v0.7.0

Applications

Security

• Pocket ID — OpenID Connect provider with passkey (passwordless) sign-in

IoT

• Frigate — local NVR with realtime AI object detection
• Mosquitto — MQTT broker for Frigate/Home Assistant
• Matter — Matter controller for Home Assistant
• OpenThread — Thread border router

Dev

• Forgejo — self-hosted alternative to GitHub

Network

• Zot — OCI registry with pull-through image cache

Features

Pocket ID Single Sign-On

Sign in to applications with a Pocket ID passkey instead of creating a separate account on every service.

Native OIDC authentication supported by: Beszel, DroppedNeedle, Grafana, Forgejo, Home Assistant, Immich, Jellyfin, Nextcloud, Open WebUI, RustFS, Technitium, Vaultwarden, Zot

Apps without OAuth support can:

• be protected by Traefik OIDC (f.e. Longhorn UI)
• receive profile information via forwarded request headers (Frigate)
• appear in Pocket ID's My Apps as launcher tiles.

Use pocket-*.sh scripts to create OAuth client and generate <app>:auth/clientId and <app>:auth/clientSecret.
<app>:auth/groupMap is used to map roles to PocketID groups.

More information in pocket.md and individual component pages.

IoT

Communication and provisioning of devices based on Thread and Zigbee protocols. This allows home automation that is completely local and does not require any Google/Apple/Amazon hub device.

• OpenThread border router - supports Home Assistant Connect ZBT-2
• Matter server (matter.js) for Home Assistant, with WiFi and Bluetooth provisioning of devices
• Frigate - video monitoring and AI detection (NVidia, AMD, Intel and Google Coral USB accelerator)
• Mosquitto MQTT broker for Home Assistant/Frigate integration

Intel GPU

ollama and frigate support setting <app>:gpu=intel to use Intel integrated graphics. Nodes labeled automatically with orangelab/gpu-intel=true by NFD.

Development

Git repositories can be hosted on Forgejo, a GitHub alternative. Note: CI runners are not supported yet.

Build Docker images and push to Zot.
K3S can also be configured to use it as it's registry so all images used in the cluster will automatically be downloaded from upstream and cached.

Improvements

• Email (SMTP): Consistent mail settings via <app>:smtp/* for Immich, Vaultwarden, Nextcloud, and Forgejo.
• Core stack reference: Set orangelab:coreStackRef (organization/project/stack) in a module stack to inherit the core stack's custom domain and Longhorn backup policy.
• Immich: OAuth, machine learning, and SMTP settings are now generated as a config file on every deployment instead of being configured in the UI.
• Immich: Pin the container version instead of the release tag, fixing database migration errors during upgrades.
• Bitcoin: Inline rpcauth lines so authentication works on Bitcoin Core (rpcauthfile is Knots-only).
• Longhorn: Allow replicas to co-locate on a node so 3-replica volumes can rebuild when only two nodes are schedulable.

Repository Moved

The GitHub repository is now at OrangeLab-space/orange-lab (previously QC-Labs/orange-lab). Old URLs redirect, but update your git remote:

git remote set-url origin git@github.com:OrangeLab-space/orange-lab.git

---

⚠️ BREAKING CHANGES & UPGRADE ACTIONS

Secrets and Keys Must Be Set Before Deployment

These values were previously auto-generated. They are now required in config and must stay stable for restores:

Setting	Stack	Previous output path
prometheus:grafana/password	core	monitoring.grafanaPassword
rustfs:rootPassword	core	storage.rustfsUsers.admin
n8n:N8N_ENCRYPTION_KEY	stacks/ai	apps.n8n.encryptionKey
open-webui:WEBUI_SECRET_KEY	stacks/ai	apps["open-webui"].secretKey
nextcloud:adminPassword	stacks/apps	apps.nextcloud.users.admin

• Action: Before upgrading, copy each deployed value into stack config. Run each block from the listed stack directory:

# core stack
pulumi config set prometheus:grafana/password "$(pulumi stack output --show-secrets --json | jq -r '.monitoring.grafanaPassword')" --secret
pulumi config set rustfs:rootPassword "$(pulumi stack output --show-secrets --json | jq -r '.storage.rustfsUsers.admin')" --secret

# stacks/ai
pulumi config set n8n:N8N_ENCRYPTION_KEY "$(pulumi stack output --show-secrets --json | jq -r '.apps.n8n.encryptionKey')" --secret
pulumi config set open-webui:WEBUI_SECRET_KEY "$(pulumi stack output --show-secrets --json | jq -r '.apps["open-webui"].secretKey')" --secret

# stacks/apps
pulumi config set nextcloud:adminPassword "$(pulumi stack output --show-secrets --json | jq -r '.apps.nextcloud.users.admin')" --secret

Without these values, logins and backup restores will not work.

v0.6.0

Applications

• MEDIA: New media stack:
  • Immich — photo management
  • Jellyfin — media server
  • Seerr — request management for movies/TV
  • DroppedNeedle (previously MusicSeerr) — request and discovery for music
  • Radarr / Sonarr / Lidarr — movie/TV/music library management
  • Prowlarr — indexer management
  • Transmission — Torrent downloads
  • slskd — SoulSeek music downloads
• Vaultwarden: Password manager
• Technitium: DNS server
• RustFS: S3 storage for Longhorn backups

Features

• Modular Stacks: IoT, Office, Bitcoin, AI, and Dev now live in separate stacks/<name>/ directories for independent management
• RWX Volumes: Support for RWX (ReadWriteMany) volumes, used by Jellyfin and related components for media access
• Per-Component GPU: Set <app>:<component>/gpu to nvidia or amd
• Routing Provider: orangelab:routingProvider setting to choose tailscale or traefik; can also be set per-app via <app>:routingProvider
• Image Overrides: Set <app>:<component>/image to use a custom Docker image
• Exclude Node Labels: New excludeNodeLabel setting to keep apps off certain nodes
• Bitcoin Node: externalIp setting to advertise the node's public IP (the node's port must be forwarded on your router)
• Nextcloud: Redis for the UnifiedPush provider app

---

⚠️ BREAKING CHANGES & UPGRADE ACTIONS

1. Modular Stacks Migration

Media, IoT, Office, Bitcoin, AI, and Dev moved to separate stacks (stacks/<name>/). See Multi-Stack Deployment for details.

• Action: Disable these apps in your main stack, move their config to the new stack's Pulumi.<stack>.yaml, then run pulumi up in each new stack directory.

2. MinIO Removed — Migrate to RustFS

MinIO has been removed. Use RustFS for S3-compatible storage and Longhorn backups.

• Action: Disable MinIO and Longhorn backups, enable RustFS, then re-enable Longhorn backups targeting RustFS.

3. AI GPU Config Changed

• <app>:amd-gpu is replaced by <app>:gpu (set to nvidia or amd)
• Action: Update config for ollama, automatic1111, sdnext, invokeai, open-webui

4. Traefik Disabled by Default

• Action: Enable explicitly if you use custom domain ingress.

pulumi config set traefik:enabled true
pulumi up

5. Storage: GPU Volume Affinity Removed

Longhorn now manages placement.

• Action: Set requiredVolumeLabel if you need volumes on specific nodes.

v0.5.0

Applications

• OFFICE: Added Nextcloud for file hosting, contacts, calendars, tasks, bookmarks
• DATA: Database management with CloudNative-PG (PostgreSQL) and MariaDB-operator
• BITCOIN: Run your own node with Bitcoin Core/Bitcoin Knots, Electrs, and Mempool explorer

Features

• Custom Domains supported via Traefik. Note: TCP endpoints (bitcoin, electrs) still using Tailscale-operator
• HTTPS endpoints: automated Let's Encrypt certificates via cert-manager
• AMD GPU Direct Access: Enhanced AMD support by mounting /dev/kfd and /dev/dri directly, allowing multiple pods to share the same GPU
• /orangelab-upgrade command in OpenCode to use your LLM model for migration guidance

Improvements

• Database Provisioning: Applications can now easily request PostgreSQL or MariaDB clusters via app.addPostgres() and app.addMariaDB()
• Beszel Agent: Improved monitoring with universal token registration for host-network agents
• Refactored Architecture: Core logic moved to src/ for better maintainability, with a clearer separation between framework code and application components

Fixes

• better dependency management: databases created before applications, destroy storage only after charts/deployments removed

---

⚠️ BREAKING CHANGES & UPGRADE ACTIONS

This version contains several breaking changes. Use /orangelab-upgrade command in OpenCode (plan mode) using your LLM model for guidance or follow these steps:

1. Tailscale Migration (OAuth & Labels)

The Tailscale integration has been completely overhauled to use OAuth and a unified tag.

• Action: Create a new tag:orangelab in your Tailscale admin console.
• Action: Generate a Tailscale OAuth token and update your config:

  pulumi config set tailscale:enabled false
  pulumi up
  # Add your new OAuth token to Pulumi.<stack>.yaml
  pulumi config set tailscale:enabled true
  pulumi up

• Action: Update nodes using ./scripts/k3s-server.sh and ./scripts/k3s-agent.sh to remove legacy VPN auth keys.

2. Traefik Helm Transition

Traefik is now managed via Helm for better flexibility.

• Action: Uninstall the old built-in Traefik instance before applying:

  ./scripts/k3s-server.sh # Updates k3s config to disable default traefik
  helm uninstall traefik traefik-crd -n kube-system

3. Minio & S3 Provisioner

The Minio Pulumi provider has been replaced by a custom S3-provisioner.

• Action: Disable and re-enable Minio:

  pulumi config set minio:enabled false
  pulumi up
  pulumi config set minio:enabled true
  pulumi up

4. Node Label Standardization

Node labels have been migrated to Kubernetes standard node-role format.

• Longhorn: Replaced orangelab/storage with node-role.kubernetes.io/longhorn.
  • Action: Manually label your storage nodes:

    kubectl label nodes <node-name> node-role.kubernetes.io/longhorn=true
    kubectl label nodes <node-name> orangelab/storage-

• GPU: Replaced orangelab/gpu with node-role.kubernetes.io/gpu.
  • Action: These labels should be auto-detected by NFD, redeployment of GPU-dependent applications might be needed to pick up new affinity rules.

5. Longhorn Volume Affinity

Volume affinity logic was updated to improve scheduling. Due to the immutability of VolumeNodeAffinity, applications may need redeployment.

• Action: Ensure fromVolume and db/rootPassword are correctly set for your apps to ensure smooth state recovery during redeployment.

v0.4.0

• AMD GPU support
• automatic detection of GPU nodes (NVidia and AMD)
• storage: attach to existing volumes (restored or cloned) with <app>:fromVolume
• storage: automatic incremental backups to S3
• storage: provisioning from S3 backups with <app>:fromBackup
• MinIO S3-compatible storage
• TCP endpoint support in addition to HTTPS
• preload models with ollama:models
• ./scripts/logs.sh <app> <namespace?> wrapper to view logs from deployed applications
• storage: attach multiple volumes to container
• storage: automatic snapshots, backups and file system trim

New documentation:

• Backup and restore - https://github.com/QC-Labs/orange-lab/blob/main/docs/backup.md
• AMD GPU support - https://github.com/QC-Labs/orange-lab/blob/main/docs/amd-gpu.md
• Upgrade workflow - https://github.com/QC-Labs/orange-lab/blob/main/docs/upgrade.md

v0.3.0

• SD-Next (https://vladmandic.github.io/sdnext-docs/) as alternative to automatic1111 stable diffusion
• InvokeAI community edition (https://www.invoke.com/)
• updates to KubeAI and vLLM
• Application builder class to make it easier to define applications
• support for adding Grafana dashboards
• allow overriding storage class used by each app
• preferredNodeLabel to deploy to subset of nodes or specific node
• requiredNodeLabel to require labeled nodes (replaces zone setting)
• cpu/memory limits per namespace, application and container
• version now optional for Helm charts, use latest by default
• faster recovery when node down (default toleration reduced from 5 minutes to 10 seconds)
• clean up application labels, use standard app.kubernetes.io labels
• support for liveness, readiness and startup probes
• use Recreate instead of RollingUpdate by default for apps with storage
• documentation updates (moved module docs to subfolders, troubleshooting section, SSH, disable suspend on lid close)

v0.2.0

AI module release:

• NVidia GPU Operator
• Ollama
• Open-WebUI
• automatic1111

Beszel (https://beszel.dev/) monitoring component.

Longhorn as default provisioner.

Move from oranglelab:<app> to <app>:enabled setting.
<app>:storageOnly to disable application but keep storage.

Read-only k8s access with tailscale configure kubeconfig k8s

Pulumi IDs updated to group by module.