Commits
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This reverts commit 958e60ccdd2ae465a1b4441ef179f68109501ed8.
Collapse the control plane from 3x cx23 to a single cx33 on Hetzner, and
add off-node etcd snapshots (siderolabs/talos-backup, 6-hourly) to the Ceph
object store, encrypted with age. A single etcd member has no quorum, so the
backup is the recovery path if the control-plane node or its disk is lost.
Backup auth uses a talos.dev ServiceAccount scoped to os:etcd:backup, backed
by a new machine.features.kubernetesTalosAPIAccess block on the control
plane. Also sets includeCoAuthoredBy: false for the repo.
feat: add harbor registry with authentik oidc
Harbor 2.15 (chart 1.19.1) as a services-group app: CNPG-backed external
postgres, internal redis, hcloud-volumes persistence, exposed through the
public gateway at harbor.tibor.sh.
All chart-generated component secrets are pinned via existingSecret
references (sops-encrypted, age-only recipients) so ArgoCD renders stay
deterministic. OIDC is wired both ways: an authentik blueprint creates
the provider/application (client secret via authentik-oidc-clients env
secret), and a post-deploy job PUTs the matching oidc_auth config into
Harbor's API. tibor joins the new harbor-admins group for oidc admin.
rework: single terragrunt + argocd application layer
main advanced the old three-stage Terraform module architecture
(terragrunt/{foundation,extensions} with Keycloak, RKE, metallb,
ingress-nginx, rancher) via renovate bumps and further module
refactoring. This branch already abandoned that architecture wholesale
in the "fresh slate" commit (11e7fa6) in favor of a single terragrunt
provisioning unit plus an ArgoCD-managed applications/ layer, and never
reinstated it across 100+ subsequent commits.
Conflict resolution keeps this branch's architecture throughout:
- All old-architecture files under terragrunt/foundation/**,
terragrunt/extensions/**, and old keycloak templates stay deleted,
including new content main added there after the branches diverged.
- terragrunt/cluster/{main.tf,terragrunt.hcl}, README.md,
applications/kustomization.yaml, and shell.nix keep this branch's
versions, which already reflect the new architecture.
- scripts/init_gitlab.sh, renovate.json, scripts/create_docs.sh, and
terragrunt/README.md stay dropped, matching the "fresh slate" intent
(they configure/document the old architecture and were never
reintroduced on this branch).
- applications/README.md is taken from main as-is: it's a new,
architecture-agnostic addition that doesn't conflict with anything
here.
Collapse the control plane from 3x cx23 to a single cx33 on Hetzner, and
add off-node etcd snapshots (siderolabs/talos-backup, 6-hourly) to the Ceph
object store, encrypted with age. A single etcd member has no quorum, so the
backup is the recovery path if the control-plane node or its disk is lost.
Backup auth uses a talos.dev ServiceAccount scoped to os:etcd:backup, backed
by a new machine.features.kubernetesTalosAPIAccess block on the control
plane. Also sets includeCoAuthoredBy: false for the repo.
Harbor 2.15 (chart 1.19.1) as a services-group app: CNPG-backed external
postgres, internal redis, hcloud-volumes persistence, exposed through the
public gateway at harbor.tibor.sh.
All chart-generated component secrets are pinned via existingSecret
references (sops-encrypted, age-only recipients) so ArgoCD renders stay
deterministic. OIDC is wired both ways: an authentik blueprint creates
the provider/application (client secret via authentik-oidc-clients env
secret), and a post-deploy job PUTs the matching oidc_auth config into
Harbor's API. tibor joins the new harbor-admins group for oidc admin.
main advanced the old three-stage Terraform module architecture
(terragrunt/{foundation,extensions} with Keycloak, RKE, metallb,
ingress-nginx, rancher) via renovate bumps and further module
refactoring. This branch already abandoned that architecture wholesale
in the "fresh slate" commit (11e7fa6) in favor of a single terragrunt
provisioning unit plus an ArgoCD-managed applications/ layer, and never
reinstated it across 100+ subsequent commits.
Conflict resolution keeps this branch's architecture throughout:
- All old-architecture files under terragrunt/foundation/**,
terragrunt/extensions/**, and old keycloak templates stay deleted,
including new content main added there after the branches diverged.
- terragrunt/cluster/{main.tf,terragrunt.hcl}, README.md,
applications/kustomization.yaml, and shell.nix keep this branch's
versions, which already reflect the new architecture.
- scripts/init_gitlab.sh, renovate.json, scripts/create_docs.sh, and
terragrunt/README.md stay dropped, matching the "fresh slate" intent
(they configure/document the old architecture and were never
reintroduced on this branch).
- applications/README.md is taken from main as-is: it's a new,
architecture-agnostic addition that doesn't conflict with anything
here.