feat(kuma-sync): attach Kuma's default notifications to managed monitors

Kuma 2.5.6 applies "default enabled" notifications only in the web UI
(src/pages/EditMonitor.vue:4128-4132); the server's add handler stores
exactly the notificationIDList the client sends (server/server.js:748,791).
Monitors created by kuma-sync therefore had no notifications.

The notification set is now a managed field: exactly the IDs of all
notifications with isDefault set, sorted, applied on create and update
(group monitors included). Monitor.NotificationIDs is part of
Normalized(), so a changed default set or a hand-made change triggers an
update on the next resync and an unchanged one does not.

Client.DefaultNotifications reads the library's cached notificationList
(go-uptime-kuma-client v0.6.2 notification.go:17). Kuma has no command to
request the list; it pushes it at login and to every session of the user
after each change (server/client.js:31, server/server.js:1573,1594,1836).
A failed read is KumaUnavailable with no create or update.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.woodpecker/alert-monitor.yml

@@ -101,7 +101,7 @@ steps:
         bash scripts/ci/make-diag-kubeconfig.sh
 
   - name: alert-triage-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/ci-scripts-test.yml

@@ -35,25 +35,25 @@ when:
 steps:
   - name: model-selection-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     commands:
       - sh scripts/ci/test-model-selection.sh
 
   - name: pr-review-mistral-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     commands:
       - sh scripts/ci/test-pr-review-mistral.sh
 
   - name: promtool-rules-guard-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     commands:
       - sh scripts/ci/test-promtool-rules.sh
 
   - name: yaml-citations-guard-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     commands:
       - sh scripts/ci/test-yaml-citations.sh
 

.woodpecker/e2e.yml

@@ -26,7 +26,7 @@ steps:
     # fetch-models.sh response mapping. No cluster, no secrets, no network — the
     # ci-claude image just provides sh + jq. Keeps the flag-injection regression
     # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     commands:
       - sh scripts/ci/test-model-selection.sh
 

.woodpecker/issue-fix.yml

@@ -62,7 +62,7 @@ steps:
       - bash scripts/ci/make-diag-kubeconfig.sh
 
   - name: issue-fix-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/security-scan.yml

@@ -18,12 +18,12 @@ when:
 
 steps:
   - name: iac-scan
-    image: aquasec/trivy:latest@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa
+    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
     commands:
       - trivy fs --format json -o trivy-iac.json --severity CRITICAL,HIGH --ignore-unfixed .
 
   - name: image-scans
-    image: aquasec/trivy:latest@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa
+    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
     commands:
       - trivy image --download-db-only
       - |
@@ -70,7 +70,7 @@ steps:
     # this step is skipped — otherwise we'd fork-bomb PRs.
     when:
       - branch: master
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/update-audit.yml

@@ -30,7 +30,7 @@ when:
 
 steps:
   - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

ci/images/authentik-gate-sync/Containerfile

@@ -5,12 +5,12 @@
 
 # The unit tests gate the image: the final stage copies the controller out of
 # this stage, so a failing test fails the build.
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS test
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce AS test
 WORKDIR /src
 COPY controller.py test_controller.py ./
 RUN python3 -B -m unittest -v
 
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
 
 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY --from=test /src/controller.py /opt/controller.py

ci/images/claude/Containerfile

@@ -1,4 +1,4 @@
-FROM node:24-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1
+FROM node:24-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f
 
 # Default to the latest Claude Code. Pinning a fixed version is the wrong
 # default here: old releases eventually stop working against the API, so a

ci/images/heating-can/Containerfile

@@ -23,7 +23,7 @@
 # namespace, so can0 is only reachable with network_mode: host. That is also
 # how the local MQTT broker on 127.0.0.1:1883 is reached. CAN_RAW sockets need
 # no capabilities, so both run unprivileged.
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS build
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce AS build
 
 # Pins live here, in the artifact, rather than in Ansible variables.
 #
@@ -56,7 +56,7 @@ RUN git clone --quiet https://github.com/MyHomeMyData/E3onCAN.git /opt/e3oncan \
  && rm -rf /opt/e3oncan/.git
 
 
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
 
 ARG OPEN3E_REF=6553c10453a6bae1210908f38a5af2481a46a3e5
 ARG E3ONCAN_REF=461dcbdf97e8d72d2edb9929c63b39382af6c3a1

ci/images/kuma-sync/internal/controller/e2e_integration_test.go

@@ -7,12 +7,14 @@ import (
 	"fmt"
 	"io"
 	"path/filepath"
+	"slices"
 	"sync"
 	"testing"
 	"time"
 
 	kuma "github.com/breml/go-uptime-kuma-client"
 	"github.com/breml/go-uptime-kuma-client/monitor"
+	"github.com/breml/go-uptime-kuma-client/notification"
 	"github.com/testcontainers/testcontainers-go"
 	"github.com/testcontainers/testcontainers-go/wait"
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -395,6 +397,60 @@ func TestE2EDriftRepaired(t *testing.T) {
 	})
 }
 
+func (f *e2e) webhook(name string, isDefault bool) int64 {
+	f.t.Helper()
+	id, err := f.raw.CreateNotification(f.t.Context(), notification.Webhook{
+		Base: notification.Base{Name: name, IsActive: true, IsDefault: isDefault},
+		WebhookDetails: notification.WebhookDetails{
+			WebhookURL: "http://127.0.0.1:9/" + name, WebhookContentType: "json",
+		},
+	})
+	if err != nil {
+		f.t.Fatalf("create notification %s: %v", name, err)
+	}
+	return id
+}
+
+func TestE2EDefaultNotifications(t *testing.T) {
+	f, env := newE2E(t)
+	first := f.webhook("first", true)
+	f.webhook("opt-in", false)
+	f.start(env)
+	f.apply(group("g", ""), dns("probe", "g"))
+
+	carry := func(want ...int64) func() (bool, string) {
+		return func() (bool, string) {
+			m := byKey(f.owned())
+			for _, k := range []string{"default/g", "default/probe"} {
+				got, ok := m[k]
+				if !ok {
+					return false, k + " missing"
+				}
+				if !slices.Equal(got.NotificationIDs, want) {
+					return false, fmt.Sprintf("%s carries %v, want %v", k, got.NotificationIDs, want)
+				}
+			}
+			return true, ""
+		}
+	}
+	eventually(t, 30*time.Second, "monitors created with the default notification", carry(first))
+
+	second := f.webhook("second", true)
+	want := []int64{first, second}
+	slices.Sort(want)
+	eventually(t, 30*time.Second, "new default notification attached by a resync", carry(want...))
+
+	var live monitor.DNS
+	if err := f.raw.GetMonitorAs(t.Context(), byKey(f.owned())["default/probe"].ID, &live); err != nil {
+		t.Fatal(err)
+	}
+	live.NotificationIDs = nil
+	if err := f.raw.UpdateMonitor(t.Context(), &live); err != nil {
+		t.Fatal(err)
+	}
+	eventually(t, 30*time.Second, "notifications removed by hand restored by a resync", carry(want...))
+}
+
 // A monitor that lost its ownership tag in the UI must not get a twin when the
 // controller restarts: the resource reports NotOwned and nothing is created.
 func TestE2ETagRemovedNeverDuplicates(t *testing.T) {

ci/images/kuma-sync/internal/controller/kumamonitor_controller.go

@@ -129,22 +129,28 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 	if fail != nil {
 		return r.fail(ctx, km, fail)
 	}
+	notifications, err := r.Kuma.DefaultNotifications(ctx)
+	if err != nil {
+		return r.fail(ctx, km, &failure{ReasonKumaUnavailable, msgKumaUnavailable, err})
+	}
+	desired.NotificationIDs = notifications
 
 	var id int64
 	if res.mon == nil {
 		// The monitor this resource synced before may have lost its tag; a
-		// second one would then sit beside it.
+		// second one would then sit beside it. An ID now carrying another
+		// owner's key was reused by Kuma, so ours is gone.
 		if prev := km.Status.MonitorID; prev != 0 {
 			found, key, err := r.Kuma.Probe(ctx, prev)
 			switch {
 			case err != nil:
 				return r.fail(ctx, km, &failure{ReasonKumaUnavailable, msgKumaUnavailable, err})
-			case found && key != desired.OwnerKey:
+			case found && key == "":
 				log.FromContext(ctx).Error(nil, "previous monitor exists without our ownership tag, not creating another",
 					"ownerKey", desired.OwnerKey, "monitorID", prev, "tagValue", key)
 				err := r.setReady(ctx, km, metav1.ConditionFalse, ReasonNotOwned, msgNotOwned, nil)
 				return ctrl.Result{RequeueAfter: r.resync()}, err
-			case found:
+			case found && key == desired.OwnerKey:
 				return r.fail(ctx, km, &failure{ReasonKumaUnavailable, msgKumaUnavailable,
 					fmt.Errorf("monitor %d carries our key but is missing from the owned list", prev)})
 			}

ci/images/kuma-sync/internal/controller/kumamonitor_controller_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 	"testing"
 	"time"
 
@@ -310,6 +311,79 @@ func TestReconcileListErrorNoCreate(t *testing.T) {
 	}
 }
 
+func TestReconcileCreateGetsDefaultNotifications(t *testing.T) {
+	group := &v1.KumaMonitor{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "grp"},
+		Spec:       v1.KumaMonitorSpec{Type: "group", DisplayName: "grp", Interval: 60, RetryInterval: 60},
+	}
+	e := newEnv(t, httpMonitor("a"), group)
+	e.kuma.SetDefaultNotifications(7, 3)
+	for _, name := range []string{"a", "grp"} {
+		if _, err := e.reconcile(t, name); err != nil {
+			t.Fatal(err)
+		}
+		got := e.kuma.Get(e.get(t, name).Status.MonitorID)
+		if got == nil || !slices.Equal(got.NotificationIDs, []int64{3, 7}) {
+			t.Errorf("%s: kuma monitor = %+v, want notifications [3 7]", name, got)
+		}
+	}
+}
+
+func TestReconcileRevertsNotificationDrift(t *testing.T) {
+	km := httpMonitor("a")
+	e := newEnv(t, km)
+	e.kuma.SetDefaultNotifications(1, 2)
+	drifted := Desired(km)
+	drifted.NotificationIDs = []int64{2, 9}
+	id, _ := e.kuma.Create(t.Context(), drifted)
+	if _, err := e.reconcile(t, "a"); err != nil {
+		t.Fatal(err)
+	}
+	if e.cnt.updates != 1 || e.cnt.creates != 0 {
+		t.Fatalf("updates=%d creates=%d", e.cnt.updates, e.cnt.creates)
+	}
+	if got := e.kuma.Get(id).NotificationIDs; !slices.Equal(got, []int64{1, 2}) {
+		t.Errorf("notifications = %v, want [1 2]", got)
+	}
+}
+
+func TestReconcileUnchangedNotificationsNoUpdate(t *testing.T) {
+	km := httpMonitor("a")
+	e := newEnv(t, km)
+	e.kuma.SetDefaultNotifications(4, 2)
+	existing := Desired(km)
+	existing.NotificationIDs = []int64{4, 2}
+	e.kuma.Create(t.Context(), existing)
+	for range 2 {
+		if _, err := e.reconcile(t, "a"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if e.cnt.updates != 0 || e.cnt.creates != 0 {
+		t.Fatalf("updates=%d creates=%d, want 0 and 0", e.cnt.updates, e.cnt.creates)
+	}
+}
+
+func TestReconcileNotificationListErrorNoWrite(t *testing.T) {
+	adopt := httpMonitor("b")
+	e := newEnv(t, httpMonitor("a"), adopt)
+	drifted := Desired(adopt)
+	drifted.Interval = 30
+	e.kuma.Create(t.Context(), drifted)
+	e.kuma.SetNotificationsErr(errors.New("boom"))
+	for _, name := range []string{"a", "b"} {
+		if _, err := e.reconcile(t, name); err == nil {
+			t.Fatalf("%s: expected error", name)
+		}
+		if c := ready(t, e.get(t, name)); c.Status != metav1.ConditionFalse || c.Reason != ReasonKumaUnavailable {
+			t.Errorf("%s: Ready = %+v", name, c)
+		}
+	}
+	if e.cnt.creates != 0 || e.cnt.updates != 0 {
+		t.Errorf("creates=%d updates=%d", e.cnt.creates, e.cnt.updates)
+	}
+}
+
 func TestReconcileOwnerTagMissing(t *testing.T) {
 	e := newEnv(t, httpMonitor("a"))
 	e.kuma.SetErrs(kumaclient.ErrOwnerTagMissing, nil, nil, nil)
@@ -428,7 +502,7 @@ func TestReconcileRefusesCreateBesideUntaggedPrevious(t *testing.T) {
 	}
 }
 
-func TestReconcileRefusesCreateBesideOtherOwnersMonitor(t *testing.T) {
+func TestReconcileCreatesWhenPreviousIDReusedByOtherOwner(t *testing.T) {
 	e := newEnv(t, withPreviousMonitor(1))
 	if _, err := e.kuma.Create(t.Context(), kumaclient.Monitor{Name: "x", OwnerKey: "default/other"}); err != nil {
 		t.Fatal(err)
@@ -436,12 +510,15 @@ func TestReconcileRefusesCreateBesideOtherOwnersMonitor(t *testing.T) {
 	if _, err := e.reconcile(t, "a"); err != nil {
 		t.Fatal(err)
 	}
-	if e.cnt.creates != 0 {
-		t.Errorf("creates = %d, want 0", e.cnt.creates)
+	if e.cnt.creates != 1 {
+		t.Errorf("creates = %d, want 1", e.cnt.creates)
 	}
-	if c := ready(t, e.get(t, "a")); c.Reason != ReasonNotOwned {
+	if c := ready(t, e.get(t, "a")); c.Reason != ReasonSynced {
 		t.Errorf("Ready = %+v", c)
 	}
+	if m := e.kuma.Get(1); m == nil || m.OwnerKey != "default/other" {
+		t.Errorf("other owner's monitor 1 = %+v, want untouched", m)
+	}
 }
 
 func TestReconcileCreatesWhenPreviousMonitorIsGone(t *testing.T) {

ci/images/kuma-sync/internal/kumaclient/breml.go

@@ -13,6 +13,7 @@ import (
 
 	kuma "github.com/breml/go-uptime-kuma-client"
 	"github.com/breml/go-uptime-kuma-client/monitor"
+	"github.com/breml/go-uptime-kuma-client/notification"
 	"github.com/breml/go-uptime-kuma-client/tag"
 )
 
@@ -373,8 +374,8 @@ func (b *Breml) update(ctx context.Context, m Monitor) error {
 		return fmt.Errorf("update %d: monitor carries owner key %q, not %q: %w", m.ID, key, m.OwnerKey, ErrNotOwned)
 	}
 	// Start from the full current object, also across a type change, so
-	// fields we do not manage (notifications, proxy, resend interval, upside
-	// down, auth) survive the overwrite.
+	// fields we do not manage (proxy, resend interval, upside down, auth)
+	// survive the overwrite.
 	wire, err := toWire(m, &cur)
 	if err != nil {
 		return err
@@ -404,18 +405,42 @@ func (b *Breml) Delete(ctx context.Context, id int64) error {
 	return err
 }
 
+// DefaultNotifications reads the notification list cached by the session.
+// Kuma has no command to request it: it pushes the list at login and to every
+// session of the user after each change.
+func (b *Breml) DefaultNotifications(ctx context.Context) ([]int64, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return defaultIDs(b.c.GetNotifications(ctx)), nil
+}
+
+func defaultIDs(list []notification.Base) []int64 {
+	var ids []int64
+	for _, n := range list {
+		if n.IsDefault {
+			ids = append(ids, n.ID)
+		}
+	}
+	slices.Sort(ids)
+	return ids
+}
+
 // toDomain converts a monitor from the Kuma monitor list.
 func toDomain(base monitor.Base, ownerKey string) (Monitor, error) {
 	m := Monitor{
-		ID:            base.ID,
-		Type:          base.Type(),
-		Name:          base.Name,
-		Parent:        base.Parent,
-		Active:        base.IsActive,
-		Interval:      int32(base.Interval),
-		RetryInterval: int32(base.RetryInterval),
-		MaxRetries:    int32(base.MaxRetries),
-		OwnerKey:      ownerKey,
+		ID:              base.ID,
+		Type:            base.Type(),
+		Name:            base.Name,
+		Parent:          base.Parent,
+		Active:          base.IsActive,
+		Interval:        int32(base.Interval),
+		RetryInterval:   int32(base.RetryInterval),
+		MaxRetries:      int32(base.MaxRetries),
+		NotificationIDs: slices.Clone(base.NotificationIDs),
+		OwnerKey:        ownerKey,
 	}
 	if base.Description != nil {
 		m.Description = *base.Description
@@ -565,6 +590,7 @@ func writeBase(b *monitor.Base, m Monitor) {
 	b.RetryInterval = int64(m.RetryInterval)
 	b.MaxRetries = int64(m.MaxRetries)
 	b.IsActive = m.Active
+	b.NotificationIDs = slices.Clone(m.NotificationIDs)
 }
 
 // writeHTTP expects m to be normalized.

ci/images/kuma-sync/internal/kumaclient/breml_integration_test.go

@@ -287,12 +287,10 @@ func TestUpdateKeepsUnchangedFields(t *testing.T) {
 	}
 }
 
-// setUnmanaged sets state through the raw library that Monitor does not model.
-func setUnmanaged(t *testing.T, b *Breml, id int64) (notificationID int64) {
+func createWebhook(t *testing.T, b *Breml, name string, isDefault bool) int64 {
 	t.Helper()
-	ctx := context.Background()
-	nid, err := b.c.CreateNotification(ctx, &notification.Webhook{
-		Base: notification.Base{Name: "n", IsActive: true},
+	nid, err := b.c.CreateNotification(context.Background(), &notification.Webhook{
+		Base: notification.Base{Name: name, IsActive: true, IsDefault: isDefault},
 		WebhookDetails: notification.WebhookDetails{
 			WebhookURL: "http://example.com/hook", WebhookContentType: "application/json",
 		},
@@ -300,6 +298,15 @@ func setUnmanaged(t *testing.T, b *Breml, id int64) (notificationID int64) {
 	if err != nil {
 		t.Fatalf("create notification: %v", err)
 	}
+	return nid
+}
+
+// setUnmanaged sets state through the raw library that Monitor does not
+// model, and attaches a notification by hand.
+func setUnmanaged(t *testing.T, b *Breml, id int64) (notificationID int64) {
+	t.Helper()
+	ctx := context.Background()
+	nid := createWebhook(t, b, "n", false)
 	var kw monitor.HTTPKeyword
 	if err := b.c.GetMonitorAs(ctx, id, &kw); err != nil {
 		t.Fatal(err)
@@ -313,16 +320,15 @@ func setUnmanaged(t *testing.T, b *Breml, id int64) (notificationID int64) {
 	return nid
 }
 
-func assertUnmanaged(t *testing.T, c *Breml, id, nid int64, when string) {
+func assertUnmanaged(t *testing.T, c *Breml, id int64, when string) {
 	t.Helper()
 	var base monitor.Base
 	base, err := c.c.GetMonitor(t.Context(), id)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !base.UpsideDown || base.ResendInterval != 7 || !reflect.DeepEqual(base.NotificationIDs, []int64{nid}) {
-		t.Errorf("%s: unmanaged state lost: upsideDown=%v resend=%d notifications=%v",
-			when, base.UpsideDown, base.ResendInterval, base.NotificationIDs)
+	if !base.UpsideDown || base.ResendInterval != 7 {
+		t.Errorf("%s: unmanaged state lost: upsideDown=%v resend=%d", when, base.UpsideDown, base.ResendInterval)
 	}
 }
 
@@ -362,14 +368,15 @@ func TestUpdatePreservesUnmanagedAndClearsManaged(t *testing.T) {
 		t.Fatal(err)
 	}
 	m := byID(got)[id]
-	if m.Parent != nil || m.Headers != nil || m.Keyword != "" || m.Interval != 90 {
+	if m.Parent != nil || m.Headers != nil || m.Keyword != "" || m.Interval != 90 || m.NotificationIDs != nil {
 		t.Errorf("managed fields not cleared: %+v", m)
 	}
-	assertUnmanaged(t, fresh, id, nid, "after plain update")
+	assertUnmanaged(t, fresh, id, "after plain update")
 
 	// Type change must not wipe unmanaged state either.
 	changed := cleared
 	changed.Type = "http"
+	changed.NotificationIDs = []int64{nid}
 	if err := b.Update(ctx, changed); err != nil {
 		t.Fatal(err)
 	}
@@ -377,10 +384,55 @@ func TestUpdatePreservesUnmanagedAndClearsManaged(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if m := byID(got)[id]; m.Type != "http" {
-		t.Errorf("type = %q, want http", m.Type)
+	if m := byID(got)[id]; m.Type != "http" || !reflect.DeepEqual(m.NotificationIDs, []int64{nid}) {
+		t.Errorf("type = %q, notifications = %v, want http and [%d]", m.Type, m.NotificationIDs, nid)
+	}
+	assertUnmanaged(t, fresh, id, "after type change")
+}
+
+func TestDefaultNotificationsAndWrite(t *testing.T) {
+	ctx := context.Background()
+	url := startKuma(t)
+	b := setupClient(t, url)
+	other := freshClient(t, url)
+
+	if ids, err := other.DefaultNotifications(ctx); err != nil || ids != nil {
+		t.Fatalf("no notifications: ids=%v err=%v", ids, err)
+	}
+	def := createWebhook(t, b, "default", true)
+	createWebhook(t, b, "opt-in", false)
+	// Kuma pushes the list to every session of the user, not only the writer.
+	deadline := time.Now().Add(10 * time.Second)
+	for {
+		ids, err := other.DefaultNotifications(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if reflect.DeepEqual(ids, []int64{def}) {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("other session sees defaults %v, want [%d]", ids, def)
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+
+	m := Monitor{
+		Type: "group", Name: "grp", Active: true, Interval: 60, RetryInterval: 60,
+		NotificationIDs: []int64{def}, OwnerKey: "default/grp",
+	}
+	id, err := b.Create(ctx, m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := freshClient(t, url).ListOwned(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	m.ID = id
+	if !reflect.DeepEqual(byID(got)[id], m.Normalized()) {
+		t.Errorf("read-back differs:\n got  %+v\n want %+v", byID(got)[id], m.Normalized())
 	}
-	assertUnmanaged(t, fresh, id, nid, "after type change")
 }
 
 func TestRestartAdoptsByTag(t *testing.T) {

ci/images/kuma-sync/internal/kumaclient/client.go

@@ -63,6 +63,7 @@ func Conflicts(err error) (conflicts []*ConflictError, only bool) {
 func (m Monitor) clone() Monitor {
 	m.Headers = maps.Clone(m.Headers)
 	m.AcceptedStatusCodes = slices.Clone(m.AcceptedStatusCodes)
+	m.NotificationIDs = slices.Clone(m.NotificationIDs)
 	if m.Parent != nil {
 		p := *m.Parent
 		m.Parent = &p
@@ -80,12 +81,18 @@ func isHTTPFamily(typ string) bool {
 // For http, keyword and json-query: an empty Method becomes GET, empty
 // AcceptedStatusCodes become ["200-299"], and Timeout 0 becomes
 // round(0.8*Interval). For all other types Timeout is stored as 0 and the
-// HTTP-only slices are nil. Empty Headers become nil. It is idempotent.
+// HTTP-only slices are nil. Empty Headers become nil. NotificationIDs are
+// sorted and deduplicated, empty becomes nil. It is idempotent.
 func (m Monitor) Normalized() Monitor {
 	m = m.clone()
 	if len(m.Headers) == 0 {
 		m.Headers = nil
 	}
+	slices.Sort(m.NotificationIDs)
+	m.NotificationIDs = slices.Compact(m.NotificationIDs)
+	if len(m.NotificationIDs) == 0 {
+		m.NotificationIDs = nil
+	}
 	if len(m.AcceptedStatusCodes) == 0 {
 		m.AcceptedStatusCodes = nil
 	}
@@ -143,6 +150,9 @@ type Monitor struct {
 	DNSResolveType   string
 	DNSResolveServer string
 
+	// NotificationIDs are the Kuma notifications attached to the monitor.
+	NotificationIDs []int64
+
 	// OwnerKey is the value of the kuma-sync tag; "" means not ours.
 	OwnerKey string
 }
@@ -170,4 +180,7 @@ type Client interface {
 	// Delete removes an owned monitor. It wraps ErrNotFound for an unknown ID
 	// and ErrNotOwned for a monitor without the kuma-sync tag.
 	Delete(ctx context.Context, id int64) error
+	// DefaultNotifications returns the IDs of all notifications marked
+	// "default enabled" in Kuma, sorted. An empty result is valid.
+	DefaultNotifications(ctx context.Context) ([]int64, error)
 }

ci/images/kuma-sync/internal/kumaclient/fake.go

@@ -3,6 +3,7 @@ package kumaclient
 import (
 	"context"
 	"fmt"
+	"slices"
 	"sort"
 	"sync"
 )
@@ -20,6 +21,10 @@ type Fake struct {
 	UpdateErr error
 	DeleteErr error
 	ProbeErr  error
+	// NotificationsErr is returned by DefaultNotifications.
+	NotificationsErr error
+	// Defaults are the IDs DefaultNotifications returns.
+	Defaults []int64
 	// ListPartial makes ListOwned return the stored monitors together with
 	// ListErr, as the real client does for owner conflicts.
 	ListPartial bool
@@ -90,6 +95,32 @@ func (f *Fake) Probe(_ context.Context, id int64) (bool, string, error) {
 	return ok, m.OwnerKey, nil
 }
 
+// SetDefaultNotifications sets the IDs DefaultNotifications returns.
+func (f *Fake) SetDefaultNotifications(ids ...int64) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.Defaults = slices.Clone(ids)
+}
+
+// SetNotificationsErr makes DefaultNotifications return err.
+func (f *Fake) SetNotificationsErr(err error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.NotificationsErr = err
+}
+
+// DefaultNotifications returns Defaults, sorted.
+func (f *Fake) DefaultNotifications(_ context.Context) ([]int64, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.NotificationsErr != nil {
+		return nil, f.NotificationsErr
+	}
+	ids := slices.Clone(f.Defaults)
+	slices.Sort(ids)
+	return ids, nil
+}
+
 func (f *Fake) allocID() int64 {
 	id := f.nextID
 	f.nextID++

ci/images/kuma-sync/internal/kumaclient/fake_test.go

@@ -118,6 +118,21 @@ func TestFakeInjectedErrors(t *testing.T) {
 	}
 }
 
+func TestFakeDefaultNotifications(t *testing.T) {
+	f := NewFake()
+	if ids, err := f.DefaultNotifications(context.Background()); err != nil || ids != nil {
+		t.Fatalf("empty: %v %v", ids, err)
+	}
+	f.SetDefaultNotifications(4, 1)
+	if ids, err := f.DefaultNotifications(context.Background()); err != nil || len(ids) != 2 || ids[0] != 1 || ids[1] != 4 {
+		t.Fatalf("set: %v %v", ids, err)
+	}
+	f.SetNotificationsErr(errors.New("boom"))
+	if _, err := f.DefaultNotifications(context.Background()); err == nil {
+		t.Error("expected injected error")
+	}
+}
+
 func TestFakeUpdateRejectsOtherOwnerKey(t *testing.T) {
 	f := NewFake()
 	id, _ := f.Create(context.Background(), Monitor{Name: "a", OwnerKey: "ns/a"})

ci/images/kuma-sync/internal/kumaclient/logic_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	kuma "github.com/breml/go-uptime-kuma-client"
+	"github.com/breml/go-uptime-kuma-client/notification"
 	"github.com/breml/go-uptime-kuma-client/tag"
 )
 
@@ -167,3 +168,29 @@ func TestFakeStoresNormalized(t *testing.T) {
 		t.Fatalf("fake did not normalize: %+v", got)
 	}
 }
+
+func TestNormalizedNotificationIDs(t *testing.T) {
+	in := Monitor{Type: "group", NotificationIDs: []int64{10, 2, 10}}
+	got := in.Normalized()
+	if !reflect.DeepEqual(got.NotificationIDs, []int64{2, 10}) {
+		t.Errorf("notifications = %v, want [2 10]", got.NotificationIDs)
+	}
+	if !reflect.DeepEqual(in.NotificationIDs, []int64{10, 2, 10}) {
+		t.Errorf("Normalized changed its receiver: %v", in.NotificationIDs)
+	}
+	if e := (Monitor{Type: "group", NotificationIDs: []int64{}}).Normalized(); e.NotificationIDs != nil {
+		t.Errorf("empty notifications must be nil: %v", e.NotificationIDs)
+	}
+}
+
+func TestDefaultIDs(t *testing.T) {
+	got := defaultIDs([]notification.Base{
+		{ID: 5, IsDefault: true}, {ID: 1}, {ID: 3, IsDefault: true},
+	})
+	if !reflect.DeepEqual(got, []int64{3, 5}) {
+		t.Errorf("defaultIDs = %v, want [3 5]", got)
+	}
+	if got := defaultIDs(nil); got != nil {
+		t.Errorf("defaultIDs(nil) = %v, want nil", got)
+	}
+}

ci/images/netbird-service-sync/Containerfile

@@ -2,7 +2,7 @@
 # domains -> TLS passthrough -> Traefik ClusterIP) from Ingresses carrying the
 # public label. Standard library only, so the image is the interpreter plus one
 # file; runs unprivileged as its own user.
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
 
 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY controller.py /opt/controller.py

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -974,6 +974,71 @@ data:
           negate: false
           failure_result: false
 
+      # Hermes Agent dashboard (apps/hermes): its self-hosted OIDC login,
+      # also brokered for Hermes Desktop's native sign-in. Public client +
+      # PKCE (Hermes does not support confidential clients); RS256 so the
+      # dashboard can verify the ID token against the JWKS.
+      - id: hermes-users-group
+        model: authentik_core.group
+        identifiers:
+          name: Hermes Users
+        state: present
+        attrs:
+          is_superuser: false
+          # Members get the agent, which holds a read-only kubeconfig and
+          # the model login. Add/remove members HERE.
+          users:
+            - !Find [authentik_core.user, [username, k.renner]]
+
+      - id: hermes-provider
+        model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: Hermes Dashboard
+        state: present
+        attrs:
+          authentication_flow: null
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: public
+          client_id: hermes-dashboard
+          # See the Matrix (MAS) provider: a blueprint-made provider starts
+          # with no grant types.
+          grant_types:
+            - authorization_code
+            - refresh_token
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+          redirect_uris:
+            - url: https://hermes.renner.uno/auth/callback
+              matching_mode: strict
+
+      # The slug is the issuer path: https://auth.renner.uno/application/o/hermes/
+      - model: authentik_core.application
+        identifiers:
+          slug: hermes
+        state: present
+        attrs:
+          name: Hermes
+          slug: hermes
+          provider: !KeyOf hermes-provider
+          meta_launch_url: https://hermes.renner.uno
+          meta_description: "Hermes Agent dashboard"
+
+      # Only the Hermes Users group passes.
+      - model: authentik_policies.policybinding
+        identifiers:
+          target: !Find [authentik_core.application, [slug, hermes]]
+          group: !KeyOf hermes-users-group
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: false
+
       # OpenProject, decommissioned. Application first: Application.provider
       # is on_delete=PROTECT. Its policy binding cascades with it.
       - model: authentik_core.application

kubernetes/apps/authentik/gate-sync.yaml

@@ -114,7 +114,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: controller
-          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-15-0857 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
+          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-19-0544 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

kubernetes/apps/hermes/api-key.yaml

@@ -0,0 +1,32 @@
+# Bearer key for the OpenAI-compatible API server (hermes-api.renner.uno).
+# Generated once in-cluster, nothing in OpenBao. Read it with
+#   kubectl -n hermes get secret hermes-api-key -o jsonpath='{.data.API_SERVER_KEY}' | base64 -d
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: hermes-api-key
+  namespace: hermes
+spec:
+  length: 64
+  digits: 16
+  symbols: 0
+  allowRepeat: true
+  noUpper: false
+  secretKeys:
+    - API_SERVER_KEY
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hermes-api-key
+  namespace: hermes
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: hermes-api-key
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: hermes-api-key

kubernetes/apps/hermes/hermes.yaml

@@ -0,0 +1,170 @@
+# All Hermes state: config.yaml, .env (keys entered in the dashboard), auth.json
+# (the Anthropic OAuth login), sessions, memories, skills, cron. Mounted at
+# /opt/data, the image's HERMES_HOME.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: hermes-data
+  namespace: hermes
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ceph-block
+  resources:
+    requests:
+      storage: 10Gi
+---
+# Hermes Agent: the gateway (messaging platforms, cron, API server on 8642) and
+# the dashboard (9119, also the Hermes Desktop remote-gateway backend), both
+# supervised by the image's s6-overlay. s6 must be PID 1 and starts as root,
+# remapping and dropping to the `hermes` user (10000).
+#
+# One replica, Recreate: two gateways must never share one data directory.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hermes
+  namespace: hermes
+  labels:
+    app.kubernetes.io/name: hermes
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hermes
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: hermes
+    spec:
+      serviceAccountName: hermes
+      securityContext:
+        fsGroup: 10000
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # The dashboard trusts X-Forwarded-* only from listed peers; Traefik
+        # connects from the pod network. No env equivalent exists, so it is
+        # set in config.yaml on every start (idempotent).
+        - name: config
+          image: nousresearch/hermes-agent:v2026.9.24 # {"$imagepolicy": "flux-system:hermes"}
+          command:
+            - /opt/hermes/.venv/bin/hermes
+            - config
+            - set
+            - dashboard.trusted_proxies
+            - '["10.244.0.0/16","fd10:244::/48"]'
+          env:
+            - name: HERMES_HOME
+              value: /opt/data
+            - name: HOME
+              value: /opt/data
+          securityContext:
+            runAsUser: 10000
+            runAsGroup: 10000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: data
+              mountPath: /opt/data
+        # kubectl for the agent. /opt/data/.local/bin is on the image's PATH;
+        # an emptyDir there keeps the binary out of the PVC and current with
+        # this pin.
+        - name: kubectl
+          image: docker.io/alpine/kubectl:1.37.1@sha256:b568e8beb6a79aee269c142343078a278b85e7710f1c0e7d8d6b21d1eb566a48
+          command: ["cp", "/usr/local/bin/kubectl", "/tools/kubectl"]
+          securityContext:
+            runAsUser: 10000
+            runAsGroup: 10000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: tools
+              mountPath: /tools
+      containers:
+        - name: hermes
+          image: nousresearch/hermes-agent:v2026.9.24 # {"$imagepolicy": "flux-system:hermes"}
+          args: ["gateway", "run"]
+          env:
+            - name: HERMES_DASHBOARD
+              value: "1"
+            - name: HERMES_DASHBOARD_PUBLIC_URL
+              value: https://hermes.renner.uno
+            # Dashboard login: Authentik OIDC, public PKCE client (blueprint
+            # in apps/authentik/blueprints-configmap.yaml, group Hermes Users).
+            - name: HERMES_DASHBOARD_OIDC_ISSUER
+              value: https://auth.renner.uno/application/o/hermes/
+            - name: HERMES_DASHBOARD_OIDC_CLIENT_ID
+              value: hermes-dashboard
+            - name: API_SERVER_ENABLED
+              value: "true"
+            - name: API_SERVER_HOST
+              value: 0.0.0.0
+          envFrom:
+            - secretRef:
+                name: hermes-api-key
+          ports:
+            - name: dashboard
+              containerPort: 9119
+            - name: api
+              containerPort: 8642
+          # The dashboard is the user-facing surface; /api/status is public.
+          startupProbe:
+            httpGet:
+              path: /api/status
+              port: dashboard
+            periodSeconds: 10
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /api/status
+              port: dashboard
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /api/status
+              port: dashboard
+            periodSeconds: 60
+            timeoutSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              memory: 4Gi
+          volumeMounts:
+            - name: data
+              mountPath: /opt/data
+            - name: tools
+              mountPath: /opt/data/.local/bin
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: hermes-data
+        - name: tools
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes
+  namespace: hermes
+  labels:
+    app.kubernetes.io/name: hermes
+spec:
+  selector:
+    app.kubernetes.io/name: hermes
+  ports:
+    - name: dashboard
+      port: 9119
+      targetPort: dashboard
+    - name: api
+      port: 8642
+      targetPort: api

kubernetes/apps/hermes/ingress.yaml

@@ -0,0 +1,59 @@
+# Both hosts are LAN-only (no dns.renner.uno/public or netbird.renner.uno/public
+# label).
+#
+# hermes.renner.uno — dashboard and Hermes Desktop remote gateway. Plain
+# Traefik, not the authentik-gate class: Hermes Desktop calls the API with a
+# Bearer token from its native (PKCE) sign-in, which a forward-auth gate would
+# redirect. Authentik still guards it: the dashboard's own OIDC login against
+# the `hermes` application, restricted to the Hermes Users group.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hermes
+  namespace: hermes
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - hermes.renner.uno
+      secretName: hermes-tls
+  rules:
+    - host: hermes.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: hermes
+                port:
+                  number: 9119
+---
+# hermes-api.renner.uno — the OpenAI-compatible API server. Hermes checks
+# `Authorization: Bearer <API_SERVER_KEY>` itself (secret hermes-api-key).
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hermes-api
+  namespace: hermes
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - hermes-api.renner.uno
+      secretName: hermes-api-tls
+  rules:
+    - host: hermes-api.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: hermes
+                port:
+                  number: 8642

kubernetes/apps/hermes/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - rbac.yaml
+  - api-key.yaml
+  - hermes.yaml
+  - ingress.yaml

kubernetes/apps/hermes/rbac.yaml

@@ -0,0 +1,22 @@
+# Read-only cluster access for the agent's kubectl, as for claude-workstation:
+# the built-in `view` ClusterRole, which excludes Secrets. The token is the
+# pod's projected ServiceAccount token; kubectl picks it up as in-cluster
+# config.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: hermes
+  namespace: hermes
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: hermes-view
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: view
+subjects:
+  - kind: ServiceAccount
+    name: hermes
+    namespace: hermes

kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml

@@ -61,7 +61,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: shelly-manager
-          image: gitea.renner.uno/k.renner/shelly-manager:build.1791777553 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/k.renner/shelly-manager:build.1792387459 # {"$imagepolicy": "flux-system:shelly-manager"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

kubernetes/apps/home-assistant/deployment.yaml

@@ -159,7 +159,7 @@ spec:
         # substitution to POD_IP so nginx-runtime variables like $host
         # / $http_x_forwarded_for in the template stay intact.
         - name: proxy
-          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b9241c6e7b8e9a862f129d8d4199ab64b10390949a78bdd5603379b32c844083
+          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:378d0c32f6562f7fd9629170797f57d2b953aa09be983b3daaf4809bb039ca00
           env:
             - name: POD_IP
               valueFrom:
@@ -203,7 +203,7 @@ spec:
         # readiness probe on purpose: a broker outage must not take HA out of
         # its Service endpoints.
         - name: mqtt-tls
-          image: ghostunnel/ghostunnel:v1.11.3@sha256:2599b8a04bae16d70a4209495618dea61b46a00a9a05fcf74da282688ad3517f
+          image: ghostunnel/ghostunnel:v1.11.4@sha256:e5248233863aadd36383a11c92360f2981141881ef05e38360a6ada8630d36b1
           args:
             - client
             - --listen=127.0.0.1:11883
@@ -304,7 +304,7 @@ spec:
         # dedicated long-lived token.
         # Runs as root to match HA's root-owned /config files. See config-sync.sh.
         - name: config-sync
-          image: alpine/git:2.54.0@sha256:ce84fd6a057b4dc5cf5009da2dd832f1c6d096c1984bf50496cf3c256402264d
+          image: alpine/git:2.54.0@sha256:03228d7ded483b0b3e55e1de7fa660d70d3e1bb432fa7021d29e192640de11aa
           command: ["/bin/sh", "/scripts/sync.sh"]
           env:
             - name: SYNC_BRANCH

kubernetes/apps/review-bot/deployment.yaml

@@ -32,7 +32,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: review-bot
-          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-18-0706 # {"$imagepolicy": "flux-system:review-bot"}
+          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-19-0540 # {"$imagepolicy": "flux-system:review-bot"}
           env:
             - name: REPOS
               value: k.renner/homelab,konairius/homeassistant,konairius/authentik-samba-bridge,konairius/shelly-manager

kubernetes/clusters/homelab/hermes.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: hermes
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./kubernetes/apps/hermes
+  prune: true
+  wait: true
+  dependsOn:
+    - name: infrastructure
+    - name: infrastructure-crds

kubernetes/infrastructure/image-automation/gitea-mcp.yaml

@@ -4,7 +4,7 @@ metadata:
   name: gitea-mcp
   namespace: flux-system
 spec:
-  image: docker.gitea.com/gitea-mcp-server
+  image: docker.gitea.com/gitea-mcp-server@sha256:20701c3dcf3b71df384417d04f9f6382205b7f362380b258fb8e4dcf9599091f
   interval: 1h
 ---
 apiVersion: image.toolkit.fluxcd.io/v1

kubernetes/infrastructure/image-automation/hermes.yaml

@@ -0,0 +1,24 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: hermes
+  namespace: flux-system
+spec:
+  image: nousresearch/hermes-agent
+  interval: 1h
+---
+# v-prefix tags (v0.22.2). The filter skips rc.*, -desktop and per-arch tags.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: hermes
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: hermes
+  filterTags:
+    pattern: '^v(?P<ver>\d+\.\d+\.\d+)$'
+    extract: '$ver'
+  policy:
+    semver:
+      range: ">=0.22.2"

kubernetes/infrastructure/image-automation/kustomization.yaml

@@ -10,6 +10,7 @@ resources:
   - gatus.yaml
   - gitea-mcp.yaml
   - gotenberg.yaml
+  - hermes.yaml
   - home-assistant.yaml
   - immich.yaml
   - kuma-sync.yaml

kubernetes/infrastructure/namespaces/namespaces.yaml

@@ -294,3 +294,12 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: kuma-sync
+---
+# Hermes Agent (kubernetes/apps/hermes). Declared here so it exists before
+# infrastructure-crds applies its CNPs. No pod-security labels: the image's
+# s6-overlay init starts as root and drops to the `hermes` user, which the
+# cluster's default `baseline` enforcement allows.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hermes

kubernetes/infrastructure/network-policies/hermes-ns.yaml

@@ -0,0 +1,137 @@
+---
+# Baseline policy for the `hermes` namespace (Hermes Agent, apps/hermes).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-deny
+  namespace: hermes
+spec:
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+    - fromEntities:
+        - host
+        - remote-node
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    # Every LAN hostname (gitea, home, auth for the dashboard's OIDC
+    # discovery, matrix) via Traefik.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+---
+# The agent itself: model APIs (api.anthropic.com), web tools, messaging
+# platforms, read-only kubectl, and the monitoring read APIs. The matching
+# ingress grant on the monitoring side is monitoring-ns.yaml
+# (monitoring-allow-hermes).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hermes-egress
+  namespace: hermes
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: hermes
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+            - port: "80"
+              protocol: TCP
+    # `kube-apiserver` is its own entity in Cilium; port is the post-DNAT 6443.
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+            app.kubernetes.io/name: prometheus
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+            app.kubernetes.io/name: alertmanager
+      toPorts:
+        - ports:
+            - port: "9093"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+            app.kubernetes.io/name: loki
+      toPorts:
+        - ports:
+            - port: "3100"
+              protocol: TCP
+---
+# Traefik serves the dashboard (9119) and the OpenAI-compatible API (8642).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hermes-allow-traefik
+  namespace: hermes
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: hermes
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+      toPorts:
+        - ports:
+            - port: "9119"
+              protocol: TCP
+            - port: "8642"
+              protocol: TCP

kubernetes/infrastructure/network-policies/kustomization.yaml

@@ -34,5 +34,6 @@ resources:
   - uptime-monitor-ns.yaml
   - kuma-sync-ns.yaml
   - renovate-ns.yaml
+  - hermes-ns.yaml
   - allow-cilium-health.yaml
   - kube-system-hubble-relay.yaml

kubernetes/infrastructure/network-policies/monitoring-ns.yaml

@@ -57,3 +57,30 @@ spec:
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
             - { type: 143, family: IPv6 }
+---
+# Hermes Agent (hermes ns) reads metrics, alerts and logs: the Prometheus,
+# Alertmanager and Loki HTTP APIs, scoped to those pods and ports.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: monitoring-allow-hermes
+  namespace: monitoring
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values: [prometheus, alertmanager, loki]
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+            app.kubernetes.io/name: hermes
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+            - port: "9093"
+              protocol: TCP
+            - port: "3100"
+              protocol: TCP

kubernetes/infrastructure/openbao/helmrelease.yaml

@@ -24,7 +24,7 @@ spec:
       # window. The StatefulSet rolls one pod at a time (updateStrategyType
       # below). Undo after a pod has run the new server = restore the
       # snapshot, not a git revert.
-      version: ">=0.30.3 <0.31.0"
+      version: ">=0.30.4 <0.31.0"
       sourceRef:
         kind: HelmRepository
         name: openbao

kubernetes/infrastructure/velero/backup-verify-cronjob.yaml

@@ -32,7 +32,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: backup-verify
-              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-15 # {"$imagepolicy": "flux-system:backup-verify"}
+              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-19 # {"$imagepolicy": "flux-system:backup-verify"}
               command: ["bash", "/script/backup-verify.sh"]
               env:
                 - name: HOME

kubernetes/restore-test/egress-check.yaml

@@ -11,7 +11,7 @@ spec:
   restartPolicy: Never
   containers:
     - name: check
-      image: docker.io/nicolaka/netshoot:v0.13
+      image: docker.io/nicolaka/netshoot:v0.13@sha256:a20c2531bf35436ed3766cd6cfe89d352b050ccc4d7005ce6400adf97503da1b
       command:
         - /bin/bash
         - -c