Story Crater Bot
3a91c19b5c
feat(monitoring): enable Alertmanager (null receiver, longhorn PVC, az-a) + fix forgejo-rules ns forgejo->cicd — alerting delivery was disabled; forgejo PrometheusRule targeted a nonexistent namespace
2026-08-13 07:10:03 -07:00
Story Crater Bot
09873aa275
fix(coredns): own Corefile+hostname rewrites via Talos inlineManifest (single-source terraform/files/coredns/Corefile), drop ArgoCD coredns-config app — in-cluster *.riotpiao.com now resolves to nginx ingress so MinIO/OIDC discovery works; update cp-2 IP .213->.214
2026-08-12 16:16:44 -07:00
Story Crater Bot
3f5d44d6fa
fix(terraform): cap EPHEMERAL volume size to reserve disk space for swap partition on worker nodes
2026-08-10 22:22:20 -07:00
Story Crater Bot
209df7558e
fix(terraform): parameterize worker network interface, use nvme diskSelector instead of raw path, add configurable swap partition support
2026-08-10 22:05:53 -07:00
Story Crater Bot
8589c40b44
feat(terraform): add GPU-enabled Talos schematic and worker node template support
2026-08-10 19:44:18 -07:00
Story Crater Bot
bf67d2d9de
fix: patch bootstrap cluster with correct config
2026-07-25 07:09:45 -07:00
Story Crater Bot
6a2aacc4e6
feat(terraform): add per-node Cloudflare Tunnel cert SANs to controlplane certSANs — remote talosctl/kubectl over tunnel pass TLS verification
...
Adds optional cloudflare_talos_sans (machine.certSANs, talos API :50000) and
cloudflare_apiserver_sans (cluster.apiServer.certSANs, kube-apiserver :6443) per
control-plane node. cp-1 gets cp1.homelab + cp1-talos.homelab; cp-2/cp-3 get
their cpN-talos.homelab. Values set in gitignored tfvars.
2026-07-21 08:02:24 -07:00
Story Crater Bot
15b1ec6ad4
feat(terraform): restructure control planes into a 3-node map with LAN etcd advertise and live machine CA — enables talos-cp-1/2/3 HA and drops worker configs
2026-07-20 08:22:53 -07:00
Story Crater Bot
578a707867
feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications
2026-07-19 09:29:17 -07:00
Story Crater Bot
c6493f14ae
feat(ci,iac): Consolidate Forgejo CI workflows and add Talos Terraform IaC
...
Consolidate three separate Forgejo Actions (argocd-sync, security-scan, validate-k8s) into single cluster-ci workflow for cleaner CI/CD pipeline with proper job sequencing and reduced auth overhead.
Add Terraform configuration for Talos cluster machine configs:
- Provider setup for Talos
- Centralized variables for CP and worker configs
- Template-based config generation for controlplane.yaml and worker-*.yaml
- Sensitive data separated in terraform.tfvars (gitignored)
- Local state tracking for infrastructure
2026-07-17 23:44:08 -07:00
Story Crater Bot
a860de94da
refactor: remove terraform entirely, migrate to pure GitOps (ArgoCD)
...
Delete entire terraform/ directory.
Architecture: Terraform + ArgoCD → ArgoCD only
- Single tool: ArgoCD manages all infrastructure and applications
- Source of truth: git only (k8s/ directory)
- Continuous reconciliation: no manual apply needed
- Simpler state: no tfstate backend, no state files
Next: Migrate all Terraform resources to k8s/ YAML manifests
and ArgoCD Applications (namespaces, storage classes, Helm releases,
RBAC, network policies, Authentik config).
2026-07-16 11:04:52 -07:00
Story Crater Bot
94a2bd648c
fix: remove kubeconfig references, use try() for pod runtime files
...
- main.tf: remove kubeconfig_path local (no longer used with direct auth)
- providers.tf: wrap file() with try() to handle plan-time on non-pod systems
try() allows terraform plan to work locally; at runtime in pod, files exist and are used.
2026-07-15 21:36:05 -07:00
Story Crater Bot
9a4d486b86
feat: Terraform foundation for cluster & app bootstrap
...
Phase 1 infrastructure-as-code setup:
- Core providers (kubernetes, helm, null)
- 15 Helm repositories (grafana, minio, prometheus, etc.)
- Namespace scaffolding (15 namespaces with pod-security labels)
- Storage classes (longhorn, longhorn-kafka with prevent_destroy)
- TLS certificate bootstrap (selfsigned, CA, wildcard cert)
- Remote state backend config (local for now, S3/GCS TODO)
- Variable definitions for all secrets/OIDC clients
Tested: terraform plan passes with no changes (bootstrap infrastructure ready)
Next: Create 25 helm_release resources (Phase 2-4)
Kept helmfile intact; network/Cilium managed via helmfile (no config risk)
Co-Authored-By: Claude Haiku 4.5 <[email protected]
2026-07-14 09:27:24 -07:00
Story Crater Bot