Story Crater Bot
cdf1cdeb18
feat(terraform): GPU worker node support (schematic, interface/diskSelector/swap tuning, gpu-node label, NVIDIA LTS extensions)
2026-08-18 15:08:04 -07:00
Story Crater Bot
5b3307ffee
fix(bootstrap): correct cluster config + complete Phase4 ArgoCD bootstrap permanent fixes
2026-08-18 15:08:03 -07:00
Story Crater Bot
97330d780c
feat(terraform): add per-node Cloudflare Tunnel cert SANs to controlplane certSANs — remote talosctl/kubectl over tunnel pass TLS verification
...
Adds optional cloudflare_talos_sans (machine.certSANs, talos API :50000) and
cloudflare_apiserver_sans (cluster.apiServer.certSANs, kube-apiserver :6443) per
control-plane node. cp-1 gets cp1.homelab + cp1-talos.homelab; cp-2/cp-3 get
their cpN-talos.homelab. Values set in gitignored tfvars.
2026-08-18 15:08:02 -07:00
Story Crater Bot
5b34e71111
feat(terraform): restructure control planes into a 3-node map with LAN etcd advertise and live machine CA — enables talos-cp-1/2/3 HA and drops worker configs
2026-08-18 15:08:02 -07:00
Story Crater Bot
54bfb5ade6
feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications
2026-08-18 15:08:02 -07:00
Story Crater Bot
491e88e493
feat(ci,iac): Consolidate Forgejo CI workflows and add Talos Terraform IaC
...
Consolidate three separate Forgejo Actions (argocd-sync, security-scan, validate-k8s) into single cluster-ci workflow for cleaner CI/CD pipeline with proper job sequencing and reduced auth overhead.
Add Terraform configuration for Talos cluster machine configs:
- Provider setup for Talos
- Centralized variables for CP and worker configs
- Template-based config generation for controlplane.yaml and worker-*.yaml
- Sensitive data separated in terraform.tfvars (gitignored)
- Local state tracking for infrastructure
2026-08-18 15:08:01 -07:00
Story Crater Bot
563f720d09
refactor: retire Terraform, migrate to pure ArgoCD GitOps + CI validation
2026-08-18 15:08:01 -07:00
Story Crater Bot
adbad3d97e
fix(ci): use direct in-cluster Kubernetes auth for CI runner — drop kubeconfig file dependency
2026-08-18 15:08:01 -07:00
Story Crater Bot
29d5ba3e6e
chore(terraform): clean up TF state git-tracking (gitignore, drop cached state, dep bump)
2026-08-18 15:08:01 -07:00
Story Crater Bot
4e473978b5
Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF
...
- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply
2026-08-18 15:08:00 -07:00
Story Crater Bot
7835ac2932
feat: Terraform foundation for cluster & app bootstrap
...
Phase 1 infrastructure-as-code setup:
- Core providers (kubernetes, helm, null)
- 15 Helm repositories (grafana, minio, prometheus, etc.)
- Namespace scaffolding (15 namespaces with pod-security labels)
- Storage classes (longhorn, longhorn-kafka with prevent_destroy)
- TLS certificate bootstrap (selfsigned, CA, wildcard cert)
- Remote state backend config (local for now, S3/GCS TODO)
- Variable definitions for all secrets/OIDC clients
Tested: terraform plan passes with no changes (bootstrap infrastructure ready)
Next: Create 25 helm_release resources (Phase 2-4)
Kept helmfile intact; network/Cilium managed via helmfile (no config risk)
Co-Authored-By: Claude Haiku 4.5 <[email protected]
2026-08-18 15:08:00 -07:00
Story Crater Bot