Oskar Kapala
831bbedffa
Sesja 2026-06-30: migracja DNS kapala.org z 42.pl na Cloudflare, wildcard *.kapala.org przez DNS-01, ha/immich.kapala.org przez NPM@PIHA mesh-only. - nowy session log z root-cause buga "unrecognized name" (NPM duplikuje proxy_http_version przy Websockets ON) + wzorzec migracji usługi na mesh - backlog: gotchas (NPM WS config, CF auto-proxy DKIM) + TODO (migracja okit.pl, foty renew, cleanup ha-ken add-on, stale ha.okit.pl) - topology: nowa sekcja ingress (ha/immich → NPM@PIHA, wildcard cert) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
115 lines
3 KiB
YAML
115 lines
3 KiB
YAML
topology:
|
|
mesh: tailscale
|
|
git_provider: forgejo
|
|
|
|
deployment:
|
|
mode: pull
|
|
orchestrator: saturn
|
|
|
|
# Ingress dla usług domowych przez NPM @ PIHA + wildcard cert kapala.org.
|
|
# Od 2026-06-30. Poprzednia ścieżka (add-on Tailscale na ha-ken) PORZUCONA.
|
|
# DNS kapala.org: Cloudflare, wildcard *.kapala.org via DNS-01 (auto-renew).
|
|
# Mail: Fastmail (MX/DKIM/SPF na CF, DNS only).
|
|
# Subdomeny mesh: A → 100.108.208.3 (Tailscale PIHA), DNS only.
|
|
ingress:
|
|
dns_provider: cloudflare # kapala.org od 2026-06-30
|
|
wildcard_cert:
|
|
domain: "*.kapala.org"
|
|
method: dns-01 # Cloudflare DNS-01, auto-renew
|
|
proxy: npm-piha # Nginx Proxy Manager @ PIHA
|
|
services:
|
|
home_assistant:
|
|
host: 192.168.31.7
|
|
port: 8123
|
|
ingress: ha.kapala.org # NPM @ PIHA, cert *.kapala.org, mesh-only
|
|
access: tailscale # 100.108.208.3
|
|
cert: wildcard-kapala # DNS-01 Cloudflare, auto-renew
|
|
immich:
|
|
host: 192.168.31.5
|
|
port: 2283
|
|
ingress: immich.kapala.org # NPM @ PIHA, cert *.kapala.org, mesh-only
|
|
access: tailscale
|
|
cert: wildcard-kapala
|
|
|
|
nodes:
|
|
|
|
saturn:
|
|
roles:
|
|
- control
|
|
- development
|
|
|
|
piha:
|
|
roles:
|
|
- infra
|
|
- monitoring
|
|
services:
|
|
- node-agent
|
|
- ha-diag-agent
|
|
- brain-watchdog
|
|
- vikunja # Task management (vikunja + postgres), public via npm
|
|
- kb-postgres # KB spine: Postgres 16 + pgvector, port 5433 (always-on)
|
|
|
|
solaria:
|
|
roles:
|
|
- compute
|
|
- ai
|
|
services:
|
|
- node-agent
|
|
|
|
vps:
|
|
roles:
|
|
- edge
|
|
- ingress
|
|
- control-plane
|
|
services:
|
|
# Repo-managed GitOps services (hosts/vps/services.yaml is authoritative)
|
|
- node-agent
|
|
- control-plane # executor, observer, supervisor, operator-ui
|
|
- node_exporter
|
|
- fleet-prometheus # Fleet liveness source of truth (Tailscale-internal)
|
|
- stability-agent
|
|
- npm # Nginx Proxy Manager — public ingress, TLS termination
|
|
- outline # Team wiki (outline + postgres + redis)
|
|
- joplin # Note sync server (joplin-server + postgres)
|
|
- ai-cluster # AI workers: codex-worker, openclaw, planner-worker,
|
|
# service-ops-worker, redis, mosquitto
|
|
|
|
chelsty-infra:
|
|
site: chelsty
|
|
roles:
|
|
- remote
|
|
- hypervisor
|
|
- infra
|
|
- staging
|
|
connectivity:
|
|
uplink: lte
|
|
intermittent: true
|
|
home_automation:
|
|
offline_operation_required: true
|
|
services:
|
|
- zigbee2mqtt
|
|
- mosquitto
|
|
coordinator:
|
|
model: SLZB-06U
|
|
connection: network
|
|
usb: false
|
|
|
|
chelsty-ha:
|
|
site: chelsty
|
|
roles:
|
|
- remote
|
|
- homeassistant
|
|
connectivity:
|
|
uplink: lte
|
|
intermittent: true
|
|
home_automation:
|
|
offline_operation_required: true
|
|
services:
|
|
- homeassistant
|
|
|
|
lustro:
|
|
roles:
|
|
- edge
|
|
services:
|
|
- node-agent
|