gitops/homelab-v
1
0
Fork 0
mirror of https://github.com/outbackdingo/homelab-v.git synced 2026-08-25 14:53:19 +00:00
Code Issues Packages Projects Releases Wiki Activity
327 Commits 1 Branch 0 Tags
3cbc35aaf95e72f29aabef535deaa9b9eb7fbacd
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Vegard Hagen 3cbc35aaf9 fix(netbird-signal): harden security 2025-01-05 15:43:44 +01:00
Vegard Hagen c35ba49135 fix(netbird-relay): harden security 2025-01-05 15:40:20 +01:00
Vegard Hagen a99b4c6e14 fix(netbird-management): harden security 2025-01-05 15:36:57 +01:00
Vegard Hagen 1c585e2ce4 fix(netbird-dashboard): harden security 2025-01-05 15:36:49 +01:00
Vegard Hagen c9ffd698c8 fix(netbird-agent): allow read root fs and add sysctl 
The agent seems to assume it's running with full root privileges,
something we don't want. Accommodate by changing manually.
 2025-01-05 14:56:24 +01:00
Vegard Hagen a89e51b027 refactor(netbird): use env-variable name as key in secrets 
this makes the configuration less verbose
 2025-01-05 12:02:11 +01:00
Vegard Hagen 56d2a42b9d feat(netbird): replace backend helm chart with plain manifests 
no need for all the patching anymore
 2025-01-05 11:34:25 +01:00
Vegard Hagen 0149a02e4c feat(netbird): replace dashboard helm chart with plain manifests 
imho the chart doesn't add much here
 2025-01-04 21:53:23 +01:00
Vegard Hagen 31c6b25013 fix(netbird): new agent setup key 2025-01-04 10:18:31 +01:00
Vegard Hagen 5ecf061fc3 fix(keycloak): move crossplane-keycloak-credentials to keycloak from crossplane namespace 2025-01-04 09:47:39 +01:00
Vegard Hagen aa1a078294 feat(netbird): add relay service 
This is a required step for solving #81

Netbird 0.29.0 added its own relay service based on websockets
 2025-01-03 17:43:11 +01:00
Vegard Hagen 15adc6f863 feat(netbird): configuring oidc-clients using new XOidcClient composition 2025-01-03 15:24:19 +01:00
Vegard Hagen bff741753a feat(crossplane): try to organise crossplane crds 
also add a keycloak-oidc-client composition
 2025-01-03 14:55:12 +01:00
Vegard Hagen 253e65a708 fix(keycloak): update crossplane keycloak-provider 2025-01-03 13:50:47 +01:00
Vegard Hagen b07b728855 fix(netbird): update oidc client 
trying to fix id_token_hint error with keycloak
 2025-01-03 10:13:39 +01:00
Vegard Hagen e4fbd938c1 fix(dns): tweak unbound setting again 
Still some intermittent issues with DNS-resolving
 2025-01-02 14:38:58 +01:00
Vegard Hagen 48b6fc376a fix(vpn): remove security context for agent 2024-12-12 20:02:56 +01:00
Vegard Hagen 02eb0a62d7 fix(vpn): remove read only root fs for netbird agent 2024-12-12 20:02:56 +01:00
Vegard Hagen eb74b5baff fix(dns): tweak dns settingss after update 2024-12-12 20:02:38 +01:00
Vegard Hagen e48986a5a2 feat(authelia): add kubectl oidc account 2024-12-01 22:33:36 +01:00
Vegard Hagen ffa170117b fix(keycloak): new postgres volume 2024-12-01 21:48:26 +01:00
Vegard Stenhjem Hagen 694d56b32d fix: update renovate syntax 2024-11-17 17:03:35 +01:00
Vegard Hagen 4dd769fdf7 feat: add extra admin user 2024-11-17 17:03:35 +01:00
Vegard Hagen 237a321ec3 chore(qBit): downgrade to 4.6.5 2024-11-17 17:03:35 +01:00
Vegard Hagen 0c19b80b75 feat(authelia): add "optional" secrets in config 2024-11-17 17:03:35 +01:00
Vegard Hagen 403d32b9ed feat(authelia): make cert-manager generate jwks 2024-11-17 17:03:35 +01:00
Vegard Hagen 140fbc249b feat(tofu): use new talos_image_factory_schematic resource 
talos provider 0.6 added a new resource for generating the image schematic id
 2024-11-17 17:03:34 +01:00
Vegard Hagen 8d8e0ca87a fix(authelia): add access_control policy rule 2024-11-17 17:03:34 +01:00
Vegard Hagen 996bf85daf chore(talos): upgrade last node ctrl-00 
Regular 'terraform apply' was enough this time

We're now on Talos 1.8.1 and Kubernetes 1.31.1
 2024-11-17 17:03:34 +01:00
Vegard Hagen 4c8066a130 chore(talos): upgrade node ctrl-02 
It worked with 'tofu apply -refresh=false'! Still had to manually shut down the VM though. Still scary!
 2024-11-17 17:03:34 +01:00
Vegard Hagen 094d72abdf chore(talos): upgrade node ctrl-01 
start manual talos upgrade process

Issue with upgrading 'endppoint' node (ctrl-02) since API becomes unresponsive. Either do proper LB or maybe 'tofu apply -refresh=false'
 2024-11-17 17:03:34 +01:00
Vegard Hagen 6d137906d1 feat(authelia): add ES256 jwk and use it 2024-11-17 17:03:34 +01:00
Vegard Hagen cbf1210859 fix(cert-manager): update API token 2024-11-17 17:03:34 +01:00
Vegard Hagen 9a92b48c97 feat(authelia): enable 2FA 2024-11-17 17:03:33 +01:00
Vegard Hagen d077f4b035 feat(authelia): add ES256 jwk 2024-11-17 17:03:33 +01:00
Vegard Hagen e0ce01c80f fix(oidc): conceal jwks signing key 2024-11-17 17:03:33 +01:00
Vegard Hagen 53855a6d27 fix(oidc): conceal argo cd client secret 2024-11-17 17:03:33 +01:00
Vegard Hagen 86395edc1f feat(authelia): add Argo CD client 2024-11-17 17:03:33 +01:00
Vegard Hagen c88403691b feat(lldap): create and use own authelia user 2024-11-17 17:03:33 +01:00
Vegard Hagen ba69146b4b feat(auth): add Authelia for OIDC 
Use Authelia in an attempt to replace Keycloak. Kanidm is another alternative we're going to try later.
 2024-11-17 17:03:33 +01:00
Vegard Hagen 6ac8652e24 chore(torrent): change torrent ports 2024-11-17 17:03:32 +01:00
Vegard Hagen c524a6ab65 feat(cilium): enable maglev loadBalancer 
Maglev Consistent Hashing should improve resiliency in case of failures https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/\#maglev-consistent-hashing
 2024-11-17 17:03:32 +01:00
Vegard Hagen af79c5b906 fix(argocd): turn on server-side diff 
https://argo-cd.readthedocs.io/en/latest/user-guide/diff-strategies/\#server-side-diff

This should solve out-of-sync for e.g. Cilium ref https://github.com/argoproj/argo-cd/issues/19038
 2024-11-17 17:03:32 +01:00
Vegard Hagen ddb7f0fd9f feat(lldap): bootstrap lldap users with script 2024-11-17 17:03:32 +01:00
Vegard Hagen 2a3f01736d feat(ldap): add lldap as ldap server 2024-11-17 17:03:32 +01:00
Vegard Hagen 1d0ae6d437 feat(cnpg): configure test-database for external connection 2024-11-17 17:03:32 +01:00
Vegard Hagen f1a11669a6 feat(renovate): group related containers for fewer renovate PRs 2024-11-17 17:03:32 +01:00
Vegard Hagen e5b3cd91d3 feat(unrar): add an image for unrar tool 2024-11-17 17:03:31 +01:00
Vegard Stenhjem Hagen 944f4a92ba fix(netbird): expose netbird dashboard 2024-11-17 17:03:31 +01:00
Vegard Hagen 5d69e82eb7 fix: route plex and jellyfin through gateway for tls-termination 2024-11-17 17:03:31 +01:00
Vegard Hagen d3338da90a feat(database): add cnpg for database management 2024-11-17 17:03:31 +01:00
Vegard Hagen 505a18cf38 fix(netbird): use internal dns to resolve auth admin-endpoint to internal gateway 2024-11-17 17:03:31 +01:00
Vegard Hagen 91e389dc0e fix(netbird): allow required endpoint from keycloak 2024-11-17 17:03:30 +01:00
Vegard Hagen d74b811d84 chore(docs): update readme 2024-11-17 17:03:30 +01:00
Vegard Hagen 9a7894a7ab feat(vpn): split gateway into external and internal services 2024-11-17 17:03:30 +01:00
Vegard Hagen 0e0a356fd1 fix(oidc): add 'basic' scope to netbird client and update keycloak 
Change in Keycloak 25.0.0

https://www.keycloak.org/docs/25.0.0/upgrading/\#new-default-client-scope-basic

Thanks to Olav https://github.com/olav-st/homelab/commit/14dac2b576adad90306f9b23026a9048f66b38b7
 2024-11-17 17:03:30 +01:00
Vegard Hagen 872f33c295 feat(adguard): mount config-file for declarative configuration 2024-11-17 17:03:30 +01:00
Vegard Hagen 9dec025db7 feat(dns): use Unbound and AdGuardHome for DNS 
Unbound as a recursive resolver and AdGuardHome as main DNS backed by
Unbound
 2024-11-17 17:03:29 +01:00
Vegard Hagen 38f118fa17 fix(jellyfin): use Memory for /cache to avoid NodeDiskPressure 2024-11-17 17:03:29 +01:00
Vegard Hagen 653d3e946c feat(whoami): add simple whoami-app for testing 2024-11-17 17:03:29 +01:00
Vegard Hagen 5c0c3366b2 feat(netbird): add netbird router agent 
This should allow me to connect to services from a Netbird VPN connection
 2024-11-17 17:03:29 +01:00
Vegard Hagen 0048da7ffa chore(oidc): collect all oidc-clients under keycloak 2024-11-17 17:03:29 +01:00
Vegard Hagen d79f57efd3 chore(ingress): remove all ingress resources in favour of http-routes 2024-11-17 17:03:29 +01:00
Vegard Hagen 1602202137 feat(vuetorrent): use git-sync to fetch vuetorrent theme 2024-11-17 17:03:29 +01:00
Vegard Hagen 9de3a6ba0f chore(cloudflared): clean up cloudflared deployment 
remove unused config and enable renovate
 2024-11-17 17:03:28 +01:00
Vegard Hagen 11cba23ae2 chore(renovate): add renovate comments on deployments 
This should allow Renovate to pick up the image versions automatically and create update PRs
 2024-11-17 17:03:28 +01:00
Vegard Hagen e03f701119 chore(nas): update TrueNAS IP after router change 
New router is trash and can't set static IPs, some device stole the old one
 2024-11-17 17:03:28 +01:00
Vegard Hagen 5abde08753 fix: conflicting svc name 2024-11-17 17:03:28 +01:00
Vegard Hagen e6a8ad12c8 chore(plex): use Memory for /tmp and /transcode 
Try to fix NodeDiskPressure issue where I think Plex filling up ephemeral storage
 2024-11-17 17:03:28 +01:00
Vegard Hagen dbb66ba93d chore: rename svc for arr-stack applications 
Dropping -web postfix since it doesn't mean anything and I think it just clutters
 2024-11-17 17:03:28 +01:00
Vegard Hagen 8668f58a38 chore(gateway): update to Gateway API 1.1.0 2024-11-17 17:03:28 +01:00
Vegard Hagen 25f977126b fix(cert): ask for cert for both *.stonegarden.dev and stonegarden.dev 
try to bypass letsenrypt rate-limiting for exact set of domains
 2024-11-17 17:03:27 +01:00
Vegard Hagen ba2ab6435b chore(cleanup): Cleanup after cluster rebuild 2024-11-17 17:03:27 +01:00
Vegard Hagen 1c602200c7 chore(pv): consistent naming scheme 2024-11-17 17:03:27 +01:00
Vegard Hagen 69d56e8e71 feat: install Netbird as a VPN solution 
Also configure Netbird OIDC client in Keycloak using Crossplane
 2024-11-17 17:03:27 +01:00
Vegard Stenhjem Hagen 935a13038c fix(remark42): correct url 
Wrong URL used from the old cluster. Made it impossible to log in due to a wrong redirect URL.
 2024-11-17 17:03:27 +01:00
Vegard Hagen e2e30a91e2 fix: bind prometheus operator to same node with volume 
No shared volumes (yet), so have to bind deployment to the node with the volume
 2024-11-17 17:03:27 +01:00
Vegard Hagen c4ba7120dd feat(tofu): updated kubernetes setup 
tried to to some tidying while writing an article based on the current
setup.
 2024-11-17 17:03:27 +01:00
Vegard Hagen 0a265cbfd5 fix: crossed-wires in Plex and Jellyfin 2024-11-17 17:03:26 +01:00
Vegard Hagen 605e5ef181 fix: increase cpu and mem limits for Argo CD and cloudflared 
This will hopefully alleviate issues with syncing and routing apparently hanging sometimes
 2024-11-17 17:03:26 +01:00
Vegard Hagen 4cb40d3282 feat: configure keycloak using crossplane provider 2024-11-17 17:03:26 +01:00
Vegard Hagen 76ab7a71a2 feat: add crossplane.io 
Planning to use Crossplane to declaratively create OIDC-clients for Keycloak
 2024-11-17 17:03:26 +01:00
Vegard Hagen 628bdb53d6 feat(auth): add keycloak for auth 2024-11-17 17:03:26 +01:00
Vegard Hagen be08e101b2 feat: configure renovate 2024-07-22 01:05:36 +02:00
Vegard Hagen c80528ffbd chore: switch remodelling to main-branch 2024-07-21 23:40:10 +02:00
Vegard Hagen 207b1892bf feat: cleanup of remodelling 
move remodel folder down to root and delete old unused manifests
 2024-07-21 23:21:12 +02:00
Vegard Hagen f1797c94ec feat(monitoring): install kube-prometheus-stack 2024-07-21 23:20:31 +02:00
Vegard Hagen 4d2fe610e2 fix(proxmox-csi-plugin): fetch from Helm chart 2024-07-21 23:20:31 +02:00
Vegard Hagen 1eafca98b5 chore: enable Cilium Hubble 2024-07-21 23:20:31 +02:00
Vegard Hagen 7c492be433 chore: switch Argo CD over to main domain 2024-07-21 23:20:30 +02:00
Vegard Hagen aa6af35f48 feat: routes to cluster external services 
Routes to Home Assistant, Proxmox and TrueNAS
 2024-07-21 23:20:30 +02:00
Vegard Hagen 482c0368ea fix: stonegarden routing 
added a listener for stonegarden.dev
 2024-07-21 23:20:30 +02:00
Vegard Hagen 2c1e894af0 fix: media player services 
Correct labels and svc type
 2024-07-21 23:20:30 +02:00
Vegard Hagen bca0889c47 fix(cloudflared): correct routing to homepage 2024-07-21 23:20:30 +02:00
Vegard Hagen bf5f26da5a chore: restore remark42 backup 2024-07-21 23:20:30 +02:00
Vegard Hagen 32cee0d16e chore: move from euclid sub-domain to main domain 2024-07-21 23:20:30 +02:00
Vegard Hagen 731a16baf3 feat(homepage): add homepage and blog 
Add Vue Homepage, Hugo blog and Remark 42 for comments
 2024-07-21 23:20:30 +02:00
Vegard Hagen 3edf3260d6 feat(media): add media players 
Adding both Plex and Jellyfin media players
 2024-07-21 23:20:29 +02:00
Vegard Hagen 7780078984 chore(tofu): don't use variables for nodes and volumes in main module 2024-07-21 23:20:29 +02:00
Vegard Hagen ac16aed3d2 feat: add node-feature-discovery and intel-device-plugins 
label nodes with features to enable e.g. Intel iGPU support
 2024-07-21 23:20:29 +02:00