rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
138 Commits 3 Branches 0 Tags
54fa540b332367439804232843064a90c9aa34a0
Commit Graph
7 Commits
Author SHA1 Message Date
Story Crater Bot 8df78be298 fix(ingress): add TLS configuration for Forgejo Ingress 
- Add explicit tls block with riotpiao-com-tls secret
- Enables HTTPS access to https://forgejo.riotpiao.com
- Matches wildcard certificate (*.riotpiao.com)

The file comment mentioned TLS should be handled via default-ssl-certificate,
but explicit TLS blocks are needed for proper HTTPS routing.
 2026-08-18 15:08:03 -07:00
Story Crater Bot d16203b79d fix(ingress) patch the wrong ingress port during bootstrap 2026-08-18 15:08:03 -07:00
Story Crater Bot d70993a6bd fix(homarr): correct ingress port from 3000 to 7575 
Service listens on port 7575 (chart default), not 3000.
Nginx was routing to wrong port → 503 errors.
 2026-08-18 15:08:03 -07:00
Story Crater Bot 86f94f96fd feat(homarr): complete wiring for landing page deployment 
Adds Homarr landing page with Authentik SSO:
- k8s/argocd/apps/60-applications.yaml: multi-source Application (homarr
  chart from homarr-labs + in-repo values), ns dashboard, wave 8
- k8s/bootstrap/ingress/ingress.yaml: homarr.riotpiao.com → dashboard/homarr:3000
- k8s/bootstrap/coredns/coredns-configmap.yaml: rewrite homarr.riotpiao.com
  to ingress controller
- k8s/security/iam/scripts/authentik-provision.py: added 'homarr' to SERVICES
  (generates OAuth provider/app + homarr-oidc secret with client-id/secret)
- k8s/security/iam/rbac-dashboard-rolebinding.yaml: grants authentik-provisioner
  SA access to dashboard ns for secret management
- k8s/security/iam/kustomization.yaml: includes new RoleBinding

Homarr now fully wired:
- Ingress: https://homarr.riotpiao.com
- SSO: redirects to Authentik, login as rock
- Persistence: 5Gi RWO on longhorn-wffc (3-replica HA)
- Tile config: UI-managed (saved to PVC)
 2026-08-18 15:08:03 -07:00
Story Crater Bot 06164288bb fix(ingress): correct broken/mismatched backends found in full audit 
- minio console ingress: minio-console -> minio-cluster-console:9090 (service renamed by operator)
- minio-api ingress: point to minio:9000 (restored once requestAutoCert disabled)
- minio tenant: requestAutoCert: false (MinIO was TLS-only internally, breaking
  plain-HTTP clients like Vault's S3 backend - this was the real cause of the
  Vault S3 hang)
- argocd ingress: moved from namespace cicd -> argocd (service lives in argocd
  namespace; ingress in wrong namespace can never route, was returning 503)
- removed duplicate kmsvc ingress (sqs namespace already has management-service
  ingress with proper TLS block for same host/backend)

Audit method: cross-checked every ingress backend.service.{name,port} against
actual Service objects in cluster. Found 3 broken backends out of 15 ingresses.
 2026-08-18 15:08:02 -07:00
Story Crater Bot 54bfb5ade6 feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications 2026-08-18 15:08:02 -07:00
Story Crater Bot 0f30d77288 refactor(k8s): Reorganize into 5-layer structure with production kustomizations 2026-08-18 15:08:01 -07:00