Milestones
opnsense2otel
Progress across published tasks.
M1 - Bugs & first wave
12 of 12 completed
OPN-0007Kea reserved/dynamic lease split silently wrong on OPNsense 26.7 (upstream removed is_reserved)OPN-0008hasync collector never emits remote_reachable=0 despite documented 0 stateOPN-0009Secondary-fetch failures invisible: scrape_collector_success stays 1 and endpoint_errors_total never incrementsOPN-0010docs/flow.md flag table shows 10x-stale defaults for --flow.top-n and --flow.max-keysOPN-0011deploy/k8s NetworkPolicy omits Zenarmor (9200/TCP) and NetFlow (2055/UDP) ingressOPN-0012AGENTS.md mislabels internal/options/otlp.go as OTLP-tracing configOPN-0013interfaces link_type label drifts on OPNsense 26.7.2: IPv6 fallback removed, new link_typev6 fieldOPN-0014Unbound search_queries payload churn on 26.7: blocklist value rewritten, new category keyOPN-0027Config revision diff events to Loki with dashboard annotationsOPN-0032Reserve fast-tier poll capacity in the schedulerOPN-0035Syslog UDP receiver: decouple read loop with a worker poolOPN-0052Metric naming lint: reject non-monotonic _total gauges and unsuffixed timestamp metrics
M2 - Loki config-data platform
5 of 5 completed
OPN-0028Config-state snapshots to Loki: per-entity JSON, opt-in per family, 6h heartbeatOPN-0029Device inventory fusion: one record per device to LokiOPN-0030Security posture snapshot to LokiOPN-0031Gateway/routing change events (snapshot diff mode)OPN-0049Ship the exporter's own logs through its OTLP logs pipeline (opt-in)
M3 - 26.7 catch-up
8 of 8 completed
OPN-0015Kea DHCP reservation inventory counts for unclaimed reservations (both families)OPN-0016Gateway groups collector (api/routing/groupsettings, new in 26.7)OPN-0019Firewall legacy-rule migration debt gauge (api/firewall/migration, 26.7)OPN-0024Verify monit status-XML parser against monit 6.0.0 (ships in OPNsense 26.7.3)OPN-0025Document 26.7 ACL privilege merge impact on restricted API keysOPN-0026Account for 26.7 NetFlow-service restart gaps in flow gap-detection/alertingOPN-0050Pre-classify expected canary drift from 26.7 daemon bumps (Kea 3.0.4, Unbound 1.26, Suricata 8.0.6, dpinger 3.6)OPN-0051Comment the deliberate is_enabled (not isBlockListEnabled) choice in the unbound client
M4 - New collectors
6 of 6 completed
OPN-0017Complete FRR coverage: BGP route tables + BFD summaryOPN-0018ZeroTier plugin collector (network search/info)OPN-0020IPsec per-lease collector (api/ipsec/leases/search)OPN-0021HAProxy maintenance-state visibility (api/haproxy/maintenance/searchServer)OPN-0022pfTop / top-talkers diagnostics collector, capped top-NOPN-0023Per-plugin service-status collectors for the agent-family plugins
M5 - Pipeline & dashboard polish
11 of 11 completed
OPN-0034Surface gateway threshold parse failures (Warn + counter)OPN-0036Set SO_RCVBUF on syslog and NetFlow UDP socketsOPN-0037Standing unparsed-syslog metric (logs_unparsed_total by subsystem)OPN-0038DNS-domain enrichment for filterlog recordsOPN-0039Expose NetFlow worker/queue sizing as flagsOPN-0040Operator console: receivers/flow visibility tabOPN-0042Gateway threshold-vs-actual dashboard panelOPN-0043Dashboard polish: cert-expiry colour thresholds + DHCP leases-nearing-expiry viewOPN-0044Deep-link hot firewall rules to the OPNsense UI from dashboard tablesOPN-0048Troubleshooting docs for the push receivers (syslog/Zenarmor/NetFlow)OPN-0057Measure UDP receiver throughput: same-harness before/after for buffers and worker pool
M6 - Deployment & config
4 of 4 completed
M7 - Next major
1 of 1 completed
Unassigned
92 of 95 completed
OPN-0001Rare data race in syslog Listener shutdown (Close vs the TLS accept goroutine)OPN-0002main is red: WAN address reintroduced into public fixtures, check-public-ips failing since 2026-08-08OPN-0003Add Codex cloud manual environment setupOPN-0004Upgrade Go toolchain to 1.27OPN-0005Remediate 20 Codex Security findingsOPN-0006Migrate the repo task surface to just and retire Makefiles and ad-hoc scriptsOPN-0053Restyle the embedded console onto design system v2 (family follower)OPN-0054CodeQL initialization fails with repository Contents API 404OPN-0055Preserve stable Unbound blocklist identity across search-query response generationsOPN-0056Correct `just gen` dependency order for new catalogue metricsOPN-0058Narrow auto-rc so only shipped-code commits cut a release candidateOPN-0059Prune pre-25.1 healthCheck legacy fields and their canary exemptionsOPN-0060Prove live Loki and OTLP delivery end to end against the m7kni stackOPN-0061Fix Grafana GitSync verifier after repository ownership moveOPN-0062Stop NetFlow intake before the correlator final flushOPN-0063Preserve fractional flow-correlation window boundariesOPN-0064Account for Zenarmor connections rejected at the capOPN-0065Redact credential-bearing URLs from exporter self-logsOPN-0066Persist device-inventory seen identities across restartOPN-0067Correct console documentation to match the opt-in runtime defaultOPN-0068State pfTop retained-cardinality and address-label costs accuratelyOPN-0069Ship source poll errors to the log backend instead of stderr onlyOPN-0070Live delivery proof miscategorises structured metadata as promoted labelsOPN-0071Preserve Zenarmor-first enrichment at the correlator capOPN-0072Drain in-flight Zenarmor bulk handlers before pipeline shutdownOPN-0073Make startup and shutdown self-log loss observableOPN-0074Bound log pipeline source shutdown by its deadlineOPN-0075Correct false manual flow and Zenarmor runtime contractsOPN-0076Close credential-vocabulary gaps in config and API-error redactionOPN-0077Redact credential-bearing HTML URL attributes after backslashesOPN-0078Redact sensitive malformed-JSON fields after stray quotesOPN-0079Redact credential URLs in malformed JSON after stray quotesOPN-0080Resynchronise credential URL scanning after redacted overlapsOPN-0081Redact credential URLs after malformed single-quoted HTMLOPN-0082Redact sensitive fields in malformed JSON-like syntaxOPN-0083Redact Unicode-escaped malformed JSON-like credential keysOPN-0084Serialize Release Please: no concurrency group on a workflow that publishesOPN-0085Preserve firewall snapshot delivery when search rows share a rule identityOPN-0086Emit configuration revision diffs in old-to-new orderOPN-0087Correct the UDP measurement guide after receiver observability shippedOPN-0088Recover DNS enrichment cache capacity from expired answersOPN-0089Count tolerated ZeroTier per-network 404 fetch failuresOPN-0090Preserve unresolved interface labels during NetFlow enrichment startupOPN-0091Present console API counters as lifetime history rather than current auth healthOPN-0092Config diff loses redaction state when the diff prefix changes mid-elementOPN-0093Credential nested inside a JSON string value is never field-scannedOPN-0094Shared sensitive-key vocabulary is imprecise in both directionsOPN-0095Firmware-status cache pins a transient empty last_check for the full TTLOPN-0096Triage the standing nightly and release-vm canary drift findings open since 2026-09-01OPN-0097Bound config revision diff input before redaction to cap transient allocationOPN-0098Reclaim expired Zenarmor inventory entries before rejecting fresh sightingsOPN-0099Document and harness the Loki visibility delay for historical config revision eventsOPN-0100Define a Content-Security-Policy for the embedded consoleOPN-0101Syslog UDP receiver refuses to start on FreeBSD when the requested receive buffer exceeds the kernel limitOPN-0102Skip the GeoIP startup fetch when the installed database is freshOPN-0103Console quiet mode when self-logs ship over OTLPOPN-0104Retire the syslog debug-capture mount on camdenOPN-0105Diversify Grafana dashboard visualizationsOPN-0106Retire the production-firewall schema canaryOPN-0107Stamp the OPNsense generation on both testbed canary reportsOPN-0108Update both testbed firewalls to their channel head on every canary sessionOPN-0109Raise and lower the oli testbed from CI over forced-command SSHOPN-0110Consolidate the testbed to three guests and run the canary profiles sequentiallyOPN-0111Narrow the support policy to the current stable OPNsense releaseOPN-0112Comment on the canary issues only when the findings changeOPN-0113Decide per endpoint whether to prune the pre-26.7 legacy payload shimsOPN-0114Both testbed firewalls run Kea and dnsmasq DHCP at once, racing for UDP/67OPN-0115Correct the IPsec coverage ledger and decide whether the release box gets a tunnelOPN-0116Prune tautological and change-detector unit testsOPN-0117Add a read-only live API contract test layerOPN-0118Emit native (exponential) histograms instead of classical bucketsOPN-0119Triage the 2026-09-20 canary drift on 26.7.4_1 and 27.1 develOPN-0120Export the BFD rejected-control-packet counterOPN-0121Per-subnet Kea DHCP pool statistics keyed on subnet_idOPN-0122Firmware collector: info endpoint outgrows the client timeout and status polls uncached while last_check is emptyOPN-0123Tolerate transitional CARP and NDP response shapes seen during a firewall upgradeOPN-0124Classify the boot-time syslog shapes and the Zenarmor web parse error from the 2026-10-12 upgrade captureOPN-0125Keep OTLP log delivery through a WAN outage longer than the retry budgetOPN-0126Isolate composed loop gates from machine-local lane worktreesOPN-0127Document the firmware info exception to the global request timeoutOPN-0128Repair rejected BFD counter landing CI failureOPN-0129Design native histogram conversion for pre-bucketed flow and Unbound dataOPN-0130Study lossless Unbound histogram source and transport alternativesOPN-0131Correct Unbound histogram precision and overflow documentationOPN-0132Infer const histogram types in the generated metric catalogueOPN-0133Preserve native histogram samples in duration heatmapsOPN-0134Disposition remaining capture shapes before debug-capture retirementOPN-0135Publish verified 5.2.0 release after resilience and live-contract proofOPN-0136Export per-NIC hardware receive discards (ixl rx_discards) for physical WAN parentsOPN-0137Derive PPPoE (mpd5) link-edge counters and a last-link-up timestamp from ppp logsOPN-0138Count gateway state-kill events (gateway_states_killed)OPN-0139Keep per-queue interrupt and iflib thread identity in the activity collectorOPN-0140Spike: source for Zenarmor engine health (crash and stall counts)OPN-0141Expose Zenarmor daily engine crash and stall counts through the textfile companionOPN-0142Refresh Go and certificate trust dependencies and publish release