1614 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Greg Hellings	21dbcb3113	feat: aws-cli and cargo on lithic	2026-04-06 16:23:03 -05:00
Greg Hellings	6b7f54d0a2	feat: pull dynamic names for Darwin/Home	2026-04-06 16:21:02 -05:00
Greg Hellings	0d70a9e018	feat: add li host	2026-04-06 08:43:41 -05:00
Greg Hellings	aee34e5b86	feat: more bookmarks	2026-04-05 20:03:51 -05:00
Greg Hellings	0460014b75	feat: Add minio-client and Discord to Exodus	2026-04-05 19:45:36 -05:00
Greg Hellings	84d050fb0c	fix: remove files before re-upload in Immich backup	2026-04-05 16:52:04 -05:00
Greg Hellings	3847c7d92d	fix: streamline Gitea runners	2026-04-05 16:51:31 -05:00
klaatu	81936ac524	feat: Gitea Actions shell runners + flake-lock workflow ... - Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in shell mode, with options for enable, instanceURL, name, labels, and tokenFile (agenix secret path). - Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with appropriate labels. Agenix secret placeholders left with TODOs. - Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday midnight) that runs nix flake update and opens a PR if flake.lock changed, using GITEA_TOKEN secret for authentication. Closes part of #15 (NixOS shell runners + flake-lock workflow).	2026-04-05 04:58:27 -05:00
Greg Hellings	45d8154a04	Merge remote-tracking branch 'origin/feat/gitea-actions'	2026-04-04 14:18:22 -05:00
Greg Hellings	03400f1c93	fix: pull correct secrets	2026-04-04 14:14:23 -05:00
greg	603598a3f9	Merge branch 'main' into feat/gitea-actions	2026-04-04 19:13:31 +00:00
klaatu	757b07c22f	fix: replace placeholder Secret with ExternalSecret via bitwarden-login	2026-04-04 19:05:17 +00:00
klaatu	b7fba0e151	fix: chart name act_runner -> actions, version 0.2.5 -> 0.0.4	2026-04-04 19:05:06 +00:00
greg	75278cdb6a	Merge pull request 'fix: set MC_CONFIG_DIR to /tmp/.mc so mc can write config as non-root' (#20) from klaatu/nixos:fix/mc-config-dir into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/20 Reviewed-by: greg <gitea@local.domain>	2026-04-04 18:23:42 +00:00
klaatu	67f12856e1	fix: set MC_CONFIG_DIR to /tmp/.mc so mc can write config as non-root	2026-04-04 18:18:43 +00:00
Greg Hellings	475c0eda64	fix: minio secrets exposed	2026-04-04 13:11:31 -05:00
greg	828d61d818	Merge pull request 'feat: backup improvements — AlbyHub Restic, Gitea dump CronJob, Immich → MinIO' (#17) from klaatu/nixos:feature/backup-improvements into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/17 Reviewed-by: greg <gitea@local.domain>	2026-04-04 18:00:16 +00:00
klaatu	0218447008	fix: address review feedback on backup improvements ... - manifests/gitea/dump-cronjob.yaml: Remove --skip-log, --skip-custom-dir, --skip-db flags to make backup complete - manifests/gitea/dump-cronjob.yaml: Replace NFS volume + cleanup container with S3 upload to backup-gitea bucket using MinIO client (mc). 30-day lifecycle set via mc ilm. Uses minio_key/minio_secret from existing gitea-config secret. - hosts/unstable/hosea/default.nix: Replace raw services.restic.backups.albyhub block with greg.backup.jobs.albyhub using the greg.backup module. Remove manual age.secrets.restic-env and age.secrets.restic-pw entries since the greg.backup module declares them.	2026-04-04 02:05:03 -05:00
klaatu	2741be72c7	feat: add update-manifests workflow	2026-04-04 06:18:14 +00:00
klaatu	e8beb7f2a9	feat: add update-flake-lock workflow	2026-04-04 06:18:12 +00:00
klaatu	b2728bf1de	feat: add gitea-runner NixOS module	2026-04-04 06:18:10 +00:00
klaatu	d65dcb51a3	feat: add gitea-runner secret placeholder	2026-04-04 06:18:07 +00:00
klaatu	87bc9a21d9	feat: add gitea-runner kustomization	2026-04-04 06:18:04 +00:00
klaatu	ca25dde780	feat: add gitea-runner FluxCD HelmRelease	2026-04-04 06:18:01 +00:00
klaatu	c61900f9e6	feat: add gitea-runner namespace manifest	2026-04-04 06:17:59 +00:00
klaatu	1077d357ca	feat(immich): switch backup to rclone sync → MinIO immich bucket on nas1	2026-04-04 06:13:43 +00:00
klaatu	6b84824a53	feat(gitea): add dump-cronjob to kustomization	2026-04-04 06:13:00 +00:00
klaatu	c74d647ec3	feat(gitea): add daily dump CronJob writing to NAS1 NFS	2026-04-04 06:12:56 +00:00
klaatu	58a5c95c32	feat(hosea): add Restic backup for AlbyHub /chain/alby	2026-04-04 06:12:31 +00:00
Greg Hellings	9a26c75884	chore: allow outgoing webhooks	2026-04-03 23:49:27 -05:00
Greg Hellings	276b939252	fix: expose buildbot	2026-04-03 23:49:12 -05:00
greg	3eb44f2958	Merge pull request 'feat: expose Buildbot via nginx proxy on LAN' (#13) from klaatu/nixos:feat/buildbot-proxy into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/13	2026-04-04 03:45:51 +00:00
klaatu	9bbdb74f85	fix: merge conflict — keep both nebula.enable and buildbot proxies	2026-04-03 22:18:17 -05:00
greg	35b6058c09	Merge pull request 'feat: Nebula mesh network overlay' (#12) from klaatu/nixos:feat/nebula-mesh into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/12	2026-04-04 03:03:53 +00:00
Greg Hellings	88d9234332	fix: no default routes	2026-04-02 08:11:32 -05:00
root	eabead05ab	feat: expose Buildbot via nginx proxy on LAN ... Add greg.proxies entries on jeremiah for buildbot.home and buildbot.thehellings.lan, both proxying to http://localhost:8010/. Nginx handles auth passthrough - Buildbot's own Gitea OAuth applies. Add DNS aliases in genesis hosts file: - buildbot.thehellings.lan → 10.42.1.8 (LAN) - buildbot.home → 100.102.186.39 (Tailscale)	2026-04-01 17:31:38 -05:00
Greg Hellings	a1bef073cf	fix: generate linode certs	2026-04-01 17:20:46 -05:00
root	f35e8c755c	fix: only set listen.port on lighthouse/relay nodes (regular nodes use OS-assigned port 0)	2026-04-01 17:14:12 -05:00
root	71ae25a58c	fix: move unsafe_routes to settings.tun.unsafe_routes (correct NixOS nebula option path)	2026-04-01 17:13:37 -05:00
root	0e61efe5b5	fix: rename tun.dev to tun.device (correct NixOS option name)	2026-04-01 17:07:47 -05:00
root	84e4c68f0e	fix: move unsafeRoutes to module default, genesis overrides to [] ... Per review feedback: - nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}] so all regular nodes get home LAN routing automatically - genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop) - exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to nebula.enable = true only, relying on the new default	2026-04-01 16:45:59 -05:00
greg	559155d411	Merge branch 'main' into feat/nebula-mesh	2026-04-01 21:36:08 +00:00
Greg Hellings	2bb0177ffa	chore: add encrypted keys and unencrypted certs	2026-04-01 16:33:59 -05:00
Greg Hellings	15ed4ae5f7	chore: allow click.discord.com	2026-04-01 15:49:32 -05:00
root	792217f640	feat: add Nebula mesh network overlay ... Introduces a greg.nebula NixOS module and enables it across all managed hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16). Architecture: - linode: lighthouse + relay (public internet, UDP 4242) - genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN) - hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes pointing to genesis to reach the home LAN Changes: - modules/nixos/nebula.nix: new greg.nebula module - isLighthouse / isRelay options - unsafeRoutes option (tun.unsafe_routes) - routesSubnet option: enables IP forwarding + nftables masquerade NAT on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16 - agenix secret reference per-host (secrets/nebula/<name>.key.age) - opens UDP/4242 in the firewall - modules/nixos/default.nix: import nebula.nix - hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true - hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16" - hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix: greg.nebula.enable = true with unsafeRoutes via genesis - network.json: add nebulaIp field for each managed host - secrets/secrets.nix: declare nebula/<host>.key.age entries - secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)	2026-03-28 23:24:52 -05:00
greg	ba1914e48c	Merge pull request 'feat: add top-5 fullest PVs panel to Kubernetes dashboard' (#11) from klaatu/nixos:feat/k8s-volume-dashboard into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/11	2026-03-27 15:25:44 +00:00
root	07b3601206	feat: add top-5 fullest PVs panel to Kubernetes dashboard ... Add a horizontal bar gauge showing the disk usage % of the 5 most-full PersistentVolumes in the cluster, using kubelet volume stats already scraped by Prometheus: topk(5, kubelet_volume_stats_used_bytes / kubelet_volume_stats_capacity_bytes * 100) Labels show namespace/PVC name. Color thresholds: green <70%, yellow 70–90%, red >90%. Placed at the bottom of the dashboard (y=46). Bump dashboard version to 3.	2026-03-27 09:06:19 -05:00
Greg Hellings	93458eb6d4	chore: slight updates to Network dashboard	2026-03-27 09:03:07 -05:00
greg	6f7b3c238e	Merge pull request 'fix: correct unpoller metric names in Network & UniFi dashboard' (#10) from klaatu/nixos:fix/network-dashboard-metrics into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/10 Reviewed-by: greg <gitea@local.domain>	2026-03-27 13:51:18 +00:00
root	de0b8fb07e	fix: correct unpoller metric names in network dashboard ... All metrics had wrong prefix (unifipoller_ → unpoller_) and several had incorrect names entirely. Corrected against unpoller master source (pkg/promunifi/): - unifipoller_device_uptime_seconds → unpoller_device_uptime_seconds - unifipoller_port_receive_bytes_total → unpoller_device_port_receive_bytes_total (port metrics live under device_ namespace: unpoller_device_port_*) - unifipoller_port_transmit_bytes_total → unpoller_device_port_transmit_bytes_total - unifipoller_device_wan_receive_bytes_total → unpoller_wan_max_rx_bytes_rate (no per-device WAN bytes total counter; WAN ns is unpoller_wan_*; rate metrics are already instantaneous gauges, no rate() wrapper) - unifipoller_device_wan_transmit_bytes_total → unpoller_wan_max_tx_bytes_rate - unifipoller_client_wifi_tx_rate_bps → count(unpoller_client_uptime_seconds{wired="false"}) (no wifi-specific rate metric; wired label distinguishes client types) - unifipoller_client_wired_tx_rate_bps → count(unpoller_client_uptime_seconds{wired="true"}) - unifipoller_client_receive_bytes_total → unpoller_client_receive_bytes_total - unifipoller_client_transmit_bytes_total → unpoller_client_transmit_bytes_total Bump dashboard version to 3.	2026-03-27 08:44:12 -05:00