management

Files

T

Thore Cimbal e3958ebe51 issues: #0110 — the hardening that only existed on the host

Two write endpoints without authentication were bound to every interface in this
repository and to a private address on the machine. The machine was right. A pull
would have silently undone it, and the only reason it did not is that git refused
over an unrelated local edit.

The ports are fixed. What is not fixed is that nothing compares the working copy
on CFGMON to the repository — it was behind by four commits and locally modified
at the same time, and neither showed anywhere. The firewall rules themselves live
in no repository at all, which makes every statement about that host's exposure a
memory rather than a source.

Measured rather than asserted, and the measurement needed care: from my own
network all three ports look shut, but so does 443, because the firewall drops
that source first. Only from a host the firewall admits does the result mean
anything — there 443 answers and 9090 does not.

2026-08-21 12:00:00 +00:00

0001-matrix-03-www-matrix-axion1337-de-ist.md

docs(issues): close #0001 , #0003 — matrix/game www cleanup done

2026-08-14 12:00:00 +00:00

0002-game-01-host-von-cfgmon-aus-nicht-erreichbar-2.md

#0002 abgeschlossen: Game-Host ist angebunden, alle Targets up

2026-08-20 12:00:00 +00:00

0003-game-02-www-game-axion1337-de-ist-ueberfluessig.md

docs(issues): close #0001 , #0003 — matrix/game www cleanup done

2026-08-14 12:00:00 +00:00

0004-overmind-02-e1000e-nic-hang-beobachtung-nach.md

issues: M1 down to one — #0056 and #0004 struck, #0078 taken up

2026-08-21 12:00:00 +00:00

0005-zone-01-ionos-default-records-bereinigen-www.md

docs(issues): close #0005 — IONOS zone cleanup complete

2026-08-14 12:00:00 +00:00

0006-zone-02-apex-dmarc-ist-p-none-und-schuetzt.md

docs(issues): close #0006 — apex DMARC already at p=reject, DKIM present

2026-08-14 12:00:00 +00:00

0007-cfgmon-01-zertifikatserneuerung-braucht-offene.md

docs(issues): close #0007 done — DNS-01 live and verified

2026-08-14 12:00:00 +00:00

0008-cfgmon-03-prometheus-remote-write-und-loki.md

docs(issues): close #0008 with its reservation stated

2026-08-19 12:00:00 +00:00

0009-cfgmon-04-grafana-admin-credentials-aus-env.md

feat: slice 4 - the open management issues live in the repo

2026-08-11 12:00:00 +00:00

0010-cfgmon-09-gitea-backups-off-host-borg-storage.md

docs(issues): reject #0010 (Gitea is a mirror), age key escrow resolves #0030 risk

2026-08-14 12:00:00 +00:00

0014-cfgmon-14-root-zugang-ueber-die-docker-gruppe.md

docs(issues): review all waiting issues, close #0041 and #0025

2026-08-15 12:00:00 +00:00

0015-cfgmon-15-token-hygiene-einmal-tokens-der.md

docs(issues): defer token rotation to platform acceptance (#0015 , #0027 W4)

2026-08-15 12:00:00 +00:00

0018-doc-01-wiki-rollout-abschliessen-ci-freigaben.md

docs(issues): reject #0018 as moot, close #0028 as already running

2026-08-15 12:00:00 +00:00

0019-doc-02-veralteten-wiki-branch-im-gitops-repo.md

feat: slice 4 - the open management issues live in the repo

2026-08-11 12:00:00 +00:00

0020-doc-03-wiki-oberflaeche-entscheiden-docusaurus.md

docs: resolve wiki hostname + surface decisions, track the two follow-ups

2026-08-11 12:00:00 +00:00

0021-overmind-03-windows-build-vm-verschwindet-ci.md

docs(issues): review all waiting issues, close #0041 and #0025

2026-08-15 12:00:00 +00:00

0022-build-01-macos-client-reproduzierbar-bauen.md

feat: slice 4 - the open management issues live in the repo

2026-08-11 12:00:00 +00:00

0023-doc-04-navbar-logo-im-docusaurus-wiki-wird.md

docs(issues): reject #0023 (obsolete post-Wikijs), plan #0007 cert renewal

2026-08-14 12:00:00 +00:00

0024-wiki-hostname-klaeren-wiki-lab-oder-axionwiki.md

docs: resolve wiki hostname + surface decisions, track the two follow-ups

2026-08-11 12:00:00 +00:00

0025-deploy-uebergabe-cve-alarme-aggregiert-receiver.md

docs(issues): review all waiting issues, close #0041 and #0025

2026-08-15 12:00:00 +00:00

0027-audit-01-acht-widersprueche-aus-dem-labnet-02.md

docs(issues): reopen #0027 — W5 and W7 are unresolved again

2026-08-15 12:00:00 +00:00

0028-mirror-01-ein-ausfall-der-push-mirrors-bleibt.md

docs(issues): reject #0018 as moot, close #0028 as already running

2026-08-15 12:00:00 +00:00

0029-ui-harmonisieren-gleiche-farben-und-formen.md

0029-ui-harmonisieren-gleiche-farben-und-formen.md theming advice added

2026-08-21 14:33:42 +00:00

0030-der-restore-ist-nie-geprobt-sicherungen-sind.md

docs: the widened alarms are live, and their fallback is no longer theory

2026-08-21 12:00:00 +00:00

0031-stillstandspruefung-gitea-token-und-authentik.md

docs(issues): close #0031 and #0104 - green is the normal state again

2026-08-19 12:00:00 +00:00

0032-gameserver-hat-keinen-push-mirror-und-auf-gitea.md

STATUS nach Meilenstein gruppieren, #0032 abgelehnt

2026-08-20 12:00:00 +00:00

0033-overmind-01-element-desktop-build-lab-registry.md

chore(issues): record the mirror addresses from the first full run

2026-08-18 12:00:00 +00:00

0034-cfgmon-11-gitea-ci-rueckbau-abschliessen.md

chore(issues): record the mirror addresses from the first full run

2026-08-18 12:00:00 +00:00

0035-rollout-agents-pointer-axion1337-chat-gitops.md

docs(issues): close #0035-#0039 — group-rules pointers rolled out

2026-08-15 12:00:00 +00:00

0036-rollout-agents-pointer-threadnet-web.md

docs(issues): close #0035-#0039 — group-rules pointers rolled out

2026-08-15 12:00:00 +00:00

0037-rollout-agents-pointer-threadnet-call.md

docs(issues): close #0035-#0039 — group-rules pointers rolled out

2026-08-15 12:00:00 +00:00

0038-rollout-agents-pointer-thread-net-git.md

docs(issues): close #0035-#0039 — group-rules pointers rolled out

2026-08-15 12:00:00 +00:00

0039-rollout-agents-pointer-threadnet-operating.md

docs(issues): close #0035-#0039 — group-rules pointers rolled out

2026-08-15 12:00:00 +00:00

0040-neckbeard-rueckmeldungen-einreichen.md

AARs nachgeholt: vier Pflichtfaelle, die ich uebergangen habe

2026-08-20 12:00:00 +00:00

0041-wartegrund-der-importierten-waiting-issues.md

docs(issues): review all waiting issues, close #0041 and #0025

2026-08-15 12:00:00 +00:00

0042-migration-in-betrieb-nehmen-push-spiegel-schedule.md

docs(issues): close #0042 - the schedule step was already satisfied

2026-08-18 12:00:00 +00:00

0043-invitation-flow-eindeutigkeit-case-insensitiv.md

docs(issues): close #0043 , record the coverage map for #0044

2026-08-15 12:00:00 +00:00

0044-sops-secret-aenderung-startet-dienst-nicht-neu.md

docs(issues): close #0044 — no reloader, the moving secrets are already covered

2026-08-15 12:00:00 +00:00

0045-report-event-kein-kontaktweg-fuer-melder.md

docs(issues): close #0045 — reporting no longer ends in silence

2026-08-15 12:00:00 +00:00

0046-wiki-in-threadnet-server-suite-umziehen.md

docs(issues): close #0046/#0049/#0050 — wiki move, abschottung verified, theming done

2026-08-13 12:00:00 +00:00

0047-wiki-oberflaeche-ueber-bookstack-hinaus-pruefen.md

docs: decide Wiki.js (ADR-0014, supersedes 0007) + wiki build issues

2026-08-12 12:00:00 +00:00

0048-wikijs-in-der-suite-deployen.md

docs(issue): close #0048 — wikijs postgres backup live, all criteria met

2026-08-13 12:00:00 +00:00

0049-wikijs-oidc-rollen-abschottung.md

docs(issues): close #0046/#0049/#0050 — wiki move, abschottung verified, theming done

2026-08-13 12:00:00 +00:00

0050-wikijs-theming-farben-logo.md

docs(issues): close #0046/#0049/#0050 — wiki move, abschottung verified, theming done

2026-08-13 12:00:00 +00:00

0051-cve-remediation-pass.md

docs: #0051 closes with two criteria it did not quite meet

2026-08-21 12:00:00 +00:00

0052-update-kadenz-latest-beseitigen.md

docs(issues): close #0052 — no :latest left, coturn pinned and verified

2026-08-15 12:00:00 +00:00

0053-historien-durchgang-nicht-kanonische-commits.md

chore(issues): record the mirror addresses from the first full run

2026-08-18 12:00:00 +00:00

0054-ki-geraeuschunterdrueckung-element-call.md

docs(issues): #0054 — phone test cancelled, not deferred (sorb)

2026-08-17 12:00:00 +00:00

0055-npm-scope-aufloesung-threadnet-web.md

#0055 : Korrektur - "vollstaendig geschlossen" stimmte nicht

2026-08-20 12:00:00 +00:00

0056-gitops-9-external-postgresql-migration-cloudnativepg-o.md

issues: M1 down to one — #0056 and #0004 struck, #0078 taken up

2026-08-21 12:00:00 +00:00

0057-gitops-11-element-call-vp9-codec-retry.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0058-gitops-14-web-application-firewall-waf.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0059-gitops-16-pod-security-admission-restricted.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0060-gitops-17-federation-allowlist-or-closed-federation-dec.md

docs(issues): close #0060 - group call verified with federation closed

2026-08-19 12:00:00 +00:00

0061-gitops-20-external-secrets-operator-vs-current-sops-set.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0062-gitops-21-renovate-dependabot-for-chart-and-image-updat.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0063-gitops-22-security-advisory-monitoring-ess-element.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0064-gitops-23-disable-automountserviceaccounttoken-where-no.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0065-gitops-25-k3s-api-security-hardening.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0066-gitops-26-auditd-for-file-integrity-syscall-audit.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0067-gitops-27-kernel-hardening-sysctl.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0068-gitops-28-lynis-security-baseline.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0069-gitops-29-crowdsec-integration.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0070-gitops-30-falco-runtime-monitoring.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0071-gitops-31-trivy-image-scanning-for-cves.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0072-gitops-34-dsgvo-datenschutz-compliance-konkretisieren.md

milestones: M6 — Zuletzt, and M1 closes with it (ADR-0027)

2026-08-21 12:00:00 +00:00

0073-gitops-35-architektur-monorepo-umbau-mit-generalisierte.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0074-gitops-39-cleanup-checkliste-laufend.md

docs(issues): #0074 - lucky locked, and why locked is not deactivated

2026-08-18 12:00:00 +00:00

0075-gitops-40-neue-issues-erscheinen-nicht-automatisch-im-g.md

docs: relevance pass over the backlog - close #0055 , retire four stale issues

2026-08-18 12:00:00 +00:00

0076-gitops-41-registry-git-traffic-zum-gitea-host-ueber-pri.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0077-gitops-42-grafana-dashboard-fuer-clamav-scan-ergebnisse.md

#0077 erledigt, #0002 vermessen

2026-08-20 12:00:00 +00:00

0078-gitops-45-cve-meldeweg-v2-metriken-grafana-dashboard-al.md

issues: #0078 was already built and delivering — #0106 for what it hides

2026-08-21 12:00:00 +00:00

0079-gitops-46-issue-migration-nach-gitlab-zentrale-projekt.md

docs: relevance pass over the backlog - close #0055 , retire four stale issues

2026-08-18 12:00:00 +00:00

0080-gitops-47-raidplaner-mit-sozialer-komponente-verfuegbar.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0081-gitops-48-gaeste-invite-workflow-per-bot-3-tage-account.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0082-gitops-49-cve-alarme-eine-matrix-nachricht-pro-cve-flut.md

docs(issues): close #0082 - its headline was fixed the day it was written

2026-08-19 12:00:00 +00:00

0083-gitops-50-monitoring-deploy-geaenderte-configs-greifen.md

docs: #0083 closed by measurement, #0088 corrected to the measured state

2026-08-21 12:00:00 +00:00

0084-gitops-51-ci-canonize-token-fuer-die-automatische-turn.md

docs(issues): close #0084 - the token exists and is proven to work

2026-08-19 12:00:00 +00:00

0085-gitops-52-docs-traegt-zwei-altbestaende-abgeschlossener.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0086-gitops-53-k8s-ressourcen-heissen-noch-element-web-docs.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0087-gitops-55-logo-fuer-die-authentik-anmeldemaske-entwerfe.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0088-gitops-56-networkpolicy-ausgehender-verkehr-ist-unbesch.md

docs: close #0088 — the call is measured, ADR-0025 accepted

2026-08-21 12:00:00 +00:00

0089-gitops-58-eigene-images-sind-unsigniert-beim-deploy-pru.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0090-gitops-59-kein-kubernetes-audit-log-zugriffe-an-der-api.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0091-gitops-61-enrollment-kollidierender-localpart-uebernimm.md

docs: relevance pass over the backlog - close #0055 , retire four stale issues

2026-08-18 12:00:00 +00:00

0092-threadnet-web-1-default-client-einstellungen-theme-features-f.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0093-threadnet-web-3-settings-normalisieren-video-audio-einstellun.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0094-threadnet-web-4-direkter-link-zur-2fa-passkey-einrichtung-in.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0095-threadnet-web-6-windows-desktop-code-signing-installer-brandi.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0096-threadnet-web-7-rebranding-element-axion1337-web-desktop-gesa.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0097-threadnet-web-9-feedback-bugreport-weg-eigener-rageshake-oder.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0098-threadnet-web-11-themes-rollout-2026-08-02-web-live-linux-wind.md

docs: relevance pass over the backlog - close #0055 , retire four stale issues

2026-08-18 12:00:00 +00:00

0099-threadnet-web-12-upstream-sicherheitsfixes-lassen-sich-nicht-m.md

#0099 : Tor deckt den ganzen Baum ab, Spiegel ist wieder gleichauf

2026-08-20 12:00:00 +00:00

0100-threadnet-web-13-asset-pfade-tragen-weiterhin-element-themes-e.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0101-threadnet-call-4-kaputtes-paket-0-19-2-threadnet-6-in-der-regi.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0102-dmarc-und-mail-haertung-der-zone-axion1337-chat.md

#0102 abgeschlossen: DMARC gehoert wieder uns und ist scharf

2026-08-20 12:00:00 +00:00

0103-wiki-zugang-ohne-gruppe-endet-stumm.md

#0103 abgeschlossen: der gruppenlose Zustand ist jetzt erkennbar

2026-08-20 12:00:00 +00:00

0104-daueralarme-melden-nichts-mehr.md

docs(issues): close #0031 and #0104 - green is the normal state again

2026-08-19 12:00:00 +00:00

0105-projekt-wiki-vor-projektabschluss-klaeren.md

chore(issues): record #0105 's mirror address

2026-08-18 12:00:00 +00:00

0106-cve-scan-deckt-nur-die-haelfte-zielliste-ist-handgepflegt.md

docs: #0106 criterion five is proven, by the Authentik upgrade itself

2026-08-21 12:00:00 +00:00

0107-aktives-konto-ohne-profil-zeile-faellt-nur-durch-beschwerde-auf.md

issues: the two blind spots both AARs ended on, #0108 and #0109

2026-08-21 12:00:00 +00:00

0108-erlaubnisliste-veraltet-still-wenn-das-chart-die-verdrahtung-ver.md

issues: the two blind spots both AARs ended on, #0108 and #0109

2026-08-21 12:00:00 +00:00

0109-der-weg-vom-commit-ins-cluster-meldet-seinen-stillstand-nicht.md

issues: the two blind spots both AARs ended on, #0108 and #0109

2026-08-21 12:00:00 +00:00

0110-haertung-lebt-auf-dem-host-das-repo-weiss-nichts-davon.md

issues: #0110 — the hardening that only existed on the host

2026-08-21 12:00:00 +00:00

template.md

feat: slice 1 - the neckbeard framework chain runs end to end

2026-08-11 12:00:00 +00:00