Ruben Hensen
2a1394763d
docs: CNPG backups and the infra NetworkPolicies are in
2026-10-26 23:59:47 +01:00
Ruben Hensen
86bbf25145
Merge pull request #56 from rubenhensen/cnpg-barman
...
CNPG: back the databases up to Garage with the barman cloud plugin
2026-10-26 23:43:39 +01:00
Ruben Hensen
92d5147994
Merge pull request #55 from rubenhensen/roadmap-decisions
...
docs: the roadmap after tonight
2026-10-26 23:43:20 +01:00
Ruben Hensen
9e88a92ff7
Merge pull request #53 from rubenhensen/netpol-infra
...
NetworkPolicies for the infrastructure namespaces
2026-10-26 23:42:21 +01:00
Ruben Hensen
7b12ee2028
cnpg: back the databases up to Garage with the barman cloud plugin
2026-10-26 23:38:13 +01:00
Ruben Hensen
039b956764
Merge pull request #54 from rubenhensen/netpol-envoy
...
NetworkPolicy for envoy-gateway-system
2026-10-26 23:31:28 +01:00
Ruben Hensen
d187f55e57
docs: tonight's decisions on the roadmap
2026-10-26 23:29:23 +01:00
Ruben Hensen
66207de2dd
Merge pull request #52 from rubenhensen/renovate-automerge
...
Renovate: automerge patch updates of low-risk apps
2026-10-26 23:28:09 +01:00
Ruben Hensen
a8ccbef274
envoy-gateway-system: NetworkPolicy
2026-10-26 23:28:05 +01:00
Ruben Hensen
d0ce5ddbec
Merge pull request #51 from rubenhensen/netpol-acme
...
NetworkPolicies: let Envoy reach cert-manager's HTTP-01 solver
2026-10-26 23:27:48 +01:00
Ruben Hensen
c384ae921f
default: deny all, through a folder app of its own
2026-10-26 23:26:47 +01:00
Ruben Hensen
13b92fff54
dns: NetworkPolicy
2026-10-26 23:26:38 +01:00
Ruben Hensen
3834f7a354
mariadb-system: NetworkPolicy
2026-10-26 23:26:25 +01:00
Ruben Hensen
8110a235a9
velero: NetworkPolicy
2026-10-26 23:26:15 +01:00
Ruben Hensen
fa33bf44ae
external-secrets: NetworkPolicy, through a folder app of its own
2026-10-26 23:26:06 +01:00
Ruben Hensen
d4e99d28c7
cnpg-system: NetworkPolicy, through a folder app of its own
2026-10-26 23:25:55 +01:00
Ruben Hensen
c8a81e805d
cert-manager: NetworkPolicy
2026-10-26 23:25:28 +01:00
Ruben Hensen
3fd585de5f
docs: immich ML v2 is done ( #39 )
2026-10-26 23:25:11 +01:00
Ruben Hensen
6c727346f6
renovate: patch updates of low-risk apps merge themselves
2026-10-26 23:23:25 +01:00
Ruben Hensen
ed828b426f
networkpolicy: let Envoy reach cert-manager's HTTP-01 solver
2026-10-26 23:19:28 +01:00
Ruben Hensen
0dc69d34f0
Merge pull request #50 from rubenhensen/proxy-protocol
...
Pass the visitor's address from node001 to the home cluster
2026-10-26 23:12:14 +01:00
Ruben Hensen
30540ea579
node001: send the visitor's address to the home cluster
...
The stream server on 443 now starts each connection with a PROXY header.
nginx sends it to every upstream or none, so Stalwart (8443) and the
local nginx for Gatus and ntfy (8444) get theirs through a hop on
8445/8446 that takes it off again; nothing changes for them.
Deploy after the Gateway accepts the header, or the tunneled hosts stop
answering until it does.
2026-10-26 23:11:38 +01:00
Ruben Hensen
53d74768ad
gateway: take the visitor's address from a PROXY header
...
node001 passes TLS through without opening it, so every request from
the tunneled hosts arrives from 46.224.26.65. Wordfence locked that
address out after 20 failed logins on 2026-10-26, and with it everyone
who logs in to scoutingmbg.nl. With a PROXY header from node001, Envoy
puts the visitor's address in X-Forwarded-For instead.
The header is optional: s2 and ntfy2 point straight at home, and
node001's proxy on port 80 sends none either.
2026-10-26 23:11:38 +01:00
Ruben Hensen
b6462fb3a9
Merge pull request #49 from rubenhensen/roadmap-garage
...
docs: Velero on Garage
2026-10-26 23:04:15 +01:00
Ruben Hensen
bed68c70a8
velero: the switch to Garage was on 10-26
2026-10-26 22:57:35 +01:00
Ruben Hensen
3991a8d726
docs: Velero on Garage, and the off-site copy from the bucket
2026-10-26 22:57:35 +01:00
Ruben Hensen
648f99c505
Merge pull request #35 from rubenhensen/velero-garage
...
Velero backs up to Garage instead of MinIO
2026-10-26 22:52:42 +01:00
Ruben Hensen
20bd3a4bca
Merge pull request #39 from rubenhensen/immich-ml-v2
...
immich: the optimized ML models, cached on a volume
2026-10-25 17:48:40 +01:00
Ruben Hensen
6cba1a9363
immich: the optimized ML models, cached on a volume
2026-10-25 17:46:03 +01:00
Ruben Hensen
acfce6645e
velero: skip PVCs in Longhorn's no-backup group
2026-10-25 17:46:03 +01:00
Ruben Hensen
0de86dd65c
Merge pull request #36 from rubenhensen/renovate-re2
...
Renovate: skip the non-app folders without a lookahead
2026-10-25 17:41:32 +01:00
Ruben Hensen
d7ffdc05f6
docs: Renovate rejected the lookahead ( #32 )
2026-10-25 17:33:39 +01:00
Ruben Hensen
c0f8034e14
renovate: skip the non-app folders through ignorePaths, not a lookahead
2026-10-25 17:33:39 +01:00
Ruben Hensen
a15a4f7c75
Merge pull request #34 from rubenhensen/velero-garage-secret
...
Garage on the NAS, and Velero's key for it
2026-10-25 17:23:33 +01:00
Ruben Hensen
bdafcaf1e0
backup-testing: read Velero's key for Garage
2026-10-25 17:10:32 +01:00
Ruben Hensen
03c3196242
velero: back up to Garage instead of MinIO
2026-10-25 17:10:32 +01:00
Ruben Hensen
b072099cc1
nas: Garage keeps its metadata in SQLite
2026-10-25 17:08:13 +01:00
Ruben Hensen
e10ca337f1
velero: a key for Garage, from Vault
2026-10-25 16:28:43 +01:00
Ruben Hensen
c72b08867f
nas: Garage, which takes over from MinIO
2026-10-25 16:28:43 +01:00
Ruben Hensen
d85362ce3b
docs: the restore test passed against the real backups
2026-10-25 14:57:18 +01:00
Ruben Hensen
018f528fb3
docs: a WordPress cache without plugins
2026-10-25 14:56:10 +01:00
Ruben Hensen
714712b862
docs: WordPress is capped at 12 workers
2026-10-25 13:11:20 +01:00
Ruben Hensen
7dc13466cb
mbgwp: cap Apache at 12 workers so a crawler can't run it out of memory
2026-10-25 13:07:30 +01:00
Ruben Hensen
9b77596bcb
backup-testing: take endpoint, region and bucket from Velero's location
2026-10-25 12:59:25 +01:00
Ruben Hensen
fbf2cb2d92
docs: the unseal key is kept safe
2026-10-25 12:57:18 +01:00
Ruben Hensen
122873ca5c
docs: hensen.io can expire
2026-10-25 12:54:32 +01:00
Ruben Hensen
71449dd185
docs: record the external-secrets upgrade
2026-10-25 12:54:01 +01:00
Ruben Hensen
297d2dffa5
Merge pull request #17 from rubenhensen/renovate/external-secrets-2.x
...
chore(deps): update helm chart external-secrets to v2.14.0
2026-10-25 12:50:28 +01:00
Ruben Hensen
46117ee658
chore(deps): update helm chart external-secrets to v2.14.0
2026-10-25 12:49:06 +01:00
Ruben Hensen
2a5bbc7f44
docs: the scoutingmbg.nl DNS questions are answered
...
Only the four records moved to node001, hensen.io is no longer needed, and SPF's a mechanism doesn't matter since all mail goes through Google.
2026-10-25 12:39:57 +01:00
Ruben Hensen