Ruben Hensen
aaae182844
Home IP is now 62.41.86.53
...
After the ISP cut the connection, it came back on a new address. node001
still tunneled everything to 62.41.86.27, so every host behind it timed
out. Moves the tunnel, the ldap, s2 and ntfy2 records and the Gatus DNS
plan to the new address.
2026-11-03 22:09:55 +01:00
Ruben Hensen
0589bb3e08
Merge pull request #61 from rubenhensen/immich-pg14-cleanup
...
immich: remove the PostgreSQL 14 cluster
2026-10-28 15:44:45 +01:00
Ruben Hensen
c298ad8746
immich: remove the PostgreSQL 14 cluster
2026-10-28 15:40:14 +01:00
Ruben Hensen
fe105a4fa7
Merge pull request #60 from rubenhensen/mariadb-11.4
...
MariaDB: newest 11.4 patch, and keep Renovate on 11.4
2026-10-28 15:36:16 +01:00
Ruben Hensen
1afd4b6bbd
mariadb: newest 11.4 patch, and keep Renovate on 11.4
2026-10-28 15:31:40 +01:00
Ruben Hensen
b4663216db
Merge pull request #59 from rubenhensen/immich-share-people
...
immich: share the group account's people with everyone
2026-10-28 15:17:06 +01:00
Ruben Hensen
955c22c665
Merge pull request #58 from rubenhensen/memory-limits
...
Memory limits from a day of measurements
2026-10-28 15:16:55 +01:00
Ruben Hensen
f7396b3cb7
immich: share the group account's people with everyone
2026-10-28 15:10:06 +01:00
Ruben Hensen
1f894996e6
docs: memory limits on the roadmap
2026-10-28 14:58:03 +01:00
Ruben Hensen
c380bfc0cf
Memory limits from a day of measurements
2026-10-28 14:57:34 +01:00
Ruben Hensen
c3597ef0a6
Merge pull request #45 from rubenhensen/renovate/mariadb-operator-26.x
...
chore(deps): update helm chart mariadb-operator to v26
2026-10-27 10:43:09 +01:00
Ruben Hensen
baa8c70b55
Merge pull request #46 from rubenhensen/renovate/mariadb-operator-crds-26.x
...
chore(deps): update helm chart mariadb-operator-crds to v26
2026-10-27 10:38:31 +01:00
Ruben Hensen
1efa6c2b93
Merge pull request #40 from rubenhensen/renovate/ghcr.io-cloudnative-pg-postgresql-17.x
...
chore(deps): update ghcr.io/cloudnative-pg/postgresql docker tag to v17.11
2026-10-27 09:51:44 +01:00
Ruben Hensen
15a92294a6
Merge pull request #41 from rubenhensen/renovate/actualbudget-1.x
...
chore(deps): update helm chart actualbudget to v1.9.5
2026-10-27 09:31:49 +01:00
Ruben Hensen
144b9dda2b
Merge pull request #48 from rubenhensen/renovate/docker.io-envoyproxy-gateway-helm-1.x
...
chore(deps): update docker.io/envoyproxy/gateway-helm docker tag to v1.9.3
2026-10-27 09:31:28 +01:00
Ruben Hensen
920e54b43c
Merge pull request #44 from rubenhensen/renovate/ubuntu-26.x
...
chore(deps): update dependency ubuntu to v26
2026-10-27 09:31:03 +01:00
Ruben Hensen
665147a691
Merge pull request #43 from rubenhensen/renovate/python-3.x
...
chore(deps): update python docker tag to v3.15
2026-10-27 09:30:50 +01:00
renovate[bot]
1ba1d5f1a0
chore(deps): update ghcr.io/cloudnative-pg/postgresql docker tag to v17.11
2026-10-27 08:30:49 +00:00
Ruben Hensen
285a64f980
Merge pull request #38 from rubenhensen/renovate/alpine-git-2.x
...
chore(deps): update alpine/git docker tag to v2.54.0
2026-10-27 09:30:32 +01:00
Ruben Hensen
6cf41b0f14
Merge pull request #37 from rubenhensen/renovate/freshrss-freshrss-1.x
...
chore(deps): update freshrss/freshrss docker tag to v1.30.4
2026-10-27 09:30:16 +01:00
renovate[bot]
5678adfa82
chore(deps): update freshrss/freshrss docker tag to v1.30.4
2026-10-26 23:02:19 +00:00
Ruben Hensen
2e2d367f63
Merge pull request #57 from rubenhensen/roadmap-cnpg
...
docs: CNPG backups and the infra NetworkPolicies are in
2026-10-27 00:00:51 +01:00
Ruben Hensen
2a1394763d
docs: CNPG backups and the infra NetworkPolicies are in
2026-10-26 23:59:47 +01:00
Ruben Hensen
86bbf25145
Merge pull request #56 from rubenhensen/cnpg-barman
...
CNPG: back the databases up to Garage with the barman cloud plugin
2026-10-26 23:43:39 +01:00
Ruben Hensen
92d5147994
Merge pull request #55 from rubenhensen/roadmap-decisions
...
docs: the roadmap after tonight
2026-10-26 23:43:20 +01:00
Ruben Hensen
9e88a92ff7
Merge pull request #53 from rubenhensen/netpol-infra
...
NetworkPolicies for the infrastructure namespaces
2026-10-26 23:42:21 +01:00
Ruben Hensen
7b12ee2028
cnpg: back the databases up to Garage with the barman cloud plugin
2026-10-26 23:38:13 +01:00
Ruben Hensen
039b956764
Merge pull request #54 from rubenhensen/netpol-envoy
...
NetworkPolicy for envoy-gateway-system
2026-10-26 23:31:28 +01:00
Ruben Hensen
d187f55e57
docs: tonight's decisions on the roadmap
2026-10-26 23:29:23 +01:00
renovate[bot]
a36fc6f348
chore(deps): update python docker tag to v3.15
2026-10-26 22:28:58 +00:00
Ruben Hensen
66207de2dd
Merge pull request #52 from rubenhensen/renovate-automerge
...
Renovate: automerge patch updates of low-risk apps
2026-10-26 23:28:09 +01:00
Ruben Hensen
a8ccbef274
envoy-gateway-system: NetworkPolicy
2026-10-26 23:28:05 +01:00
Ruben Hensen
d0ce5ddbec
Merge pull request #51 from rubenhensen/netpol-acme
...
NetworkPolicies: let Envoy reach cert-manager's HTTP-01 solver
2026-10-26 23:27:48 +01:00
Ruben Hensen
c384ae921f
default: deny all, through a folder app of its own
2026-10-26 23:26:47 +01:00
Ruben Hensen
13b92fff54
dns: NetworkPolicy
2026-10-26 23:26:38 +01:00
Ruben Hensen
3834f7a354
mariadb-system: NetworkPolicy
2026-10-26 23:26:25 +01:00
Ruben Hensen
8110a235a9
velero: NetworkPolicy
2026-10-26 23:26:15 +01:00
Ruben Hensen
fa33bf44ae
external-secrets: NetworkPolicy, through a folder app of its own
2026-10-26 23:26:06 +01:00
Ruben Hensen
d4e99d28c7
cnpg-system: NetworkPolicy, through a folder app of its own
2026-10-26 23:25:55 +01:00
Ruben Hensen
c8a81e805d
cert-manager: NetworkPolicy
2026-10-26 23:25:28 +01:00
Ruben Hensen
3fd585de5f
docs: immich ML v2 is done ( #39 )
2026-10-26 23:25:11 +01:00
Ruben Hensen
6c727346f6
renovate: patch updates of low-risk apps merge themselves
2026-10-26 23:23:25 +01:00
Ruben Hensen
ed828b426f
networkpolicy: let Envoy reach cert-manager's HTTP-01 solver
2026-10-26 23:19:28 +01:00
Ruben Hensen
0dc69d34f0
Merge pull request #50 from rubenhensen/proxy-protocol
...
Pass the visitor's address from node001 to the home cluster
2026-10-26 23:12:14 +01:00
Ruben Hensen
30540ea579
node001: send the visitor's address to the home cluster
...
The stream server on 443 now starts each connection with a PROXY header.
nginx sends it to every upstream or none, so Stalwart (8443) and the
local nginx for Gatus and ntfy (8444) get theirs through a hop on
8445/8446 that takes it off again; nothing changes for them.
Deploy after the Gateway accepts the header, or the tunneled hosts stop
answering until it does.
2026-10-26 23:11:38 +01:00
Ruben Hensen
53d74768ad
gateway: take the visitor's address from a PROXY header
...
node001 passes TLS through without opening it, so every request from
the tunneled hosts arrives from 46.224.26.65. Wordfence locked that
address out after 20 failed logins on 2026-10-26, and with it everyone
who logs in to scoutingmbg.nl. With a PROXY header from node001, Envoy
puts the visitor's address in X-Forwarded-For instead.
The header is optional: s2 and ntfy2 point straight at home, and
node001's proxy on port 80 sends none either.
2026-10-26 23:11:38 +01:00
Ruben Hensen
b6462fb3a9
Merge pull request #49 from rubenhensen/roadmap-garage
...
docs: Velero on Garage
2026-10-26 23:04:15 +01:00
Ruben Hensen
bed68c70a8
velero: the switch to Garage was on 10-26
2026-10-26 22:57:35 +01:00
Ruben Hensen
3991a8d726
docs: Velero on Garage, and the off-site copy from the bucket
2026-10-26 22:57:35 +01:00
renovate[bot]
f6186d5a11
chore(deps): update helm chart mariadb-operator-crds to v26
2026-10-26 21:54:29 +00:00
Ruben Hensen