graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

updates

Browse source
This commit is contained in:
Graham McIntire 2025-09-08 10:13:45 -05:00
parent 27bb17d366
commit 1d5607da71
No known key found for this signature in database
17 changed files with 854 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
home/ansible/caddy-almalinux.yml
View file

@ -59,6 +59,7 @@
- unzip
- python3-libsemanage
- python3-policycoreutils
- iptables-services
update_cache: yes
- name: Enable and start firewalld
@ -122,7 +123,7 @@
failed_when: false
- name: Authenticate Tailscale
command: tailscale up --authkey="{{ tailscale_key }}" --accept-routes --hostname=caddy
command: tailscale up --authkey="{{ tailscale_key }}" --hostname=caddy
when:
- tailscale_key is defined
- tailscale_key != ""
@ -170,6 +171,35 @@
setype: http_port_t
state: present
# Note about SSH forwarding:
# Since SSH doesn't support hostname-based routing, you have two options:
# 1. Use git.w5isp.com:22 which forwards ALL SSH to Forgejo (can't SSH to caddy directly)
# 2. Use different ports: caddy.w5isp.com:22 for server, git.w5isp.com:2222 for git
# 3. Configure client-side SSH config to use ProxyJump through caddy server
- name: Create SSH config info
copy:
content: |
# SSH Configuration for git.w5isp.com
#
# Since SSH protocol doesn't support hostname-based routing like HTTP,
# users need to configure their SSH client to access git properly.
#
# Add this to your ~/.ssh/config:
#
# Host git.w5isp.com
# ProxyJump caddy.w5isp.com
# HostName 100.109.233.14
# User git
# Port 22
#
# This allows:
# - ssh caddy.w5isp.com → Direct access to caddy server
# - ssh git.w5isp.com → Access to Forgejo via ProxyJump
# - git clone git@git.w5isp.com:user/repo.git → Works with ProxyJump
dest: /etc/ssh/ssh_routing_info.txt
mode: '0644'
handlers:
- name: reload caddy
service:

42
home/ansible/check-postgres-container.yml Normal file
View file

@ -0,0 +1,42 @@
---
- name: Check PostgreSQL Container 300 Status
hosts: lab02
gather_facts: no
tasks:
- name: List PostgreSQL clusters
ansible.builtin.command: pct exec 300 -- pg_lsclusters
register: pg_clusters
changed_when: false
- name: Display PostgreSQL clusters
ansible.builtin.debug:
msg: "{{ pg_clusters.stdout_lines }}"
- name: Check disk space for PostgreSQL
ansible.builtin.command: pct exec 300 -- df -h /var/lib/postgresql
register: disk_space
changed_when: false
- name: Display disk space
ansible.builtin.debug:
msg: "{{ disk_space.stdout_lines }}"
- name: List databases and their sizes
ansible.builtin.command: |
pct exec 300 -- sudo -u postgres psql -c "SELECT datname, pg_size_pretty(pg_database_size(datname)) as size FROM pg_database ORDER BY pg_database_size(datname) DESC;"
register: db_sizes
changed_when: false
- name: Display database sizes
ansible.builtin.debug:
msg: "{{ db_sizes.stdout_lines }}"
- name: Check active connections
ansible.builtin.command: |
pct exec 300 -- sudo -u postgres psql -c "SELECT datname, count(*) as connections FROM pg_stat_activity GROUP BY datname ORDER BY connections DESC;"
register: active_connections
changed_when: false
- name: Display active connections
ansible.builtin.debug:
msg: "{{ active_connections.stdout_lines }}"

9
home/ansible/inventory.yml
View file

@ -47,3 +47,12 @@ all:
ansible_ssh_private_key_file: "~/.ssh/ansible"
ansible_python_interpreter: /usr/bin/python3
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
postgresql:
hosts:
postgres-lxc:
ansible_host: 10.0.19.5
vars:
ansible_user: root # LXC containers typically use root
ansible_ssh_private_key_file: "~/.ssh/id_rsa" # Try default key
ansible_python_interpreter: /usr/bin/python3
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"

73
home/ansible/postgresql-pre-check-via-proxmox.yml Normal file
View file

@ -0,0 +1,73 @@
---
- name: Pre-upgrade checks for PostgreSQL via Proxmox
hosts: lab02 # Proxmox host
become: yes
gather_facts: no
vars:
container_id: 300
tasks:
- name: Check if container is running
command: pct status {{ container_id }}
register: container_status
changed_when: false
- name: Display container status
debug:
var: container_status.stdout
- name: Check current PostgreSQL version
command: pct exec {{ container_id }} -- sudo -u postgres psql -t -c "SELECT version();"
register: pg_version
changed_when: false
- name: Display current version
debug:
msg: "Current version: {{ pg_version.stdout }}"
- name: List PostgreSQL clusters
command: pct exec {{ container_id }} -- pg_lsclusters
register: pg_clusters
changed_when: false
- name: Display clusters
debug:
var: pg_clusters.stdout_lines
- name: Check disk space in container
command: pct exec {{ container_id }} -- df -h /var/lib/postgresql
register: disk_space
changed_when: false
- name: Display disk space
debug:
var: disk_space.stdout_lines
- name: List installed PostgreSQL packages
command: pct exec {{ container_id }} -- dpkg -l | grep postgresql
register: pg_packages
changed_when: false
- name: Display PostgreSQL packages
debug:
var: pg_packages.stdout_lines
- name: Get database sizes
command: |
pct exec {{ container_id }} -- sudo -u postgres psql -t -c "SELECT pg_database.datname, pg_size_pretty(pg_database_size(pg_database.datname)) FROM pg_database WHERE datname NOT IN ('template0', 'template1') ORDER BY pg_database_size(pg_database.datname) DESC;"
register: db_sizes
changed_when: false
- name: Display database sizes
debug:
var: db_sizes.stdout_lines
- name: Check active connections
command: |
pct exec {{ container_id }} -- sudo -u postgres psql -t -c "SELECT count(*) as connections, datname FROM pg_stat_activity GROUP BY datname ORDER BY connections DESC;"
register: active_connections
changed_when: false
- name: Display active connections
debug:
var: active_connections.stdout_lines

85
home/ansible/postgresql-pre-upgrade-check.yml Normal file
View file

@ -0,0 +1,85 @@
---
- name: Pre-upgrade checks for PostgreSQL
hosts: postgresql
become: yes
gather_facts: yes
tasks:
- name: Check current PostgreSQL version
command: sudo -u postgres psql -t -c "SELECT version();"
register: pg_version
changed_when: false
- name: Display current version
debug:
msg: "Current version: {{ pg_version.stdout }}"
- name: Check PostgreSQL service status
command: systemctl status postgresql
register: pg_status
changed_when: false
- name: List PostgreSQL clusters
command: pg_lsclusters
register: pg_clusters
changed_when: false
- name: Display clusters
debug:
var: pg_clusters.stdout_lines
- name: Get database sizes
become_user: postgres
shell: |
psql -t -c "SELECT pg_database.datname, pg_size_pretty(pg_database_size(pg_database.datname)) FROM pg_database WHERE datname NOT IN ('template0', 'template1') ORDER BY pg_database_size(pg_database.datname) DESC;"
register: db_sizes
changed_when: false
- name: Display database sizes
debug:
msg: "Database sizes:"
- name: Show database sizes
debug:
var: db_sizes.stdout_lines
- name: Check disk space
command: df -h /var/lib/postgresql
register: disk_space
changed_when: false
- name: Display disk space
debug:
var: disk_space.stdout_lines
- name: List installed PostgreSQL packages
shell: dpkg -l | grep postgresql | grep -E "^ii"
register: pg_packages
changed_when: false
- name: Display PostgreSQL packages
debug:
var: pg_packages.stdout_lines
- name: Check active connections
become_user: postgres
shell: |
psql -t -c "SELECT count(*) as connections, datname FROM pg_stat_activity GROUP BY datname ORDER BY connections DESC;"
register: active_connections
changed_when: false
- name: Display active connections
debug:
var: active_connections.stdout_lines
- name: Check for replication slots (if any)
become_user: postgres
command: psql -t -c "SELECT * FROM pg_replication_slots;"
register: replication_slots
changed_when: false
ignore_errors: yes
- name: Display replication slots
debug:
var: replication_slots.stdout_lines
when: replication_slots.rc == 0

173
home/ansible/postgresql-upgrade-15-to-17.yml Normal file
View file

@ -0,0 +1,173 @@
---
- name: Upgrade PostgreSQL from 15 to 17
hosts: postgresql
become: yes
gather_facts: yes
vars:
old_version: 15
new_version: 17
postgres_data_dir: "/var/lib/postgresql"
backup_dir: "/var/backups/postgresql-upgrade-{{ ansible_date_time.epoch }}"
tasks:
- name: Check current PostgreSQL version
command: sudo -u postgres psql -t -c "SELECT version();"
register: pg_version_check
changed_when: false
- name: Display current PostgreSQL version
debug:
msg: "Current PostgreSQL version: {{ pg_version_check.stdout }}"
- name: Install required packages
apt:
name:
- postgresql-{{ new_version }}
- postgresql-client-{{ new_version }}
- postgresql-contrib-{{ new_version }}
- postgresql-{{ new_version }}-postgis-3 # If PostGIS is needed
state: present
update_cache: yes
- name: Stop PostgreSQL services
service:
name: "{{ item }}"
state: stopped
loop:
- "postgresql@{{ old_version }}-main"
- "postgresql@{{ new_version }}-main"
ignore_errors: yes
- name: Create backup directory
file:
path: "{{ backup_dir }}"
state: directory
owner: postgres
group: postgres
mode: '0755'
- name: Get list of databases
become_user: postgres
postgresql_info:
filter: databases
register: pg_databases
- name: Backup all databases
become_user: postgres
command: |
pg_dumpall -p 5432 > {{ backup_dir }}/all_databases.sql
environment:
PGVERSION: "{{ old_version }}"
- name: Backup PostgreSQL configuration files
copy:
src: "{{ item }}"
dest: "{{ backup_dir }}/"
remote_src: yes
owner: postgres
group: postgres
loop:
- "/etc/postgresql/{{ old_version }}/main/postgresql.conf"
- "/etc/postgresql/{{ old_version }}/main/pg_hba.conf"
ignore_errors: yes
- name: Check if new cluster exists
stat:
path: "/etc/postgresql/{{ new_version }}/main"
register: new_cluster_check
- name: Drop new cluster if it exists
command: pg_dropcluster {{ new_version }} main --stop
when: new_cluster_check.stat.exists
ignore_errors: yes
- name: Upgrade PostgreSQL cluster
command: |
pg_upgradecluster {{ old_version }} main
register: upgrade_result
environment:
LC_ALL: C.UTF-8
LANG: C.UTF-8
- name: Show upgrade result
debug:
var: upgrade_result.stdout_lines
- name: Start new PostgreSQL service
service:
name: "postgresql@{{ new_version }}-main"
state: started
enabled: yes
- name: Verify new PostgreSQL version
command: sudo -u postgres psql -p 5432 -t -c "SELECT version();"
register: new_pg_version
changed_when: false
- name: Display new PostgreSQL version
debug:
msg: "New PostgreSQL version: {{ new_pg_version.stdout }}"
- name: Update PostgreSQL configuration
lineinfile:
path: "/etc/postgresql/{{ new_version }}/main/postgresql.conf"
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
loop:
- { regexp: '^#?listen_addresses', line: "listen_addresses = '*'" }
- { regexp: '^#?max_connections', line: "max_connections = 200" }
- { regexp: '^#?shared_buffers', line: "shared_buffers = 2GB" }
- { regexp: '^#?effective_cache_size', line: "effective_cache_size = 6GB" }
- { regexp: '^#?work_mem', line: "work_mem = 16MB" }
notify: restart postgresql
- name: Update pg_hba.conf for network access
blockinfile:
path: "/etc/postgresql/{{ new_version }}/main/pg_hba.conf"
block: |
# Allow connections from K3s cluster
host all all 10.0.19.0/24 scram-sha-256
host all all 10.0.0.0/8 scram-sha-256
marker: "# {mark} ANSIBLE MANAGED BLOCK - K3s access"
notify: restart postgresql
- name: Check if PostGIS extension needs update
become_user: postgres
command: psql -d forgejo -c "SELECT PostGIS_version();"
register: postgis_check
ignore_errors: yes
changed_when: false
- name: Update PostGIS extension if present
become_user: postgres
command: psql -d {{ item }} -c "ALTER EXTENSION postgis UPDATE;"
loop:
- forgejo
- postgres
when: postgis_check.rc == 0
ignore_errors: yes
- name: Run ANALYZE on all databases
become_user: postgres
command: psql -d {{ item }} -c "ANALYZE;"
loop: "{{ pg_databases.databases.keys() | select('ne', 'template0') | list }}"
when: pg_databases.databases is defined
ignore_errors: yes
- name: Display upgrade summary
debug:
msg:
- "PostgreSQL upgrade completed successfully!"
- "Old version: PostgreSQL {{ old_version }}"
- "New version: PostgreSQL {{ new_version }}"
- "Backup location: {{ backup_dir }}"
- ""
- "IMPORTANT: The old cluster is still present but stopped."
- "After verifying everything works correctly, you can remove it with:"
- " sudo pg_dropcluster {{ old_version }} main"
handlers:
- name: restart postgresql
service:
name: "postgresql@{{ new_version }}-main"
state: restarted

184
home/ansible/postgresql-upgrade-manual-steps.md Normal file
View file

@ -0,0 +1,184 @@
# Manual PostgreSQL 15 to 17 Upgrade Steps
## Prerequisites
- SSH into Proxmox host: `ssh root@10.0.16.231` (or appropriate host)
- Access PostgreSQL container: `pct enter 300`
## Step 1: Pre-upgrade Checks
```bash
# Check current version
sudo -u postgres psql -t -c "SELECT version();"
# List current clusters
pg_lsclusters
# Check disk space
df -h /var/lib/postgresql
# List databases and sizes
sudo -u postgres psql -t -c "SELECT pg_database.datname, pg_size_pretty(pg_database_size(pg_database.datname)) FROM pg_database WHERE datname NOT IN ('template0', 'template1') ORDER BY pg_database_size(pg_database.datname) DESC;"
# Check active connections
sudo -u postgres psql -t -c "SELECT count(*) as connections, datname FROM pg_stat_activity GROUP BY datname ORDER BY connections DESC;"
```
## Step 2: Backup Current Data
```bash
# Create backup directory
mkdir -p /var/backups/postgresql-upgrade-$(date +%s)
cd /var/backups/postgresql-upgrade-$(date +%s)
# Backup all databases
sudo -u postgres pg_dumpall > all_databases.sql
# Backup configuration files
cp /etc/postgresql/15/main/postgresql.conf postgresql.conf.backup
cp /etc/postgresql/15/main/pg_hba.conf pg_hba.conf.backup
# Note important settings from postgresql.conf
grep -E "listen_addresses|max_connections|shared_buffers|effective_cache_size|work_mem" /etc/postgresql/15/main/postgresql.conf
```
## Step 3: Install PostgreSQL 17
```bash
# Add PostgreSQL APT repository
apt-get update
apt-get install -y wget ca-certificates
wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
echo "deb http://apt.postgresql.org/pub/repos/apt/ bookworm-pgdg main" > /etc/apt/sources.list.d/pgdg.list
apt-get update
# Install PostgreSQL 17
apt-get install -y postgresql-17 postgresql-client-17 postgresql-contrib-17
# If using PostGIS
apt-get install -y postgresql-17-postgis-3
```
## Step 4: Stop Services
```bash
# Stop all PostgreSQL services
systemctl stop postgresql
# Verify services are stopped
systemctl status postgresql
```
## Step 5: Perform the Upgrade
```bash
# Check clusters again
pg_lsclusters
# Drop the empty PostgreSQL 17 cluster (if it was auto-created)
pg_dropcluster 17 main --stop
# Upgrade the cluster
pg_upgradecluster 15 main
# This will:
# - Create new cluster with PostgreSQL 17
# - Migrate all data
# - Update ports (old cluster moves to 5433, new stays on 5432)
```
## Step 6: Configure PostgreSQL 17
```bash
# Edit postgresql.conf
nano /etc/postgresql/17/main/postgresql.conf
# Update these settings:
# listen_addresses = '*'
# max_connections = 200
# shared_buffers = 2GB
# effective_cache_size = 6GB
# work_mem = 16MB
# Edit pg_hba.conf for network access
nano /etc/postgresql/17/main/pg_hba.conf
# Add these lines:
# host all all 10.0.19.0/24 scram-sha-256
# host all all 10.0.0.0/8 scram-sha-256
```
## Step 7: Start and Verify
```bash
# Start PostgreSQL 17
systemctl start postgresql@17-main
systemctl enable postgresql@17-main
# Check status
systemctl status postgresql@17-main
# Verify version
sudo -u postgres psql -p 5432 -t -c "SELECT version();"
# Check clusters
pg_lsclusters
# Test connection
sudo -u postgres psql -l
```
## Step 8: Post-upgrade Tasks
```bash
# Update PostGIS extension (if used)
sudo -u postgres psql -d forgejo -c "ALTER EXTENSION postgis UPDATE;"
# Run ANALYZE on all databases for optimizer statistics
for db in $(sudo -u postgres psql -t -c "SELECT datname FROM pg_database WHERE datname NOT IN ('template0', 'template1');"); do
echo "Analyzing $db..."
sudo -u postgres psql -d $db -c 'ANALYZE;'
done
# Test remote connectivity
# From another host:
# psql -h 10.0.19.5 -U forgejo -d forgejo
```
## Step 9: Cleanup (After Verification)
```bash
# Once everything is confirmed working:
# Stop old cluster
systemctl stop postgresql@15-main
# Optional: Remove old cluster (only after thorough testing!)
# pg_dropcluster 15 main
# Remove old packages (only after thorough testing!)
# apt-get remove postgresql-15 postgresql-client-15 postgresql-contrib-15
```
## Important Notes
- The old PostgreSQL 15 cluster will remain on port 5433
- The new PostgreSQL 17 cluster will be on port 5432
- Ensure all applications are tested before removing the old cluster
- Keep backups for at least 30 days after upgrade
- Monitor logs: `tail -f /var/log/postgresql/postgresql-17-main.log`
## Rollback Plan
If issues occur:
```bash
# Stop PostgreSQL 17
systemctl stop postgresql@17-main
# Change PostgreSQL 15 back to port 5432
sed -i 's/port = 5433/port = 5432/' /etc/postgresql/15/main/postgresql.conf
# Start PostgreSQL 15
systemctl start postgresql@15-main
# Update applications to point back to PostgreSQL 15
```

129
home/ansible/postgresql-upgrade-via-proxmox.yml Normal file
View file

@ -0,0 +1,129 @@
---
- name: Upgrade PostgreSQL from 15 to 17 via Proxmox
hosts: lab02 # Proxmox host where the LXC container runs
become: yes
gather_facts: yes
vars:
container_id: 300
old_version: 15
new_version: 17
backup_dir: "/var/backups/postgresql-upgrade-{{ ansible_date_time.epoch }}"
tasks:
- name: Check current PostgreSQL version
command: pct exec {{ container_id }} -- sudo -u postgres psql -t -c "SELECT version();"
register: pg_version_check
changed_when: false
- name: Display current PostgreSQL version
debug:
msg: "Current PostgreSQL version: {{ pg_version_check.stdout }}"
- name: Update package lists in container
command: pct exec {{ container_id }} -- apt-get update
changed_when: false
- name: Install PostgreSQL 17 repository
command: |
pct exec {{ container_id }} -- bash -c "
apt-get install -y wget ca-certificates &&
wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - &&
echo 'deb http://apt.postgresql.org/pub/repos/apt/ bookworm-pgdg main' > /etc/apt/sources.list.d/pgdg.list &&
apt-get update
"
- name: Install PostgreSQL 17 packages
command: |
pct exec {{ container_id }} -- apt-get install -y postgresql-17 postgresql-client-17 postgresql-contrib-17 postgresql-17-postgis-3
- name: Stop PostgreSQL services
command: pct exec {{ container_id }} -- systemctl stop postgresql
- name: Create backup directory
command: pct exec {{ container_id }} -- mkdir -p {{ backup_dir }}
- name: Set ownership of backup directory
command: pct exec {{ container_id }} -- chown postgres:postgres {{ backup_dir }}
- name: Backup all databases
command: |
pct exec {{ container_id }} -- sudo -u postgres pg_dumpall -p 5432 > {{ container_id }}_postgres_backup.sql
delegate_to: localhost
- name: Copy backup into container
command: |
pct push {{ container_id }} {{ container_id }}_postgres_backup.sql {{ backup_dir }}/all_databases.sql
- name: List current clusters
command: pct exec {{ container_id }} -- pg_lsclusters
register: clusters_before
changed_when: false
- name: Display current clusters
debug:
var: clusters_before.stdout_lines
- name: Drop PostgreSQL 17 cluster if exists
command: pct exec {{ container_id }} -- pg_dropcluster {{ new_version }} main --stop
ignore_errors: yes
- name: Upgrade PostgreSQL cluster
command: pct exec {{ container_id }} -- pg_upgradecluster {{ old_version }} main
register: upgrade_result
- name: Show upgrade result
debug:
var: upgrade_result.stdout_lines
- name: Start PostgreSQL 17
command: pct exec {{ container_id }} -- systemctl start postgresql@{{ new_version }}-main
- name: Enable PostgreSQL 17
command: pct exec {{ container_id }} -- systemctl enable postgresql@{{ new_version }}-main
- name: Verify new PostgreSQL version
command: pct exec {{ container_id }} -- sudo -u postgres psql -p 5432 -t -c "SELECT version();"
register: new_pg_version
changed_when: false
- name: Display new PostgreSQL version
debug:
msg: "New PostgreSQL version: {{ new_pg_version.stdout }}"
- name: Update PostgreSQL configuration for network access
command: |
pct exec {{ container_id }} -- bash -c "
sed -i \"s/^#listen_addresses.*/listen_addresses = '*'/\" /etc/postgresql/{{ new_version }}/main/postgresql.conf &&
echo 'host all all 10.0.19.0/24 scram-sha-256' >> /etc/postgresql/{{ new_version }}/main/pg_hba.conf &&
echo 'host all all 10.0.0.0/8 scram-sha-256' >> /etc/postgresql/{{ new_version }}/main/pg_hba.conf
"
- name: Restart PostgreSQL to apply configuration
command: pct exec {{ container_id }} -- systemctl restart postgresql@{{ new_version }}-main
- name: Run ANALYZE on all databases
command: |
pct exec {{ container_id }} -- bash -c "
for db in \$(sudo -u postgres psql -t -c \"SELECT datname FROM pg_database WHERE datname NOT IN ('template0', 'template1');\"); do
sudo -u postgres psql -d \$db -c 'ANALYZE;'
done
"
ignore_errors: yes
- name: Clean up local backup file
file:
path: "{{ container_id }}_postgres_backup.sql"
state: absent
delegate_to: localhost
- name: Display upgrade summary
debug:
msg:
- "PostgreSQL upgrade completed successfully!"
- "Old version: PostgreSQL {{ old_version }}"
- "New version: PostgreSQL {{ new_version }}"
- "Backup location in container: {{ backup_dir }}"
- ""
- "IMPORTANT: The old cluster is still present but stopped."
- "After verifying everything works correctly, you can remove it with:"
- " pct exec {{ container_id }} -- pg_dropcluster {{ old_version }} main"

13
home/ansible/ssh-config-template.j2 Normal file
View file

@ -0,0 +1,13 @@
# SSH Configuration for git.w5isp.com access
# This config allows users to SSH to git.w5isp.com for Git operations
# while still allowing direct SSH to caddy.w5isp.com
Host git.w5isp.com
HostName caddy.w5isp.com
Port 2222
User git
Host caddy.w5isp.com
HostName caddy.w5isp.com
Port 22
User graham

46
home/ansible/templates/Caddyfile.j2
View file

@ -15,4 +15,50 @@ git.w5isp.com {
}
}
# APRS application
aprs.me {
# Caddy will automatically obtain Let's Encrypt certificates
reverse_proxy http://100.93.178.105 {
# Tell backend that SSL is handled by proxy
header_up Host {host}
header_up X-Real-IP {remote}
header_up X-Forwarded-Proto https
header_up X-Forwarded-Port 443
# Enable WebSocket support
header_up Upgrade {http.request.header.Upgrade}
header_up Connection {http.request.header.Connection}
}
}
# Jellyfin media server
jellyfin.w5isp.com {
# Caddy will automatically obtain Let's Encrypt certificates
reverse_proxy http://10.0.16.1:8096 {
# Tell backend that SSL is handled by proxy
header_up Host {host}
header_up X-Real-IP {remote}
header_up X-Forwarded-Proto https
header_up X-Forwarded-Port 443
}
}
# Immich photo management
photos.w5isp.com {
# Caddy will automatically obtain Let's Encrypt certificates
reverse_proxy http://10.0.16.1:2283 {
# Tell backend that SSL is handled by proxy
header_up Host {host}
header_up X-Real-IP {remote}
header_up X-Forwarded-Proto https
header_up X-Forwarded-Port 443
# Immich requires these additional headers for proper operation
header_up X-Forwarded-For {remote}
}
}
# Add more entries below as needed

2
home/cluster/aprs/aprs-statefulset.yaml
View file

@ -119,6 +119,8 @@ spec:
value: "aprs.me"
- name: PORT
value: "4000"
- name: PHX_CHECK_ORIGIN
value: "false"
- name: DATABASE_URL
valueFrom:
secretKeyRef:

19
home/cluster/aprs/aprs-tailscale-service.yaml Normal file
View file

@ -0,0 +1,19 @@
apiVersion: v1
kind: Service
metadata:
name: aprs-tailscale
namespace: aprs
annotations:
tailscale.com/expose: "true"
tailscale.com/hostname: "aprs"
tailscale.com/funnel: "true"
spec:
type: LoadBalancer
loadBalancerClass: tailscale
selector:
app: aprs
ports:
- name: http
port: 80
targetPort: 4000
protocol: TCP

26
home/terraform/.terraform.lock.hcl generated
View file

@ -1,6 +1,29 @@
# This file is maintained automatically by "tofu init".
# Manual edits may be lost in future updates.
provider "registry.opentofu.org/cloudflare/cloudflare" {
version = "4.52.2"
constraints = "~> 4.0"
hashes = [
"h1:nFaCutAjRKkGsRsRH0kMdJCZMslrdAHaJI1XxAgkjPo=",
"zh:08238aa3fdcfb89697c84c7777004eb26b069c17117bef75b0e70aec5019dea2",
"zh:12d7f25f8722f941bca10e30fc8cdea470d92f83fbdfb7d1476df6612895c1d1",
"zh:236865850d06bb790b8d6fa579eee5866ef92ea8dd9f1c836a5946eb18195e0b",
"zh:52ae35d6260609931402d44d3d946384c84c5b5ad25e3b5cc5b6644765e1b25c",
"zh:67be160b7c3277fbfaa595aff4186f74067af0735f613f4fe037dabe58fc2e5f",
"zh:6e1492149084b277be4f65cd3a0c08794ba63b42211148575c709187635047d8",
"zh:716c00b62ac6c30fb9ee24d69d89fa6a6465e272d1caf5adb3c9b6b43a152e6b",
"zh:7c3b6cbe12d73727e18606901875541b1f0f56ca506400434399813ea9b56686",
"zh:7cd7806cc9eb62475b6c0c2bf7520a1ff204b96ce62390941d474cbaa480207b",
"zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
"zh:98bca149a0535cbb8bdc5fe1c173237dde4b184f085bb7d592f5bf1842ff293e",
"zh:b1b8b0161f06f1c013d8697deee2d92e44025e1218262ea4fb071f6864304629",
"zh:cb857d44e4f707be2bed0d8eb2178b9e7a7422e5416e92929da7ec7c2c0d7451",
"zh:d34490872248369c8da4ff77f96fe089c4bae6fb1b17632e76c6b115726058db",
"zh:f993f7dafaa3c6a4f9ff8b50af0af74357d2e2b83526d5f18a788bdbd4b41615",
]
}
provider "registry.opentofu.org/dnsimple/dnsimple" {
version = "1.8.0"
constraints = "1.8.0"
@ -48,7 +71,8 @@ provider "registry.opentofu.org/kyswtn/porkbun" {
}
provider "registry.opentofu.org/pan-net/powerdns" {
version = "1.5.0"
version = "1.5.0"
constraints = "1.5.0"
hashes = [
"h1:oMzrqQGFY88Cwx06YkFHP6io3jow/22FRZkeK0UZtGY=",
"zh:02d1a87c28635779f66d1dcf165b5f16530f809deb6c71c35c3e58d715a88bf4",

14
home/terraform/dns_w5isp.tf
View file

@ -41,7 +41,7 @@ resource "dnsimple_zone_record" "w5isp_log" {
resource "dnsimple_zone_record" "w5isp_photos" {
zone_name = "w5isp.com"
name = "photos"
value = "204.110.191.8"
value = "204.110.191.212" # Points to Caddy proxy server
type = "A"
ttl = 3600
}
@ -65,7 +65,7 @@ resource "dnsimple_zone_record" "w5isp_ntfy" {
resource "dnsimple_zone_record" "w5isp_jellyfin" {
zone_name = "w5isp.com"
name = "jellyfin"
value = "204.110.191.8"
value = "204.110.191.212" # Points to Caddy proxy server
type = "A"
ttl = 3600
}
@ -176,3 +176,13 @@ resource "dnsimple_zone_record" "w5isp_caddy" {
type = "A"
ttl = 3600
}
# Git server - points to Caddy proxy which forwards to Forgejo
resource "dnsimple_zone_record" "w5isp_git" {
zone_name = "w5isp.com"
name = "git"
value = "204.110.191.212" # Points to Caddy proxy server
type = "A"
ttl = 3600
}

9
home/terraform/main.tf
View file

@ -16,6 +16,10 @@ terraform {
source = "vultr/vultr"
version = "~> 2.0"
}
cloudflare = {
source = "cloudflare/cloudflare"
version = "~> 4.0"
}
# proxmox = {
# source = "bpg/proxmox"
# version = "~> 0.66"
@ -43,6 +47,11 @@ provider "vultr" {
api_key = var.vultr_api_key
}
provider "cloudflare" {
# API token is read from CLOUDFLARE_API_TOKEN environment variable
# No explicit api_token parameter needed - provider automatically reads the env var
}
# provider "proxmox" {
# endpoint = var.proxmox_api_url
# username = var.proxmox_user

2
home/terraform/terraform.tfstate
View file

File diff suppressed because one or more lines are too long

2
home/terraform/terraform.tfstate.backup
View file

File diff suppressed because one or more lines are too long