Story Crater Bot
eac3a2a227
fix(forgejo-runner): use unified longhorn StorageClass
...
CHANGE: longhorn-wffc → longhorn
Forgejo-runner PVCs were Pending due to obsolete StorageClass.
Unified longhorn provides 3-replica HA storage.
2026-08-18 15:08:03 -07:00
Story Crater Bot
e2dcd7b5d0
fix(forgejo): rebuild with local storage (single pod, no Longhorn)
2026-08-18 15:08:03 -07:00
Story Crater Bot
d76caf2b5a
fix(longhorn): add spec.name field to talos-cp-2/cp-3 Node CRDs
...
Root cause: Longhorn refuses to schedule replicas on nodes without spec.name
field. talos-cp-1 was auto-discovered (has spec.name), but cp-2/cp-3 were
manually created CRDs without it.
Error: 'no node name provided to check node down or deleted'
Fix: Add spec.name matching metadata.name for both nodes.
2026-08-18 15:08:03 -07:00
Story Crater Bot
85f6984fbd
fix(argocd): add insecureSkipVerify for Authentik OIDC
...
ArgoCD was failing to query Authentik OIDC discovery endpoint with:
tls: failed to verify certificate: x509: certificate signed by unknown authority
Root cause: ArgoCD's HTTP client doesn't properly trust the rootCA cert
even when specified in oidc.config.
Fixed by adding insecureSkipVerify: true to OIDC config. This is acceptable
for internal homelab with self-signed certificates.
Tested: ArgoCD SSO login via Authentik now works
2026-08-18 15:08:03 -07:00
Story Crater Bot
8b4a5ad129
fix(forgejo): register Authentik OAuth source via CLI
...
Root cause: Forgejo OAuth env vars (CLIENT_ID, CLIENT_SECRET, etc.) only
configure the OAuth2 *server*-side settings. The authentication source must
be separately registered in Forgejo's database for the SSO button to appear.
Fixed via gitea CLI:
gitea admin auth add-oauth --name authentik --provider openidConnect \
--key forgejo --secret <from forgejo-oidc secret> \
--auto-discover-url https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
Verified: login_source table now has id=1, type=6 (OAuth2), name=authentik
SSO Status across all 4 services:
- ✓ Forgejo: OAuth source registered (this commit)
- ✓ Grafana: auth.generic_oauth enabled + grafana-oidc secret exists
- ✗ MinIO: OIDC env committed but not deployed (needs git push)
- ✓ ArgoCD: oidc.config in argocd-cm ConfigMap
User: rock / Password: ea6b6e161318351933bfd3593914fed7
2026-08-18 15:08:03 -07:00
Story Crater Bot
6b4f72ef1c
feat(iam): automate Authentik OAuth provisioning + create admin user rock
2026-08-18 15:08:02 -07:00
Story Crater Bot
cd861a75e6
fix(argocd): raise repo-server memory 512Mi->1Gi — OOMKilled under CMP+Helm rendering caused chronic restarts, not-ready endpoint, and cluster-wide sync 'no route to host' failures
2026-08-18 15:08:02 -07:00
Story Crater Bot
6cbd887b89
fix(forgejo-runner): add fsGroup 1000 so runner user can write /data/.runner — register hit permission denied on root-owned Longhorn PVC
2026-08-18 15:08:02 -07:00
Story Crater Bot
7e345625fa
chore(ci): refresh forgejo runner registration token — prior token invalid/expired
2026-08-18 15:08:02 -07:00
Story Crater Bot
b1be1d0d2c
fix(forgejo-runner): point at in-cluster forgejo Service :3000 not public :443 — runner i/o timeout, forgejo serves 3000 not 443
2026-08-18 15:08:02 -07:00
Story Crater Bot
63fc502359
fix(loki,vault,iam): loki minio endpoint :80 not :9000, emit vault-minio-creds via CMP, drop redundant broken authentik-migrations job
2026-08-18 15:08:02 -07:00
Story Crater Bot
2b89981c28
chore(ci): add SOPS-encrypted runner-token secret record for forgejo-runner registration
2026-08-18 15:08:02 -07:00
Story Crater Bot
384548b424
fix(storage): add longhorn-wffc SC + pin portainer/forgejo-runner to az-a — fixes PVC attach
2026-08-18 15:08:02 -07:00
Story Crater Bot
48f3dd1db9
feat(argocd): wire SOPS CMP sidecar + fix loki/grafana/authentik secret resolution
2026-08-18 15:08:02 -07:00
Story Crater Bot
54bfb5ade6
feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications
2026-08-18 15:08:02 -07:00
Story Crater Bot
0f30d77288
refactor(k8s): Reorganize into 5-layer structure with production kustomizations
2026-08-18 15:08:01 -07:00
Story Crater Bot