Repository navigation

feat: implement skillet configuration tool - #46

Open

gbagnoli wants to merge 332 commits into

masterfrom

skillet

Open

feat: implement skillet configuration tool#46
gbagnoli wants to merge 332 commits into
masterfrom
skillet

This pull request is big! We're only showing the most recent 250 commits

Commits on Sep 29, 2026
- Document clamps Btrfs data layout and migration steps
  gbagnoli
  committed
  c4f3b77
- Record fresh clamps VM smoke acceptance
  gbagnoli
  committed
  cbe8e38
- Share Btrfs data and Podman storage across uCore hosts
  gbagnoli
  committed
  970f846
- fix(butane): support native libvirt on Rocky Linux
  gbagnoli
  committed
  c7a356c
- feat(skillet): create and deliver KeePass host credentials
  gbagnoli
  committed
  db3e53c
- fix(skillet): cache vault unlock in expiring session keyring
  gbagnoli
  committed
  db58bf0
- docs(plan): record clamps rebase and recovery checks
  gbagnoli
  committed
  76f0f35
- fix(ci): run container checks with base phase
  gbagnoli
  committed
  2885014
- feat(pihole): add shared DNS network
  gbagnoli
  committed
  60fa0b5
- feat(syncthing): provision clamps service
  gbagnoli
  committed
  10a407d
- docs(access): choose private tailnet UI routing
  gbagnoli
  committed
  b35bb8d
- docs(plan): hand off clamps btrbk milestone
  gbagnoli
  committed
  802880a
- feat(btrbk): add host-configurable snapshot convergence
  gbagnoli
  committed
  3e3d9ed
- fix(systemd): avoid waiting for unit termination
  gbagnoli
  committed
  8a34887
- docs(btrbk): require leaf snapshot sources
  gbagnoli
  committed
  aba3f91
- docs(tailscale): document provisioning and split DNS
  gbagnoli
  committed
  58782e2
Commits on Sep 30, 2026
- feat(tailscale): provision and clean up host identities
  gbagnoli
  committed
  afb6f40
- docs(tailscale): document provisioning and DNS decisions
  gbagnoli
  committed
  86c7c2a
Commits on Oct 1, 2026
- fix(syncthing): keep the GUI on the private container network
  gbagnoli
  committed
  732634f
- feat(credentials): allow installation before service activation
  gbagnoli
  committed
  8ffaf39
- feat(caddy): add private UI configuration and credential delivery
  gbagnoli
  committed
  875deca
- docs(ublue): plan generic UI provisioning and record validation
  gbagnoli
  committed
  5d4e5d0
- feat(skillet): generalize private UI provisioning
  gbagnoli
  committed
  4391246
- test(caddy): verify idempotent generic apply
  gbagnoli
  committed
  a0fb991
- docs: record generic private UI provisioning
  gbagnoli
  committed
  eb2bc4e
- docs(ublue): define Cloudflare UI lifecycle and aliases
  gbagnoli
  committed
  bb35651
Commits on Oct 2, 2026
- feat(skillet): manage Cloudflare UI credentials and DNS
  gbagnoli
  committed
  3af993e
- docs(ublue): record Cloudflare UI lifecycle
  gbagnoli
  committed
  1f9f9f5
- docs(cloudflare): clarify token issuer permissions
  gbagnoli
  committed
  25244ff
- docs(skillet): record local musl compiler setup
  gbagnoli
  committed
  0d5dc72
- docs(acceptance): record musl build and vault unlock blocker
  gbagnoli
  committed
  4b9ef6a
- docs(storage): plan TPM encrypted root and acceptance tests
  gbagnoli
  committed
  67c81e8
- fix(cloudflare): explain zone preflight permission requirements
  gbagnoli
  committed
  0937807
- feat(caddy): derive relative UI namespace from Cloudflare zone
  gbagnoli
  committed
  b40b7ac
- feat(cloudflare): support account-owned token issuers
  gbagnoli
  committed
  8fcb583
- test(cloudflare): cover mutation retry recovery
  gbagnoli
  committed
  f91c63a
- test(caddy): probe non-tailnet UI denial in VM
  gbagnoli
  committed
  b6a26e6
- docs(pihole): record smoke DNS checks
  gbagnoli
  committed
  404c92c
- docs(plan): group deferred network acceptance checks
  gbagnoli
  committed
  d3a9657
- feat(unifi): add clamps controller container
  gbagnoli
  committed
  37fc526
Commits on Oct 3, 2026
- fix(unifi): support numeric container ownership
  gbagnoli
  committed
  6765ecb
- docs(unifi): record VM acceptance
  gbagnoli
  committed
  6f450ad
- docs(skillet): define architecture refactoring prerequisite
  gbagnoli
  committed
  471068f
- refactor(vm): add typed manifests and strict legacy import
  gbagnoli
  committed
  544b8e5
- fix(vm): centralize owned disposal and recover absent guests
  gbagnoli
  committed
  d799ace
- refactor(vm): share catalog and Cargo artifact discovery
  gbagnoli
  committed
  cbfa1c2
- fix(vm): preserve manifests through artifact cleanup failures
  gbagnoli
  committed
  67d8f54
- refactor(vm): add bounded shared SSH transport
  gbagnoli
  committed
  fc88433
- refactor(vm): migrate retained binary updates to Rust
  gbagnoli
  committed
  4c7092e
- refactor(vm): migrate guest readiness checks to Rust
  gbagnoli
  committed
  a9c00d3
- fix(vm): recover failed readiness retries safely
  gbagnoli
  committed
  0a0de81
- docs(vm): link readiness recovery evidence
  gbagnoli
  committed
  226c661
- feat(vm): persist recoverable creation intents
  gbagnoli
  committed
  fd9ec85
- refactor(vm): render native domain XML in Rust
  gbagnoli
  committed
  e4da712
- refactor(vm): move local artifact preparation to Rust
  gbagnoli
  committed
  45eec4b
- refactor(vm): move Butane staging to Rust
  gbagnoli
  committed
  cfe3872
- refactor(vm): move native define and start into Rust
  gbagnoli
  committed
  ea61803
- refactor(vm): move reboot and guest access into Rust
  gbagnoli
  committed
  ba1142e
- refactor(vm): add Rust Flatpak creation adapter
  gbagnoli
  committed
  b259119
- refactor(vm): move create orchestration into Rust
  gbagnoli
  committed
  d341498
- docs(vm): record Rust lifecycle migration
  gbagnoli
  committed
  7b8dd0a
- refactor(hosts): centralize host profiles
  gbagnoli
  committed
  c031aee
- refactor(core): inject host identity and credentials
  gbagnoli
  committed
  4144af4
- refactor(core): split file effect capabilities
  gbagnoli
  committed
  fe181f2
- refactor(core): split system effect capabilities
  gbagnoli
  committed
  0e6d7ab
- refactor(vm): share credential delivery transport
  gbagnoli
  committed
  6cf9d54
- refactor(tailscale): replace curl with Rust HTTP client
  gbagnoli
  committed
  d97b454
- refactor(workstation): extract vault and guest credentials
  gbagnoli
  committed
  e77c001
- refactor(workstation): extract Cloudflare provider
  gbagnoli
  committed
  f767151
- refactor(workstation): extract Tailscale provider
  gbagnoli
  committed
  798cca4
- refactor(workstation): model provisioning policy
  gbagnoli
  committed
  badc341
- refactor(podman): move DNS policy to host baseline
  gbagnoli
  committed
  4da7571
- refactor(podman): model process identity explicitly
  gbagnoli
  committed
  bb94318
- refactor(podman): type networks and port bindings
  gbagnoli
  committed
  d436803
Commits on Oct 4, 2026
- refactor(podman): share data mount dependencies
  gbagnoli
  committed
  3ef996b
- refactor(skillet): unify activation and recording
  gbagnoli
  committed
  9c54351
- test(skillet): isolate smoke fixture and verify artifacts
  gbagnoli
  committed
  25cf3a7
- refactor(skillet): share credential guest transport
  gbagnoli
  committed
  a597a54
- test(skillet-core): share file adapter contracts
  gbagnoli
  committed
  c24cc9d
- test(skillet-core): verify account lookup adapters
  gbagnoli
  committed
  6700e1b
- test(skillet-core): verify system effect contracts
  gbagnoli
  committed
  2fb6f64
- refactor(skillet-podman): type volume root ownership
  gbagnoli
  committed
  fd423f9
- refactor(workstation): own provider cleanup journals
  gbagnoli
  committed
  72397e2
- refactor(workstation): share private UI provisioning plan
  gbagnoli
  committed
  5bfbb1c
- refactor(tailscale): parse guest status in provider
  gbagnoli
  committed
  b442dfc
- refactor(tailscale): share enrollment retry policy
  gbagnoli
  committed
  9d00748
- fix(skillet): fail closed on Tailscale probe errors
  gbagnoli
  committed
  430f2f6
- refactor(vm): install deferred credentials as a set
  gbagnoli
  committed
  3fe5e1a
- refactor(workstation): own disposable Tailscale enrollment
  gbagnoli
  committed
  f74119b
- refactor(workstation): own disposable UI DNS provisioning
  gbagnoli
  committed
  0023a3c
- build(skillet): record workstation VM dependency
  gbagnoli
  committed
  dc987a3
- refactor(workstation): own disposable Cloudflare cleanup
  gbagnoli
  committed
  980af4a
- refactor(workstation): own disposable Tailscale cleanup
  gbagnoli
  committed
  ab7d5f3
- refactor(workstation): own persistent UI delivery
  gbagnoli
  committed
  7055abe
- refactor(workstation): own disposable Caddy delivery
  gbagnoli
  committed
  ed791d7
- refactor(workstation): own host credential delivery
  gbagnoli
  committed
  d93ca42
- docs(skillet): record remaining ownership boundary gap
  gbagnoli
  committed
  c516a4c
- refactor(vm): use owned manifests for provisioning
  gbagnoli
  committed
  9f1a79d
- docs(skillet): record provisioning ownership boundaries
  gbagnoli
  committed
  d3066b7
- refactor(core): unify file ownership inputs
  gbagnoli
  committed
  b4b4506
- docs(skillet): record unified ownership contract
  gbagnoli
  committed
  ccd5eba
- feat(cli): add standalone vault unlock command
  gbagnoli
  committed
  8b14b76
- docs(skillet): record clamps smoke acceptance
  gbagnoli
  committed
  6177483
- fix(vm): handle fresh host provisioning prerequisites
  gbagnoli
  committed
  103167b
- docs: record fresh VM acceptance and shared zone path
  gbagnoli
  committed
  5ab6e05
- fix(workstation): scope Cloudflare zone by environment
  gbagnoli
  committed
  43cfe66
- fix(workstation): use prod and test vault groups
  gbagnoli
  committed
  72f9d4c
- docs: record successful test ACME acceptance
  gbagnoli
  committed
  06f4989
- docs(skillet): reconcile refactor acceptance status
  gbagnoli
  committed
  5cd2e22
Commits on Oct 5, 2026
- fix(ci): install required tools
  gbagnoli
  committed
  3f750a3
- docs(skillet): complete refactor acceptance record
  gbagnoli
  committed
  511447b
- refactor(vm): move smoke lifecycle under Rust
  gbagnoli
  committed
  24c0d6c
- test(core): align resource fakes with runtime contracts
  gbagnoli
  committed
  4b92b58
- ci: run bootstrap state regression suite
  gbagnoli
  committed
  0985c1d
- docs: track refactor follow-up acceptance
  gbagnoli
  committed
  161ba63
- fix(workstation): probe Caddy through its bridge address
  gbagnoli
  committed
  fc62cdb
- fix(test): check the managed Btrfs timer unit
  gbagnoli
  committed
  b5d6716
- docs: record live application acceptance
  gbagnoli
  committed
  5f856ff
- test(vm): script interrupted reboot recovery
  gbagnoli
  committed
  9fb43fd
- fix(syncthing): map container identity to data owner
  gbagnoli
  committed
  43438e3
- fix(cli): improve application smoke diagnostics
  gbagnoli
  committed
  126004f
- docs(plan): park Syncthing VM acceptance
  gbagnoli
  committed
  71eb002
Commits on Oct 6, 2026
- docs(clamps): audit parity and plan Cloudflare DDNS port
  gbagnoli
  committed
  c8f5d7e
- fix(ci): satisfy Rust 1.99 and scoped ShellCheck checks
  gbagnoli
  committed
  0c6bed4
- feat(ddns): add optional updater and scoped credential delivery
  gbagnoli
  committed
  82465cc
- feat(ddns): add disposable ownership lifecycle
  gbagnoli
  committed
  c378ce6
- docs(ddns): record disposable acceptance status
  gbagnoli
  committed
  1f286d1
- feat(config): resolve vault references in service templates
  gbagnoli
  committed
  e3674fc
Commits on Oct 7, 2026
- feat(datadog): add optional rootful agent and service monitoring
  gbagnoli
  committed
  ce68783
- feat(secrets): audit vault requirements and unused entries
  gbagnoli
  committed
  bbfcae8
- fix(podman): preserve literal Quadlet directives
  gbagnoli
  committed
  28ed7a3
- fix(datadog): share API key and preserve Agent integrations
  gbagnoli
  committed
  511de06
- docs(acceptance): record DDNS and Datadog VM results
  gbagnoli
  committed
  869c438
Commits on Oct 8, 2026
- fix(datadog): order boot discovery after monitored workloads
  gbagnoli
  committed
  196ce80
- feat(datadog): separate lab telemetry from production regions
  gbagnoli
  committed
  59fea9d
- docs(datadog): record test monitor exclusions and setup key
  gbagnoli
  committed
  69e908d
- fix(datadog): enable perf events under Podman seccomp
  gbagnoli
  committed
  7b01e86
- feat(vm): forward local UI ports through owned SSH sessions
  gbagnoli
  committed
  db7ff94
- test(unifi): prepare fenced backup restore acceptance
  gbagnoli
  committed
  a1da068
Commits on Oct 9, 2026
- docs(unifi): record restored-data acceptance and email follow-up
  gbagnoli
  committed
  81f11c4
- docs(unifi): reconcile migration acceptance summary
  gbagnoli
  committed
  62fb216
- docs(unifi): close isolated restore acceptance
  gbagnoli
  committed
  b1945ac
- docs(smtp): plan shared Postfix relay provisioning
  gbagnoli
  committed
  0a3d8b7
- feat(secrets): validate structured SMTP vault fields
  gbagnoli
  committed
  556fb22
- feat(smtp): provision shared native fleet relay with isolated tests
  gbagnoli
  committed
  b145f49
- fix(smtp): initialize persistent Postfix state on ostree hosts
  gbagnoli
  committed
  9925265
- feat(smtp): opt in to live provider checks on owned VMs
  gbagnoli
  committed
  a792859
- fix(smtp): prepare trusted TLS and confined credential access
  gbagnoli
  committed
  1944f78
- docs(smtp): record Mailjet delivery and Gmail acceptance
  gbagnoli
  committed
  c784001
- docs(clamps): park UniFi email and identify exit-node milestone
  gbagnoli
  committed
  b5c9774
- feat(tailscale): configure caller-selected production exit nodes
  gbagnoli
  committed
  3d15abe
- docs(clamps): audit host access and baseline parity
  gbagnoli
  committed
  cdeb737
- feat(access): finalize sudo and first-login password policy
  gbagnoli
  committed
  eb38ba2
Commits on Oct 10, 2026
- docs(storage): audit TPM encryption and boot prerequisites
  gbagnoli
  committed
  3a5accc
- feat(vm): add native TPM-encrypted root profile
  gbagnoli
  committed
  de914bf
- feat(storage): archive verified root recovery keys in KeePassXC
  gbagnoli
  committed
  b65777d
- docs(storage): record live vault recovery acceptance
  gbagnoli
  committed
  bfc7ed7
- feat(storage): archive verified LUKS headers in KeePassXC
  gbagnoli
  committed
  3f0d75d
- feat(vm): add isolated TPM-loss recovery acceptance
  gbagnoli
  committed
  ec8ac14
- docs(storage): record TPM-loss recovery acceptance
  gbagnoli
  committed
  83725c2
- feat(installation): prepare guarded physical USB install media
  gbagnoli
  committed
  3b8028a
- docs(installation): record USB media and VM regression acceptance
  gbagnoli
  committed
  3ca517e
Commits on Oct 11, 2026
Commits on Oct 12, 2026
- feat(core): add injectable USB discovery and rule refresh
  gbagnoli
  committed
  3e29151
- feat(skillet): configure optional local UPS protection for clamps
  gbagnoli
  committed
  5875f93
- feat(datadog): enable local Unix-socket metric ingestion
  gbagnoli
  committed
  5adf1ea
- feat(nut): collect UPS metrics with the static guest binary
  gbagnoli
  committed
  d01ee1e
- fix(nut): invoke the provisioned guest binary
  gbagnoli
  committed
  35e4a86
- fix(installer): recognize confirmed MOK enrollment across live images
  gbagnoli
  committed
  65f3a2b
- fix(installer): show and accept the prepared disk name
  gbagnoli
  committed
  b257260
- fix(vault): preserve binary IDs when refreshing recovery headers
  gbagnoli
  committed
  d6bd6e7
- docs(storage): record physical TPM rebase recovery status
  gbagnoli
  committed
  26288b8
- docs(storage): record physical encrypted-root cold boot
  gbagnoli
  committed
  f0acb0b
- docs(clamps): record physical service startup evidence
  gbagnoli
  committed
  ef8b32f
- feat(cli)!: apply all declared services over verified SSH
  gbagnoli
  committed
  9510597
- feat(network): stage private host profiles for boot
  gbagnoli
  committed
  9cbd294
Commits on Oct 13, 2026
Commits on Oct 14, 2026
- docs(clamps): record physical network recovery and update acceptance
  gbagnoli
  committed
  74cca86
- feat(mikochi): follow latest with registry auto-update
  gbagnoli
  committed
  3f8ff12
- feat(syncthing): protect private UI with tailnet user identity
  gbagnoli
  committed
  1bc08ff
- feat(cli): use positional hosts and native SSH alias defaults
  gbagnoli
  committed
  255f260
- feat(cli): explain SSH-agent setup in help and authentication errors
  gbagnoli
  committed
  c9a3778
- docs(acceptance): record SSH-agent help validation
  gbagnoli
  committed
  7879272
- fix(podman): collapse overlapping dual-stack wildcard publications
  gbagnoli
  committed
  0a31d2f
- fix(caddy): prepare confined SELinux authorization broker
  gbagnoli
  committed
  1d6ea99
- docs(caddy): record enforcing broker live acceptance
  gbagnoli
  committed
  7c0ae3e
- fix(caddy): clear application queries from auth subrequests
  gbagnoli
  committed
  3e0b564
- docs(caddy): record auth-query deployment and diagnostic cleanup
  gbagnoli
  committed
  a1a120e
- docs(caddy): record Android usability confirmation
  gbagnoli
  committed
  3810207
- docs(syncthing): define missing-only configuration bootstrap
  gbagnoli
  committed
  0e32a7d
- feat(core): add atomic file creation without replacement
  gbagnoli
  committed
  0903d57
- feat(syncthing): bootstrap missing config through encrypted delivery
  gbagnoli
  committed
  f6c3076
- fix(syncthing): keep private names out of generator arguments
  gbagnoli
  committed
  ef3c690
- fix(vm): converge workloads when reusing enrollment
  gbagnoli
  committed
  abbaeea
- docs(syncthing): record physical and VM bootstrap acceptance
  gbagnoli
  committed
  4e5bdfb
- docs(test): record complete Syncthing smoke success
  gbagnoli
  committed
  620e150
- fix(ui): use tailnet authentication for Pi-hole and Mikochi
  gbagnoli
  committed
  edbcff2
- docs(ui): complete native VM rollout acceptance
  gbagnoli
  committed
  8959e12
Commits on Oct 15, 2026
- fix(datadog): isolate monitoring DNS from Pi-hole filtering
  gbagnoli
  committed
  e5edd04
- docs(ui): record operator browser acceptance
  gbagnoli
  committed
  c7cc22e
- fix(files): preserve omitted metadata on atomic replacement
  gbagnoli
  committed
  0e1f720
- feat(pihole): provision shared private DNS inventory
  gbagnoli
  committed
  18137ec
Commits on Oct 16, 2026
Commits on Oct 17, 2026
- feat(homeassistant): deploy private UI and encrypted backup export
  gbagnoli
  committed
  a010376
- docs(homeassistant): record VM acceptance and remaining live gates
  gbagnoli
  committed
  133bbf0
- docs(homeassistant): record successful staging ACME acceptance
  gbagnoli
  committed
  6b93773
- feat(homeassistant): share owner login behind tailnet authorization
  gbagnoli
  committed
  4c8cb61
- fix(caddy): serialize SELinux policy loading at boot
  gbagnoli
  committed
  01c69bb
- test: fix Home Assistant and Mikochi CI checks
  gbagnoli
  committed
  b2309c8
- fix(workstation): verify oneshot completion from journal
  gbagnoli
  committed
  20567a8
- docs(homeassistant): plan companion integrations and recovery
  gbagnoli
  committed
  2704ea3
- docs(homeassistant): keep backup data out of vault
  gbagnoli
  committed
  58d48d1
- feat(homeassistant): preserve verified host restore procedure
  gbagnoli
  committed
  a7bcb4b
- docs(homeassistant): record verified off-machine backup copy
  gbagnoli
  committed
  bee92fa
- feat(homeassistant): retain seven exported backups
  gbagnoli
  committed
  01a2d81
- feat(homeassistant): enable selected host Bluetooth access
  gbagnoli
  committed
  76b802c
Commits on Oct 18, 2026
- feat(homer): add shared private dashboard for fleet hosts
  gbagnoli
  committed
  d2083cc
- fix(ddns): defer clamps production writer until cutover
  gbagnoli
  committed
  d273cd1
- docs(acceptance): record clamps DDNS deferral and dashboard apply
  gbagnoli
  committed
  9421a76
- feat(homer): serve dashboard on host machine name
  gbagnoli
  committed
  630c9ea
- docs(acceptance): record clamps dashboard machine route
  gbagnoli
  committed
  cce805e
- fix(homer): allow dashboard assets and service health checks
  gbagnoli
  committed
  01a41c5
Commits on Oct 19, 2026
- fix(homer): correct Pi-hole links and API proxying
  gbagnoli
  committed
  3726a34
- fix(caddy): allow Pi-hole v6 widget authentication
  gbagnoli
  committed
  aa33bd1
- fix(homer): send empty Pi-hole v6 password
  gbagnoli
  committed
  2e7a845
Commits on Oct 20, 2026
- fix(homer): proxy Pi-hole widget API same-origin
  gbagnoli
  committed
  23ae496
- docs(acceptance): record clamps LAN checks
  gbagnoli
  committed
  6052a08
- docs(clamps): record IPv6 DNS acceptance
  gbagnoli
  committed
  bda64e6
- feat(postgres): add reusable app database modules
  gbagnoli
  committed
  9957360
- feat(donbot): provision Joplin with PostgreSQL backups
  gbagnoli
  committed
  1fa323a
- fix(vm): check KVM before preparing run
  gbagnoli
  committed
  5a5067a
- refactor(caddy): split rendering helpers
  gbagnoli
  committed
  891b976
Commits on Oct 21, 2026
- fix(caddy): separate tailnet denial from proxy route
  gbagnoli
  committed
  afbdbf0
- fix(postgres): create application data parent
  gbagnoli
  committed
  94e880c
- fix(joplin): make service activation retryable
  gbagnoli
  committed
  9eeb8fc
- docs(donbot): record joplin backup acceptance
  gbagnoli
  committed
  048c558
- docs(vm): describe disposable disk expansion
  gbagnoli
  committed
  6b755e7

Commits

Commits on Sep 29, 2026

Commits on Sep 30, 2026

Commits on Oct 1, 2026

Commits on Oct 2, 2026

Commits on Oct 3, 2026

Commits on Oct 4, 2026

Commits on Oct 5, 2026

Commits on Oct 6, 2026

Commits on Oct 7, 2026

Commits on Oct 8, 2026