infra

viktor/infra

Fork 0

Commit graph

5a312563c6 monitoring/wealth: dash the in-progress year on the hourly-rate panel master Viktor Barzin 2026-06-30 12:45:51 +00:00
28984dda9a monitoring/wealth: add per-year effective hourly-rate panel (gross vs net) Viktor Barzin 2026-06-30 12:28:46 +00:00
82371d1ef8 dbaas/mysql: innodb_doublewrite=DETECT_ONLY to halve page-flush writes Viktor Barzin 2026-06-30 08:47:09 +00:00
fbae573664 state(dbaas): update encrypted state Viktor Barzin 2026-06-30 08:46:45 +00:00
71501be408 nodes: journald -> volatile (RAM) to cut sdc write-IOPS Viktor Barzin 2026-06-30 08:15:38 +00:00
1afe41880e docs: MySQL buffer-pool/limit + nextcloud webcal throttle; VCT drift fixed Viktor Barzin 2026-06-30 07:56:04 +00:00
82c9e69b77 dbaas/mysql: 2Gi InnoDB buffer pool + 6Gi limit + ignore VCT drift Viktor Barzin 2026-06-30 07:55:18 +00:00
29bf275cef state(dbaas): update encrypted state Viktor Barzin 2026-06-30 07:53:48 +00:00
308a174ad6 docs(networking): record MetalLB .204 (frigate-rtsp go2rtc) allocation Viktor Barzin 2026-06-30 07:42:27 +00:00
469cdd7507 frigate: expose go2rtc on a dedicated MetalLB LB IP (RTSP 8554 + WebRTC 8555) emo/frigate-go2rtc-expose ebarzin 2026-06-30 07:15:22 +00:00
9ea9cae073 rightsize: reconcile batch-2/3 stacks blocked by killed #427 (job-hunter, wealthfolio, f1-stream) Viktor Barzin 2026-06-29 15:59:41 +00:00
7cc9cde5b1 external-secrets: enable ESO Vault token cache to cut sdc write churn Viktor Barzin 2026-06-29 15:32:22 +00:00
5e384ed762 state(external-secrets): update encrypted state Viktor Barzin 2026-06-29 15:31:06 +00:00
bc626a2d89 rightsize: raise OOM-tight memory limits (batch 3/N — spike protection) Viktor Barzin 2026-06-29 15:28:11 +00:00
418d1efb4b rightsize: trim over-provisioned memory (batch 2/N) Viktor Barzin 2026-06-29 15:27:17 +00:00
a3f2c2947a docs: refresh CNPG tuning note (archive_timeout=0, commit_delay, zstd) + apply gotcha Viktor Barzin 2026-06-29 15:17:38 +00:00
ec04963bfe state(dbaas): update encrypted state Viktor Barzin 2026-06-29 15:16:50 +00:00
c3553731c7 dbaas: CNPG write-reduction — archive_timeout=0, commit_delay, wal_compression=zstd Viktor Barzin 2026-06-29 15:16:38 +00:00
5d059786a1 rightsize: trim over-provisioned memory limits+requests (batch 1/N) Viktor Barzin 2026-06-29 14:46:58 +00:00
4473b469e3 lvm-pvc-snapshot: cut retention 7->3 days (reduce sdc thin-pool CoW IOPS + free ~1TB) Viktor Barzin 2026-06-29 12:59:03 +00:00
256122ff5b monitoring: make ClusterCannotTolerateNonGpuNodeLoss topology-agnostic Viktor Barzin 2026-06-29 12:34:01 +00:00
6c3619c9c6 state(dbaas): update encrypted state Viktor Barzin 2026-06-29 12:26:21 +00:00
682b982c78 state(dbaas): update encrypted state Viktor Barzin 2026-06-29 12:25:53 +00:00
c0e0911afa dbaas: bump pg_cluster trigger so the checkpoint/WAL params actually apply Viktor Barzin 2026-06-29 12:25:37 +00:00
bebe8fbd74 workflows: add read-only memory-overcommit + node-removal capacity analysis Viktor Barzin 2026-06-29 12:06:17 +00:00
a2c8f906ec dbaas: stretch CNPG checkpoint timer 5->15min + raise WAL size (cut sdc write IOPS) Viktor Barzin 2026-06-29 11:41:09 +00:00
3398873a16 k8s-upgrade: move version-check cadence from daily to weekly (Sun check, Mon report) Viktor Barzin 2026-06-29 06:22:20 +00:00
e43e64c666 kyverno: disable reports-controller to stop etcd ephemeralreport load Viktor Barzin 2026-06-29 05:35:36 +00:00
cf42042cba monitoring: re-trigger apply to persist state after CI cancel-race Viktor Barzin 2026-06-28 16:58:49 +00:00
f92075b7c5 fire-planner: solve FIRE targets to age 100 (horizon 60→72) Viktor Barzin 2026-06-28 16:49:20 +00:00
7fe2d9780e monitoring: add pfSense WAN/egress alerting + probes Viktor Barzin 2026-06-28 16:46:30 +00:00
279b88d2bc docs: add MetalLB L2Status-immutable PG-VIP-flap post-mortem (code-aoxk) Viktor Barzin 2026-06-28 16:25:10 +00:00
6f042ee239 fix(fire-planner): grafana fire-planner-pg datasource survives pw rotation Viktor Barzin 2026-06-28 16:14:42 +00:00
35c0057d83 chrome-service: raise noVNC sidecar memory limit 96Mi->256Mi (fix OOMKill) Viktor Barzin 2026-06-28 15:39:17 +00:00
2e50c1235c chrome-service: grant emo shared browser access (noVNC + homelab browser CLI) Viktor Barzin 2026-06-28 15:20:07 +00:00
50077b43d4 paperless-ngx: drop TASK_WORKERS 6->4 (6 OOMKilled the pod mid-import) Viktor Barzin 2026-06-28 15:06:46 +00:00
8236ae309d postiz: reconcile HCL to live (adopt unmerged stack config), keep parked Viktor Barzin 2026-06-28 12:54:59 +00:00
250d0fc334 docs(authentik): document SFE forced-WebAuthn escape hatches (TOTP + social) Viktor Barzin 2026-06-28 12:24:40 +00:00
e518ada3d4 authentik: repoint to overlay patch3 (all-iOS SFE + SFE social links) + docs Viktor Barzin 2026-06-28 11:53:26 +00:00
4fc09b7a61 Merge remote-tracking branch 'origin/master' into wizard/authentik-sfe-social Viktor Barzin 2026-06-28 11:53:04 +00:00
916516eeab authentik overlay patch3: SFE for ALL old iOS browsers + social-login links Viktor Barzin 2026-06-28 11:53:03 +00:00
08bdf32aa0 feat(fire-planner): FIRE Countdown dashboard section + monthly target solve Viktor Barzin 2026-06-28 11:52:17 +00:00
6ba60cbb2d authentik: repoint to overlay patch2 (SFE for old Safari) + docs Viktor Barzin 2026-06-28 11:39:29 +00:00
5fb2004de5 Merge remote-tracking branch 'origin/master' into wizard/authentik-perf-fix Viktor Barzin 2026-06-28 11:38:07 +00:00
f10bb71562 authentik overlay: serve the no-JS SFE login to old Safari (patch #2) Viktor Barzin 2026-06-28 11:38:05 +00:00
ec681ba6e1 ci(infra): stop double-apply + stop counting PG lock-waits as failures Viktor Barzin 2026-06-28 11:37:18 +00:00
69e35efd95 Merge remote-tracking branch 'origin/master' into wizard/vault-kv Viktor Barzin 2026-06-28 11:09:38 +00:00
e03e4719ad vault: distinguish Vaultwarden vs HashiCorp Vault, add vault kv Viktor Barzin 2026-06-28 11:09:33 +00:00
460f2ad42f state(vault): update encrypted state Viktor Barzin 2026-06-28 11:06:53 +00:00
87a450e9a3 vault: grant emo full read/write on his own secret/emo tree Viktor Barzin 2026-06-28 11:06:23 +00:00
a1cf7ccaf6 authentik: repoint to the SLOW-1a overlay image + un-enroll Keel Viktor Barzin 2026-06-28 10:46:21 +00:00
7ec64ed5ff authentik: custom-image overlay to fix the 1.4s login-flow query (SLOW-1a) Viktor Barzin 2026-06-28 10:42:58 +00:00
12a45fa94e vault: bw sync on every read so reads show the latest values Viktor Barzin 2026-06-28 10:19:54 +00:00
3d948c7033 Merge remote-tracking branch 'origin/master' into wizard/upgrade-gate-held Viktor Barzin 2026-06-28 10:09:42 +00:00
2880fe1c29 docs: update k8s-version-upgrade runbook for actionable-vs-held gate Viktor Barzin 2026-06-28 10:09:34 +00:00
eebb6c8594 k8s-upgrade: classify compat-gate blocks as actionable vs held; quiet the held case Viktor Barzin 2026-06-28 10:08:20 +00:00
ccee443790 vault: add get --all to browse every field of an item Viktor Barzin 2026-06-28 10:01:49 +00:00
afcd463f39 k8s-upgrade: design doc for actionable-vs-held compat-gate classification Viktor Barzin 2026-06-28 10:01:36 +00:00
b3c419e108 Merge remote-tracking branch 'origin/master' into wizard/authentik-perf-fix Viktor Barzin 2026-06-28 09:55:25 +00:00
9a1ab6247b cli: add homelab edges — who-talks-to-whom investigation helper (v0.9.0) Viktor Barzin 2026-06-28 09:51:41 +00:00
0fa5852ec6 homelab v0.8.2: fix memory recall truncating multibyte UTF-8 mid-character Viktor Barzin 2026-06-28 09:40:51 +00:00
a3eb309e26 calico: fix empty Whisker UI — allow whisker egress to the kube-dns ClusterIP Viktor Barzin 2026-06-28 09:32:21 +00:00
385dfff0e7 authentik: fix episodic blank-screen + 30s-hang login (reliability R2) Viktor Barzin 2026-06-28 09:17:05 +00:00
b84b0021c2 authentik: dedicated rate-limit carve-out + per-router 5xx observability Viktor Barzin 2026-06-28 09:10:34 +00:00
65a09dcbc4 docs(homelab-vault): rebuild snippet uses cli/VERSION, not git describe Viktor Barzin 2026-06-28 09:05:49 +00:00
c53e7839e1 Merge remote-tracking branch 'origin/master' into wizard/vault-addr-default Viktor Barzin 2026-06-28 09:04:43 +00:00
0525f0b12d homelab vault: self-default VAULT_ADDR + prefer scoped token over ~/.vault-token Viktor Barzin 2026-06-28 09:04:28 +00:00
8d1d2fb999 calico: add whisker-watchdog CronJob to self-heal a wedged whisker-backend Viktor Barzin 2026-06-28 08:59:07 +00:00
c70810a51b workstation: per-user long-lived Claude token to end concurrent-refresh logout Viktor Barzin 2026-06-28 08:07:43 +00:00
3cc8f9f661 paperless-ngx: keep mem limit at 8Gi (tier LimitRange caps containers) Viktor Barzin 2026-06-27 19:37:59 +00:00
21d20dccf8 paperless-ngx: bulk-import via PVC consume dir (restart-safe) + 6 workers Viktor Barzin 2026-06-27 19:35:10 +00:00
2cb37d51d4 paperless-ngx: scale Gotenberg x3 + Tika x2, 4 workers, skip-archive — speed the Emo import Viktor Barzin 2026-06-27 18:45:25 +00:00
d6bd9486e3 Merge remote-tracking branch 'origin/master' into wizard/portal-onboarding-paths Viktor Barzin 2026-06-27 16:34:44 +00:00
fca948a23d k8s-portal: document all three cluster-access paths in onboarding Viktor Barzin 2026-06-27 16:34:36 +00:00
9599beadc9 paperless-ngx: 2 task workers + 2 threads/worker + 4Gi limit for the Emo bulk import Viktor Barzin 2026-06-27 16:33:43 +00:00
d4f564e8d5 Merge pull request 'docs(ci-cd): plotting-book build→ghcr→deploy flow diagram' (#16) from wizard/plotting-doc into master viktor 2026-06-27 15:50:02 +00:00
0097bddf9f docs(ci-cd): add plotting-book build→ghcr→deploy flow diagram Viktor Barzin 2026-06-27 15:49:58 +00:00
bbc797b30e ci(woodpecker): stop applying/planning the Tier-0 vault stack in CI Viktor Barzin 2026-06-27 15:48:20 +00:00
81c2b14e29 Merge pull request 'plotting-book: pull image from private ghcr instead of public DockerHub' (#15) from wizard/plotting-ghcr into master viktor 2026-06-27 15:32:35 +00:00
c13a3f1694 plotting-book: pull image from private ghcr instead of public DockerHub Viktor Barzin 2026-06-27 15:32:19 +00:00
bf40409141 docs(security): note crowdsec-cf-sync rate-limit resilience Viktor Barzin 2026-06-27 15:27:44 +00:00
5b49634fe0 rybbit/crowdsec-cf-sync: stop Cloudflare Lists-API retry-storm (429 self-DoS) Viktor Barzin 2026-06-27 15:23:42 +00:00
7c72368243 state(vault): update encrypted state Viktor Barzin 2026-06-27 13:54:23 +00:00
f92ab04dae vault: grant emo read-only access to his own secret/emo Viktor Barzin 2026-06-27 13:35:57 +00:00
90f5425cdc state(vault): update encrypted state Viktor Barzin 2026-06-27 13:33:34 +00:00
a7117e0bfe immich(frame-emo): bump photo-frame Interval 30->45s Emil Barzin 2026-06-27 13:07:00 +00:00
d50962b00e immich: add Immich photo-frame for Emo's Portal (highlights-immich-emo) Viktor Barzin 2026-06-27 12:40:29 +00:00
e8b72019b5 paperless-ngx: deploy Tika + Gotenberg for Office ingest + raise PVC ceiling to 80Gi Viktor Barzin 2026-06-27 12:02:04 +00:00
041aedc486 Merge remote-tracking branch 'origin/master' into wizard/paperless-emo Viktor Barzin 2026-06-27 08:17:28 +00:00
7988a690ed paperless-ngx: add Bulgarian OCR (bul+eng) + raise data PVC ceiling to 30Gi Viktor Barzin 2026-06-27 08:17:13 +00:00
6415f77fed Merge remote-tracking branch 'origin/master' into wizard/emo-vault-onboard Viktor Barzin 2026-06-27 08:17:06 +00:00
b371ae6eee homelab vault: install bw system-wide + onboarding runbook Viktor Barzin 2026-06-27 08:16:52 +00:00
51dc5d031c homelab vault: make it work for non-admin workstation users Viktor Barzin 2026-06-27 08:15:42 +00:00
82a7b2585b chrome-service: reconcile state after pipeline #366 was killed mid-apply + document cancel-previous hazard Viktor Barzin 2026-06-27 08:15:41 +00:00
006f97ef58 docs: bless local terragrunt apply, but require committing every applied change Viktor Barzin 2026-06-27 08:10:20 +00:00
7b4a8ba867 chrome-service: pin noVNC image to the x11vnc-supervision build Viktor Barzin 2026-06-27 08:04:55 +00:00
19d0f0933a chrome-service: supervise x11vnc in noVNC sidecar so the VNC view self-heals Viktor Barzin 2026-06-27 08:03:29 +00:00
abb15cd49d devvm: personalize emo's cluster-health skill for ha-sofia Viktor Barzin 2026-06-26 16:03:14 +00:00
fc83595f5e devvm: vendor cluster-health into per-user agent-skill snapshot Viktor Barzin 2026-06-26 15:20:19 +00:00
fd33d1a447 monitoring: consolidate all Slack alerting to #alerts, abandon #security Viktor Barzin 2026-06-26 13:29:44 +00:00