Payload
{
"action": "created",
"issue": {
"url": "https://api.github.com/repos/darkmatter/gitops/issues/103",
"repository_url": "https://api.github.com/repos/darkmatter/gitops",
"labels_url": "https://api.github.com/repos/darkmatter/gitops/issues/103/labels{/name}",
"comments_url": "https://api.github.com/repos/darkmatter/gitops/issues/103/comments",
"events_url": "https://api.github.com/repos/darkmatter/gitops/issues/103/events",
"html_url": "https://github.com/darkmatter/gitops/pull/103",
"id": 4930578331,
"node_id": "PR_kwDOSjW5Zs7z7Zl1",
"number": 103,
"title": "feat: deploy tailnet-only OMP collab relay/web (centaur-3w2.3)",
"user": {
"login": "czxtm",
"id": 1325802,
"node_id": "MDQ6VXNlcjEzMjU4MDI=",
"avatar_url": "https://avatars.githubusercontent.com/u/1325802?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/czxtm",
"html_url": "https://github.com/czxtm",
"followers_url": "https://api.github.com/users/czxtm/followers",
"following_url": "https://api.github.com/users/czxtm/following{/other_user}",
"gists_url": "https://api.github.com/users/czxtm/gists{/gist_id}",
"starred_url": "https://api.github.com/users/czxtm/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/czxtm/subscriptions",
"organizations_url": "https://api.github.com/users/czxtm/orgs",
"repos_url": "https://api.github.com/users/czxtm/repos",
"events_url": "https://api.github.com/users/czxtm/events{/privacy}",
"received_events_url": "https://api.github.com/users/czxtm/received_events",
"type": "User",
"user_view_type": "public",
"site_admin": false
},
"labels": [],
"state": "closed",
"locked": false,
"assignees": [],
"milestone": null,
"comments": 1,
"created_at": "2026-07-20T15:44:34Z",
"updated_at": "2026-07-20T15:45:35Z",
"closed_at": "2026-07-20T15:45:35Z",
"assignee": null,
"author_association": "MEMBER",
"issue_field_values": [],
"type": null,
"active_lock_reason": null,
"draft": false,
"pull_request": {
"url": "https://api.github.com/repos/darkmatter/gitops/pulls/103",
"html_url": "https://github.com/darkmatter/gitops/pull/103",
"diff_url": "https://github.com/darkmatter/gitops/pull/103.diff",
"patch_url": "https://github.com/darkmatter/gitops/pull/103.patch",
"merged_at": null
},
"body": "## Summary\n\nDeploy the native OMP collaboration relay and web client as a single-replica, memory-only service reachable only through Tailscale HTTPS/WSS. No public ingress, Console SSO, persistent room storage, or per-user DB.\n\nPattern: mirrors `omp-auth-broker` (`manifests/omp-auth-broker/`) for single-replica tailnet-only service posture.\n\n## Changed files\n\n- `apps/omp-collab-relay.yaml` — ArgoCD Application (sync wave 1, centaur namespace)\n- `manifests/omp-collab-relay/deployment.yaml` — single replica, Recreate, hardened pod security\n- `manifests/omp-collab-relay/service.yaml` — ClusterIP on port 7466\n- `manifests/omp-collab-relay/ingress.yaml` — Tailscale ingress class, TLS hostname\n- `manifests/omp-collab-relay/networkpolicy.yaml` — least-privilege (tailscale proxy only, no egress)\n- `manifests/omp-collab-relay/kustomization.yaml` — resource set\n\n## Image provenance\n\n`ghcr.io/darkmatter/centaur-collab-relay` — to be built from the upstream `collab-web` package (`can1357/oh-my-pi` `packages/collab-web`) at a pinned oh-my-pi tag, following the `centaur-omp-stats` Dockerfile + `darkmatter-images.yml` pattern in `darkmatter/centaur`.\n\n**Exhaustive provenance verification — no immutable native OMP collab-web image/artifact exists:**\n- No `collab-web` or `collab-relay` container image in any registry (darkmatter GHCR, paradigmxyz GHCR, can1357 GHCR)\n- No `@oh-my-pi/collab-web` npm package (private, not published)\n- No Dockerfile in `packages/collab-web/`\n- No CI job builds/publishes a collab-web/relay container image\n- The omp binary release (v17.0.5) ships only omp CLI binaries — no relay/web assets\n\n## ⚠️ Blocker\n\nThe `centaur-collab-relay` image does not yet exist — the deployment is **blocked on a proper image build** being added to `darkmatter/centaur` (Dockerfile + `darkmatter-images.yml` job, following the `centaur-omp-stats` pattern). The image build depends on the `collab-web` package source at a pinned oh-my-pi tag. The image tag in `deployment.yaml` is a `sha-TODO` placeholder until the image is published.\n\nThe gitops manifests are correct and deployable once the image exists — they do not hand-roll or duplicate the native relay/web protocol.\n\n## Security boundary\n\n- **No public ingress** — Tailscale ingress class only (tailnet-only)\n- **Least-privilege NetworkPolicy** — admits only the Tailscale operator proxy pod; no egress at all (pure in-memory WebSocket broker)\n- **Hardened pod security** — non-root (UID 1001), `readOnlyRootFilesystem`, drop ALL capabilities, no privilege escalation\n- **Memory-only** — rooms live in the process heap; relay restart invalidates all rooms (host owns the authoritative transcript)\n- **No Console SSO, no per-user DB, no PVC**\n\n## Validation\n\n```\nkubeconform -strict -ignore-missing-schemas -summary — 6 resources, 0 errors\nyq eval '.' — all files OK\ngit diff --check — clean\n```\n\n## Bead\n\ncentaur-3w2.3 — left **OPEN**: the live WSS flow cannot be verified without the image build + deploy. The exact remaining gate: add `services/collab-relay/Dockerfile` + `darkmatter-images.yml` job in `darkmatter/centaur` to build and publish `ghcr.io/darkmatter/centaur-collab-relay:sha-<commit>` from the upstream `collab-web` package, then update the tag in `deployment.yaml` and verify the tailnet WSS flow.",
"reactions": {
"url": "https://api.github.com/repos/darkmatter/gitops/issues/103/reactions",
"total_count": 0,
"+1": 0,
"-1": 0,
"laugh": 0,
"hooray": 0,
"confused": 0,
"heart": 0,
"rocket": 0,
"eyes": 0
},
"timeline_url": "https://api.github.com/repos/darkmatter/gitops/issues/103/timeline",
"performed_via_github_app": null,
"state_reason": null
},
"comment": {
"url": "https://api.github.com/repos/darkmatter/gitops/issues/comments/5024174652",
"html_url": "https://github.com/darkmatter/gitops/pull/103#issuecomment-5024174652",
"issue_url": "https://api.github.com/repos/darkmatter/gitops/issues/103",
"id": 5024174652,
"node_id": "IC_kwDOSjW5Zs8AAAABK3bSPA",
"user": {
"login": "czxtm",
"id": 1325802,
"node_id": "MDQ6VXNlcjEzMjU4MDI=",
"avatar_url": "https://avatars.githubusercontent.com/u/1325802?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/czxtm",
"html_url": "https://github.com/czxtm",
"followers_url": "https://api.github.com/users/czxtm/followers",
"following_url": "https://api.github.com/users/czxtm/following{/other_user}",
"gists_url": "https://api.github.com/users/czxtm/gists{/gist_id}",
"starred_url": "https://api.github.com/users/czxtm/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/czxtm/subscriptions",
"organizations_url": "https://api.github.com/users/czxtm/orgs",
"repos_url": "https://api.github.com/users/czxtm/repos",
"events_url": "https://api.github.com/users/czxtm/events{/privacy}",
"received_events_url": "https://api.github.com/users/czxtm/received_events",
"type": "User",
"user_view_type": "public",
"site_admin": false
},
"created_at": "2026-07-20T15:45:35Z",
"updated_at": "2026-07-20T15:45:35Z",
"body": "Closing until the referenced immutable relay image exists. We do not merge placeholder image tags. The manifests remain available on feat/omp-collab-relay and will be updated/reopened after the Centaur image build lands.",
"author_association": "MEMBER",
"reactions": {
"url": "https://api.github.com/repos/darkmatter/gitops/issues/comments/5024174652/reactions",
"total_count": 0,
"+1": 0,
"-1": 0,
"laugh": 0,
"hooray": 0,
"confused": 0,
"heart": 0,
"rocket": 0,
"eyes": 0
},
"performed_via_github_app": null,
"minimized": null
},
"repository": {
"id": 1245034854,
"node_id": "R_kgDOSjW5Zg",
"name": "gitops",
"full_name": "darkmatter/gitops",
"private": true,
"owner": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/darkmatter",
"html_url": "https://github.com/darkmatter",
"followers_url": "https://api.github.com/users/darkmatter/followers",
"following_url": "https://api.github.com/users/darkmatter/following{/other_user}",
"gists_url": "https://api.github.com/users/darkmatter/gists{/gist_id}",
"starred_url": "https://api.github.com/users/darkmatter/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/darkmatter/subscriptions",
"organizations_url": "https://api.github.com/users/darkmatter/orgs",
"repos_url": "https://api.github.com/users/darkmatter/repos",
"events_url": "https://api.github.com/users/darkmatter/events{/privacy}",
"received_events_url": "https://api.github.com/users/darkmatter/received_events",
"type": "Organization",
"user_view_type": "public",
"site_admin": false
},
"html_url": "https://github.com/darkmatter/gitops",
"description": "ArgoCD-managed Kubernetes workloads for the Dark Matter k3s control plane (app-of-apps target).",
"fork": false,
"url": "https://api.github.com/repos/darkmatter/gitops",
"forks_url": "https://api.github.com/repos/darkmatter/gitops/forks",
"keys_url": "https://api.github.com/repos/darkmatter/gitops/keys{/key_id}",
"collaborators_url": "https://api.github.com/repos/darkmatter/gitops/collaborators{/collaborator}",
"teams_url": "https://api.github.com/repos/darkmatter/gitops/teams",
"hooks_url": "https://api.github.com/repos/darkmatter/gitops/hooks",
"issue_events_url": "https://api.github.com/repos/darkmatter/gitops/issues/events{/number}",
"events_url": "https://api.github.com/repos/darkmatter/gitops/events",
"assignees_url": "https://api.github.com/repos/darkmatter/gitops/assignees{/user}",
"branches_url": "https://api.github.com/repos/darkmatter/gitops/branches{/branch}",
"tags_url": "https://api.github.com/repos/darkmatter/gitops/tags",
"blobs_url": "https://api.github.com/repos/darkmatter/gitops/git/blobs{/sha}",
"git_tags_url": "https://api.github.com/repos/darkmatter/gitops/git/tags{/sha}",
"git_refs_url": "https://api.github.com/repos/darkmatter/gitops/git/refs{/sha}",
"trees_url": "https://api.github.com/repos/darkmatter/gitops/git/trees{/sha}",
"statuses_url": "https://api.github.com/repos/darkmatter/gitops/statuses/{sha}",
"languages_url": "https://api.github.com/repos/darkmatter/gitops/languages",
"stargazers_url": "https://api.github.com/repos/darkmatter/gitops/stargazers",
"contributors_url": "https://api.github.com/repos/darkmatter/gitops/contributors",
"subscribers_url": "https://api.github.com/repos/darkmatter/gitops/subscribers",
"subscription_url": "https://api.github.com/repos/darkmatter/gitops/subscription",
"commits_url": "https://api.github.com/repos/darkmatter/gitops/commits{/sha}",
"git_commits_url": "https://api.github.com/repos/darkmatter/gitops/git/commits{/sha}",
"comments_url": "https://api.github.com/repos/darkmatter/gitops/comments{/number}",
"issue_comment_url": "https://api.github.com/repos/darkmatter/gitops/issues/comments{/number}",
"contents_url": "https://api.github.com/repos/darkmatter/gitops/contents/{+path}",
"compare_url": "https://api.github.com/repos/darkmatter/gitops/compare/{base}...{head}",
"merges_url": "https://api.github.com/repos/darkmatter/gitops/merges",
"archive_url": "https://api.github.com/repos/darkmatter/gitops/{archive_format}{/ref}",
"downloads_url": "https://api.github.com/repos/darkmatter/gitops/downloads",
"issues_url": "https://api.github.com/repos/darkmatter/gitops/issues{/number}",
"pulls_url": "https://api.github.com/repos/darkmatter/gitops/pulls{/number}",
"milestones_url": "https://api.github.com/repos/darkmatter/gitops/milestones{/number}",
"notifications_url": "https://api.github.com/repos/darkmatter/gitops/notifications{?since,all,participating}",
"labels_url": "https://api.github.com/repos/darkmatter/gitops/labels{/name}",
"releases_url": "https://api.github.com/repos/darkmatter/gitops/releases{/id}",
"deployments_url": "https://api.github.com/repos/darkmatter/gitops/deployments",
"created_at": "2026-05-20T21:03:10Z",
"updated_at": "2026-07-20T13:47:28Z",
"pushed_at": "2026-07-20T15:44:19Z",
"git_url": "git://github.com/darkmatter/gitops.git",
"ssh_url": "org-17834193@github.com:darkmatter/gitops.git",
"clone_url": "https://github.com/darkmatter/gitops.git",
"svn_url": "https://github.com/darkmatter/gitops",
"homepage": null,
"size": 2306,
"stargazers_count": 0,
"watchers_count": 0,
"language": "Shell",
"has_issues": true,
"has_projects": true,
"has_downloads": true,
"has_wiki": true,
"has_pages": false,
"has_discussions": true,
"forks_count": 0,
"mirror_url": null,
"archived": false,
"disabled": false,
"open_issues_count": 23,
"license": null,
"allow_forking": false,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "private",
"forks": 0,
"open_issues": 23,
"watchers": 0,
"default_branch": "main",
"custom_properties": {}
},
"organization": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"url": "https://api.github.com/orgs/darkmatter",
"repos_url": "https://api.github.com/orgs/darkmatter/repos",
"events_url": "https://api.github.com/orgs/darkmatter/events",
"hooks_url": "https://api.github.com/orgs/darkmatter/hooks",
"issues_url": "https://api.github.com/orgs/darkmatter/issues",
"members_url": "https://api.github.com/orgs/darkmatter/members{/member}",
"public_members_url": "https://api.github.com/orgs/darkmatter/public_members{/member}",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"description": ""
},
"enterprise": {
"id": 469843,
"slug": "darkmatter",
"name": "darkmatter",
"node_id": "E_kgDOAAcrUw",
"avatar_url": "https://avatars.githubusercontent.com/b/469843?v=4",
"description": "",
"website_url": "darkmatter.io",
"html_url": "https://github.com/enterprises/darkmatter",
"created_at": "2025-09-07T16:01:00Z",
"updated_at": "2026-07-07T15:59:26Z"
},
"sender": {
"login": "czxtm",
"id": 1325802,
"node_id": "MDQ6VXNlcjEzMjU4MDI=",
"avatar_url": "https://avatars.githubusercontent.com/u/1325802?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/czxtm",
"html_url": "https://github.com/czxtm",
"followers_url": "https://api.github.com/users/czxtm/followers",
"following_url": "https://api.github.com/users/czxtm/following{/other_user}",
"gists_url": "https://api.github.com/users/czxtm/gists{/gist_id}",
"starred_url": "https://api.github.com/users/czxtm/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/czxtm/subscriptions",
"organizations_url": "https://api.github.com/users/czxtm/orgs",
"repos_url": "https://api.github.com/users/czxtm/repos",
"events_url": "https://api.github.com/users/czxtm/events{/privacy}",
"received_events_url": "https://api.github.com/users/czxtm/received_events",
"type": "User",
"user_view_type": "public",
"site_admin": false
},
"installation": {
"id": 131074261,
"node_id": "MDIzOkludGVncmF0aW9uSW5zdGFsbGF0aW9uMTMxMDc0MjYx"
}
}