4354 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
k.renner	01142fec4f	fix: Use printf instead of echo for base64 decoding SSH key	2026-03-24 13:49:16 +01:00
k.renner	d80c724503	fix: Pass SSH key through as-is, no re-encoding	2026-03-24 13:21:14 +01:00
k.renner	11b8f1d86d	chore: Add key diagnostic step to sync pipeline	2026-03-24 13:12:05 +01:00
k.renner	2c024248b3	fix: Ensure SSH key is base64-encoded for Woodpecker	2026-03-24 12:02:32 +01:00
k.renner	d19194fd4f	fix: Use python3 for JSON-safe SSH key sync, install in runner	2026-03-24 07:55:42 +01:00
k.renner	96148fc1a5	fix: Use jq to properly escape SSH key in sync workflow	2026-03-24 07:44:13 +01:00
k.rennerandClaude Opus 4.6	423a44953c	fix(ansible): Deploy SSH keys to both root and ladmin users ... Keys must be in root's authorized_keys for LXC containers (CI connects as root) and ladmin's for VMs. Previous version only deployed to the connecting user. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-24 07:27:40 +01:00
k.rennerandClaude Opus 4.6	846ccd2903	feat(ansible): Add SSH key deployment playbook ... Deploys all authorized SSH keys to reachable hosts. Run manually from fortress to bootstrap CI SSH access on LXC containers. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-24 06:57:30 +01:00
k.rennerandClaude Opus 4.6	b317b66771	fix(ansible): Set ansible_user per VM type in dynamic inventory ... LXC containers use root, VMs use ladmin. Previously all hosts defaulted to ladmin from group_vars, but LXC containers only have root's SSH keys configured. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-23 22:15:49 +01:00
k.renner	9d6656177a	fix: Install curl in act_runner container and re-trigger sync	2026-03-23 21:43:35 +01:00
k.renner	3fcc12ea6d	fix: Use host execution mode for temporary Gitea runner	2026-03-23 21:33:12 +01:00
k.renner	58714db612	chore: Run temporary Gitea runner to process sync workflow	2026-03-23 21:27:07 +01:00
k.renner	cd20c98013	chore: Extract public key from Woodpecker SSH secret	2026-03-23 21:02:08 +01:00
k.renner	0039a68743	chore: Improve sync pipeline to scrape runner registration token	2026-03-23 20:55:16 +01:00
k.renner	79bca7010e	chore: Add debug pipeline to test gitea token and SSH key	2026-03-23 20:53:06 +01:00
k.renner	6bb7697add	chore: Trigger sync workflow on push	2026-03-23 20:42:12 +01:00
k.rennerandClaude Opus 4.6	f026fa9701	chore: Add one-time workflow to sync SSH key from Gitea to Woodpecker ... Temporary Gitea Actions workflow to copy the SSH_PRIVATE_KEY secret from Gitea Actions to Woodpecker CI. Will be removed after sync. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-23 20:39:51 +01:00
k.rennerandClaude Opus 4.6	8bb6395b40	fix(woodpecker): Set ANSIBLE_ROLES_PATH env var for update-all pipeline ... ansible.cfg is ignored in world-writable CI directories. Setting ANSIBLE_ROLES_PATH as environment variable bypasses the issue. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-23 18:02:06 +01:00
k.rennerandClaude Opus 4.6	7a55a43315	fix(woodpecker): Fix update-all pipeline ansible.cfg and collection issues ... - Install community.proxmox collection for dynamic inventory plugin - chmod workspace to fix world-writable directory warning that causes ansible.cfg to be ignored (breaks roles_path resolution) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-23 17:53:49 +01:00
k.rennerandClaude	1f7e3bd1d6	feat(woodpecker): Add update-all workflow ... Runs full infrastructure update via Ansible: - VMs (apt upgrade) - LXC containers (apt upgrade) - Authentik HA - Docker containers - Proxmox nodes (rolling) Triggered manually or via cron. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-03-23 15:26:49 +01:00
k.rennerandClaude	69fe3764cc	chore(opentofu): Remove legacy Gitea runners ... Removed after migration to Woodpecker CI: - Deleted runners.tf module - Removed gitea_runners local definition - Removed gitea_runner_count variable - Cleaned up test trigger comments The Gitea runner LXC containers (905, 906) will be destroyed when apply is triggered manually in Woodpecker CI. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-03-23 14:57:36 +01:00
k.rennerandClaude	544e595315	chore: Remove Gitea Actions workflows ... Migrated to Woodpecker CI. All pipelines verified working: - deploy-infrastructure (plan on push, apply on manual) - build-caddy (xcaddy build with plugins) - security-scan (Trivy IaC and image scanning) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-03-22 22:21:33 +01:00
k.rennerandClaude	c2dfddbaa1	chore(woodpecker): Test build-caddy and security-scan pipelines ... Triggering both pipelines to verify Woodpecker CI is working. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-03-22 22:12:48 +01:00
k.rennerandClaude	aaf571b4c9	fix(woodpecker): Separate plan and apply with manual approval ... - Plan runs on push (automatic) - Apply only runs on manual trigger (requires approval) This prevents automatic infrastructure changes and allows reviewing the plan before applying. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-03-22 21:54:10 +01:00
k.renner	dbee853cd2	chore: test Woodpecker webhook after Gitea fix	2026-03-22 21:48:48 +01:00
k.rennerandClaude	be6de139ce	fix(gitea-workflow): Add Proxmox credentials for dynamic inventory ... The update-gitea-config workflow failed because the Proxmox dynamic inventory requires PROXMOX_TOKEN_ID and PROXMOX_TOKEN_SECRET env vars. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-03-22 21:42:12 +01:00
k.renner	67317eabc1	chore: trigger Woodpecker webhook test	2026-03-22 21:35:52 +01:00
k.rennerandClaude	4abd30bc98	fix(gitea): allow webhooks to private/loopback hosts ... Gitea was blocking webhooks to Woodpecker CI despite having 'private' in ALLOWED_HOST_LIST. Changed to '*' to allow all webhook destinations. Also updated update-gitea-config workflow to trigger on gitea role changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-03-22 21:32:59 +01:00
k.rennerandClaude	49032bd909	fix(woodpecker): Combine plan and apply to prevent stale plan errors ... The separate plan and apply steps caused "Saved plan is stale" errors when multiple pipelines ran concurrently or state changed between steps. Combined into single plan-and-apply step that runs tofu plan followed immediately by tofu apply -auto-approve in the same container. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-03-22 21:30:56 +01:00
k.rennerandClaude	03f47ee86d	chore(opentofu): Test Woodpecker CI pipeline trigger ... No-op change to verify Woodpecker CI is working before removing old Gitea runners. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-03-22 21:17:27 +01:00
k.rennerandClaude	4d873a178f	docs: Enforce CI-only workflow for all cluster changes ... Direct execution of ansible, ssh, and tofu commands is no longer allowed. All infrastructure and configuration changes must go through CI/CD by pushing to Gitea and waiting for pipelines to execute. Updated CLAUDE.md to: - Add prominent CI-only workflow warning at top - Replace "Common Commands" with "Making Changes (CI/CD Workflow)" - Update all sections to remove direct execution examples - Add critical rule about never running ansible/ssh/tofu directly - Clarify which commands are allowed locally (validation only) - Update troubleshooting to reference CI and Grafana/Loki 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-03-22 21:10:37 +01:00
k.renner	4d9244d0a0	fix(gitea): allow webhooks to private/loopback hosts ... Add [webhook] ALLOWED_HOST_LIST = private,loopback to Gitea app.ini. Default is 'external' which blocks webhooks to internal IPs like woodpecker.srv.renner.uno.	2026-03-19 06:12:21 +01:00
k.renner	67878aa625	chore: remove debug-wp-logs workflow, test webhook via HTTP	2026-03-19 06:09:42 +01:00
k.renner	9c6448e3d2	debug: check woodpecker server logs for webhook issues	2026-03-19 06:05:01 +01:00
k.renner	b0d44fd118	fix: revert webhook host override, Gitea can reach Caddy proxy	2026-03-19 06:03:34 +01:00
k.renner	0e93eb8e54	fix(woodpecker): set webhook host to internal address ... Gitea can't reach ci.renner.uno (goes through Caddy ingress which doesn't resolve from the services VLAN). Set WOODPECKER_EXPERT_WEBHOOK_HOST to the direct internal address.	2026-03-19 06:01:26 +01:00
k.renner	67e3bafccc	test: verify Woodpecker webhook triggers on push	2026-03-18 23:52:20 +01:00
k.renner	f41b0c5da9	fix(woodpecker): replace gitea-release plugin with curl-based upload ... All gitea-release plugins require tag events. Use direct Gitea API calls to delete old asset and upload new binary to the existing 'latest' release.	2026-03-18 23:47:04 +01:00
k.renner	3c36d524ed	fix(woodpecker): use plugins/gitea-release for caddy release step ... The old woodpeckerci/plugin-gitea-release is deprecated and only works with tag events. Switch to plugins/gitea-release which works with manual triggers.	2026-03-18 23:41:08 +01:00
k.renner	b05ad48950	fix(woodpecker): upgrade Go image to 1.26 for Caddy v2.11.2 build ... Caddy v2.11.2 requires Go >= 1.25.0, golang:1.24 is too old.	2026-03-17 21:34:41 +01:00
k.renner	c243b99273	feat: add Woodpecker CI deploy key to common_ssh_keys and vault ... New ed25519 key for Woodpecker CI pipelines to SSH into managed hosts. Added to locals.tf (provisioned to all LXCs) and stored in vault.	2026-03-17 17:33:37 +01:00
k.renner	40fe2df410	chore: remove debug-woodpecker workflow	2026-03-17 06:10:20 +01:00
k.renner	4b859b98fb	fix(woodpecker): set data dir ownership to UID 1000 for container user ... Container runs as non-root (UID 1000) but /var/lib/woodpecker/ was owned by root, causing 'unable to open database file' errors.	2026-03-17 06:02:45 +01:00
k.renner	820886c0b5	ci: add debug-woodpecker workflow to check container status	2026-03-17 06:00:25 +01:00
k.renner	f31996eb4d	fix(ci): add community.proxmox collection and Proxmox credentials for Caddy deploy ... The Caddy HA playbook targets proxmox_caddy_ha group which is resolved by the dynamic Proxmox inventory plugin. Added: - ansible-galaxy collection install community.proxmox - PROXMOX_TOKEN_ID and PROXMOX_TOKEN_SECRET env vars	2026-03-17 05:56:12 +01:00
k.renner	a5f2a7c638	fix(ci): re-set VAULT_PASS secret with correct encoding	2026-03-16 22:27:30 +01:00
k.renner	b5cee9a767	fix(ci): install bash for vault-password.sh shebang	2026-03-16 22:25:26 +01:00
k.renner	c13ccd981b	fix(ci): set ANSIBLE_VAULT_PASSWORD_FILE for CI container path ... ansible.cfg points to ~/source/homelab which doesn't exist in the CI container. Override with ANSIBLE_VAULT_PASSWORD_FILE env var.	2026-03-16 22:23:18 +01:00
k.renner	b9d213a446	fix(ci): use git clone instead of actions/checkout in setup-woodpecker ... Alpine container has no Node.js, which actions/checkout@v3 requires. Replaced with plain git clone and collapsed into single job.	2026-03-16 22:21:34 +01:00
k.renner	fd7d983ebf	ci: trigger setup-woodpecker on push to its own file ... Gitea 1.21 does not support workflow_dispatch via API or UI. Changed to push trigger on the workflow file path.	2026-03-16 22:20:15 +01:00