home-network-k3s-impl

505 Commits 139 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
jakman85andClaude Opus 5	3f980d2a17	feat(env): tokenize hardcoded dev LAN addresses into cluster-vars (R-ENV-02) R-ENV-02 promises dev and prod differ ONLY by scoped cluster-vars overrides. In fact dev LAN addresses were hardcoded into base manifests, so clusters/prod would have come up ANNOUNCING DEV ADDRESSES (192.168.1.x) on the prod LAN (192.168.2.x). New cluster-vars knobs (base default = dev literal, per the file's existing convention): K3S_API_HOST platform/cilium/helmrelease.yaml (+ the values.yaml mirror) CILIUM_LB_POOL_START platform-config/cilium/l2-ip-pool.yaml CILIUM_LB_POOL_STOP " UNIFI_L4_VIP apps/vms/unifi/50-service-l4.yaml CRAFTY_L4_VIP platform/crafty/service-l4.yaml S3_BACKUP_ENDPOINT platform/keycloak/postgres-cluster.yaml, apps/wave-0/{nextcloud, semaphore}-db.yaml, and platform/velero/helmrelease.yaml Also fixes GATEWAY_VIP's base default, which was still the RETIRED libvirt address 10.73.0.240, and adds the GATEWAY_VIP patch that clusters/prod was missing entirely. clusters/base/apps-vms.yaml gains postBuild.substituteFrom (it was the one consuming Kustomization without it, so a ${TOKEN} there would have shipped as a literal string). The envsubst contract is documented there: ${VAR} substitutes and escapes as $${VAR}; $VAR and $(cmd) are left alone; ${ARR[0]} hard-errors. The three UOS_URL expansions in the unifi cloud-init are escaped accordingly. PROD ADDRESS PLAN (operator, 2026-08-31): nodes .10/.11/.12 · control-plane VIP .9 (Ansible-side) · GATEWAY_VIP .20 Cilium LB pool .20-.30 CONTAINMENT INVARIANT, now documented at the pool and in the prod overlay: GATEWAY_VIP MUST equal CILIUM_LB_POOL_START. The shared Gateway pins no address, so Cilium LB-IPAM gives it the first free address of a matching pool block. An initial prod proposal put .20 outside a .21-.30 pool; the Gateway would have come up on .21 while split-horizon coredns-custom kept answering .home.keithjackson.dev with .20 — an address nothing announces — blackholing in-cluster OIDC hairpin traffic while reporting healthy. The pool was widened to .20-.30. The control-plane VIP (.9) stays outside the pool so kube-vip and LB-IPAM can never contend. Values prod still cannot know stay INVALID `TBD-PROD-` placeholders on purpose: base defaults are dev values, so an omitted patch means prod silently inherits a dev address — far worse than a loud failed apply. DEV IS BYTE-IDENTICAL. Verified by kustomize build over 13 paths before/after, then flux envsubst with the dev cluster-vars values applied to both sides: zero drift. The only deltas are the intended additive keys in the overlay ConfigMap itself. No unresolved ${TOKEN} survives. render-golden green (10 goldens); yamllint clean. Serves: R-ENV-02. Task: T-7.1 (prerequisite). Gate: MERGE GATE: PASS. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>	2026-08-31 22:43:36 -05:00
jakman85andClaude Opus 4.8	d1248e6778	feat(backup): wire Velero + CNPG Barman to the live MinIO S3 target Author the GitOps side of off-cluster backups against the on-Proxmox MinIO (http://192.168.1.9:9000, path-style; buckets velero + cnpg). Velero (R-STATE-03): - HelmRelease (chart 8.x / Velero 1.15) + velero-plugin-for-aws init container + node-agent kopia File System Backup (deployNodeAgent, uploaderType=kopia, snapshotsEnabled=false). BSL default -> bucket velero, s3ForcePathStyle. - Two daily Schedules: `daily` backs up the whole cluster's resources+PVC data (defaultVolumesToFsBackup opt-out) EXCEPT monitoring+unifi; `daily-resources-only` captures monitoring+unifi RESOURCES only (Prometheus TSDB, Loki 72h logs, and the ~7.4GiB UniFi VM disk are reconstructable — excluded from volume backup). - velero-cloud-credentials SOPS Secret (cloud INI key, ns velero). - Own non-gating Flux tier clusters/base/backup.yaml (dependsOn platform-config, wait:false) + clusters/dev SOPS decryption patch — mirrors headlamp. CNPG native Barman PITR (R-IDP-05 / R-STATE-03): - keycloak-db, nextcloud-db, semaphore-db gain spec.backup.barmanObjectStore (s3://cnpg/<cluster>, endpointURL MinIO, gzip WAL+data, 30d retention) + a daily ScheduledBackup (6-field cron, immediate) each. - Per-namespace scoped-key SOPS Secrets (<db>-backup-credentials), same-ns only. - render.py: emit-waves now recognizes <svc>-db-backup-credentials.sops.yaml as a DB-wave sidecar (+ self-test); wave-0 kustomization regenerated. Creds mirror platform/backup/minio-credentials.sops.yaml (scoped key k3s-backup), SOPS round-trip verified with the cluster age key. gate: green. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-08-28 22:37:17 -05:00
jakman85andClaude Opus 4.8	af4f6c07ae	T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01) Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-08-16 00:08:31 -05:00

Author

SHA1

Message

Date

jakman85andClaude Opus 5

3f980d2a17

feat(env): tokenize hardcoded dev LAN addresses into cluster-vars (R-ENV-02)

R-ENV-02 promises dev and prod differ ONLY by scoped cluster-vars overrides. In fact
dev LAN addresses were hardcoded into base manifests, so clusters/prod would have come
up ANNOUNCING DEV ADDRESSES (192.168.1.x) on the prod LAN (192.168.2.x).

New cluster-vars knobs (base default = dev literal, per the file's existing convention):
  K3S_API_HOST          platform/cilium/helmrelease.yaml (+ the values.yaml mirror)
  CILIUM_LB_POOL_START  platform-config/cilium/l2-ip-pool.yaml
  CILIUM_LB_POOL_STOP   "
  UNIFI_L4_VIP          apps/vms/unifi/50-service-l4.yaml
  CRAFTY_L4_VIP         platform/crafty/service-l4.yaml
  S3_BACKUP_ENDPOINT    platform/keycloak/postgres-cluster.yaml, apps/wave-0/{nextcloud,
                        semaphore}-db.yaml, and platform/velero/helmrelease.yaml

Also fixes GATEWAY_VIP's base default, which was still the RETIRED libvirt address
10.73.0.240, and adds the GATEWAY_VIP patch that clusters/prod was missing entirely.

clusters/base/apps-vms.yaml gains postBuild.substituteFrom (it was the one consuming
Kustomization without it, so a ${TOKEN} there would have shipped as a literal string).
The envsubst contract is documented there: ${VAR} substitutes and escapes as $${VAR};
$VAR and $(cmd) are left alone; ${ARR[0]} hard-errors. The three UOS_URL expansions in
the unifi cloud-init are escaped accordingly.

PROD ADDRESS PLAN (operator, 2026-08-31):
  nodes .10/.11/.12 · control-plane VIP .9 (Ansible-side) · GATEWAY_VIP .20
  Cilium LB pool .20-.30

CONTAINMENT INVARIANT, now documented at the pool and in the prod overlay: GATEWAY_VIP
MUST equal CILIUM_LB_POOL_START. The shared Gateway pins no address, so Cilium LB-IPAM
gives it the first free address of a matching pool block. An initial prod proposal put
.20 outside a .21-.30 pool; the Gateway would have come up on .21 while split-horizon
coredns-custom kept answering *.home.keithjackson.dev with .20 — an address nothing
announces — blackholing in-cluster OIDC hairpin traffic while reporting healthy. The
pool was widened to .20-.30. The control-plane VIP (.9) stays outside the pool so
kube-vip and LB-IPAM can never contend.

Values prod still cannot know stay INVALID `TBD-PROD-*` placeholders on purpose: base
defaults are dev values, so an omitted patch means prod silently inherits a dev address
— far worse than a loud failed apply.

DEV IS BYTE-IDENTICAL. Verified by kustomize build over 13 paths before/after, then
flux envsubst with the dev cluster-vars values applied to both sides: zero drift. The
only deltas are the intended additive keys in the overlay ConfigMap itself. No
unresolved ${TOKEN} survives. render-golden green (10 goldens); yamllint clean.

Serves: R-ENV-02. Task: T-7.1 (prerequisite). Gate: MERGE GATE: PASS.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

2026-08-31 22:43:36 -05:00

jakman85andClaude Opus 4.8

d1248e6778

feat(backup): wire Velero + CNPG Barman to the live MinIO S3 target

Author the GitOps side of off-cluster backups against the on-Proxmox MinIO
(http://192.168.1.9:9000, path-style; buckets velero + cnpg).

Velero (R-STATE-03):
- HelmRelease (chart 8.x / Velero 1.15) + velero-plugin-for-aws init container +
  node-agent kopia File System Backup (deployNodeAgent, uploaderType=kopia,
  snapshotsEnabled=false). BSL default -> bucket velero, s3ForcePathStyle.
- Two daily Schedules: `daily` backs up the whole cluster's resources+PVC data
  (defaultVolumesToFsBackup opt-out) EXCEPT monitoring+unifi; `daily-resources-only`
  captures monitoring+unifi RESOURCES only (Prometheus TSDB, Loki 72h logs, and the
  ~7.4GiB UniFi VM disk are reconstructable — excluded from volume backup).
- velero-cloud-credentials SOPS Secret (cloud INI key, ns velero).
- Own non-gating Flux tier clusters/base/backup.yaml (dependsOn platform-config,
  wait:false) + clusters/dev SOPS decryption patch — mirrors headlamp.

CNPG native Barman PITR (R-IDP-05 / R-STATE-03):
- keycloak-db, nextcloud-db, semaphore-db gain spec.backup.barmanObjectStore
  (s3://cnpg/<cluster>, endpointURL MinIO, gzip WAL+data, 30d retention) + a daily
  ScheduledBackup (6-field cron, immediate) each.
- Per-namespace scoped-key SOPS Secrets (<db>-backup-credentials), same-ns only.
- render.py: emit-waves now recognizes <svc>-db-backup-credentials.sops.yaml as a
  DB-wave sidecar (+ self-test); wave-0 kustomization regenerated.

Creds mirror platform/backup/minio-credentials.sops.yaml (scoped key k3s-backup),
SOPS round-trip verified with the cluster age key. gate: green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-08-28 22:37:17 -05:00

jakman85andClaude Opus 4.8

af4f6c07ae

T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-08-16 00:08:31 -05:00