honeyDueAPI

admin/honeyDueAPI

Fork 0

Files

T

History

Trey t 93fddc3769

Backend CI / Test (push) Has been cancelled

Details

Backend CI / Contract Tests (push) Has been cancelled

Details

Backend CI / Lint (push) Has been cancelled

Details

Backend CI / Secret Scanning (push) Has been cancelled

Details

Backend CI / Build (push) Has been cancelled

Details

feat(observability): ship pod logs to Loki via Grafana Alloy

Adds a Grafana Alloy DaemonSet that tails honeydue-namespace pod logs
from /var/log/pods and pushes them to Loki at obs.88oakapps.com,
reusing the existing OBS_INGEST_TOKEN (14-day retention).

- deploy-k3s/manifests/observability/alloy-logs.yaml — DaemonSet + RBAC
  + token Secret + Alloy config. Runs as root (/var/log/pods is 0750
  root:root) but otherwise locked down: all caps dropped, read-only
  root filesystem, seccomp RuntimeDefault, read-only hostPath mount.
- network-policies.yaml — allow-egress-from-alloy-logs (DNS + k8s API
  + obs HTTPS), mirroring the vmagent egress policy.
- 03-deploy.sh — applies alloy-logs with the OBS_INGEST_TOKEN
  substitution and waits for the DaemonSet rollout.

The Loki container, nginx /loki/api/v1/push route, and Grafana Loki
datasource live on the obs server and are not repo-managed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-17 20:04:09 -05:00

admin

fix(security): remediate 2026-05-12 audit findings (Stages 2–5)

2026-05-16 22:28:33 -05:00

api

fix(security): remediate 2026-05-12 audit findings (Stages 2–5)

2026-05-16 22:28:33 -05:00

ingress

fix(security): remediate 2026-05-12 audit findings (Stages 2–5)

2026-05-16 22:28:33 -05:00

migrate

fix(security): remediate 2026-05-12 audit findings (Stages 2–5)