Ruben Hensen 53d74768ad gateway: take the visitor's address from a PROXY header ...

node001 passes TLS through without opening it, so every request from
the tunneled hosts arrives from 46.224.26.65. Wordfence locked that
address out after 20 failed logins on 2026-10-26, and with it everyone
who logs in to scoutingmbg.nl. With a PROXY header from node001, Envoy
puts the visitor's address in X-Forwarded-For instead.

The header is optional: s2 and ntfy2 point straight at home, and
node001's proxy on port 80 sends none either.

2026-10-26 23:11:38 +01:00

.github/workflows

Render and validate every app on PRs and pushes

2026-10-25 03:57:24 +01:00

actual-budget

Limit the other public apps to their own pods, DNS and the internet

2026-10-25 03:21:53 +01:00

apps

mbgwp: cap Apache at 12 workers so a crawler can't run it out of memory

2026-10-25 13:07:30 +01:00

argocd

Set resource requests from measured usage

2026-10-25 07:08:16 +01:00

authentik

Set resource requests from measured usage

2026-10-25 07:08:16 +01:00

backup-testing

backup-testing: take endpoint, region and bucket from Velero's location

2026-10-25 12:59:25 +01:00

bolletjestrui

Limit the other public apps to their own pods, DNS and the internet

2026-10-25 03:21:53 +01:00

ca-bundle

Remove ghost-blog and whishper

2026-10-22 10:11:06 +02:00

cert-manager

gateway: take over ports 80 and 443 from ingress-nginx

2026-10-23 21:02:52 +02:00

dns

Move every ExternalSecret and the ClusterSecretStore to external-secrets.io/v1

2026-10-22 21:41:28 +02:00

docs

docs: Renovate rejected the lookahead (#32)

2026-10-25 17:33:39 +01:00

freshrss

Raise two requests after the morning's numbers

2026-10-25 09:43:11 +01:00

gateway

gateway: take the visitor's address from a PROXY header

2026-10-26 23:11:38 +01:00

gatus

Merge pull request #31 from rubenhensen/renovate/python-3.x

2026-10-25 12:17:31 +01:00

gitea

Merge pull request #26 from rubenhensen/renovate/gitea-gitea-28.x

2026-10-25 12:25:03 +01:00

home-assistant

Replace the Ingresses with Certificate resources

2026-10-23 21:20:25 +02:00

immich

immich: the optimized ML models, cached on a volume

2026-10-25 17:46:03 +01:00

longhorn

Replace the Ingresses with Certificate resources

2026-10-23 21:20:25 +02:00

mariadb-operator

Set resource requests from measured usage

2026-10-25 07:08:16 +01:00

mbgwp

mbgwp: limit WordPress to its database, DNS and the internet

2026-10-25 03:09:06 +01:00

nas/garage

nas: Garage keeps its metadata in SQLite

2026-10-25 17:08:13 +01:00

nix-infra-machine

node001: tunnel scoutingmbg.nl and www to the home cluster

2026-10-25 02:59:00 +02:00

ntfy

chore(deps): update binwiederhier/ntfy docker tag to v2.34.0

2026-10-25 03:06:23 +00:00

serpbear

Set resource requests from measured usage

2026-10-25 07:08:16 +01:00

tools

Merge pull request #27 from rubenhensen/renovate/github.com-canonical-go-dqlite-v3-3.x

2026-10-25 12:24:30 +01:00

vault

Set resource requests from measured usage

2026-10-25 07:08:16 +01:00

velero

velero: skip PVCs in Longhorn's no-backup group

2026-10-25 17:46:03 +01:00

.envrc

Add direnv for kubeconfig

2026-03-18 09:04:40 +01:00

.gitignore

Remove commented-out files, the empty secrets app and a stale script copy

2026-10-25 03:27:32 +01:00

renovate.json

renovate: skip the non-app folders through ignorePaths, not a lookahead

2026-10-25 17:33:39 +01:00

S

Description

No description provided

2.4 MiB

0 Stars 1 Watchers 0 Forks

Languages

Nix 49.6%

Shell 46.7%

Python 2.9%

Go 0.8%