Architecture alignment:
- Rewrite k3s-server.nix from aspirational role=server to actual role=agent
(cupfox is the real control-plane at 100.110.163.82:6443)
- Update flake.nix: correct serverAddr for all nodes, annotate dead nodes,
fix hostname from nixos-laptop to nixos
- Update join-agent.sh default SERVER to cupfox
- Document actual vs intended architecture in comments
Ingress:
- Add rs-apps-books Ingress for audiobookshelf (/apps/books → media ns)
- Add strip-apps-books middleware for prefix stripping
- Create ray-ingress.yaml for Ray dashboard at /server/ray
Ray:
- Fix raycluster.yaml: enable dashboard, mount /dev/dri on gpu-workers
- Point gpu-workers to qfox-1 (was neon-64gb)
- Remove nvidia.com/gpu resource dependency (use /dev/dri via Mesa)
Security:
- Move OPENID_CLIENT_SECRET from plaintext to K8s Secret ref
- Update manifest to use valueFrom.secretKeyRef
Cleanup:
- Remove 53 committed test PNG screenshots from git tracking
- Remove auth-state.json from git tracking
- Add *.png, *.json to tests/.gitignore
Build: no build needed
- Homarr OIDC env vars set (sso-homarr)
- Database created at /data/db.sqlite
- Config schema updated to v2
- Onboard wizard needs final UI completion
Build: 3313 jobs, 0 errors
- Libraries created via API (204 on creation + path update)
- Paths: /media/movies, /media/tv, /media/music
- SSO-Auth plugin Active, SSO button on login page
- Paths may need manual setting through Dashboard UI
Build: 3313 jobs, 0 errors
Tests the full traffic path against live researchstack.info infrastructure:
Edge Caddy (TLS) → Tailscale → Traefik Ingress → k3s services
Coverage:
- edge-tls-redirects: HTTPS reachability, cert validity, legacy subdomain
301s (status/dash/home/media/books/music/vault/pulse/apps), stable
subdomains (auth, mail), wildcard fallback
- path-routing: /apps/*, /server/*, /api/* routes; prefix stripping; SSO
redirect vs token-auth isolation
- auth-integration: Authentik login page, OIDC discovery, forward_auth
gating on protected paths, /api/* bypass
19/40 tests pass against current live infrastructure (pre-deploy). The 21
failures are "not yet deployed" signals, not design errors. Run after each
phase of the deployment plan to use as a regression gate.
Run: cd 4-Infrastructure/k3s-flake/tests && npm test
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
