- Add encryption password and API key support
- Fix volume mount paths with spaces
- Add CRON_BACKUP_ONLY mode
- Configure nas-1 backup paths and PBS server
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add snmp-exporter role with Synology module support
- Add Synology scrape job to Prometheus config
- Add Synology NAS Grafana dashboard
- Support SNMPv2/v3 authentication
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add raw syslog format support for BSD/RFC 3164 style logs
- Parse hostname and app from Synology log messages
- Configure loki.srv.renner.uno as syslog receiver (UDP 1514)
- Add stability_level experimental for raw format support
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add MkDocs wiki LXC (235) on saturn
- Create mkdocs-wiki Ansible role with:
- MkDocs Material theme
- Obsidian wikilinks support (roamlinks plugin)
- Multi-language support (i18n plugin)
- Caddy for local serving
- Sync script for updates
- Add wiki.renner.uno route to Caddy HA
Source: Obsidian vault at ~/Notes/Work & Dev/Homelab
Renders documentation for household members at wiki.renner.uno
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Update CLAUDE.md to use the docs-maintainer Task agent for
documentation updates in ~/Notes Obsidian vault.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add loki.source.syslog receiver to Alloy config template
- Enable syslog receiver on loki.srv.renner.uno (UDP port 1514)
- Extracts hostname and app labels from syslog messages
- Configure Synology DSM to forward logs to loki.srv.renner.uno:1514
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add caddy3.dmz.renner.uno (LXC 234) on jupiter node
- Update caddy-ha role to support 3-node priorities (100/90/80)
- Add netbird-client role for automated NetBird deployment
- Add setup-netbird-client.yml playbook with host_vars/group_vars support
- Add proxmox_caddy_ha group_vars for shared NetBird setup key
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add Ansible role to deploy Proxmox Backup Server client on Synology NAS
using Docker. The role uses the aterfax/pbs-client image with built-in
cron scheduling for automated backups.
Configured for nas-1.renner.uno backing up to pbs2.renner.uno:
- Documents, homes, Homeassistant Backup, Games, Media, Music, video volumes
- Daily backups at 2 AM with retention policy
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Delete authentik.renner.uno DNS CNAME (was pointing to old VM)
- VM 116 (authentik.srv.renner.uno) destroyed via tofu
Authentik HA is now the primary with auth.renner.uno endpoint
served via Caddy reverse proxy to authentik-app-1/2.srv.renner.uno.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Update forward_auth configuration in Caddyfile to use the new HA Authentik
servers (authentik-app-1/2) instead of the deprecated authentik.renner.uno.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update authentik-update.yml to target HA hosts (authentik_app group)
- Add serial: 1 for rolling updates across HA nodes
- Update Caddyfile to route auth.renner.uno to HA setup with load balancing
- Replace single-instance reverse_proxy with dual-backend configuration
- Add health checks for automatic failover
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update Authentik HA LXC configuration
- Update Proxmox VM module
- Update Home Assistant and Paperless VM configs
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update Prometheus server node and main config templates
- Update blackbox exporter configuration
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add music-assistant Ansible role with Docker Compose setup
- Add installation playbook for Music Assistant
- Add OpenTofu LXC definition for music-assistant
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add OpenTofu LXC definition for Grist (ID 228)
- Add Ansible role for Grist deployment with Docker
- Add installation playbook
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Lesson learned from NetBird proxy debugging: always strictly adhere
to official documentation instead of improvising custom solutions.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add netbird_client tag to Loki and Prometheus LXC containers
- Create setup-netbird-monitoring.yml playbook for ARM64 NetBird server
- Update install-netbird-client.yml to also target netbird_server group
- Fix monitoring-agent role to use architecture-specific binary pattern
Enables log aggregation and metrics collection from the external
NetBird server by routing traffic through the NetBird mesh network.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add relay service to docker-compose with Traefik routing
- Add Relay configuration to management.json
- Relay exposed at rels://netbird.renner.uno:443
This enables relay connectivity for peers behind strict NAT/CGNAT,
improving connectivity for mobile devices and restrictive networks.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add install-netbird-client.yml playbook for deploying NetBird clients
- Add netbird_client tag to Caddy containers for dynamic inventory
- Add caddy_ha group to static inventory
- Update proxy configuration with debug logging
- Update vault with new setup key for gateway clients
Caddy nodes now connected to NetBird mesh (caddy.nb.renner.uno,
caddy2.nb.renner.uno) enabling direct mesh access to ingress services.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add netbird-server role with Docker Compose deployment
- Add netbird-gateway role for mesh network routing
- Add OpenTofu LXC definition for netbird gateway (ID 260)
- Add inventory group for netbird_server
- Include playbooks for installation and setup
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add gnupg, curl, ca-certificates as prerequisites for CrowdSec
- Fix log directory ownership to root:root (caddy user doesn't exist yet)
- Enable SSH keys for both Caddy HA containers
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update Caddy build workflow with CrowdSec bouncer modules
- Create crowdsec Ansible role for installation and configuration
- Update caddy-ha role with CrowdSec configuration in Caddyfile
- Add setup-crowdsec-caddy.yml playbook for deployment
- Upgrade Caddy to v2.10.2 and Go to 1.24
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
The moved block for template migration was already applied and is now
causing errors when comparing state types during plan.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Pin container images to specific versions (opentofu:1.9, alpine:3.21)
- Add --pull=missing to avoid unnecessary image pulls
- Fix POSIX shell compatibility in Caddy test (no bash arrays)
- Check if mc is already installed before downloading
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Check S3 endpoint connectivity first
- Verify tfstate bucket access (critical for OpenTofu)
- Test read/write capability
- Make cluster health check optional (requires admin credentials)
- TF_RFS credentials are S3-only, not admin
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
k.rennerandClaude