jv
/
my-homelab-configs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update debian ip

This commit is contained in:
juvdiaz 2026-06-26 22:50:19 -06:00
parent 2f290b8ce2
commit 84b60979f2
18 changed files with 31 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
.gitea/workflows/homelab-main.yml
View File

@ -16,12 +16,12 @@ jobs:
find . -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
git init
git remote add origin https://lab2025.duckdns.org/git/jv/my-homelab-configs.git
git remote add origin ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git
git fetch --prune origin +refs/heads/main:refs/remotes/origin/main +refs/tags/*:refs/tags/*
git checkout --force "${{ gitea.sha }}"
git config --global --add safe.directory "$PWD"
- name: Block automatic deploy for Raspberry Pi Gitea changes
- name: Block automatic deploy for external Gitea changes
run: |
set -euo pipefail
@ -115,7 +115,7 @@ jobs:
if [[ -n "${blocked_files}" ]]; then
printf '%s\n' "${blocked_files}"
echo "Raspberry Pi Gitea service changes require a manual Debian run."
echo "External Gitea service changes require a manual Debian run."
exit 1
fi

12
README.md
View File

@ -286,7 +286,7 @@ duplicate those PV manifests when you want storage on another node.
`homelab.dev/workload-class=control-plane` on the Debian control plane
- `homelab.dev/node-role=edge-app`, `homelab.dev/storage=local`, and
`homelab.dev/workload-class=edge` on the Raspberry Pi worker
- `homelab.dev/node-role=app`, `homelab.dev/storage=nvme`, and
- `homelab.dev/node-role=app`, `homelab.dev/storage=ssd`, and
`homelab.dev/workload-class=platform` on automated Pimox worker clones when
those workers are enabled
@ -389,8 +389,8 @@ are clean, individual policies can be promoted to `Enforce` in
`apps/supply-chain-policy` adds a separate Kyverno `ImageValidatingPolicy` for
the images built by this repo and pushed to the local registry. The policy
targets `192.168.100.68:30500/php-website:*` and
`192.168.100.68:30500/demos-static:*`, mutates admitted pods to image digests,
targets `192.168.100.73:30500/php-website:*` and
`192.168.100.73:30500/demos-static:*`, mutates admitted pods to image digests,
and audits whether the image has both:
- a valid Cosign signature from the homelab signing key
@ -512,7 +512,7 @@ than a `/heimdall/` path.
The `n8n` app runs in the `n8n` namespace with retained OpenEBS storage and is
exposed at `https://n8n.lab2025.duckdns.org`. It receives
`OLLAMA_BASE_URL=http://192.168.100.68:11434` so workflows can call the existing
`OLLAMA_BASE_URL=http://192.168.100.73:11434` so workflows can call the existing
Debian-host Ollama API for translation prewarming and batch jobs.
The `arr-stack` app runs Prowlarr, Sonarr, Radarr, qBittorrent, Kapowarr,
@ -712,7 +712,7 @@ website image that points at it:
```
Ollama must also listen on the Debian host LAN address so Kubernetes pods on
other nodes can reach `OLLAMA_HOST=http://192.168.100.68:11434`:
other nodes can reach `OLLAMA_HOST=http://192.168.100.73:11434`:
```bash
./lab.sh website-ollama-listen
@ -746,7 +746,7 @@ immutable. The Kyverno supply-chain policy mutates admitted pods to the verified
image digest, so the workload runs the same digest that was signed and attested.
After `./lab.sh apps`, the live deployment image should be a content-hash tag,
for example `192.168.100.68:30500/php-website:src-...`. If it still shows
for example `192.168.100.73:30500/php-website:src-...`. If it still shows
`php-website:latest`, Argo CD has not rendered the current Application source.
Check the `website-production` Application source, sync status, and repository
access before restarting pods.

2
apps/demos-static/web-app.yaml
View File

@ -25,7 +25,7 @@ spec:
fsGroupChangePolicy: OnRootMismatch
containers:
- name: demos-static
image: 192.168.100.68:30500/demos-static:latest
image: 192.168.100.73:30500/demos-static:latest
imagePullPolicy: Always
securityContext:
allowPrivilegeEscalation: false

2
apps/n8n/web-app.yaml
View File

@ -69,7 +69,7 @@ spec:
- name: N8N_RUNNERS_ENABLED
value: "true"
- name: OLLAMA_BASE_URL
value: http://192.168.100.68:11434
value: http://192.168.100.73:11434
ports:
- containerPort: 5678
name: http

4
apps/supply-chain-policy/local-registry-image-policy.yaml
View File

@ -32,8 +32,8 @@ spec:
resources:
- pods
matchImageReferences:
- glob: "192.168.100.68:30500/php-website:*"
- glob: "192.168.100.68:30500/demos-static:*"
- glob: "192.168.100.73:30500/php-website:*"
- glob: "192.168.100.73:30500/demos-static:*"
validationConfigurations:
mutateDigest: true
required: true

2
apps/website/Dockerfile
View File

@ -86,7 +86,7 @@ RUN rm -f /var/www/localhost/htdocs/index.html && \
chmod 0755 /usr/local/bin/start-website
ENV WEBSITE_LANG_WRITE_DIR=/var/www/localhost/htdocs/db/lang
ENV OLLAMA_HOST=http://192.168.100.68:11434
ENV OLLAMA_HOST=http://192.168.100.73:11434
ENV OLLAMA_MODEL=website-translator
USER apache

2
apps/website/README.md
View File

@ -64,7 +64,7 @@ translations back to Redis with a TTL, then returns results in the original
order. The browser never calls the private Ollama address directly.
n8n is deployed separately at `https://n8n.lab2025.duckdns.org` and receives
`OLLAMA_BASE_URL=http://192.168.100.68:11434` so workflows can prewarm
`OLLAMA_BASE_URL=http://192.168.100.73:11434` so workflows can prewarm
translations or run batch jobs against the Debian-host Ollama API.
## Translation Observability

2
apps/website/buildkitd.toml
View File

@ -1,4 +1,4 @@
[registry."192.168.100.68:30500"]
[registry."192.168.100.73:30500"]
http = true
insecure = true

2
apps/website/homelab-tree.php
View File

@ -181,7 +181,7 @@ $blogHref = 'blog.php?lang=' . urlencode($lang);
<rect class="tree-trunk" x="468" y="650" width="104" height="142" rx="12"></rect>
<text class="tree-trunk-text" x="520" y="700">Debian</text>
<text class="tree-trunk-text tree-small" x="520" y="722">control plane</text>
<text class="tree-trunk-text tree-small" x="520" y="744">192.168.100.68</text>
<text class="tree-trunk-text tree-small" x="520" y="744">192.168.100.73</text>
<path class="tree-root" d="M520 790 C456 814 390 822 310 822"></path>
<path class="tree-root" d="M520 790 C584 816 660 824 740 822"></path>

2
apps/website/translate.php
View File

@ -211,7 +211,7 @@ if (!$texts || count($texts) > 240 || $totalLength > 80000) {
translate_response(400, ['error' => 'Invalid translation batch']);
}
$ollamaHost = rtrim(getenv('OLLAMA_HOST') ?: 'http://192.168.100.68:11434', '/');
$ollamaHost = rtrim(getenv('OLLAMA_HOST') ?: 'http://192.168.100.73:11434', '/');
$ollamaModel = getenv('OLLAMA_MODEL') ?: 'llama3.2:3b';
$cachePrefix = getenv('TRANSLATION_CACHE_PREFIX') ?: 'translation:v1';
$cacheKeys = [];

2
apps/website/web-app.yaml
View File

@ -69,7 +69,7 @@ spec:
- name: WEBSITE_IDEAS_WRITE_DIR
value: /var/www/localhost/htdocs/db/ideas
- name: OLLAMA_HOST
value: http://192.168.100.68:11434
value: http://192.168.100.73:11434
- name: OLLAMA_MODEL
value: website-translator
- name: TRANSLATION_REDIS_HOST

2
bootstrap/apps/variables.tf
View File

@ -10,7 +10,7 @@ variable "argocd_namespace" {
variable "gitops_repo_url" {
type = string
default = "ssh://git@192.168.100.89:32222/jv/my-homelab-configs.git"
default = "ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git"
}
variable "website_image_ref" {

4
bootstrap/cluster/variables.tf
View File

@ -14,7 +14,7 @@ variable "control_plane_node_labels" {
variable "control_plane_advertise_address" {
type = string
default = "192.168.100.68"
default = "192.168.100.73"
}
variable "pod_network_cidr" {
@ -34,7 +34,7 @@ variable "kubeconfig_owner" {
variable "registry_endpoint" {
type = string
default = "192.168.100.68:30500"
default = "192.168.100.73:30500"
}
variable "node_dns_servers" {

2
bootstrap/platform/variables.tf
View File

@ -20,7 +20,7 @@ variable "calico_operator_node_name" {
variable "gitops_repo_url" {
type = string
default = "ssh://git@192.168.100.89:32222/jv/my-homelab-configs.git"
default = "ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git"
}
variable "gitops_ssh_key_path" {

2
bootstrap/provisioning/README.md
View File

@ -60,7 +60,7 @@ generates a unique fallback name using `TF_VAR_clone_hostname_prefix`.
Create an arm64 VM in Pimox with UEFI firmware, a virtio disk, and a NIC on the same LAN as the Debian provisioning host. Put network boot first.
PXE should load `grubaa64.efi`, boot the Debian installer, fetch the preseed from `http://192.168.100.68:8088/preseed/debian13-arm64-worker.cfg`, and install the golden image.
PXE should load `grubaa64.efi`, boot the Debian installer, fetch the preseed from `http://192.168.100.73:8088/preseed/debian13-arm64-worker.cfg`, and install the golden image.
If your Pimox firmware needs a different Debian arm64 EFI loader, override `TF_VAR_pxe_boot_file`.

6
bootstrap/provisioning/variables.tf
View File

@ -1,6 +1,6 @@
variable "provisioning_host" {
type = string
default = "192.168.100.68"
default = "192.168.100.73"
}
variable "provisioning_user" {
@ -29,7 +29,7 @@ variable "proxy_dhcp_range" {
variable "http_host" {
type = string
default = "192.168.100.68"
default = "192.168.100.73"
}
variable "http_port" {
@ -138,7 +138,7 @@ variable "kernel_cgroup_boot_options" {
variable "registry_endpoint" {
type = string
default = "192.168.100.68:30500"
default = "192.168.100.73:30500"
}
variable "node_dns_servers" {

2
infra/gitea/README.md
View File

@ -32,7 +32,7 @@ Argo CD does not read from the Gitea SSH port. It reads from the
Debian bare GitOps mirror through `gitops_repo_url`, normally:
```text
ssh://jv@192.168.100.68/home/jv/git-server/my-homelab-configs.git
ssh://jv@192.168.100.73/home/jv/git-server/my-homelab-configs.git
```
The platform bootstrap registers that repo secret and updates

6
lab.sh
View File

@ -212,7 +212,7 @@ adopt_apps_existing_resources() {
ensure_homelab_node_labels() {
local control_plane_node="${LAB_CONTROL_PLANE_NODE_NAME:-debian}"
local raspberry_node="${LAB_RASPBERRY_NODE_NAME:-raspberry}"
local prometheus_selector="homelab.dev/node-role=app,homelab.dev/storage=nvme"
local prometheus_selector="homelab.dev/node-role=app,homelab.dev/storage=ssd"
local node
local target_nodes
@ -236,7 +236,7 @@ ensure_homelab_node_labels() {
if [[ "${node}" == pimox-worker-* ]]; then
kubectl --kubeconfig "${KUBECONFIG_PATH}" label node "${node}" \
homelab.dev/node-role=app \
homelab.dev/storage=nvme \
homelab.dev/storage=ssd \
homelab.dev/workload-class=platform \
--overwrite
elif [[ "${node}" == "${raspberry_node}" ]]; then
@ -813,7 +813,7 @@ write_cluster_worker_var_file() {
LAB_RASPBERRY_NODE_NAME="${LAB_RASPBERRY_NODE_NAME:-raspberry}" \
LAB_RASPBERRY_SSH_KEY_PATH="${LAB_RASPBERRY_SSH_KEY_PATH:-/home/jv/.ssh/id_ed25519}" \
LAB_RASPBERRY_NODE_LABELS_JSON="${LAB_RASPBERRY_NODE_LABELS_JSON:-{\"node-role.kubernetes.io/worker\":\"worker\",\"homelab.dev/node-role\":\"edge-app\",\"homelab.dev/storage\":\"local\",\"homelab.dev/workload-class\":\"edge\"}}" \
LAB_PIMOX_WORKER_NODE_LABELS_JSON="${LAB_PIMOX_WORKER_NODE_LABELS_JSON:-{\"node-role.kubernetes.io/worker\":\"worker\",\"homelab.dev/node-role\":\"app\",\"homelab.dev/storage\":\"nvme\",\"homelab.dev/workload-class\":\"platform\"}}" \
LAB_PIMOX_WORKER_NODE_LABELS_JSON="${LAB_PIMOX_WORKER_NODE_LABELS_JSON:-{\"node-role.kubernetes.io/worker\":\"worker\",\"homelab.dev/node-role\":\"app\",\"homelab.dev/storage\":\"ssd\",\"homelab.dev/workload-class\":\"platform\"}}" \
python3 - "${spec_file}" "${var_file}" <<'PY'
import json
import os