updates

clusters/blog/ghost-deployment.yaml

@@ -0,0 +1,96 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ghost-content
+  namespace: blog
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: local-path
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ghost
+  namespace: blog
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ghost
+  template:
+    metadata:
+      labels:
+        app: ghost
+    spec:
+      containers:
+      - name: ghost
+        image: ghost:6
+        ports:
+        - containerPort: 2368
+          name: http
+        env:
+        - name: NODE_ENV
+          value: production
+        - name: url
+          value: https://w5isp.com
+        - name: database__client
+          value: mysql
+        - name: database__connection__host
+          value: "10.0.19.6"
+        - name: database__connection__port
+          value: "3306"
+        - name: database__connection__database
+          value: ghost
+        - name: database__connection__user
+          value: ghost
+        - name: database__connection__password
+          valueFrom:
+            secretKeyRef:
+              name: ghost-db-secret
+              key: password
+        - name: mail__transport
+          value: SMTP
+        - name: mail__from
+          value: noreply@w5isp.com
+        - name: mail__options__service
+          value: Sendgrid
+        - name: mail__options__auth__user
+          value: apikey
+        - name: mail__options__auth__pass
+          valueFrom:
+            secretKeyRef:
+              name: ghost-smtp
+              key: password
+              optional: true
+        volumeMounts:
+        - name: ghost-content
+          mountPath: /var/lib/ghost/content
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "100m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+      volumes:
+      - name: ghost-content
+        persistentVolumeClaim:
+          claimName: ghost-content
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ghost
+  namespace: blog
+spec:
+  selector:
+    app: ghost
+  ports:
+  - port: 80
+    targetPort: 2368
+    protocol: TCP
+  type: LoadBalancer

clusters/blog/ghost-tailscale-service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ghost-tailscale
+  namespace: blog
+  annotations:
+    tailscale.com/expose: "true"
+    tailscale.com/hostname: "ghost"
+    tailscale.com/tags: "tag:k8s"
+spec:
+  selector:
+    app: ghost
+  ports:
+  - port: 80
+    targetPort: 2368
+    protocol: TCP
+  type: ClusterIP

clusters/wavelog/wavelog-deployment.yaml

@@ -0,0 +1,116 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: wavelog-data
+  namespace: wavelog
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: local-path
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: wavelog-uploads
+  namespace: wavelog
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi
+  storageClassName: local-path
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wavelog
+  namespace: wavelog
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: wavelog
+  template:
+    metadata:
+      labels:
+        app: wavelog
+    spec:
+      containers:
+      - name: wavelog
+        image: ghcr.io/wavelog/wavelog:latest
+        ports:
+        - containerPort: 80
+          name: http
+        env:
+        - name: WAVELOG_DB_TYPE
+          value: mysql
+        - name: WAVELOG_DB_HOST
+          value: "10.0.19.6"
+        - name: WAVELOG_DB_PORT
+          value: "3306"
+        - name: WAVELOG_DB_NAME
+          value: wavelog
+        - name: WAVELOG_DB_USER
+          value: wavelog
+        - name: WAVELOG_DB_PASS
+          valueFrom:
+            secretKeyRef:
+              name: wavelog-db-secret
+              key: password
+        - name: WAVELOG_BASE_URL
+          value: https://log.w5isp.com
+        volumeMounts:
+        - name: wavelog-data
+          mountPath: /var/www/wavelog
+        - name: wavelog-uploads
+          mountPath: /var/www/wavelog/uploads
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "100m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+      volumes:
+      - name: wavelog-data
+        persistentVolumeClaim:
+          claimName: wavelog-data
+      - name: wavelog-uploads
+        persistentVolumeClaim:
+          claimName: wavelog-uploads
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wavelog
+  namespace: wavelog
+spec:
+  selector:
+    app: wavelog
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+  type: LoadBalancer
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wavelog-tailscale
+  namespace: wavelog
+  annotations:
+    tailscale.com/expose: "true"
+    tailscale.com/hostname: "wavelog"
+    tailscale.com/tags: "tag:k8s"
+spec:
+  selector:
+    app: wavelog
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+  type: ClusterIP

home/ansible/deploy-mariadb.yml

@@ -0,0 +1,102 @@
+---
+- name: Deploy MariaDB LXC Container on Proxmox
+  hosts: proxmox
+  gather_facts: no
+  vars:
+    container_id: 301
+    container_hostname: mariadb
+    container_template: "local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst"
+    container_cores: 2
+    container_memory: 4096
+    container_storage: 50
+    container_ip: "10.0.19.6/24"
+    container_gateway: "10.0.19.254"
+    container_nameserver: "9.9.9.9"
+    container_password: "{{ lookup('password', '/dev/null length=20 chars=ascii_letters,digits') }}"
+
+  tasks:
+    - name: Check if container already exists
+      shell: pct status {{ container_id }}
+      register: container_status
+      ignore_errors: yes
+      changed_when: false
+
+    - name: Create MariaDB LXC container
+      shell: |
+        pct create {{ container_id }} {{ container_template }} \
+          --hostname {{ container_hostname }} \
+          --cores {{ container_cores }} \
+          --memory {{ container_memory }} \
+          --storage ceph \
+          --rootfs ceph:{{ container_storage }} \
+          --net0 name=eth0,bridge=vmbr0,ip={{ container_ip }},gw={{ container_gateway }} \
+          --nameserver {{ container_nameserver }} \
+          --password {{ container_password }} \
+          --unprivileged 1 \
+          --features nesting=1 \
+          --ostype debian
+      when: container_status.rc != 0
+
+    - name: Start the container
+      shell: pct start {{ container_id }}
+      when: container_status.rc != 0
+
+    - name: Wait for container to be ready
+      pause:
+        seconds: 30
+      when: container_status.rc != 0
+
+    - name: Update container and install MariaDB
+      shell: |
+        pct exec {{ container_id }} -- bash -c "
+          apt-get update
+          apt-get install -y mariadb-server mariadb-client
+          systemctl enable mariadb
+          systemctl start mariadb
+        "
+
+    - name: Secure MariaDB installation
+      shell: |
+        pct exec {{ container_id }} -- bash -c "
+          mysql -e \"ALTER USER 'root'@'localhost' IDENTIFIED BY 'mariadb_root_2024';\"
+          mysql -uroot -pmariadb_root_2024 -e \"DELETE FROM mysql.user WHERE User='';\"
+          mysql -uroot -pmariadb_root_2024 -e \"DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');\"
+          mysql -uroot -pmariadb_root_2024 -e \"DROP DATABASE IF EXISTS test;\"
+          mysql -uroot -pmariadb_root_2024 -e \"DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';\"
+          mysql -uroot -pmariadb_root_2024 -e \"FLUSH PRIVILEGES;\"
+        "
+
+    - name: Configure MariaDB for network access
+      shell: |
+        pct exec {{ container_id }} -- bash -c "
+          sed -i 's/^bind-address.*/bind-address = 0.0.0.0/' /etc/mysql/mariadb.conf.d/50-server.cnf
+          systemctl restart mariadb
+        "
+
+    - name: Configure firewall
+      shell: |
+        pct exec {{ container_id }} -- bash -c "
+          apt-get install -y ufw
+          ufw allow 3306/tcp
+          ufw --force enable
+        "
+
+    - name: Create Ghost database and user
+      shell: |
+        pct exec {{ container_id }} -- bash -c "
+          mysql -uroot -pmariadb_root_2024 -e \"CREATE DATABASE IF NOT EXISTS ghost CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;\"
+          mysql -uroot -pmariadb_root_2024 -e \"CREATE USER IF NOT EXISTS 'ghost'@'%' IDENTIFIED BY 'ghost_db_password_2024';\"
+          mysql -uroot -pmariadb_root_2024 -e \"GRANT ALL PRIVILEGES ON ghost.* TO 'ghost'@'%';\"
+          mysql -uroot -pmariadb_root_2024 -e \"FLUSH PRIVILEGES;\"
+        "
+
+    - name: Display container information
+      debug:
+        msg:
+          - "MariaDB container created successfully!"
+          - "Container ID: {{ container_id }}"
+          - "IP Address: 10.0.19.6"
+          - "Root password: mariadb_root_2024"
+          - "Ghost database: ghost"
+          - "Ghost user: ghost"
+          - "Ghost password: ghost_db_password_2024"

home/ansible/templates/Caddyfile.j2

@@ -61,4 +61,36 @@ photos.w5isp.com {
     }
 }
 
+# Ghost blog
+w5isp.com {
+    # Caddy will automatically obtain Let's Encrypt certificates
+    
+    reverse_proxy http://100.127.248.71 {
+        # Tell backend that SSL is handled by proxy
+        header_up Host {host}
+        header_up X-Real-IP {remote}
+        header_up X-Forwarded-Proto https
+        header_up X-Forwarded-Port 443
+        
+        # Ghost requires these headers
+        header_up X-Forwarded-For {remote}
+    }
+}
+
+# Wavelog amateur radio logging
+log.w5isp.com {
+    # Caddy will automatically obtain Let's Encrypt certificates
+    
+    reverse_proxy http://100.112.57.20 {
+        # Tell backend that SSL is handled by proxy
+        header_up Host {host}
+        header_up X-Real-IP {remote}
+        header_up X-Forwarded-Proto https
+        header_up X-Forwarded-Port 443
+        
+        # Wavelog requires these headers
+        header_up X-Forwarded-For {remote}
+    }
+}
+
 # Add more entries below as needed

home/terraform/dns_w5isp.tf

@@ -1,7 +1,7 @@
 resource "dnsimple_zone_record" "w5isp_root" {
   zone_name = "w5isp.com"
   name      = ""
-  value     = "204.110.191.8"
+  value     = "204.110.191.212"  # Points to Caddy proxy server
   type      = "A"
   ttl       = 3600
 }
@@ -30,13 +30,6 @@ resource "dnsimple_zone_record" "w5isp_home" {
   ttl       = 3600
 }
 
-resource "dnsimple_zone_record" "w5isp_log" {
-  zone_name = "w5isp.com"
-  name      = "log"
-  value     = "204.110.191.8"
-  type      = "A"
-  ttl       = 3600
-}
 
 resource "dnsimple_zone_record" "w5isp_photos" {
   zone_name = "w5isp.com"