35 Commits

Include renames

Author	SHA1	Message	Date
renovate-bot	506c04e15c	chore(deps): update all minor updates	2026-10-06 15:33:28 +00:00
forust	ff83daed1e	feat(reloader): enable deployment and reload runtime-config consumers	2026-10-06 14:54:45 +00:00
renovate-bot	1add5b5cd7	chore(deps): update all patch updates	2026-10-05 21:41:00 +00:00
renovate-bot	3320018232	chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.42.2	2026-10-03 09:17:01 +00:00
forust	0859479c0f	feat(ingress): replace traefik crowdsec plugin with firewall bouncer ... Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.	2026-09-30 20:14:25 +02:00
forust	a6af69dca0	fix(k8s): Recreate singletons and trim requests for scheduler headroom ... RollingUpdate with default maxSurge needs a spare pod the single node does not have (99% CPU requested), so multi-workload restarts end Pending and verify times out. Recreate on all replicas:1 Deployments (immich-server and bentopdf keep RollingUpdate at replicas 2). Also trims CPU/memory requests toward measured use (adguard, authentik, gitea, netbox, uptime-kuma, netbird-server) and gives traefik requests/limits so it is no longer BestEffort.	2026-09-28 22:36:46 +02:00
renovate-bot	987a89f022	chore(deps): update container patch updates	2026-09-25 22:18:07 +00:00
forust	648b354951	refactor(deploy): marker-driven selection (k8s/active, root active); enable headscale/nextcloud hybrid, disable dockmon/kener/downtify/n8n	2026-09-23 18:11:51 +02:00
renovate-bot	c10d344fd7	chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.41.0	2026-09-23 14:14:39 +00:00
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ... Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
renovate-bot	872d9695c3	chore(deps): update container patch updates	2026-09-18 17:20:48 +00:00
renovate-bot	89fbdef10e	chore(deps): update container patch updates	2026-09-17 17:55:32 +00:00
renovate-bot	303eaaa71b	chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.40.0	2026-09-15 10:18:03 +00:00
renovate-bot	50911b4ec1	chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.39.5	2026-09-14 09:04:30 +00:00
forustandCopilot	23ed72826a	chore(images): pin service image updates ... Replace floating service images with reviewable tags or digests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:16:01 +02:00
forustandCopilot	ed1ddaad5d	feat(crowdsec): restore web traffic protection ... Protect public Traefik routes with CrowdSec HTTP decisions and restore access logging for web traffic analysis. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-12 21:05:12 +02:00
forust	861d89d36a	ci(deploy): split runtime by k8s/active marker ... services marked k8s/active are applied via kubectl; the rest via docker compose. inactive services with k8s/ keep only routing manifests (external Services, EndpointSlices, Ingresses) to reach docker backends. headscale/nextcloud routing moved to k8s/routing/. validations: compose config --quiet + kubectl apply --dry-run=client. namespace manifests applied first. pull_policy:build stacks get build+push before up so the registry image stays fresh.	2026-09-06 20:39:12 +02:00
forust	587611ca88	chore: remove empty middlewares blocks from k8s ingresses	2026-09-02 12:17:04 +02:00
forust	92aa731e44	deleted crowdsec stack from the repo. will figure something else ... Signed-off-by: mr-forust <vzlomdsisma@gmail.com>	2026-07-19 23:16:14 +02:00
forust	a128523c24	Fix CrowdSec middleware references in Traefik ingresses	2026-06-29 22:47:21 +02:00
forust	1762962f32	chore(k8s): fix indentation in ingress manifests (3-space -> 2-space)	2026-06-19 12:03:02 +02:00
forust	d53b14b1de	chore: apply yaml lint fixes across compose files ... - Fix trailing whitespace in compose files - Add missing final newlines (EOF) - Fix indentation in dockmon (3-space -> 2-space) and glance monitor.yml - Align comments consistently	2026-06-19 11:57:14 +02:00
forust	0803f3efff	chore(k8s): returned to Host || Host standart instead of regexp. ... Yaml lint (yamllint)	2026-06-18 21:02:40 +02:00
forust	b9b8474455	feat(k8s): protect all prod routers with crowdsec middleware	2026-06-17 01:50:33 +02:00
forust	4ca3ccdad3	chore(k8s): router rewrite ... - returned to Host matcher instead of Hostregexp - switched dockercompose labels to letsencrypt - renamed DoH route	2026-06-16 12:34:15 +02:00
forust	68c5eac164	chore: compact ingress rules with regex	2026-06-11 14:20:03 +02:00
forust	12d59cb6f9	feat(k8s): n8n	2026-06-10 23:32:59 +02:00
forust	42826a037c	refactor: store n8n data in named volumes	2026-02-04 22:26:43 +01:00
forust	d7a68237e5	chore: remove redundant or unnececary traefik labels ... - traefik.docker.network= (defined by traefik cli) - traefik.http.routers.<routername>.middlewares=security-headers@file" (applied globally by traefik cli)	2026-02-04 22:26:27 +01:00
forust	fb2f420520	refactor: update network refs form "traefik-proxy" to "proxy" ... - To allow testing dev vers of other services	2025-12-30 14:14:24 +01:00
forust	a767107277	fix: refering to file-defined middlewares	2025-12-05 14:36:57 +01:00
forust	e68e37c285	refactor: use internal tld according to ICAAN	2025-12-05 04:30:51 +01:00
forust	fc6a11397b	refactor: move traefik configuration to docker-compose files via labels	2025-12-05 04:03:24 +01:00
forust	ca8e29bb4f	fixed traefix proxy network for n8n	2025-11-15 13:59:43 +01:00
forust	fd3d2affe7	full refactor ... edu_master glance n8n nextcloud portainer traefik gitignore comments	2025-11-15 13:30:51 +01:00