This points at nik-debian's raw IP (192.168.7.183) for a host-level SMB/Samba
share, not a Kubernetes Service. Stage 3 removed it based on "no Certificate/
Ingress/IngressRoute references it" -- the wrong test for a non-HTTP,
non-Kubernetes service that was never going to have one. Broke real SMB
access. Restored to both Pi-hole values files in their original position.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Not used enough to justify chasing the stale-NFS-handle issue on its
photos-art mount. Removes manifests/media/immich.yaml (Namespace, PVCs,
Deployments, Service, Certificate, IngressRoute), its secret script and
sealed secret, immich.home.arpa from both Pi-hole values files, its Dashy
dashboard tile, and all other repo references (READMEs, secrets-leak-scanner
scope, regen-sealed-secret example, .env.example).
Per explicit confirmation: this also means the live namespace's PVCs
(immich-library 50Gi, immich-postgres-data 20Gi, immich-ml-cache 10Gi, all
local-path with Delete reclaim policy) are intended to be deleted along with
it -- any photos actually uploaded to Immich's own library are gone once the
namespace is deleted, separately from the read-only NFS folders it browsed
(untouched either way, those live independently on nik-debian).
Git removal alone does not delete the live cluster resources -- the media
Application has prune: false. Manual `kubectl delete namespace immich` still
needed to actually free the namespace/PVCs/data.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Root-causes today's Gitea outage. The official Gitea Helm chart
(dl.gitea.com/charts, gitea/helm-gitea) always builds Gitea's own [database]
config directly from the plaintext postgresql.global.postgresql.auth.password
value, confirmed from templates/gitea/config.yaml:
{{- $_ := set .Values.gitea.config.database "PASSWD" .Values.postgresql.global.postgresql.auth.password -}}
`existingSecret` only affects the bundled postgresql subchart's own credential
provisioning -- it has no effect on what Gitea itself connects with. Removing
the plaintext field in the earlier Stage 1 "secret hygiene" commit made this
silently fall back to the chart's built-in default password ("gitea", 5
chars), which got re-baked into the persisted app.ini on every pod restart
regardless of what the live Postgres role's real password was -- hence the
repeating CrashLoopBackOff no amount of Postgres-side fixing could resolve.
Restores a plaintext password (the value already live on Postgres from this
incident's recovery), with a comment explaining why, so this doesn't get
"cleaned up" back into the same breakage later. Removes the now-nonfunctional
manifests/gitea/gitea-postgres-secret.sh and its .env.example entry. Getting
this fully off plaintext would need a Config Management Plugin or similar --
not attempted here.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Stage 3 + 6 of REFACTOR_PLAN.md.
- Drop nik4nao.home.arpa from both Pi-hole values files: no Certificate,
Ingress, or IngressRoute anywhere references it (confirmed via grep).
- Add the immich.home.arpa and gluetun.home.arpa entries that existed in
values/pihole.yaml but were missing from values/pihole-debian.yaml --
Pi-hole has no wildcard DNS here, so every hostname must be listed in both.
Both files' hostname lists now match exactly (aside from the differing
target IPs, which is expected for primary vs. secondary).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Stage 1 of REFACTOR_PLAN.md. values/gitea.yaml and config/dashy/conf.yaml now
reference secrets injected at apply-time (gitea-postgres-secret.sh, .env) instead
of hardcoding a live DB password and weather API key in git. Both values must be
treated as compromised and rotated by the operator (see .env.example).
Also fixes authentik-ingress.yaml and traefik-dashboard-ingress.yaml, which
pointed at the internal-ca root ClusterIssuer instead of internal-ca-issuer,
the chained issuer every other internal Certificate uses -- causing untrusted-cert
warnings on the SSO login and Traefik dashboard.
Extends .gitignore for *.retry, .vault_pass*, kubeconfig patterns, and editor
swap files.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
feat: update qBittorrent deployment to expose gluetun API on port 8000 and add TLS certificate for secure access
feat: add gluetun DNS entry to Pi-hole configuration for improved network management
feat(gitea): create PersistentVolume and PersistentVolumeClaim for Gitea
feat(gitea): add script to create Gitea runner registration token secret
feat(gitea): deploy Gitea Actions runner with Docker socket access
feat(media): deploy JDownloader with Ingress configuration
feat(media): set up Jellyfin media server with NFS and Ingress
feat(media): configure qBittorrent deployment with Ingress
feat(monitoring): add Grafana Loki datasource ConfigMap
feat(monitoring): create Grafana admin credentials secret
feat(monitoring): define PersistentVolumes for monitoring stack
feat(network): implement DDNS CronJob for Porkbun DNS updates
feat(network): create secret for Porkbun DDNS API credentials
feat(network): set up Glances service and Ingress for Debian node
fix(network): patch Pi-hole DNS services with external IPs
feat(network): configure Traefik dashboard Ingress with Authentik auth
feat(network): set up Watch Party service and Ingress for Mac Mini
refactor(values): update Helm values files for various services
- Create .env.example for API credentials
- Update .gitignore to include .env file
- Add cluster issuer configurations for internal CA and Let's Encrypt
- Implement porkbun-secret.sh for creating Kubernetes secrets
- Define Helm values for cert-manager, Gitea, and Pihole with TLS settings
- Created ansible.cfg for configuration settings
- Added inventory.yml for host definitions
- Implemented bootstrap playbook for Minisforum setup
- Developed setup playbook for K3s installation
- Defined common role with user and package management tasks
- Established K3s server role with configuration and installation tasks
- Included Traefik Helm values for ingress management
