the historical defaults dc3.security.key.2026.io.github.pnoker and
io.github.pnoker.dc3 are public in this repository, so any deployment
that never overrode them shipped a known hmac signing key
- app/scale/swarm compose: fail fast (${var:?}) when dc3_security_key
or auth_hmac_secret is unset; dev compose keeps a clearly-marked
dev-only default
- helm production/default values and k8s secret.env ship empty values:
pre/pro startup rejects blank and known-default hmac keys, forcing
--set-string or an existingsecret; document the per-key failure mode
honestly instead of overpromising startup rejection for both
- dev env files: rotate both keys to machine-generated dev-only values
and add throwaway rs256 material for local oauth flows
- fix the chart maintainer email to a syntactically valid address
- migrate auth, manager, data, and agentic persistence to R2DBC
- hard cut pagination, facade, gateway, web, and CLI contracts
- remove legacy database and TSDB adapters and document validation gates
BREAKING CHANGE: platform persistence now requires PostgreSQL 18 with TimescaleDB and the new reactive API contracts.
- add the canonical AGPL header to the six agentic application yml files and the two python scripts that lacked one
- add the header to all 79 kustomize, helm, and grafana yaml files, including the k8s driver template which regenerates the 36 driver manifests
- verified: the k8s yaml files parse (multi-document aware), the python scripts compile, and the regenerated drivers differ only by the header
- add ble, can, dlt645, dnp3, iec61850, kafka, knx, lorawan, mbus, redis, and zigbee to the k8s driver list, kustomization, helm values, and compose service stacks
- regenerate k8s driver deployments and preserve the listening-virtual ports in the generator
- replace the per-driver named volumes with one shared driver_data volume isolated by mount path, matching the scale/swarm stacks
- correct scaling docs: compose scale/swarm drivers stay at one replica because replicas would share one SQLite outbox file
pnoker