rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

Browse Source
This commit is contained in:
Story Crater Bot
2026-07-19 09:29:17 -07:00
parent c6493f14ae
commit 578a707867
86 changed files with 889 additions and 446 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/applications/cloudflared/deployment.yaml
+37
View File
@@ -0,0 +1,37 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: cloudflared
namespace: cloudflared
spec:
replicas: 2
selector:
matchLabels:
app: cloudflared
template:
metadata:
labels:
app: cloudflared
spec:
containers:
- name: cloudflared
image: cloudflare/cloudflared:latest
args:
- tunnel
- --no-autoupdate
- run
- --token
- $(TUNNEL_TOKEN)
env:
- name: TUNNEL_TOKEN
valueFrom:
secretKeyRef:
name: cloudflared-token
key: token
resources:
requests:
cpu: 10m
memory: 32Mi
limits:
cpu: 100m
memory: 128Mi
k8s/applications/cloudflared/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cloudflared
resources:
- deployment.yaml
k8s/applications/dev-tools/README.md
+4 -4
View File
@@ -9,17 +9,17 @@ Build for `linux/amd64`:
```bash
cd homelab
docker buildx build --platform linux/amd64 \
-t forgejo.riotpiao.homelab.com/rock/claude-terminal:latest \
-t forgejo.riotpiao.com/rock/claude-terminal:latest \
-f k8s/dev-tools/Dockerfile \
k8s/dev-tools
# Log in to Forgejo registry
docker login forgejo.riotpiao.homelab.com \
docker login forgejo.riotpiao.com \
--username ci-bot \
--password "$(talos get cluster/iam/agents/ci-bot --key token)"
# Push
docker push forgejo.riotpiao.homelab.com/rock/claude-terminal:latest
docker push forgejo.riotpiao.com/rock/claude-terminal:latest
```
Or use the provided build script:
@@ -36,7 +36,7 @@ Update `values.yaml` if needed, then deploy via helmfile:
helmfile apply -l name=claude-terminal
```
Access the terminal at: **https://claude.riotpiao.homelab.com**
Access the terminal at: **https://claude.riotpiao.com**
## Persistent Storage
k8s/applications/dev-tools/build.sh
+1 -1
View File
@@ -1,7 +1,7 @@
#!/bin/bash
set -euo pipefail
REGISTRY="forgejo.riotpiao.homelab.com"
REGISTRY="forgejo.riotpiao.com"
IMAGE_NAME="rock/claude-terminal"
TAG="latest"
FULL_IMAGE="${REGISTRY}/${IMAGE_NAME}:${TAG}"
k8s/applications/dev-tools/values.yaml
+2 -2
View File
@@ -15,14 +15,14 @@ ingress:
annotations:
cert-manager.io/cluster-issuer: homelab-ca
hosts:
- host: claude.riotpiao.homelab.com
- host: claude.riotpiao.com
paths:
- path: /
pathType: Prefix
tls:
- secretName: claude-terminal-tls
hosts:
- claude.riotpiao.homelab.com
- claude.riotpiao.com
persistence:
enabled: true
k8s/applications/duckdns/kustomization.yaml
+2 -3
View File
@@ -1,5 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: duckdns
resources: []
# DuckDNS deployed via Helm chart or CronJob
resources:
- duckdns-corn.yaml
k8s/applications/forge/runner.yaml
+4 -4
View File
@@ -21,7 +21,7 @@
# The homelab-ca secret above only reaches the runner/register/dind containers.
# It does NOT reach the per-job containers DinD spawns (e.g. golangci-lint,
# node:22-bookworm) — those are fresh sibling containers with their own trust
# store. Without this, any git/curl/apk call to forgejo.riotpiao.homelab.com
# store. Without this, any git/curl/apk call to forgejo.riotpiao.com
# from inside a job fails with "SSL certificate problem: unable to get local
# issuer certificate". Build a merged bundle (public roots + homelab CA) and
# bind-mount it over /etc/ssl/certs/ca-certificates.crt in every job
@@ -30,7 +30,7 @@
# IMPORTANT: source the CA from the live cluster secret, NOT from
# k8s/forge/pki/ca.crt — that repo file is a stale CA from before the
# "unified certificate" migration (different key, fails verification
# against the cert actually served by forgejo.riotpiao.homelab.com). The
# against the cert actually served by forgejo.riotpiao.com). The
# org-wide CA that signs the live ingress cert lives in
# cert-manager/homelab-ca-secret, and cicd/homelab-ca above is already
# synced from it.
@@ -220,7 +220,7 @@ spec:
- |
test -f /data/.runner && echo "already registered, skipping" && exit 0
forgejo-runner register --no-interactive \
--instance https://forgejo.riotpiao.homelab.com \
--instance https://forgejo.riotpiao.com \
--token "$RUNNER_TOKEN" \
--name talos-runner \
--labels "docker:docker://node:22-bookworm"
@@ -407,7 +407,7 @@ spec:
- to:
- podSelector: {}
# ingress-nginx (the runner talks to Forgejo via its public hostname,
# https://forgejo.riotpiao.homelab.com, which resolves to the ingress
# https://forgejo.riotpiao.com, which resolves to the ingress
# controller's ClusterIP — a different namespace on the pod network)
- to:
- namespaceSelector:
k8s/applications/kustomization.yaml
+1
View File
@@ -16,3 +16,4 @@ resources:
- shadowsocks/
- dev-tools/
- duckdns/
- cloudflared/
k8s/applications/sqs/argocd/apps/01-kafka-cluster.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: kmsvc
source:
repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
repoURL: https://forgejo.riotpiao.com/rock/kafaka-management-service.git
targetRevision: main
path: k8s/charts/kafka-cluster
helm:
k8s/applications/sqs/argocd/apps/03-queue-crd.yaml
+2 -2
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: kmsvc
source:
repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
repoURL: https://forgejo.riotpiao.com/rock/kafaka-management-service.git
targetRevision: main
path: k8s/charts/queue-crd
helm:
@@ -17,7 +17,7 @@ spec:
kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
image:
repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service-queue-operator
repository: forgejo.riotpiao.com/rock/kafka-management-service-queue-operator
# CI (.forgejo/workflows/release.yaml) writes the released git tag
# here and pushes the commit -- ArgoCD picks it up on its next sync.
tag: latest
k8s/applications/sqs/argocd/apps/04-management-service.yaml
+4 -4
View File
@@ -8,25 +8,25 @@ metadata:
spec:
project: kmsvc
source:
repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
repoURL: https://forgejo.riotpiao.com/rock/kafaka-management-service.git
targetRevision: main
path: k8s/charts/management-service
helm:
values: |
namespace: sqs
image:
repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service
repository: forgejo.riotpiao.com/rock/kafka-management-service
# CI (.forgejo/workflows/release.yaml) writes the released git tag
# here and pushes the commit -- ArgoCD picks it up on its next sync.
tag: latest
env:
kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
authentikIssuerURL: "https://authentik.riotpiao.homelab.com/application/o/kafaka/"
authentikIssuerURL: "https://authentik.riotpiao.com/application/o/kafaka/"
authentikAudience: "QI0gPtR99ar8VvhK8Tqox4SDkTKzbNU7lbgwBNSc"
ingress:
enabled: true
host: kmsvc.riotpiao.homelab.com
host: kmsvc.riotpiao.com
clusterIssuer: homelab-ca
destination:
server: https://kubernetes.default.svc
k8s/applications/sqs/argocd/project.yaml
+1 -1
View File
@@ -6,7 +6,7 @@ metadata:
spec:
description: Kafka Management Service (design.md) -- Strimzi/Kafka, Redis, queue-operator, message-plane server
sourceRepos:
- https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
- https://forgejo.riotpiao.com/rock/kafaka-management-service.git
- https://strimzi.io/charts/
- https://charts.bitnami.com/bitnami
destinations:
k8s/applications/sqs/argocd/root.yaml
+1 -1
View File
@@ -6,7 +6,7 @@ metadata:
spec:
project: kmsvc
source:
repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
repoURL: https://forgejo.riotpiao.com/rock/kafaka-management-service.git
targetRevision: main
path: k8s/argocd/apps
directory:
k8s/applications/sqs/charts/management-service/values.yaml
+2 -2
View File
@@ -40,10 +40,10 @@ ingress:
enabled: true
className: nginx
clusterIssuer: homelab-ca
host: kmsvc.riotpiao.homelab.com
host: kmsvc.riotpiao.com
tlsSecretName: kmsvc-tls
# kmsvc-cli connects via gRPC directly to --server/KMSVC_SERVER (default
# kmsvc.riotpiao.homelab.com:443, see kmsvc-cli's README), so raw gRPC needs an
# kmsvc.riotpiao.com:443, see kmsvc-cli's README), so raw gRPC needs an
# external path too — scoped to the gRPC service's own path prefix on the
# same host/port, rather than opening the whole host to gRPC passthrough.
grpcEnabled: true
k8s/applications/sqs/environments/homelab.yaml
+2 -2
View File
@@ -23,7 +23,7 @@ redis:
managementService:
ingress:
host: kmsvc.riotpiao.homelab.com
host: kmsvc.riotpiao.com
clusterIssuer: homelab-ca
authentikIssuerURL: "https://authentik.riotpiao.homelab.com/application/o/kafaka/"
authentikIssuerURL: "https://authentik.riotpiao.com/application/o/kafaka/"
authentikAudience: "QI0gPtR99ar8VvhK8Tqox4SDkTKzbNU7lbgwBNSc"
k8s/applications/temporal/PHASE_2_TESTING.md
+1 -1
View File
@@ -119,7 +119,7 @@ worker-production-5f8b4c... 1/1 Running 0 10s
### Step 5: Verify Worker Connected to Temporal Namespace
Check Temporal UI for namespace "production":
```bash
open https://temporal.riotpiao.homelab.com/namespaces/production/task-queues
open https://temporal.riotpiao.com/namespaces/production/task-queues
```
Look for all task queues with worker count > 0:
k8s/applications/temporal/TEMPORAL_OAUTH2_SETUP.md
+6 -6
View File
@@ -19,7 +19,7 @@ Browser → Ingress (TLS) → oauth2-proxy (OIDC check) → temporal-web (intern
✅ Authentik OIDC provider `temporal` already exists with:
- Client ID: `temporal`
- Client Secret: stored in Kubernetes secret `temporal-oidc` (key: `clientSecret`)
- Redirect URI: `https://temporal.riotpiao.homelab.com/oauth2/callback`
- Redirect URI: `https://temporal.riotpiao.com/oauth2/callback`
## Secrets
@@ -85,14 +85,14 @@ kubectl get ingress -n temporal
Expected:
```
NAME CLASS HOSTS ADDRESS PORTS AGE
temporal nginx temporal.riotpiao.homelab.com ... 80, 443 10s
temporal nginx temporal.riotpiao.com ... 80, 443 10s
```
### Step 3: Test Access
1. **Open Temporal UI (unauthenticated):**
```bash
open https://temporal.riotpiao.homelab.com
open https://temporal.riotpiao.com
```
Expected: Redirects to Authentik login page
@@ -100,12 +100,12 @@ temporal nginx temporal.riotpiao.homelab.com ... 80, 443 10s
2. **Login with Authentik credentials**
- Username/email
- Password
- Should redirect back to `temporal.riotpiao.homelab.com` and display UI
- Should redirect back to `temporal.riotpiao.com` and display UI
3. **Verify auth:**
```bash
# Check for oauth2_proxy cookie
curl -v https://temporal.riotpiao.homelab.com 2>&1 | grep -i cookie
curl -v https://temporal.riotpiao.com 2>&1 | grep -i cookie
```
4. **Check oauth2-proxy logs:**
@@ -127,7 +127,7 @@ redirect_uri_mismatch: The redirect_uri does not match the one registered in Aut
```
Fix:
- Verify Authentik application (Applications → temporal) has redirect URI: `https://temporal.riotpiao.homelab.com/oauth2/callback`
- Verify Authentik application (Applications → temporal) has redirect URI: `https://temporal.riotpiao.com/oauth2/callback`
- Ensure HTTPS (not HTTP)
### Missing secret