webgrip/homelab-cluster
5
0
Fork 0
Code Issues 2 Pull requests 18 Projects Releases Packages Wiki Activity Actions

feat(vikunja): watchdog for the token the board and the factory share #573

Open
ryangr0 wants to merge 1 commit from fix/litellm-ingress-ploeg into main
pull from: fix/litellm-ingress-ploeg
merge into: webgrip:main
Conversation 0 Commits 1 Files changed 2 +91
ryangr0 commented 2026-08-13 17:32:45 +00:00
Owner
Copy link

One OpenBao entry (secret/vikunja/mcp api_token) authenticates both the MCP bridge and ploegd's tracker write-backs. When it expired on 2026-08-11 the board lost its agent and ploegd crash-looped at boot — routing-as-a-file resolves project names through this token, so an invalid one is fatal rather than cosmetic. The only trace was in pod logs nobody was tailing; it was found hours later, by hand, mid-benchmark.

A daily CronJob exercises the credential the way its consumers do and fails the Job when it stops working, so the estate's existing KubeJobFailed alert is the pager — no new alerting plumbing.

Not a countdown, though three weeks' warning is what you actually want: Vikunja bars API tokens from the token-management routes, so a token cannot read its own expiry (measured — /api/v1/tokens answers invalid token to a valid API token). Mint with a long expiry until that changes.

🤖 Generated with Claude Code

One OpenBao entry (`secret/vikunja/mcp` `api_token`) authenticates **both** the MCP bridge and ploegd's tracker write-backs. When it expired on 2026-08-11 the board lost its agent and ploegd crash-looped at boot — routing-as-a-file resolves project *names* through this token, so an invalid one is fatal rather than cosmetic. The only trace was in pod logs nobody was tailing; it was found hours later, by hand, mid-benchmark. A daily CronJob exercises the credential the way its consumers do and **fails the Job** when it stops working, so the estate's existing KubeJobFailed alert is the pager — no new alerting plumbing. Not a countdown, though three weeks' warning is what you actually want: Vikunja bars API tokens from the token-management routes, so a token cannot read its own expiry (measured — `/api/v1/tokens` answers *invalid token* to a valid API token). Mint with a long expiry until that changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
feat(vikunja): watchdog for the token the board and the factory share
Some checks failed
e2e / Lint & static validation (pull_request) Failing after 32s
Details
e2e / Kyverno Chainsaw (KinD) (pull_request) Successful in 9s
Details
e2e / Validate Renovate config (pull_request) Successful in 39s
Details
e2e / Flux-local render (pull_request) Successful in 48s
Details
f537e17e2a 
One OpenBao entry authenticates both the MCP bridge and ploegd's tracker
write-backs, so when it expired on 2026-08-11 the board lost its agent and
ploegd crash-looped at boot — routing-as-a-file resolves project NAMES through
this token, so an invalid one is fatal rather than cosmetic. The only trace was
in pod logs nobody was tailing; it was found hours later, by hand, mid-benchmark.

A daily CronJob exercises the credential the way its consumers do and fails the
Job when it stops working, so the existing KubeJobFailed alert is the pager.

Not a countdown, though three weeks' warning is what you want: Vikunja bars API
tokens from the token-management routes, so a token cannot read its own expiry
(measured — /api/v1/tokens answers 'invalid token' to a valid API token). Mint
with a long expiry until that changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Some checks failed
e2e / Lint & static validation (pull_request) Failing after 32s
Required
Details
e2e / Kyverno Chainsaw (KinD) (pull_request) Successful in 9s
Required
Details
e2e / Validate Renovate config (pull_request) Successful in 39s
Required
Details
e2e / Flux-local render (pull_request) Successful in 48s
Required
Details
Some required checks were not successful.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/litellm-ingress-ploeg:fix/litellm-ingress-ploeg
git switch fix/litellm-ingress-ploeg
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/homelab-cluster!573
No description provided.