748 lines
32 KiB
Markdown
748 lines
32 KiB
Markdown
---
|
||
title: changelog
|
||
tags:
|
||
- meta
|
||
---
|
||
|
||
# Changelog
|
||
|
||
All notable changes to BlumeOps are documented in this file.
|
||
|
||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
|
||
|
||
<!-- towncrier release notes start -->
|
||
|
||
## [v1.11.5] - 2026-02-26
|
||
|
||
### Features
|
||
|
||
- Add authenticated GitHub mirror sync with PAT rotation tooling (`mirror-update-pats`, `mirror-create` auth support, how-to doc).
|
||
- Add Transmission Grafana dashboard with metrics exporter sidecar for monitoring upload/download speeds, transfer volumes, and per-torrent breakdowns.
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix Frigate dashboard "Detection Events Rate" panel showing no data — corrected metric name to `frigate_camera_events_total` and label to `camera`.
|
||
- Filter car and bird detections from Frigate driveway zone to stop repeated alerts on parked cars at night
|
||
|
||
### Infrastructure
|
||
|
||
- Port CloudNative-PG operator from Helm chart to direct upstream release manifest via forge mirror.
|
||
- Add multi-cluster Kubernetes observability: deploy kube-state-metrics and Alloy on ringtail (k3s), add `cluster` label to all metrics/logs, replace single-cluster dashboards with multi-cluster Kubernetes dashboard and dedicated Ringtail dashboard with GPU monitoring.
|
||
- Add explicit ExternalSecret defaults for SSA sync parity with ArgoCD v3.3
|
||
- Upgrade ArgoCD from v3.2.6 to v3.3.2 with Server-Side Apply enabled
|
||
|
||
### AI Assistance
|
||
|
||
- Bake default bat options into `ai-docs` mise task so agents no longer need verbose flags at session start.
|
||
- docs-review task now prints the file path instead of the file content, so the LLM reads it directly.
|
||
|
||
|
||
## [v1.11.4] - 2026-02-25
|
||
|
||
### Features
|
||
|
||
- Add `mirror-create` mise task for creating upstream mirrors in the `mirrors/` Forgejo org
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix Grafana OAuth role mapping: INI parser was stripping quotes from `role_attribute_path = 'Admin'`, causing all Authentik users to get Viewer role instead of Admin. Now uses group-based mapping from the `admins` Authentik group.
|
||
- Fix TeslaMate dashboards showing "No Data": Grafana 12.x's `grafana-postgresql-datasource` plugin requires the database name in `jsonData`, not just the top-level `database` field.
|
||
|
||
### Infrastructure
|
||
|
||
- Move image tags to kustomize `images:` transformer across 22 services and replace hand-written ConfigMaps with `configMapGenerator:` in 12 services, enabling content-hash-based automatic rollouts on config changes.
|
||
- Migrate upstream mirror repos from `eblume/` to `mirrors/` Forgejo organization
|
||
- Port Prometheus to local container build (3-stage: Node UI, Go binaries, Alpine runtime) for supply chain control via Zot registry.
|
||
- Fix ArgoCD app definitions and credential template to use `mirrors/` org after forge mirror migration; bump immich v2.5.2 → v2.5.6.
|
||
- Document AirPlay cross-VLAN firewall rules for Samsung Frame TV (established/related, AirPlay ports, dynamic reverse) and fix rule ordering in segment-home-network plan.
|
||
- Update image tags for all 6 mirror-migrated containers (homepage, navidrome, ntfy, miniflux, prometheus, teslamate)
|
||
- Switch prometheus, teslamate, and miniflux container builds to forge mirrors; create miniflux mirror
|
||
|
||
### Documentation
|
||
|
||
- Document squash-merge container tag provenance issue and post-merge workflow for updating manifests to main-SHA tags.
|
||
- Add mise-tasks reference card with categorized task inventory; include in ai-docs context
|
||
- Review 3 how-to docs: stamp provision-authentik-database and use-pypi-proxy, fix wrong policy path and misleading --yes in update-tailscale-acls
|
||
|
||
|
||
## [v1.11.3] - 2026-02-23
|
||
|
||
### Features
|
||
|
||
- Upgrade Grafana from 11.4.0 to 12.3.3 with home-built container image and Kustomize manifests, replacing the Helm chart deployment.
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix Dagger pipelines hanging when called from mise tasks in interactive terminals. Added `--progress=plain` to all `dagger call` invocations to prevent SIGTTOU from stopping the process when mise's child process group is not the terminal foreground group.
|
||
- Fix Grafana TeslaMate dashboards not appearing in a folder — enabled `foldersFromFilesStructure` so the sidecar's `grafana_folder` annotation is respected.
|
||
- Container build workflows now checkout the dispatch ref when building from feature branches, fixing "No Dockerfile — skipping" errors for containers not yet on main.
|
||
|
||
### Infrastructure
|
||
|
||
- Fix Frigate Prometheus scrape target to route via Caddy (nvr.ops.eblu.me) after migration to ringtail, and rebuild Grafana dashboard with updated Frigate 0.17 metrics (GPU usage, temperature, skipped FPS, detection events).
|
||
- Update tooling dependencies: pre-commit hooks (trufflehog, ruff, shellcheck, prettier, actionlint), Fly.io Dockerfile (pin nginx 1.28.2-alpine, alloy v1.13.1), and normalize mise task Python lower bounds.
|
||
- Rename `containers/forgejo-runner` to `containers/runner-job-image` to distinguish the CI job execution image from the Forgejo runner daemon, fixing a version-check false positive.
|
||
|
||
### Documentation
|
||
|
||
- Review deploy-authentik card: rewrite as reproducible process guide, remove stale version info and future work section, mark plan as completed.
|
||
- Formalize C0/C1/C2 change classification: C0 allows direct-to-main commits, C1 adds docs-first workflow with branch deployment, C2 introduces the Mikado Branch Invariant for strict commit ordering on multi-phase changes. Add C2 conventions: `C2(<chain>): plan/impl/close/finalize` commit messages, `mikado/<chain-stem>` branch naming, and `branch:` frontmatter on goal cards. New tooling: `docs-mikado --resume` for cold-start session pickup and `mikado-branch-invariant-check` pre-commit hook.
|
||
- Replace Grafana Helm upgrade plan with C2 Mikado chain for upgrading to 12.x with kustomize and home-built containers.
|
||
|
||
### AI Assistance
|
||
|
||
- Improved Mikado C2 process: end-of-cycle session prompts, rigorous reset discipline with documented git patterns, and `--resume` now shows PR number and stash hints.
|
||
|
||
|
||
## [v1.11.2] - 2026-02-22
|
||
|
||
### Features
|
||
|
||
- Add `branch-cleanup` mise task and scheduled Forgejo workflow to delete merged branches locally and on the Forgejo remote. Detects squash-merged PRs via the Forgejo API. The workflow runs approximately every 10 days with a configurable age cutoff (default 30 days).
|
||
- Add Forgejo repository health metrics collector and Grafana dashboard with CI/CD, release, and language tracking across all repos.
|
||
- Switch Frigate object detection from YOLO-NAS-S (320x320) to YOLOv9-c (640x640) with CUDA Graphs support, and add `frigate-export-model` Dagger pipeline + mise task for reproducible model exports.
|
||
|
||
### Infrastructure
|
||
|
||
- Simplify service-versions.yaml type taxonomy to `argocd | ansible | nixos`; add nix-container-builder entry; backfill forgejo and forgejo-runner versions
|
||
- Prepare forgejo-runner v12 upgrade: review config compatibility, add workflow schema validation via Dagger, wire pre-commit hook
|
||
- Upgrade k8s forgejo-runner daemon from v6.3.1 to v12.7.0
|
||
|
||
### Documentation
|
||
|
||
- Add Mikado chain for upgrading k8s forgejo-runner from v6.3.1 to v12.x
|
||
|
||
|
||
## [v1.11.1] - 2026-02-22
|
||
|
||
### Infrastructure
|
||
|
||
- Use Zot registry logo instead of Docker logo on homepage dashboard
|
||
|
||
|
||
## [v1.11.0] - 2026-02-22
|
||
|
||
### Features
|
||
|
||
- Add agent change process (C0/C1/C2) documentation and `docs-mikado` tool for Mikado method dependency chain resolution. Rename `zk-docs` task to `ai-docs`.
|
||
- Deploy Authentik identity provider on ringtail k3s cluster, replacing Dex as the SSO provider. Includes Nix-built container, CNPG database, Redis, and Caddy routing at `authentik.ops.eblu.me`.
|
||
- Integrate Forgejo with Authentik OIDC for single sign-on with group-based admin propagation. Enforce TOTP MFA on Authentik authentication flow.
|
||
- Add Authentik SSO to Jellyfin with admin group mapping
|
||
- Container builds now trigger automatically on merge to main (path-based) and use commit-SHA-based image tags (`vX.Y.Z-<sha>`) for full traceability. The `container-tag-and-release` task is replaced by `container-build-and-release` which dispatches workflows via the Forgejo API. Added pre-commit hook to keep container versions in sync with `service-versions.yaml`.
|
||
- Register Zot as an OIDC client in Authentik via blueprint, with artifact-workloads group, zot-ci service account, and OIDC credentials template for Ansible deployment.
|
||
- Enable OIDC + API key authentication on zot registry with three-tier access control (anonymous read, CI create, admin full). Wire both CI push paths (Dagger and Nix/skopeo) with registry credentials via Forgejo Actions secrets. Allow anonymous Prometheus metrics scraping via `accessControl.metrics.users`.
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix frigate-notify notification pipeline: switch to webapi polling, enable dedup, drop events without snapshots, use hi-res snapshots
|
||
|
||
### Infrastructure
|
||
|
||
- Add Mikado prereq for commit-based container tagging scheme to harden-zot-registry chain
|
||
- Convert deploy-authentik plan to C2 Mikado chain entry point.
|
||
- Add `flake-update` Dagger pipeline for updating ringtail NixOS flake inputs.
|
||
- Upgrade frigate-notify from v0.3.5 to v0.5.4
|
||
|
||
### Documentation
|
||
|
||
- Add deployment plan for Authentik identity provider to replace Dex
|
||
|
||
|
||
## [v1.10.0] - 2026-02-19
|
||
|
||
### Features
|
||
|
||
- Deploy Dex OIDC identity provider on ringtail with Grafana as first SSO client.
|
||
- Added Nix container build for nettest, validating the full nix-container-builder pipeline on ringtail. One git tag now triggers both Dockerfile and Nix workflows — each skips if its build file is absent. Rewrote container-tag-and-release as a typer CLI with --dry-run support. Added container policy.json and registries.conf to ringtail for skopeo.
|
||
- Add NixOS configuration for ringtail (gaming/compute workstation with RTX 4080). Includes declarative disk partitioning via disko, NVIDIA drivers, sway/Wayland desktop, Steam, Tailscale, and Ansible-driven provisioning.
|
||
- Add screen lock, idle timeout, and sleep prevention to ringtail: swaylock locks after 15min, display powers off after 60min, machine never suspends.
|
||
- Systemd Forgejo Actions runner on ringtail (`nix-container-builder` label) for building containers with `nix build` and pushing via `skopeo`. K3s cluster retained for future workloads. 1Password Connect + External Secrets Operator available for k8s secret management.
|
||
|
||
### Bug Fixes
|
||
|
||
- Cap detect FPS to 2 and sync motion masks/zones from live config
|
||
- Fix `zk-docs` task to use new path for troubleshooting doc after how-to reorg.
|
||
- Inhibit swayidle lock screen when a fullscreen window is active on ringtail, preventing screen lock during gamepad-only gaming sessions.
|
||
- Make 1Password secret tasks in ringtail playbook idempotent by checking kubectl apply output instead of always reporting changed.
|
||
|
||
### Infrastructure
|
||
|
||
- Port Frigate NVR to ringtail k3s with RTX 4080 GPU acceleration (TensorRT/ONNX), replacing the ZMQ-based Apple Silicon detector on indri.
|
||
- Replace Homepage Helm chart (jameswynn/homepage v2.1.0, pinned at app v1.2.0) with plain kustomize manifests and a custom Dockerfile built from upstream v1.10.1. Gives full version control and matches the pattern used by other blumeops services.
|
||
- Port ntfy to a locally built container image from forge mirror source.
|
||
- Port Mosquitto (MQTT) and ntfy to ringtail k3s; retire Apple Silicon Detector from indri.
|
||
- Ringtail post-install: NixOS config (sway with Catppuccin Macchiato theme, fish, 1Password, Steam, LibreWolf, Bluetooth audio, chezmoi, dev tools, nix-ld), Dagger flake-lock pipeline, improved provision-ringtail workflow, services-check integration, and reference documentation.
|
||
- Add ringtail DeviceTags to Pulumi and allow homelab-to-homelab Tailscale SSH for cross-host ansible/management.
|
||
- Update Frigate zone masks from live config and expand alert notifications to cover both Driveway and Driveway_entrance zones.
|
||
- Add Apple Silicon ZMQ detector for Frigate — inference moves from in-pod ONNX CPU to CoreML on indri via ZMQ, using YOLOv9-m model
|
||
- Deploy Tailscale operator on ringtail k3s cluster
|
||
- Upgrade ntfy from v2.11.0 to v2.17.0 and add ntfy and frigate reference docs.
|
||
- Update External Secrets Operator Helm chart from 1.3.1 to 2.0.0 (operator v1.3.2)
|
||
- Upgrade Frigate NVR from 0.16.4 to 0.17.0-rc2 (prerequisite for Apple Silicon ZMQ detector)
|
||
|
||
### Documentation
|
||
|
||
- Add Dex OIDC documentation: reference card, federated login explanation, services-check integration, and updated plan.
|
||
- Update services-check and documentation to reflect Frigate, Mosquitto, and ntfy migration from indri minikube to ringtail k3s (PRs #216, #217).
|
||
- Review and fix update-documentation how-to: add missing cache purge step, clean up fragment types table.
|
||
|
||
|
||
## [v1.9.4] - 2026-02-17
|
||
|
||
### Documentation
|
||
|
||
- Reorganize how-to guides into `deployment/`, `configuration/`, and `operations/` subdirectories; review and update gandi-operations doc; fix missing cv.eblu.me CNAME in gandi reference card.
|
||
|
||
|
||
## [v1.9.3] - 2026-02-16
|
||
|
||
### Features
|
||
|
||
- Add service version review system with `mise run service-review` task, tracking file, and how-to guide.
|
||
- Add UniFi admin link to homepage dashboard bookmarks.
|
||
|
||
### Infrastructure
|
||
|
||
- Eliminate double towncrier run in release workflow — changelog is now built once on the runner, then the pre-processed source tree is passed to a new `build_quartz` Dagger function for the Quartz site build only.
|
||
- First service version review: pin mosquitto to 2.0.22, bump tailscale-operator to v1.94.2, record 7 reviewed services
|
||
|
||
|
||
## [v1.9.2] - 2026-02-16
|
||
|
||
### Features
|
||
|
||
- Add how-to guide for building container images and port navidrome to a custom-built container image.
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix Frigate repeatedly alerting on parked cars by removing per-object max_frames and setting stationary interval to 0. Make Frigate config writable so UI changes (zones, masks) persist within a pod lifecycle.
|
||
- Switch navidrome to custom container image with dedicated non-root user and fsGroup security context
|
||
|
||
### Documentation
|
||
|
||
- Review expose-service-publicly doc: replace stale inline code with references to actual files, add observability sidecar section, fix broken internal link, update templates to current patterns.
|
||
|
||
|
||
## [v1.9.1] - 2026-02-15
|
||
|
||
### Documentation
|
||
|
||
- Review connect-to-postgres, create-release-artifact-workflow, and deploy-k8s-service docs. Fix stale repoURL, incorrect Caddy config keys, add Tailscale tag documentation, and migrate remaining `op item get` calls to `op read`.
|
||
|
||
|
||
## [v1.9.0] - 2026-02-14
|
||
|
||
### Features
|
||
|
||
- Deploy cloud-free NVR stack: Frigate 0.16.4 (ARM64) with ONNX/YOLO-NAS-s detection, Mosquitto MQTT broker, Ntfy self-hosted push notifications (with iOS APNs relay), and frigate-notify for detection alerting. GableCam (ReoLink Elite Floodlight) connected via RTSP with NFS recordings on sifaka, Grafana dashboard, Prometheus scraping, Homepage integration, and Caddy reverse proxies at nvr.ops.eblu.me and ntfy.ops.eblu.me.
|
||
|
||
### Infrastructure
|
||
|
||
- Configure DinD sidecar to use Zot as a pull-through registry mirror for Docker Hub images, reducing bandwidth and avoiding rate limits during Dagger CI builds.
|
||
- Abandon UniFi Pulumi IaC (provider bugs caused network outage); add manual three-network segmentation plan for UX7 web UI.
|
||
- Upgrade Node.js from 20 to 22 (LTS) in Dagger docs build and forgejo-runner container
|
||
- Tier 1 version bumps: upstream images (prometheus, loki, alloy, kube-state-metrics, tailscale, navidrome), helm charts (CloudNativePG, 1Password Connect), and custom containers (miniflux, kubectl, kiwix-serve, nettest, transmission) updated to latest stable versions with Alpine 3.22 base.
|
||
|
||
### Documentation
|
||
|
||
- Add how-to guide for connecting to PostgreSQL as a superuser via psql.
|
||
- Review add-ansible-role doc: fix secrets to use `op read`, match tag format to playbook, fix handler pattern, add last-reviewed date.
|
||
- Review and fix why-gitops doc: correct wiki-links, fix apt->brew, broaden Pulumi scope, add last-reviewed.
|
||
|
||
|
||
## [v1.8.2] - 2026-02-13
|
||
|
||
### Features
|
||
|
||
- Recategorize homepage groups: "Content" (Immich, Kiwix, Miniflux, DJ, Grafana) and "Misc" (CV, TeslaMate, Transmission, Docs, Prometheus, PyPI)
|
||
|
||
### Infrastructure
|
||
|
||
- Move non-secret forgejo-runner env vars from ExternalSecret to deployment spec so version bumps trigger automatic rollouts
|
||
- Add yq to forgejo-runner container and replace sed-based YAML editing in workflows with yq
|
||
|
||
|
||
## [v1.8.0] - 2026-02-12
|
||
|
||
### Features
|
||
|
||
- Update CV release to v1.0.2
|
||
- Update CV release to v1.0.3.
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix cache hit rate panels on APM and Fly.io dashboards showing blank/red or misleading 100% for low-traffic static sites.
|
||
|
||
### Documentation
|
||
|
||
- Add reference/tools/ category with Dagger, ArgoCD CLI, Ansible, and Pulumi reference cards
|
||
|
||
### Miscellaneous
|
||
|
||
- Add X-Clacks-Overhead header to public proxy for cv and docs: GNU Terry Pratchett.
|
||
|
||
|
||
## [v1.7.1] - 2026-02-12
|
||
|
||
### Features
|
||
|
||
- Expose CV service publicly at cv.eblu.me via Fly.io proxy.
|
||
- Update CV service to resume release v1.0.1.
|
||
|
||
### Infrastructure
|
||
|
||
- Add CV to services-check (tailnet and public endpoints).
|
||
|
||
### Miscellaneous
|
||
|
||
- Update CV homepage link to use public URL (cv.eblu.me).
|
||
- Remove `/_error` test endpoint from Fly.io nginx proxy.
|
||
|
||
|
||
## [v1.7.0] - 2026-02-12
|
||
|
||
### Features
|
||
|
||
- Add CV/resume web app at cv.ops.eblu.me — container, k8s manifests, Caddy route, and deploy workflow. Content built from separate cv repo.
|
||
|
||
### Infrastructure
|
||
|
||
- Extend forgejo_actions_secrets Ansible role to support multiple repos.
|
||
|
||
### Documentation
|
||
|
||
- Add CV service reference card and update apps registry, Caddy docs, and services index.
|
||
- Add how-to guide for creating release artifact workflows with Forgejo packages.
|
||
|
||
|
||
## [v1.6.9] - 2026-02-11
|
||
|
||
### Bug Fixes
|
||
|
||
- Set ``TZ=America/Los_Angeles`` in the Dagger ``build_changelog`` container so towncrier stamps the correct local date instead of UTC (which showed tomorrow's date for evening releases).
|
||
|
||
|
||
## [v1.6.8] - 2026-02-11
|
||
|
||
### Documentation
|
||
|
||
- Update "Deploy K8s Service" how-to with current ProxyGroup ingress pattern.
|
||
|
||
|
||
## [v1.6.7] - 2026-02-11
|
||
|
||
### Documentation
|
||
|
||
- Close Dagger CI plan (Phases 1–3 complete) and move to completed plans archive.
|
||
|
||
|
||
## [v1.6.6] - 2026-02-11
|
||
|
||
### Features
|
||
|
||
- Simplify Forgejo runner image (Dagger Phase 3): remove Node.js, Docker CLI, buildx, skopeo, gnupg, lsb-release, and xz-utils. Add tzdata and flyctl. All build tools now live inside Dagger containers.
|
||
|
||
### Bug Fixes
|
||
|
||
- Restore Docker CLI to Forgejo runner image — Dagger shells out to ``docker`` to provision its BuildKit engine.
|
||
- Restore Node.js to Forgejo runner image — required by ``actions/checkout@v4`` and other JavaScript Actions that were broken by the Phase 3 simplification.
|
||
|
||
|
||
## [v1.6.4] - 2026-02-12
|
||
|
||
### Bug Fixes
|
||
|
||
- Set Forgejo runner timezone to America/Los_Angeles. The runner previously used UTC, causing towncrier changelog entries to show tomorrow's date when releases were cut in the evening. Note: the v1.6.2 changelog entry shows 2026-02-12 due to this bug; dates may appear non-sequential as a result.
|
||
|
||
|
||
## [v1.6.2] - 2026-02-12
|
||
|
||
### Features
|
||
|
||
- Migrate docs build pipeline to Dagger (Phase 2): `dagger call build-docs --src=. --version=dev` now runs the full Quartz build locally, identically to CI. Adds `date-modified` frontmatter to all docs and a `docs-check-frontmatter` pre-commit hook.
|
||
- Adopt Dagger as CI build engine for container images (Phase 1). Replaces the Docker buildx + skopeo composite action with a Dagger Python module. BuildKit's push is compatible with Zot, eliminating the skopeo workaround.
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix blumeops-tasks: migrate from deprecated Todoist REST API v2 to API v1, handle cursor-based pagination, and use `op read` for 1Password credential retrieval.
|
||
|
||
|
||
## [v1.6.1] - 2026-02-11
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix Fly.io proxy cache purge command for BusyBox shell compatibility.
|
||
|
||
|
||
## [v1.6.0] - 2026-02-11
|
||
|
||
### Bug Fixes
|
||
|
||
- Purge Fly.io proxy cache after docs deploy so new releases are served immediately.
|
||
|
||
|
||
## [v1.5.4] - 2026-02-11
|
||
|
||
### Bug Fixes
|
||
|
||
- Bump Fly.io proxy VM memory from 256MB to 512MB to prevent Alloy OOM kills.
|
||
|
||
### Documentation
|
||
|
||
- Add plan documents for Dagger CI/CD adoption and upstream fork strategy.
|
||
- Add plan documents for OIDC provider adoption, zot registry hardening, and expanded network segmentation details.
|
||
- Review security-model.md: fix op CLI pattern, add Tailscale Operator section.
|
||
|
||
|
||
## [v1.5.3] - 2026-02-11
|
||
|
||
### Features
|
||
|
||
- Add BorgBase offsite backup repository for 3-2-1 backup strategy
|
||
- Fly.io proxy serves a friendly error page when upstreams are unreachable (indri offline, Tailscale tunnel down, etc.). Test at `docs.eblu.me/_error`.
|
||
- Add `op-backup` mise task for encrypted 1Password disaster recovery backups via borgmatic
|
||
- Add SMART disk health monitoring for sifaka NAS with smartctl_exporter, Grafana dashboard, Ansible playbook, and Caddy L4 routing via ops.eblu.me.
|
||
|
||
### Bug Fixes
|
||
|
||
- Replace `op item get --fields` with `op read` in all mise tasks (tailnet-up, tailnet-preview, dns-up, dns-preview) to prevent multi-line secret corruption.
|
||
- Fix 502 errors during Fly.io proxy deploys by deferring health check until Tailscale is connected.
|
||
- Fix minikube ansible role not restarting cluster after power loss — status check only examined host VM state, missing stopped kubelet/apiserver.
|
||
- Log real client IPs in Fly.io proxy access logs using Fly-Client-IP header instead of showing the internal proxy address.
|
||
|
||
### Infrastructure
|
||
|
||
- Switch CI container builds from deprecated `docker build` to `docker buildx build` (BuildKit).
|
||
- Install `docker-buildx-plugin` in forgejo-runner image to support `docker buildx build`.
|
||
- Eliminate 502 errors during Fly.io proxy deploys by starting nginx after Tailscale, switching to bluegreen deploys, and using service-level health checks for traffic gating.
|
||
|
||
### Documentation
|
||
|
||
- Add troubleshooting guide for CNI conflict after unclean shutdown to restart-indri how-to.
|
||
- Add migration plan for Forgejo brew-to-source transition
|
||
- Document `op read` vs `op item get` convention for 1Password secret retrieval
|
||
- Add power infrastructure reference card documenting the battery-backed UPS chain (Anker SOLIX F2000 → CyberPower UPS → homelab).
|
||
- Add plan and reference card for UniFi Express 7 Pulumi IaC management.
|
||
- Add how-to guide for restoring 1Password backup from borgmatic, with cross-links from disaster recovery, borgmatic, 1password, and backup policy docs
|
||
|
||
|
||
## [v1.5.2] - 2026-02-09
|
||
|
||
### Features
|
||
|
||
- Filter blumeops-tasks to only show dated/recurring tasks when due today or earlier.
|
||
- Add `docs-review` mise task that sorts docs by `last-reviewed` frontmatter date, prioritizing never-reviewed cards. Updated the review-documentation how-to to match.
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix fly-deploy WARNING by starting nginx before Tailscale, deferring upstream DNS resolution to request time.
|
||
|
||
### Infrastructure
|
||
|
||
- Migrate all Ansible `op item get` calls to `op read` URI syntax for cleaner output and remove the `regex_replace` workaround on the Fly deploy token.
|
||
- Restrict fly.io proxy ACLs to dedicated `tag:flyio-target` endpoints instead of broad `tag:k8s` and `tag:homelab` grants. Migrate all Tailscale Ingresses to a shared ProxyGroup with per-Ingress tag overrides (`tag:flyio-target` on docs, loki, prometheus). Add `autoApprovers` for VIP service routes. Enable `--accept-routes` on indri for ProxyGroup VIP routing.
|
||
|
||
|
||
## [v1.5.1] - 2026-02-08
|
||
|
||
### Features
|
||
|
||
- Add observability to Fly.io proxy: Alloy collects nginx access logs (→ Loki) and derived metrics (→ Prometheus), with Grafana dashboards for Docs APM and Fly.io proxy health.
|
||
|
||
### Infrastructure
|
||
|
||
- Add docs.eblu.me and Fly.io health check to services-check
|
||
|
||
|
||
## [v1.5.0] - 2026-02-08
|
||
|
||
### Features
|
||
|
||
- Add Fly.io public reverse proxy infrastructure for exposing services to the internet (first target: docs.eblu.me)
|
||
|
||
### Documentation
|
||
|
||
- Add how-to guide for exposing services publicly via Fly.io reverse proxy + Tailscale tunnel.
|
||
- Update docs for public proxy: canonical URL is now docs.eblu.me, add Fly.io proxy reference card and operations how-to
|
||
|
||
|
||
## [v1.4.2] - 2026-02-08
|
||
|
||
### Documentation
|
||
|
||
- Update all docs frontmatter titles from slug-case to human-readable and delete title-test cards.
|
||
|
||
|
||
## [v1.4.1] - 2026-02-08
|
||
|
||
### Documentation
|
||
|
||
- Remove docs-check-titles pre-commit hook, add repo links to homepage, and test duplicate frontmatter titles.
|
||
|
||
|
||
## [v1.4.0] - 2026-02-08
|
||
|
||
### Features
|
||
|
||
- Add documentation consistency checks: orphan detection in doc-links, new doc-index (category index coverage), doc-stale (staleness report), and doc-tags (tag inventory).
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix broken icons for Pulumi and ArgoCD in homepage Admin bookmarks section.
|
||
|
||
### Infrastructure
|
||
|
||
- Add pre-commit to mise.toml project tools.
|
||
|
||
### Documentation
|
||
|
||
- Review exploring-the-docs tutorial: simplify wiki-links, fix broken replication/ reference, add Related section, match zk-docs flags to CLAUDE.md. Update use-pypi-proxy to document env-var-based proxy toggle.
|
||
- Add Gandi DNS reference card and operations how-to, rewrite homepage intro for wider audience.
|
||
- Add missing `ai` changelog fragment type to update-documentation guide, consolidate `cicd`→`ci-cd` and `network`→`networking` tags
|
||
- Updated restart-indri how-to to reflect actual recovery procedure after power outage. Added UPS to indri specs.
|
||
- Fixed zk-docs links after file renames due to relative path issues
|
||
|
||
### Miscellaneous
|
||
|
||
- Rename `doc-*` mise tasks to `docs-check-*` / `docs-review-*` for clearer naming convention.
|
||
|
||
|
||
## [v1.3.4] - 2026-02-05
|
||
|
||
### Documentation
|
||
|
||
- Enforce unique filenames, simple wiki-links (no paths), and no spaces in wiki-link targets for obsidian.nvim compatibility
|
||
|
||
|
||
## [v1.3.3] - 2026-02-04
|
||
|
||
### Infrastructure
|
||
|
||
- Add IaC for Forgejo Actions secrets via new `forgejo_actions_secrets` Ansible role, syncing repository secrets from 1Password to Forgejo API
|
||
|
||
### Documentation
|
||
|
||
- Add how-to guide for safely restarting indri, plus AutoMounter reference card.
|
||
|
||
|
||
## [v1.3.2] - 2026-02-04
|
||
|
||
### Infrastructure
|
||
|
||
- Fix Quartz build to use -d docs flag for accurate git-based file dates
|
||
|
||
|
||
## [v1.3.1] - 2026-02-04
|
||
|
||
### Infrastructure
|
||
|
||
- Fix Quartz build to preserve git history for accurate file dates
|
||
|
||
### Documentation
|
||
|
||
- Fix misc changelog fragment type to show content (was showing empty entries)
|
||
|
||
|
||
## [v1.3.0] - 2026-02-04
|
||
|
||
### Features
|
||
|
||
- Build workflow now supports version bump selection (major/minor/patch) and includes changelog in release body
|
||
- Add 'ai' changelog fragment type for AI assistance changes
|
||
|
||
### Bug Fixes
|
||
|
||
- Fix Navidrome automatic library scan by correcting env var name from `ND_SCANSCHEDULE` to `ND_SCANNER_SCHEDULE`
|
||
|
||
### Infrastructure
|
||
|
||
- Move CHANGELOG.md to repository root (still included in docs build)
|
||
- Remove iCloud Photos from borgmatic backup (photos now managed via Immich)
|
||
|
||
### Documentation
|
||
|
||
- Document Forgejo Actions secrets in forgejo reference card
|
||
- Add troubleshooting how-to to zk-docs output
|
||
|
||
### AI Assistance
|
||
|
||
- Add wiki-link formatting convention to AI assistance guide
|
||
|
||
### Miscellaneous
|
||
|
||
- ,
|
||
|
||
|
||
## [v1.2.1] - 2026-02-04
|
||
|
||
### Features
|
||
|
||
- Add doc-random mise task for random documentation review
|
||
|
||
### Documentation
|
||
|
||
- Add Caddy reference card and fix replication tutorial sequence
|
||
|
||
|
||
## [v1.2.0] - 2026-02-04
|
||
|
||
### Documentation
|
||
|
||
- Complete Phase 6: migrate zk content, delete legacy cards, rewrite zk-docs for AI context priming
|
||
|
||
|
||
## [v1.1.5] - 2026-02-04
|
||
|
||
### Documentation
|
||
|
||
- Add Phase 5 explanation docs: why GitOps, architecture overview, and security model
|
||
|
||
|
||
## [v1.1.4] - 2026-02-04
|
||
|
||
### Documentation
|
||
|
||
- Add Phase 4 how-to guides: deploy k8s services, add ansible roles, update tailscale ACLs, and troubleshooting
|
||
|
||
|
||
## [v1.1.3] - 2026-02-04
|
||
|
||
### Features
|
||
|
||
- Build workflow now automatically deploys docs after creating a release - updates the deployment manifest with the new release URL and syncs via ArgoCD, triggering a pod rollout
|
||
|
||
### Miscellaneous
|
||
|
||
- Remove confirmation prompt from container-tag-and-release task for non-interactive use
|
||
|
||
|
||
## [v1.1.2] - 2026-02-04
|
||
|
||
No significant changes.
|
||
|
||
|
||
## [v1.1.1] - 2026-02-04
|
||
|
||
### Documentation
|
||
|
||
- Add Phase 3 tutorials: "What is BlumeOps?", "Exploring the Docs", "AI Assistance Guide", "Contributing", and "Replicating BlumeOps" with sub-tutorials for Tailscale, Kubernetes, ArgoCD, and Observability. Each tutorial explicitly identifies its target audiences.
|
||
|
||
|
||
## [v1.1.0] - 2026-02-04
|
||
|
||
No significant changes.
|
||
|
||
|
||
## [v1.0.14] - 2026-02-04
|
||
|
||
No significant changes.
|
||
|
||
|
||
## [v1.0.13] - 2026-02-04
|
||
|
||
No significant changes.
|
||
|
||
|
||
## [v1.0.12] - 2026-02-04
|
||
|
||
No significant changes.
|
||
|
||
|
||
## [v1.0.8] - 2026-02-04
|
||
|
||
### Documentation
|
||
|
||
- Convert wiki-link titles to lowercase slugs for reliable Quartz resolution
|
||
|
||
|
||
## [v1.0.7] - 2026-02-03
|
||
|
||
### Documentation
|
||
|
||
- Switch to title-based wiki-links with validation (Quartz resolves via frontmatter title)
|
||
|
||
|
||
## [v1.0.6] - 2026-02-03
|
||
|
||
### Documentation
|
||
|
||
- Fix wiki-links to use filename-based resolution with Quartz shortest path mode
|
||
|
||
|
||
## [v1.0.5] - 2026-02-03
|
||
|
||
### Documentation
|
||
|
||
- Convert wiki-links to title-based format and add duplicate title detection
|
||
|
||
|
||
## [v1.0.2] - 2026-02-03
|
||
|
||
### Features
|
||
|
||
- Add Reference section with 24 technical reference cards covering services, infrastructure, kubernetes, and storage
|
||
|
||
### Documentation
|
||
|
||
- Reorder documentation phases: Reference (Phase 2) now comes before Tutorials (Phase 3) so other docs can link to reference material
|
||
|
||
|
||
## [v1.0.1] - 2026-02-03
|
||
|
||
### Infrastructure
|
||
|
||
- Add towncrier for automated changelog generation from news fragments
|
||
|
||
|
||
## [0.1.0] - 2026-02-03
|
||
|
||
This is a historical release which doesn't actually exist and which aggregates
|
||
the changelogs prior to this date. The work on this blumeops project more or
|
||
less began around Jan 16 2026. To an extent you can find corroborating details
|
||
in the git commit log, but at the beginning (during this initial phase) there
|
||
was a fairly large amount of non-source-controlled work. If a more accurate
|
||
record is needed for this work, you may find it in borgmatic zk backups from
|
||
this time period.
|
||
|
||
### Features
|
||
|
||
- Add Grafana Alloy for metrics remote_write to Prometheus
|
||
- Add Alloy DaemonSet for automatic pod log collection and service health probes
|
||
- Set up Borgmatic daily backups to Sifaka NAS with PostgreSQL streaming support
|
||
- Add CloudNativePG PostgreSQL metrics scraping via Tailscale service
|
||
- Add devpi PyPI caching proxy in Kubernetes with custom container image
|
||
- Add Forgejo Actions CI runner in Kubernetes with host mode execution
|
||
- Add Homepage service dashboard with automatic Kubernetes service discovery
|
||
- Add Jellyfin media server with VideoToolbox hardware transcoding on indri
|
||
- Add Kiwix offline Wikipedia server with kiwix-tools on indri
|
||
- Add kube-state-metrics for Kubernetes resource metrics (pods, deployments, etc.)
|
||
- Add Loki log aggregation with 31-day retention and Grafana integration
|
||
- Add Miniflux RSS/Atom feed reader connected to PostgreSQL
|
||
- Add Navidrome music streaming server with NFS storage from Sifaka
|
||
- Add Prometheus metrics collection on indri with Sifaka node_exporter scraping
|
||
- Add TeslaMate vehicle data logger with 18 Grafana dashboards
|
||
- Add Transmission BitTorrent daemon for ZIM archive downloads
|
||
- Add Zot OCI registry as pull-through cache for Docker Hub, GHCR, and Quay
|
||
|
||
### Bug Fixes
|
||
|
||
- Build Alloy with CGO for macOS native DNS resolver (fixes Tailscale MagicDNS)
|
||
- Suppress noisy "v1 Endpoints is deprecated" warning from minikube storage-provisioner
|
||
|
||
### Infrastructure
|
||
|
||
- Deploy ArgoCD for GitOps continuous delivery with manual sync policy for workloads
|
||
- Set up Caddy reverse proxy for *.ops.eblu.me with ACME DNS-01 TLS via Gandi
|
||
- Deploy CloudNativePG operator and blumeops-pg PostgreSQL cluster in Kubernetes
|
||
- Migrate Grafana from Homebrew to Kubernetes via Helm chart
|
||
- Migrate Kiwix to Kubernetes with torrent-sync sidecar and ZIM watcher CronJob
|
||
- Migrate Loki to Kubernetes StatefulSet with 50Gi PVC
|
||
- Migrate Miniflux from Homebrew to Kubernetes with CloudNativePG database
|
||
- Set up Minikube single-node Kubernetes cluster on indri with Tailscale API access
|
||
- Migrate minikube from podman to docker driver for better stability and NFS support
|
||
- Manage Prometheus configuration via Ansible
|
||
- Migrate Prometheus to Kubernetes StatefulSet with 50Gi PVC
|
||
- Set up Pulumi for Tailnet ACL management with OAuth authentication
|
||
- Migrate Transmission to Kubernetes with NFS storage from Sifaka
|
||
- Migrate Zot registry from Tailscale serve to Caddy reverse proxy at registry.ops.eblu.me
|
||
- Integrate Zot as minikube registry mirror for all image pulls
|