Robot
5ce4f0d1e7
deploy(gx10): add DeviceManagement enrollment CA runtime
2026-06-19 06:45:09 -05:00
Robot
adafbb41f7
secure gx10 device management writes
2026-06-18 18:15:14 -05:00
Andrew Stoltz
ae6dfe9144
deploy: bump GX10 PHP and MySQL bypass proof images
2026-06-18 17:22:49 -05:00
Andrew Stoltz
a7ba47e307
platform: dedicate GX10 Gitea SSH VIP
2026-06-18 16:40:50 -05:00
Andrew Stoltz
2e8cabcd63
platform: keep GX10 shared VIP traffic policy aligned
2026-06-18 16:30:24 -05:00
Andrew Stoltz
3948350ac2
platform: align GX10 Traefik source policy with live chart
2026-06-18 16:26:47 -05:00
Andrew Stoltz
ac153248c2
platform: preserve GX10 Traefik client source IP
2026-06-18 16:25:46 -05:00
Andrew Stoltz
9cef99739a
security: add tenant allowlist and WAF canary proof
2026-06-18 16:21:08 -05:00
Andrew Stoltz
6e0d33b5b9
deploy(tenant): add bluejay.dev edge controls
2026-06-18 12:56:41 -05:00
Robot
f78e6747b4
deploy(apple-mdm): route scep to noc1 ca
...
Adds the GX10 /scep route to the noc1 Apple MDM SCEP CA without exposing NanoHUB APIs.
2026-06-18 11:23:00 -05:00
Andrew Stoltz
e543018bdc
deploy(updater): recover GX10 image after packaging failure
2026-06-18 11:20:11 -05:00
Andrew Stoltz
d0c9717d90
deploy(updater): roll GX10 containment image
2026-06-18 11:08:12 -05:00
Andrew Stoltz
2c1aa3f0c8
deploy(updater): contain public UpdateCenter on GX10
2026-06-18 10:55:50 -05:00
Andrew Stoltz
b7d34da3d6
deploy(updater): gate public UpdateCenter host
2026-06-17 23:47:18 -05:00
Robot
83db2bbe6b
deploy(gx10): add NanoHUB Apple MDM workload
2026-06-17 22:45:10 -05:00
Andrew Stoltz
ee14d3a2d0
whc4: front bluejay tenant route with CRS WAF
2026-06-17 19:54:26 -05:00
Andrew Stoltz
193b167d10
whc4: quiet PHP WAF health probes
2026-06-17 19:27:02 -05:00
Andrew Stoltz
ef782ed56d
whc4: front PHP route with CRS WAF
2026-06-17 19:24:36 -05:00
Andrew Stoltz
41fb117ff0
whc4: deploy PHP tenant edge controls
2026-06-17 18:51:38 -05:00
Andrew Stoltz
a0d79eeb8c
hm4: own hosting operator CRDs and RBAC
2026-06-17 13:47:40 -05:00
Andrew Stoltz
44608acae2
hm1: add GX10 MCP gateway wiring
2026-06-17 13:15:36 -05:00
Andrew Stoltz
204001a89d
deploy(dns): pin current DNS image
2026-06-16 11:45:13 -05:00
Andrew Stoltz
3a7978ab1f
deploy(dns): pin DN-3b drift image
2026-06-15 20:56:30 -05:00
Andrew Stoltz
c0bfcb46fa
deploy(dns): pin DN-3 PowerDNS image
2026-06-15 20:33:18 -05:00
Andrew Stoltz
ebbf501038
deploy(dns): pin DN-2 MCP bridge image
2026-06-15 20:15:42 -05:00
Andrew Stoltz
d4f24f6f43
deploy(dns): wire MCP transport key
2026-06-15 19:58:52 -05:00
Andrew Stoltz
9f4805f1d6
deploy(dns): pin DN-2 entity CRUD image
2026-06-15 19:52:42 -05:00
Andrew Stoltz
6febe1fdb3
deploy(dns): enable production auth profile
2026-06-15 15:08:03 -05:00
Andrew Stoltz
6b2e6a61d0
deploy(dns): roll hosting quota image
2026-06-13 02:06:40 -05:00
Andrew Stoltz
8e2c960be3
deploy(dns): align l4 image and auth gate
2026-06-12 12:10:23 -05:00
Andrew Stoltz
a4c9e44a36
fix(runners): disable self-update in k8s pods
2026-06-11 14:57:00 -05:00
Andrew Stoltz
3798b7c00e
deploy(devicemgmt): enable web runtime
2026-06-11 14:21:51 -05:00
Andrew Stoltz
f0cb7a5e81
fix(hardening): align probe-path annotations with live health routes
2026-06-04 22:01:04 -05:00
Andrew Stoltz
c4b08f41ab
feat(infra): prestage broader app exposure hardening
2026-06-04 18:14:22 -05:00
Andrew Stoltz
417d3830ae
test(lint): reconcile baseline infra assertions
2026-06-04 18:02:32 -05:00
Andrew Stoltz
81a3ddac4c
fix(auth): mark OIDC healthz probes anonymous
2026-06-04 11:03:20 -05:00
300f8ad546
fix(monitoring): probe OIDC-safe health routes
...
Sprint 58 Cx-12. Rebased over OIDC GitOps main; YAML parse and focused bluejay-infra lint tests passed.
2026-06-04 06:45:34 +00:00
Andrew Stoltz
3b40dfb185
fix(auth): deploy distribution root anonymous image
2026-06-04 01:19:16 -05:00
Andrew Stoltz
36039c1335
fix(auth): deploy distribution oidc image tag
2026-06-04 01:04:44 -05:00
Andrew Stoltz
933fea89d1
feat(auth): adopt oidc apps in gitops
2026-06-04 00:49:36 -05:00
Andrew Stoltz
5bdedfc5ae
divoom: add pi deploy artifact manifests
...
Add source-controlled Puppet/Hiera contracts for edge2 Divoom-as-DM-device without replacing the live flowercore-divoom systemd deployment.
Add Divoom TV Pi HDMI systemd/Puppet deployment artifacts, LF shell-script guardrails, and focused lint coverage for the additive non-K8s deploy shape.
Co-Authored-By: Codex <codex@openai.com >
2026-06-02 21:45:27 -05:00
bc8c35896f
tests: add bluejay-ws runner-exclusion lint + fix 3 stale runner-fleet assertions ( #30 )
...
BLUEJAY-WS must never be a fleet GHA runner (operator directive 2026-05-26). Build-side analog of Sprint 9 safe-account exclusion. Also fixes 3 stale runner-fleet assertions broken by initContainer addition + replica tuning.
2026-05-26 03:42:01 +00:00
0d2090fe81
runners: add github-runner-updater Deployment ( #29 )
...
Close runner-fleet gap for FlowerCore.Updater. Matches Sprint 32 long-tail pattern; registers entry in fleet-lint required-set.
2026-05-26 03:24:13 +00:00
89b147bbdd
docs(openvox): document quadlet durability smoke ( #12 )
2026-05-18 04:53:02 +00:00
d7238a5e3b
feat(brochure): add public brochure GitOps app ( #13 )
2026-05-18 04:52:37 +00:00
fef68a9560
feat(fc-devicemgmt): add Kubernetes deployment manifests ( #1 )
...
Sprint 8 IMPL lane Cx-5: fc-devicemgmt K8s manifests (rebased onto main 2026-05-18; 13 files, +944).
Namespace + Web Deployment (replicas:2, MySQL backend) + Operator Deployment (replicas:1, KubeOps leader-elect) + Service + Certificate (step-ca-acme ClusterIssuer) + Traefik IngressRoute (devices.iamworkin.lan internal) + ServiceAccount + ClusterRole + ClusterRoleBinding + NetworkPolicy (CNI DNAT-aware backend ports) + OnePasswordItem (5-field consolidated) + ArgoCD Application bootstrap shape + lint coverage.
Follow-ups (not merge blockers):
- localhost/fc-devicemgmt-{web,operator}:v20260512-cx5 must be imported to all 3 RKE2 nodes; pods will ErrImageNeverPull until imported.
- 1Password vault item 'FlowerCore DeviceManagement Runtime' must be created with 5 fields before pods can start.
- DNS devices.iamworkin.lan -> 10.0.56.200 already present.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-18 02:56:23 +00:00
634b9c4169
feat(github-runner): harden Linux runner fleet ( #5 )
2026-05-18 02:51:02 +00:00
b8c7e59005
Tighten Pi signage HDMI settle coverage ( #3 )
2026-05-18 02:35:17 +00:00
8d87d9172c
Add Pi signage Phase 1 player artifacts
...
Squash merge Sprint 14 Pi signage player artifacts.
2026-05-14 01:46:09 +00:00
Codex
5484ed7db6
Adopt fc-updater into ArgoCD
2026-05-06 17:33:32 -05:00
