forust
71e769c002
chore(deploy): disable checkmk, enable netbox and rackpeek
deploy / validate (push) Skipped
renovate-ci / validate-renovate (push) Skipped
ci / lint-prettier (push) Failing after 3s
ci / lint-ruff (push) Successful in 1s
ci / lint-yaml (push) Successful in 2s
ci / lint-dockerfiles (push) Successful in 1s
ci / validate (push) Successful in 2s
ci / build (push) Skipped
ci / lint-prettier (pull_request) Failing after 3s
ci / lint-ruff (pull_request) Successful in 1s
ci / lint-yaml (pull_request) Successful in 3s
ci / lint-dockerfiles (pull_request) Successful in 1s
ci / validate (pull_request) Successful in 1s
ci / build (pull_request) Skipped
renovate-ci / validate-renovate (pull_request) Successful in 21s
2026-09-26 00:04:37 +02:00
forust
bc1e69ebe0
feat(tls): internal CA wildcard for *.internal routes
...
ci / lint-prettier (push) Successful in 2s
ci / lint-ruff (push) Successful in 0s
ci / lint-yaml (push) Successful in 2s
ci / lint-dockerfiles (push) Successful in 1s
ci / validate (push) Successful in 1s
ci / build (push) Skipped
ci / deploy-userbot-panel (push) Skipped
Selfsigned root (10y) + internal-ca issuer; per-namespace
internal-wildcard-tls certs referenced by all -local routers.
Root public cert committed for client trust stores.
2026-09-23 14:45:05 +02:00
forust
ef325cd3b1
feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager
...
ci / lint-ruff (push) Successful in 1s
ci / lint-prettier (push) Successful in 3s
ci / lint-yaml (push) Successful in 2s
ci / lint-dockerfiles (push) Successful in 1s
ci / validate (push) Successful in 2s
ci / build (push) Skipped
ci / deploy-userbot-panel (push) Skipped
All prod IngressRoutes switch tls.certResolver to tls.secretName
backed by per-router Certificates (HTTP-01, letsencrypt-prod).
adguard-prod reuses the shared adguard-certs secret (also feeds
DoT :853); sync CronJob removed as redundant.
Traefik certificatesResolvers removed: its internal
acme-http@internal router hijacks HTTP-01 for every host while
enabled, blocking external solvers. Dormant files (kener,
downtify) converted for consistency but not applied; n8n
untouched per live-only rule.
2026-09-23 14:12:36 +02:00
forust and Copilot
23ed72826a
chore(images): pin service image updates
...
Replace floating service images with reviewable tags or digests.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-09-14 09:16:01 +02:00
forust and Copilot
ed1ddaad5d
feat(crowdsec): restore web traffic protection
...
Protect public Traefik routes with CrowdSec HTTP decisions and restore access logging for web traffic analysis.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-09-12 21:05:12 +02:00
forust
13309b26e0
fix: add checkmk agent entrypoint
...
ci / lint-dockerfiles (push) Successful in 5s
ci / validate (push) Successful in 5s
ci / deploy-userbot-panel (push) Has been skipped
ci / lint-prettier (push) Successful in 10s
ci / lint-ruff (push) Successful in 5s
ci / lint-yaml (push) Successful in 7s
ci / build (push) Successful in 2s
update traefik to v3.7.13
2026-09-10 14:52:49 +02:00
forust
861d89d36a
ci(deploy): split runtime by k8s/active marker
...
services marked k8s/active are applied via kubectl; the rest via docker
compose. inactive services with k8s/ keep only routing manifests
(external Services, EndpointSlices, Ingresses) to reach docker backends.
headscale/nextcloud routing moved to k8s/routing/.
validations: compose config --quiet + kubectl apply --dry-run=client.
namespace manifests applied first. pull_policy:build stacks get
build+push before up so the registry image stays fresh.
2026-09-06 20:39:12 +02:00
forust
587611ca88
chore: remove empty middlewares blocks from k8s ingresses
2026-09-02 12:17:04 +02:00
forust
92aa731e44
deleted crowdsec stack from the repo. will figure something else
...
ci / lint-prettier (push) Successful in 18s
ci / lint-ruff (push) Successful in 6s
ci / lint-yaml (push) Successful in 6s
ci / lint-dockerfiles (push) Successful in 5s
ci / validate (push) Successful in 6s
ci / build (push) Successful in 43s
Signed-off-by: mr-forust <vzlomdsisma@gmail.com >
2026-07-19 23:16:14 +02:00
forust
a128523c24
Fix CrowdSec middleware references in Traefik ingresses
2026-06-29 22:47:21 +02:00
forust
1762962f32
chore(k8s): fix indentation in ingress manifests (3-space -> 2-space)
2026-06-19 12:03:02 +02:00
forust
0803f3efff
chore(k8s): returned to Host || Host standart instead of regexp.
...
Deploy to Server / deploy (push) Has been cancelled
Yaml lint (yamllint)
2026-06-18 21:02:40 +02:00
forust
b9b8474455
feat(k8s): protect all prod routers with crowdsec middleware
2026-06-17 01:50:33 +02:00
forust
4ca3ccdad3
chore(k8s): router rewrite
...
- returned to Host matcher instead of Hostregexp
- switched dockercompose labels to letsencrypt
- renamed DoH route
2026-06-16 12:34:15 +02:00
forust
68c5eac164
chore: compact ingress rules with regex
2026-06-11 14:20:03 +02:00
forust
18d1e21690
fix(k8s): traefik log spam for non-existing local-tls secret, because of namespace isolation
2026-06-10 21:14:10 +02:00
forust
1ea669220b
chore(k8): adjusted system resources requests and limits based on manual monitoring
2026-06-10 19:37:16 +02:00
forust
7a3708f70c
lint: yaml spaces and tabs
2026-06-09 12:59:36 +02:00
forust
d85b3f02f5
k8s: fixes and formating
...
- Add checkmk secrets example
- space-tab fixes (linter)
- switcher kener redis to statefulset
- disabled netronome voulme mount (not needed). postgres statefulset instead
- switched naio to 8888 port (traefik port conflict)
- changed nextcloud ips and ports to prod
2026-06-08 17:39:32 +02:00
forust
e19660fdf4
feat(k8s): standardize IngressRoutes — LE prod certs, prod→local→dev order, Traefik values fix
2026-06-08 12:27:55 +02:00
forust
36922a177c
feat(k8s): add K8s manifests for all homelab services
...
traefik, gitea, adguard, nextcloud, errorpages, homepages,
uptime-kuma, kener, checkmk, headscale, dockmon, metube,
downtify, portainer, netronome, userbot
Includes Helm values, deployments, services, ingress routes,
configmaps, secrets (placeholders), postgres statefulsets,
kustomize overlays, and Traefik dynamic configuration.
2026-06-08 10:54:03 +02:00
forust
