infra

viktor/infra

Fork 0

Commit graph

196d0db4bd rbac/apiserver-oidc: back up the apiserver manifest OUTSIDE /etc/kubernetes/manifests Viktor Barzin 2026-06-26 10:29:19 +00:00
5d33327c30 postiz: repoint postgres-backup CronJob at CNPG (was failing on removed host) Viktor Barzin 2026-06-26 09:34:42 +00:00
1bca799bb4 monitoring: give kube-state-metrics a 512Mi memory limit (Burstable) Viktor Barzin 2026-06-26 09:06:31 +00:00
d105713ae7 fix(workstation): claude-auth-sync must merge, not overwrite, the shared Vault path Viktor Barzin 2026-06-26 08:33:41 +00:00
6f1951af93 fix(workstation): carry OS/sudo authz policy into managed-settings source + multi-tenancy doc Viktor Barzin 2026-06-26 08:25:33 +00:00
8121d8a4ac docs(adr): add ADR-0015 (OS/sudo is the authorization boundary), supersede ADR-0011 privacy norm Viktor Barzin 2026-06-26 08:22:29 +00:00
ebc8b6588f ESO: add force_conflicts to all ExternalSecret manifests (fleet sweep) Viktor Barzin 2026-06-25 21:28:11 +00:00
6c5288998f goldmane-trail: polish follow-ups #57/#59/#61/#62/#63 + digest→#alerts Viktor Barzin 2026-06-25 17:49:25 +00:00
306cdd4cb3 state(dbaas): update encrypted state Viktor Barzin 2026-06-25 17:31:03 +00:00
9c68d147e0 k8s-upgrade: reclaim+auto-prune kubeadm /etc/kubernetes/tmp leak; correct crash root cause to etcd IO (not OIDC) Viktor Barzin 2026-06-25 15:23:15 +00:00
60a1cb9a25 k8s-upgrade: reconcile kubeadm-config OIDC drift that crash-looped the v1.35 apiserver upgrade Viktor Barzin 2026-06-25 14:16:04 +00:00
c6bba1da6e home-assistant skill: refresh ha-london map (HAOS 2026.5.2, Cowboy revived, Overview redesign) Viktor Barzin 2026-06-24 22:03:15 +00:00
b858561bd0 Merge remote-tracking branch 'origin/master' Viktor Barzin 2026-06-24 20:59:39 +00:00
a7704f46a6 deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Viktor Barzin 2026-06-24 20:55:38 +00:00
aa510e3600 instagram-poster: force_conflicts on ESO manifests (fix apply) Viktor Barzin 2026-06-24 20:49:53 +00:00
53834deb24 instagram-poster: scale to 0 (unused, dead ExternalSecret) Viktor Barzin 2026-06-24 20:45:30 +00:00
e002fddede WIP: goldmane-edge-aggregator deploy stack + vault role + ghcr allowlist (infra #58) wizard/goldmane-edge-agg-deploy Viktor Barzin 2026-06-24 13:01:37 +00:00
8dd9a3978d Merge remote-tracking branch 'forgejo/master' into wizard/homelab-vault Viktor Barzin 2026-06-24 12:25:52 +00:00
65b2df1222 fix(monitoring): force_conflicts on grafana_db_creds ExternalSecret Viktor Barzin 2026-06-24 12:25:36 +00:00
1d0388da12 Merge remote-tracking branch 'origin/master' Viktor Barzin 2026-06-24 12:22:58 +00:00
92361f36db calico: enable Goldmane + Whisker (Calico 3.30 OSS flow observability) Viktor Barzin 2026-06-24 12:22:48 +00:00
e711b2f971 feat(monitoring): homelab vault traceability alerts (TOTP-fetch + volume) Viktor Barzin 2026-06-24 10:31:32 +00:00
64104e56e9 feat(devvm): install Bitwarden CLI for homelab vault Viktor Barzin 2026-06-24 10:29:57 +00:00
15643d1f44 feat(cli): bare homelab vault help command Viktor Barzin 2026-06-24 10:29:32 +00:00
772aed5370 fix(cli): vault security review fixes Viktor Barzin 2026-06-24 10:28:31 +00:00
5a864cf19c feat(cli): homelab vault setup onboarding (one-time, self-service) Viktor Barzin 2026-06-24 10:21:57 +00:00
e20033855d feat(cli): vault list/search/code/status/lock Viktor Barzin 2026-06-24 10:21:07 +00:00
365340b37d feat(cli): homelab vault get with TTY-aware return Viktor Barzin 2026-06-24 10:20:05 +00:00
2dd12fc6be feat(cli): vault session bootstrap with per-user flock + no-coredump Viktor Barzin 2026-06-24 10:18:36 +00:00
5bae2a3907 feat(cli): privacy-aware vault op-log (process, never the secret) Viktor Barzin 2026-06-24 10:17:50 +00:00
81122f8607 feat(cli): TTY-aware return + OSC52 clipboard with terminal gating Viktor Barzin 2026-06-24 10:17:13 +00:00
06f4b87af1 feat(cli): vault bw engine env/arg builders + unlock Viktor Barzin 2026-06-24 10:16:19 +00:00
cd44ca5921 feat(cli): vault creds loading from per-user Vault path Viktor Barzin 2026-06-24 10:15:32 +00:00
6c53ee10b1 feat(cli): register homelab vault command group skeleton Viktor Barzin 2026-06-24 10:14:24 +00:00
ae0d7984c4 docs: ADR-0014 + glossary — service identity (namespace+label) & Calico Goldmane observability Viktor Barzin 2026-06-24 10:00:36 +00:00
0293b5c634 android-emulator: fix idle-sleeper dying with SIGPIPE before it could sleep Viktor Barzin 2026-06-24 08:57:36 +00:00
839fdb33c2 android-emulator: sleep after 6h idle (activity-based), fix never-sleeping Viktor Barzin 2026-06-24 08:49:23 +00:00
566447a698 k8s-upgrade: preflight kubeadm-plan gate must pass explicit target (minor-upgrade fix) Viktor Barzin 2026-06-24 06:06:14 +00:00
98d2b89614 calico: bump tigera-operator mem limit 256Mi -> 512Mi (OOM crashloop fix) Viktor Barzin 2026-06-23 12:46:28 +00:00
68c240b8de Merge remote-tracking branch 'origin/master' Viktor Barzin 2026-06-23 09:56:25 +00:00
7d297dc6b1 eso: complete migration — chart 2.6.0, all CRs on v1, 1.35 gate cleared Viktor Barzin 2026-06-23 09:55:51 +00:00
ff4b01a674 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:53:36 +00:00
e1a85dd727 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:52:30 +00:00
af22416d6f state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:51:21 +00:00
c75982f408 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:50:11 +00:00
0407e3c578 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:48:33 +00:00
dab8f9446f state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:47:24 +00:00
e815bb0295 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:46:17 +00:00
8412cd7d54 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:45:04 +00:00
f2956e1e62 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:43:57 +00:00
bf2f865eee state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:42:52 +00:00
6f3cfb18c7 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:41:46 +00:00
6e8e066215 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:40:14 +00:00
de1fb04d9f state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:39:12 +00:00
606cfdb544 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:38:12 +00:00
72464e7880 state(external-secrets): update encrypted state Viktor Barzin 2026-06-23 09:37:11 +00:00
e88ea50304 docs(multi-tenancy): document install_skills (vendored per-user agent skills) Viktor Barzin 2026-06-23 09:30:27 +00:00
1c8dc6bd6c t3-provision-users: install_skills heals stale symlinks + owns ~/.agents Viktor Barzin 2026-06-23 09:27:31 +00:00
987fdd16db t3-provision-users: vendor agent skills + per-user install_skills (emo) Viktor Barzin 2026-06-23 09:23:37 +00:00
59f2beda21 chrome-service: run real Google Chrome (H.264/AAC codecs) for the browser Viktor Barzin 2026-06-22 21:15:36 +00:00
df1ec1879d chrome-service: build a real-Chrome browser image (H.264/AAC codecs) Viktor Barzin 2026-06-22 21:01:17 +00:00
7061b1dfc6 state(external-secrets): update encrypted state Viktor Barzin 2026-06-22 20:55:27 +00:00
e2f328ff4a state(external-secrets): update encrypted state Viktor Barzin 2026-06-22 20:45:24 +00:00
a735be9ba4 state(external-secrets): update encrypted state Viktor Barzin 2026-06-22 20:45:08 +00:00
c670cb7118 eso: Phase 2 — migrate all 104 ExternalSecrets + 2 ClusterSecretStores to v1 Viktor Barzin 2026-06-22 19:13:04 +00:00
98cd535b97 authentik: lock chrome.viktorbarzin.me noVNC to Viktor only Viktor Barzin 2026-06-22 18:09:27 +00:00
a3cdc0d6d0 chrome-service: size headed Chrome window to fill Xvfb (noVNC cut-off) Viktor Barzin 2026-06-22 18:00:20 +00:00
c7ead032ec chrome-service: fix noVNC stuck-"Connecting" (x11vnc fd-sweep under nofile=2^31) Viktor Barzin 2026-06-22 17:34:03 +00:00
20ca5ee624 tripit: REEL_PROVIDER=anonymous — actually fetch reels (was fake canned caption) Viktor Barzin 2026-06-22 17:30:47 +00:00
f46b69f372 tripit: enable real LLM + Nominatim on the web Deployment (in-app reel paste #120) Viktor Barzin 2026-06-22 16:50:04 +00:00
59f2070e56 tripit: switch mail-ingest LLM_MODEL qwen3-8b -> qwen3vl-8b (qwen3-8b segfaults) Viktor Barzin 2026-06-22 15:52:09 +00:00
7dbbb74163 homelab v0.8.1: frame browser as escalation (default headless), match CLAUDE.md Viktor Barzin 2026-06-22 15:44:43 +00:00
f96cde35bd tripit: enable Nominatim POI geocoding for reel→Wishlist ingest Viktor Barzin 2026-06-22 14:59:37 +00:00
a6b52a5839 homelab v0.8.0: browser verbs for headful anti-bot web automation Viktor Barzin 2026-06-22 12:22:22 +00:00
de163aa6af workstation: switch devvm OOM backstop from systemd-oomd to earlyoom Viktor Barzin 2026-06-22 10:39:16 +00:00
3a59f4a8bf workstation: per-user memory caps + systemd-oomd backstop on devvm Viktor Barzin 2026-06-22 10:25:09 +00:00
2169e0de5f workstation: harden memory hooks — prune dead plugin refs + homelab-CLI-only store Viktor Barzin 2026-06-22 09:24:42 +00:00
aeed461591 Revert "feat(monitoring): Tempo + OTel Collector for tripit tracing, hardened (ADR-0032 Phase 2)" Viktor Barzin 2026-06-22 08:31:17 +00:00
1595bddfc2 feat(monitoring): Tempo + OTel Collector for tripit tracing, hardened (ADR-0032 Phase 2) Viktor Barzin 2026-06-22 08:17:59 +00:00
a0897de7c3 workstation: document homelab-memory hooks + provisioner self-deploy [ci skip] Viktor Barzin 2026-06-22 08:04:38 +00:00
92f35550f2 workstation: self-deploy t3-provision-users from the repo each reconcile [ci skip] Viktor Barzin 2026-06-22 08:02:31 +00:00
0b11a28d66 workstation: stop install_memory aborting the reconcile under set -e Viktor Barzin 2026-06-22 07:59:47 +00:00
464e0bfb97 Revert "feat(monitoring): Tempo + OTel Collector for tripit tracing (ADR-0032 Phase 2)" Viktor Barzin 2026-06-22 06:46:56 +00:00
72dcb125d5 Revert "fix(monitoring): tempo OOMKilled — move resources under tempo.resources" Viktor Barzin 2026-06-22 06:46:56 +00:00
a02782d11f fix(monitoring): tempo OOMKilled — move resources under tempo.resources Viktor Barzin 2026-06-22 06:44:31 +00:00
7513468a2d feat(monitoring): Tempo + OTel Collector for tripit tracing (ADR-0032 Phase 2) Viktor Barzin 2026-06-22 06:31:11 +00:00
1a32c07ffe docs(eso): Phase 1 done (0.16.2) + confirmed Phase 2 GC findings Viktor Barzin 2026-06-21 20:44:50 +00:00
ac27e41fde Merge remote-tracking branch 'origin/master' Viktor Barzin 2026-06-21 20:41:35 +00:00
296deda3b4 eso: Phase 1 — climb chart 0.12.1 -> 0.16.2 (transition version) + atomic Viktor Barzin 2026-06-21 20:41:30 +00:00
0cd59d2c55 state(external-secrets): update encrypted state Viktor Barzin 2026-06-21 20:41:10 +00:00
b8612e788d state(external-secrets): update encrypted state Viktor Barzin 2026-06-21 20:39:45 +00:00
877e5c73b2 state(external-secrets): update encrypted state Viktor Barzin 2026-06-21 20:38:34 +00:00
de2250f667 immich-frame: set photo date format to dd/MM/yyyy Viktor Barzin 2026-06-21 20:36:43 +00:00
8e6eff03dd state(external-secrets): update encrypted state Viktor Barzin 2026-06-21 20:36:37 +00:00
0bae025b9b wealth dashboard: spend-down figures in today's money (inflation-adjusted) Viktor Barzin 2026-06-21 20:13:59 +00:00
3fb6284e2b immich-frame: use 24-hour clock (ClockFormat HH:mm) Viktor Barzin 2026-06-21 20:10:51 +00:00
e89de86af0 wealth dashboard: spend-down table → three growth scenarios Viktor Barzin 2026-06-21 20:06:29 +00:00
85d42f2c13 wealth dashboard: merge spend-down tiles into one compact table Viktor Barzin 2026-06-21 19:55:57 +00:00
63add2a126 feat(tripit): finalize ADR-0028 auth env — AUTH_MODE=normal, trips@ sender, trust XFF Viktor Barzin 2026-06-21 19:50:20 +00:00
166a2bcab4 wealth dashboard: add "spend-down to £0 at 100" stat tiles Viktor Barzin 2026-06-21 19:48:30 +00:00