Oskar Kapala
fbf9e7501d
Nextcloud zostaje prywatny (mesh/kapala.org); Gokapi to osobny publiczny serwis do wysylania linkow do plikow na zewnatrz (Firefox Send alt). owner_node=vps, storage lokalny dysk (nie S3), E2E encryption ON, port 53842 bindowany tylko na TAILSCALE_BIND_IP (hairpin NAT przez npm@VPS, nigdy 0.0.0.0). Cutover checklist w README (DNS, wildcard *.okit.pl na npm@VPS, setup wizard) — nie zdeployowane w tym commicie. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
118 lines
3.3 KiB
YAML
118 lines
3.3 KiB
YAML
topology:
|
|
mesh: tailscale
|
|
git_provider: forgejo
|
|
|
|
deployment:
|
|
mode: pull
|
|
orchestrator: saturn
|
|
|
|
# Ingress dla usług domowych przez NPM @ PIHA + wildcard cert kapala.org.
|
|
# Od 2026-06-30. Poprzednia ścieżka (add-on Tailscale na ha-ken) PORZUCONA.
|
|
# DNS kapala.org: Cloudflare, wildcard *.kapala.org via DNS-01 (auto-renew).
|
|
# Mail: Fastmail (MX/DKIM/SPF na CF, DNS only).
|
|
# Subdomeny mesh: A → 100.108.208.3 (Tailscale PIHA), DNS only.
|
|
ingress:
|
|
dns_provider: cloudflare # kapala.org od 2026-06-30
|
|
wildcard_cert:
|
|
domain: "*.kapala.org"
|
|
method: dns-01 # Cloudflare DNS-01, auto-renew
|
|
proxy: npm-piha # Nginx Proxy Manager @ PIHA
|
|
services:
|
|
home_assistant:
|
|
host: 192.168.31.7
|
|
port: 8123
|
|
ingress: ha.kapala.org # NPM @ PIHA, cert *.kapala.org, mesh-only
|
|
access: tailscale # 100.108.208.3
|
|
cert: wildcard-kapala # DNS-01 Cloudflare, auto-renew
|
|
immich:
|
|
host: 192.168.31.5
|
|
port: 2283
|
|
ingress: immich.kapala.org # NPM @ PIHA, cert *.kapala.org, mesh-only
|
|
access: tailscale
|
|
cert: wildcard-kapala
|
|
|
|
nodes:
|
|
|
|
saturn:
|
|
roles:
|
|
- control
|
|
- development
|
|
|
|
piha:
|
|
roles:
|
|
- infra
|
|
- monitoring
|
|
services:
|
|
- node-agent
|
|
- ha-diag-agent
|
|
- brain-watchdog
|
|
- vikunja # Task management (vikunja + postgres), public via npm
|
|
- kb-postgres # KB spine: Postgres 16 + pgvector, port 5433 (always-on)
|
|
- llm-gateway # FastAPI router -> Ollama @ SOLARIA (Tailscale-internal :8080)
|
|
|
|
solaria:
|
|
roles:
|
|
- compute
|
|
- ai
|
|
services:
|
|
- node-agent
|
|
|
|
vps:
|
|
roles:
|
|
- edge
|
|
- ingress
|
|
- control-plane
|
|
services:
|
|
# Repo-managed GitOps services (hosts/vps/services.yaml is authoritative)
|
|
- node-agent
|
|
- control-plane # executor, observer, supervisor, operator-ui
|
|
- node_exporter
|
|
- fleet-prometheus # Fleet liveness source of truth (Tailscale-internal)
|
|
- stability-agent
|
|
- npm # Nginx Proxy Manager — public ingress, TLS termination
|
|
- outline # Team wiki (outline + postgres + redis)
|
|
- joplin # Note sync server (joplin-server + postgres)
|
|
- ai-cluster # AI workers: codex-worker, openclaw, planner-worker,
|
|
# service-ops-worker, redis, mosquitto
|
|
- gokapi # Public file-share (Firefox Send alt), share.okit.pl via npm@VPS,
|
|
# local disk storage, E2E encryption ON — separate from private Nextcloud
|
|
|
|
chelsty-infra:
|
|
site: chelsty
|
|
roles:
|
|
- remote
|
|
- hypervisor
|
|
- infra
|
|
- staging
|
|
connectivity:
|
|
uplink: lte
|
|
intermittent: true
|
|
home_automation:
|
|
offline_operation_required: true
|
|
services:
|
|
- zigbee2mqtt
|
|
- mosquitto
|
|
coordinator:
|
|
model: SLZB-06U
|
|
connection: network
|
|
usb: false
|
|
|
|
chelsty-ha:
|
|
site: chelsty
|
|
roles:
|
|
- remote
|
|
- homeassistant
|
|
connectivity:
|
|
uplink: lte
|
|
intermittent: true
|
|
home_automation:
|
|
offline_operation_required: true
|
|
services:
|
|
- homeassistant
|
|
|
|
lustro:
|
|
roles:
|
|
- edge
|
|
services:
|
|
- node-agent
|