17 Commits

Include renames

Author	SHA1	Message	Date
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
renovate-bot	872d9695c3	chore(deps): update container patch updates	2026-09-18 17:20:48 +00:00
forust	3e057ea18d	feat(postgres): upgrade shared database to PostgreSQL 17 ... Move the shared postgres service from 15.19 to 17.6 as the postgres17 StatefulSet with its own PVC, extend the initdb and ingress policy with the statuspage database, and drop the now-unused per-app postgres manifests for authentik, gitea and netronome.	2026-09-14 11:56:23 +00:00
forustandCopilot	77113fb629	feat(postgres): migrate apps to shared database ... Move Authentik and Netronome to the shared PostgreSQL service after logical dump and restore. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 11:56:23 +00:00
renovate-bot	c28d7323b3	chore(deps): update ghcr.io/goauthentik/server docker tag to v2026	2026-09-14 09:06:56 +00:00
renovate-bot	8b28bd24ff	chore(deps): update ghcr.io/goauthentik/server docker tag to v2025.12.6	2026-09-14 09:03:24 +00:00
forustandCopilot	23ed72826a	chore(images): pin service image updates ... Replace floating service images with reviewable tags or digests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:16:01 +02:00
forustandCopilot	ed1ddaad5d	feat(crowdsec): restore web traffic protection ... Protect public Traefik routes with CrowdSec HTTP decisions and restore access logging for web traffic analysis. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-12 21:05:12 +02:00
forust	861d89d36a	ci(deploy): split runtime by k8s/active marker ... services marked k8s/active are applied via kubectl; the rest via docker compose. inactive services with k8s/ keep only routing manifests (external Services, EndpointSlices, Ingresses) to reach docker backends. headscale/nextcloud routing moved to k8s/routing/. validations: compose config --quiet + kubectl apply --dry-run=client. namespace manifests applied first. pull_policy:build stacks get build+push before up so the registry image stays fresh.	2026-09-06 20:39:12 +02:00
forust	587611ca88	chore: remove empty middlewares blocks from k8s ingresses	2026-09-02 12:17:04 +02:00
forust	92aa731e44	deleted crowdsec stack from the repo. will figure something else ... Signed-off-by: mr-forust <vzlomdsisma@gmail.com>	2026-07-19 23:16:14 +02:00
forust	a128523c24	Fix CrowdSec middleware references in Traefik ingresses	2026-06-29 22:47:21 +02:00
forust	0803f3efff	chore(k8s): returned to Host || Host standart instead of regexp. ... Yaml lint (yamllint)	2026-06-18 21:02:40 +02:00
forust	b9b8474455	feat(k8s): protect all prod routers with crowdsec middleware	2026-06-17 01:50:33 +02:00
forust	4ca3ccdad3	chore(k8s): router rewrite ... - returned to Host matcher instead of Hostregexp - switched dockercompose labels to letsencrypt - renamed DoH route	2026-06-16 12:34:15 +02:00
forust	68c5eac164	chore: compact ingress rules with regex	2026-06-11 14:20:03 +02:00
forust	4c356924e7	feat(k8s): authentik server+worker deployments and postgres statefulset	2026-06-11 03:35:28 +02:00