konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests Packages Projects Releases 1 Wiki Activity

chore: remove the nas-1 remnants and make incomplete scans visible #696

Merged
k.renner merged 3 commits from cleanup-nas-1-remnants into master 2026-08-28 08:47:37 +00:00
Conversation 1 Commits 3 Files Changed 19
+19 -733
3 Commits
Author SHA1 Message Date
claude-bot b8125e4669 fix(ci): make an incomplete image scan visible
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details 
The scan loop swallowed every Trivy failure with `|| true`, so a step that
scanned 21 of 22 images reported exactly the same as one that scanned all 22.
The gap was found by the fix agent noticing a missing file in its own input,
not by the pipeline.

The loop still continues past a bad image — one unpullable reference should not
cost the scan of everything after it — but now counts what failed, names it,
and exits non-zero:

    --- scanned 21 of 22 images ---
    NOT SCANNED: proxmox/proxmox-backup-client:latest

`failure: ignore` stays, which per Woodpecker's semantics reports the step as
failed while letting the workflow continue. That is deliberate: coverage is
reported, not enforced. The step goes red and the fix agent still runs on what
was scanned. Making the whole pipeline fail would mean one unscannable image
blocks all remediation.

The image that prompted this is gone with the nas-1 removal in the previous
commit, so the next run should report 20 of 20. The accounting is what matters
— the next dead reference will announce itself instead of being absorbed.

Refs #694
 2026-08-28 10:45:11 +02:00
claude-bot 9c9e45d17d chore(ansible): drop the nas-1 inventory, roles and plays 
nas-1 has been off for months. Everything scoped to it went with it:

  inventory/host_vars/nas-1.renner.uno/   vars and vault
  [synology_nas] in pve_hosts.yml         the group's only member
  roles/pbs-client/                       PBS backup client
  plays/install-pbs-client.yml            role-based, hosts: synology_nas
  plays/install-pbs-client-synology.yml   raw-module variant, same host
  plays/install-garage-synology.yml       Garage S3, replaced by Hetzner
  .woodpecker/install-garage-synology.yml the pipeline that ran it

The two PBS plays were already inconsistent with each other before the host
went away: the role pulled aterfax/pbs-client, while the standalone play
pulled proxmox/proxmox-backup-client, which has never existed on Docker Hub
(404). Nothing referenced the standalone play at all. Both are moot now.

pve_hosts.yml keeps its "gone from this file, and why" list, so synology_nas is
recorded there alongside pve_cluster and the in-cluster migrations rather than
vanishing without trace.

Checked: `ansible-inventory --graph` resolves, and grep finds no remaining
reference to synology_nas, nas-1, pbs-client or the garage play outside that
one note. plays/archived/ is left alone — it is history, not live config.
 2026-08-28 10:43:59 +02:00
claude-bot b68ef964d9 fix(apps): remove the file ingress pointing at a powered-off NAS 
file.renner.uno served HTTP 502. The Service is an ExternalName to
nas.renner.uno:7001, a CNAME to nas-1, and nas-1 has been off for months. The
Ingress and Service had been in the cluster for 110 days pointing at nothing.

Nothing caught it because file.renner.uno is not in the blackbox probe list, so
a publicly resolvable hostname returned 502 for months without a single alert.

The insecure-backend ServersTransport goes with it. It existed to let Traefik
re-encrypt to the NAS web UI's self-signed certificate and apps/file was its
only consumer, which its own header comment documents.
 2026-08-28 10:42:52 +02:00