Commit Graph
8 Commits
Author SHA1 Message Date
claude-botandClaude Opus 5 56bb47e483 chore: remove the decommissioned Proxmox DNS server and its migration script
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
ci/woodpecker/pr/pr-review Pipeline was successful
The Proxmox DNS HA VIP (10.2.40.53) was decommissioned after it dead-ended
non-Ingress resolution and broke ~1374 Home Assistant entities on a pod restart
(2026-07-14). With Proxmox itself now gone, the implementation and everything
pointing at it are dead weight — and one piece was actively dangerous.

Removed:

  dns-server/                         the Go implementation, its systemd unit,
                                      and a 7.4 MB checked-in binary
  opentofu/scripts/remove_unifi_clients.sh
  the "Proxmox DNS (VIP)" Gatus check in the ansible role

remove_unifi_clients.sh is the one worth calling out. It instructs the reader
to deploy module.proxmox_dns and point UniFi DNS at 10.2.40.53 — precisely the
configuration that caused the outage. It also works by `tofu state rm`, which
orphans resources rather than removing them. It was already marked deprecated
in its own header; anyone who ignored that and followed it would have
reintroduced a known failure.

The Gatus check queried k8s-1.srv.renner.uno against 10.2.40.53 every 30s. It
belongs to the ansible gatus role, which targets a Proxmox LXC that no longer
exists, so nothing was running it — but the check itself asserts the decommis-
sioned server should answer, which is the opposite of the intended end state.

Deliberately kept: the three comments in bootstrap.sh, coredns-config and
k8s-gateway that record 10.2.40.53 as DECOMMISSIONED and say not to reintroduce
it. They carry the outage date and blast radius, and are the reason this keeps
not happening again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-26 07:18:23 +02:00
k.rennerandClaude fbf5be53ae fix: Update validate_plan.py for module-based infrastructure
Security Audit / Infrastructure Scan (IaC) (push) Successful in 1m12s
Deploy Infrastructure / plan (push) Successful in 1m30s
Security Audit / Docker Image Scan (docker.io/apache/tika:latest) (push) Failing after 4m55s
Security Audit / Docker Image Scan (docker.io/gotenberg/gotenberg:8) (push) Failing after 5m35s
Deploy Infrastructure / apply (push) Successful in 1m7s
Security Audit / Docker Image Scan (docker.io/library/postgres:15) (push) Failing after 1m7s
Security Audit / Docker Image Scan (docker.io/library/redis:7) (push) Failing after 59s
Deploy Infrastructure / integration-tests (push) Failing after 10s
Security Audit / Docker Image Scan (ghcr.io/icereed/paperless-gpt:latest) (push) Failing after 52s
Security Audit / Docker Image Scan (shenxn/protonmail-bridge:latest) (push) Successful in 2m1s
Security Audit / Docker Image Scan (ghcr.io/paperless-ngx/paperless-ngx:latest) (push) Failing after 3m57s
- Add recursive function to collect resources from child modules
- Update resource address patterns for BPG provider
  (proxmox_virtual_environment_container instead of proxmox_lxc)
- Handle tags as arrays instead of comma-separated strings
- Use pattern matching for gitea/runner detection

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2026-02-18 20:16:58 +01:00
k.renner 57f6782fcc feat: Implement High Availability for Proxmox DNS Server using Keepalived
- Added Ansible playbook for installing Proxmox DNS server in HA configuration.
- Created role for Keepalived with VIP management and health checks.
- Implemented notification script for state changes in Keepalived.
- Developed health check script to monitor DNS service status.
- Configured Keepalived with VRRP settings and health check scripts.
- Documented HA architecture and deployment process for Proxmox DNS server.
- Migrated DHCP management from UniFi to Proxmox DNS server for dynamic IP resolution.
- Removed UniFi client resources from OpenTofu modules to streamline management.
- Added scripts for managing UniFi client resources during migration.
2026-02-13 21:56:26 +01:00
k.renner 82cf07abf4 Add unifi DNS records and modules for various services
- Created unifi_targets.txt and unifi_targets_strict.txt files to define DNS records for services including authentik, caddy, and others.
- Included ingress CNAMEs for modules such as audiobookshelf, gitea, grafana, and more.
- Ensured both files contain comprehensive lists of DNS records to support service discovery and routing.
2026-02-11 18:48:55 +01:00
k.renner 4b4727dff3 fix: remove obsolete Audiobookshelf migration script 2026-02-09 21:03:52 +01:00
k.renner 0699c87838 fix: add mountpoints configuration for audiobookshelf LXC and create migration script 2026-02-09 21:03:38 +01:00
k.renner 18076bc2a8 refactor(ansible): update roles_path and clean up Caddy HA playbook
Security Audit / Infrastructure Scan (IaC) (push) Successful in 27s
Ansible Setup / ansible (push) Failing after 1m6s
Deploy Infrastructure / plan (push) Successful in 1m42s
Security Audit / Docker Image Scan (docker.io/library/postgres:15) (push) Failing after 35s
Deploy Infrastructure / apply (push) Successful in 1m44s
Security Audit / Docker Image Scan (docker.io/library/redis:7) (push) Failing after 27s
Security Audit / Docker Image Scan (docker.io/apache/tika:latest) (push) Failing after 4m1s
Security Audit / Docker Image Scan (docker.io/gotenberg/gotenberg:8) (push) Failing after 4m3s
Security Audit / Docker Image Scan (ghcr.io/icereed/paperless-gpt:latest) (push) Failing after 46s
Security Audit / Docker Image Scan (shenxn/protonmail-bridge:latest) (push) Successful in 1m2s
Security Audit / Docker Image Scan (ghcr.io/paperless-ngx/paperless-ngx:latest) (push) Failing after 1m42s
2026-01-28 17:56:40 +01:00
k.renner 429ab4ac1a Add 'opentofu/' from commit '4fc0f24efcbf452338a1f2a06eb97a5904cf874d'
git-subtree-dir: opentofu
git-subtree-mainline: c13b5819d1
git-subtree-split: 4fc0f24efc
2026-01-27 17:56:15 +01:00