`gpu-proxy`'s gaming guard — the thing that stops a local-LLM wake-up (or unloads an already-loaded model) from competing with a game for the one GPU in the house — used to run as a Windows-side agent polling `nvidia-smi` and maintaining an exclusion list of system/vendor processes (`dwm.exe`, `explorer.exe`, `NVIDIA Overlay.exe`, ...) to tell "a game" apart from normal desktop chrome. That agent is gone. In its place: `gpu-proxy` on tselitedesk polls Windows's lock state every 5 seconds over the SSH connection it already holds — `[bool](Get-Process -Name LogonUI -ErrorAction SilentlyContinue)` — and nothing runs on the gaming PC for this anymore.
Watchtower runs on both non-cluster hosts, but not every container gets the same treatment: stateless infra pieces auto-update on sight, while anything holding real user data or state — Sonarr, Radarr, Jellyfin, qBittorrent, Prowlarr, byparr, Seerr, Gluetun — is kept on monitor-only. A separate script reads Watchtower's own logs daily, and if any of those protected containers has a new image waiting, it fires a real alert into Alertmanager instead of updating silently or getting forgotten.
Both `elitedesk` and `tspi` — the two hosts running things outside the k3s cluster itself — cron a nightly script that pulls their own live configuration back into the `homelab` git repo and pushes it: Docker Compose files, Prometheus/Alertmanager configs, every Grafana dashboard (exported fresh via the Grafana API, not hand-copied), and each host's own crontab.
A cron job on `elitedesk`, running every 5 minutes, that watches for a specific recurring failure signature in Longhorn's manager logs — `webhook ... context deadline exceeded` — and, once it's seen more than 3 times in a 5-minute window, deletes Longhorn's own stale validating and mutating webhook configurations so it re-registers itself cleanly.
An auto-login demo user on `x.sacenpapier.org`, confirmed working end-to-end.
Every one of the 6 GitHub Actions pipelines now builds a local, unpushed image first, scans it with Trivy for `CRITICAL` severity CVEs, and only proceeds to the real multi-platform build-and-push if it's clean. An image with a critical, fixable vulnerability now never reaches Docker Hub at all — a true gate, not a post-push alert Image Updater could still pick up.
A confirmed fix for a known CVE in the `python-jose` dependency, closing out a flagged item from the security-hardening backlog.
11 NetworkPolicies across 5 apps plus the default namespace: frontends locked down to Traefik-only ingress, and the shared MySQL instance locked to only its 4 real client apps.
Every container across all 13 Deployments in the cluster — 10 in `default`, 3 in `homelab-dashboard` — now has CPU/memory requests and limits set, sized from real `kubectl top pods` observations rather than guessed.
The same observability shape rolled out to all five FastAPI backends — homelab-sacenpapier, PopRoom, BotWhy, Apercu, and x: a `/metrics` endpoint via `prometheus-fastapi-instrumentator`, an `/api/health` check, and one app-specific business gauge per app that a pure infra-level check can't see. Each app gets its own NodePort metrics Service and a Prometheus scrape job on `tspi`, tagged with a `project` label.