summaryrefslogtreecommitdiff
path: root/f3s/argocd-apps
AgeCommit message (Collapse)Author
2026-04-08Deactivate Apache ArgoCD applicationPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d6da8-3a08-7079-bb2a-eb072c0bf17f Co-authored-by: Amp <amp@ampcode.com>
2026-04-08feat(f3s): deploy Trivy Operator for image CVE scanning (task h)Paul Buetow
- ArgoCD app: aquasecurity/trivy-operator in monitoring with ServiceMonitor - PrometheusRule for Critical/High trivy_image_vulnerabilities alerts - Alertmanager route/receiver for component=trivy (UI; webhook TBD) Made-with: Cursor
2026-04-06immich: fix chart value structure - image tag under server/ml controllers, ↵Paul Buetow
remove duplicate controllers.server Amp-Thread-ID: https://ampcode.com/threads/T-019d6154-8fdf-74fe-b865-f796d8a4214a Co-authored-by: Amp <amp@ampcode.com>
2026-04-06immich: fix ML config to use chart's machine-learning.controllers.main structurePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d6154-8fdf-74fe-b865-f796d8a4214a Co-authored-by: Amp <amp@ampcode.com>
2026-04-06immich: tune ML throughput - add postgres anti-affinity, increase intra-op ↵Paul Buetow
threads, increase worker timeout Amp-Thread-ID: https://ampcode.com/threads/T-019d6154-8fdf-74fe-b865-f796d8a4214a Co-authored-by: Amp <amp@ampcode.com>
2026-04-04fix(immich): use dual-style values for resources and affinity to ensure they ↵Paul Buetow
apply
2026-04-04fix(immich): use correctly nested controllers structure for affinity and 4Gi ↵Paul Buetow
resources
2026-04-04fix(immich): increase memory limits to 4Gi to avoid OOMKilled for MLPaul Buetow
2026-04-04feat(immich): add preferred anti-affinity and resources to balance loadPaul Buetow
2026-04-01immich: separate PVs for videos RO/RW to avoid dual-PVC mount issuePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d47a3-2deb-75c3-8a75-b0f39006a35d Co-authored-by: Amp <amp@ampcode.com>
2026-04-01immich: per-user external library mounts with RO/RW separationPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d47a3-2deb-75c3-8a75-b0f39006a35d Co-authored-by: Amp <amp@ampcode.com>
2026-04-01immich: use bjw-s persistence for external library mountPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d47a3-2deb-75c3-8a75-b0f39006a35d Co-authored-by: Amp <amp@ampcode.com>
2026-04-01immich: replace yoga videos with general external library mountPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d47a3-2deb-75c3-8a75-b0f39006a35d Co-authored-by: Amp <amp@ampcode.com>
2026-03-28pkgrepo: add FreeBSD/OpenBSD package repository servicePaul Buetow
Serve custom-built FreeBSD and OpenBSD packages via nginx in the k3s cluster. Includes helm chart, ArgoCD app, test artifact build script, and DNS entry via frontends Rexfile. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-16Update hyperstack VM bootstrap, WireGuard, and Ollama setup logic; add ↵Paul Buetow
retries, apt lock waits, and model verification
2026-02-08joPaul Buetow
2026-02-08Upgrade immich to v2.5.5 latest stable releasePaul Buetow
Updated immich-server and immich-machine-learning images to v2.5.5. This release includes major features: - Free Up Space functionality - Non-destructive photo editing - Database backup and restore via web - Upload improvements and visual refresh - Progressive JPEGs support - Additional fine-grained API key permissions Release notes: https://github.com/immich-app/immich/releases/tag/v2.5.5
2026-02-08Add immich LAN ingress and remove unsupported helm configPaul Buetow
- Created custom ingress-lan.yaml for immich.f3s.lan.buetow.org with TLS - Removed unsupported 'lan' ingress config from ArgoCD app values - The Immich Helm chart doesn't support multiple named ingresses, so we create the LAN ingress as a custom resource instead This aligns immich with other services that have both regular and LAN ingress endpoints.
2026-02-07feat: add LAN ingresses for all servicesPaul Buetow
Add *.f3s.lan.buetow.org ingress resources for all services to enable LAN access with TLS termination. This allows direct access from the 192.168.1.0/24 network through the FreeBSD CARP/relayd setup. Services updated: - argocd: argocd.f3s.lan.buetow.org - cgit: cgit.f3s.lan.buetow.org - grafana: grafana.f3s.lan.buetow.org - anki-sync-server: anki.f3s.lan.buetow.org - apache: f3s.lan.buetow.org, www.f3s.lan.buetow.org, standby.f3s.lan.buetow.org - audiobookshelf: audiobookshelf.f3s.lan.buetow.org - filebrowser: filebrowser.f3s.lan.buetow.org - immich: immich.f3s.lan.buetow.org - ipv6test: ipv6test.f3s.lan.buetow.org (+ ipv4/ipv6 subdomains) - keybr: keybr.f3s.lan.buetow.org - koreader-sync-server: koreader.f3s.lan.buetow.org - miniflux: flux.f3s.lan.buetow.org - opodsync: gpodder.f3s.lan.buetow.org - radicale: radicale.f3s.lan.buetow.org - syncthing: syncthing.f3s.lan.buetow.org - tracing-demo: tracing-demo.f3s.lan.buetow.org - wallabag: bag.f3s.lan.buetow.org - webdav: webdav.f3s.lan.buetow.org All LAN ingresses use: - TLS with f3s-lan-tls certificate (cert-manager) - Traefik entrypoints: web,websecure - Same backend services as external ingresses Also fixed koreader-sync-server ingress to use modern annotations. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07feat(pihole): add LAN DNS access via externalIPPaul Buetow
Configure Pi-hole DNS service to bind to 192.168.1.120 for LAN access. This allows clients on the 192.168.1.0/24 network to use Pi-hole as their DNS server without needing to be on the Wireguard mesh. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(pihole): use correct helm parameter for existing secretPaul Buetow
The pihole helm chart uses 'admin.existingSecret' not 'adminPasswordSecret'. This ensures the deployment uses the pihole-admin-password secret instead of creating a default 'pihole-password' secret with 'admin' password. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(pihole): add Traefik middleware to redirect root to /admin/Paul Buetow
Pi-hole's web interface returns 403 Forbidden when accessed via the root path. Add a Traefik middleware that redirects requests to the root URL to /admin/ path where the web interface is accessible. Also add the pihole ArgoCD application manifest. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-06Restore jellyfin helm-chart and ArgoCD applicationPaul Buetow
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-05Add LAN access via CARP and relaydPaul Buetow
- Add cert-manager for self-signed TLS certificates - Create wildcard cert for *.f3s.lan.buetow.org - Add LAN ingress to Navidrome (navidrome.f3s.lan.buetow.org) - Document FreeBSD relayd configuration for LAN access - Add comprehensive setup guide LAN access uses existing CARP VIP (192.168.1.138) on f0/f1 with relayd forwarding HTTP/HTTPS to k3s Traefik NodePorts. External access via OpenBSD relayd continues unchanged.
2026-02-04Add Navidrome music server deploymentPaul Buetow
Adds Navidrome music streaming server with: - Helm chart with deployment, service, ingress, and persistent volumes - Two PVs: data (10Gi) and music library (200Gi) - ArgoCD application for automated deployment - Ingress at navidrome.f3s.buetow.org - Justfile for operational commands
2026-01-31cleanupPaul Buetow
2026-01-31Add MinVid deploymentPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Revert "Remove jellyfin argocd application"Paul Buetow
This reverts commit 6fd8d4e3d3f7abf54a9ae433f0c47ce18a84a3c1.
2026-01-31Remove jellyfin argocd applicationPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c10cd-6a62-75c9-a556-f2ed9611f278 Co-authored-by: Amp <amp@ampcode.com>
2026-01-30Add jellyfin deploymentPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c10b2-ea57-752e-818e-33a56d69d9fa Co-authored-by: Amp <amp@ampcode.com>
2026-01-30Revert to dual source setup with pruning disabledPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1088-dc3e-701a-b064-5e50cf52b32a Co-authored-by: Amp <amp@ampcode.com>
2026-01-30Simplify Application to use only Helm chart sourcePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1088-dc3e-701a-b064-5e50cf52b32a Co-authored-by: Amp <amp@ampcode.com>
2026-01-30Fix Helm repository URL for immich-chartsPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1088-dc3e-701a-b064-5e50cf52b32a Co-authored-by: Amp <amp@ampcode.com>
2026-01-30Manage Immich Helm deployment via ArgoCDPaul Buetow
- Add Helm chart source to deploy immich-app/immich chart - Include yoga-videos PVC volume mount in server config - Persist configuration across redeployments - Keep custom resources deployment for PVs and PostgreSQL Amp-Thread-ID: https://ampcode.com/threads/T-019c1088-dc3e-701a-b064-5e50cf52b32a Co-authored-by: Amp <amp@ampcode.com>
2026-01-29Add traefik-config for X-Forwarded-For header trustPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c086d-c760-779d-b740-0f748094b62a Co-authored-by: Amp <amp@ampcode.com>
2026-01-29Add ipv6test deployment for f3sPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c086d-c760-779d-b740-0f748094b62a Co-authored-by: Amp <amp@ampcode.com>
2026-01-27add apachePaul Buetow
2026-01-15fix: scope ignoreDifferences to only tracing-demo-frontend RolloutPaul Buetow
2026-01-15feat: add ignoreDifferences for Argo Rollouts to prevent ArgoCD conflictsPaul Buetow
2026-01-15feat: add Argo Rollouts controller and tracing-demo canary rollout demoPaul Buetow
2026-01-10Migrate all ArgoCD applications from SSH to HTTP git URLsPaul Buetow
Changes all application manifests to use HTTP git backend instead of SSH: - From: ssh://git@git-server.cicd.svc.cluster.local/repos/repos/conf.git - To: http://git-server.cicd.svc.cluster.local/conf.git Benefits: - No SSH agent or key management required - No issues with changing SSH host keys on pod restarts - Simpler ArgoCD configuration - HTTP git-http-backend now fully functional Updated applications: - monitoring: prometheus, grafana-ingress, pushgateway (3) - services: anki-sync-server, audiobookshelf, filebrowser, immich, keybr, kobo-sync-server, miniflux, opodsync, radicale, syncthing, tracing-demo, wallabag, webdav (13) - infra: registry (1) - test: example-apache-volume-claim (1) Total: 18 applications migrated to HTTP
2026-01-09Migrate all applications from Codeberg to self-hosted gitPaul Buetow
Updated 17 application manifests to use internal git-server: - Monitoring: grafana-ingress, prometheus, pushgateway - Services: anki-sync-server, audiobookshelf, filebrowser, immich, keybr, kobo-sync-server, miniflux, opodsync, radicale, syncthing, tracing-demo, wallabag, webdav - Infra: registry All applications now fetch from: ssh://git@git-server.cicd.svc.cluster.local/repos/repos/conf.git Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Migrate example-apache-volume-claim to self-hosted gitPaul Buetow
Test migration of first application from Codeberg to internal git-server. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add self-hosted git server with SSH and cgit web UIPaul Buetow
Deploy a self-hosted git repository solution to replace external Codeberg dependency. Components: - SSH git server: Alpine-based container with OpenSSH and git - cgit web UI: Browse repositories at cgit.f3s.buetow.org - Single pod design: git-server + cgit containers sharing storage Infrastructure: - Docker image in git-server/docker-image/ with Justfile build automation - Helm chart in git-server/helm-chart/ for Kubernetes deployment - 5Gi ReadWriteMany PVC for NFS-backed repository storage - ClusterIP service for ArgoCD internal access - NodePort 30022 for external SSH push access - Traefik ingress for cgit web UI ArgoCD Application manifest deployed to cicd namespace. Note: SSH keys must be created as Kubernetes secrets manually, not in git. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-08Enable prune for prometheus ArgoCD app, update READMEPaul Buetow
2026-01-08prunePaul Buetow
2026-01-08Fix: disable kubeScheduler rules entirelyPaul Buetow
2026-01-08Disable KubeProxyDown and KubeSchedulerDown alerts for k3sPaul Buetow
2026-01-08Disable kube-proxy and kube-scheduler monitoring for k3sPaul Buetow
K3s embeds kube-proxy and kube-scheduler functionality into the main k3s server process, unlike standard Kubernetes where they run as separate components. This change disables monitoring for these components to prevent false-positive critical alerts: - KubeProxyDown - KubeSchedulerDown These alerts were firing because kube-prometheus-stack expects standard Kubernetes architecture with separate kube-proxy and kube-scheduler pods/processes. Cluster info: - Running k3s v1.32.6+k3s1 - 3 control-plane nodes (r0, r1, r2) - Components embedded in k3s binary Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-08Configure Alertmanager routing for ArgoCD application alertsPaul Buetow
Added Alertmanager configuration to: - Route ArgoCD application alerts to dedicated 'argocd-alerts' receiver - Group ArgoCD alerts by alertname, name (app name), and severity - Faster alert grouping for ArgoCD (10s wait vs 30s default) - Repeat ArgoCD alerts every 6 hours - Suppress Watchdog test alerts - Configure inhibit rules to prevent alert spam Alerts are visible in: - Prometheus UI: http://localhost:9090/alerts - Alertmanager UI: http://localhost:9093 - Grafana dashboard: ArgoCD Applications - Health & Sync Status This ensures critical application issues are properly routed and visible in the monitoring UI for immediate action. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-10 20:45:58 +0000