elfenec/homelab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Homelab GitOps
163 commits 1 branch 0 tags 76 MiB
  • Shell 37.9%
  • Go Template 25.1%
  • Python 18.5%
  • HTML 8.5%
  • CSS 5.7%
  • Other 4.3%
Find a file
Exact
alfenec b9a6e21d05 fix(collabora): securityContext CAP_SYS_ADMIN (coolmount/jail -> documents ne chargeaient pas)
2026-09-14 17:17:56 +02:00
.opencode chore(opencode): versionne le skill create-homelab-app dans le repo homelab 2026-08-29 22:14:18 +02:00
apps fix(collabora): securityContext CAP_SYS_ADMIN (coolmount/jail -> documents ne chargeaient pas) 2026-09-14 17:17:56 +02:00
backups fix: remplacer le password Harbor registre hardcodé par HARBOR_REGISTRY_PASSWORD dans les scripts de sync 2026-07-25 02:13:06 +02:00
cert-manager fix: migrer les secrets SOPS, argocd connect, cert-manager ; ajouter .gitignore pour les secrets générés ; supprimer le secret Harbor en clair du chart cert-manager 2026-07-25 02:16:58 +02:00
ci fix(silverbullet): exclude silverbullet secret from ArgoCD, managed solely by sync-secrets.sh 2026-08-09 15:48:09 +02:00
ia feat(kubeopencode): suspend auto de l'agent après 10 min d'inactivité (standby.idleTimeout) 2026-09-08 15:03:27 +02:00
k8up re-write real initial file 2026-07-20 14:03:38 +02:00
mail fix(roundcube): set service.targetPort to 80 for -apache image variant 2026-07-20 18:26:56 +02:00
notebooks fix(silverbullet): exclude silverbullet secret from ArgoCD, managed solely by sync-secrets.sh 2026-08-09 15:48:09 +02:00
sealed-secrets fix: migrer les secrets Silverbullet (SSH key, admin password) vers SealedSecret et .gitignore 2026-07-25 02:16:31 +02:00
secrets security(kubeopencode): rotate Cloudflare AI Gateway token 2026-08-09 18:27:43 +02:00
skopeo initial commit: infrastructure Homelab avec Forgejo 2026-07-16 02:21:44 +02:00
widgets fix(silverbullet): remove initContainer crash by emptying git.repository, embed SealedSecret in chart 2026-08-09 15:31:48 +02:00
.drone.yml initial commit: infrastructure Homelab avec Forgejo 2026-07-16 02:21:44 +02:00
.gitignore fix: arrêter le tracking des backups Ghost (Stripe live keys, Mailgun API key, clés privées en clair) 2026-07-25 02:26:55 +02:00
NOTICE.md initial commit: infrastructure Homelab avec Forgejo 2026-07-16 02:21:44 +02:00
README.md fix: migrer les secrets SOPS, argocd connect, cert-manager ; ajouter .gitignore pour les secrets générés ; supprimer le secret Harbor en clair du chart cert-manager 2026-07-25 02:16:58 +02:00

README.md

Homelab — k3s GitOps Bootstrap

État au 18 juillet 2026 — cluster k3s v1.36.2 restauré après corruption PostgreSQL Harbor.

Cluster

Node Rôle OS Arch IP
piroof control-plane Debian 13 arm64 192.168.1.3
nixos worker Ubuntu 24.04 amd64 192.168.1.16

Bootstrap (ordre réel)

  1. k3s install — 2 nodes, CoreDNS + metrics-server + local-path
  2. ingress-nginx — LoadBalancer 192.168.1.16
  3. cert-manager — v1.16.3, ClusterIssuer letsencrypt-nginx
  4. MinIO — standalone S3 (minio.elfenec.org / minioapi.elfenec.org)
  5. Forgejo — Gitea fork (forgejo.elfenec.org, admin elfenec)
  6. ArgoCD — GitOps (argocd.elfenec.org, projet apps + secret)
  7. Harbor — v2.14.0, S3 backend MinIO, PostgreSQL standalone
  8. Apps — fenec, manim, n8n, kubermetrics, medusa (en cours)

Apps ArgoCD

App Sync Health Notes
fenec Unknown Healthy JupyterHub fenec
manim Unknown Healthy JupyterHub manim
n8n Unknown Healthy Workflows
kubermetrics Unknown Healthy Prometheus/Grafana stack
medusa Unknown Degraded En attente build Kaniko
reflector Synced Healthy Copie secrets Harbor
harbor-patch-* (x8) Synced Healthy Patch SA avec pull secret

Architecture clé

  • Harbor utilise MinIO comme backend S3 (harbor bucket)
  • Images mirrorées via skopeo copy (scripts apps/*/mirror-images.sh)
  • Pull secrets gérés par reflector + harbor-patch-appset (robot account)
  • Build custom via Kaniko (ci/image-builder, CRD builds.build.elfenec.org)
  • Cert staging pour Harbor (rate limit Let's Encrypt, retry 2026-07-19)

Dépendances

graph TD
  k3s --> ingress-nginx
  k3s --> cert-manager
  k3s --> MinIO
  MinIO --> Harbor
  Harbor --> n8n
  Harbor --> fenec
  Harbor --> manim
  Harbor --> kubermetrics
  Harbor --> medusa
  Forgejo --> ArgoCD
  ArgoCD --> Apps
  ingress-nginx --> Apps

Commandes utiles

# Voir tout
kubectl get pods,svc,ing,pvc -A

# Logs ArgoCD
kubectl logs -n argocd deployment/argocd-server

# Logs Harbor core
kubectl logs -n harbor deployment/harbor-core

# MinIO client (depuis host)
mc ls minio/harbor/registry/v2/

# Trigger mirror images
HARBOR_PASS=$HARBOR_PASS bash apps/n8n/mirror-images.sh

# Trigger Kaniko build
kubectl apply -f ci/image-builder/examples/build-medusa.yaml

Secrets

Secret Namespace Usage
harbor-pull-secret kube-system Reflected via reflector
connect-repo argocd Forgejo git credentials
connect-harbor argocd Harbor helm credentials

Problèmes connus

  • Harbor staging cert → containerd config insecure_skip_verify: true (fix via registries.yaml)
  • medusa image pas encore buildée (Kaniko en cours)
  • Apps ArgoCD en statut "Unknown" (sync à vérifier)
  • Let's Encrypt rate limit pour harbor.elfenec.org jusqu'au 2026-07-19