v0.5.0

Applications

• OFFICE: Added Nextcloud for file hosting, contacts, calendars, tasks, bookmarks
• DATA: Database management with CloudNative-PG (PostgreSQL) and MariaDB-operator
• BITCOIN: Run your own node with Bitcoin Core/Bitcoin Knots, Electrs, and Mempool explorer

Features

• Custom Domains supported via Traefik. Note: TCP endpoints (bitcoin, electrs) still using Tailscale-operator
• HTTPS endpoints: automated Let's Encrypt certificates via cert-manager
• AMD GPU Direct Access: Enhanced AMD support by mounting /dev/kfd and /dev/dri directly, allowing multiple pods to share the same GPU
• /orangelab-upgrade command in OpenCode to use your LLM model for migration guidance

Improvements

• Database Provisioning: Applications can now easily request PostgreSQL or MariaDB clusters via app.addPostgres() and app.addMariaDB()
• Beszel Agent: Improved monitoring with universal token registration for host-network agents
• Refactored Architecture: Core logic moved to src/ for better maintainability, with a clearer separation between framework code and application components

Fixes

• better dependency management: databases created before applications, destroy storage only after charts/deployments removed

---

⚠️ BREAKING CHANGES & UPGRADE ACTIONS

This version contains several breaking changes. Use /orangelab-upgrade command in OpenCode (plan mode) using your LLM model for guidance or follow these steps:

1. Tailscale Migration (OAuth & Labels)

The Tailscale integration has been completely overhauled to use OAuth and a unified tag.

• Action: Create a new tag:orangelab in your Tailscale admin console.
• Action: Generate a Tailscale OAuth token and update your config:

  pulumi config set tailscale:enabled false
  pulumi up
  # Add your new OAuth token to Pulumi.<stack>.yaml
  pulumi config set tailscale:enabled true
  pulumi up

• Action: Update nodes using ./scripts/k3s-server.sh and ./scripts/k3s-agent.sh to remove legacy VPN auth keys.

2. Traefik Helm Transition

Traefik is now managed via Helm for better flexibility.

• Action: Uninstall the old built-in Traefik instance before applying:

  ./scripts/k3s-server.sh # Updates k3s config to disable default traefik
  helm uninstall traefik traefik-crd -n kube-system

3. Minio & S3 Provisioner

The Minio Pulumi provider has been replaced by a custom S3-provisioner.

• Action: Disable and re-enable Minio:

  pulumi config set minio:enabled false
  pulumi up
  pulumi config set minio:enabled true
  pulumi up

4. Node Label Standardization

Node labels have been migrated to Kubernetes standard node-role format.

• Longhorn: Replaced orangelab/storage with node-role.kubernetes.io/longhorn.
  • Action: Manually label your storage nodes:

    kubectl label nodes <node-name> node-role.kubernetes.io/longhorn=true
    kubectl label nodes <node-name> orangelab/storage-

• GPU: Replaced orangelab/gpu with node-role.kubernetes.io/gpu.
  • Action: These labels should be auto-detected by NFD, redeployment of GPU-dependent applications might be needed to pick up new affinity rules.

5. Longhorn Volume Affinity

Volume affinity logic was updated to improve scheduling. Due to the immutability of VolumeNodeAffinity, applications may need redeployment.

• Action: Ensure fromVolume and db/rootPassword are correctly set for your apps to ensure smooth state recovery during redeployment.