- sish config mirrors kubernetes/base/sish (HTTP by Host on :80, SNI passthrough
on :443, raw TCP on 22 and 20000-20099), single tenant via bind-any-host,
domain tunnel.traberph.de
- host key and connector key provisioned from gitignored coreos/.secrets/
- MemoryMax=256M for sish
- Zincati reboot window 03:00-04:00 UTC, daily sish update within v2 with rollback
- ignore *.ign (contains the host key)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- talos/: generated base config (gitignored) + patches for control-plane
scheduling, unprivileged ports and the ingress firewall
- kubernetes/: sish base and cirrus-dev overlay, applied with kubectl
- READMEs incl. production rollout plan
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
traberphandClaude Opus 5.5