host_vars/gpu-node.yaml's ufw_allowed_ports has overridden (not extended)
the common role's default list since the node was added, silently dropping
the Flannel VXLAN (8472/udp), K3s API (6443/tcp), and Kubelet (10250/tcp)
rules every other node gets. Went unnoticed because kubectl logs/exec/stats
tunnel through the agent's outbound connection to the k3s server rather
than needing a direct inbound path - but real pod dataplane traffic (e.g.
tts-gateway on nik-gpu resolving DNS against CoreDNS on nik-debian) needs
actual VXLAN connectivity and was blackholing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Deploys the Go gRPC gateway and Python/libtorch inference sidecar as one
pod on nik-gpu (nodeSelector/toleration/runtimeClassName: nvidia, sidecar
requesting nvidia.com/gpu: 1), matching the existing GPU device plugin.
Model checkpoint/config are bind-mounted from /data/tts-gateway, added to
gpu-node's Ansible data_dirs for consistency with the other hosts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Stage 4 of REFACTOR_PLAN.md.
- Merge ansible/ansible.cfg into root ansible.cfg (single source of truth);
the dual-config setup silently broke documented commands and lost
host_key_checking=False when run from the ansible/ directory.
- Add ansible/requirements.yml pinning community.general, ansible.posix,
community.docker -- previously undocumented deps of the glances/watch-party
roles that would fail a fresh bootstrap.
- Align K3s version to v1.32.4+k3s1 across roles/k3s-server, roles/k3s-agent,
and host_vars/gpu-node.yaml defaults (was skewed: .2 vs .4). This only
changes what a *future* provision installs -- minisforum/debian are still
live on v1.32.2+k3s1 until separately upgraded.
- Fix kubeconfig fetch/replace path mismatch in k3s-server role: the `fetch`
task (flat: true) writes to ~/.kube/config, but `replace` was targeting a
/tmp/k3s-minisforum.yaml nothing creates -- would break a fresh rebuild.
- gitea-runner: only remove /run/docker.sock when it's actually a directory
(task name implied a check that wasn't there); tighten registration-token
systemd unit from 0644 to 0600.
- nvidia: stop unconditionally reporting `changed` (and restarting Docker)
on every run for an idempotent runtime-configure command.
- Gate the K3s join-token debug print and WireGuard client-config/QR display
behind opt-in vars (k3s_show_token, wireguard_show_client_configs), default
off -- both were printing real secrets to console on every run.
- Parameterize the docker role for Debian and Ubuntu; homeassistant now
depends on it (meta/main.yaml) instead of duplicating a Debian-only Docker
install inline.
- FQCN cleanup across wireguard, homeassistant, and ollama roles/handlers
(bare module names -> ansible.builtin.*/community.general.*/ansible.posix.*),
plus a few ansible-lint name-casing/idiom fixes. Handler renames verified
against their `notify:` call sites so notifications still fire.
- Update ansible/README.md and root README.md: add gpu-node/gpu_workstation
(4th host, previously undocumented), docker/nvidia roles, setup-gpu-node.yaml,
homeassistant.yaml, requirements.yml install step; correct the "Legacy"
homeassistant label (it's the only thing serving ha.home.arpa); correct the
Gitea ingress/backup-storage doc-drift; flag the Grafana/Loki static-PV
binding drift discovered via live cluster check.
Verified: all playbooks pass `ansible-playbook --syntax-check`, yamllint clean.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
feat(gitea): create PersistentVolume and PersistentVolumeClaim for Gitea
feat(gitea): add script to create Gitea runner registration token secret
feat(gitea): deploy Gitea Actions runner with Docker socket access
feat(media): deploy JDownloader with Ingress configuration
feat(media): set up Jellyfin media server with NFS and Ingress
feat(media): configure qBittorrent deployment with Ingress
feat(monitoring): add Grafana Loki datasource ConfigMap
feat(monitoring): create Grafana admin credentials secret
feat(monitoring): define PersistentVolumes for monitoring stack
feat(network): implement DDNS CronJob for Porkbun DNS updates
feat(network): create secret for Porkbun DDNS API credentials
feat(network): set up Glances service and Ingress for Debian node
fix(network): patch Pi-hole DNS services with external IPs
feat(network): configure Traefik dashboard Ingress with Authentik auth
feat(network): set up Watch Party service and Ingress for Mac Mini
refactor(values): update Helm values files for various services
- Created ansible.cfg for configuration settings
- Added inventory.yml for host definitions
- Implemented bootstrap playbook for Minisforum setup
- Developed setup playbook for K3s installation
- Defined common role with user and package management tasks
- Established K3s server role with configuration and installation tasks
- Included Traefik Helm values for ingress management
