homelab

3 Commits

Include renames

Author	SHA1	Message	Date
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ci / lint-prettier (push) Successful in 2s Details ci / lint-ruff (push) Successful in 0s Details ci / lint-yaml (push) Successful in 2s Details ci / lint-dockerfiles (push) Successful in 1s Details ci / validate (push) Successful in 1s Details ci / build (push) Skipped Details ci / deploy-userbot-panel (push) Skipped Details Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ci / lint-ruff (push) Successful in 1s Details ci / lint-prettier (push) Successful in 3s Details ci / lint-yaml (push) Successful in 2s Details ci / lint-dockerfiles (push) Successful in 1s Details ci / validate (push) Successful in 2s Details ci / build (push) Skipped Details ci / deploy-userbot-panel (push) Skipped Details All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
forust	4e3ad00202	feat(xui): add 3x-ui VPN panel behind cloudflared tunnel VLESS+WS inbound (port 10000) via Traefik IngressRoute, panel on internal domains only with public route commented out. gitignore now covers nested k8s secrets and local-only grafana values.	2026-09-19 19:06:37 +02:00