Speculative: move dashboard into k3s with hostPath vault + git-pull sidecar #3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally filed by @coilysiren on 2026-05-14T12:11:02Z - https://github.com/coilysiren/personal-dashboard/issues/63
Speculative, not a right-now problem. Filing so the shape is on record if a future reason to rebuild appears.
Premise
Today the dashboard is a native systemd daemon on kai-server reading the vault from a local path. Isolation comes from Unix perms (
0700, dedicated service user) plus systemd sandboxing (ProtectHome,ReadOnlyPaths). This works.The speculative alternative: deploy into k3s on the same host, mount the vault via
hostPath, run a sidecar that refreshes the vault on a timer.Why it is tempting
Why it does not earn its weight today
hostPath is not stronger isolation than Unix perms. Any pod manifest naming the path can mount it. k3s does not enforce PodSecurityAdmission or hostPath restrictions by default, and pods default to root. "No other manifest mentions the path" is the same guarantee as "no other systemd unit reads
/var/lib/personal-dashboard/vault/."Obsidian Sync (cloud) has no headless API. E2E-encrypted, only official clients speak it. A sidecar cannot pull from Obsidian Cloud directly. Realistic refresh sources:
git pullon a timer. Standard self-hoster answer.The vault is already a git repo, so the git-pull shape is correct regardless of whether the consumer is k3s or native systemd. The "pull from Obsidian Cloud" framing does not buy anything the native path does not already have.
Repo-recall loopback. Repo-recall runs natively on kai-server. A k3s dashboard would need k3s-to-native loopback that the native deployment does not need. Solvable, but added complexity for no isolation gain.
If we ever do this anyway
k3s-to-native loopback options for repo-recall, increasing cleanliness:
hostNetwork: trueon the dashboard pod.127.0.0.1:<port>works. Loses cluster DNS for that pod.repo-recall.default.svc.cluster.local. Most k8s-native, most YAML.Vault refresh sidecar:
git pullagainst the vault's git remote on a timer (5-15 min). Obsidian Git plugin on Mac and phone pushes commits. hostPath mounted into both the sidecar (rw) and the dashboard (ro).Bonus joke shape from the original conversation: a Linuxbrew-based Kubernetes operator that provisions the hostPath + sidecar + refresh timer as a single CR. Not actually a container, just Linuxbrew on the host wired into a CRD. For funsies, not for shipping.
Decision
Stay on native systemd. If isolation needs to harden, tighten the existing unit (
User=,Group=,ProtectHome=true,ReadOnlyPaths=,ReadWritePaths=scoped to dashboard state only). Vault refresh, if ever needed, lands as asystemd.timernext to the dashboard unit doinggit pullagainst the vault remote. Same outcome as the sidecar with one fewer substrate.Revisit this issue if: