582 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
forust	f4df6d4437	Merge pull request 'chore(deps): update container patch updates' (#38) from renovate/container-patch-updates into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/38	2026-09-25 22:18:21 +00:00
renovate-bot	987a89f022	chore(deps): update container patch updates	2026-09-25 22:18:07 +00:00
forust	b423119632	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.115.9' (#47) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/47	2026-09-25 22:17:46 +00:00
renovate-bot	ddbc0cc7e6	chore(deps): update renovate/renovate docker tag to v44.115.9	2026-09-25 22:17:46 +00:00
forust	6ad33d75e6	Merge pull request 'chore(deps): update prom/prometheus docker tag to v3.15.0' (#48) from renovate/prom-prometheus-3.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/48	2026-09-25 22:17:15 +00:00
renovate-bot	11bfb426c0	chore(deps): update prom/prometheus docker tag to v3.15.0	2026-09-25 22:17:15 +00:00
forust	b7a1835adb	Merge pull request 'feat(netbird): add tailscale-alternative' (#50) from feat/netbird into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/50	2026-09-25 22:16:51 +00:00
forust	ad4bb8750d	chore(deploy): enable netbird	2026-09-25 22:16:02 +00:00
forust	f1e00b946f	Merge pull request 'Feat/documenting services' (#51) from feat/documenting-services into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/51	2026-09-25 22:15:45 +00:00
forust	7ee7d0c961	Update README.md	2026-09-26 00:15:01 +02:00
forust	71e769c002	chore(deploy): disable checkmk, enable netbox and rackpeek	2026-09-26 00:04:37 +02:00
forust	16dd67c2c0	feat(rackpeek): add internal-only rack visualization service ... Compose and k8s manifests behind workstation/gigaforust internal hosts.	2026-09-26 00:00:49 +02:00
forust	c536a16a2a	feat(netbox): add enterprise-grade server documenting app w/ shared postgres	2026-09-25 23:24:21 +02:00
forust	a4a4bb4cc5	feat(netbird): add tailscale-alternative	2026-09-25 20:26:11 +02:00
forust	648b354951	refactor(deploy): marker-driven selection (k8s/active, root active); enable headscale/nextcloud hybrid, disable dockmon/kener/downtify/n8n	2026-09-23 18:11:51 +02:00
forust	b0a9b3476d	fix(deploy): drop broken %q quoting that wrapped remote vars in literal quotes	2026-09-23 16:33:51 +02:00
forust	ac3bf4a55a	fix(deploy): strip quotes and CR from DEPLOY_PATH	2026-09-23 16:31:06 +02:00
forust	34fb6f85ba	Merge pull request 'chore(deps): update darthnorse/dockmon docker tag to v2.5.0' (#39) from renovate/darthnorse-dockmon-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/39	2026-09-23 14:16:21 +00:00
renovate-bot	66eacd86d1	chore(deps): update darthnorse/dockmon docker tag to v2.5.0	2026-09-23 14:16:21 +00:00
forust	54f43fc2c7	Merge pull request 'chore(deps): update ghcr.io/lukegus/termix docker tag to v2.8.0' (#40) from renovate/ghcr.io-lukegus-termix-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/40	2026-09-23 14:16:06 +00:00
renovate-bot	451d0dc6b7	chore(deps): update ghcr.io/lukegus/termix docker tag to v2.8.0	2026-09-23 14:16:06 +00:00
forust	88ae20a543	Merge pull request 'chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v3' (#42) from renovate/ghcr.io-henriquesebastiao-downtify-3.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/42	2026-09-23 14:15:51 +00:00
renovate-bot	6bd183ba73	chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v3	2026-09-23 14:14:58 +00:00
forust	aeefdd8560	Merge pull request 'chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.41.0' (#43) from renovate/docker.n8n.io-n8nio-n8n-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/43	2026-09-23 14:14:39 +00:00
renovate-bot	c10d344fd7	chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.41.0	2026-09-23 14:14:39 +00:00
forust	6e5f80611b	Merge pull request 'Cicd/deploy rework' (#44) from cicd/deploy-rework into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/44	2026-09-23 14:11:42 +00:00
forust	5cf0c90258	style: prettier formatting for edu_master alerts and postgres readme	2026-09-23 16:10:33 +02:00
forust	90a452a253	feat(deploy): auto-rollout on push to main (gated by branch protection)	2026-09-23 15:58:15 +02:00
forust	a9eabfba02	fix(userbot): include internal-certificate in kustomize base	2026-09-23 15:52:32 +02:00
forust	46c7e99b1d	chore(deploy): rework k8s pipeline, monitoring and postgres 17 ... Deploy workflow uses git-tracked manifests, DISABLED flag and kustomize overlays; add webinar-checker metrics with ServiceMonitor and alerts; upgrade shared postgres to 17 with statuspage DB and probes/resources.	2026-09-23 15:47:26 +02:00
forust	8b2cf29771	feat(tls): internal CA wildcard for *.internal routes	2026-09-23 14:47:14 +02:00
forust	7b7fc3bcb0	fix(tls): drop internal certs for dormant namespaces (kener, downtify have no ns live)	2026-09-23 14:46:09 +02:00
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ... Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
forust	f29bb3d580	revert: drop Grafana cert-manager dashboard	2026-09-23 14:42:09 +02:00
forust	1f7166026b	feat(observability): cert-manager metrics, dashboard and alerts	2026-09-23 14:32:36 +02:00
forust	1cbdfc1d6f	feat(observability): cert-manager metrics, dashboard and alerts ... - ServiceMonitor for cert-manager (release: prometheus-stack) - Grafana dashboard Cert-manager-Kubernetes (ID 22908, datasource refs fixed) via dashboard sidecar ConfigMap - PrometheusRule: NotReady (crit), expiry <14d (warn) / <7d (crit), ACME 429 rate-limit (warn)	2026-09-23 14:32:36 +02:00
forust	6be3769288	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... Big-bang: 24 Certificates (HTTP-01, letsencrypt-prod) replace Traefik certResolver on all prod IngressRoutes. Traefik certificatesResolvers removed (its acme-http router hijacked HTTP-01 for every host). AdGuard DoT shares the cert-manager adguard-certs secret; sync CronJob retired. Dormant files converted, n8n untouched (live-only deletion rule).	2026-09-23 14:16:23 +02:00
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
forust	aa81f1bf8a	feat(adguard): Traefik-synced TLS for AdGuard DoT + reloader ... - CronJob mirrors Traefik prod cert dns.forust.xyz into adguard-certs (cert-manager HTTP-01 is hijacked by Traefik acme-http router, see adguardhome/k8s/cert-sync.yaml) - reloader for auto-restart on secret rotation - drop retired adguard.forust.xyz from prod route - traefik: enable kubernetesIngress, drop unused staging resolver	2026-09-23 14:04:14 +02:00
forust	93d768e988	fix(adguard): split deployment RBAC rule for list/watch ... Collection verbs cannot combine with resourceNames (grant would be void). Instance verbs stay name-scoped to adguard-deployment; list/watch is namespace-scoped (single Deployment in ns).	2026-09-23 13:54:06 +02:00
forust	a8f7c79934	fix(adguard): sync job RBAC and idempotency ... - grant list+watch on adguard-deployment (rollout status hung without it, job hit activeDeadline and failed) - compare content digests only (old hash embedded filenames, so every run patched + restarted even when in sync) Keeps explicit rollout restart alongside reloader annotation: one extra restart per rotation (~60d) is accepted for determinism if reloader is down.	2026-09-23 13:52:57 +02:00
forust	c42bf14c9a	fix(adguard): drop retired adguard.forust.xyz from prod route so dns.forust.xyz gets LE cert ... adguard.forust.xyz is NXDOMAIN (host retired); the combo SAN cert kept failing and dns.forust.xyz served TRAEFIK DEFAULT CERT. Scope prod route to dns.forust.xyz only. Also commit live traefik-values state (remove letsencrypt-staging resolver, live since helm rev 33).	2026-09-23 13:42:04 +02:00
forust	1e8479b853	feat(adguard): sync Traefik prod cert for dns.forust.xyz into adguard-certs ... CronJob adguard-cert-sync (daily 03:17) copies the public cert/key for dns.forust.xyz from Traefik acme.json into Secret adguard-certs, which AdGuard mounts for DNS-over-TLS on :853. - least-privilege RBAC: read pods/exec in ns traefik, get/update/patch Secret adguard-certs and get/patch adguard-deployment in ns adguard - script selects the PROD resolver entry only, matches main domain or SANs, compares sha256 hashes, patches the secret and restarts the deployment ONLY on change; exits non-zero and touches nothing when Traefik holds no cert yet (HTTP-01 currently cannot complete)	2026-09-23 13:39:38 +02:00
forust	c139d700f1	feat(adguard,traefik,cert-manager,reloader): foundation for adguard cert sync ... - traefik: enable kubernetesIngress provider (needed for cert-manager HTTP-01) - adguard: add reloader auto annotation for secret-driven restarts - cert-manager: namespace, helm values (crds), staging+prod ClusterIssuers - reloader: namespace manifest	2026-09-23 13:19:26 +02:00
forust	67b9996911	fix(renovate): default endpoint to gitea API URL ... Fall back to https://gitea.forust.xyz/api/v1 when RENOVATE_ENDPOINT is unset, in both local config and in-cluster ConfigMap.	2026-09-23 13:06:19 +02:00
forust	4e9ee567ca	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.106.0' (#41) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/41	2026-09-21 20:03:24 +00:00
renovate-bot	4863e13596	chore(deps): update renovate/renovate docker tag to v44.106.0	2026-09-21 16:18:03 +00:00
forust	9c4580a522	fix(prometheus): exclude xui services from TraefikServiceHighLatency ... Long-lived VPN WebSocket sessions inflate P95 request duration; keep 5xx/down/cert alerts for xui unchanged.	2026-09-19 19:06:42 +02:00
forust	4e3ad00202	feat(xui): add 3x-ui VPN panel behind cloudflared tunnel ... VLESS+WS inbound (port 10000) via Traefik IngressRoute, panel on internal domains only with public route commented out. gitignore now covers nested k8s secrets and local-only grafana values.	2026-09-19 19:06:37 +02:00
forust	86ac43567d	chore(renovate): sync pins to 44.103.0	2026-09-18 22:21:48 +02:00