3610fb9e5e
fix(prometheus): pin to az-a longhorn-wffc SC, drop conflicting ServerSideApply
Story Crater Bot2026-08-18 15:08:02 -07:00
2845ded626
fix(ingress): switch riotpiao-com-tls to letsencrypt-prod issuer
Story Crater Bot2026-07-21 11:10:22 -07:00
96b4064ec7
fix(prometheus): scrapeTimeout must be <= scrapeInterval — authentik/nginx SMs (60s>30s) + global (60s>30s) blocked operator config gen, no Prometheus STS created
Story Crater Bot2026-07-21 11:08:23 -07:00
dc1ab77b54
fix: set logging/monitoring namespaces privileged PSS for promtail/node-exporter hostPath access
Story Crater Bot2026-08-18 15:08:02 -07:00
cd861a75e6
fix(argocd): raise repo-server memory 512Mi->1Gi — OOMKilled under CMP+Helm rendering caused chronic restarts, not-ready endpoint, and cluster-wide sync 'no route to host' failures
Story Crater Bot2026-07-21 10:01:11 -07:00
6cbd887b89
fix(forgejo-runner): add fsGroup 1000 so runner user can write /data/.runner — register hit permission denied on root-owned Longhorn PVC
Story Crater Bot2026-07-21 09:40:59 -07:00
b1be1d0d2c
fix(forgejo-runner): point at in-cluster forgejo Service :3000 not public :443 — runner i/o timeout, forgejo serves 3000 not 443
Story Crater Bot2026-07-21 09:35:32 -07:00
0a6568491b
fix(minio,loki): declare loki-chunks/ruler/admin buckets in minio Tenant — loki failed with NoSuchBucket
Story Crater Bot2026-07-21 09:31:52 -07:00
63fc502359
fix(loki,vault,iam): loki minio endpoint :80 not :9000, emit vault-minio-creds via CMP, drop redundant broken authentik-migrations job
Story Crater Bot2026-07-21 09:24:52 -07:00
7ab39280c2
fix(ingress): add homelab-ingress ArgoCD app to apply orphaned ingress.yaml — services had no Ingress object, unreachable via LAN ingress .160
Story Crater Bot2026-07-21 09:15:58 -07:00
97330d780c
feat(terraform): add per-node Cloudflare Tunnel cert SANs to controlplane certSANs — remote talosctl/kubectl over tunnel pass TLS verification
Story Crater Bot2026-07-21 08:02:24 -07:00
2b89981c28
chore(ci): add SOPS-encrypted runner-token secret record for forgejo-runner registration
Story Crater Bot2026-07-21 07:55:28 -07:00
384548b424
fix(storage): add longhorn-wffc SC + pin portainer/forgejo-runner to az-a — fixes PVC attach
Story Crater Bot2026-08-18 15:08:02 -07:00
cda75eeb7b
fix(authentik): drop redundant authentik-migrate init container — server entrypoint migrates; old-image manage migrate tripped version-history precheck on empty DB
Story Crater Bot2026-07-20 23:40:08 -07:00
79118de8d3
feat(data): add CNPG managed roles + Database CRs for authentik/temporal — replaces missing helmfile post-sync user creation
Story Crater Bot2026-07-20 23:36:21 -07:00
d9ae0a6c44
feat(substrate): deploy cert-manager/ingress-nginx/reloader + privileged PodSecurity for ingress-nginx
Story Crater Bot2026-08-18 15:08:02 -07:00
a6465f7158
fix(minio): correct operator chart source + rewrite Tenant to v5 schema + config.env creds — tenant now boots
Story Crater Bot2026-08-18 15:08:02 -07:00
2623eecfca
feat(argocd): SOPS CMP plugin decryption for Stage 0 secrets (simplify to directory source)
Story Crater Bot2026-08-18 15:08:02 -07:00
dca0e7cb9a
feat(cloudflared): wire tunnel token secret and document bootstrap
Story Crater Bot2026-07-20 10:50:20 -07:00
1168dc8417
fix(k8s,docs): scale ddb-cluster to single instance, pin minio to storage namespace, document 3-CP topology in USAGE
Story Crater Bot2026-07-20 08:22:53 -07:00
8f86a03828
refactor(argocd): replace wave/layer/phase schemes with two-phase bootstrap + app-of-apps and document both CD scopes — fixes self-hosted-git chicken-egg and stale paths
Story Crater Bot2026-07-20 08:22:53 -07:00
5b34e71111
feat(terraform): restructure control planes into a 3-node map with LAN etcd advertise and live machine CA — enables talos-cp-1/2/3 HA and drops worker configs
Story Crater Bot2026-07-20 08:22:53 -07:00
9956379f5f
chore: remove scratch planning docs — not meant for the repo
Story Crater Bot2026-08-18 15:08:02 -07:00
54bfb5ade6
feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications
Story Crater Bot2026-07-19 09:29:17 -07:00
491e88e493
feat(ci,iac): Consolidate Forgejo CI workflows and add Talos Terraform IaC
Story Crater Bot2026-07-17 23:42:55 -07:00
e48580adb9
fix(ci): Forgejo Actions auth + kustomize cleanup in validate-k8s workflow
Story Crater Bot2026-08-18 15:08:01 -07:00
517d823f77
feat(minio): Expand CRDs to include Policies and Users — full YAML-driven resource creation
Story Crater Bot2026-07-16 14:55:50 -07:00
Story Crater Bot