Completed work
opnsense2otel
109 completed tasks.
OPN-0108Update both testbed firewalls to their channel head on every canary sessionOPN-0112Comment on the canary issues only when the findings changeOPN-0111Narrow the support policy to the current stable OPNsense releaseOPN-0107Stamp the OPNsense generation on both testbed canary reportsOPN-0106Retire the production-firewall schema canaryOPN-0105Diversify Grafana dashboard visualizationsOPN-0102Skip the GeoIP startup fetch when the installed database is freshOPN-0103Console quiet mode when self-logs ship over OTLPOPN-0057Measure UDP receiver throughput: same-harness before/after for buffers and worker poolOPN-0101Syslog UDP receiver refuses to start on FreeBSD when the requested receive buffer exceeds the kernel limitOPN-0097Bound config revision diff input before redaction to cap transient allocationOPN-0099Document and harness the Loki visibility delay for historical config revision eventsOPN-0021HAProxy maintenance-state visibility (api/haproxy/maintenance/searchServer)OPN-0100Define a Content-Security-Policy for the embedded consoleOPN-0033Metric naming: breaking rename of _total gauges and wireguard handshake timestamp at next majorOPN-0053Restyle the embedded console onto design system v2 (family follower)OPN-0060Prove live Loki and OTLP delivery end to end against the m7kni stackOPN-0096Triage the standing nightly and release-vm canary drift findings open since 2026-09-01OPN-0098Reclaim expired Zenarmor inventory entries before rejecting fresh sightingsOPN-0095Firmware-status cache pins a transient empty last_check for the full TTLOPN-0094Shared sensitive-key vocabulary is imprecise in both directionsOPN-0092Config diff loses redaction state when the diff prefix changes mid-elementOPN-0093Credential nested inside a JSON string value is never field-scannedOPN-0086Emit configuration revision diffs in old-to-new orderOPN-0087Correct the UDP measurement guide after receiver observability shippedOPN-0088Recover DNS enrichment cache capacity from expired answersOPN-0089Count tolerated ZeroTier per-network 404 fetch failuresOPN-0090Preserve unresolved interface labels during NetFlow enrichment startupOPN-0091Present console API counters as lifetime history rather than current auth healthOPN-0085Preserve firewall snapshot delivery when search rows share a rule identityOPN-0084Serialize Release Please: no concurrency group on a workflow that publishesOPN-0077Redact credential-bearing HTML URL attributes after backslashesOPN-0078Redact sensitive malformed-JSON fields after stray quotesOPN-0079Redact credential URLs in malformed JSON after stray quotesOPN-0080Resynchronise credential URL scanning after redacted overlapsOPN-0081Redact credential URLs after malformed single-quoted HTMLOPN-0082Redact sensitive fields in malformed JSON-like syntaxOPN-0083Redact Unicode-escaped malformed JSON-like credential keysOPN-0062Stop NetFlow intake before the correlator final flushOPN-0071Preserve Zenarmor-first enrichment at the correlator capOPN-0072Drain in-flight Zenarmor bulk handlers before pipeline shutdownOPN-0073Make startup and shutdown self-log loss observableOPN-0074Bound log pipeline source shutdown by its deadlineOPN-0075Correct false manual flow and Zenarmor runtime contractsOPN-0076Close credential-vocabulary gaps in config and API-error redactionOPN-0070Live delivery proof miscategorises structured metadata as promoted labelsOPN-0069Ship source poll errors to the log backend instead of stderr onlyOPN-0063Preserve fractional flow-correlation window boundariesOPN-0064Account for Zenarmor connections rejected at the capOPN-0065Redact credential-bearing URLs from exporter self-logsOPN-0066Persist device-inventory seen identities across restartOPN-0067Correct console documentation to match the opt-in runtime defaultOPN-0068State pfTop retained-cardinality and address-label costs accuratelyOPN-0061Fix Grafana GitSync verifier after repository ownership moveOPN-0030Security posture snapshot to LokiOPN-0059Prune pre-25.1 healthCheck legacy fields and their canary exemptionsOPN-0022pfTop / top-talkers diagnostics collector, capped top-NOPN-0027Config revision diff events to Loki with dashboard annotationsOPN-0028Config-state snapshots to Loki: per-entity JSON, opt-in per family, 6h heartbeatOPN-0029Device inventory fusion: one record per device to LokiOPN-0031Gateway/routing change events (snapshot diff mode)OPN-0037Standing unparsed-syslog metric (logs_unparsed_total by subsystem)OPN-0038DNS-domain enrichment for filterlog recordsOPN-0049Ship the exporter's own logs through its OTLP logs pipeline (opt-in)OPN-0041Config-file support via kingpin @file expansionOPN-0058Narrow auto-rc so only shipped-code commits cut a release candidateOPN-0023Per-plugin service-status collectors for the agent-family pluginsOPN-0020IPsec per-lease collector (api/ipsec/leases/search)OPN-0018ZeroTier plugin collector (network search/info)OPN-0017Complete FRR coverage: BGP route tables + BFD summaryOPN-0019Firewall legacy-rule migration debt gauge (api/firewall/migration, 26.7)OPN-0016Gateway groups collector (api/routing/groupsettings, new in 26.7)OPN-0044Deep-link hot firewall rules to the OPNsense UI from dashboard tablesOPN-0043Dashboard polish: cert-expiry colour thresholds + DHCP leases-nearing-expiry viewOPN-0042Gateway threshold-vs-actual dashboard panelOPN-0015Kea DHCP reservation inventory counts for unclaimed reservations (both families)OPN-0014Unbound search_queries payload churn on 26.7: blocklist value rewritten, new category keyOPN-0035Syslog UDP receiver: decouple read loop with a worker poolOPN-0039Expose NetFlow worker/queue sizing as flagsOPN-0055Preserve stable Unbound blocklist identity across search-query response generationsOPN-0056Correct `just gen` dependency order for new catalogue metricsOPN-0025Document 26.7 ACL privilege merge impact on restricted API keysOPN-0026Account for 26.7 NetFlow-service restart gaps in flow gap-detection/alertingOPN-0054CodeQL initialization fails with repository Contents API 404OPN-0007Kea reserved/dynamic lease split silently wrong on OPNsense 26.7 (upstream removed is_reserved)OPN-0032Reserve fast-tier poll capacity in the schedulerOPN-0051Comment the deliberate is_enabled (not isBlockListEnabled) choice in the unbound clientOPN-0036Set SO_RCVBUF on syslog and NetFlow UDP socketsOPN-0034Surface gateway threshold parse failures (Warn + counter)OPN-0024Verify monit status-XML parser against monit 6.0.0 (ships in OPNsense 26.7.3)OPN-0040Operator console: receivers/flow visibility tabOPN-0045Helm chart ships default resources in values.yamlOPN-0046Opt-in NetworkPolicy template in the Helm chart (all three receiver ports)OPN-0047Raw k8s manifest gets the config-check initContainer the chart already hasOPN-0048Troubleshooting docs for the push receivers (syslog/Zenarmor/NetFlow)OPN-0050Pre-classify expected canary drift from 26.7 daemon bumps (Kea 3.0.4, Unbound 1.26, Suricata 8.0.6, dpinger 3.6)OPN-0052Metric naming lint: reject non-monotonic _total gauges and unsuffixed timestamp metricsOPN-0013interfaces link_type label drifts on OPNsense 26.7.2: IPv6 fallback removed, new link_typev6 fieldOPN-0012AGENTS.md mislabels internal/options/otlp.go as OTLP-tracing configOPN-0011deploy/k8s NetworkPolicy omits Zenarmor (9200/TCP) and NetFlow (2055/UDP) ingressOPN-0010docs/flow.md flag table shows 10x-stale defaults for --flow.top-n and --flow.max-keysOPN-0009Secondary-fetch failures invisible: scrape_collector_success stays 1 and endpoint_errors_total never incrementsOPN-0008hasync collector never emits remote_reachable=0 despite documented 0 stateOPN-0006Migrate the repo task surface to just and retire Makefiles and ad-hoc scriptsOPN-0005Remediate 20 Codex Security findingsOPN-0004Upgrade Go toolchain to 1.27OPN-0001Rare data race in syslog Listener shutdown (Close vs the TLS accept goroutine)OPN-0003Add Codex cloud manual environment setupOPN-0002main is red: WAN address reintroduced into public fixtures, check-public-ips failing since 2026-08-08