100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
forust	4c7c53e0f2	fix(cicd): align apply timeout with stage budgets	2026-10-07 23:28:17 +02:00
forust	ba934265ac	Merge pull request 'docs: record completed EDU ownership handoff' (#115) from docs/record-edu-handoff-complete into main ... Reviewed-on: #115	2026-10-07 21:10:52 +00:00
forust	c7155808d9	docs: record completed EDU ownership handoff	2026-10-07 20:43:12 +02:00
forust	fc4d64bdb2	chore(streaming): disable Kubernetes routing	2026-10-07 18:23:16 +02:00
forust	a6f7fc6030	chore(streaming): disable streaming stack	2026-10-07 17:48:54 +02:00
forust	11de1d1468	Merge pull request 'fix(cicd): preserve AIO tag in rollback snapshot' (#112) from fix/nextcloud-aio-rollback-tag into main ... Reviewed-on: #112	2026-10-07 15:29:11 +00:00
forust	64962d1a63	fix(cicd): preserve AIO tag in recovery snapshot	2026-10-07 16:53:14 +02:00
forust	b08a0a927d	Merge pull request 'fix(cicd): preserve Nextcloud AIO tag' (#111) from fix/preserve-nextcloud-aio-tag into main ... Reviewed-on: #111	2026-10-07 14:46:02 +00:00
forust	8203ba1b0b	fix(cicd): preserve Nextcloud AIO image tag	2026-10-07 14:45:10 +00:00
forust	48033b5495	Merge pull request 'fix(cicd): support Helm 4 release listing' (#110) from fix/helm4-list into main ... Reviewed-on: #110	2026-10-07 13:55:15 +00:00
forust	73d2af73e5	fix(cicd): support Helm 4 release listing	2026-10-07 15:51:57 +02:00
forust	64253e005e	Merge pull request 'fix(cicd): use Gitea artifact v4 backend' (#109) from fix/gitea-v4-artifacts into main ... Reviewed-on: #109	2026-10-07 13:35:36 +00:00
forust	69accd1752	fix(cicd): use Gitea artifact v4 backend	2026-10-07 15:29:49 +02:00
forust	0cf4b08a95	Merge pull request 'fix(cicd): isolate pull request runner jobs' (#108) from fix/cicd-pr-runner into main ... Reviewed-on: #108	2026-10-07 13:03:01 +00:00
forust	86df5d9048	docs(cicd): document user-scoped PR runner	2026-10-07 14:50:32 +02:00
forust	d7441bbbc2	fix(cicd): isolate pull request runner jobs	2026-10-07 14:39:57 +02:00
forust	2be089e048	Merge pull request 'Collect Headscale, NetBird, Gitea and Immich metrics' (#100) from feat/service-metrics into main ... Reviewed-on: #100	2026-10-07 11:46:16 +00:00
forust	83b2e68371	feat(metrics): collect Headscale, NetBird, Gitea and Immich metrics	2026-10-07 11:46:16 +00:00
forust	597f64cbb0	Merge pull request 'Show CI checks and deployment results' (#99) from codex/ci-visible-checks into main ... Reviewed-on: #99	2026-10-07 11:46:05 +00:00
forust	f767f3ce1a	docs: update EDU handoff status	2026-10-07 10:25:17 +02:00
forust	95e4d8f875	ci: add per-image jobs to homelab CI	2026-10-07 10:19:12 +02:00
forust	1d93588e06	refactor: remove EDU ownership from homelab	2026-10-07 10:19:12 +02:00
forust	fb400eea6e	Use plain text for the deploy request details	2026-10-06 23:44:24 +02:00
forust	0c76426c17	Show failure details in CI and deploy summaries	2026-10-06 23:44:00 +02:00
forust	d74822cd27	Add CI and deploy summaries	2026-10-06 23:28:56 +02:00
forust	b677d553b4	refactor(ci): split checks into visible jobs	2026-10-06 23:22:15 +02:00
forust	898463b759	Merge pull request 'refactor(ci): native VPS runner and durable incremental deploys' (#98) from codex/cicd-runner-deploy into main ... Reviewed-on: #98	2026-10-06 21:19:55 +00:00
forust	9a76529be8	refactor(ci): use native runner and durable incremental deploys	2026-10-06 23:08:47 +02:00
forust	5f9354b9a8	fix(edu): deploy reviewed application release with Redis authentication	2026-10-06 22:56:02 +02:00
forust	fcd16f6128	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.140.0' (#96) from renovate/renovate-self-update into main ... Reviewed-on: #96	2026-10-06 17:51:40 +00:00
forust	3c7e358dd5	Merge pull request 'chore(deps): update lscr.io/linuxserver/qbittorrent docker tag to v20' (#97) from renovate/lscr.io-linuxserver-qbittorrent-20.x into main ... Reviewed-on: #97	2026-10-06 17:51:25 +00:00
forust	7fdeacffb8	feat(monitoring): stand down Prometheus server during VM trial ... vmagent scrapes and remote-writes to VictoriaMetrics, so the Prometheus server scales to 0. Encoded as prometheusSpec.replicas in values instead of a kubectl patch, so helm keeps owning spec.replicas and Helm 4 server-side apply stops conflicting with the kubectl-patch field manager.	2026-10-06 19:29:30 +02:00
forust	cef499de73	fix(deploy): skip VMAgent in secrets check before CRD install ... check_referenced_secrets ran kubectl create on vmagent.yaml even when the VMAgent CRD is not installed yet, failing validate with 'no matches for kind VMAgent'. Apply the same skip_uninstalled_vmagent_crd guard used by both dry-run loops.	2026-10-06 19:19:47 +02:00
forust	1b70a55300	fix(ci): handle malformed push before SHA	2026-10-06 18:21:19 +02:00
forust	3f2b4e9acf	fix(deploy): skip VMAgent preflight before CRD install	2026-10-06 18:18:25 +02:00
forust	6057734a4f	fix(renovate): sync generated configmap	2026-10-06 18:08:17 +02:00
forust	8eedf8b74b	Merge pull request 'feat(monitoring): add VictoriaMetrics trial stack' (#95) from feat/victoria-metrics-migration into main ... Reviewed-on: #95	2026-10-06 16:05:46 +00:00
forust	8c0e36a5c0	feat(monitoring): replace scrape dump with vmagent	2026-10-06 18:03:59 +02:00
forust	78cd15f12c	chore(monitoring): remove vmctl backfill job ... One-shot Prometheus history backfill is complete; drop the Job and clean up related comments.	2026-10-06 17:53:24 +02:00
forust	18c633c242	feat(monitoring): add VictoriaMetrics trial stack	2026-10-06 17:45:44 +02:00
forust	4510394531	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.139.0' (#81) from renovate/renovate-self-update into main ... Reviewed-on: #81	2026-10-06 15:33:45 +00:00
forust	8ce0b809c0	Merge pull request 'chore(deps): update all minor updates' (#77) from renovate/all-minor into main ... Reviewed-on: #77	2026-10-06 15:33:28 +00:00
forust	bdcbb3d5af	Merge pull request 'chore(deps): update all patch updates' (#82) from renovate/all-patch into main ... Reviewed-on: #82	2026-10-06 15:33:09 +00:00
forust	695da1308c	Merge pull request 'fix(renovate): restore custom extraction and update groups' (#93) from fix/renovate-extraction-groups into main ... Reviewed-on: #93	2026-10-06 15:31:25 +00:00
forust	552b22cb66	fix(renovate): include self-update Compose filename	2026-10-06 15:31:25 +00:00
forust	3756e60c95	fix(renovate): restore custom extraction and update groups	2026-10-06 15:31:25 +00:00
forust	d0d217ddf4	Merge pull request 'fix(deploy): skip verify and smoke when deployment is disabled' (#94) from fix/deploy-skip-when-disabled into main ... Reviewed-on: #94	2026-10-06 15:24:17 +00:00
forust	24f84bab2f	fix(deploy): skip verification when deployment is disabled	2026-10-06 15:24:06 +00:00
forust	0b8a3c16a7	Merge pull request 'fix(glance): mount CSS from the correct ConfigMap' (#87) from fix/glance-assets into main ... Reviewed-on: #87	2026-10-06 15:17:47 +00:00
forust	e9a68aae77	fix(glance): mount CSS from the assets ConfigMap	2026-10-06 15:17:47 +00:00
forust	5359df5ed6	Merge pull request 'fix(postgres): include the required NetBox database password' (#88) from fix/postgres-env-example into main ... Reviewed-on: #88	2026-10-06 15:17:19 +00:00
forust	8aea0f0d13	fix(postgres): include required NetBox password in Compose env example	2026-10-06 15:17:19 +00:00
forust	65d4f2d482	Merge pull request 'fix(traefik): correct AdGuard and SearXNG Compose rules' (#90) from fix/compose-router-rules into main ... Reviewed-on: #90	2026-10-06 15:10:49 +00:00
forust	2fe9b7632f	fix(traefik): correct AdGuard and SearXNG Compose router expressions	2026-10-06 15:10:49 +00:00
forust	e436d89eef	Merge pull request 'fix(netbird): restore Compose setup and runtime renderer' (#86) from fix/netbird-compose-runtime into main ... Reviewed-on: #86	2026-10-06 15:10:12 +00:00
forust	8729cb5062	fix(netbird): restore Compose setup and server entrypoint	2026-10-06 15:08:46 +00:00
forust	f1e4a1088d	Merge pull request 'fix(ci): deduplicate PR checks and filter deploy triggers' (#92) from fix/ci-trigger-dedup into main ... Reviewed-on: #92	2026-10-06 15:06:47 +00:00
forust	b357ef95d8	fix(deploy): only create automatic runs for main CI	2026-10-06 17:00:05 +02:00
forust	67422663b7	fix(ci): avoid duplicate branch and PR runs	2026-10-06 16:59:26 +02:00
forust	88705fec88	Merge pull request 'fix(deploy): reject unsafe per-file pruning' (#85) from fix/deploy-prune-guard into main ... Reviewed-on: #85	2026-10-06 14:57:22 +00:00
forust	c098807aa4	fix(deploy): reject destructive per-file pruning before apply	2026-10-06 14:57:11 +00:00
forust	e1eee2d3c7	Merge pull request 'feat(reloader): enable deploy and integrate configuration reloads' (#91) from fix/reloader-integration into main ... Reviewed-on: #91	2026-10-06 14:55:16 +00:00
forust	ff83daed1e	feat(reloader): enable deployment and reload runtime-config consumers	2026-10-06 14:54:45 +00:00
forust	080ae343e6	Merge pull request 'fix(deploy): validate resolved Compose config and namespaced Secrets' (#84) from fix/deploy-validation into main ... Reviewed-on: #84	2026-10-06 14:54:27 +00:00
forust	8d3185f8ab	fix(ci): install jq for deploy validation regressions	2026-10-06 16:31:48 +02:00
forust	ff40a71145	fix(deploy): resolve Compose config and check namespaced pod Secrets	2026-10-06 15:58:44 +02:00
forust	cc9c3dea88	feat(traefik): expose insecure API on 8080 for Homarr integration ... ClusterIP access to api@internal from Homarr pod. LAN-reachable on 192.168.80.2:8080, accepted.	2026-10-06 11:27:38 +02:00
forust	815cd85b9a	feat(homarr): deploy dashboard to k8s on home subdomain ... Local-only IngressRoute (home.workstation.internal, home.gigaforust.internal), prod commented out. Compose stack for test stand.	2026-10-06 11:27:35 +02:00
forust	9021eddbc3	chore(deps): pin streaming images, isolate python and floating tags ... Python Y-bumps arrived as minor 3.11->3.14 and floating tags (:latest/:beta) were automerged blindly. Pin the linuxserver stack to digest-verified tags and keep python plus rolling images in manual review groups.	2026-10-05 23:53:38 +02:00
forust	2adf17c307	Merge pull request 'chore(deps): update all patch updates' (#76) from renovate/all-patch into main ... Reviewed-on: #76	2026-10-05 21:41:00 +00:00
forust	34f10211ab	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.136.0' (#79) from renovate/renovate-self-update into main ... Reviewed-on: #79	2026-10-05 21:39:21 +00:00
forust	8799962b1c	Revert "feat(adguard): add netbird sidecar" ... This reverts commit 7a81b4ea8b.	2026-10-04 17:40:19 +02:00
forust	fb80024fa2	feat(streaming): add bazarr for subtitles	2026-10-04 17:25:00 +02:00
forust	0f1a788874	Merge pull request 'feat(streaming): compose *arr streaming stack (k8s routing)' (#78) from feat/streaming-compose-test into main ... Reviewed-on: #78	2026-10-04 14:04:28 +00:00
forust	39df442e60	fix(streaming): trailing newline for yamllint	2026-10-04 16:03:40 +02:00
forust	62a451773e	feat(streaming): compose *arr streaming stack (k8s routing)	2026-10-04 15:57:08 +02:00
forust	f196099491	feat(adguard): add DNS readiness probe	2026-10-03 22:39:25 +02:00
forust	66502b8279	fix(traefik): protect dashboard with security-chain	2026-10-03 22:39:25 +02:00
forust	9018c091fa	feat(uptime-kuma): add ServiceMonitor, alerts and secrets example	2026-10-03 22:39:24 +02:00
forust	114608af2f	fix(uptime-kuma): label service and name http port	2026-10-03 22:39:23 +02:00
forust	51a73fb213	chore(gitea): switch domain to git.forust.xyz (28.0.0 update)	2026-10-03 22:37:48 +02:00
forust	939fad4a23	chore(renovate,crowdsec): group minor/patch updates and whitelist VPS ... Renovate: group all minor updates and all patch updates into reviewable PRs. Crowdsec: whitelist static VPS IP. Remove stale cloudflared/k8s/active marker.	2026-10-03 11:57:46 +02:00
forust	12d5cc6202	Merge pull request 'chore(deps): update docker.gitea.com/gitea docker tag to v28' (#74) from renovate/docker.gitea.com-gitea-28.x into main ... Reviewed-on: #74	2026-10-03 09:44:13 +00:00
forust	a6b84d86b4	Merge pull request 'chore(deps): update gitea/gitea docker tag to v28' (#75) from renovate/gitea-gitea-28.x into main ... Reviewed-on: #75	2026-10-03 09:44:06 +00:00
forust	f3a5cedc80	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.132.2' (#69) from renovate/renovate-self-update into main ... Reviewed-on: #69	2026-10-03 09:31:07 +00:00
forust	e208ccae62	Merge pull request 'chore(deps): update ghcr.io/alexta69/metube docker tag to v2026.09.29' (#70) from renovate/container-patch-updates into main ... Reviewed-on: #70	2026-10-03 09:20:36 +00:00
forust	d3892d2ed5	Merge pull request 'chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v3.4.0' (#71) from renovate/ghcr.io-henriquesebastiao-downtify-3.x into main ... Reviewed-on: #71 Reviewed-by: forust <vzlomdsisma@gmail.com>	2026-10-03 09:20:06 +00:00
forust	7164b48275	Merge pull request 'chore(deps): update ghcr.io/lukegus/termix docker tag to v2.9.0' (#72) from renovate/ghcr.io-lukegus-termix-2.x into main ... Reviewed-on: #72	2026-10-03 09:19:37 +00:00
forust	956596e6aa	Merge pull request 'chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.42.2' (#68) from renovate/docker.n8n.io-n8nio-n8n-2.x into main ... Reviewed-on: #68	2026-10-03 09:17:01 +00:00
forust	65709e005b	Merge pull request 'chore(deps): update netbirdio/netbird-server docker tag to v0.80.0' (#73) from renovate/netbirdio-netbird-server-0.x into main ... Reviewed-on: #73	2026-10-03 09:16:28 +00:00
forust	78e6363fe2	chore(gitea): add git.forust.xyz route	2026-10-03 11:07:48 +02:00
forust	22c2f1e108	extract dtek_notif subtree to its own repo	2026-10-03 10:48:01 +02:00
forust	64ba4ce9f1	Revert "chore(prometheus): drop dead grafana routes and cert" ... This reverts commit 314ec0cda7.	2026-10-03 10:40:39 +02:00
forust	7a81b4ea8b	feat(adguard): add netbird sidecar	2026-10-03 10:36:15 +02:00
forust	0859479c0f	feat(ingress): replace traefik crowdsec plugin with firewall bouncer ... Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.	2026-09-30 20:14:25 +02:00
forust	872f64b887	fix(ci): silence intentional SC2029 in ssh-run.sh	2026-09-29 14:54:17 +02:00
forust	a90fb19ed4	fix(traefik): size probes for HDD stalls ... Single replica is the whole ingress; liveness kills at 2s timeouts took every public service down in a loop. Same stall-sized budgets as postgres/metallb. Applied live via helm (pinned 41.5.0, values from git).	2026-09-29 14:47:53 +02:00
forust	6f4cd03f4b	feat(deploy): serialize apply stages and wait for calm node ... apply-k8s and apply-compose share a workstation flock so host docker churn never overlaps cluster churn. Each helm upgrade and the apply loop wait up to 10m for load <28 first, so a deploy never piles onto an already-hot node (the load-40/netbird-death/pending-helm spiral).	2026-09-29 14:42:56 +02:00
forust	e56662194b	fix(ci): log in to registry for manifest-only main pushes ... The pin step writes manifest PUTs on every main push, but login was gated on services != ''. Manifest-only pushes skipped login and pushed anonymously (401); this only worked before via a stale persistent login on the old runner.	2026-09-29 14:21:57 +02:00
forust	4856348a6e	chore(searxng,glance): disable services ... Workloads, services, routes and certs removed from the cluster. Configs, manifests and PVCs kept for easy re-enable via k8s/active.	2026-09-29 13:59:59 +02:00