628 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
renovate-bot	11bfb426c0	chore(deps): update prom/prometheus docker tag to v3.15.0	2026-09-25 22:17:15 +00:00
forust	b7a1835adb	Merge pull request 'feat(netbird): add tailscale-alternative' (#50) from feat/netbird into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/50	2026-09-25 22:16:51 +00:00
forust	ad4bb8750d	chore(deploy): enable netbird	2026-09-25 22:16:02 +00:00
forust	f1e00b946f	Merge pull request 'Feat/documenting services' (#51) from feat/documenting-services into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/51	2026-09-25 22:15:45 +00:00
forust	7ee7d0c961	Update README.md	2026-09-26 00:15:01 +02:00
forust	27ab6b859e	chore(deploy): enable netbird	2026-09-26 00:04:50 +02:00
forust	71e769c002	chore(deploy): disable checkmk, enable netbox and rackpeek	2026-09-26 00:04:37 +02:00
forust	16dd67c2c0	feat(rackpeek): add internal-only rack visualization service ... Compose and k8s manifests behind workstation/gigaforust internal hosts.	2026-09-26 00:00:49 +02:00
forust	c536a16a2a	feat(netbox): add enterprise-grade server documenting app w/ shared postgres	2026-09-25 23:24:21 +02:00
forust	a4a4bb4cc5	feat(netbird): add tailscale-alternative	2026-09-25 20:26:11 +02:00
forust	648b354951	refactor(deploy): marker-driven selection (k8s/active, root active); enable headscale/nextcloud hybrid, disable dockmon/kener/downtify/n8n	2026-09-23 18:11:51 +02:00
forust	b0a9b3476d	fix(deploy): drop broken %q quoting that wrapped remote vars in literal quotes	2026-09-23 16:33:51 +02:00
forust	ac3bf4a55a	fix(deploy): strip quotes and CR from DEPLOY_PATH	2026-09-23 16:31:06 +02:00
forust	34fb6f85ba	Merge pull request 'chore(deps): update darthnorse/dockmon docker tag to v2.5.0' (#39) from renovate/darthnorse-dockmon-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/39	2026-09-23 14:16:21 +00:00
renovate-bot	66eacd86d1	chore(deps): update darthnorse/dockmon docker tag to v2.5.0	2026-09-23 14:16:21 +00:00
forust	54f43fc2c7	Merge pull request 'chore(deps): update ghcr.io/lukegus/termix docker tag to v2.8.0' (#40) from renovate/ghcr.io-lukegus-termix-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/40	2026-09-23 14:16:06 +00:00
renovate-bot	451d0dc6b7	chore(deps): update ghcr.io/lukegus/termix docker tag to v2.8.0	2026-09-23 14:16:06 +00:00
forust	88ae20a543	Merge pull request 'chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v3' (#42) from renovate/ghcr.io-henriquesebastiao-downtify-3.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/42	2026-09-23 14:15:51 +00:00
renovate-bot	6bd183ba73	chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v3	2026-09-23 14:14:58 +00:00
forust	aeefdd8560	Merge pull request 'chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.41.0' (#43) from renovate/docker.n8n.io-n8nio-n8n-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/43	2026-09-23 14:14:39 +00:00
renovate-bot	c10d344fd7	chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.41.0	2026-09-23 14:14:39 +00:00
forust	6e5f80611b	Merge pull request 'Cicd/deploy rework' (#44) from cicd/deploy-rework into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/44	2026-09-23 14:11:42 +00:00
forust	5cf0c90258	style: prettier formatting for edu_master alerts and postgres readme	2026-09-23 16:10:33 +02:00
forust	90a452a253	feat(deploy): auto-rollout on push to main (gated by branch protection)	2026-09-23 15:58:15 +02:00
forust	a9eabfba02	fix(userbot): include internal-certificate in kustomize base	2026-09-23 15:52:32 +02:00
forust	46c7e99b1d	chore(deploy): rework k8s pipeline, monitoring and postgres 17 ... Deploy workflow uses git-tracked manifests, DISABLED flag and kustomize overlays; add webinar-checker metrics with ServiceMonitor and alerts; upgrade shared postgres to 17 with statuspage DB and probes/resources.	2026-09-23 15:47:26 +02:00
forust	8b2cf29771	feat(tls): internal CA wildcard for *.internal routes	2026-09-23 14:47:14 +02:00
forust	7b7fc3bcb0	fix(tls): drop internal certs for dormant namespaces (kener, downtify have no ns live)	2026-09-23 14:46:09 +02:00
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ... Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
forust	f29bb3d580	revert: drop Grafana cert-manager dashboard	2026-09-23 14:42:09 +02:00
forust	1f7166026b	feat(observability): cert-manager metrics, dashboard and alerts	2026-09-23 14:32:36 +02:00
forust	1cbdfc1d6f	feat(observability): cert-manager metrics, dashboard and alerts ... - ServiceMonitor for cert-manager (release: prometheus-stack) - Grafana dashboard Cert-manager-Kubernetes (ID 22908, datasource refs fixed) via dashboard sidecar ConfigMap - PrometheusRule: NotReady (crit), expiry <14d (warn) / <7d (crit), ACME 429 rate-limit (warn)	2026-09-23 14:32:36 +02:00
forust	6be3769288	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... Big-bang: 24 Certificates (HTTP-01, letsencrypt-prod) replace Traefik certResolver on all prod IngressRoutes. Traefik certificatesResolvers removed (its acme-http router hijacked HTTP-01 for every host). AdGuard DoT shares the cert-manager adguard-certs secret; sync CronJob retired. Dormant files converted, n8n untouched (live-only deletion rule).	2026-09-23 14:16:23 +02:00
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
forust	aa81f1bf8a	feat(adguard): Traefik-synced TLS for AdGuard DoT + reloader ... - CronJob mirrors Traefik prod cert dns.forust.xyz into adguard-certs (cert-manager HTTP-01 is hijacked by Traefik acme-http router, see adguardhome/k8s/cert-sync.yaml) - reloader for auto-restart on secret rotation - drop retired adguard.forust.xyz from prod route - traefik: enable kubernetesIngress, drop unused staging resolver	2026-09-23 14:04:14 +02:00
forust	93d768e988	fix(adguard): split deployment RBAC rule for list/watch ... Collection verbs cannot combine with resourceNames (grant would be void). Instance verbs stay name-scoped to adguard-deployment; list/watch is namespace-scoped (single Deployment in ns).	2026-09-23 13:54:06 +02:00
forust	a8f7c79934	fix(adguard): sync job RBAC and idempotency ... - grant list+watch on adguard-deployment (rollout status hung without it, job hit activeDeadline and failed) - compare content digests only (old hash embedded filenames, so every run patched + restarted even when in sync) Keeps explicit rollout restart alongside reloader annotation: one extra restart per rotation (~60d) is accepted for determinism if reloader is down.	2026-09-23 13:52:57 +02:00
forust	c42bf14c9a	fix(adguard): drop retired adguard.forust.xyz from prod route so dns.forust.xyz gets LE cert ... adguard.forust.xyz is NXDOMAIN (host retired); the combo SAN cert kept failing and dns.forust.xyz served TRAEFIK DEFAULT CERT. Scope prod route to dns.forust.xyz only. Also commit live traefik-values state (remove letsencrypt-staging resolver, live since helm rev 33).	2026-09-23 13:42:04 +02:00
forust	1e8479b853	feat(adguard): sync Traefik prod cert for dns.forust.xyz into adguard-certs ... CronJob adguard-cert-sync (daily 03:17) copies the public cert/key for dns.forust.xyz from Traefik acme.json into Secret adguard-certs, which AdGuard mounts for DNS-over-TLS on :853. - least-privilege RBAC: read pods/exec in ns traefik, get/update/patch Secret adguard-certs and get/patch adguard-deployment in ns adguard - script selects the PROD resolver entry only, matches main domain or SANs, compares sha256 hashes, patches the secret and restarts the deployment ONLY on change; exits non-zero and touches nothing when Traefik holds no cert yet (HTTP-01 currently cannot complete)	2026-09-23 13:39:38 +02:00
forust	c139d700f1	feat(adguard,traefik,cert-manager,reloader): foundation for adguard cert sync ... - traefik: enable kubernetesIngress provider (needed for cert-manager HTTP-01) - adguard: add reloader auto annotation for secret-driven restarts - cert-manager: namespace, helm values (crds), staging+prod ClusterIssuers - reloader: namespace manifest	2026-09-23 13:19:26 +02:00
forust	67b9996911	fix(renovate): default endpoint to gitea API URL ... Fall back to https://gitea.forust.xyz/api/v1 when RENOVATE_ENDPOINT is unset, in both local config and in-cluster ConfigMap.	2026-09-23 13:06:19 +02:00
forust	4e9ee567ca	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.106.0' (#41) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/41	2026-09-21 20:03:24 +00:00
renovate-bot	4863e13596	chore(deps): update renovate/renovate docker tag to v44.106.0	2026-09-21 16:18:03 +00:00
forust	9c4580a522	fix(prometheus): exclude xui services from TraefikServiceHighLatency ... Long-lived VPN WebSocket sessions inflate P95 request duration; keep 5xx/down/cert alerts for xui unchanged.	2026-09-19 19:06:42 +02:00
forust	4e3ad00202	feat(xui): add 3x-ui VPN panel behind cloudflared tunnel ... VLESS+WS inbound (port 10000) via Traefik IngressRoute, panel on internal domains only with public route commented out. gitignore now covers nested k8s secrets and local-only grafana values.	2026-09-19 19:06:37 +02:00
forust	86ac43567d	chore(renovate): sync pins to 44.103.0	2026-09-18 22:21:48 +02:00
forust	35bf980bda	Merge branch 'main' of https://gitea.forust.xyz/forust/homelab	2026-09-18 22:19:57 +02:00
forust	51677ae184	ci: run all lint jobs natively without docker	2026-09-18 22:18:59 +02:00
forust	c9e6fc0e2b	ci: run ruff and yamllint natively, cache npm ... Ruff and yamllint ship in Arch repos, drop their container pulls. Prettier keeps the node container but mounts persistent npm cache. Hadolint and kubeconform stay containerized (AUR-only / hermetic pin).	2026-09-18 19:41:02 +02:00
forust	ab386fc436	ci: keep gitea workflows only, harden and speed up pipelines ... Drop duplicated .github/workflows (helm blocks ported to .gitea deploy first). Add ci concurrency with cancel on branches, pin checkout to SHA and prettier to 3.9.8, registry layer cache for image builds. renovate-run gains config validation and dry-run input.	2026-09-18 19:38:56 +02:00