This website requires JavaScript.
dfa1a370ac
ci(deploy): publish the stack over TLS when PUBLIC_DOMAIN is set (refs #175 )
not and Claude Opus 5
2026-09-18 16:31:47 +02:00
399d110663
docs(arch): ADR-0035 and the runbook section for publishing the stack (refs #177 )
not and Claude Opus 5
2026-09-18 16:30:38 +02:00
56cba9c340
feat(k8s): terminate TLS in the cluster for a public domain (refs #177 )
not and Claude Opus 5
2026-09-18 16:30:38 +02:00
88fda30008
test(k8s): pin the issuer, the portal authority and the public edge (refs #177 )
not and Claude Opus 5
2026-09-18 16:30:38 +02:00
e8cb1ec7e9
docs(k8s): how to reach the deployed portals from a laptop (refs #175 )
not and Claude Opus 5
2026-09-18 16:19:02 +02:00
de6db7d35b
docs(k8s): split the taint fix from the registry patch (refs #175 )
not and Claude Opus 5
2026-09-18 16:06:24 +02:00
d17e79959b
ci(deploy): say why a deploy stalled, and document the cluster prerequisite (refs #175 )
not and Claude Opus 5
2026-09-18 16:01:47 +02:00
6cfcc4cf83
ci(deploy): deploy the stack to Talos on merge to main (closes #175 ) (#176 )
not
2026-09-18 13:53:58 +00:00
fc036d53d5
ci(deploy): deploy the stack to Talos on merge to main (refs #175 )
not and Claude Opus 5
2026-09-18 15:40:42 +02:00
9d7e8e5b65
ci(k8s): gate the Helm chart in CI + a compose↔chart drift check (closes #168 ) (#171 )
not
2026-09-18 13:25:24 +00:00
421597851a
Merge branch 'main' into ci/168-helm-chart-ci-gate
not
2026-09-18 12:55:28 +00:00
17f1f2f809
docs(nav): publish every ADR and runbook, gated by a nav check (closes #169 ) (#172 )
not
2026-09-18 12:55:20 +00:00
ab4392320a
docs(nav): point the landing page at the Kubernetes runbook (refs #169 )
not
2026-09-10 11:04:08 +02:00
16509a399c
docs(nav): publish every ADR and runbook, not just the first ten (refs #169 )
not
2026-09-10 11:03:39 +02:00
8df3faf979
test(docs): fail when a page under docs/ is missing from the nav (refs #169 )
not
2026-09-10 11:02:52 +02:00
70de3d0a4d
ci(k8s): gate the Helm chart on every PR (refs #168 )
not
2026-09-10 11:01:29 +02:00
fddf14e5f9
feat(k8s): declare the six platform deviations so only new drift fails (refs #168 )
not
2026-09-10 11:00:32 +02:00
5000b749b9
test(k8s): fail when compose and the Helm chart describe different stacks (refs #168 )
not
2026-09-10 10:59:53 +02:00
1dd8bd4e1b
S-24/#25 · Helm chart + Kubernetes deployment, and Caddy for the portals (#166 ) (#167 )
not
2026-09-10 08:53:58 +00:00
e6aaed7c8c
docs(k8s): ADR-0033 + the Talos deployment runbook (refs #25 )
not
2026-09-04 17:26:04 +02:00
7a5840149c
feat(k8s): Helm chart for the whole stack on a single-node cluster (refs #25 )
not
2026-09-04 17:25:46 +02:00
916d671d49
test(k8s): gate the Helm chart with a render + schema check (refs #25 )
not
2026-09-04 17:25:29 +02:00
2d40c84e2c
docs(portals): ADR-0034 — Caddy serves the portals (refs #166 )
not
2026-09-04 17:25:29 +02:00
4edcf00267
feat(portals): serve each portal with Caddy instead of nginx (refs #166 )
not
2026-09-04 17:24:56 +02:00
51d99855d1
test(portals): assert each portal proxies only its own endpoint group (refs #166 )
not
2026-09-04 17:24:41 +02:00
d6b3f9764f
fix(e2e): bound the Playwright run and make a failed login say why (closes #161 ) (#165 )
not
2026-09-04 10:53:35 +00:00
7a4ec72f43
Merge remote-tracking branch 'origin/main' into fix/161-e2e-bounded-and-diagnosable
not
2026-09-04 11:49:30 +02:00
ab1d824e1e
docs(ci): a killed job loses its if: always() steps — gotchas §9 (refs #161 )
not and Claude Opus 5
2026-09-04 11:46:56 +02:00
e7d4ed8ad4
fix(e2e): fail fast when a portal never reaches Keycloak, and bound the run (refs #161 )
not and Claude Opus 5
2026-09-04 11:46:28 +02:00
27f2607e4e
refactor(e2e): route every portal login through one Keycloak helper (refs #161 )
not and Claude Opus 5
2026-09-04 11:44:30 +02:00
779f0deb5a
fix(ci): carry the failing spec's error into the e2e job summary (refs #161 )
not and Claude Opus 5
2026-09-04 11:41:45 +02:00
699fef4e68
test(ci): the e2e job summary must name why a spec failed (refs #161 )
not and Claude Opus 5
2026-09-04 11:40:35 +02:00
8b206a005f
S-26/#162 · Werkbak refreshes itself when a registration is ready for beoordeling (#164 )
not
2026-09-04 09:34:14 +00:00
3628efc17a
test(e2e): open the werkbak before the registration is ready for beoordeling (refs #162 )
not and Claude Opus 5
2026-09-04 11:12:30 +02:00
fc843a419a
docs(portal-behandel): ADR-0032 + demo note for the self-refreshing werkbak (refs #162 )
not and Claude Opus 5
2026-09-04 11:00:21 +02:00
3f8b438500
feat(portal-behandel): let a successful refresh clear the load failure (refs #162 )
not and Claude Opus 5
2026-09-04 10:46:41 +02:00
d906e2c111
test(portal-behandel): a refresh must clear a stale load failure (refs #162 )
not and Claude Opus 5
2026-09-04 10:46:28 +02:00
e38bf62b43
feat(portal-behandel): refresh the werkbak on an interval while it is open (refs #162 )
not and Claude Opus 5
2026-09-04 10:46:02 +02:00
cd3faaf638
test(portal-behandel): the werkbak must show a new registration without a reload (refs #162 )
not and Claude Opus 5
2026-09-04 10:45:17 +02:00
d0fb2b3e8c
S-15c · Enforce MFA on the medewerker (Keycloak) realm (#158 )
not
2026-09-04 08:27:52 +00:00
b76035ebfe
Merge remote-tracking branch 'origin/feat/132-medewerker-mfa' into feat/132-medewerker-mfa
not
2026-09-04 09:56:05 +02:00
984d2e9d54
fix(e2e): spend a fresh TOTP counter per medewerker login (refs #132 )
not and Claude Opus 5
2026-09-04 09:55:58 +02:00
716b8d03e0
test(e2e): a medewerker login must not reuse a spent TOTP counter (refs #132 )
not and Claude Opus 5
2026-09-04 09:53:55 +02:00
a16f811d50
Merge branch 'main' into feat/132-medewerker-mfa
not
2026-09-04 06:47:59 +00:00
321ee50dcb
docs(architecture): import the FDS architecture decisions from the lab repo (closes #159 ) (#160 )
eho
2026-09-03 12:35:01 +00:00
a87a32e269
docs(infra): document MFA on the medewerker realm + ADR-0031 (refs #132 )
not and Claude Opus 5
2026-09-03 09:11:03 +02:00
3567bc1f42
feat(infra): enforce MFA on the medewerker realm (refs #132 )
not and Claude Opus 5
2026-09-03 09:08:50 +02:00
30c5279e90
test(infra): medewerker login must be refused without a second factor (refs #132 )
not and Claude Opus 5
2026-09-03 09:07:45 +02:00
94720f0fcb
fix(observability): stop single-binary Tempo evicting its only ingester (closes #156 ) (#157 )
not
2026-09-01 08:31:36 +00:00
60d556b46e
docs(architecture): record why single-binary Tempo has its ingester health check off (refs #156 )
not
2026-09-01 09:45:28 +02:00
e54dbe9d5d
fix(observability): stop Tempo evicting its only ingester under load (refs #156 )
not
2026-09-01 09:45:07 +02:00
94742a261f
feat: read projection sourced from the register in Objecten (closes #153 ) (#155 )
not
2026-09-01 07:26:33 +00:00
b30fa664d8
feat(event-subscriber): accept partial_update as a register write (refs #153 )
not
2026-08-28 13:40:01 +02:00
0dd26a711a
test(event-subscriber): approval arrives as partial_update, not update (refs #153 )
not
2026-08-28 13:39:03 +02:00
7e0897a41e
fix(infra): repoint the acl at OpenZaak's IP before opening a zaak (refs #153 )
not
2026-08-28 13:18:00 +02:00
744f91a2b2
fix(infra): anchor wait-healthy's container lookup on the compose replica suffix (refs #153 )
not
2026-08-28 13:01:10 +02:00
b496ac9477
refactor(event-subscriber): drop the hoofdObject fallback (refs #153 )
not
2026-08-28 12:38:27 +02:00
88a601123b
docs(e2e): the happy path's public statuses now come from the register (refs #153 )
not
2026-08-28 12:37:21 +02:00
62fb986701
docs: ADR-0030 — the read projection is sourced from the register (refs #153 )
not
2026-08-28 12:36:52 +02:00
ceb65991de
feat(infra): subscribe the projection to the objecten kanaal (refs #153 )
not
2026-08-28 12:35:44 +02:00
8af09b2c92
feat(event-subscriber): project register records read back through the ACL (refs #153 )
not
2026-08-28 12:32:42 +02:00
142ed454aa
test(event-subscriber): the projection is sourced from register records (refs #153 )
not
2026-08-28 12:32:15 +02:00
566ef7dd64
feat(acl): write the INGEDIEND record on submit and read records back (refs #153 )
not
2026-08-28 12:28:47 +02:00
06c0444859
test(acl): submit writes an INGEDIEND record, and records are readable back (refs #153 )
not
2026-08-28 12:28:01 +02:00
2125fb0cfd
feat(infra): Objecten publishes register events to NRC (closes #152 ) (#154 )
not
2026-08-28 10:11:54 +00:00
a5fd47e546
fix(infra): correlate the delivery on the object URL, not the record reference (refs #152 )
not
2026-08-28 11:50:07 +02:00
d76abf2df2
fix(infra): address Objecten by a dotted host so NRC accepts its notifications (refs #152 )
not
2026-08-28 11:31:31 +02:00
448896206f
feat(infra): Objecten publishes register events to NRC (refs #152 )
not
2026-08-28 10:54:14 +02:00
dc9ca2ceb2
test(infra): verify-objecten-notifications asserts Objecten publishes to NRC (refs #152 )
not
2026-08-14 11:50:16 +02:00
0cd70ae8c3
S-19a · ACL writes the RegisterRecord to Objecten on approval (closes #149 ) (#151 )
not
2026-08-14 09:34:04 +00:00
2d783448b7
fix(e2e): assert the register record where a real approval happens (refs #149 )
not
2026-08-14 10:43:34 +02:00
10b784cc05
fix(infra): reach Objecten by service name in the register-record check (refs #149 )
not
2026-08-14 10:20:26 +02:00
2bb7d9c165
test(acl): ObjectenGateway integration test against live Objecten (refs #149 )
not
2026-08-14 09:44:15 +02:00
4a047c618c
fix(infra): let Objecten actually accept the register record (refs #149 )
not
2026-08-14 09:41:00 +02:00
43b45ad756
fix(acl): read each objecttype version instead of the versions collection (refs #149 )
not
2026-08-14 09:33:15 +02:00
5502e4c099
test(acl): raise the Objecten gateway above the mutation ratchet (refs #149 )
not
2026-08-14 09:29:03 +02:00
3705a18e18
docs: ADR-0028 + demo note — Objecten holds the register (refs #149 )
not
2026-08-14 09:23:41 +02:00
400bdcafc4
test(infra): assert the approval wrote the register record to Objecten (refs #149 )
not
2026-08-14 09:22:09 +02:00
c67ee7d3f5
refactor(acl): resolve the objecttype's highest published version (refs #149 )
not
2026-08-14 09:19:50 +02:00
d14f379358
feat(acl): write the RegisterRecord to Objecten on approval (refs #149 )
not
2026-08-14 09:18:34 +02:00
66f8322580
test(acl): approval writes the RegisterRecord to Objecten (refs #149 )
not
2026-08-14 09:16:23 +02:00
d37d4c96c6
S-18c · RegisterRecord objecttype defined + registered (closes #141 ) (#146 )
not
2026-07-27 15:14:16 +00:00
12197e11ce
Merge branch 'main' into feat/141-registerrecord-objecttype
not
2026-07-27 16:32:38 +02:00
159f014c1e
perf: cap OpenZaak + NRC uWSGI workers — shrink verify-stack footprint (closes #147 ) (#148 )
not
2026-07-27 14:32:13 +00:00
4aafd32b4a
perf(infra): cap OpenZaak + NRC uWSGI to 1 worker — shrink verify-stack footprint (closes #147 )
not and Claude Opus 4.8
2026-07-27 16:10:49 +02:00
07d68eb06d
docs: ADR-0027 + demo note — public-safe RegisterRecord objecttype schema (refs #141 )
not and Claude Opus 4.8
2026-07-27 15:18:38 +02:00
5f38f761d1
feat(infra): register RegisterRecord objecttype + published version in Objecttypen (refs #141 )
not and Claude Opus 4.8
2026-07-27 15:17:06 +02:00
2bb18f4a51
test(infra): verify-registerrecord asserts RegisterRecord objecttype registered + published (refs #141 )
not and Claude Opus 4.8
2026-07-27 15:14:58 +02:00
dd54688f86
fix: cap Objecten/Objecttypen uWSGI to 1 worker — unstarve verify-stack e2e (closes #144 ) (#145 )
not
2026-07-27 13:07:55 +00:00
802f0e2c65
fix(infra): cap Objecten/Objecttypen uWSGI to 1 worker — unstarve verify-stack e2e (closes #144 )
not and Claude Opus 4.8
2026-07-27 13:38:47 +02:00
0a97fa4bf7
S-18b · Objecten API up in compose, wired to Objecttypen (closes #140 ) (#143 )
not
2026-07-27 09:53:01 +00:00
1113e1ebed
docs: S-18b demo note + backlog — Objecten API up, wired to Objecttypen (refs #140 )
not and Claude Opus 4.8
2026-07-27 11:02:11 +02:00
481a9216ce
feat(infra): Objecten API up in compose, wired to Objecttypen (refs #140 )
not and Claude Opus 4.8
2026-07-27 11:01:36 +02:00
32c3d31407
test(infra): verify-objecten asserts Objecten API up + token auth + trusts Objecttypen (refs #140 )
not and Claude Opus 4.8
2026-07-27 10:57:05 +02:00
23ea91de32
feat(infra): Objecttypen API up in compose with a seeded static token (closes #139 ) (#142 )
not
2026-07-27 08:51:14 +00:00
660538b41a
docs: S-18a demo note — Objecttypen API up (refs #139 )
not
2026-07-24 16:40:37 +02:00
069d3ba942
feat(infra): Objecttypen API up in compose with a seeded static token (refs #139 )
not
2026-07-24 16:40:16 +02:00
b7784a80bd
docs(backlog): split S-18 into S-18a/b/c (refs #139 )
not
2026-07-24 16:27:25 +02:00
0494730223
feat(portal-beheer): ACL default-fill configuration editor (closes #131 ) (#138 )
not
2026-07-24 14:22:22 +00:00
d74270b0bd
docs+test(e2e): ADR-0026, S-15b demo note, default-fill e2e (refs #131 )
not
2026-07-24 15:45:18 +02:00
notandClaude Opus 5
eho