dce4fa6022
Edge matrix vhost, node-exporter scrape, arr/rpi refinements
...
- bootstrap/edge: add matrix-vhost template + matrix.conf mount
(isolated cert path), config_hash includes matrix.conf so tofu
regenerates edge config when it changes; add node-exporter sidecar
- bootstrap/platform: prometheus additionalScrapeConfigs for rpi-node
and oci-edge-node targets, plus node-exporter edge port 9100
- apps/homelab-alerts: host filesystem >85% alert
- infra/arr-stack + rpi-services: compose refinements
- .gitignore: ignore tofu tfstate backups (*.tfstate.*.backup)
2026-09-16 11:37:35 -05:00
fe661f9b24
Add Matrix/Hermes/Omniroute to jeannie pipeline (SOPS-encrypted secrets)
...
Codify the full Matrix homeserver stack, OmniRoute LLM gateway, and
Hermes agent into the Jeannie deploy pipeline so the repo reproduces
the running homelab from scratch.
New files:
infra/matrix-server/ — Synapse + Postgres + Element docker-compose,
homeserver.yaml.tpl, log_config, element config, bootstrap.sh
infra/omniroute/ — diegosouzapw/omniroute:latest on port 20128
infra/hermes.secret.yaml — SOPS-encrypted bot password + API key
infra/matrix-server/matrix.secret.yaml — SOPS-encrypted Synapse secrets
.sops.yaml — age recipient + encrypted_regex: '.*'
jeannie additions:
deploy_matrix() — renders homeserver.yaml from template, creates
signing key via 'generate' on first boot, delegates to bootstrap.sh
deploy_omniroute() — docker compose up with env-file support
deploy_hermes() — git clone + venv + 'hermes gateway install',
writes ~/.hermes/.env (mode 600), registers non-admin bot via
shared-secret CLI, idempotent
sops_load_secrets() — decrypts *.secret.yaml via age key at deploy
time; fails loudly if the age key is missing
ensure_sops_age_tools() — installs sops from getsops GitHub release
when apt has no sops package (Debian trixie)
DAG: hermes-deploy depends on matrix-deploy + omniroute-deploy.
Root cause: deploy_hermes previously used wrong entrypoint (python
module instead of ./hermes launcher); generate was called with
--generate-config (invalid subcommand); .sops.yaml encrypted_regex
'^password$' left prefixed keys as plaintext — all fixed in this
commit.
2026-09-16 11:37:13 -05:00
d6e33250f4
Gates for pimoc workers with less than 2 cpus
2026-07-23 13:16:11 -06:00
fb605ffa8b
Increase argocd limits
2026-07-23 11:32:23 -06:00
6277dfb5d2
Confir what argo is watching
2026-07-22 23:31:10 -06:00
005a3c4b84
Make helm do not block
2026-07-22 23:10:11 -06:00
101668fbc9
Fixes stale state in tofu
2026-07-22 22:35:23 -06:00
318ba53eb0
Fixes stale helm
2026-07-22 22:22:54 -06:00
0d05159054
Fix apt interpolation
2026-07-22 22:11:57 -06:00
9df2dd0fd4
Making apt cms ricker in pimox workers
2026-07-22 22:07:17 -06:00
a47f4b56e9
Using dedicated known host file for ephemeral pimox workers
2026-07-22 21:43:36 -06:00
1f94eebca2
Fixing terraform error
2026-07-22 21:32:24 -06:00
53e7fbd228
Failing faster on no ip for pimox template
2026-07-22 21:17:33 -06:00
7c0936d889
Fixing pimox template ip
2026-07-22 20:42:19 -06:00
58af55e7e0
Fixing pimox worker seen one cpu instead of two
2026-07-22 19:09:55 -06:00
de990cdfb3
adding platform agument
2026-07-02 21:38:48 -06:00
7a0a54b60b
untrim srgocd after adding 2nd worker
2026-07-02 21:20:14 -06:00
8c07e3f27b
wait on iptables lock
2026-07-02 21:02:49 -06:00
41db105b8b
disabling dex in argo
2026-07-02 20:38:52 -06:00
d5458a3482
Limit diagnostic to failed component
2026-07-02 20:21:31 -06:00
1e63d0cbc8
Fixing k8s api timing
2026-07-02 19:26:43 -06:00
12cde3acac
Fixing k8s api timing
2026-07-02 17:40:50 -06:00
8bc44edaf8
Adding limits
2026-07-02 17:32:25 -06:00
acc88d1ca6
Heimdall seeds
2026-07-02 16:56:56 -06:00
140fc63a5f
Moving heimdall outside k8s
2026-07-02 15:49:00 -06:00
36126132db
Adding k8s metrics server
2026-07-02 13:38:21 -06:00
ddc971f6df
Adding tailscaed route for debian host
2026-07-02 13:13:37 -06:00
6cf5abe8bd
fixig ailscaled routes
2026-07-02 13:04:11 -06:00
7f851ccfa2
Updated cert check to fallback to /git/
2026-07-02 12:58:26 -06:00
8f168fde83
Add certbot retries
2026-07-02 12:46:36 -06:00
8865ab9d18
Adding haproxy pass as secret managed in pipeline
2026-07-02 12:42:46 -06:00
d278355d68
exportin inventory vars
2026-07-02 12:38:47 -06:00
ffef3386c6
rewrite apt sources as https
2026-07-02 12:11:11 -06:00
f041cf2aba
Updating preflights
2026-07-02 11:42:31 -06:00
db6035e75f
fix kubeconfig missing
2026-07-02 11:33:57 -06:00
364c028315
fixing kubeadm create
2026-07-02 11:24:13 -06:00
77e31bba0b
fixing PATH in pimox worker
2026-07-02 11:12:57 -06:00
cfcfc39f1f
Install iptables if missing
2026-07-02 10:59:58 -06:00
540ae7e486
Fixing pimox worker having 2 ips
2026-07-02 10:26:19 -06:00
d7d83bef6a
worker SSH uses a dedicated known host file
2026-07-02 10:05:50 -06:00
04d5b259c0
Update docker root dir in rpi
2026-07-02 09:02:52 -06:00
06941a8454
Repair Pimox worker SSH readiness
2026-07-01 19:33:23 -06:00
349ffd006e
Default cluster workers to Pimox only
2026-07-01 19:12:37 -06:00
21adbd5628
Rebuild cluster worker vars for static Pimox workers
2026-07-01 18:57:40 -06:00
86ac132629
Fix Pimox worker static networking
2026-07-01 18:41:29 -06:00
e8b9b57d77
Restore known-good Pimox worker defaults
2026-07-01 14:49:25 -06:00
d80960fce0
Reduce duplicate Jeannie progress repaints
2026-07-01 14:27:42 -06:00
0cda6573ad
Let Pimox generate worker NIC MACs by default
2026-07-01 14:05:11 -06:00
ed0983d09a
Run independent Jeannie up tasks in parallel
2026-07-01 14:01:58 -06:00
ea4576c707
Stream Jeannie step output to logs
2026-07-01 13:49:02 -06:00
jv
juvenal.diaz