konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

feat(paperclip): deploy Paperclip (server-local runs, trial) #966

Merged
k.renner merged 10 commits from feat/paperclip into master 2026-09-25 11:24:24 +00:00
Conversation 1 Commits 10 Files Changed 23
+1767
10 Commits
Author SHA1 Message Date
claude-botandClaude Opus 5.5 50cf3e977a docs(paperclip): align spec with implementation and review fixes
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 13:22:43 +02:00
claude-botandClaude Opus 5.5 bb3a923c43 fix(paperclip): probes pass the hostname guard; tighten egress and SA token 
- Paperclip's private-hostname guard (authenticated+private) returns 403
  for any Host but loopback and the public URL. Kubelet probes send the
  pod IP, so the pod could never become Ready. Probes now send
  Host: localhost.
- Liveness is a TCP check: /api/health runs SELECT 1, so a Postgres
  outage would have restarted the server and killed in-flight runs.
- Baseline CNP allowed world on every port; Cilium unions allows across
  CNPs, so the app-level :443 restriction was not enforced. world is
  now :443-only in the baseline as well.
- automountServiceAccountToken: false. Every agent shares the pod
  filesystem; bots bring their own cluster credentials.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 13:22:17 +02:00
claude-botandClaude Opus 5.5 78cac12367 feat(paperclip): Flux Kustomization 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 13:08:47 +02:00
claude-botandClaude Opus 5.5 5a22ea8df3 feat(paperclip): server Deployment, PVC, gated Ingress and CNPs 
- Sign-up stays enabled: upstream's first-admin claim requires an
  existing signed-in Better Auth account (routes/access.ts
  /bootstrap/claim), so disabling it would lock out the claim. A
  follow-up flips PAPERCLIP_AUTH_DISABLE_SIGN_UP after the claim.
- Telemetry is off via PAPERCLIP_TELEMETRY_DISABLED=1, which
  resolveTelemetryConfig honours; config.json can't carry it alone
  because the schema requires a complete file.
- Container starts as root: docker-entrypoint.sh remaps the node user
  and chowns /paperclip before dropping privileges with gosu.
- Image pinned to the amd64 manifest digest of nightly; Flux digest
  reflection takes over from there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 13:08:32 +02:00
claude-botandClaude Opus 5.5 cb81157216 feat(authentik): paperclip-gate outpost and Paperclip Users group 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 13:07:14 +02:00
claude-botandClaude Opus 5.5 d3257c56ac feat(paperclip): CNPG pclp-pg with barman backups and OpenBao secrets 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 13:06:22 +02:00
claude-botandClaude Opus 5.5 2d56534581 feat(paperclip): Flux image automation tracks the nightly digest 
digestReflectionPolicy: Always requires spec.interval on the ImagePolicy
(admission rejects it otherwise); set to 1h to match the ImageRepository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 13:05:43 +02:00
claude-botandClaude Opus 5.5 6fa4c340b8 feat(paperclip): namespace, baseline CNP and OpenBao allowlist 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 13:04:29 +02:00
claude-botandClaude Opus 5.5 c3c8662ca7 docs(paperclip): implementation plan 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 12:59:16 +02:00
claude-botandClaude Opus 5.5 c2a2481313 docs(paperclip): design spec for running Paperclip in the cluster 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 12:44:47 +02:00