1592 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Greg Hellings	475c0eda64	fix: minio secrets exposed	2026-04-04 13:11:31 -05:00
greg	828d61d818	Merge pull request 'feat: backup improvements — AlbyHub Restic, Gitea dump CronJob, Immich → MinIO' (#17) from klaatu/nixos:feature/backup-improvements into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/17 Reviewed-by: greg <gitea@local.domain>	2026-04-04 18:00:16 +00:00
klaatu	0218447008	fix: address review feedback on backup improvements ... - manifests/gitea/dump-cronjob.yaml: Remove --skip-log, --skip-custom-dir, --skip-db flags to make backup complete - manifests/gitea/dump-cronjob.yaml: Replace NFS volume + cleanup container with S3 upload to backup-gitea bucket using MinIO client (mc). 30-day lifecycle set via mc ilm. Uses minio_key/minio_secret from existing gitea-config secret. - hosts/unstable/hosea/default.nix: Replace raw services.restic.backups.albyhub block with greg.backup.jobs.albyhub using the greg.backup module. Remove manual age.secrets.restic-env and age.secrets.restic-pw entries since the greg.backup module declares them.	2026-04-04 02:05:03 -05:00
klaatu	1077d357ca	feat(immich): switch backup to rclone sync → MinIO immich bucket on nas1	2026-04-04 06:13:43 +00:00
klaatu	6b84824a53	feat(gitea): add dump-cronjob to kustomization	2026-04-04 06:13:00 +00:00
klaatu	c74d647ec3	feat(gitea): add daily dump CronJob writing to NAS1 NFS	2026-04-04 06:12:56 +00:00
klaatu	58a5c95c32	feat(hosea): add Restic backup for AlbyHub /chain/alby	2026-04-04 06:12:31 +00:00
Greg Hellings	9a26c75884	chore: allow outgoing webhooks	2026-04-03 23:49:27 -05:00
Greg Hellings	276b939252	fix: expose buildbot	2026-04-03 23:49:12 -05:00
greg	3eb44f2958	Merge pull request 'feat: expose Buildbot via nginx proxy on LAN' (#13) from klaatu/nixos:feat/buildbot-proxy into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/13	2026-04-04 03:45:51 +00:00
klaatu	9bbdb74f85	fix: merge conflict — keep both nebula.enable and buildbot proxies	2026-04-03 22:18:17 -05:00
greg	35b6058c09	Merge pull request 'feat: Nebula mesh network overlay' (#12) from klaatu/nixos:feat/nebula-mesh into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/12	2026-04-04 03:03:53 +00:00
Greg Hellings	88d9234332	fix: no default routes	2026-04-02 08:11:32 -05:00
root	eabead05ab	feat: expose Buildbot via nginx proxy on LAN ... Add greg.proxies entries on jeremiah for buildbot.home and buildbot.thehellings.lan, both proxying to http://localhost:8010/. Nginx handles auth passthrough - Buildbot's own Gitea OAuth applies. Add DNS aliases in genesis hosts file: - buildbot.thehellings.lan → 10.42.1.8 (LAN) - buildbot.home → 100.102.186.39 (Tailscale)	2026-04-01 17:31:38 -05:00
Greg Hellings	a1bef073cf	fix: generate linode certs	2026-04-01 17:20:46 -05:00
root	f35e8c755c	fix: only set listen.port on lighthouse/relay nodes (regular nodes use OS-assigned port 0)	2026-04-01 17:14:12 -05:00
root	71ae25a58c	fix: move unsafe_routes to settings.tun.unsafe_routes (correct NixOS nebula option path)	2026-04-01 17:13:37 -05:00
root	0e61efe5b5	fix: rename tun.dev to tun.device (correct NixOS option name)	2026-04-01 17:07:47 -05:00
root	84e4c68f0e	fix: move unsafeRoutes to module default, genesis overrides to [] ... Per review feedback: - nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}] so all regular nodes get home LAN routing automatically - genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop) - exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to nebula.enable = true only, relying on the new default	2026-04-01 16:45:59 -05:00
greg	559155d411	Merge branch 'main' into feat/nebula-mesh	2026-04-01 21:36:08 +00:00
Greg Hellings	2bb0177ffa	chore: add encrypted keys and unencrypted certs	2026-04-01 16:33:59 -05:00
Greg Hellings	15ed4ae5f7	chore: allow click.discord.com	2026-04-01 15:49:32 -05:00
root	792217f640	feat: add Nebula mesh network overlay ... Introduces a greg.nebula NixOS module and enables it across all managed hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16). Architecture: - linode: lighthouse + relay (public internet, UDP 4242) - genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN) - hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes pointing to genesis to reach the home LAN Changes: - modules/nixos/nebula.nix: new greg.nebula module - isLighthouse / isRelay options - unsafeRoutes option (tun.unsafe_routes) - routesSubnet option: enables IP forwarding + nftables masquerade NAT on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16 - agenix secret reference per-host (secrets/nebula/<name>.key.age) - opens UDP/4242 in the firewall - modules/nixos/default.nix: import nebula.nix - hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true - hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16" - hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix: greg.nebula.enable = true with unsafeRoutes via genesis - network.json: add nebulaIp field for each managed host - secrets/secrets.nix: declare nebula/<host>.key.age entries - secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)	2026-03-28 23:24:52 -05:00
greg	ba1914e48c	Merge pull request 'feat: add top-5 fullest PVs panel to Kubernetes dashboard' (#11) from klaatu/nixos:feat/k8s-volume-dashboard into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/11	2026-03-27 15:25:44 +00:00
root	07b3601206	feat: add top-5 fullest PVs panel to Kubernetes dashboard ... Add a horizontal bar gauge showing the disk usage % of the 5 most-full PersistentVolumes in the cluster, using kubelet volume stats already scraped by Prometheus: topk(5, kubelet_volume_stats_used_bytes / kubelet_volume_stats_capacity_bytes * 100) Labels show namespace/PVC name. Color thresholds: green <70%, yellow 70–90%, red >90%. Placed at the bottom of the dashboard (y=46). Bump dashboard version to 3.	2026-03-27 09:06:19 -05:00
Greg Hellings	93458eb6d4	chore: slight updates to Network dashboard	2026-03-27 09:03:07 -05:00
greg	6f7b3c238e	Merge pull request 'fix: correct unpoller metric names in Network & UniFi dashboard' (#10) from klaatu/nixos:fix/network-dashboard-metrics into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/10 Reviewed-by: greg <gitea@local.domain>	2026-03-27 13:51:18 +00:00
root	de0b8fb07e	fix: correct unpoller metric names in network dashboard ... All metrics had wrong prefix (unifipoller_ → unpoller_) and several had incorrect names entirely. Corrected against unpoller master source (pkg/promunifi/): - unifipoller_device_uptime_seconds → unpoller_device_uptime_seconds - unifipoller_port_receive_bytes_total → unpoller_device_port_receive_bytes_total (port metrics live under device_ namespace: unpoller_device_port_*) - unifipoller_port_transmit_bytes_total → unpoller_device_port_transmit_bytes_total - unifipoller_device_wan_receive_bytes_total → unpoller_wan_max_rx_bytes_rate (no per-device WAN bytes total counter; WAN ns is unpoller_wan_*; rate metrics are already instantaneous gauges, no rate() wrapper) - unifipoller_device_wan_transmit_bytes_total → unpoller_wan_max_tx_bytes_rate - unifipoller_client_wifi_tx_rate_bps → count(unpoller_client_uptime_seconds{wired="false"}) (no wifi-specific rate metric; wired label distinguishes client types) - unifipoller_client_wired_tx_rate_bps → count(unpoller_client_uptime_seconds{wired="true"}) - unifipoller_client_receive_bytes_total → unpoller_client_receive_bytes_total - unifipoller_client_transmit_bytes_total → unpoller_client_transmit_bytes_total Bump dashboard version to 3.	2026-03-27 08:44:12 -05:00
greg	3111548c99	Merge pull request 'feat: kube-state-metrics, Restic ExternalSecret, updated dashboards' (#9) from klaatu/nixos:fix/observability-complete into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/9 Reviewed-by: greg <gitea@local.domain>	2026-03-27 13:27:30 +00:00
Greg Hellings	841224b20f	fix: update external-secrets apiVersion	2026-03-27 08:27:03 -05:00
klaatuandGreg Hellings	45536f4a8d	feat: update kubernetes and network Grafana dashboards	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	4717763fed	feat: add restic ExternalSecret for Prometheus basic auth	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	53f33eb13a	feat: add kube-state-metrics	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	b18807b1ef	feat: add kube-state-metrics.yaml and restic-secret.yaml to kustomization	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	2c0b4b1472	feat: add kube_state_metrics job, restic basic_auth, remove kea job	2026-03-27 08:19:40 -05:00
klaatuandGreg Hellings	d713e5104c	feat: mount restic-credentials secret into Prometheus	2026-03-27 08:18:53 -05:00
Greg Hellings	e9a4662620	fix: open kubelet/cadvisor prometheus ports	2026-03-26 05:58:52 -05:00
Greg Hellings	eba1a0c1ca	fix: make restic https	2026-03-26 05:56:21 -05:00
Greg Hellings	4eb5d6873a	chore: remove unused kea configuration	2026-03-26 05:45:16 -05:00
greg	71f553a6f2	Merge pull request 'fix: add missing shire-zebra.ts.net DNS entries; update exodus Tailscale IP' (#8) from klaatu/nixos:fix/tailscale-dns-entries into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/8	2026-03-26 02:48:34 +00:00
root	8e218a71e0	fix: add missing shire-zebra.ts.net DNS entries; update exodus Tailscale IP ... genesis, zeke, linode, and exodus were missing shire-zebra.ts.net aliases in the genesis dnsmasq hosts file. Only hosea, isaiah, jeremiah, gitlab, matrix, chronicles, and nas1 had them. Since genesis is the DNS server for the whole network, Prometheus (and everything else) couldn't resolve those four hostnames, causing instant connection failures on scrape. Also update exodus Tailscale IP from 100.80.99.48 to 100.70.99.91 (stale IP in both network.json and the hosts file).	2026-03-25 21:12:51 -05:00
greg	fe65f34c05	Merge pull request 'fix: disable Grafana enforce_domain to allow LAN proxy access' (#6) from klaatu/nixos:fix/grafana-enforce-domain into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/6	2026-03-25 22:42:16 +00:00
root	053e383046	fix: disable Grafana enforce_domain to allow LAN proxy access ... With enforce_domain = true, Grafana redirects any request not matching the configured domain (hosea.shire-zebra.ts.net) back to that hostname. Since the nginx proxy serves Grafana at grafana.thehellings.lan, every proxied request gets redirected to the Tailscale address, making the proxy useless for non-Tailscale clients. The domain setting is still correct for cookie scoping; enforce_domain is only needed if direct port access is a concern, which is mitigated by the firewall (port 3001 is not open on the LAN).	2026-03-25 17:40:38 -05:00
Greg Hellings	ffff7e9683	Merge branch 'main' of srcpub:greg/nixos	2026-03-25 17:38:28 -05:00
greg	68fdf7c37c	Merge pull request 'fix: open ports 80/443 in proxy module when proxies are configured' (#5) from klaatu/nixos:fix/proxy-firewall into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/5	2026-03-25 22:37:43 +00:00
root	a5719c4e02	fix: open ports 80/443 in proxy module when proxies are configured ... The greg.proxies module enables nginx but never opened the firewall, so all proxied services (Jellyfin, Grafana, etc.) were unreachable on the LAN. Add allowedTCPPorts [80 443] conditioned on the same mkIf guard as the nginx virtualHosts config.	2026-03-25 17:35:52 -05:00
Greg Hellings	1dd63dd90c	Merge branch 'main' of srcpub:greg/nixos	2026-03-25 17:29:04 -05:00
greg	c2f454f876	Merge pull request 'feat: proxy Grafana via nginx on hosea LAN hostnames' (#4) from klaatu/nixos:feat/grafana-proxy into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/4	2026-03-25 22:26:06 +00:00
root	b143543ba1	feat: add grafana DNS entries to genesis hosts file ... Add grafana.thehellings.lan (LAN) and grafana.home (Tailscale) pointing at hosea's respective addresses, matching the pattern used for jellyfin and other hosea-hosted services.	2026-03-25 17:22:54 -05:00
root	fb5daa3be7	feat: proxy Grafana via nginx on hosea LAN hostnames ... Add grafana.home and grafana.thehellings.lan nginx proxy entries pointing at localhost:3001. This allows LAN clients (and Klaatu) to reach Grafana without Tailscale or direct port access, working around the enforce_domain restriction on hosea.shire-zebra.ts.net.	2026-03-25 17:21:21 -05:00