21 Commits

Include renames

Author	SHA1	Message	Date
Greg Hellings	307dbbe044	fix: do not claim mastery of TS net	2026-05-30 00:24:36 -05:00
Greg Hellings	95eea6fc26	fix: enable s3 DNS aliases	2026-05-19 23:47:42 -05:00
Greg Hellings	2a476a7bfe	chore: update refined-storage to release	2026-05-18 12:45:34 -05:00
Greg Hellings	fc4430e4f1	fix: system build fixes for new package setup	2026-05-13 08:33:48 -05:00
Greg Hellings	985dd927c4	chore: move from attic to niks3	2026-05-12 21:25:24 -05:00
Greg Hellings	2932e9e335	chore: remove vm-gitlab which is no longer in use	2026-04-30 16:06:58 -05:00
Greg Hellings	c939d67cb6	chore: allow genesis to use its own DNS	2026-04-29 16:11:20 -05:00
Greg Hellings	600aa885d4	chore: add minecraft server	2026-04-29 16:10:31 -05:00
Greg Hellings	f8cc47614f	chore: remove unused genesis config bits	2026-04-24 18:56:10 -05:00
Greg Hellings	8509fff746	chore: upgrade from dnsmasq to bind	2026-04-19 01:04:41 -05:00
klaatu	9bbdb74f85	fix: merge conflict — keep both nebula.enable and buildbot proxies	2026-04-03 22:18:17 -05:00
root	eabead05ab	feat: expose Buildbot via nginx proxy on LAN ... Add greg.proxies entries on jeremiah for buildbot.home and buildbot.thehellings.lan, both proxying to http://localhost:8010/. Nginx handles auth passthrough - Buildbot's own Gitea OAuth applies. Add DNS aliases in genesis hosts file: - buildbot.thehellings.lan → 10.42.1.8 (LAN) - buildbot.home → 100.102.186.39 (Tailscale)	2026-04-01 17:31:38 -05:00
root	84e4c68f0e	fix: move unsafeRoutes to module default, genesis overrides to [] ... Per review feedback: - nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}] so all regular nodes get home LAN routing automatically - genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop) - exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to nebula.enable = true only, relying on the new default	2026-04-01 16:45:59 -05:00
greg	559155d411	Merge branch 'main' into feat/nebula-mesh	2026-04-01 21:36:08 +00:00
Greg Hellings	15ed4ae5f7	chore: allow click.discord.com	2026-04-01 15:49:32 -05:00
root	792217f640	feat: add Nebula mesh network overlay ... Introduces a greg.nebula NixOS module and enables it across all managed hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16). Architecture: - linode: lighthouse + relay (public internet, UDP 4242) - genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN) - hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes pointing to genesis to reach the home LAN Changes: - modules/nixos/nebula.nix: new greg.nebula module - isLighthouse / isRelay options - unsafeRoutes option (tun.unsafe_routes) - routesSubnet option: enables IP forwarding + nftables masquerade NAT on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16 - agenix secret reference per-host (secrets/nebula/<name>.key.age) - opens UDP/4242 in the firewall - modules/nixos/default.nix: import nebula.nix - hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true - hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16" - hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix: greg.nebula.enable = true with unsafeRoutes via genesis - network.json: add nebulaIp field for each managed host - secrets/secrets.nix: declare nebula/<host>.key.age entries - secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)	2026-03-28 23:24:52 -05:00
Greg Hellings	4eb5d6873a	chore: remove unused kea configuration	2026-03-26 05:45:16 -05:00
root	8e218a71e0	fix: add missing shire-zebra.ts.net DNS entries; update exodus Tailscale IP ... genesis, zeke, linode, and exodus were missing shire-zebra.ts.net aliases in the genesis dnsmasq hosts file. Only hosea, isaiah, jeremiah, gitlab, matrix, chronicles, and nas1 had them. Since genesis is the DNS server for the whole network, Prometheus (and everything else) couldn't resolve those four hostnames, causing instant connection failures on scrape. Also update exodus Tailscale IP from 100.80.99.48 to 100.70.99.91 (stale IP in both network.json and the hosts file).	2026-03-25 21:12:51 -05:00
root	b143543ba1	feat: add grafana DNS entries to genesis hosts file ... Add grafana.thehellings.lan (LAN) and grafana.home (Tailscale) pointing at hosea's respective addresses, matching the pattern used for jellyfin and other hosea-hosted services.	2026-03-25 17:22:54 -05:00
root	df2f9d69fe	fix: address PR feedback + expand infrastructure coverage ... - Replace unpoller-credentials plain Secret with ExternalSecret pulling from Bitwarden item 15bfc957-5de5-49b2-ab6c-b41800e71564 via bitwarden-login ClusterSecretStore (username + password) - Pull UP_UNIFI_DEFAULT_USER from secret as well (was hardcoded) - Add OpenWRT access point (10.42.0.3) to genesis DNS hosts file as ap.thehellings.lan (discovered during network scan) - Add blackbox exporter to genesis (port 9115, ICMP module) for probing non-NixOS infrastructure that has no node_exporter: OpenWRT AP, Joel, pve1, chronicles, nas1, odoo, mattermost, homeassistant, USW-Pro-HD-24 UniFi switch - Add infra_ping scrape job to Prometheus using blackbox prober targeting all non-NixOS LAN hosts via genesis blackbox exporter	2026-03-25 09:25:16 -05:00
Greg Hellings	e2181f124a	chore: dynamic hosts, builder targets ... Make hosts read from directories, to limit manual changes Rename vm-gitlab -> gitlab A few reformatting and lint changes due to altered files Create builder targets for Darwin builders	2026-02-17 16:11:29 -06:00