`gpu-proxy`'s gaming guard — the thing that stops a local-LLM wake-up (or unloads an already-loaded model) from competing with a game for the one GPU in the house — used to run as a Windows-side agent polling `nvidia-smi` and maintaining an exclusion list of system/vendor processes (`dwm.exe`, `explorer.exe`, `NVIDIA Overlay.exe`, ...) to tell "a game" apart from normal desktop chrome. That agent is gone. In its place: `gpu-proxy` on tselitedesk polls Windows's lock state every 5 seconds over the SSH connection it already holds — `[bool](Get-Process -Name LogonUI -ErrorAction SilentlyContinue)` — and nothing runs on the gaming PC for this anymore.
Watchtower runs on both non-cluster hosts, but not every container gets the same treatment: stateless infra pieces auto-update on sight, while anything holding real user data or state — Sonarr, Radarr, Jellyfin, qBittorrent, Prowlarr, byparr, Seerr, Gluetun — is kept on monitor-only. A separate script reads Watchtower's own logs daily, and if any of those protected containers has a new image waiting, it fires a real alert into Alertmanager instead of updating silently or getting forgotten.
Both `elitedesk` and `tspi` — the two hosts running things outside the k3s cluster itself — cron a nightly script that pulls their own live configuration back into the `homelab` git repo and pushes it: Docker Compose files, Prometheus/Alertmanager configs, every Grafana dashboard (exported fresh via the Grafana API, not hand-copied), and each host's own crontab.
A cron job on `elitedesk`, running every 5 minutes, that watches for a specific recurring failure signature in Longhorn's manager logs — `webhook ... context deadline exceeded` — and, once it's seen more than 3 times in a 5-minute window, deletes Longhorn's own stale validating and mutating webhook configurations so it re-registers itself cleanly.
Every container across all 13 Deployments in the cluster — 10 in `default`, 3 in `homelab-dashboard` — now has CPU/memory requests and limits set, sized from real `kubectl top pods` observations rather than guessed.
Added `podAntiAffinity` to the homelab dashboard's frontend deployment, so its three replicas spread across different nodes instead of potentially landing on the same one.