Update ghcr.io/remsky/kokoro-fastapi-cpu Docker tag to v0.9.0

Reviewed-on: #417

.woodpecker/build-images.yaml

@@ -2,11 +2,12 @@ when:
   - event: push
     path:
       include:
-        - mikrotik/coredns/**
+        - docker/**
+        - .woodpecker/build-images.yaml
 
 steps:
   - name: Get registry creds from OpenBao
-    image: quay.io/openbao/openbao:2.5.4
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
       ROLE_ID:
@@ -21,8 +22,8 @@ steps:
       - 'printf "PLUGIN_USERNAME=%s\n" "$(bao kv get -mount secret -field REGISTRY_USERNAME container-registry)" > /woodpecker/registry.env'
       - 'printf "PLUGIN_PASSWORD=%s\n" "$(bao kv get -mount secret -field REGISTRY_PASSWORD container-registry)" >> /woodpecker/registry.env'
 
-  - name: Build and push
+  - name: Build and push mikrotik coredns
-    image: woodpeckerci/plugin-docker-buildx:6.1.0
+    image: woodpeckerci/plugin-docker-buildx:6.1.1
     privileged: true
     settings:
       registry: gitea.lumpiasty.xyz
@@ -31,12 +32,32 @@ steps:
       tags:
         - latest
         - ${CI_COMMIT_SHA:0:8}
-      dockerfile: mikrotik/coredns/Dockerfile
+      dockerfile: docker/coredns/Dockerfile
-      context: mikrotik/coredns/
+      context: docker/coredns/
       env_file: /woodpecker/registry.env
+      cache_images:
+        - gitea.lumpiasty.xyz/lumpiasty/coredns-mikrotik:buildcache
+    depends_on: ["Get registry creds from OpenBao"]
+
+  - name: Build and push supervisord
+    image: woodpeckerci/plugin-docker-buildx:6.1.1
+    privileged: true
+    settings:
+      registry: gitea.lumpiasty.xyz
+      repo: gitea.lumpiasty.xyz/lumpiasty/supervisord
+      platforms: linux/amd64
+      tags:
+        - latest
+        - ${CI_COMMIT_SHA:0:8}
+      dockerfile: docker/supervisord/Dockerfile
+      context: docker/supervisord/
+      env_file: /woodpecker/registry.env
+      cache_images:
+        - gitea.lumpiasty.xyz/lumpiasty/supervisord:buildcache
+    depends_on: ["Get registry creds from OpenBao"]
 
   - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.5.4
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
     commands:
@@ -44,3 +65,6 @@ steps:
       - bao write -f auth/token/revoke-self
     when:
       - status: [success, failure]
+    depends_on:
+      - Build and push mikrotik coredns
+      - Build and push supervisord

.woodpecker/flux-reconcile-source.yaml

@@ -6,7 +6,7 @@ skip_clone: true
 
 steps:
   - name: Get kubernetes access from OpenBao
-    image: quay.io/openbao/openbao:2.5.4
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
       ROLE_ID:
@@ -35,13 +35,13 @@ steps:
           --namespace flux-system
       - kubectl config use-context cluster
   - name: Reconcile git source
-    image: ghcr.io/fluxcd/flux-cli:v2.8.8
+    image: ghcr.io/fluxcd/flux-cli:v2.9.5
     environment:
       KUBECONFIG: /woodpecker/kubeconfig
     commands:
       - flux reconcile source git flux-system
   - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.5.4
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
     commands:

.woodpecker/renovate.yaml

@@ -6,7 +6,7 @@ skip_clone: true
 
 steps:
   - name: Get renovate token from OpenBao
-    image: quay.io/openbao/openbao:2.5.4
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
       ROLE_ID:
@@ -21,7 +21,8 @@ steps:
       - bao kv get -mount secret -field RENOVATE_TOKEN renovate > /woodpecker/renovate_token
       - bao kv get -mount secret -field GITHUB_COM_TOKEN renovate > /woodpecker/github_com_token
   - name: Run Renovate
-    image: renovate/renovate:43.222.1
+    image: renovate/renovate:44
+    pull: true
     environment:
       RENOVATE_AUTODISCOVER: "true"
       RENOVATE_ENDPOINT: https://gitea.lumpiasty.xyz/api/v1
@@ -34,7 +35,7 @@ steps:
       - export GITHUB_COM_TOKEN=$(cat /woodpecker/github_com_token)
       - /usr/local/sbin/renovate-entrypoint.sh renovate
   - name: Invalidate OpenBao token
-    image: quay.io/openbao/openbao:2.5.4
+    image: quay.io/openbao/openbao:2.6.2
     environment:
       VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
     commands:

ansible/roles/openwrt/tasks/wireless.yml

@@ -25,6 +25,12 @@
       network: iot
       mode: ap
       ssid: szafa
+      hidden: '1' # Stop broadcasting SSID
+      macfilter: allow # Apply MAC filter allowing only specific addresses
+      maclist:
+        - 80:64:7c:99:21:20 # Thermomether
+        - C0:F8:53:89:E5:EF # Smart plug
+        - C0:F8:53:89:E3:42 # smart plug
       encryption: psk2
       key: "{{ openwrt_iot_wifi_password }}"
       disabled: '0'

ansible/roles/routeros/tasks/firewall.yml

@@ -1,8 +1,56 @@
 ---
+- name: Configure WAN connection marking
+  community.routeros.api_modify:
+    path: ip firewall mangle
+    data:
+      - action: mark-connection
+        chain: forward
+        connection-state: new
+        new-connection-mark: wan-gpon
+        out-interface: pppoe-gpon
+        passthrough: true
+        comment: Mark connections going out GPON
+      - action: mark-connection
+        chain: forward
+        connection-state: new
+        new-connection-mark: wan-lte
+        out-interface: vlan6
+        passthrough: true
+        comment: Mark connections going out LTE
+    handle_absent_entries: remove
+    handle_entries_content: remove_as_much_as_possible
+    ensure_order: true
+
 - name: Configure IPv4 firewall filter rules
   community.routeros.api_modify:
     path: ip firewall filter
     data:
+      - action: reject
+        chain: forward
+        connection-mark: wan-gpon
+        out-interface: vlan6
+        protocol: tcp
+        reject-with: tcp-reset
+        comment: Fast-fail TCP connections that shifted from GPON to LTE
+      - action: reject
+        chain: forward
+        connection-mark: wan-gpon
+        out-interface: vlan6
+        reject-with: icmp-network-unreachable
+        comment: Fast-fail non-TCP connections that shifted from GPON to LTE
+      - action: reject
+        chain: forward
+        connection-mark: wan-lte
+        out-interface: pppoe-gpon
+        protocol: tcp
+        reject-with: tcp-reset
+        comment: Fast-fail TCP connections that shifted from LTE to GPON
+      - action: reject
+        chain: forward
+        connection-mark: wan-lte
+        out-interface: pppoe-gpon
+        reject-with: icmp-network-unreachable
+        comment: Fast-fail non-TCP connections that shifted from LTE to GPON
       - action: fasttrack-connection
         chain: forward
         connection-state: established,related
@@ -208,6 +256,11 @@
         dst-port: 30033
         out-interface: vlan4
         protocol: tcp
+      - action: accept
+        chain: allow-ports
+        dst-port: 10011
+        out-interface: vlan4
+        protocol: tcp
       - action: accept
         chain: allow-ports
         comment: Allow HTTP
@@ -267,6 +320,12 @@
         dst-port: 30033
         protocol: tcp
         to-addresses: 10.44.0.0
+      - action: dst-nat
+        chain: dstnat
+        dst-address: 139.28.40.212
+        dst-port: 10011
+        protocol: tcp
+        to-addresses: 10.44.0.0
       - action: src-nat
         chain: srcnat
         comment: src-nat from LAN to TS3 to some Greenland address

ansible/roles/routeros/tasks/routing.yml

@@ -12,15 +12,44 @@
         scope: 30
         suppress-hw-offload: false
         target-scope: 10
-      - disabled: false
+      - comment: GPON Monitor 1
+        disabled: false
+        distance: 1
+        dst-address: 1.0.0.1/32
+        gateway: pppoe-gpon
+        routing-table: main
+        scope: 10
+        suppress-hw-offload: false
+        target-scope: 10
+      - comment: GPON Monitor 2
+        disabled: false
+        distance: 1
+        dst-address: 8.8.4.4/32
+        gateway: pppoe-gpon
+        routing-table: main
+        scope: 10
+        suppress-hw-offload: false
+        target-scope: 10
+      - comment: GPON Default 1
+        disabled: false
         distance: 1
         dst-address: 0.0.0.0/0
-        gateway: pppoe-gpon
+        gateway: 1.0.0.1
+        check-gateway: ping
         routing-table: main
         scope: 30
         suppress-hw-offload: false
-        target-scope: 10
+        target-scope: 11
-        vrf-interface: pppoe-gpon
+      - comment: GPON Default 2
+        disabled: false
+        distance: 2
+        dst-address: 0.0.0.0/0
+        gateway: 8.8.4.4
+        check-gateway: ping
+        routing-table: main
+        scope: 30
+        suppress-hw-offload: false
+        target-scope: 11
     handle_absent_entries: remove
     handle_entries_content: remove_as_much_as_possible
 
@@ -32,6 +61,7 @@
         distance: 1
         dst-address: 2000::/3
         gateway: 2001:470:70:dd::1
+        check-gateway: ping
         scope: 30
         target-scope: 10
       - comment: Tailnet

ansible/roles/routeros/tasks/wan.yml

@@ -10,6 +10,7 @@
         password: "{{ routeros_pppoe_password }}"
         # Using CoreDNS container with DNS64
         use-peer-dns: false
+        add-default-route: false
         user: "{{ routeros_pppoe_username }}"
     handle_absent_entries: remove
     handle_entries_content: remove_as_much_as_possible

apps/authentik/release.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: authentik
-      version: 2026.5.3
+      version: 2026.8.1
       sourceRef:
         kind: HelmRepository
         name: authentik

apps/gitea/gitea-shared-volume.yaml

@@ -7,7 +7,7 @@ metadata:
   name: gitea-shared-storage-lvmhdd
   namespace: openebs
 spec:
-  capacity: 10Gi
+  capacity: "21474836480"
   ownerNodeID: anapistula-delrosalae
   shared: "yes"
   thinProvision: "no"
@@ -20,7 +20,7 @@ metadata:
   name: gitea-shared-storage-lvmhdd
 spec:
   capacity:
-    storage: 10Gi
+    storage: 20Gi
   accessModes:
     - ReadWriteOnce
   persistentVolumeReclaimPolicy: Retain
@@ -41,6 +41,6 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: 20Gi
   storageClassName: hdd-lvmpv
   volumeName: gitea-shared-storage-lvmhdd

apps/gitea/release.yaml

@@ -17,13 +17,15 @@ spec:
   chart:
     spec:
       chart: gitea
-      version: 12.6.0
+      version: 12.7.0
       sourceRef:
         kind: HelmRepository
         name: gitea-charts
         namespace: gitea
       interval: 12h
   values:
+    image:
+      tag: 1.27.2 # REMOVE ME after new helm chart version includes this update
     postgresql-ha:
       enabled: false
 

apps/gitea/valkey-volume.yaml

@@ -7,7 +7,7 @@ metadata:
   name: gitea-valkey-primary-lvmhdd-0
   namespace: openebs
 spec:
-  capacity: 1Gi
+  capacity: "4294967296"
   ownerNodeID: anapistula-delrosalae
   shared: "yes"
   thinProvision: "no"
@@ -20,7 +20,7 @@ metadata:
   name: gitea-valkey-primary-lvmhdd-0
 spec:
   capacity:
-    storage: 1Gi
+    storage: 4Gi
   accessModes:
     - ReadWriteOnce
   persistentVolumeReclaimPolicy: Retain
@@ -41,6 +41,6 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 1Gi
+      storage: 4Gi
   storageClassName: hdd-lvmpv
   volumeName: gitea-valkey-primary-lvmhdd-0

apps/immich/redis.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: valkey
-      version: 0.9.4
+      version: 0.11.0
       sourceRef:
         kind: HelmRepository
         name: valkey

apps/immich/release.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: immich
-      version: 1.2.6
+      version: 2.0.3
       sourceRef:
         kind: HelmRepository
         name: secustor

apps/ispeak3/service.yaml

@@ -15,6 +15,10 @@ spec:
     protocol: TCP
     port: 30033
     targetPort: 30033
+  - name: rawquery
+    protocol: TCP
+    port: 10011
+    targetPort: 10011
   type: LoadBalancer
   externalTrafficPolicy: Local
   ipFamilyPolicy: PreferDualStack

apps/kaneo/app-secret.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: kaneo-app-secret
+  namespace: kaneo
+spec:
+  type: kv-v2
+
+  mount: secret
+  path: kaneo
+
+  destination:
+    create: true
+    name: kaneo-app-secret
+    type: Opaque
+    transformation:
+      excludeRaw: true
+      templates:
+        auth_secret:
+          text: '{{ get .Secrets "auth_secret" }}'
+
+  vaultAuthRef: kaneo

apps/kaneo/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
+  - app-secret.yaml
   - oauth-secret.yaml
   - postgres-volume.yaml
   - postgres-cluster.yaml

apps/kaneo/release.yaml

@@ -8,7 +8,7 @@ spec:
   interval: 24h
   url: https://github.com/usekaneo/kaneo.git
   ref:
-    tag: v2.7.7
+    tag: v2.22.0
   ignore: |
     # exclude all
     /*
@@ -53,11 +53,13 @@ spec:
       enabled: false
     
     kaneo:
-      image:
-        tag: "2.7.3"  # renovate: depName=ghcr.io/usekaneo/kaneo registryUrl=https://ghcr.io
       env:
         clientUrl: "https://kaneo.lumpiasty.xyz"
         disablePasswordRegistration: true
+        existingSecret:
+          enabled: true
+          name: kaneo-app-secret
+          key: auth_secret
         database:
           external:
             enabled: true

apps/llama/configs/config.yaml

@@ -1,444 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/mostlygeek/llama-swap/refs/heads/main/config-schema.json
-healthCheckTimeout: 600
-logToStdout: "both" # proxy and upstream
-
-macros:
-  base_args: "--no-warmup --port ${PORT} --mlock --no-mmap"
-  common_args: "--fit-target 256 --no-warmup --port ${PORT} --no-mmap -tb 12 -t 6"
-  cpu_args: "--no-warmup --port ${PORT} -ngl 0"
-  ctx_64k: "--ctx-size 65536"
-  ctx_128k: "--ctx-size 131072"
-  ctx_256k: "--ctx-size 131072"
-  qwen35_think_args:   "--temp 1.0 --top-p 0.95 --top-k 20 --min-p 0.00 -ctk q4_0 -ctv q4_0 --presence_penalty 1.5 --reasoning on"
-  qwen35_nothink_args: "--temp 0.7 --top-p 0.80 --top-k 20 --min-p 0.00 -ctk q4_0 -ctv q4_0 --presence_penalty 1.5 --reasoning off"
-  qwen35_35b_heretic_mmproj: "--mmproj-url https://huggingface.co/unsloth/Qwen3.5-35B-A3B-GGUF/resolve/main/mmproj-F16.gguf --mmproj /root/.cache/llama.cpp/unsloth_Qwen3.5-35B-A3B-GGUF_mmproj-F16.gguf"
-  qwen35_4b_heretic_mmproj: "--mmproj-url https://huggingface.co/unsloth/Qwen3.5-4B-GGUF/resolve/main/mmproj-F16.gguf --mmproj /root/.cache/llama.cpp/unsloth_Qwen3.5-4B-GGUF_mmproj-F16.gguf"
-  gemma4_sampling: "--temp 1.0 --top-p 0.95 --top-k 64 -ctk q4_0 -ctv q4_0"
-  gemma4_nothink_sampling: "--temp 1.0 --top-p 0.95 --top-k 64 -ctk q4_0 -ctv q4_0 --reasoning off"
-
-hooks:
-  on_startup:
-    preload:
-      - "Qwen3.5-0.8B-GGUF-nothink:Q4_K_XL"
-      - "parakeet-tdt_ctc-1.1b"
-
-# matrix replaces groups (they are mutually exclusive).
-# The small 0.8B model runs alongside any LLM.
-# FLUX runs alone — it needs all available VRAM and will evict the 0.8B first.
-matrix:
-  vars:
-    q8: "Qwen3.5-0.8B-GGUF-nothink:Q4_K_XL"
-    stt: "parakeet-tdt_ctc-1.1b"
-    flux: "flux2-klein-4b:Q4_K_M"
-    coder: "Qwen3-Coder-Next-GGUF:Q4_K_M"
-    q35t: "Qwen3.5-35B-A3B-GGUF:Q4_K_M"
-    q35nt: "Qwen3.5-35B-A3B-GGUF-nothink:Q4_K_M"
-    q35ht: "Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M"
-    q35hnt: "Qwen3.5-35B-A3B-heretic-GGUF-nothink:Q4_K_M"
-    q4t: "Qwen3.5-4B-GGUF:Q4_K_M"
-    q4nt: "Qwen3.5-4B-GGUF-nothink:Q4_K_M"
-    q4ht: "Qwen3.5-4B-heretic-GGUF:Q4_K_M"
-    q4hnt: "Qwen3.5-4B-heretic-GGUF-nothink:Q4_K_M"
-    g26xl: "gemma-4-26B-A4B-it-qat:UD-Q4_K_XL"
-    g26xlnt: "gemma-4-26B-A4B-it-qat-nothink:UD-Q4_K_XL"
-    g26mtp: "gemma-4-26B-A4B-it-qat-mtp:UD-Q4_K_XL"
-    g26mtpnt: "gemma-4-26B-A4B-it-qat-mtp-nothink:UD-Q4_K_XL"
-    g26ht: "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL"
-    g26hnt: "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-nothink:UD-Q4_K_XL"
-    g26hmtp: "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-mtp:UD-Q4_K_XL"
-    g26hmnt: "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-mtp-nothink:UD-Q4_K_XL"
-    ge4qat: "unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL"
-    ge4qatnt: "unsloth/gemma-4-E4B-it-qat-GGUF-nothink:UD-Q4_K_XL"
-    ge2qat: "unsloth/gemma-4-E2B-it-qat-GGUF:UD-Q4_K_XL"
-    ge2qatnt: "unsloth/gemma-4-E2B-it-qat-GGUF-nothink:UD-Q4_K_XL"
-    ge4mtp: "unsloth/gemma-4-E4B-it-qat-GGUF-mtp:UD-Q4_K_XL"
-    ge4mtpnt: "unsloth/gemma-4-E4B-it-qat-GGUF-mtp-nothink:UD-Q4_K_XL"
-    ge4ht: "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M"
-    ge4hnt: "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-nothink:Q4_K_M"
-    ge4hmtp: "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-mtp:Q4_K_M"
-    ge4hmnt: "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-mtp-nothink:Q4_K_M"
-    q36t: "unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL"
-    q36nt: "unsloth/Qwen3.6-35B-A3B-GGUF-nothink:UD-Q4_K_XL"
-    haut: "HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M"
-    haunt: "HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-nothink:Q4_K_M"
-    mtpt: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M"
-    mtpnt: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF-nothink:Q4_K_M"
-
-  evict_costs:
-    flux: 10  # large files, slow to reload
-
-  sets:
-    # any LLM can run alongside the small always-on model + STT + TTS (all CPU, no VRAM cost)
-    with_q8: "(coder | q35t | q35nt | q35ht | q35hnt | q4t | q4nt | q4ht | q4hnt | g26xl | g26xlnt | g26mtp | g26mtpnt | g26ht | g26hnt | g26hmtp | g26hmnt | ge4qat | ge4qatnt | ge2qat | ge2qatnt | ge4mtp | ge4mtpnt | ge4ht | ge4hnt | ge4hmtp | ge4hmnt | q36t | q36nt | haut | haunt | mtpt | mtpnt) & q8 & stt"
-    # FLUX runs alone — evicts everything including q8, but keeps STT for voice during image gen
-    image_gen: "flux & stt"
-
-
-models:
-  "Qwen3-Coder-Next-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3-Coder-Next-GGUF:Q4_K_M
-        --ctx-size 65536
-        --predict 8192
-        --temp 1.0
-        --min-p 0.01
-        --top-p 0.95
-        --top-k 40
-        --repeat-penalty 1.0
-        -ctk q4_0 -ctv q4_0
-        ${common_args}
-
-  "Qwen3.5-35B-A3B-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3.5-35B-A3B-GGUF:Q4_K_M
-        ${ctx_256k}
-        ${qwen35_think_args}
-        ${common_args}
-
-  "Qwen3.5-35B-A3B-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3.5-35B-A3B-GGUF:Q4_K_M
-        ${ctx_256k}
-        ${qwen35_nothink_args}
-        ${common_args}
-
-  # The "heretic" version does not provide the mmproj
-  # so providing url to the one from the non-heretic version.
-  "Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf mradermacher/Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M
-        ${qwen35_35b_heretic_mmproj}
-        ${ctx_256k}
-        ${qwen35_think_args}
-        ${common_args}
-
-  "Qwen3.5-35B-A3B-heretic-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf mradermacher/Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M
-        ${qwen35_35b_heretic_mmproj}
-        ${ctx_256k}
-        ${qwen35_nothink_args}
-        ${common_args}
-
-  "Qwen3.5-0.8B-GGUF-nothink:Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3.5-0.8B-GGUF:Q4_K_XL
-        --ctx-size 4096
-        ${qwen35_nothink_args}
-        ${base_args}
-
-  "Qwen3.5-4B-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3.5-4B-GGUF:Q4_K_M
-        ${ctx_128k}
-        ${qwen35_think_args}
-        ${common_args}
-
-  "Qwen3.5-4B-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf unsloth/Qwen3.5-4B-GGUF:Q4_K_M
-        ${ctx_128k}
-        ${qwen35_nothink_args}
-        ${common_args}
-
-  "Qwen3.5-4B-heretic-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf mradermacher/Qwen3.5-4B-heretic-GGUF:Q4_K_M
-        ${qwen35_4b_heretic_mmproj}
-        ${ctx_128k}
-        ${qwen35_think_args}
-        ${common_args}
-
-  "Qwen3.5-4B-heretic-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf mradermacher/Qwen3.5-4B-heretic-GGUF:Q4_K_M
-        ${qwen35_4b_heretic_mmproj}
-        ${ctx_128k}
-        ${qwen35_nothink_args}
-        ${common_args}
-
-  "gemma-4-26B-A4B-it-qat:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_256k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "gemma-4-26B-A4B-it-qat-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_256k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "gemma-4-26B-A4B-it-qat-mtp:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_256k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "gemma-4-26B-A4B-it-qat-mtp-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_256k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL \
-        ${ctx_256k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL \
-        ${ctx_256k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  # The heretic QAT repo does not ship an MTP drafter,
-  # so borrow the one from the non-heretic unsloth QAT repo.
-  "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-mtp:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_256k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF-mtp-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf SC117/gemma-4-26B-A4B-it-qat-heretic-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-26B-A4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_256k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_128k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E4B-it-qat-GGUF-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_128k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E2B-it-qat-GGUF:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E2B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_128k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E2B-it-qat-GGUF-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E2B-it-qat-GGUF:UD-Q4_K_XL \
-        ${ctx_128k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E4B-it-qat-GGUF-mtp:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-E4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_128k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "unsloth/gemma-4-E4B-it-qat-GGUF-mtp-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-        -hf unsloth/gemma-4-E4B-it-qat-GGUF:UD-Q4_K_XL \
-        --spec-draft-hf unsloth/gemma-4-E4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_128k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M \
-        ${ctx_128k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M \
-        ${ctx_128k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-mtp:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M \
-        --spec-draft-hf unsloth/gemma-4-E4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_128k}
-        ${gemma4_sampling}
-        ${common_args}
-
-  "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF-mtp-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-        -hf llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic-GGUF:Q4_K_M \
-        --spec-draft-hf unsloth/gemma-4-E4B-it-qat-GGUF:Q8_0-MTP \
-        --spec-type draft-mtp
-        --spec-draft-n-max 1
-        --swa-full
-        --kv-unified
-        --parallel 1
-        ${ctx_128k}
-        ${gemma4_nothink_sampling}
-        ${common_args}
-
-  "unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-      -hf unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL
-      ${ctx_256k}
-      ${qwen35_think_args}
-      ${common_args}
-
-  "unsloth/Qwen3.6-35B-A3B-GGUF-nothink:UD-Q4_K_XL":
-    cmd: |
-      llama-server
-      -hf unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL
-      ${ctx_256k}
-      ${qwen35_nothink_args}
-      ${common_args}
-
-  "HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M":
-    cmd: |
-      llama-server
-      -hf HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M
-      ${ctx_256k}
-      ${qwen35_think_args}
-      ${common_args}
-
-  "HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-      -hf HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M
-      ${ctx_256k}
-      ${qwen35_nothink_args}
-      ${common_args}
-
-  "unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M":
-    cmd: |
-      llama-server
-      -hf unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M
-      ${ctx_256k}
-      ${qwen35_think_args}
-      --spec-type draft-mtp --spec-draft-n-max 1
-      --parallel 1
-      ${common_args}
-
-  "unsloth/Qwen3.6-35B-A3B-MTP-GGUF-nothink:Q4_K_M":
-    cmd: |
-      llama-server
-      -hf unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M
-      ${ctx_256k}
-      ${qwen35_nothink_args}
-      --spec-type draft-mtp --spec-draft-n-max 1
-      --parallel 1
-      ${common_args}
-
-  # STT via parakeet-server (parakeet.cpp OpenAI-compatible server, CPU, always loaded)
-  # Model downloaded on first start and cached under /root/.cache/parakeet.cpp/models
-  # parakeet-proxy.py sits in front to convert any audio format to WAV via ffmpeg,
-  # since parakeet-server only accepts real WAV but browsers send Ogg/Opus.
-  "parakeet-tdt_ctc-1.1b":
-    checkEndpoint: none
-    cmd: |
-      env PROXY_PORT=${PORT} FFMPEG_BIN=/root/.cache/ffmpeg/ffmpeg python3 /config/parakeet-proxy.py
-
-
-  # Image generation via stable-diffusion.cpp (sd-server)
-  # Models must be pre-downloaded to /root/.cache/sd/
-  # FLUX.2-klein-4B: fast unified text-to-image and image editing model (Apache 2.0)
-  # Download: uv run --with huggingface_hub hf download unsloth/FLUX.2-klein-4B-GGUF flux-2-klein-4b-Q4_K_M.gguf --local-dir /root/.cache/sd
-  # Download VAE: uv run --with huggingface_hub hf download Comfy-Org/flux2-klein-4B split_files/vae/flux2-vae.safetensors --local-dir /root/.cache/sd/flux2-klein && cp /root/.cache/sd/flux2-klein/split_files/vae/flux2-vae.safetensors /root/.cache/sd/
-  # Download LLM: uv run --with huggingface_hub hf download ponpoke/flux2-klein-4b-uncensored-text-encoder flux2-klein-4b-uncensored-q4_k_m.gguf --local-dir /root/.cache/sd
-  "flux2-klein-4b:Q4_K_M":
-    checkEndpoint: "/"
-    cmd: |
-      sd-server
-        --listen-port ${PORT}
-        --diffusion-model /root/.cache/sd/flux-2-klein-4b-Q4_K_M.gguf
-        --vae /root/.cache/sd/flux2-vae.safetensors
-        --llm /root/.cache/sd/flux2-klein-4b-uncensored-q4_k_m.gguf
-        --cfg-scale 1.0
-        --sampling-method euler
-        --steps 4
-        --diffusion-fa
-        --offload-to-cpu

apps/llama/configs/parakeet-proxy.py

@@ -1,227 +0,0 @@
-#!/usr/bin/env python3
-"""
-Thin reverse proxy for parakeet-server.
-
-Accepts POST /v1/audio/transcriptions with any audio format,
-converts the audio to 16 kHz mono WAV via ffmpeg, then forwards
-the converted file to the real parakeet-server running on PARAKEET_PORT.
-
-Also proxies GET /health straight through.
-
-Usage:
-    PROXY_PORT=<port>  PARAKEET_PORT=<upstream>  python3 parakeet-proxy.py
-"""
-
-import http.server
-import io
-import os
-import subprocess
-import sys
-import tempfile
-import urllib.request
-import urllib.error
-
-PROXY_PORT    = int(os.environ.get("PROXY_PORT", "8080"))
-PARAKEET_PORT = PROXY_PORT + 1
-FFMPEG        = os.environ.get("FFMPEG_BIN", "ffmpeg")
-MODEL         = os.environ.get("PARAKEET_MODEL", "tdt_ctc-1.1b-q4_k.gguf")
-CACHE_DIR     = os.environ.get("PARAKEET_CACHE_DIR", "/root/.cache/parakeet.cpp/models")
-
-
-def convert_to_wav(data: bytes) -> bytes:
-    """Convert any audio bytes to 16 kHz mono PCM WAV via ffmpeg."""
-    with tempfile.NamedTemporaryFile(suffix=".input", delete=False) as inf:
-        inf.write(data)
-        inf_path = inf.name
-    out_path = inf_path + ".wav"
-    try:
-        subprocess.run(
-            [
-                FFMPEG, "-y",
-                "-i", inf_path,
-                "-ar", "16000",
-                "-ac", "1",
-                "-f", "wav",
-                out_path,
-            ],
-            check=True,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-        )
-        with open(out_path, "rb") as f:
-            return f.read()
-    finally:
-        os.unlink(inf_path)
-        if os.path.exists(out_path):
-            os.unlink(out_path)
-
-
-def parse_multipart(content_type: str, body: bytes):
-    """
-    Parse a multipart/form-data body.
-    Returns a dict of field_name -> (filename_or_None, content_type, data).
-    """
-    import email
-    from email import policy as email_policy
-
-    # email.parser needs the full MIME headers to parse multipart
-    raw = b"Content-Type: " + content_type.encode() + b"\r\n\r\n" + body
-    msg = email.message_from_bytes(raw, policy=email_policy.compat32)
-    parts = {}
-    for part in msg.get_payload():
-        cd = part.get("Content-Disposition", "")
-        name = None
-        filename = None
-        for item in cd.split(";"):
-            item = item.strip()
-            if item.startswith('name='):
-                name = item[5:].strip('"')
-            elif item.startswith('filename='):
-                filename = item[9:].strip('"')
-        if name is not None:
-            parts[name] = (filename, part.get_content_type(), part.get_payload(decode=True))
-    return parts
-
-
-def build_multipart(fields: dict) -> tuple[bytes, str]:
-    """
-    Build a multipart/form-data body from fields dict:
-      field_name -> (filename_or_None, content_type, data_bytes)
-    Returns (body_bytes, content_type_header_value).
-    """
-    boundary = b"----ParakeetProxyBoundary0xDEADBEEF"
-    body = b""
-    for name, (filename, ct, data) in fields.items():
-        body += b"--" + boundary + b"\r\n"
-        if filename:
-            body += (
-                f'Content-Disposition: form-data; name="{name}"; filename="{filename}"\r\n'
-            ).encode()
-        else:
-            body += f'Content-Disposition: form-data; name="{name}"\r\n'.encode()
-        body += f"Content-Type: {ct}\r\n\r\n".encode()
-        body += data + b"\r\n"
-    body += b"--" + boundary + b"--\r\n"
-    return body, f"multipart/form-data; boundary={boundary.decode()}"
-
-
-class ProxyHandler(http.server.BaseHTTPRequestHandler):
-    def log_message(self, fmt, *args):
-        print(f"[parakeet-proxy] {self.address_string()} - {fmt % args}", flush=True)
-
-    def do_GET(self):
-        if self.path == "/health":
-            self._forward_get("/health")
-        else:
-            self.send_response(404)
-            self.end_headers()
-
-    def do_POST(self):
-        if self.path.rstrip("/") == "/v1/audio/transcriptions":
-            self._handle_transcription()
-        else:
-            self.send_response(404)
-            self.end_headers()
-
-    def _forward_get(self, path):
-        try:
-            url = f"http://127.0.0.1:{PARAKEET_PORT}{path}"
-            with urllib.request.urlopen(url, timeout=5) as resp:
-                body = resp.read()
-                self.send_response(resp.status)
-                self.send_header("Content-Type", resp.headers.get("Content-Type", "application/json"))
-                self.end_headers()
-                self.wfile.write(body)
-        except Exception as e:
-            self.send_response(502)
-            self.end_headers()
-            self.wfile.write(str(e).encode())
-
-    def _handle_transcription(self):
-        length = int(self.headers.get("Content-Length", 0))
-        body = self.rfile.read(length)
-        ct = self.headers.get("Content-Type", "")
-
-        try:
-            fields = parse_multipart(ct, body)
-        except Exception as e:
-            self._error(400, f"failed to parse multipart: {e}")
-            return
-
-        if "file" not in fields:
-            self._error(400, "missing required field 'file'")
-            return
-
-        filename, file_ct, audio_data = fields["file"]
-
-        # Convert to WAV regardless of what we received
-        try:
-            wav_data = convert_to_wav(audio_data)
-        except subprocess.CalledProcessError:
-            self._error(400, "ffmpeg could not decode audio")
-            return
-        except Exception as e:
-            self._error(500, f"conversion error: {e}")
-            return
-
-        # Rebuild multipart with converted WAV, preserve other fields
-        new_fields = {}
-        for name, (fn, fct, data) in fields.items():
-            if name == "file":
-                new_fields[name] = ("recording.wav", "audio/wav", wav_data)
-            else:
-                new_fields[name] = (fn, fct, data)
-
-        new_body, new_ct = build_multipart(new_fields)
-
-        # Forward to parakeet-server
-        try:
-            url = f"http://127.0.0.1:{PARAKEET_PORT}/v1/audio/transcriptions"
-            req = urllib.request.Request(
-                url,
-                data=new_body,
-                headers={"Content-Type": new_ct},
-                method="POST",
-            )
-            with urllib.request.urlopen(req, timeout=300) as resp:
-                resp_body = resp.read()
-                self.send_response(resp.status)
-                self.send_header("Content-Type", resp.headers.get("Content-Type", "application/json"))
-                self.end_headers()
-                self.wfile.write(resp_body)
-        except urllib.error.HTTPError as e:
-            resp_body = e.read()
-            self.send_response(e.code)
-            self.send_header("Content-Type", e.headers.get("Content-Type", "application/json"))
-            self.end_headers()
-            self.wfile.write(resp_body)
-        except Exception as e:
-            self._error(502, f"upstream error: {e}")
-
-    def _error(self, code: int, msg: str):
-        body = f'{{"error":{{"message":"{msg}","type":"proxy_error"}}}}'.encode()
-        self.send_response(code)
-        self.send_header("Content-Type", "application/json")
-        self.end_headers()
-        self.wfile.write(body)
-
-
-if __name__ == "__main__":
-    proc = subprocess.Popen([
-        "parakeet-server",
-        "--host", "127.0.0.1",
-        "--port", str(PARAKEET_PORT),
-        "--model", MODEL,
-        "--cache-dir", CACHE_DIR,
-    ])
-    print(f"[parakeet-proxy] started parakeet-server pid={proc.pid} on :{PARAKEET_PORT}", flush=True)
-
-    server = http.server.HTTPServer(("0.0.0.0", PROXY_PORT), ProxyHandler)
-    print(f"[parakeet-proxy] listening on :{PROXY_PORT}", flush=True)
-    try:
-        server.serve_forever()
-    except KeyboardInterrupt:
-        pass
-    finally:
-        proc.terminate()
-        proc.wait()

apps/llama/deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: llama-swap
+  name: supervisord
   namespace: llama
 spec:
   replicas: 1
@@ -16,64 +16,24 @@ spec:
       labels:
         app: llama-swap
     spec:
-      initContainers:
-        - name: download-whisper
-          image: gitea.lumpiasty.xyz/lumpiasty/llama-swap:unified-vulkan-parakeet-2026-06-12
-          command:
-            - sh
-            - -c
-            - |
-              mkdir -p /root/.cache/whisper
-              if [ ! -f /root/.cache/whisper/ggml-small.bin ]; then
-                echo "Downloading whisper-small model..."
-                curl -L -o /root/.cache/whisper/ggml-small.bin \
-                  https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-small.bin
-              else
-                echo "whisper-small model already present, skipping download"
-              fi
-              if [ ! -f /root/.cache/ffmpeg/ffmpeg ]; then
-                echo "Downloading static ffmpeg..."
-                mkdir -p /root/.cache/ffmpeg
-                apt-get update -qq && apt-get install -y --no-install-recommends xz-utils
-                curl -L -o /root/.cache/ffmpeg/ffmpeg.tar.xz \
-                  https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-linux64-gpl.tar.xz
-                tar -xJf /root/.cache/ffmpeg/ffmpeg.tar.xz -C /root/.cache/ffmpeg --wildcards '*/ffmpeg' --strip-components=2
-                rm /root/.cache/ffmpeg/ffmpeg.tar.xz
-                chmod +x /root/.cache/ffmpeg/ffmpeg
-              else
-                echo "ffmpeg already present, skipping download"
-              fi
-          volumeMounts:
-            - name: models
-              mountPath: /root/.cache
       containers:
-        - name: llama-swap
+        - name: supervisord
-          image: gitea.lumpiasty.xyz/lumpiasty/llama-swap:unified-vulkan-parakeet-2026-06-12
+          image: gitea.lumpiasty.xyz/lumpiasty/supervisord:latest@sha256:2676d13df2a0833b27ab8ec441da78c6c43d3f7bf75837d35723eefb40a82ce1
           imagePullPolicy: IfNotPresent
-          command:
-            - llama-swap
-          args:
-            - --config=/config/config.yaml
-            - --watch-config
-          env:
-            - name: RADV_EXPERIMENTAL
-              value: transfer_queue
           ports:
             - containerPort: 8080
               name: http
               protocol: TCP
+          env:
+            - name: WORKSPACE
+              value: /root
           volumeMounts:
             - name: models
-              mountPath: /root/.cache
+              mountPath: /root
-            - name: models
-              mountPath: /usr/local/bin/ffmpeg
-              subPath: ffmpeg/ffmpeg
             - mountPath: /dev/kfd
               name: kfd
             - mountPath: /dev/dri
               name: dri
-            - mountPath: /config
-              name: config
           securityContext:
             privileged: true
       volumes:
@@ -88,9 +48,6 @@ spec:
           hostPath:
             path: /dev/dri
             type: Directory
-        - name: config
-          configMap:
-            name: llama-swap
 ---
 apiVersion: v1
 kind: Service

apps/llama/kokoro.yaml

@@ -21,7 +21,7 @@ spec:
           # OpenAI-compatible Kokoro-FastAPI TTS server, CPU PyTorch backend.
           # Models baked into the image (no PVC needed).
           # v0.3.0 includes fix for per-request voice tensor memory leak (#459).
-          image: ghcr.io/remsky/kokoro-fastapi-cpu:v0.5.0
+          image: ghcr.io/remsky/kokoro-fastapi-cpu:v0.9.0
           ports:
             - containerPort: 8880
               name: http

apps/llama/kustomization.yaml

@@ -8,9 +8,3 @@ resources:
   - pvc-ssd.yaml
   - deployment.yaml
   - kokoro.yaml
-configMapGenerator:
-  - name: llama-swap
-    namespace: llama
-    files:
-      - config.yaml=configs/config.yaml
-      - parakeet-proxy.py=configs/parakeet-proxy.py

apps/nas/deployment.yaml

@@ -15,7 +15,7 @@ spec:
     spec:
       initContainers:
         - name: prepare-home
-          image: alpine:3.24.0
+          image: alpine:3.24.1
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh

apps/openwebui/release.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: open-webui
-      version: 14.8.0
+      version: 16.5.0
       sourceRef:
         kind: HelmRepository
         name: open-webui

apps/woodpecker/release.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: woodpecker
-      version: 3.6.4
+      version: 3.7.3
       sourceRef:
         kind: HelmRepository
         name: woodpecker

docker/coredns/Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1: build CoreDNS with minimal plugin set
-FROM golang:1.25-alpine AS build
+FROM golang:1.27-alpine AS build
 
 RUN apk add --no-cache git make bash
 

docker/supervisord/Dockerfile

@@ -0,0 +1,15 @@
+FROM debian:13.6
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt update && apt install -y --no-install-recommends\
+    curl wget vim \
+    ca-certificates \
+    build-essential cmake libvulkan-dev glslc spirv-headers libssl-dev git \
+    mesa-utils mesa-vulkan-drivers \
+    supervisor \
+    && rm -rf /var/lib/apt/lists/*
+
+ADD --chmod=755 entrypoint.sh /
+
+ENTRYPOINT ["/entrypoint.sh"]

docker/supervisord/entrypoint.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+WORKSPACE="${WORKSPACE:-/workspace}"
+CONF=$WORKSPACE/supervisord.conf
+
+[[ -f "$CONF" ]] || (echo_supervisord_conf > $CONF )
+
+exec supervisord -n -c $CONF "$@"

docs/lte-failover-design.md

@@ -84,9 +84,10 @@ subnets would fail routing lookup with "net unreachable" without it.
 
 | Destination | Source | Distance | Active when |
 |---|---|---|---|
-| `0.0.0.0/0` | static via `pppoe-gpon` | 1 | GPON up |
+| `1.0.0.1/32`, `8.8.4.4/32` | static via `pppoe-gpon` | 1 | always |
+| `0.0.0.0/0` | static via `1.0.0.1`, `8.8.4.4` (recursive) | 1, 2 | GPON ping check succeeds |
 | `0.0.0.0/0` | BGP from D-Link via `192.168.6.2` | 200 | wwan up on D-Link |
-| `2000::/3` | static via `sit1` (HE tunnel) | 1 | sit1 active (HE tunnel works) |
+| `2000::/3` | static via `2001:470:70:dd::1` (HE tunnel) | 1 | HE tunnel ping check succeeds |
 | `2000::/3` | BGP from D-Link via `2001:470:61a3:600::2` | 200 | wwan up on D-Link |
 
 RouterOS distance comparison is straightforward: distance 1 always wins
@@ -136,11 +137,12 @@ preferred route for D-Link's own traffic.
 - **wwan modem goes down** → BIRD2 device protocol detects wwan0 down →
   static `lte_default` / `lte_default6` become unreachable → BGP withdraws
   announcements → CRS removes BGP-learned default
-- **GPON drops** → `pppoe-gpon` interface down → CRS distance-1 default
+- **GPON drops or blackholes** → recursive ping checks (1.0.0.1, 8.8.4.4) over `pppoe-gpon`
-  route inactive → distance-200 BGP route activates → CRS withdraws its
+  fail (takes ~20s: 10s ping interval + 10s timeout) → CRS distance-1/2 default routes inactive → distance-200 BGP route
-  default-originate announcement to D-Link (since no default is installed
+  activates → CRS withdraws its default-originate announcement to D-Link (loop
-  any more) → D-Link's kernel default-via-CRS is removed → D-Link uses
+  prevention prevents reflecting D-Link's own route) → D-Link's kernel
-  wwan kernel default → traffic flows from CRS via vlan6 → D-Link → wwan
+  default-via-CRS is removed → D-Link uses wwan kernel default → traffic flows
+  from CRS via vlan6 → D-Link → wwan
 
 All transitions are automatic and driven by interface state. No active
 probing (Netwatch / mwan3), no scripts toggling routes.
@@ -241,6 +243,16 @@ QMI initialization within ~1 second.
 
 Full investigation: see [wwan-bm806c-qmi-workaround.md](./wwan-bm806c-qmi-workaround.md).
 
+## Multi-WAN Stale Connection Tracking
+
+When the routing table fails over from GPON to LTE (or vice versa), RouterOS does not automatically clear existing connection tracking entries. If an established TCP/UDP connection is routed out the new WAN interface, it retains the NAT translation state (source IP) of the old WAN interface. The packet is sent to the ISP with the wrong source IP and is silently dropped, causing clients (like Tailscale) to hang for minutes until their internal sockets time out.
+
+To solve this purely declaratively without scripts or blanket connection flushes, the `forward` chain is configured to "fast-fail" these shifted connections:
+
+1. Connections are marked with their egress WAN upon establishment (`wan-gpon` or `wan-lte`) via the `mangle` table.
+2. If an established connection with a `wan-gpon` mark attempts to route out `vlan6` (LTE), or a `wan-lte` mark routes out `pppoe-gpon`, it is explicitly rejected (`tcp-reset` for TCP, `icmp-network-unreachable` for UDP) before reaching the NAT table.
+3. This rejection immediately signals the client OS that the route is dead, forcing the application (Tailscale, SIP clients, etc.) to instantly close the socket and establish a new one, which successfully binds to the new WAN interface and NAT state.
+
 ## Implementation files
 
 | File | Role |

docs/network.md

@@ -50,7 +50,7 @@ Network is divided to multiple VLANs to enforce strict access control rules usin
   Internet access only<br>
   IP: 192.168.5.0/24 / 2001:470:61a3:a::/64<br>
   Gateway: 192.168.5.1 / 2001:470:61a3:a:ffff:ffff:ffff:ffff<br>
-  DHCP / SLAAC, accessible via separate WiFi network "szafa" from D-Link for absolutely untrusted Tuya and like devices
+  DHCP / SLAAC, accessible via separate, hidden WiFi network "szafa" from D-Link with strict MAC filtering for absolutely untrusted Tuya and like devices
 - 6: Internet access for OpenWRT<br>
   Internet access only<br>
   IP: 192.168.6.0/24 / 2001:470:61a3:600::/64<br>

infra/configs/bgp-cluster-config.yaml

@@ -56,6 +56,7 @@ spec:
         addresses:
           # Not advertising ClusterIP - kubeproxyreplacement should? translate them directly to pod ips
           # Not advertising ExternalIP - they should be reachable via static config
+          - ClusterIP
           - LoadBalancerIP
       selector:
         matchExpressions:

infra/controllers/cert-manager-webhook-ovh.yaml

@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: cert-manager-webhook-ovh
-      version: 0.9.13
+      version: 0.9.16
       sourceRef:
         kind: HelmRepository
         name: cert-manager-webhook-ovh

infra/controllers/cert-manager.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: v1.20.2
+      version: v1.21.1
       sourceRef:
         kind: HelmRepository
         name: cert-manager

infra/controllers/cilium.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: cilium
-      version: 1.19.4
+      version: 1.20.1
       sourceRef:
         kind: HelmRepository
         name: cilium

infra/controllers/cloudnative-pg.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: cloudnative-pg
-      version: 0.28.3
+      version: 0.29.0
       sourceRef:
         kind: HelmRepository
         name: cnpg

infra/controllers/coredns.yaml

@@ -110,7 +110,7 @@ spec:
         kubernetes.io/os: linux
       containers:
         - name: coredns
-          image: registry.k8s.io/coredns/coredns:v1.14.3
+          image: registry.k8s.io/coredns/coredns:v1.14.7
           imagePullPolicy: IfNotPresent
           args: ["-conf", "/etc/coredns/Corefile"]
           ports:

infra/controllers/dns-public.yaml

@@ -97,7 +97,7 @@ spec:
           env:
             - name: GOMEMLIMIT
               value: 161MiB
-          image: registry.k8s.io/coredns/coredns:v1.14.3
+          image: registry.k8s.io/coredns/coredns:v1.14.7
           imagePullPolicy: IfNotPresent
           livenessProbe:
             failureThreshold: 5

infra/controllers/k8up.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: k8up
-      version: 4.9.0
+      version: 4.10.0
       sourceRef:
         kind: HelmRepository
         name: k8up-io

infra/controllers/openbao.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: openbao
-      version: 0.28.3
+      version: 0.29.4
       sourceRef:
         kind: HelmRepository
         name: openbao

infra/controllers/openebs.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: openebs
-      version: 4.5.0
+      version: 4.5.1
       sourceRef:
         kind: HelmRepository
         name: openebs

infra/controllers/vault-secrets-operator.yaml

@@ -23,7 +23,7 @@ spec:
   chart:
     spec:
       chart: vault-secrets-operator
-      version: 1.4.0
+      version: 1.5.1
       sourceRef:
         kind: HelmRepository
         name: hashicorp

renovate.json

@@ -11,6 +11,18 @@
     ]
   },
   "prHourlyLimit": 9,
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "apps/.+\\.yaml$"
+      ],
+      "matchStrings": [
+        "tag:\\s*[\"']?(?<currentValue>[^\"' \\n]+)[\"']?\\s*#\\s*renovate:\\s*(?:datasource=(?<datasource>[^\\s]+)\\s+)?depName=(?<depName>[^\\s]+)(?:\\s+registryUrl=(?<registryUrl>[^\\s]+))?"
+      ],
+      "datasourceTemplate": "{{#if datasource}}{{{datasource}}}{{else}}docker{{/if}}"
+    }
+  ],
   "packageRules": [
     {
       "matchPackageNames": ["usekaneo/kaneo", "ghcr.io/usekaneo/kaneo"],
@@ -25,7 +37,7 @@
       "platformAutomerge": true
     },
     {
-      "matchUpdateTypes": ["patch"],
+      "matchUpdateTypes": ["patch", "digest"],
       "automerge": true,
       "automergeType": "pr",
       "platformAutomerge": true

talos/patches/anapistula-delrosalae.patch

@@ -28,3 +28,4 @@ machine:
     # arrives too late. Work around using kernel args:
     extraKernelArgs:
       - amdgpu.runpm=1
+      - amdgpu.lockup_timeout=0,120000,0,0

vault/policy/kaneo.hcl

@@ -1,3 +1,7 @@
 path "secret/data/authentik/kaneo" {
     capabilities = ["read"]
 }
+
+path "secret/data/kaneo" {
+    capabilities = ["read"]
+}