6 Commits

Include renames

Author	SHA1	Message	Date
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ... Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
forustandCopilot	23ed72826a	chore(images): pin service image updates ... Replace floating service images with reviewable tags or digests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:16:01 +02:00
forust	861d89d36a	ci(deploy): split runtime by k8s/active marker ... services marked k8s/active are applied via kubectl; the rest via docker compose. inactive services with k8s/ keep only routing manifests (external Services, EndpointSlices, Ingresses) to reach docker backends. headscale/nextcloud routing moved to k8s/routing/. validations: compose config --quiet + kubectl apply --dry-run=client. namespace manifests applied first. pull_policy:build stacks get build+push before up so the registry image stays fresh.	2026-09-06 20:39:12 +02:00
forust	587611ca88	chore: remove empty middlewares blocks from k8s ingresses	2026-09-02 12:17:04 +02:00
forust	c855764bc6	feat: add vaultwarden deployment config (compose + k8s)	2026-06-21 01:02:09 +02:00