Merge pull request 'chore(coredns): Talos alone owns the Corefile (2/2)' (#1450 ) from claude/coredns-talos-owned-2 into main

Reviewed-on: #1450
chore(coredns): Talos alone owns the Corefile
2026-10-26 09:04:47 +00:00 · 2026-10-26 09:59:37 +01:00 · 2026-10-26 08:58:29 +00:00 · 2026-10-26 09:55:13 +01:00 · 2026-10-26 07:39:52 +00:00 · 2026-10-26 07:39:25 +00:00
42 changed files with 245 additions and 148 deletions
@@ -1,4 +1,4 @@
-FROM nousresearch/hermes-agent:v0.22.2@sha256:36099926da316742423544e055d4734777105ffe6341873af5459b957d0c2919
+FROM nousresearch/hermes-agent:v0.22.5@sha256:9c5561579f3ffdf333401797094ac3a743738d6c25d40f4331c7bf77b694238d

 USER root

@@ -6,9 +6,9 @@ RUN apt-get update \
 && apt-get install -y --no-install-recommends jq \
 && rm -rf /var/lib/apt/lists/*

-COPY --from=ghcr.io/siderolabs/talosctl:v1.13.10@sha256:3116f64c97ddffb53bd3c5bf87c8614d99f04df4326177dbbb7702b5087f0e4d /talosctl /usr/local/bin/talosctl
-COPY --from=alpine/kubectl:1.36.3@sha256:dae261106d5555008acede256b7102c8a6decde7209198434f5999f051460f57 /usr/local/bin/kubectl /usr/local/bin/kubectl
-COPY --from=ghcr.io/fluxcd/flux-cli:v2.9.5@sha256:704d5529535570a495249b643159c93a9aa88ffca07813c974a54b7ba6edbd86 /usr/local/bin/flux /usr/local/bin/flux
+COPY --from=ghcr.io/siderolabs/talosctl:v1.14.4@sha256:b3233234327350f20ed194f3fad83d90a64344c1940f839c7b0c0abef50c8c33 /talosctl /usr/local/bin/talosctl
+COPY --from=alpine/kubectl:1.37.1@sha256:a5d0fbecab3f7b6c2ab7398f1daa73a3e0ed6ece18556d21698233e9e3759cc7 /usr/local/bin/kubectl /usr/local/bin/kubectl
+COPY --from=ghcr.io/fluxcd/flux-cli:v2.9.6@sha256:b1ac18156f227af9a524b842a96f2c20986c7a779ef721df3ba4e4540f449d76 /usr/local/bin/flux /usr/local/bin/flux
 COPY --from=quay.io/openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf /usr/bin/bao /usr/local/bin/bao
 COPY --from=gitea/tea:0.16.0@sha256:af50a2060ce4d8fd76b7ebe75a3d6db4bb0c615c5bc8f2bdfd8ea83207c4752d /usr/bin/tea /usr/local/bin/tea

@@ -48,7 +48,7 @@ spec:
        # cert when doing server-side OIDC token exchange. Bundle both
        # roots into one PEM since NODE_EXTRA_CA_CERTS accepts one file.
        - name: fetch-le-staging-roots
-          image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
          command:
            - sh
            - -c
@@ -28,7 +28,7 @@ spec:
      enableServiceLinks: false
      containers:
        - name: evcc
-          image: evcc/evcc:0.317.1@sha256:c50cd4f83c22b39722a76a76b8d428b69bf8ab3334209ed9ed24ec0e3c48dde5
+          image: evcc/evcc:0.318.1@sha256:2f8163ab22f04863afd86cd511c09607ba71debd9eebd65511f3d654922a80d1
          # evcc auto-discovers /etc/evcc.yaml on its default search path;
          # the file is delivered (with the MQTT password) via the
          # sops-encrypted evcc-config Secret mounted below.
@@ -20,7 +20,7 @@ metadata:
 #   services group                   infrastructure group
 #     Web Service 1 = Authentik        Infrastructure 1 = retired (was PBS 2)
 #     Web Service 2 = Gitea            Infrastructure 2 = retired (was Proxmox VE)
-#     Web Service 3 = Immich           Infrastructure 3 = UDM DNS (10.2.40.1)
+#     Web Service 3 = Immich           Infrastructure 3 = UDM DNS (10.2.47.1)
 #     Web Service 4 = Woodpecker CI    Infrastructure 4 = Mosquitto MQTT broker
 #     Web Service 5 = Grafana
 #     Web Service 6 = Home Assistant
@@ -290,9 +290,11 @@ data:
      # a backup server that nothing backs up to reports on nothing. Re-add
      # alongside the first host that is declared to back up to it.

+      # The UDM on the segment pod traffic leaves on (k8s-gateway-site in
+      # talos/patches/site-homelab.yaml).
      - name: Infrastructure 3
        group: infrastructure
-        url: 10.2.40.1
+        url: 10.2.47.1
        interval: 30s
        dns:
          query-name: udm.renner.uno
@@ -115,7 +115,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: retention
-              image: docker.io/library/python:3.14-alpine@sha256:f6a589d43c42b9e7f7dc67a12d37132491f362859a5d750607710cc56da3bc72
+              image: docker.io/library/python:3.15-alpine@sha256:d44b1254cb92329418d164b22b20d86bbd3869d48e80e09e476531a409a728bb
              command: ["python3", "/app/package-retention.py"]
              env:
                # In-cluster Service; the public name hairpins off the ingress
@@ -88,7 +88,7 @@ spec:
        # deliver, and the ClusterIP has no backend while HA restarts. The
        # trap forwards SIGTERM so the pod still terminates promptly.
        - name: socat-ipv4
-          image: alpine/socat:1.8.1.3@sha256:fb3862c949af7c79996d0e514ee96128644d840835ed5368eeecb14a869de361
+          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -130,7 +130,7 @@ spec:
        # depends on the kernel's bindv6only default rather than on anything
        # stated here, so the roles are made explicit instead of inherited.
        - name: socat-ipv6
-          image: alpine/socat:1.8.1.3@sha256:fb3862c949af7c79996d0e514ee96128644d840835ed5368eeecb14a869de361
+          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -61,7 +61,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: shelly-manager
-          image: gitea.renner.uno/k.renner/shelly-manager:build.1792387459 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/k.renner/shelly-manager:build.1792997278 # {"$imagepolicy": "flux-system:shelly-manager"}
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
@@ -177,7 +177,7 @@ spec:
        # No probes: it only serves the API-key path, and a probe failure would
        # also pull the pod out of the shelly-manager Service.
        - name: api-proxy
-          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b9241c6e7b8e9a862f129d8d4199ab64b10390949a78bdd5603379b32c844083
+          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b5047b9b76845eac124358373c6852377c52e4b05834a47647e955dd91cb8f1e
          env:
            - name: POD_IP
              valueFrom:
@@ -192,7 +192,7 @@ spec:
        # substitution to POD_IP so nginx-runtime variables like $host
        # / $http_x_forwarded_for in the template stay intact.
        - name: proxy
-          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:378d0c32f6562f7fd9629170797f57d2b953aa09be983b3daaf4809bb039ca00
+          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b5047b9b76845eac124358373c6852377c52e4b05834a47647e955dd91cb8f1e
          env:
            - name: POD_IP
              valueFrom:
@@ -236,7 +236,7 @@ spec:
        # readiness probe on purpose: a broker outage must not take HA out of
        # its Service endpoints.
        - name: mqtt-tls
-          image: ghostunnel/ghostunnel:v1.11.4@sha256:e5248233863aadd36383a11c92360f2981141881ef05e38360a6ada8630d36b1
+          image: ghostunnel/ghostunnel:v1.11.5@sha256:65c4e34ec0ee0f30ea1f72b7411ec70a91c32fc50f067a8466ad2adb1e7420f2
          args:
            - client
            - --listen=127.0.0.1:11883
@@ -275,7 +275,7 @@ spec:
        # any LAN client can edit, matching the user's trust-the-network
        # model. Runs as root so its writes match HA's root-owned files.
        - name: code-server
-          image: codercom/code-server:4.141.0@sha256:72ab24b5680ee597dd647b30d82625752f40109b5f61bef90ffbf1ea1f02dbb8
+          image: codercom/code-server:4.143.1@sha256:377b66bec5645510ed52549bb00e648c273edc604d230a3f90fd2b2433afcb97
          args:
            - "--auth=none"
            - "--bind-addr=0.0.0.0:8080"
@@ -337,7 +337,7 @@ spec:
        # dedicated long-lived token.
        # Runs as root to match HA's root-owned /config files. See config-sync.sh.
        - name: config-sync
-          image: alpine/git:2.54.0@sha256:03228d7ded483b0b3e55e1de7fa660d70d3e1bb432fa7021d29e192640de11aa
+          image: alpine/git:2.54.0@sha256:e8ceedc73bd80992ae8d58a7d24c58b8322146c354f1d2e81a97db4452068ec0
          command: ["/bin/sh", "/scripts/sync.sh"]
          env:
            - name: SYNC_BRANCH
@@ -36,7 +36,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: esphome
-          image: ghcr.io/esphome/esphome:2026.9.1@sha256:776a845d508909bf426d2ee7bdd81796361ebe6a7f091807ce1d6d0b48985413
+          image: ghcr.io/esphome/esphome:2026.10.0@sha256:1dff19a59070cdb523b76576cdc74d200f862d43c1407809088855920cf57145
          imagePullPolicy: IfNotPresent
          # Default entrypoint runs the dashboard (Device Builder) against the
          # mounted /config — no command override needed.
@@ -66,7 +66,7 @@ spec:
        # The library PVC is populated by the seed phase before this
        # Deployment reconciles, so no rsync init is needed here.
        - name: fetch-le-staging-roots
-          image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
          command:
            - sh
            - -c
@@ -57,7 +57,7 @@ spec:
        runAsNonRoot: false
      initContainers:
        - name: wait-for-influxd
-          image: influxdb:2.9.1@sha256:cdd3dbdea45c2f43513abd06ee9644b6e05d2354a2b93ca829c9f07d716eaaac
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
          env:
            - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
            - { name: INFLUX_ORG, value: renner }
@@ -80,7 +80,7 @@ spec:
              echo "[$(date -u +%H:%M:%S)] $INFLUX_HOST ready and authenticated"
      containers:
        - name: create
-          image: influxdb:2.9.1@sha256:cdd3dbdea45c2f43513abd06ee9644b6e05d2354a2b93ca829c9f07d716eaaac
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
          env:
            - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
            - { name: INFLUX_ORG, value: renner }
@@ -88,7 +88,7 @@ spec:
        # state). Two-stage so we don't try to create an auth before
        # the chart's `influx setup` has finished.
        - name: wait-for-influxd
-          image: influxdb:2.9.1@sha256:cdd3dbdea45c2f43513abd06ee9644b6e05d2354a2b93ca829c9f07d716eaaac
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
          env:
            - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
            - { name: INFLUX_ORG, value: renner }
@@ -111,7 +111,7 @@ spec:
              echo "[$(date -u +%H:%M:%S)] $INFLUX_HOST ready and authenticated"
      containers:
        - name: create
-          image: influxdb:2.9.1@sha256:cdd3dbdea45c2f43513abd06ee9644b6e05d2354a2b93ca829c9f07d716eaaac
+          image: influxdb:2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2
          env:
            - { name: INFLUX_HOST, value: http://influxdb-influxdb2.influxdb.svc.cluster.local:8086 }
            - { name: INFLUX_ORG, value: renner }
@@ -55,7 +55,7 @@ spec:
      repository: influxdb
      # Was pinned to VM 108's 2.7.4 for the one-time `influx restore`; that
      # migration is done. No downgrade below 2.9 without `influxd downgrade`.
-      tag: "2.9.1@sha256:cdd3dbdea45c2f43513abd06ee9644b6e05d2354a2b93ca829c9f07d716eaaac"
+      tag: "2.9.1@sha256:8f106f7ff12659c5e367b99f8a0e7d14cbd4e6ca1f2914094062db6a9813d9c2"
    # Single replica — InfluxDB OSS doesn't cluster. RWO Ceph-block + Velero
    # backups (pending) is the durability story.
    persistence:
@@ -72,7 +72,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: element-web
-          image: ghcr.io/element-hq/element-web:v1.12.30@sha256:3e7dbd4424de9e11c812bc740acf2725b2abe66ea0d0802023b56fd85d3fa09a
+          image: ghcr.io/element-hq/element-web:v1.12.32@sha256:f8700633d4336258af7a05b53865a4f479e0d628cf2d9ca83d28b5939314d4ce
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -137,7 +137,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.26.0@sha256:e089f1048a1d4a9a492ed17b9fe759100f1bd619407b001f5927928d88b780c4
+          image: ghcr.io/element-hq/matrix-authentication-service:1.27.1@sha256:02712e68c90f3743fedbd5e3343517481b2b4f246a9fd9e2f050dc2553033847
          # The server applies database migrations and syncs the upstream
          # providers from the config on start.
          args: ["server", "--config", "/config/config.yaml"]
@@ -124,7 +124,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: livekit
-          image: livekit/livekit-server:v1.13.10@sha256:89ca9ce0791e18d6e03bf6e2c49ceb27e1c754eae8bd50c989386c1a5963791a
+          image: livekit/livekit-server:v1.13.11@sha256:25cd902de7cacbd5f1f779f6a6ac1eae20ba8f56b0935934ce6b0ab80d1e3d20
          args:
            - --config
            - /config/livekit.yaml
@@ -179,7 +179,7 @@ spec:
        # first. The marker on the data PVC makes later starts skip it.
        # Debug image: the plain one has no shell for the marker check.
        - name: migrate-to-mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.26.0-debug@sha256:46f7480f5ea4243ccb6fd2c447ea859e0230c8b3c0e676ee285d4ae6ca344ee3
+          image: ghcr.io/element-hq/matrix-authentication-service:1.27.1-debug@sha256:75f369b206785f1480f4a9f8dd81d7f9f3c6793c40fd184358ecd5d7acae17d4
          command:
            - /busybox/sh
            - -ec
@@ -234,7 +234,7 @@ spec:
              mountPath: /data
      containers:
        - name: synapse
-          image: ghcr.io/element-hq/synapse:v1.162.0@sha256:6b84a7bbac36f080b2d2e51e0289cf1b08b349598ea44a558df38d558f2c2311
+          image: ghcr.io/element-hq/synapse:v1.163.2@sha256:c3c21919a322f74d177a43bce8031adc81ef839ddd117a8dd03cfec350e76e02
          # Bypass /start.py: it expects to run as root and template a config
          # from env. Default mode is generate-missing-and-run, which creates
          # the signing key on first start.
@@ -5,7 +5,9 @@
 #
 # The UDM is queried directly rather than through the cluster resolver:
 # k8s-gateway caches these with `serve_stale 1h immediate`, which would keep
-# a deleted record green for an hour.
+# a deleted record green for an hour. The addresses are the UDM on the segment
+# pod traffic leaves on, the same upstream k8s-gateway uses (k8s-gateway-site
+# in talos/patches/site-homelab.yaml).
 #
 # `release` is load-bearing — probeSelector matches on it.
 apiVersion: monitoring.coreos.com/v1
@@ -25,8 +27,8 @@ spec:
  targets:
    staticConfig:
      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
      # instance is the resolver and identical across these Probes, so the
      # queried name has to come from a label.
      labels:
@@ -49,8 +51,8 @@ spec:
  targets:
    staticConfig:
      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
      labels:
        dns_name: mqtt.renner.uno
 ---
@@ -71,8 +73,8 @@ spec:
  targets:
    staticConfig:
      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
      labels:
        dns_name: ldap.renner.uno
 ---
@@ -93,8 +95,8 @@ spec:
  targets:
    staticConfig:
      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
      labels:
        dns_name: syslog.renner.uno
 ---
@@ -115,8 +117,8 @@ spec:
  targets:
    staticConfig:
      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
      labels:
        dns_name: ftp.paperless.renner.uno
 ---
@@ -137,7 +139,7 @@ spec:
  targets:
    staticConfig:
      static:
-        - "[fd00::1]:53"
-        - "10.2.40.1:53"
+        - "[fd02:47::1]:53"
+        - "10.2.47.1:53"
      labels:
        dns_name: syncthing.paperless.renner.uno
@@ -32,6 +32,9 @@ spec:
    deploymentMode: SingleBinary
    loki:
      auth_enabled: false
+      # No usage reports to stats.grafana.org (egress is not allowed anyway).
+      analytics:
+        reporting_enabled: false
      commonConfig:
        replication_factor: 1
      storage:
@@ -17,7 +17,7 @@ spec:
  chart:
    spec:
      chart: kube-prometheus-stack
-      version: "92.3.0"
+      version: "92.13.1"
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
@@ -74,7 +74,7 @@ spec:
          # alpine/kubectl is the maintained replacement. Pin the tag
          # to the cluster's server version so kubectl is in lock-step
          # (mismatched skew can break exec streaming).
-          image: docker.io/alpine/kubectl:1.37.1@sha256:b568e8beb6a79aee269c142343078a278b85e7710f1c0e7d8d6b21d1eb566a48
+          image: docker.io/alpine/kubectl:1.37.1@sha256:a5d0fbecab3f7b6c2ab7398f1daa73a3e0ed6ece18556d21698233e9e3759cc7
          env:
            - name: DATASET_TLV
              valueFrom:
@@ -47,7 +47,7 @@ spec:
        #
        # Hence socat is installed at startup and run inside this container.
        - name: otbr
-          image: openthread/otbr:latest@sha256:a1ccea58241c2e0c2e16a55590cdd5651336462c3b4fa26e24a59607e155ef72
+          image: openthread/otbr:latest@sha256:f3e43ccd86d6da87323873efa0c9b6f92a2a8cc75a804ea50e34c96680363e2e
          command:
            - bash
            - -c
@@ -22,7 +22,7 @@ spec:
          type: RuntimeDefault
      initContainers:
        - name: prepare-dirs
-          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+          image: alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
          command:
            - sh
            - -c
@@ -287,7 +287,7 @@ spec:
              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
        # anchor: bridge-tls-proxy
        - name: bridge-tls-proxy
-          image: alpine/socat:1.8.1.3@sha256:fb3862c949af7c79996d0e514ee96128644d840835ed5368eeecb14a869de361
+          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
          args:
            - "-d"
            - "TCP-LISTEN:11143,fork,reuseaddr,bind=127.0.0.1"
@@ -50,7 +50,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: syncthing
-          image: syncthing/syncthing:2.1.6@sha256:4d0281bdcb4ed9baf503d251d0544ddd856f49fce3f114056257ae172b7fb670
+          image: syncthing/syncthing:2.1.7@sha256:2b71da7c0d0a91a6ae5285ad079226fecc0a365d08b27720e1f7037b018f7546
          env:
            # UI bind: any-interface so the ClusterIP Service can reach
            # it. Network exposure is gated by the absence of an Ingress
@@ -59,7 +59,7 @@ spec:
            - name: renovate
              # Pinned by tag and digest. Renovate updates itself through
              # homelab's renovate.json, like any other image here.
-              image: docker.io/renovate/renovate:44.151.2@sha256:9ea828b38867af0ca5f269e6c5feace9e74e7f035da150bb16f8c5f70bf2e6e8
+              image: docker.io/renovate/renovate:44.181.8@sha256:b28b2de1dfd35de7e8198756d7f7cdd84ebc28c3f25e80f5b09e598d3faefb2a
              env:
                - name: RENOVATE_CONFIG_FILE
                  value: /config/config.json
@@ -32,7 +32,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: review-bot
-          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-25-1455 # {"$imagepolicy": "flux-system:review-bot"}
+          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-26-0647 # {"$imagepolicy": "flux-system:review-bot"}
          env:
            - name: REPOS
              value: konairius/homelab,konairius/homeassistant,konairius/authentik-samba-bridge,konairius/shelly-manager
@@ -0,0 +1,152 @@
+# The wiki's schedules. The service runs nothing on its own clock; these jobs
+# call its API with the `scheduler` key. Run one now:
+#   kubectl -n ai create job --from=cronjob/wiki-encyclopedia wiki-encyclopedia-now
+# Generated once in-cluster, nothing in OpenBao.
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: wiki-scheduler-key
+  namespace: ai
+spec:
+  length: 64
+  digits: 16
+  symbols: 0
+  allowRepeat: true
+  noUpper: false
+  secretKeys:
+    - Auth__ApiKeys__scheduler
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wiki-scheduler-key
+  namespace: ai
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: wiki-scheduler-key
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: wiki-scheduler-key
+---
+# Interval sync; the Gitea push webhook is the fast path.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: wiki-sync
+  namespace: ai
+  labels:
+    app.kubernetes.io/name: wiki-sync
+spec:
+  schedule: "*/30 * * * *"
+  timeZone: Etc/UTC
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 3
+  startingDeadlineSeconds: 600
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 1800
+      ttlSecondsAfterFinished: 86400
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: wiki-sync
+        spec:
+          restartPolicy: Never
+          enableServiceLinks: false
+          automountServiceAccountToken: false
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            runAsGroup: 65534
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: sync
+              image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+              command:
+                - sh
+                - -c
+                - 'curl -fsS --max-time 1700 -X POST -H "X-Api-Key: $API_KEY" http://wiki.ai.svc.cluster.local:8080/api/v1/sync'
+              env:
+                - name: API_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: wiki-scheduler-key
+                      key: Auth__ApiKeys__scheduler
+              resources:
+                requests:
+                  cpu: 5m
+                  memory: 16Mi
+                limits:
+                  memory: 64Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: ["ALL"]
+---
+# Plans and writes the house encyclopedia (/house). The endpoint syncs first and
+# answers 502 when the run fails or the Anthropic API stopped it.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: wiki-encyclopedia
+  namespace: ai
+  labels:
+    app.kubernetes.io/name: wiki-encyclopedia
+spec:
+  schedule: "0 6 * * *"
+  timeZone: Europe/Berlin
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  startingDeadlineSeconds: 3600
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 11400
+      ttlSecondsAfterFinished: 604800
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: wiki-encyclopedia
+        spec:
+          restartPolicy: Never
+          enableServiceLinks: false
+          automountServiceAccountToken: false
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            runAsGroup: 65534
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: run
+              image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+              command:
+                - sh
+                - -c
+                - 'curl -fsS --max-time 10800 -X POST -H "X-Api-Key: $API_KEY" http://wiki.ai.svc.cluster.local:8080/api/v1/encyclopedia/run'
+              env:
+                - name: API_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: wiki-scheduler-key
+                      key: Auth__ApiKeys__scheduler
+              resources:
+                requests:
+                  cpu: 5m
+                  memory: 16Mi
+                limits:
+                  memory: 64Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: ["ALL"]
@@ -24,7 +24,7 @@ metadata:
  namespace: ai
  annotations:
    # Keys, tokens and the Anthropic key arrive via envFrom; a rotated Secret rolls the pod.
-    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-typesafe,wiki-anthropic,wiki-api-basic-auth
+    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-scheduler-key,wiki-typesafe,wiki-anthropic,wiki-api-basic-auth
  labels:
    app.kubernetes.io/name: wiki
 spec:
@@ -53,7 +53,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: wiki
-          image: gitea.renner.uno/konairius/wiki:build.1792939775 # {"$imagepolicy": "flux-system:wiki"}
+          image: gitea.renner.uno/konairius/wiki:build.1792997373 # {"$imagepolicy": "flux-system:wiki"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -89,6 +89,9 @@ spec:
                name: wiki-gitea
            - secretRef:
                name: wiki-api-keys
+            # The key the wiki-sync and wiki-encyclopedia CronJobs call with (cronjobs.yaml).
+            - secretRef:
+                name: wiki-scheduler-key
            - secretRef:
                name: wiki-typesafe
            - secretRef:
@@ -4,3 +4,4 @@ resources:
  - externalsecrets.yaml
  - deployment.yaml
  - ingress.yaml
+  - cronjobs.yaml
@@ -69,7 +69,7 @@ spec:
          # first build of that day — imagePullPolicy: Always does not help,
          # because the tag itself resolves stale. Update this when the image
          # is rebuilt.
-          image: gitea.renner.uno/gitea_admin/bird@sha256:afd8c3a1fc21a9f2c67af366b3bf77ca9b948f07f66a4977821e4972c8fa6ae4
+          image: gitea.renner.uno/gitea_admin/bird@sha256:65fc93efead1e9b065d2c78e748f6c3c1ad7216e28b757d9fa4e204fa2ffe9a9
          command: ["/bin/sh", "-c"]
          args:
            - |
@@ -95,7 +95,7 @@ spec:
              mountPath: /etc/bird
      containers:
        - name: bird
-          image: gitea.renner.uno/gitea_admin/bird@sha256:afd8c3a1fc21a9f2c67af366b3bf77ca9b948f07f66a4977821e4972c8fa6ae4
+          image: gitea.renner.uno/gitea_admin/bird@sha256:65fc93efead1e9b065d2c78e748f6c3c1ad7216e28b757d9fa4e204fa2ffe9a9
          resources:
            requests:
              cpu: "50m"
@@ -1,74 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: coredns
-  namespace: kube-system
-data:
-  Corefile: |
-    # Delegate renner.uno to the in-cluster k8s_gateway resolver. It
-    # watches Ingress resources and synthesises A/AAAA records that
-    # point at the ingress-nginx LB, so pods resolving `auth.renner.uno`,
-    # `audiobooks.renner.uno`, … stay inside the cluster. Names not
-    # backed by an in-cluster Ingress fall through inside k8s_gateway
-    # itself to the UDM (10.2.40.1 / fd00::1), which serves the split-horizon
-    # renner.uno zone, preserving resolution of LXC/VM + physical services.
-    # (The old Proxmox DNS VIP 10.2.40.53 is DECOMMISSIONED.) 10.96.0.11 is a
-    # pinned ClusterIP of the k8s-gateway Service — avoids DNS-name
-    # resolution during CoreDNS startup.
-    # Cache tuning mirrors k8s-gateway's (issue #393): the UDM's dnsmasq
-    # refuses connections in bursts, and because the public renner.uno zone
-    # has a *.renner.uno wildcard CNAME that matches at every depth, a local
-    # failure never returns NXDOMAIN — it resolves to the WAN proxy instead.
-    # Correct answers carry TTL 5 (dnsmasq lease records) while the wrong
-    # wildcard answer carries TTL 300, so one brief blip pins a wrong answer
-    # for minutes. `success ... 60` raises the 5s TTL to a 60s floor and
-    # `serve_stale 1h immediate` keeps serving through an upstream outage.
-    # NOTE: only cache/serve_stale — the `template` plugin is deliberately NOT
-    # reintroduced here (it broke cluster DNS in 7a09bad5).
-    renner.uno:53 {
-        errors
-        cache 300 {
-            success 9984 300 60
-            denial 9984 300 30
-            serve_stale 1h immediate
-        }
-        forward . 10.96.0.11
-        loop
-        reload
-    }
-
-    .:53 {
-        errors
-        health {
-            lameduck 5s
-        }
-        ready
-        log . {
-            class error
-        }
-        prometheus :9153
-
-        kubernetes cluster.local in-addr.arpa ip6.arpa {
-            pods insecure
-            fallthrough in-addr.arpa ip6.arpa
-            ttl 30
-        }
-        forward . /etc/resolv.conf {
-           max_concurrent 1000
-        }
-        # serve_stale mirrors the renner.uno:53 block (issue #393): when the
-        # upstream resolver browns out, keep answering from expired cache
-        # instead of SERVFAILing every public name cluster-wide. Seen on
-        # 2026-07-30 01:22-01:26Z (~1150 SERVFAILs) — it killed a Velero Kopia
-        # maintenance job, which runs with backoffLimit 0, on the Hetzner S3
-        # endpoint (issue #439). cluster.local is exempt from the cache above,
-        # so in-cluster Service records are never served stale.
-        cache 30 {
-           disable success cluster.local
-           disable denial cluster.local
-           serve_stale 1h immediate
-        }
-        loop
-        reload
-        loadbalance
-    }
@@ -1,5 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+# CoreDNS itself (Deployment, Corefile) is a Talos bootstrap manifest; only
+# its LoadBalancer Service lives here.
 resources:
-  - configmap.yaml
  - service.yaml
@@ -4,7 +4,7 @@ metadata:
  name: gitea-mcp
  namespace: flux-system
 spec:
-  image: docker.gitea.com/gitea-mcp-server
+  image: docker.gitea.com/gitea-mcp-server@sha256:ccdb5660ecdf54c5e480f10cc8120ba2bf150b582cea8a1974de2e59883582d3
  interval: 1h
 ---
 apiVersion: image.toolkit.fluxcd.io/v1
@@ -85,10 +85,11 @@ spec:
            parameters: "0.0.0.0:9153"
    serviceType: ClusterIP
    service:
-      # Pinned so the main CoreDNS Corefile can forward renner.uno
-      # here without depending on DNS-based Service resolution during
-      # CoreDNS startup (chicken-and-egg). Chosen from the low, sparsely
-      # populated end of the service CIDR (kube-dns is 10.96.0.10).
+      # Pinned because the nodes' resolver names it by address
+      # (ResolverConfig in the Talos site patches); CoreDNS forwards to the
+      # node, so every name reaches k8s-gateway that way. Chosen from the
+      # low, sparsely populated end of the service CIDR (kube-dns is
+      # 10.96.0.10).
      clusterIP: 10.96.0.11
      ipFamilyPolicy: PreferDualStack
  # The site's upstream resolvers (deployment.dnsPolicy/dnsConfig), from the
@@ -71,7 +71,7 @@ spec:
        # socket's parent, and refuses to start if the socket file is left
        # over from an unclean shutdown (bind: address already in use).
        - name: clean-socket
-          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+          image: alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
          command: ["sh", "-c", "rm -f /run/cni/dhcp.sock"]
          volumeMounts:
            - name: run-cni
@@ -83,7 +83,7 @@ spec:
          # Any image with a shell works: the binary executed here is the
          # host's, bind-mounted from /opt/cni/bin. Pinned to the same
          # alpine tag the sibling installer uses.
-          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+          image: alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
          command:
            - /opt/cni/bin/dhcp
            - daemon
@@ -288,7 +288,8 @@ spec:
            - port: "80"
              protocol: TCP
 ---
-# syncthing: relays/discovery (443), STUN (3478), peer sync (22000), local discovery (21027).
+# syncthing: relays/discovery (443), STUN (3478, 3479 for the NAT-type
+# change request), peer sync (22000), local discovery (21027).
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -306,6 +307,7 @@ spec:
            - port: "443"
              protocol: TCP
            - port: "3478"
+              endPort: 3479
              protocol: UDP
            - port: "22000"
              protocol: TCP
@@ -71,7 +71,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-25 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-26 # {"$imagepolicy": "flux-system:secret-rotator"}
              args: ["ha-token"]
              securityContext:
                allowPrivilegeEscalation: false
@@ -133,7 +133,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-25 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-26 # {"$imagepolicy": "flux-system:secret-rotator"}
              args: ["ha-token"]
              securityContext:
                allowPrivilegeEscalation: false
@@ -195,7 +195,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-25 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-26 # {"$imagepolicy": "flux-system:secret-rotator"}
              args: ["ha-token"]
              securityContext:
                allowPrivilegeEscalation: false
@@ -11,7 +11,7 @@ spec:
  restartPolicy: Never
  containers:
    - name: check
-      image: docker.io/nicolaka/netshoot:v0.13@sha256:a20c2531bf35436ed3766cd6cfe89d352b050ccc4d7005ce6400adf97503da1b
+      image: docker.io/nicolaka/netshoot:v0.16@sha256:b09d9b21381f47a79b3cbcb30da25266dc17186ea00ae65e99fdc51396f48e70
      command:
        - /bin/bash
        - -c
@@ -20,8 +20,9 @@ machine:
        - 10.2.46.0/24
        - fd02:46::/64
  # The UDM on the ingress segment. Published here rather than as a route
-  # because bird owns table 47 and originates the default from it; this is the
-  # one place the address is stated.
+  # because bird owns table 47 and originates the default from it. Bird reads
+  # it from here; k8s-gateway-site below names it again as the pods' resolver,
+  # because a Talos inline manifest cannot read a node annotation.
  nodeAnnotations:
    net.renner.uno/egress-gw-v6: fd02:47::1
    net.renner.uno/egress-gw-v4: 10.2.47.1
@@ -63,7 +64,10 @@ cluster:
              directRoutingDevice: pod0
            ipv4NativeRoutingCIDR: 10.0.0.0/8
            ipv6NativeRoutingCIDR: fd00::/8
-    # The site's upstream for k8s-gateway (its pod resolv.conf): the UDM.
+    # The site's upstream for k8s-gateway (its pod resolv.conf): the UDM on
+    # the segment pod traffic leaves on, ingress0 (net.renner.uno/egress-gw-*
+    # above). The UDM's DNS answers out of the interface a query arrived on,
+    # so its address on another segment gets no reply to a pod source.
    - name: k8s-gateway-site
      contents: |
        apiVersion: v1
@@ -79,8 +83,8 @@ cluster:
              dnsPolicy: None
              dnsConfig:
                nameservers:
-                  - 10.2.40.1
-                  - fd00::1
+                  - fd02:47::1
+                  - 10.2.47.1
 ---
 # All pod traffic goes to table 47, and the table decides — longest prefix
 # match, no exceptions to carve out. bird fills it with the node's attached
@@ -2,7 +2,7 @@
 #
 # Nothing in the final image but the binary and the CA bundle it needs to reach the Mistral API
 # (the binary has no shell and no package manager to patch or to exec).
-FROM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61 AS build
+FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS build

 WORKDIR /build
 COPY go.mod go.sum ./
@@ -8,7 +8,7 @@
 # lives inside the binary rather than in /etc/ssl. (In-cluster traffic to
 # OpenBao and Home Assistant is plain HTTP anyway; TLS is here so the same
 # binary can take over the external-API rotators — Cloudflare, Proxmox.)
-FROM rust:1.99-alpine@sha256:0cce0a5e0e8ba67b455257a3a02a1d99005f382748789d6464460028810f1627 AS build
+FROM rust:1.99-alpine@sha256:b1d5dd5a22a09404d3e798c0cf051b689077360374eb505fa5bb93c479693d87 AS build

 # musl-dev provides the C runtime bits the linker needs for a fully static
 # binary; nothing from it ends up in the final image.
Author	SHA1	Message	Date
k.renner	622a4cc593	Merge pull request 'chore(coredns): Talos alone owns the Corefile (2/2)' (#1450 ) from claude/coredns-talos-owned-2 into main Reviewed-on: #1450	2026-10-26 09:04:47 +00:00
claude-botandClaude Opus 5.5	60d3acc202	chore(coredns): Talos alone owns the Corefile ci/woodpecker/pr/ci-manifests-test Pipeline is running Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details Step 2 of 2. The coredns ConfigMap is a Talos bootstrap manifest; Flux stops applying its own copy (prune is disabled since the previous commit, so the live ConfigMap stays until talosctl upgrade-k8s writes Talos's version). CoreDNS forwards to the node resolver, which asks k8s-gateway first, so cluster DNS no longer depends on Flux. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-26 09:59:37 +01:00
k.renner	cb697e2812	Merge pull request 'chore(coredns): keep Flux from pruning the Talos-owned Corefile (1/2)' (#1449 ) from claude/coredns-talos-owned into main Reviewed-on: #1449 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-26 08:58:29 +00:00
claude-botandClaude Opus 5.5	1e26d5cdb2	chore(coredns): keep Flux from pruning the Talos-owned Corefile ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Step 1 of 2 to hand the coredns ConfigMap back to Talos. It is a Talos bootstrap manifest (talos-bootstrap-manifests-inventory) that Flux also applies; talosctl upgrade-k8s reverts Flux's Corefile. Bootstrap already runs on Talos's Corefile (forward to the node resolver, which asks k8s-gateway first), and k8s-gateway carries serve_stale for every name, so the Flux copy is redundant. With prune disabled, step 2 can drop the file without Flux deleting the live ConfigMap. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-26 09:55:13 +01:00
k.renner	fbd3fbd119	Merge pull request 'fix(dns): pods ask the UDM on the segment they leave on' (#1448 ) from claude/k8s-gateway-ingress-resolver into main Reviewed-on: #1448	2026-10-26 07:39:52 +00:00
k.renner	3c05098780	Merge pull request 'fix(egress): syncthing STUN 3479, Loki usage reporting off' (#1447 ) from claude/egress-followups into main Reviewed-on: #1447 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-26 07:39:25 +00:00
claude-botandClaude Opus 5.5	5ecd17d26b	fix(dns): pods ask the UDM on the segment they leave on ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Since UniFi OS 6.0.15 / Network 11.0.97 (2026-10-25 18:42Z) the UDM's DNS answers out of the interface a query arrived on. Pod traffic to 10.2.40.1 arrives on VLAN 40 (on-link route in table 47) while the pod CIDRs are routed back over VLAN 47, so the UDM ARPs for the pod on VLAN 40 and never answers (seen with talosctl pcap on k8s-3; TCP 443 to the same address works, UDP and TCP 53 do not). fd00::1 was reached over VLAN 47 and kept working. k8s-gateway's upstream (k8s-gateway-site), the blackbox-dns probes and the gatus UDM check now use the UDM's ingress-segment addresses, fd02:47::1 and 10.2.47.1 (the egress-gw annotations); both answer from a pod. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-26 08:29:04 +01:00
security-bot	f29e9f965a	chore(image-automation): bump gitea.renner.uno/konairius/wiki:build.1792997373 Updates managed by image-automation-controller.	2026-10-26 06:56:47 +00:00
security-bot	42a3a31460	chore(image-automation): bump gitea.renner.uno/k.renner/shelly-manager:build.1792997278 gitea.renner.uno/gitea_admin/review-bot:2026-10-26-0647 Updates managed by image-automation-controller.	2026-10-26 06:53:44 +00:00
security-bot	188784d406	chore(image-automation): bump gitea.renner.uno/gitea_admin/secret-rotator:2026-10-26 Updates managed by image-automation-controller.	2026-10-26 06:53:42 +00:00
security-bot	6f5c4f7b81	chore(image-automation): bump docker.gitea.com/gitea-mcp-server:1.11.0 Updates managed by image-automation-controller.	2026-10-26 06:52:51 +00:00
claude-botandClaude Opus 5.5	76f3d4b6b5	fix(egress): syncthing STUN 3479, Loki usage reporting off ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details syncthing's STUN NAT-type probe sends its change request to port 3479, which syncthing-egress dropped (seen: 77.72.169.212:3479/UDP). Loki tried to send usage reports to Grafana (34.49.170.206:443), denied by its egress policy; switch reporting off instead of allowing it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-26 07:51:31 +01:00
k.renner	67ff176875	Merge pull request 'chore(deps): update alpine:3.24 docker digest to be26560' (#1441 ) from renovate/multus into main Reviewed-on: #1441	2026-10-26 06:43:16 +00:00
k.renner	2ddb9544e6	Merge pull request 'feat(wiki): sync and encyclopedia schedules as CronJobs' (#1446 ) from feat/wiki-cronjobs into main Reviewed-on: #1446	2026-10-26 06:43:02 +00:00
k.renner	25e70dc555	Merge pull request 'chore(deps): update home-assistant non-major' (#1442 ) from renovate/home-assistant-minor-patch into main Reviewed-on: #1442	2026-10-26 06:42:36 +00:00
k.renner	a4b18f44c3	Merge pull request 'chore(deps): update all non-major dependencies' (#1440 ) from renovate/all-minor-patch into main ci/woodpecker/push/build-ci-images Pipeline was successful Details Reviewed-on: #1440	2026-10-26 06:42:16 +00:00
k.renner	49856fe577	Merge pull request 'chore(deps): update influxdb:2.9.1 docker digest to 8f106f7' (#1443 ) from renovate/influxdb into main Reviewed-on: #1443 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-26 06:42:01 +00:00
k.renner	576611faae	Merge pull request 'chore(deps): update ci non-major' (#1444 ) from renovate/ci-minor-patch into main ci/woodpecker/push/build-ci-images Pipeline is pending Details ci/woodpecker/push/ci-claude-refresh Pipeline is pending Details ci/woodpecker/push/deploy-infrastructure Pipeline is pending Details Reviewed-on: #1444 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-26 06:41:44 +00:00
k.renner	cc898ec553	Merge pull request 'chore(deps): update hermes image' (#1445 ) from renovate/hermes-image into main ci/woodpecker/push/build-ci-images Pipeline is pending Details ci/woodpecker/push/hermes-image Pipeline is pending Details Reviewed-on: #1445	2026-10-26 06:41:25 +00:00
k.renner	7d53c99062	Merge pull request 'chore(deps): pin docker.gitea.com/gitea-mcp-server docker tag to ccdb566' (#1439 ) from renovate/pin-image-digests into main Reviewed-on: #1439	2026-10-26 06:40:47 +00:00
claude-botandClaude Opus 5.5	8ce5ebd8ac	feat(wiki): sync and encyclopedia schedules as CronJobs ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details wiki-sync (every 30 min) and wiki-encyclopedia (06:00 Europe/Berlin) call the service's API with a generated scheduler key; the service no longer schedules anything itself (konairius/Wiki#18). Pods in ai already reach the wiki through the namespace default policy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-26 07:37:15 +01:00
renovate-bot	9258947fef	chore(deps): update hermes image ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details	2026-10-26 03:01:35 +00:00
renovate-bot	da614f83fe	chore(deps): update influxdb:2.9.1 docker digest to 8f106f7 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details	2026-10-26 03:01:30 +00:00
renovate-bot	e5c99655e5	chore(deps): update home-assistant non-major ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details	2026-10-26 03:01:27 +00:00
renovate-bot	392a010daa	chore(deps): update alpine:3.24 docker digest to be26560 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details	2026-10-26 03:01:25 +00:00
renovate-bot	f04f449163	chore(deps): update all non-major dependencies ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/review-bot-test Pipeline was successful Details	2026-10-26 03:01:23 +00:00
renovate-bot	32d0f0cc7b	chore(deps): pin docker.gitea.com/gitea-mcp-server docker tag to ccdb566 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details	2026-10-26 03:01:19 +00:00