k-space/kube
12
1
Fork 3
Code Issues 66 Pull Requests Wiki Activity
913 Commits 1 Branch 0 Tags
e17b0e0b413e27147a938d5008a24c69f7601380
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Erki AasandClaude Opus 4.8 e17b0e0b41 Make gitea OAuth2 JWT_SECRET a valid, stable 43-char key 
GITEA__OAUTH2__JWT_SECRET must base64url-decode to 32 bytes. The size-32
claim decoded to 24 bytes, so 1.27 rejected it and generated its own key
on each boot; since app.ini lives on an emptyDir that regenerated every
restart and logged out all OAuth2 clients. size 43 decodes to 32 bytes,
so the rotated key is accepted and stays stable across restarts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-09-15 22:38:10 +03:00
Erki AasandClaude Opus 4.8 18034b7cd9 Rotate gitea INTERNAL_TOKEN and JWT_SECRET into separate claims 
Post-breach (CVE-2026-59774) rotation. All three security secrets shared
one generated value via the gitea-random SecretClaim, and the file-read
exploit leaked it. Split INTERNAL_TOKEN and JWT_SECRET into their own
claims (gitea-internal-token, gitea-oauth2-jwt) with fresh distinct
values and repoint the StatefulSet at them.

INTERNAL_TOKEN is the secret the attacker actually used against the
still-internet-reachable /api/internal, so this closes reuse of any saved
copy. Rotating JWT_SECRET invalidates gitea-issued OAuth2 and LFS tokens,
so the OAuth2 integrations (Woodpecker, tea, credential helpers) need one
re-login.

SECRET_KEY is deliberately left on gitea-random: rotating it would break
the 2 push mirrors (encrypted creds) and must be done in a window that
re-enters those credentials.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-09-15 22:23:56 +03:00
Erki AasandClaude Opus 5 bcb637685a Pin gitea SSH_LISTEN_PORT to 2222 
The rootless image defaulted SSH_LISTEN_PORT to SSH_PORT until 1.26; in
1.27 docker-setup.sh leaves it empty, so Gitea fell back to SSH_PORT=22
and crash-looped with "listen tcp :22: bind: permission denied" as uid
1000. The Service already maps 22 -> 2222, so pin the listen port
explicitly rather than depending on an image default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-09-15 22:07:01 +03:00
Erki AasandClaude Opus 5 c525300036 gitea v1.27.3 
Fixes CVE-2026-59774, an unauthenticated arbitrary file read in the
Org-mode renderer (POST /{owner}/{repo}/markup, #+INCLUDE directive)
affecting 1.22.1-1.27.0. It was used against this instance on 2026-09-10
to read app.ini, steal INTERNAL_TOKEN and plant an uploadpack
packObjectsHook that ran a Monero miner on every clone. The 1.25 branch
never received the fix, so this skips 1.26.

Env-var config still works: the rootless image's environment-to-ini is
now a shim for `gitea config edit-ini --in-place --apply-env`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-09-15 22:04:34 +03:00
Erki Aas 8a76219544 Enable ceph pvc snapshots 2026-08-31 18:14:34 +03:00
Erki Aas eb3ff2dfb5 Cap mikrotik exporter probes 2026-08-31 17:52:13 +03:00
Erki Aas 50887550e0 Let Argo ignore dynamically generated secret diffs 2026-08-31 17:50:52 +03:00
Erki Aas ae7b3fe8ff Excempt 1G modules from 10G link rate degraded alert 2026-08-31 16:46:05 +03:00
Erki Aas bdfc82633f Pin working SecretClaimOperator image 2026-08-31 16:37:39 +03:00
Erki Aas ccb361a0b1 Fix rosdump alert 2026-08-31 16:37:18 +03:00
Erki Aas 9c72de9a8d Use etherpad secret 2026-08-23 14:30:24 +03:00
Erki Aas 9ad15aa58f Upgrade etherpad 2026-08-23 14:24:51 +03:00
Erki Aas fa78dba6a9 Update Calico CRD 2026-08-23 13:31:03 +03:00
Erki Aas 7216e85889 Improve stability of Calico upgrades 2026-08-23 13:30:51 +03:00
Erki Aas 31f3ea0376 Improve ArgoCD prom rule 2026-08-23 13:30:28 +03:00
Erki Aas 0307fca109 Upgrade Calico and fully disable vxlan 2026-08-23 13:10:35 +03:00
Erki Aas f1b601b0c1 Fix KubernetesStatefulsetDown prom rule 2026-08-23 13:10:13 +03:00
Erki Aas 20df574678 Add stable secret to woodpecker agent 2026-08-22 23:57:43 +03:00
Erki Aas 825d4cf602 Fix traefik prom rule 2026-08-22 23:14:13 +03:00
Erki Aas 47f92fd058 Fix rook connection with pve ceph cluster 2026-08-10 02:00:20 +03:00
Erki Aas 64ece67ed7 Fix rspamd memory limit 2026-08-10 01:46:06 +03:00
Erki Aas aed9fb1c29 Update Freescout volume mount per new image 2026-08-10 00:31:03 +03:00
Erki Aas 636e0f72cc wildduck: fix cert renewal 2026-07-21 15:55:30 +03:00
Erki Aas c20bb80915 passmower: upgrade to 1.3.0 2026-06-26 11:49:07 +03:00
Erki Aas 2d891c42e9 fix(wildduck): supress xOriginatingIP header 2026-05-22 10:00:57 +03:00
Erki Aas 2cdea27b74 Fix haraka config 2026-04-16 17:07:07 +03:00
Erki Aas 3ebacea720 Fix haraka config 2026-04-16 17:02:14 +03:00
Erki Aas 2e611270ed Upgrade wildduck components 2026-04-16 16:58:09 +03:00
Erki Aas a303146c5d Cleanup 2025-12-28 22:35:42 +02:00
Erki Aas 3ce56bc860 Fix etherpad networkpolicy 2025-12-28 22:25:00 +02:00
Erki Aas dc31b51e9d Fix etherpad networkpolicy 2025-12-28 22:17:48 +02:00
Erki Aas c88abafeb5 Fix etherpad networkpolicy 2025-12-28 22:17:17 +02:00
Erki Aas d9183ec8c5 Fix etherpad networkpolicy 2025-12-28 22:14:59 +02:00
Erki Aas 4f7c595a2d Dedicated mariadb for etherpad 2025-12-28 22:07:39 +02:00
Erki Aas ec0c616b82 Dedicated mariadb for grafana 2025-12-28 22:04:21 +02:00
Erki Aas f4612d96b3 Run inventory mongo as rs 2025-12-23 00:16:55 +02:00
Erki Aas 2a62eb67f2 Dedicated mariadb for woodpecker 2025-12-22 23:08:20 +02:00
Erki Aas c4a361a426 Dedicated mariadb for woodpecker 2025-12-22 22:32:49 +02:00
Erki Aas a895efd44c Dedicated mariadb for woodpecker 2025-12-22 22:30:32 +02:00
Erki Aas 61212eed98 Dedicated mariadb for woodpecker 2025-12-22 22:29:38 +02:00
Erki Aas e151e0f92e Dedicated mongo for inventory 2025-12-22 22:17:19 +02:00
Erki Aas 676cd6890d Dedicated mongo for wildduck 2025-12-22 22:01:18 +02:00
Erki Aas 7183690873 Dedicated mongo for wildduck 2025-12-22 21:52:35 +02:00
Erki Aas c74041cffc Dedicated mongo for inventory 2025-12-22 21:37:15 +02:00
Erki Aas d174b12e73 Migrate nextcloud to harbor s3 2025-12-22 19:45:30 +02:00
Erki Aas aed0f55e3f Migrate nextcloud to harbor s3 2025-12-22 19:41:42 +02:00
Erki Aas 2590e2f35f Dedicated postgres for harbor 2025-12-22 19:37:16 +02:00
Erki Aas 2732baca95 Dedicated postgres for harbor 2025-12-22 19:13:59 +02:00
Erki Aas 8efd07940e Dedicated postgres for harbor 2025-12-22 18:43:49 +02:00
Erki Aas 6f2aa0e907 Dedicated postgres for harbor 2025-12-22 18:39:26 +02:00
Erki Aas b23a007672 Dedicated postgres for harbor 2025-12-22 18:34:13 +02:00
Erki Aas 6e9240328e Migrate harbor to garage s3 2025-12-22 17:50:56 +02:00
Erki Aas ab57c3cd7b Add garage s3 2025-12-22 17:50:07 +02:00
Erki Aas aace0ff288 Update mikrotik-exporter 2025-12-05 11:35:04 +02:00
Erki Aas 36cd4f7fc0 Update mikrotik-exporter 2025-12-05 10:09:52 +02:00
Erki Aas 40eabdf9f8 Update mikrotik-exporter 2025-12-05 09:27:54 +02:00
Erki Aas e08abcf3fe Fix nextcloud installation, use dedicated DB 2025-11-28 15:39:58 +02:00
Erki Aas 20889f093e Migrate wiki to dedicated mariadb 2025-11-27 21:26:09 +02:00
Erki Aas 98f934b705 Migrate gitea to dedicated mariadb 2025-11-27 21:20:58 +02:00
Erki Aas 200086a3c7 Migrate freescout to upstream image and local storage 2025-11-27 21:11:09 +02:00
Erki Aas f9074ba60d Add mariadb for freescout 2025-11-27 19:52:14 +02:00
Erki Aas ffbef05bce Add mariadb for freescout 2025-11-27 19:44:21 +02:00
Erki Aas 46a4d3bd2b Add mariadb for freescout 2025-11-27 19:40:35 +02:00
Erki Aas e0e7a4ab21 Add mariadb for freescout 2025-11-27 19:37:25 +02:00
Erki Aas 75dacabc72 Add mariadb for freescout 2025-11-27 19:34:08 +02:00
Erki Aas 42383a8009 Add rotmower 2025-11-18 19:08:11 +02:00
Erki Aas e75272c5ff Add rotmower 2025-11-18 19:05:33 +02:00
Erki Aas 25531431f7 Add rotmower 2025-11-18 18:59:16 +02:00
Erki Aas 0c073d4ef2 Add rotmower 2025-11-18 18:57:40 +02:00
Erki Aas ae0b3d3939 Add rotmower 2025-11-18 18:55:22 +02:00
Erki Aas d123517e63 Increase/remove prometheus resource limits 2025-11-13 19:57:07 +02:00
Erki Aas a491e5961b Add scrapeconfig support 2025-11-13 19:50:17 +02:00
Erki Aas f9601bf5a5 Add ceph monitoring 2025-11-13 19:39:21 +02:00
Erki Aas ae16e4c83f Add ceph monitoring 2025-11-13 19:28:01 +02:00
Erki Aas 4b7073997c Add unifi controller 2025-08-14 22:22:50 +03:00
Erki Aas f27a92a545 Add unifi controller 2025-08-14 21:48:48 +03:00
Erki Aas f823300169 Add unifi controller 2025-08-14 21:42:32 +03:00
Erki Aas c0f79a229c Add unifi controller 2025-08-14 21:06:59 +03:00
Erki Aas d8120a3b0d Add unifi controller 2025-08-14 20:34:28 +03:00
Erki Aas 07c04bf216 Add unifi controller 2025-08-14 20:31:19 +03:00
Erki Aas 16fd71d6f0 Add unifi controller 2025-08-14 20:29:41 +03:00
Erki Aas da0f3ea05f Add unifi controller 2025-08-14 20:28:42 +03:00
Erki Aas 1204039ba3 Remove longhorn 2025-08-14 18:58:54 +03:00
Erki Aas a85367da34 Add cephfs storage class 2025-08-14 18:56:21 +03:00
Erki Aas 9a02fcdef0 Add cephfs storage class 2025-08-14 18:55:26 +03:00
Erki Aas b6d4ee2b05 Migrate all storage classes to ceph 2025-08-14 18:55:07 +03:00
Erki Aas 9c66882d83 Use cephfs for harbor job pvc 2025-08-14 18:40:34 +03:00
Erki Aas 18d181f36a Disable csi-proxmox 2025-08-08 00:45:29 +03:00
Erki Aas 88eae1c35c Allow rook on control plane nodes 2025-08-07 22:11:50 +03:00
Erki Aas 79ebad6730 Disable managing rook-ceph secrets 2025-08-07 22:05:27 +03:00
Erki Aas 24229639b4 Allow rook on control plane nodes 2025-08-07 21:42:03 +03:00
Erki Aas 71d0667009 Fix ceph storage classes 2025-08-07 21:17:03 +03:00
Erki Aas ad35fc4828 Migrate storage classes to ceph 2025-08-07 21:06:44 +03:00
Erki Aas 86668b80a3 Fix external-snapshotter 2025-08-07 18:50:45 +03:00
Erki Aas d74e4fd76f Fix external-snapshotter 2025-08-07 18:46:53 +03:00
Erki Aas 605ad868bb Fix external-snapshotter 2025-08-07 18:44:39 +03:00
Erki Aas 20704e3a24 Add kubernetes-csi/external-snapshotter 2025-08-04 19:40:03 +03:00
Erki Aas 4dc45594f1 Fix rook config 2025-08-03 20:41:28 +03:00
Erki Aas 103c4deff4 Fix rook config 2025-08-03 20:35:47 +03:00
Erki Aas 6b753d4bf1 Fix rook config 2025-08-03 20:32:15 +03:00