oskar/homelab-codex-ws
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity
homelab-codex-ws/inventory/topology.yaml

118 lines
3.3 KiB
YAML
Raw Normal View History

Add topology inventory foundation
2026-05-10 22:05:16 +02:00
topology:
mesh: tailscale
git_provider: forgejo
deployment:
mode: pull
orchestrator: saturn
docs(sesja): kapala.org → Cloudflare wildcard DNS-01, HA i Immich na mesh Sesja 2026-06-30: migracja DNS kapala.org z 42.pl na Cloudflare, wildcard *.kapala.org przez DNS-01, ha/immich.kapala.org przez NPM@PIHA mesh-only. - nowy session log z root-cause buga "unrecognized name" (NPM duplikuje proxy_http_version przy Websockets ON) + wzorzec migracji usługi na mesh - backlog: gotchas (NPM WS config, CF auto-proxy DKIM) + TODO (migracja okit.pl, foty renew, cleanup ha-ken add-on, stale ha.okit.pl) - topology: nowa sekcja ingress (ha/immich → NPM@PIHA, wildcard cert) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-30 16:23:57 +02:00
# Ingress dla usług domowych przez NPM @ PIHA + wildcard cert kapala.org.
# Od 2026-06-30. Poprzednia ścieżka (add-on Tailscale na ha-ken) PORZUCONA.
# DNS kapala.org: Cloudflare, wildcard *.kapala.org via DNS-01 (auto-renew).
# Mail: Fastmail (MX/DKIM/SPF na CF, DNS only).
# Subdomeny mesh: A → 100.108.208.3 (Tailscale PIHA), DNS only.
ingress:
dns_provider: cloudflare # kapala.org od 2026-06-30
wildcard_cert:
domain: "*.kapala.org"
method: dns-01 # Cloudflare DNS-01, auto-renew
proxy: npm-piha # Nginx Proxy Manager @ PIHA
services:
home_assistant:
host: 192.168.31.7
port: 8123
ingress: ha.kapala.org # NPM @ PIHA, cert *.kapala.org, mesh-only
access: tailscale # 100.108.208.3
cert: wildcard-kapala # DNS-01 Cloudflare, auto-renew
immich:
host: 192.168.31.5
port: 2283
ingress: immich.kapala.org # NPM @ PIHA, cert *.kapala.org, mesh-only
access: tailscale
cert: wildcard-kapala
Add topology inventory foundation
2026-05-10 22:05:16 +02:00
nodes:
saturn:
roles:
- control
- development
piha:
roles:
- infra
- monitoring
feat(piha): brain-watchdog — external watchdog for control-plane Polls /summary on VPS over Tailscale every 60s; computes freshness locally from last_update epoch (never trusts self-reported status). Alerts via Telegram Bot API directly after 3 consecutive failures; sends recovery message on heal. State (fail_count, alerted) persisted to volume so debounce survives restarts. - services/brain-watchdog/: Python service, no external deps (stdlib only) - hosts/piha/runtime/brain-watchdog/: override with mem_limit 64m - hosts/piha/services.yaml + inventory/topology.yaml: manifest entries Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-01 17:54:36 +02:00
services:
- node-agent
- ha-diag-agent
- brain-watchdog
feat(vikunja): bring PIHA Vikunja under GitOps (postgres + Forgejo OIDC) Wraps the existing manually-run Vikunja instance on PIHA in the standard service layout. No deploy — definition only, for review. - services/vikunja/: docker-compose.yml (vikunja + postgres:16-alpine), service.yaml, README, healthcheck, config.yml (OIDC, secret-free), .env.example. Real .env stays gitignored. - Pins EXISTING named volumes (vikunja_vikunja_db, vikunja_vikunja_files) so DB + uploaded files survive cutover. - extra_hosts forgejo.okit.pl=192.168.31.5 (npm on PIHA) so OIDC discovery resolves over LAN instead of flaky public DNS. - OIDC client secret injected via env (VIKUNJA_AUTH_OPENID_PROVIDERS_ FORGEJO_CLIENTSECRET); config.yml keeps trailing-slash authurl/redirecturl. - Registers vikunja in hosts/piha/services.yaml + inventory/topology.yaml, plus hosts/piha/runtime/vikunja override (advisory mem_limits). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-17 15:02:37 +02:00
- vikunja # Task management (vikunja + postgres), public via npm
refactor(kb-postgres): relokacja SOLARIA→PIHA — arm64, mem_limit 1g, tuning pod małą maszynę Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-22 19:59:58 +02:00
- kb-postgres # KB spine: Postgres 16 + pgvector, port 5433 (always-on)
feat(llm-gateway): wciagniecie shadow-serwisu z PIHA do GitOps Kod zyl tylko na dysku PIHA w /opt/llm-gateway (bez gita). Przeniesiony do services/llm-gateway/ pod pelny wzorzec homelaba: - app/main.py: kod 1:1 z PIHA + OLLAMA_URL/CHAT_MODEL/CODE_MODEL nadpisywalne przez env (defaulty bez zmian) - docker-compose.yml: bind TYLKO do Tailscale IP (${TAILSCALE_BIND_IP}, wzorzec fleet-prometheus), nie 0.0.0.0 jak w starym compose - service.yaml, env.example (bez sekretow), healthcheck.sh, README, testy - hosts/piha/runtime/llm-gateway: mem_limit 256m (PIHA jest RAM-bound) - rejestracja w hosts/piha/services.yaml i inventory/topology.yaml Zepsuty /opt/llm-gateway/docker-compose.yml (zduplikowany klucz ports) celowo NIE przeniesiony. DoD: pytest 4 passed; docker build + smoke run OK (GET / -> gateway ok). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 13:41:44 +02:00
- llm-gateway # FastAPI router -> Ollama @ SOLARIA (Tailscale-internal :8080)
Add topology inventory foundation
2026-05-10 22:05:16 +02:00
solaria:
roles:
- compute
- ai
feat(kb-mail): fundament — pgvector spine, koperta, archiwum, pakiet domeny - services/kb-postgres: pgvector/pgvector:pg16 na SOLARIA (:5433), named volume, init/001_envelope.sql (CREATE EXTENSION vector + zamrożona tabela envelope: id/source/ts/geo/raw_ref/entities), service.yaml, healthcheck, README z poprawnym mechanizmem deploy (deploy-node.sh składa dwa -f) - hosts/solaria/runtime/kb-postgres/docker-compose.override.yml: mem_limit 4g - inventory/topology.yaml + hosts/solaria/services.yaml: kb-postgres wpisany - packages/kb-mail: nowa konwencja shared lib (pip install /repo/packages/<lib>/) envelope.py — @dataclass Envelope, walidacja tz-aware ts db.py — insert_envelope / get_envelope (asyncpg, ON CONFLICT DO NOTHING) archive.py — save_eml append-only (asyncio.to_thread, FileExistsError na dup) tests: 15 unit pass + 5 integration (@pytest.mark.integration, wymaga KB_TEST_DSN) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-17 21:50:49 +02:00
services:
- node-agent
Add topology inventory foundation
2026-05-10 22:05:16 +02:00
vps:
roles:
- edge
- ingress
ops: align vps desired state with control-plane architecture, remove legacy agent-system references Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-21 11:40:55 +02:00
- control-plane
feat(piha): brain-watchdog — external watchdog for control-plane Polls /summary on VPS over Tailscale every 60s; computes freshness locally from last_update epoch (never trusts self-reported status). Alerts via Telegram Bot API directly after 3 consecutive failures; sends recovery message on heal. State (fail_count, alerted) persisted to volume so debounce survives restarts. - services/brain-watchdog/: Python service, no external deps (stdlib only) - hosts/piha/runtime/brain-watchdog/: override with mem_limit 64m - hosts/piha/services.yaml + inventory/topology.yaml: manifest entries Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-01 17:54:36 +02:00
services:
# Repo-managed GitOps services (hosts/vps/services.yaml is authoritative)
- node-agent
- control-plane # executor, observer, supervisor, operator-ui
- node_exporter
chore(vps): register fleet-prometheus in topology and services - hosts/vps/services.yaml: fleet-prometheus entry (role: fleet-liveness-source, exposure: tailscale-internal, port 9090, runtime paths, depends_on node_exporter) - inventory/topology.yaml: add fleet-prometheus to the vps services list Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-24 17:13:55 +02:00
- fleet-prometheus # Fleet liveness source of truth (Tailscale-internal)
feat(piha): brain-watchdog — external watchdog for control-plane Polls /summary on VPS over Tailscale every 60s; computes freshness locally from last_update epoch (never trusts self-reported status). Alerts via Telegram Bot API directly after 3 consecutive failures; sends recovery message on heal. State (fail_count, alerted) persisted to volume so debounce survives restarts. - services/brain-watchdog/: Python service, no external deps (stdlib only) - hosts/piha/runtime/brain-watchdog/: override with mem_limit 64m - hosts/piha/services.yaml + inventory/topology.yaml: manifest entries Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-01 17:54:36 +02:00
- stability-agent
- npm # Nginx Proxy Manager — public ingress, TLS termination
- outline # Team wiki (outline + postgres + redis)
- joplin # Note sync server (joplin-server + postgres)
- ai-cluster # AI workers: codex-worker, openclaw, planner-worker,
# service-ops-worker, redis, mosquitto
feat(gokapi): config publicznego file-share na VPS (share.okit.pl, E2E, Tailscale-bind za npm@VPS, disk-protection) — do deployu Nextcloud zostaje prywatny (mesh/kapala.org); Gokapi to osobny publiczny serwis do wysylania linkow do plikow na zewnatrz (Firefox Send alt). owner_node=vps, storage lokalny dysk (nie S3), E2E encryption ON, port 53842 bindowany tylko na TAILSCALE_BIND_IP (hairpin NAT przez npm@VPS, nigdy 0.0.0.0). Cutover checklist w README (DNS, wildcard *.okit.pl na npm@VPS, setup wizard) — nie zdeployowane w tym commicie. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-09 17:29:28 +02:00
- gokapi # Public file-share (Firefox Send alt), share.okit.pl via npm@VPS,
# local disk storage, E2E encryption ON — separate from private Nextcloud
Add topology inventory foundation
2026-05-10 22:05:16 +02:00
docs(chelsty): update docs and topology for site/node split - chelsty-runtime.md: references chelsty-infra and chelsty-ha nodes - chelsty-stability-agent.md: scoped to chelsty-infra - topology.yaml: chelsty monolith replaced with chelsty-infra + chelsty-ha
2026-05-20 14:23:57 +02:00
chelsty-infra:
site: chelsty
Add topology inventory foundation
2026-05-10 22:05:16 +02:00
roles:
Add CHELSTY home automation inventory model
2026-05-11 13:26:23 +02:00
- remote
Add topology inventory foundation
2026-05-10 22:05:16 +02:00
- hypervisor
docs(chelsty): update docs and topology for site/node split - chelsty-runtime.md: references chelsty-infra and chelsty-ha nodes - chelsty-stability-agent.md: scoped to chelsty-infra - topology.yaml: chelsty monolith replaced with chelsty-infra + chelsty-ha
2026-05-20 14:23:57 +02:00
- infra
Add topology inventory foundation
2026-05-10 22:05:16 +02:00
- staging
Add CHELSTY home automation inventory model
2026-05-11 13:26:23 +02:00
connectivity:
uplink: lte
intermittent: true
home_automation:
offline_operation_required: true
services:
- zigbee2mqtt
- mosquitto
coordinator:
model: SLZB-06U
connection: network
usb: false
docs(chelsty): update docs and topology for site/node split - chelsty-runtime.md: references chelsty-infra and chelsty-ha nodes - chelsty-stability-agent.md: scoped to chelsty-infra - topology.yaml: chelsty monolith replaced with chelsty-infra + chelsty-ha
2026-05-20 14:23:57 +02:00
chelsty-ha:
site: chelsty
roles:
- remote
- homeassistant
connectivity:
uplink: lte
intermittent: true
home_automation:
offline_operation_required: true
services:
- homeassistant
feat(onboard): register lustro in topology + services.yaml
2026-06-10 13:02:04 +02:00
lustro:
roles:
- edge
services:
- node-agent
Reference in a new issue Copy permalink