22 Commits

Include renames

Author	SHA1	Message	Date
forust	ff83daed1e	feat(reloader): enable deployment and reload runtime-config consumers	2026-10-06 14:54:45 +00:00
renovate-bot	c65fee7b29	chore(deps): update ghcr.io/alexta69/metube docker tag to v2026.09.29	2026-10-03 09:20:36 +00:00
renovate-bot	19029fa012	chore(deps): update ghcr.io/alexta69/metube docker tag to v2026.09.28	2026-09-28 21:05:33 +00:00
forust	a6af69dca0	fix(k8s): Recreate singletons and trim requests for scheduler headroom ... RollingUpdate with default maxSurge needs a spare pod the single node does not have (99% CPU requested), so multi-workload restarts end Pending and verify times out. Recreate on all replicas:1 Deployments (immich-server and bentopdf keep RollingUpdate at replicas 2). Also trims CPU/memory requests toward measured use (adguard, authentik, gitea, netbox, uptime-kuma, netbird-server) and gives traefik requests/limits so it is no longer BestEffort.	2026-09-28 22:36:46 +02:00
renovate-bot	e451c97dfc	chore(deps): update container patch updates	2026-09-28 19:56:45 +00:00
forust	2a4f215546	fix(k8s): bring the over-reserved memory limits down to measured use ... Six pods reserved far more memory than they have ever touched. uptime-kuma held a 3Gi limit against 469M of measured p95, metube 2Gi against 72M, convertx 1.5Gi against 85M, netbird-server 1Gi against 97M, searxng 700Mi against 134M and bentopdf 700Mi against 4M. Every one of them is a ceiling the scheduler counts against the node while the memory sits unused. Requests move down with the limits but never below the measured p95, so none of these becomes an eviction candidate as a side effect of being right-sized. The limits keep between 2.2x and 11.6x over the observed max, which is the figure that decides whether a pod gets OOM-killed during a burst. Net effect across the six: requests -557M, limits -4.6Gi, all of it ceiling that was never in use. This is the first change that actually gives memory back. CPU limits are left exactly as they were. They were not part of the sizing pass, they are not being hit on a node sitting at 5% CPU, and removing them is a separate decision from moving memory. Verified: each limit is above the container's own observed max and each request is above its p95, and 16/16 local gates pass.	2026-09-28 10:20:24 +02:00
renovate-bot	987a89f022	chore(deps): update container patch updates	2026-09-25 22:18:07 +00:00
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ... Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
renovate-bot	3af5ecd07f	chore(deps): update ghcr.io/alexta69/metube docker tag to v2026.09.15	2026-09-17 17:54:43 +00:00
forustandCopilot	23ed72826a	chore(images): pin service image updates ... Replace floating service images with reviewable tags or digests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:16:01 +02:00
forust	861d89d36a	ci(deploy): split runtime by k8s/active marker ... services marked k8s/active are applied via kubectl; the rest via docker compose. inactive services with k8s/ keep only routing manifests (external Services, EndpointSlices, Ingresses) to reach docker backends. headscale/nextcloud routing moved to k8s/routing/. validations: compose config --quiet + kubectl apply --dry-run=client. namespace manifests applied first. pull_policy:build stacks get build+push before up so the registry image stays fresh.	2026-09-06 20:39:12 +02:00
forust	1762962f32	chore(k8s): fix indentation in ingress manifests (3-space -> 2-space)	2026-06-19 12:03:02 +02:00
forust	0803f3efff	chore(k8s): returned to Host || Host standart instead of regexp. ... Yaml lint (yamllint)	2026-06-18 21:02:40 +02:00
forust	4ca3ccdad3	chore(k8s): router rewrite ... - returned to Host matcher instead of Hostregexp - switched dockercompose labels to letsencrypt - renamed DoH route	2026-06-16 12:34:15 +02:00
forust	68c5eac164	chore: compact ingress rules with regex	2026-06-11 14:20:03 +02:00
forust	4623fbd8bd	chore: make metube downloads writed to a temporary storage	2026-06-10 21:17:43 +02:00
forust	18d1e21690	fix(k8s): traefik log spam for non-existing local-tls secret, because of namespace isolation	2026-06-10 21:14:10 +02:00
forust	1ea669220b	chore(k8): adjusted system resources requests and limits based on manual monitoring	2026-06-10 19:37:16 +02:00
forust	7a3708f70c	lint: yaml spaces and tabs	2026-06-09 12:59:36 +02:00
forust	e19660fdf4	feat(k8s): standardize IngressRoutes — LE prod certs, prod→local→dev order, Traefik values fix	2026-06-08 12:27:55 +02:00
forust	36922a177c	feat(k8s): add K8s manifests for all homelab services ... traefik, gitea, adguard, nextcloud, errorpages, homepages, uptime-kuma, kener, checkmk, headscale, dockmon, metube, downtify, portainer, netronome, userbot Includes Helm values, deployments, services, ingress routes, configmaps, secrets (placeholders), postgres statefulsets, kustomize overlays, and Traefik dynamic configuration.	2026-06-08 10:54:03 +02:00