From f80e1fa8688f53fa23d8cb8af49100b2c9480c38 Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Mon, 6 Apr 2026 11:54:45 +0300 Subject: [PATCH] cluster health fixes: NFS CSI, Immich ML, dbaas, Redis, DNS, trading-bot removal MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - NFS CSI: fix liveness-probe port conflict (29652 → 29653) - Immich ML: add gpu-workload priority class to enable preemption on node1 - dbaas: right-size MySQL memory limits (sidecar 6Gi→350Mi, main 4Gi→3Gi) - Redis: add redis-master service via HAProxy for master-only routing, update config.tfvars redis_host to use it - CoreDNS: forward .viktorbarzin.lan to Technitium ClusterIP (10.96.0.53) instead of stale LoadBalancer IP (10.0.20.200) - Trading bot: comment out all resources (no longer needed) - Vault: remove trading-bot PostgreSQL database role --- config.tfvars | Bin 10070 -> 10111 bytes stacks/dbaas/modules/dbaas/main.tf | 31 ++++++--- stacks/immich/main.tf | 1 + stacks/nfs-csi/modules/nfs-csi/main.tf | 3 + stacks/platform/modules/nfs-csi/main.tf | 3 + stacks/platform/modules/technitium/main.tf | 4 +- stacks/redis/modules/redis/main.tf | 30 +++++++++ stacks/technitium/modules/technitium/main.tf | 64 ++++++++++++------- stacks/trading-bot/main.tf | 6 ++ stacks/vault/main.tf | 8 ++- 10 files changed, 115 insertions(+), 35 deletions(-) diff --git a/config.tfvars b/config.tfvars index 706a3ded71fa64f18554059cfe09eca8194f88ee..9c50b8ef14018c7384c8105279eca3a33545c6b4 100644 GIT binary patch literal 10111 zcmV-_CxF-hM@dveQdv+`0QQ|VN;C~?P4pmOVBS8ECft9UiYb;<5J$H_=B5TRt3Nm942k6UYN>H&;hTr z*=orlr+{<}=U9NHtcp^D0HH~4#_aX3Qa;Zs{wU7+KX7LXouLt)1Gl=XU}F2E_! z?wjke1WVQbQ+?IUYpzOYMP?`-h6wOn=oz$cpZ}1mQao1 z8N@J_Ypt<{=mhG9`D1@)6})wPif2$(^d^&wTXobQr98n+7EM3(hXYe&CPyI0%411w zNi53bp+o6cS5Dd;wA0xs)CGZaG-IWV>O~%@j=xQT^31M`M)YI=6$ zZBm2~WIQ&|PvNW{*+&ffap*Wxm2; zVc|6wU)eu;4cz}Q^Ca`Zx{c4lV-CD;J%6y|dA4oB%yPNVIK^J{`{#iqki`PLN2d1n z`kJJe=E;!4i!c}4bK`=!o*2YMnZnJ7O z$=0Qnec3%f)`-mKwSwPFMBmBkGmN>4#!l<{&O~Irc5@=~n}_5c3*j*YCadV4UPz^> z@Kpi!IUF55i(OAVrtg|BE`Y9CI$#1eeh4~(3Qm(-^oK9aTT>wsnKJ{3)wFc!TF=%b z=;6(JFKLUl+rwR`G*O=^w*8(vgdYuEu)4xH5Fmyx$sgu{zKH-K=x}=+>vMhNNM-3V z8^sr6jD_IO1MzZLA1vpaCoYf(JWHxOC$o?FIT5>Q)Yw^Rwj9#i@(??EkhQ19So_?E z)gbyP+vSrE->&P&*i(farZ10p*gm8(rwXrhmNwUGWJ#V|hb>)?Ef?%0&ju}1yiGK~ z;Ux;@9;CGh@#wv78>Vr$2Gn3b0|vV-OsRA0Ek@$iUpmTpulM$$h-a?WUjC*|;6VZG zD?H@pU6GVjjp^a$)SQN7FT26cqqqU}j2iII{DT{!nmJtf$Q95rF`+nrqN}P$%ZJd2 zt^3Tz7TK4>L=o7LHPx1%x+c+Fhc8KvyJU$Iqr7Gh?N%_cdOob1Gm0!T4s@a$6h?cY zulUN0zsOsH{`;pm$pQ|Nrmd{uHAL94cknt6`hX-0-r@cFRp!s9fBXV;iwnHc9XMW< z?D=HLu$Yn?#r7BPkQN`5$>L#2x#e*q(P^aW9+@O1Qnd2qhFE7hI*!sdLaLfcem+mP zL@cq}*|Iv4m_5*j#sP&Mb_N_}M!bPRQA1Z_xOtgPbam()g6bGFZR?r~gF40JE|fL1 zw45uLM_G(K7P9w0acG`#T73VOWIQc9SS{332QS{`9}@C>IxD|P#GTEX6u*`M!B#pg zCqNx`!@G<@{m}6z1|NtLV7+O{&8x+t;G$nmc;tU1PZm-LwlIGn&wl_tXG==kB=r1` z_X*AOFIl~}$`Z}!2g1fGW`1>u5Pv#!xA9;vtXs_RomYl{E0a}!^C98O=Ge@scK9}} zr5%lVjPy%Pe9trTT^)>mcwP7x59EIU!G-WiMuaQ)JC--4wBQ2T4CA&wNH4KR919?q zNz!kd+7cc_(;QewL3nf}T7hyqPR0ii!d|}>Vgvnb?~^see$Wc_E|;lyS=mZZ5T(G{ zITwMoBx-81wr}5{O|Qp$_q(u?Mff4<;0`bP!H%~iT!$dZ`@@Jajn`%Ci7c+nMl5~& zW};wjc`M36ja_OAVPkg?e^`GWHR97sRhvn~wDFRaZevLRarRa3v6bv|i-3efQ;ohX5 zIa}i<+urYoD!S~f<&>0)#}e+&EzXvAOl|ITjY<9iV)W5h+E#F)XK;Y-UHzR1<&WRG z{3ehb!Fa5Wu6sp0#j+=?f^xlG!gsCD%`n4@diO4BZ6S_#2yWr;aP*enN$ejCamUWQ z*6ldI`LkP@_%+W!7}zrKZmS&2Bc3n}7&Xnd-%DRgGx$)A7gIHGg8XQTwYKFN&!B>x zBzy7%S9{Q;pJ?5)ff)lK(2tyoJ{=sw2`YWlA#xp|im&X3Roo}EWe<7kB52T4PucF6 zBx|ZSRgtqckoIn??!vIW44pAH#1DUl`;hf7k>;8W+KVHSTF<$l0?8SMI!QsL_57T) z^453i%H|#4+!%BH82Fqp59}#CkkA_b$&m{7MWt6XP_rZxB$67eyqq%7`q46$J3QXz zS4zDYFvNkL6+$e@*T0=Gi@TTR=fwWb_nhQHq#;{jeDsYf<`gk$o+)Clc1Fg2hsOiQ z0R%axrw%V1CplD?92uFRZ}D^*UQKI=Xt(6XER(@KF>6O1v}d-&VrfE_E(P0x{b?#E zcd3l-6lpDO&2eyaL?EA+u;T#+s=SNF3HuR-c1={0m`YwvVFEt*8S(++ppGX_lOGE7a0{q5wMg#+%f4T&WL#brjKqJ3BFPlIP z3Z+#+i=!mbVOv)_bk}L$p#dMZH}&-4w9Z42GOR_lK_NfPr*DCH?>S~Io<-&cE}Ss3 z%W8?7pE+XqQIdU`oY z(WQ8Fr;q56a@EvZ<D_tPsO+XTI(Jaf_4&_lKkm|v>-r6Qpx{5i zoEpwl_Yk@8C$%F|P4h3s72cRP31*HDsp-TO-9;%!G%Vv5lRea~ou6|BWbt*GXb$C$ zYk_DZ$|dViLy)e@npIHN%%1-%LS)jZFr3Hl)od7XEZaAq%{==J^meOTHDnlY$2!{G zAcRMujOA$-Dcl9<$2F&uA8CJ|@~&H|xD*I!keb+Ch^>O*c99|S64VtE{605xt6Zhg zXdHJ0^WuWB^`_tF>1Y2nT~D<*w^!!QPKfm&@fH)D2FO4u!kyH@|0+RCgb&x-FJEDw>O(JnPAt9Q7Coiuqr-x6i;!jBcFz6uGW;O46PIXgsI8QspzX&x#%PB$%uI9J}!BuF4_$5WzW==dIA7)BUV zBn1rUY?BBJwPl>1_@1W*uve~+{_>@A704i7*K@&YK?z#gUO{9Lrw;G@<-b~cSnQi0 zOa2O@VlF@tFgR|Uqs@kU&-B=bg}sZ{>hu{3P|fBE9j;{)9^@~G{5oY>emRV)u_^($ zGT4*xSXD4!4u%oA&5TO5b5$T@5dIzV_Y)lyu>)k{S3V{k4D3d~iY#Vmy{vk-!Wtdg zSm-EGliKVJ)1sNj4$M`qF?B*nm_M#@4bklRB9Ee0Q!pPKZkaTts`tYy;UMp}2IMA$ zhP~z9ba7}WKuH{HgkDk*#pFLhEE6P83->Y}EJA*!8PGMxRx~o$QrQ>jiWQ?^q(O;) zUFN8O>9d+4$OAoxFuNE+l@eMp7*Q_;!rnfY73)zF!9c{!qXn@<@{9UWQJ!F880iBb zqI3s37_$>G4o1%R6>PWXRr})4B(&MD8gE z^S_C&z#pmRo#ONBqu0IAl+iNC+Gbm`L0eHPKN30lOh>>E))QB_Hp03;P0jY7o1i5d zF^ITv_9Bo#YkHXaH1R%$VUVq29F`WKhF(*&nD8y?#7~xRdH+0jdYh#Rpc}Z0^sM#Q zRb`Igb9A>}xDJ1=FIyzIsZ^6|K}G8EL$NjS%~XPgd}fI4z7%K^sV|7Ulcz(JJ#VMy z3=mj$AelAyG9Z3%)&8-c?i@su&xD0Dy19A*em{at2E4G84r_q;(GC;YWR1mh?6ULr zBHo%BK7VFag{kylH;93}iyY~d3@%jUaS8&G3NIQkYmx6Egg>{lWH=#3biRWqhRffN z`sUqMxn7;iN8hGW!45YS7g<#?xoedS5V72*yzDQE~I&>cV{$0L|C6fE9pG(PJWc%_?OyXdVbc`G0=1;l zCmwT6I;;DyDTQuP=}^jf?;Ehc&{ZEfuTI6-FYbGQ?~YyYV$uDurn7vkj|K2XODedUesnZm@}v2{?H}^xlJektRs<( zG~yD$2@wX$I5z~CnFr{zSp44Ub4K7X6*ft^4$K=c$GP8hcic^b1S^nyJV1y{q<0N) z;kWS#AkUKN6)E#64a%O!JMQ<{PpGM+N2-fHqbYv>T)`t_hed^OP05AZ81mbLyh=X# zju{I&)5+$-7zh-?9L#|~IOi}=1Hz=|fOH<5&iC`BY!C|dKVHuLMqqJxMn0}O znRhPMIZ`r-%t1zE?Y7MHTRnKt%lHt!D`+tjo8`M+P;~G=l3|w-_A(BRxOb&)zS?e6 zJ_axmIlvB*$iwOXp#~<*siU!@uzqf@d=x2b>`*l_M46T`oaDp9aT^H} z+jFZ{WOb!LzzC+A+aP7U$fh3pKVhRSw+-mtb)$3n=?i_-qU=zmQ?*TxVd<0rh!?P* zc{fgajMkI}8hr^ZSkJ`wPD9o>w$NQjYo5-1uEkkXQaVdS#+1-~-)(sG?mbX> zCKDNdi!s>Vuvi>U(1N0Q^d>oc10JhfBl2oy*uGQ;NiRJDYr709|ulM~CSzGi)K;u(V%h z!cNZb-UM5SZTQ`AdvCa2;JubJx$85**(d_OkhK)iIEAh7@wEelhW`rV5b9J+H-ZGE z%Y}Ty_W4zk1*A-;Ujq%QRM&R7i|MVAhW9p2G0if|dpNQ70bhD`n}DS%C1XSy$PIg> zak19(evmCc`HnPbda$0%i^C7oz~=*OT{!+as`UBKz;Tw@{I{)ikM1%jHZHg%`DK2S zq0OBcFBy=D^|0zR?3PF?5XT@SlRy}1Cn?_c3v0aBP(XxCO>SaFF5sGg3>&g^>^40C zsl*FA7WUIf62$%PIk}npy+5byc;k>&N<4e=OI(&GHydG}(e1YKGA1Mtm)VuCZ6jVyFG&jt)@EV3AwUhA9v2A z*7X)e>tCeJ0r{4jjLfI0$&c&@NX7T{%_*Kq(=C4yF0F4;ik)pjF806*O$QSy%B%ty z)+(~ReOFz$&RWu<02t2jbA$+7lYmeotk_20Xu#9IC`WqW)_+nsE-=bo|5x_Uk=8LI zKBb5Qx}_0kU7vT7e^+G?W5$%w_PqDM_dagJEV7{TiG_UoQY66kO#Qb$+62Q#6Hpv> zy_s+SS#pa)o*{o?mqC#=(XnZTF%vYJm@osKngurtseV*^x>cJgttyz1o?}o;!H%ez zRMNLUu(Q3S0;5xtfa{+RziQFUfEzp?hS+i$zy`c85AjY!()o_ZRa zAETnwulVU{pPm`B<4fc?yd}st_}U5D{k7CxADOLVG-umrI-+LA!E5w5 zoP|@JcnwGMtV9}uDbkoZE}dddOz{EV{l6+qP)^-rTT+ciCJ0Lm5!e7Qs0Er6Un7Wm zaeEy1rU%Wmb%T5xT`C1syxw#=c-D(z8Po)mfXB5^HFq}EEH2azE?Ds0j}96U`$_cc z9@C#)N0AEisY7QNKcjrM-t={)6>j8Tf0tGd|G}g(qHcZ0z`y0)ekUTJUVp3>z6!oQ z%HYqjid-jl&?aqwcz~-5Cn81!P!rMW0v!c>h-}a1D`$AuF#1EuZkSw&B1s!@<^9kN zb3u5DGQb7ywgaqs@YmZbA)+iF^0jU&gNpc}d-D`zyhvhDE)VcKplu#GXR8~9nqg;M z3|uVqD19<@gn(N&>C=#&WaU~Naop=mMX3FUFQ#&Wt`WnxK{O^z4ZZED2u7Qjxk*m7 zdbYB5nw= zS|ToCR$6FAG}0hueG5yd zqHRuqG(&3}{CS4i0-m%s3ZHmJn?TwFzUcx>&RAw#_DaAZ4LpgfeKJOiXHMc@O_{=Z z`O9V*@)(84m;8;U&t?h7AAM#i>5DcTkg(9-l3jifa3exfrlrzAzQd`FEf**Fjc#rFczyU0`7p)WIZgQJ%-Us&H z+QdCUwc;Z;kt9{P%qjrH*<(NPF_@PJ0e&o%fFclZ4L=NJPU@md5Io2-R&&4~Enw^? zGu~f1A5pYhKqAa|a%~Hd+->L4t%+zn(2k`Ya4(eIQ^FHFKWc!ge`(bkWGr>8$CKL&H zPB!zLj*YW<`7hvIPM9jBTAtC-L#O(|+TBaRIA*bbbSkn-ns6^u@FYE@D6y#6++Jz5%*PQmCjlGzoQqeXi`4uZ%A{iXS?^ivI37H*U88 z4b?#^K6te*kGh2*78L`4g}>HPI-V=kEDAc`Ijj%50sp_JYeZ=T5+4H8aIgMbF4T8R z_;g$)l5R0G$@u<`CcQoJ4|hG_C@^Ta#CO2|WCulQzZgMYtecs#$r2><5oH;cR_M>) zHAW#?QD*MKV2=*vUmxAc$@8y`?V$fX``gx79aQ^X9K?k*u-(vK)wlE&&}Yhzz-SQ3 zAkxzOD}Z(9#n#XrJz6?y9N2keY}X(8<`_B_izb)`>mqT1o<7et-gr*Iae7*PHB%ku zkGz3&Q=!ju6Y%e-osDTc;K;;kIsQKb0@y_u4+kR@)|xbzs3ePy-`k0zW^(BtV5)?0i)AnB*2K6%MlKVvq zuvI{aDkMD=lk=@ITEJ zCeh|qBI77+4jU%Iw$-jzJ<2*L?XJi5|2W58u={CWLbziwEst;f9T$ASy-z4*Jz{=? zf=gy?3$<`!MPf zA%Irq&{Z^D-hlY3Ixn^wCpikQtwnG>B1`x8a_WxE2F-1^|4~}H!wG`*jQ?Y}C*z8k zTSX7%eH+D%HrpYsgv*Z_QEff|v_4|S)ez&7?4o`!aPHZ)L#7?L=1{O?QuGtkvn93j ztEF#x`QgG4OfhEh8FY>`4q_xb-LStF8t52&yXA^6R91~|NW}VlguhXE**AU)7t*X! z>m}H5DLFzYmyLCiU^sOdr7spr8wTgD&o?O|iG%rjR^>gIiI zP>LXlwf!!}5Kx*TT7njc@gNZg)0iTZn}~k(^R*4_f)pT0AY~ydOT{~vDREU~yB@mV zhskxy&ss>E=8!_BS4wYAA`bzn^ju=z?BV`X2*kkt-fB8yIGX|a!UM73jhBw#$Jy)~ z5CF-X3qeS@tV`U2O))|Ryd{1o7P?DMhA8j*GcM`3Ch|9{0xr1J0SpD--<YFgVaiF|=3Snaz`&X`i}Xe;jN7aLZO8_#yX+E%DK-TbM7&^Pce z~dL8;_!uFavtC;@W7}xX`ikxa|RxGC&%RXb0tV02#Ld&-#hbBlD#xwKClZ+&hfo>bv1S1kys_YyYf zI7w`DTwP~2xiIOt$2i*`)<-~c`z9iT@ShiA-B(m`Yx&f<4?Fed+GOC`leM$CfZwdGFT@OWC^dC9VHW_`}Vac(Em!=qQ_&(I~$F&sK>@6 zf`~g%LV$VY5d_$xqJBov%sZ-uRVGstk>g%_%koV2hbY_5p9TG0KDLntwOYrbaIJSJ z^CVQ&-s)@w7y())+GG1!(f&`VKC6`ijY~fq&<4T8VO`m?9YwS2#R?@mB{6@AMibU> zr0_}~vdnV!Zps#;In8v2g<73luN31g!b{dSq@%vF&4*1E0ZMMAtC7Fd( z$>QerQuR)u7|;e->@p4M#x~n6atKXLO*!~)<{O4!eE!I5>cH#jB4mK}l(ob8dVmT; za`)~>Fq+z6Q$(QEvN&<5C;#nf3?KeaBgQV~Vp?cV&3ZE+|t3GhPNg>VlJFH2p%aqhhv$VSEX3H0dq*9HE6B>|@RF8Pf#;M{t%{1B( zF4@wh<~z&z8w$n#AY(QzOhCgaez{FQO+`@*%5glydJX^9G{%g=e&9DH{(smD0QjmK7W$vGp(ihS{_BupH4 z05BiK{b|6PqxWZyBdbpjInv(Ovu|>FlE5p*Na(}%t>H(Ol%+#wY#ehrNi_QE^;gYX z6i{-pza>u|+fdOzrU7A+S+(%kH=ARnl$r_;D|Zfj0HvgEHY(4UZI&A(y#}xdOLfa|LHSdHxcDU~pPOd%_uMS*`VkoMk*s+EBo=QZx$RN_` ze54@b6R1GKvGunbc-*;p)!&K=VCcFtWNoc5+$RSf-1sb-;!15P3o5I3Mey)xx9q-1 zKHncy|DN&_&Y13TgbPJ*B|eh7y`Mr!&(7j+8d`<w)6PY3XGzHc5jUljLOd;w|CVu6U!^TrZCD6xu%ItqH z-t1`UGk5?9AsoPK7UMt2{lwjIv$$>rP-AHEU3TqqI%9bFiXK~7lyA@x=u#N$Y6OUF zK}I89&0{iVc|zb~zXqt==3%#gBvhej&sa1pBYw0R7f!ML;Nv}>HpC7yJ+@>b0bKX{zX}S@G2am+g9+rx$Eul z1tSzpg>@_mwClEq(`(mU7`U>r9@bwMmqK&E426hLEXIgjSs;mn{xJ4<0$JOaa+3zujO)bm9jD~-SL6>?*=r_y@d zlV5Vr8oc(Q7&>k_mEq3SLiZ;-MrqrRG|Z9hIBN)ssFdbpJM@xyLUIhqt?g4X0r?k} ziPbYp+|8??lWUk_H(7a zT^s@3%q18{F;!uBUk#PbUCUy-YZMP!C>_$0Yvr;`?-Jw0snY*v1IH7X;MHZg;ry8< zM<0_L)n4G81hdEWI+$pb&Tm>;y0H74m)Jlbarm zxaQct4yMhc*z#LZ>Ad*tf^Akzx?$;3b2<2QipO_|jSy+5Sab+T6+S4aLDAp%b8Cey zxJYmW5u)JysqJ^gxx;sFH3+y&mfGR)nA(U!6E`tL15Faxt0a)_LSNL?5EqlLTEAGx z$xY;66-;hyP5RtL+0ZwzTN-U2B3+A0j!~8?kHg6#$fQu&sByX$RV64>i10hoo!-j8 zw@?FGbVKy=%1k82g8iBe47yX=qp z0xZEa#PhbZ+>9Hv?O9JOU6EAfKK7|nwQDV4FdE9~Cf~*^q~I%1)oSGV?U3^R-kdH^ za09Ebrr4woPURDeVzLVL7tloXlrDAlg0^+B(Py{W+aOpp^FIg3*q+-bo^mjUi*RoAH{1EOJM9q`_<>lGRqT zpQ}gKr}XNJ$$tU7bc2RRoJ;zM^KFaN@kiVZ&IE4+M#n!(JsiN7@!TTAocKN_mstp? zLAq{e0>P+I<1bECUYh1$R8GSkL({>svQ8K-DdYScE#B17kSh6B{UCaJ6WOR zbY|ZI&f@+#sq4`ywqJHfIf}Uxjr=EU2Rw*j5jQFU-L0TL>7sP0mrlKp@v-a;L2v`K z7!8#m5?+N8_x zL9#5({L}=+bsIM9cy;QlCQFiaf?VWSRSQ_^A717GF;M8!X1j=1GZ2Xuu#;-(7GOa! z?#!OB1g6Dr0vF2^!*O%4Ke5W0)Z32vs(0hh+&(do0P38p!XXbgM!&umff-JF&r)yA z0NY}_ymLoWPe)q5+Ygd6_||ju-)xhzFiheG(bGnbjKPjfQa)Mh>36D(Xw#<@F~%;& zZ9}KIDX4x~+pf;fmI2rV?K{2>%JgPPDK;5GT)(?f8msFzu%*@B?b%~b-fx4AEu4E5 zc8y%XY_fT*cYF#uWrLe=L6d)jR?!wP@cMbgd;sva@=#)~Q!j5nN9#S^EI=9D0 zb{eRv>s+;=PXpxUgcs3fF0eeFic{WV!W{QYPWX8LwTkCUPLaN|x#(!uubpi0Cb3 z&F9D4+WuYPl+^BTCTG+=)6xwEP!;RIz&}57fgN6`-;AN4WivN4`hrf9FA4{ZMXDSf zdLeVXu}{~{6Y+nl-X?7}!pHml9=G1ZIH!=MD-s>&yKv@wn5~K8lf8Auab7J#j^uZ-!a0XvB^eUK$?m=nYTP^u&YI0wB_Lck{3zBV%l}BlWCgjG;zJfP|1Ke6z(Z zS{;`tS)0>mi)LYZ7f&Fw2JJpt-j?~X{BZ2VjCaunA^lOTKp*4B{{1}~tT)d4v9`|p z3@4R%C1@fW>XK-8lK$U(U^mozZQfGb$M>&})oo{Fgs5l!Ng({gRWEHCeOU?v1!Ma8 zh|)3Mgf$CFO^kKwKavJ5S<&Gu9cRxdm3;PDPryMYe)FSu;{D98Z zh5E4A+^En>J9S&pm~e4Qsp`!32#RHeaz1O0^Ag_iVJQ}| zhr!Regovp4ZMM`avNlK+iv)sU+qL;&RUzW>uNOxJyQ#XP{Xi3;Fh8A_52TY4W6^3L zZh=KeDGn?5;!9~z=_0|;q-MkVK$J; z;N!N-0KEneH6{FWI}cl@RJV2!H$V(7y{dkr#)dtIS%9JyNEDGF(;DKC>#jBpBP4_) ztl0QHAU2+j^(-MMPPVWOS+(g4rk6L-N31!iYrlsE(V|*xcoYojwtFFYHhX&2=;|u- zbog@3mezP^owL$ZNn#3!?|a}#=Y%vOXG#%|*;>Pi$!8<|^CTli z5z(^M_QAbCt}s=YG-q^1>hr@`@ht4@I*j*+CMcPKPaP@3eDS-c#_jBLBm4Wb0$bJ4 zSqUfd3Q{Q;Gc9w&H-S}&Fzo&EiRnhUCd^FMt_q3aJ4f6Xf#1^{K)d@GFoxmu>>dl2^=ealRJ$UP_=lsAjS77+s(t}V zJbDqj$?ha(v{L)M2&P8G3QAnZWsSVZz8p@;1HE~&Yc0iyZqZ60mc`hg;Er!;V0@c%;qmq-kP;4bNzZFZK01@NkT+{=20S5 z_o5oXG!m@OXT$X%<%I}bpkU!=z%GN=K}XLTvpL}Iyn-qOUM;%AY03KVAA?XViJuGH z6*tt+aWftoH=Oo990=u>FHuy58a0^wMzOOq2J69Q_j19=?lFr2g0I0zYMt{K_yV{a zbMeSu$~LIuw5krMJnmCku;0&ZYM^QpI7kc8i+m;?&H)}Z0^rF^?bzAJJR~<;ov&Ay zl;VJ(&pn&E3_h&vnWqfOEMH*b5)0#vmVq`X4@x^Li6JKCs~xPq1Y^XTxt)%J7~^@= zz`BgeHF8@@lzn^#?E<{;?YS$on`tLJ=es?i<~_K+hujf*=WVze2F{9w9lAq_?UjvtPW@1DxeY6K1e20I`1+ zyRoPV`FfjSAg8cgjp0-^GxSR42pqiytwGpqvx4m;pDVIvS4EZNZIX;onS%O71F@5R zAg&+qWdFvM4=E`CL-i~M;O)c@v*4%oQnHw$rv4cOd(iOsB$rs-r`1pIUO-00?ujV1 z+8w6+>p(uWWrnY@h|tqv3$0vk9Rx*xIv)-pau}sk9X#(jcxXIRB7Fb8qZn03Wln%M zTk?y~i}n#vEs7lNG9pNg%7;KWk5olBvW?Znl!%x@2X`yp?^N3G117c?d=RgxiZS53 z7R(4Aw!L8e)I|HOkMkWM;ZOMKz+6iF9L}Q60M4N}(?I-yu}*CsClb?oe^`up0?lJG zf}DI?DAlBiPLv&ME>04`-oIrrDO&zfS!Xg!@}TmV>gn#%jQr+-=ViFqsj{*WqK6w{k0*Ok*T5?? z5(Sj1(6&f!ahnP|!*^0ZiB|q5?;&~ZwNpJ%>-AN!$HI*bUX)po62GW<#F5;f6IvVs z(MQ^k&m6~8{ykQLh0)e%f?!)%h>}oK_{p@TM)b&Ifk+qbOO}}$z)6D2B0)JH*EL;e zDt&|u1Y-yMn$vm0X|MxS7Ql_FBqX8&{U7<^^!v>4iCF=h0$8^d8>oy@)l10^-cTIJ>y*DJUkYDohoa~; zaxJQW(;pT{oH?u94$R)?nMZF-ro7?TNpJ$UB8ZQtdEXi5jQ?|)q1%hCcb%m%Pj^@7 z)Gj|#oAA*M!Qh5BC|21*PGipLy;sk0;-PUr@38TmE$a)2uGOPU$$B4YY!!UpyT32e zf$Qh-2}3RW-a8o1ocP*DcdALC+YDbu_Wb$rcQ`AWOZfDWC1^f~X|%XvL5)-5)EF(# zd{>9@-{C0_Fx5jvk$!vPu#Aq;FiaVX_u7ti5@7O;P6!Nw0!!mVnrh3#k)at4IU=9# zx8CsDIg?lo{_EIWpoIHA-+1=yDxKgeL7W=G7%l?Nf1E_>(}5Y2D{6)bT_4+}X#Jt; z);g`|{+i0^F+MQ0HpJ&=nUo_042GcjwToM7y!i(9X{=r*Rz6rpGK4V`spggS*)H!N za`Bk!ZYW5v(QCLObV1VyIV8k2vhvl*b|57oIP%EiO~x`X!jMt(jB+kBEe}x-`v!x` zS`cUh6_HJYU^a*Jhc4D7-}=i4?)TIK!+$*=LtKaw*>x$9CBQprYOWgUX<@R{VvWwK zGxBGEBwFuck%Ub=<6#+7-su_R{rwvYC$bxdk^i_e*fkPVrchlh{s%W;+ss<9vnd{Q zyENfr(7?HzRxWNKFt!l^j@C+yj#R8-;fgyL=7CMwbUx{C#9Hi5lG?oXClSN<73y~I z5H}S4;x|(tyeWVwqf}!V64J!)oFi-c&+Kwduhpmv0LK=&S@7#AV>IC-)M3bLGg#n} zFwLlqU3vNI99K&S?!C4-H;m-V_=|58>=%Ss#zP9R_b%OpY+?PHcL|IKF$j8%vJKBKi$HI~sH9!+7M}d<8F?E8L>t zxY|rsrJSW&Y`n*jEh12b)Z23`Q^gV=E))&XH9R8aI5mUb!qQoLaq!(pN@_+Ktb`|v zQt52&BS#jRVm%L;q$JH@_!xHIZ=1XqY*vUZ58sF)oP9Mqnuel3VZY45e$T1xS*Vem zY$u~f>9{0N^^gMn3MKZ3yh-^QZTRnHc%A*BHZ;OK_zl{*4Ay5x8ONwFoH1SB_aG9a zC@>oG%5a3lwAJB$4Qc&CGB%J{*u)#iMst*6Bfde;ukw60{G<^?kyFiqXKT%S$ z2;6y zaXYdXQTlbd_H5AQbvF6Xqcvb8)u>mx3o{Jv`eFIGf8@s)GQ?sx37GdgaAe6QvU-_Q zhARm)guY$kZb1VsTRFA^6}xJsx<>>ty~WT?q+f;l|4YV!M3U;?*`J&Q2iRg6)wOZ5 zi!M+xuhXIZu=DGb{G;u<7S6nTw`*@nP#IW`cs!9J$5f~hK;0m=4c6Nl&dt-gfS_#J zu7cU9T!g_X!gWP3%ub`*T)#s2P^cgNi7*uM^;8()2d7d1@XTX|A+II`>HEp}*m79K z3z*L}17Vw1O;W?1f#OXuo?ICKin9ia-UN9&q5;*vzAJ5rcS*hPmYqSavd-P@>PVqL zYWy!;&(=GJ#uVauI}qDhn?K`Yczt{4L>&xP)g%yO64rTp!*n8{tb4h|p^&93EW zI^LA+6xN-bCHIJgvJmkq_KB?2%3EsLlMkIQs#5(CeY^&Su-p^dXmRI+iyCk?M%*6) zRB6!aufrf{fH8^f6vJRckC4B6126Wu%&D1?PtX{l9~S7tL6WT``O41dCL4e-YW~!R z?s68y5BhtiW)3>%;^!kHGyzxOYX$NyFT>hAMwaB7{2r|UYyh>7hbAi1bItg1t(QiZ z-uVzcUT=F{VBN;k!Tc8v#Smionnrh{=Vtz3d_wCkVoEsX&1+ZzQm*VS58l{yUo1Es zjWHgAuJ-=a)X2E6evf)V>@d)pm1q=E(Ti!{sT& zYXCwbDW`@FS1-n0Nm%ODQwIV);_)82SffLxlyh8(FFiQ!S#FaO4G&tc)18#sPXzg` zRNPP5nn$L%vnQ2<|6Z}N&c^Z?PyAMrw%TEE= z^d0geOD2QO3wdX*kzLcX65Ve#=z>a?hE+gyh(kE7+95!Uuj}LB}RB8&G^7$d{Z#VsJ z{M=rZK!E91H1V&(UtWPsY>B4}lIV>H7{y+5NsPCi4?BmwhouSCH4qEx!8(JUf`ap6 zMt3*V33W?W7>|a_o>jP!&Gxxm&xs5c@r(Mpt^>b#_i;`QRLfOLD-s2x-aTF)rPdLt zQ)wHmhZ2TC`~)vqJ?{|te^uKbhVML-m#Dr%^K=x~YTx@u@KjJyun0U3 zRRF%pfY>aan0pHR0xOx`_8*Hqv1-NNijO=)S@*`uL3I{sapl*CHjIY?a=(*jMg@^! zT^GiIMu!?6%k;k=1gwn&FQ#4f3z%SIo&Tf0%wX)av<%!D&}*4*8VRQO4Ff?O2%O>l zolFA<+lg@$@Jepxb|_nJJ)ZHvVcruBC&?=hSaB=WJIL!AN}W@)v92LD?ZUxY z^3}7WDNQ(!_{;eR*rD$%x@6scDw_VBMi}$}42?E^rSmMaW}0;iF4UMRLmq%g zZka@}m$yK7s%$s{eOUQ-H-Vq1wr?Uo$#i)#63J7-$)GbLq>)@Uj-C~fBX^lb6c43L zhZ1JJC;IRv?HoCE+z!Dkg3Nw%wxg{Qi)5;f((e>i&t7->G+%y#tI-U* z!jzdh{9uNTcH^rpNL2e2_MwGfQpE!*BiiFNeZI^)QI?Tx`D^Aa&K*t%IIN+6P@Xd|7xKDFaC5^UGmCQEWn!q1$0%9-{jguL{PmU2pTG+@+KxPdZat( z)pJ-%sS7jTR)ezeSLD1*JSCoL#mVk4&AueBB)WNNv5%+o%l12RJH@~wp2a<+se%%X?dGrLjjf}U z4jzv<5nB^|p06rZqTid~R76oi1JD@h6?Bu>NX%iY*y=Q7yb}$R9}P(y7Mco&?@0PJ ztDahepCvqbgCf|7u1X-GMJ|vFk;eJ`j;zB;Z2AIh@?v=Pim*%j|T~A-0 zK^=0imlTJX*oXy2W^savCz%d&o-I5nuX%pEyUOZgC9g49eNpLfC%3K=dR>)CR?P!5 zPa>{|QmB1}3fn$x4}&$|JXN{DKJ6r!7C7&XgUoUTu;%-xXH(2T(i=#-IhkJ!Y#vy1 zq!)YGpZNA5!TA0TfKgAIRuZMN^vPuhD^IZV4;dkUyVtb-JEto z72!PnysGxH6KND|xqp58Rqfh6i=MM^PBH(eAC3}4BX6r=msV_dV@(y+4@V%TLG1Hy zrws|>hgb_|$cZwuS0(?%MASAL%vjv44!`xK$_g8$9dz@tT0tMuK%Op!Bsb8JBAl`P zjZWIp3ub2t3j z;UcLhC<0_i1blPf&zKD+&Lpe&gm&v@S_MPys@!T>9SZM7JyO$3EK1JGO%i%w1>`b! zv+wLluvV*+$+NZ7kP?JW$Y(45%_Ag>G{HC36LL75`&f92{Tv1^#hve3=|@r3dq&NN zco2bVFWvA$e6|s+seA7^P!kWmY39Uz4gq)%*Wtsd&TGTa6s^U!-Vs(M1117jsAhMH=h(Pb_Xj^xFF6#e(Zk-2w- z{za9oucABVap#03olCOl4auCi2yHD-EN5JN)cANEtF-F_zRyOXUyVzH zm~Nnf{LUgyuOwmY@Zkv+yO+TMYDgZ4RgtPsSgugtLmS4{kT&i1a^4OKZ~xX8szSD}EFZ>)XNB)_ZNS3lygmQFKVgi}1mc z2k)cIcU(?_PCgnu#c##2GVV-!2VG`xtLsE@1e3WZ8fEH{K(Y>-gh{QNFzI}FAJ8WX zwG?ae^f*q&+TO?yE2G&@QR=8(DX=%pH&q^0h+SeJzs;w__vJM3``^fmn)(0zz`cHh zEjcXXTiLA4yV%C1j2)#u`9h-5pUT*14Y5+v$RliJEiWSb%-;m)S-#EwPF9llp_@5I zr%rIgNZ59R@#C)+d~cMt1baFT4mC2<*p}PBwf0bSR7b z_#j9tC5*lq(Osy6Fi!!%HJurqyuvt@!It~scJC(-I$dzH2fa{8M%+n6vGT5EZOXUF z)P4D3R%zX#VQ>>i9n#5^bGeB*jSOL5L6^yUI9=^RRIWc{i~Wo@4gRsY0j7Dxkh2UyWgfdA&(gEBg9$Oktov{=GuW8OBd3mN+(|hV)!Eytu-x7^r zas~jv7I$F@??*_eG7jb`y1%5`wz4AA$)%^-PRAL=V^RTo;wHd!1B~+?LEK7#Y<&RL zU!_W;6<45)08TVVyq;om?;WLhm8M{fNZlu=A0Esn{&-6O0&UfQ?o7@SbMi%`*v7?@ zX8Q#=k5?rkf7x{3IeP?ww@0Sf(ytV5C|QkPODGS=nS$@nJX>1iJ!&iC#1PGSH`-{J zwOwh{*U#C5xe}POY3JQZt#etX2qLJU$A9?#0uZm|L$jy^XUQv)QsLQZ?_!!l?XcpE zEGs$IF`EE(3le7tAdyXMHZzr!Cfb$2F`t+DB9~P(eOaNAO0}Z8nEY~%->8u~tlDz% zn4H-WwX#p-*(}L4oMNB?3#znvSP4;_MdOp67Hdx_im{O^mgK@%^o|T7YwCBjzW*-( znifSKFA0$f7~C2L%fB#=9%B528}NnNsq*(O+1J(-ecl)^0-t5eQNRjcM%O{tUyI5E z^P7eYcN7e?;KA`{_*K+}qA0D^(*<(NQO&hVdA0Z|371HK-ly(_Nx>@|-u=8!theV- zU26&B)vw*&GRt>tpXE`1vDFzUi_ogeC|hh5j_$pr((nC*9cY`VKn5F9P@h7&ACAYJ z0PDG89fJB6P27+1j<8a+lrC)*;CwT2zbBsOmb#XLRmm;YVzrqfk~#4ErQ$u1FCWrK*-bgQ@5Z>5iaqv%zUK_B zoAjGgW!d=!#CI%WqUD1mu!V?H7Fe62rz~g$+_iZrjPb>S&$#_fw?ewMO3!fJFWi+1YDIw`xt3zo}V!9{9?f!@y@9Voxt`9_tOvXw~?NQ#cGynhq diff --git a/stacks/dbaas/modules/dbaas/main.tf b/stacks/dbaas/modules/dbaas/main.tf index 79489348..474cb610 100644 --- a/stacks/dbaas/modules/dbaas/main.tf +++ b/stacks/dbaas/modules/dbaas/main.tf @@ -213,13 +213,16 @@ resource "helm_release" "mysql_cluster" { EOT } + # Top-level resources apply to SIDECAR container + # VPA shows sidecar needs only 248Mi target / 334Mi upper bound + # Setting to 350Mi (was 2Gi/4Gi - 17× over-provisioned) resources = { requests = { cpu = "250m" - memory = "2Gi" + memory = "350Mi" } limits = { - memory = "4Gi" + memory = "350Mi" } } @@ -251,15 +254,18 @@ resource "helm_release" "mysql_cluster" { }] } } + # Container-specific resources for MYSQL container + # VPA shows 2.98Gi target / 5.26Gi upper bound + # Current usage ~1.8Gi peak. Reducing limit from 4Gi to 3Gi containers = [{ name = "mysql" resources = { requests = { - memory = "3Gi" + memory = "2Gi" cpu = "250m" } limits = { - memory = "6Gi" + memory = "3Gi" } } }] @@ -287,6 +293,15 @@ resource "helm_release" "mysql_cluster" { } ] } + +# MySQL Router - explicitly set resources (chart does not expose router.resources) +# VPA shows 100Mi upper bound, setting to 128Mi +# Note: This requires manual kubectl patch after helm release: +# kubectl patch deployment mysql-cluster-router -n dbaas --type=json -p='[ +# {"op": "replace", "path": "/spec/template/spec/containers/0/resources", +# "value": {"requests": {"cpu": "25m", "memory": "128Mi"}, "limits": {"memory": "128Mi"}}}]' +# TODO: migrate to mysql-operator fork or wait for upstream router.resources support + })] depends_on = [helm_release.mysql_operator] @@ -637,10 +652,10 @@ resource "kubernetes_deployment" "phpmyadmin" { resources { requests = { cpu = "15m" - memory = "128Mi" + memory = "100Mi" } limits = { - memory = "128Mi" + memory = "100Mi" } } } @@ -1076,10 +1091,10 @@ resource "kubernetes_deployment" "pgadmin" { resources { requests = { cpu = "25m" - memory = "512Mi" + memory = "450Mi" } limits = { - memory = "512Mi" + memory = "450Mi" } } diff --git a/stacks/immich/main.tf b/stacks/immich/main.tf index 5c7558be..5802a713 100644 --- a/stacks/immich/main.tf +++ b/stacks/immich/main.tf @@ -517,6 +517,7 @@ resource "kubernetes_deployment" "immich-machine-learning" { } } spec { + priority_class_name = "gpu-workload" node_selector = { "gpu" : "true" } diff --git a/stacks/nfs-csi/modules/nfs-csi/main.tf b/stacks/nfs-csi/modules/nfs-csi/main.tf index 962a1fe4..af2cbfd3 100644 --- a/stacks/nfs-csi/modules/nfs-csi/main.tf +++ b/stacks/nfs-csi/modules/nfs-csi/main.tf @@ -23,6 +23,9 @@ resource "helm_release" "nfs_csi_driver" { values = [yamlencode({ controller = { replicas = 2 + livenessProbe = { + httpPort = 29653 + } resources = { csiProvisioner = { requests = { cpu = "10m", memory = "128Mi" } diff --git a/stacks/platform/modules/nfs-csi/main.tf b/stacks/platform/modules/nfs-csi/main.tf index 962a1fe4..af2cbfd3 100644 --- a/stacks/platform/modules/nfs-csi/main.tf +++ b/stacks/platform/modules/nfs-csi/main.tf @@ -23,6 +23,9 @@ resource "helm_release" "nfs_csi_driver" { values = [yamlencode({ controller = { replicas = 2 + livenessProbe = { + httpPort = 29653 + } resources = { csiProvisioner = { requests = { cpu = "10m", memory = "128Mi" } diff --git a/stacks/platform/modules/technitium/main.tf b/stacks/platform/modules/technitium/main.tf index a8b8910a..69f3c76b 100644 --- a/stacks/platform/modules/technitium/main.tf +++ b/stacks/platform/modules/technitium/main.tf @@ -30,7 +30,7 @@ module "tls_secret" { } # CoreDNS Corefile - manages cluster DNS resolution -# The viktorbarzin.lan block forwards to Technitium via LoadBalancer. +# The viktorbarzin.lan block forwards to Technitium via ClusterIP (stable, LB-independent). # A template regex in the viktorbarzin.lan block short-circuits junk queries # caused by ndots:5 search domain expansion (e.g. www.cloudflare.com.viktorbarzin.lan, # redis.redis.svc.cluster.local.viktorbarzin.lan) by returning NXDOMAIN for any @@ -74,7 +74,7 @@ resource "kubernetes_config_map" "coredns" { rcode NXDOMAIN fallthrough } - forward . 10.0.20.200 # Technitium LoadBalancer + forward . 10.96.0.53 # Technitium ClusterIP (technitium-dns-internal) cache { success 10000 300 6 denial 10000 300 60 diff --git a/stacks/redis/modules/redis/main.tf b/stacks/redis/modules/redis/main.tf index 24dbcb1c..19c8b0a3 100644 --- a/stacks/redis/modules/redis/main.tf +++ b/stacks/redis/modules/redis/main.tf @@ -236,6 +236,36 @@ resource "kubernetes_deployment" "haproxy" { depends_on = [helm_release.redis] } +# Dedicated service for HAProxy master-only routing. +# Clients should use redis-master.redis.svc.cluster.local for write-safe connections. +# HAProxy health-checks Redis nodes and only routes to the current master. +resource "kubernetes_service" "redis_master" { + metadata { + name = "redis-master" + namespace = kubernetes_namespace.redis.metadata[0].name + labels = { + app = "redis-haproxy" + } + } + spec { + selector = { + app = "redis-haproxy" + } + port { + name = "redis" + port = 6379 + target_port = 6379 + } + port { + name = "sentinel" + port = 26379 + target_port = 26379 + } + } + + depends_on = [kubernetes_deployment.haproxy] +} + # The Helm chart creates a `redis` Service that selects all nodes (master + replica), # causing READONLY errors when clients hit the replica. We patch it post-Helm to # route through HAProxy instead, which health-checks and routes only to the master. diff --git a/stacks/technitium/modules/technitium/main.tf b/stacks/technitium/modules/technitium/main.tf index 41a9934c..569b2207 100644 --- a/stacks/technitium/modules/technitium/main.tf +++ b/stacks/technitium/modules/technitium/main.tf @@ -30,7 +30,7 @@ module "tls_secret" { } # CoreDNS Corefile - manages cluster DNS resolution -# The viktorbarzin.lan block forwards to Technitium via LoadBalancer. +# The viktorbarzin.lan block forwards to Technitium via ClusterIP (stable, LB-independent). # A template regex in the viktorbarzin.lan block short-circuits junk queries # caused by ndots:5 search domain expansion (e.g. www.cloudflare.com.viktorbarzin.lan, # redis.redis.svc.cluster.local.viktorbarzin.lan) by returning NXDOMAIN for any @@ -74,7 +74,7 @@ resource "kubernetes_config_map" "coredns" { rcode NXDOMAIN fallthrough } - forward . 10.0.20.200 # Technitium LoadBalancer + forward . 10.96.0.53 # Technitium ClusterIP (technitium-dns-internal) cache { success 10000 300 6 denial 10000 300 60 @@ -148,22 +148,6 @@ resource "kubernetes_deployment" "technitium" { } spec { affinity { - # Prefer nodes running Traefik for network locality - pod_affinity { - preferred_during_scheduling_ignored_during_execution { - weight = 100 - pod_affinity_term { - label_selector { - match_expressions { - key = "app.kubernetes.io/name" - operator = "In" - values = ["traefik"] - } - } - topology_key = "kubernetes.io/hostname" - } - } - } # Spread DNS pods across nodes for HA pod_anti_affinity { required_during_scheduling_ignored_during_execution { @@ -225,7 +209,7 @@ resource "kubernetes_deployment" "technitium" { volume { name = "nfs-config" persistent_volume_claim { - claim_name = kubernetes_persistent_volume_claim.config_proxmox.metadata[0].name + claim_name = module.nfs_config.claim_name } } volume { @@ -284,24 +268,58 @@ resource "kubernetes_service" "technitium-dns" { "app" = "technitium" } annotations = { - "metallb.io/loadBalancerIPs" = "10.0.20.200" - "metallb.io/allow-shared-ip" = "shared" + "metallb.io/loadBalancerIPs" = "10.0.20.201" } } spec { type = "LoadBalancer" port { - name = "technitium-dns" + name = "dns-udp" port = 53 protocol = "UDP" } - external_traffic_policy = "Cluster" + port { + name = "dns-tcp" + port = 53 + protocol = "TCP" + } + external_traffic_policy = "Local" selector = { "dns-server" = "true" } } } + +# Fixed ClusterIP for CoreDNS forwarding — bypasses MetalLB entirely. +# IP 10.96.0.53 is pinned so it survives Service recreation. +resource "kubernetes_service" "technitium_dns_internal" { + metadata { + name = "technitium-dns-internal" + namespace = kubernetes_namespace.technitium.metadata[0].name + labels = { + app = "technitium" + } + } + spec { + type = "ClusterIP" + cluster_ip = "10.96.0.53" + selector = { + "dns-server" = "true" + } + port { + name = "dns-udp" + port = 53 + protocol = "UDP" + } + port { + name = "dns-tcp" + port = 53 + protocol = "TCP" + } + } +} + module "ingress" { source = "../../../../modules/kubernetes/ingress_factory" namespace = kubernetes_namespace.technitium.metadata[0].name diff --git a/stacks/trading-bot/main.tf b/stacks/trading-bot/main.tf index fe0246bd..0a7230a7 100644 --- a/stacks/trading-bot/main.tf +++ b/stacks/trading-bot/main.tf @@ -1,3 +1,8 @@ +/* +# TRADING-BOT STACK COMMENTED OUT - 2026-04-06 +# Deployments scaled to 0, infrastructure disabled to prevent re-creation on apply +# To re-enable: uncomment this entire block + variable "tls_secret_name" { type = string sensitive = true @@ -620,3 +625,4 @@ module "ingress" { "gethomepage.dev/pod-selector" = "" } } +*/ diff --git a/stacks/vault/main.tf b/stacks/vault/main.tf index 9dbd39da..5818bc2c 100644 --- a/stacks/vault/main.tf +++ b/stacks/vault/main.tf @@ -189,7 +189,7 @@ resource "vault_policy" "sops_admin" { policy = <<-EOT path "transit/encrypt/sops-state-*" { capabilities = ["update"] } path "transit/decrypt/sops-state-*" { capabilities = ["update"] } - path "transit/keys/sops-state-*" { capabilities = ["read"] } + path "transit/keys/sops-state-*" { capabilities = ["create", "read", "update"] } EOT } @@ -481,7 +481,8 @@ resource "vault_database_secret_backend_connection" "postgresql" { backend = vault_mount.database.path name = "postgresql" allowed_roles = [ - "pg-trading", "pg-health", "pg-linkwarden", + # "pg-trading", # Commented out 2026-04-06 - trading-bot disabled + "pg-health", "pg-linkwarden", "pg-affine", "pg-woodpecker", "pg-claude-memory" ] @@ -545,6 +546,8 @@ resource "vault_database_secret_backend_static_role" "mysql_grafana" { # --- PostgreSQL Static Roles --- +/* +# Commented out 2026-04-06 - trading-bot disabled resource "vault_database_secret_backend_static_role" "pg_trading" { backend = vault_mount.database.path db_name = vault_database_secret_backend_connection.postgresql.name @@ -552,6 +555,7 @@ resource "vault_database_secret_backend_static_role" "pg_trading" { username = "trading" rotation_period = 604800 } +*/ resource "vault_database_secret_backend_static_role" "pg_health" { backend = vault_mount.database.path