Owner decision on #206: keep status.renner.uno public (NOT Authentik-gated) but stop it disclosing the internal service estate.
What changed
kubernetes/apps/gatus/configmap.yaml only. For gatus v5.36.0, all ui.hide-* options default to false, so the public page and /api/v1/endpoints/statuses API exposed each check target and, on failure, error strings containing internal FQDNs/IPs.
For every endpoint:
Opaque display name — Authentik/Gitea/Immich/Woodpecker CI/Grafana/Home Assistant/Paperless/Audiobookshelf/Music Assistant -> Web Service 1..9; PBS 2 (pbs2.renner.uno)/Proxmox VE/UDM DNS (renner.uno)/Mosquitto (MQTT broker) -> Infrastructure 1..4. No product/vendor/hostname left in any public name.
Per-endpoint ui: block with hide-hostname/hide-url/hide-port/hide-conditions/hide-errors: true — gatus scrubs the target hostname, URL, port, condition strings, and error text server-side.
Preserved
Every health check still runs unchanged (real targets remain in url, visible only to git/cluster operators). No monitor was dropped.
A maintainer-only opaque->real map is kept as a YAML comment (not served publicly).
Public page now shows only: group + opaque label + up/down + response time.
Owner decision on #206: keep status.renner.uno public (NOT Authentik-gated) but stop it disclosing the internal service estate.
## What changed
`kubernetes/apps/gatus/configmap.yaml` only. For gatus v5.36.0, all `ui.hide-*` options default to `false`, so the public page and `/api/v1/endpoints/statuses` API exposed each check target and, on failure, error strings containing internal FQDNs/IPs.
For every endpoint:
1. **Opaque display name** — `Authentik/Gitea/Immich/Woodpecker CI/Grafana/Home Assistant/Paperless/Audiobookshelf/Music Assistant` -> `Web Service 1..9`; `PBS 2 (pbs2.renner.uno)/Proxmox VE/UDM DNS (renner.uno)/Mosquitto (MQTT broker)` -> `Infrastructure 1..4`. No product/vendor/hostname left in any public `name`.
2. **Per-endpoint `ui:` block** with `hide-hostname/hide-url/hide-port/hide-conditions/hide-errors: true` — gatus scrubs the target hostname, URL, port, condition strings, and error text server-side.
## Preserved
- Every health check still runs unchanged (real targets remain in `url`, visible only to git/cluster operators). No monitor was dropped.
- A maintainer-only opaque->real map is kept as a YAML comment (not served publicly).
Public page now shows only: group + opaque label + up/down + response time.
## Validation
`kubectl kustomize kubernetes/apps/gatus` builds clean (exit 0).
Fixes #206
🤖 Generated with [Claude Code](https://claude.com/claude-code)
status.renner.uno / status.k.renner.uno is a public, unauthenticated gatus
page. Its endpoints named the internal service estate (Authentik, Gitea,
Immich, Grafana, HA, Paperless, Proxmox, PBS, UDM DNS, Mosquitto) and gatus
exposed each check's target hostname/URL/port — and on failure the error
text (e.g. mosquitto.home-assistant.svc.cluster.local, 10.2.40.1) — via the
public results and /api/v1/endpoints/statuses API (all hide-* default false).
Per owner decision keep the page public (not Authentik-gated) but scrub the
disclosure:
- rename every endpoint to an opaque label (Web Service N / Infrastructure N),
removing product/vendor/hostname identifiers from the public `name`
- add a per-endpoint ui block with hide-hostname/hide-url/hide-port/
hide-conditions/hide-errors: true so gatus scrubs targets server-side
All checks keep running unchanged (real targets stay in `url`, visible only
to git/cluster operators). Public page now shows group + opaque label +
up/down + response time only. Maintainer opaque->real map kept as a comment.
Fixes#206
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Owner decision on #206: keep status.renner.uno public (NOT Authentik-gated) but stop it disclosing the internal service estate.
What changed
kubernetes/apps/gatus/configmap.yamlonly. For gatus v5.36.0, allui.hide-*options default tofalse, so the public page and/api/v1/endpoints/statusesAPI exposed each check target and, on failure, error strings containing internal FQDNs/IPs.For every endpoint:
Authentik/Gitea/Immich/Woodpecker CI/Grafana/Home Assistant/Paperless/Audiobookshelf/Music Assistant->Web Service 1..9;PBS 2 (pbs2.renner.uno)/Proxmox VE/UDM DNS (renner.uno)/Mosquitto (MQTT broker)->Infrastructure 1..4. No product/vendor/hostname left in any publicname.ui:block withhide-hostname/hide-url/hide-port/hide-conditions/hide-errors: true— gatus scrubs the target hostname, URL, port, condition strings, and error text server-side.Preserved
url, visible only to git/cluster operators). No monitor was dropped.Public page now shows only: group + opaque label + up/down + response time.
Validation
kubectl kustomize kubernetes/apps/gatusbuilds clean (exit 0).Fixes #206
🤖 Generated with Claude Code