summaryrefslogtreecommitdiff
path: root/frontends
AgeCommit message (Collapse)Author
2026-07-10packages+frontends: dtail packaging follow-ups (vs0 review items)Paul Buetow
- dtail-freebsd.json.tpl: move HostKeyFile from volatile /var/run/dserver/cache to persistent /var/db/dserver/ssh_host_key — FreeBSD's cleanvar purges /var/run at boot, so the host key was regenerated on every reboot (mirrors the NetBSD/OpenBSD templates) - dserver-freebsd.tpl rc.d: start_precmd now creates /var/db/dserver (0700, dserver-owned) and re-runs dserver-update-key-cache.sh on every start, so the volatile key cache repopulates right after a reboot or restart instead of waiting for the daily periodic job - packages/Makefile: .SHELLFLAGS gains -o pipefail — the "git archive | ssh ... tar" pipeline could mask a git archive failure as long as tar succeeded on the truncated stream (the only recipe-level pipeline; $(shell ...) calls are unaffected) - packages/Makefile: OS-suffixed /tmp staging names for the OpenBSD and NetBSD dtail tgz (dtail-openbsd-*/dtail-netbsd-*) — a dash-less version would have made both targets stage to the same /tmp/dtail-<version>.tgz locally and on f0; the final repo copy keeps the canonical dtail-<version>.tgz name - dserver-update-key-cache.sh.tpl (OpenBSD): port the NetBSD hardening — quote all variable expansions, derive the user via basename suffix stripping instead of cut -d. -f1 (dotted usernames broke), fix the obsolete-cachefile echo that used single quotes and never interpolated $cachefile, add a header comment documenting the rc_pre and /etc/daily.local call sites - dserver.tpl (OpenBSD rc.d): replace 'rc_cmd $1 &' with rc_bg=YES and a plain rc_cmd "$1" — the daemon needs backgrounding because it does not daemonize, but backgrounding the whole rc framework made rc_pre failures and the start result invisible to rcctl; rc_bg is rc.subr's supported way to background only the daemon - dserver-update-key-cache-freebsd.sh.tpl: header now documents the new rc.d start_precmd call site Deployed: FreeBSD pkg republished, f0/f1/f2 upgraded with host key migrated to /var/db/dserver first (sha256 verified identical); f3 unreachable, still on the old package. OpenBSD pkg republished, fishfinger reinstalled + restarted, host key unchanged, dcat verified. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10frontends: OpenBSD dserver rc.d — create /var/run/dserver parent explicitlyPaul Buetow
install -d applies -o/-m only to the final directory, so the previous single 'install -d -o _dserver /var/run/dserver/cache' left the parent /var/run/dserver (the _dserver home dir) implicitly created as root:wheel after a reboot. Create the parent explicitly with the right ownership, matching the NetBSD template (dserver-netbsd.tpl). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10frontends: OpenBSD dserver — absolute CacheDir, persistent host keyPaul Buetow
The OpenBSD dserver template used relative CacheDir "cache" and HostKeyFile "cache/ssh_host_key", which only worked because rc.d starts the daemon via su -l _dserver (CWD = /var/run/dserver). Any start from another directory broke public key lookup — same bug class dtail commit fec2f9d fixed on the server side. Switch to absolute paths like the FreeBSD/NetBSD templates. OpenBSD /etc/rc wipes /var/run/* at boot, so move the SSH host key to persistent /var/db/dserver/ssh_host_key (mirrors the NetBSD template) — a regenerated host key would break clients' known_hosts. The rc.d rc_pre now also creates /var/db/dserver and re-runs the key-cache helper on every service start, so the volatile cache is repopulated right after a reboot instead of waiting for the daily cron job. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-09packages: harden NetBSD dtail pipeline (review findings)Paul Buetow
- Makefile: .SHELLFLAGS := -ec — with .ONESHELL a failing intermediate recipe line (remote pkg_create, scp, PV upload) previously did not stop the recipe and make exited 0; also remove stale /tmp package artifacts at target start so a failed build can never silently re-upload an old tgz, guard against an empty extracted version, and quote the tr operand - dtail-netbsd.json.tpl + rc.d: move the SSH host key from volatile /var/run/dserver/cache to persistent /var/db/dserver/ssh_host_key so it survives reboots (clients re-accept the key once after upgrade) - pkg-dtail-netbsd.sh: reject a missing version argument; write the pkg_summary via a temp file so a pkg_info failure cannot publish a truncated pkg_summary.gz; document that the dserver user/group is a deliberate manual install step - key-cache template: comment now states the daily cron entry is added manually at install time (documented in the pkgrepo skill) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-09packages: add NetBSD dtail pipeline (pi0/pi1, aarch64)Paul Buetow
- Makefile target dtail-netbsd: cross-compile netbsd/arm64 (CGO_ENABLED=0, nozstd), package natively on pi0 with pkg_create, upload package plus pkg_summary.gz to the PV at netbsd/10.1/packages/aarch64/ via f0 - scripts/pkg-dtail-netbsd.sh: NetBSD pkg_create packaging (prefix /, root-owned files via @owner/@group plist directives) - frontends: NetBSD dserver rc.d script, dtail.json (absolute cache paths), and key-cache helper templates - pkgrepo nginx: serve /netbsd/ with autoindex - Fix stale ROCKY_ARM_BUILD_HOST: pi0 was re-imaged to NetBSD, aarch64 RPMs are built on pi2 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-30add ychatPaul Buetow
2026-06-08Add rocky WireGuard IP to hosts append and Rexfile wg0_ipsPaul Buetow
2026-06-07changePaul Buetow
2026-05-16frontends + packages: add dserver/dtail support for FreeBSD and RockyPaul Buetow
Adds FreeBSD .tpl variants of the existing dserver templates and a matching pkg-dtail-freebsd.sh packaging script, plus a pkg-dtail-rpm.sh script and packages/files/dtail-rocky/ (systemd units, key-cache script, dtail.json) for the Rocky Linux dtail build.
2026-05-09add xplayerPaul Buetow
2026-05-03add player.f3s.buetow.orgPaul Buetow
2026-04-17frontends/relayd: route anki.f3s.buetow.org directly to NodePort 30800Paul Buetow
Bypass Traefik for anki-sync-server to fix HTTP 303 stream failures. The Anki client maps zstd response body read errors to SEE_OTHER (303). This was caused by Traefik's HTTP proxy layer interfering with the binary zstd-compressed response bodies. Route directly to the anki NodePort like Jellyfin's 30096, which avoids the double-proxy issue.
2026-04-16frontends: switch goprecords upload to unified script with separate token filePaul Buetow
Deploy goprecords-upload-client.sh from goprecords/scripts/ instead of the inline-token template. Token is now stored in /etc/goprecords-upload.token (mode 600) and the script reads it at runtime. Old goprecords-upload.sh (token baked in, mode 500) is removed. daily.local entry updated to pass GOPRECORDS_HOST=<host> as environment variable. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-14frontends: daily goprecords uptimed upload for fishfinger and blowfish.Paul Buetow
Add POSIX sh script template deployed to /usr/local/bin/goprecords-upload.sh, invoked from /etc/daily.local. Rex task goprecords_upload installs curl, renders per-host script from geheim secrets/etc/goprecords/<host>.token, and hooks commons. Document token layout and kubectl key creation in README. Made-with: Cursor
2026-04-13add goprecords.f3s.buetow.orgPaul Buetow
2026-04-10fixPaul Buetow
2026-04-10add emaPaul Buetow
2026-04-10acme.sh: skip standby certs for server FQDNs, restart relayd if deadPaul Buetow
- Skip standby.blowfish.buetow.org and standby.fishfinger.buetow.org (no DNS records, no httpd/acme-client.conf entries) - Use 'rcctl check && reload || restart' for relayd so a dead relayd gets restarted instead of silently failing on reload Amp-Thread-ID: https://ampcode.com/threads/T-019d77bf-0537-74e1-a1a9-c1b47d2af392 Co-authored-by: Amp <amp@ampcode.com>
2026-04-10snonux.foo: route to Pi backends at /snonux, redirect wwwPaul Buetow
- relayd: route www.snonux.foo to localhost for redirect, keep bare/standby on f3s_static_proxy - httpd: www.snonux.foo returns 302 redirect to snonux.foo - gogios: monitor pi0/pi1 via wg0.wan.buetow.org instead of lan.buetow.org - AGENTS.md: document Pi lighttpd Host-based virtual hosting pattern Amp-Thread-ID: https://ampcode.com/threads/T-019d7766-909d-741c-bcb9-1e1e931f1e1b Co-authored-by: Amp <amp@ampcode.com>
2026-04-08Add offline-page fallback for f3s static relayPaul Buetow
2026-04-08Return HTTP errors for dead f3s static backendsPaul Buetow
2026-04-08Route f3s.buetow.org to Pi static backendsPaul Buetow
2026-04-08add pi0 and pi1Paul Buetow
2026-04-08h0: document PI phase 3.2 role splitPaul Buetow
2026-04-08relayd: route garage.f3s.buetow.org to Garage S3 backends (task d)Paul Buetow
Add table <garage> (192.168.2.130-132), Host header match in f3s block, and forward to port 3900 with tcp health checks on https4/https6. Made-with: Cursor
2026-04-08frontends: add garage.f3s.buetow.org to @f3s_hosts (task 8)Paul Buetow
Include garage in f3s host list so DNS, TLS (acme), and httpd/relayd templates generate config for the new hostname. Made-with: Cursor
2026-04-07dserver: replace broken newsyslog rotation with daily.local find cleanupPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019d6727-d603-72c5-97a0-c1e419211767 Co-authored-by: Amp <amp@ampcode.com>
2026-03-29Add newsyslog rotation for dserver logsPaul Buetow
2026-03-28Add OpenBSD build VM and dtail package infrastructurePaul Buetow
Add a QEMU/KVM OpenBSD VM for native compilation of CGo packages (e.g. dtail with DataDog/zstd). The VM is fully automated via expect driving the serial console installer. - packages/buildvm/: setup, provision, start, stop scripts and expect installer - packages/scripts/pkg-dtail-openbsd.sh: multi-binary package with signify signing - packages/Makefile: build VM management and dtail-openbsd target using git archive - frontends/Rexfile: dtail_install task uses custom pkg repo, dtail task enabled Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-28Sign OpenBSD packages with signify, drop -D unsignedPaul Buetow
Packages are now signed via pkg_sign with the custom-pkg signify key on the OpenBSD build host. The public key at /etc/signify/custom-pkg.pub on each client allows pkg_add to verify without -D unsigned. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-28frontends: install gogios from pkg repo, add pkgrepo_setup taskPaul Buetow
Replace manual binary copy in gogios_install with pkg install (FreeBSD) and pkg_add (OpenBSD). Add pkgrepo_setup task that configures PKG_PATH in root's .profile on OpenBSD frontends. The gogios task now calls gogios_install automatically. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-28pkgrepo: add FreeBSD/OpenBSD package repository servicePaul Buetow
Serve custom-built FreeBSD and OpenBSD packages via nginx in the k3s cluster. Includes helm chart, ArgoCD app, test artifact build script, and DNS entry via frontends Rexfile. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15cleanup of old zone template files and RexfilePaul Buetow
2026-02-08doesnt belong herePaul Buetow
2026-02-07add ingress for piholePaul Buetow
2026-02-06joPaul Buetow
2026-02-04add navidromePaul Buetow
2026-02-01Preserve prompt spacing on send-back.Paul Buetow
Keep the first-line prefix strip without trimming spaces.
2026-02-01Refactor tmux-edit-send and document helpers.Paul Buetow
Add function comments and optional logging toggle.
2026-02-01Capture multiline prompt input in popup editor.Paul Buetow
Parse boxed prompt lines and join wrapped text for prefill.
2026-02-01Strip prefilled prompt from first line.Paul Buetow
Avoid sending duplicated prompt text back to the pane.
2026-02-01Prefill editor from cursor-agent prompt line.Paul Buetow
Capture the last prompt line and seed the temp file for editing.
2026-02-01Add tmux editor popup and deploy helper script.Paul Buetow
This enables an overlay editor binding and installs the send-keys script on frontends.
2026-01-31Fix: push @acme_hosts syntax to include f3s_hosts for TLS certsPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c15ba-eb08-73ed-9afe-c93659dc123c Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Fix relayd.conf syntax: replace invalid persist/timeout keywords with ↵Paul Buetow
session timeout Amp-Thread-ID: https://ampcode.com/threads/T-019c1549-6538-740f-b867-595c2dff8117 Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Fix acme.sh to handle f3s host server blocks with -port80/-port8080 suffixesPaul Buetow
Changes grep from exact match (^server "") to prefix match (^server ") This allows acme.sh to find and generate certificates for f3s cluster hosts. Amp-Thread-ID: https://ampcode.com/threads/T-019c14ac-164f-776f-8648-471d4ac4ce5a Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Revert relayd routing changes - cert generation fix (acme.sh) is sufficientPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c14ac-164f-776f-8648-471d4ac4ce5a Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Fix relayd template loop closing syntaxPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c14ac-164f-776f-8648-471d4ac4ce5a Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Fix minvid.f3s.buetow.org TLS certificate generation and routingPaul Buetow
- acme.sh: Change grep from exact match to prefix match for f3s hosts Server blocks for f3s hosts use -port80/-port8080 suffixes - relayd: Add explicit routing for f3s hosts (except registry/jellyfin) minvid and other f3s hosts now route to <f3s> backend table Amp-Thread-ID: https://ampcode.com/threads/T-019c14ac-164f-776f-8648-471d4ac4ce5a Co-authored-by: Amp <amp@ampcode.com>
2026-01-31Add MinVid Docker image build filesPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c1492-bec0-70f8-8d02-ef3596a7228b Co-authored-by: Amp <amp@ampcode.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-08 07:25:59 +0000