moritz/infrapuzzle
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(openclaw): upgrade fleet to DeepSeek V4.1 Flash 1017 and harden operations

Browse Source 
- Upgrade OpenClaw primary model from deepseek-v4.1-flash to deepseek-v4.1-flash-1017 across all interactive agents, heartbeats, compaction, and cron jobs.
- Configure hardened OpenRouter provider routing for 1017 (deepinfra, inference-net, parasail, cloudflare) with strict fp8/bf16 quantization and tool_choice verification.
- Retain deepseek-v4.1-flash (0910), z-ai/glm-5.3-flash, and qwen3.8-flash in the automated fallback chain.
- Update ADR 0002 with 1017 economics (30% price reduction on prompt/cache, +60% intelligence benchmark increase) and a 7-point provider qualification playbook.
- Add operational scripts and tooling for session compaction, subagent vector deduplication, gateway preflight, and triage diagnostics in k8s/openclaw.
- Update DuckDB backend engine, git-sync logic, and test suites.
- Enhance Mila tracking UI components and add container build configuration.
- Sync Terraform infrastructure state for Authentik.
This commit is contained in:
Moritz Graf
2026-10-18 10:54:59 +02:00
parent 7ce1da18ab
commit dd60a095c6
26 changed files with 1786 additions and 1301 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/infrastructure/authentik.tf
+30
View File
@@ -376,6 +376,23 @@ resource "authentik_application" "hosting_family" {
protocol_provider = authentik_provider_proxy.hosting_family.id
}
# 11. Family Portal (family.haumdaucher.de)
resource "authentik_provider_proxy" "family_portal" {
name = "Family Portal"
external_host = "https://family.haumdaucher.de"
mode = "forward_single"
authorization_flow = data.authentik_flow.default_authorization_flow.id
invalidation_flow = data.authentik_flow.default_invalidation_flow.id
intercept_header_auth = true
access_token_validity = "days=30"
}
resource "authentik_application" "family_portal" {
name = "Family Portal"
slug = "family-portal"
protocol_provider = authentik_provider_proxy.family_portal.id
}
# --- Outpost: Embedded Proxy Outpost ---
resource "authentik_outpost" "embedded" {
@@ -392,6 +409,7 @@ resource "authentik_outpost" "embedded" {
authentik_provider_proxy.n8n.id,
authentik_provider_proxy.silverbullet.id,
authentik_provider_proxy.hosting_family.id,
authentik_provider_proxy.family_portal.id,
]
}
@@ -789,6 +807,18 @@ resource "authentik_policy_binding" "hosting_family_family" {
order = 1
}
resource "authentik_policy_binding" "family_portal_admin" {
target = authentik_application.family_portal.uuid
group = authentik_group.infra_admins.id
order = 0
}
resource "authentik_policy_binding" "family_portal_family" {
target = authentik_application.family_portal.uuid
group = authentik_group.family.id
order = 1
}
# 2. Shared & Member Applications (Accessible to all authenticated users)
resource "authentik_policy_binding" "grafana_users" {
terraform/infrastructure/terraform.tfstate
+151 -5
View File
@@ -1,7 +1,7 @@
{
"version": 4,
"terraform_version": "1.14.3",
"serial": 423,
"serial": 429,
"lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
"outputs": {
"coder_oauth_client_secret": {
@@ -217,7 +217,7 @@
"id": "7",
"is_active": true,
"is_superuser": false,
"last_login": "2026-09-05T14:23:02.674777Z",
"last_login": "2026-10-12T06:28:53.399647Z",
"name": "Amelie Graf",
"path": "users",
"pk": 7,
@@ -306,6 +306,41 @@
}
]
},
{
"mode": "managed",
"type": "authentik_application",
"name": "family_portal",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"backchannel_providers": null,
"group": "",
"id": "family-portal",
"meta_description": "",
"meta_hide": false,
"meta_icon": "",
"meta_launch_url": "",
"meta_publisher": "",
"name": "Family Portal",
"open_in_new_tab": false,
"policy_engine_mode": "any",
"protocol_provider": 17,
"slug": "family-portal",
"uuid": "48cb7294-f186-4fa9-80d8-007b9ebb8f62"
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_provider_proxy.family_portal",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_application",
@@ -1155,7 +1190,8 @@
3,
10,
15,
16
16,
17
],
"service_connection": "",
"type": "proxy"
@@ -1165,6 +1201,7 @@
"private": "bnVsbA==",
"dependencies": [
"authentik_provider_proxy.alertmanager",
"authentik_provider_proxy.family_portal",
"authentik_provider_proxy.gitea_phpmyadmin",
"authentik_provider_proxy.hass_coder",
"authentik_provider_proxy.hosting_family",
@@ -1251,6 +1288,73 @@
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
"name": "family_portal_admin",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"enabled": true,
"failure_result": false,
"group": "c0ad76f4-d157-4c9e-882c-9ae5b5fc1690",
"id": "f9dffd65-0fe7-4384-a2e1-684ff2a85475",
"negate": false,
"order": 0,
"policy": "",
"target": "48cb7294-f186-4fa9-80d8-007b9ebb8f62",
"timeout": 30,
"user": 0
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_application.family_portal",
"authentik_group.infra_admins",
"authentik_provider_proxy.family_portal",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
"name": "family_portal_family",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"enabled": true,
"failure_result": false,
"group": "5e91f468-a0f2-4433-aa23-a7b6ad69df38",
"id": "033b6b44-6a29-4d01-b7f1-750b33070541",
"negate": false,
"order": 1,
"policy": "",
"target": "48cb7294-f186-4fa9-80d8-007b9ebb8f62",
"timeout": 30,
"user": 0
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_application.family_portal",
"authentik_group.family",
"authentik_provider_proxy.family_portal",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow",
"data.authentik_user.amy"
]
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
@@ -2302,6 +2406,48 @@
}
]
},
{
"mode": "managed",
"type": "authentik_provider_proxy",
"name": "family_portal",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"access_token_validity": "days=30",
"authentication_flow": "",
"authorization_flow": "68f43818-60ba-4d8e-ae66-cbac29d7be42",
"basic_auth_enabled": false,
"basic_auth_password_attribute": "",
"basic_auth_username_attribute": "",
"client_id": "4HO1RbjsgDq3JI5K4VeXF3SFCmeCTePXs3466tfz",
"cookie_domain": "",
"external_host": "https://family.haumdaucher.de",
"id": "17",
"intercept_header_auth": true,
"internal_host": "",
"internal_host_ssl_validation": true,
"invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba",
"jwks_sources": null,
"jwt_federation_providers": null,
"jwt_federation_sources": null,
"mode": "forward_single",
"name": "Family Portal",
"property_mappings": null,
"refresh_token_validity": "days=30",
"skip_path_regex": ""
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_provider_proxy",
@@ -2410,8 +2556,8 @@
"internal_host_ssl_validation": true,
"invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba",
"jwks_sources": null,
"jwt_federation_providers": null,
"jwt_federation_sources": null,
"jwt_federation_providers": [],
"jwt_federation_sources": [],
"mode": "forward_single",
"name": "Hosting Family",
"property_mappings": null,
terraform/infrastructure/terraform.tfstate.backup
+152 -5
View File
@@ -1,7 +1,7 @@
{
"version": 4,
"terraform_version": "1.14.3",
"serial": 417,
"serial": 423,
"lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
"outputs": {
"coder_oauth_client_secret": {
@@ -211,7 +211,8 @@
"date_joined": "2026-09-05T14:23:01.528947Z",
"email": "",
"groups": [
"ad33b003-77a4-4571-bec8-8301f6d6552b"
"ad33b003-77a4-4571-bec8-8301f6d6552b",
"5e91f468-a0f2-4433-aa23-a7b6ad69df38"
],
"id": "7",
"is_active": true,
@@ -495,6 +496,41 @@
}
]
},
{
"mode": "managed",
"type": "authentik_application",
"name": "hosting_family",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"backchannel_providers": null,
"group": "",
"id": "hosting-family",
"meta_description": "",
"meta_hide": false,
"meta_icon": "",
"meta_launch_url": "",
"meta_publisher": "",
"name": "Hosting Family",
"open_in_new_tab": false,
"policy_engine_mode": "any",
"protocol_provider": 16,
"slug": "hosting-family",
"uuid": "14ad2eb5-c3b8-4fe6-b980-26f1a91f44a3"
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_provider_proxy.hosting_family",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_application",
@@ -1007,8 +1043,8 @@
"id": "5e91f468-a0f2-4433-aa23-a7b6ad69df38",
"is_superuser": false,
"name": "family",
"parents": null,
"roles": null,
"parents": [],
"roles": [],
"users": [
7
]
@@ -1118,7 +1154,8 @@
7,
3,
10,
15
15,
16
],
"service_connection": "",
"type": "proxy"
@@ -1130,6 +1167,7 @@
"authentik_provider_proxy.alertmanager",
"authentik_provider_proxy.gitea_phpmyadmin",
"authentik_provider_proxy.hass_coder",
"authentik_provider_proxy.hosting_family",
"authentik_provider_proxy.n8n",
"authentik_provider_proxy.nextcloud_phpmyadmin",
"authentik_provider_proxy.openclaw",
@@ -1393,6 +1431,73 @@
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
"name": "hosting_family_admin",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"enabled": true,
"failure_result": false,
"group": "c0ad76f4-d157-4c9e-882c-9ae5b5fc1690",
"id": "55b2f74f-f650-40a2-9781-a00a5978e1e8",
"negate": false,
"order": 0,
"policy": "",
"target": "14ad2eb5-c3b8-4fe6-b980-26f1a91f44a3",
"timeout": 30,
"user": 0
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_application.hosting_family",
"authentik_group.infra_admins",
"authentik_provider_proxy.hosting_family",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
"name": "hosting_family_family",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"enabled": true,
"failure_result": false,
"group": "5e91f468-a0f2-4433-aa23-a7b6ad69df38",
"id": "b598a889-f04b-4955-8a01-6558cfaad60e",
"negate": false,
"order": 1,
"policy": "",
"target": "14ad2eb5-c3b8-4fe6-b980-26f1a91f44a3",
"timeout": 30,
"user": 0
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"authentik_application.hosting_family",
"authentik_group.family",
"authentik_provider_proxy.hosting_family",
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow",
"data.authentik_user.amy"
]
}
]
},
{
"mode": "managed",
"type": "authentik_policy_binding",
@@ -2281,6 +2386,48 @@
}
]
},
{
"mode": "managed",
"type": "authentik_provider_proxy",
"name": "hosting_family",
"provider": "provider[\"registry.terraform.io/goauthentik/authentik\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"access_token_validity": "days=30",
"authentication_flow": "",
"authorization_flow": "68f43818-60ba-4d8e-ae66-cbac29d7be42",
"basic_auth_enabled": false,
"basic_auth_password_attribute": "",
"basic_auth_username_attribute": "",
"client_id": "27XovQEtW8nMAgUN6kANZnQZMMbWVEbi8Mh6VsGP",
"cookie_domain": "",
"external_host": "https://hosting.haumdaucher.de",
"id": "16",
"intercept_header_auth": true,
"internal_host": "",
"internal_host_ssl_validation": true,
"invalidation_flow": "9add9e98-4fe7-48c5-bca8-d68968e0a7ba",
"jwks_sources": null,
"jwt_federation_providers": null,
"jwt_federation_sources": null,
"mode": "forward_single",
"name": "Hosting Family",
"property_mappings": null,
"refresh_token_validity": "days=30",
"skip_path_regex": ""
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"data.authentik_flow.default_authorization_flow",
"data.authentik_flow.default_invalidation_flow"
]
}
]
},
{
"mode": "managed",
"type": "authentik_provider_proxy",