552 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
forust	8b2cf29771	feat(tls): internal CA wildcard for *.internal routes	2026-09-23 14:47:14 +02:00
forust	7b7fc3bcb0	fix(tls): drop internal certs for dormant namespaces (kener, downtify have no ns live)	2026-09-23 14:46:09 +02:00
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ... Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
forust	f29bb3d580	revert: drop Grafana cert-manager dashboard	2026-09-23 14:42:09 +02:00
forust	1f7166026b	feat(observability): cert-manager metrics, dashboard and alerts	2026-09-23 14:32:36 +02:00
forust	1cbdfc1d6f	feat(observability): cert-manager metrics, dashboard and alerts ... - ServiceMonitor for cert-manager (release: prometheus-stack) - Grafana dashboard Cert-manager-Kubernetes (ID 22908, datasource refs fixed) via dashboard sidecar ConfigMap - PrometheusRule: NotReady (crit), expiry <14d (warn) / <7d (crit), ACME 429 rate-limit (warn)	2026-09-23 14:32:36 +02:00
forust	6be3769288	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... Big-bang: 24 Certificates (HTTP-01, letsencrypt-prod) replace Traefik certResolver on all prod IngressRoutes. Traefik certificatesResolvers removed (its acme-http router hijacked HTTP-01 for every host). AdGuard DoT shares the cert-manager adguard-certs secret; sync CronJob retired. Dormant files converted, n8n untouched (live-only deletion rule).	2026-09-23 14:16:23 +02:00
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
forust	aa81f1bf8a	feat(adguard): Traefik-synced TLS for AdGuard DoT + reloader ... - CronJob mirrors Traefik prod cert dns.forust.xyz into adguard-certs (cert-manager HTTP-01 is hijacked by Traefik acme-http router, see adguardhome/k8s/cert-sync.yaml) - reloader for auto-restart on secret rotation - drop retired adguard.forust.xyz from prod route - traefik: enable kubernetesIngress, drop unused staging resolver	2026-09-23 14:04:14 +02:00
forust	93d768e988	fix(adguard): split deployment RBAC rule for list/watch ... Collection verbs cannot combine with resourceNames (grant would be void). Instance verbs stay name-scoped to adguard-deployment; list/watch is namespace-scoped (single Deployment in ns).	2026-09-23 13:54:06 +02:00
forust	a8f7c79934	fix(adguard): sync job RBAC and idempotency ... - grant list+watch on adguard-deployment (rollout status hung without it, job hit activeDeadline and failed) - compare content digests only (old hash embedded filenames, so every run patched + restarted even when in sync) Keeps explicit rollout restart alongside reloader annotation: one extra restart per rotation (~60d) is accepted for determinism if reloader is down.	2026-09-23 13:52:57 +02:00
forust	c42bf14c9a	fix(adguard): drop retired adguard.forust.xyz from prod route so dns.forust.xyz gets LE cert ... adguard.forust.xyz is NXDOMAIN (host retired); the combo SAN cert kept failing and dns.forust.xyz served TRAEFIK DEFAULT CERT. Scope prod route to dns.forust.xyz only. Also commit live traefik-values state (remove letsencrypt-staging resolver, live since helm rev 33).	2026-09-23 13:42:04 +02:00
forust	1e8479b853	feat(adguard): sync Traefik prod cert for dns.forust.xyz into adguard-certs ... CronJob adguard-cert-sync (daily 03:17) copies the public cert/key for dns.forust.xyz from Traefik acme.json into Secret adguard-certs, which AdGuard mounts for DNS-over-TLS on :853. - least-privilege RBAC: read pods/exec in ns traefik, get/update/patch Secret adguard-certs and get/patch adguard-deployment in ns adguard - script selects the PROD resolver entry only, matches main domain or SANs, compares sha256 hashes, patches the secret and restarts the deployment ONLY on change; exits non-zero and touches nothing when Traefik holds no cert yet (HTTP-01 currently cannot complete)	2026-09-23 13:39:38 +02:00
forust	c139d700f1	feat(adguard,traefik,cert-manager,reloader): foundation for adguard cert sync ... - traefik: enable kubernetesIngress provider (needed for cert-manager HTTP-01) - adguard: add reloader auto annotation for secret-driven restarts - cert-manager: namespace, helm values (crds), staging+prod ClusterIssuers - reloader: namespace manifest	2026-09-23 13:19:26 +02:00
forust	67b9996911	fix(renovate): default endpoint to gitea API URL ... Fall back to https://gitea.forust.xyz/api/v1 when RENOVATE_ENDPOINT is unset, in both local config and in-cluster ConfigMap.	2026-09-23 13:06:19 +02:00
forust	4e9ee567ca	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.106.0' (#41) from renovate/renovate-renovate-44.x into main ... Reviewed-on: #41	2026-09-21 20:03:24 +00:00
renovate-bot	4863e13596	chore(deps): update renovate/renovate docker tag to v44.106.0	2026-09-21 16:18:03 +00:00
forust	9c4580a522	fix(prometheus): exclude xui services from TraefikServiceHighLatency ... Long-lived VPN WebSocket sessions inflate P95 request duration; keep 5xx/down/cert alerts for xui unchanged.	2026-09-19 19:06:42 +02:00
forust	4e3ad00202	feat(xui): add 3x-ui VPN panel behind cloudflared tunnel ... VLESS+WS inbound (port 10000) via Traefik IngressRoute, panel on internal domains only with public route commented out. gitignore now covers nested k8s secrets and local-only grafana values.	2026-09-19 19:06:37 +02:00
forust	86ac43567d	chore(renovate): sync pins to 44.103.0	2026-09-18 22:21:48 +02:00
forust	35bf980bda	Merge branch 'main' of https://gitea.forust.xyz/forust/homelab	2026-09-18 22:19:57 +02:00
forust	51677ae184	ci: run all lint jobs natively without docker	2026-09-18 22:18:59 +02:00
forust	c9e6fc0e2b	ci: run ruff and yamllint natively, cache npm ... Ruff and yamllint ship in Arch repos, drop their container pulls. Prettier keeps the node container but mounts persistent npm cache. Hadolint and kubeconform stay containerized (AUR-only / hermetic pin).	2026-09-18 19:41:02 +02:00
forust	ab386fc436	ci: keep gitea workflows only, harden and speed up pipelines ... Drop duplicated .github/workflows (helm blocks ported to .gitea deploy first). Add ci concurrency with cancel on branches, pin checkout to SHA and prettier to 3.9.8, registry layer cache for image builds. renovate-run gains config validation and dry-run input.	2026-09-18 19:38:56 +02:00
forust	7e17ae638a	Merge pull request 'chore(deps): update container patch updates' (#35) from renovate/container-patch-updates into main ... Reviewed-on: #35	2026-09-18 17:20:48 +00:00
renovate-bot	872d9695c3	chore(deps): update container patch updates	2026-09-18 17:20:48 +00:00
forust	69e7df6a63	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.103.0' (#36) from renovate/renovate-renovate-44.x into main ... Reviewed-on: #36	2026-09-18 17:20:39 +00:00
renovate-bot	98aceef192	chore(deps): update renovate/renovate docker tag to v44.103.0	2026-09-18 17:20:39 +00:00
forust	dfd9cc6fbf	Merge pull request 'chore(deps): update cloudflare/cloudflared docker tag to v2026.9.1' (#37) from renovate/cloudflare-cloudflared-2026.x into main ... Reviewed-on: #37	2026-09-18 17:20:31 +00:00
renovate-bot	40e7499e7c	chore(deps): update cloudflare/cloudflared docker tag to v2026.9.1	2026-09-18 17:19:16 +00:00
forust	7f0bd5f609	feat(renovate): add manual run pipeline and sync configs ... renovate-run workflow_dispatch runs pinned renovate via docker on self-hosted runner. Sync helm-values manager into config.js/configmap, bump compose and validator pins to 44.97.2.	2026-09-18 19:15:11 +02:00
forust	043923fc64	style(crowdsec): fix prettier formatting in grafana dashboards	2026-09-18 19:07:46 +02:00
forust	f0f8a35b0f	Merge branch 'main' of https://gitea.forust.xyz/forust/homelab ... # Conflicts: # postgres/k8s/postgres.yaml	2026-09-18 19:05:56 +02:00
forust	f5f389b440	chore(ci): deploy loki alloy and track helm values in renovate ... Deploy hook installs loki 7.3.0 and alloy 1.12.1 when loki/k8s/active exists. Renovate watches k8s values files.	2026-09-18 19:02:46 +02:00
forust	7cca330438	feat(crowdsec): switch agent to loki acquisition with static identity ... Read traefik logs from Loki instead of file tail. Static machine identity via pre-created secret stops 403 register races. Add janitor cronjob, dashboards, whitelists and metrics.	2026-09-18 19:02:43 +02:00
forust	5936de3e56	fix(alertmanager): quote null receiver and wire telegram template ... Unquoted null parses as YAML null and breaks routing. Add shared telegram message template.	2026-09-18 19:02:41 +02:00
forust	c98ea8b957	feat(monitoring): align storage to live pvc, add loki datasource and alerts ... Match grafana/alertmanager storageClass to live PVCs to avoid immutable-field failures. Add Loki datasource and LokiDown/AlloyDown alerts.	2026-09-18 19:02:38 +02:00
forust	34c33697bb	feat(loki): add single-binary loki and alloy stack ... Filesystem storage on local-path-retain, 14d retention. Alloy daemonset ships k8s pod logs to loki-gateway.	2026-09-18 19:02:36 +02:00
forust	92bd920113	Merge pull request 'chore(deps): update postgres docker tag to v17.11' (#34) from renovate/postgres-17.x into main ... Reviewed-on: #34	2026-09-17 18:04:58 +00:00
renovate-bot	8007f82d52	chore(deps): update postgres docker tag to v17.11	2026-09-17 17:59:25 +00:00
forust	60b9766449	Merge pull request 'chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v2.13.0' (#32) from renovate/ghcr.io-henriquesebastiao-downtify-2.x into main ... Reviewed-on: #32	2026-09-17 17:58:27 +00:00
renovate-bot	0ebb7264bc	chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v2.13.0	2026-09-17 17:58:27 +00:00
forust	ce21c60eba	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.97.2' (#33) from renovate/renovate-renovate-44.x into main ... Reviewed-on: #33	2026-09-17 17:58:15 +00:00
renovate-bot	53638f831d	chore(deps): update renovate/renovate docker tag to v44.97.2	2026-09-17 17:57:23 +00:00
forust	4953da2dd7	Merge pull request 'Feat/centralized postgres' (#26) from feat/centralized-postgres into main ... Reviewed-on: #26	2026-09-17 17:55:58 +00:00
forust	4ac65f743c	lint(postgres): 126:77 error no new line character at the end of file (new-line-at-end-of-file)	2026-09-17 17:55:50 +00:00
forust	8f2e9d66c8	chore(gite): updated deprecated access log config	2026-09-17 17:55:50 +00:00
forust	c7d42fb90a	feat(postgres): migrate gitea to shared postgres database	2026-09-17 17:55:50 +00:00
forust	003b1e5dca	feat(postgres): upgrade shared database to PostgreSQL 17 ... Move the shared postgres service from 15.19 to 17.6 as the postgres17 StatefulSet with its own PVC, extend the initdb and ingress policy with the statuspage database, and drop the now-unused per-app postgres manifests for authentik, gitea and netronome.	2026-09-17 17:55:50 +00:00
forustandCopilot	b3463705c3	feat(postgres): migrate apps to shared database ... Move Authentik and Netronome to the shared PostgreSQL service after logical dump and restore. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-17 17:55:50 +00:00