viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/stacks
History
Viktor Barzin 73cb0aab8b t3code: per-user isolation via Authentik + nginx username dispatcher 
t3 is single-owner (no in-app multi-user), so each person runs their own
`t3 serve` on the DevVM as their own OS user: wizard→:3773 (t3-serve.service),
emo→:3774 (t3-serve-emo.service). An in-cluster nginx `t3-dispatch` maps the
Authentik-injected X-authentik-username to the right instance; unmapped
identities get 403 (no shared fallback). Flipped the ingress auth app→required
(Authentik forward-auth) — the same-origin self-served UI works behind it (WS
carries the Authentik cookie) and t3's own pairing/bearer stays the inner gate.
Mirrors the terminal stack's per-user model.

Verified: dispatcher routes vbarzin→:3773, emil.barzin→:3774, unmapped→403;
t3.viktorbarzin.me now 302s to Authentik. Cross-origin native app / app.t3.codes
intentionally unsupported here — deferred until the native app is published.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-01 21:38:06 +00:00
..
_template ingress_factory: replace protected bool with auth enum + audit pass across 100 stacks 2026-05-10 18:53:49 +00:00
actualbudget kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
affine keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
authentik keel+anubis: extend sweep to non-V2 raw deployments; fix anubis replicas validation 2026-05-29 06:02:24 +00:00
beads-server keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
blog kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
broker-sync broker-sync: unsuspend broker-sync-imap (IE structurally skipped at code level now) 2026-05-27 17:57:26 +00:00
calico security(wave1): W1.6 expand observation from recruiter-responder pilot → tier 3+4 (82 namespaces) 2026-05-19 22:14:16 +00:00
changedetection kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
chrome-service keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
city-guesser keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
claude-agent-service claude-agent-service: cut memory request 2Gi → 1Gi (limit 4Gi → 2Gi) 2026-05-23 10:03:42 +00:00
claude-memory keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
cloudflared cloudflared: fix tunnel origin .200 -> Traefik svc DNS (full-site 502 outage) [ci skip] 2026-06-01 21:22:05 +00:00
cnpg cnpg: bump webhook-cert renewal threshold 7d -> 30d 2026-05-22 15:00:41 +00:00
coturn keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
crowdsec crowdsec: pin image to v1.7.8 + remove ENROLL_KEY, CAPI restored 2026-05-24 11:11:29 +00:00
cyberchef keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
dashy keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
dawarich keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
dbaas tripit: deploy stack + DB provisioning + ongoing mail-ingest [ci skip] 2026-05-30 10:23:11 +00:00
descheduler keel: enroll 15 critical-path namespaces for digest-only auto-update 2026-05-17 12:13:22 +00:00
diun keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
ebook2audiobook keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
ebooks keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
echo keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
excalidraw kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
external-secrets recruiter-responder: bump image_tag to 189ef901 2026-05-16 12:41:05 +00:00
f1-stream keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
fire-planner fire-planner: LLM_MODEL env var → qwen3vl-4b default (fits in current GPU headroom; immich-ml is holding ~10GB) 2026-06-01 19:50:41 +00:00
forgejo keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
freedify state(dbaas): update encrypted state 2026-05-26 08:59:40 +00:00
freshrss keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
frigate keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
grampsweb keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
hackmd keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
headscale keel: enroll 15 critical-path namespaces for digest-only auto-update 2026-05-17 12:13:22 +00:00
health keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
hermes-agent hermes-agent: gate PVC on parked flag (clears PVCStuckPending) 2026-05-31 15:19:28 +00:00
homepage keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
immich kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
infra cloud-init: hands-off k8s worker provisioning + 5 bug fixes 2026-05-26 11:52:00 +00:00
infra-maintenance [infra] Sweep dns_config ignore_changes across all pod-owning resources [ci skip] 2026-04-18 21:19:48 +00:00
insta2spotify keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
instagram-poster keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
isponsorblocktv keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
job-hunter keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
jsoncrack keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
k8s-dashboard final wave: enroll immich + status-page, retrigger 17 pending Bucket A 2026-05-16 23:19:20 +00:00
k8s-portal Bucket A retrigger + Bucket D enrollment (5 module-nested stacks) 2026-05-16 23:10:38 +00:00
k8s-version-upgrade k8s-version-upgrade: ignore IngressTTFBCritical in halt-on-alert check 2026-05-24 01:10:44 +00:00
keel keel: re-enable with policy=patch (semver-bounded) + fix CI deny-privileged 2026-05-26 19:06:51 +00:00
kms kms: add /diag anonymous telemetry collector behind Anubis carve-out 2026-06-01 19:50:41 +00:00
kured kured: fix sentinel-gate OOM — 256Mi limit + self-restart leak guard 2026-05-31 14:49:04 +00:00
kyverno kyverno: strip orphaned keel.sh/match-tag fleet-wide (image-swap fix) 2026-06-01 19:50:41 +00:00
linkwarden keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
llama-cpp kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
local-path keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
mailserver keel+anubis: extend sweep to non-V2 raw deployments; fix anubis replicas validation 2026-05-29 06:02:24 +00:00
matrix keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
meshcentral keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
metallb keel: enroll 11 more namespaces (operators + critical infra) 2026-05-17 20:59:14 +00:00
metrics-server keel: enroll 15 critical-path namespaces for digest-only auto-update 2026-05-17 12:13:22 +00:00
monitoring wealth: add 30y net-worth projection row + align net-pay panel 2026-06-01 19:50:41 +00:00
n8n keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
navidrome keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
netbox keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
networking-toolbox keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
nextcloud nextcloud: re-enable Keel auto-upgrades with occ-upgrade self-heal + live-tag floor 2026-06-01 19:50:41 +00:00
nfs-csi keel: enroll 11 more namespaces (operators + critical infra) 2026-05-17 20:59:14 +00:00
nodelocal-dns [dns] NodeLocal DNSCache — deploy DaemonSet to all nodes (WS C) 2026-04-19 15:46:41 +00:00
novelapp Woodpecker CI deploy [CI SKIP] 2026-05-16 23:17:44 +00:00
ntfy keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
nvidia keel: belt-and-suspenders opt-out for mysql/redis/nvidia-exporter 2026-05-26 21:53:10 +00:00
onlyoffice keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
openclaw keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
osm_routing keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
owntracks keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
paperless-mcp keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
paperless-ngx kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
payslip-ingest keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
phpipam keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
platform kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
plotting-book Woodpecker CI deploy [CI SKIP] 2026-05-16 23:17:44 +00:00
poison-fountain keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
postiz postiz: adopt drifted resources into TF state; exclude stuck Helm release 2026-05-30 14:36:07 +00:00
priority-pass keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
privatebin keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
proxmox-csi cloud-init: hands-off k8s worker provisioning + 5 bug fixes 2026-05-26 11:52:00 +00:00
pvc-autoresizer [infra] Suppress Goldilocks vpa-update-mode label drift on all namespaces [ci skip] 2026-04-18 21:15:27 +00:00
rbac [infra] Migrate Terraform state from local SOPS to PostgreSQL backend 2026-04-16 19:33:12 +00:00
real-estate-crawler keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
recruiter-responder keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
redis redis: revert 3-node Sentinel HA to single standalone instance [ci skip] 2026-05-30 17:49:43 +00:00
reloader keel: enroll 15 critical-path namespaces for digest-only auto-update 2026-05-17 12:13:22 +00:00
resume keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
reverse-proxy keel: enroll 15 critical-path namespaces for digest-only auto-update 2026-05-17 12:13:22 +00:00
rybbit keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
sealed-secrets keel: enroll 11 more namespaces (operators + critical infra) 2026-05-17 20:59:14 +00:00
send keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
servarr keel+anubis: extend sweep to non-V2 raw deployments; fix anubis replicas validation 2026-05-29 06:02:24 +00:00
shadowsocks keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
speedtest kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
status-page status-page: disable pusher CronJob to stop sdc write storm 2026-05-26 21:40:14 +00:00
stirling-pdf keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
t3code t3code: per-user isolation via Authentik + nginx username dispatcher 2026-06-01 21:38:06 +00:00
tandoor keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
technitium technitium: complete Traefik .200->.203 migration for the .lan zone [ci skip] 2026-05-30 16:54:09 +00:00
terminal terminal: probe + alerts after Traefik replica routing-table skew 2026-05-17 10:04:26 +00:00
tor-proxy keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
trading-bot kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
traefik traefik: bot-block-proxy buffer 256k + document the real HTTP/2 limit 2026-06-01 15:15:27 +00:00
travel-agent travel-agent: switch from Slack webhook to bot token (chat.postMessage) 2026-05-30 22:44:11 +00:00
travel_blog keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
tripit tripit: deploy stack + DB provisioning + ongoing mail-ingest [ci skip] 2026-05-30 10:23:11 +00:00
tuya-bridge Woodpecker CI deploy [CI SKIP] 2026-05-29 05:48:10 +00:00
uptime-kuma uptime-kuma: declare Proxmox UI monitor in TF 2026-05-29 05:40:18 +00:00
url kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
vault kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
vaultwarden keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
vpa keel: enroll 11 more namespaces (operators + critical infra) 2026-05-17 20:59:14 +00:00
wealthfolio kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
webhook_handler keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
whisper keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
wireguard keel: enroll 15 critical-path namespaces for digest-only auto-update 2026-05-17 12:13:22 +00:00
woodpecker ci: retrigger v3 — apply remaining 22 Keel-enrolled stacks 2026-05-16 14:06:39 +00:00
xray xray: drop dead vless ingress + pin Service target_port 2026-05-24 01:13:54 +00:00
ytdlp keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00