conf - Configuration files for the automation of my personal infrastructure (servers, laptops, workstations, phones)!

Age	Commit message (Collapse)	Author
2026-06-20	k8s: add NFS-aware liveness probes to all NFS-backed deployments	Paul Buetow
	All hostPath PVs are backed by NFS (127.0.0.1:/k3svolumes via stunnel). Existing NFS sentinel init containers only protect against pod startup when NFS is unmounted. If NFS goes stale mid-flight (e.g. after an NFS server restart during FreeBSD upgrades), running pods hold stale file descriptors and serve errors indefinitely without being restarted. Fix: add livenessProbe to every NFS-backed container: - Non-postgres services: test -f /mount-path/.nfs-sentinel (ESTALE fails this) - Postgres (immich, miniflux): pg_isready AND test -f on pg_filenode.map so the probe exercises both the TCP listener and the NFS data directory - webdav: also adds missing nfs-check-data init container (was the only service without sentinel protection at startup) - git-server (two containers): test -d /repos (sentinel is in PVC root, not the repos subPath, so directory existence check is used instead) All probes: initialDelaySeconds 30 (60 for jellyfin/postgres), periodSeconds 30, failureThreshold 3 — triggers restart after ~90 s of NFS unavailability. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-25	Add NFS sentinel initContainers to filebrowser chart for r5	Paul Buetow

2026-05-16	f3s: set strategy Recreate on single-replica stateful deployments	Paul Buetow
	Prevents NFS-lock races during rolling updates. The hostPath PVs point at an NFS-shared directory mounted on every r-node, so RWO is not actually enforced across nodes — under the default RollingUpdate strategy the new pod can start on a different node and grab the same data dir while the old pod still holds file locks, producing errors like postgres' "could not write to file postmaster.pid: Unknown error 512". Applied to: immich-postgres, audiobookshelf, anki-sync-server, registry, pkgrepo, player, wallabag, miniflux-postgres, opodsync, radicale, kobo-sync-server, keybr, filebrowser, git-server, goprecords, jellyfin. (syncthing and navidrome already had it.) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-02-07	feat: add LAN ingresses for all services	Paul Buetow
	Add *.f3s.lan.buetow.org ingress resources for all services to enable LAN access with TLS termination. This allows direct access from the 192.168.1.0/24 network through the FreeBSD CARP/relayd setup. Services updated: - argocd: argocd.f3s.lan.buetow.org - cgit: cgit.f3s.lan.buetow.org - grafana: grafana.f3s.lan.buetow.org - anki-sync-server: anki.f3s.lan.buetow.org - apache: f3s.lan.buetow.org, www.f3s.lan.buetow.org, standby.f3s.lan.buetow.org - audiobookshelf: audiobookshelf.f3s.lan.buetow.org - filebrowser: filebrowser.f3s.lan.buetow.org - immich: immich.f3s.lan.buetow.org - ipv6test: ipv6test.f3s.lan.buetow.org (+ ipv4/ipv6 subdomains) - keybr: keybr.f3s.lan.buetow.org - koreader-sync-server: koreader.f3s.lan.buetow.org - miniflux: flux.f3s.lan.buetow.org - opodsync: gpodder.f3s.lan.buetow.org - radicale: radicale.f3s.lan.buetow.org - syncthing: syncthing.f3s.lan.buetow.org - tracing-demo: tracing-demo.f3s.lan.buetow.org - wallabag: bag.f3s.lan.buetow.org - webdav: webdav.f3s.lan.buetow.org All LAN ingresses use: - TLS with f3s-lan-tls certificate (cert-manager) - Traefik entrypoints: web,websecure - Same backend services as external ingresses Also fixed koreader-sync-server ingress to use modern annotations. Co-authored-by: Cursor <cursoragent@cursor.com>
2025-12-26	add webdav	Paul Buetow

2025-11-22	add filebrowser	Paul Buetow