1584 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Greg Hellings	276b939252	fix: expose buildbot	2026-04-03 23:49:12 -05:00
greg	3eb44f2958	Merge pull request 'feat: expose Buildbot via nginx proxy on LAN' (#13) from klaatu/nixos:feat/buildbot-proxy into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/13	2026-04-04 03:45:51 +00:00
klaatu	9bbdb74f85	fix: merge conflict — keep both nebula.enable and buildbot proxies	2026-04-03 22:18:17 -05:00
greg	35b6058c09	Merge pull request 'feat: Nebula mesh network overlay' (#12) from klaatu/nixos:feat/nebula-mesh into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/12	2026-04-04 03:03:53 +00:00
Greg Hellings	88d9234332	fix: no default routes	2026-04-02 08:11:32 -05:00
root	eabead05ab	feat: expose Buildbot via nginx proxy on LAN ... Add greg.proxies entries on jeremiah for buildbot.home and buildbot.thehellings.lan, both proxying to http://localhost:8010/. Nginx handles auth passthrough - Buildbot's own Gitea OAuth applies. Add DNS aliases in genesis hosts file: - buildbot.thehellings.lan → 10.42.1.8 (LAN) - buildbot.home → 100.102.186.39 (Tailscale)	2026-04-01 17:31:38 -05:00
Greg Hellings	a1bef073cf	fix: generate linode certs	2026-04-01 17:20:46 -05:00
root	f35e8c755c	fix: only set listen.port on lighthouse/relay nodes (regular nodes use OS-assigned port 0)	2026-04-01 17:14:12 -05:00
root	71ae25a58c	fix: move unsafe_routes to settings.tun.unsafe_routes (correct NixOS nebula option path)	2026-04-01 17:13:37 -05:00
root	0e61efe5b5	fix: rename tun.dev to tun.device (correct NixOS option name)	2026-04-01 17:07:47 -05:00
root	84e4c68f0e	fix: move unsafeRoutes to module default, genesis overrides to [] ... Per review feedback: - nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}] so all regular nodes get home LAN routing automatically - genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop) - exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to nebula.enable = true only, relying on the new default	2026-04-01 16:45:59 -05:00
greg	559155d411	Merge branch 'main' into feat/nebula-mesh	2026-04-01 21:36:08 +00:00
Greg Hellings	2bb0177ffa	chore: add encrypted keys and unencrypted certs	2026-04-01 16:33:59 -05:00
Greg Hellings	15ed4ae5f7	chore: allow click.discord.com	2026-04-01 15:49:32 -05:00
root	792217f640	feat: add Nebula mesh network overlay ... Introduces a greg.nebula NixOS module and enables it across all managed hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16). Architecture: - linode: lighthouse + relay (public internet, UDP 4242) - genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN) - hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes pointing to genesis to reach the home LAN Changes: - modules/nixos/nebula.nix: new greg.nebula module - isLighthouse / isRelay options - unsafeRoutes option (tun.unsafe_routes) - routesSubnet option: enables IP forwarding + nftables masquerade NAT on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16 - agenix secret reference per-host (secrets/nebula/<name>.key.age) - opens UDP/4242 in the firewall - modules/nixos/default.nix: import nebula.nix - hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true - hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16" - hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix: greg.nebula.enable = true with unsafeRoutes via genesis - network.json: add nebulaIp field for each managed host - secrets/secrets.nix: declare nebula/<host>.key.age entries - secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)	2026-03-28 23:24:52 -05:00
greg	ba1914e48c	Merge pull request 'feat: add top-5 fullest PVs panel to Kubernetes dashboard' (#11) from klaatu/nixos:feat/k8s-volume-dashboard into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/11	2026-03-27 15:25:44 +00:00
root	07b3601206	feat: add top-5 fullest PVs panel to Kubernetes dashboard ... Add a horizontal bar gauge showing the disk usage % of the 5 most-full PersistentVolumes in the cluster, using kubelet volume stats already scraped by Prometheus: topk(5, kubelet_volume_stats_used_bytes / kubelet_volume_stats_capacity_bytes * 100) Labels show namespace/PVC name. Color thresholds: green <70%, yellow 70–90%, red >90%. Placed at the bottom of the dashboard (y=46). Bump dashboard version to 3.	2026-03-27 09:06:19 -05:00
Greg Hellings	93458eb6d4	chore: slight updates to Network dashboard	2026-03-27 09:03:07 -05:00
greg	6f7b3c238e	Merge pull request 'fix: correct unpoller metric names in Network & UniFi dashboard' (#10) from klaatu/nixos:fix/network-dashboard-metrics into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/10 Reviewed-by: greg <gitea@local.domain>	2026-03-27 13:51:18 +00:00
root	de0b8fb07e	fix: correct unpoller metric names in network dashboard ... All metrics had wrong prefix (unifipoller_ → unpoller_) and several had incorrect names entirely. Corrected against unpoller master source (pkg/promunifi/): - unifipoller_device_uptime_seconds → unpoller_device_uptime_seconds - unifipoller_port_receive_bytes_total → unpoller_device_port_receive_bytes_total (port metrics live under device_ namespace: unpoller_device_port_*) - unifipoller_port_transmit_bytes_total → unpoller_device_port_transmit_bytes_total - unifipoller_device_wan_receive_bytes_total → unpoller_wan_max_rx_bytes_rate (no per-device WAN bytes total counter; WAN ns is unpoller_wan_*; rate metrics are already instantaneous gauges, no rate() wrapper) - unifipoller_device_wan_transmit_bytes_total → unpoller_wan_max_tx_bytes_rate - unifipoller_client_wifi_tx_rate_bps → count(unpoller_client_uptime_seconds{wired="false"}) (no wifi-specific rate metric; wired label distinguishes client types) - unifipoller_client_wired_tx_rate_bps → count(unpoller_client_uptime_seconds{wired="true"}) - unifipoller_client_receive_bytes_total → unpoller_client_receive_bytes_total - unifipoller_client_transmit_bytes_total → unpoller_client_transmit_bytes_total Bump dashboard version to 3.	2026-03-27 08:44:12 -05:00
greg	3111548c99	Merge pull request 'feat: kube-state-metrics, Restic ExternalSecret, updated dashboards' (#9) from klaatu/nixos:fix/observability-complete into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/9 Reviewed-by: greg <gitea@local.domain>	2026-03-27 13:27:30 +00:00
Greg Hellings	841224b20f	fix: update external-secrets apiVersion	2026-03-27 08:27:03 -05:00
klaatuandGreg Hellings	45536f4a8d	feat: update kubernetes and network Grafana dashboards	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	4717763fed	feat: add restic ExternalSecret for Prometheus basic auth	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	53f33eb13a	feat: add kube-state-metrics	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	b18807b1ef	feat: add kube-state-metrics.yaml and restic-secret.yaml to kustomization	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	2c0b4b1472	feat: add kube_state_metrics job, restic basic_auth, remove kea job	2026-03-27 08:19:40 -05:00
klaatuandGreg Hellings	d713e5104c	feat: mount restic-credentials secret into Prometheus	2026-03-27 08:18:53 -05:00
Greg Hellings	e9a4662620	fix: open kubelet/cadvisor prometheus ports	2026-03-26 05:58:52 -05:00
Greg Hellings	eba1a0c1ca	fix: make restic https	2026-03-26 05:56:21 -05:00
Greg Hellings	4eb5d6873a	chore: remove unused kea configuration	2026-03-26 05:45:16 -05:00
greg	71f553a6f2	Merge pull request 'fix: add missing shire-zebra.ts.net DNS entries; update exodus Tailscale IP' (#8) from klaatu/nixos:fix/tailscale-dns-entries into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/8	2026-03-26 02:48:34 +00:00
root	8e218a71e0	fix: add missing shire-zebra.ts.net DNS entries; update exodus Tailscale IP ... genesis, zeke, linode, and exodus were missing shire-zebra.ts.net aliases in the genesis dnsmasq hosts file. Only hosea, isaiah, jeremiah, gitlab, matrix, chronicles, and nas1 had them. Since genesis is the DNS server for the whole network, Prometheus (and everything else) couldn't resolve those four hostnames, causing instant connection failures on scrape. Also update exodus Tailscale IP from 100.80.99.48 to 100.70.99.91 (stale IP in both network.json and the hosts file).	2026-03-25 21:12:51 -05:00
greg	fe65f34c05	Merge pull request 'fix: disable Grafana enforce_domain to allow LAN proxy access' (#6) from klaatu/nixos:fix/grafana-enforce-domain into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/6	2026-03-25 22:42:16 +00:00
root	053e383046	fix: disable Grafana enforce_domain to allow LAN proxy access ... With enforce_domain = true, Grafana redirects any request not matching the configured domain (hosea.shire-zebra.ts.net) back to that hostname. Since the nginx proxy serves Grafana at grafana.thehellings.lan, every proxied request gets redirected to the Tailscale address, making the proxy useless for non-Tailscale clients. The domain setting is still correct for cookie scoping; enforce_domain is only needed if direct port access is a concern, which is mitigated by the firewall (port 3001 is not open on the LAN).	2026-03-25 17:40:38 -05:00
Greg Hellings	ffff7e9683	Merge branch 'main' of srcpub:greg/nixos	2026-03-25 17:38:28 -05:00
greg	68fdf7c37c	Merge pull request 'fix: open ports 80/443 in proxy module when proxies are configured' (#5) from klaatu/nixos:fix/proxy-firewall into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/5	2026-03-25 22:37:43 +00:00
root	a5719c4e02	fix: open ports 80/443 in proxy module when proxies are configured ... The greg.proxies module enables nginx but never opened the firewall, so all proxied services (Jellyfin, Grafana, etc.) were unreachable on the LAN. Add allowedTCPPorts [80 443] conditioned on the same mkIf guard as the nginx virtualHosts config.	2026-03-25 17:35:52 -05:00
Greg Hellings	1dd63dd90c	Merge branch 'main' of srcpub:greg/nixos	2026-03-25 17:29:04 -05:00
greg	c2f454f876	Merge pull request 'feat: proxy Grafana via nginx on hosea LAN hostnames' (#4) from klaatu/nixos:feat/grafana-proxy into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/4	2026-03-25 22:26:06 +00:00
root	b143543ba1	feat: add grafana DNS entries to genesis hosts file ... Add grafana.thehellings.lan (LAN) and grafana.home (Tailscale) pointing at hosea's respective addresses, matching the pattern used for jellyfin and other hosea-hosted services.	2026-03-25 17:22:54 -05:00
root	fb5daa3be7	feat: proxy Grafana via nginx on hosea LAN hostnames ... Add grafana.home and grafana.thehellings.lan nginx proxy entries pointing at localhost:3001. This allows LAN clients (and Klaatu) to reach Grafana without Tailscale or direct port access, working around the enforce_domain restriction on hosea.shire-zebra.ts.net.	2026-03-25 17:21:21 -05:00
Greg Hellings	3fab3b5c6b	Merge branch 'main' of srcpub:greg/nixos	2026-03-25 16:40:32 -05:00
greg	9b8f883de5	Merge pull request 'fix: two observability bugs from initial deployment' (#3) from klaatu/nixos:fix/observability-bugs into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/3	2026-03-25 21:40:06 +00:00
root	2d874d3969	fix: two observability bugs from initial deployment ... Fix 1 - UnPoller 404 on UDM Pro: Remove :8443 from UP_UNIFI_DEFAULT_URL. UniFi OS devices (UDM Pro, UDM, UXG, CloudKey) use a different API path and do NOT use port 8443. URL should be https://10.42.1.1 (no port); unpoller handles the /proxy/network path internally for UniFi OS devices. Fix 2 - Grafana dashboards showing invalid datasource: Add uid = "prometheus" to the provisioned Prometheus datasource. Without an explicit UID, Grafana auto-generates one on first run. All dashboard JSON references datasource uid "prometheus" which only works if the provisioning explicitly sets that UID.	2026-03-25 12:37:29 -05:00
Greg Hellings	7579b2b7a1	fix: Grafana network port	2026-03-25 12:24:03 -05:00
Greg Hellings	1a578ff032	fix: add grafana file and open Grafana port	2026-03-25 11:40:00 -05:00
root	4eebf07f6b	fix: scope prometheus exporter firewall rules to home hosts only ... Move allowedTCPPorts for node/ping/systemd/blackbox exporters from hosts/baseline.nix (applies to ALL hosts including linode) into modules/nixos/home.nix (applies only to greg.home = true hosts). This prevents ports 9100/9115/9427/9558 from being opened on linode, which is internet-facing. All LAN hosts set greg.home = true and will still get the ports opened; linode sets greg.home = false and will not.	2026-03-25 09:46:26 -05:00
root	df2f9d69fe	fix: address PR feedback + expand infrastructure coverage ... - Replace unpoller-credentials plain Secret with ExternalSecret pulling from Bitwarden item 15bfc957-5de5-49b2-ab6c-b41800e71564 via bitwarden-login ClusterSecretStore (username + password) - Pull UP_UNIFI_DEFAULT_USER from secret as well (was hardcoded) - Add OpenWRT access point (10.42.0.3) to genesis DNS hosts file as ap.thehellings.lan (discovered during network scan) - Add blackbox exporter to genesis (port 9115, ICMP module) for probing non-NixOS infrastructure that has no node_exporter: OpenWRT AP, Joel, pve1, chronicles, nas1, odoo, mattermost, homeassistant, USW-Pro-HD-24 UniFi switch - Add infra_ping scrape job to Prometheus using blackbox prober targeting all non-NixOS LAN hosts via genesis blackbox exporter	2026-03-25 09:25:16 -05:00
root	ab6e1d24fe	feat: comprehensive observability stack ... - Add restic_backups and mattermost scrape jobs to Prometheus config - Add UnPoller deployment+service+secret for UniFi metrics (unpoller.yaml) - Add unifi scrape job targeting unpoller in-cluster - Add 4 Grafana dashboards as NixOS-managed etc files on hosea: - system-health: CPU, memory, disk, network per host - backup-health: restic backup freshness and duration - kubernetes: pod counts, restart rates, node resources - network: DNS queries, DHCP leases, UniFi ports, ping latency - Add grafana-api-token agenix secret placeholder on hosea - Open firewall ports 9100/9427/9558 for prometheus exporters in baseline.nix	2026-03-25 09:23:31 -05:00