595 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
forust	f22793e32e	ci: lint workflows and shell scripts, validate k8s against the API server ... Adds three lint jobs (actionlint, shellcheck, compose) and a server-side dry-run of the active manifests. Previously the only k8s check was kubeconform, which has no schemas for CRDs, so every IngressRoute, Certificate, PrometheusRule and Middleware was silently skipped. The server-side pass needs the live API server because that is the only place the real CRD schemas and the cert-manager / Traefik admission webhooks exist. It is scoped to services carrying a k8s/active marker, since dry-run needs the target namespace to exist. userbot/ is excluded from shellcheck: it is a git subtree, and linting upstream's scripts would let a routine subtree pull turn the deploy gate red on code we do not own. kubeconform, shellcheck and actionlint are now installed from pinned versions in tool-versions.env rather than picked up from the runner's PATH. The Compose helper is shared with the deploy workflow so both check the same file set the same way.	2026-09-26 20:09:09 +02:00
forust	4a8d4feea0	fix(netbox): run probes with curl directly, not python -c ... python -c 'exec /usr/bin/curl ...' is shell syntax, not Python, so every probe raised SyntaxError and the pod never became ready. Verified curl against /login/ returns HTTP 200.	2026-09-26 19:07:47 +02:00
forust	1d9a85bef9	fix(edu-master): stop 20722d false alert on zeroed last_success gauge ... checker.py initialises last_success to 0, so right after a pod restart `time() - last_success` equals the current epoch. The rule compared that against 300, went firing instantly, and humanizeDuration rendered the raw epoch delta as ~20722d. The last_run > 0 guard did not help because a run happens long before the first success. Guard the duration rule on last_success > 0, keeping the duration expression on the left of `and` so $value stays the real gap, and add a separate WebinarCheckerNeverSucceeded rule for the zeroed-gauge case so a checker that has never succeeded is still caught.	2026-09-26 17:50:45 +02:00
forust	b625d30568	ci(deploy): cancel superseded deploys on new push ... Queued deploy runs were deploying origin/main at start anyway (preflight reset), so waiting runs duplicated the newest deploy instead of their own commit. Cancel them.	2026-09-26 17:42:36 +02:00
forust	d018a441af	fix(deploy): move netbox from compose to k8s ... compose.yaml is a local-only stand on 127.0.0.1:8000 per README; the live service runs in-cluster. The root active marker made apply-compose fail on gitignored .env vars.	2026-09-26 17:38:20 +02:00
forust	ecb254017d	fix(searxng): use existing image tag 2026.9.25-12f8b6515 ... 2026.09.13-d4ce87c23 was never published (upstream tags month without leading zero); rollout stuck in ImagePullBackOff. Verified replacement tag exists on Docker Hub.	2026-09-26 17:37:20 +02:00
forust	41f18ea993	fix(deploy): move netbird from compose to k8s ... netbird runs in-cluster; the root active marker made apply-compose pick up netbird/compose.yaml and fail on gitignored .env vars. Drop the compose marker and enable k8s/active instead.	2026-09-26 17:24:03 +02:00
forust	91c344fe2c	fix(monitoring): disable control-plane alerts and scrapes on k0s ... k0s runs kube-controller-manager, kube-scheduler and etcd inside its own process rather than as pods, so the chart's Services never get endpoints and the targets stay permanently absent. Drop the matching ServiceMonitors and their Down/HighCommitDurations rules; kube-proxy and kubelet do get endpoints on k0s and stay enabled.	2026-09-26 17:16:55 +02:00
forust	cab6ef2102	Merge branch 'feat/netbird'	2026-09-26 17:05:55 +02:00
forust	a2ff9515a3	fix(deploy): validate compose without workstation secrets ... docker compose config required real values for gitignored .env files and secrets, so validate always failed on stacks with :? guards (netbird, netbox). Validate structure only via --no-interpolate, --no-env-resolution and --no-path-resolution, keeping normalization and consistency checks.	2026-09-26 17:00:43 +02:00
forust	62d39ee4f1	Merge pull request 'chore(deps): update netbirdio/dashboard docker tag to v2.93.0' (#53) from renovate/netbirdio-dashboard-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/53	2026-09-25 22:27:21 +00:00
renovate-bot	f1f7dd4a0a	chore(deps): update netbirdio/dashboard docker tag to v2.93.0	2026-09-25 22:26:10 +00:00
forust	f4df6d4437	Merge pull request 'chore(deps): update container patch updates' (#38) from renovate/container-patch-updates into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/38	2026-09-25 22:18:21 +00:00
renovate-bot	987a89f022	chore(deps): update container patch updates	2026-09-25 22:18:07 +00:00
forust	b423119632	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.115.9' (#47) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/47	2026-09-25 22:17:46 +00:00
renovate-bot	ddbc0cc7e6	chore(deps): update renovate/renovate docker tag to v44.115.9	2026-09-25 22:17:46 +00:00
forust	6ad33d75e6	Merge pull request 'chore(deps): update prom/prometheus docker tag to v3.15.0' (#48) from renovate/prom-prometheus-3.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/48	2026-09-25 22:17:15 +00:00
renovate-bot	11bfb426c0	chore(deps): update prom/prometheus docker tag to v3.15.0	2026-09-25 22:17:15 +00:00
forust	b7a1835adb	Merge pull request 'feat(netbird): add tailscale-alternative' (#50) from feat/netbird into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/50	2026-09-25 22:16:51 +00:00
forust	ad4bb8750d	chore(deploy): enable netbird	2026-09-25 22:16:02 +00:00
forust	f1e00b946f	Merge pull request 'Feat/documenting services' (#51) from feat/documenting-services into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/51	2026-09-25 22:15:45 +00:00
forust	7ee7d0c961	Update README.md	2026-09-26 00:15:01 +02:00
forust	27ab6b859e	chore(deploy): enable netbird	2026-09-26 00:04:50 +02:00
forust	71e769c002	chore(deploy): disable checkmk, enable netbox and rackpeek	2026-09-26 00:04:37 +02:00
forust	16dd67c2c0	feat(rackpeek): add internal-only rack visualization service ... Compose and k8s manifests behind workstation/gigaforust internal hosts.	2026-09-26 00:00:49 +02:00
forust	c536a16a2a	feat(netbox): add enterprise-grade server documenting app w/ shared postgres	2026-09-25 23:24:21 +02:00
forust	a4a4bb4cc5	feat(netbird): add tailscale-alternative	2026-09-25 20:26:11 +02:00
forust	648b354951	refactor(deploy): marker-driven selection (k8s/active, root active); enable headscale/nextcloud hybrid, disable dockmon/kener/downtify/n8n	2026-09-23 18:11:51 +02:00
forust	b0a9b3476d	fix(deploy): drop broken %q quoting that wrapped remote vars in literal quotes	2026-09-23 16:33:51 +02:00
forust	ac3bf4a55a	fix(deploy): strip quotes and CR from DEPLOY_PATH	2026-09-23 16:31:06 +02:00
forust	34fb6f85ba	Merge pull request 'chore(deps): update darthnorse/dockmon docker tag to v2.5.0' (#39) from renovate/darthnorse-dockmon-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/39	2026-09-23 14:16:21 +00:00
renovate-bot	66eacd86d1	chore(deps): update darthnorse/dockmon docker tag to v2.5.0	2026-09-23 14:16:21 +00:00
forust	54f43fc2c7	Merge pull request 'chore(deps): update ghcr.io/lukegus/termix docker tag to v2.8.0' (#40) from renovate/ghcr.io-lukegus-termix-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/40	2026-09-23 14:16:06 +00:00
renovate-bot	451d0dc6b7	chore(deps): update ghcr.io/lukegus/termix docker tag to v2.8.0	2026-09-23 14:16:06 +00:00
forust	88ae20a543	Merge pull request 'chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v3' (#42) from renovate/ghcr.io-henriquesebastiao-downtify-3.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/42	2026-09-23 14:15:51 +00:00
renovate-bot	6bd183ba73	chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v3	2026-09-23 14:14:58 +00:00
forust	aeefdd8560	Merge pull request 'chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.41.0' (#43) from renovate/docker.n8n.io-n8nio-n8n-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/43	2026-09-23 14:14:39 +00:00
renovate-bot	c10d344fd7	chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.41.0	2026-09-23 14:14:39 +00:00
forust	6e5f80611b	Merge pull request 'Cicd/deploy rework' (#44) from cicd/deploy-rework into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/44	2026-09-23 14:11:42 +00:00
forust	5cf0c90258	style: prettier formatting for edu_master alerts and postgres readme	2026-09-23 16:10:33 +02:00
forust	90a452a253	feat(deploy): auto-rollout on push to main (gated by branch protection)	2026-09-23 15:58:15 +02:00
forust	a9eabfba02	fix(userbot): include internal-certificate in kustomize base	2026-09-23 15:52:32 +02:00
forust	46c7e99b1d	chore(deploy): rework k8s pipeline, monitoring and postgres 17 ... Deploy workflow uses git-tracked manifests, DISABLED flag and kustomize overlays; add webinar-checker metrics with ServiceMonitor and alerts; upgrade shared postgres to 17 with statuspage DB and probes/resources.	2026-09-23 15:47:26 +02:00
forust	8b2cf29771	feat(tls): internal CA wildcard for *.internal routes	2026-09-23 14:47:14 +02:00
forust	7b7fc3bcb0	fix(tls): drop internal certs for dormant namespaces (kener, downtify have no ns live)	2026-09-23 14:46:09 +02:00
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ... Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
forust	f29bb3d580	revert: drop Grafana cert-manager dashboard	2026-09-23 14:42:09 +02:00
forust	1f7166026b	feat(observability): cert-manager metrics, dashboard and alerts	2026-09-23 14:32:36 +02:00
forust	1cbdfc1d6f	feat(observability): cert-manager metrics, dashboard and alerts ... - ServiceMonitor for cert-manager (release: prometheus-stack) - Grafana dashboard Cert-manager-Kubernetes (ID 22908, datasource refs fixed) via dashboard sidecar ConfigMap - PrometheusRule: NotReady (crit), expiry <14d (warn) / <7d (crit), ACME 429 rate-limit (warn)	2026-09-23 14:32:36 +02:00
forust	6be3769288	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... Big-bang: 24 Certificates (HTTP-01, letsencrypt-prod) replace Traefik certResolver on all prod IngressRoutes. Traefik certificatesResolvers removed (its acme-http router hijacked HTTP-01 for every host). AdGuard DoT shares the cert-manager adguard-certs secret; sync CronJob retired. Dormant files converted, n8n untouched (live-only deletion rule).	2026-09-23 14:16:23 +02:00