viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/stacks
History
Viktor Barzin 9ad7756a94 traefik: make bot-block-proxy a clean no-op while poison-fountain is at 0 
bot-block-proxy is the forward-auth target for the ai-bot-block
middleware (applied to every anti-AI ingress). It proxied /auth to the
poison-fountain bot trap with error_page 5xx=200 fail-open. But
poison-fountain is intentionally scaled to 0, so proxy_pass only ever
failed and fell open to '200 allowed' -- while logging ~51k errors/hr
(the #1 Loki source once pod logs began shipping 2026-06-05) and paying
up to 100ms connect-timeout per authed request.

Short-circuit /auth to 'return 200 "allowed"' directly (drop the
upstream + proxy_pass + fallback). Identical effective behaviour
(allow-all), no upstream attempt, no noise, no latency. Reversible:
restore the upstream + proxy_pass and scale poison-fountain up.

Also add the missing configmap.reloader.stakater.com/reload annotation
so openresty picks up ConfigMap changes (it does not hot-reload on its
own -- the root reason stale config ran for days). replicas stays 2:
critical-path forward-auth target (anti-AI ingresses fail closed if it
is down), so HA is retained though each request is now trivial.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-06 16:51:26 +00:00
..
_template
actualbudget infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
affine infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
authentik feat(authentik): adopt admin-services-restriction policy; admit kubernetes-* groups to k8s dashboard 2026-06-05 09:19:10 +00:00
beads-server keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
blog infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
broker-sync
calico
changedetection Woodpecker CI deploy [CI SKIP] 2026-06-06 16:51:26 +00:00
chrome-service chrome-service: switch to CDP + persistent profile + hourly snapshot pipeline 2026-06-05 09:19:10 +00:00
city-guesser infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
claude-agent-service claude-agent: grant shared pod executor powers (Forgejo PR, terragrunt apply, kubectl write, MCP) 2026-06-05 09:19:10 +00:00
claude-memory infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
cloudflared cloudflared: fix tunnel origin .200 -> Traefik svc DNS (full-site 502 outage) [ci skip] 2026-06-01 21:22:05 +00:00
cnpg
coturn infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
crowdsec
cyberchef infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
dashy infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
dawarich infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
dbaas feat(nextcloud-todos): Phase 4 IaC — service stack, Vault role, DB bootstrap, OpenClaw plugin, monitoring 2026-06-05 09:19:10 +00:00
descheduler infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
diun infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
ebook2audiobook infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
ebooks keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
echo infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
excalidraw infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
external-secrets infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
f1-stream f1-stream: right-size memory 1Gi -> 256Mi (CDP-only, no bundled Chromium) 2026-06-05 12:57:22 +00:00
fire-planner fire-planner: reset bulk ingest toggle after successful run 2026-06-05 09:19:12 +00:00
forgejo infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
freedify infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
freshrss Woodpecker CI deploy [CI SKIP] 2026-06-05 09:19:11 +00:00
frigate infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
grampsweb infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
hackmd storage: migrate hackmd uploads off proxmox-lvm-encrypted to NFS (LUN-cap relief) 2026-06-05 20:11:31 +00:00
headscale
health infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
hermes-agent hermes-agent: gate PVC on parked flag (clears PVCStuckPending) 2026-05-31 15:19:28 +00:00
homepage infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
immich immich: fix slow context search — prewarm clip_index + latency alert/healthcheck 2026-06-05 09:19:07 +00:00
infra infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
infra-maintenance
insta2spotify storage: migrate insta2spotify off proxmox-lvm to NFS (LUN relief, Phase 1) 2026-06-05 21:38:01 +00:00
instagram-poster keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
isponsorblocktv Woodpecker CI deploy [CI SKIP] 2026-06-05 09:19:11 +00:00
job-hunter job-hunter: weekly above-target Slack alert CronJob 2026-06-02 20:49:42 +00:00
jsoncrack infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
k8s-dashboard feat(k8s-dashboard): auto-inject per-user SA token (no token-paste) 2026-06-05 09:19:10 +00:00
k8s-portal
k8s-version-upgrade
keel
kms infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
kured kured: fix sentinel-gate OOM — 256Mi limit + self-restart leak guard 2026-05-31 14:49:04 +00:00
kyverno trek: trial-deploy TREK group-trip planner behind Authentik (solo eval) 2026-06-05 20:30:07 +00:00
linkwarden infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
llama-cpp kms: revert files accidentally bundled into the docs commit 2026-06-01 10:36:49 +00:00
local-path keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
mailserver mail(tripit): send From: plans@viktorbarzin.me instead of spam@ 2026-06-05 18:41:08 +00:00
matrix Woodpecker CI deploy [CI SKIP] 2026-06-06 16:51:26 +00:00
meshcentral infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
metallb
metrics-server
monitoring monitoring: NodeFilesystemFull 90%->95% + Synology storage runbook 2026-06-05 18:18:31 +00:00
n8n infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
navidrome infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
netbox infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
networking-toolbox infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
nextcloud infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
nextcloud-todos nextcloud-todos: register only the Created webhook (drop Updated) 2026-06-05 09:19:11 +00:00
nfs-csi
nodelocal-dns
novelapp novelapp: bump Keel policy patch -> all (track any upstream version) 2026-06-05 09:19:11 +00:00
ntfy infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
nvidia
onlyoffice infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
openclaw openclaw: pin 2026.2.26, resilient startup, SHA-pinned plugin init (recover from agentRuntime + configSchema crashloop) 2026-06-05 09:19:11 +00:00
osm_routing infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
owntracks infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
paperless-mcp keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
paperless-ngx infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
payslip-ingest keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
phpipam keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
platform infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
plotting-book infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
poison-fountain infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
postiz postiz: adopt drifted resources into TF state; exclude stuck Helm release 2026-05-30 14:36:07 +00:00
priority-pass priority-pass: bump image_tag to 63e118c3 [ci skip] 2026-06-05 09:19:09 +00:00
privatebin infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
proxmox-csi proxmox-csi: auto-reconcile CronJob to detach ghost disks (code-dfjn prevention) 2026-06-05 21:25:36 +00:00
pvc-autoresizer
rbac fix(rbac): tighten dashboard SA cluster-read to namespaces+nodes only 2026-06-05 09:19:11 +00:00
real-estate-crawler infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
recruiter-responder keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
redis redis: revert 3-node Sentinel HA to single standalone instance [ci skip] 2026-05-30 17:49:43 +00:00
reloader infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
resume infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
reverse-proxy
rybbit infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
sealed-secrets
send storage: migrate send off proxmox-lvm to NFS (LUN-cap relief) 2026-06-05 20:04:37 +00:00
servarr mam-farming: migrate data volume proxmox-lvm → NFS 2026-06-05 09:19:09 +00:00
shadowsocks infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
speedtest storage: migrate speedtest off proxmox-lvm to NFS (LUN-cap relief) 2026-06-05 19:59:56 +00:00
status-page
stirling-pdf infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
t3code t3code: ingress -> devvm dispatch+autopair (retire in-cluster nginx) 2026-06-02 19:24:30 +00:00
tandoor Woodpecker CI deploy [CI SKIP] 2026-06-06 16:51:26 +00:00
technitium technitium: CoreDNS rewrite forgejo.viktorbarzin.me -> Traefik ClusterIP 2026-06-04 07:34:30 +00:00
terminal infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
tor-proxy infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
trading-bot infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
traefik traefik: make bot-block-proxy a clean no-op while poison-fountain is at 0 2026-06-06 16:51:26 +00:00
travel_blog infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
trek trek: trial-deploy TREK group-trip planner behind Authentik (solo eval) 2026-06-05 20:30:07 +00:00
tripit tripit: GEOCODER_PROVIDER=openmeteo for per-city itinerary weather 2026-06-05 20:01:31 +00:00
tuya-bridge infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
uptime-kuma feat(nextcloud-todos): Phase 4 IaC — service stack, Vault role, DB bootstrap, OpenClaw plugin, monitoring 2026-06-05 09:19:10 +00:00
url infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
vault vault: deny secret/data/vault for claude-agent terraform-state policy (executor elevation safety narrowing) 2026-06-05 09:19:10 +00:00
vaultwarden keel: sweep KEEL_LIFECYCLE_V1 + per-container KEEL_IGNORE_IMAGE across enrolled workloads 2026-05-28 23:09:30 +00:00
vpa
wealthfolio wealthfolio-sync: podAffinity to co-locate with app pod (RWO multi-attach fix) 2026-06-05 09:19:10 +00:00
webhook_handler infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
whisper infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00
wireguard
woodpecker woodpecker: reload server on Vault PG password rotation [ci skip] 2026-06-05 09:19:12 +00:00
xray
ytdlp infra: untrack generated backend.tf (stale PG creds + .200 literal) [CI SKIP] 2026-06-03 10:52:46 +00:00