whyredfire
d55d711463
fix(wireguard): Allow egress to Traefik pod ports
...
Traffic to the 192.168.2.5 external IP is DNATed to the Traefik pod
before NetworkPolicy is evaluated, so the 10.0.0.0/8 exclusion blocked
VPN clients from reaching services behind the gateway.
2026-10-28 21:43:36 +05:30
whyredfire
e4346af5ba
chore(add-ons): Add network policies to operators and monitoring
2026-10-28 15:27:26 +05:30
whyredfire
49ee2a29f5
chore(apps): Add network policies to apps
2026-10-28 15:19:35 +05:30
whyredfire
6e1f53ed3f
chore: Set resource requests and limits on every workload
2026-10-28 14:53:44 +05:30
whyredfire
9888eb99fb
chore(monitoring): Raise Grafana memory limit to 768Mi
2026-10-28 14:49:37 +05:30
whyredfire
ebb0c6bd39
chore(apps): Compress redoost responses with a Traefik middleware
2026-10-28 14:03:54 +05:30
whyredfire
1a79ef8776
chore(apps): Bump wireguard image to 15.5.0
2026-10-25 20:26:49 +05:30
whyredfire
058bf558fc
chore(monitoring): Trim down monitoring
2026-10-23 19:47:51 +05:30
whyredfire
e264c265e4
chore(apps): Sunset legislative-summarization (archived)
2026-10-19 01:33:42 +05:30
whyredfire
7d4c508a61
chore(apps): Sunset scriptscribe (archived)
2026-10-19 01:11:02 +05:30
whyredfire
c8cdc24fac
chore(apps): Bump pgweb image to sha-f718189
2026-10-16 01:59:59 +05:30
whyredfire
379f87b379
feat(sealed-secrets): Disable key rotation
2026-10-14 19:25:31 +05:30
whyredfire
2f1d9570dc
feat(apps): Use my pgweb fork
2026-10-13 00:11:17 +05:30
whyredfire
66d63f7217
chore(deps): Update charts and images to latest versions
...
Charts:
- kube-prometheus-stack 91.8.2 -> 92.3.0
- traefik 41.6.0 -> 41.7.1
- loki 18.13.7 -> 18.15.1
- alloy 1.13.0 -> 1.13.1
- sealed-secrets 2.19.1 -> 2.20.0
- cert-manager v1.21.1 -> v1.21.2
- cloudnative-pg 0.29.0 -> 0.29.1
- garage-ui 0.12.1 -> 0.13.0
Images:
- argo-cd v3.5.2 -> v3.5.5
- jellyfin 12.0 -> 12.2
- qbittorrent 5.2.3_v2.0.15-ls478 -> 5.2.4_v2.0.15-ls480
- busybox (garage init) 1.37.0 -> 1.38.0
2026-10-12 21:50:34 +05:30
whyredfire
7c8bcd4ef7
feat(monitoring): Scrape node and pod metrics, add logs and Pi dashboards
2026-10-10 13:07:56 +05:30
whyredfire
a3c15d1aaa
refactor(argocd): Use server-side apply for all apps
2026-10-10 12:28:21 +05:30
whyredfire
390c2e332d
feat(apps): Add pgweb
2026-10-10 12:23:13 +05:30
whyredfire
1a104cb0c5
refactor(authentik): Seperate blueprint for applications
2026-10-10 11:21:54 +05:30
whyredfire
01ddf5937b
feat(apps): Log in to wg-easy with authentik OIDC
2026-10-10 01:46:35 +05:30
whyredfire
40df38dd8d
feat(apps): Replace wireguard config with wg-easy behind authentik
2026-10-10 01:32:31 +05:30
whyredfire
f1ea8c5c7a
feat(apps): Enable Google sign-in for redoost
2026-10-02 15:03:16 +05:30
whyredfire
cfa6a6e227
feat(add-ons): Add redoost database to Postgres
2026-10-01 18:01:55 +05:30
whyredfire
e17f299bae
chore: Remove unused manifests
2026-09-30 02:19:03 +05:30
whyredfire
50e0a5f77c
docs: Add README with node configuration
2026-09-30 02:02:38 +05:30
whyredfire
f23dd4fcd4
feat(add-ons): Add legislative-summarization database to Postgres
...
Move legislative-summarization off its dedicated CNPG cluster onto the shared one, with its own role and database like authentik and grafana.
2026-09-30 01:42:12 +05:30
whyredfire
576c42554d
feat(add-ons): Add observability stack with kube-prometheus-stack, loki and alloy
2026-09-30 01:26:38 +05:30
whyredfire
148890fb86
refactor(gitops): Align add-on and app directory names
2026-09-30 00:55:28 +05:30
whyredfire
923ecd3461
feat(apps): Add wireguard
2026-09-27 04:06:10 +05:30
whyredfire
6452a8efcc
feat(apps): Add qbit
2026-09-26 20:55:42 +05:30
whyredfire
96db9b3511
feat(apps): Enable network policies for redoost
2026-09-26 11:49:21 +05:30
whyredfire
7b94d671e4
feat(authentik): Log in with Google only
2026-09-25 03:20:54 +05:30
whyredfire
f553fd3cd9
fix(authentik): Accept token requests without trailing slash
2026-09-25 03:14:16 +05:30
whyredfire
ca90f591bd
feat(argocd): Use PKCE for OIDC login
2026-09-25 03:07:31 +05:30
whyredfire
b91cc2409c
feat(apps): Put garage-ui behind authentik forward-auth
2026-09-25 02:35:12 +05:30
whyredfire
e1da29adbe
feat(argocd): Disable local admin account
2026-09-25 02:21:49 +05:30
whyredfire
6a744d0525
chore(add-ons): Drop anubis and its proxy from all applications
2026-09-25 02:21:15 +05:30
whyredfire
b1224e0d5b
chore(apps): Drop autoregexbot application
2026-09-25 01:42:01 +05:30
whyredfire
db59b123df
feat(argocd): Prepare ArgoCD through Authentik login
2026-09-25 01:38:38 +05:30
whyredfire
4afa2a1e87
feat(add-ons): Add shared postgres cluster and authentik
2026-09-25 01:16:28 +05:30
whyredfire
a9b287d06c
feat(apps): Add splitpro application
2026-09-24 22:57:55 +05:30
whyredfire
8659225f0d
chore(add-ons): Bump traefik chart to 41.6.0 and disable IngressClass
2026-09-24 13:48:45 +05:30
whyredfire
19810bb114
chore(add-ons): Prepare for k3s upgrade to v1.37.0+k3s1
2026-09-24 13:41:35 +05:30
whyredfire
42e94b8d22
feat(apps): Pass Open Graph tags through Anubis for redoost
2026-09-24 01:01:40 +05:30
whyredfire
e69dced597
chore(apps): Use redoost's default image tags
2026-09-24 00:49:18 +05:30
whyredfire
e460030099
feat(apps): Put redoost behind anubis
2026-09-24 00:46:31 +05:30
whyredfire
c69767b489
feat(apps): Add redoost application
2026-09-23 23:46:49 +05:30
whyredfire
538ed748a1
feat(apps): Expose garage service to s3.whyredfire.dev
2026-09-23 23:45:29 +05:30
whyredfire
485db774f5
feat(traefik): Add wildcard certificate and listener for whyredfire.dpdns.org
2026-09-23 23:25:23 +05:30
whyredfire
4c9ea9a8b8
chore(cert-manager): Rotate Cloudflare API token
2026-09-23 23:21:00 +05:30
whyredfire
a4c3bd4179
feat(apps): Add rustbin
2026-09-18 16:17:09 +05:30
whyredfire