Stage 3 + 6 of REFACTOR_PLAN.md.
- Drop nik4nao.home.arpa from both Pi-hole values files: no Certificate,
Ingress, or IngressRoute anywhere references it (confirmed via grep).
- Add the immich.home.arpa and gluetun.home.arpa entries that existed in
values/pihole.yaml but were missing from values/pihole-debian.yaml --
Pi-hole has no wildcard DNS here, so every hostname must be listed in both.
Both files' hostname lists now match exactly (aside from the differing
target IPs, which is expected for primary vs. secondary).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Stage 2 of REFACTOR_PLAN.md. Repo had no CI or local validation tooling at
all. Tuned rules to match this repo's existing conventions (no trailing
newline on hand-written manifests, aligned comment blocks) rather than
rewriting hundreds of pre-existing files to satisfy defaults.
Baseline is clean: yamllint reports 0 issues repo-wide, kubeconform validates
117 manifests + 20 Argo CD Applications, and all Ansible playbooks pass
--syntax-check.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Stage 1 of REFACTOR_PLAN.md. values/gitea.yaml and config/dashy/conf.yaml now
reference secrets injected at apply-time (gitea-postgres-secret.sh, .env) instead
of hardcoding a live DB password and weather API key in git. Both values must be
treated as compromised and rotated by the operator (see .env.example).
Also fixes authentik-ingress.yaml and traefik-dashboard-ingress.yaml, which
pointed at the internal-ca root ClusterIssuer instead of internal-ca-issuer,
the chained issuer every other internal Certificate uses -- causing untrusted-cert
warnings on the SSO login and Traefik dashboard.
Extends .gitignore for *.retry, .vault_pass*, kubeconfig patterns, and editor
swap files.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
feat: update qBittorrent deployment to expose gluetun API on port 8000 and add TLS certificate for secure access
feat: add gluetun DNS entry to Pi-hole configuration for improved network management
