rubenhensen/k8scd
1
0 Fork 0
mirror of https://github.com/rubenhensen/k8scd.git synced 2026-11-15 14:29:09 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,577 Commits 27 Branches 0 Tags
main
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ruben Hensen b29616990c Merge pull request #69 from rubenhensen/renovate/towfiqi-serpbear-3.x 
chore(deps): update towfiqi/serpbear docker tag to v3.1.2
 2026-11-04 09:47:34 +01:00
Ruben Hensen f08737c221 Merge pull request #65 from rubenhensen/renovate/wordpress-0.16.x 
chore(deps): update helm chart wordpress to v0.16.8
 2026-11-04 09:45:45 +01:00
Ruben Hensen 65858d3f0b Merge pull request #64 from rubenhensen/renovate/velero-12.2.x 
chore(deps): update helm chart velero to v12.2.3
 2026-11-04 09:45:39 +01:00
Ruben Hensen b6be49b701 Merge pull request #67 from rubenhensen/renovate/gitea-gitea-28.x 
chore(deps): update gitea/gitea docker tag to v28.3.0
 2026-11-04 09:45:34 +01:00
Ruben Hensen d6779a399f Merge pull request #66 from rubenhensen/renovate/binwiederhier-ntfy-2.x 
chore(deps): update binwiederhier/ntfy docker tag to v2.37.2
 2026-11-04 09:45:30 +01:00
Ruben Hensen 3d1b7dd230 Merge pull request #70 from rubenhensen/home-ip-62.41.86.53 
Home IP is now 62.41.86.53
 2026-11-03 22:11:32 +01:00
Ruben Hensen aaae182844 Home IP is now 62.41.86.53 
After the ISP cut the connection, it came back on a new address. node001
still tunneled everything to 62.41.86.27, so every host behind it timed
out. Moves the tunnel, the ldap, s2 and ntfy2 records and the Gatus DNS
plan to the new address.
 2026-11-03 22:09:55 +01:00
Ruben Hensen 7db73a100e Merge pull request #63 from rubenhensen/renovate/twinproduction-gatus-5.x 
chore(deps): update twinproduction/gatus docker tag to v5.38.0
 2026-10-29 10:55:26 +01:00
Ruben Hensen 40cd825602 Merge pull request #62 from rubenhensen/roadmap-2026-10-28 
docs: the roadmap as of 2026-10-28
 2026-10-29 10:55:23 +01:00
Ruben Hensen a4b09fc51e docs: the roadmap as of 2026-10-28 2026-10-28 16:01:16 +01:00
Ruben Hensen 0589bb3e08 Merge pull request #61 from rubenhensen/immich-pg14-cleanup 
immich: remove the PostgreSQL 14 cluster
 2026-10-28 15:44:45 +01:00
Ruben Hensen c298ad8746 immich: remove the PostgreSQL 14 cluster 2026-10-28 15:40:14 +01:00
Ruben Hensen fe105a4fa7 Merge pull request #60 from rubenhensen/mariadb-11.4 
MariaDB: newest 11.4 patch, and keep Renovate on 11.4
 2026-10-28 15:36:16 +01:00
Ruben Hensen 1afd4b6bbd mariadb: newest 11.4 patch, and keep Renovate on 11.4 2026-10-28 15:31:40 +01:00
Ruben Hensen b4663216db Merge pull request #59 from rubenhensen/immich-share-people 
immich: share the group account's people with everyone
 2026-10-28 15:17:06 +01:00
Ruben Hensen 955c22c665 Merge pull request #58 from rubenhensen/memory-limits 
Memory limits from a day of measurements
 2026-10-28 15:16:55 +01:00
Ruben Hensen f7396b3cb7 immich: share the group account's people with everyone 2026-10-28 15:10:06 +01:00
Ruben Hensen 1f894996e6 docs: memory limits on the roadmap 2026-10-28 14:58:03 +01:00
Ruben Hensen c380bfc0cf Memory limits from a day of measurements 2026-10-28 14:57:34 +01:00
Ruben Hensen c3597ef0a6 Merge pull request #45 from rubenhensen/renovate/mariadb-operator-26.x 
chore(deps): update helm chart mariadb-operator to v26
 2026-10-27 10:43:09 +01:00
Ruben Hensen baa8c70b55 Merge pull request #46 from rubenhensen/renovate/mariadb-operator-crds-26.x 
chore(deps): update helm chart mariadb-operator-crds to v26
 2026-10-27 10:38:31 +01:00
Ruben Hensen 1efa6c2b93 Merge pull request #40 from rubenhensen/renovate/ghcr.io-cloudnative-pg-postgresql-17.x 
chore(deps): update ghcr.io/cloudnative-pg/postgresql docker tag to v17.11
 2026-10-27 09:51:44 +01:00
Ruben Hensen 15a92294a6 Merge pull request #41 from rubenhensen/renovate/actualbudget-1.x 
chore(deps): update helm chart actualbudget to v1.9.5
 2026-10-27 09:31:49 +01:00
Ruben Hensen 144b9dda2b Merge pull request #48 from rubenhensen/renovate/docker.io-envoyproxy-gateway-helm-1.x 
chore(deps): update docker.io/envoyproxy/gateway-helm docker tag to v1.9.3
 2026-10-27 09:31:28 +01:00
Ruben Hensen 920e54b43c Merge pull request #44 from rubenhensen/renovate/ubuntu-26.x 
chore(deps): update dependency ubuntu to v26
 2026-10-27 09:31:03 +01:00
Ruben Hensen 665147a691 Merge pull request #43 from rubenhensen/renovate/python-3.x 
chore(deps): update python docker tag to v3.15
 2026-10-27 09:30:50 +01:00
Ruben Hensen 285a64f980 Merge pull request #38 from rubenhensen/renovate/alpine-git-2.x 
chore(deps): update alpine/git docker tag to v2.54.0
 2026-10-27 09:30:32 +01:00
Ruben Hensen 6cf41b0f14 Merge pull request #37 from rubenhensen/renovate/freshrss-freshrss-1.x 
chore(deps): update freshrss/freshrss docker tag to v1.30.4
 2026-10-27 09:30:16 +01:00
Ruben Hensen 2e2d367f63 Merge pull request #57 from rubenhensen/roadmap-cnpg 
docs: CNPG backups and the infra NetworkPolicies are in
 2026-10-27 00:00:51 +01:00
Ruben Hensen 2a1394763d docs: CNPG backups and the infra NetworkPolicies are in 2026-10-26 23:59:47 +01:00
Ruben Hensen 86bbf25145 Merge pull request #56 from rubenhensen/cnpg-barman 
CNPG: back the databases up to Garage with the barman cloud plugin
 2026-10-26 23:43:39 +01:00
Ruben Hensen 92d5147994 Merge pull request #55 from rubenhensen/roadmap-decisions 
docs: the roadmap after tonight
 2026-10-26 23:43:20 +01:00
Ruben Hensen 9e88a92ff7 Merge pull request #53 from rubenhensen/netpol-infra 
NetworkPolicies for the infrastructure namespaces
 2026-10-26 23:42:21 +01:00
Ruben Hensen 7b12ee2028 cnpg: back the databases up to Garage with the barman cloud plugin 2026-10-26 23:38:13 +01:00
Ruben Hensen 039b956764 Merge pull request #54 from rubenhensen/netpol-envoy 
NetworkPolicy for envoy-gateway-system
 2026-10-26 23:31:28 +01:00
Ruben Hensen d187f55e57 docs: tonight's decisions on the roadmap 2026-10-26 23:29:23 +01:00
Ruben Hensen 66207de2dd Merge pull request #52 from rubenhensen/renovate-automerge 
Renovate: automerge patch updates of low-risk apps
 2026-10-26 23:28:09 +01:00
Ruben Hensen a8ccbef274 envoy-gateway-system: NetworkPolicy 2026-10-26 23:28:05 +01:00
Ruben Hensen d0ce5ddbec Merge pull request #51 from rubenhensen/netpol-acme 
NetworkPolicies: let Envoy reach cert-manager's HTTP-01 solver
 2026-10-26 23:27:48 +01:00
Ruben Hensen c384ae921f default: deny all, through a folder app of its own 2026-10-26 23:26:47 +01:00
Ruben Hensen 13b92fff54 dns: NetworkPolicy 2026-10-26 23:26:38 +01:00
Ruben Hensen 3834f7a354 mariadb-system: NetworkPolicy 2026-10-26 23:26:25 +01:00
Ruben Hensen 8110a235a9 velero: NetworkPolicy 2026-10-26 23:26:15 +01:00
Ruben Hensen fa33bf44ae external-secrets: NetworkPolicy, through a folder app of its own 2026-10-26 23:26:06 +01:00
Ruben Hensen d4e99d28c7 cnpg-system: NetworkPolicy, through a folder app of its own 2026-10-26 23:25:55 +01:00
Ruben Hensen c8a81e805d cert-manager: NetworkPolicy 2026-10-26 23:25:28 +01:00
Ruben Hensen 3fd585de5f docs: immich ML v2 is done (#39) 2026-10-26 23:25:11 +01:00
Ruben Hensen 6c727346f6 renovate: patch updates of low-risk apps merge themselves 2026-10-26 23:23:25 +01:00
Ruben Hensen ed828b426f networkpolicy: let Envoy reach cert-manager's HTTP-01 solver 2026-10-26 23:19:28 +01:00
Ruben Hensen 0dc69d34f0 Merge pull request #50 from rubenhensen/proxy-protocol 
Pass the visitor's address from node001 to the home cluster
 2026-10-26 23:12:14 +01:00
Ruben Hensen 30540ea579 node001: send the visitor's address to the home cluster 
The stream server on 443 now starts each connection with a PROXY header.
nginx sends it to every upstream or none, so Stalwart (8443) and the
local nginx for Gatus and ntfy (8444) get theirs through a hop on
8445/8446 that takes it off again; nothing changes for them.

Deploy after the Gateway accepts the header, or the tunneled hosts stop
answering until it does.
 2026-10-26 23:11:38 +01:00
Ruben Hensen 53d74768ad gateway: take the visitor's address from a PROXY header 
node001 passes TLS through without opening it, so every request from
the tunneled hosts arrives from 46.224.26.65. Wordfence locked that
address out after 20 failed logins on 2026-10-26, and with it everyone
who logs in to scoutingmbg.nl. With a PROXY header from node001, Envoy
puts the visitor's address in X-Forwarded-For instead.

The header is optional: s2 and ntfy2 point straight at home, and
node001's proxy on port 80 sends none either.
 2026-10-26 23:11:38 +01:00
Ruben Hensen b6462fb3a9 Merge pull request #49 from rubenhensen/roadmap-garage 
docs: Velero on Garage
 2026-10-26 23:04:15 +01:00
Ruben Hensen bed68c70a8 velero: the switch to Garage was on 10-26 2026-10-26 22:57:35 +01:00
Ruben Hensen 3991a8d726 docs: Velero on Garage, and the off-site copy from the bucket 2026-10-26 22:57:35 +01:00
Ruben Hensen 648f99c505 Merge pull request #35 from rubenhensen/velero-garage 
Velero backs up to Garage instead of MinIO
 2026-10-26 22:52:42 +01:00
Ruben Hensen 20bd3a4bca Merge pull request #39 from rubenhensen/immich-ml-v2 
immich: the optimized ML models, cached on a volume
 2026-10-25 17:48:40 +01:00
Ruben Hensen 6cba1a9363 immich: the optimized ML models, cached on a volume 2026-10-25 17:46:03 +01:00
Ruben Hensen acfce6645e velero: skip PVCs in Longhorn's no-backup group 2026-10-25 17:46:03 +01:00
Ruben Hensen 0de86dd65c Merge pull request #36 from rubenhensen/renovate-re2 
Renovate: skip the non-app folders without a lookahead
 2026-10-25 17:41:32 +01:00
Ruben Hensen d7ffdc05f6 docs: Renovate rejected the lookahead (#32) 2026-10-25 17:33:39 +01:00
Ruben Hensen c0f8034e14 renovate: skip the non-app folders through ignorePaths, not a lookahead 2026-10-25 17:33:39 +01:00
Ruben Hensen a15a4f7c75 Merge pull request #34 from rubenhensen/velero-garage-secret 
Garage on the NAS, and Velero's key for it
 2026-10-25 17:23:33 +01:00
Ruben Hensen bdafcaf1e0 backup-testing: read Velero's key for Garage 2026-10-25 17:10:32 +01:00
Ruben Hensen 03c3196242 velero: back up to Garage instead of MinIO 2026-10-25 17:10:32 +01:00
Ruben Hensen b072099cc1 nas: Garage keeps its metadata in SQLite 2026-10-25 17:08:13 +01:00
Ruben Hensen e10ca337f1 velero: a key for Garage, from Vault 2026-10-25 16:28:43 +01:00
Ruben Hensen c72b08867f nas: Garage, which takes over from MinIO 2026-10-25 16:28:43 +01:00
Ruben Hensen d85362ce3b docs: the restore test passed against the real backups 2026-10-25 14:57:18 +01:00
Ruben Hensen 018f528fb3 docs: a WordPress cache without plugins 2026-10-25 14:56:10 +01:00
Ruben Hensen 714712b862 docs: WordPress is capped at 12 workers 2026-10-25 13:11:20 +01:00
Ruben Hensen 7dc13466cb mbgwp: cap Apache at 12 workers so a crawler can't run it out of memory 2026-10-25 13:07:30 +01:00
Ruben Hensen 9b77596bcb backup-testing: take endpoint, region and bucket from Velero's location 2026-10-25 12:59:25 +01:00
Ruben Hensen fbf2cb2d92 docs: the unseal key is kept safe 2026-10-25 12:57:18 +01:00
Ruben Hensen 122873ca5c docs: hensen.io can expire 2026-10-25 12:54:32 +01:00
Ruben Hensen 71449dd185 docs: record the external-secrets upgrade 2026-10-25 12:54:01 +01:00
Ruben Hensen 297d2dffa5 Merge pull request #17 from rubenhensen/renovate/external-secrets-2.x 
chore(deps): update helm chart external-secrets to v2.14.0
 2026-10-25 12:50:28 +01:00
Ruben Hensen 46117ee658 chore(deps): update helm chart external-secrets to v2.14.0 2026-10-25 12:49:06 +01:00
Ruben Hensen 2a5bbc7f44 docs: the scoutingmbg.nl DNS questions are answered 
Only the four records moved to node001, hensen.io is no longer needed, and SPF's a mechanism doesn't matter since all mail goes through Google.
 2026-10-25 12:39:57 +01:00
Ruben Hensen d7b0372f1a docs: record the rest of the merged PRs 2026-10-25 12:37:25 +01:00
Ruben Hensen 0ad6ca816c docs: who cleaned up the snapshots, and the stalls per minute 
Every minute with dqlite errors in the 23 hours sampled had the SSD fully busy; the controllers with 60s leases held.
 2026-10-25 12:35:47 +01:00
Ruben Hensen 3e252799a4 Merge pull request #26 from rubenhensen/renovate/gitea-gitea-28.x 
chore(deps): update gitea/gitea docker tag to v28
 2026-10-25 12:25:03 +01:00
Ruben Hensen bfd5619e9e Merge pull request #27 from rubenhensen/renovate/github.com-canonical-go-dqlite-v3-3.x 
fix(deps): update module github.com/canonical/go-dqlite/v3 to v3.0.4
 2026-10-25 12:24:30 +01:00
Ruben Hensen 0b38d8dec8 Merge pull request #33 from rubenhensen/requests 
Set resource requests from measured usage
 2026-10-25 12:23:54 +01:00
Ruben Hensen 083353fb9d Merge pull request #23 from rubenhensen/renovate/binwiederhier-ntfy-2.x 
chore(deps): update binwiederhier/ntfy docker tag to v2.34.0
 2026-10-25 12:22:45 +01:00
Ruben Hensen 23f9c5c60a docs: record the merged Renovate PRs 2026-10-25 12:21:38 +01:00
Ruben Hensen a8bf3d5b64 Merge pull request #31 from rubenhensen/renovate/python-3.x 
chore(deps): update python docker tag to v3.15.1
 2026-10-25 12:17:31 +01:00
Ruben Hensen 618954ae2c Merge pull request #25 from rubenhensen/renovate/wordpress-0.x 
chore(deps): update helm chart wordpress to v0.16.7
 2026-10-25 12:17:17 +01:00
Ruben Hensen 44dc85d306 Merge pull request #24 from rubenhensen/renovate/https-github.com-kubernetes-csi-external-snapshotter.git-8.x 
chore(deps): update dependency https://github.com/kubernetes-csi/external-snapshotter.git to v8.7.0
 2026-10-25 12:16:25 +01:00
Ruben Hensen b60735f6b0 Merge pull request #28 from rubenhensen/renovate/cert-manager-1.21.x 
chore(deps): update helm chart cert-manager to v1.21.3
 2026-10-25 12:14:55 +01:00
Ruben Hensen 3a57e5be48 docs: WordPress went out of memory under a crawler 2026-10-25 09:45:33 +01:00
Ruben Hensen 1611f5d1ef docs: PR 33's window and Renovate's PR limit 2026-10-25 09:44:20 +01:00
Ruben Hensen 5bb1422594 Raise two requests after the morning's numbers 2026-10-25 09:43:11 +01:00
Ruben Hensen 68b692a112 docs: requests are in PR 33 2026-10-25 07:10:37 +01:00
Ruben Hensen 72f49bed51 Set resource requests from measured usage 2026-10-25 07:08:16 +01:00
Ruben Hensen f4b42757cd backup-testing: remove k3s's anonymous volumes too 2026-10-25 07:04:17 +01:00
Ruben Hensen f529bd99ee docs: triage PR 31 2026-10-25 07:02:07 +01:00
Ruben Hensen 74dec430b8 docs: the restore test is ready to run 2026-10-25 07:01:04 +01:00
Ruben Hensen 6fe0acc061 backup-testing: a restore test from a read-only copy of the bucket 2026-10-25 07:00:49 +01:00
Ruben Hensen bb34b601d9 docs: the system backups' snapshots hold 258 GiB 2026-10-25 04:35:58 +01:00