kevinveenbirkenbachandClaude Opus 5 0ddcf033cd fix(svc-net-wireguard-firewalled): stop appending a duplicate rule per deploy ...

The role ran one shell line, iptables -A FORWARD -i wg0-client -j ACCEPT followed by iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. An append checks nothing, so every deploy added the same two rules again and both chains grew for the life of the host.

The iptables module probes with -C before it inserts, so the rules converge instead of accumulating, and the two interface names move out of the shell string into variables.

The mechanism stays iptables deliberately. An nftables fragment in its own table cannot do this job: an accept there terminates its own base chain and nothing more, so docker's DROP policy on the filter FORWARD chain still executes and the forwarded packet dies. Measured in a namespace with a real forwarding rig: the appended rule delivers 3 of 3 packets under that policy, the fragment delivers 0 of 3, with the fragment's own counter showing the accept matched all three. The inet family would also have started masquerading IPv6, which iptables -t nat never touched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-15 20:31:20 +02:00

..

desk-bluray-player

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-chromium

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-copyq

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-docker

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-dotlinker

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-firefox

feat(readme): ask the reader for a domain the deployment can resolve

2026-09-02 18:30:25 +02:00

desk-git

test(roles): require one embeddable video per invokable role

2026-09-09 01:46:36 +02:00

desk-gnome

feat(readme): ask the reader for a domain the deployment can resolve

2026-09-02 18:30:25 +02:00

desk-gnome-caffeine

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-gnome-extensions

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-gnome-terminal

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-gnucash

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-jrnl

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-keepassxc

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-libreoffice

test(roles): require one embeddable video per invokable role

2026-09-09 01:46:36 +02:00

desk-micro

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-neovim

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-nextcloud

feat(readme): ask the reader for a domain the deployment can resolve

2026-09-02 18:30:25 +02:00

desk-obs

test(roles): require one embeddable video per invokable role

2026-09-09 01:46:36 +02:00

desk-qbittorrent

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-retroarch

test(roles): require one embeddable video per invokable role

2026-09-09 01:46:36 +02:00

desk-spotify

feat(readme): ask the reader for a domain the deployment can resolve

2026-09-02 18:30:25 +02:00

desk-ssh

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

desk-torbrowser

feat(readme): ask the reader for a domain the deployment can resolve

2026-09-02 18:30:25 +02:00

desk-virtualbox

test(roles): require one embeddable video per invokable role

2026-09-09 01:46:36 +02:00

desk-zoom

test(roles): require one embeddable video per invokable role

2026-09-09 01:46:36 +02:00

dev-arduino

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-base-devel

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-core

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-fakeroot

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-gcc

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-git

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-java

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-locales

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-make

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-nix

fix(env): point python at the OS trust store

2026-08-22 18:55:58 +02:00

dev-nodejs

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-npm

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

dev-python

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

dev-shell

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

drv-epson-multiprinter

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

drv-intel

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

drv-lid-switch

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

drv-non-free

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

gen-hunspell

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

pkgmgr

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

pkgmgr-install

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

svc-ai-litellm

fix(api): resolve credentials against the declaration an inventory override hides

2026-09-15 03:35:47 +02:00

svc-ai-lmstudio

docs(lmstudio): describe the preload contract the role actually has

2026-09-15 04:26:28 +02:00

svc-ai-mcp-adapter

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-ai-ollama

feat(ai): let LM Studio serve the models Ollama serves, under one catalogue

2026-09-14 19:21:47 +02:00

svc-ai-robot

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-bkp-local-2-device

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-bkp-nfs-2-local

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-bkp-remote-2-local

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-bkp-secrets-2-local

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-bkp-volume-2-local

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-db-elasticsearch

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

svc-db-mariadb

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

svc-db-memcached

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

svc-db-openldap

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-db-postgres

fix(security): require no_log on every task that carries a credential

2026-09-11 21:52:18 +02:00

svc-db-qdrant

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

svc-db-rabbitmq

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

svc-db-redis

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

svc-db-typesense

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

svc-dns-unbound

feat(svc-net-tor): carry mail to a .onion in both deploy modes

2026-09-15 17:13:12 +02:00

svc-net-firewall

feat(svc-net-firewall): own the packet filter as one nftables table per role

2026-09-15 20:02:36 +02:00

svc-net-tor

feat(svc-net-firewall): own the packet filter as one nftables table per role

2026-09-15 20:02:36 +02:00

svc-net-wireguard-core

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-net-wireguard-firewalled

fix(svc-net-wireguard-firewalled): stop appending a duplicate rule per deploy

2026-09-15 20:31:20 +02:00

svc-net-wireguard-plain

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-opt-keyboard-color

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-opt-ssd-hdd

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-opt-swapfile

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-prx-openresty

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

svc-registry-cache

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

svc-registry-docker

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

svc-runner

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-storage-nfs-client

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-storage-nfs-server

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-swarm-manager

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

svc-swarm-node

fix(security): require no_log on every task that carries a credential

2026-09-11 21:52:18 +02:00

svc-virt-kata

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

sys-ca-selfsigned

style: apply make autoformat

2026-09-09 14:00:16 +02:00

sys-cleanup

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-cli

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-ctl-alm-compose

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

sys-ctl-alm-email

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

sys-ctl-alm-telegram

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-ctl-cln-anon-volumes

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-ctl-cln-bkps

Merge fork/feature/svc-net-tor into feature/ai-agent-employees

2026-08-24 16:32:30 +02:00

sys-ctl-cln-certs

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-ctl-cln-disc-space

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-ctl-cln-docker

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

sys-ctl-cln-faild-bkps

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-ctl-hlth-btrfs

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-ctl-hlth-container

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-ctl-hlth-csp

style(hlth-csp): wrap the start-timeout expression the way autoformat does

2026-09-12 00:28:14 +02:00

sys-ctl-hlth-disc-space

fix(health): exit with a status, not a failure count

2026-09-04 04:41:04 +02:00

sys-ctl-hlth-journalctl

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-ctl-hlth-msmtp

Merge fork/feature/svc-net-tor into feature/ai-agent-employees

2026-08-24 16:32:30 +02:00

sys-ctl-hlth-volumes

fix(hlth-volumes): probe the NFS port the server actually serves

2026-09-04 13:43:37 +02:00

sys-ctl-hlth-webserver

fix(front-proxy): accept the status codes an app declares, not just the triple

2026-09-04 17:30:34 +02:00

sys-ctl-mtn-cert-deploy

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-ctl-mtn-cert-renew

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-ctl-rpr-btrfs-balancer

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-ctl-rpr-container-hard

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-ctl-rpr-container-soft

fix(health): exit with a status, not a failure count

2026-09-04 04:41:04 +02:00

sys-daemon

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-dns-cloudflare-records

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

sys-dns-hetzner-rdns

fix(security): require no_log on every task that carries a credential

2026-09-11 21:52:18 +02:00

sys-dns-wildcards

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

sys-front-inj-all

fix(onion): mirror CSS asset origins and emit plaintext onion CSP siblings

2026-09-11 12:24:03 +02:00

sys-front-inj-css

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

sys-front-inj-dashboard

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-front-inj-javascript

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-front-inj-logout

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-front-inj-matomo

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-front-tls

perf(front-tls): reload the proxy for a redirect config, do not redeploy it

2026-09-09 12:56:47 +02:00

sys-front-tls-letsencrypt

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-front-tls-selfsigned

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-hostname

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-lint

Merge branch 'main' into feature/ai-agent-employees

2026-09-12 11:19:01 +02:00

sys-lock

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-openssl

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-pip

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-pip-install

perf(deploy): run the per-host setup once per host, not once per application

2026-09-14 20:13:57 +02:00

sys-service

feat(sys-service): carry unit ordering, an Install section and a user scope

2026-09-15 18:09:43 +02:00

sys-service-loader

Merge fork/feature/svc-net-tor into feature/ai-agent-employees

2026-08-24 16:32:30 +02:00

sys-service-terminator

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-stk-backend

fix(compose): bootstrap before notify, render last

2026-09-04 01:16:38 +02:00

sys-stk-front-base

fix(security): hoist uniform credential no_log to the include and mask bridge loops

2026-09-11 22:50:54 +02:00

sys-stk-front-proxy

fix(front-proxy): stop redeploying the proxy when a backend answers 5xx

2026-09-09 19:03:07 +02:00

sys-stk-full

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-sudo

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-svc-cdn

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-svc-certbot

fix(security): require no_log on every task that carries a credential

2026-09-11 21:52:18 +02:00

sys-svc-certs

style: apply the project formatters

2026-08-18 03:22:05 +02:00

sys-svc-cln-domains

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

sys-svc-compose

perf(deploy): run the per-host setup once per host, not once per application

2026-09-14 20:13:57 +02:00

sys-svc-compose-ca

fix(ca): extend the container trust store instead of replacing it

2026-09-09 12:32:44 +02:00

sys-svc-container

fix(sys-svc-container): pin the automtu the deploy installs

2026-09-09 01:42:54 +02:00

sys-svc-dns

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-svc-engine

Merge fork/feature/svc-net-tor into feature/ai-agent-employees

2026-08-24 16:32:30 +02:00

sys-svc-journalctl

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

sys-svc-mail

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-svc-mail-msmtp

fix(ca): extend the container trust store instead of replacing it

2026-09-09 12:32:44 +02:00

sys-svc-mail-smtp

Merge fork/feature/svc-net-tor into feature/ai-agent-employees

2026-08-24 16:32:30 +02:00

sys-svc-mcp-reconcile

Merge fork/feature/svc-net-tor into feature/ai-agent-employees

2026-08-24 16:32:30 +02:00

sys-svc-nss

docs(readme): regenerate after the tor onboarding

2026-08-28 13:01:29 +02:00

sys-svc-objstore

Merge fork/feature/svc-net-tor into feature/ai-agent-employees

2026-08-24 16:32:30 +02:00

sys-svc-proxy

fix(onion): mirror CSS asset origins and emit plaintext onion CSP siblings

2026-09-11 12:24:03 +02:00

sys-svc-rdbms

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

sys-svc-ssh

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-svc-sshd

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-svc-webserver-core

fix(webserver-core): raise the header ceiling where nginx reads it

2026-09-03 11:28:01 +02:00

sys-svc-webserver-https

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-timer

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

sys-token-store

Merge fork/feature/svc-net-tor into feature/ai-agent-employees

2026-08-24 16:32:30 +02:00

sys-util-git-pull

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

sys-version

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

test-e2e-cli

fix(test-e2e-cli): run one role's CLI test at a time

2026-09-13 15:21:12 +02:00

test-e2e-playwright

style(test-e2e-playwright): wrap the navigation timeout the way autoformat does

2026-09-12 16:31:49 +02:00

update

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

user

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

user-administrator

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

user-backup

test(lint): check the shell scripts that ship as jinja templates

2026-09-15 17:01:27 +02:00

user-root

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

user-workstation

feat(readme): draw mandatory and disabled service relations

2026-08-17 18:02:31 +02:00

web-app-akaunting

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

web-app-baserow

refactor(sso): compute the app logout target once in the sso lookup

2026-09-11 13:06:19 +02:00

web-app-bigbluebutton

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

web-app-bluesky

test(lint): forbid a JavaScript default for an unset environment variable

2026-09-12 12:07:57 +02:00

web-app-bookwyrm

Merge branch 'main' into feature/ai-agent-employees

2026-09-12 11:19:01 +02:00

web-app-bridgy-fed

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-checkmk

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

web-app-chess

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-confluence

test(roles): require one embeddable video per invokable role

2026-09-09 01:46:36 +02:00

web-app-dashboard

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

web-app-decidim

fix(decidim): create the organization that db:seed skips in production

2026-09-10 10:53:55 +02:00

web-app-discourse

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

web-app-erpnext

fix(security): require no_log on every task that carries a credential

2026-09-11 21:52:18 +02:00

web-app-espocrm

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

web-app-fediwall

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-fider

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-flowise

refactor(ai): declare the litellm consumer contract once

2026-09-14 19:23:59 +02:00

web-app-friendica

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-funkwhale

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

web-app-fusiondirectory

feat(readme): ask the reader for a domain the deployment can resolve

2026-09-02 18:30:25 +02:00

web-app-gitea

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

web-app-gitlab

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

web-app-hermes

refactor(ai): declare the litellm consumer contract once

2026-09-14 19:23:59 +02:00

web-app-homeassistant

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-hugo

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-jellyfin

fix(jellyfin): authenticate once, so the token survives to the password change

2026-09-04 13:54:31 +02:00

web-app-jenkins

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

web-app-jira

Merge branch 'main' into feature/ai-agent-employees

2026-09-03 13:48:28 +02:00

web-app-jitsi

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

web-app-joomla

fix(security): require no_log on every task that carries a credential

2026-09-11 21:52:18 +02:00

web-app-keycloak

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

web-app-kix

fix(kix): let the proxy wait until its upstreams are healthy

2026-09-13 19:41:55 +02:00

web-app-lam

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-listmonk

fix(security): require no_log on every task that carries a credential

2026-09-11 21:52:18 +02:00

web-app-litellm

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-littlejs

feat(readme): ask the reader for a domain the deployment can resolve

2026-09-02 18:30:25 +02:00

web-app-magento

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

web-app-mailu

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

web-app-mastodon

fix(mastodon): emit http and ws URLs when TLS is off, not only skip force_ssl

2026-09-11 11:17:41 +02:00

web-app-matomo

test(lint): forbid a JavaScript default for an unset environment variable

2026-09-12 12:07:57 +02:00

web-app-matrix

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

web-app-mattermost

feat(litellm): serve OpenAI, Anthropic and OpenRouter from declared keys

2026-09-14 19:57:21 +02:00

web-app-mediawiki

refactor(ai): declare the litellm consumer contract once

2026-09-14 19:23:59 +02:00

web-app-mig

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-mini-qr

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-minio

feat(readme): ask the reader for a domain the deployment can resolve

2026-09-02 18:30:25 +02:00

web-app-mobilizon

test(roles): require one embeddable video per invokable role

2026-09-09 01:46:36 +02:00

web-app-moodle

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

web-app-n8n

refactor(ai): declare the litellm consumer contract once

2026-09-14 19:23:59 +02:00

web-app-navigator

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-nextcloud

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

web-app-odoo

fix(security): require no_log on every task that carries a credential

2026-09-11 21:52:18 +02:00

web-app-openclaw

refactor(ai): declare the litellm consumer contract once

2026-09-14 19:23:59 +02:00

web-app-opencloud

feat(readme): ask the reader for a domain the deployment can resolve

2026-09-02 18:30:25 +02:00

web-app-openproject

feat(readme): ask the reader for a domain the deployment can resolve

2026-09-02 18:30:25 +02:00

web-app-opentalk

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-openwebui

refactor(ai): declare the litellm consumer contract once

2026-09-14 19:23:59 +02:00

web-app-peertube

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

web-app-penpot

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

web-app-pgadmin

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

web-app-phpldapadmin

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-phpmyadmin

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-pihole

fix(pihole): pass the admin password through a dotenv-quoted env file and judge the denial before the callback URL

2026-09-11 13:47:22 +02:00

web-app-pixelfed

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-postmarks

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-pretix

test(roles): require one embeddable video per invokable role

2026-09-09 01:46:36 +02:00

web-app-prometheus

refactor(sso): compute the app logout target once in the sso lookup

2026-09-11 13:06:19 +02:00

web-app-roulette-wheel

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-seaweedfs

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-semaphore

Merge branch 'main' into feature/ai-agent-employees

2026-09-12 11:19:01 +02:00

web-app-shopware

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

web-app-snipe-it

fix(snipe-it): mint as apache and hand Passport's keys to it so the API can verify the MCP token

2026-09-11 14:04:13 +02:00

web-app-socialhome

Merge branch 'main' into feature/ai-agent-employees

2026-09-12 16:35:20 +02:00

web-app-sphinx

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-app-suitecrm

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

web-app-taiga

perf(healthcheck): let the start window outlast a real boot

2026-09-09 21:54:26 +02:00

web-app-wordpress

refactor(ai): declare the litellm consumer contract once

2026-09-14 19:23:59 +02:00

web-app-xwiki

refactor(ai): declare the litellm consumer contract once

2026-09-14 19:23:59 +02:00

web-app-yourls

fix(yourls): let every replica salt from the same cookie key

2026-09-12 16:30:20 +02:00

web-app-zammad

refactor(ai): declare the litellm consumer contract once

2026-09-14 19:23:59 +02:00

web-opt-rdr-domains

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-opt-rdr-www

fix(security): require no_log on every task that carries a credential

2026-09-11 21:52:18 +02:00

web-svc-asset

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-svc-cdn

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-svc-collabora

test(roles): require one embeddable video per invokable role

2026-09-09 01:46:36 +02:00

web-svc-coturn

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

web-svc-css

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-svc-file

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-svc-html

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-svc-legal

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-svc-libretranslate

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-svc-logout

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-svc-mirror

refactor(meta): move the info-media exemption to the file it speaks about

2026-09-09 22:26:38 +02:00

web-svc-onlyoffice

fix(onlyoffice): validate the JWT secret against the generator that makes it

2026-09-09 12:35:35 +02:00

web-svc-simpleicons

test(lint): forbid a JavaScript default for an unset environment variable

2026-09-12 12:07:57 +02:00

web-svc-xmpp

feat(services): require an explicit onion decision per host-bound port

2026-09-15 14:51:59 +02:00

__init__.py

…

.gitignore

…

glosar.rst

…

index.rst

…