forust
b4678e5437
feat(postgres): upgrade shared database to PostgreSQL 17
...
Move the shared postgres service from 15.19 to 17.6 as the postgres17 StatefulSet with its own PVC, extend the initdb and ingress policy with the statuspage database, and drop the now-unused per-app postgres manifests for authentik, gitea and netronome.
2026-09-14 11:54:28 +02:00
forust and Copilot
592d24ce96
feat(postgres): migrate apps to shared database
...
Move Authentik and Netronome to the shared PostgreSQL service after logical dump and restore.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-09-14 10:41:46 +02:00
forust and Copilot
23ed72826a
chore(images): pin service image updates
...
Replace floating service images with reviewable tags or digests.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-09-14 09:16:01 +02:00
forust and Copilot
ed1ddaad5d
feat(crowdsec): restore web traffic protection
...
Protect public Traefik routes with CrowdSec HTTP decisions and restore access logging for web traffic analysis.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-09-12 21:05:12 +02:00
forust
861d89d36a
ci(deploy): split runtime by k8s/active marker
...
services marked k8s/active are applied via kubectl; the rest via docker
compose. inactive services with k8s/ keep only routing manifests
(external Services, EndpointSlices, Ingresses) to reach docker backends.
headscale/nextcloud routing moved to k8s/routing/.
validations: compose config --quiet + kubectl apply --dry-run=client.
namespace manifests applied first. pull_policy:build stacks get
build+push before up so the registry image stays fresh.
2026-09-06 20:39:12 +02:00
forust
587611ca88
chore: remove empty middlewares blocks from k8s ingresses
2026-09-02 12:17:04 +02:00
forust
92aa731e44
deleted crowdsec stack from the repo. will figure something else
...
ci / lint-prettier (push) Successful in 18s
ci / lint-ruff (push) Successful in 6s
ci / lint-yaml (push) Successful in 6s
ci / lint-dockerfiles (push) Successful in 5s
ci / validate (push) Successful in 6s
ci / build (push) Successful in 43s
Signed-off-by: mr-forust <vzlomdsisma@gmail.com >
2026-07-19 23:16:14 +02:00
forust
a128523c24
Fix CrowdSec middleware references in Traefik ingresses
2026-06-29 22:47:21 +02:00
forust
0803f3efff
chore(k8s): returned to Host || Host standart instead of regexp.
...
Deploy to Server / deploy (push) Has been cancelled
Yaml lint (yamllint)
2026-06-18 21:02:40 +02:00
forust
b9b8474455
feat(k8s): protect all prod routers with crowdsec middleware
2026-06-17 01:50:33 +02:00
forust
4ca3ccdad3
chore(k8s): router rewrite
...
- returned to Host matcher instead of Hostregexp
- switched dockercompose labels to letsencrypt
- renamed DoH route
2026-06-16 12:34:15 +02:00
forust
68c5eac164
chore: compact ingress rules with regex
2026-06-11 14:20:03 +02:00
forust
4c356924e7
feat(k8s): authentik server+worker deployments and postgres statefulset
2026-06-11 03:35:28 +02:00
forust
d7a68237e5
chore: remove redundant or unnececary traefik labels
...
- traefik.docker.network= (defined by traefik cli)
- traefik.http.routers.<routername>.middlewares=security-headers@file" (applied globally by traefik cli)
2026-02-04 22:26:27 +01:00
forust
45ce789f58
chore: compose cleanup:
...
- Remove TZ envs
- +- unified compose structure
- Minify where possible
- Remove <service>.internal routers
- Remove service specifications where possible
Affected services:
- adguardhome
- authentik
- cfddns
- checkmk
- dockmon
- downtify
- gitea
- glance
- headscale
- homepages
- metube
- nextcloud
- penpot
- portainer
- termix
- traefik
- uptime-kuma
TODO: Move data from directory to volumes
2026-01-19 23:33:50 +01:00
forust
c048efd569
Merge branch 'main' of ssh://gitssh.forust.xyz:2221/forust/homelab into feat/tailscale
2026-01-01 01:45:57 +01:00
forust
fb2f420520
refactor: update network refs form "traefik-proxy" to "proxy"
...
- To allow testing dev vers of other services
2025-12-30 14:14:24 +01:00
forust
5e4c60bb30
chore (security): port hardening, commented out non-critical ports
2025-12-14 02:42:46 +01:00
forust
6eb62f41cc
fix: authentik-traefik dns lookup
2025-12-09 13:23:48 +01:00
forust
aed28ed15c
refactor: sepparate traefik and authentik
2025-12-09 03:52:20 +01:00
forust
