forust/homelab
0
0 Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Wiki Activity
714 Commits 31 Branches 20 Tags
815cd85b9ab95e8f1c5f273b7d76fa65bab78e81
Commit Graph
6 Commits
Author SHA1 Message Date
forust 0859479c0f feat(ingress): replace traefik crowdsec plugin with firewall bouncer
ci / lint-compose (push) Successful in 9s
Details
ci / lint-actionlint (push) Successful in 4s
Details
ci / lint-shellcheck (push) Successful in 7s
Details
ci / lint-prettier (push) Successful in 12s
Details
ci / lint-ruff (push) Successful in 6s
Details
ci / lint-yaml (push) Successful in 9s
Details
ci / lint-dockerfiles (push) Successful in 5s
Details
ci / validate (push) Successful in 5s
Details
renovate-ci / validate-renovate (push) Successful in 7s
Details
ci / build (push) Failing after 14m22s
Details 
Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.
 2026-09-30 20:14:25 +02:00
forust bc1e69ebe0 feat(tls): internal CA wildcard for *.internal routes
ci / lint-prettier (push) Successful in 2s
Details
ci / lint-ruff (push) Successful in 0s
Details
ci / lint-yaml (push) Successful in 2s
Details
ci / lint-dockerfiles (push) Successful in 1s
Details
ci / validate (push) Successful in 1s
Details
ci / build (push) Skipped
Details
ci / deploy-userbot-panel (push) Skipped
Details 
Selfsigned root (10y) + internal-ca issuer; per-namespace
internal-wildcard-tls certs referenced by all -local routers.
Root public cert committed for client trust stores.
 2026-09-23 14:45:05 +02:00
forust ef325cd3b1 feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager
ci / lint-ruff (push) Successful in 1s
Details
ci / lint-prettier (push) Successful in 3s
Details
ci / lint-yaml (push) Successful in 2s
Details
ci / lint-dockerfiles (push) Successful in 1s
Details
ci / validate (push) Successful in 2s
Details
ci / build (push) Skipped
Details
ci / deploy-userbot-panel (push) Skipped
Details 
All prod IngressRoutes switch tls.certResolver to tls.secretName
backed by per-router Certificates (HTTP-01, letsencrypt-prod).
adguard-prod reuses the shared adguard-certs secret (also feeds
DoT :853); sync CronJob removed as redundant.

Traefik certificatesResolvers removed: its internal
acme-http@internal router hijacks HTTP-01 for every host while
enabled, blocking external solvers. Dormant files (kener,
downtify) converted for consistency but not applied; n8n
untouched per live-only rule.
 2026-09-23 14:12:36 +02:00
forust 9a806724af chore(crowdsec): remove crowdsec bouncer from dns and headscale ingresses 2026-09-14 01:15:55 +02:00
forustandCopilot ed1ddaad5d feat(crowdsec): restore web traffic protection 
Protect public Traefik routes with CrowdSec HTTP decisions and restore access logging for web traffic analysis.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-09-12 21:05:12 +02:00
forust 861d89d36a ci(deploy): split runtime by k8s/active marker 
services marked k8s/active are applied via kubectl; the rest via docker
compose. inactive services with k8s/ keep only routing manifests
(external Services, EndpointSlices, Ingresses) to reach docker backends.
headscale/nextcloud routing moved to k8s/routing/.

validations: compose config --quiet + kubectl apply --dry-run=client.
namespace manifests applied first. pull_policy:build stacks get
build+push before up so the registry image stays fresh.
 2026-09-06 20:39:12 +02:00