vhaudiquet/homeprod
1
0
Fork 1
mirror of https://github.com/vhaudiquet/homeprod.git synced 2026-10-23 17:03:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,140 Commits 16 Branches 0 Tags
1d40419316f99f4c5c794114e907957a8d51da28
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
vhaudiquet f44a4e7d76 Revert "revert: restore caddy values to the last working state (s3 mount pending rework)" 
This reverts commit bdfc374f08.
 2026-10-16 09:20:37 +02:00
vhaudiquet bdfc374f08 revert: restore caddy values to the last working state (s3 mount pending rework) 2026-10-16 09:09:28 +02:00
vhaudiquet bd3143065c feat(caddy): mount the s3.rhema.rs certificate 2026-10-16 09:06:11 +02:00
vhaudiquet e33b82671a revert: restore the caddy values gutted by a bad s3 volume edit 2026-10-16 09:04:31 +02:00
vhaudiquet 844c8f8abe fix(caddy): the s3 certificate volume references its secret 2026-10-16 09:03:55 +02:00
vhaudiquet 93054f962a feat(caddy): mount the s3.rhema.rs certificate 2026-10-16 09:01:46 +02:00
vhaudiquet 9aeecee770 feat(get-rhema): expose the S3 API publicly for release uploads 
The release runners cannot resolve the in-cluster Service name, so the
binary uploads died on DNS. s3.rhema.rs fronts the same Garage through
Caddy and Traefik, with its own certificate, matching the web face's
shape (Caddy terminates, Traefik routes, bucket by path).
 2026-10-16 08:56:34 +02:00
vhaudiquet 9d53dd0fc6 rhema(kube): deploy rhema.rs and get.rhema.rs 2026-10-15 22:32:14 +02:00
vhaudiquet 5058982605 dns: manage rhema.rs via cloudflare 2026-10-15 22:28:50 +02:00
vhaudiquet bb443f3311 kyverno-policies(kube): exclude longhorn instance-manager pods from cpu stripping 
The longhorn instance-manager and engine-image pods carry
longhorn.io/component labels, not app, so the exclusions never matched.
Kyverno stripped their cpu requests at admission, longhorn-manager saw a
spec mismatch and deleted the pod in a loop, and after any node reboot
all longhorn volumes stayed detached with every workload stuck in
ContainerCreating. Match the real labels instead.
 2026-10-14 17:43:14 +02:00
vhaudiquet a1ce8d3880 rhema-claw(kube): deploy 2026-10-10 13:49:22 +02:00
vhaudiquet 8c7a905d39 saggar(kube): weekly full syncs on the embedded garages 
Garage's hourly full-sync cycles were the InvalidAccessKeyId source:
while a key-table sync runs, auth lookups transiently fail, and the
edge job's prune step kept landing inside the window (one sync ran
87 minutes). Both embedded stores get a weekly interval.
 2026-10-06 06:20:19 +02:00
vhaudiquet 9629597703 get-saggar(kube): deploy 
The saggar-dist chart: a single-node Garage hosting the distribution
bucket — public read-only website on get.saggar.dev (the host label
is what Garage's vhost routing resolves the bucket from), S3 write
surface staying cluster-internal for the publish workflow. Same edge
path as the other saggar hosts: dns A record, cert-manager
certificate, caddy route. Chart repo and packages auth carry over
from the saggar release.
 2026-10-04 23:14:09 +02:00
vhaudiquet 89420bae2f saggar(kube): set the device login's web origin (auth.uiUrl) 2026-10-01 21:25:56 +02:00
vhaudiquet b8879b2025 saggar(kube): expose docs.saggar.dev 
The chart's docs book (static nginx) was up in-cluster only: give its
ingress a host, with the same edge path as the api host — dns A
record, cert-manager certificate and caddy route.
 2026-10-01 19:39:26 +02:00
vhaudiquet 32207635fe gitea(kube): raise limits to receive a kernel tree 
index-pack on ~12M objects OOMKilled the 1Gi container mid push, and
500m of CPU stretched the receive for many minutes before that.
Bump to 6Gi / 4 cores; the node has ~40Gi free.
 2026-09-30 23:03:47 +02:00
vhaudiquet e6ab21317a traefik(kube): raise web entrypoint read timeout to 5m 
Traefik v3 defaults respondingTimeouts.readTimeout to 60s counted
over the whole request body, so large HTTP git pushes get a 504 the
moment they pass one minute. writeTimeout stays unset: a cap there
would cut long-lived SSE streams mid-flight.
 2026-09-30 23:03:42 +02:00
vhaudiquet ae8a4ddb27 saggar(kube): deploy 
Flux HelmRelease of the saggar hub (chart saggar-hub >=0.2.0-0,
CI-published on the gitea saggar org, appVersion pinned to the image
commit) with the web UI. Engine on api.saggar.dev for the CLI and the
docker/apt registries, UI on saggar.dev — new cert, caddy route and
dns A record for the api host, TLS terminating at Caddy as usual.
Login via the home Gitea as an OIDC provider; private registry and
helm repo auth share one packages token.
 2026-09-30 22:30:47 +02:00
vhaudiquet c83b4550ed Merge branch 'main' of https://github.com/vhaudiquet/homeprod 
* 'main' of https://github.com/vhaudiquet/homeprod:
  chore(kube): bump chart Helm release cert-manager-webhook-ovh to v0.9.17
  chore(kube): bump chart Helm release notesnook to v1.0.38
  chore(kube): bump chart Helm release stalwart to v0.7.19
  chore(kube): bump chart postgres Docker tag to v0.20.6
  chore(kube): bump chart redis Docker tag to v0.35.4
  chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.23
 2026-09-28 01:24:28 +02:00
vhaudiquet 50d992b727 saggar.dev(kube): deploy 
- cert-manager-webhook-porkbun via Flux (chart 2.0.7, octabits fork)
- porkbun DNS-01 solver on letsencrypt-production for saggar.dev
- porkbun API credentials secret (sops)
- saggar.dev apex Certificate + Caddy site block -> traefik
 2026-09-28 01:14:58 +02:00
vhaudiquet fc6db118d3 dns: manage saggar.dev via porkbun provider 
- new saggar.dev zone (apex A -> 82.64.154.58) targeting porkbun
- replace '*' zone glob with explicit per-zone targets (cloudflare
  for vhaudiquet.fr/buildpath.win, porkbun for saggar.dev)
- CI: switch to octodns/octodns image + install cloudflare/porkbun
  provider modules
 2026-09-28 01:05:00 +02:00
vhaudiquet 818ed232e4 dns: add pkgatlas.vhaudiquet.fr A record 
Caddy's wildcard *.vhaudiquet.fr vhost already routes the host to the
in-cluster Traefik and on to the pkgatlas ingress.
 2026-09-24 22:00:21 +02:00
vhaudiquet b2f656c757 pkgatlas(kube): deploy 
Flux HelmRelease tracking the CI-published chart (>=0.4.0-0, timestamped
versions, appVersion pinned to the image commit). Ingress host
pkgatlas.vhaudiquet.fr via traefik; TLS terminates at Caddy with the
*.vhaudiquet.fr wildcard, so the new @pkgatlas route proxies to Traefik
like the other public vhosts.
 2026-09-24 21:57:42 +02:00
vhaudiquet 3f986b65ab gitea(kube): fix valkey memory limits 2026-09-22 22:35:36 +02:00
vhaudiquet e354a56e15 gitea(kube): bump pvc storage to 30Gi 2026-09-22 21:58:25 +02:00
vhaudiquet bd5fab7419 syncthing(kube): deploy 2026-09-22 00:30:42 +02:00
vhaudiquet f2d7fe7bcc openclaw: pin image to 2026.9.3 and chown PVC mount root (operator#607) 
- Pin gateway image to immutable tag 2026.9.3: the stale node-cached
  'latest' (old build, state schema v1) crash-looped against the PVC's
  DB already migrated to schema v15/16.
- Add fix-data-owner init container: the operator mounts the PVC root
  at /home/openclaw/.openclaw with fsGroup only, leaving the mount root
  owned by root; OpenClaw >= 2026.9 fchmods its config dir on write and
  fails with EPERM (paperclipinc/openclaw-operator#607).
- Ran one-time 'openclaw doctor --fix --non-interactive' against the
  PVC to complete the 2.0 workspace-state migration.
 2026-09-10 00:59:25 +02:00
vhaudiquet 807d764bdf cilium(kube): scale replicas down to 1 2026-09-10 00:16:34 +02:00
vhaudiquet c613811c8e gitea: bump memory limit for valkey 2026-09-09 23:39:29 +02:00
vhaudiquet 5608fa2f0d kyverno(kube): strip limits.cpu too 2026-09-09 23:21:51 +02:00
vhaudiquet 3d258f147d kyverno(kube): foreach patchStrategicMerge must be inline mapping, not block scalar 2026-09-09 23:07:13 +02:00
vhaudiquet 764a029c39 kyverno(kube): update policy to v1 2026-09-09 22:57:58 +02:00
vhaudiquet 21d54fba97 kyverno(kube): bump version 2026-09-09 22:52:51 +02:00
vhaudiquet 26dd59845f kyverno(kube): fix deployment 2026-09-09 22:20:59 +02:00
vhaudiquet a07ce44e6d kyverno(kube): add kyverno 
add a policy to remove cpu requests, to relieve cluster
 2026-09-09 21:43:13 +02:00
vhaudiquet 99880ab291 gitea,longhorn: update CPU limits, tolerations, replicas 2026-09-09 18:47:12 +02:00
vhaudiquet f813170b86 gitea/valkey(kube): bump memory limit to 512 Mi 
bump requested memory to 256 Mi
 2026-09-07 23:43:39 +02:00
vhaudiquet 38a6fdba74 renovate: remove pr footer, remove hourly limit, fix patterns 2026-09-01 00:39:25 +02:00
vhaudiquet 54ae16dda9 renovate: remove schedule 2026-08-31 22:58:06 +02:00
vhaudiquet 15b8ef7687 renovate: set ram limits up to 2G 2026-08-30 10:04:19 +02:00
vhaudiquet 2a44c4932b renovate: update renovate.json config 2026-08-26 21:55:09 +02:00
vhaudiquet 13cca1852e renovate: update to new oci repository 2026-08-26 21:39:34 +02:00
vhaudiquet a80b45618c renovate: deploy renovate on kube 2026-08-26 21:35:02 +02:00
vhaudiquet 989a16b878 openclaw: allow runtimeDeps python 2026-08-24 23:19:41 +02:00
vhaudiquet 53fd78081d openclaw: add chromium sidecar 2026-08-24 23:15:04 +02:00
vhaudiquet b351545c92 radicale: deploy on kube 2026-08-24 21:16:53 +02:00
vhaudiquet ced1042fc1 openclaw: update secrets 
<beep boop, I'm a bot>
 2026-08-24 14:01:23 +02:00
vhaudiquet 400d5910be openclaw: allow ingress networkpolicy 2026-08-23 21:36:32 +02:00
vhaudiquet 79faafe40a openclaw: allow traefik namespace 2026-08-23 18:21:54 +02:00
vhaudiquet 539622817d openclaw: enable http access 2026-08-23 11:03:05 +02:00
vhaudiquet 34660b1231 openclaw: deploy openclaw on kube 2026-08-23 10:43:07 +02:00
vhaudiquet 9c2f4de590 dependabot: update commit messages 2026-08-22 21:19:11 +02:00
vhaudiquet b393049241 gitea: make namespace privileged for actions runners 2026-08-22 12:31:03 +02:00
vhaudiquet 8abd2add2e gitea: deploy in-cluster action runner 2026-08-22 12:15:30 +02:00
vhaudiquet 19fb650b8d infra: remove stale old kube files, infra/kube is new truth 2026-08-21 20:36:53 +02:00
vhaudiquet 8f97feb3e9 infra/kube: added kube cluster infrastructure 2026-08-21 20:35:32 +02:00
vhaudiquet 7ff65257a7 linkwarden: remove linkwarden, bye! 2026-08-21 20:18:41 +02:00
vhaudiquet 16f83820e7 dns(local): remove/update stale entries 2026-08-21 19:25:02 +02:00
vhaudiquet 972d4d1510 blocky: update coredns service ip 2026-08-21 18:53:47 +02:00
vhaudiquet 38fa3ae058 dns(local): update truenas, p330 2026-08-21 00:30:27 +02:00
vhaudiquet 0ef10e278e trafik: pin loadbalancerip 2026-08-20 23:32:22 +02:00
vhaudiquet ac3a6a1b60 network: fix previous ips 2026-08-20 23:26:03 +02:00
vhaudiquet 207aa84670 network: allocate new ips on final segment 2026-08-20 22:31:57 +02:00
vhaudiquet 950ced8477 flux: re-order longhorn jobs for right dependencies 2026-08-19 17:14:26 +02:00
vhaudiquet bc6f92e145 flux: re-order certificates for right dependencies 2026-08-19 16:56:23 +02:00
vhaudiquet f420718943 dns(local): update p330 2026-08-17 21:32:25 +02:00
vhaudiquet fd309e4f94 network: release old IPs, allocate new IPs, swap DNS 
Migrating houses is never easy...
 2026-08-17 20:27:08 +02:00
vhaudiquet 4b1d2c3102 obsidian-livesync: remove from docker 2026-08-17 00:12:49 +02:00
vhaudiquet d8970a5f4b obsidian-livesync: set couchdb shards to 1 2026-08-16 23:50:13 +02:00
vhaudiquet 7b6d8f3dc4 obsidian-livesync: update ingress 2026-08-16 22:29:08 +02:00
vhaudiquet 7d32e91b9c obsidian-livesync: add couchdb uuid 2026-08-16 22:25:52 +02:00
vhaudiquet 8c83e6c7ab obsidian-livesync: deploy to kube 2026-08-16 22:16:47 +02:00
vhaudiquet f553e19af4 p330: remove dedicated=failover taint 2026-08-16 20:40:15 +02:00
vhaudiquet 5e9bebc4f0 paperless: remove from docker 2026-08-16 12:10:27 +02:00
vhaudiquet 5a3984c0b2 dns(local): remove old paperless dns entry 2026-08-16 11:46:25 +02:00
vhaudiquet 48608bc59e paperless: deploy on kube 2026-08-16 11:07:01 +02:00
vhaudiquet 2d05743c6d dns(local): update p330 ip 2026-08-15 14:49:50 +02:00
vhaudiquet fe98f670cf infra/rpi4: set CNI to none for cilium 2026-08-14 20:31:46 +02:00
vhaudiquet 2a024821d2 infra/p330: set CNI to none for cilium 2026-08-14 18:36:28 +02:00
vhaudiquet 00859be72a notesnook: tryfix, remove know_proxies 2026-08-13 19:31:25 +02:00
vhaudiquet c1f4a57570 notesnook: add minio ingress path 2026-08-13 19:21:15 +02:00
vhaudiquet eaa47c9b6d notesnook: updated chart, added inbox API 2026-08-13 18:55:06 +02:00
vhaudiquet f2cd5f2d98 buildpath: update memory limits 2026-08-13 12:55:04 +02:00
vhaudiquet be88bbcd93 buildpath: remove from docker, bye! 2026-08-13 01:16:17 +02:00
vhaudiquet a8f7ff538c caddy: move buildpath from docker to kube 2026-08-13 00:52:49 +02:00
vhaudiquet b5a48584f0 gitea: go back to rootless 2026-08-13 00:43:19 +02:00
vhaudiquet c89ee33798 gitea: tryfix running non-rootless image 2026-08-12 23:24:09 +02:00
vhaudiquet 1e9a9080e9 gitea: add env override for HOME 2026-08-12 22:59:54 +02:00
vhaudiquet 50b68bf569 buildpath: specify kube chart version 2026-08-12 18:31:38 +02:00
vhaudiquet 2a95f8129b buildpath: update repository for kube 2026-08-12 18:28:05 +02:00
vhaudiquet 2a988f1a7c gitea: bump to latest 2026-08-12 18:22:39 +02:00
vhaudiquet 8604e270e1 buildpath: update kustomizeconfig 2026-08-12 18:17:10 +02:00
vhaudiquet 99639b1052 buildpath: fix kube chart repository 2026-08-12 18:14:26 +02:00
vhaudiquet 51d234157d buildpath: fix kube chart kind 2026-08-12 18:12:26 +02:00
vhaudiquet b8104d982b buildpath: fix kube chart 2026-08-12 18:11:08 +02:00
vhaudiquet 0fcfc016a6 buildpath: deploy on kube 2026-08-12 18:02:38 +02:00
vhaudiquet 315a7d79ea build(deps): bump buildpath 2026-08-12 00:53:11 +02:00
vhaudiquet 314b51313e photoprism: bump storage to 10G 2026-08-11 11:25:09 +02:00
vhaudiquet 8f8fa75099 photoprism: bump memory to 8G and limit to 1 worker 2026-08-11 00:49:57 +02:00
vhaudiquet 68ba23768e photoprism: moved to photos.vhaudiquet.fr 2026-08-10 23:40:33 +02:00