hermes-bot
13a7ad1c06
Stage 1 of 3 for moving the wiki off proxy-header identity (konairius/Wiki feat/oidc-login). The wiki took the username from X-Authentik-Username for any peer in the pod CIDR, so any pod that may reach :8080 (Hermes, Gitea, Traefik, all of ai and monitoring) could claim a human's name. Authentik's proxy provider sends no signed identity header, so the wiki now signs humans in itself with OpenID Connect and takes the username from the verified ID token. - Blueprint: OAuth2 provider "Wiki" (public client `wiki`, PKCE, authorization_code, RS256 self-signed key, openid+profile) and application `wiki` (issuer https://auth.renner.uno/application/o/wiki/), redirect URI https://wiki.renner.uno/signin-oidc. No policy binding, the same audience as today's gate, which has no group annotation. - Deployment: Auth__Oidc__Authority and Auth__Oidc__ClientId. The running image ignores them; the OIDC image refuses to start without them, which is why this lands first. Order: this PR, then konairius/Wiki feat/oidc-login (Flux image automation rolls it; it works behind the existing gate, since the gate session makes the OIDC round trip silent), then the stacked PR that moves wiki.renner.uno off the authentik-gate class.
homelab
GitOps source for the Renner homelab cluster. Flux applies main to
production, so every merge is a production change. Changes go in by pull
request only; see CONTRIBUTING.md for YAML conventions.
Change rules that protect Home Assistant
Owner decision (REN-240, REN-243). Home Assistant runs the house, so it gets two rules on top of normal review.
1. Disruptive work runs only 02:00–05:00 Europe/Berlin
Planned work that can restart Home Assistant or disrupt the cluster is merged and applied only between 02:00 and 05:00 Europe/Berlin. That covers:
- node drain, node reboot, Talos upgrade
- CNI (Cilium, Multus) and cluster-wide network policy
- storage (Rook/Ceph, CSI, snapshot controller, CNPG operator)
- Flux core (
kubernetes/clusters/*/flux-system/, Flux controllers) - Authentik
- OpenBao, including secret rotation that restarts consumers
- anything in
kubernetes/apps/home-assistant/
A PR in this list states in its description that it waits for the window. Flux applies on merge, so "wait for the window" means merge in the window, not just apply. If unsure whether a change is disruptive, treat it as disruptive.
Not covered: Home Assistant image bumps by Flux image automation. They stay fully automatic by owner decision. If one breaks Home Assistant, roll it back with RUNBOOK-home-assistant-image-rollback.md. An incident rollback is not planned work; the owner decides its timing.
2. HA-impact review before merge
Every PR that touches kubernetes/apps/home-assistant/, or makes a
cluster-wide disruptive change from the list above, needs an HA-impact
review before merge: a named reviewer states in the PR what Home
Assistant will notice (restart, lost integration, lost history, none) and
approves.
- Reviewer: Hestia, the Home Assistant maintainer.
- Until Hestia exists: the owner does the HA-impact review.
This is in addition to the normal review and merge by Argus. Argus does not merge such a PR without the HA-impact approval.