Story Crater Bot
49eabd0e46
feat(terraform): enable S3 remote state backend (MinIO)
...
Migrate terraform state from local file to MinIO S3 bucket (terraform-state).
Backend config: https://minio-api.riotpiao.homelab.com (external endpoint).
State now persisted remotely, shared across team, safe for cluster rebuild.
Also added terraform-state bucket to MinIO managed buckets.
2026-08-18 15:08:01 -07:00
Story Crater Bot
22e18c6f33
feat(minio): add loki storage buckets (chunks/ruler/admin/index)
2026-08-18 15:08:01 -07:00
Story Crater Bot
acfc9cfc04
feat(authentik): import 24 resources to TF; chore(bootstrap): add cilium to TF
...
Import all live authentik resources (groups, users, oauth2 providers, applications)
into terraform state via authentik-generated.tf. Provider config in authentik-config.tf.
Resources are drift-free and match live cluster.
Add cilium CNI to bootstrap helm_release.for_each (1.19.5, kube-system).
Cilium was unmanaged (helmfile-only); now IaC-owned. Critical path for
cluster rebuild recovery. Adds cilium repo to helm-repositories.tf.
2026-08-18 15:08:01 -07:00
Story Crater Bot
80e146e106
feat(minio): migrate to official MinIO Operator chart, TF-owned
2026-08-18 15:08:01 -07:00
Story Crater Bot
07b785e5fc
Fix: Inject homelab-ca cert into ArgoCD repo-server
...
- Mount homelab-ca-secret for TLS verification
- Allows repo-server to reach forgejo.riotpiao.homelab.com
- Fixes x509 certificate verification error
2026-08-18 15:08:01 -07:00
Story Crater Bot
bb1239ab0d
Re-enable cert-manager manifests for TF import
...
- ClusterIssuers + Certificates now back in TF
- Will import existing live resources
2026-08-18 15:08:01 -07:00
Story Crater Bot
68dc426e53
feat(argocd): phase2 app-of-apps for 19 workloads + AppProject sourceRepos fix
2026-08-18 15:08:01 -07:00
Story Crater Bot
da0ec35f6c
fix(terraform): set ingress-nginx PodSecurity to privileged, keep TF-managed
2026-08-18 15:08:01 -07:00
Story Crater Bot
f64fda297e
Temp: disable kubernetes_manifest cert-manager resources (already live)
...
- Will import separately after helm issues resolved
- Avoids re-create conflicts during bootstrap apply
2026-08-18 15:08:01 -07:00
Story Crater Bot
1c1b924d1d
Fix: downgrade ArgoCD to 7.3.3, ignore helm metadata drift
...
- ArgoCD 7.9.1 -> 7.3.3 (match live cluster)
- Ignore helm release metadata in lifecycle rules
- Prevents unnecessary upgrade attempts
2026-08-18 15:08:00 -07:00
Story Crater Bot
4e473978b5
Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF
...
- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply
2026-08-18 15:08:00 -07:00
Story Crater Bot
7835ac2932
feat: Terraform foundation for cluster & app bootstrap
...
Phase 1 infrastructure-as-code setup:
- Core providers (kubernetes, helm, null)
- 15 Helm repositories (grafana, minio, prometheus, etc.)
- Namespace scaffolding (15 namespaces with pod-security labels)
- Storage classes (longhorn, longhorn-kafka with prevent_destroy)
- TLS certificate bootstrap (selfsigned, CA, wildcard cert)
- Remote state backend config (local for now, S3/GCS TODO)
- Variable definitions for all secrets/OIDC clients
Tested: terraform plan passes with no changes (bootstrap infrastructure ready)
Next: Create 25 helm_release resources (Phase 2-4)
Kept helmfile intact; network/Cilium managed via helmfile (no config risk)
Co-Authored-By: Claude Haiku 4.5 <[email protected]
2026-08-18 15:08:00 -07:00
Story Crater Bot