mbgwp: run mariadb-upgrade when MariaDB starts on 11.8

11.4 to 11.8 is a major MariaDB upgrade. MARIADB_AUTO_UPGRADE has the
image's entrypoint migrate the datadir on start, as operator 26.10.1's
updateStrategy.mariadbAutoUpgradeEnabled would; set as env because CI's
schema for MariaDB doesn't know that field yet.

backup-testing/restore-test.sh

@@ -3,7 +3,7 @@
 # k3s in Docker, to prove the backups can be restored. Nothing on the NAS
 # changes:
 # - one backup (backups/<name>/) and the kopia repositories of the chosen
-#   namespaces (kopia/<namespace>/) are copied read-only from MinIO with
+#   namespaces (kopia/<namespace>/) are copied read-only from the NAS with
 #   rclone into a Docker volume. A second Velero on the real bucket could
 #   run kopia maintenance on the same repositories as the cluster's own
 # - `rclone serve s3` serves that copy to a Velero 1.18.2 in k3s, with a
@@ -19,7 +19,7 @@
 # Defaults: the newest Completed daily-backup, and ntfy freshrss
 # actual-budget. Not gatus: a restored Gatus would start sending alerts.
 #
-# It reads Velero's MinIO key from the cluster (velero/cloud-credentials)
+# It reads Velero's S3 key from the cluster (velero/velero-s3-credentials)
 # into a temporary directory, and the copied backup holds every Secret of
 # the cluster; all of it is deleted at the end. KEEP=1 keeps the test
 # cluster (kubeconfig in the printed directory) until you run it with
@@ -71,14 +71,14 @@ wait_for() {
   done
 }
 
-# Endpoint, region and bucket as Velero itself uses them. MinIO answers a
-# request signed for the wrong region (rclone defaults to us-east-1) with a
-# bare 400 on HEAD.
+# Endpoint, region and bucket as Velero itself uses them. The NAS rejects a
+# request signed for the wrong region (rclone defaults to us-east-1); MinIO
+# did so with a bare 400 on HEAD.
 if [[ -n ${FROM_VOLUME:-} ]]; then
   BUCKET=${BUCKET:-velero-backups}
 else
   bsl=$(pk -n velero get backupstoragelocations default -o json)
-  MINIO=${MINIO:-$(jq -r '.spec.config.s3Url' <<<"$bsl")}
+  S3URL=${S3URL:-$(jq -r '.spec.config.s3Url' <<<"$bsl")}
   REGION=${REGION:-$(jq -r '.spec.config.region // "us-east-1"' <<<"$bsl")}
   BUCKET=${BUCKET:-$(jq -r '.spec.objectStorage.bucket' <<<"$bsl")}
 fi
@@ -101,10 +101,10 @@ if [[ -n ${FROM_VOLUME:-} ]]; then
   docker run --rm -v "$FROM_VOLUME:/from:ro" -v "$VOL:/data" alpine:3.22 cp -a /from/. /data/
 else
 echo "== copy from the NAS (read-only)"
-(umask 077; pk -n velero get secret cloud-credentials -o jsonpath='{.data.cloud}' | base64 -d |
+(umask 077; pk -n velero get secret velero-s3-credentials -o jsonpath='{.data.cloud}' | base64 -d |
   awk -F' *= *' '/aws_access_key_id/ {print "RCLONE_CONFIG_NAS_ACCESS_KEY_ID="$2}
                  /aws_secret_access_key/ {print "RCLONE_CONFIG_NAS_SECRET_ACCESS_KEY="$2}' > "$WORK/nas.env"
-  printf 'RCLONE_CONFIG_NAS_TYPE=s3\nRCLONE_CONFIG_NAS_PROVIDER=Minio\nRCLONE_CONFIG_NAS_ENDPOINT=%s\nRCLONE_CONFIG_NAS_REGION=%s\n' "$MINIO" "$REGION" >> "$WORK/nas.env")
+  printf 'RCLONE_CONFIG_NAS_TYPE=s3\nRCLONE_CONFIG_NAS_PROVIDER=Other\nRCLONE_CONFIG_NAS_ENDPOINT=%s\nRCLONE_CONFIG_NAS_REGION=%s\n' "$S3URL" "$REGION" >> "$WORK/nas.env")
 copy() { docker run --rm --env-file "$WORK/nas.env" -v "$VOL:/data" "$RCLONE" copy --stats-one-line "nas:$BUCKET/$1" "/data/$BUCKET/$1"; }
 copy "backups/$backup"
 for ns in "${namespaces[@]}"; do copy "kopia/$ns"; done

gateway/proxy-protocol.yaml

@@ -1,23 +0,0 @@
-# node001 passes TLS for the tunneled hosts through without opening it, so
-# without this every request arrives from 46.224.26.65. Wordfence locks that
-# address out after 20 failed logins (2026-10-26), and with it everyone who
-# logs in to scoutingmbg.nl. node001 puts a PROXY header with the visitor's
-# address in front of each connection; Envoy takes the address from there
-# and adds it to X-Forwarded-For.
-#
-# Optional, because s2 and ntfy2 point straight at home and their clients
-# send no header, and neither does node001's proxy on port 80. The price:
-# whoever connects to the home address directly can send a header of their
-# own and claim any address.
-apiVersion: gateway.envoyproxy.io/v1alpha1
-kind: ClientTrafficPolicy
-metadata:
-  name: proxy-protocol
-  namespace: envoy-gateway-system
-spec:
-  targetRefs:
-  - group: gateway.networking.k8s.io
-    kind: Gateway
-    name: homelab
-  proxyProtocol:
-    optional: true

mbgwp/mariadb-cluster.yaml

@@ -8,8 +8,17 @@ spec:
     name: mbgwp-mariadb-credentials
     key: root-password
 
-  image: mariadb:11.4.5
+  image: mariadb:11.8.9
   imagePullPolicy: IfNotPresent
+  # Every X.Y is a major MariaDB release (11.4 to 11.8 too) and needs
+  # mariadb-upgrade on the datadir, or queries on mysql.proc fail. With this
+  # the image's entrypoint runs it on start; a no-op when there is nothing
+  # to migrate, so it stays. Operator 26.10.1 sets the same variable through
+  # updateStrategy.mariadbAutoUpgradeEnabled, but CI's MariaDB schema (datree
+  # catalog) doesn't know that field yet.
+  env:
+    - name: MARIADB_AUTO_UPGRADE
+      value: "true"
 
   port: 3306
 

nix-infra-machine/nodes/node001.nix

@@ -173,18 +173,12 @@ in
     #   - mail.rubenhensen.nl (and anything else) → local stalwart on 8443
     #   - tunneled hosts → home cluster ingress on 443
     #   - s1 / ntfy1.rubenhensen.nl → local nginx on 8444 (Gatus, ntfy)
-    #
-    # Each connection starts with a PROXY header that carries the visitor's
-    # address, so the home cluster sees who is asking instead of this box
-    # (gateway/proxy-protocol.yaml in k8scd). nginx sends the header to
-    # every upstream or none, so the local ones go through a hop on
-    # 8445/8446 that takes it off again.
     streamConfig = ''
       map $ssl_preread_server_name $tunnel_upstream {
 ${sniMapEntries}
-        s1.rubenhensen.nl 127.0.0.1:8446;
-        ntfy1.rubenhensen.nl 127.0.0.1:8446;
-        default 127.0.0.1:8445;
+        s1.rubenhensen.nl 127.0.0.1:8444;
+        ntfy1.rubenhensen.nl 127.0.0.1:8444;
+        default 127.0.0.1:8443;
       }
 
       server {
@@ -192,17 +186,6 @@ ${sniMapEntries}
         listen [::]:443;
         proxy_pass $tunnel_upstream;
         ssl_preread on;
-        proxy_protocol on;
-      }
-
-      server {
-        listen 127.0.0.1:8445 proxy_protocol;
-        proxy_pass 127.0.0.1:8443;
-      }
-
-      server {
-        listen 127.0.0.1:8446 proxy_protocol;
-        proxy_pass 127.0.0.1:8444;
       }
     '';
 

velero/nas-svc.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: nas-minio-external
-spec:
-  type: ExternalName
-  externalName: 192.168.1.99
-  ports:
-    - port: 9000
-      protocol: TCP

velero/velero-helm.yaml

@@ -27,20 +27,22 @@ spec:
               - mountPath: /target
                 name: plugins
         configuration:
+          # Garage on the NAS (nas/garage). Until 2026-10-25 this was MinIO on
+          # the same NAS; the bucket was copied over with rclone, so the
+          # existing backups and kopia repositories carried on.
           backupStorageLocation:
             - name: default
               bucket: velero-backups
               provider: aws
               config:
-                region: minio
+                region: garage
                 s3ForcePathStyle: true
-                s3Url: http://192.168.1.99:9000
-                insecureSkipTLSVerify: "true"
+                s3Url: http://192.168.1.99:3900
           volumeSnapshotLocation:
             - name: default
               provider: aws
               config:
-                region: minio
+                region: garage
           features: EnableCSI
           # Kopia maintenance ran every hour for each of the 15 repositories,
           # and once a day as a full run of several minutes that writes its
@@ -59,11 +61,8 @@ spec:
                   memoryRequest: 256Mi
                   memoryLimit: 2Gi
         credentials:
-          # Use existing secret created by External Secrets Operator
-          # existingSecret: velero-minio-credentials
-          # extraEnvVars:
-          # AWS_SHARED_CREDENTIALS_FILE: /credentials/cloud
-          existingSecret: cloud-credentials
+          # From Vault, velero/external-secret.yaml
+          existingSecret: velero-s3-credentials
         deployNodeAgent: true
         nodeAgent:
           containerSecurityContext: