| Age | Commit message (Collapse) | Author |
|---|
|
All hostPath PVs are backed by NFS (127.0.0.1:/k3svolumes via stunnel).
Existing NFS sentinel init containers only protect against pod startup when
NFS is unmounted. If NFS goes stale mid-flight (e.g. after an NFS server
restart during FreeBSD upgrades), running pods hold stale file descriptors
and serve errors indefinitely without being restarted.
Fix: add livenessProbe to every NFS-backed container:
- Non-postgres services: test -f /mount-path/.nfs-sentinel (ESTALE fails this)
- Postgres (immich, miniflux): pg_isready AND test -f on pg_filenode.map so
the probe exercises both the TCP listener and the NFS data directory
- webdav: also adds missing nfs-check-data init container (was the only
service without sentinel protection at startup)
- git-server (two containers): test -d /repos (sentinel is in PVC root,
not the repos subPath, so directory existence check is used instead)
All probes: initialDelaySeconds 30 (60 for jellyfin/postgres), periodSeconds
30, failureThreshold 3 — triggers restart after ~90 s of NFS unavailability.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Add *.f3s.lan.buetow.org ingress resources for all services to enable
LAN access with TLS termination. This allows direct access from the
192.168.1.0/24 network through the FreeBSD CARP/relayd setup.
Services updated:
- argocd: argocd.f3s.lan.buetow.org
- cgit: cgit.f3s.lan.buetow.org
- grafana: grafana.f3s.lan.buetow.org
- anki-sync-server: anki.f3s.lan.buetow.org
- apache: f3s.lan.buetow.org, www.f3s.lan.buetow.org, standby.f3s.lan.buetow.org
- audiobookshelf: audiobookshelf.f3s.lan.buetow.org
- filebrowser: filebrowser.f3s.lan.buetow.org
- immich: immich.f3s.lan.buetow.org
- ipv6test: ipv6test.f3s.lan.buetow.org (+ ipv4/ipv6 subdomains)
- keybr: keybr.f3s.lan.buetow.org
- koreader-sync-server: koreader.f3s.lan.buetow.org
- miniflux: flux.f3s.lan.buetow.org
- opodsync: gpodder.f3s.lan.buetow.org
- radicale: radicale.f3s.lan.buetow.org
- syncthing: syncthing.f3s.lan.buetow.org
- tracing-demo: tracing-demo.f3s.lan.buetow.org
- wallabag: bag.f3s.lan.buetow.org
- webdav: webdav.f3s.lan.buetow.org
All LAN ingresses use:
- TLS with f3s-lan-tls certificate (cert-manager)
- Traefik entrypoints: web,websecure
- Same backend services as external ingresses
Also fixed koreader-sync-server ingress to use modern annotations.
Co-authored-by: Cursor <cursoragent@cursor.com>
|
|
Apps migrated in this commit:
- anki-sync-server (custom images, 1 PVC)
- syncthing (file sync, 2 PVCs)
- audiobookshelf (3 PVCs)
- radicale (CalDAV/CardDAV)
- opodsync (podcast sync, 2-container pod)
- kobo-sync-server (eReader sync)
- filebrowser (3 PVCs)
- webdav (WebDAV server)
All apps:
- Created ArgoCD Application manifests
- Updated Justfiles with ArgoCD commands
- All synced successfully and healthy
- Zero downtime migrations
Also includes:
- Updated migration progress tracker (12/23 apps, 52%)
- Deleted freshrss directory (app no longer needed)
Progress: 12/23 apps (52%)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
|
|
