summaryrefslogtreecommitdiff
path: root/f3s
AgeCommit message (Collapse)Author
2026-02-08Add PostgreSQL health checks to fix immich pod restartsPaul Buetow
Added liveness and readiness probes to the PostgreSQL deployment to ensure it's ready to accept connections before immich-server attempts to connect. This fixes the race condition causing ECONNREFUSED errors and pod restarts. The readiness probe prevents services from routing traffic until PostgreSQL is fully initialized, while the liveness probe ensures the container is restarted if PostgreSQL becomes unresponsive.
2026-02-07docs(git-server): update README with persistent SSH keys infoPaul Buetow
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(git-server): copy SSH keys from NFS to local emptyDirPaul Buetow
OpenSSH refuses to load host keys from NFS for security reasons. The solution is to store keys in persistent NFS (so they survive restarts) but copy them to a local emptyDir at startup (so sshd can read them). This ensures: - SSH host keys persist across pod restarts - sshd can successfully load the keys from local storage - Clients don't see "host key changed" warnings Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(git-server): add sshd_config to persistent storagePaul Buetow
The sshd_config file needs to be in the persistent SSH directory for the git-server container to start properly. Added ConfigMap and updated initContainer to copy it on first deployment. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(git-server): persist SSH host keys across pod restartsPaul Buetow
SSH host keys are now stored in persistent NFS storage instead of ephemeral emptyDir. Keys are only generated once on first deployment, preventing known_hosts updates on every pod restart. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07feat: add LAN ingresses for all servicesPaul Buetow
Add *.f3s.lan.buetow.org ingress resources for all services to enable LAN access with TLS termination. This allows direct access from the 192.168.1.0/24 network through the FreeBSD CARP/relayd setup. Services updated: - argocd: argocd.f3s.lan.buetow.org - cgit: cgit.f3s.lan.buetow.org - grafana: grafana.f3s.lan.buetow.org - anki-sync-server: anki.f3s.lan.buetow.org - apache: f3s.lan.buetow.org, www.f3s.lan.buetow.org, standby.f3s.lan.buetow.org - audiobookshelf: audiobookshelf.f3s.lan.buetow.org - filebrowser: filebrowser.f3s.lan.buetow.org - immich: immich.f3s.lan.buetow.org - ipv6test: ipv6test.f3s.lan.buetow.org (+ ipv4/ipv6 subdomains) - keybr: keybr.f3s.lan.buetow.org - koreader-sync-server: koreader.f3s.lan.buetow.org - miniflux: flux.f3s.lan.buetow.org - opodsync: gpodder.f3s.lan.buetow.org - radicale: radicale.f3s.lan.buetow.org - syncthing: syncthing.f3s.lan.buetow.org - tracing-demo: tracing-demo.f3s.lan.buetow.org - wallabag: bag.f3s.lan.buetow.org - webdav: webdav.f3s.lan.buetow.org All LAN ingresses use: - TLS with f3s-lan-tls certificate (cert-manager) - Traefik entrypoints: web,websecure - Same backend services as external ingresses Also fixed koreader-sync-server ingress to use modern annotations. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07docs(agents): add note about pushing to internal git serverPaul Buetow
Add reminder to push changes to r0 for ArgoCD sync and note about accepting new SSH host keys. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07docs(pihole): add DNS client configuration guidePaul Buetow
Document how to configure clients to use Pi-hole DNS: - NetworkManager configuration for Linux/Fedora - Multiple DNS servers with automatic failover - Firefox DoH configuration notes - Verification steps Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07feat(pihole): add LAN DNS access via externalIPPaul Buetow
Configure Pi-hole DNS service to bind to 192.168.1.120 for LAN access. This allows clients on the 192.168.1.0/24 network to use Pi-hole as their DNS server without needing to be on the Wireguard mesh. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(pihole): use correct helm parameter for existing secretPaul Buetow
The pihole helm chart uses 'admin.existingSecret' not 'adminPasswordSecret'. This ensures the deployment uses the pihole-admin-password secret instead of creating a default 'pihole-password' secret with 'admin' password. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(pihole): add Traefik middleware to redirect root to /admin/Paul Buetow
Pi-hole's web interface returns 403 Forbidden when accessed via the root path. Add a Traefik middleware that redirects requests to the root URL to /admin/ path where the web interface is accessible. Also add the pihole ArgoCD application manifest. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07add piholePaul Buetow
2026-02-06Add Traefik ingresses for jellyfin (external and LAN with TLS)Paul Buetow
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-06fix(jellyfin): move values.yaml to helm-chart directoryPaul Buetow
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-06Restore jellyfin helm-chart and ArgoCD applicationPaul Buetow
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-05Add end-to-end test results for LAN accessPaul Buetow
2026-02-05Update Navidrome LAN ingress to use TLS with cert-manager certificatePaul Buetow
2026-02-05Add LAN access via CARP and relaydPaul Buetow
- Add cert-manager for self-signed TLS certificates - Create wildcard cert for *.f3s.lan.buetow.org - Add LAN ingress to Navidrome (navidrome.f3s.lan.buetow.org) - Document FreeBSD relayd configuration for LAN access - Add comprehensive setup guide LAN access uses existing CARP VIP (192.168.1.138) on f0/f1 with relayd forwarding HTTP/HTTPS to k3s Traefik NodePorts. External access via OpenBSD relayd continues unchanged.
2026-02-04Add Navidrome music server deploymentPaul Buetow
Adds Navidrome music streaming server with: - Helm chart with deployment, service, ingress, and persistent volumes - Two PVs: data (10Gi) and music library (200Gi) - ArgoCD application for automated deployment - Ingress at navidrome.f3s.buetow.org - Justfile for operational commands
2026-02-03Update ipv6test to 1.6.2 with fixed non-root permissionsPaul Buetow
Fix Apache PidFile and cgid ScriptSock paths for non-root user.
2026-02-03Update ipv6test to enforce non-root runtime.Paul Buetow
Switch the container to an unprivileged UID/GID and update probes for port 8080.
2026-02-03UpdatePaul Buetow
2026-01-31Fix relayd.conf syntax: replace invalid persist/timeout keywords with ↵Paul Buetow
session timeout Amp-Thread-ID: https://ampcode.com/threads/T-019c1549-6538-740f-b867-595c2dff8117 Co-authored-by: Amp <amp@ampcode.com>
2026-01-31cleanupPaul Buetow
2026-01-31Fix minvid.f3s.buetow.org TLS certificate generation and routingPaul Buetow
- acme.sh: Change grep from exact match to prefix match for f3s hosts Server blocks for f3s hosts use -port80/-port8080 suffixes - relayd: Add explicit routing for f3s hosts (except registry/jellyfin) minvid and other f3s hosts now route to <f3s> backend table Amp-Thread-ID: https://ampcode.com/threads/T-019c14ac-164f-776f-8648-471d4ac4ce5a Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Add MinVid Docker image build filesPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Update MinVid to use local registry imagePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Add TLS offloading support via relayd proxyPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Update MinVid deployment with corrected image and port configurationPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Add MinVid deploymentPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Remove database.xml ConfigMap - config managed directly on NFSPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1392-78a3-7440-9d95-1a1b2fd7dfec Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Fix database.xml structure - use correct DatabaseConfigurationOptions and ↵Paul Buetow
LockingBehavior Amp-Thread-ID: https://ampcode.com/threads/T-019c1392-78a3-7440-9d95-1a1b2fd7dfec Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Fix database.xml mount path to /config/config/Paul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1392-78a3-7440-9d95-1a1b2fd7dfec Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Fix Jellyfin slow database: set SQLite locking mode to OptimisticPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1392-78a3-7440-9d95-1a1b2fd7dfec Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Increase Jellyfin CPU and memory resourcesPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12eb-6dd8-76ab-9b88-b9dc12e6984a Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Update Jellyfin to version 10.11.6 with helm templatingPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12eb-6dd8-76ab-9b88-b9dc12e6984a Co-authored-by: Amp <amp@ampcode.com>
2026-01-31docs(jellyfin): add deployment summary and configuration overviewPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31upgrade(jellyfin): use latest versionPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31fix(jellyfin): remove read-only ConfigMap mount, let Jellyfin manage network.xmlPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31upgrade(jellyfin): 10.8.13 → 10.10.7 (intermediate step to 10.11.6)Paul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31upgrade(jellyfin): 10.8.13 → 10.11.6 (latest)Paul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31revert(jellyfin): rollback to 10.8.13 due to image issuePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31upgrade(jellyfin): 10.8.13 → 10.10.7 for Android app compatibilityPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31fix(jellyfin): revert to simple config without dynamic header forwardingPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31fix(jellyfin): disable explicit public ports to use forwarded headersPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31fix(jellyfin): enable EnablePublishedServerUriByRequest for proper reverse ↵Paul Buetow
proxy support Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31fix(jellyfin): set public ports to 443 for external accessPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31refactor(jellyfin): expose via NodePorts, bypass Traefik to avoid ↵Paul Buetow
double-proxy issues Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31fix(jellyfin): configure known proxies and reverse proxy headers per ↵Paul Buetow
Jellyfin docs Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31fix(jellyfin): use X-Forwarded-Proto header for TLS offloading via relaydPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-17 07:37:50 +0000