497 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
k.rennerandClaude Opus 4.6	8b9a07dc23	fix: Use docker run for oCIS init instead of docker_container module ... The docker_container module with detach:false hangs indefinitely. Use shell docker run --rm which handles exit codes properly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 19:54:59 +02:00
k.rennerandClaude Opus 4.6	c5a7c3933c	fix: Fix ownCloud init task - use stat check and remove auto_remove ... The auto_remove flag prevents reading container exit status. Use stat check to skip init if already configured. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 19:43:19 +02:00
k.rennerandClaude Opus 4.6	4e5dcb06a3	fix: Switch UniFi provider to API key auth and upgrade to ~>0.41 ... Newer UniFi OS requires API key authentication instead of username/password login. Removes deprecated credential variables. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 09:48:06 +02:00
k.rennerandClaude Opus 4.6	efebabdc9d	fix: Revert UniFi provider to v0.41.12 ... Newer versions use /api/auth/login (SSO endpoint) which returns 403 with local accounts. v0.41.12 uses /api/login which works correctly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 09:44:14 +02:00
k.rennerandClaude Opus 4.6	831cdea435	fix: Upgrade UniFi provider to ~>0.41 for current firmware compatibility ... UniFi provider v0.41.12 can't authenticate with current UDM firmware. Use flexible version constraint and tofu init -upgrade in CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 09:37:55 +02:00
k.rennerandClaude Opus 4.6	f2ae00cf43	fix: Fix YAML quoting in run-ansible pipeline ... Woodpecker requires $$ for variable references and proper quoting to avoid YAML parsing issues. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 09:18:58 +02:00
k.rennerandClaude Opus 4.6	dd383bde9e	feat: Add generic run-ansible pipeline for ad-hoc playbook runs ... Requires PIPELINE=run-ansible and PLAYBOOK=plays/<name>.yml variables. Independent of S3/tofu state, useful for fixing infrastructure issues. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 09:17:20 +02:00
k.rennerandClaude Opus 4.6	4b33eebd2c	fix: Require explicit PIPELINE variable for manual triggers ... Remove PIPELINE=="" catch-all from all pipelines so manual triggers only run the specifically requested pipeline. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 09:08:15 +02:00
k.rennerandClaude Opus 4.6	386f819aa0	fix: Guard tofu apply behind TOFU_APPLY variable ... Apply step now requires both manual trigger and TOFU_APPLY="true" to prevent accidental applies of destructive plans. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 08:46:20 +02:00
k.rennerandClaude Opus 4.6	3a43f5a293	feat: Add ownCloud Infinite Scale (oCIS) deployment ... LXC 236 on saturn with 4GB RAM, 4 cores, 50GB disk. Includes Ansible role with Docker Compose, Authentik OIDC integration, and vault secrets for admin password and OAuth credentials. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 08:28:17 +02:00
k.rennerandClaude Opus 4.6	0abab025dd	feat: Remove unused VMs (uptime-kuma, mosquitto, cdns) ... Remove VM 107 (uptime-kuma), VM 110 (mosquitto), and VM 119 (cdns) to reduce cluster resource usage. Frees 12 CPU cores. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-26 11:26:53 +01:00
k.renner	f97cba516f	fix: Only backup VMs when updates are available	2026-03-26 10:07:26 +01:00
k.renner	cb95694c76	fix: Restore install-immich in update pipeline	2026-03-26 10:05:07 +01:00
k.renner	0fead4c4cd	fix: Set Immich postgres to pg16-v0.3.0 to match data on disk	2026-03-26 10:03:55 +01:00
k.renner	804a264c1b	fix: Remove install-immich from weekly updates - needs dedicated migration	2026-03-26 10:03:12 +01:00
k.renner	244888067d	feat: Add log aggregation deployment to weekly update pipeline	2026-03-26 09:00:00 +01:00
k.renner	be9a9c1146	fix: Revert Immich postgres to pg16-v0.2.1 to restore vector search	2026-03-26 08:53:53 +01:00
k.renner	98fa4d0de6	fix: Revert Immich redis->valkey migration to restore service ... Keep redis:7.4-alpine (security update) but revert the service rename that broke the running deployment. Valkey migration needs to be done with proper container cleanup.	2026-03-26 08:40:59 +01:00
k.renner	b9af15b22d	fix: Disable HA and stop USB-passthrough VMs before PVE node reboot	2026-03-26 08:31:48 +01:00
k.renner	fe08e26abf	chore: Remove ntp and wazuh VMs from infrastructure	2026-03-26 08:29:51 +01:00
k.renner	fbb7729c4f	fix: Exclude eol-tagged VMs from updates	2026-03-26 07:38:55 +01:00
k.renner	bf7a844af8	fix: Add eol tag to VMs running EOL Ubuntu 24.10	2026-03-26 07:36:56 +01:00
k.renner	216481e829	fix: Tag dev, kasm, grafana with noansible - EOL Ubuntu 24.10 repos	2026-03-26 07:35:46 +01:00
k.renner	a63d0baa81	fix: Increase backup wait to 5 minutes for larger VMs	2026-03-26 07:05:19 +01:00
k.renner	c18456d33d	fix: Force apt cache refresh and clean before VM updates	2026-03-26 06:57:19 +01:00
k.renner	7769bd6fe0	fix: Run VM updates serial: 1 since only one backup can run at a time	2026-03-25 22:53:03 +01:00
k.renner	d34ab8977a	fix: Wait for pre-update backup completion (2min max, was 50min)	2026-03-25 22:47:36 +01:00
k.renner	6b02dadffa	fix: Remove max_fail_percentage - every failure should stop the pipeline	2026-03-25 22:27:45 +01:00
k.renner	22489c3b60	fix: Remove pre-update backup step and add max_fail_percentage to VM updates	2026-03-25 22:26:56 +01:00
k.renner	eb9461a849	fix: Install community.docker collection and increase timeout to 120min	2026-03-25 22:09:37 +01:00
k.renner	a00a2767a6	fix: Update Docker images and re-render templates during updates ... Image updates: - Immich: redis:6.2-alpine → valkey:9-alpine (upstream migration) - Immich: pgvecto-rs pg16-v0.2.1 → pg16-v0.3.0 (latest patch, same PG major) - Paperless: redis:7 → redis:7.4, postgres:15 → postgres:15.17 Update pipeline: - Run install playbooks before docker update to re-render templates - All install playbooks are idempotent (safe to re-run)	2026-03-25 18:17:05 +01:00
k.renner	4242e4a4dd	fix: Update Docker images to address security vulnerabilities ... Immich: - Migrate from redis:6.2-alpine to valkey:9-alpine (upstream change) - Migrate from tensorchord/pgvecto-rs:pg16-v0.2.1 to ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0 - Update REDIS_HOSTNAME to point to valkey service Paperless: - Update redis:7 to redis:7.4 - Pin postgres:15 to postgres:15.17	2026-03-25 18:10:21 +01:00
k.renner	f84ae78ade	fix: Filter bare 'latest' and fix vlatest tag in image discovery	2026-03-25 18:04:30 +01:00
k.renner	9b6988015d	fix: Use find+xargs instead of grep --include for BusyBox compatibility	2026-03-25 17:30:51 +01:00
k.renner	b8505224dc	fix: Escape dollar signs for Woodpecker variable parser	2026-03-25 17:14:19 +01:00
k.renner	d70cfc07bb	feat: Dynamically discover Docker images from repo for security scanning	2026-03-25 16:59:08 +01:00
k.renner	da51bbe2d7	feat: Scan all Docker images used in the repo for vulnerabilities	2026-03-25 16:57:50 +01:00
k.renner	50770e9373	perf: Combine image scans into single step to avoid repeated DB downloads	2026-03-25 16:54:29 +01:00
k.renner	e167118432	fix: Guard update-all cron event with PIPELINE variable	2026-03-25 16:51:28 +01:00
k.renner	036be85748	feat: Add PIPELINE variable filter to all workflows for scoped cron/manual triggers	2026-03-25 16:44:14 +01:00
k.rennerandClaude Opus 4.6	14c7b4583a	chore: Remove temporary SSH key sync pipelines ... The SSH key has been successfully rotated. Remove the one-time Gitea Actions workflow and Woodpecker sync pipeline. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-24 20:30:59 +01:00
k.rennerandClaude Opus 4.6	37e589ea6e	feat: Rotate CI SSH key to new woodpecker-ci@homelab keypair ... Generated fresh ed25519 key. Private key set directly in Woodpecker secrets. Public key updated in locals.tf, vars.yml, and the SSH key deployment playbook. Run configure-ssh-keys.yml from fortress to deploy to all hosts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-24 19:35:19 +01:00
k.renner	16e7eedeaa	fix: Use python3 for reliable base64 SSH key decoding	2026-03-24 18:04:20 +01:00
k.renner	01142fec4f	fix: Use printf instead of echo for base64 decoding SSH key	2026-03-24 13:49:16 +01:00
k.renner	d80c724503	fix: Pass SSH key through as-is, no re-encoding	2026-03-24 13:21:14 +01:00
k.renner	11b8f1d86d	chore: Add key diagnostic step to sync pipeline	2026-03-24 13:12:05 +01:00
k.renner	2c024248b3	fix: Ensure SSH key is base64-encoded for Woodpecker	2026-03-24 12:02:32 +01:00
k.renner	d19194fd4f	fix: Use python3 for JSON-safe SSH key sync, install in runner	2026-03-24 07:55:42 +01:00
k.renner	96148fc1a5	fix: Use jq to properly escape SSH key in sync workflow	2026-03-24 07:44:13 +01:00
k.rennerandClaude Opus 4.6	423a44953c	fix(ansible): Deploy SSH keys to both root and ladmin users ... Keys must be in root's authorized_keys for LXC containers (CI connects as root) and ladmin's for VMs. Previous version only deployed to the connecting user. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-24 07:27:40 +01:00