23 Commits

Include renames

Author	SHA1	Message	Date
forust	91c344fe2c	fix(monitoring): disable control-plane alerts and scrapes on k0s ... k0s runs kube-controller-manager, kube-scheduler and etcd inside its own process rather than as pods, so the chart's Services never get endpoints and the targets stay permanently absent. Drop the matching ServiceMonitors and their Down/HighCommitDurations rules; kube-proxy and kubelet do get endpoints on k0s and stay enabled.	2026-09-26 17:16:55 +02:00
renovate-bot	11bfb426c0	chore(deps): update prom/prometheus docker tag to v3.15.0	2026-09-25 22:17:15 +00:00
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ... Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
forust	f29bb3d580	revert: drop Grafana cert-manager dashboard	2026-09-23 14:42:09 +02:00
forust	1cbdfc1d6f	feat(observability): cert-manager metrics, dashboard and alerts ... - ServiceMonitor for cert-manager (release: prometheus-stack) - Grafana dashboard Cert-manager-Kubernetes (ID 22908, datasource refs fixed) via dashboard sidecar ConfigMap - PrometheusRule: NotReady (crit), expiry <14d (warn) / <7d (crit), ACME 429 rate-limit (warn)	2026-09-23 14:32:36 +02:00
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
forust	9c4580a522	fix(prometheus): exclude xui services from TraefikServiceHighLatency ... Long-lived VPN WebSocket sessions inflate P95 request duration; keep 5xx/down/cert alerts for xui unchanged.	2026-09-19 19:06:42 +02:00
forust	f0f8a35b0f	Merge branch 'main' of https://gitea.forust.xyz/forust/homelab ... # Conflicts: # postgres/k8s/postgres.yaml	2026-09-18 19:05:56 +02:00
forust	5936de3e56	fix(alertmanager): quote null receiver and wire telegram template ... Unquoted null parses as YAML null and breaks routing. Add shared telegram message template.	2026-09-18 19:02:41 +02:00
forust	c98ea8b957	feat(monitoring): align storage to live pvc, add loki datasource and alerts ... Match grafana/alertmanager storageClass to live PVCs to avoid immutable-field failures. Add Loki datasource and LokiDown/AlloyDown alerts.	2026-09-18 19:02:38 +02:00
renovate-bot	89fbdef10e	chore(deps): update container patch updates	2026-09-17 17:55:32 +00:00
renovate-bot	4eab6a43c8	chore(deps): update grafana/grafana docker tag to v13.2.2	2026-09-15 12:07:56 +00:00
forustandCopilot	24d3686f60	ci: fix formatting and YAML lint scope ... Lint tracked YAML files without scanning generated dependencies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:30:55 +02:00
forustandCopilot	23ed72826a	chore(images): pin service image updates ... Replace floating service images with reviewable tags or digests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:16:01 +02:00
forust	360a6fc5dc	feat(prometheus): add alerting rules and alertmanager config	2026-09-14 01:21:27 +02:00
forustandCopilot	ed1ddaad5d	feat(crowdsec): restore web traffic protection ... Protect public Traefik routes with CrowdSec HTTP decisions and restore access logging for web traffic analysis. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-12 21:05:12 +02:00
forust	861d89d36a	ci(deploy): split runtime by k8s/active marker ... services marked k8s/active are applied via kubectl; the rest via docker compose. inactive services with k8s/ keep only routing manifests (external Services, EndpointSlices, Ingresses) to reach docker backends. headscale/nextcloud routing moved to k8s/routing/. validations: compose config --quiet + kubectl apply --dry-run=client. namespace manifests applied first. pull_policy:build stacks get build+push before up so the registry image stays fresh.	2026-09-06 20:39:12 +02:00
forust	92aa731e44	deleted crowdsec stack from the repo. will figure something else ... Signed-off-by: mr-forust <vzlomdsisma@gmail.com>	2026-07-19 23:16:14 +02:00
forust	a128523c24	Fix CrowdSec middleware references in Traefik ingresses	2026-06-29 22:47:21 +02:00
forust	1762962f32	chore(k8s): fix indentation in ingress manifests (3-space -> 2-space)	2026-06-19 12:03:02 +02:00
forust	0803f3efff	chore(k8s): returned to Host || Host standart instead of regexp. ... Yaml lint (yamllint)	2026-06-18 21:02:40 +02:00
forust	76853637bc	feat: traefik prometheus metrics	2026-06-17 01:41:45 +02:00
forust	ea483da645	feat: kube-prometeus-stack	2026-06-16 12:36:31 +02:00