14 Commits

Include renames

Author	SHA1	Message	Date
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
forust	9c4580a522	fix(prometheus): exclude xui services from TraefikServiceHighLatency ... Long-lived VPN WebSocket sessions inflate P95 request duration; keep 5xx/down/cert alerts for xui unchanged.	2026-09-19 19:06:42 +02:00
forust	5936de3e56	fix(alertmanager): quote null receiver and wire telegram template ... Unquoted null parses as YAML null and breaks routing. Add shared telegram message template.	2026-09-18 19:02:41 +02:00
forust	c98ea8b957	feat(monitoring): align storage to live pvc, add loki datasource and alerts ... Match grafana/alertmanager storageClass to live PVCs to avoid immutable-field failures. Add Loki datasource and LokiDown/AlloyDown alerts.	2026-09-18 19:02:38 +02:00
forustandCopilot	24d3686f60	ci: fix formatting and YAML lint scope ... Lint tracked YAML files without scanning generated dependencies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:30:55 +02:00
forust	360a6fc5dc	feat(prometheus): add alerting rules and alertmanager config	2026-09-14 01:21:27 +02:00
forustandCopilot	ed1ddaad5d	feat(crowdsec): restore web traffic protection ... Protect public Traefik routes with CrowdSec HTTP decisions and restore access logging for web traffic analysis. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-12 21:05:12 +02:00
forust	861d89d36a	ci(deploy): split runtime by k8s/active marker ... services marked k8s/active are applied via kubectl; the rest via docker compose. inactive services with k8s/ keep only routing manifests (external Services, EndpointSlices, Ingresses) to reach docker backends. headscale/nextcloud routing moved to k8s/routing/. validations: compose config --quiet + kubectl apply --dry-run=client. namespace manifests applied first. pull_policy:build stacks get build+push before up so the registry image stays fresh.	2026-09-06 20:39:12 +02:00
forust	92aa731e44	deleted crowdsec stack from the repo. will figure something else ... Signed-off-by: mr-forust <vzlomdsisma@gmail.com>	2026-07-19 23:16:14 +02:00
forust	a128523c24	Fix CrowdSec middleware references in Traefik ingresses	2026-06-29 22:47:21 +02:00
forust	1762962f32	chore(k8s): fix indentation in ingress manifests (3-space -> 2-space)	2026-06-19 12:03:02 +02:00
forust	0803f3efff	chore(k8s): returned to Host || Host standart instead of regexp. ... Yaml lint (yamllint)	2026-06-18 21:02:40 +02:00
forust	76853637bc	feat: traefik prometheus metrics	2026-06-17 01:41:45 +02:00
forust	ea483da645	feat: kube-prometeus-stack	2026-06-16 12:36:31 +02:00