100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
forust	2b9e34ba4a	fix(k8s): add readiness probes so a bad image cannot look healthy ... Six of eight workloads had no readinessProbe, so a pod turned Ready the moment its process started. The verify job relies on `rollout status`, so it passed for images that crash-looped or served errors, which left the rollback safety net inert. Each probe targets the path the service is actually reached on: - homepages: / (verified 200) - error-pages: /404.html, the path Traefik's errorPages middleware requests. / returns 403 by design and would never pass. - webinar-checker: /health (verified 200). /metrics also answers, but it is a Prometheus endpoint, not a readiness signal. The two userbot deployments stay without probes: they expose no port and no session file, and the panel reaches Telegram through its own client. A truthful signal there needs a health endpoint in the app itself.	2026-09-27 10:01:09 +02:00
forust	30d2b83efe	chore(reloader): manage the reloader release from the repository ... Reloader has been running since 23 September and is what makes the reloader.stakater.com/auto annotation on a pod template do anything, but the repository only held a namespace. It was a release someone installed by hand, so it was invisible to review, invisible to Renovate, and one reinstall away from being silently dropped. Declaring it in HELM_RELEASES pins the chart version somewhere Renovate can update it, and the active marker means the namespace is applied before the upgrade instead of only existing as a side effect of the original install. The values file sets nothing the running release does not already do, apart from resource requests and limits, which the chart leaves empty.	2026-09-27 09:48:32 +02:00
forust	db7bccfd89	fix(deploy): restart workloads whose image tag moved past what they run ... Our manifests pin images to `:latest`, so a rebuild leaves the pod template byte-identical. kubectl apply sees no change, creates no ReplicaSet and pulls nothing, and the cluster keeps serving the previous build. imagePullPolicy: Always does not help, because it only decides whether a pod that *is* starting pulls, and no pod ever starts. All eight workloads that consume an image from our own registry were affected. Three of them had been running code from 23 September, and the single hardcoded `rollout restart deployment/userbot-panel` covered one of the eight. Restarting everything unconditionally was not the answer either: that bounces healthy services on every deploy, error-pages included, and the brief window where nothing answers is exactly what error-pages exists to prevent. So compare what each workload actually runs against what the tag resolves to now, and restart only the ones that differ. When the tag still points at the running digest nothing happens, so a redeploy that changed no image is a no-op. Scope is the repository, deliberately. Five more workloads run our images but have no manifest here, and they are applied out of band. Walking the manifests rather than the cluster means this can never reach them. The digest is resolved for the node architecture. A multi-arch tag also carries `unknown/unknown` entries for the build attestation, and a pod's imageID is always the per-platform digest, so comparing the wrong entry would mark everything stale forever. Once a restart happens it bumps the generation, which is what makes the change visible to changed_workloads and therefore watchable and revertible by the verify stage.	2026-09-27 09:48:04 +02:00
forust	1505b638ce	fix(deploy): verify and roll back in a separate job ... verify_workloads ended on `[ -s "$failed_file" ]`, which is the opposite of what its own contract says. A non-empty file means something failed, so the function returned success exactly when a workload never came up, and failure when everything was fine. Every rollback was therefore skipped, and every deploy that changed anything ended red with an empty failure list and a bogus "Rolled back successfully". Worse, the check only ever ran at the end of stage_apply_k8s, inside the same process as the apply. A job killed by timeout-minutes, cancelled by a new push, or cut off by a dropped SSH connection never reached it, which is precisely when a rollback matters. The three helm upgrades alone can consume the whole 30-minute job budget, so that path was reachable. Verification now lives in its own job, gated on always(), so it runs whatever happened to the apply. The apply stage publishes its pre-apply snapshot through DEPLOY_SNAPSHOT_DIR/current before touching anything, and the verify stage picks it up from there. A snapshot whose recorded commit does not match the deploy is refused rather than trusted, so a stale pointer from an earlier run cannot make the rollback revert the wrong workloads. An unwritable snapshot directory now fails the deploy up front instead of silently continuing without a way back. cancel-in-progress becomes false for the same reason: cancelling a run kills the apply job and takes the verify job with it, which is the failure this change exists to prevent. Both applies are idempotent, so queueing costs little. The SSH key moves to a per-run directory removed on exit, and the deploy is pinned to the exact commit CI validated.	2026-09-26 20:09:20 +02:00
forust	7ce727bc8a	chore(renovate): move config under renovate/ and validate it in CI ... The config lived in renovate.json at the repo root while everything else Renovate-related sat under renovate/, and renovate/config.js was a second, unused source of truth. Both are gone: renovate/renovate.json is now the only config file. Because the CronJob in the cluster cannot read the repository, its ConfigMap carries an inlined copy of the config. That copy is generated, and sync-renovate-configmap.sh --check now fails the build when it drifts from the source file. The workflows also stop carrying a copy of the renovate/renovate image tag. They read it from renovate/k8s/cronjob.yaml, so the version validated in CI is the version that actually runs in the cluster. ci.yaml validates the config with renovate-config-validator, checks the generated ConfigMap, and kubeconforms the CronJob's own manifests.	2026-09-26 20:09:13 +02:00
forust	f22793e32e	ci: lint workflows and shell scripts, validate k8s against the API server ... Adds three lint jobs (actionlint, shellcheck, compose) and a server-side dry-run of the active manifests. Previously the only k8s check was kubeconform, which has no schemas for CRDs, so every IngressRoute, Certificate, PrometheusRule and Middleware was silently skipped. The server-side pass needs the live API server because that is the only place the real CRD schemas and the cert-manager / Traefik admission webhooks exist. It is scoped to services carrying a k8s/active marker, since dry-run needs the target namespace to exist. userbot/ is excluded from shellcheck: it is a git subtree, and linting upstream's scripts would let a routine subtree pull turn the deploy gate red on code we do not own. kubeconform, shellcheck and actionlint are now installed from pinned versions in tool-versions.env rather than picked up from the runner's PATH. The Compose helper is shared with the deploy workflow so both check the same file set the same way.	2026-09-26 20:09:09 +02:00
forust	4a8d4feea0	fix(netbox): run probes with curl directly, not python -c ... python -c 'exec /usr/bin/curl ...' is shell syntax, not Python, so every probe raised SyntaxError and the pod never became ready. Verified curl against /login/ returns HTTP 200.	2026-09-26 19:07:47 +02:00
forust	1d9a85bef9	fix(edu-master): stop 20722d false alert on zeroed last_success gauge ... checker.py initialises last_success to 0, so right after a pod restart `time() - last_success` equals the current epoch. The rule compared that against 300, went firing instantly, and humanizeDuration rendered the raw epoch delta as ~20722d. The last_run > 0 guard did not help because a run happens long before the first success. Guard the duration rule on last_success > 0, keeping the duration expression on the left of `and` so $value stays the real gap, and add a separate WebinarCheckerNeverSucceeded rule for the zeroed-gauge case so a checker that has never succeeded is still caught.	2026-09-26 17:50:45 +02:00
forust	b625d30568	ci(deploy): cancel superseded deploys on new push ... Queued deploy runs were deploying origin/main at start anyway (preflight reset), so waiting runs duplicated the newest deploy instead of their own commit. Cancel them.	2026-09-26 17:42:36 +02:00
forust	d018a441af	fix(deploy): move netbox from compose to k8s ... compose.yaml is a local-only stand on 127.0.0.1:8000 per README; the live service runs in-cluster. The root active marker made apply-compose fail on gitignored .env vars.	2026-09-26 17:38:20 +02:00
forust	ecb254017d	fix(searxng): use existing image tag 2026.9.25-12f8b6515 ... 2026.09.13-d4ce87c23 was never published (upstream tags month without leading zero); rollout stuck in ImagePullBackOff. Verified replacement tag exists on Docker Hub.	2026-09-26 17:37:20 +02:00
forust	41f18ea993	fix(deploy): move netbird from compose to k8s ... netbird runs in-cluster; the root active marker made apply-compose pick up netbird/compose.yaml and fail on gitignored .env vars. Drop the compose marker and enable k8s/active instead.	2026-09-26 17:24:03 +02:00
forust	91c344fe2c	fix(monitoring): disable control-plane alerts and scrapes on k0s ... k0s runs kube-controller-manager, kube-scheduler and etcd inside its own process rather than as pods, so the chart's Services never get endpoints and the targets stay permanently absent. Drop the matching ServiceMonitors and their Down/HighCommitDurations rules; kube-proxy and kubelet do get endpoints on k0s and stay enabled.	2026-09-26 17:16:55 +02:00
forust	cab6ef2102	Merge branch 'feat/netbird'	2026-09-26 17:05:55 +02:00
forust	a2ff9515a3	fix(deploy): validate compose without workstation secrets ... docker compose config required real values for gitignored .env files and secrets, so validate always failed on stacks with :? guards (netbird, netbox). Validate structure only via --no-interpolate, --no-env-resolution and --no-path-resolution, keeping normalization and consistency checks.	2026-09-26 17:00:43 +02:00
forust	62d39ee4f1	Merge pull request 'chore(deps): update netbirdio/dashboard docker tag to v2.93.0' (#53) from renovate/netbirdio-dashboard-2.x into main ... Reviewed-on: #53	2026-09-25 22:27:21 +00:00
forust	f4df6d4437	Merge pull request 'chore(deps): update container patch updates' (#38) from renovate/container-patch-updates into main ... Reviewed-on: #38	2026-09-25 22:18:21 +00:00
forust	b423119632	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.115.9' (#47) from renovate/renovate-renovate-44.x into main ... Reviewed-on: #47	2026-09-25 22:17:46 +00:00
forust	6ad33d75e6	Merge pull request 'chore(deps): update prom/prometheus docker tag to v3.15.0' (#48) from renovate/prom-prometheus-3.x into main ... Reviewed-on: #48	2026-09-25 22:17:15 +00:00
forust	b7a1835adb	Merge pull request 'feat(netbird): add tailscale-alternative' (#50) from feat/netbird into main ... Reviewed-on: #50	2026-09-25 22:16:51 +00:00
forust	ad4bb8750d	chore(deploy): enable netbird	2026-09-25 22:16:02 +00:00
forust	f1e00b946f	Merge pull request 'Feat/documenting services' (#51) from feat/documenting-services into main ... Reviewed-on: #51	2026-09-25 22:15:45 +00:00
forust	7ee7d0c961	Update README.md	2026-09-26 00:15:01 +02:00
forust	27ab6b859e	chore(deploy): enable netbird	2026-09-26 00:04:50 +02:00
forust	71e769c002	chore(deploy): disable checkmk, enable netbox and rackpeek	2026-09-26 00:04:37 +02:00
forust	16dd67c2c0	feat(rackpeek): add internal-only rack visualization service ... Compose and k8s manifests behind workstation/gigaforust internal hosts.	2026-09-26 00:00:49 +02:00
forust	c536a16a2a	feat(netbox): add enterprise-grade server documenting app w/ shared postgres	2026-09-25 23:24:21 +02:00
forust	a4a4bb4cc5	feat(netbird): add tailscale-alternative	2026-09-25 20:26:11 +02:00
forust	648b354951	refactor(deploy): marker-driven selection (k8s/active, root active); enable headscale/nextcloud hybrid, disable dockmon/kener/downtify/n8n	2026-09-23 18:11:51 +02:00
forust	b0a9b3476d	fix(deploy): drop broken %q quoting that wrapped remote vars in literal quotes	2026-09-23 16:33:51 +02:00
forust	ac3bf4a55a	fix(deploy): strip quotes and CR from DEPLOY_PATH	2026-09-23 16:31:06 +02:00
forust	34fb6f85ba	Merge pull request 'chore(deps): update darthnorse/dockmon docker tag to v2.5.0' (#39) from renovate/darthnorse-dockmon-2.x into main ... Reviewed-on: #39	2026-09-23 14:16:21 +00:00
forust	54f43fc2c7	Merge pull request 'chore(deps): update ghcr.io/lukegus/termix docker tag to v2.8.0' (#40) from renovate/ghcr.io-lukegus-termix-2.x into main ... Reviewed-on: #40	2026-09-23 14:16:06 +00:00
forust	88ae20a543	Merge pull request 'chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v3' (#42) from renovate/ghcr.io-henriquesebastiao-downtify-3.x into main ... Reviewed-on: #42	2026-09-23 14:15:51 +00:00
forust	aeefdd8560	Merge pull request 'chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.41.0' (#43) from renovate/docker.n8n.io-n8nio-n8n-2.x into main ... Reviewed-on: #43	2026-09-23 14:14:39 +00:00
forust	6e5f80611b	Merge pull request 'Cicd/deploy rework' (#44) from cicd/deploy-rework into main ... Reviewed-on: #44	2026-09-23 14:11:42 +00:00
forust	5cf0c90258	style: prettier formatting for edu_master alerts and postgres readme	2026-09-23 16:10:33 +02:00
forust	90a452a253	feat(deploy): auto-rollout on push to main (gated by branch protection)	2026-09-23 15:58:15 +02:00
forust	a9eabfba02	fix(userbot): include internal-certificate in kustomize base	2026-09-23 15:52:32 +02:00
forust	46c7e99b1d	chore(deploy): rework k8s pipeline, monitoring and postgres 17 ... Deploy workflow uses git-tracked manifests, DISABLED flag and kustomize overlays; add webinar-checker metrics with ServiceMonitor and alerts; upgrade shared postgres to 17 with statuspage DB and probes/resources.	2026-09-23 15:47:26 +02:00
forust	8b2cf29771	feat(tls): internal CA wildcard for *.internal routes	2026-09-23 14:47:14 +02:00
forust	7b7fc3bcb0	fix(tls): drop internal certs for dormant namespaces (kener, downtify have no ns live)	2026-09-23 14:46:09 +02:00
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ... Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
forust	f29bb3d580	revert: drop Grafana cert-manager dashboard	2026-09-23 14:42:09 +02:00
forust	1f7166026b	feat(observability): cert-manager metrics, dashboard and alerts	2026-09-23 14:32:36 +02:00
forust	1cbdfc1d6f	feat(observability): cert-manager metrics, dashboard and alerts ... - ServiceMonitor for cert-manager (release: prometheus-stack) - Grafana dashboard Cert-manager-Kubernetes (ID 22908, datasource refs fixed) via dashboard sidecar ConfigMap - PrometheusRule: NotReady (crit), expiry <14d (warn) / <7d (crit), ACME 429 rate-limit (warn)	2026-09-23 14:32:36 +02:00
forust	6be3769288	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... Big-bang: 24 Certificates (HTTP-01, letsencrypt-prod) replace Traefik certResolver on all prod IngressRoutes. Traefik certificatesResolvers removed (its acme-http router hijacked HTTP-01 for every host). AdGuard DoT shares the cert-manager adguard-certs secret; sync CronJob retired. Dormant files converted, n8n untouched (live-only deletion rule).	2026-09-23 14:16:23 +02:00
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
forust	aa81f1bf8a	feat(adguard): Traefik-synced TLS for AdGuard DoT + reloader ... - CronJob mirrors Traefik prod cert dns.forust.xyz into adguard-certs (cert-manager HTTP-01 is hijacked by Traefik acme-http router, see adguardhome/k8s/cert-sync.yaml) - reloader for auto-restart on secret rotation - drop retired adguard.forust.xyz from prod route - traefik: enable kubernetesIngress, drop unused staging resolver	2026-09-23 14:04:14 +02:00
forust	93d768e988	fix(adguard): split deployment RBAC rule for list/watch ... Collection verbs cannot combine with resourceNames (grant would be void). Instance verbs stay name-scoped to adguard-deployment; list/watch is namespace-scoped (single Deployment in ns).	2026-09-23 13:54:06 +02:00
forust	a8f7c79934	fix(adguard): sync job RBAC and idempotency ... - grant list+watch on adguard-deployment (rollout status hung without it, job hit activeDeadline and failed) - compare content digests only (old hash embedded filenames, so every run patched + restarted even when in sync) Keeps explicit rollout restart alongside reloader annotation: one extra restart per rotation (~60d) is accepted for determinism if reloader is down.	2026-09-23 13:52:57 +02:00
forust	c42bf14c9a	fix(adguard): drop retired adguard.forust.xyz from prod route so dns.forust.xyz gets LE cert ... adguard.forust.xyz is NXDOMAIN (host retired); the combo SAN cert kept failing and dns.forust.xyz served TRAEFIK DEFAULT CERT. Scope prod route to dns.forust.xyz only. Also commit live traefik-values state (remove letsencrypt-staging resolver, live since helm rev 33).	2026-09-23 13:42:04 +02:00
forust	1e8479b853	feat(adguard): sync Traefik prod cert for dns.forust.xyz into adguard-certs ... CronJob adguard-cert-sync (daily 03:17) copies the public cert/key for dns.forust.xyz from Traefik acme.json into Secret adguard-certs, which AdGuard mounts for DNS-over-TLS on :853. - least-privilege RBAC: read pods/exec in ns traefik, get/update/patch Secret adguard-certs and get/patch adguard-deployment in ns adguard - script selects the PROD resolver entry only, matches main domain or SANs, compares sha256 hashes, patches the secret and restarts the deployment ONLY on change; exits non-zero and touches nothing when Traefik holds no cert yet (HTTP-01 currently cannot complete)	2026-09-23 13:39:38 +02:00
forust	c139d700f1	feat(adguard,traefik,cert-manager,reloader): foundation for adguard cert sync ... - traefik: enable kubernetesIngress provider (needed for cert-manager HTTP-01) - adguard: add reloader auto annotation for secret-driven restarts - cert-manager: namespace, helm values (crds), staging+prod ClusterIssuers - reloader: namespace manifest	2026-09-23 13:19:26 +02:00
forust	67b9996911	fix(renovate): default endpoint to gitea API URL ... Fall back to https://gitea.forust.xyz/api/v1 when RENOVATE_ENDPOINT is unset, in both local config and in-cluster ConfigMap.	2026-09-23 13:06:19 +02:00
forust	4e9ee567ca	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.106.0' (#41) from renovate/renovate-renovate-44.x into main ... Reviewed-on: #41	2026-09-21 20:03:24 +00:00
forust	9c4580a522	fix(prometheus): exclude xui services from TraefikServiceHighLatency ... Long-lived VPN WebSocket sessions inflate P95 request duration; keep 5xx/down/cert alerts for xui unchanged.	2026-09-19 19:06:42 +02:00
forust	4e3ad00202	feat(xui): add 3x-ui VPN panel behind cloudflared tunnel ... VLESS+WS inbound (port 10000) via Traefik IngressRoute, panel on internal domains only with public route commented out. gitignore now covers nested k8s secrets and local-only grafana values.	2026-09-19 19:06:37 +02:00
forust	86ac43567d	chore(renovate): sync pins to 44.103.0	2026-09-18 22:21:48 +02:00
forust	35bf980bda	Merge branch 'main' of https://gitea.forust.xyz/forust/homelab	2026-09-18 22:19:57 +02:00
forust	51677ae184	ci: run all lint jobs natively without docker	2026-09-18 22:18:59 +02:00
forust	c9e6fc0e2b	ci: run ruff and yamllint natively, cache npm ... Ruff and yamllint ship in Arch repos, drop their container pulls. Prettier keeps the node container but mounts persistent npm cache. Hadolint and kubeconform stay containerized (AUR-only / hermetic pin).	2026-09-18 19:41:02 +02:00
forust	ab386fc436	ci: keep gitea workflows only, harden and speed up pipelines ... Drop duplicated .github/workflows (helm blocks ported to .gitea deploy first). Add ci concurrency with cancel on branches, pin checkout to SHA and prettier to 3.9.8, registry layer cache for image builds. renovate-run gains config validation and dry-run input.	2026-09-18 19:38:56 +02:00
forust	7e17ae638a	Merge pull request 'chore(deps): update container patch updates' (#35) from renovate/container-patch-updates into main ... Reviewed-on: #35	2026-09-18 17:20:48 +00:00
forust	69e7df6a63	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.103.0' (#36) from renovate/renovate-renovate-44.x into main ... Reviewed-on: #36	2026-09-18 17:20:39 +00:00
forust	dfd9cc6fbf	Merge pull request 'chore(deps): update cloudflare/cloudflared docker tag to v2026.9.1' (#37) from renovate/cloudflare-cloudflared-2026.x into main ... Reviewed-on: #37	2026-09-18 17:20:31 +00:00
forust	7f0bd5f609	feat(renovate): add manual run pipeline and sync configs ... renovate-run workflow_dispatch runs pinned renovate via docker on self-hosted runner. Sync helm-values manager into config.js/configmap, bump compose and validator pins to 44.97.2.	2026-09-18 19:15:11 +02:00
forust	043923fc64	style(crowdsec): fix prettier formatting in grafana dashboards	2026-09-18 19:07:46 +02:00
forust	f0f8a35b0f	Merge branch 'main' of https://gitea.forust.xyz/forust/homelab ... # Conflicts: # postgres/k8s/postgres.yaml	2026-09-18 19:05:56 +02:00
forust	f5f389b440	chore(ci): deploy loki alloy and track helm values in renovate ... Deploy hook installs loki 7.3.0 and alloy 1.12.1 when loki/k8s/active exists. Renovate watches k8s values files.	2026-09-18 19:02:46 +02:00
forust	7cca330438	feat(crowdsec): switch agent to loki acquisition with static identity ... Read traefik logs from Loki instead of file tail. Static machine identity via pre-created secret stops 403 register races. Add janitor cronjob, dashboards, whitelists and metrics.	2026-09-18 19:02:43 +02:00
forust	5936de3e56	fix(alertmanager): quote null receiver and wire telegram template ... Unquoted null parses as YAML null and breaks routing. Add shared telegram message template.	2026-09-18 19:02:41 +02:00
forust	c98ea8b957	feat(monitoring): align storage to live pvc, add loki datasource and alerts ... Match grafana/alertmanager storageClass to live PVCs to avoid immutable-field failures. Add Loki datasource and LokiDown/AlloyDown alerts.	2026-09-18 19:02:38 +02:00
forust	34c33697bb	feat(loki): add single-binary loki and alloy stack ... Filesystem storage on local-path-retain, 14d retention. Alloy daemonset ships k8s pod logs to loki-gateway.	2026-09-18 19:02:36 +02:00
forust	92bd920113	Merge pull request 'chore(deps): update postgres docker tag to v17.11' (#34) from renovate/postgres-17.x into main ... Reviewed-on: #34	2026-09-17 18:04:58 +00:00
forust	60b9766449	Merge pull request 'chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v2.13.0' (#32) from renovate/ghcr.io-henriquesebastiao-downtify-2.x into main ... Reviewed-on: #32	2026-09-17 17:58:27 +00:00
forust	ce21c60eba	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.97.2' (#33) from renovate/renovate-renovate-44.x into main ... Reviewed-on: #33	2026-09-17 17:58:15 +00:00
forust	4953da2dd7	Merge pull request 'Feat/centralized postgres' (#26) from feat/centralized-postgres into main ... Reviewed-on: #26	2026-09-17 17:55:58 +00:00
forust	4ac65f743c	lint(postgres): 126:77 error no new line character at the end of file (new-line-at-end-of-file)	2026-09-17 17:55:50 +00:00
forust	8f2e9d66c8	chore(gite): updated deprecated access log config	2026-09-17 17:55:50 +00:00
forust	c7d42fb90a	feat(postgres): migrate gitea to shared postgres database	2026-09-17 17:55:50 +00:00
forust	003b1e5dca	feat(postgres): upgrade shared database to PostgreSQL 17 ... Move the shared postgres service from 15.19 to 17.6 as the postgres17 StatefulSet with its own PVC, extend the initdb and ingress policy with the statuspage database, and drop the now-unused per-app postgres manifests for authentik, gitea and netronome.	2026-09-17 17:55:50 +00:00
forustandCopilot	b3463705c3	feat(postgres): migrate apps to shared database ... Move Authentik and Netronome to the shared PostgreSQL service after logical dump and restore. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-17 17:55:50 +00:00
forust	52e1f50a80	feat(postgres): add shared database deployments	2026-09-17 17:55:50 +00:00
forust	cdc2f10fe8	Merge pull request 'chore(deps): update container patch updates' (#30) from renovate/container-patch-updates into main ... Reviewed-on: #30	2026-09-17 17:55:32 +00:00
forust	ac795feeed	Merge pull request 'chore(deps): update ghcr.io/alexta69/metube docker tag to v2026.09.15' (#31) from renovate/ghcr.io-alexta69-metube-2026.x into main ... Reviewed-on: #31	2026-09-17 17:55:11 +00:00
forust	82949613db	fix(cloudflared): drop bogus exec livenessProbe that SIGTERMed the tunnel	2026-09-17 19:34:28 +02:00
forust	47d788ca13	feat(cloudflared): add Cloudflare Tunnel deployment (token-based, cfddns-style)	2026-09-17 19:09:02 +02:00
forust	77be606912	Merge pull request 'chore(deps): update grafana/grafana docker tag to v13.2.2' (#28) from renovate/container-patch-updates into main ... Reviewed-on: #28	2026-09-15 12:07:56 +00:00
forust	6c24d4fb17	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.91.0' (#27) from renovate/renovate-renovate-44.x into main ... Reviewed-on: #27	2026-09-15 12:07:44 +00:00
forust	e07537ff8b	Merge pull request 'chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.40.0' (#29) from renovate/docker.n8n.io-n8nio-n8n-2.x into main ... Reviewed-on: #29	2026-09-15 12:07:27 +00:00
forust	1e66b5f344	lint(postgres): 126:77 error no new line character at the end of file (new-line-at-end-of-file)	2026-09-14 11:56:23 +00:00
forust	d638a2c1f9	chore(gite): updated deprecated access log config	2026-09-14 11:56:23 +00:00
forust	b8512c6033	feat(postgres): migrate gitea to shared postgres database	2026-09-14 11:56:23 +00:00
forust	3e057ea18d	feat(postgres): upgrade shared database to PostgreSQL 17 ... Move the shared postgres service from 15.19 to 17.6 as the postgres17 StatefulSet with its own PVC, extend the initdb and ingress policy with the statuspage database, and drop the now-unused per-app postgres manifests for authentik, gitea and netronome.	2026-09-14 11:56:23 +00:00
forustandCopilot	77113fb629	feat(postgres): migrate apps to shared database ... Move Authentik and Netronome to the shared PostgreSQL service after logical dump and restore. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 11:56:23 +00:00
forust	a3a0ab92b7	feat(postgres): add shared database deployments	2026-09-14 11:56:23 +00:00
forust	68fb5eb45e	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.85.0' (#25) from renovate/renovate-renovate-44.x into main ... Reviewed-on: #25	2026-09-14 09:48:39 +00:00
forust	82124017c0	Merge pull request 'chore(deps): update redis docker tag to v8.10.1' (#23) from renovate/redis-8.x into main ... Reviewed-on: #23	2026-09-14 09:46:49 +00:00
forust	a4f8218b5e	Merge pull request 'chore(deps): update valkey/valkey docker tag to v9' (#24) from renovate/valkey-valkey-9.x into main ... Reviewed-on: #24	2026-09-14 09:46:24 +00:00