docs: immich ML v2 is done (#39)

actual-budget/networkpolicy.yaml

@@ -55,29 +55,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

authentik/networkpolicy.yaml

@@ -135,29 +135,3 @@ spec:
             cidr: 192.168.1.204/32
       ports:
         - port: 16443
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

bolletjestrui/networkpolicy.yaml

@@ -54,29 +54,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

docs/roadmap.md

@@ -38,7 +38,8 @@ docs/longhorn-second-ssd.md:
   2026-10-25). The snap is held, so microk8s gets no updates at all until
   someone refreshes it
 - [ ] Second SSD, docs/longhorn-second-ssd.md
-- [ ] Optional: `MACHINE_LEARNING_MODEL_REVISION=v2` for immich ML
+- [x] `MACHINE_LEARNING_MODEL_REVISION=v2` for immich ML (PR #39, 2026-10-25;
+  the models are cached on a volume)
 
 ## Next, in order
 

freshrss/networkpolicy.yaml

@@ -56,29 +56,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

gateway/proxy-protocol.yaml

@@ -1,23 +0,0 @@
-# node001 passes TLS for the tunneled hosts through without opening it, so
-# without this every request arrives from 46.224.26.65. Wordfence locks that
-# address out after 20 failed logins (2026-10-26), and with it everyone who
-# logs in to scoutingmbg.nl. node001 puts a PROXY header with the visitor's
-# address in front of each connection; Envoy takes the address from there
-# and adds it to X-Forwarded-For.
-#
-# Optional, because s2 and ntfy2 point straight at home and their clients
-# send no header, and neither does node001's proxy on port 80. The price:
-# whoever connects to the home address directly can send a header of their
-# own and claim any address.
-apiVersion: gateway.envoyproxy.io/v1alpha1
-kind: ClientTrafficPolicy
-metadata:
-  name: proxy-protocol
-  namespace: envoy-gateway-system
-spec:
-  targetRefs:
-  - group: gateway.networking.k8s.io
-    kind: Gateway
-    name: homelab
-  proxyProtocol:
-    optional: true

gatus/networkpolicy.yaml

@@ -83,29 +83,3 @@ spec:
             cidr: 192.168.1.204/32
       ports:
         - port: 16443
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

gitea/networkpolicy.yaml

@@ -55,29 +55,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

immich/networkpolicy.yaml

@@ -100,29 +100,3 @@ spec:
             cidr: 192.168.1.204/32
       ports:
         - port: 16443
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

mbgwp/networkpolicy.yaml

@@ -85,29 +85,3 @@ spec:
               kubernetes.io/metadata.name: mariadb-system
       ports:
         - port: 3306
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

nix-infra-machine/nodes/node001.nix

@@ -173,18 +173,12 @@ in
     #   - mail.rubenhensen.nl (and anything else) → local stalwart on 8443
     #   - tunneled hosts → home cluster ingress on 443
     #   - s1 / ntfy1.rubenhensen.nl → local nginx on 8444 (Gatus, ntfy)
-    #
-    # Each connection starts with a PROXY header that carries the visitor's
-    # address, so the home cluster sees who is asking instead of this box
-    # (gateway/proxy-protocol.yaml in k8scd). nginx sends the header to
-    # every upstream or none, so the local ones go through a hop on
-    # 8445/8446 that takes it off again.
     streamConfig = ''
       map $ssl_preread_server_name $tunnel_upstream {
 ${sniMapEntries}
-        s1.rubenhensen.nl 127.0.0.1:8446;
-        ntfy1.rubenhensen.nl 127.0.0.1:8446;
-        default 127.0.0.1:8445;
+        s1.rubenhensen.nl 127.0.0.1:8444;
+        ntfy1.rubenhensen.nl 127.0.0.1:8444;
+        default 127.0.0.1:8443;
       }
 
       server {
@@ -192,17 +186,6 @@ ${sniMapEntries}
         listen [::]:443;
         proxy_pass $tunnel_upstream;
         ssl_preread on;
-        proxy_protocol on;
-      }
-
-      server {
-        listen 127.0.0.1:8445 proxy_protocol;
-        proxy_pass 127.0.0.1:8443;
-      }
-
-      server {
-        listen 127.0.0.1:8446 proxy_protocol;
-        proxy_pass 127.0.0.1:8444;
       }
     '';
 

ntfy/networkpolicy.yaml

@@ -65,29 +65,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

serpbear/networkpolicy.yaml

@@ -54,29 +54,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

vault/networkpolicy.yaml

@@ -66,29 +66,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089