- zulip: rename legacy env vars per 12.x migration guide
(DB_HOST -> SETTING_REMOTE_POSTGRES_HOST, etc.)
Remove DISABLE_HTTPS/SSL_CERTIFICATE_GENERATION (HTTP is default in 12.x)
Re-enable slot 12 as latest
- open-webui: try v0.10.0 as intermediate step from v0.9.5
(v0.12.4 had duplicate column migration error jumping from v0.9.5)
- immich: add fsGroup: 1000 so init container can write to PVC
- keila: set TZ_AUTOUPDATE=disabled to prevent tz library crash
on read-only /opt/app/lib path in v0.30.3
- open-webui: revert to v0.9.5 — v0.12.x migration crashes on
existing DB (duplicate column name: info_json)
- gitea: use rootless image tag (28.2.0-rootless) since deployment
runs as non-root UID 1000; standard tag uses s6-overlay requiring root
- openproject: add secretKeyBase secret and SECRET_KEY_BASE env var
to web, worker, and seeder; v17 enforces non-default SECRET_KEY_BASE
feat(synapse): update ingress to use traefik ingress class and bump version
feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress
feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration
fix(taiga): update liveness and readiness probes to use tcpSocket for health checks
fix(taiga): change PVC access mode to ReadWriteMany for media and static storage
feat(traefik): add icon and ignore rules for traefik service
docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments
feat(ushahidi): implement dedicated Redis deployment for Ushahidi
fix(vllm): update deployment strategy and readiness/liveness probes for improved stability
fix(writefreely): pin writefreely image version to v0.15.1 for consistency
docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior
pretix/standalone runs gunicorn + celery + celery-beat in one container
and OOMKilled at 4Gi. Increased limit to 6Gi, request to 512Mi.
eventyay: add nginx sidecar to serve static files, update health probes
to check a static asset at port 8080, add create-superuser script,
register script in manifest.
crowdsec: middleware fix (previously uncommitted).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The karrot-frontend nginx template hardcodes Docker's DNS resolver
(127.0.0.11) which doesn't exist in Kubernetes. Added a ConfigMap to
override the template, removing the Docker DNS resolver by using a
direct proxy_pass with no nginx variable (which would force runtime
resolution). Also adds a README with usage instructions.
Documents lessons learned in ADDING-APPS-NOTES.md:
- Note 24: nginx Docker DNS resolver doesn't work in Kubernetes; any
nginx variable in proxy_pass (including $request_uri) forces runtime
DNS resolution requiring a resolver directive
- Note 25: ConfigMap changes don't restart pods; subPath mounts never
auto-update; always follow with kubectl rollout restart
- Note 26: includeSelectors mismatch affects every deployment in an
app — check all endpoints, not just the web-facing one
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
