v1.5

Changelog archive — v1.5

Moved verbatim from CHANGELOG.md; never edited.

[v1.5.4] - 2026-02-11

Bug Fixes

• Bump Fly.io proxy VM memory from 256MB to 512MB to prevent Alloy OOM kills.

Documentation

• Add plan documents for Dagger CI/CD adoption and upstream fork strategy.
• Add plan documents for OIDC provider adoption, zot registry hardening, and expanded network segmentation details.
• Review security-model.md: fix op CLI pattern, add Tailscale Operator section.

[v1.5.3] - 2026-02-11

Features

• Add BorgBase offsite backup repository for 3-2-1 backup strategy
• Fly.io proxy serves a friendly error page when upstreams are unreachable (indri offline, Tailscale tunnel down, etc.). Test at docs.eblu.me/_error.
• Add op-backup mise task for encrypted 1Password disaster recovery backups via borgmatic
• Add SMART disk health monitoring for sifaka NAS with smartctl_exporter, Grafana dashboard, Ansible playbook, and Caddy L4 routing via ops.eblu.me.

Bug Fixes

• Replace op item get --fields with op read in all mise tasks (tailnet-up, tailnet-preview, dns-up, dns-preview) to prevent multi-line secret corruption.
• Fix 502 errors during Fly.io proxy deploys by deferring health check until Tailscale is connected.
• Fix minikube ansible role not restarting cluster after power loss — status check only examined host VM state, missing stopped kubelet/apiserver.
• Log real client IPs in Fly.io proxy access logs using Fly-Client-IP header instead of showing the internal proxy address.

Infrastructure

• Switch CI container builds from deprecated docker build to docker buildx build (BuildKit).
• Install docker-buildx-plugin in forgejo-runner image to support docker buildx build.
• Eliminate 502 errors during Fly.io proxy deploys by starting nginx after Tailscale, switching to bluegreen deploys, and using service-level health checks for traffic gating.

Documentation

• Add troubleshooting guide for CNI conflict after unclean shutdown to restart-indri how-to.
• Add migration plan for Forgejo brew-to-source transition
• Document op read vs op item get convention for 1Password secret retrieval
• Add power infrastructure reference card documenting the battery-backed UPS chain (Anker SOLIX F2000 → CyberPower UPS → homelab).
• Add plan and reference card for UniFi Express 7 Pulumi IaC management.
• Add how-to guide for restoring 1Password backup from borgmatic, with cross-links from disaster recovery, borgmatic, 1password, and backup policy docs

[v1.5.2] - 2026-02-09

Features

• Filter blumeops-tasks to only show dated/recurring tasks when due today or earlier.
• Add docs-review mise task that sorts docs by last-reviewed frontmatter date, prioritizing never-reviewed cards. Updated the review-documentation how-to to match.

Bug Fixes

• Fix fly-deploy WARNING by starting nginx before Tailscale, deferring upstream DNS resolution to request time.

Infrastructure

• Migrate all Ansible op item get calls to op read URI syntax for cleaner output and remove the regex_replace workaround on the Fly deploy token.
• Restrict fly.io proxy ACLs to dedicated tag:flyio-target endpoints instead of broad tag:k8s and tag:homelab grants. Migrate all Tailscale Ingresses to a shared ProxyGroup with per-Ingress tag overrides (tag:flyio-target on docs, loki, prometheus). Add autoApprovers for VIP service routes. Enable --accept-routes on indri for ProxyGroup VIP routing.

[v1.5.1] - 2026-02-08

Features

• Add observability to Fly.io proxy: Alloy collects nginx access logs (→ Loki) and derived metrics (→ Prometheus), with Grafana dashboards for Docs APM and Fly.io proxy health.

Infrastructure

• Add docs.eblu.me and Fly.io health check to services-check

[v1.5.0] - 2026-02-08

Features

• Add Fly.io public reverse proxy infrastructure for exposing services to the internet (first target: docs.eblu.me)

Documentation

• Add how-to guide for exposing services publicly via Fly.io reverse proxy + Tailscale tunnel.
• Update docs for public proxy: canonical URL is now docs.eblu.me, add Fly.io proxy reference card and operations how-to