summaryrefslogtreecommitdiff
path: root/f3s
AgeCommit message (Collapse)Author
2026-02-15Use Recreate strategy for syncthing to avoid file lock conflictsPaul Buetow
Changed deployment strategy from RollingUpdate to Recreate to prevent file lock conflicts when using RWO volumes. Syncthing uses file locks in the config directory, so only one pod can access it at a time. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-15Add health probes to syncthing deployment to auto-recover from stale NFS mountsPaul Buetow
Added startup, liveness, and readiness probes to the syncthing deployment. The liveness probe will automatically restart the pod when it becomes unresponsive due to stale NFS file handles, preventing filesystem errors and service disruptions. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-15Remove AGENTS.md and add Serena project configurationPaul Buetow
Removed AGENTS.md as it is no longer referenced in the project. Added .serena/ directory with project configuration for Serena AI agent. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-15Add health probes to registry deployment to auto-recover from stale NFS mountsPaul Buetow
Added startup, liveness, and readiness probes to the docker registry deployment. The liveness probe will automatically restart the pod when it returns 503 errors (which happens when NFS storage becomes stale), preventing prolonged ImagePullBackOff issues for dependent services like radicale and git-server. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-08docs(pihole): add DNS toggle script documentation and improve setup instructionsPaul Buetow
Added quick toggle script section to README with usage examples. Reorganized client configuration into quick toggle (recommended) and manual sections for better clarity. The toggle script provides an easy way to enable/disable Pi-hole DNS on Fedora laptops without remembering NetworkManager commands. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-08joPaul Buetow
2026-02-08Upgrade immich to v2.5.5 latest stable releasePaul Buetow
Updated immich-server and immich-machine-learning images to v2.5.5. This release includes major features: - Free Up Space functionality - Non-destructive photo editing - Database backup and restore via web - Upload improvements and visual refresh - Progressive JPEGs support - Additional fine-grained API key permissions Release notes: https://github.com/immich-app/immich/releases/tag/v2.5.5
2026-02-08Add immich LAN ingress and remove unsupported helm configPaul Buetow
- Created custom ingress-lan.yaml for immich.f3s.lan.buetow.org with TLS - Removed unsupported 'lan' ingress config from ArgoCD app values - The Immich Helm chart doesn't support multiple named ingresses, so we create the LAN ingress as a custom resource instead This aligns immich with other services that have both regular and LAN ingress endpoints.
2026-02-08Add PostgreSQL health checks to fix immich pod restartsPaul Buetow
Added liveness and readiness probes to the PostgreSQL deployment to ensure it's ready to accept connections before immich-server attempts to connect. This fixes the race condition causing ECONNREFUSED errors and pod restarts. The readiness probe prevents services from routing traffic until PostgreSQL is fully initialized, while the liveness probe ensures the container is restarted if PostgreSQL becomes unresponsive.
2026-02-07docs(git-server): update README with persistent SSH keys infoPaul Buetow
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(git-server): copy SSH keys from NFS to local emptyDirPaul Buetow
OpenSSH refuses to load host keys from NFS for security reasons. The solution is to store keys in persistent NFS (so they survive restarts) but copy them to a local emptyDir at startup (so sshd can read them). This ensures: - SSH host keys persist across pod restarts - sshd can successfully load the keys from local storage - Clients don't see "host key changed" warnings Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(git-server): add sshd_config to persistent storagePaul Buetow
The sshd_config file needs to be in the persistent SSH directory for the git-server container to start properly. Added ConfigMap and updated initContainer to copy it on first deployment. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(git-server): persist SSH host keys across pod restartsPaul Buetow
SSH host keys are now stored in persistent NFS storage instead of ephemeral emptyDir. Keys are only generated once on first deployment, preventing known_hosts updates on every pod restart. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07feat: add LAN ingresses for all servicesPaul Buetow
Add *.f3s.lan.buetow.org ingress resources for all services to enable LAN access with TLS termination. This allows direct access from the 192.168.1.0/24 network through the FreeBSD CARP/relayd setup. Services updated: - argocd: argocd.f3s.lan.buetow.org - cgit: cgit.f3s.lan.buetow.org - grafana: grafana.f3s.lan.buetow.org - anki-sync-server: anki.f3s.lan.buetow.org - apache: f3s.lan.buetow.org, www.f3s.lan.buetow.org, standby.f3s.lan.buetow.org - audiobookshelf: audiobookshelf.f3s.lan.buetow.org - filebrowser: filebrowser.f3s.lan.buetow.org - immich: immich.f3s.lan.buetow.org - ipv6test: ipv6test.f3s.lan.buetow.org (+ ipv4/ipv6 subdomains) - keybr: keybr.f3s.lan.buetow.org - koreader-sync-server: koreader.f3s.lan.buetow.org - miniflux: flux.f3s.lan.buetow.org - opodsync: gpodder.f3s.lan.buetow.org - radicale: radicale.f3s.lan.buetow.org - syncthing: syncthing.f3s.lan.buetow.org - tracing-demo: tracing-demo.f3s.lan.buetow.org - wallabag: bag.f3s.lan.buetow.org - webdav: webdav.f3s.lan.buetow.org All LAN ingresses use: - TLS with f3s-lan-tls certificate (cert-manager) - Traefik entrypoints: web,websecure - Same backend services as external ingresses Also fixed koreader-sync-server ingress to use modern annotations. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07docs(agents): add note about pushing to internal git serverPaul Buetow
Add reminder to push changes to r0 for ArgoCD sync and note about accepting new SSH host keys. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07docs(pihole): add DNS client configuration guidePaul Buetow
Document how to configure clients to use Pi-hole DNS: - NetworkManager configuration for Linux/Fedora - Multiple DNS servers with automatic failover - Firefox DoH configuration notes - Verification steps Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07feat(pihole): add LAN DNS access via externalIPPaul Buetow
Configure Pi-hole DNS service to bind to 192.168.1.120 for LAN access. This allows clients on the 192.168.1.0/24 network to use Pi-hole as their DNS server without needing to be on the Wireguard mesh. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(pihole): use correct helm parameter for existing secretPaul Buetow
The pihole helm chart uses 'admin.existingSecret' not 'adminPasswordSecret'. This ensures the deployment uses the pihole-admin-password secret instead of creating a default 'pihole-password' secret with 'admin' password. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(pihole): add Traefik middleware to redirect root to /admin/Paul Buetow
Pi-hole's web interface returns 403 Forbidden when accessed via the root path. Add a Traefik middleware that redirects requests to the root URL to /admin/ path where the web interface is accessible. Also add the pihole ArgoCD application manifest. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07add piholePaul Buetow
2026-02-06Add Traefik ingresses for jellyfin (external and LAN with TLS)Paul Buetow
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-06fix(jellyfin): move values.yaml to helm-chart directoryPaul Buetow
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-06Restore jellyfin helm-chart and ArgoCD applicationPaul Buetow
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-05Add end-to-end test results for LAN accessPaul Buetow
2026-02-05Update Navidrome LAN ingress to use TLS with cert-manager certificatePaul Buetow
2026-02-05Add LAN access via CARP and relaydPaul Buetow
- Add cert-manager for self-signed TLS certificates - Create wildcard cert for *.f3s.lan.buetow.org - Add LAN ingress to Navidrome (navidrome.f3s.lan.buetow.org) - Document FreeBSD relayd configuration for LAN access - Add comprehensive setup guide LAN access uses existing CARP VIP (192.168.1.138) on f0/f1 with relayd forwarding HTTP/HTTPS to k3s Traefik NodePorts. External access via OpenBSD relayd continues unchanged.
2026-02-04Add Navidrome music server deploymentPaul Buetow
Adds Navidrome music streaming server with: - Helm chart with deployment, service, ingress, and persistent volumes - Two PVs: data (10Gi) and music library (200Gi) - ArgoCD application for automated deployment - Ingress at navidrome.f3s.buetow.org - Justfile for operational commands
2026-02-03Update ipv6test to 1.6.2 with fixed non-root permissionsPaul Buetow
Fix Apache PidFile and cgid ScriptSock paths for non-root user.
2026-02-03Update ipv6test to enforce non-root runtime.Paul Buetow
Switch the container to an unprivileged UID/GID and update probes for port 8080.
2026-02-03UpdatePaul Buetow
2026-01-31Fix relayd.conf syntax: replace invalid persist/timeout keywords with ↵Paul Buetow
session timeout Amp-Thread-ID: https://ampcode.com/threads/T-019c1549-6538-740f-b867-595c2dff8117 Co-authored-by: Amp <amp@ampcode.com>
2026-01-31cleanupPaul Buetow
2026-01-31Fix minvid.f3s.buetow.org TLS certificate generation and routingPaul Buetow
- acme.sh: Change grep from exact match to prefix match for f3s hosts Server blocks for f3s hosts use -port80/-port8080 suffixes - relayd: Add explicit routing for f3s hosts (except registry/jellyfin) minvid and other f3s hosts now route to <f3s> backend table Amp-Thread-ID: https://ampcode.com/threads/T-019c14ac-164f-776f-8648-471d4ac4ce5a Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Add MinVid Docker image build filesPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Update MinVid to use local registry imagePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Add TLS offloading support via relayd proxyPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Update MinVid deployment with corrected image and port configurationPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Add MinVid deploymentPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Remove database.xml ConfigMap - config managed directly on NFSPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1392-78a3-7440-9d95-1a1b2fd7dfec Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Fix database.xml structure - use correct DatabaseConfigurationOptions and ↵Paul Buetow
LockingBehavior Amp-Thread-ID: https://ampcode.com/threads/T-019c1392-78a3-7440-9d95-1a1b2fd7dfec Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Fix database.xml mount path to /config/config/Paul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1392-78a3-7440-9d95-1a1b2fd7dfec Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Fix Jellyfin slow database: set SQLite locking mode to OptimisticPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1392-78a3-7440-9d95-1a1b2fd7dfec Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Increase Jellyfin CPU and memory resourcesPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12eb-6dd8-76ab-9b88-b9dc12e6984a Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Update Jellyfin to version 10.11.6 with helm templatingPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12eb-6dd8-76ab-9b88-b9dc12e6984a Co-authored-by: Amp <amp@ampcode.com>
2026-01-31docs(jellyfin): add deployment summary and configuration overviewPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31upgrade(jellyfin): use latest versionPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31fix(jellyfin): remove read-only ConfigMap mount, let Jellyfin manage network.xmlPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31upgrade(jellyfin): 10.8.13 → 10.10.7 (intermediate step to 10.11.6)Paul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31upgrade(jellyfin): 10.8.13 → 10.11.6 (latest)Paul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
2026-01-31revert(jellyfin): rollback to 10.8.13 due to image issuePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c12b1-e861-773b-8f74-64b6c2255a5f Co-authored-by: Amp <amp@ampcode.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-10 18:29:13 +0000