fix(tailscale): official doc validation — schema, flags, key-expiry

.claude/scripts/setup-runner.sh

@@ -3,7 +3,7 @@
 # Generated: 2025-12-23
 #
 # Usage: ./setup-runner.sh <HOST_TYPE>
-# Where HOST_TYPE is one of: ai-lab, vps, cloudstartup, kvm4
+# Where HOST_TYPE is one of: ai-lab, vps, cloudstartup, kvm4, kvm4-1, kvm4-2, kvm2
 
 set -e
 
@@ -21,10 +21,13 @@ HOST_LABELS["ai-lab"]="self-hosted,ai-lab,gpu,Linux,X64"
 HOST_LABELS["vps"]="self-hosted,vps,Linux,X64"
 HOST_LABELS["cloudstartup"]="self-hosted,cloudstartup,staging,Linux,X64"
 HOST_LABELS["kvm4"]="self-hosted,kvm4,production,Linux,X64"
+HOST_LABELS["kvm4-1"]="self-hosted,vps,kvm4,kvm4-1,production,Linux,X64"
+HOST_LABELS["kvm4-2"]="self-hosted,vps,kvm4,kvm4-2,production,Linux,X64"
+HOST_LABELS["kvm2"]="self-hosted,vps,kvm2,backup,Linux,X64"
 
 if [[ -z "$HOST_TYPE" ]] || [[ ! ${HOST_LABELS[$HOST_TYPE]+_} ]]; then
     echo "Usage: $0 <HOST_TYPE>"
-    echo "HOST_TYPE must be one of: ai-lab, vps, cloudstartup, kvm4"
+    echo "HOST_TYPE must be one of: ai-lab, vps, cloudstartup, kvm4, kvm4-1, kvm4-2, kvm2"
     exit 1
 fi
 

.github/workflows/build-images.yml

@@ -19,7 +19,7 @@ env:
 
 jobs:
   setup-matrix:
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
@@ -47,6 +47,7 @@ jobs:
     runs-on: [self-hosted, Linux, X64]
     strategy:
       fail-fast: false
+      max-parallel: 4
       matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
     defaults:
       run:

.github/workflows/codex-parity-advisory.yml

@@ -11,6 +11,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   codex-parity-advisory:
     name: codex-parity-advisory

.github/workflows/deploy-gateway-agent.yml

@@ -32,8 +32,7 @@ env:
 jobs:
   validate:
     name: Validate Configuration
-    # PMOVES.AI: Use self-hosted runners for production CI
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
@@ -177,9 +176,15 @@ jobs:
 
       - name: Verify secrets loaded
         run: |
-          secrets=$(curl -s http://localhost:8100/secrets)
-          echo "✓ Secrets endpoint response:"
-          echo "$secrets" | jq '.'
+          count=$(curl -sf http://localhost:8100/secrets | jq 'length' 2>/dev/null) || {
+            echo "✗ Failed to query secrets endpoint"
+            exit 1
+          }
+          if [ "$count" -eq 0 ] 2>/dev/null; then
+            echo "✗ Zero secret keys loaded — check GitHub Secrets configuration"
+            exit 1
+          fi
+          echo "✓ $count secret keys loaded"
 
   # ============================================================================
   # Rollback

.github/workflows/hardening-validation.yml

@@ -31,7 +31,7 @@ jobs:
   # ============================================================================
   validate-hardening:
     name: Validate Hardening Patterns
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
 
     steps:
       - name: Harden Runner
@@ -88,7 +88,7 @@ jobs:
   # ============================================================================
   validate-dockerfiles:
     name: Validate Dockerfiles
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       # Limit fan-out to reduce self-hosted queue contention.
@@ -166,7 +166,7 @@ jobs:
   # ============================================================================
   docker-bench:
     name: Docker Bench Security
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: [self-hosted, Linux, X64, vps]
 
     steps:
       - name: Harden Runner
@@ -200,7 +200,7 @@ jobs:
   # ============================================================================
   validate-compose:
     name: Validate Compose Files
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
 
     steps:
       - name: Harden Runner
@@ -277,7 +277,7 @@ jobs:
   # ============================================================================
   summary:
     name: Validation Summary
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     needs: [validate-hardening, validate-dockerfiles, validate-compose]
     if: always()
 

.github/workflows/python-tests.yml

@@ -29,8 +29,7 @@ concurrency:
 
 jobs:
   tests:
-    # PMOVES.AI: Use self-hosted runners for production CI
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       actions: read

.github/workflows/self-hosted-builds-hardened.yml

@@ -183,6 +183,7 @@ jobs:
     runs-on: [self-hosted, Linux, X64]
     strategy:
       fail-fast: false
+      max-parallel: 3
       matrix:
         service:
           - name: pmoves-yt

.github/workflows/sql-policy-lint.yml

@@ -23,8 +23,7 @@ permissions:
 
 jobs:
   lint:
-    # PMOVES.AI: Use self-hosted runners for production CI
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:

.github/workflows/sync-secrets-local.yml

@@ -106,6 +106,14 @@ jobs:
           GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          # Hostinger VPS
+          HOSTINGER_API_TOKEN: ${{ secrets.HOSTINGER_API_TOKEN }}
+          HOSTINGER_KVM4_1_IP: ${{ secrets.HOSTINGER_KVM4_1_IP }}
+          HOSTINGER_KVM4_1_USER: ${{ secrets.HOSTINGER_KVM4_1_USER }}
+          HOSTINGER_KVM4_2_IP: ${{ secrets.HOSTINGER_KVM4_2_IP }}
+          HOSTINGER_KVM4_2_USER: ${{ secrets.HOSTINGER_KVM4_2_USER }}
+          HOSTINGER_KVM2_IP: ${{ secrets.HOSTINGER_KVM2_IP }}
+          HOSTINGER_KVM2_USER: ${{ secrets.HOSTINGER_KVM2_USER }}
         run: |
           import json, os, sys
           from pathlib import Path

.github/workflows/webhook-smoke.yml

@@ -17,9 +17,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   smoke:
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@v2

.github/workflows/yt-dlp-bump.yml

@@ -19,8 +19,7 @@ permissions:
 
 jobs:
   bump-yt-dlp:
-    # PMOVES.AI: Use self-hosted runners for production CI
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -38,6 +37,12 @@ jobs:
           fi
           echo "version=$latest" >> $GITHUB_OUTPUT
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
       - name: Build pmoves-yt with bumped yt-dlp
         uses: docker/build-push-action@v6
         with:

.gitignore

@@ -154,6 +154,15 @@ pmoves/env.jellyfin-ai
 pmoves/env.supa.runtime.bak.*
 
 
+# =============================================================================
+# Terraform
+# =============================================================================
+*.tfvars
+!*.tfvars.example
+.terraform/
+*.tfstate
+*.tfstate.*
+
 # Windows
 desktop.ini
 Thumbs.db