- Add loki.source.syslog receiver to Alloy config template
- Enable syslog receiver on loki.srv.renner.uno (UDP port 1514)
- Extracts hostname and app labels from syslog messages
- Configure Synology DSM to forward logs to loki.srv.renner.uno:1514
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add caddy3.dmz.renner.uno (LXC 234) on jupiter node
- Update caddy-ha role to support 3-node priorities (100/90/80)
- Add netbird-client role for automated NetBird deployment
- Add setup-netbird-client.yml playbook with host_vars/group_vars support
- Add proxmox_caddy_ha group_vars for shared NetBird setup key
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add Ansible role to deploy Proxmox Backup Server client on Synology NAS
using Docker. The role uses the aterfax/pbs-client image with built-in
cron scheduling for automated backups.
Configured for nas-1.renner.uno backing up to pbs2.renner.uno:
- Documents, homes, Homeassistant Backup, Games, Media, Music, video volumes
- Daily backups at 2 AM with retention policy
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Delete authentik.renner.uno DNS CNAME (was pointing to old VM)
- VM 116 (authentik.srv.renner.uno) destroyed via tofu
Authentik HA is now the primary with auth.renner.uno endpoint
served via Caddy reverse proxy to authentik-app-1/2.srv.renner.uno.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Update forward_auth configuration in Caddyfile to use the new HA Authentik
servers (authentik-app-1/2) instead of the deprecated authentik.renner.uno.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update authentik-update.yml to target HA hosts (authentik_app group)
- Add serial: 1 for rolling updates across HA nodes
- Update Caddyfile to route auth.renner.uno to HA setup with load balancing
- Replace single-instance reverse_proxy with dual-backend configuration
- Add health checks for automatic failover
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update Authentik HA LXC configuration
- Update Proxmox VM module
- Update Home Assistant and Paperless VM configs
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update Prometheus server node and main config templates
- Update blackbox exporter configuration
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add music-assistant Ansible role with Docker Compose setup
- Add installation playbook for Music Assistant
- Add OpenTofu LXC definition for music-assistant
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add OpenTofu LXC definition for Grist (ID 228)
- Add Ansible role for Grist deployment with Docker
- Add installation playbook
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Lesson learned from NetBird proxy debugging: always strictly adhere
to official documentation instead of improvising custom solutions.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add netbird_client tag to Loki and Prometheus LXC containers
- Create setup-netbird-monitoring.yml playbook for ARM64 NetBird server
- Update install-netbird-client.yml to also target netbird_server group
- Fix monitoring-agent role to use architecture-specific binary pattern
Enables log aggregation and metrics collection from the external
NetBird server by routing traffic through the NetBird mesh network.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add relay service to docker-compose with Traefik routing
- Add Relay configuration to management.json
- Relay exposed at rels://netbird.renner.uno:443
This enables relay connectivity for peers behind strict NAT/CGNAT,
improving connectivity for mobile devices and restrictive networks.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add install-netbird-client.yml playbook for deploying NetBird clients
- Add netbird_client tag to Caddy containers for dynamic inventory
- Add caddy_ha group to static inventory
- Update proxy configuration with debug logging
- Update vault with new setup key for gateway clients
Caddy nodes now connected to NetBird mesh (caddy.nb.renner.uno,
caddy2.nb.renner.uno) enabling direct mesh access to ingress services.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add netbird-server role with Docker Compose deployment
- Add netbird-gateway role for mesh network routing
- Add OpenTofu LXC definition for netbird gateway (ID 260)
- Add inventory group for netbird_server
- Include playbooks for installation and setup
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add gnupg, curl, ca-certificates as prerequisites for CrowdSec
- Fix log directory ownership to root:root (caddy user doesn't exist yet)
- Enable SSH keys for both Caddy HA containers
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update Caddy build workflow with CrowdSec bouncer modules
- Create crowdsec Ansible role for installation and configuration
- Update caddy-ha role with CrowdSec configuration in Caddyfile
- Add setup-crowdsec-caddy.yml playbook for deployment
- Upgrade Caddy to v2.10.2 and Go to 1.24
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
The moved block for template migration was already applied and is now
causing errors when comparing state types during plan.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Pin container images to specific versions (opentofu:1.9, alpine:3.21)
- Add --pull=missing to avoid unnecessary image pulls
- Fix POSIX shell compatibility in Caddy test (no bash arrays)
- Check if mc is already installed before downloading
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Check S3 endpoint connectivity first
- Verify tfstate bucket access (critical for OpenTofu)
- Test read/write capability
- Make cluster health check optional (requires admin credentials)
- TF_RFS credentials are S3-only, not admin
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Use mc admin info to check full cluster health
- Report cluster mode and drive status
- Warn if cluster is degraded (offline drives)
- Verify tfstate bucket is accessible
- Fail if cluster is unhealthy or bucket inaccessible
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Check server responds (any HTTP code except 000 means running)
- Use S3 credentials for optional bucket access verification
- RustFS health endpoints require auth, so check connectivity instead
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add recursive function to collect resources from child modules
- Update resource address patterns for BPG provider
(proxmox_virtual_environment_container instead of proxmox_lxc)
- Handle tags as arrays instead of comma-separated strings
- Use pattern matching for gitea/runner detection
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Create Promtail role to collect and ship logs to Loki
- Add setup-gitea-runner-logging.yml playbook
- Configure collection of act_runner service logs via journald
- Add Docker daemon log collection
- Uses dynamic Proxmox inventory (proxmox_gitea_runner group)
Logs are now visible in Loki/Grafana for monitoring CI/CD pipeline
execution and debugging build failures.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Create modules/dns_records/ for reusable DNS record management
- Update proxmox_vm module to use shared DNS module
- Update proxmox_lxc module to use shared DNS module
- Add moved blocks for zero-downtime state migration
- Remove duplicated unifi provider requirement from VM/LXC modules
Resolves MAINT-2 from infrastructure review.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Created ARCHITECTURE.md and OPERATIONS.md addressing missing
operational documentation (DOC-1).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
k.rennerandClaude