summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-01-122 replicasPaul Buetow
2026-01-11Mark all WireGuard roaming client tasks as completePaul Buetow
2026-01-11Add WireGuard roaming client support and OpenBSD NAT configurationPaul Buetow
- Add pf.conf template with WireGuard NAT rules for roaming clients (earth, pixel7pro) - Add Rex task to deploy pf.conf to both OpenBSD frontends (blowfish, fishfinger) - Document WireGuard roaming client implementation plan and limitations - NAT rules enable roaming clients to route all traffic through VPN gateways - Firewall rules allow incoming WireGuard connections on UDP port 56709 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-11monitor all wg hostsPaul Buetow
2026-01-11feat(miniflux): add liveness and readiness probesPaul Buetow
2026-01-10Document self-hosted git-server requirement in ArgoCD READMEPaul Buetow
Add comprehensive documentation about the self-hosted git-server setup: - Explain that conf.git must be pushed to r0 before ArgoCD can use it - Provide gitsyncer and manual push examples - Document HTTP access method used by ArgoCD - Include verification commands - Emphasize that changes must be pushed to git-server (r0), not just external git hosts This ensures operators understand the critical step of syncing the conf repository to the self-hosted git-server. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-10add changePaul Buetow
2026-01-10Simplify git-server path from /repos/repos to /reposPaul Buetow
Changes: - Mount PVC with subPath: repos in deployment - Update cgit scan-path from /repos/repos to /repos - Update git-http-backend GIT_PROJECT_ROOT to /repos - Update all documentation to reflect simplified paths This eliminates the redundant /repos/repos duplication and simplifies all git URLs to ssh://git@r0:30022/repos/<repo>.git format. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-10Update git-server README to use explicit NodePort in gitsyncer configPaul Buetow
Replace git@git-server:/repos/repos with ssh://git@r0:30022/repos/repos in the documentation to match the actual configuration and make the NodePort usage explicit. SSH alias approach now documented as optional. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-10Merge remote-tracking branch 'r0/master'Paul Buetow
2026-01-10Add comprehensive README for git-server helm chartPaul Buetow
Includes: - Component overview (SSH, HTTP, cgit) - Access methods (SSH, HTTP, web UI) - Gitsyncer integration guide - ArgoCD integration - Security configuration - Troubleshooting guide - Maintenance procedures
2026-01-10Remove test filePaul Buetow
2026-01-10Test: gitsyncer SSH pushPaul Buetow
2026-01-10Add git.f3s.buetow.org to f3s hosts listPaul Buetow
Adding DNS/frontend configuration for the new git server
2026-01-10Add nginx timeouts for git-http-backend to fix large clone issuesPaul Buetow
ArgoCD was experiencing 'early EOF' errors during git fetch operations. Added fastcgi timeout settings to prevent connection closures: - fastcgi_read_timeout: 300s (5 minutes) - fastcgi_send_timeout: 300s (5 minutes) - fastcgi_buffering: off (stream responses immediately) This fixes: curl 18 transfer closed with outstanding read data remaining
2026-01-10Migrate all ArgoCD applications from SSH to HTTP git URLsPaul Buetow
Changes all application manifests to use HTTP git backend instead of SSH: - From: ssh://git@git-server.cicd.svc.cluster.local/repos/repos/conf.git - To: http://git-server.cicd.svc.cluster.local/conf.git Benefits: - No SSH agent or key management required - No issues with changing SSH host keys on pod restarts - Simpler ArgoCD configuration - HTTP git-http-backend now fully functional Updated applications: - monitoring: prometheus, grafana-ingress, pushgateway (3) - services: anki-sync-server, audiobookshelf, filebrowser, immich, keybr, kobo-sync-server, miniflux, opodsync, radicale, syncthing, tracing-demo, wallabag, webdav (13) - infra: registry (1) - test: example-apache-volume-claim (1) Total: 18 applications migrated to HTTP
2026-01-10Update git-server SSH host keys (current as of pod restart)Paul Buetow
Note: These keys change on pod restarts. HTTP git backend is now available and recommended for ArgoCD to avoid SSH key changes.
2026-01-10Set HOME=/tmp for cgit container to allow git config writesPaul Buetow
Non-root container cannot write to /.gitconfig, setting HOME=/tmp allows git to write config files
2026-01-10Add git safe.directory config for NFS repository ownershipPaul Buetow
Fixes 'dubious ownership' error when git-http-backend runs as UID 33 accessing repository owned by UID 1001:33
2026-01-10Fix: Install git-daemon instead of git for git-http-backendPaul Buetow
git-http-backend is in the git-daemon package in Alpine, not the base git package
2026-01-10Add initContainer to install git-http-backendPaul Buetow
- New initContainer installs git and copies git-http-backend to shared /tmp volume - Updated nginx config to use /tmp/git-http-backend - Removed apk add from cgit container (was failing due to non-root user)
2026-01-10Install git-daemon package for git-http-backend supportPaul Buetow
2026-01-10Enable HTTP git operations in repository configPaul Buetow
- Make /repos mount read-write on cgit container - Set http.receivepack=true and http.uploadpack=true in git config - Allows git clone/fetch/push via HTTP - Fixes 403 Forbidden error from git-http-backend
2026-01-10Fix nginx: copy fastcgi_params to /tmp and reference itPaul Buetow
- Copy /etc/nginx/fastcgi_params to /tmp/fastcgi_params - Update include path to /tmp/fastcgi_params - Fixes 'No such file or directory' error
2026-01-10Fix git-http-backend: insert location into existing server blockPaul Buetow
- Use sed to insert git-http-backend location into default.conf - Location must be inside server block, not separate file - Fixes nginx config syntax error
2026-01-10Fix: remove apk install, use git already in alpine-cgit imagePaul Buetow
2026-01-10Add git-http-backend for HTTP git operationsPaul Buetow
- Install git package in cgit container - Add nginx config for git-http-backend via fcgiwrap - Supports git clone/fetch/pull over HTTP at /conf.git/ path - cgit remains for web UI at /conf/ path - Eliminates need for SSH and SSH agent sidecar
2026-01-10Remove custom SSH agent sidecar - use ArgoCD native SSH supportPaul Buetow
- Removed SSH agent sidecar container - Removed custom SSH_AUTH_SOCK and SSH key volumes - ArgoCD will use native SSH support with: - Repository credential secret (git-server-repo-creds) - Known hosts ConfigMap (argocd-ssh-known-hosts-cm) - Much simpler and follows ArgoCD best practices
2026-01-10Add persistent ArgoCD configs for git-serverPaul Buetow
- git-server-repo-creds.yaml: Repository credential secret for SSH auth - git-server-known-hosts.yaml: SSH known_hosts for git-server - Ensures configs survive cluster restarts
2026-01-10Make ssh-agent socket world-readable (chmod 666)Paul Buetow
- Fixes permission denied error when repo-server accesses socket - Ensures changes survive cluster restart
2026-01-10Fix ssh-agent user creation - check if UID 999 exists firstPaul Buetow
- Check if UID 999 exists before creating user - Look up username for UID 999 dynamically - Fixes 'unknown user argocd' error
2026-01-10Fix ssh-agent sidecar: install openssh as root, run agent as user 999Paul Buetow
- Install openssh as root (has apk permissions) - Create argocd user (999) if needed - Use su to run ssh-agent as argocd user - Fixes 'permission denied' and 'ssh-agent not found' errors
2026-01-10Run SSH agent sidecar as argocd user (999)Paul Buetow
- Fixes permission denied error when repo-server tries to access socket - Both containers now run as same user for shared socket access
2026-01-10Add SSH agent sidecar to ArgoCD repo-serverPaul Buetow
- Create ssh-agent sidecar container to provide SSH_AUTH_SOCK - Share socket via emptyDir volume at /tmp/ssh-agent - Add SSH key from argocd-git-ssh-key secret to agent - Fixes 'SSH agent requested but SSH_AUTH_SOCK not-specified' errors
2026-01-10Use ArgoCD native repository credentials instead of manual SSH key mountPaul Buetow
- Remove custom SSH key volume and volumeMount - Remove SSH_AUTH_SOCK and GIT_SSH_COMMAND env vars - Let ArgoCD use repository credential secret (git-server-repo-creds)
2026-01-10Set SSH_AUTH_SOCK to /dev/null instead of empty stringPaul Buetow
2026-01-10Fix ArgoCD SSH agent errorPaul Buetow
- Set SSH_AUTH_SOCK to empty string to disable SSH agent - Add IdentitiesOnly=yes to GIT_SSH_COMMAND to use only the specified key - Fixes 'SSH agent requested but SSH_AUTH_SOCK not-specified' errors
2026-01-10add changePaul Buetow
2026-01-10Fix git-server non-root deploymentPaul Buetow
- Generate SSH host keys in initContainer with correct ownership - Remove deprecated UsePrivilegeSeparation from sshd_config - Fix NFS repository permissions (UID 1001, GID 33) - Configure git shared repository mode
2026-01-09remove testPaul Buetow
2026-01-09Remove SETUID/SETGID capabilities from cgit containerPaul Buetow
cgit doesn't need privilege escalation capabilities when running as UID 33 with writable /tmp for runtime files. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Final test: verify complete workflowPaul Buetow
2026-01-09Fix cgit nginx config - update correct socket path in default.confPaul Buetow
The fcgiwrap socket path is configured in /etc/nginx/conf.d/default.conf, not cgit.conf. Copy conf.d directory to /tmp and update socket path there. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add git safe.directory config to entrypoint for NFS compatibilityPaul Buetow
Configures git to trust all directories on startup, preventing 'dubious ownership' errors when accessing NFS-mounted repositories with different UIDs. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix cgit container permissions - use writable /tmp for runtime filesPaul Buetow
- Mount emptyDir volume at /tmp for cgit runtime files - Copy nginx.conf to /tmp and modify there (read-only /etc) - Move nginx PID file to /tmp/nginx.pid - Move fcgiwrap socket to /tmp/fcgiwrap.sock - Update cgit.conf to use new socket location Allows cgit to run as non-root (UID 33) without write access to /etc or /var. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Merge branch 'master' of ssh://r0:30022/repos/repos/confPaul Buetow
2026-01-09Use proper security contexts for NFS access without chownPaul Buetow
Changes: - Set fsGroup: 33 at pod level for proper NFS group access - Updated git user to UID 1001, GID 33 (www-data) to match NFS ownership - Run git-server container as UID 1001:33 (non-root) - Run cgit container as UID 33:33 (non-root) - Disabled SSH privilege separation (UsePrivilegeSeparation no) - Removed unnecessary capabilities (SETGID, SETUID, SYS_CHROOT) This follows the same pattern as filebrowser and webdav services, using security contexts instead of chown operations on NFS. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Test: verify push access worksPaul Buetow
2026-01-09Merge: resolve conflict, keep virtual-root and correct scan-pathPaul Buetow
2026-01-09Fix cgit URL generation by setting virtual-rootPaul Buetow
Added virtual-root=/ to cgitrc to prevent duplicate path segments in generated URLs. This fixes the "Invalid request" error when clicking links in the cgit web interface. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-10 20:51:10 +0000