diff --git a/.gitea/workflows/homelab-main.yml b/.gitea/workflows/homelab-main.yml index 4ff874c..3c91dc7 100644 --- a/.gitea/workflows/homelab-main.yml +++ b/.gitea/workflows/homelab-main.yml @@ -16,12 +16,12 @@ jobs: find . -mindepth 1 -maxdepth 1 -exec rm -rf -- {} + git init - git remote add origin https://lab2025.duckdns.org/git/jv/my-homelab-configs.git + git remote add origin ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git git fetch --prune origin +refs/heads/main:refs/remotes/origin/main +refs/tags/*:refs/tags/* git checkout --force "${{ gitea.sha }}" git config --global --add safe.directory "$PWD" - - name: Block automatic deploy for Raspberry Pi Gitea changes + - name: Block automatic deploy for external Gitea changes run: | set -euo pipefail @@ -115,7 +115,7 @@ jobs: if [[ -n "${blocked_files}" ]]; then printf '%s\n' "${blocked_files}" - echo "Raspberry Pi Gitea service changes require a manual Debian run." + echo "External Gitea service changes require a manual Debian run." exit 1 fi diff --git a/README.md b/README.md index 529c528..0cf0b56 100644 --- a/README.md +++ b/README.md @@ -286,7 +286,7 @@ duplicate those PV manifests when you want storage on another node. `homelab.dev/workload-class=control-plane` on the Debian control plane - `homelab.dev/node-role=edge-app`, `homelab.dev/storage=local`, and `homelab.dev/workload-class=edge` on the Raspberry Pi worker -- `homelab.dev/node-role=app`, `homelab.dev/storage=nvme`, and +- `homelab.dev/node-role=app`, `homelab.dev/storage=ssd`, and `homelab.dev/workload-class=platform` on automated Pimox worker clones when those workers are enabled @@ -389,8 +389,8 @@ are clean, individual policies can be promoted to `Enforce` in `apps/supply-chain-policy` adds a separate Kyverno `ImageValidatingPolicy` for the images built by this repo and pushed to the local registry. The policy -targets `192.168.100.68:30500/php-website:*` and -`192.168.100.68:30500/demos-static:*`, mutates admitted pods to image digests, +targets `192.168.100.73:30500/php-website:*` and +`192.168.100.73:30500/demos-static:*`, mutates admitted pods to image digests, and audits whether the image has both: - a valid Cosign signature from the homelab signing key @@ -512,7 +512,7 @@ than a `/heimdall/` path. The `n8n` app runs in the `n8n` namespace with retained OpenEBS storage and is exposed at `https://n8n.lab2025.duckdns.org`. It receives -`OLLAMA_BASE_URL=http://192.168.100.68:11434` so workflows can call the existing +`OLLAMA_BASE_URL=http://192.168.100.73:11434` so workflows can call the existing Debian-host Ollama API for translation prewarming and batch jobs. The `arr-stack` app runs Prowlarr, Sonarr, Radarr, qBittorrent, Kapowarr, @@ -712,7 +712,7 @@ website image that points at it: ``` Ollama must also listen on the Debian host LAN address so Kubernetes pods on -other nodes can reach `OLLAMA_HOST=http://192.168.100.68:11434`: +other nodes can reach `OLLAMA_HOST=http://192.168.100.73:11434`: ```bash ./lab.sh website-ollama-listen @@ -746,7 +746,7 @@ immutable. The Kyverno supply-chain policy mutates admitted pods to the verified image digest, so the workload runs the same digest that was signed and attested. After `./lab.sh apps`, the live deployment image should be a content-hash tag, -for example `192.168.100.68:30500/php-website:src-...`. If it still shows +for example `192.168.100.73:30500/php-website:src-...`. If it still shows `php-website:latest`, Argo CD has not rendered the current Application source. Check the `website-production` Application source, sync status, and repository access before restarting pods. diff --git a/apps/demos-static/web-app.yaml b/apps/demos-static/web-app.yaml index 44e91c0..b92da5f 100644 --- a/apps/demos-static/web-app.yaml +++ b/apps/demos-static/web-app.yaml @@ -25,7 +25,7 @@ spec: fsGroupChangePolicy: OnRootMismatch containers: - name: demos-static - image: 192.168.100.68:30500/demos-static:latest + image: 192.168.100.73:30500/demos-static:latest imagePullPolicy: Always securityContext: allowPrivilegeEscalation: false diff --git a/apps/n8n/web-app.yaml b/apps/n8n/web-app.yaml index 5bc3ba6..85692cb 100644 --- a/apps/n8n/web-app.yaml +++ b/apps/n8n/web-app.yaml @@ -69,7 +69,7 @@ spec: - name: N8N_RUNNERS_ENABLED value: "true" - name: OLLAMA_BASE_URL - value: http://192.168.100.68:11434 + value: http://192.168.100.73:11434 ports: - containerPort: 5678 name: http diff --git a/apps/supply-chain-policy/local-registry-image-policy.yaml b/apps/supply-chain-policy/local-registry-image-policy.yaml index d3bf522..cb560c9 100644 --- a/apps/supply-chain-policy/local-registry-image-policy.yaml +++ b/apps/supply-chain-policy/local-registry-image-policy.yaml @@ -32,8 +32,8 @@ spec: resources: - pods matchImageReferences: - - glob: "192.168.100.68:30500/php-website:*" - - glob: "192.168.100.68:30500/demos-static:*" + - glob: "192.168.100.73:30500/php-website:*" + - glob: "192.168.100.73:30500/demos-static:*" validationConfigurations: mutateDigest: true required: true diff --git a/apps/website/Dockerfile b/apps/website/Dockerfile index 59513d0..c8dd538 100644 --- a/apps/website/Dockerfile +++ b/apps/website/Dockerfile @@ -86,7 +86,7 @@ RUN rm -f /var/www/localhost/htdocs/index.html && \ chmod 0755 /usr/local/bin/start-website ENV WEBSITE_LANG_WRITE_DIR=/var/www/localhost/htdocs/db/lang -ENV OLLAMA_HOST=http://192.168.100.68:11434 +ENV OLLAMA_HOST=http://192.168.100.73:11434 ENV OLLAMA_MODEL=website-translator USER apache diff --git a/apps/website/README.md b/apps/website/README.md index 83625f7..27abffc 100644 --- a/apps/website/README.md +++ b/apps/website/README.md @@ -64,7 +64,7 @@ translations back to Redis with a TTL, then returns results in the original order. The browser never calls the private Ollama address directly. n8n is deployed separately at `https://n8n.lab2025.duckdns.org` and receives -`OLLAMA_BASE_URL=http://192.168.100.68:11434` so workflows can prewarm +`OLLAMA_BASE_URL=http://192.168.100.73:11434` so workflows can prewarm translations or run batch jobs against the Debian-host Ollama API. ## Translation Observability diff --git a/apps/website/buildkitd.toml b/apps/website/buildkitd.toml index 8b92fa1..e0300e5 100644 --- a/apps/website/buildkitd.toml +++ b/apps/website/buildkitd.toml @@ -1,4 +1,4 @@ -[registry."192.168.100.68:30500"] +[registry."192.168.100.73:30500"] http = true insecure = true diff --git a/apps/website/homelab-tree.php b/apps/website/homelab-tree.php index 20074dc..105d8f8 100644 --- a/apps/website/homelab-tree.php +++ b/apps/website/homelab-tree.php @@ -181,7 +181,7 @@ $blogHref = 'blog.php?lang=' . urlencode($lang); Debian control plane - 192.168.100.68 + 192.168.100.73 diff --git a/apps/website/translate.php b/apps/website/translate.php index 5e81abb..c85d2ab 100644 --- a/apps/website/translate.php +++ b/apps/website/translate.php @@ -211,7 +211,7 @@ if (!$texts || count($texts) > 240 || $totalLength > 80000) { translate_response(400, ['error' => 'Invalid translation batch']); } -$ollamaHost = rtrim(getenv('OLLAMA_HOST') ?: 'http://192.168.100.68:11434', '/'); +$ollamaHost = rtrim(getenv('OLLAMA_HOST') ?: 'http://192.168.100.73:11434', '/'); $ollamaModel = getenv('OLLAMA_MODEL') ?: 'llama3.2:3b'; $cachePrefix = getenv('TRANSLATION_CACHE_PREFIX') ?: 'translation:v1'; $cacheKeys = []; diff --git a/apps/website/web-app.yaml b/apps/website/web-app.yaml index c6f14b4..3ecd56d 100644 --- a/apps/website/web-app.yaml +++ b/apps/website/web-app.yaml @@ -69,7 +69,7 @@ spec: - name: WEBSITE_IDEAS_WRITE_DIR value: /var/www/localhost/htdocs/db/ideas - name: OLLAMA_HOST - value: http://192.168.100.68:11434 + value: http://192.168.100.73:11434 - name: OLLAMA_MODEL value: website-translator - name: TRANSLATION_REDIS_HOST diff --git a/bootstrap/apps/variables.tf b/bootstrap/apps/variables.tf index 0d77486..f9798a5 100644 --- a/bootstrap/apps/variables.tf +++ b/bootstrap/apps/variables.tf @@ -10,7 +10,7 @@ variable "argocd_namespace" { variable "gitops_repo_url" { type = string - default = "ssh://git@192.168.100.89:32222/jv/my-homelab-configs.git" + default = "ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git" } variable "website_image_ref" { diff --git a/bootstrap/cluster/variables.tf b/bootstrap/cluster/variables.tf index 970a78d..1fe5860 100644 --- a/bootstrap/cluster/variables.tf +++ b/bootstrap/cluster/variables.tf @@ -14,7 +14,7 @@ variable "control_plane_node_labels" { variable "control_plane_advertise_address" { type = string - default = "192.168.100.68" + default = "192.168.100.73" } variable "pod_network_cidr" { @@ -34,7 +34,7 @@ variable "kubeconfig_owner" { variable "registry_endpoint" { type = string - default = "192.168.100.68:30500" + default = "192.168.100.73:30500" } variable "node_dns_servers" { diff --git a/bootstrap/platform/variables.tf b/bootstrap/platform/variables.tf index a937034..da0e5be 100644 --- a/bootstrap/platform/variables.tf +++ b/bootstrap/platform/variables.tf @@ -20,7 +20,7 @@ variable "calico_operator_node_name" { variable "gitops_repo_url" { type = string - default = "ssh://git@192.168.100.89:32222/jv/my-homelab-configs.git" + default = "ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git" } variable "gitops_ssh_key_path" { diff --git a/bootstrap/provisioning/README.md b/bootstrap/provisioning/README.md index 8152d60..93b5e9c 100644 --- a/bootstrap/provisioning/README.md +++ b/bootstrap/provisioning/README.md @@ -60,7 +60,7 @@ generates a unique fallback name using `TF_VAR_clone_hostname_prefix`. Create an arm64 VM in Pimox with UEFI firmware, a virtio disk, and a NIC on the same LAN as the Debian provisioning host. Put network boot first. -PXE should load `grubaa64.efi`, boot the Debian installer, fetch the preseed from `http://192.168.100.68:8088/preseed/debian13-arm64-worker.cfg`, and install the golden image. +PXE should load `grubaa64.efi`, boot the Debian installer, fetch the preseed from `http://192.168.100.73:8088/preseed/debian13-arm64-worker.cfg`, and install the golden image. If your Pimox firmware needs a different Debian arm64 EFI loader, override `TF_VAR_pxe_boot_file`. diff --git a/bootstrap/provisioning/variables.tf b/bootstrap/provisioning/variables.tf index 32094a7..fb0b1f9 100644 --- a/bootstrap/provisioning/variables.tf +++ b/bootstrap/provisioning/variables.tf @@ -1,6 +1,6 @@ variable "provisioning_host" { type = string - default = "192.168.100.68" + default = "192.168.100.73" } variable "provisioning_user" { @@ -29,7 +29,7 @@ variable "proxy_dhcp_range" { variable "http_host" { type = string - default = "192.168.100.68" + default = "192.168.100.73" } variable "http_port" { @@ -138,7 +138,7 @@ variable "kernel_cgroup_boot_options" { variable "registry_endpoint" { type = string - default = "192.168.100.68:30500" + default = "192.168.100.73:30500" } variable "node_dns_servers" { diff --git a/infra/gitea/README.md b/infra/gitea/README.md index b2d2e2e..4bb1683 100644 --- a/infra/gitea/README.md +++ b/infra/gitea/README.md @@ -32,7 +32,7 @@ Argo CD does not read from the Gitea SSH port. It reads from the Debian bare GitOps mirror through `gitops_repo_url`, normally: ```text -ssh://jv@192.168.100.68/home/jv/git-server/my-homelab-configs.git +ssh://jv@192.168.100.73/home/jv/git-server/my-homelab-configs.git ``` The platform bootstrap registers that repo secret and updates diff --git a/lab.sh b/lab.sh index dcae021..0447a9f 100755 --- a/lab.sh +++ b/lab.sh @@ -212,7 +212,7 @@ adopt_apps_existing_resources() { ensure_homelab_node_labels() { local control_plane_node="${LAB_CONTROL_PLANE_NODE_NAME:-debian}" local raspberry_node="${LAB_RASPBERRY_NODE_NAME:-raspberry}" - local prometheus_selector="homelab.dev/node-role=app,homelab.dev/storage=nvme" + local prometheus_selector="homelab.dev/node-role=app,homelab.dev/storage=ssd" local node local target_nodes @@ -236,7 +236,7 @@ ensure_homelab_node_labels() { if [[ "${node}" == pimox-worker-* ]]; then kubectl --kubeconfig "${KUBECONFIG_PATH}" label node "${node}" \ homelab.dev/node-role=app \ - homelab.dev/storage=nvme \ + homelab.dev/storage=ssd \ homelab.dev/workload-class=platform \ --overwrite elif [[ "${node}" == "${raspberry_node}" ]]; then @@ -813,7 +813,7 @@ write_cluster_worker_var_file() { LAB_RASPBERRY_NODE_NAME="${LAB_RASPBERRY_NODE_NAME:-raspberry}" \ LAB_RASPBERRY_SSH_KEY_PATH="${LAB_RASPBERRY_SSH_KEY_PATH:-/home/jv/.ssh/id_ed25519}" \ LAB_RASPBERRY_NODE_LABELS_JSON="${LAB_RASPBERRY_NODE_LABELS_JSON:-{\"node-role.kubernetes.io/worker\":\"worker\",\"homelab.dev/node-role\":\"edge-app\",\"homelab.dev/storage\":\"local\",\"homelab.dev/workload-class\":\"edge\"}}" \ - LAB_PIMOX_WORKER_NODE_LABELS_JSON="${LAB_PIMOX_WORKER_NODE_LABELS_JSON:-{\"node-role.kubernetes.io/worker\":\"worker\",\"homelab.dev/node-role\":\"app\",\"homelab.dev/storage\":\"nvme\",\"homelab.dev/workload-class\":\"platform\"}}" \ + LAB_PIMOX_WORKER_NODE_LABELS_JSON="${LAB_PIMOX_WORKER_NODE_LABELS_JSON:-{\"node-role.kubernetes.io/worker\":\"worker\",\"homelab.dev/node-role\":\"app\",\"homelab.dev/storage\":\"ssd\",\"homelab.dev/workload-class\":\"platform\"}}" \ python3 - "${spec_file}" "${var_file}" <<'PY' import json import os