fix(unifi): capture the API response on create only, not on every write

Root cause of the 60 permanently-dirty hairpin NAT rules.

The provider was configured write_returns_object = true, which makes it store
the API response into `data` after POST *and* PUT. The UDM assigns `_id`;
unifi_nat_hairpin.tf's data = jsonencode({...}) never sets it. So every write
put a field into state that the config does not have, and all 60 rules planned
as "will be updated in-place" with `- _id` as the entire diff — re-dirtying
themselves on the next write, indefinitely.

No provider-side ignore can suppress this, because `data` is a configured
attribute and Terraform compares config to state in core, before provider
logic runs. Three were tried and disproven against real plans rather than
argued about:

  ignore_changes_to = ["_id"]                       plan 5661 — 60 remained
  ignore_all_server_changes = true                  plan 5662 — 60 remained
  restapi 3.x + ignore_server_additions = true      plan 5667 — 60 remained,
                                                    plus a new api_data diff

create_returns_object keeps the part the provider genuinely needs — the POST
response is how it learns `_id` for id_attribute = "_id" — while no longer
letting updates rewrite `data` from the response.

This does not clear the existing pollution by itself: state still carries `_id`
in `data` for all 60 rules, so the plan will keep showing them until one apply
rewrites `data` to the configured value. What it changes is that the apply then
sticks, instead of the next write undoing it.

Co-Authored-By: Claude Bot <claude-bot@renner.uno>

.woodpecker/alert-monitor.yml

@@ -42,7 +42,7 @@ when:
 
 steps:
   - name: fetch-alerts
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-05-01
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
     environment:
       SOPS_AGE_KEY:
         from_secret: sops_age_key

.woodpecker/ci-manifests-test.yml

@@ -60,7 +60,7 @@ steps:
   # run that never touched them. Tracked in #461.
   - name: kustomize-build
     depends_on: [] # see note above `steps:`
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-07-30
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
     commands:
       - |
         set -eu
@@ -115,7 +115,7 @@ steps:
   # An earlier revision of this comment also asserted that several deploy-*.yml
   # files emit "Additional property timeout is not allowed" warnings. That was
   # observed under the v3.9.0 CLI this step used to pin, and it is NOT known to
-  # still hold on v3.16.0 — review raised the likelihood that the warning was
+  # still hold on current CLIs — review raised the likelihood that the warning was
   # schema drift in a 7-minor-old CLI rather than real debt in those files, which
   # is one of the reasons this pin moved to latest stable. It cannot be confirmed
   # from a green run either, because the loop below sends lint output to /tmp/out
@@ -123,9 +123,15 @@ steps:
   # The claim is dropped rather than restated: what this step guarantees is the
   # exit-code contract above, which is what the gate actually rests on.
   # Latest stable, per the standing rule that any software uses the latest
-  # stable version. Matching the deployed woodpecker-server (v3.16.0) is a
-  # CONSEQUENCE of that, not a separate requirement — the server is bumped by
-  # image-automation within the 3.x range, so both land on the same release.
+  # stable version. Matching the deployed woodpecker-server is a CONSEQUENCE of
+  # that, not a separate requirement — the server is bumped by image-automation
+  # within the 3.x range, so both should land on the same release.
+  #
+  # They do not land together, though: the server is a Kubernetes manifest and
+  # is bumped automatically, this pipeline file is not and cannot be (see
+  # infrastructure/image-automation/README.md). So the server moves first and
+  # this trails until someone bumps it by hand — which is what happened at
+  # v3.16.0 -> v3.17.0, caught by the update audit (#426) rather than by CI.
   #
   # It matters here because the CLI compiles the config against its own schema:
   # one behind the server can pass a config the server then rejects, or reject
@@ -152,7 +158,7 @@ steps:
   # whenever it trails the deployed server. If you bump the server, bump here.
   - name: woodpecker-lint
     depends_on: [] # see note above `steps:`
-    image: woodpeckerci/woodpecker-cli:v3.16.0-alpine
+    image: woodpeckerci/woodpecker-cli:v3.17.0-alpine
     commands:
       - |
         set -eu
@@ -240,7 +246,7 @@ steps:
   # this step fails permanently on its own documentation.
   - name: no-digest-pins
     depends_on: [] # see note above `steps:`
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-07-30
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
     commands:
       - |
         set -eu

.woodpecker/e2e-test.yml

@@ -4,7 +4,7 @@ when:
 
 steps:
   - name: e2e
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-05-01
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
     environment:
       SOPS_AGE_KEY:
         from_secret: sops_age_key

.woodpecker/e2e.yml

@@ -30,7 +30,7 @@ steps:
       - sh scripts/ci/test-model-selection.sh
 
   - name: e2e-test
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-05-01
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
     environment:
       SOPS_AGE_KEY:
         from_secret: sops_age_key

.woodpecker/issue-fix.yml

@@ -49,7 +49,7 @@ steps:
     # (the issue-pick logic needs jq, which only the ci-claude image has);
     # minting a 1h read-only token per run is cheap. Degrades to
     # snapshot-only if the ci-diagnostics ServiceAccount isn't reconciled.
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-05-01
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
     environment:
       SOPS_AGE_KEY:
         from_secret: sops_age_key

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -1326,7 +1326,121 @@ data:
           name: Caddy docs.renner.uno
         state: absent
 
-  # Passkey-only (WebAuthn) login for selected apps, in two parts:
+      # ---------------------------------------------------------------
+      # wordpress-gate — www.renner.uno
+      #
+      # Unlike every other gate here, this one does NOT front a whole
+      # host. www.renner.uno is a public family blog; only /wp-admin and
+      # /wp-login.php are routed to this outpost (see
+      # kubernetes/apps/wordpress/ingress.yaml). The front end never
+      # touches it.
+      #
+      # The reverse carve-out — gate everything, skip_path_regex the
+      # public parts, as paperless-gate does for /static/ — is not
+      # possible here: the public set is every post URL, so the pattern
+      # would need a negative lookahead and the outpost's RE2 has none.
+      - id: wordpress-authors-group
+        model: authentik_core.group
+        identifiers:
+          name: WordPress Authors
+        state: present
+        attrs:
+          is_superuser: false
+          # Git owns membership, as with the other gates: this group is the
+          # explicit allowlist for who may publish on www.renner.uno.
+          # Add/remove members HERE, not in the UI — blueprint apply is
+          # authoritative for this M2M and reverts UI edits.
+          #
+          # s.renner is the Authentik account for the site's WordPress
+          # Editor, which still carries the pre-2019 login `s.birzer` — the
+          # two names do not match, and that is expected.
+          users:
+            - !Find [authentik_core.user, [username, k.renner]]
+            - !Find [authentik_core.user, [username, s.renner]]
+
+      - id: wordpress-gate-provider
+        model: authentik_providers_proxy.proxyprovider
+        identifiers:
+          name: wordpress-gate
+        state: present
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: proxy
+          internal_host: http://wordpress.wordpress.svc.cluster.local
+          internal_host_ssl_validation: false
+          external_host: https://www.renner.uno
+          cookie_domain: renner.uno
+          access_token_validity: hours=24
+          refresh_token_validity: days=30
+          intercept_header_auth: true
+          # No skip_path_regex: wp-admin's assets are only ever fetched by an
+          # already-authenticated session, and wp-admin has no manifest or
+          # service worker — the credentials:'omit' PWA problem that forced
+          # carve-outs on vscode-gate and retired music-assistant-gate does
+          # not arise here.
+
+      - model: authentik_core.application
+        identifiers:
+          slug: wordpress-gate
+        state: present
+        attrs:
+          name: WordPress (Gate)
+          slug: wordpress-gate
+          provider: !KeyOf wordpress-gate-provider
+          meta_launch_url: https://www.renner.uno/wp-admin/
+          meta_description: "Forward-auth gate in front of wp-admin on www.renner.uno"
+
+      # Only WordPress Authors pass the gate — see the group above for the
+      # membership list. Both accounts that exist on the migrated site are
+      # covered, so the gate cannot lock out the editor the site is
+      # currently being kept alive for.
+      - model: authentik_policies.policybinding
+        identifiers:
+          target: !Find [authentik_core.application, [slug, wordpress-gate]]
+          group: !KeyOf wordpress-authors-group
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: false
+
+      - model: authentik_outposts.outpost
+        identifiers:
+          name: wordpress-gate
+        state: present
+        attrs:
+          type: proxy
+          service_connection: !KeyOf k8s-conn
+          providers:
+            - !KeyOf wordpress-gate-provider
+          config:
+            log_level: info
+            authentik_host: "http://authentik-server.authentik.svc.cluster.local"
+            authentik_host_insecure: false
+            authentik_host_browser: "https://auth.renner.uno/"
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 1
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: ["ingress"]
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_json_patches: null
+
+  # Passkey login for selected apps. Passkey is mandatory for accounts
+  # that hold one and unavailable to accounts that do not, so both flows
+  # branch on enrollment (policy passkey-user-has-webauthn): enrolled →
+  # WebAuthn, not enrolled → password + MFA. Enrollment status is a
+  # property of the identified account, so the weaker branch is never
+  # something a requester can select.
+  #
+  # Two parts:
   #
   # 1. A passwordless AUTHENTICATION flow (username → passkey, no
   #    password prompt) bound per-provider, so fresh logins to these
@@ -1335,7 +1449,13 @@ data:
   # 2. A step-up AUTHORIZATION flow — unlike the authentication flow,
   #    this runs on EVERY interactive authorize, so an existing
   #    password-only SSO session from another app cannot slip into
-  #    these apps without presenting a passkey.
+  #    these apps without presenting a passkey. Two things narrow that:
+  #    the stage is skipped outright for accounts with no passkey (they
+  #    have no way to satisfy it), and last_auth_threshold reduces it to
+  #    "without presenting a passkey in this browser within the window"
+  #    — one touch then covers every app, including a later
+  #    password-only session for the same user. The cookie is keyed to
+  #    that user's device, so it never carries across users.
   passkey-stepup.yaml: |
     version: 1
     metadata:
@@ -1356,43 +1476,99 @@ data:
           # flow this replaces.
           authentication: require_authenticated
 
-      - id: passkey-stepup-webauthn-validation
+      # ONE stage object, shared by the step-up authorization flow and
+      # the passwordless authentication flow below.
+      #
+      # `last_auth_threshold` is enforced with a single browser cookie
+      # (`authentik_mfa`) whose JWT is both signed with and carries the
+      # stage's PK, so a validation stage only ever honours a cookie it
+      # wrote itself. Two separate stage objects therefore each demand
+      # their own touch, and — sharing the one cookie name — overwrite
+      # each other, so neither window survives. Sharing this object is
+      # what lets the login touch satisfy the per-app step-up.
+      #
+      # Declared here, ahead of every !KeyOf reference to it: the
+      # blueprint importer resolves entries top-to-bottom.
+      - id: passkey-webauthn-validation
         model: authentik_stages_authenticator_validate.authenticatorvalidatestage
         identifiers:
-          name: passkey-stepup-webauthn-validation
+          name: passkey-webauthn-validation
         state: present
         attrs:
           device_classes:
             - webauthn
-          # `configure`, not `deny`: g.renner has Home Assistant access
-          # but no enrolled WebAuthn device (live check 2026-07-07), so
-          # a hard deny would lock her out with no self-service path.
-          # `configure` injects the default WebAuthn enrollment stage
-          # inline — first login without a passkey becomes "enroll one
-          # now, then validate it". Still passkey-only: there is no way
-          # through this stage without a WebAuthn credential.
-          not_configured_action: configure
-          configuration_stages:
-            - !Find [authentik_stages_authenticator_webauthn.authenticatorwebauthnstage, [name, default-authenticator-webauthn-setup]]
-          # Skip re-validation if a passkey was already presented within
-          # the window. Non-zero for two reasons: (1) no double-touch
-          # when the login itself used a passkey seconds earlier;
-          # (2) NetBird's dashboard silently re-authorizes via
-          # /silent-auth (prompt=none) on token expiry — a flow that
-          # always demands interaction would fail those and force a
-          # visible re-login every access-token lifetime.
+          # `deny`, not `configure`: the authentication flow reaches this
+          # stage with the user merely *identified* (a typed username)
+          # and no password stage in front of it, so inline enrollment
+          # would let anyone who knows a passkey-less username enroll
+          # their own passkey and take over that account. The policy
+          # binding means only accounts that already hold a passkey reach
+          # this stage at all, so `deny` is defence in depth rather than
+          # a path anyone walks — accounts without one branch to password
+          # + MFA instead.
+          not_configured_action: deny
+          # Window within which an already-presented passkey satisfies a
+          # later run of this stage. Non-zero for two reasons: (1) the
+          # per-app step-up must not demand a second touch seconds after
+          # the login touch; (2) NetBird's dashboard silently
+          # re-authorizes via /silent-auth (prompt=none) on token expiry —
+          # a stage that always demands interaction fails those and
+          # forces a visible re-login every access-token lifetime.
+          #
+          # The cookie is browser-scoped, so inside the window a re-login
+          # in that same browser is satisfied by the cookie alone and the
+          # username is all that gets typed. Accepted for a single touch
+          # per app.
           last_auth_threshold: hours=8
           webauthn_user_verification: preferred
 
-      - model: authentik_flows.flowstagebinding
+      # Gate on "this account has a passkey", so enrollment status picks
+      # the branch. Enrolled accounts must use WebAuthn — at login and at
+      # every authorize — while accounts with no passkey fall back to
+      # password + MFA. An attacker cannot pick the weaker branch: the
+      # user is already identified when this runs, so the branch follows
+      # the victim's enrollment, not the requester's choice.
+      #
+      # request.user is the flow's pending_user, not the (anonymous)
+      # requester: ReevaluateMarker builds the engine with
+      # plan.context[PLAN_CONTEXT_PENDING_USER] (flows/markers.py). That
+      # requires the bindings below to keep evaluate_on_plan false and
+      # re_evaluate_policies true — on-plan evaluation happens before the
+      # identification stage has resolved a user.
+      - id: policy-has-passkey
+        model: authentik_policies_expression.expressionpolicy
+        identifiers:
+          name: passkey-user-has-webauthn
+        state: present
+        attrs:
+          expression: |
+            return ak_user_has_authenticator(request.user, "webauthn")
+
+      - id: binding-stepup-webauthn
+        model: authentik_flows.flowstagebinding
         identifiers:
           target: !KeyOf passkey-stepup-flow
-          stage: !KeyOf passkey-stepup-webauthn-validation
+          stage: !KeyOf passkey-webauthn-validation
           order: 10
         state: present
+        attrs:
+          evaluate_on_plan: false
+          re_evaluate_policies: true
+
+      - model: authentik_policies.policybinding
+        identifiers:
+          policy: !KeyOf policy-has-passkey
+          target: !KeyOf binding-stepup-webauthn
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: false
 
       # Passwordless authentication flow: identification (username or
-      # email, NO password stage) → WebAuthn validation → login.
+      # email, NO password stage) → WebAuthn validation → login, with a
+      # password + MFA branch for accounts that have no passkey.
       - id: passkey-passwordless-flow
         model: authentik_flows.flow
         identifiers:
@@ -1403,37 +1579,6 @@ data:
           title: "Sign in with your passkey"
           designation: authentication
 
-      # SEPARATE stage from the step-up one, and deliberately `deny`:
-      # at this point in an authentication flow the user has only been
-      # *identified* (typed a username), not authenticated — `configure`
-      # here would let anyone who knows a passkey-less username enroll
-      # their own passkey and take over that account. Inline enrollment
-      # for passkey-less users happens exclusively in the authorization
-      # step-up stage above, where require_authenticated guarantees a
-      # fully authenticated session. A passkey-less user therefore
-      # bootstraps via password login on auth.renner.uno, then gets the
-      # enrollment prompt on first app access.
-      #
-      # Declared BEFORE the identification stage because the latter
-      # references it via !KeyOf (webauthn_stage), and the blueprint
-      # importer resolves entries top-to-bottom.
-      - id: passkey-passwordless-webauthn-validation
-        model: authentik_stages_authenticator_validate.authenticatorvalidatestage
-        identifiers:
-          name: passkey-passwordless-webauthn-validation
-        state: present
-        attrs:
-          device_classes:
-            - webauthn
-          not_configured_action: deny
-          # Small non-zero window so a passkey presented via the
-          # identification stage's autofill (webauthn_stage below) is
-          # not challenged a second time by this stage at order 20 in
-          # the same flow run. The skip is session-scoped, so a fresh
-          # (attacker) session never inherits it.
-          last_auth_threshold: minutes=5
-          webauthn_user_verification: preferred
-
       # webauthn_stage enables passkey autofill (conditional WebAuthn,
       # authentik >= 2025.12): the browser offers enrolled passkeys in
       # the username field's autofill — one tap, no username typed.
@@ -1449,7 +1594,7 @@ data:
           user_fields:
             - username
             - email
-          webauthn_stage: !KeyOf passkey-passwordless-webauthn-validation
+          webauthn_stage: !KeyOf passkey-webauthn-validation
 
       - model: authentik_flows.flowstagebinding
         identifiers:
@@ -1458,12 +1603,87 @@ data:
           order: 10
         state: present
 
-      - model: authentik_flows.flowstagebinding
+      # Order 20 and 21/22 are the two mutually exclusive branches.
+      - id: binding-passwordless-webauthn
+        model: authentik_flows.flowstagebinding
         identifiers:
           target: !KeyOf passkey-passwordless-flow
-          stage: !KeyOf passkey-passwordless-webauthn-validation
+          stage: !KeyOf passkey-webauthn-validation
           order: 20
         state: present
+        attrs:
+          evaluate_on_plan: false
+          re_evaluate_policies: true
+
+      - model: authentik_policies.policybinding
+        identifiers:
+          policy: !KeyOf policy-has-passkey
+          target: !KeyOf binding-passwordless-webauthn
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: false
+
+      # The negated branch. failure_result: true is the safety net — the
+      # UserLoginStage defaults a missing authentication backend to
+      # BACKEND_INBUILT instead of refusing (user_login/stage.py), so a
+      # flow that drops BOTH branches would log the user in on a typed
+      # username alone. A PolicyException is resolved to failure_result
+      # before negate is applied (policies/process.py), so a broken
+      # expression pulls the password stage IN and degrades everyone to
+      # password + MFA rather than to no factor at all.
+      - id: binding-passwordless-password
+        model: authentik_flows.flowstagebinding
+        identifiers:
+          target: !KeyOf passkey-passwordless-flow
+          stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]
+          order: 21
+        state: present
+        attrs:
+          evaluate_on_plan: false
+          re_evaluate_policies: true
+
+      - model: authentik_policies.policybinding
+        identifiers:
+          policy: !KeyOf policy-has-passkey
+          target: !KeyOf binding-passwordless-password
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: true
+          failure_result: true
+
+      # Same MFA validation the default authentication flow runs at its
+      # order 30, so the fallback is not a weaker way into these apps
+      # than auth.renner.uno's own login already is. It carries
+      # not_configured_action: configure, which is safe here and nowhere
+      # else in this flow: the password stage above has established a
+      # first factor by the time it runs, so it doubles as the enrollment
+      # path for accounts holding no authenticator at all.
+      - id: binding-passwordless-mfa
+        model: authentik_flows.flowstagebinding
+        identifiers:
+          target: !KeyOf passkey-passwordless-flow
+          stage: !Find [authentik_stages_authenticator_validate.authenticatorvalidatestage, [name, default-authentication-mfa-validation]]
+          order: 22
+        state: present
+        attrs:
+          evaluate_on_plan: false
+          re_evaluate_policies: true
+
+      - model: authentik_policies.policybinding
+        identifiers:
+          policy: !KeyOf policy-has-passkey
+          target: !KeyOf binding-passwordless-mfa
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: true
+          failure_result: true
 
       - model: authentik_flows.flowstagebinding
         identifiers:
@@ -1577,3 +1797,19 @@ data:
           redirect_uris:
             - url: https://dash.renner.uno/login/generic_oauth
               matching_mode: strict
+
+      # Superseded by the single passkey-webauthn-validation stage above.
+      # Their flowstagebindings are FK-CASCADEd away with them; the
+      # identification stage's webauthn_stage FK is SET_NULL and is
+      # re-pointed above, so no dangling reference survives. Declared
+      # last: the importer applies entries top-to-bottom inside one
+      # transaction, so the replacements exist before these go.
+      - model: authentik_stages_authenticator_validate.authenticatorvalidatestage
+        identifiers:
+          name: passkey-stepup-webauthn-validation
+        state: absent
+
+      - model: authentik_stages_authenticator_validate.authenticatorvalidatestage
+        identifiers:
+          name: passkey-passwordless-webauthn-validation
+        state: absent

kubernetes/apps/authentik/kustomization.yaml

@@ -14,6 +14,7 @@ resources:
   - zone-configurator-gate-egress.yaml
   - alertmanager-gate-egress.yaml
   - prometheus-gate-egress.yaml
+  - wordpress-gate-egress.yaml
   - outpost-servicemonitors.yaml
   - ldap-outpost-cert.yaml
   - ldap-outpost-lb.yaml

kubernetes/apps/authentik/wordpress-gate-egress.yaml

@@ -0,0 +1,28 @@
+---
+# Allow the dedicated wordpress-gate outpost to egress into the wordpress
+# namespace and reach WordPress (:80). Without this, the authentik-namespace
+# baseline CNP has no egress rule to wordpress, so the gate outpost's
+# forwarded requests are dropped. Scoped to the gate outpost's pod label so no
+# other authentik component can reach it. Mirrors esphome-gate-egress.yaml.
+#
+# Note this gate only ever sees /wp-admin and /wp-login.php — the public site
+# is routed straight to the same Service by a separate Ingress, so this rule
+# is not the only path into the wordpress namespace, unlike the paperless case.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: wordpress-gate-egress
+  namespace: authentik
+spec:
+  endpointSelector:
+    matchLabels:
+      goauthentik.io/outpost-name: wordpress-gate
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": wordpress
+            app.kubernetes.io/name: wordpress
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP

kubernetes/apps/home-assistant/deployment.yaml

@@ -38,7 +38,7 @@ spec:
       # gets the heavy HA pod (8Gi) off the soon-to-be-tiny edge box.
       containers:
         - name: home-assistant
-          image: ghcr.io/home-assistant/home-assistant:2026.8.1 # {"$imagepolicy": "flux-system:home-assistant"}
+          image: ghcr.io/home-assistant/home-assistant:2026.8.2 # {"$imagepolicy": "flux-system:home-assistant"}
           env:
             - name: TZ
               value: Europe/Berlin

kubernetes/apps/ical-proxy/deployment.yaml

@@ -17,7 +17,33 @@ spec:
     spec:
       containers:
         - name: ical-proxy
-          image: ghcr.io/konairius/ical-proxy:latest
+          # Pinned to a commit build rather than :latest.
+          #
+          # :latest never rolls. The tag moves when a build publishes, but
+          # nothing tells the Deployment about it: the pod template is
+          # unchanged, so Kubernetes has no reason to replace anything, and
+          # this image is deliberately NOT enrolled in Flux image automation
+          # — see kubernetes/infrastructure/image-automation/README.md, which
+          # lists ghcr.io/konairius/ical-proxy as having "only main, latest,
+          # and main-<sha> commit builds; no release tags", so there is no
+          # ImagePolicy watching it. The pods therefore sat on a 21-day-old
+          # image while :latest moved underneath them, and the only way to
+          # pick up a new build was a manual restart.
+          #
+          # A pinned tag makes the rollout a git change: Flux applies the new
+          # pod template and Kubernetes rolls it, which is also what makes
+          # what is RUNNING recoverable from this repo rather than "whatever
+          # :latest meant the last time a pod happened to restart".
+          #
+          # main-99a912b is the merge of konairius/ical-proxy#12, which adds
+          # the summary_match/summary_replace parameters this deployment
+          # needs to strip "| Abfuhrkalender - Landkreis Amberg-Sulzbach"
+          # from every waste collection.
+          #
+          # Bumping this is a manual, reviewed edit. The tag format is
+          # main-<short-sha> (docker/metadata-action type=sha with the branch
+          # as prefix).
+          image: ghcr.io/konairius/ical-proxy:main-99a912b
           ports:
             - containerPort: 8080
               name: http

kubernetes/apps/monitoring-rules/cnpg-podmonitors.yaml

@@ -73,3 +73,29 @@ spec:
       interval: 30s
   podTargetLabels:
     - role
+---
+# wp-pg, restored into the `woodpecker` namespace (issue #433). It has never
+# been scraped: `apps` had no PodMonitor for it AND its baseline network policy
+# never allowed the monitoring namespace, so `cnpg_collector_up` has series for
+# the four clusters above but not this one. The namespace move fixes the policy
+# half; without this PodMonitor there is still no scrape target at all.
+#
+# Deliberately not adding one for the cluster still in `apps`: it is retired in
+# stage 3, and a PodMonitor there would only be reconciled to be deleted again.
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: cnpg-wp-pg
+  namespace: woodpecker
+  labels:
+    app.kubernetes.io/name: cloudnative-pg
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      cnpg.io/cluster: wp-pg
+  podMetricsEndpoints:
+    - port: metrics
+      interval: 30s
+  podTargetLabels:
+    - role

kubernetes/apps/monitoring-rules/kustomization.yaml

@@ -4,6 +4,8 @@ kind: Kustomization
 # come from the kube-prometheus-stack chart. Flux applies this Kustomization
 # only after `monitoring` is Ready (chart installed → CRDs present).
 resources:
+  - prometheusrule-ceph.yaml
+  - prometheusrule-cilium.yaml
   - prometheusrule-hetzner-backup.yaml
   - prometheusrule-loki.yaml
   - prometheusrule-netbird-availability.yaml

kubernetes/apps/monitoring-rules/prometheusrule-ceph.yaml

@@ -0,0 +1,56 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: ceph
+  namespace: monitoring
+  labels:
+    # kube-prometheus-stack's Prometheus resource selects on this label;
+    # without it the rule is created but never loaded into Prometheus.
+    release: kube-prometheus-stack
+spec:
+  groups:
+    - name: ceph.rules
+      rules:
+        - alert: CephHealthWarn
+          # ceph_health_status: 0 = HEALTH_OK, 1 = HEALTH_WARN, 2 = HEALTH_ERR.
+          # 6h is deliberately long. Ceph warns for self-clearing conditions —
+          # a slow BlueStore op during the Sunday restore sweep, a mon briefly
+          # below its disk threshold — and paging on those trains people to
+          # ignore the alert. What matters is a warning that does not clear.
+          expr: ceph_health_status == 1
+          for: 6h
+          labels:
+            severity: warning
+          annotations:
+            summary: "Ceph has been HEALTH_WARN for 6h"
+            description: "The Ceph cluster has held HEALTH_WARN for six hours, so it is not a self-clearing blip. Get the detail with `kubectl -n rook-ceph exec deploy/rook-ceph-tools -- ceph health detail`."
+
+        - alert: CephHealthError
+          # HEALTH_ERR means data availability or redundancy is at risk.
+          expr: ceph_health_status == 2
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Ceph is HEALTH_ERR"
+            description: "The Ceph cluster is in HEALTH_ERR — availability or redundancy is at risk. Inspect immediately with `kubectl -n rook-ceph exec deploy/rook-ceph-tools -- ceph health detail` and `ceph osd df tree`."
+
+        - alert: CephMonDiskLow
+          # Named explicitly rather than left to CephHealthWarn, because the
+          # mons sit on the node's /var alongside container storage: this
+          # fires for a full node, not for Ceph growth. The mon's own data is
+          # ~106 MB, so 30% of a 60 GB shared filesystem says nothing about
+          # Ceph.
+          # Image GC does not clear this — measured on k8s-2, the reclaimable
+          # content store is a small fraction of /var/lib/containerd next to
+          # ~20 GB of overlayfs snapshots held by running containers. Look at
+          # what actually grew before reaching for a threshold.
+          expr: |
+            100 * node_filesystem_avail_bytes{mountpoint="/var"}
+              / node_filesystem_size_bytes{mountpoint="/var"} < 30
+          for: 30m
+          labels:
+            severity: warning
+          annotations:
+            summary: "{{ $labels.instance }} /var below 30% free — Ceph mon will warn"
+            description: "/var on {{ $labels.instance }} is under 30% free, which is Ceph's mon_data_avail_warn threshold, so the mon on this node will report MON_DISK_LOW. Find the actual consumer with `talosctl -n <node> usage /var/lib --depth 1` and then `/var/lib/containerd --depth 1` — note that overlayfs snapshots belong to running containers and are not reclaimable by image GC."

kubernetes/apps/monitoring-rules/prometheusrule-cilium.yaml

@@ -0,0 +1,44 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: cilium
+  namespace: monitoring
+  labels:
+    # kube-prometheus-stack's Prometheus resource selects on this label;
+    # without it the rule is created but never loaded into Prometheus.
+    release: kube-prometheus-stack
+spec:
+  groups:
+    - name: cilium.rules
+      # Both alerts are map-agnostic on purpose. cilium_bpf_map_pressure is
+      # emitted per map type — policy, conntrack, NAT, LB — distinguished by
+      # the map_name label, and running out of any of them degrades the
+      # datapath. The policy map is merely the one that has bitten us.
+      # Cilium only exports the metric for maps above
+      # policyMapPressureMetricsThreshold (chart default 0.1), so quiet maps
+      # produce no series rather than a flood of near-zero ones.
+      rules:
+        - alert: CiliumBPFMapPressureHigh
+          # cilium_bpf_map_pressure is used/capacity for the fullest map of
+          # that name on the agent. A full map is not a slow path — it is a
+          # hard failure: the agent cannot program the datapath, so endpoint
+          # regeneration fails and every new pod on the node hangs in sandbox
+          # creation until something frees space.
+          expr: cilium_bpf_map_pressure > 0.8
+          for: 15m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Cilium BPF map {{ $labels.map_name }} is {{ $value | humanizePercentage }} full on {{ $labels.node }}"
+            description: "The BPF map {{ $labels.map_name }} on node {{ $labels.node }} has been over 80% full for 15 minutes. At 100% the Cilium agent can no longer program the datapath and new pods on this node fail sandbox creation. Raise the corresponding size in kubernetes/infrastructure/cilium/helmrelease.yaml (values.bpf) — the map is sized at creation, so the change needs an agent restart."
+
+        - alert: CiliumBPFMapFull
+          # Pressure reaches (and can exceed) 1.0 when the agent wants more
+          # entries than the map holds. Pods are already failing to start.
+          expr: cilium_bpf_map_pressure >= 1
+          for: 0m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Cilium BPF map {{ $labels.map_name }} is full on {{ $labels.node }}"
+            description: "The BPF map {{ $labels.map_name }} on node {{ $labels.node }} is at or over capacity. Endpoint regeneration is failing with 'no space left on device' and pods scheduled to this node will hang in ContainerCreating. Check `{namespace=\"kube-system\",pod=~\"cilium-.+\"} |= \"no space left on device\"` in Loki for the affected endpoints."

kubernetes/apps/monitoring-rules/prometheusrule-woodpecker-rotation.yaml

@@ -12,37 +12,37 @@ spec:
   groups:
     - name: woodpecker-rotation.rules
       # Convergence safety net for the automated WOODPECKER_AGENT_SECRET rotation
-      # (kubernetes/apps/woodpecker/rotate-agent-secret.yaml). That rotation Job is
+      # (kubernetes/infrastructure/openbao/rotation/woodpecker.yaml). That rotation Job is
       # fire-and-forget: it writes OpenBao and exits WITHOUT verifying ESO re-synced
       # or that both consumers restarted healthy. These alerts close that gap. ESO
       # metrics are not scraped in this cluster, so everything here is built on
-      # kube-state-metrics. The CronJob/Job series stay empty until the rotation
-      # feature (branch feat/woodpecker-secret-auto-rotation) is merged — harmless.
+      # kube-state-metrics. The rotation has since landed: the CronJob lives in the
+      # openbao namespace, not apps, which is where the last two rules look.
       rules:
         - alert: WoodpeckerServerNotReady
           # 0 ready replicas well past the 10m ESO refresh + Reloader restart cycle.
-          expr: kube_statefulset_status_replicas_ready{namespace="apps",statefulset="woodpecker-server"} == 0
+          expr: kube_deployment_status_replicas_ready{namespace="woodpecker",deployment="woodpecker-server"} == 0
           for: 20m
           labels:
             severity: critical
           annotations:
             summary: "Woodpecker CI server has no ready replica"
             description: >-
-              StatefulSet woodpecker-server (ns apps) has had 0 ready replicas for 20m;
-              all CI is down (agents cannot reach woodpecker.apps.svc:9000). If this
-              followed a secret rotation, the server pod failed to return after its
-              Reloader-triggered restart — check `kubectl -n apps describe pod
-              woodpecker-server-0` (PVC attach / crashloop) and the woodpecker-secret
-              ExternalSecret sync status.
+              Deployment woodpecker-server (ns woodpecker) has had 0 ready replicas
+              for 20m; all CI is down (agents cannot reach
+              woodpecker.woodpecker.svc:9000). If this followed a secret rotation, the
+              server pod failed to return after its Reloader-triggered restart — check
+              `kubectl -n woodpecker describe deploy woodpecker-server` and the
+              woodpecker-secret ExternalSecret sync status.
         - alert: WoodpeckerAgentNotReady
-          expr: kube_deployment_status_replicas_available{namespace="apps",deployment="woodpecker-agent"} == 0
+          expr: kube_deployment_status_replicas_available{namespace="woodpecker",deployment="woodpecker-agent"} == 0
           for: 20m
           labels:
             severity: warning
           annotations:
             summary: "Woodpecker CI agent has no available replica"
             description: >-
-              Deployment woodpecker-agent (ns apps) has had 0 available replicas for
+              Deployment woodpecker-agent (ns woodpecker) has had 0 available replicas for
               20m; no pipelines will run. If this followed a secret rotation, the agent
               did not return after its Reloader restart, or its WOODPECKER_AGENT_SECRET
               no longer matches the server's — check the agent pod logs for a gRPC auth
@@ -50,29 +50,29 @@ spec:
         - alert: WoodpeckerSecretRotationJobFailed
           # Named, clearer signal than the generic KubeJobFailed for the OpenBao-write
           # step. Fires while a failed rotation Job is retained (ttl 3d).
-          expr: kube_job_status_failed{namespace="apps",job_name=~"woodpecker-secret-rotate.*"} > 0
+          expr: kube_job_status_failed{namespace="openbao",job_name=~"woodpecker-secret-rotate.*"} > 0
           for: 15m
           labels:
             severity: warning
           annotations:
             summary: "Woodpecker agent-secret rotation Job failed"
             description: >-
-              A woodpecker-secret-rotate Job (ns apps) failed at the OpenBao-write step;
+              A woodpecker-secret-rotate Job (ns openbao) failed at the OpenBao-write step;
               the agent secret was NOT rotated. Most common cause: the one-time OpenBao
               `rotator` role/policy bootstrap was never applied (see
               kubernetes/infrastructure/openbao/policies/rotator.hcl). Check
-              `kubectl -n apps logs job/<name>`.
+              `kubectl -n openbao logs job/<name>`.
         - alert: WoodpeckerSecretRotationStale
           # Quarterly cadence (~91d) + grace. The series is ABSENT until the first
           # successful run, so this cannot false-fire before rotation has ever worked.
-          expr: (time() - kube_cronjob_status_last_successful_time{namespace="apps",cronjob="woodpecker-secret-rotate"}) > 100 * 24 * 3600
+          expr: (time() - kube_cronjob_status_last_successful_time{namespace="openbao",cronjob="woodpecker-secret-rotate"}) > 100 * 24 * 3600
           for: 1h
           labels:
             severity: warning
           annotations:
             summary: "Woodpecker agent secret has not rotated in >100 days"
             description: >-
-              The quarterly woodpecker-secret-rotate CronJob (ns apps) has not completed
+              The quarterly woodpecker-secret-rotate CronJob (ns openbao) has not completed
               successfully in over 100 days — rotation has silently stopped (CronJob
               suspended/deleted, or every run failing). Investigate the CronJob and its
               recent Jobs.

kubernetes/apps/paperless/gotenberg.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: gotenberg
-          image: gotenberg/gotenberg:8.35.0 # {"$imagepolicy": "flux-system:gotenberg"}
+          image: gotenberg/gotenberg:8.36.0 # {"$imagepolicy": "flux-system:gotenberg"}
           args:
             - "gotenberg"
             - "--chromium-disable-javascript=true"

kubernetes/apps/trmnl/renderer.yaml

@@ -29,6 +29,14 @@ data:
   # The app re-reads schedules.json every 60 s, so edits here take
   # effect without a restart once the init container has rewritten it.
   #
+  # lang is "de", not null. It calls Home Assistant's own
+  # _selectLanguage() for the screenshot session, so the rendered page
+  # is localised by HA rather than by hand. With it left null the
+  # dashboard grew a German weekday array, a German month array and a
+  # fifteen-entry weather-condition dict — reimplementing translations
+  # HA already ships. The instance itself stays language "en"; this
+  # only affects the render session.
+  #
   # model_id is 1 — TRMNL X (name "v2", 1872x1404, 16 colours) — and it
   # is an INTEGER, not a name. Confirmed against the running server:
   # GET /api/screens returns model_id as a number, and upstream's
@@ -61,7 +69,7 @@ data:
         "zoom": 1,
         "wait": null,
         "theme": "Graphite E-ink Light",
-        "lang": null,
+        "lang": "de",
         "dark": false,
         "invert": false,
         "timestamp": false,
@@ -107,6 +115,27 @@ metadata:
   namespace: trmnl
   labels:
     app.kubernetes.io/name: trmnl-renderer
+  annotations:
+    # BOTH sources need this, and for the same reason: the init
+    # container writes /data/schedules.json ONCE, at pod start. Nothing
+    # re-reads either source afterwards.
+    #
+    # The app re-reads schedules.json every 60s, which makes it look
+    # self-updating — but only the FILE, and the file is only rewritten
+    # by the init container. So a ConfigMap or Secret change lands in
+    # git, updates the object, and the running renderer keeps the old
+    # values indefinitely.
+    #
+    # Both halves were hit repeatedly in practice and each time needed
+    # `kubectl delete pod` by hand: the theme name, the schedule's lang
+    # field, and every re-mint of the BYOS tokens. A fix that depends on
+    # someone remembering to restart a pod is not deployed.
+    #
+    # Named per-resource rather than the blanket
+    # reloader.stakater.com/auto: "true", matching terminus.yaml and
+    # mosquitto-deployment.yaml.
+    configmap.reloader.stakater.com/reload: trmnl-renderer-schedule
+    secret.reloader.stakater.com/reload: trmnl-renderer-secrets
 spec:
   replicas: 1
   # RWO PVC, and two renderers would push conflicting screens for the

kubernetes/apps/trmnl/terminus.yaml

@@ -53,6 +53,29 @@ data:
   # NOTE: the period is fixed at mint time. Changing this does not extend
   # tokens that already exist — they must be re-minted afterwards.
   API_ACCESS_TOKEN_PERIOD: "315360000"
+  # The OTHER half of the same problem, and the reason the first fix
+  # did not hold. Terminus has TWO independent expiries: the JWT's own
+  # lifetime (above) and the SESSION behind it. Raising only the token
+  # period left the session at its defaults, so pushes kept working for
+  # a while and then failed with
+  #   HTTP 401 {"error":"This session has expired, please login again"}
+  # which is a different error, from a different mechanism, than the
+  # "expired JWT access token" the first fix addressed.
+  #
+  # Documented in doc/configuration.adoc:
+  #   SESSION_EXPIRATION_ENABLED — "Determines if your browser session
+  #   or JWT API token is expired or not." Default: true.
+  #   SESSION_INACTIVITY_LIMIT 1800s, SESSION_LIFETIME_LIMIT 86400s.
+  #
+  # Disabling it is exactly the state the renderer's own code assumes
+  # ("stock Terminus disables session expiration and issues ~100-year
+  # tokens") — an assumption that is false by default and has to be
+  # made true here, same as the token period.
+  #
+  # Same trade as above, and it is the deciding one for an unattended
+  # appliance: a session that expires needs a human with a password to
+  # restore it, and this panel has neither.
+  SESSION_EXPIRATION_ENABLED: "false"
 ---
 apiVersion: apps/v1
 kind: Deployment

kubernetes/apps/whisper/deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: whisper
-          image: rhasspy/wyoming-whisper:3.5.0 # {"$imagepolicy": "flux-system:wyoming-whisper"}
+          image: rhasspy/wyoming-whisper:3.6.0 # {"$imagepolicy": "flux-system:wyoming-whisper"}
           args:
             - --model=base-int8
             - --language=de

kubernetes/apps/woodpecker/MIGRATION-namespace.md

@@ -0,0 +1,388 @@
+# Woodpecker: `apps` → `woodpecker` namespace migration
+
+Moves the Woodpecker service — server, agent and the `wp-pg` CNPG backend — out
+of the shared `apps` namespace into one of its own. Distinct from
+`MIGRATION.md`, which covers the earlier SQLite → CNPG move.
+
+## Why
+
+`apps` holds gitea, gatus, external-dns, ical-proxy and woodpecker together,
+and its `default-deny-ingress` uses `endpointSelector: {}`. Every allow rule it
+carries therefore applies to *every* workload in the namespace.
+
+That is not academic. Issue #433 — `wp-pg` stuck at `Ready=False` with
+`Instance Status Extraction Error` for three weeks — is caused by the CNPG
+operator in `database` being unable to reach `https://<pod-ip>:8000/pg/status`.
+The only namespace-level fix is `fromEndpoints: namespace=database`, which
+would expose gitea, gatus, external-dns and ical-proxy to the whole `database`
+namespace to solve a problem affecting one pod on one port.
+
+`cnpg_collector_up` has series for authentik, immich, monitoring and paperless
+but not for `wp-pg`, for the same reason: `apps` never allowed the monitoring
+namespace either.
+
+A namespace per service keeps each grant on the workload that needs it.
+
+**`woodpecker-ci` is not the target.** It enforces `pod-security: privileged`
+and exists solely for ephemeral pipeline step pods running repo-supplied code.
+Putting the database there would let any build step reach it through the
+intra-namespace allow.
+
+## Staging
+
+Rollback is trivial through stage 2. The `apps` cluster is untouched until
+stage 3, so reverting means pointing the DSN back and scaling up.
+
+| Stage | Contents | CI impact |
+|---|---|---|
+| **1** (this PR) | `woodpecker` namespace, its network policies, ExternalSecret, ObjectStores, and `wp-pg` restored from barman | none — parallel, nothing points at it |
+| **runbook** | verify the restore holds real data | none |
+| **2** | move server + agent, flip DSN, RBAC subject, rotator policies, docs | **downtime** |
+| **3** | delete the `apps` originals, add the prune guard to the survivor | none |
+
+## Stage 1 design notes
+
+**Two ObjectStores, deliberately.** `wp-pg-store-source` points at
+`s3://renner-uno-k8s-cnpg/wp-pg` — the prefix the live cluster archives to —
+and is read-only. `wp-pg-store` points at a **new** prefix,
+`s3://renner-uno-k8s-cnpg/wp-pg-woodpecker`, for ongoing archiving.
+
+Both clusters writing one `destinationPath` would interleave their WAL streams
+and corrupt both. Splitting them also leaves the pre-migration backup intact
+and independently restorable.
+
+**`serverName: wp-pg`** on the `externalCluster` names the cluster that
+*produced* the backup, not the one being created.
+
+**The namespace is declared in `infrastructure/namespaces/namespaces.yaml`,**
+not alongside these workloads. Its CiliumNetworkPolicies ship with the
+`infrastructure-crds` KS (`infrastructure/post-crds` includes
+`../network-policies/`), which `dependsOn` `infrastructure` — so the namespace
+exists before any policy targets it. Creating it in the `woodpecker` workload
+KS would invert that order, since that KS runs after both.
+
+**Ingress from `woodpecker-ci` is deliberately absent in stage 1.** Step pods do
+call the server back on `:8000`, but the CNPG instance manager serves its status
+API on `:8000` too, and the baseline policy uses `endpointSelector: {}`. A
+`toPorts` block narrows the port, not the destination workload — so putting that
+rule on the baseline would hand arbitrary repo-supplied build steps a route to
+wp-pg's instance manager. It lands in stage 2 as its own policy selecting the
+server pod.
+
+**No `prune: disabled` guard on the restored cluster.** The original carries one
+because it holds the only copy of the data. This one is reconstructable by
+re-running the restore, and a prune guard on a migration artifact is how orphans
+survive an abandoned migration. It gains the guard in stage 3.
+
+**Barman credentials still come from `seed/paperless/hetzner-creds`.** Issue
+#397 wants woodpecker to own `seed/woodpecker/hetzner-creds`, and this would
+have been the natural moment — but creating that path needs OpenBao write
+access that was not available (`bao kv list seed` → 403). Repointing at a path
+that may not exist would leave the restored cluster unable to archive WAL,
+which is the thing this stage exists to prove. #397 stays open; the swap is one
+line once the path exists.
+
+## Expect the `woodpecker` Kustomization to go not-Ready during the restore
+
+`kubernetes/clusters/homelab/woodpecker.yaml` sets `wait: true` and a
+`healthCheckExprs` entry matching `postgresql.cnpg.io/v1 Cluster` **with no
+name or namespace qualifier**. Flux evaluates it against every Cluster in that
+Kustomization's inventory — which, after this stage, is both the live
+`apps/wp-pg` and the restoring `woodpecker/wp-pg`.
+
+So while the restore runs, the whole `woodpecker` KS — the one that owns
+production Woodpecker — reports not-Ready, and a reconcile timeout in that
+window will trip the `flux-failures` Alert. **That is expected and is not
+Woodpecker breaking.** Nothing `dependsOn: woodpecker`, so it does not cascade.
+
+If the restore is going to sit for a long time, or the noise is unwelcome, the
+options are to suspend the KS while it completes, or to split the migration
+resources into their own `wait: false` Kustomization. For a ~660 MB database the
+window should be minutes.
+
+## Verifying stage 1
+
+Restore is asynchronous. Watch it reach a healthy state:
+
+```sh
+kubectl -n woodpecker get cluster wp-pg -w
+kubectl -n woodpecker get pods
+```
+
+Expect `Cluster in healthy state`. If it sticks in bootstrap, the recovery job's
+logs carry the reason:
+
+```sh
+kubectl -n woodpecker logs -l cnpg.io/jobRole=full-recovery --tail=100
+```
+
+**First check the generated app credentials target the right database.** CNPG
+defaults `bootstrap.recovery.database` to `app`; the restored data uses
+`woodpecker`. If this reads anything but `woodpecker`, the cluster has
+provisioned an empty `app` database and the real data is unreachable through
+the `-app` Secret and Service:
+
+```sh
+kubectl -n woodpecker get secret wp-pg-app -o jsonpath='{.data.dbname}' | base64 -d; echo
+kubectl -n woodpecker get secret wp-pg-app -o jsonpath='{.data.username}' | base64 -d; echo
+```
+
+**Then confirm the restore actually holds Woodpecker's data** — a cluster that
+comes up healthy but empty is the failure mode worth catching:
+
+```sh
+PGPASS=$(kubectl -n woodpecker get secret wp-pg-app -o jsonpath='{.data.password}' | base64 -d)
+kubectl -n woodpecker exec -it wp-pg-1 -- env PGPASSWORD="$PGPASS" \
+  psql -U woodpecker -d woodpecker -c '\dt'
+kubectl -n woodpecker exec -it wp-pg-1 -- env PGPASSWORD="$PGPASS" \
+  psql -U woodpecker -d woodpecker -c 'select count(*) from repos;'
+```
+
+Row counts should match the live cluster:
+
+```sh
+PGPASS_OLD=$(kubectl -n apps get secret wp-pg-app -o jsonpath='{.data.password}' | base64 -d)
+kubectl -n apps exec -it wp-pg-1 -- env PGPASSWORD="$PGPASS_OLD" \
+  psql -U woodpecker -d woodpecker -c 'select count(*) from repos;'
+```
+
+They will not match exactly if builds ran after the backup the restore used.
+
+**And stage 2 does not close that gap.** An earlier draft of this document
+claimed it quiesced the server first; it does not — Flux simply prunes the
+`apps` workloads and creates the `woodpecker` ones, so anything written to the
+old database between the restore and the cutover stays only in the old database.
+
+Measured on the live cutover: the restore captured through pipeline `9488`,
+four more (`9491`, `9492`, `9494`, `9496`) landed in `apps/wp-pg` before the
+swap, and the new cluster resumed at `9521`. Four pipeline records and their
+log entries exist only in the old cluster. No ID collision, no functional
+breakage — Woodpecker's own manifest calls this database "small and
+non-critical (state is largely reconstructable)" — but it is real history loss
+and should be a decision, not a surprise.
+
+If that gap matters for a future migration, quiesce before cutting over:
+
+```sh
+flux suspend kustomization woodpecker
+kubectl -n <old-ns> scale deploy/woodpecker-server deploy/woodpecker-agent --replicas=0
+# re-run the restore so it captures the final state, then resume
+```
+
+The old cluster keeps its `prune: disabled` guard until stage 3, so the missing
+rows remain recoverable until then.
+
+Confirm the two fixes this move exists for:
+
+```sh
+# #433: operator can now reach the instance
+kubectl -n woodpecker get cluster wp-pg -o jsonpath='{.status.conditions}'
+# metrics now scraped — needs BOTH the PodMonitor (cnpg-podmonitors.yaml) and
+# the monitoring ingress allow; wp-pg had neither in `apps`, which is why it is
+# absent from cnpg_collector_up while ak-pg/im-pg/gf-pg/pprl-pg are present
+kubectl get --raw '/api/v1/namespaces/monitoring/services/kube-prometheus-stack-prometheus:9090/proxy/api/v1/query?query=cnpg_collector_up{namespace="woodpecker"}'
+```
+
+Confirm the scrape target is actually registered, not just that the metric is
+missing for some other reason:
+
+```sh
+kubectl -n woodpecker get podmonitor cnpg-wp-pg
+```
+
+**Check the policy semantics by hand.** `kubectl --dry-run=server` validates
+manifest shape, not Cilium behaviour, so it cannot catch a rule that is
+syntactically fine but scoped wider than intended.
+
+`cilium-dbg policy trace` does **not** exist in Cilium 1.20 — it was removed,
+and `cilium-dbg policy` now offers only `get`, `selectors`, `subject-selectors`
+and `wait`. Read the realized BPF policy map instead, which is better evidence
+anyway: it is the datapath as programmed, not a simulation of it, and it
+carries live byte/packet counters.
+
+Find the agent on wp-pg's node and the endpoint id:
+
+```sh
+kubectl -n woodpecker get pod wp-pg-1 -o jsonpath='{.spec.nodeName}'
+kubectl -n kube-system get pod -l k8s-app=cilium \
+  --field-selector spec.nodeName=<node> --no-headers -o custom-columns=N:.metadata.name
+
+kubectl -n kube-system exec <cilium-pod> -c cilium-agent -- \
+  cilium-dbg endpoint list -o json \
+  | jq -r '.[] | select((.status.labels."security-relevant"[]?|tostring)
+      | test("cnpg.io/cluster=wp-pg")) | "\(.id) \(.status.networking.addressing[0].ipv4)"'
+```
+
+Then, on that endpoint id — who may reach `:8000`:
+
+```sh
+kubectl -n kube-system exec <cilium-pod> -c cilium-agent -- \
+  cilium-dbg bpf policy get <endpoint-id> | awk '$4 ~ /8000/ || NR<=1'
+```
+
+Expect exactly one row, the CNPG operator, with non-zero counters once it has
+polled:
+
+```
+Allow  Ingress  k8s:app.kubernetes.io/instance=cloudnative-pg  8000/TCP  11756  58
+```
+
+And confirm CI step pods reach **ICMP only** — never a TCP port:
+
+```sh
+kubectl -n kube-system exec <cilium-pod> -c cilium-agent -- \
+  cilium-dbg bpf policy get <endpoint-id> | grep woodpecker-ci | awk '{print $4}' | sort -u
+```
+
+Every line must be an ICMP/ICMPv6 type. A bare port number here means the
+namespace baseline has grown a rule it should not have.
+
+Note the operator's allow is also confirmed indirectly and more strongly by
+`Ready=True` on the Cluster: that condition only goes true once the operator has
+successfully polled this exact endpoint and port.
+
+And that archiving goes to the new prefix, leaving the old one alone:
+
+```sh
+kubectl -n woodpecker get cluster wp-pg -o jsonpath='{.status.conditions[?(@.type=="ContinuousArchiving")]}'
+```
+
+## Stage 2 — the cutover
+
+Moves server, agent, service, ingress, pdb, the agent ServiceAccount, the
+`woodpecker-secret` ExternalSecret and the rotator policy into `woodpecker`,
+points the server's DSN at `wp-pg-rw.woodpecker.svc`, repoints the agent's gRPC
+at `woodpecker.woodpecker.svc:9000`, moves the openbao rotators' egress, and
+adds the `woodpecker-ci` → server `:8000` policy that stage 1 deliberately
+deferred — scoped to the server pod, not the namespace baseline.
+
+**This is the downtime window.** Flux prunes the `apps` copies and creates the
+`woodpecker` ones; `ci.renner.uno` is down in between, and in-flight pipelines
+die with their agent.
+
+**The outage outlasts the pods becoming Ready, because of TLS.** Certificates
+are namespace-scoped, so moving the Ingress does not move `woodpecker-tls` —
+cert-manager issues a fresh one in the new namespace. Until it completes,
+Traefik serves a default certificate and clients fail before they get an HTTP
+status at all:
+
+```
+curl: (60) SSL: no alternative certificate subject name matches target hostname 'ci.renner.uno'
+```
+
+That is expected, not a routing or policy fault. Watch it clear with:
+
+```sh
+kubectl -n woodpecker get certificate woodpecker-tls -w
+```
+
+`letsencrypt-cluster` solves **DNS-01** via Cloudflare, so there is no in-cluster
+ACME solver pod and no HTTP challenge to admit through the network policies —
+worth knowing before scoping any ingress rule, since an HTTP-01 issuer would
+need the solver reachable too.
+
+The four CNPG files (`cluster.yaml`, `objectstore.yaml`, `scheduled-backup.yaml`,
+`hetzner-creds-externalsecret.yaml`) still describe the **original** apps-namespace
+cluster and are deliberately untouched — they are the rollback. Stage 3 retires
+them.
+
+### Verifying stage 2
+
+```sh
+kubectl -n woodpecker get pods
+kubectl -n apps get pods -l app.kubernetes.io/name=woodpecker   # expect none
+```
+
+The server must reach the restored database, not the old one:
+
+```sh
+kubectl -n woodpecker logs deploy/woodpecker-server --tail=40 | grep -i "database\|migrat\|error"
+kubectl -n woodpecker exec deploy/woodpecker-server -- env | grep DATASOURCE
+```
+
+Then confirm the UI and a real pipeline, which is the only check that exercises
+server → agent → step pod → server end to end:
+
+```sh
+curl -sS -o /dev/null -w '%{http_code}\n' https://ci.renner.uno/
+woodpecker pipeline create --branch master --var PIPELINE=e2e-test k.renner/homelab
+```
+
+Step pods must still reach the server on `:8000` while still being unable to
+reach wp-pg on any TCP port — re-run the `bpf policy get` checks above against
+both the server's and wp-pg's endpoint ids.
+
+Check the rotators can still reach the server, since their egress moved:
+
+```sh
+kubectl -n openbao get cronjob
+kubectl -n openbao logs -l app.kubernetes.io/component=secret-rotator --tail=20
+```
+
+### Rolling back stage 2
+
+Revert the PR. Flux recreates the `apps` workloads and the DSN points back at
+`wp-pg-rw.apps.svc`, which never stopped running. Data written to the new
+cluster during the window is lost, so roll back promptly or not at all — if
+pipelines have run against `woodpecker/wp-pg`, prefer fixing forward.
+
+## Stage 3 — retiring the old cluster
+
+Deletes the four `apps` manifests, promotes the `migration-*` set onto their
+names, and gives the surviving Cluster the `prune: disabled` data guard it was
+deliberately denied while a rollback still existed.
+
+**Merging stage 3 does not delete anything.** The old resources carry
+`kustomize.toolkit.fluxcd.io/prune: disabled`, so dropping them from git only
+stops Flux managing them — they keep running, and keep occupying their PVC.
+That is the point: the PR is reversible, the teardown is a separate, deliberate
+act.
+
+Before deleting anything, confirm the new cluster is genuinely standing on its
+own — that it has taken at least one base backup to its own prefix, so recovery
+no longer depends on the retired cluster's data:
+
+```sh
+kubectl -n woodpecker get backup.postgresql.cnpg.io
+kubectl -n woodpecker get cluster wp-pg -o jsonpath='{.status.conditions}'
+```
+
+`LastBackupSucceeded` must be `True`, not merely `BackupStarted`.
+
+Then retire the old set:
+
+```sh
+kubectl -n apps delete scheduledbackup.postgresql.cnpg.io wp-pg-daily
+kubectl -n apps delete cluster.postgresql.cnpg.io wp-pg          # deletes its PVCs
+kubectl -n apps delete objectstore.barmancloud.cnpg.io wp-pg-store
+kubectl -n apps delete externalsecret hetzner-s3-creds
+```
+
+Delete the ScheduledBackup first: leaving it while the Cluster goes away
+produces failing backup jobs against a cluster that no longer exists.
+
+**What this destroys and what it does not.** It destroys the old cluster's PVCs
+— including the four pipeline records that only ever existed there (see the
+stage-1 verification section). It does **not** touch
+`s3://renner-uno-k8s-cnpg/wp-pg`: that prefix keeps its backups until their own
+retention expires, and `wp-pg-store-source` is retained precisely so it stays
+restorable. That is the real safety net, not the running cluster.
+
+### After the teardown
+
+The `apps` namespace should have no woodpecker-related objects left:
+
+```sh
+kubectl -n apps get cluster,objectstore,scheduledbackup,externalsecret 2>/dev/null | grep -i "wp-pg\|hetzner" || echo "clean"
+```
+
+## Rolling back stage 1
+
+Delete the four resources and the namespace. Nothing references them, and the
+`apps` cluster is untouched:
+
+```sh
+kubectl delete ns woodpecker
+```
+
+Then revert this PR so Flux stops recreating them.

kubernetes/apps/woodpecker/agent.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: woodpecker-agent
-  namespace: apps
+  namespace: woodpecker
   labels:
     app.kubernetes.io/name: woodpecker
     app.kubernetes.io/component: agent
@@ -12,7 +12,7 @@ metadata:
     secret.reloader.stakater.com/reload: woodpecker-secret
 spec:
   # 1: the in-cluster server owns ci.renner.uno now, so this agent registers with
-  # it (woodpecker.apps.svc:9000) and runs pipelines on the kubernetes backend,
+  # it (woodpecker.woodpecker.svc:9000) and runs pipelines on the kubernetes backend,
   # replacing the retired docker agents (LXC 910/911).
   replicas: 1
   selector:
@@ -37,7 +37,7 @@ spec:
           image: woodpeckerci/woodpecker-agent:v3.17.0 # {"$imagepolicy": "flux-system:woodpecker-agent"}
           env:
             - name: WOODPECKER_SERVER
-              value: woodpecker.apps.svc.cluster.local:9000 # in-cluster gRPC, replaces LXC :9000
+              value: woodpecker.woodpecker.svc.cluster.local:9000 # in-cluster gRPC, replaces LXC :9000
             - name: WOODPECKER_MAX_WORKFLOWS
               value: "2"
             # --- kubernetes backend: pipeline steps run as native pods (retires

kubernetes/apps/woodpecker/cluster.yaml

@@ -1,19 +1,27 @@
+---
+# Woodpecker's Postgres backend. Serves the server at wp-pg-rw.woodpecker.svc.
+#
+# Originally created in `apps` with bootstrap.initdb; moved here by restoring
+# from barman into the new namespace rather than by editing a namespace field,
+# because PVCs are namespace-scoped and a Cluster cannot be relocated in place
+# (issue #433, MIGRATION-namespace.md).
+#
+# The bootstrap.recovery stanza and its externalCluster are retained rather than
+# reverted to initdb. CNPG honours `bootstrap` only when PGDATA is absent, so on
+# this live cluster it is inert — and keeping it means a cold rebuild of an
+# empty cluster restores from backup instead of coming up empty, which is the
+# gap kubernetes/RECOVERY.md exists to close for the other CNPG clusters.
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
   name: wp-pg
-  namespace: apps
+  namespace: woodpecker
   annotations:
-    # CRITICAL data-guard: prune-disabled so the seed-woodpecker -> dedicated
-    # woodpecker KS ownership handoff can never prune this Cluster (which would
-    # delete its data PVCs). Landed here first, via seed-woodpecker, so it's
-    # live before the move. Kept permanently as a standing guard.
+    # Data guard, earned at stage 3 now that this is the only copy: prevents a
+    # Flux prune from deleting the Cluster and with it the data PVCs. The
+    # migration deliberately withheld this while a rollback still existed.
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
-  # Single instance: the Woodpecker CI DB is small and non-critical (state is
-  # largely reconstructable), so HA isn't warranted — but WAL archiving to
-  # object storage still gives point-in-time backups. Mirrors grafana-db's
-  # single-instance shape, with barman enabled like immich/paperless.
   instances: 1
   imageName: ghcr.io/cloudnative-pg/postgresql:16
   storage:
@@ -25,9 +33,25 @@ spec:
       parameters:
         barmanObjectName: wp-pg-store
   bootstrap:
-    initdb:
+    recovery:
+      source: wp-pg-apps
+      # Must mirror the initdb values of the cluster this restores from
+      # (apps/wp-pg: database woodpecker, owner woodpecker). CNPG defaults
+      # `database` to `app` and `owner` to whatever `database` is, and those
+      # names do not exist in the physically restored data — it would provision
+      # an empty `app` database, point the generated wp-pg-app Secret and the
+      # -app Service at it, and leave the real data unreachable through them.
+      # Same pattern as every recovery example in kubernetes/RECOVERY.md.
       database: woodpecker
       owner: woodpecker
+  externalClusters:
+    - name: wp-pg-apps
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: wp-pg-store-source
+          # The cluster that produced the backup, not this one.
+          serverName: wp-pg
   postgresql:
     parameters:
       shared_buffers: "128MB"

kubernetes/apps/woodpecker/externalsecret.yaml

@@ -2,7 +2,7 @@ apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: woodpecker-secret
-  namespace: apps
+  namespace: woodpecker
 spec:
   # 10m (was 1h) so an automated rotation (rotate-agent-secret.yaml writes a new
   # value to OpenBao) propagates into the k8s Secret within ~10m without a manual

kubernetes/apps/woodpecker/hetzner-creds-externalsecret.yaml

@@ -1,11 +1,20 @@
+---
+# Barman S3 credentials for wp-pg.
+#
+# Sourced from seed/paperless/hetzner-creds, which is not where they belong.
+# Issue #397 wants woodpecker to own seed/woodpecker/hetzner-creds; creating
+# that path needs OpenBao write access (`bao kv list seed` → 403 for the
+# identities available here), so it stays open. The values are identical, so it
+# is a one-line swap of the `key:` below once the path exists.
+#
+# The namespace allowlist on the openbao ClusterSecretStore
+# (infrastructure/post-crds/openbao-clustersecretstore.yaml) must include this
+# namespace, or ESO silently never syncs — see #505.
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: hetzner-s3-creds
-  namespace: apps
-  annotations:
-    # Prune-disabled — a standing guard kept from the seed->dedicated-KS handoff (barman S3 creds).
-    kustomize.toolkit.fluxcd.io/prune: disabled
+  namespace: woodpecker
 spec:
   refreshInterval: 1h
   secretStoreRef:
@@ -14,10 +23,5 @@ spec:
   target:
     name: hetzner-s3-creds
   dataFrom:
-    # Reuses the paperless copy of the shared Hetzner S3 credentials (identical
-    # ACCESS_KEY_ID / ACCESS_SECRET_KEY / REGION) to avoid seeding a new OpenBao
-    # path for this migration. FOLLOW-UP: give woodpecker its own
-    # seed/woodpecker/hetzner-creds path once OpenBao can be written, and repoint
-    # this here (the value is the same, so it's a drop-in swap).
     - extract:
         key: seed/paperless/hetzner-creds

kubernetes/apps/woodpecker/ingress.yaml

@@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: woodpecker
-  namespace: apps
+  namespace: woodpecker
   labels:
     app.kubernetes.io/name: woodpecker
   annotations:

kubernetes/apps/woodpecker/kustomization.yaml

@@ -21,11 +21,20 @@ resources:
   # (kubernetes/infrastructure/openbao/rotation/woodpecker.yaml) — intra-ns
   # OpenBao access, no NetworkPolicy needed. server.yaml/agent.yaml keep their
   # Reloader annotations; externalsecret.yaml keeps the 10m refreshInterval.
-  # wp-pg CNPG Postgres backend (moved here from the retired seed-woodpecker KS;
-  # each object carries prune: disabled so ownership transferred without a
-  # teardown). The dedicated `woodpecker` KS depends on infrastructure-cnpg-barman
-  # for the barman plugin behind the ObjectStore/ScheduledBackup.
-  - cluster.yaml
-  - objectstore.yaml
-  - scheduled-backup.yaml
+  # --- namespace migration, stages 1-2 (issue #433) ---
+  # Stage 2 has moved the workloads above (server, agent, service, ingress, pdb,
+  # rbac, secrets, policies) into the `woodpecker` namespace and pointed the
+  # server's DSN at wp-pg-rw.woodpecker.svc. Stage 3 retired the `apps`
+  # originals; these four now describe the surviving cluster. History and the
+  # reasoning behind the three stages: MIGRATION-namespace.md.
+  #
+  # The `woodpecker` Namespace itself is declared in infrastructure/namespaces,
+  # not here: it must exist before the `infrastructure-crds` KS applies the
+  # namespace's CiliumNetworkPolicies, and this KS runs after both of those.
+  #
+  # This KS depends on infrastructure-cnpg-barman for the barman plugin behind
+  # the ObjectStore and ScheduledBackup.
   - hetzner-creds-externalsecret.yaml
+  - objectstore.yaml
+  - cluster.yaml
+  - scheduled-backup.yaml

kubernetes/apps/woodpecker/networkpolicy.yaml

@@ -1,20 +1,23 @@
 # Secret rotation: the review-bot and claude-oauth rotators (openbao ns) reach
 # the Woodpecker SERVER to upsert org-level CI secrets (review_bot_token,
 # claude_code_oauth_token). They use the in-cluster Service
-# (woodpecker.apps.svc:8000) — the public ci.renner.uno name hairpins off the
-# ingress LB from a pod. The apps default-deny-ingress only allows same-ns /
-# host / a few named sources, so without this the rotator's connect to :8000 is
+# (woodpecker.woodpecker.svc:8000) — the public ci.renner.uno name hairpins off the
+# ingress LB from a pod. This namespace's baseline
+# (network-policies/woodpecker-ns.yaml) admits only same-namespace, monitoring,
+# host/remote-node and ICMP, so without this the rotator's connect to :8000 is
 # dropped. Scoped to the woodpecker SERVER pod :8000 and the two rotator labels;
 # the egress halves are rotator-review-bot-egress + rotator-claude-oauth-egress
 # in network-policies/openbao-ns.yaml.
 #
-# This is additive to the apps-ns baseline allows (allow-ingress.yaml selects all
-# apps pods), so the server's existing ingress — Traefik, agents — is unaffected.
+# Cilium unions allow rules, so this composes with the baseline and with the
+# sibling policies below (traefik, CI steps) rather than replacing them. Note
+# allow-ingress.yaml does NOT apply here — it is hard-scoped to `namespace:
+# apps`, which is why traefik needs its own rule in this file now.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
   name: woodpecker-allow-rotators
-  namespace: apps
+  namespace: woodpecker
 spec:
   endpointSelector:
     matchLabels:
@@ -34,3 +37,25 @@ spec:
         - ports:
             - port: "8000"
               protocol: TCP
+---
+# Pipeline step pods call the server back on :8000 to stream logs and report
+# status. Deferred from stage 1 on purpose, and scoped to the SERVER pod rather
+# than granted on the namespace baseline.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: woodpecker-allow-ci-steps
+  namespace: woodpecker
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: woodpecker
+      app.kubernetes.io/component: server
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": woodpecker-ci
+      toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP

kubernetes/apps/woodpecker/objectstore.yaml

@@ -1,18 +1,20 @@
 ---
+# RECOVERY SOURCE — read-only. The prefix the retired `apps/wp-pg` archived to.
+#
+# Kept after the migration on purpose. Nothing writes to it, and the backups
+# under it age out on their own retention, but while they last this is a second,
+# independent restore point that predates the move — worth having until the new
+# prefix has a meaningful backup history of its own.
+#
+# serverName on the consuming externalCluster must be `wp-pg`, the name of the
+# cluster that produced these backups.
 apiVersion: barmancloud.cnpg.io/v1
 kind: ObjectStore
 metadata:
-  name: wp-pg-store
-  namespace: apps
-  annotations:
-    # Prune-disabled — a standing guard kept from the seed->dedicated-KS handoff (backup target).
-    kustomize.toolkit.fluxcd.io/prune: disabled
+  name: wp-pg-store-source
+  namespace: woodpecker
 spec:
   configuration:
-    # Same offsite Hetzner Object Storage bucket as the other CNPG clusters,
-    # under a per-cluster prefix. See apps/paperless/objectstore.yaml for the
-    # SSE / addressing rationale (Hetzner is SSE-C only; transit is TLS,
-    # bucket private).
     destinationPath: s3://renner-uno-k8s-cnpg/wp-pg
     endpointURL: https://fsn1.your-objectstorage.com
     s3Credentials:
@@ -29,4 +31,36 @@ spec:
       compression: gzip
     data:
       compression: gzip
+  # No retentionPolicy: this store is a read source during the migration, and
+  # the old cluster in `apps` owns the lifecycle of the data underneath it.
+---
+# ARCHIVING TARGET — a DIFFERENT prefix from the source, deliberately.
+#
+# Two clusters archiving WAL to one destinationPath interleave their streams and
+# corrupt both. That mattered during the parallel-run window; it still matters
+# now, because the source prefix above is retained and must stay frozen for the
+# independent restore point it provides.
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: wp-pg-store
+  namespace: woodpecker
+spec:
+  configuration:
+    destinationPath: s3://renner-uno-k8s-cnpg/wp-pg-woodpecker
+    endpointURL: https://fsn1.your-objectstorage.com
+    s3Credentials:
+      accessKeyId:
+        name: hetzner-s3-creds
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: hetzner-s3-creds
+        key: ACCESS_SECRET_KEY
+      region:
+        name: hetzner-s3-creds
+        key: REGION
+    wal:
+      compression: gzip
+    data:
+      compression: gzip
   retentionPolicy: "30d"

kubernetes/apps/woodpecker/pdb.yaml

@@ -15,7 +15,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: woodpecker-server
-  namespace: apps
+  namespace: woodpecker
   labels:
     app.kubernetes.io/name: woodpecker
     app.kubernetes.io/component: server

kubernetes/apps/woodpecker/rbac.yaml

@@ -17,7 +17,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: woodpecker-agent
-  namespace: apps
+  namespace: woodpecker
   labels:
     app.kubernetes.io/name: woodpecker
     app.kubernetes.io/component: agent
@@ -60,4 +60,7 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: woodpecker-agent
-    namespace: apps
+    # The agent's SA lives in `woodpecker`; this Role/RoleBinding stays in
+    # `woodpecker-ci`, because that is the namespace it grants pod
+    # create/delete in. Cross-namespace subject, deliberately.
+    namespace: woodpecker

kubernetes/apps/woodpecker/scheduled-backup.yaml

@@ -1,18 +1,19 @@
 ---
-# Daily base backup at 02:35 UTC (offset from the other clusters' 02:30 to
-# avoid a thundering herd against the Hetzner bucket). WAL archiving runs
-# continuously (see cluster.yaml spec.plugins[].isWALArchiver). immediate:true
-# takes the first base backup as soon as this CR applies.
+# Daily base backups onto the wp-pg-woodpecker prefix. Continuous WAL archiving
+# runs separately (cluster.yaml spec.plugins[].isWALArchiver); without periodic
+# base backups the prefix would have no recovery point of its own and
+# wp-pg-store's retentionPolicy: 30d would have nothing to prune against, so the
+# WAL chain would grow without bound.
+#
+# 02:40 UTC, offset from the other CNPG clusters' 02:30 so they do not all hit
+# the Hetzner bucket together.
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup
 metadata:
   name: wp-pg-daily
-  namespace: apps
-  annotations:
-    # Prune-disabled — a standing guard kept from the seed->dedicated-KS handoff (backup schedule).
-    kustomize.toolkit.fluxcd.io/prune: disabled
+  namespace: woodpecker
 spec:
-  schedule: "0 35 2 * * *"
+  schedule: "0 40 2 * * *"
   immediate: true
   backupOwnerReference: self
   cluster:

kubernetes/apps/woodpecker/secret.example.yaml

@@ -14,7 +14,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: woodpecker-secret
-  namespace: apps
+  namespace: woodpecker
   labels:
     app.kubernetes.io/name: woodpecker
 type: Opaque

kubernetes/apps/woodpecker/server.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: woodpecker-server
-  namespace: apps
+  namespace: woodpecker
   labels:
     app.kubernetes.io/name: woodpecker
     app.kubernetes.io/component: server
@@ -84,7 +84,7 @@ spec:
             - name: WOODPECKER_DATABASE_DRIVER
               value: postgres
             - name: WOODPECKER_DATABASE_DATASOURCE
-              value: "host=wp-pg-rw.apps.svc.cluster.local port=5432 user=$(WP_DB_USER) password=$(WP_DB_PASS) dbname=woodpecker sslmode=require"
+              value: "host=wp-pg-rw.woodpecker.svc.cluster.local port=5432 user=$(WP_DB_USER) password=$(WP_DB_PASS) dbname=woodpecker sslmode=require"
           # AGENT_SECRET + GITEA_CLIENT + GITEA_SECRET come from the SOPS secret.
           envFrom:
             - secretRef:

kubernetes/apps/woodpecker/service.yaml

@@ -2,13 +2,13 @@ apiVersion: v1
 kind: Service
 metadata:
   name: woodpecker
-  namespace: apps
+  namespace: woodpecker
   labels:
     app.kubernetes.io/name: woodpecker
 spec:
   # Flipped ExternalName -> ClusterIP: ci.renner.uno (via the Ingress, by name)
   # and the in-cluster agent both target this Service now. http:8000 serves the
-  # UI/API; grpc:9000 is how the agent (woodpecker.apps.svc:9000) reaches the
+  # UI/API; grpc:9000 is how the agent (woodpecker.woodpecker.svc:9000) reaches the
   # server. Selects the server pod only (not the agent).
   type: ClusterIP
   selector:

kubernetes/apps/wordpress/deployment.yaml

@@ -0,0 +1,115 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wordpress
+  namespace: wordpress
+  annotations:
+    secret.reloader.stakater.com/reload: wordpress-secrets
+spec:
+  replicas: 1
+  strategy:
+    # RWO volume, single writer — the rolling default would deadlock on the
+    # new pod waiting for a volume the old pod still holds.
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: wordpress
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: wordpress
+    spec:
+      securityContext:
+        # wp-content must be writable by Apache (www-data, uid/gid 33) for
+        # media uploads and plugin installs.
+        fsGroup: 33
+      containers:
+        - name: wordpress
+          image: wordpress:7.0.4-php8.3-apache
+          ports:
+            - name: http
+              containerPort: 80
+          env:
+            # The operator names the base Service after the MariaDB resource;
+            # the CRD's separate primaryService/secondaryService fields are the
+            # suffixed variants for replicated setups, which this is not
+            # (replicas: 1). Not verified against a running cluster — if it is
+            # wrong the pod fails loudly on connect at startup rather than
+            # degrading quietly. Confirm with `kubectl get svc -n wordpress`
+            # on first deploy.
+            - name: WORDPRESS_DB_HOST
+              value: wordpress-mariadb.wordpress.svc.cluster.local:3306
+            - name: WORDPRESS_DB_NAME
+              value: wordpress
+            - name: WORDPRESS_DB_USER
+              value: wordpress
+            - name: WORDPRESS_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  # Generated by the operator from the MariaDB CR — never
+                  # stored in Git or OpenBao.
+                  name: wordpress-mariadb-app
+                  key: password
+            - name: WORDPRESS_CONFIG_EXTRA
+              value: |
+                define('WP_HOME', 'https://www.renner.uno');
+                define('WP_SITEURL', 'https://www.renner.uno');
+                define('FORCE_SSL_ADMIN', true);
+                /* Traefik terminates TLS; without this WordPress sees plain
+                   HTTP and builds http:// URLs into every page and redirect. */
+                if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
+                    $_SERVER['HTTPS'] = 'on';
+                }
+                /* Core lives in the image, not on the volume — the updater
+                   would only fail against a read-only docroot. Plugin and
+                   theme installs are unaffected. */
+                define('WP_AUTO_UPDATE_CORE', false);
+                /* No add_filter() here. WORDPRESS_CONFIG_EXTRA is eval'd inside
+                   wp-config.php, long before wp-settings.php loads the plugin
+                   API, so any add_filter call is a fatal error on every request
+                   — which is exactly what happened on first deploy. xmlrpc is
+                   handled at the ingress instead, by routing /xmlrpc.php
+                   through the Authentik gate. */
+          envFrom:
+            # The eight WordPress salts. Rotating them in OpenBao invalidates
+            # every session — which is the intended lever, not a side effect.
+            - secretRef:
+                name: wordpress-secrets
+          volumeMounts:
+            - name: content
+              mountPath: /var/www/html/wp-content
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: 50m
+              memory: 256Mi
+            limits:
+              memory: 768Mi
+      volumes:
+        - name: content
+          persistentVolumeClaim:
+            claimName: wordpress-content
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wordpress
+  namespace: wordpress
+spec:
+  selector:
+    app.kubernetes.io/name: wordpress
+  ports:
+    - name: http
+      port: 80
+      targetPort: http

kubernetes/apps/wordpress/externalsecret.yaml

@@ -0,0 +1,46 @@
+# The eight WordPress salts (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY,
+# NONCE_KEY, AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT, NONCE_SALT).
+# Expected keys in OpenBao at homelab/apps/wordpress, named exactly as the
+# image's env vars: WORDPRESS_AUTH_KEY, WORDPRESS_SECURE_AUTH_KEY, ...
+#
+# Deliberately NOT carried over from the old wp-config.php: the Hetzner host
+# is being decommissioned and its salts have been sitting on a VM whose
+# neighbour site was compromised this month. New salts cost one logout.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wordpress-secrets
+  namespace: wordpress
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: wordpress-secrets
+  dataFrom:
+    - extract:
+        key: apps/wordpress
+---
+# S3 credentials for the MariaDB Backup.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hetzner-s3-creds
+  namespace: wordpress
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: hetzner-s3-creds
+  dataFrom:
+    # Reuses the paperless copy of the shared Hetzner S3 credentials (identical
+    # ACCESS_KEY_ID / ACCESS_SECRET_KEY / REGION) to avoid seeding a new OpenBao
+    # path for this migration — same approach woodpecker took. FOLLOW-UP: give
+    # wordpress its own seed/wordpress/hetzner-creds path once OpenBao can be
+    # written, and repoint this here (the value is the same, so it's a drop-in
+    # swap).
+    - extract:
+        key: seed/paperless/hetzner-creds

kubernetes/apps/wordpress/gate-service.yaml

@@ -0,0 +1,15 @@
+# A plain Ingress cannot point at a Service in another namespace, and the
+# Authentik outposts all live in `authentik`. Same workaround as
+# zone-configurator and paperless: mirror the outpost Service in as an
+# ExternalName.
+apiVersion: v1
+kind: Service
+metadata:
+  name: ak-outpost-wordpress-gate
+  namespace: wordpress
+spec:
+  type: ExternalName
+  externalName: ak-outpost-wordpress-gate.authentik.svc.cluster.local
+  ports:
+    - port: 9000
+      targetPort: 9000

kubernetes/apps/wordpress/ingress.yaml

@@ -0,0 +1,110 @@
+# Two routers on one host. The site itself must stay readable by anyone --
+# it is a family blog -- while the editing surface sits behind Authentik.
+#
+# Why not one gated Ingress with skip_path_regex, the way paperless-gate
+# carves out /static/: that works when the PUBLIC paths are enumerable. Here
+# it is the reverse -- every post URL is public and only two paths are gated
+# -- which would need a negative lookahead. The outpost is Go, and RE2 has no
+# lookahead. So the split happens at the router instead.
+#
+# Traefik orders routers by rule length, so PathPrefix(`/wp-admin`) is
+# evaluated before PathPrefix(`/`); no explicit priority is needed.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wordpress
+  namespace: wordpress
+  labels:
+    dns.renner.uno/public: "true"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: www.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wordpress
+                port:
+                  number: 80
+  tls:
+    - secretName: wordpress-tls
+      hosts:
+        - www.renner.uno
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wordpress-admin
+  namespace: wordpress
+  labels:
+    # Same label as the public Ingress on purpose. external-dns-unifi runs
+    # with --label-filter=dns.renner.uno/public!=true, so an unlabelled
+    # Ingress on this host would quietly gain a UDM A-record pointing LAN
+    # clients straight at the Traefik VIP -- a second, unintended path to
+    # the same host that skips the public route entirely.
+    dns.renner.uno/public: "true"
+  # No cert-manager annotation and no tls block: the public Ingress above
+  # already owns the certificate for this host. Declaring it twice would
+  # create two Certificates racing for the same wordpress-tls Secret.
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: www.renner.uno
+      http:
+        paths:
+          # The outpost's own OAuth leg. Without this the gate is a dead end,
+          # not a gate: hitting /wp-admin redirects to
+          # /outpost.goauthentik.io/start on THIS host, which otherwise falls
+          # through to the public `/` router and lands on WordPress's 404
+          # page — verified exactly that way on first deploy. paperless needs
+          # the same route and has it as a separate Ingress on auth.renner.uno
+          # (apps/authentik/paperless-gate-ingress.yaml); here the flow stays
+          # on www.renner.uno, so it belongs in this rule set.
+          #
+          # It is not an authentication hole: these endpoints ARE the login
+          # flow, and the outpost serves them itself.
+          - path: /outpost.goauthentik.io
+            pathType: Prefix
+            backend:
+              service:
+                name: ak-outpost-wordpress-gate
+                port:
+                  number: 9000
+          # Covers admin-ajax.php too. That is only safe because the gift
+          # registry plugin -- the sole thing on this site that ever emitted
+          # an ajaxurl -- is being dropped in the migration. Verified against
+          # the live site: 121 admin-ajax hits in the current log window, not
+          # one of them a 200.
+          - path: /wp-admin
+            pathType: Prefix
+            backend:
+              service:
+                name: ak-outpost-wordpress-gate
+                port:
+                  number: 9000
+          - path: /wp-login.php
+            pathType: Exact
+            backend:
+              service:
+                name: ak-outpost-wordpress-gate
+                port:
+                  number: 9000
+          # xmlrpc.php would otherwise be served by the public `/` prefix
+          # router — an earlier version of this file claimed it was "blocked
+          # at the ingress" while nothing blocked it at all. There is no deny
+          # verb in an Ingress, so it goes through the gate instead: anonymous
+          # callers get Authentik, not the XML-RPC endpoint. Nothing on this
+          # site uses it (no Jetpack, no mobile app, no pingbacks worth
+          # keeping), so no legitimate caller is affected.
+          - path: /xmlrpc.php
+            pathType: Exact
+            backend:
+              service:
+                name: ak-outpost-wordpress-gate
+                port:
+                  number: 9000

kubernetes/apps/wordpress/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - externalsecret.yaml
+  - mariadb.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - gate-service.yaml
+  - ingress.yaml

kubernetes/apps/wordpress/mariadb.yaml

@@ -0,0 +1,86 @@
+# The database for www.renner.uno. Named `wordpress-mariadb`, not `wp-*`:
+# `wp-pg` in the woodpecker namespace is Woodpecker's Postgres, and reusing
+# the prefix for an unrelated engine invites exactly the wrong guess.
+#
+# Mirrors the CNPG convention: the operator lives in `database`, the database
+# resource lives with its consumer (ak-pg in authentik, im-pg in immich).
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: MariaDB
+metadata:
+  name: wordpress-mariadb
+  namespace: wordpress
+  annotations:
+    # Data guard — a Kustomization rebuild must never take the database with it.
+    kustomize.toolkit.fluxcd.io/prune: disabled
+spec:
+  # generate: true lets the operator create both Secrets on first reconcile.
+  # Neither password is ever typed by a human or parked in OpenBao, so there
+  # is nothing to rotate by hand and nothing to leak through Git.
+  rootPasswordSecretKeyRef:
+    name: wordpress-mariadb-root
+    key: password
+    generate: true
+  username: wordpress
+  passwordSecretKeyRef:
+    name: wordpress-mariadb-app
+    key: password
+    generate: true
+  database: wordpress
+  port: 3306
+  replicas: 1
+
+  storage:
+    size: 5Gi
+    storageClassName: ceph-block
+  # The source database is 527 KB. 5Gi is not a sizing estimate, it is the
+  # smallest allocation that leaves room for binlogs and a decade of posts.
+
+  myCnf: |
+    [mariadb]
+    bind-address=*
+    default_storage_engine=InnoDB
+    innodb_buffer_pool_size=256M
+    # WordPress writes utf8mb4 throughout; the source dump carries
+    # utf8mb4_unicode_520_ci on every table that survives the migration.
+    character_set_server=utf8mb4
+    collation_server=utf8mb4_unicode_520_ci
+    max_allowed_packet=64M
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 512Mi
+    limits:
+      memory: 1Gi
+---
+# Logical backup to Hetzner Object Storage. Velero only captures PVC data,
+# which for a running database is crash-consistent, not transaction-consistent
+# — that is a snapshot, not a backup you would want to restore from.
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Backup
+metadata:
+  name: wordpress-mariadb-backup
+  namespace: wordpress
+spec:
+  mariaDbRef:
+    name: wordpress-mariadb
+  schedule:
+    # 02:45, ahead of the Velero window that starts at 03:15.
+    cron: "45 2 * * *"
+    suspend: false
+  maxRetention: 720h # 30d, matching the CNPG ObjectStore retentionPolicy
+  compression: gzip
+  storage:
+    s3:
+      bucket: renner-uno-k8s-mariadb
+      prefix: wordpress
+      endpoint: fsn1.your-objectstorage.com
+      region: fsn1
+      accessKeyIdSecretKeyRef:
+        name: hetzner-s3-creds
+        key: ACCESS_KEY_ID
+      secretAccessKeySecretKeyRef:
+        name: hetzner-s3-creds
+        key: ACCESS_SECRET_KEY
+      tls:
+        enabled: true

kubernetes/apps/wordpress/pvc.yaml

@@ -0,0 +1,35 @@
+# Only wp-content is persisted, not the whole docroot. WordPress core comes
+# from the pinned image, so upgrading the site means bumping a tag in Git
+# rather than clicking "update" in wp-admin — which is the entire point of
+# moving off the Hetzner VM, where core was a mutable pile of PHP on disk.
+#
+# Consequence to be aware of: WordPress's own core updater will fail against
+# a read-only core. Plugin and theme installs still work, because those land
+# in wp-content.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: wordpress-content
+  namespace: wordpress
+  labels:
+    # The Velero Schedule selects ON this label rather than excluding the
+    # database PVC by one the mariadb-operator is merely assumed to set. If
+    # that assumption were wrong the exclusion would fail silently and Velero
+    # would snapshot the live database volume; selecting a label this repo
+    # owns cannot fail that way. Same direction as openbao-daily, which picks
+    # its snapshot PVC by app.kubernetes.io/component.
+    app.kubernetes.io/name: wordpress
+    app.kubernetes.io/component: content
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+spec:
+  accessModes:
+    - ReadWriteOnce
+  # RWO is sufficient: a single replica with strategy Recreate. ceph-block is
+  # the cluster default; named explicitly so a default change can't silently
+  # move the media library onto another class.
+  storageClassName: ceph-block
+  resources:
+    requests:
+      # The migrated wp-content is 29 MB compressed, 13 MB of it uploads.
+      storage: 10Gi

kubernetes/clusters/homelab/infrastructure.yaml

@@ -48,6 +48,10 @@ spec:
       kind: HelmRelease
       name: cloudnative-pg # DB operator — seed jobs create databases
       namespace: database
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: mariadb-operator # the MySQL half — WordPress can't use CNPG
+      namespace: database
   # decryption block dropped 2026-07-13: no *.sops.yaml left under this
   # path — secrets come from OpenBao via ESO (MIGRATION-sops-openbao.md).
 ---

kubernetes/clusters/homelab/wordpress.yaml

@@ -0,0 +1,29 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: wordpress
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  timeout: 15m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./kubernetes/apps/wordpress
+  prune: true
+  dependsOn:
+    # infrastructure gates on the mariadb-operator HelmRelease being Ready,
+    # so the MariaDB CRD exists and has a controller before this applies.
+    - name: infrastructure
+    - name: infrastructure-crds
+    - name: infrastructure-ceph-cluster
+  # kstatus has no built-in rule for k8s.mariadb.com resources, so without
+  # this the Kustomization would report Ready the moment the manifests are
+  # accepted — before the database is actually serving. Same reasoning as
+  # the CephCluster expressions in infrastructure.yaml.
+  healthCheckExprs:
+    - apiVersion: k8s.mariadb.com/v1alpha1
+      kind: MariaDB
+      failed: "has(status.conditions) && status.conditions.exists(c, c.type == 'Ready' && c.status == 'False' && c.reason == 'Failed')"
+      current: "has(status.conditions) && status.conditions.exists(c, c.type == 'Ready' && c.status == 'True')"

kubernetes/infrastructure/cilium/helmrelease.yaml

@@ -17,7 +17,11 @@ spec:
   chart:
     spec:
       chart: cilium
-      version: ">=1.19.0"
+      # Patch-only range: Flux reconciles every 30m and would otherwise take a
+      # CNI minor or major unattended. Widening this is a deliberate, reviewed
+      # act — a minor bump changes datapath behaviour and rolls 2 of 3 agents
+      # at once.
+      version: ">=1.20.0 <1.21.0"
       sourceRef:
         kind: HelmRepository
         name: cilium
@@ -29,6 +33,16 @@ spec:
     remediation:
       retries: 3
   values:
+    # Which pod labels feed security-identity computation. Patterns are
+    # start-anchored regexes; a leading "!" excludes while keeping the default
+    # set. Woodpecker stamps every step pod with woodpecker-ci.org/task-uuid
+    # and step=<name>, so without this each build step is its own identity —
+    # and every identity costs one entry per allowed (direction, proto, port)
+    # in every endpoint's policy map, cluster-wide. Nothing selects on these
+    # labels in policy, so they buy identity churn and nothing else.
+    # Keep in lockstep with kubernetes/talos/patches/cilium-cni.yaml and
+    # kubernetes/talos/cilium.yaml.
+    labels: '!woodpecker-ci\.org/.* !step$'
     ipv6:
       enabled: true
     ipam:
@@ -46,6 +60,19 @@ spec:
       serviceMonitor:
         enabled: true
     bpf:
+      # Size of each endpoint's own cilium_policy_v3_<id> map, holding one
+      # entry per (identity, direction, protocol, port) the endpoint is
+      # allowed. When it fills, endpoint regeneration fails with "no space
+      # left on device", the CNI ADD call never returns, and the pod is stuck
+      # in sandbox creation — so this must stay comfortably above the busiest
+      # endpoint's entry count, tracked by cilium_bpf_map_pressure.
+      # Takes effect on agent restart; the map is sized at creation.
+      # Bootstrap installs Cilium from the inline manifest in
+      # kubernetes/talos/patches/cilium-cni.yaml, so bpf-policy-map-max there
+      # must move with this value or a cold rebuild starts with the old size.
+      # kubernetes/talos/cilium.yaml carries a third copy of the same key.
+      # Nothing enforces any of this; grep bpf-policy-map-max before changing it.
+      policyMapMax: 65536
       # Let pods reach the cluster's own LoadBalancer external IPs; Cilium
       # redirects the socket directly to the backend pod instead of sending
       # traffic out to the VIP and back (which fails with L2 announcements).

kubernetes/infrastructure/kustomization.yaml

@@ -15,6 +15,7 @@ resources:
   - rook-ceph/
   - ceph-csi-drivers/
   - cloudnative-pg/
+  - mariadb-operator/
   - netbird-ingress/
   - netbird-backup/
   - coredns-config/

kubernetes/infrastructure/mariadb-operator/helmrelease.yaml

@@ -0,0 +1,81 @@
+# MariaDB operator, for the one workload in this cluster that cannot use
+# CloudNativePG: WordPress. WordPress speaks MySQL natively — the PostgreSQL
+# route would mean pg4wp, an SQL-rewriting shim whose own README lists
+# WordPress 6.5.3 as its newest tested version while renner.uno runs 7.0.4.
+#
+# The charts are OCI artifacts (ghcr.io), so this follows the OCIRepository
+# pattern from infrastructure/spegel rather than the HelmRepository pattern
+# used for CNPG.
+#
+# CRDs ship as a SEPARATE chart that must be installed first — upstream is
+# explicit about the ordering, hence the dependsOn below rather than a single
+# release with crds: CreateReplace.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: mariadb-operator-crds
+  namespace: database
+spec:
+  interval: 24h
+  url: oci://ghcr.io/mariadb-operator/charts/mariadb-operator-crds
+  ref:
+    # Calendar versioning: the major is the year. Upstream ships an upgrade
+    # guide with each minor (Helm repo deprecations, registry moves), so the
+    # range is capped at the year boundary instead of the usual open ">=".
+    semver: ">=26.6.0 <27.0.0"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: mariadb-operator-crds
+  namespace: database
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: mariadb-operator-crds
+    namespace: database
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: mariadb-operator
+  namespace: database
+spec:
+  interval: 24h
+  url: oci://ghcr.io/mariadb-operator/charts/mariadb-operator
+  ref:
+    semver: ">=26.6.0 <27.0.0"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: mariadb-operator
+  namespace: database
+spec:
+  interval: 30m
+  dependsOn:
+    - name: mariadb-operator-crds
+      namespace: database
+  chartRef:
+    kind: OCIRepository
+    name: mariadb-operator
+    namespace: database
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    # The operator watches all namespaces; the MariaDB CR itself lives with
+    # the app in kubernetes/apps/wordpress/, mirroring how CNPG Clusters sit
+    # in their consumer's namespace (ak-pg in authentik, im-pg in immich).
+    metrics:
+      enabled: false

kubernetes/infrastructure/mariadb-operator/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrelease.yaml

kubernetes/infrastructure/namespaces/namespaces.yaml

@@ -151,3 +151,35 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: trmnl
+---
+# WordPress for www.renner.uno, migrated off the Hetzner VM `wordpress-hochzeit`.
+# No privileged label needed: the cluster enforces `baseline`, which permits the
+# official Apache image's root master process binding :80. It does trip the
+# `restricted` audit/warn level — that is expected and not an error.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: wordpress
+---
+# The Woodpecker service itself — server, agent and its wp-pg Postgres backend,
+# moving out of the shared `apps` namespace (issue #433). Distinct from
+# `woodpecker-ci`, which enforces pod-security: privileged and holds only
+# ephemeral pipeline step pods.
+#
+# `apps` uses an endpointSelector:{} default-deny, so every allow it carries
+# applies to gitea, gatus, external-dns and ical-proxy alike — granting the
+# CNPG operator access to wp-pg there would have opened all of `apps` to all of
+# `database`. A namespace per service keeps that grant on the one workload.
+#
+# Declared here rather than alongside the workloads so it is created by the
+# `infrastructure` KS. The namespace's CiliumNetworkPolicies ship with the
+# `infrastructure-crds` KS (infrastructure/post-crds includes
+# ../network-policies/), which itself dependsOn `infrastructure` — so the
+# namespace exists before any policy targets it. Creating it in the `woodpecker`
+# workload KS would invert that order, since that KS runs after both.
+#
+# No pod-security labels: the cluster default applies.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: woodpecker

kubernetes/infrastructure/network-policies/audiobookshelf-ns.yaml

@@ -31,43 +31,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -103,40 +80,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/authentik-ns.yaml

@@ -38,43 +38,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -103,40 +80,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/crowdsec-ns.yaml

@@ -36,40 +36,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/database-ns.yaml

@@ -32,40 +32,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/evcc-ns.yaml

@@ -27,43 +27,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -102,40 +79,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/external-secrets-ns.yaml

@@ -28,43 +28,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -103,40 +80,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/home-assistant-ns.yaml

@@ -157,44 +157,21 @@ spec:
       icmps:
         - fields:
             - { type: 0,   family: IPv4 }   # Echo Reply
-            - { type: 3,   family: IPv4 }   # Destination Unreachable
-            - { type: 4,   family: IPv4 }   # Source Quench
-            - { type: 5,   family: IPv4 }   # Redirect
+            - { type: 3,   family: IPv4 }   # Destination Unreachable — PMTUD
             - { type: 8,   family: IPv4 }   # Echo Request
-            - { type: 9,   family: IPv4 }   # Router Advertisement
-            - { type: 10,  family: IPv4 }   # Router Solicitation
             - { type: 11,  family: IPv4 }   # Time Exceeded
             - { type: 12,  family: IPv4 }   # Parameter Problem
-            - { type: 13,  family: IPv4 }   # Timestamp
-            - { type: 14,  family: IPv4 }   # Timestamp Reply
-            - { type: 15,  family: IPv4 }   # Information Request
-            - { type: 16,  family: IPv4 }   # Information Reply
-            - { type: 17,  family: IPv4 }   # Address Mask Request
-            - { type: 18,  family: IPv4 }   # Address Mask Reply
-            - { type: 30,  family: IPv4 }   # Traceroute
             - { type: 1,   family: IPv6 }   # Destination Unreachable
-            - { type: 2,   family: IPv6 }   # Packet Too Big
+            - { type: 2,   family: IPv6 }   # Packet Too Big — PMTUD, mandatory
             - { type: 3,   family: IPv6 }   # Time Exceeded
             - { type: 4,   family: IPv6 }   # Parameter Problem
             - { type: 128, family: IPv6 }   # Echo Request
             - { type: 129, family: IPv6 }   # Echo Reply
-            - { type: 130, family: IPv6 }   # Multicast Listener Query
-            - { type: 131, family: IPv6 }   # Multicast Listener Report
-            - { type: 132, family: IPv6 }   # Multicast Listener Done
             - { type: 133, family: IPv6 }   # Router Solicitation
             - { type: 134, family: IPv6 }   # Router Advertisement
             - { type: 135, family: IPv6 }   # Neighbor Solicitation
             - { type: 136, family: IPv6 }   # Neighbor Advertisement
-            - { type: 137, family: IPv6 }   # Redirect
-            - { type: 138, family: IPv6 }   # Router Renumbering
-            - { type: 141, family: IPv6 }   # Inverse ND Solicitation
-            - { type: 142, family: IPv6 }   # Inverse ND Advertisement
             - { type: 143, family: IPv6 }   # MLDv2 Listener Report
-            - { type: 148, family: IPv6 }   # Certification Path Solicitation
-            - { type: 149, family: IPv6 }   # Certification Path Advertisement
-            - { type: 151, family: IPv6 }   # Multicast Router Advertisement
-            - { type: 152, family: IPv6 }   # Multicast Router Solicitation
-            - { type: 153, family: IPv6 }   # Multicast Router Termination
   egress:
     # Cluster-internal callers HA initiates connections to: mosquitto,
     # whisper, matter-server, etc.
@@ -253,43 +230,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
 ---
 # Scoped world ingress — replaces the former namespace-wide `fromEntities:
 # world` allow (see the note in the default-deny-ingress policy above). IoT-VLAN

kubernetes/infrastructure/network-policies/immich-ns.yaml

@@ -42,40 +42,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/influxdb-ns.yaml

@@ -42,40 +42,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/kustomization.yaml

@@ -21,5 +21,7 @@ resources:
   - openbao-ns.yaml
   - external-secrets-ns.yaml
   - woodpecker-ci-ns.yaml
+  - woodpecker-ns.yaml
   - trmnl-ns.yaml
+  - wordpress-ns.yaml
   - allow-cilium-health.yaml

kubernetes/infrastructure/network-policies/monitoring-ns.yaml

@@ -67,40 +67,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/openbao-ns.yaml

@@ -141,9 +141,9 @@ spec:
 ---
 # Egress for the review-bot rotator. Its CronJob has two steps: the init step
 # mints review-bot's PAT against gitea (apps :3000), the main step upserts the
-# Woodpecker org secret against the woodpecker server (apps :8000). Both run
+# Woodpecker org secret against the woodpecker server (woodpecker :8000). Both run
 # under the same pod labels, so one egress policy covers both hops. Complements
-# gitea-allow-review-bot-rotator + woodpecker-allow-rotators (apps side).
+# gitea-allow-review-bot-rotator (apps) + woodpecker-allow-rotators (woodpecker).
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -165,16 +165,16 @@ spec:
               protocol: TCP
     - toEndpoints:
         - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": apps
+            "k8s:io.kubernetes.pod.namespace": woodpecker
             app.kubernetes.io/name: woodpecker
       toPorts:
         - ports:
             - port: "8000"
               protocol: TCP
 ---
-# Egress for the claude-oauth sync rotator: woodpecker server only (apps :8000).
+# Egress for the claude-oauth sync rotator: woodpecker server only (woodpecker :8000).
 # It never touches gitea (the OAuth value is seeded into OpenBao by hand, not
-# minted). Complements woodpecker-allow-rotators (apps side).
+# minted). Complements woodpecker-allow-rotators (woodpecker side).
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -188,7 +188,7 @@ spec:
   egress:
     - toEndpoints:
         - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": apps
+            "k8s:io.kubernetes.pod.namespace": woodpecker
             app.kubernetes.io/name: woodpecker
       toPorts:
         - ports:

kubernetes/infrastructure/network-policies/paperless-ns.yaml

@@ -37,43 +37,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     - toEndpoints:
         - matchLabels:
@@ -109,43 +86,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
 ---
 # Allow FTP access (from scanners on the LAN) to the ftp-scanner pod.
 apiVersion: cilium.io/v2

kubernetes/infrastructure/network-policies/rook-ceph-ns.yaml

@@ -41,40 +41,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/spegel-ns.yaml

@@ -26,43 +26,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
   egress:
     # Peer P2P
     - toEndpoints:
@@ -92,40 +69,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/trmnl-ns.yaml

@@ -42,43 +42,20 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }
 ---
 # The TRMNL panel polls /api/display over cleartext HTTP on the
 # terminus-device LoadBalancer. The firmware cannot be handed the internal

kubernetes/infrastructure/network-policies/velero-ns.yaml

@@ -28,40 +28,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml

@@ -45,40 +45,17 @@ spec:
         - fields:
             - { type: 0,   family: IPv4 }
             - { type: 3,   family: IPv4 }
-            - { type: 4,   family: IPv4 }
-            - { type: 5,   family: IPv4 }
             - { type: 8,   family: IPv4 }
-            - { type: 9,   family: IPv4 }
-            - { type: 10,  family: IPv4 }
             - { type: 11,  family: IPv4 }
             - { type: 12,  family: IPv4 }
-            - { type: 13,  family: IPv4 }
-            - { type: 14,  family: IPv4 }
-            - { type: 15,  family: IPv4 }
-            - { type: 16,  family: IPv4 }
-            - { type: 17,  family: IPv4 }
-            - { type: 18,  family: IPv4 }
-            - { type: 30,  family: IPv4 }
             - { type: 1,   family: IPv6 }
             - { type: 2,   family: IPv6 }
             - { type: 3,   family: IPv6 }
             - { type: 4,   family: IPv6 }
             - { type: 128, family: IPv6 }
             - { type: 129, family: IPv6 }
-            - { type: 130, family: IPv6 }
-            - { type: 131, family: IPv6 }
-            - { type: 132, family: IPv6 }
             - { type: 133, family: IPv6 }
             - { type: 134, family: IPv6 }
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
-            - { type: 137, family: IPv6 }
-            - { type: 138, family: IPv6 }
-            - { type: 141, family: IPv6 }
-            - { type: 142, family: IPv6 }
             - { type: 143, family: IPv6 }
-            - { type: 148, family: IPv6 }
-            - { type: 149, family: IPv6 }
-            - { type: 151, family: IPv6 }
-            - { type: 152, family: IPv6 }
-            - { type: 153, family: IPv6 }

kubernetes/infrastructure/network-policies/woodpecker-ns.yaml

@@ -0,0 +1,156 @@
+---
+# Baseline ingress policy for the `woodpecker` namespace (wp-pg now; server and
+# agent arrive in stage 2).
+#
+# Unlike the `apps` baseline this replaces, every allow here lands on a
+# namespace holding one service, so a namespace-scoped grant is not a blanket
+# grant across unrelated workloads. That is the point of the move: in `apps`,
+# letting the CNPG operator reach wp-pg would also have opened gitea, gatus,
+# external-dns and ical-proxy to the whole database namespace (issue #433).
+#
+# CAUTION when adding rules here: this policy has `endpointSelector: {}`, so
+# every rule below applies to EVERY pod in the namespace. A `toPorts` block
+# narrows the port, NOT the destination workload — that is governed solely by
+# the enclosing policy's endpointSelector. Anything meant for one workload
+# belongs in its own policy with its own selector, as
+# `wp-pg-allow-cnpg-operator` below does.
+#
+# No egress section, so egress is unrestricted. Deliberate for now and revisited
+# in stage 2: wp-pg needs DNS plus `world` for WAL archiving to Hetzner S3, and
+# the server/agent add gitea, the Kubernetes API and outbound plugin pulls.
+# Writing that ruleset once, with the full workload set present, beats guessing
+# it here and silently breaking the WAL archiving this stage exists to verify.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: woodpecker
+spec:
+  endpointSelector: {}
+  ingress:
+    # Intra-namespace: server <-> agent, server -> wp-pg.
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": woodpecker
+    # NOT here: ingress from the `ingress` namespace. Traefik terminates
+    # ci.renner.uno and forwards to the server, but that namespace also holds
+    # netbird-ingress, and this policy's endpointSelector:{} would extend the
+    # grant to wp-pg and the agent as well. Scoped to traefik -> server in the
+    # companion policy at the bottom of this file.
+    # Prometheus scrape. Namespace-wide and port-unrestricted, matching the
+    # other *-ns baselines; this is what covers wp-pg's :9187 metrics.
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+    # Kubelet probes and hostNetwork siblings.
+    - fromEntities:
+        - host
+        - remote-node
+    # ICMP — from any cluster pod. See home-assistant-ns.yaml for the rationale.
+    # INGRESS ONLY: do NOT add an egress section to this CNP.
+    #
+    # Needed here specifically because wp-pg-allow-cnpg-operator below attaches
+    # an L4 rule (toPorts :8000) to the wp-pg pods, and Cilium blocks ICMP to an
+    # endpoint once any layer 4 policy selects it unless the traffic is
+    # CT-related. Without this, PMTUD Destination Unreachable and Packet Too Big
+    # toward wp-pg are dropped silently — the failure shows up as stalled
+    # transfers, not as a policy denial.
+    #
+    # Namespace-wide is right for this one, unlike the :8000 case noted below:
+    # these are diagnostic and path-MTU messages that expose no API surface, so
+    # granting them across the namespace concedes nothing a per-workload rule
+    # would withhold.
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+    #
+    # NOT here: ingress from `woodpecker-ci`. Pipeline step pods do call the
+    # server back on :8000 to stream logs, but the CNPG instance manager serves
+    # its status API on :8000 too — so granting that on this endpointSelector:{}
+    # policy would hand arbitrary repo-supplied build steps a route to wp-pg's
+    # instance manager. It lands in stage 2 as its own policy selecting the
+    # server pod, the way woodpecker-allow-rotators already scopes its :8000
+    # rule in apps/woodpecker/networkpolicy.yaml.
+---
+# The CNPG operator polls each instance's status endpoint over HTTPS
+# (https://<pod-ip>:8000/pg/status) to populate Cluster status. Without it the
+# Cluster reports "Instance Status Extraction Error: HTTP communication issue"
+# while Postgres serves normally, and the operator loses failover and
+# switchover decisions — issue #433, where the operator's dial timed out
+# because the apps baseline never allowed the database namespace.
+#
+# Scoped to the wp-pg endpoints and that one port: the operator has no reason to
+# reach the woodpecker server or agent, and the barman and mariadb operators
+# sharing its namespace have no reason to reach anything here at all.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: wp-pg-allow-cnpg-operator
+  namespace: woodpecker
+spec:
+  endpointSelector:
+    matchLabels:
+      cnpg.io/cluster: wp-pg
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": database
+            app.kubernetes.io/name: cloudnative-pg
+      toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP
+---
+# Traefik terminates ci.renner.uno and forwards to the server on :8000.
+#
+# Lives here, beside the baseline, rather than with the workload policies in
+# apps/woodpecker/networkpolicy.yaml — deliberately. The baseline's `ingress`
+# admit was removed in the same commit, and these two ship in the same
+# Kustomization (infrastructure-crds), so the swap lands in one reconcile. Split
+# across Kustomizations it would not: infrastructure-crds reconciles before the
+# `woodpecker` KS, so the admit would be withdrawn minutes before its
+# replacement arrived, and ci.renner.uno would 503 in the gap.
+#
+# Scoped to traefik and to the server pod. The `ingress` namespace also holds
+# netbird-ingress, and the baseline's endpointSelector:{} would have extended a
+# namespace-level admit to wp-pg and the agent. The `apps` policy this replaces
+# (allow-ingress.yaml) matches traefik by label for the same reason, and does
+# NOT apply here — it is hard-scoped to `namespace: apps`.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: woodpecker-allow-traefik
+  namespace: woodpecker
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: woodpecker
+      app.kubernetes.io/component: server
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+      toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP

kubernetes/infrastructure/network-policies/wordpress-ns.yaml

@@ -0,0 +1,121 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: wordpress
+spec:
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": wordpress
+    # Unlike paperless, traefik IS allowed here. www.renner.uno is a public
+    # blog: the front end must be reachable without authentication, so the
+    # public router terminates directly in this namespace.
+    #
+    # Be clear about what this does and does not buy: the public/admin split
+    # is enforced by the two Ingress objects' path rules (`/` straight to the
+    # Service, /wp-admin and /wp-login.php to the gate outpost) and by
+    # Authentik — NOT at the network layer. paperless can point a
+    # workload-scoped CNP at its gate because nothing else may reach it;
+    # here traefik must reach the pod directly for every public page, so the
+    # equivalent rule would be a no-op. Anyone auditing this namespace for
+    # defence in depth should know the network layer is not where the admin
+    # surface is protected.
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+    # Scoped to the gate outpost rather than the whole authentik namespace:
+    # only that pod has business reaching wp-admin.
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": authentik
+            goauthentik.io/outpost-name: wordpress-gate
+    # The mariadb-operator reconciles the MariaDB CR from the database
+    # namespace — same cross-namespace requirement CNPG consumers have.
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": database
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+    - fromEntities:
+        - host
+        - remote-node
+    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
+    # home-assistant-ns.yaml for the rationale.
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": wordpress
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": authentik
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": rook-ceph
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+    # world covers two things WordPress genuinely needs outbound: the
+    # wordpress.org update/plugin API, and the Hetzner Object Storage
+    # endpoint the MariaDB Backup writes to.
+    - toEntities:
+        - host
+        - remote-node
+        - world
+    # ICMP — egress mirror.
+    - toEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }

kubernetes/infrastructure/openbao/rotation/claude-oauth.yaml

@@ -14,8 +14,10 @@
 # immediately:
 #   kubectl -n openbao create job --from=cronjob/claude-oauth-secret-sync claude-oauth-sync-now
 #
-# woodpecker is reached in-cluster at woodpecker.apps.svc:8000. Needs the netpol
-# halves woodpecker-allow-rotators (apps/*) + rotator-claude-oauth-egress
+# woodpecker is reached in-cluster at woodpecker.woodpecker.svc:8000 (it moved
+# out of `apps` in the namespace migration — see
+# kubernetes/apps/woodpecker/MIGRATION-namespace.md). Needs the netpol
+# halves woodpecker-allow-rotators (woodpecker ns) + rotator-claude-oauth-egress
 # (openbao-ns.yaml). OpenBao policy/role rotator-claude-oauth + the bootstraps
 # (woodpecker-bot token, the seeded OAuth value) are provisioned by hand — see
 # policies/rotator-claude-oauth.hcl.
@@ -89,7 +91,7 @@ spec:
                 - name: BAO_FIELD
                   value: setup-token
                 - name: WOODPECKER_URL
-                  value: http://woodpecker.apps.svc.cluster.local:8000
+                  value: http://woodpecker.woodpecker.svc.cluster.local:8000
                 - name: WOODPECKER_ORG
                   value: k.renner
                 - name: WOODPECKER_SECRET_NAME

kubernetes/infrastructure/openbao/rotation/review-bot.yaml

@@ -25,9 +25,10 @@
 # but a failed sync should be fixed before the next run rather than left.
 #
 # gitea is reached in-cluster at gitea.apps.svc:3000, woodpecker at
-# woodpecker.apps.svc:8000 (both hairpin off the ingress LB from a pod). Needs
+# woodpecker.woodpecker.svc:8000 (it moved out of `apps` in the namespace
+# migration — see kubernetes/apps/woodpecker/MIGRATION-namespace.md). Needs
 # the netpol halves: gitea-allow-review-bot-rotator + woodpecker-allow-rotators
-# (apps/*) and rotator-review-bot-egress (openbao-ns.yaml).
+# (woodpecker ns) and rotator-review-bot-egress (openbao-ns.yaml).
 #
 # OpenBao policy/role rotator-review-bot + the bootstraps (review-bot password,
 # woodpecker-bot token, seed review-bot#token) are provisioned by hand — see
@@ -147,7 +148,7 @@ spec:
                 - name: BAO_FIELD
                   value: token
                 - name: WOODPECKER_URL
-                  value: http://woodpecker.apps.svc.cluster.local:8000
+                  value: http://woodpecker.woodpecker.svc.cluster.local:8000
                 - name: WOODPECKER_ORG
                   value: k.renner
                 - name: WOODPECKER_SECRET_NAME

kubernetes/infrastructure/post-crds/openbao-clustersecretstore.yaml

@@ -30,6 +30,8 @@ spec:
         - paperless
         - trmnl
         - velero
+        - woodpecker # wp-pg barman creds; woodpecker moving out of `apps` (#433)
+        - wordpress
   provider:
     vault: # ESO's provider name; speaks OpenBao fine
       server: http://openbao.openbao.svc.cluster.local:8200

kubernetes/infrastructure/post-crds/velero-schedules.yaml

@@ -312,3 +312,38 @@ spec:
       matchExpressions:
         - key: cnpg.io/cluster
           operator: DoesNotExist
+---
+apiVersion: velero.io/v1
+kind: Schedule
+metadata:
+  name: wordpress-daily
+  namespace: velero
+  labels:
+    app.kubernetes.io/part-of: homelab-backup
+spec:
+  # Daily at 08:45 local (next free stagger slot after trmnl-daily at 08:15).
+  # Covers the wordpress-content PVC: the media library and any plugins or
+  # themes installed through wp-admin. WordPress core is not in here — it
+  # comes from the pinned image, so Git is its backup.
+  schedule: "45 8 * * *"
+  useOwnerReferencesInBackup: false
+  template:
+    includedNamespaces:
+      - wordpress
+    includedResources:
+      - persistentvolumeclaims
+    storageLocation: default
+    ttl: 720h0m0s
+    snapshotMoveData: true
+    # Selects the content PVC by a label this repo sets, rather than
+    # excluding the database PVC by one the mariadb-operator is assumed to
+    # set — an exclusion built on a wrong assumption fails silently and
+    # sweeps the live database volume in. A crash-consistent snapshot of a
+    # running database is not a restorable backup; the operator's own Backup
+    # resource takes a logical dump to Hetzner Object Storage at 02:45, the
+    # same division of labour as CNPG/Barman elsewhere in this file.
+    # openbao-daily picks its PVC the same way.
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: wordpress
+        app.kubernetes.io/component: content

kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml

@@ -24,6 +24,27 @@ spec:
   # gives headroom for parallel restores during cluster rebuild too
   # (paperless + audiobookshelf + immich + ... all clone at once).
   cephConfig:
+    mon:
+      # Ceph's 30% default assumes the mon has a filesystem to itself, where
+      # 30% free is a meaningful reserve. Here the mons live on
+      # dataDirHostPath /var/lib/rook — the node's /var, shared with ~29 GB
+      # of containerd image and snapshot storage — and the mon DB itself is
+      # ~106 MB. So the default measures container churn, not Ceph: k8s-2
+      # trips MON_DISK_LOW whenever the image cache fills, and image GC does
+      # not clear it (most of /var/lib/containerd is overlayfs snapshots held
+      # by running containers, which GC cannot reclaim — see #434).
+      # 20% of a 60 GB /var still leaves ~12 GB against a 106 MB database.
+      # mon_data_avail_crit stays at the 5% default, and CephMonDiskLow in
+      # monitoring-rules watches /var directly for the real risk, which is the
+      # node filling rather than the mon growing.
+      #
+      # BARE-METAL MIGRATION: revisit this. Give the mons their own volume and
+      # the default 30% becomes meaningful again, at which point this override
+      # should be dropped rather than carried over. It cannot be done on the
+      # current cluster — every StorageClass is Ceph-backed, so a mon PVC
+      # would be circular, and Rook only applies mon.volumeClaimTemplate to
+      # newly created mons, never migrating existing ones.
+      mon_data_avail_warn: "20"
     mgr:
       mgr/volumes/max_concurrent_clones: "16"
     # QLC tune for the Crucial P2 NVMe per host. Baseline 2026-05-05:

kubernetes/infrastructure/rook-ceph-cluster/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - cephcluster.yaml
+  - toolbox.yaml
   - storageclass.yaml
   - volumesnapshotclass.yaml
   - objectstore.yaml

kubernetes/infrastructure/rook-ceph-cluster/toolbox.yaml

@@ -0,0 +1,172 @@
+# Upstream Rook toolbox, taken verbatim from
+# https://raw.githubusercontent.com/rook/rook/v1.20.4/deploy/examples/toolbox.yaml
+# (matching the operator image docker.io/rook/ceph:v1.20.4), with three
+# deliberate changes:
+#   - the image is pinned to the cluster's own Ceph version and carries the
+#     same imagepolicy marker as cephcluster.yaml, so the client never drifts
+#     ahead of the mons it talks to
+#   - resource requests/limits, since this is a long-lived idle pod
+#   - no other divergence; keep it that way so upstream diffs stay readable
+#
+# This is the only admin path to Ceph internals. Without it `ceph status`,
+# `ceph health detail`, `ceph osd df tree`, `ceph osd perf` and `ceph device
+# ls` are unreachable during an incident: the mons, OSDs and mgr mount no
+# admin keyring, and the operator's /etc/ceph is empty.
+#
+# It mounts the client.admin keyring from the rook-ceph-mon secret, so it is
+# a full-privilege credential holder, not a read-only one — Rook offers no
+# lesser-privileged toolbox. Ingress to it is gated by the namespace
+# default-deny-ingress CNP (network-policies/rook-ceph-ns.yaml).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rook-ceph-tools
+  namespace: rook-ceph
+  labels:
+    app: rook-ceph-tools
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: rook-ceph-tools
+  template:
+    metadata:
+      labels:
+        app: rook-ceph-tools
+    spec:
+      dnsPolicy: ClusterFirstWithHostNet
+      serviceAccountName: rook-ceph-default
+      containers:
+        - name: rook-ceph-tools
+          image: quay.io/ceph/ceph:v19.2.5 # {"$imagepolicy": "flux-system:ceph"}
+          command:
+            - /bin/bash
+            - -c
+            - |
+              # Replicate the script from toolbox.sh inline so the ceph image
+              # can be run directly, instead of requiring the rook toolbox
+              CEPH_CONFIG="/etc/ceph/ceph.conf"
+              MON_CONFIG="/etc/rook/mon-endpoints"
+              KEYRING_FILE="/etc/ceph/keyring"
+              CONFIG_OVERRIDE="/etc/rook-config-override/config"
+
+              # create a ceph config file in its default location so ceph/rados tools can be used
+              # without specifying any arguments
+              write_endpoints() {
+                endpoints=$(cat ${MON_CONFIG})
+
+                # filter out the mon names
+                # external cluster can have numbers or hyphens in mon names, handling them in regex
+                # shellcheck disable=SC2001
+                mon_endpoints=$(echo "${endpoints}"| sed 's/[a-z0-9_-]\+=//g')
+
+                DATE=$(date)
+                echo "$DATE writing mon endpoints to ${CEPH_CONFIG}: ${endpoints}"
+                  cat <<EOF > ${CEPH_CONFIG}
+              [global]
+              mon_host = ${mon_endpoints}
+
+              [client.admin]
+              keyring = ${KEYRING_FILE}
+              EOF
+
+                # Merge the config override if it exists and is not empty
+                if [ -f "${CONFIG_OVERRIDE}" ] && [ -s "${CONFIG_OVERRIDE}" ]; then
+                  echo "$DATE merging config override from ${CONFIG_OVERRIDE}"
+                  echo "" >> ${CEPH_CONFIG}
+                  cat ${CONFIG_OVERRIDE} >> ${CEPH_CONFIG}
+                  echo "" >> ${CEPH_CONFIG}
+                fi
+              }
+
+              # watch the endpoints config file and update if the mon endpoints ever change
+              watch_endpoints() {
+                # get the timestamp for the target of the soft link
+                real_path=$(realpath ${MON_CONFIG})
+                initial_time=$(stat -c %Z "${real_path}")
+                while true; do
+                  real_path=$(realpath ${MON_CONFIG})
+                  latest_time=$(stat -c %Z "${real_path}")
+
+                  if [[ "${latest_time}" != "${initial_time}" ]]; then
+                    write_endpoints
+                    initial_time=${latest_time}
+                  fi
+
+                  sleep 10
+                done
+              }
+
+              # read the secret from an env var (for backward compatibility), or from the secret file
+              ceph_secret=${ROOK_CEPH_SECRET}
+              if [[ "$ceph_secret" == "" ]]; then
+                ceph_secret=$(cat /var/lib/rook-ceph-mon/secret.keyring)
+              fi
+
+              # create the keyring file
+              cat <<EOF > ${KEYRING_FILE}
+              [${ROOK_CEPH_USERNAME}]
+              key = ${ceph_secret}
+              EOF
+
+              # write the initial config file
+              write_endpoints
+
+              # continuously update the mon endpoints if they fail over
+              watch_endpoints
+          imagePullPolicy: IfNotPresent
+          tty: true
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 2016
+            runAsGroup: 2016
+            capabilities:
+              drop: ["ALL"]
+          env:
+            - name: ROOK_CEPH_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: rook-ceph-mon
+                  key: ceph-username
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+            limits:
+              memory: 512Mi
+          volumeMounts:
+            - mountPath: /etc/ceph
+              name: ceph-config
+            - name: mon-endpoint-volume
+              mountPath: /etc/rook
+            - name: ceph-admin-secret
+              mountPath: /var/lib/rook-ceph-mon
+              readOnly: true
+            - name: rook-config-override
+              mountPath: /etc/rook-config-override
+              readOnly: true
+      volumes:
+        - name: ceph-admin-secret
+          secret:
+            secretName: rook-ceph-mon
+            optional: false
+            items:
+              - key: ceph-secret
+                path: secret.keyring
+        - name: mon-endpoint-volume
+          configMap:
+            name: rook-ceph-mon-endpoints
+            items:
+              - key: data
+                path: mon-endpoints
+        - name: rook-config-override
+          configMap:
+            name: rook-config-override
+            optional: true
+        - name: ceph-config
+          emptyDir: {}
+      tolerations:
+        - key: "node.kubernetes.io/unreachable"
+          operator: "Exists"
+          effect: "NoExecute"
+          tolerationSeconds: 5

kubernetes/talos/cilium.yaml

@@ -249,6 +249,11 @@ data:
 
   identity-heartbeat-timeout: "30m0s"
   identity-gc-interval: "15m0s"
+  # Exclude Woodpecker's per-build labels from identity computation, so CI
+  # steps share one identity instead of minting one each. Keep in lockstep
+  # with patches/cilium-cni.yaml and values.labels in
+  # kubernetes/infrastructure/cilium/helmrelease.yaml.
+  labels: '!woodpecker-ci\.org/.* !step$'
   cilium-endpoint-gc-interval: "5m0s"
   nodes-gc-interval: "5m0s"
 
@@ -302,8 +307,9 @@ data:
   # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
   bpf-map-dynamic-size-ratio: "0.0025"
   # bpf-policy-map-max specifies the maximum number of entries in endpoint
-  # policy map (per endpoint)
-  bpf-policy-map-max: "16384"
+  # policy map (per endpoint). Keep in lockstep with patches/cilium-cni.yaml and
+  # values.bpf.policyMapMax in kubernetes/infrastructure/cilium/helmrelease.yaml.
+  bpf-policy-map-max: "65536"
   # bpf-policy-stats-map-max specifies the maximum number of entries in global
   # policy stats map
   bpf-policy-stats-map-max: "65536"

kubernetes/talos/patches/cilium-cni.yaml

@@ -267,6 +267,11 @@ cluster:
         
           identity-heartbeat-timeout: "30m0s"
           identity-gc-interval: "15m0s"
+          # Exclude Woodpecker's per-build labels from identity computation, so
+          # CI steps share one identity instead of minting one each. Keep in
+          # lockstep with values.labels in
+          # kubernetes/infrastructure/cilium/helmrelease.yaml.
+          labels: '!woodpecker-ci\.org/.* !step$'
           cilium-endpoint-gc-interval: "5m0s"
           nodes-gc-interval: "5m0s"
         
@@ -320,8 +325,12 @@ cluster:
           # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
           bpf-map-dynamic-size-ratio: "0.0025"
           # bpf-policy-map-max specifies the maximum number of entries in endpoint
-          # policy map (per endpoint)
-          bpf-policy-map-max: "16384"
+          # policy map (per endpoint). Keep in lockstep with values.bpf.policyMapMax
+          # in kubernetes/infrastructure/cilium/helmrelease.yaml, and with the third
+          # copy in kubernetes/talos/cilium.yaml: bootstrap installs Cilium from this
+          # inline manifest, so a lower value here means a cold rebuild comes up with
+          # a map that overflows until Flux reconciles.
+          bpf-policy-map-max: "65536"
           # bpf-policy-stats-map-max specifies the maximum number of entries in global
           # policy stats map
           bpf-policy-stats-map-max: "65536"

kubernetes/talos/patches/cluster.yaml

@@ -26,16 +26,20 @@ machine:
     nodeIP:
       validSubnets:
         - 10.2.40.0/24
-    # Lower the image GC thresholds from the kubelet defaults (85/80)
-    # so containerd's image cache is pruned before /var crosses Ceph's
-    # mon_data_avail_warn line (mon DB warns when its hostpath has
-    # <30% free). k8s-2 and k8s-3 sit at 77-79% used because of pod
-    # density (75 pods on k8s-2 vs 42 on k8s-1) — unused image layers
-    # accumulate untouched until the 85% high watermark, which the
-    # node never hits, so GC never fires. 70/60 keeps /var safely
-    # under 30%-free without raising the VM disk again. Spegel P2P
-    # pull-through softens the re-pull cost when GC'd images are
-    # needed back.
+    # Lower the image GC thresholds from the kubelet defaults (85/80) to
+    # bound containerd's image cache, which is the largest single consumer
+    # of /var. Spegel P2P pull-through softens the re-pull cost when GC'd
+    # images are needed back.
+    #
+    # These thresholds do NOT control whether Ceph's mon reports
+    # MON_DISK_LOW, and must not be tuned for that. Measured on k8s-2:
+    # image GC frees only the content store (~8.6 GB), while the bulk of
+    # /var/lib/containerd is ~20 GB of overlayfs snapshots — unpacked
+    # layers shared with running containers, which GC cannot reclaim.
+    # Dropping high to 60 deleted 28 images and moved free space by 0.02
+    # percentage points. The mon's own data is ~106 MB; its 30%-free
+    # warning is measuring a filesystem it merely shares, so the lever for
+    # it is elsewhere (mon volume, /var size, or mon_data_avail_warn).
     extraConfig:
       imageGCHighThresholdPercent: 70
       imageGCLowThresholdPercent: 60

opentofu/dns_renner_uno.tf

@@ -1,8 +1,20 @@
 locals {
   renner_uno_records = {
-    # A Records
-    "@"   = { type = "A", value = "159.69.42.237" }
-    "www" = { type = "A", value = "159.69.42.237" }
+    # No "@" / "www" entries. Both used to pin renner.uno and www.renner.uno
+    # to 159.69.42.237, the Hetzner VM that hosted the WordPress site until it
+    # moved into the cluster (kubernetes/apps/wordpress). Neither record is
+    # actually live on the UDM any more — verified 2026-08-16: a LAN query for
+    # www.renner.uno returns the public answer (proxy.renner.uno) — so this
+    # block was drift waiting to be re-applied.
+    #
+    # The correct end state is exactly this absence: www.renner.uno is labelled
+    # dns.renner.uno/public, so external-dns-unifi deliberately writes no UDM
+    # record and LAN clients follow the public path (wildcard -> proxy) and
+    # hairpin back in. Re-adding an A record here would point the house at a
+    # server that is being decommissioned.
+    #
+    # The apex stays with Cloudflare, where a redirect rule sends
+    # renner.uno/* to https://www.renner.uno/*.
 
     # CNAME Records (External Targets)
     "nut" = { type = "CNAME", value = "nut.srv.renner.uno" }

opentofu/lxc_800_rustfs_decommission.tf

@@ -1,4 +1,4 @@
-# TEMPORARY shims v2 — rustfs LXCs 800/801/802, decommission in progress.
+# TEMPORARY shims v3 — rustfs LXCs 800/801/802, decommission in progress.
 #
 # Stage 2 (#270) failed: both destroy attempts died instantly with
 # "context deadline exceeded" on the pre-destroy status GET, while the PVE
@@ -10,34 +10,113 @@
 #
 # Fix: declare the timeouts explicitly, apply ONCE so they land in state
 # (in-place no-API update), then delete this file again and the next apply
-# destroys the containers. No lifecycle ignore_changes this time — the
-# timeout update must actually apply; the other attributes mirror the real
-# containers so the plan stays in-place.
+# destroys the containers.
+#
+# v3: v2 declared ONLY the ids, `started`, `unprivileged` and the timeouts,
+# claiming "the other attributes mirror the real containers so the plan stays
+# in-place". They did not. Everything absent from config planned as a removal,
+# and two of those removals — `mount_point` and `operating_system` — force
+# replacement, so the plan came back `must be replaced` for all three. Applying
+# that would have destroyed and recreated containers tagged `critical`,
+# `state-backend`, `terraform-backend` instead of nudging a timeout into state.
+#
+# So the blocks below are not decoration: each one exists to keep an attribute
+# out of the diff. They mirror the live containers, read from the plan's own
+# state values. `tags` is declared for the same reason — without it the apply
+# strips the tags off the real containers.
 #
 #   1. merge; run PIPELINE=deploy-infrastructure (plan MUST show in-place
 #      update only, no replace), then TOFU_APPLY=true
 #   2. follow-up PR deletes this file; plan shows 3 destroys; apply.
 
 locals {
+  # Per-container values mirrored from live state. hostname and mac_address
+  # differ per container; declaring them wrong would itself force a diff.
   rustfs_decommission = {
-    "800" = "saturn"
-    "801" = "jupiter"
-    "802" = "neptune"
+    "800" = { node = "saturn", hostname = "rustfs-1.srv.renner.uno", mac = "BC:24:11:0B:E5:7B" }
+    "801" = { node = "jupiter", hostname = "rustfs-2.srv.renner.uno", mac = "BC:24:11:EA:1D:38" }
+    "802" = { node = "neptune", hostname = "rustfs-3.srv.renner.uno", mac = "BC:24:11:8F:F4:67" }
   }
 }
 
 resource "proxmox_virtual_environment_container" "rustfs_decommission" {
   for_each = local.rustfs_decommission
 
-  node_name     = each.value
+  node_name     = each.value.node
   vm_id         = tonumber(each.key)
   started       = false
   unprivileged  = true
   start_on_boot = true
 
+  tags = [
+    "critical",
+    "rustfs",
+    "state-backend",
+    "terraform-backend",
+  ]
+
   timeout_create = 1800
   timeout_clone  = 1800
   timeout_update = 1800
   timeout_delete = 1800
   timeout_start  = 300
+
+  cpu {
+    architecture = "amd64"
+    cores        = 1
+    units        = 1024
+  }
+
+  memory {
+    dedicated = 1024
+    swap      = 0
+  }
+
+  disk {
+    datastore_id = "local"
+    size         = 10
+  }
+
+  # forces replacement if absent — this is the block that broke v2.
+  mount_point {
+    path      = "/mnt/data"
+    size      = "50G"
+    volume    = "local:${each.key}/vm-${each.key}-disk-1.raw"
+    backup    = true
+    replicate = true
+  }
+
+  network_interface {
+    name        = "eth0"
+    bridge      = "v40srv"
+    enabled     = true
+    firewall    = false
+    mac_address = each.value.mac
+  }
+
+  initialization {
+    hostname = each.value.hostname
+
+    ip_config {
+      ipv4 {
+        address = "dhcp"
+      }
+    }
+  }
+
+  # operating_system is NOT declared, and must not be. The provider requires
+  # template_file_id inside it, which is a create-time-only value: PVE does not
+  # report the original template for an existing container, so it is absent
+  # from state and cannot be mirrored. Declaring the block without it fails
+  # validation ("Missing required argument"); declaring it with a guessed
+  # template would be a lie that only surfaces if something ever recreates
+  # these.
+  #
+  # Left undeclared it would plan as a removal, and removing operating_system
+  # forces replacement — the exact failure this file exists to avoid. So it is
+  # ignored instead. The timeouts above are deliberately NOT ignored: they are
+  # the one thing this shim needs to actually apply.
+  lifecycle {
+    ignore_changes = [operating_system]
+  }
 }

opentofu/object_storage.tf

@@ -42,6 +42,7 @@ locals {
     "renner-uno-k8s-velero",  # Velero PVC backups (Kopia data mover)
     "renner-uno-k8s-secrets", # SOPS talosconfig/kubeconfig for cluster bootstrap
     "renner-uno-tfstate",     # OpenTofu remote state (migrated off the nas-1 Garage S3)
+    "renner-uno-k8s-mariadb", # mariadb-operator logical dumps (wordpress-mariadb)
   ]
 }
 
@@ -95,8 +96,9 @@ locals {
   # precedent in this repo — left uncapped (keep every version) since
   # storage cost there is negligible.
   hetzner_buckets_noncurrent_expiry_days = {
-    "renner-uno-k8s-cnpg"   = 30
-    "renner-uno-k8s-velero" = 30
+    "renner-uno-k8s-cnpg"    = 30
+    "renner-uno-k8s-velero"  = 30
+    "renner-uno-k8s-mariadb" = 30 # Backup maxRetention: 720h (kubernetes/apps/wordpress/mariadb.yaml)
   }
 }
 

opentofu/providers.tf

@@ -61,11 +61,27 @@ provider "unifi" {
 # as the unifi provider above; the v2 endpoints are simply not covered by it.
 # UniFi PUT quirk: updates may require _id in the body, which restapi does
 # not send — if an in-place update 400s, taint the object so CI recreates it.
+#
+# create_returns_object, NOT write_returns_object. Both make the provider store
+# the API response into `data`; write_returns_object does it for PUT as well as
+# POST. Since `data` in unifi_nat_hairpin.tf never sets the UDM-assigned `_id`,
+# every write put a field into state that config does not have, so all 60 rules
+# planned as "will be updated in-place" with `- _id` as the whole diff — and
+# re-dirtied themselves on the next write, forever.
+#
+# No provider-side ignore can suppress that: `data` is a configured attribute,
+# compared by Terraform core before provider logic runs. Tried and disproven —
+# ignore_changes_to = ["_id"] (plan 5661), ignore_all_server_changes (5662),
+# and ignore_server_additions on restapi 3.x (5667). All three left the 60.
+#
+# create_returns_object keeps what the provider actually needs — the POST
+# response is how it learns `_id` for id_attribute below — without letting
+# updates rewrite `data`.
 provider "restapi" {
-  uri                  = "${var.unifi_api_url}/proxy/network/v2/api/site/default"
-  insecure             = var.unifi_insecure
-  write_returns_object = true
-  id_attribute         = "_id"
+  uri                   = "${var.unifi_api_url}/proxy/network/v2/api/site/default"
+  insecure              = var.unifi_insecure
+  create_returns_object = true
+  id_attribute          = "_id"
   headers = {
     "X-API-KEY"    = var.unifi_api_key
     "Content-Type" = "application/json"