692 Commits

Include renames

Author	SHA1	Message	Date
Greg Hellings	21cb84ac7a	Major update for linode and Nebula ... * Consolidate Linode into a single file * Convert gitea and matrix to using Nebula connections * Have Linode proxy to Nebula connections instead of Tailscale * Update Acme to use DNS-01 * Update Flake to pull from branch that supports ACME 5.x client	2026-08-01 14:38:01 -05:00
Greg Hellings	1c52f8a6b9	chore: baseline nixos for proxmox configuration	2026-07-28 22:42:21 -05:00
Greg Hellings	93a847c658	chore: get kuma up and running	2026-07-28 22:40:17 -05:00
Greg Hellings	42efe476db	chore: update framework firmware settings	2026-07-26 21:36:46 -05:00
Greg Hellings	64a253e9e4	chore: remove proxmoxtemplate entries as well	2026-07-25 15:48:04 -05:00
Greg Hellings	e4008a0beb	chore: remove icdm-root as well	2026-07-25 15:45:21 -05:00
Greg Hellings	363098c0a1	chore: remove references to hermes	2026-07-25 15:43:27 -05:00
Greg Hellings	a07068a4fb	chore: remove unused attic reference	2026-07-25 15:39:30 -05:00
Greg Hellings	389798c4f0	chore: buildbot over Nebula	2026-07-25 15:38:28 -05:00
Greg Hellings	475fe50d19	Expand Nebula ... * Add Nebula to Kubernetes node * Update k3s nodes to support nebula keepalived * Move external IPs to a separate structure	2026-07-25 15:18:15 -05:00
Greg Hellings	b3304c0ef5	chore: migrate to Garage	2026-07-25 11:40:35 -05:00
Greg Hellings	067c00330b	chore: enable Hermes agent Matrix connection	2026-07-21 20:49:26 -05:00
Greg Hellings	60e2450c66	chore: proxy hermes dashboard	2026-07-21 20:04:23 -05:00
Greg Hellings	348a1d7301	fix: get Hermes host built	2026-07-21 19:07:39 -05:00
Greg Hellings	d2f7b85283	chore: bring hermes into nebula	2026-07-21 17:16:37 -05:00
Greg Hellings	3e60f73251	chore: initial configuration for Hermes	2026-07-21 16:11:39 -05:00
Greg Hellings	4f79033b04	chore: add Proxmox CT baseline	2026-07-13 18:18:54 -05:00
Greg Hellings	394c2c2aba	chore: arr to NAS	2026-06-04 13:31:26 -05:00
Greg Hellings	307dbbe044	fix: do not claim mastery of TS net	2026-05-30 00:24:36 -05:00
Greg Hellings	69651258d6	chore: connect buildbot and gitea by tailscale	2026-05-28 16:57:05 -05:00
Greg Hellings	53c491f537	fix: buildbot domain name	2026-05-26 07:48:39 -05:00
rootandGreg Hellings	e6217401f9	feat(gitea): add Anubis anti-crawler proxy ... Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work challenge that protects web services from AI crawlers and scrapers.	2026-05-24 21:25:50 -05:00
Greg Hellings	75e71f9ce9	fix: get Matrix running again	2026-05-20 03:27:45 -05:00
Greg Hellings	95eea6fc26	fix: enable s3 DNS aliases	2026-05-19 23:47:42 -05:00
Greg Hellings	2a476a7bfe	chore: update refined-storage to release	2026-05-18 12:45:34 -05:00
Greg Hellings	fc4430e4f1	fix: system build fixes for new package setup	2026-05-13 08:33:48 -05:00
Greg Hellings	f735423d98	chore: make zims separate packages	2026-05-13 08:06:57 -05:00
Greg Hellings	985dd927c4	chore: move from attic to niks3	2026-05-12 21:25:24 -05:00
Greg Hellings	2932e9e335	chore: remove vm-gitlab which is no longer in use	2026-04-30 16:06:58 -05:00
Greg Hellings	c939d67cb6	chore: allow genesis to use its own DNS	2026-04-29 16:11:20 -05:00
Greg Hellings	600aa885d4	chore: add minecraft server	2026-04-29 16:10:31 -05:00
Greg Hellings	f8cc47614f	chore: remove unused genesis config bits	2026-04-24 18:56:10 -05:00
Greg Hellings	088c1a0033	chore: add new uuid for zeke	2026-04-22 21:01:42 -05:00
Greg Hellings	8509fff746	chore: upgrade from dnsmasq to bind	2026-04-19 01:04:41 -05:00
Greg Hellings	fb4c6966af	chore: upgrade Nextcloud to 33	2026-04-17 16:01:36 -05:00
Greg Hellings	e84e03cd05	chore: move charts into manifests	2026-04-17 15:43:57 -05:00
Greg Hellings	3847c7d92d	fix: streamline Gitea runners	2026-04-05 16:51:31 -05:00
klaatu	81936ac524	feat: Gitea Actions shell runners + flake-lock workflow ... - Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in shell mode, with options for enable, instanceURL, name, labels, and tokenFile (agenix secret path). - Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with appropriate labels. Agenix secret placeholders left with TODOs. - Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday midnight) that runs nix flake update and opens a PR if flake.lock changed, using GITEA_TOKEN secret for authentication. Closes part of #15 (NixOS shell runners + flake-lock workflow).	2026-04-05 04:58:27 -05:00
klaatu	0218447008	fix: address review feedback on backup improvements ... - manifests/gitea/dump-cronjob.yaml: Remove --skip-log, --skip-custom-dir, --skip-db flags to make backup complete - manifests/gitea/dump-cronjob.yaml: Replace NFS volume + cleanup container with S3 upload to backup-gitea bucket using MinIO client (mc). 30-day lifecycle set via mc ilm. Uses minio_key/minio_secret from existing gitea-config secret. - hosts/unstable/hosea/default.nix: Replace raw services.restic.backups.albyhub block with greg.backup.jobs.albyhub using the greg.backup module. Remove manual age.secrets.restic-env and age.secrets.restic-pw entries since the greg.backup module declares them.	2026-04-04 02:05:03 -05:00
klaatu	58a5c95c32	feat(hosea): add Restic backup for AlbyHub /chain/alby	2026-04-04 06:12:31 +00:00
Greg Hellings	276b939252	fix: expose buildbot	2026-04-03 23:49:12 -05:00
klaatu	9bbdb74f85	fix: merge conflict — keep both nebula.enable and buildbot proxies	2026-04-03 22:18:17 -05:00
root	eabead05ab	feat: expose Buildbot via nginx proxy on LAN ... Add greg.proxies entries on jeremiah for buildbot.home and buildbot.thehellings.lan, both proxying to http://localhost:8010/. Nginx handles auth passthrough - Buildbot's own Gitea OAuth applies. Add DNS aliases in genesis hosts file: - buildbot.thehellings.lan → 10.42.1.8 (LAN) - buildbot.home → 100.102.186.39 (Tailscale)	2026-04-01 17:31:38 -05:00
root	84e4c68f0e	fix: move unsafeRoutes to module default, genesis overrides to [] ... Per review feedback: - nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}] so all regular nodes get home LAN routing automatically - genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop) - exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to nebula.enable = true only, relying on the new default	2026-04-01 16:45:59 -05:00
greg	559155d411	Merge branch 'main' into feat/nebula-mesh	2026-04-01 21:36:08 +00:00
Greg Hellings	15ed4ae5f7	chore: allow click.discord.com	2026-04-01 15:49:32 -05:00
root	792217f640	feat: add Nebula mesh network overlay ... Introduces a greg.nebula NixOS module and enables it across all managed hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16). Architecture: - linode: lighthouse + relay (public internet, UDP 4242) - genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN) - hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes pointing to genesis to reach the home LAN Changes: - modules/nixos/nebula.nix: new greg.nebula module - isLighthouse / isRelay options - unsafeRoutes option (tun.unsafe_routes) - routesSubnet option: enables IP forwarding + nftables masquerade NAT on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16 - agenix secret reference per-host (secrets/nebula/<name>.key.age) - opens UDP/4242 in the firewall - modules/nixos/default.nix: import nebula.nix - hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true - hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16" - hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix: greg.nebula.enable = true with unsafeRoutes via genesis - network.json: add nebulaIp field for each managed host - secrets/secrets.nix: declare nebula/<host>.key.age entries - secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)	2026-03-28 23:24:52 -05:00
root	07b3601206	feat: add top-5 fullest PVs panel to Kubernetes dashboard ... Add a horizontal bar gauge showing the disk usage % of the 5 most-full PersistentVolumes in the cluster, using kubelet volume stats already scraped by Prometheus: topk(5, kubelet_volume_stats_used_bytes / kubelet_volume_stats_capacity_bytes * 100) Labels show namespace/PVC name. Color thresholds: green <70%, yellow 70–90%, red >90%. Placed at the bottom of the dashboard (y=46). Bump dashboard version to 3.	2026-03-27 09:06:19 -05:00
Greg Hellings	93458eb6d4	chore: slight updates to Network dashboard	2026-03-27 09:03:07 -05:00
root	de0b8fb07e	fix: correct unpoller metric names in network dashboard ... All metrics had wrong prefix (unifipoller_ → unpoller_) and several had incorrect names entirely. Corrected against unpoller master source (pkg/promunifi/): - unifipoller_device_uptime_seconds → unpoller_device_uptime_seconds - unifipoller_port_receive_bytes_total → unpoller_device_port_receive_bytes_total (port metrics live under device_ namespace: unpoller_device_port_*) - unifipoller_port_transmit_bytes_total → unpoller_device_port_transmit_bytes_total - unifipoller_device_wan_receive_bytes_total → unpoller_wan_max_rx_bytes_rate (no per-device WAN bytes total counter; WAN ns is unpoller_wan_*; rate metrics are already instantaneous gauges, no rate() wrapper) - unifipoller_device_wan_transmit_bytes_total → unpoller_wan_max_tx_bytes_rate - unifipoller_client_wifi_tx_rate_bps → count(unpoller_client_uptime_seconds{wired="false"}) (no wifi-specific rate metric; wired label distinguishes client types) - unifipoller_client_wired_tx_rate_bps → count(unpoller_client_uptime_seconds{wired="true"}) - unifipoller_client_receive_bytes_total → unpoller_client_receive_bytes_total - unifipoller_client_transmit_bytes_total → unpoller_client_transmit_bytes_total Bump dashboard version to 3.	2026-03-27 08:44:12 -05:00