Pending tasks collected from the Cirrus pages, grouped by area. Source page linked under each heading.

Cluster (k3s)

From Two-Node k3s Cluster — Networking & Postgres Setup

• [ ] Migrate the postgres Endpoints to EndpointSlice (discovery.k8s.io/v1)
• [ ] Decide on secrets management (Infisical, Doppler, or sops)
• [ ] Add metrics-server for lightweight observability
• [x] Add a recurring WSL watchdog task (check-and-restart) to cover manual wsl --shutdown, since the keepalive only triggers on boot

Ingress

From Cloudflared Tunnel Setup (cirrus)

• [ ] Disable Traefik (--disable=traefik in Rowan's k3s server args, then restart k3s)

Access (Thunderhead)

From SSH Access / Network Map

• [ ] Move the kubeconfig on Thunderhead into Termux private app storage (not /sdcard)
• [x] Consider running k9s on Thunderhead so all devices share one kubeconfig
• [ ] Consider Thunderhead as the target for the Postgres backup cron job

Faraday (Postgres host)

From Faraday Node (Termux Postgres Host)

• [ ] Mirror the argocd-cm exclusion change into the Argo install manifest so an upgrade does not reset it
• [ ] Retire Rowan's systemd Postgres once the rollback window has passed
• [x] Reboot test: confirm SSH works and sv status ~/sv/* shows both services up