127 Commits

Include renames

Author	SHA1	Message	Date
Greg Hellings	bbdfe1e1de	chore: update Gitea to backup to Garage	2026-08-03 20:46:48 -05:00
Greg Hellings	71486e9ab3	chore: update Longhorn version	2026-08-03 20:46:20 -05:00
Greg Hellings	8a8664287f	chore: remove gitea-runner	2026-08-03 18:56:23 -05:00
Greg Hellings	4965d42e59	chore: remove smokeping and donetick from k8s	2026-08-03 18:55:07 -05:00
Greg Hellings	03e174367d	chore: uptimekuma migrated to NixOS	2026-08-03 18:52:01 -05:00
Greg Hellings	21cb84ac7a	Major update for linode and Nebula ... * Consolidate Linode into a single file * Convert gitea and matrix to using Nebula connections * Have Linode proxy to Nebula connections instead of Tailscale * Update Acme to use DNS-01 * Update Flake to pull from branch that supports ACME 5.x client	2026-08-01 14:38:01 -05:00
Greg Hellings	a6b46f9c74	chore: remove unused anubis container	2026-06-03 21:02:00 -05:00
Greg Hellings	e865d0832e	chore: update longhorn and gitea versions	2026-06-01 15:56:06 -05:00
Greg Hellings	69651258d6	chore: connect buildbot and gitea by tailscale	2026-05-28 16:57:05 -05:00
rootandGreg Hellings	e6217401f9	feat(gitea): add Anubis anti-crawler proxy ... Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work challenge that protects web services from AI crawlers and scrapers.	2026-05-24 21:25:50 -05:00
Greg Hellings	19540ea1da	chore: update mariadb-operator version	2026-05-20 03:26:37 -05:00
Greg Hellings	431f78f8af	fix: enable minio access for gitea backups	2026-05-19 23:48:34 -05:00
Greg Hellings	10d6f85b5e	chore: update pre-commit	2026-05-10 01:48:45 -05:00
Greg Hellings	2932e9e335	chore: remove vm-gitlab which is no longer in use	2026-04-30 16:06:58 -05:00
Greg Hellings	904754e059	fix: re-enable scheduling on Zeke disk replacement	2026-04-24 06:46:29 -05:00
Greg Hellings	fcba03f3d0	chore: update Gitea to latest.	2026-04-22 20:36:03 -05:00
Greg Hellings	8ba503ca5d	chore: upgrade Immich db to PG 18	2026-04-21 16:22:21 -05:00
Greg Hellings	8509fff746	chore: upgrade from dnsmasq to bind	2026-04-19 01:04:41 -05:00
Greg Hellings	e84e03cd05	chore: move charts into manifests	2026-04-17 15:43:57 -05:00
Greg Hellings	84d050fb0c	fix: remove files before re-upload in Immich backup	2026-04-05 16:52:04 -05:00
Greg Hellings	45d8154a04	Merge remote-tracking branch 'origin/feat/gitea-actions'	2026-04-04 14:18:22 -05:00
Greg Hellings	03400f1c93	fix: pull correct secrets	2026-04-04 14:14:23 -05:00
greg	603598a3f9	Merge branch 'main' into feat/gitea-actions	2026-04-04 19:13:31 +00:00
klaatu	757b07c22f	fix: replace placeholder Secret with ExternalSecret via bitwarden-login	2026-04-04 19:05:17 +00:00
klaatu	b7fba0e151	fix: chart name act_runner -> actions, version 0.2.5 -> 0.0.4	2026-04-04 19:05:06 +00:00
greg	75278cdb6a	Merge pull request 'fix: set MC_CONFIG_DIR to /tmp/.mc so mc can write config as non-root' (#20) from klaatu/nixos:fix/mc-config-dir into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/20 Reviewed-by: greg <gitea@local.domain>	2026-04-04 18:23:42 +00:00
klaatu	67f12856e1	fix: set MC_CONFIG_DIR to /tmp/.mc so mc can write config as non-root	2026-04-04 18:18:43 +00:00
Greg Hellings	475c0eda64	fix: minio secrets exposed	2026-04-04 13:11:31 -05:00
klaatu	0218447008	fix: address review feedback on backup improvements ... - manifests/gitea/dump-cronjob.yaml: Remove --skip-log, --skip-custom-dir, --skip-db flags to make backup complete - manifests/gitea/dump-cronjob.yaml: Replace NFS volume + cleanup container with S3 upload to backup-gitea bucket using MinIO client (mc). 30-day lifecycle set via mc ilm. Uses minio_key/minio_secret from existing gitea-config secret. - hosts/unstable/hosea/default.nix: Replace raw services.restic.backups.albyhub block with greg.backup.jobs.albyhub using the greg.backup module. Remove manual age.secrets.restic-env and age.secrets.restic-pw entries since the greg.backup module declares them.	2026-04-04 02:05:03 -05:00
klaatu	d65dcb51a3	feat: add gitea-runner secret placeholder	2026-04-04 06:18:07 +00:00
klaatu	87bc9a21d9	feat: add gitea-runner kustomization	2026-04-04 06:18:04 +00:00
klaatu	ca25dde780	feat: add gitea-runner FluxCD HelmRelease	2026-04-04 06:18:01 +00:00
klaatu	c61900f9e6	feat: add gitea-runner namespace manifest	2026-04-04 06:17:59 +00:00
klaatu	1077d357ca	feat(immich): switch backup to rclone sync → MinIO immich bucket on nas1	2026-04-04 06:13:43 +00:00
klaatu	6b84824a53	feat(gitea): add dump-cronjob to kustomization	2026-04-04 06:13:00 +00:00
klaatu	c74d647ec3	feat(gitea): add daily dump CronJob writing to NAS1 NFS	2026-04-04 06:12:56 +00:00
Greg Hellings	9a26c75884	chore: allow outgoing webhooks	2026-04-03 23:49:27 -05:00
Greg Hellings	841224b20f	fix: update external-secrets apiVersion	2026-03-27 08:27:03 -05:00
klaatuandGreg Hellings	4717763fed	feat: add restic ExternalSecret for Prometheus basic auth	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	53f33eb13a	feat: add kube-state-metrics	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	b18807b1ef	feat: add kube-state-metrics.yaml and restic-secret.yaml to kustomization	2026-03-27 08:19:45 -05:00
klaatuandGreg Hellings	2c0b4b1472	feat: add kube_state_metrics job, restic basic_auth, remove kea job	2026-03-27 08:19:40 -05:00
klaatuandGreg Hellings	d713e5104c	feat: mount restic-credentials secret into Prometheus	2026-03-27 08:18:53 -05:00
Greg Hellings	eba1a0c1ca	fix: make restic https	2026-03-26 05:56:21 -05:00
Greg Hellings	4eb5d6873a	chore: remove unused kea configuration	2026-03-26 05:45:16 -05:00
root	2d874d3969	fix: two observability bugs from initial deployment ... Fix 1 - UnPoller 404 on UDM Pro: Remove :8443 from UP_UNIFI_DEFAULT_URL. UniFi OS devices (UDM Pro, UDM, UXG, CloudKey) use a different API path and do NOT use port 8443. URL should be https://10.42.1.1 (no port); unpoller handles the /proxy/network path internally for UniFi OS devices. Fix 2 - Grafana dashboards showing invalid datasource: Add uid = "prometheus" to the provisioned Prometheus datasource. Without an explicit UID, Grafana auto-generates one on first run. All dashboard JSON references datasource uid "prometheus" which only works if the provisioning explicitly sets that UID.	2026-03-25 12:37:29 -05:00
root	df2f9d69fe	fix: address PR feedback + expand infrastructure coverage ... - Replace unpoller-credentials plain Secret with ExternalSecret pulling from Bitwarden item 15bfc957-5de5-49b2-ab6c-b41800e71564 via bitwarden-login ClusterSecretStore (username + password) - Pull UP_UNIFI_DEFAULT_USER from secret as well (was hardcoded) - Add OpenWRT access point (10.42.0.3) to genesis DNS hosts file as ap.thehellings.lan (discovered during network scan) - Add blackbox exporter to genesis (port 9115, ICMP module) for probing non-NixOS infrastructure that has no node_exporter: OpenWRT AP, Joel, pve1, chronicles, nas1, odoo, mattermost, homeassistant, USW-Pro-HD-24 UniFi switch - Add infra_ping scrape job to Prometheus using blackbox prober targeting all non-NixOS LAN hosts via genesis blackbox exporter	2026-03-25 09:25:16 -05:00
root	ab6e1d24fe	feat: comprehensive observability stack ... - Add restic_backups and mattermost scrape jobs to Prometheus config - Add UnPoller deployment+service+secret for UniFi metrics (unpoller.yaml) - Add unifi scrape job targeting unpoller in-cluster - Add 4 Grafana dashboards as NixOS-managed etc files on hosea: - system-health: CPU, memory, disk, network per host - backup-health: restic backup freshness and duration - kubernetes: pod counts, restart rates, node resources - network: DNS queries, DHCP leases, UniFi ports, ping latency - Add grafana-api-token agenix secret placeholder on hosea - Open firewall ports 9100/9427/9558 for prometheus exporters in baseline.nix	2026-03-25 09:23:31 -05:00
greg	0050f866bf	Merge pull request 'fix: security and monitoring improvements (issues 1-3)' (#1) from klaatu/nixos:fix/security-and-monitoring into main ... Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/1	2026-03-25 12:09:28 +00:00
Greg Hellings	d5796c19b4	feat: Enable shared registration secret for Dendrite	2026-03-25 06:28:27 -05:00