`gpu-proxy`'s gaming guard — the thing that stops a local-LLM wake-up (or unloads an already-loaded model) from competing with a game for the one GPU in the house — used to run as a Windows-side agent polling `nvidia-smi` and maintaining an exclusion list of system/vendor processes (`dwm.exe`, `explorer.exe`, `NVIDIA Overlay.exe`, ...) to tell "a game" apart from normal desktop chrome. That agent is gone. In its place: `gpu-proxy` on tselitedesk polls Windows's lock state every 5 seconds over the SSH connection it already holds — `[bool](Get-Process -Name LogonUI -ErrorAction SilentlyContinue)` — and nothing runs on the gaming PC for this anymore.
Every one of the 6 GitHub Actions pipelines now builds a local, unpushed image first, scans it with Trivy for `CRITICAL` severity CVEs, and only proceeds to the real multi-platform build-and-push if it's clean. An image with a critical, fixable vulnerability now never reaches Docker Hub at all — a true gate, not a post-push alert Image Updater could still pick up.
A confirmed fix for a known CVE in the `python-jose` dependency, closing out a flagged item from the security-hardening backlog.
11 NetworkPolicies across 5 apps plus the default namespace: frontends locked down to Traefik-only ingress, and the shared MySQL instance locked to only its 4 real client apps.
Two ServiceAccounts running with full `cluster-admin` got scoped down to exactly the permissions they actually use: `homelab-dashboard`'s to read-only `get`/`list` on nodes and pods, and `kube-system`'s Prometheus SA to `get` on `/metrics` and `nodes/metrics` only.
All 6 apps switched from SSH-triggered deploys to ArgoCD Image Updater. CI now pushes images tagged by the commit SHA instead of reusing `:latest`; Image Updater detects the new tag, writes it into each app's `kustomization.yaml`, and ArgoCD syncs it like any other git change. The `appleboy/ssh-action` step — and the `SSH_HOST`/`SSH_USER`/`SSH_PRIVATE_KEY` secrets behind it — is gone from all 6 workflows.
`PopRoom`, `BotWhy`, `Apercu`, and `x` each connect to the shared MySQL instance (`shared-mysql`), but all four were using the exact same login — one username and password with broad `ALL PRIVILEGES` grants across every app's database. Replaced that with four dedicated MySQL users, each scoped to only its own database: `apercu_app` → `apercu`, `botwhy_app` → `chatbox_db`, `x_app` → `twitter_db`, `poproom_app` → `poproom`. The old shared login's grants on all four databases were revoked once every app confirmed healthy on its new credentials.
A security pass across the homelab boxes' SSH configuration, plus a tuning fix on a false-alarm memory alert triggered by Watchtower's nightly auto-updates squeezing `glances`' memory limit.
A per-IP rate limit (20 requests/minute via `slowapi`) and a 500-character message length cap on BotWhy's `/openai/answer` endpoint — the one route that actually calls out to a paid AI provider on every request.