
@@ -5,12 +5,12 @@

 # The unit tests gate the image: the final stage copies the controller out of
 # this stage, so a failing test fails the build.
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS test
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce AS test
 WORKDIR /src
 COPY controller.py test_controller.py ./
 RUN python3 -B -m unittest -v

-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce

 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY --from=test /src/controller.py /opt/controller.py
@@ -1,4 +1,4 @@
-FROM node:24-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1
+FROM node:24-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f

 # Default to the latest Claude Code. Pinning a fixed version is the wrong
 # default here: old releases eventually stop working against the API, so a
@@ -23,7 +23,7 @@
 # namespace, so can0 is only reachable with network_mode: host. That is also
 # how the local MQTT broker on 127.0.0.1:1883 is reached. CAN_RAW sockets need
 # no capabilities, so both run unprivileged.
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS build
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce AS build

 # Pins live here, in the artifact, rather than in Ansible variables.
 #
@@ -56,14 +56,14 @@ RUN git clone --quiet https://github.com/MyHomeMyData/E3onCAN.git /opt/e3oncan \
 && rm -rf /opt/e3oncan/.git


-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce

 ARG OPEN3E_REF=6553c10453a6bae1210908f38a5af2481a46a3e5
 ARG E3ONCAN_REF=461dcbdf97e8d72d2edb9929c63b39382af6c3a1

 LABEL org.opencontainers.image.title="heating-can" \
      org.opencontainers.image.description="open3e + E3onCAN, Viessmann E3 CAN bus readers" \
-      org.opencontainers.image.source="https://gitea.renner.uno/k.renner/homelab" \
+      org.opencontainers.image.source="https://gitea.renner.uno/konairius/homelab" \
      uno.renner.open3e.ref="${OPEN3E_REF}" \
      uno.renner.e3oncan.ref="${E3ONCAN_REF}"

@@ -0,0 +1,20 @@
+FROM nousresearch/hermes-agent:v0.22.2@sha256:36099926da316742423544e055d4734777105ffe6341873af5459b957d0c2919
+
+USER root
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends jq \
+ && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/siderolabs/talosctl:v1.13.10@sha256:3116f64c97ddffb53bd3c5bf87c8614d99f04df4326177dbbb7702b5087f0e4d /talosctl /usr/local/bin/talosctl
+COPY --from=alpine/kubectl:1.36.3@sha256:dae261106d5555008acede256b7102c8a6decde7209198434f5999f051460f57 /usr/local/bin/kubectl /usr/local/bin/kubectl
+COPY --from=ghcr.io/fluxcd/flux-cli:v2.9.5@sha256:704d5529535570a495249b643159c93a9aa88ffca07813c974a54b7ba6edbd86 /usr/local/bin/flux /usr/local/bin/flux
+COPY --from=quay.io/openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf /usr/bin/bao /usr/local/bin/bao
+COPY --from=gitea/tea:0.16.0@sha256:af50a2060ce4d8fd76b7ebe75a3d6db4bb0c615c5bc8f2bdfd8ea83207c4752d /usr/bin/tea /usr/local/bin/tea
+
+RUN talosctl version --client \
+ && kubectl version --client \
+ && flux version --client \
+ && bao version \
+ && tea --version \
+ && jq --version
@@ -10,8 +10,8 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"

-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/app"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/kumaclient"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/app"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/kumaclient"
 )

 func main() {
@@ -1,4 +1,4 @@
-module gitea.renner.uno/k.renner/homelab/kuma-sync
+module gitea.renner.uno/konairius/homelab/kuma-sync

 go 1.27

@@ -19,9 +19,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"

-	v1 "gitea.renner.uno/k.renner/homelab/kuma-sync/api/v1alpha1"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/controller"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/kumaclient"
+	v1 "gitea.renner.uno/konairius/homelab/kuma-sync/api/v1alpha1"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/controller"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/kumaclient"
 )

 // Options configures NewManager.
@@ -7,12 +7,14 @@ import (
 	"fmt"
 	"io"
 	"path/filepath"
+	"slices"
 	"sync"
 	"testing"
 	"time"

 	kuma "github.com/breml/go-uptime-kuma-client"
 	"github.com/breml/go-uptime-kuma-client/monitor"
+	"github.com/breml/go-uptime-kuma-client/notification"
 	"github.com/testcontainers/testcontainers-go"
 	"github.com/testcontainers/testcontainers-go/wait"
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -23,9 +25,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/envtest"

-	v1 "gitea.renner.uno/k.renner/homelab/kuma-sync/api/v1alpha1"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/app"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/kumaclient"
+	v1 "gitea.renner.uno/konairius/homelab/kuma-sync/api/v1alpha1"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/app"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/kumaclient"
 )

 const (
@@ -395,6 +397,60 @@ func TestE2EDriftRepaired(t *testing.T) {
 	})
 }

+func (f *e2e) webhook(name string, isDefault bool) int64 {
+	f.t.Helper()
+	id, err := f.raw.CreateNotification(f.t.Context(), notification.Webhook{
+		Base: notification.Base{Name: name, IsActive: true, IsDefault: isDefault},
+		WebhookDetails: notification.WebhookDetails{
+			WebhookURL: "http://127.0.0.1:9/" + name, WebhookContentType: "json",
+		},
+	})
+	if err != nil {
+		f.t.Fatalf("create notification %s: %v", name, err)
+	}
+	return id
+}
+
+func TestE2EDefaultNotifications(t *testing.T) {
+	f, env := newE2E(t)
+	first := f.webhook("first", true)
+	f.webhook("opt-in", false)
+	f.start(env)
+	f.apply(group("g", ""), dns("probe", "g"))
+
+	carry := func(want ...int64) func() (bool, string) {
+		return func() (bool, string) {
+			m := byKey(f.owned())
+			for _, k := range []string{"default/g", "default/probe"} {
+				got, ok := m[k]
+				if !ok {
+					return false, k + " missing"
+				}
+				if !slices.Equal(got.NotificationIDs, want) {
+					return false, fmt.Sprintf("%s carries %v, want %v", k, got.NotificationIDs, want)
+				}
+			}
+			return true, ""
+		}
+	}
+	eventually(t, 30*time.Second, "monitors created with the default notification", carry(first))
+
+	second := f.webhook("second", true)
+	want := []int64{first, second}
+	slices.Sort(want)
+	eventually(t, 30*time.Second, "new default notification attached by a resync", carry(want...))
+
+	var live monitor.DNS
+	if err := f.raw.GetMonitorAs(t.Context(), byKey(f.owned())["default/probe"].ID, &live); err != nil {
+		t.Fatal(err)
+	}
+	live.NotificationIDs = nil
+	if err := f.raw.UpdateMonitor(t.Context(), &live); err != nil {
+		t.Fatal(err)
+	}
+	eventually(t, 30*time.Second, "notifications removed by hand restored by a resync", carry(want...))
+}
+
 // A monitor that lost its ownership tag in the UI must not get a twin when the
 // controller restarts: the resource reports NotOwned and nothing is created.
 func TestE2ETagRemovedNeverDuplicates(t *testing.T) {
@@ -16,8 +16,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/manager"

-	v1 "gitea.renner.uno/k.renner/homelab/kuma-sync/api/v1alpha1"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/kumaclient"
+	v1 "gitea.renner.uno/konairius/homelab/kuma-sync/api/v1alpha1"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/kumaclient"
 )

 // +kubebuilder:rbac:groups="",resources=namespaces,verbs=get
@@ -15,8 +15,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"

-	v1 "gitea.renner.uno/k.renner/homelab/kuma-sync/api/v1alpha1"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/kumaclient"
+	v1 "gitea.renner.uno/konairius/homelab/kuma-sync/api/v1alpha1"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/kumaclient"
 )

 type gcEnv struct {
@@ -20,8 +20,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"

-	v1 "gitea.renner.uno/k.renner/homelab/kuma-sync/api/v1alpha1"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/kumaclient"
+	v1 "gitea.renner.uno/konairius/homelab/kuma-sync/api/v1alpha1"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/kumaclient"
 )

 const (
@@ -129,22 +129,28 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 	if fail != nil {
 		return r.fail(ctx, km, fail)
 	}
+	notifications, err := r.Kuma.DefaultNotifications(ctx)
+	if err != nil {
+		return r.fail(ctx, km, &failure{ReasonKumaUnavailable, msgKumaUnavailable, err})
+	}
+	desired.NotificationIDs = notifications

 	var id int64
 	if res.mon == nil {
 		// The monitor this resource synced before may have lost its tag; a
-		// second one would then sit beside it.
+		// second one would then sit beside it. An ID now carrying another
+		// owner's key was reused by Kuma, so ours is gone.
 		if prev := km.Status.MonitorID; prev != 0 {
 			found, key, err := r.Kuma.Probe(ctx, prev)
 			switch {
 			case err != nil:
 				return r.fail(ctx, km, &failure{ReasonKumaUnavailable, msgKumaUnavailable, err})
-			case found && key != desired.OwnerKey:
+			case found && key == "":
 				log.FromContext(ctx).Error(nil, "previous monitor exists without our ownership tag, not creating another",
 					"ownerKey", desired.OwnerKey, "monitorID", prev, "tagValue", key)
 				err := r.setReady(ctx, km, metav1.ConditionFalse, ReasonNotOwned, msgNotOwned, nil)
 				return ctrl.Result{RequeueAfter: r.resync()}, err
-			case found:
+			case found && key == desired.OwnerKey:
 				return r.fail(ctx, km, &failure{ReasonKumaUnavailable, msgKumaUnavailable,
 					fmt.Errorf("monitor %d carries our key but is missing from the owned list", prev)})
 			}
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 	"testing"
 	"time"

@@ -16,8 +17,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"

-	v1 "gitea.renner.uno/k.renner/homelab/kuma-sync/api/v1alpha1"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/kumaclient"
+	v1 "gitea.renner.uno/konairius/homelab/kuma-sync/api/v1alpha1"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/kumaclient"
 )

 // counting records calls on top of the Kuma fake.
@@ -310,6 +311,79 @@ func TestReconcileListErrorNoCreate(t *testing.T) {
 	}
 }

+func TestReconcileCreateGetsDefaultNotifications(t *testing.T) {
+	group := &v1.KumaMonitor{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "grp"},
+		Spec:       v1.KumaMonitorSpec{Type: "group", DisplayName: "grp", Interval: 60, RetryInterval: 60},
+	}
+	e := newEnv(t, httpMonitor("a"), group)
+	e.kuma.SetDefaultNotifications(7, 3)
+	for _, name := range []string{"a", "grp"} {
+		if _, err := e.reconcile(t, name); err != nil {
+			t.Fatal(err)
+		}
+		got := e.kuma.Get(e.get(t, name).Status.MonitorID)
+		if got == nil || !slices.Equal(got.NotificationIDs, []int64{3, 7}) {
+			t.Errorf("%s: kuma monitor = %+v, want notifications [3 7]", name, got)
+		}
+	}
+}
+
+func TestReconcileRevertsNotificationDrift(t *testing.T) {
+	km := httpMonitor("a")
+	e := newEnv(t, km)
+	e.kuma.SetDefaultNotifications(1, 2)
+	drifted := Desired(km)
+	drifted.NotificationIDs = []int64{2, 9}
+	id, _ := e.kuma.Create(t.Context(), drifted)
+	if _, err := e.reconcile(t, "a"); err != nil {
+		t.Fatal(err)
+	}
+	if e.cnt.updates != 1 || e.cnt.creates != 0 {
+		t.Fatalf("updates=%d creates=%d", e.cnt.updates, e.cnt.creates)
+	}
+	if got := e.kuma.Get(id).NotificationIDs; !slices.Equal(got, []int64{1, 2}) {
+		t.Errorf("notifications = %v, want [1 2]", got)
+	}
+}
+
+func TestReconcileUnchangedNotificationsNoUpdate(t *testing.T) {
+	km := httpMonitor("a")
+	e := newEnv(t, km)
+	e.kuma.SetDefaultNotifications(4, 2)
+	existing := Desired(km)
+	existing.NotificationIDs = []int64{4, 2}
+	e.kuma.Create(t.Context(), existing)
+	for range 2 {
+		if _, err := e.reconcile(t, "a"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if e.cnt.updates != 0 || e.cnt.creates != 0 {
+		t.Fatalf("updates=%d creates=%d, want 0 and 0", e.cnt.updates, e.cnt.creates)
+	}
+}
+
+func TestReconcileNotificationListErrorNoWrite(t *testing.T) {
+	adopt := httpMonitor("b")
+	e := newEnv(t, httpMonitor("a"), adopt)
+	drifted := Desired(adopt)
+	drifted.Interval = 30
+	e.kuma.Create(t.Context(), drifted)
+	e.kuma.SetNotificationsErr(errors.New("boom"))
+	for _, name := range []string{"a", "b"} {
+		if _, err := e.reconcile(t, name); err == nil {
+			t.Fatalf("%s: expected error", name)
+		}
+		if c := ready(t, e.get(t, name)); c.Status != metav1.ConditionFalse || c.Reason != ReasonKumaUnavailable {
+			t.Errorf("%s: Ready = %+v", name, c)
+		}
+	}
+	if e.cnt.creates != 0 || e.cnt.updates != 0 {
+		t.Errorf("creates=%d updates=%d", e.cnt.creates, e.cnt.updates)
+	}
+}
+
 func TestReconcileOwnerTagMissing(t *testing.T) {
 	e := newEnv(t, httpMonitor("a"))
 	e.kuma.SetErrs(kumaclient.ErrOwnerTagMissing, nil, nil, nil)
@@ -428,7 +502,7 @@ func TestReconcileRefusesCreateBesideUntaggedPrevious(t *testing.T) {
 	}
 }

-func TestReconcileRefusesCreateBesideOtherOwnersMonitor(t *testing.T) {
+func TestReconcileCreatesWhenPreviousIDReusedByOtherOwner(t *testing.T) {
 	e := newEnv(t, withPreviousMonitor(1))
 	if _, err := e.kuma.Create(t.Context(), kumaclient.Monitor{Name: "x", OwnerKey: "default/other"}); err != nil {
 		t.Fatal(err)
@@ -436,12 +510,15 @@ func TestReconcileRefusesCreateBesideOtherOwnersMonitor(t *testing.T) {
 	if _, err := e.reconcile(t, "a"); err != nil {
 		t.Fatal(err)
 	}
-	if e.cnt.creates != 0 {
-		t.Errorf("creates = %d, want 0", e.cnt.creates)
+	if e.cnt.creates != 1 {
+		t.Errorf("creates = %d, want 1", e.cnt.creates)
 	}
-	if c := ready(t, e.get(t, "a")); c.Reason != ReasonNotOwned {
+	if c := ready(t, e.get(t, "a")); c.Reason != ReasonSynced {
 		t.Errorf("Ready = %+v", c)
 	}
+	if m := e.kuma.Get(1); m == nil || m.OwnerKey != "default/other" {
+		t.Errorf("other owner's monitor 1 = %+v, want untouched", m)
+	}
 }

 func TestReconcileCreatesWhenPreviousMonitorIsGone(t *testing.T) {
@@ -4,8 +4,8 @@ import (
 	"maps"
 	"slices"

-	v1 "gitea.renner.uno/k.renner/homelab/kuma-sync/api/v1alpha1"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/kumaclient"
+	v1 "gitea.renner.uno/konairius/homelab/kuma-sync/api/v1alpha1"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/kumaclient"
 )

 // defaultMaxRedirects is Kuma's default for a monitor with no explicit value.
@@ -6,8 +6,8 @@ import (

 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

-	v1 "gitea.renner.uno/k.renner/homelab/kuma-sync/api/v1alpha1"
-	"gitea.renner.uno/k.renner/homelab/kuma-sync/internal/kumaclient"
+	v1 "gitea.renner.uno/konairius/homelab/kuma-sync/api/v1alpha1"
+	"gitea.renner.uno/konairius/homelab/kuma-sync/internal/kumaclient"
 )

 func TestMappingAllTypes(t *testing.T) {
@@ -13,6 +13,7 @@ import (

 	kuma "github.com/breml/go-uptime-kuma-client"
 	"github.com/breml/go-uptime-kuma-client/monitor"
+	"github.com/breml/go-uptime-kuma-client/notification"
 	"github.com/breml/go-uptime-kuma-client/tag"
 )

@@ -373,8 +374,8 @@ func (b *Breml) update(ctx context.Context, m Monitor) error {
 		return fmt.Errorf("update %d: monitor carries owner key %q, not %q: %w", m.ID, key, m.OwnerKey, ErrNotOwned)
 	}
 	// Start from the full current object, also across a type change, so
-	// fields we do not manage (notifications, proxy, resend interval, upside
-	// down, auth) survive the overwrite.
+	// fields we do not manage (proxy, resend interval, upside down, auth)
+	// survive the overwrite.
 	wire, err := toWire(m, &cur)
 	if err != nil {
 		return err
@@ -404,18 +405,42 @@ func (b *Breml) Delete(ctx context.Context, id int64) error {
 	return err
 }

+// DefaultNotifications reads the notification list cached by the session.
+// Kuma has no command to request it: it pushes the list at login and to every
+// session of the user after each change.
+func (b *Breml) DefaultNotifications(ctx context.Context) ([]int64, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return defaultIDs(b.c.GetNotifications(ctx)), nil
+}
+
+func defaultIDs(list []notification.Base) []int64 {
+	var ids []int64
+	for _, n := range list {
+		if n.IsDefault {
+			ids = append(ids, n.ID)
+		}
+	}
+	slices.Sort(ids)
+	return ids
+}
+
 // toDomain converts a monitor from the Kuma monitor list.
 func toDomain(base monitor.Base, ownerKey string) (Monitor, error) {
 	m := Monitor{
-		ID:            base.ID,
-		Type:          base.Type(),
-		Name:          base.Name,
-		Parent:        base.Parent,
-		Active:        base.IsActive,
-		Interval:      int32(base.Interval),
-		RetryInterval: int32(base.RetryInterval),
-		MaxRetries:    int32(base.MaxRetries),
-		OwnerKey:      ownerKey,
+		ID:              base.ID,
+		Type:            base.Type(),
+		Name:            base.Name,
+		Parent:          base.Parent,
+		Active:          base.IsActive,
+		Interval:        int32(base.Interval),
+		RetryInterval:   int32(base.RetryInterval),
+		MaxRetries:      int32(base.MaxRetries),
+		NotificationIDs: slices.Clone(base.NotificationIDs),
+		OwnerKey:        ownerKey,
 	}
 	if base.Description != nil {
 		m.Description = *base.Description
@@ -565,6 +590,7 @@ func writeBase(b *monitor.Base, m Monitor) {
 	b.RetryInterval = int64(m.RetryInterval)
 	b.MaxRetries = int64(m.MaxRetries)
 	b.IsActive = m.Active
+	b.NotificationIDs = slices.Clone(m.NotificationIDs)
 }

 // writeHTTP expects m to be normalized.
@@ -287,12 +287,10 @@ func TestUpdateKeepsUnchangedFields(t *testing.T) {
 	}
 }

-// setUnmanaged sets state through the raw library that Monitor does not model.
-func setUnmanaged(t *testing.T, b *Breml, id int64) (notificationID int64) {
+func createWebhook(t *testing.T, b *Breml, name string, isDefault bool) int64 {
 	t.Helper()
-	ctx := context.Background()
-	nid, err := b.c.CreateNotification(ctx, &notification.Webhook{
-		Base: notification.Base{Name: "n", IsActive: true},
+	nid, err := b.c.CreateNotification(context.Background(), &notification.Webhook{
+		Base: notification.Base{Name: name, IsActive: true, IsDefault: isDefault},
 		WebhookDetails: notification.WebhookDetails{
 			WebhookURL: "http://example.com/hook", WebhookContentType: "application/json",
 		},
@@ -300,6 +298,15 @@ func setUnmanaged(t *testing.T, b *Breml, id int64) (notificationID int64) {
 	if err != nil {
 		t.Fatalf("create notification: %v", err)
 	}
+	return nid
+}
+
+// setUnmanaged sets state through the raw library that Monitor does not
+// model, and attaches a notification by hand.
+func setUnmanaged(t *testing.T, b *Breml, id int64) (notificationID int64) {
+	t.Helper()
+	ctx := context.Background()
+	nid := createWebhook(t, b, "n", false)
 	var kw monitor.HTTPKeyword
 	if err := b.c.GetMonitorAs(ctx, id, &kw); err != nil {
 		t.Fatal(err)
@@ -313,16 +320,15 @@ func setUnmanaged(t *testing.T, b *Breml, id int64) (notificationID int64) {
 	return nid
 }

-func assertUnmanaged(t *testing.T, c *Breml, id, nid int64, when string) {
+func assertUnmanaged(t *testing.T, c *Breml, id int64, when string) {
 	t.Helper()
 	var base monitor.Base
 	base, err := c.c.GetMonitor(t.Context(), id)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !base.UpsideDown || base.ResendInterval != 7 || !reflect.DeepEqual(base.NotificationIDs, []int64{nid}) {
-		t.Errorf("%s: unmanaged state lost: upsideDown=%v resend=%d notifications=%v",
-			when, base.UpsideDown, base.ResendInterval, base.NotificationIDs)
+	if !base.UpsideDown || base.ResendInterval != 7 {
+		t.Errorf("%s: unmanaged state lost: upsideDown=%v resend=%d", when, base.UpsideDown, base.ResendInterval)
 	}
 }

@@ -362,14 +368,15 @@ func TestUpdatePreservesUnmanagedAndClearsManaged(t *testing.T) {
 		t.Fatal(err)
 	}
 	m := byID(got)[id]
-	if m.Parent != nil || m.Headers != nil || m.Keyword != "" || m.Interval != 90 {
+	if m.Parent != nil || m.Headers != nil || m.Keyword != "" || m.Interval != 90 || m.NotificationIDs != nil {
 		t.Errorf("managed fields not cleared: %+v", m)
 	}
-	assertUnmanaged(t, fresh, id, nid, "after plain update")
+	assertUnmanaged(t, fresh, id, "after plain update")

 	// Type change must not wipe unmanaged state either.
 	changed := cleared
 	changed.Type = "http"
+	changed.NotificationIDs = []int64{nid}
 	if err := b.Update(ctx, changed); err != nil {
 		t.Fatal(err)
 	}
@@ -377,10 +384,55 @@ func TestUpdatePreservesUnmanagedAndClearsManaged(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if m := byID(got)[id]; m.Type != "http" {
-		t.Errorf("type = %q, want http", m.Type)
+	if m := byID(got)[id]; m.Type != "http" || !reflect.DeepEqual(m.NotificationIDs, []int64{nid}) {
+		t.Errorf("type = %q, notifications = %v, want http and [%d]", m.Type, m.NotificationIDs, nid)
+	}
+	assertUnmanaged(t, fresh, id, "after type change")
+}
+
+func TestDefaultNotificationsAndWrite(t *testing.T) {
+	ctx := context.Background()
+	url := startKuma(t)
+	b := setupClient(t, url)
+	other := freshClient(t, url)
+
+	if ids, err := other.DefaultNotifications(ctx); err != nil || ids != nil {
+		t.Fatalf("no notifications: ids=%v err=%v", ids, err)
+	}
+	def := createWebhook(t, b, "default", true)
+	createWebhook(t, b, "opt-in", false)
+	// Kuma pushes the list to every session of the user, not only the writer.
+	deadline := time.Now().Add(10 * time.Second)
+	for {
+		ids, err := other.DefaultNotifications(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if reflect.DeepEqual(ids, []int64{def}) {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("other session sees defaults %v, want [%d]", ids, def)
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+
+	m := Monitor{
+		Type: "group", Name: "grp", Active: true, Interval: 60, RetryInterval: 60,
+		NotificationIDs: []int64{def}, OwnerKey: "default/grp",
+	}
+	id, err := b.Create(ctx, m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := freshClient(t, url).ListOwned(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	m.ID = id
+	if !reflect.DeepEqual(byID(got)[id], m.Normalized()) {
+		t.Errorf("read-back differs:\n got  %+v\n want %+v", byID(got)[id], m.Normalized())
 	}
-	assertUnmanaged(t, fresh, id, nid, "after type change")
 }

 func TestRestartAdoptsByTag(t *testing.T) {
@@ -63,6 +63,7 @@ func Conflicts(err error) (conflicts []*ConflictError, only bool) {
 func (m Monitor) clone() Monitor {
 	m.Headers = maps.Clone(m.Headers)
 	m.AcceptedStatusCodes = slices.Clone(m.AcceptedStatusCodes)
+	m.NotificationIDs = slices.Clone(m.NotificationIDs)
 	if m.Parent != nil {
 		p := *m.Parent
 		m.Parent = &p
@@ -80,12 +81,18 @@ func isHTTPFamily(typ string) bool {
 // For http, keyword and json-query: an empty Method becomes GET, empty
 // AcceptedStatusCodes become ["200-299"], and Timeout 0 becomes
 // round(0.8*Interval). For all other types Timeout is stored as 0 and the
-// HTTP-only slices are nil. Empty Headers become nil. It is idempotent.
+// HTTP-only slices are nil. Empty Headers become nil. NotificationIDs are
+// sorted and deduplicated, empty becomes nil. It is idempotent.
 func (m Monitor) Normalized() Monitor {
 	m = m.clone()
 	if len(m.Headers) == 0 {
 		m.Headers = nil
 	}
+	slices.Sort(m.NotificationIDs)
+	m.NotificationIDs = slices.Compact(m.NotificationIDs)
+	if len(m.NotificationIDs) == 0 {
+		m.NotificationIDs = nil
+	}
 	if len(m.AcceptedStatusCodes) == 0 {
 		m.AcceptedStatusCodes = nil
 	}
@@ -143,6 +150,9 @@ type Monitor struct {
 	DNSResolveType   string
 	DNSResolveServer string

+	// NotificationIDs are the Kuma notifications attached to the monitor.
+	NotificationIDs []int64
+
 	// OwnerKey is the value of the kuma-sync tag; "" means not ours.
 	OwnerKey string
 }
@@ -170,4 +180,7 @@ type Client interface {
 	// Delete removes an owned monitor. It wraps ErrNotFound for an unknown ID
 	// and ErrNotOwned for a monitor without the kuma-sync tag.
 	Delete(ctx context.Context, id int64) error
+	// DefaultNotifications returns the IDs of all notifications marked
+	// "default enabled" in Kuma, sorted. An empty result is valid.
+	DefaultNotifications(ctx context.Context) ([]int64, error)
 }
@@ -3,6 +3,7 @@ package kumaclient
 import (
 	"context"
 	"fmt"
+	"slices"
 	"sort"
 	"sync"
 )
@@ -20,6 +21,10 @@ type Fake struct {
 	UpdateErr error
 	DeleteErr error
 	ProbeErr  error
+	// NotificationsErr is returned by DefaultNotifications.
+	NotificationsErr error
+	// Defaults are the IDs DefaultNotifications returns.
+	Defaults []int64
 	// ListPartial makes ListOwned return the stored monitors together with
 	// ListErr, as the real client does for owner conflicts.
 	ListPartial bool
@@ -90,6 +95,32 @@ func (f *Fake) Probe(_ context.Context, id int64) (bool, string, error) {
 	return ok, m.OwnerKey, nil
 }

+// SetDefaultNotifications sets the IDs DefaultNotifications returns.
+func (f *Fake) SetDefaultNotifications(ids ...int64) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.Defaults = slices.Clone(ids)
+}
+
+// SetNotificationsErr makes DefaultNotifications return err.
+func (f *Fake) SetNotificationsErr(err error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.NotificationsErr = err
+}
+
+// DefaultNotifications returns Defaults, sorted.
+func (f *Fake) DefaultNotifications(_ context.Context) ([]int64, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.NotificationsErr != nil {
+		return nil, f.NotificationsErr
+	}
+	ids := slices.Clone(f.Defaults)
+	slices.Sort(ids)
+	return ids, nil
+}
+
 func (f *Fake) allocID() int64 {
 	id := f.nextID
 	f.nextID++
@@ -118,6 +118,21 @@ func TestFakeInjectedErrors(t *testing.T) {
 	}
 }

+func TestFakeDefaultNotifications(t *testing.T) {
+	f := NewFake()
+	if ids, err := f.DefaultNotifications(context.Background()); err != nil || ids != nil {
+		t.Fatalf("empty: %v %v", ids, err)
+	}
+	f.SetDefaultNotifications(4, 1)
+	if ids, err := f.DefaultNotifications(context.Background()); err != nil || len(ids) != 2 || ids[0] != 1 || ids[1] != 4 {
+		t.Fatalf("set: %v %v", ids, err)
+	}
+	f.SetNotificationsErr(errors.New("boom"))
+	if _, err := f.DefaultNotifications(context.Background()); err == nil {
+		t.Error("expected injected error")
+	}
+}
+
 func TestFakeUpdateRejectsOtherOwnerKey(t *testing.T) {
 	f := NewFake()
 	id, _ := f.Create(context.Background(), Monitor{Name: "a", OwnerKey: "ns/a"})
@@ -7,6 +7,7 @@ import (
 	"testing"

 	kuma "github.com/breml/go-uptime-kuma-client"
+	"github.com/breml/go-uptime-kuma-client/notification"
 	"github.com/breml/go-uptime-kuma-client/tag"
 )

@@ -167,3 +168,29 @@ func TestFakeStoresNormalized(t *testing.T) {
 		t.Fatalf("fake did not normalize: %+v", got)
 	}
 }
+
+func TestNormalizedNotificationIDs(t *testing.T) {
+	in := Monitor{Type: "group", NotificationIDs: []int64{10, 2, 10}}
+	got := in.Normalized()
+	if !reflect.DeepEqual(got.NotificationIDs, []int64{2, 10}) {
+		t.Errorf("notifications = %v, want [2 10]", got.NotificationIDs)
+	}
+	if !reflect.DeepEqual(in.NotificationIDs, []int64{10, 2, 10}) {
+		t.Errorf("Normalized changed its receiver: %v", in.NotificationIDs)
+	}
+	if e := (Monitor{Type: "group", NotificationIDs: []int64{}}).Normalized(); e.NotificationIDs != nil {
+		t.Errorf("empty notifications must be nil: %v", e.NotificationIDs)
+	}
+}
+
+func TestDefaultIDs(t *testing.T) {
+	got := defaultIDs([]notification.Base{
+		{ID: 5, IsDefault: true}, {ID: 1}, {ID: 3, IsDefault: true},
+	})
+	if !reflect.DeepEqual(got, []int64{3, 5}) {
+		t.Errorf("defaultIDs = %v, want [3 5]", got)
+	}
+	if got := defaultIDs(nil); got != nil {
+		t.Errorf("defaultIDs(nil) = %v, want nil", got)
+	}
+}
@@ -2,7 +2,7 @@
 # domains -> TLS passthrough -> Traefik ClusterIP) from Ingresses carrying the
 # public label. Standard library only, so the image is the interpreter plus one
 # file; runs unprivileged as its own user.
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce

 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY controller.py /opt/controller.py
@@ -974,6 +974,71 @@ data:
          negate: false
          failure_result: false

+      # Hermes Agent dashboard (apps/hermes): its self-hosted OIDC login,
+      # also brokered for Hermes Desktop's native sign-in. Public client +
+      # PKCE (Hermes does not support confidential clients); RS256 so the
+      # dashboard can verify the ID token against the JWKS.
+      - id: hermes-users-group
+        model: authentik_core.group
+        identifiers:
+          name: Hermes Users
+        state: present
+        attrs:
+          is_superuser: false
+          # Members get the agent, which holds a read-only kubeconfig and
+          # the model login. Add/remove members HERE.
+          users:
+            - !Find [authentik_core.user, [username, k.renner]]
+
+      - id: hermes-provider
+        model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: Hermes Dashboard
+        state: present
+        attrs:
+          authentication_flow: null
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: public
+          client_id: hermes-dashboard
+          # See the Matrix (MAS) provider: a blueprint-made provider starts
+          # with no grant types.
+          grant_types:
+            - authorization_code
+            - refresh_token
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+          redirect_uris:
+            - url: https://hermes.renner.uno/auth/callback
+              matching_mode: strict
+
+      # The slug is the issuer path: https://auth.renner.uno/application/o/hermes/
+      - model: authentik_core.application
+        identifiers:
+          slug: hermes
+        state: present
+        attrs:
+          name: Hermes
+          slug: hermes
+          provider: !KeyOf hermes-provider
+          meta_launch_url: https://hermes.renner.uno
+          meta_description: "Hermes Agent dashboard"
+
+      # Only the Hermes Users group passes.
+      - model: authentik_policies.policybinding
+        identifiers:
+          target: !Find [authentik_core.application, [slug, hermes]]
+          group: !KeyOf hermes-users-group
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: false
+
      # OpenProject, decommissioned. Application first: Application.provider
      # is on_delete=PROTECT. Its policy binding cascades with it.
      - model: authentik_core.application
@@ -114,7 +114,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-15-0857 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
+          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-19-0544 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -0,0 +1,80 @@
+You are Hermes Agent, built by Nous Research, running in the owner's homelab Kubernetes cluster (namespace `hermes`). Be direct: match the length of your reply to the weight of the ask — a one-line question gets a one-line answer, and finished work gets a short report of what changed, what's verified, and what's left, never a replay of the process. No filler ("Great question," "I'd be happy to"), no restating the request back, no re-summarizing what you already said, no narrating tool calls the user can see. Plain claims over adjectives; when unsure, say so plainly. Agree because it's right, not because the user said it. Depth is earned — give it when the user asks for detail, teaches, or the stakes demand it, not by default.
+
+When you use a pronoun for someone whose pronouns haven't been stated, use they/them.
+
+# What you can touch
+
+- `kubectl`: read-only cluster access (the `view` ClusterRole, no Secrets). You cannot change the cluster.
+- Monitoring read APIs: Prometheus `http://kube-prometheus-stack-prometheus.monitoring.svc:9090`, Alertmanager `http://kube-prometheus-stack-alertmanager.monitoring.svc:9093`, Loki `http://loki.monitoring.svc:3100`.
+- The homelab wiki through the `homelab-wiki` skill (read, and deposit facts).
+- The web (HTTPS) and LAN hostnames under `renner.uno` through Traefik.
+
+- Gitea (`https://gitea.renner.uno`) as `hermes-bot`: `git` over HTTPS authenticates and sets the commit identity on its own. For the API, send `Authorization: token <contents of /var/run/secrets/gitea/api-token>` (read it inside the command, never print it). `tea` is installed but not logged in; use the REST API (`/api/v1`). You write only to repos where `hermes-bot` is a collaborator.
+
+All state of record lives in git: infrastructure in the `homelab` repo (Kubernetes/Flux, Ansible, OpenTofu, ESPHome), Home Assistant config in the `homeassistant` repo. Changes land as a feature branch plus a PR for the owner's review (see below).
+
+# Ask the wiki first. Always.
+
+Before kubectl, Prometheus, Loki, web search, or answering from your own knowledge, ask the wiki (`homelab-wiki` skill). Every question, every task, every assumption, including ones that look trivially factual or obviously outside its scope. Then proceed with what it returns, including "gap".
+
+- Never fill a wiki gap from training data. Say it isn't covered.
+- Ground every claim through the ladder, in order: wiki → repo → live state (kubectl, metrics, logs) → upstream docs. Never fill a missing rung from recall.
+- When a task uncovers a non-trivial verified fact, mechanism or decision, deposit it as a wiki fact before you're done. Facts only, never hypotheses.
+
+# Verify before you claim
+
+- Verify the exact claim, not an adjacent one: "X works" means you checked X itself (that hostname, that service), not its neighbour.
+- Read live config and resources before speculating about architecture or proposing a fix.
+- The first failure is the diagnostic: read its logs and act on them; don't wait for it to heal.
+- Probe an endpoint (DNS, TCP, HTTP) before telling anyone to point a client at host:port.
+- Never report something missing or broken from an error string alone; check the exact path/resource first.
+- `kubectl` pod AGE is creationTimestamp; it says nothing about when a container last failed. Use `containerStatuses[].lastState.terminated.finishedAt`.
+- "Check the documentation" means the docs site, API reference or man page first; source code only when docs are silent, and say so.
+- Research a third-party component's upstream docs before describing how to configure it; never from recall.
+
+# Design rules of this homelab
+
+Check every proposal against these. If a tool or request contradicts one, name the contradiction instead of designing around it.
+
+- IPv6 first. Design, troubleshoot and list addresses v6-first; IPv4 is legacy compatibility.
+- No IP address is fixed. Addresses are lease state; always resolve the hostname.
+- DHCP is the default; static addressing is bad practice except on the isolated VLANs 47/48. Never suggest DHCP reservations, as fix, workaround or precondition.
+- The cluster never uses external DNS for its own services.
+- The PVE DNS VIP `10.2.40.53` is decommissioned and is never a DNS upstream. The upstream is the UDM.
+- The UDM intercepts DNS: `dig @1.1.1.1` (even against an authoritative server) returns the UDM's split-horizon answer. Use DoH (`https://cloudflare-dns.com/dns-query`, `accept: application/dns-json`) for real public answers.
+- Never pin a workload to a node without a hardware reason (device, GPU, dongle). Not for "stability"; reach for BGP/native routing instead.
+- Never propose `hostNetwork` as a shortcut for source IPs, tcpdump or port binding. An existing hostNetwork pod is never there "for discovery".
+- Control-plane traffic (BGP, leader election, management) never crosses the IoT VLAN.
+- All changes go in git. State that exists only on a PVC or in a UI is drift, not done.
+- Zero-touch or nothing: a deploy that needs a manual step to become usable isn't done.
+- Each service reads only its own `apps/<service>` secrets in OpenBao; sharing a key across services is forbidden.
+- Fix the data, never loosen auth (e.g. a key with a trailing newline gets fixed at the source, not trimmed by the handler).
+- Never fork or patch third-party software, and never pin a Helm chart version; make our config work with current upstream.
+- In-house images are bumped by Flux image automation, not manual tag PRs.
+- Treat every existing service as essential; never propose decommissioning by pattern.
+- NetBird proxy-side auth is not redundant with Authentik.
+- Core infrastructure (e.g. OpenBao) being unavailable is a critical page on first evaluation.
+- nas-1 is RAID 5 + RAID 1; never describe its drives as SMR/shingled.
+
+# When proposing operational changes
+
+- Staged rollouts: apply a multi-target change with no automatic rollback to one target, validate, then broaden. If the first target fails, diagnose it; never roll to more targets to learn more.
+- Drain before reboot; between rolling reboots wait for Ceph `HEALTH_OK`, not just node Ready.
+- `rebuild-k8s` wipes disks; it is disaster recovery only. Never propose it; use `talosctl patch machineconfig`.
+- Never remove OpenTofu state; never use `ansible --limit` (stage with `serial:`); never bypass or loosen a CI pipeline's restrictions.
+- Moving objects between pruned Flux Kustomizations is an outage unless done in two phases (`prune: false` on the giver first).
+- Every change goes through a feature branch and a PR for the owner's review; never a direct push, never force-push, never self-merge.
+- If git history shows a chain of reverts in the area, ask what should change before redoing it.
+
+# How to work with the owner
+
+- Lead with the answer. Skip narrating reasoning and caveat surveys; length is earned by content.
+- Don't overframe: a one-time step is procedure, not a design dilemma with lettered options.
+- After pushback, correct only the sub-claim the evidence invalidates; don't swing to the opposite claim. When you hold evidence for a settled claim, cite it rather than absorbing doubt.
+- Stop after two failed attempts at the same subgoal and say so; announce any pivot away from an agreed plan and wait for confirmation.
+- "Stop doing X" covers the whole category, not just the one artifact. "Clean it up" means only the artifact in context.
+- A restriction the owner removed stays removed.
+- Stay in the assigned scope; don't diagnose neighbouring systems because they appeared in the output.
+- A proposal doc calling an option "recommended" isn't a decision; check it wasn't rejected.
+- Never print, probe or extract secrets or tokens.
+- Comments in config files are one terse factual line; rationale and history belong in the commit message or PR.
@@ -0,0 +1,32 @@
+# Bearer key for the OpenAI-compatible API server (hermes-api.renner.uno).
+# Generated once in-cluster, nothing in OpenBao. Read it with
+#   kubectl -n hermes get secret hermes-api-key -o jsonpath='{.data.API_SERVER_KEY}' | base64 -d
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: hermes-api-key
+  namespace: hermes
+spec:
+  length: 64
+  digits: 16
+  symbols: 0
+  allowRepeat: true
+  noUpper: false
+  secretKeys:
+    - API_SERVER_KEY
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hermes-api-key
+  namespace: hermes
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: hermes-api-key
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: hermes-api-key
@@ -0,0 +1,18 @@
+# Gitea API token of hermes-bot, mounted as a file for git and the API.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hermes-gitea
+  namespace: hermes
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: hermes-gitea
+  data:
+    - secretKey: api-token
+      remoteRef:
+        key: apps/hermes/gitea
+        property: api-token
@@ -0,0 +1,221 @@
+# All Hermes state: config.yaml, .env (keys entered in the dashboard), auth.json
+# (the Anthropic OAuth login), sessions, memories, skills, cron. Mounted at
+# /opt/data, the image's HERMES_HOME.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: hermes-data
+  namespace: hermes
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ceph-block
+  resources:
+    requests:
+      storage: 10Gi
+---
+# Hermes Agent: the gateway (messaging platforms, cron, API server on 8642) and
+# the dashboard (9119, also the Hermes Desktop remote-gateway backend), both
+# supervised by the image's s6-overlay. s6 must be PID 1 and starts as root,
+# remapping and dropping to the `hermes` user (10000).
+#
+# One replica, Recreate: two gateways must never share one data directory.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hermes
+  namespace: hermes
+  labels:
+    app.kubernetes.io/name: hermes
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hermes
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: hermes
+    spec:
+      serviceAccountName: hermes
+      securityContext:
+        fsGroup: 10000
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # The dashboard trusts X-Forwarded-* only from listed peers; Traefik
+        # connects from the pod network. No env equivalent exists, so it is
+        # set in config.yaml on every start (idempotent).
+        - name: config
+          image: gitea.renner.uno/konairius/hermes:build.1792397861 # {"$imagepolicy": "flux-system:hermes"}
+          command:
+            - /opt/hermes/.venv/bin/hermes
+            - config
+            - set
+            - dashboard.trusted_proxies
+            - '["10.244.0.0/16","fd10:244::/48"]'
+          env:
+            - name: HERMES_HOME
+              value: /opt/data
+            - name: HOME
+              value: /opt/data
+          securityContext:
+            runAsUser: 10000
+            runAsGroup: 10000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: data
+              mountPath: /opt/data
+        # Skills from git (ConfigMap hermes-skills) beside the PVC's skills/.
+        - name: skills-config
+          image: gitea.renner.uno/konairius/hermes:build.1792397861 # {"$imagepolicy": "flux-system:hermes"}
+          command:
+            - /opt/hermes/.venv/bin/hermes
+            - config
+            - set
+            - skills.external_dirs
+            - '["/opt/hermes-skills"]'
+          env:
+            - name: HERMES_HOME
+              value: /opt/data
+            - name: HOME
+              value: /opt/data
+          securityContext:
+            runAsUser: 10000
+            runAsGroup: 10000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: data
+              mountPath: /opt/data
+      containers:
+        - name: hermes
+          image: gitea.renner.uno/konairius/hermes:build.1792397861 # {"$imagepolicy": "flux-system:hermes"}
+          args: ["gateway", "run"]
+          env:
+            - name: HERMES_DASHBOARD
+              value: "1"
+            - name: HERMES_DASHBOARD_PUBLIC_URL
+              value: https://hermes.renner.uno
+            # Dashboard login: Authentik OIDC, public PKCE client (blueprint
+            # in apps/authentik/blueprints-configmap.yaml, group Hermes Users).
+            - name: HERMES_DASHBOARD_OIDC_ISSUER
+              value: https://auth.renner.uno/application/o/hermes/
+            - name: HERMES_DASHBOARD_OIDC_CLIENT_ID
+              value: hermes-dashboard
+            - name: API_SERVER_ENABLED
+              value: "true"
+            - name: API_SERVER_HOST
+              value: 0.0.0.0
+            # git as hermes-bot: the credential helper reads the mounted token.
+            - name: GIT_CONFIG_COUNT
+              value: "3"
+            - name: GIT_CONFIG_KEY_0
+              value: credential.https://gitea.renner.uno.helper
+            - name: GIT_CONFIG_VALUE_0
+              value: '!f() { test "$1" = get && echo username=hermes-bot && echo "password=$(cat /var/run/secrets/gitea/api-token)"; }; f'
+            - name: GIT_CONFIG_KEY_1
+              value: user.name
+            - name: GIT_CONFIG_VALUE_1
+              value: hermes-bot
+            - name: GIT_CONFIG_KEY_2
+              value: user.email
+            - name: GIT_CONFIG_VALUE_2
+              value: hermes-bot@konstantin-renner.de
+          envFrom:
+            - secretRef:
+                name: hermes-api-key
+          ports:
+            - name: dashboard
+              containerPort: 9119
+            - name: api
+              containerPort: 8642
+          # The dashboard is the user-facing surface; /api/status is public.
+          startupProbe:
+            httpGet:
+              path: /api/status
+              port: dashboard
+            periodSeconds: 10
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /api/status
+              port: dashboard
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /api/status
+              port: dashboard
+            periodSeconds: 60
+            timeoutSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              memory: 4Gi
+          volumeMounts:
+            - name: data
+              mountPath: /opt/data
+            # Identity and house rules from git (SOUL.md beside this file).
+            - name: soul
+              mountPath: /opt/data/SOUL.md
+              subPath: SOUL.md
+              readOnly: true
+            - name: skills
+              mountPath: /opt/hermes-skills
+              readOnly: true
+            - name: wiki-key
+              mountPath: /var/run/secrets/wiki
+              readOnly: true
+            - name: gitea-token
+              mountPath: /var/run/secrets/gitea
+              readOnly: true
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: hermes-data
+        - name: soul
+          configMap:
+            name: hermes-soul
+        - name: skills
+          configMap:
+            name: hermes-skills
+            items:
+              - key: homelab-wiki-SKILL.md
+                path: homelab-wiki/SKILL.md
+              - key: homelab-wiki-wiki.py
+                path: homelab-wiki/scripts/wiki.py
+        - name: wiki-key
+          secret:
+            secretName: hermes-wiki
+            optional: true
+        - name: gitea-token
+          secret:
+            secretName: hermes-gitea
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes
+  namespace: hermes
+  labels:
+    app.kubernetes.io/name: hermes
+spec:
+  selector:
+    app.kubernetes.io/name: hermes
+  ports:
+    - name: dashboard
+      port: 9119
+      targetPort: dashboard
+    - name: api
+      port: 8642
+      targetPort: api
@@ -0,0 +1,59 @@
+# Both hosts are LAN-only (no dns.renner.uno/public or netbird.renner.uno/public
+# label).
+#
+# hermes.renner.uno — dashboard and Hermes Desktop remote gateway. Plain
+# Traefik, not the authentik-gate class: Hermes Desktop calls the API with a
+# Bearer token from its native (PKCE) sign-in, which a forward-auth gate would
+# redirect. Authentik still guards it: the dashboard's own OIDC login against
+# the `hermes` application, restricted to the Hermes Users group.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hermes
+  namespace: hermes
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - hermes.renner.uno
+      secretName: hermes-tls
+  rules:
+    - host: hermes.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: hermes
+                port:
+                  number: 9119
+---
+# hermes-api.renner.uno — the OpenAI-compatible API server. Hermes checks
+# `Authorization: Bearer <API_SERVER_KEY>` itself (secret hermes-api-key).
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hermes-api
+  namespace: hermes
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - hermes-api.renner.uno
+      secretName: hermes-api-tls
+  rules:
+    - host: hermes-api.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: hermes
+                port:
+                  number: 8642
@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - rbac.yaml
+  - api-key.yaml
+  - wiki-externalsecret.yaml
+  - gitea-externalsecret.yaml
+  - hermes.yaml
+  - ingress.yaml
+configMapGenerator:
+  - name: hermes-soul
+    namespace: hermes
+    files:
+      - SOUL.md
+  - name: hermes-skills
+    namespace: hermes
+    files:
+      - homelab-wiki-SKILL.md=skills/homelab-wiki/SKILL.md
+      - homelab-wiki-wiki.py=skills/homelab-wiki/scripts/wiki.py
@@ -0,0 +1,22 @@
+# Read-only cluster access for the agent's kubectl, as for claude-workstation:
+# the built-in `view` ClusterRole, which excludes Secrets. The token is the
+# pod's projected ServiceAccount token; kubectl picks it up as in-cluster
+# config.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: hermes
+  namespace: hermes
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: hermes-view
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: view
+subjects:
+  - kind: ServiceAccount
+    name: hermes
+    namespace: hermes
@@ -0,0 +1,49 @@
+---
+name: homelab-wiki
+description: Ask and extend the homelab wiki, the owner's long-term knowledge base (services, hosts, network, past incidents, decisions, tool quirks). Use FIRST for every question, task or assumption about the homelab, before kubectl, Prometheus, Loki, web search or answering from memory; and to deposit verified findings.
+version: 1.0.0
+metadata:
+  hermes:
+    tags: [homelab, knowledge, wiki]
+    category: research
+---
+
+# Homelab wiki
+
+The wiki service (`http://wiki.ai.svc.cluster.local:8080`) owns the whole pipeline:
+raw sources → distilled notes. Talk to it only through
+`/opt/hermes-skills/homelab-wiki/scripts/wiki.py` (Python stdlib; it reads the API key itself, never print it):
+
+```
+python3 /opt/hermes-skills/homelab-wiki/scripts/wiki.py question "<one self-contained question>"
+python3 /opt/hermes-skills/homelab-wiki/scripts/wiki.py search "<query>" [limit]
+python3 /opt/hermes-skills/homelab-wiki/scripts/wiki.py note <slug>
+python3 /opt/hermes-skills/homelab-wiki/scripts/wiki.py fact --title "<title>" --source "<where it came from>" [--tag X] [--observed 2026-10-19T08:00:00Z] <<'EOF'
+<content, ≥40 characters>
+EOF
+```
+
+## Reading
+
+- One question per `question` call; mixed questions degrade every answer.
+- `covered` ≥ 0.7: trust the answer. 0.4–0.7: partial; use what the evidence
+  supports and say what is missing. Below 0.4 or `gap` set: the wiki does not
+  know. Say so; never fill the gap from training data.
+- Cite the `[[slug]]`s when relaying facts. Preserve disagreement the wiki
+  surfaces; don't silently pick a winner.
+- `search` + `note` when evidence is cut off or points at another note. Exact
+  identifiers (hostnames, error strings, commit hashes) work as queries.
+- Answers may come back in German; relay them in the user's language.
+
+## Writing
+
+- Deposit with `fact` when a task uncovered a non-trivial, verified fact,
+  mechanism or decision rationale. The service distills it into notes.
+- Facts only: observed state, command output, quoted docs, decisions the owner
+  stated. No hypotheses, suspicions or same-session interpretations that have
+  not survived challenge.
+- `--source` names the evidence (command, URL, file@commit, "owner, Matrix
+  2026-10-19").
+- To correct a wrong note, deposit the verified correction with its evidence;
+  there is no edit endpoint.
+- Never put secrets in a fact.
@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Client for the homelab wiki service (in-cluster, API key auth).
+
+  wiki.py question "<question>"         answer with evidence and a coverage gate
+  wiki.py search "<query>" [limit]       ranked slugs + titles
+  wiki.py note <slug>                    full note
+  wiki.py fact --title T --source S [--tag X]... [--observed ISO] < content
+                                         deposit a raw source (the service distills it)
+"""
+import argparse
+import json
+import os
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+
+URL = os.environ.get("WIKI_URL", "http://wiki.ai.svc.cluster.local:8080")
+KEY_FILE = os.environ.get("WIKI_API_KEY_FILE", "/var/run/secrets/wiki/api-key")
+KEY = open(KEY_FILE).read().strip() if os.path.exists(KEY_FILE) else ""
+
+
+def call(method, path, body=None):
+    headers = {"Accept": "application/json"}
+    if KEY:
+        headers["X-Api-Key"] = KEY
+    data = None
+    if body is not None:
+        data = json.dumps(body).encode()
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(URL + path, data=data, headers=headers, method=method)
+    try:
+        with urllib.request.urlopen(req, timeout=120) as resp:
+            return json.load(resp)
+    except urllib.error.HTTPError as e:
+        sys.exit(f"wiki: HTTP {e.code}\n{e.read().decode(errors='replace')}")
+
+
+def main():
+    p = argparse.ArgumentParser(prog="wiki.py")
+    sub = p.add_subparsers(dest="cmd", required=True)
+    q = sub.add_parser("question")
+    q.add_argument("question")
+    s = sub.add_parser("search")
+    s.add_argument("query")
+    s.add_argument("limit", nargs="?", type=int, default=10)
+    n = sub.add_parser("note")
+    n.add_argument("slug")
+    f = sub.add_parser("fact")
+    f.add_argument("--title", required=True)
+    f.add_argument("--source", required=True)
+    f.add_argument("--tag", action="append", default=[])
+    f.add_argument("--observed")
+    a = p.parse_args()
+
+    if a.cmd == "question":
+        r = call("POST", "/api/v1/questions", {"question": a.question, "save": False})
+        out = {k: r.get(k) for k in ("answer", "gap", "covered")}
+        out["evidence"] = [{k: e.get(k) for k in ("slug", "heading", "text")} for e in r.get("evidence") or []]
+        print(json.dumps(out, indent=2, ensure_ascii=False))
+    elif a.cmd == "search":
+        qs = urllib.parse.urlencode({"q": a.query, "limit": a.limit})
+        for hit in call("GET", f"/api/v1/notes?{qs}"):
+            print(f"{str(hit['score'])[:5]}  {hit['slug']}  — {hit['title']}")
+    elif a.cmd == "note":
+        r = call("GET", "/api/v1/notes/" + urllib.parse.quote(a.slug, safe=""))
+        print(f"slug: {r['slug']}  updated: {r.get('updated')}")
+        print("sources:\n" + "\n".join("  - " + s["text"] for s in r.get("sources") or []))
+        print("related: " + ", ".join(r.get("related") or []))
+        print("backlinks: " + ", ".join(sorted({b["fromSlug"] for b in r.get("backlinks") or []})))
+        print()
+        print(r.get("body", ""))
+    elif a.cmd == "fact":
+        if not KEY:
+            sys.exit(f"wiki: fact needs the API key at {KEY_FILE}")
+        content = sys.stdin.read()
+        if len(content) < 40:
+            sys.exit("wiki: content must be at least 40 characters (service rule)")
+        body = {"title": a.title, "source": a.source, "kind": "fact", "content": content, "tags": a.tag}
+        if a.observed:
+            body["observed_at"] = a.observed
+        r = call("POST", "/api/v1/facts", body)
+        print(f"stored {r['path']} (commit {r['commit'][:8]}, by {r['capturedBy']})")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,19 @@
+# Hermes's wiki API key (identity `hermes`); the wiki's copy is
+# apps/ai/wiki-api-key-hermes.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hermes-wiki
+  namespace: hermes
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: hermes-wiki
+  data:
+    - secretKey: api-key
+      remoteRef:
+        key: apps/hermes/wiki
+        property: api_key
@@ -61,7 +61,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: shelly-manager
-          image: gitea.renner.uno/k.renner/shelly-manager:build.1791777553 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/k.renner/shelly-manager:build.1792387459 # {"$imagepolicy": "flux-system:shelly-manager"}
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
@@ -159,7 +159,7 @@ spec:
        # substitution to POD_IP so nginx-runtime variables like $host
        # / $http_x_forwarded_for in the template stay intact.
        - name: proxy
-          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b9241c6e7b8e9a862f129d8d4199ab64b10390949a78bdd5603379b32c844083
+          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:378d0c32f6562f7fd9629170797f57d2b953aa09be983b3daaf4809bb039ca00
          env:
            - name: POD_IP
              valueFrom:
@@ -203,7 +203,7 @@ spec:
        # readiness probe on purpose: a broker outage must not take HA out of
        # its Service endpoints.
        - name: mqtt-tls
-          image: ghostunnel/ghostunnel:v1.11.3@sha256:2599b8a04bae16d70a4209495618dea61b46a00a9a05fcf74da282688ad3517f
+          image: ghostunnel/ghostunnel:v1.11.4@sha256:e5248233863aadd36383a11c92360f2981141881ef05e38360a6ada8630d36b1
          args:
            - client
            - --listen=127.0.0.1:11883
@@ -304,7 +304,7 @@ spec:
        # dedicated long-lived token.
        # Runs as root to match HA's root-owned /config files. See config-sync.sh.
        - name: config-sync
-          image: alpine/git:2.54.0@sha256:ce84fd6a057b4dc5cf5009da2dd832f1c6d096c1984bf50496cf3c256402264d
+          image: alpine/git:2.54.0@sha256:03228d7ded483b0b3e55e1de7fa660d70d3e1bb432fa7021d29e192640de11aa
          command: ["/bin/sh", "/scripts/sync.sh"]
          env:
            - name: SYNC_BRANCH
@@ -1,4 +1,3 @@
---
 # kuma-sync: KumaMonitor -> Uptime Kuma monitors on kuma.renner.uno (ci/images/kuma-sync).
 apiVersion: apps/v1
 kind: Deployment
@@ -31,7 +30,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-19-0545 # {"$imagepolicy": "flux-system:kuma-sync"}
+          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-19-0646 # {"$imagepolicy": "flux-system:kuma-sync"}
          env:
            - name: KUMA_URL
              value: https://kuma.renner.uno
@@ -5,3 +5,4 @@ resources:
  - externalsecret.yaml
  - rbac.yaml
  - deployment.yaml
+  - monitors
@@ -0,0 +1,53 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: audiobooks
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Audiobooks
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: audiobooks-health
+  namespace: kuma-sync
+spec:
+  type: keyword
+  displayName: Audiobookshelf Health
+  parentRef:
+    name: audiobooks
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    url: https://audiobooks.renner.uno/healthcheck
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: OK
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: audiobooks-status
+  namespace: kuma-sync
+spec:
+  type: json-query
+  displayName: Audiobookshelf Server
+  parentRef:
+    name: audiobooks
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    # initialized-server flag from the unauthenticated status endpoint
+    url: https://audiobooks.renner.uno/status
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  jsonQuery:
+    expression: isInit
+    operator: ==
+    expected: "true"
@@ -0,0 +1,48 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: auth
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Authentik
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: auth-live
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: Authentik Live
+  parentRef:
+    name: auth
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    # ungated health endpoint, empty body
+    url: https://auth.renner.uno/-/health/live/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: auth-ready
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: Authentik Ready
+  parentRef:
+    name: auth
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    # ungated readiness endpoint (database and cache), empty body
+    url: https://auth.renner.uno/-/health/ready/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
@@ -0,0 +1,30 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: docs
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Documents
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: docs-gate
+  namespace: kuma-sync
+spec:
+  type: keyword
+  displayName: Documents Login
+  parentRef:
+    name: docs
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 20
+  http:
+    # Paperless is fully behind the Authentik gate; asserts the login page the redirect chain ends on
+    url: https://docs.renner.uno/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: <title>authentik</title>
@@ -0,0 +1,53 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: home
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Home Assistant
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: home-api
+  namespace: kuma-sync
+spec:
+  type: json-query
+  displayName: Home Assistant API
+  parentRef:
+    name: home
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    # unauthenticated login-provider list, served by the HA core backend
+    url: https://home.renner.uno/auth/providers
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  jsonQuery:
+    expression: providers[type="homeassistant"].name
+    operator: ==
+    expected: Home Assistant Local
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: home-web
+  namespace: kuma-sync
+spec:
+  type: keyword
+  displayName: Home Assistant Web
+  parentRef:
+    name: home
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    url: https://home.renner.uno/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: <title>Home Assistant</title>
@@ -0,0 +1,31 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: immich
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Immich
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: immich-api
+  namespace: kuma-sync
+spec:
+  type: json-query
+  displayName: Immich API
+  parentRef:
+    name: immich
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    url: https://immich.renner.uno/api/server/ping
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  jsonQuery:
+    expression: res
+    operator: ==
+    expected: pong
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - renner-uno.yaml
+  - home.yaml
+  - immich.yaml
+  - auth.yaml
+  - docs.yaml
+  - audiobooks.yaml
+  - third-party.yaml
@@ -0,0 +1,51 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: renner-uno
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Renner.uno Website
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: renner-uno-www
+  namespace: kuma-sync
+spec:
+  type: keyword
+  displayName: www.renner.uno
+  parentRef:
+    name: renner-uno
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    url: https://www.renner.uno/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: Familie Renner
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: renner-uno-apex
+  namespace: kuma-sync
+spec:
+  type: keyword
+  displayName: renner.uno
+  parentRef:
+    name: renner-uno
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    # 301 to www, followed
+    url: https://renner.uno/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: Familie Renner
@@ -0,0 +1,87 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: third-party
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Third-party
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: mcb-portal
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: MCB Portal
+  parentRef:
+    name: third-party
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 15
+  http:
+    # root 302s to / to set a session cookie; Kuma keeps no cookies, so do not follow
+    url: https://portal.multi-circuit-boards.eu/
+    acceptedStatusCodes: ["200-299", "302"]
+    maxRedirects: 0
+    expiryNotification: true
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: mcb-tech
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: MCB Technician Portal
+  parentRef:
+    name: third-party
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 15
+  http:
+    url: https://tech.multi-circuit-boards.eu/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: mcb-www
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: MCB Website
+  parentRef:
+    name: third-party
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 15
+  http:
+    # 301 to /index.html, followed
+    url: https://www.multi-circuit-boards.eu/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: turm1388
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: Wohnen im Turm
+  parentRef:
+    name: third-party
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 15
+  http:
+    url: https://turm1388.de/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
@@ -18,6 +18,7 @@ resources:
  - prometheusrule-netbird-availability.yaml
  - prometheusrule-netbird-ingress.yaml
  - prometheusrule-openbao.yaml
+  - prometheusrule-uptime-kuma.yaml
  # Prometheus's own retention. Until REN-107 `retention: 90d` and
  # `retentionSize: 30GB` were both set, the size cap bound first, and the
  # effective window was a 20.5-27.2 day saw-tooth with nothing reporting it.
@@ -44,6 +44,8 @@ spec:
        # traverses the WAN and detects a controller/DC outage (the
        # 2026-07-24 one ran ~20 h with no signal). Dashboard root, 200.
        - https://netbird.renner.uno
+        # Dead-man probe for the off-site Uptime Kuma.
+        - https://kuma.renner.uno
        # NetBird relay health endpoints on the netcup members (relay
        # binary serves :9000/health, verified on 0.73.2). Plain http,
        # ports outside the hairpin's 80/443 — real WAN path.
@@ -26,6 +26,7 @@ spec:
        #   proxy-1/2:9000/health         same file, relay redundancy
        #   ci.renner.uno                 WoodpeckerDown
        #   openbao .../sys/health        OpenBaoUnavailable
+        #   kuma.renner.uno               UptimeKumaUnreachable
        #
        # Warning, not critical, on purpose: this rule cannot know what a given
        # target means. A target whose loss deserves a critical page gets its
@@ -33,7 +34,7 @@ spec:
        # exclusion list from being arbitrary.
        # anchor: blackbox-probe-failing
        - alert: BlackboxProbeFailing
-          expr: probe_success{job="blackbox-http", instance!~"https://fsn1\\.your-objectstorage\\.com|https://netbird\\.renner\\.uno|http://proxy-[12]\\.renner\\.uno:9000/health|https://ci\\.renner\\.uno|https://openbao\\.renner\\.uno/v1/sys/health.*"} == 0
+          expr: probe_success{job="blackbox-http", instance!~"https://fsn1\\.your-objectstorage\\.com|https://netbird\\.renner\\.uno|http://proxy-[12]\\.renner\\.uno:9000/health|https://ci\\.renner\\.uno|https://kuma\\.renner\\.uno|https://openbao\\.renner\\.uno/v1/sys/health.*"} == 0
          for: 10m
          annotations:
            summary: "Blackbox probe of {{ $labels.instance }} has been failing for 10 minutes"
@@ -0,0 +1,35 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: uptime-kuma
+  namespace: monitoring
+  labels:
+    # kube-prometheus-stack's Prometheus selects on this label.
+    release: kube-prometheus-stack
+spec:
+  groups:
+    - name: uptime-kuma.rules
+      rules:
+        # Dead-man probe for the off-site Uptime Kuma.
+        - alert: UptimeKumaUnreachable
+          expr: probe_success{job="blackbox-http", instance="https://kuma.renner.uno"} == 0
+          for: 10m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Uptime Kuma (kuma.renner.uno) unreachable for 10m+"
+            description: "The blackbox probe of the off-site Uptime Kuma has been failing for 10 minutes. The external endpoints it monitors are unwatched until it returns. Check the NetBird VPS (netbird.renner.uno), the uptime-kuma container and Traefik."
+
+        # monitor_response_time is ms; -1 when a beat has no ping (DOWN, group).
+        # anchor: uptime-kuma-slow-response
+        - alert: UptimeKumaSlowResponse
+          expr: avg by (monitor_name) (avg_over_time((monitor_response_time > 0)[15m:1m])) > 1500
+          for: 15m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Uptime Kuma monitor {{ $labels.monitor_name }} averaging {{ $value | humanize }} ms response time"
+            description: >-
+              The average response time of monitor {{ $labels.monitor_name }},
+              as measured from the off-site Uptime Kuma, has stayed above
+              1500 ms for 15 minutes.
@@ -32,6 +32,7 @@ retired the depth rule in favour of one persistence rule (`> 5` for `20m`).
 | `ceph_test.yaml` | Hand-written suite for the `CephPoolLostRedundancyBlind` canary in `prometheusrule-ceph.yaml` (REN-93). |
 | `disk-wear_test.yaml` | Hand-written suite for the EPHEMERAL exclusion in `prometheusrule-disk-wear.yaml` (REN-419). |
 | `gitea_test.yaml` | Hand-written suite for `GiteaDataVolumeLow` in `prometheusrule-gitea.yaml` (REN-583). |
+| `uptime-kuma_test.yaml` | Hand-written suite for `prometheusrule-uptime-kuma.yaml` and the kuma exclusion in `prometheusrule-blackbox.yaml`. |
 | `mutations.txt` | Negative controls. Each must make the suite fail. |

 ## Adding a suite
@@ -172,3 +172,12 @@ disk-wear-ephemeral-keeps-partition|kubernetes/apps/monitoring-rules/prometheusr
 # exactly-25% case in gitea_test.yaml.
 gitea-for-10m|kubernetes/apps/monitoring-rules/prometheusrule-gitea.yaml|/alert: GiteaDataVolumeLow/,/for:/s/for: 15m/for: 10m/
 gitea-floor-le|kubernetes/apps/monitoring-rules/prometheusrule-gitea.yaml|s/^\([[:space:]]*\)< 0\.25$/\1<= 0.25/
+
+# prometheusrule-uptime-kuma.yaml / blackbox kuma exclusion. Detected by the
+# cases in uptime-kuma_test.yaml.
+kuma-slow-no-positive-filter|kubernetes/apps/monitoring-rules/prometheusrule-uptime-kuma.yaml|s/(monitor_response_time > 0)/(monitor_response_time)/
+kuma-slow-threshold-2500|kubernetes/apps/monitoring-rules/prometheusrule-uptime-kuma.yaml|s/\[15m:1m\])) > 1500$/[15m:1m])) > 2500/
+kuma-slow-threshold-900|kubernetes/apps/monitoring-rules/prometheusrule-uptime-kuma.yaml|s/\[15m:1m\])) > 1500$/[15m:1m])) > 900/
+kuma-slow-for-30m|kubernetes/apps/monitoring-rules/prometheusrule-uptime-kuma.yaml|/alert: UptimeKumaSlowResponse/,/for:/s/for: 15m/for: 30m/
+kuma-down-for-20m|kubernetes/apps/monitoring-rules/prometheusrule-uptime-kuma.yaml|/alert: UptimeKumaUnreachable/,/for:/s/for: 10m/for: 20m/
+kuma-blackbox-exclusion-dropped|kubernetes/apps/monitoring-rules/prometheusrule-blackbox.yaml|s/kuma\\\\\.renner/kumx\\\\.renner/
@@ -0,0 +1,110 @@
+# Suite for prometheusrule-uptime-kuma.yaml and the kuma exclusion in
+# prometheusrule-blackbox.yaml.
+rule_files:
+  - ../prometheusrule-uptime-kuma.yaml
+  - ../prometheusrule-blackbox.yaml
+
+evaluation_interval: 1m
+
+tests:
+  # 2000 ms sustained: pending at 0m, fires 15m later, not before.
+  - interval: 1m
+    input_series:
+      - series: 'monitor_response_time{monitor_name="slow-mon"}'
+        values: '2000+0x40'
+    alert_rule_test:
+      - eval_time: 14m
+        alertname: UptimeKumaSlowResponse
+        exp_alerts: []
+      - eval_time: 16m
+        alertname: UptimeKumaSlowResponse
+        exp_alerts:
+          - exp_labels:
+              severity: warning
+              monitor_name: slow-mon
+            exp_annotations:
+              summary: "Uptime Kuma monitor slow-mon averaging 2k ms response time"
+              description: "The average response time of monitor slow-mon, as measured from the off-site Uptime Kuma, has stayed above 1500 ms for 15 minutes."
+
+  # 1000 ms stays silent; a monitor reporting only -1 (DOWN, group) stays silent.
+  - interval: 1m
+    input_series:
+      - series: 'monitor_response_time{monitor_name="fast-mon"}'
+        values: '1000+0x40'
+      - series: 'monitor_response_time{monitor_name="down-mon"}'
+        values: '-1+0x40'
+    alert_rule_test:
+      - eval_time: 35m
+        alertname: UptimeKumaSlowResponse
+        exp_alerts: []
+
+  # Alternating 1000 and -1: the -1 samples must not drag a slow average down
+  # nor count as slow; positives average 1000, silent.
+  - interval: 1m
+    input_series:
+      - series: 'monitor_response_time{monitor_name="flap-fast"}'
+        values: '1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1 1000 -1'
+    alert_rule_test:
+      - eval_time: 35m
+        alertname: UptimeKumaSlowResponse
+        exp_alerts: []
+
+  # Alternating 2000 and -1: the -1 samples are excluded, so the average of the
+  # real samples is 2000 and the alert fires. Unfiltered, the mean is ~500.
+  - interval: 1m
+    input_series:
+      - series: 'monitor_response_time{monitor_name="flap-slow"}'
+        values: '2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1 2000 -1'
+    alert_rule_test:
+      - eval_time: 35m
+        alertname: UptimeKumaSlowResponse
+        exp_alerts:
+          - exp_labels:
+              severity: warning
+              monitor_name: flap-slow
+            exp_annotations:
+              summary: "Uptime Kuma monitor flap-slow averaging 2k ms response time"
+              description: "The average response time of monitor flap-slow, as measured from the off-site Uptime Kuma, has stayed above 1500 ms for 15 minutes."
+
+  # Dead-man probe: critical after 10m of failure; the catch-all warning must
+  # not also fire for kuma, but still fires for another failing instance.
+  - interval: 1m
+    input_series:
+      - series: 'probe_success{job="blackbox-http",instance="https://kuma.renner.uno"}'
+        values: '0+0x40'
+      - series: 'probe_success{job="blackbox-http",instance="https://other.renner.uno"}'
+        values: '0+0x40'
+    alert_rule_test:
+      - eval_time: 9m
+        alertname: UptimeKumaUnreachable
+        exp_alerts: []
+      - eval_time: 11m
+        alertname: UptimeKumaUnreachable
+        exp_alerts:
+          - exp_labels:
+              severity: critical
+              job: blackbox-http
+              instance: https://kuma.renner.uno
+            exp_annotations:
+              summary: "Uptime Kuma (kuma.renner.uno) unreachable for 10m+"
+              description: "The blackbox probe of the off-site Uptime Kuma has been failing for 10 minutes. The external endpoints it monitors are unwatched until it returns. Check the NetBird VPS (netbird.renner.uno), the uptime-kuma container and Traefik."
+      - eval_time: 15m
+        alertname: BlackboxProbeFailing
+        exp_alerts:
+          - exp_labels:
+              severity: warning
+              job: blackbox-http
+              instance: https://other.renner.uno
+            exp_annotations:
+              summary: "Blackbox probe of https://other.renner.uno has been failing for 10 minutes"
+              description: "The endpoint is not answering as expected. For the Authentik-gated hostnames this is a reachability check covering DNS, TLS, Traefik and the gate outpost — it says nothing about the app behind the gate, which the internal /-/healthy probes cover separately."
+
+  # Healthy probe stays silent.
+  - interval: 1m
+    input_series:
+      - series: 'probe_success{job="blackbox-http",instance="https://kuma.renner.uno"}'
+        values: '1+0x40'
+    alert_rule_test:
+      - eval_time: 30m
+        alertname: UptimeKumaUnreachable
+        exp_alerts: []
@@ -97,6 +97,10 @@ spec:
              resources:
                requests:
                  storage: 50Gi
+        # Mounted at /etc/prometheus/secrets/<name>/; see
+        # ./uptime-kuma-metrics-externalsecret.yaml.
+        secrets:
+          - uptime-kuma-metrics
        # Additional scrape targets not covered by ServiceMonitors.
        additionalScrapeConfigs:
          # Gitea exposes /metrics anonymously on its main HTTP port. The
@@ -106,6 +110,16 @@ spec:
            static_configs:
              - targets: ["gitea.gitea.svc.cluster.local:3000"]
            metrics_path: /metrics
+          # Off-site Uptime Kuma. /metrics takes the API key as the basic-auth
+          # password with an empty username.
+          - job_name: uptime-kuma
+            scheme: https
+            metrics_path: /metrics
+            basic_auth:
+              username: ""
+              password_file: /etc/prometheus/secrets/uptime-kuma-metrics/api_key
+            static_configs:
+              - targets: ["kuma.renner.uno:443"]

    # Grafana
    grafana:
@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
  - grafana-oauth-externalsecret.yaml
  - alertmanager-smtp-externalsecret.yaml
+  - uptime-kuma-metrics-externalsecret.yaml
  - helmrelease-prometheus.yaml
  - helmrelease-loki.yaml
  - helmrelease-alloy-syslog.yaml
@@ -0,0 +1,19 @@
+---
+# Uptime Kuma /metrics API key for Prometheus; OpenBao homelab/infrastructure/uptime-kuma-metrics.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: uptime-kuma-metrics
+  namespace: monitoring
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: uptime-kuma-metrics
+  data:
+    - secretKey: api_key
+      remoteRef:
+        key: infrastructure/uptime-kuma-metrics
+        property: api_key
@@ -32,10 +32,10 @@ spec:
          type: RuntimeDefault
      containers:
        - name: review-bot
-          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-18-0706 # {"$imagepolicy": "flux-system:review-bot"}
+          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-19-0540 # {"$imagepolicy": "flux-system:review-bot"}
          env:
            - name: REPOS
-              value: k.renner/homelab,konairius/homeassistant,konairius/authentik-samba-bridge,konairius/shelly-manager
+              value: konairius/homelab,konairius/homeassistant,konairius/authentik-samba-bridge,konairius/shelly-manager
            - name: GITEA_URL
              value: https://gitea.renner.uno
            - name: AGENT_NAME
@@ -24,7 +24,8 @@ spec:
        key: apps/ai/wiki-index
        property: webhook_secret
 ---
-# One API key per machine identity: OpenBao apps/ai/wiki-api-keys, field = name.
+# One API key per machine identity: OpenBao apps/ai/wiki-api-keys, field = name;
+# hermes in apps/ai/wiki-api-key-hermes.
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
@@ -42,6 +43,10 @@ spec:
      remoteRef:
        key: apps/ai/wiki-api-keys
        property: workstation
+    - secretKey: Auth__ApiKeys__hermes
+      remoteRef:
+        key: apps/ai/wiki-api-key-hermes
+        property: api_key
 ---
 # TypeSafe System One key for the judge adapter (Wiki:Judges:Models:typesafe).
 apiVersion: external-secrets.io/v1
@@ -25,7 +25,7 @@ spec:
        fsGroup: 33
      containers:
        - name: wordpress
-          image: wordpress:7.1.3-php8.3-apache@sha256:8ecd8d8e374167ea22235acf30f80d1165b82f07ffa5bcef90c1cad8f7be251f
+          image: wordpress:7.1.3-php8.5-apache@sha256:ce31904fa1e51b73543fa2e35cc8f1747589b2abf48dc747b422749b88b77e9e
          ports:
            - name: http
              containerPort: 80
@@ -11,7 +11,7 @@ spec:
    branch: master
  secretRef:
    name: flux-system
-  url: https://gitea.renner.uno/k.renner/homelab.git
+  url: https://gitea.renner.uno/konairius/homelab.git
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: hermes
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./kubernetes/apps/hermes
+  prune: true
+  wait: true
+  dependsOn:
+    - name: infrastructure
+    - name: infrastructure-crds
@@ -4,7 +4,7 @@ metadata:
  name: gitea-mcp
  namespace: flux-system
 spec:
-  image: docker.gitea.com/gitea-mcp-server
+  image: docker.gitea.com/gitea-mcp-server@sha256:20701c3dcf3b71df384417d04f9f6382205b7f362380b258fb8e4dcf9599091f
  interval: 1h
 ---
 apiVersion: image.toolkit.fluxcd.io/v1
@@ -0,0 +1,24 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: hermes
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/konairius/hermes
+  interval: 10m
+---
+# .woodpecker/hermes-image.yml tags every build `build.<unix-ts>`; latest push wins.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: hermes
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: hermes
+  filterTags:
+    pattern: '^build\.(?P<ts>\d+)$'
+    extract: '$ts'
+  policy:
+    numerical:
+      order: asc
@@ -10,6 +10,7 @@ resources:
  - gatus.yaml
  - gitea-mcp.yaml
  - gotenberg.yaml
+  - hermes.yaml
  - home-assistant.yaml
  - immich.yaml
  - kuma-sync.yaml
@@ -294,3 +294,12 @@ apiVersion: v1
 kind: Namespace
 metadata:
  name: kuma-sync
+---
+# Hermes Agent (kubernetes/apps/hermes). Declared here so it exists before
+# infrastructure-crds applies its CNPs. No pod-security labels: the image's
+# s6-overlay init starts as root and drops to the `hermes` user, which the
+# cluster's default `baseline` enforcement allows.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hermes
@@ -141,8 +141,8 @@ spec:
              protocol: TCP
 ---
 # wiki: Traefik (the machine door wiki-index.renner.uno, BasicAuth with
-# X-Authentik-Username stripped) and Gitea (push webhook) may reach it; the
-# gate outpost (humans, after Authentik) is admitted
+# X-Authentik-Username stripped), Gitea (push webhook) and Hermes Agent (API
+# key) may reach it; the gate outpost (humans, after Authentik) is admitted
 # by the CNP wiki-gate that authentik-gate-sync generates. Gitea and wiki-embed
 # are reached through the namespace egress above; no OpenBao access.
 apiVersion: cilium.io/v2
@@ -162,6 +162,9 @@ spec:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": gitea
            app.kubernetes.io/name: gitea
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+            app.kubernetes.io/name: hermes
      toPorts:
        - ports:
            - port: "8080"
@@ -0,0 +1,146 @@
+---
+# Baseline policy for the `hermes` namespace (Hermes Agent, apps/hermes).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-deny
+  namespace: hermes
+spec:
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+    - fromEntities:
+        - host
+        - remote-node
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    # Every LAN hostname (gitea, home, auth for the dashboard's OIDC
+    # discovery, matrix) via Traefik.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+---
+# The agent itself: model APIs (api.anthropic.com), web tools, messaging
+# platforms, read-only kubectl, and the monitoring read APIs. The matching
+# ingress grant on the monitoring side is monitoring-ns.yaml
+# (monitoring-allow-hermes).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hermes-egress
+  namespace: hermes
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: hermes
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+            - port: "80"
+              protocol: TCP
+    # `kube-apiserver` is its own entity in Cilium; port is the post-DNAT 6443.
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+            app.kubernetes.io/name: prometheus
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+            app.kubernetes.io/name: alertmanager
+      toPorts:
+        - ports:
+            - port: "9093"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+            app.kubernetes.io/name: loki
+      toPorts:
+        - ports:
+            - port: "3100"
+              protocol: TCP
+    # The wiki service API; ingress side is the `wiki` CNP in ai-ns.yaml.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ai
+            app.kubernetes.io/name: wiki
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+---
+# Traefik serves the dashboard (9119) and the OpenAI-compatible API (8642).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hermes-allow-traefik
+  namespace: hermes
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: hermes
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+      toPorts:
+        - ports:
+            - port: "9119"
+              protocol: TCP
+            - port: "8642"
+              protocol: TCP
@@ -34,5 +34,6 @@ resources:
  - uptime-monitor-ns.yaml
  - kuma-sync-ns.yaml
  - renovate-ns.yaml
+  - hermes-ns.yaml
  - allow-cilium-health.yaml
  - kube-system-hubble-relay.yaml
@@ -57,3 +57,30 @@ spec:
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
+---
+# Hermes Agent (hermes ns) reads metrics, alerts and logs: the Prometheus,
+# Alertmanager and Loki HTTP APIs, scoped to those pods and ports.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: monitoring-allow-hermes
+  namespace: monitoring
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values: [prometheus, alertmanager, loki]
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+            app.kubernetes.io/name: hermes
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+            - port: "9093"
+              protocol: TCP
+            - port: "3100"
+              protocol: TCP
@@ -24,7 +24,7 @@ spec:
      # window. The StatefulSet rolls one pod at a time (updateStrategyType
      # below). Undo after a pod has run the new server = restore the
      # snapshot, not a git revert.
-      version: ">=0.30.3 <0.31.0"
+      version: ">=0.30.4 <0.31.0"
      sourceRef:
        kind: HelmRepository
        name: openbao
@@ -1,10 +1,18 @@
 # OpenBao policy: uptime-kuma-vps
-# Read-only on the Uptime Kuma admin credentials; self-renewal for the CI token. NOT applied by Flux.
+# Read on the Uptime Kuma admin and SMTP credentials; read/write on the metrics API key; self-renewal for the CI token. NOT applied by Flux.

 path "homelab/data/infrastructure/uptime-kuma" {
  capabilities = ["read"]
 }

+path "homelab/data/infrastructure/uptime-kuma/smtp" {
+  capabilities = ["read"]
+}
+
+path "homelab/data/infrastructure/uptime-kuma-metrics" {
+  capabilities = ["read", "create", "update"]
+}
+
 path "auth/token/renew-self" {
  capabilities = ["update"]
 }
@@ -112,3 +112,36 @@ spec:
                  memory: 16Mi
                limits:
                  memory: 48Mi
+            - name: sync-woodpecker-konairius
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
+              args: ["woodpecker-secret"]
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: ["ALL"]
+              env:
+                - name: BAO_ADDR
+                  value: http://openbao.openbao.svc.cluster.local:8200
+                - name: BAO_ROLE
+                  value: rotator-claude-oauth
+                - name: BOOTSTRAP_PATH
+                  value: homelab/infrastructure/secret-rotators-bootstrap/woodpecker-bot
+                - name: BAO_PATH
+                  value: homelab/infrastructure/claude
+                - name: BAO_FIELD
+                  value: setup-token
+                - name: WOODPECKER_URL
+                  value: http://woodpecker.woodpecker.svc.cluster.local:8000
+                - name: WOODPECKER_ORG
+                  value: konairius
+                - name: WOODPECKER_SECRET_NAME
+                  value: claude_code_oauth_token
+                - name: WOODPECKER_EVENTS
+                  value: cron,deployment,manual,push,release,tag,pull_request
+              resources:
+                requests:
+                  cpu: 25m
+                  memory: 16Mi
+                limits:
+                  memory: 48Mi
@@ -78,10 +78,10 @@ spec:
                - name: GITEA_URL
                  value: http://gitea.gitea.svc.cluster.local:3000
                - name: GITEA_VERIFY_REPO
-                  value: k.renner/homelab
+                  value: konairius/homelab
                - name: GITEA_SCOPES
                  value: write:repository
-                # Load-bearing: k.renner/homelab is public, so the pull check
+                # Load-bearing: konairius/homelab is public, so the pull check
                # passes for ANY valid token — push (git-receive-pack, needs
                # write) is the only real verification. Pinned explicitly so the
                # safety property is visible here, not just a binary default.
@@ -197,3 +197,36 @@ spec:
                  memory: 16Mi
                limits:
                  memory: 48Mi
+            - name: sync-woodpecker-konairius
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
+              args: ["woodpecker-secret"]
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: ["ALL"]
+              env:
+                - name: BAO_ADDR
+                  value: http://openbao.openbao.svc.cluster.local:8200
+                - name: BAO_ROLE
+                  value: rotator-review-bot
+                - name: BOOTSTRAP_PATH
+                  value: homelab/infrastructure/secret-rotators-bootstrap/woodpecker-bot
+                - name: BAO_PATH
+                  value: homelab/infrastructure/review-bot
+                - name: BAO_FIELD
+                  value: token
+                - name: WOODPECKER_URL
+                  value: http://woodpecker.woodpecker.svc.cluster.local:8000
+                - name: WOODPECKER_ORG
+                  value: konairius
+                - name: WOODPECKER_SECRET_NAME
+                  value: review_bot_token
+                - name: WOODPECKER_EVENTS
+                  value: cron,manual,pull_request
+              resources:
+                requests:
+                  cpu: 25m
+                  memory: 16Mi
+                limits:
+                  memory: 48Mi
@@ -23,6 +23,7 @@ spec:
        - evcc
        - flux-system # flux-system-git-auth: syncs the rotated flux gitea PAT into Flux's git secret
        - gitea # gitea-package-retention token (apps/gitea/package-retention.yaml, REN-1203)
+        - hermes # hermes-wiki (apps/hermes/wiki-externalsecret.yaml)
        - home-assistant
        - immich
        - influxdb
@@ -32,7 +32,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: backup-verify
-              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-15 # {"$imagepolicy": "flux-system:backup-verify"}
+              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-19 # {"$imagepolicy": "flux-system:backup-verify"}
              command: ["bash", "/script/backup-verify.sh"]
              env:
                - name: HOME
@@ -11,7 +11,7 @@ spec:
  restartPolicy: Never
  containers:
    - name: check
-      image: docker.io/nicolaka/netshoot:v0.13
+      image: docker.io/nicolaka/netshoot:v0.13@sha256:a20c2531bf35436ed3766cd6cfe89d352b050ccc4d7005ce6400adf97503da1b
      command:
        - /bin/bash
        - -c
@@ -45,6 +45,7 @@
        "ghcr.io/usetrmnl/terminus",
        "ghcr.io/usetrmnl/trmnl-ha-amd64",
        "gitea.renner.uno/k.renner/shelly-manager",
+        "gitea.renner.uno/konairius/hermes",
        "gitea.renner.uno/konairius/vsftpd",
        "gitea.renner.uno/konairius/wiki",
        "gotenberg/gotenberg",
@@ -215,6 +216,24 @@
        "lscr.io/linuxserver/beets"
      ],
      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<build>\\d+)$"
+    },
+    {
+      "description": "Hermes image (ci/images/hermes): its merge rolls out to the cluster via Flux image automation, so it is not CI-only. One PR of its own.",
+      "matchFileNames": [
+        "ci/images/hermes/**"
+      ],
+      "groupName": "hermes image",
+      "groupSlug": "hermes-image"
+    },
+    {
+      "description": "nousresearch/hermes-agent also carries the retired date-versioned tags (v2026.x), which sort above v0.x.",
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "nousresearch/hermes-agent"
+      ],
+      "allowedVersions": "/^v0\\./"
    }
  ]
 }
@@ -107,7 +107,7 @@ func TestAnthropicResumesAPausedTurnAndTakesTheFinalText(t *testing.T) {
 		messageStream("claude-opus-5-5", "end_turn", block(0, toolUse), block(1, toolResult),
 			textBlock(2, "## Summary\n\nok\n\nVerdict: comment")),
 	}
-	a, err := f.backend().Ask(context.Background(), "claude-opus-5-5", "Review pull request #7 of k.renner/homelab.")
+	a, err := f.backend().Ask(context.Background(), "claude-opus-5-5", "Review pull request #7 of konairius/homelab.")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -204,14 +204,14 @@ func TestSelectorPicksTheBackend(t *testing.T) {
 			f.rev.setReady("anthropic", true)
 			f.rev.selector = &TypeSafe{url: ts.URL, key: "ts-key", model: "jev-latest", http: &http.Client{Timeout: 5 * time.Second}}

-			if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+			if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 				t.Fatal(err)
 			}
 			posted := f.postedReviews()
 			if len(posted) != 1 || !strings.Contains(posted[0]["body"], "model `"+tc.wantModel+"`") {
 				t.Fatalf("want one review by %s, got %v", tc.wantModel, posted)
 			}
-			if pr := state["pull_request"].(map[string]any); pr["title"] != "feat: x" || pr["repository"] != "k.renner/homelab" {
+			if pr := state["pull_request"].(map[string]any); pr["title"] != "feat: x" || pr["repository"] != "konairius/homelab" {
 				t.Errorf("selector state: %v", state)
 			}
 		})
@@ -14,7 +14,7 @@ func noFiles(string) ([]byte, error) { return nil, errors.New("no such file") }
 func baseEnv() map[string]string {
 	return map[string]string{
 		"REVIEW_TOKEN": "t", "WEBHOOK_SECRET": "s", "MISTRAL_API_KEY": "k",
-		"CONNECTOR_ID": "c1", "REPOS": "k.renner/homelab, konairius/shelly-manager",
+		"CONNECTOR_ID": "c1", "REPOS": "konairius/homelab, konairius/shelly-manager",
 	}
 }

@@ -1,4 +1,4 @@
-module gitea.renner.uno/k.renner/homelab/review-bot
+module gitea.renner.uno/konairius/homelab/review-bot

 go 1.27

@@ -14,7 +14,7 @@ func TestBrokenStreamIsAnsweredFromTheHistory(t *testing.T) {
 	  {"type":"message.input","content":"Review pull request #7"},
 	  {"type":"tool.execution","name":"conn_get_file_contents"},
 	  {"type":"message.output","content":"## Summary\n\nfine\n\n## Recommendation\n\nLooks reasonable.\n\nVerdict: comment"}]}`
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	if f.convCalls != 1 || f.historyCalls != 1 || len(f.postedReviews()) != 1 {
@@ -26,7 +26,7 @@ func TestBrokenStreamIsAnsweredFromTheHistory(t *testing.T) {
 func TestBrokenStreamWithoutHistoryIsAskedAgain(t *testing.T) {
 	f := newFixture(t)
 	f.breakStreams = 1
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	if f.convCalls != 2 || f.historyCalls != 2 || len(f.postedReviews()) != 1 {
@@ -37,7 +37,7 @@ func TestBrokenStreamWithoutHistoryIsAskedAgain(t *testing.T) {
 func TestStreamErrorEventIsNotRetried(t *testing.T) {
 	f := newFixture(t)
 	f.streamError = "Failed to generate response."
-	err := f.rev.Review(context.Background(), "k.renner/homelab", 7)
+	err := f.rev.Review(context.Background(), "konairius/homelab", 7)
 	if err == nil || !strings.Contains(err.Error(), "Failed to generate response.") {
 		t.Fatalf("want the stream error, got %v", err)
 	}
@@ -109,22 +109,22 @@ func newFixture(t *testing.T) *fixture {
 		f.mu.Lock()
 		defer f.mu.Unlock()
 		switch {
-		case r.Method == "GET" && r.URL.Path == "/api/v1/repos/k.renner/homelab/pulls/7":
+		case r.Method == "GET" && r.URL.Path == "/api/v1/repos/konairius/homelab/pulls/7":
 			_, _ = io.WriteString(w, prJSON)
-		case r.Method == "GET" && r.URL.Path == "/api/v1/repos/k.renner/homelab/pulls/7/reviews":
+		case r.Method == "GET" && r.URL.Path == "/api/v1/repos/konairius/homelab/pulls/7/reviews":
 			_, _ = io.WriteString(w, f.reviews)
-		case r.Method == "GET" && r.URL.Path == "/api/v1/repos/k.renner/homelab/pulls":
+		case r.Method == "GET" && r.URL.Path == "/api/v1/repos/konairius/homelab/pulls":
 			_, _ = io.WriteString(w, "["+prJSON+"]")
-		case r.Method == "POST" && r.URL.Path == "/api/v1/repos/k.renner/homelab/pulls/7/reviews":
+		case r.Method == "POST" && r.URL.Path == "/api/v1/repos/konairius/homelab/pulls/7/reviews":
 			var in map[string]string
 			_ = json.NewDecoder(r.Body).Decode(&in)
 			f.posted = append(f.posted, in)
 			w.WriteHeader(http.StatusOK)
 			_, _ = io.WriteString(w, `{"html_url":"https://gitea/pr/7#review"}`)
-		case r.Method == "POST" && strings.HasPrefix(r.URL.Path, "/api/v1/repos/k.renner/homelab/statuses/"):
+		case r.Method == "POST" && strings.HasPrefix(r.URL.Path, "/api/v1/repos/konairius/homelab/statuses/"):
 			var in map[string]string
 			_ = json.NewDecoder(r.Body).Decode(&in)
-			in["sha"] = strings.TrimPrefix(r.URL.Path, "/api/v1/repos/k.renner/homelab/statuses/")
+			in["sha"] = strings.TrimPrefix(r.URL.Path, "/api/v1/repos/konairius/homelab/statuses/")
 			f.statuses = append(f.statuses, in)
 			w.WriteHeader(http.StatusCreated)
 			_, _ = io.WriteString(w, "{}")
@@ -152,7 +152,7 @@ func newFixture(t *testing.T) *fixture {
 			var in map[string]any
 			_ = json.NewDecoder(r.Body).Decode(&in)
 			if in["agent_id"] != "ag_1" || in["stream"] != true || in["store"] != true ||
-				!strings.Contains(in["inputs"].(string), "pull request #7 of k.renner/homelab") {
+				!strings.Contains(in["inputs"].(string), "pull request #7 of konairius/homelab") {
 				http.Error(w, "unexpected conversation request", http.StatusBadRequest)
 				return
 			}
@@ -197,7 +197,7 @@ func newFixture(t *testing.T) *fixture {
 		GiteaURL: f.gitea.URL, BotLogin: "review-bot", ReviewToken: "review-token", WebhookSecret: "hook-secret",
 		MistralURL: f.mistral.URL, MistralKey: "mistral-key", AgentName: "pr-review",
 		Models:      []Model{{Backend: "mistral", Name: "mistral-large-4-0"}},
-		ConnectorID: "c1", Repos: []string{"k.renner/homelab"}, Workers: 1, QueueSize: 4,
+		ConnectorID: "c1", Repos: []string{"konairius/homelab"}, Workers: 1, QueueSize: 4,
 		ReviewTimeout: 5 * time.Second, RateLimitRetries: 2, RateLimitWait: time.Millisecond,
 	}
 	f.metrics = newMetrics()
@@ -245,7 +245,7 @@ func (f *fixture) postedReviews() []map[string]string {

 func TestReviewPostsTheCleanedReport(t *testing.T) {
 	f := newFixture(t)
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	got := f.postedReviews()
@@ -272,7 +272,7 @@ func TestReviewPostsTheCleanedReport(t *testing.T) {
 func TestReviewSkipsWhatIsAlreadyReviewed(t *testing.T) {
 	f := newFixture(t)
 	f.reviews = `[{"body":"<!-- pr-review:sha=abc123 -->","user":{"login":"review-bot"}}]`
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	if n := len(f.postedReviews()); n != 0 {
@@ -286,7 +286,7 @@ func TestPendingReviewIsReviewedAgain(t *testing.T) {
 	f := newFixture(t)
 	f.reviews = `[{"body":"<!-- pr-review:sha=abc123 -->","state":"PENDING","user":{"login":"review-bot"}}]`
 	f.answer = `{"outputs":[{"type":"message.output","content":"## Summary\n\nfine\n\n## Recommendation\n\nLooks reasonable.\n\nVerdict: approve"}]}`
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	posted := f.postedReviews()
@@ -299,7 +299,7 @@ func TestReviewRefusesWriteToolsAndPostsNothing(t *testing.T) {
 	f := newFixture(t)
 	f.answer = `{"outputs":[{"type":"tool.execution","name":"conn_create_or_update_file"},
 	  {"type":"message.output","content":"## Summary\n\nx"}]}`
-	err := f.rev.Review(context.Background(), "k.renner/homelab", 7)
+	err := f.rev.Review(context.Background(), "konairius/homelab", 7)
 	if err == nil || !strings.Contains(err.Error(), "conn_create_or_update_file") {
 		t.Fatalf("want an error naming the tool, got %v", err)
 	}
@@ -311,7 +311,7 @@ func TestReviewRefusesWriteToolsAndPostsNothing(t *testing.T) {
 func TestReviewWithoutAReportPostsNothing(t *testing.T) {
 	f := newFixture(t)
 	f.answer = `{"outputs":[{"type":"message.output","content":"I could not do it."}]}`
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err == nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err == nil {
 		t.Fatal("want an error")
 	}
 	if n := len(f.postedReviews()); n != 0 {
@@ -322,7 +322,7 @@ func TestReviewWithoutAReportPostsNothing(t *testing.T) {
 func TestReviewNeedsTheAgent(t *testing.T) {
 	f := newFixture(t)
 	f.rev.setReady("mistral", false)
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err == nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err == nil {
 		t.Fatal("want an error while the agent is not ready")
 	}
 	if f.rev.Ready() {
@@ -333,7 +333,7 @@ func TestReviewNeedsTheAgent(t *testing.T) {
 func TestReviewAsksAgainAfterTheRateLimit(t *testing.T) {
 	f := newFixture(t)
 	f.convStatus = []int{429, 429}
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	if f.convCalls != 3 || len(f.postedReviews()) != 1 {
@@ -348,7 +348,7 @@ func TestReviewHonoursRetryAfter(t *testing.T) {
 	f.rev.cfg.RateLimitWait = 10 * time.Minute
 	f.retryAfter = "0"
 	f.convStatus = []int{429}
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	if f.convCalls != 2 || len(f.postedReviews()) != 1 {
@@ -371,7 +371,7 @@ func TestLimitHeaders(t *testing.T) {
 func TestReviewGivesUpWhenTheRateLimitStays(t *testing.T) {
 	f := newFixture(t)
 	f.convStatus = []int{429, 429, 429, 429}
-	err := f.rev.Review(context.Background(), "k.renner/homelab", 7)
+	err := f.rev.Review(context.Background(), "konairius/homelab", 7)
 	if err == nil || !strings.Contains(err.Error(), "still failing") {
 		t.Fatalf("want a rate limit error, got %v", err)
 	}
@@ -383,7 +383,7 @@ func TestReviewGivesUpWhenTheRateLimitStays(t *testing.T) {
 func TestOtherErrorsAreNotRetried(t *testing.T) {
 	f := newFixture(t)
 	f.convStatus = []int{500}
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err == nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err == nil {
 		t.Fatal("want an error")
 	}
 	if f.convCalls != 1 {
@@ -440,7 +440,7 @@ func (f *fixture) hook(event, signature string, body string) *httptest.ResponseR

 func TestHook(t *testing.T) {
 	f := newFixture(t)
-	body := `{"action":"opened","number":7,"repository":{"full_name":"k.renner/homelab"}}`
+	body := `{"action":"opened","number":7,"repository":{"full_name":"konairius/homelab"}}`
 	good := sign("hook-secret", []byte(body))
 	cases := []struct {
 		name, event, sig, body string
@@ -455,10 +455,10 @@ func TestHook(t *testing.T) {
 			strings.Replace(body, "opened", "closed", 1), 200},
 		{"synchronized", "pull_request", sign("hook-secret", []byte(strings.Replace(body, "opened", "synchronized", 1))),
 			strings.Replace(body, "opened", "synchronized", 1), 202},
-		{"repository that is not configured", "pull_request", sign("hook-secret", []byte(strings.Replace(body, "k.renner/homelab", "x/y", 1))),
-			strings.Replace(body, "k.renner/homelab", "x/y", 1), 200},
-		{"payload without a number", "pull_request", sign("hook-secret", []byte(`{"action":"opened","repository":{"full_name":"k.renner/homelab"}}`)),
-			`{"action":"opened","repository":{"full_name":"k.renner/homelab"}}`, 400},
+		{"repository that is not configured", "pull_request", sign("hook-secret", []byte(strings.Replace(body, "konairius/homelab", "x/y", 1))),
+			strings.Replace(body, "konairius/homelab", "x/y", 1), 200},
+		{"payload without a number", "pull_request", sign("hook-secret", []byte(`{"action":"opened","repository":{"full_name":"konairius/homelab"}}`)),
+			`{"action":"opened","repository":{"full_name":"konairius/homelab"}}`, 400},
 		{"payload that is not json", "pull_request", sign("hook-secret", []byte("nope")), "nope", 400},
 	}
 	for _, c := range cases {
@@ -473,10 +473,10 @@ func TestHook(t *testing.T) {
 func TestQueueRunsAReviewAndDeduplicates(t *testing.T) {
 	f := newFixture(t)
 	q := newQueue(f.rev, 4, f.rev.log, f.metrics)
-	if r := q.Enqueue("k.renner/homelab", 7, "abc123"); r != "queued" {
+	if r := q.Enqueue("konairius/homelab", 7, "abc123"); r != "queued" {
 		t.Fatalf("first enqueue: %s", r)
 	}
-	if r := q.Enqueue("k.renner/homelab", 7, "abc123"); r != "duplicate" {
+	if r := q.Enqueue("konairius/homelab", 7, "abc123"); r != "duplicate" {
 		t.Fatalf("second enqueue of the same PR: %s", r)
 	}
 	q.Start(context.Background(), 1)
@@ -484,7 +484,7 @@ func TestQueueRunsAReviewAndDeduplicates(t *testing.T) {
 	if n := len(f.postedReviews()); n != 1 {
 		t.Errorf("posted %d reviews, want 1", n)
 	}
-	if r := q.Enqueue("k.renner/homelab", 8, ""); r != "full" {
+	if r := q.Enqueue("konairius/homelab", 8, ""); r != "full" {
 		t.Errorf("a stopped queue takes nothing, got %s", r)
 	}
 }
@@ -529,7 +529,7 @@ func TestFirstRetryWaitsTheConfiguredTime(t *testing.T) {
 	f.rev.cfg.RateLimitWait = 300 * time.Millisecond
 	f.convStatus = []int{429}
 	start := time.Now()
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	if got := time.Since(start); got < 250*time.Millisecond {
@@ -566,7 +566,7 @@ func TestReviewOfAFileAboutRateLimitsIsNotDropped(t *testing.T) {
 	f.answer = `{"outputs":[
 	  {"type":"tool.execution","name":"conn_get_file_contents","info":{"result":"var rateLimitText = rate limit handling"}},
 	  {"type":"message.output","content":"## Summary\n\nreviewed\n\n## Recommendation\n\nApprove."}]}`
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	if f.convCalls != 1 || len(f.postedReviews()) != 1 {
@@ -579,7 +579,7 @@ func TestReviewOfAFileAboutRateLimitsIsNotDropped(t *testing.T) {
 func TestReviewDoesNotPostForAStaleHead(t *testing.T) {
 	f := newFixture(t)
 	f.pushAfter = "def456"
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	posted := f.postedReviews()
@@ -595,18 +595,18 @@ func TestReviewDoesNotPostForAStaleHead(t *testing.T) {
 func TestQueueReviewsAgainWhenAskedForDuringTheReview(t *testing.T) {
 	f := newFixture(t)
 	q := newQueue(f.rev, 4, f.rev.log, f.metrics)
-	if r := q.Enqueue("k.renner/homelab", 7, "abc123"); r != "queued" {
+	if r := q.Enqueue("konairius/homelab", 7, "abc123"); r != "queued" {
 		t.Fatalf("enqueue: %s", r)
 	}
 	q.mu.Lock()
-	q.running["k.renner/homelab#7"] = true // as if a worker had picked it up
+	q.running["konairius/homelab#7"] = true // as if a worker had picked it up
 	q.mu.Unlock()
-	if r := q.Enqueue("k.renner/homelab", 7, "abc123"); r != "duplicate" {
+	if r := q.Enqueue("konairius/homelab", 7, "abc123"); r != "duplicate" {
 		t.Fatalf("enqueue while running: %s", r)
 	}
 	q.mu.Lock()
-	again := q.again["k.renner/homelab#7"]
-	delete(q.running, "k.renner/homelab#7")
+	again := q.again["konairius/homelab#7"]
+	delete(q.running, "konairius/homelab#7")
 	q.mu.Unlock()
 	if !again {
 		t.Error("the request during the review was forgotten")
@@ -617,7 +617,7 @@ func TestReviewAsksAgainAfterAGatewayFailure(t *testing.T) {
 	for _, status := range []int{502, 503, 504} {
 		f := newFixture(t)
 		f.convStatus = []int{status}
-		if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+		if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 			t.Fatalf("%d: %v", status, err)
 		}
 		if f.convCalls != 2 || len(f.postedReviews()) != 1 {
@@ -13,10 +13,10 @@ import (
 func TestQueueReportsQueuedRunningAndPosted(t *testing.T) {
 	f := newFixture(t)
 	q := newQueue(f.rev, 4, f.rev.log, f.metrics)
-	if r := q.Enqueue("k.renner/homelab", 7, "abc123"); r != "queued" {
+	if r := q.Enqueue("konairius/homelab", 7, "abc123"); r != "queued" {
 		t.Fatalf("enqueue: %s", r)
 	}
-	if st, _ := f.status.Get("k.renner/homelab", 7); st.Phase != PhaseQueued || st.Position != 1 {
+	if st, _ := f.status.Get("konairius/homelab", 7); st.Phase != PhaseQueued || st.Position != 1 {
 		t.Errorf("before the worker runs: %+v, want queued at position 1", st)
 	}
 	q.Start(context.Background(), 1)
@@ -30,7 +30,7 @@ func TestQueueReportsQueuedRunningAndPosted(t *testing.T) {
 	if got := f.commitStatuses(); !slices.Equal(got, want) {
 		t.Errorf("commit statuses\n got %q\nwant %q", got, want)
 	}
-	st, _ := f.status.Get("k.renner/homelab", 7)
+	st, _ := f.status.Get("konairius/homelab", 7)
 	if st.Phase != PhasePosted || st.URL != "https://gitea/pr/7#review" || st.Head != "abc123" {
 		t.Errorf("after the review: %+v", st)
 	}
@@ -40,7 +40,7 @@ func TestAFailedReviewIsReportedAsAnError(t *testing.T) {
 	f := newFixture(t)
 	f.answer = `{"outputs":[{"type":"message.output","content":"I could not do it."}]}`
 	q := newQueue(f.rev, 4, f.rev.log, f.metrics)
-	q.Enqueue("k.renner/homelab", 7, "abc123")
+	q.Enqueue("konairius/homelab", 7, "abc123")
 	q.Start(context.Background(), 1)
 	q.Stop(5 * time.Second)

@@ -48,7 +48,7 @@ func TestAFailedReviewIsReportedAsAnError(t *testing.T) {
 	if last := got[len(got)-1]; last != "abc123 error: review failed: the agent's answer holds no report" {
 		t.Errorf("last commit status %q", last)
 	}
-	if st, _ := f.status.Get("k.renner/homelab", 7); st.Phase != PhaseFailed || st.Detail != "the agent's answer holds no report" {
+	if st, _ := f.status.Get("konairius/homelab", 7); st.Phase != PhaseFailed || st.Detail != "the agent's answer holds no report" {
 		t.Errorf("after the failure: %+v", st)
 	}
 }
@@ -56,7 +56,7 @@ func TestAFailedReviewIsReportedAsAnError(t *testing.T) {
 func TestARetryIsReported(t *testing.T) {
 	f := newFixture(t)
 	f.convStatus = []int{429}
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	got := f.commitStatuses()
@@ -70,12 +70,12 @@ func TestARetryIsReported(t *testing.T) {
 func TestSkipsResolveTheQueuedStatus(t *testing.T) {
 	f := newFixture(t)
 	f.title = "WIP: x"
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	f.title = "feat: x"
 	f.reviews = `[{"body":"<!-- pr-review:sha=abc123 -->","state":"APPROVED","html_url":"https://gitea/r/1","user":{"login":"review-bot"}}]`
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	want := []string{"abc123 success: skipped: wip", "abc123 success: reviewed: approve"}
@@ -87,7 +87,7 @@ func TestSkipsResolveTheQueuedStatus(t *testing.T) {
 func TestAStaleHeadIsMarkedSuperseded(t *testing.T) {
 	f := newFixture(t)
 	f.pushAfter = "def456"
-	if err := f.rev.Review(context.Background(), "k.renner/homelab", 7); err != nil {
+	if err := f.rev.Review(context.Background(), "konairius/homelab", 7); err != nil {
 		t.Fatal(err)
 	}
 	got := f.commitStatuses()
@@ -101,7 +101,7 @@ func TestStatusEndpoints(t *testing.T) {
 	f := newFixture(t)
 	q := newQueue(f.rev, 4, f.rev.log, f.metrics)
 	s := &Server{cfg: f.cfg, queue: q, reviewer: f.rev, metrics: f.metrics, log: f.rev.log}
-	q.Enqueue("k.renner/homelab", 7, "abc123")
+	q.Enqueue("konairius/homelab", 7, "abc123")
 	get := func(path string) *httptest.ResponseRecorder {
 		rec := httptest.NewRecorder()
 		s.routes().ServeHTTP(rec, httptest.NewRequest("GET", path, nil))
@@ -114,14 +114,14 @@ func TestStatusEndpoints(t *testing.T) {
 		t.Errorf("/status: %d %s", rec.Code, rec.Body)
 	}
 	var one PRStatus
-	if rec := get("/status/k.renner/homelab/7"); rec.Code != 200 || json.Unmarshal(rec.Body.Bytes(), &one) != nil ||
-		one.Repo != "k.renner/homelab" || one.Number != 7 || one.Head != "abc123" {
-		t.Errorf("/status/k.renner/homelab/7: %d %s", rec.Code, rec.Body)
+	if rec := get("/status/konairius/homelab/7"); rec.Code != 200 || json.Unmarshal(rec.Body.Bytes(), &one) != nil ||
+		one.Repo != "konairius/homelab" || one.Number != 7 || one.Head != "abc123" {
+		t.Errorf("/status/konairius/homelab/7: %d %s", rec.Code, rec.Body)
 	}
-	if rec := get("/status/k.renner/homelab/8"); rec.Code != 404 {
+	if rec := get("/status/konairius/homelab/8"); rec.Code != 404 {
 		t.Errorf("untracked PR: %d, want 404", rec.Code)
 	}
-	if rec := get("/status/k.renner/homelab/x"); rec.Code != 400 {
+	if rec := get("/status/konairius/homelab/x"); rec.Code != 400 {
 		t.Errorf("bad number: %d, want 400", rec.Code)
 	}
 }
@@ -130,8 +130,8 @@ func TestFinishedReviewsAreForgottenAfterADay(t *testing.T) {
 	f := newFixture(t)
 	now := time.Now()
 	f.status.now = func() time.Time { return now }
-	f.status.Set("k.renner/homelab", 7, "", PhasePosted, "comment", "")
-	f.status.Set("k.renner/homelab", 8, "", PhaseQueued, "", "")
+	f.status.Set("konairius/homelab", 7, "", PhasePosted, "comment", "")
+	f.status.Set("konairius/homelab", 8, "", PhaseQueued, "", "")
 	now = now.Add(keepFinished + time.Minute)
 	got := f.status.List()
 	if len(got) != 1 || got[0].Number != 8 {