viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/master' into wizard/gpu-vram-budget

Browse source
This commit is contained in:
Viktor Barzin 2026-07-02 05:18:34 +00:00
commit 968b2b9c64
17 changed files with 1989 additions and 2268 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.claude/CLAUDE.md
View file

File diff suppressed because one or more lines are too long

3
.claude/reference/service-catalog.md
View file

@ -50,7 +50,6 @@
| owntracks | Location tracking | owntracks |
| nextcloud | File sync/share | nextcloud |
| calibre | E-book management (may be merged into ebooks stack) | calibre |
| onlyoffice | Document editing | onlyoffice |
| f1-stream | F1 streaming (uses chrome-service for hmembeds verifier); canonical source in own repo `viktor/f1-stream` (Forgejo, extracted 2026-06-05); GHA-built → `ghcr.io/viktorbarzin/f1-stream` (private), Woodpecker deploy-only (ADR-0002) | f1-stream |
| chrome-service | Headed Chromium over CDP (`http://chrome-service.chrome-service.svc:9222`, `connect_over_cdp`; legacy `:3000/<token>` WS pool removed 2026-06-04) for sibling services driving anti-bot pages — snapshot-harvester CronJob + tripit fare scrape | chrome-service |
| rybbit | Analytics | rybbit |
@ -139,7 +138,7 @@ travel, netbox, phpipam, tripit, t3, stem95su
mail, wg, headscale, immich, calibre, vaultwarden,
mailserver-antispam, mailserver-admin, webhook, uptime,
owntracks, dawarich, tuya, meshcentral, nextcloud, actualbudget,
onlyoffice, forgejo, freshrss, navidrome, ollama, openwebui,
forgejo, freshrss, navidrome, ollama, openwebui,
isponsorblocktv, speedtest, freedify, rybbit, paperless,
servarr, prowlarr, bazarr, radarr, sonarr, flaresolverr,
jellyfin, jellyseerr, tdarr, affine, health, family, openclaw

13
modules/create-template-vm/cloud_init.yaml
View file

@ -88,13 +88,12 @@ write_files:
runcmd:
# Enable weekly TRIM/discard to reclaim freed blocks in LVM thin pool
- systemctl enable --now fstrim.timer
# Enable persistent journald logging for crash forensics, with size limits to reduce disk wear
- mkdir -p /var/log/journal
- sed -i 's/#Storage=auto/Storage=persistent/' /etc/systemd/journald.conf
- sed -i 's/#SystemMaxUse=/SystemMaxUse=500M/' /etc/systemd/journald.conf
- sed -i 's/#MaxRetentionSec=/MaxRetentionSec=7day/' /etc/systemd/journald.conf
- sed -i 's/#MaxFileSec=/MaxFileSec=1day/' /etc/systemd/journald.conf
- sed -i 's/#Compress=yes/Compress=yes/' /etc/systemd/journald.conf
# journald in RAM (volatile, capped) — node + pod journals already ship to
# Loki via alloy (loki.source.journal), so on-disk journald is pure sdc
# write-IOPS overhead on the IOPS-bound HDD. code-oflt 2026-06-30.
- mkdir -p /etc/systemd/journald.conf.d
- printf '[Journal]\nStorage=volatile\nRuntimeMaxUse=200M\nCompress=yes\n' > /etc/systemd/journald.conf.d/90-oflt-volatile.conf
- rm -rf /var/log/journal
- systemctl restart systemd-journald
%{if is_k8s_template}
# Node DNS is intentionally STOCK — no resolved drop-ins, no /etc/hosts

42
stacks/broker-sync/main.tf
View file

@ -167,6 +167,12 @@ resource "kubernetes_cron_job_v1" "trading212" {
}
spec {
restart_policy = "OnFailure"
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
# wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
# One node = volume attaches once and stays put.
node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
# See imap cron — without fsGroup=10001 the broker user (uid=10001
# gid=999) can't write the sqlite3 journal next to /data/sync.db
# and the dedup.record() call after a successful WF import crashes
@ -277,6 +283,12 @@ resource "kubernetes_cron_job_v1" "ibkr" {
}
spec {
restart_policy = "OnFailure"
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
# wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
# One node = volume attaches once and stays put.
node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
security_context {
fs_group = 10001
}
@ -411,6 +423,12 @@ resource "kubernetes_cron_job_v1" "imap" {
}
spec {
restart_policy = "OnFailure"
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
# wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
# One node = volume attaches once and stays put.
node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
# The broker image's user is uid=10001 gid=999, but the shared
# data PVC's /data root was created with gid=10001 (legacy from
# an earlier image build). Without fsGroup the pod can't write
@ -563,6 +581,12 @@ resource "kubernetes_cron_job_v1" "csv_drop" {
}
spec {
restart_policy = "OnFailure"
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
# wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
# One node = volume attaches once and stays put.
node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
container {
name = "broker-sync"
image = local.broker_sync_image
@ -655,6 +679,12 @@ resource "kubernetes_cron_job_v1" "fx_reconcile" {
}
spec {
restart_policy = "OnFailure"
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
# wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
# One node = volume attaches once and stays put.
node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
container {
name = "broker-sync"
image = local.broker_sync_image
@ -747,6 +777,12 @@ resource "kubernetes_cron_job_v1" "backup" {
}
spec {
restart_policy = "OnFailure"
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
# wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
# One node = volume attaches once and stays put.
node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
container {
name = "backup"
image = "alpine:3.20"
@ -850,6 +886,12 @@ resource "kubernetes_cron_job_v1" "fidelity" {
}
spec {
restart_policy = "OnFailure"
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
# wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
# One node = volume attaches once and stays put.
node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
# Materialise the JSON storage_state from the projected Secret
# onto the PVC where Playwright expects to read it. Init container
# runs as root; the main broker-sync container runs as uid 10001,

25
stacks/dbaas/modules/dbaas/main.tf
View file

@ -111,7 +111,12 @@ resource "kubernetes_config_map" "mysql_standalone_cnf" {
innodb_io_capacity=100
innodb_io_capacity_max=200
innodb_redo_log_capacity=1073741824
innodb_buffer_pool_size=1073741824
innodb_buffer_pool_size=2147483648
# DETECT_ONLY: stop writing full page content to the doublewrite buffer
# (~halves page-flush writes on the IOPS-bound sdc) while keeping torn-page
# DETECTION; recovery is restore-from-backup. OK with BBU+UPS+daily
# mysqldump. Dynamic (no restart). code-oflt 2026-06-30.
innodb_doublewrite=DETECT_ONLY
innodb_flush_neighbors=1
innodb_lru_scan_depth=256
innodb_page_cleaners=1
@ -228,11 +233,13 @@ resource "kubernetes_stateful_set_v1" "mysql_standalone" {
resources {
requests = {
cpu = "250m"
memory = "3Gi"
}
limits = {
memory = "4Gi"
}
# 6Gi (was 4Gi) — code-oflt 2026-06-30: headroom for the 2Gi InnoDB
# buffer pool (was 1Gi); the pod was already at ~3.7Gi/4Gi (near OOM).
limits = {
memory = "6Gi"
}
}
volume_mount {
@ -298,7 +305,15 @@ resource "kubernetes_stateful_set_v1" "mysql_standalone" {
}
lifecycle {
ignore_changes = [spec[0].template[0].spec[0].dns_config] # KYVERNO_LIFECYCLE_V1
ignore_changes = [
spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1
# StatefulSet volumeClaimTemplates are immutable post-creation, and the
# pvc-autoresizer rewrites their annotations on the live object
# (storage_limit/threshold), so TF's desired VCT can never apply and a
# broad `dbaas` apply errors out. The autoresizer owns PVC sizing; ignore
# the VCT so other STS changes (e.g. resources) apply cleanly. (code-oflt 2026-06-30)
spec[0].volume_claim_template,
]
}
}

2
stacks/kyverno/modules/kyverno/security-policies.tf
View file

@ -353,7 +353,7 @@ resource "kubectl_manifest" "policy_require_trusted_registries" {
"lissy93/*", "louislam/*", "matrixdotorg/*", "mauriceboe/*",
"mendhak/*",
"mghee/*", "mindflavor/*", "mpepping/*", "netboxcommunity/*",
"netsampler/*", "nousresearch/*", "nvidia/*", "onlyoffice/*",
"netsampler/*", "nousresearch/*", "nvidia/*",
"openresty/*", "opentripplanner/*", "owntracks/*",
"phpipam/*", "phpmyadmin/*", "privatebin/*", "prom/*",
"prompve/*", "rancher/*", "rhasspy/*", "roundcube/*", "sclevine/*",

284
stacks/monitoring/modules/monitoring/dashboards/wealth.json
View file

@ -1506,6 +1506,165 @@
}
]
},
{
"id": 9230,
"title": "Effective hourly rate \u2014 gross vs net (\u00a3/h, per year)",
"description": "Annual pay \u00f7 hours worked. Hours = 40h/week contractual (2,080h per full year, per offer letter: Mon\u2013Fri 09:00\u201318:00 less 1h lunch), prorated by months actually worked. Gross = gross_pay incl. notional RSU vest; Net = take-home. The latest still-accruing year is shown DASHED: it reads high because the full-year bonus (paid each March) and front-loaded quarterly RSU vests are divided by only the months worked so far, and settles lower as the year completes. Calendar year; last 10y.",
"type": "timeseries",
"datasource": {
"type": "grafana-postgresql-datasource",
"uid": "payslips-pg"
},
"gridPos": {
"h": 9,
"w": 24,
"x": 0,
"y": 77
},
"timeFrom": "10y",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"unit": "currencyGBP",
"decimals": 1,
"custom": {
"drawStyle": "line",
"lineWidth": 2,
"fillOpacity": 10,
"gradientMode": "opacity",
"pointSize": 6,
"showPoints": "always",
"spanNulls": true,
"axisPlacement": "auto",
"axisLabel": "\u00a3 / hour",
"stacking": {
"group": "A",
"mode": "none"
}
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Gross (incl. RSU)"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "#FF9830"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "Net (take-home)"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "blue"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "Gross (current yr, partial)"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "#FF9830"
}
},
{
"id": "custom.lineStyle",
"value": {
"fill": "dash",
"dash": [
10,
10
]
}
},
{
"id": "custom.fillOpacity",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Net (current yr, partial)"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "blue"
}
},
{
"id": "custom.lineStyle",
"value": {
"fill": "dash",
"dash": [
10,
10
]
}
},
{
"id": "custom.fillOpacity",
"value": 0
}
]
}
]
},
"options": {
"legend": {
"calcs": [
"last",
"max",
"min"
],
"displayMode": "table",
"placement": "bottom"
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "grafana-postgresql-datasource",
"uid": "payslips-pg"
},
"format": "time_series",
"editorMode": "code",
"rawQuery": true,
"rawSql": "WITH y AS (\n SELECT date_trunc('year', pay_date) AS yr,\n COUNT(DISTINCT date_trunc('month', pay_date)) AS months,\n SUM(gross_pay) AS gross, SUM(net_pay) AS net\n FROM payslip_ingest.payslip GROUP BY 1\n),\ncalc AS (\n SELECT yr, months,\n gross / (months * (40.0 * 52 / 12)) AS gross_h,\n net / (months * (40.0 * 52 / 12)) AS net_h\n FROM y\n),\nflagged AS (\n SELECT yr, gross_h, net_h, (yr = MAX(yr) OVER () AND months < 12) AS partial FROM calc\n),\nwithlead AS (\n SELECT yr, gross_h, net_h, partial,\n COALESCE(LEAD(partial) OVER (ORDER BY yr), false) AS next_partial FROM flagged\n)\nSELECT yr::timestamp AS \"time\",\n CASE WHEN partial THEN NULL ELSE gross_h END AS \"Gross (incl. RSU)\",\n CASE WHEN partial THEN NULL ELSE net_h END AS \"Net (take-home)\",\n CASE WHEN partial OR next_partial THEN gross_h ELSE NULL END AS \"Gross (current yr, partial)\",\n CASE WHEN partial OR next_partial THEN net_h ELSE NULL END AS \"Net (current yr, partial)\"\nFROM withlead ORDER BY yr"
}
]
},
{
"type": "row",
"title": "Holdings",
@ -1515,7 +1674,7 @@
"h": 1,
"w": 24,
"x": 0,
"y": 78
"y": 86
},
"panels": []
},
@ -1532,7 +1691,7 @@
"h": 10,
"w": 12,
"x": 0,
"y": 79
"y": 87
},
"fieldConfig": {
"defaults": {
@ -1729,7 +1888,7 @@
"h": 10,
"w": 12,
"x": 12,
"y": 79
"y": 87
},
"fieldConfig": {
"defaults": {
@ -1782,7 +1941,7 @@
"h": 1,
"w": 24,
"x": 0,
"y": 90
"y": 98
},
"panels": []
},
@ -1799,7 +1958,7 @@
"h": 9,
"w": 12,
"x": 0,
"y": 91
"y": 99
},
"fieldConfig": {
"defaults": {
@ -1916,7 +2075,7 @@
"h": 12,
"w": 12,
"x": 12,
"y": 91
"y": 99
},
"fieldConfig": {
"defaults": {
@ -2135,7 +2294,7 @@
"h": 1,
"w": 24,
"x": 0,
"y": 104
"y": 112
},
"panels": []
},
@ -2152,7 +2311,7 @@
"h": 12,
"w": 24,
"x": 0,
"y": 105
"y": 113
},
"fieldConfig": {
"defaults": {
@ -2324,13 +2483,13 @@
"title": "FC::intro",
"gridPos": {
"x": 0,
"y": 118,
"w": 24,
"y": 126,
"w": 18,
"h": 4
},
"options": {
"mode": "markdown",
"content": "## \ud83d\udd25 FIRE Countdown \u2014 **$country**\nTarget = smallest **liquid** net worth where Guyton-Klinger hits **99%** success (Monte-Carlo), in **today's money**. Spend is your real actualbudget \u00d7 **1.5**, cost-of-living re-scaled to the country. The \u00a3139k workplace pension is excluded from current NW and joins as a tranche at ~57. _Current NW = liquid bridge pot._"
"content": "## \ud83d\udd25 FIRE Countdown \u2014 **$country**\nTarget = smallest **liquid** net worth where Guyton-Klinger hits **99%** success (Monte-Carlo), in **today's money**. Spend is your real actualbudget \u00d7 **1.5**, cost-of-living re-scaled to the country. The workplace pension is excluded from current NW and joins as a separate tranche at ~57 (value at unlock shown in the Pension-tranche panel). _Current NW = liquid bridge pot._\n\n_Caveats: Household/Family include an **estimated** figure for Anca's spend (pending a live re-pull). Countries without a modelled tax regime fall back to a neutral **nomad** 1% assumption (see Tax-regime panel)._"
}
},
{
@ -2339,7 +2498,7 @@
"title": "FC::solo header",
"gridPos": {
"x": 0,
"y": 122,
"y": 130,
"w": 24,
"h": 2
},
@ -2358,7 +2517,7 @@
},
"gridPos": {
"x": 0,
"y": 124,
"y": 132,
"w": 5,
"h": 5
},
@ -2411,7 +2570,7 @@
},
"gridPos": {
"x": 5,
"y": 124,
"y": 132,
"w": 4,
"h": 5
},
@ -2484,7 +2643,7 @@
},
"gridPos": {
"x": 9,
"y": 124,
"y": 132,
"w": 5,
"h": 5
},
@ -2549,7 +2708,7 @@
},
"gridPos": {
"x": 14,
"y": 124,
"y": 132,
"w": 5,
"h": 5
},
@ -2586,7 +2745,7 @@
"uid": "fire-planner-pg"
},
"rawQuery": true,
"rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF($savings_per_year,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='solo' AND country_slug='$country' AND with_home=false AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
"rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' WHEN COALESCE(NULLIF('$savings_per_year','')::numeric, 0) <= 0 THEN 'Set savings \u00a3/yr' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF(NULLIF('$savings_per_year','')::numeric,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='solo' AND country_slug='$country' AND with_home=false AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
"editorMode": "code",
"format": "table"
}
@ -2602,7 +2761,7 @@
},
"gridPos": {
"x": 19,
"y": 124,
"y": 132,
"w": 5,
"h": 5
},
@ -2651,7 +2810,7 @@
"title": "FC::household header",
"gridPos": {
"x": 0,
"y": 129,
"y": 137,
"w": 24,
"h": 2
},
@ -2670,7 +2829,7 @@
},
"gridPos": {
"x": 0,
"y": 131,
"y": 139,
"w": 5,
"h": 5
},
@ -2723,7 +2882,7 @@
},
"gridPos": {
"x": 5,
"y": 131,
"y": 139,
"w": 4,
"h": 5
},
@ -2796,7 +2955,7 @@
},
"gridPos": {
"x": 9,
"y": 131,
"y": 139,
"w": 5,
"h": 5
},
@ -2861,7 +3020,7 @@
},
"gridPos": {
"x": 14,
"y": 131,
"y": 139,
"w": 5,
"h": 5
},
@ -2898,7 +3057,7 @@
"uid": "fire-planner-pg"
},
"rawQuery": true,
"rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF($savings_per_year,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='household' AND country_slug='$country' AND with_home=false AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
"rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' WHEN COALESCE(NULLIF('$savings_per_year','')::numeric, 0) <= 0 THEN 'Set savings \u00a3/yr' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF(NULLIF('$savings_per_year','')::numeric,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='household' AND country_slug='$country' AND with_home=false AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
"editorMode": "code",
"format": "table"
}
@ -2914,7 +3073,7 @@
},
"gridPos": {
"x": 19,
"y": 131,
"y": 139,
"w": 5,
"h": 5
},
@ -2963,7 +3122,7 @@
"title": "FC::family header",
"gridPos": {
"x": 0,
"y": 136,
"y": 144,
"w": 24,
"h": 2
},
@ -2982,7 +3141,7 @@
},
"gridPos": {
"x": 0,
"y": 138,
"y": 146,
"w": 5,
"h": 5
},
@ -3035,7 +3194,7 @@
},
"gridPos": {
"x": 5,
"y": 138,
"y": 146,
"w": 4,
"h": 5
},
@ -3108,7 +3267,7 @@
},
"gridPos": {
"x": 9,
"y": 138,
"y": 146,
"w": 5,
"h": 5
},
@ -3173,7 +3332,7 @@
},
"gridPos": {
"x": 14,
"y": 138,
"y": 146,
"w": 5,
"h": 5
},
@ -3210,7 +3369,7 @@
"uid": "fire-planner-pg"
},
"rawQuery": true,
"rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF($savings_per_year,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='family' AND country_slug='$country' AND with_home=$with_home AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
"rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' WHEN COALESCE(NULLIF('$savings_per_year','')::numeric, 0) <= 0 THEN 'Set savings \u00a3/yr' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF(NULLIF('$savings_per_year','')::numeric,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='family' AND country_slug='$country' AND with_home=$with_home AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
"editorMode": "code",
"format": "table"
}
@ -3226,7 +3385,7 @@
},
"gridPos": {
"x": 19,
"y": 138,
"y": 146,
"w": 5,
"h": 5
},
@ -3275,7 +3434,7 @@
"title": "FC::safety header",
"gridPos": {
"x": 0,
"y": 143,
"y": 151,
"w": 24,
"h": 2
},
@ -3294,7 +3453,7 @@
},
"gridPos": {
"x": 0,
"y": 145,
"y": 153,
"w": 6,
"h": 5
},
@ -3359,7 +3518,7 @@
},
"gridPos": {
"x": 6,
"y": 145,
"y": 153,
"w": 6,
"h": 5
},
@ -3412,7 +3571,7 @@
},
"gridPos": {
"x": 12,
"y": 145,
"y": 153,
"w": 6,
"h": 5
},
@ -3461,7 +3620,7 @@
"title": "FC::Anca bridge",
"gridPos": {
"x": 18,
"y": 145,
"y": 153,
"w": 6,
"h": 5
},
@ -3469,6 +3628,57 @@
"mode": "markdown",
"content": "**Anca's bridge**\n\nAnca's continued income covers the early sequence-risk years \u2014 the household never draws the full plan from day one. Plus the written **re-entry trigger**: take a contract if the portfolio is < \u00a31.0M for two quarters."
}
},
{
"id": 90099,
"type": "stat",
"title": "FC::Tax regime ($country)",
"datasource": {
"type": "grafana-postgresql-datasource",
"uid": "fire-planner-pg"
},
"gridPos": {
"x": 18,
"y": 126,
"w": 6,
"h": 4
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "fixed",
"fixedColor": "text"
}
},
"overrides": []
},
"options": {
"colorMode": "value",
"graphMode": "none",
"justifyMode": "center",
"textMode": "value",
"orientation": "auto",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
}
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "grafana-postgresql-datasource",
"uid": "fire-planner-pg"
},
"rawQuery": true,
"editorMode": "code",
"format": "table",
"rawSql": "SELECT jurisdiction FROM fire_planner.fire_target WHERE country_slug='$country' ORDER BY id LIMIT 1"
}
]
}
],
"refresh": "5m",

2
stacks/nextcloud/chart_values.yaml
View file

@ -172,7 +172,7 @@ securityContext:
fsGroupChangePolicy: OnRootMismatch
collabora:
enabled: false # Using onlyoffice instead
enabled: false # No document server (onlyoffice decommissioned 2026-07-01)
resources:
limits:

84
stacks/onlyoffice/.terraform.lock.hcl generated
View file

@ -1,84 +0,0 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/cloudflare/cloudflare" {
version = "4.52.7"
constraints = "~> 4.0"
hashes = [
"h1:pPItIWii5oymR+geZB219ROSPuSODPLTlM4S/u8xLvM=",
"zh:0c904ce31a4c6c4a5b3bf7ff1560e77c0cc7e2450c8553ded8e8c90398e1418b",
"zh:36183d310c36373fe4cb936b83c595c6fd3b0a94bc7827f28e5789ccbf59752e",
"zh:556a568a6f0235e8f41647de9e4d3a1e7b1d6502df8b19b54ec441f1c653ea10",
"zh:633ebbd5b0245e75e500ef9be4d9e62288f97e8da3baaa51323892a786d90285",
"zh:6acfe60cf52a65ba8f044f748548d2119e7f4fd7f8ebcb14698960d87c68f529",
"zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
"zh:904acc31ebb9d6ef68c792074b30532ee61bf515f19e0a3c75b46f126cca1f13",
"zh:a1d0a81246afc8750286d3f6fe7a8fbe6460dd2662407b28dbfbabb612e5fa9d",
"zh:a41a36fe253fc365fe2b7ffc749624688b2693b4634862fda161179ab100029f",
"zh:a7ef269e77ffa8715c8945a2c14322c7ff159ea44c15f62505f3cbb2cae3b32d",
"zh:b01aa3bed30610633b762df64332b26f8844a68c3960cebcb30f04918efc67fe",
"zh:b069cc2cd18cae10757df3ae030508eac8d55de7e49eda7a5e3e11f2f7fe6455",
"zh:b2d2c6313729ebb7465dceece374049e2d08bda34473901be9ff46a8836d42b2",
"zh:db0e114edaf4bc2f3d4769958807c83022bfbc619a00bdf4c4bd17faa4ab2d8b",
"zh:ecc0aa8b9044f664fd2aaf8fa992d976578f78478980555b4b8f6148e8d1a5fe",
]
}
provider "registry.terraform.io/gavinbunney/kubectl" {
version = "1.19.0"
constraints = "~> 1.14"
hashes = [
"h1:9QkxPjp0x5FZFfJbE+B7hBOoads9gmdfj9aYu5N4Sfc=",
]
}
provider "registry.terraform.io/goauthentik/authentik" {
version = "2024.12.1"
constraints = "~> 2024.10"
hashes = [
"h1:roBMd+gi+TGgikH/bMzEI8JfvJiMAQWt+8FmokCrQIs=",
]
}
provider "registry.terraform.io/hashicorp/helm" {
version = "3.2.0"
hashes = [
"h1:CTWVDQxyq1cQJR/9RJSkXii/gz5zMjxszSw9LmptDh4=",
]
}
provider "registry.terraform.io/hashicorp/kubernetes" {
version = "3.2.0"
hashes = [
"h1:OjMar8kVp0LcDtwgRs877g/K/KPAEDVhFewpE3Tp7l8=",
]
}
provider "registry.terraform.io/hashicorp/vault" {
version = "4.8.0"
constraints = "~> 4.0"
hashes = [
"h1:GPfhH6dr1LY0foPBDYv9bEGifx7eSwYqFcEAOWOUxLk=",
"h1:aHqgWQhDBMeZO9iUKwJYMlh4q+xNMUlMIcjRbF4d02Y=",
"zh:269ab13433f67684012ae7e15876532b0312f5d0d2002a9cf9febb1279ce5ea6",
"zh:4babc95bf0c40eb85005db1dc2ca403c46be4a71dd3e409db3711a56f7a5ca0e",
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
"zh:86e27c1c625ecc24446a11eeffc3ac319b36c2b4e51251db8579256a0dbcf136",
"zh:a32f31da94824009e26b077374440b52098aecb93c92ff55dc3d31dd37c4ea25",
"zh:be0a18c6c0425518bab4fbffd82078b82036a88503b5d76064de551c9f646cbf",
"zh:be5a77fdfd36863ebeec79cd12b1d13322ffad6821d157a0b279789fa06b5937",
"zh:be8317d142a3caad74c7d936039ae27076a1b2b8312ef5208e2871a5f525977c",
"zh:c94a84895a3d9954b80e983eed4603330a5cdbbd8eef5b3c99278c2d1402ef3c",
"zh:de1fb712784dd8415f011ca5346a34f87fab6046c730557615247e511dbc7d98",
"zh:e3eafae7da550f86cae395d6660b2a0e93ec8d2b0e0e5ef982ec762e961fc952",
"zh:ff35fb1ab6add288f0f368981e56f780b50405accd1937131cba1137999c8d83",
]
}
provider "registry.terraform.io/telmate/proxmox" {
version = "3.0.2-rc07"
constraints = "3.0.2-rc07"
hashes = [
"h1:zp5hpQJQ4t4zROSLqdltVpBO+Riy9VugtfFbpyTw1aM=",
]
}

278
stacks/onlyoffice/main.tf
View file

@ -1,278 +0,0 @@
variable "tls_secret_name" {
type = string
sensitive = true
}
variable "nfs_server" { type = string }
variable "redis_host" { type = string }
variable "mysql_host" { type = string }
resource "kubernetes_namespace" "onlyoffice" {
metadata {
name = "onlyoffice"
labels = {
"istio-injection" : "disabled"
tier = local.tiers.edge
"resource-governance/custom-limitrange" = "true"
"resource-governance/custom-quota" = "true"
"keel.sh/enrolled" = "true"
}
}
lifecycle {
# KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
}
}
resource "kubernetes_manifest" "external_secret" {
field_manager {
force_conflicts = true
}
manifest = {
apiVersion = "external-secrets.io/v1"
kind = "ExternalSecret"
metadata = {
name = "onlyoffice-secrets"
namespace = "onlyoffice"
}
spec = {
refreshInterval = "15m"
secretStoreRef = {
name = "vault-kv"
kind = "ClusterSecretStore"
}
target = {
name = "onlyoffice-secrets"
}
dataFrom = [{
extract = {
key = "onlyoffice"
}
}]
}
}
depends_on = [kubernetes_namespace.onlyoffice]
}
resource "kubernetes_limit_range" "onlyoffice" {
metadata {
name = "onlyoffice-limits"
namespace = kubernetes_namespace.onlyoffice.metadata[0].name
}
spec {
limit {
type = "Container"
default = {
memory = "256Mi"
}
default_request = {
cpu = "25m"
memory = "64Mi"
}
max = {
memory = "8Gi"
}
}
}
}
resource "kubernetes_resource_quota" "onlyoffice" {
metadata {
name = "onlyoffice-quota"
namespace = kubernetes_namespace.onlyoffice.metadata[0].name
}
spec {
hard = {
"requests.cpu" = "4"
"requests.memory" = "4Gi"
"limits.memory" = "16Gi"
pods = "10"
}
}
}
module "tls_secret" {
source = "../../modules/kubernetes/setup_tls_secret"
namespace = kubernetes_namespace.onlyoffice.metadata[0].name
tls_secret_name = var.tls_secret_name
}
module "nfs_data_host" {
source = "../../modules/kubernetes/nfs_volume"
name = "onlyoffice-data-host"
namespace = kubernetes_namespace.onlyoffice.metadata[0].name
nfs_server = var.nfs_server
nfs_path = "/srv/nfs/onlyoffice"
storage = "1Gi"
access_modes = ["ReadWriteOnce"]
}
resource "kubernetes_deployment" "onlyoffice-document-server" {
metadata {
name = "onlyoffice-document-server"
namespace = kubernetes_namespace.onlyoffice.metadata[0].name
labels = {
app = "onlyoffice-document-server"
tier = local.tiers.edge
}
annotations = {
"reloader.stakater.com/auto" = "true"
}
}
spec {
replicas = 1
strategy {
type = "Recreate"
}
selector {
match_labels = {
app = "onlyoffice-document-server"
}
}
template {
metadata {
labels = {
app = "onlyoffice-document-server"
}
annotations = {
"dependency.kyverno.io/wait-for" = "mysql.dbaas:3306,redis-master.redis:6379"
}
}
spec {
container {
name = "onlyoffice-document-server"
image = "onlyoffice/documentserver:9.3.1"
resources {
requests = {
cpu = "100m"
memory = "1536Mi"
}
limits = {
memory = "1536Mi"
}
}
port {
name = "http"
container_port = 80
protocol = "TCP"
}
env {
name = "DB_TYPE"
value = "mariadb"
}
env {
name = "DB_HOST"
value = var.mysql_host
}
env {
name = "DB_PORT"
value = 3306
}
env {
name = "DB_NAME"
value = "onlyoffice"
}
env {
name = "DB_USER"
value = "onlyoffice"
}
env {
name = "DB_PWD"
value_from {
secret_key_ref {
name = "onlyoffice-secrets"
key = "db_password"
}
}
}
env {
name = "REDIS_SERVER_HOST"
value = var.redis_host
}
env {
name = "REDIS_SERVER_PORT"
value = 6379
}
env {
name = "JWT_SECRET"
value_from {
secret_key_ref {
name = "onlyoffice-secrets"
key = "jwt_token"
}
}
}
volume_mount {
name = "data"
mount_path = "/var/www/onlyoffice/Data"
}
}
volume {
name = "data"
persistent_volume_claim {
claim_name = module.nfs_data_host.claim_name
}
}
}
}
}
lifecycle {
ignore_changes = [
spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1
metadata[0].annotations["keel.sh/policy"],
metadata[0].annotations["keel.sh/trigger"],
metadata[0].annotations["keel.sh/pollSchedule"], # KYVERNO_LIFECYCLE_V2
metadata[0].annotations["keel.sh/match-tag"],
spec[0].template[0].spec[0].container[0].image, # KEEL_IGNORE_IMAGE — Keel manages tag updates
metadata[0].annotations["kubernetes.io/change-cause"],
metadata[0].annotations["deployment.kubernetes.io/revision"],
spec[0].template[0].metadata[0].annotations["keel.sh/update-time"], # KEEL_LIFECYCLE_V1
]
}
}
resource "kubernetes_service" "onlyoffice" {
metadata {
name = "onlyoffice-document-server"
namespace = kubernetes_namespace.onlyoffice.metadata[0].name
labels = {
"app" = "onlyoffice-document-server"
}
}
spec {
selector = {
app = "onlyoffice-document-server"
}
port {
port = "80"
}
}
}
module "ingress" {
source = "../../modules/kubernetes/ingress_factory"
# Iframe-loaded by Nextcloud with JWT-signed session tokens; OnlyOffice
# validates the JWT itself. Authentik forward-auth would 302 the iframe
# load if the browser doesn't already have an Authentik cookie, AND
# OnlyOffice's server-to-server callback URLs (Nextcloud → OnlyOffice
# for save events, etc.) run outside any browser session entirely.
# The JWT is the auth gate.
# auth = "none": Iframe loaded by Nextcloud with JWT-signed tokens; JWT is the auth gate; forward-auth breaks iframe + server-to-server callbacks.
auth = "none"
dns_type = "proxied"
namespace = kubernetes_namespace.onlyoffice.metadata[0].name
name = "onlyoffice"
service_name = "onlyoffice-document-server"
tls_secret_name = var.tls_secret_name
extra_annotations = {
"gethomepage.dev/enabled" = "true"
"gethomepage.dev/name" = "OnlyOffice"
"gethomepage.dev/description" = "Document editor"
"gethomepage.dev/icon" = "onlyoffice.png"
"gethomepage.dev/group" = "Other"
"gethomepage.dev/pod-selector" = ""
}
}
# CI retrigger 2026-05-16T13:42:57+00:00 — bulk enrollment apply (pipeline #689 killed)
# CI retrigger v2 2026-05-16T13:46:35+00:00

53
stacks/onlyoffice/providers.tf
View file

@ -1,53 +0,0 @@
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
terraform {
required_providers {
vault = {
source = "hashicorp/vault"
version = "~> 4.0"
}
cloudflare = {
source = "cloudflare/cloudflare"
version = "~> 4"
}
authentik = {
source = "goauthentik/authentik"
version = "~> 2024.10"
}
# kubectl (gavinbunney) — workaround for hashicorp/kubernetes
# `kubernetes_manifest` panics on Kyverno CRDs. See beads code-e2dp.
# Declared for all stacks but only used where opted-in.
kubectl = {
source = "gavinbunney/kubectl"
version = "~> 1.14"
}
proxmox = {
source = "telmate/proxmox"
version = "3.0.2-rc07"
}
}
}
variable "kube_config_path" {
type = string
default = "~/.kube/config"
}
provider "kubernetes" {
config_path = var.kube_config_path
}
provider "helm" {
kubernetes = {
config_path = var.kube_config_path
}
}
provider "vault" {
address = "https://vault.viktorbarzin.me"
skip_child_token = true
}
provider "kubectl" {
config_path = var.kube_config_path
load_config_file = true
}

1
stacks/onlyoffice/secrets
View file

@ -1 +0,0 @@
../../secrets

13
stacks/onlyoffice/terragrunt.hcl
View file

@ -1,13 +0,0 @@
include "root" {
path = find_in_parent_folders()
}
dependency "platform" {
config_path = "../platform"
skip_outputs = true
}
dependency "vault" {
config_path = "../vault"
skip_outputs = true
}

10
stacks/portal-stt/main.tf
View file

@ -336,13 +336,9 @@ resource "kubernetes_service" "portal_stt" {
name = "portal-stt"
namespace = kubernetes_namespace.portal_stt.metadata[0].name
labels = local.labels
annotations = {
# Speaches exposes Prometheus metrics at /metrics — wire annotation-based
# scrape (Ready-endpoint relabeling already filters non-Ready pods).
"prometheus.io/scrape" = "true"
"prometheus.io/path" = "/metrics"
"prometheus.io/port" = "8000"
}
# No scrape annotations: the deployed Speaches build 404s /metrics, so the
# annotation-based scrape only produced a permanently firing
# ScrapeTargetDown. Re-add when the app actually serves Prometheus metrics.
}
spec {
type = "ClusterIP"

11
stacks/portal-tts/main.tf
View file

@ -184,14 +184,9 @@ resource "kubernetes_service" "portal_tts" {
name = "portal-tts"
namespace = kubernetes_namespace.portal_tts.metadata[0].name
labels = local.labels
annotations = {
# openai-edge-tts has no /metrics; annotation-based scrape kept on a live
# path so the Service stays in the scrape set (Ready-endpoint relabeling
# filters non-Ready pods). /v1/models is the OpenAI model list.
"prometheus.io/scrape" = "true"
"prometheus.io/path" = "/v1/models"
"prometheus.io/port" = "8000"
}
# No scrape annotations: openai-edge-tts exposes no Prometheus metrics, and
# scraping a JSON endpoint (/v1/models) fails exposition parsing anyway ->
# up=0 -> a permanently firing ScrapeTargetDown.
}
spec {
type = "ClusterIP"

106
stacks/postiz/modules/postiz/main.tf
View file

@ -493,109 +493,3 @@ resource "kubernetes_service" "temporal" {
}
}
}
# ──────────────────────────────────────────────────────────────────────────────
# Backup CronJob — nightly pg_dump of the bundled postiz-postgresql to NFS.
#
# The bundled PostgreSQL StatefulSet uses local-path storage on the K8s node
# OS disk (chart default), which is NOT covered by Layer 1 (LVM thin
# snapshots) or Layer 2 (sda file backup) of the 3-2-1 pipeline. A pg_dump
# CronJob writing to /srv/nfs/postiz-backup/ closes the gap: dumps land on
# Proxmox host NFS → covered by inotify-driven offsite sync to Synology.
# Three databases are dumped: postiz (app data), temporal (workflow engine),
# temporal_visibility (workflow search). Bitnami chart-default credentials
# are used — same creds the Postiz pod itself uses, scoped to the postiz
# namespace via ClusterIP-only Services.
# ──────────────────────────────────────────────────────────────────────────────
module "nfs_backup_host" {
source = "../../../../modules/kubernetes/nfs_volume"
name = "postiz-backup-host"
namespace = kubernetes_namespace.postiz.metadata[0].name
nfs_server = "192.168.1.127"
nfs_path = "/srv/nfs/postiz-backup"
}
resource "kubernetes_cron_job_v1" "postgres_backup" {
metadata {
name = "postiz-postgres-backup"
namespace = kubernetes_namespace.postiz.metadata[0].name
labels = { app = "postiz", component = "backup" }
}
spec {
schedule = "0 3 * * *"
concurrency_policy = "Forbid"
successful_jobs_history_limit = 3
failed_jobs_history_limit = 5
job_template {
metadata {}
spec {
backoff_limit = 1
ttl_seconds_after_finished = 86400
template {
metadata {
labels = { app = "postiz", component = "backup" }
}
spec {
restart_policy = "OnFailure"
container {
name = "backup"
# Same image/pattern as dbaas/postgresql-backup: official postgres
# client tools + apt-installed curl for the Pushgateway push. The
# bitnamilegacy/postgresql variant is stripped (no curl/wget/python),
# so the metric push silently failed there.
image = "docker.io/library/postgres:16.4-bullseye"
command = ["/bin/bash", "-c"]
args = [
<<-EOT
set -uo pipefail
apt-get update -qq && apt-get install -yqq curl >/dev/null 2>&1 || true
TIMESTAMP=$(date +%Y%m%d_%H%M)
BACKUP_DIR=/backup
STATUS=0
for db in postiz; do
echo "Dumping $db..."
if PGPASSWORD=postiz-password pg_dump -h postiz-postgresql -U postiz \
--format=custom --compress=6 \
--file="$BACKUP_DIR/$db-$TIMESTAMP.dump" \
"$db"; then
echo " OK: $db ($(du -h "$BACKUP_DIR/$db-$TIMESTAMP.dump" | cut -f1))"
else
echo " FAIL: $db" >&2
STATUS=1
fi
done
find "$BACKUP_DIR" -name '*.dump' -mtime +30 -delete 2>/dev/null || true
{
echo "backup_last_run_timestamp $(date +%s)"
echo "backup_last_status $STATUS"
[ "$STATUS" -eq 0 ] && echo "backup_last_success_timestamp $(date +%s)"
} | curl -sf --connect-timeout 5 --max-time 10 --data-binary @- \
"http://prometheus-prometheus-pushgateway.monitoring:9091/metrics/job/postiz-postgres-backup" || true
exit $STATUS
EOT
]
volume_mount {
name = "backup"
mount_path = "/backup"
}
resources {
requests = { cpu = "10m", memory = "64Mi" }
limits = { memory = "256Mi" }
}
}
volume {
name = "backup"
persistent_volume_claim {
claim_name = module.nfs_backup_host.claim_name
}
}
}
}
}
}
}
lifecycle {
ignore_changes = [spec[0].job_template[0].spec[0].template[0].spec[0].dns_config] # KYVERNO_LIFECYCLE_V1
}
}

3324
state/stacks/dbaas/terraform.tfstate.enc
View file

File diff suppressed because one or more lines are too long