summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-20protonbridge: switch to --noninteractive daemon mode for clean k8s exec loginPaul Buetow
The faketty pipe approach from the shenxn image caused CrashLoopBackOff: writing to the FIFO via echo sends EOF which terminates cat and bridge. Instead: override entrypoint to run bridge --noninteractive directly (the bridge binary at /usr/lib/protonmail/bridge/bridge). Bridge v3 embeds a gRPC server; the separate 'bridge --cli' exec connects to it as a client. Login flow: kubectl exec -it <pod> -- /usr/lib/protonmail/bridge/bridge --cli socat port forwarding (25→1025, 143→1143) preserved in the entrypoint. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-19protonbridge: use init container for GPG+pass setup; fix TTY+home issuesPaul Buetow
Root causes of prior CrashLoopBackOff: 1. %no-passphrase unsupported; %no-protection needed instead 2. GPG agent couldn't use pinentry without a TTY 3. Container runs as root (HOME=/root) so mounting at /home/protonmail was wrong Fix: dedicated setup-pass init container (shares image, has gpg+pass) that configures allow-loopback-pinentry in gpg-agent.conf + gpg.conf, then generates a passphrase-free key and inits the pass store. All state is written to /bridge-data (PVC mount), with GNUPGHOME and PASSWORD_STORE_DIR env vars so the main container finds the store. Main container no longer overrides the default entrypoint. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-19protonbridge: fix startup — init GPG+pass on first run, mount full homePaul Buetow
Bridge v3 requires 'pass' as keychain store. The startup script now initializes a passphrase-free GPG key and pass store on first run (all persisted on the NFS PVC so restarts reconnect without re-login). Mounts the full /home/protonmail instead of just .config to cover .gnupg and .password-store. First-time ProtonMail login via bridge --cli still required; see deployment comment for instructions. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-19protonbridge: add k8s helm chart and ArgoCD app manifestPaul Buetow
Deploys Proton Bridge (shenxn/protonmail-bridge) as a headless pod in the services namespace. Config persisted on NFS-backed PVC; nfs-sentinel initContainer guards against local-XFS shadow on NFS mount failure. Exposes IMAP (STARTTLS) on NodePort 30143 and SMTP (STARTTLS) on NodePort 30025 for LAN access. Initial ProtonMail authentication is done once via: kubectl exec -it <pod> -n services -- bridge --cli Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-08Add rocky WireGuard IP to hosts append and Rexfile wg0_ipsPaul Buetow
2026-06-08Add f3 (192.168.2.133) to Prometheus node_exporter scrape targetsPaul Buetow
f3 was previously excluded from FreeBSD host monitoring. Now that node_exporter is installed and running there, include it in the node-exporter job so CPU temperature and other host metrics are collected alongside f0/f1/f2. Also update the temperature alert comment to reflect that f3 is now covered.
2026-06-07goprecords: bump image to 0.5.2Paul Buetow
2026-06-07git-server: keep ArgoCD app source on codeberg (revert internal repo change)Paul Buetow
2026-06-07git-server: switch ArgoCD app to pull from internal git-serverPaul Buetow
2026-06-07git-server: rename cgit ingress from cgit.f3s.buetow.org to c-git.f3s.buetow.orgPaul Buetow
2026-06-07changePaul Buetow
2026-05-30f3s: add robust USB key mountingPaul Buetow
2026-05-25example-apache-volume-claim: add NFS sentinel initContainer checkPaul Buetow
Adds the standard nfs-check initContainer to verify the sentinel file exists before the main Apache container starts. Prevents silent fall-back to local XFS when NFS is unmounted on the node.
2026-05-25Add NFS sentinel initContainers to wallabag chart for 86Paul Buetow
2026-05-25Add NFS sentinel initContainers to xplayer chart for 76Paul Buetow
2026-05-25Add NFS sentinel initContainers to filebrowser chart for r5Paul Buetow
2026-05-25Add NFS sentinel initContainer to goprecords chart for t5Paul Buetow
2026-05-25Replace old wait-for-nfs with standard sentinel initContainer in ↵Paul Buetow
immich-postgres for u5
2026-05-25Add NFS sentinel initContainers to audiobookshelf chart for q5Paul Buetow
2026-05-25Add NFS sentinel initContainer to opodsync chart for 06Paul Buetow
2026-05-25Add NFS sentinel initContainer to navidrome chart for z5Paul Buetow
2026-05-25Add NFS sentinel initContainer to miniflux-postgres chart for y5Paul Buetow
2026-05-25Add NFS sentinel initContainer to kobo-sync-server chart for x5Paul Buetow
2026-05-25Add NFS sentinel initContainers to jellyfin chart for v5Paul Buetow
2026-05-25Add NFS sentinel initContainer to pkgrepo chart for 16Paul Buetow
2026-05-25Add NFS sentinel initContainer to registry chart for 46Paul Buetow
2026-05-25Add NFS sentinel initContainers to syncthing chart for 56Paul Buetow
2026-05-25Add NFS sentinel initContainers to radicale chart for 36Paul Buetow
2026-05-25Add NFS sentinel check to anki chart for o5Paul Buetow
2026-05-25Add keybr NFS sentinel initContainer for w5Paul Buetow
2026-05-25Add apache NFS sentinel initContainer for p5Paul Buetow
2026-05-25Add player NFS sentinel initContainers for task 26Paul Buetow
2026-05-25Add NFS sentinel initContainer for git-server s5Paul Buetow
2026-05-25Document NFS sentinel initContainer pattern for n5Paul Buetow
2026-05-24immich: update to v2.7.5Paul Buetow
2026-05-16f3s/monitoring: disable grafana, loki, tempo; reduce alloy to no-opPaul Buetow
Grafana's SQLite-on-NFS persistence is unreliable across restarts (the new pod can't reacquire a clean exclusive lock after any NFS bounce), and with Loki + Tempo also gone there's nothing left for it to visualize. Keeping Prometheus alone for metrics + alerting. Changes: - prometheus.yaml: add grafana.enabled=false in the kube-prometheus-stack values so the subchart no longer renders the grafana deployment/pvc. - loki.yaml, tempo.yaml, grafana-ingress.yaml: renamed to .disabled (same pattern as commit 03a18c6) so 'kubectl apply -f argocd-apps/' stops re-creating them; the cluster Applications were also deleted, which cascade-removes the helm resources via the resources-finalizer. - alloy.yaml: drop the loki.write and otelcol.* blocks (no destinations to ship to). DaemonSet stays deployed with a minimal 'logging' block so the chart can be re-enabled by restoring the blocks here. Prometheus TSDB was also wiped (corrupted zero-byte WAL segments from the same NFS blip that took grafana down) — done separately, not part of this commit.
2026-05-16Update player image tagsPaul Buetow
2026-05-16Update player image tagsPaul Buetow
2026-05-16Give player deployments longer startup windowPaul Buetow
2026-05-16Deploy xplayer and update player imagePaul Buetow
2026-05-16f3s/prometheus: add trivy unresolved-alerts report generatorPaul Buetow
Adds gen-trivy-unresolved-alerts.py which queries Prometheus (/api/v1/rules + /api/v1/alerts) via kubectl exec and produces TRIVY-UNRESOLVED-ALERTS.md. The generated *-ALERTS.md snapshots are gitignored — they're regenerable point-in-time inventories.
2026-05-16f3s/registry: add coredns-custom ConfigMap for in-cluster registry DNSPaul Buetow
Trivy scan jobs do their own DNS lookups for image names and need registry.lan.buetow.org to resolve from inside the cluster. Adds a coredns-custom server block pointing the hostname at r0's WireGuard IP (which matches the k3s registries.yaml mirror target).
2026-05-16frontends + packages: add dserver/dtail support for FreeBSD and RockyPaul Buetow
Adds FreeBSD .tpl variants of the existing dserver templates and a matching pkg-dtail-freebsd.sh packaging script, plus a pkg-dtail-rpm.sh script and packages/files/dtail-rocky/ (systemd units, key-cache script, dtail.json) for the Rocky Linux dtail build.
2026-05-16nfs-mount-monitor: switch to soft NFS mount + handle stale lockfilePaul Buetow
A hard NFS mount that fails enters uninterruptible kernel sleep (D-state) which SIGKILL cannot wake, so the recovery script hangs forever and the lockfile stays — silently disabling all subsequent health checks. Switch the remount to explicit soft,timeo=50,retrans=3 so the kernel gives up after ~15s, and detect/remove lockfiles older than 90s left behind by a SIGKILL'd predecessor.
2026-05-16f3s: set strategy Recreate on single-replica stateful deploymentsPaul Buetow
Prevents NFS-lock races during rolling updates. The hostPath PVs point at an NFS-shared directory mounted on every r-node, so RWO is not actually enforced across nodes — under the default RollingUpdate strategy the new pod can start on a different node and grab the same data dir while the old pod still holds file locks, producing errors like postgres' "could not write to file postmaster.pid: Unknown error 512". Applied to: immich-postgres, audiobookshelf, anki-sync-server, registry, pkgrepo, player, wallabag, miniflux-postgres, opodsync, radicale, kobo-sync-server, keybr, filebrowser, git-server, goprecords, jellyfin. (syncthing and navidrome already had it.) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-15f3s: disable trivy-operator and tracing-demo (rename to .disabled)Paul Buetow
Both apps were causing high CPU pressure on r0 after a cold-start (Trivy respawning vulnerability scans, multiple replicas competing for image pulls). Disabled by renaming the ArgoCD Application manifests to .disabled so 'kubectl apply -f argocd-apps/' no longer picks them up, and the Applications themselves were deleted from the cluster (with prune=true the helm-managed resources were removed). Amp-Thread-ID: https://ampcode.com/threads/T-019e2be9-50a8-7089-b628-b6d844602c13 Co-authored-by: Amp <amp@ampcode.com>
2026-05-13f3s/beets-art: schedule at noon Europe/Sofia instead of 03:30 UTCPaul Buetow
Use the CronJob timeZone field (GA since k8s 1.27, supported by the k3s 1.32 cluster) so cron interprets the schedule in local time directly, avoiding manual UTC conversion. Amp-Thread-ID: https://ampcode.com/threads/T-019e223a-d137-705e-879b-84130c0e78ea Co-authored-by: Amp <amp@ampcode.com>
2026-05-13f3s/beets-art: fix fetchart silently disabled by string-not-list configPaul Buetow
beets 2.x parses `sources: coverart itunes amazon albumart` as a single key whose value is "*", rejects it with UnknownPairError, and the entire fetchart plugin fails to load. Net effect: every job ran "successfully" but fetched zero cover art (verified: 0/195 albums had artpath set; all existing cover.jpg files predated the deployment). Convert sources and cover_names to proper YAML lists so the plugin loads. Confirmed network egress is fine (CAA + iTunes return HTTP 200). Amp-Thread-ID: https://ampcode.com/threads/T-019e223a-d137-705e-879b-84130c0e78ea Co-authored-by: Amp <amp@ampcode.com>
2026-05-13f3s/beets-art: pipe yes into embedart to bypass interactive promptPaul Buetow
beet embedart (no -f) hard-codes a "Modify artwork for N albums (Y/n)?" confirmation with no flag to suppress it. The CronJob has no stdin, so the command exits with "stdin stream ended while input required" and embedart never runs. Pipe `yes` into the command; safety still relies on embedart.ifempty:no and embedart.compare_threshold:50 from config. Amp-Thread-ID: https://ampcode.com/threads/T-019e223a-d137-705e-879b-84130c0e78ea Co-authored-by: Amp <amp@ampcode.com>
2026-05-13f3s/beets-art: fix BEETSDIR being read-only (state.pickle write failure)Paul Buetow
The ConfigMap mount at /etc/beets is kernel-enforced read-only, so beets could not write its incremental import state file (state.pickle), which broke incremental: yes — every nightly run would re-walk the entire library. Fix: point BEETSDIR at the writable state PVC (/state) and pass -c /etc/beets/config.yaml on every beet invocation so the ConfigMap is still the single source of truth for config. Also fix the Justfile run-now recipe to use a bash shebang so $() works. Amp-Thread-ID: https://ampcode.com/threads/T-019e223a-d137-705e-879b-84130c0e78ea Co-authored-by: Amp <amp@ampcode.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-08 12:29:41 +0000