summaryrefslogtreecommitdiff
path: root/f3s/argocd-apps/services
AgeCommit message (Collapse)Author
6 daysAdd shuriken nightly CronJob (irregular.ninja + alt.irregular.ninja)Paul Buetow
ArgoCD-managed CronJob that regenerates the irregular.ninja and alt.irregular.ninja photo albums with the shuriken.sh Docker image, writing them to /data/nfs/k3svolumes/shuriken.sh/<site>/dist on the shared NFS export. Single image job by default (passively cooled N100 hosts). 04:00 Europe/Sofia daily, Forbid stacking, 6h deadline.
12 daysforgejo: add a standalone Forgejo install at code.f3s.buetow.orgPaul Buetow
Deliberately independent of the cgit git-server: separate namespace (services), separate NFS volumes, separate SSH NodePort (30222 vs 30022), and no shared storage. cgit keeps serving the existing 80 bare repos at c-git.f3s.buetow.org and is not touched. Forgejo starts empty; repos get migrated by hand later. ArgoCD deliberately keeps reading conf.git from the existing git-server, so Forgejo has no consumers and cannot take cluster deploys down with it. SQLite rather than a PostgreSQL pod: single writer (replicas 1 + Recreate) and NFSv4.2 does real byte-range locking, so the usual SQLite-on-NFS failure mode does not apply. Uses the -rootless image so the pod runs wholly as UID 1000 with all capabilities dropped, and both volumes carry the .nfs-sentinel guard. The installer is locked and registration disabled because the instance is reachable from the internet; the admin account is created via the CLI. code.f3s.buetow.org added to @f3s_hosts, which drives the DNS zone, the relayd route, the ACME cert and the gogios checks. Not yet activated: the ArgoCD Application still needs applying, the NFS directories creating, and the frontends deploying. See f3s/forgejo/README.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-18immich: Stage B — upgrade server + ML to v3.0.3Paul Buetow
Bump image.tag v2.7.5 -> v3.0.3 for both immich-server and immich-machine-learning. Stage A already migrated Postgres to VectorChord (vchord 0.4.3), which 3.x requires (pgvecto.rs dropped); the postgres bundle image preloads vchord.so + vectors.so per the 3.0.1 requirement. Pre-upgrade ZFS snapshot: zdata/enc/nfsdata@immich-pre-3x-20260718 (f0). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-30f3s: add ychat revival (Mode A) Helm chart + ArgoCD appPaul Buetow
In-memory guest chat, no DB. Deployment pulls registry.lan.buetow.org:30001/ychat:f387bac, port 2000, non-root (UID 1000), readOnlyRootFilesystem with emptyDir on /app/log. TCP-socket probes (ychat speaks HTTP/0.9-style responses). Ingress: ychat.f3s.buetow.org + ychat.f3s.lan.buetow.org.
2026-06-29immich: fix stale NFS bind-mount causing 500 on uploadPaul Buetow
After a CARP failover or f-host reboot the node host remounts NFS cleanly but already-running pods keep their old stale bind-mount, causing writes to return ESTALE (errno 116). Three changes to auto-heal: 1. immich-valkey: replace ping-only liveness with a write-probe (valkey-cli ping + echo to /data/.nfs-write-probe), so a stale /data mount fails the probe and kubelet restarts the container with a fresh bind-mount. 2. immich-server: add label nfs.stale-restart/enabled=true so the node-level nfs-mount-monitor can exec a write-probe into the pod and force-delete it if writes fail. Cannot do this via Helm values — the upstream chart hardcodes an httpGet liveness and its Sprig merge refills httpGet even when set to null, producing an invalid dual-handler probe rejected by the k8s API. 3. nfs-mount-monitor/check-nfs-mount.sh: add reap_stale_nfs_pods() function (throttled to every 30 s) that handles two cases invisible to the existing fix_mount probe — Case 1: pods stuck in CreateContainerConfigError with a stale subPath message (git-server, prometheus hit this); Case 2: opt-in Running+Ready pods whose in-container write to the NFS volume fails twice in a row (the immich-server pattern). Deployed to r0/r1/r2 via Rex. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-19protonbridge: add k8s helm chart and ArgoCD app manifestPaul Buetow
Deploys Proton Bridge (shenxn/protonmail-bridge) as a headless pod in the services namespace. Config persisted on NFS-backed PVC; nfs-sentinel initContainer guards against local-XFS shadow on NFS mount failure. Exposes IMAP (STARTTLS) on NodePort 30143 and SMTP (STARTTLS) on NodePort 30025 for LAN access. Initial ProtonMail authentication is done once via: kubectl exec -it <pod> -n services -- bridge --cli Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-24immich: update to v2.7.5Paul Buetow
2026-05-16Deploy xplayer and update player imagePaul Buetow
2026-05-15f3s: disable trivy-operator and tracing-demo (rename to .disabled)Paul Buetow
Both apps were causing high CPU pressure on r0 after a cold-start (Trivy respawning vulnerability scans, multiple replicas competing for image pulls). Disabled by renaming the ArgoCD Application manifests to .disabled so 'kubectl apply -f argocd-apps/' no longer picks them up, and the Applications themselves were deleted from the cluster (with prune=true the helm-managed resources were removed). Amp-Thread-ID: https://ampcode.com/threads/T-019e2be9-50a8-7089-b628-b6d844602c13 Co-authored-by: Amp <amp@ampcode.com>
2026-05-13f3s/beets-art: nightly k3s CronJob to fetch+embed cover art for NavidromePaul Buetow
Adds a beets-based CronJob that runs every night on r1 (where the Navidrome music PVC lives), fetching external cover.jpg into each album folder and embedding art into audio files. Idempotent on re-runs: - import.incremental skips already-known album folders - fetchart skips albums that already have cover art - embedart with ifempty:no + compare_threshold:50 only fills missing embeds and refuses risky overwrites Navidrome picks new art up via its existing 1h scan; no Navidrome change required. Reuses navidrome-music-pvc directly (RWO is fine because both pods pin to r1 via nodeSelector). State (library.db, logs) lives on a small local-path PVC, regenerable by deleting the PVC. Files: f3s/beets-art/helm-chart/{Chart.yaml,README.md,templates/*.yaml} f3s/beets-art/Justfile (status, logs, run-now, suspend, resume, shell) f3s/argocd-apps/services/beets-art.yaml Amp-Thread-ID: https://ampcode.com/threads/T-019e223a-d137-705e-879b-84130c0e78ea Co-authored-by: Amp <amp@ampcode.com>
2026-05-03Add player f3s deploymentPaul Buetow
2026-04-14Add goprecords service deployment for f3s.Paul Buetow
Introduce Docker build/push workflow, Helm manifests, and ArgoCD application wiring for goprecords so the cluster can deploy the new daemon API service from the private registry. Made-with: Cursor
2026-04-11pihole: docker-pi dnsmasq wildcard, README for pi2/pi3, ArgoCD parityPaul Buetow
Add dnsmasq.d wildcard for *.f3s.lan.buetow.org → 192.168.1.138 and example compose for Pis; refresh README (DNS on pi2/pi3, etc-dnsmasq.d). Align dormant ArgoCD Helm customDnsEntries with the same wildcard. Made-with: Cursor
2026-04-10add emaPaul Buetow
2026-04-08Deactivate Apache ArgoCD applicationPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d6da8-3a08-7079-bb2a-eb072c0bf17f Co-authored-by: Amp <amp@ampcode.com>
2026-04-06immich: fix chart value structure - image tag under server/ml controllers, ↵Paul Buetow
remove duplicate controllers.server Amp-Thread-ID: https://ampcode.com/threads/T-019d6154-8fdf-74fe-b865-f796d8a4214a Co-authored-by: Amp <amp@ampcode.com>
2026-04-06immich: fix ML config to use chart's machine-learning.controllers.main structurePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d6154-8fdf-74fe-b865-f796d8a4214a Co-authored-by: Amp <amp@ampcode.com>
2026-04-06immich: tune ML throughput - add postgres anti-affinity, increase intra-op ↵Paul Buetow
threads, increase worker timeout Amp-Thread-ID: https://ampcode.com/threads/T-019d6154-8fdf-74fe-b865-f796d8a4214a Co-authored-by: Amp <amp@ampcode.com>
2026-04-04fix(immich): use dual-style values for resources and affinity to ensure they ↵Paul Buetow
apply
2026-04-04fix(immich): use correctly nested controllers structure for affinity and 4Gi ↵Paul Buetow
resources
2026-04-04fix(immich): increase memory limits to 4Gi to avoid OOMKilled for MLPaul Buetow
2026-04-04feat(immich): add preferred anti-affinity and resources to balance loadPaul Buetow
2026-04-01immich: separate PVs for videos RO/RW to avoid dual-PVC mount issuePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d47a3-2deb-75c3-8a75-b0f39006a35d Co-authored-by: Amp <amp@ampcode.com>
2026-04-01immich: per-user external library mounts with RO/RW separationPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d47a3-2deb-75c3-8a75-b0f39006a35d Co-authored-by: Amp <amp@ampcode.com>
2026-04-01immich: use bjw-s persistence for external library mountPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d47a3-2deb-75c3-8a75-b0f39006a35d Co-authored-by: Amp <amp@ampcode.com>
2026-04-01immich: replace yoga videos with general external library mountPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d47a3-2deb-75c3-8a75-b0f39006a35d Co-authored-by: Amp <amp@ampcode.com>
2026-03-16Update hyperstack VM bootstrap, WireGuard, and Ollama setup logic; add ↵Paul Buetow
retries, apt lock waits, and model verification
2026-02-08joPaul Buetow
2026-02-08Upgrade immich to v2.5.5 latest stable releasePaul Buetow
Updated immich-server and immich-machine-learning images to v2.5.5. This release includes major features: - Free Up Space functionality - Non-destructive photo editing - Database backup and restore via web - Upload improvements and visual refresh - Progressive JPEGs support - Additional fine-grained API key permissions Release notes: https://github.com/immich-app/immich/releases/tag/v2.5.5
2026-02-08Add immich LAN ingress and remove unsupported helm configPaul Buetow
- Created custom ingress-lan.yaml for immich.f3s.lan.buetow.org with TLS - Removed unsupported 'lan' ingress config from ArgoCD app values - The Immich Helm chart doesn't support multiple named ingresses, so we create the LAN ingress as a custom resource instead This aligns immich with other services that have both regular and LAN ingress endpoints.
2026-02-07feat: add LAN ingresses for all servicesPaul Buetow
Add *.f3s.lan.buetow.org ingress resources for all services to enable LAN access with TLS termination. This allows direct access from the 192.168.1.0/24 network through the FreeBSD CARP/relayd setup. Services updated: - argocd: argocd.f3s.lan.buetow.org - cgit: cgit.f3s.lan.buetow.org - grafana: grafana.f3s.lan.buetow.org - anki-sync-server: anki.f3s.lan.buetow.org - apache: f3s.lan.buetow.org, www.f3s.lan.buetow.org, standby.f3s.lan.buetow.org - audiobookshelf: audiobookshelf.f3s.lan.buetow.org - filebrowser: filebrowser.f3s.lan.buetow.org - immich: immich.f3s.lan.buetow.org - ipv6test: ipv6test.f3s.lan.buetow.org (+ ipv4/ipv6 subdomains) - keybr: keybr.f3s.lan.buetow.org - koreader-sync-server: koreader.f3s.lan.buetow.org - miniflux: flux.f3s.lan.buetow.org - opodsync: gpodder.f3s.lan.buetow.org - radicale: radicale.f3s.lan.buetow.org - syncthing: syncthing.f3s.lan.buetow.org - tracing-demo: tracing-demo.f3s.lan.buetow.org - wallabag: bag.f3s.lan.buetow.org - webdav: webdav.f3s.lan.buetow.org All LAN ingresses use: - TLS with f3s-lan-tls certificate (cert-manager) - Traefik entrypoints: web,websecure - Same backend services as external ingresses Also fixed koreader-sync-server ingress to use modern annotations. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07feat(pihole): add LAN DNS access via externalIPPaul Buetow
Configure Pi-hole DNS service to bind to 192.168.1.120 for LAN access. This allows clients on the 192.168.1.0/24 network to use Pi-hole as their DNS server without needing to be on the Wireguard mesh. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(pihole): use correct helm parameter for existing secretPaul Buetow
The pihole helm chart uses 'admin.existingSecret' not 'adminPasswordSecret'. This ensures the deployment uses the pihole-admin-password secret instead of creating a default 'pihole-password' secret with 'admin' password. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(pihole): add Traefik middleware to redirect root to /admin/Paul Buetow
Pi-hole's web interface returns 403 Forbidden when accessed via the root path. Add a Traefik middleware that redirects requests to the root URL to /admin/ path where the web interface is accessible. Also add the pihole ArgoCD application manifest. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-06Restore jellyfin helm-chart and ArgoCD applicationPaul Buetow
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-04Add Navidrome music server deploymentPaul Buetow
Adds Navidrome music streaming server with: - Helm chart with deployment, service, ingress, and persistent volumes - Two PVs: data (10Gi) and music library (200Gi) - ArgoCD application for automated deployment - Ingress at navidrome.f3s.buetow.org - Justfile for operational commands
2026-01-31cleanupPaul Buetow
2026-01-31Add MinVid deploymentPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Revert "Remove jellyfin argocd application"Paul Buetow
This reverts commit 6fd8d4e3d3f7abf54a9ae433f0c47ce18a84a3c1.
2026-01-31Remove jellyfin argocd applicationPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c10cd-6a62-75c9-a556-f2ed9611f278 Co-authored-by: Amp <amp@ampcode.com>
2026-01-30Add jellyfin deploymentPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c10b2-ea57-752e-818e-33a56d69d9fa Co-authored-by: Amp <amp@ampcode.com>
2026-01-30Revert to dual source setup with pruning disabledPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1088-dc3e-701a-b064-5e50cf52b32a Co-authored-by: Amp <amp@ampcode.com>
2026-01-30Simplify Application to use only Helm chart sourcePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1088-dc3e-701a-b064-5e50cf52b32a Co-authored-by: Amp <amp@ampcode.com>
2026-01-30Fix Helm repository URL for immich-chartsPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1088-dc3e-701a-b064-5e50cf52b32a Co-authored-by: Amp <amp@ampcode.com>
2026-01-30Manage Immich Helm deployment via ArgoCDPaul Buetow
- Add Helm chart source to deploy immich-app/immich chart - Include yoga-videos PVC volume mount in server config - Persist configuration across redeployments - Keep custom resources deployment for PVs and PostgreSQL Amp-Thread-ID: https://ampcode.com/threads/T-019c1088-dc3e-701a-b064-5e50cf52b32a Co-authored-by: Amp <amp@ampcode.com>
2026-01-29Add ipv6test deployment for f3sPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c086d-c760-779d-b740-0f748094b62a Co-authored-by: Amp <amp@ampcode.com>
2026-01-27add apachePaul Buetow
2026-01-15fix: scope ignoreDifferences to only tracing-demo-frontend RolloutPaul Buetow
2026-01-15feat: add ignoreDifferences for Argo Rollouts to prevent ArgoCD conflictsPaul Buetow
2026-01-15feat: add Argo Rollouts controller and tracing-demo canary rollout demoPaul Buetow
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-07 09:10:32 +0000