ba99111753
Add media stack: Plex, Radarr, Sonarr, Prowlarr, qBittorrent, Bazarr, Overseerr
...
- Namespace: media (created via Terraform)
- Storage: hostPath PV at /media on Legion (movies, tv/shows, tv/anime, downloads)
- VPN: gluetun sidecar with ProtonVPN WireGuard (US-TX#253), all torrent traffic tunneled
- Radarr: movie automation with /media/movies root
- Sonarr: TV/anime automation with /media/tv/{shows,anime} roots
- Prowlarr: indexer aggregator (YTS, 1337x, Nyaa for anime)
- qBittorrent: torrent client, network namespaced behind gluetun VPN
- Bazarr: automatic subtitle downloads (connects to Radarr + Sonarr)
- Overseerr: family request portal at watch.nook.family
- Plex: media server at plex.nook.family
2026-04-10 22:50:13 -05:00
78c1c9750f
Add Memos journaling app at journal.neuralplatform.ai
2026-04-08 15:46:10 -05:00
54b2abf767
chore(neuron): deploy d97b23808e953dccf35d784c47ca003d74bcda61
2026-04-06 14:01:48 +00:00
937e138f7d
chore(neuron): deploy d3d72a5adbdddfd6c18ae674c921469d410dc7da
2026-04-06 13:44:50 +00:00
55f4eab6ae
chore(neuron): deploy bf185a6b19bfce25a3c67d4d13fa4e39b6fc6685
2026-04-06 13:38:05 +00:00
3ba1bf5c08
fix: neuron probes — use tcpSocket, /mcp returns 406 on plain GET
2026-04-06 04:17:11 -05:00
c138982fcf
fix: neuron health probes — /health 404, use /mcp endpoint
2026-04-06 04:14:51 -05:00
49b5604860
chore(neuron): deploy 2476e1167826cf320375143c09e94852b4330114
2026-04-06 07:54:36 +00:00
bf40bd7f15
feat: add Listmonk newsletter platform on Legion k3s
...
- Namespace, ExternalSecrets (Vault), DB init job, deployment, service, PVC, ingress
- Routes newsletter.harmonic-framework.com via existing Cloudflare tunnel
- Uses shared platform postgres with dedicated listmonk DB/user
- Credentials stored at secret/data/listmonk in Vault
2026-04-04 18:43:44 -05:00
6b546b6168
ci: bump runner pod to pick up valid_volumes config change
2026-04-04 10:27:06 -05:00
f3898d4c8e
ci: allow /var/run/docker.sock as valid volume for Docker builds
2026-04-04 10:24:37 -05:00
82ed0eb10b
feat: add Redpanda and wp-deploy-coordinator to Legion
...
- Redpanda single-node StatefulSet in platform namespace
- wp-coordinator deployment consuming wp.deploy topic
- RBAC for coordinator to exec into harmonic-wordpress pods
- R2 credentials via ExternalSecret (no SSH key needed on coordinator)
- Sites config as ConfigMap — add new WP sites without code changes
2026-04-04 10:18:09 -05:00
6a9db2094e
feat: add harmonic-wordpress dev environment on Legion
...
- Add harmonic-wordpress namespace
- WordPress + MySQL deployment with PVCs and ExternalSecrets
- Ingress for dev.harmonic-framework.com via Traefik + cert-manager
- Argo CD Application watching k8s/harmonic-wordpress/
- Add public Gitea repo credential for git.neuralplatform.ai
2026-04-04 09:47:41 -05:00
b23dc7a5c5
chore(neuron): deploy 3527a5c04037f8f2d24b67c9eab2c507e97b873c
2026-03-30 01:11:02 +00:00
e4d209ac03
chore(neuron): deploy 56718f795b875bfecf263d5f3a6c36beee665b6b
2026-03-30 00:58:15 +00:00
4515fd7fba
chore(neuron): deploy 9c86e158a5c45c5006da23a7bb7d826d0bbca8b3
2026-03-30 00:19:18 +00:00
1cf47477d3
Add MUDCraft Minecraft server infrastructure
...
- Purpur 1.21.4 server via itzg/docker-minecraft-server (java21)
- StatefulSet with 3 PVCs: worlds (20Gi), plugins (5Gi), logs (5Gi)
- Aikar G1GC JVM flags, 6GB heap (sized for Legion's 15GB RAM)
- Postgres: mudcraft database + user in existing platform/postgres
- RCON secret + DB password via ExternalSecret → Vault
- Traefik TCP entrypoint on port 25565 for mudcraft.nook.family
- mudcraft namespace via Terraform
- Argo CD app watching k8s/mudcraft/
2026-03-29 18:17:48 -05:00
9161ab0104
chore(neuron): deploy bc7035d932d72112ebd5bb7c0c20f7ff8b7c9a04
2026-03-27 16:31:42 +00:00
fda9a9d9fb
chore(neuron): deploy 2e06323389bd37eaabb5c0fa3bae72fa6a3459d0
2026-03-27 16:15:57 +00:00
e510207857
chore(neuron): deploy 56e092b61e9eb1b92ba753c0ba17914212ad58af
2026-03-27 16:05:11 +00:00
58448a445f
chore(neuron): deploy 87b0bad5c66abf7218dd51319d23eea3d1bfbd29
2026-03-27 16:00:05 +00:00
ff2b9238fd
chore(neuron): deploy 8e87d7057235151e430bbc78015732f463d6d323
2026-03-27 15:51:49 +00:00
f78b9b0d75
chore(neuron): deploy c8eeba5783de3f388ed0266d850fc0b26db219fd
2026-03-27 15:39:40 +00:00
485e09532e
scale down github-runner — no longer needed
2026-03-27 10:38:33 -05:00
7a53d14cf0
chore(neuron): deploy d69b7bf14a8b641c5685adc3171e7acf9b3b7112
2026-03-27 14:36:29 +00:00
076b3562f0
ci: map runner labels to ci-base image via docker:// scheme
2026-03-26 13:39:25 -05:00
aff34f061f
ci: set default_image to ci-base so all jobs get full tooling
2026-03-26 13:17:19 -05:00
a40897fd5d
ci: add ubuntu-latest, ubuntu-24.04 labels to runner
2026-03-26 12:48:38 -05:00
db08c5a208
ci: set runner default_image to ubuntu:24.04
...
Replace pantheon-ci:latest (custom, potentially stale) with ubuntu:24.04
as the fallback container for jobs that don't specify container:.
2026-03-26 11:41:55 -05:00
9595a18f3a
refactor: rebase CI runner on Ubuntu 24.04, rename to ci-base
...
Replace Alpine-based legion-runner with a minimal Ubuntu 24.04 image.
The act_runner binary is copied from the official image via multi-stage
build. Job-specific tooling (Ruby, Node, Python, etc.) belongs in
per-job container images specified via container: in workflows, not
in the base runner image.
Rename: legion-runner → ci-base
2026-03-26 11:32:52 -05:00
206873e83b
fix: set DEFAULT_ACTIONS_URL to Forgejo action mirrors
...
code.forgejo.org maintains up-to-date mirrors of common GitHub Actions
(checkout, upload-artifact, etc.) and is the recommended source for
Gitea Actions runners.
2026-03-26 11:06:43 -05:00
8425f0988c
fix: set Gitea DEFAULT_ACTIONS_URL to self
...
https://gitea.com is no longer a valid value in Gitea 1.25 — causes
startup crash. Use 'self' to point action references at this instance.
2026-03-26 10:41:54 -05:00
d8f2c822f8
fix: DEFAULT_ACTIONS_URL must be a full URL, not 'gitea'
2026-03-26 10:36:31 -05:00
f3477ac102
ci: fix gitea runner URL and set DEFAULT_ACTIONS_URL
...
- external-secrets.yaml: GITEA_INSTANCE_URL changed from cluster-internal
URL to https://git.neuralplatform.ai so runner can register externally
- gitea.yaml: add GITEA__actions__DEFAULT_ACTIONS_URL=gitea so all
actions/* references resolve from gitea.com, not github.com
- Dockerfile: track runner image (Python 3.12 + build deps) in repo
2026-03-26 10:35:13 -05:00
737fb27a5c
gitea-runner: use lean legion-runner base image
2026-03-26 08:01:41 -05:00
5f984e1fc2
gitea-runner: revert to pantheon-runner (container: directive unsupported in host mode)
2026-03-26 07:53:48 -05:00
4e9d3287d4
gitea-runner: use lean legion-runner base image
2026-03-26 07:51:21 -05:00
f409c06e65
gitea-runner: use pantheon-runner image (act_runner + all CI tools)
2026-03-25 20:39:32 -05:00
08d4ab1d72
gitea-runner: set default_image in container config to use pantheon-ci for all jobs
2026-03-25 20:37:17 -05:00
d5c5d753c7
ci: use custom pantheon-ci image; fix registry 413 with Traefik buffering middleware
2026-03-25 20:36:20 -05:00
ebb42a6dd2
gitea-runner: switch to native host execution with Legion tool mounts
2026-03-25 20:27:58 -05:00
672a890659
upgrade gitea 1.23 → 1.25.5
2026-03-25 20:22:54 -05:00
35055ec783
upgrade gitea to 1.23
2026-03-25 20:04:05 -05:00
24f2dcbf9b
Fix headscale DNS nameservers: use LAN IP and Cloudflare fallback
2026-03-25 10:59:45 -05:00
3737ff0bcb
fix: pin PVCs to existing PVs; fix kube-prometheus-stack grafana auth
...
PVC manifests: add volumeName to bind new PVCs to existing PVs whose
old PVCs were accidentally deleted during Terraform->ArgoCD migration.
All PVs patched to Retain to prevent data loss on pod restart.
kube-prometheus-stack: replace invalid adminPassword.valueFrom.secretKeyRef
(Helm values don't support k8s secretKeyRef syntax) with correct
admin.existingSecret + admin.passwordKey pattern.
2026-03-25 10:48:10 -05:00
4d0cfb1bbf
Migrate k8s config from Terraform to Argo CD + ESO
...
Phase 1: Install External Secrets Operator via Argo CD app
- apps/external-secrets.yaml — ESO Helm chart install
- apps/external-secrets-config.yaml — ClusterSecretStore deployment
- k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret
Phase 2: Create k8s manifests for all services
- k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress
- k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress
- k8s/github-runner/ — ExternalSecret (github-runner-secret)
- k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret)
- k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress
- k8s/postgres/ — ExternalSecret (postgres-passwords)
- k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault)
- k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret
- k8s/ollama/ — PVC, Ingress
- k8s/headscale/ — PVC
- k8s/packages/ — PVCs, ConfigMap, Ingresses
- k8s/registry/ — PVC, Ingresses
- k8s/backup/ — CronJob, ExternalSecret (backup-credentials)
New Argo CD apps for Helm releases:
- apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml
- apps/postgres.yaml, redis.yaml, vault.yaml
New Argo CD apps for k8s config paths:
- apps/neuron-config, gitea-config, ci-config, gitea-runner-config
- apps/monitoring-config, adguard-config, ollama-config, headscale-config
- apps/packages-config, registry-config, postgres-config, vault-config, backup
Phase 3: Strip Terraform to infrastructure-only
- All kubernetes_* and helm_release resources removed from service .tf files
- Each service .tf now contains only kubernetes_namespace (bootstrap dependency)
- variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token
- namespaces.tf gains external-secrets namespace
- ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/)
- cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)
2026-03-25 10:29:14 -05:00
abe2dad093
headscale: fix base_domain conflict, set ts.neuralplatform.ai for MagicDNS
2026-03-25 08:35:59 -05:00
a461172473
headscale: rename coordination endpoint to vpn.neuralplatform.ai
2026-03-25 08:16:47 -05:00
5334881d3f
infra: add Headscale — self-hosted Tailscale control plane
...
- headscale.tf: namespace + 1Gi PVC for SQLite state
- apps/headscale.yaml: Deployment (headscale/headscale:0.23) + Service + ConfigMap
- server_url: https://headscale.neuralplatform.ai
- sqlite3 backend, DERP via Tailscale's map
- MagicDNS base: vpn.neuralplatform.ai
- Cloudflare tunnel: headscale.neuralplatform.ai → headscale.headscale.svc:8080
- DNS CNAME added via API
Next: install tailscaled on Legion host, enroll as subnet router
2026-03-25 07:59:46 -05:00
1312be1a03
runner: bind-mount host kubectl into job containers; registry domain → neuralplatform.ai
...
gitea-runner: add container.options to mount /usr/local/bin/kubectl:ro
from the Legion host into every act_runner job container. Eliminates
per-run curl download in CI workflows.
ingress: change registry ingress hostname from registry.nook.family to
registry.neuralplatform.ai. Matches the domain used in Neuron CI and
neuron.yaml image reference. DNS CNAME + tunnel route already added.
2026-03-24 14:39:57 -05:00
Will Anderson