summaryrefslogtreecommitdiff
path: root/frontends/Rexfile
AgeCommit message (Collapse)Author
4 daysfrontends: restore standalone standby certificatesPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019fc408-6e41-73fe-826d-d47b0408981b Co-authored-by: Amp <amp@ampcode.com>
4 daysfrontends: give f3s hosts a standby.<host> SAN instead of a separate certPaul Buetow
f3s hosts don't get a distinct standby certificate/keypair; alias the primary cert's files under the standby name (relayd selects a keypair by SNI, so it needs matching filenames) and add standby.<host> as a SAN on the primary cert. Every host now also gets www.<host> as a SAN unconditionally, since public DNS publishes www for all of them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
5 daysgogios: scalar read_file for check_shuriken_age (avoid list-context line split)Paul Buetow
5 daysgogios: read check_shuriken_age from $HOME/git/shuriken.sh (Rex __FILE__ is ↵Paul Buetow
internal)
5 daysgogios: add Shuriken album-age check (1w warn, 2w crit)Paul Buetow
Add a custom gogios check that monitors shuriken album freshness via dist/status.json's unix_epoch, read locally on each frontend (so it covers the whole generation+sync pipeline). warn at 1 week, crit at 2 weeks; CRIT if status.json is missing (album not published). DependsOn the site's HTTP checks. The check_shuriken_age plugin (Perl, Nagios API) lives in the shuriken.sh repo (contrib/); the frontends Rexfile gogios task installs it to /usr/local/bin/ from the sibling shuriken.sh checkout (single source of truth, no vendored copy).
12 daysforgejo: add a standalone Forgejo install at code.f3s.buetow.orgPaul Buetow
Deliberately independent of the cgit git-server: separate namespace (services), separate NFS volumes, separate SSH NodePort (30222 vs 30022), and no shared storage. cgit keeps serving the existing 80 bare repos at c-git.f3s.buetow.org and is not touched. Forgejo starts empty; repos get migrated by hand later. ArgoCD deliberately keeps reading conf.git from the existing git-server, so Forgejo has no consumers and cannot take cluster deploys down with it. SQLite rather than a PostgreSQL pod: single writer (replicas 1 + Recreate) and NFSv4.2 does real byte-range locking, so the usual SQLite-on-NFS failure mode does not apply. Uses the -rootless image so the pod runs wholly as UID 1000 with all capabilities dropped, and both volumes carry the .nfs-sentinel guard. The installer is locked and registration disabled because the instance is reachable from the internet; the admin account is created via the CLI. code.f3s.buetow.org added to @f3s_hosts, which drives the DNS zone, the relayd route, the ACME cert and the gogios checks. Not yet activated: the ArgoCD Application still needs applying, the NFS directories creating, and the frontends deploying. See f3s/forgejo/README.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-06-30add ychatPaul Buetow
2026-06-08Add rocky WireGuard IP to hosts append and Rexfile wg0_ipsPaul Buetow
2026-06-07changePaul Buetow
2026-05-09add xplayerPaul Buetow
2026-05-03add player.f3s.buetow.orgPaul Buetow
2026-04-16frontends: switch goprecords upload to unified script with separate token filePaul Buetow
Deploy goprecords-upload-client.sh from goprecords/scripts/ instead of the inline-token template. Token is now stored in /etc/goprecords-upload.token (mode 600) and the script reads it at runtime. Old goprecords-upload.sh (token baked in, mode 500) is removed. daily.local entry updated to pass GOPRECORDS_HOST=<host> as environment variable. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-14frontends: daily goprecords uptimed upload for fishfinger and blowfish.Paul Buetow
Add POSIX sh script template deployed to /usr/local/bin/goprecords-upload.sh, invoked from /etc/daily.local. Rex task goprecords_upload installs curl, renders per-host script from geheim secrets/etc/goprecords/<host>.token, and hooks commons. Document token layout and kubectl key creation in README. Made-with: Cursor
2026-04-13add goprecords.f3s.buetow.orgPaul Buetow
2026-04-10fixPaul Buetow
2026-04-10add emaPaul Buetow
2026-04-08frontends: add garage.f3s.buetow.org to @f3s_hosts (task 8)Paul Buetow
Include garage in f3s host list so DNS, TLS (acme), and httpd/relayd templates generate config for the new hostname. Made-with: Cursor
2026-04-07dserver: replace broken newsyslog rotation with daily.local find cleanupPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d6727-d603-72c5-97a0-c1e419211767 Co-authored-by: Amp <amp@ampcode.com>
2026-03-28Add OpenBSD build VM and dtail package infrastructurePaul Buetow
Add a QEMU/KVM OpenBSD VM for native compilation of CGo packages (e.g. dtail with DataDog/zstd). The VM is fully automated via expect driving the serial console installer. - packages/buildvm/: setup, provision, start, stop scripts and expect installer - packages/scripts/pkg-dtail-openbsd.sh: multi-binary package with signify signing - packages/Makefile: build VM management and dtail-openbsd target using git archive - frontends/Rexfile: dtail_install task uses custom pkg repo, dtail task enabled Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-28Sign OpenBSD packages with signify, drop -D unsignedPaul Buetow
Packages are now signed via pkg_sign with the custom-pkg signify key on the OpenBSD build host. The public key at /etc/signify/custom-pkg.pub on each client allows pkg_add to verify without -D unsigned. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-28frontends: install gogios from pkg repo, add pkgrepo_setup taskPaul Buetow
Replace manual binary copy in gogios_install with pkg install (FreeBSD) and pkg_add (OpenBSD). Add pkgrepo_setup task that configures PKG_PATH in root's .profile on OpenBSD frontends. The gogios task now calls gogios_install automatically. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-28pkgrepo: add FreeBSD/OpenBSD package repository servicePaul Buetow
Serve custom-built FreeBSD and OpenBSD packages via nginx in the k3s cluster. Includes helm chart, ArgoCD app, test artifact build script, and DNS entry via frontends Rexfile. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15cleanup of old zone template files and RexfilePaul Buetow
2026-02-07add ingress for piholePaul Buetow
2026-02-06joPaul Buetow
2026-02-04add navidromePaul Buetow
2026-02-01Add tmux editor popup and deploy helper script.Paul Buetow
This enables an overlay editor binding and installs the send-keys script on frontends.
2026-01-31Fix: push @acme_hosts syntax to include f3s_hosts for TLS certsPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c15ba-eb08-73ed-9afe-c93659dc123c Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Add MinVid Docker image build filesPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Update MinVid deployment with corrected image and port configurationPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
2026-01-31fix: relayd template and missing ipv4address variablePaul Buetow
- Fixed Perl template syntax error in relayd.conf.tpl (lines 68-77) with improperly nested if/elsif blocks - Added ipv4address subroutine to Rexfile to lookup IPv4 by hostname - Updated relayd template to use ipv4address->($hostname) instead of undefined $vio0_ip variable - Pass ipv4address to template engine in relayd task Amp-Thread-ID: https://ampcode.com/threads/T-019c1441-7e3a-77cd-890f-cd31df998a31 Co-authored-by: Amp <amp@ampcode.com>
2026-01-31fix tlsPaul Buetow
2026-01-30not OrCreatePaul Buetow
2026-01-30add jellyPaul Buetow
2026-01-29Add ipv4/ipv6 subdomain ingress and bump to 1.2.0Paul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c086d-c760-779d-b740-0f748094b62a Co-authored-by: Amp <amp@ampcode.com>
2026-01-29Add ipv6test.f3s.buetow.org to DNS and ACME configPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c086d-c760-779d-b740-0f748094b62a Co-authored-by: Amp <amp@ampcode.com>
2026-01-27fixPaul Buetow
2026-01-24Add f3s hosts to ACME certificate managementPaul Buetow
- Add all 18 f3s hosts to @acme_hosts for certificate issuance - Skip standby certificate variants for f3s hosts (not needed for k3s cluster) - Add port 80 ACME challenge blocks to httpd for all f3s hosts - Add port 8080 fallback page blocks to httpd for f3s hosts (when cluster is down) - Update relayd.conf.tpl to skip standby keypairs for f3s hosts - Update acme-client.conf.tpl to skip standby certificates for f3s hosts Fixes missing certificates on flux.f3s.buetow.org, anki.f3s.buetow.org, and other f3s services
2026-01-21UpdatePaul Buetow
2026-01-21Add solarcat.buetow.org and cleanup configPaul Buetow
- Add solarcat DNS records, httpd server block, and ACME host - Re-enable Prometheus and WG0 ping notifications in gogios - Remove paul.cyou from DNS zones - Cleanup duplicate definitions in Rexfile Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-21adjust cPaul Buetow
2026-01-19Merge branch 'master' of codeberg.org:snonux/confPaul Buetow
2026-01-18fix alertsPaul Buetow
2026-01-17adjust monitoring checksPaul Buetow
2026-01-17fixPaul Buetow
2026-01-17updatePaul Buetow
2026-01-11Add WireGuard roaming client support and OpenBSD NAT configurationPaul Buetow
- Add pf.conf template with WireGuard NAT rules for roaming clients (earth, pixel7pro) - Add Rex task to deploy pf.conf to both OpenBSD frontends (blowfish, fishfinger) - Document WireGuard roaming client implementation plan and limitations - NAT rules enable roaming clients to route all traffic through VPN gateways - Firewall rules allow incoming WireGuard connections on UDP port 56709 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-10Add git.f3s.buetow.org to f3s hosts listPaul Buetow
Adding DNS/frontend configuration for the new git server
2026-01-09add cgitPaul Buetow
2026-01-06Fix 404 errors for blowfish/fishfinger index.txt URLsPaul Buetow
Added blowfish.buetow.org and fishfinger.buetow.org to @acme_hosts array to ensure proper routing through relayd to localhost instead of falling through to f3s cluster backends. Changes: - Rexfile: Add blowfish.buetow.org and fishfinger.buetow.org to @acme_hosts - httpd.conf.tpl: Skip current server hostname in @acme_hosts loop to avoid duplicate server blocks (already handled by dedicated "Current server's FQDN" block) - relayd.conf.tpl: Skip both server hostnames in TLS keypair loop since each server only has its own certificate (not the other server's cert) This ensures relayd routes these hostnames to localhost:8080 where httpd serves content from /htdocs/buetow.org/self including index.txt health checks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-07 05:39:50 +0000