vhaudiquet/homeprod
1
0
Fork 1
mirror of https://github.com/vhaudiquet/homeprod.git synced 2026-09-21 16:36:05 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,066 Commits 16 Branches 0 Tags
45f8f84cbce769544302f51cf703a2f0401122c4
Commit Graph
222 Commits
Author SHA1 Message Date
kosmos-ai-botandvhaudiquet 45f8f84cbc chore(renovate): drop self-hosted runner from this PR (merge config only) 
Per review feedback: remove the self-hosted Renovate deployment
(kubernetes/code/renovate/* + root kustomization wiring) from this PR and
defer it to a follow-up. Keep the renovate.json config to merge now.

Also drop the postUpgradeTasks SOPS re-encrypt block: it depended on the
runner's boot.sh decrypt flow, and the hosted Mend app cannot run 'sops'
(allowedPostUpgradeCommands). SOPS handling returns with the deployment.
 2026-08-26 19:58:55 +02:00
kosmosandvhaudiquet 1623b2ea7d fix(renovate): decrypt values BEFORE renovate edits them (retract broken post-bump round-trip) 
The prior postUpgradeTasks command 'sops -d ... && sops -e' was wrong:
Renovate has no preUpgradeTasks hook, and postUpgradeTasks runs AFTER
Renovate rewrites the file. These values.yaml are SOPS documents whose
sops.mac authenticates the whole file, so editing a plaintext image.tag
invalidates the MAC and 'sops -d' then fails (data-integrity error). The
claimed decrypt-after-bump therefore could never work.

boot.sh now decrypts every values.yaml in the checkout BEFORE Renovate
extracts/edits them, committing the decrypted tree locally (never pushed,
so no plaintext secrets enter remote git). postUpgradeTasks is reduced to
'sops -e -i' only (the file is already plaintext when Renovate edits it).

Validated: kustomize build passes for the whole kubernetes/ tree.
 2026-08-26 19:58:55 +02:00
kosmosandvhaudiquet 5bf07a2fff chore(renovate): add SOPS round-trip postUpgradeTasks + self-hosted runner 
Address review feedback on SOPS handling for encrypted values.yaml.

- renovate.json: Renovate has NO preUpgradeTasks option (verified against
  the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks
  (which run after the tag bump, before the commit): decrypt the values.yaml,
  then re-encrypt. Encrypting an already-encrypted file would double-encrypt
  the existing ENC secret values. Only **/values.yaml is re-encrypted; the
  docker-compose and Chart.yaml files are not SOPS-encrypted here.
- kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob
  running the renovatebot/renovate image, with sops allowed as a
  postUpgradeTask command and the SOPS PGP key loaded to re-encrypt
  values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources.
- Wire code/renovate into the root kubernetes kustomization.
 2026-08-26 19:58:55 +02:00
kosmosandvhaudiquet 6da9484fa3 openclaw: add egress NetworkPolicy for Radicale CalDAV 
Allow the openclaw pod to reach the Radicale CalDAV/CardDAV server
(namespace: radicale, port 5232) so Kosmos can read/write Valentin's
calendar via the in-cluster service. Mirrors networkpolicy-mail-egress.yaml.

Workaround for spec.networkPolicy.additionalEgress not being in the CRD
bundled with operator chart 0.39.0 yet (silently pruned).
 2026-08-25 00:08:03 +02:00
vhaudiquet 989a16b878 openclaw: allow runtimeDeps python 2026-08-24 23:19:41 +02:00
vhaudiquet 53fd78081d openclaw: add chromium sidecar 2026-08-24 23:15:04 +02:00
vhaudiquet b351545c92 radicale: deploy on kube 2026-08-24 21:16:53 +02:00
vhaudiquet ced1042fc1 openclaw: update secrets 
<beep boop, I'm a bot>
 2026-08-24 14:01:23 +02:00
vhaudiquet 400d5910be openclaw: allow ingress networkpolicy 2026-08-23 21:36:32 +02:00
vhaudiquet 79faafe40a openclaw: allow traefik namespace 2026-08-23 18:21:54 +02:00
vhaudiquet 539622817d openclaw: enable http access 2026-08-23 11:03:05 +02:00
vhaudiquet 34660b1231 openclaw: deploy openclaw on kube 2026-08-23 10:43:07 +02:00
vhaudiquet b393049241 gitea: make namespace privileged for actions runners 2026-08-22 12:31:03 +02:00
vhaudiquet 8abd2add2e gitea: deploy in-cluster action runner 2026-08-22 12:15:30 +02:00
vhaudiquet 7ff65257a7 linkwarden: remove linkwarden, bye! 2026-08-21 20:18:41 +02:00
vhaudiquet 16f83820e7 dns(local): remove/update stale entries 2026-08-21 19:25:02 +02:00
vhaudiquet 972d4d1510 blocky: update coredns service ip 2026-08-21 18:53:47 +02:00
vhaudiquet 38fa3ae058 dns(local): update truenas, p330 2026-08-21 00:30:27 +02:00
vhaudiquet 0ef10e278e trafik: pin loadbalancerip 2026-08-20 23:32:22 +02:00
vhaudiquet ac3a6a1b60 network: fix previous ips 2026-08-20 23:26:03 +02:00
vhaudiquet 207aa84670 network: allocate new ips on final segment 2026-08-20 22:31:57 +02:00
vhaudiquet 950ced8477 flux: re-order longhorn jobs for right dependencies 2026-08-19 17:14:26 +02:00
vhaudiquet bc6f92e145 flux: re-order certificates for right dependencies 2026-08-19 16:56:23 +02:00
vhaudiquet f420718943 dns(local): update p330 2026-08-17 21:32:25 +02:00
vhaudiquet fd309e4f94 network: release old IPs, allocate new IPs, swap DNS 
Migrating houses is never easy...
 2026-08-17 20:27:08 +02:00
vhaudiquet d8970a5f4b obsidian-livesync: set couchdb shards to 1 2026-08-16 23:50:13 +02:00
vhaudiquet 7b6d8f3dc4 obsidian-livesync: update ingress 2026-08-16 22:29:08 +02:00
vhaudiquet 7d32e91b9c obsidian-livesync: add couchdb uuid 2026-08-16 22:25:52 +02:00
vhaudiquet 8c83e6c7ab obsidian-livesync: deploy to kube 2026-08-16 22:16:47 +02:00
vhaudiquet 5a3984c0b2 dns(local): remove old paperless dns entry 2026-08-16 11:46:25 +02:00
vhaudiquet 48608bc59e paperless: deploy on kube 2026-08-16 11:07:01 +02:00
semerysandvhaudiquet dcdc0bf138 caddy: move semeryfr to kube 2026-08-15 16:46:33 +02:00
semerysandvhaudiquet 07ea93a90a semery-fr: deploy on kube 2026-08-15 16:46:33 +02:00
vhaudiquet 2d05743c6d dns(local): update p330 ip 2026-08-15 14:49:50 +02:00
vhaudiquet 00859be72a notesnook: tryfix, remove know_proxies 2026-08-13 19:31:25 +02:00
vhaudiquet c1f4a57570 notesnook: add minio ingress path 2026-08-13 19:21:15 +02:00
vhaudiquet eaa47c9b6d notesnook: updated chart, added inbox API 2026-08-13 18:55:06 +02:00
vhaudiquet f2cd5f2d98 buildpath: update memory limits 2026-08-13 12:55:04 +02:00
vhaudiquet a8f7ff538c caddy: move buildpath from docker to kube 2026-08-13 00:52:49 +02:00
vhaudiquet b5a48584f0 gitea: go back to rootless 2026-08-13 00:43:19 +02:00
vhaudiquet c89ee33798 gitea: tryfix running non-rootless image 2026-08-12 23:24:09 +02:00
vhaudiquet 1e9a9080e9 gitea: add env override for HOME 2026-08-12 22:59:54 +02:00
vhaudiquet 50b68bf569 buildpath: specify kube chart version 2026-08-12 18:31:38 +02:00
vhaudiquet 2a95f8129b buildpath: update repository for kube 2026-08-12 18:28:05 +02:00
vhaudiquet 2a988f1a7c gitea: bump to latest 2026-08-12 18:22:39 +02:00
vhaudiquet 8604e270e1 buildpath: update kustomizeconfig 2026-08-12 18:17:10 +02:00
vhaudiquet 99639b1052 buildpath: fix kube chart repository 2026-08-12 18:14:26 +02:00
vhaudiquet 51d234157d buildpath: fix kube chart kind 2026-08-12 18:12:26 +02:00
vhaudiquet b8104d982b buildpath: fix kube chart 2026-08-12 18:11:08 +02:00
vhaudiquet 0fcfc016a6 buildpath: deploy on kube 2026-08-12 18:02:38 +02:00