- Add Headscale VPN entry to services table with note about direct TLS
- Add Grafana/Prometheus/Alertmanager/Alloy to platform services
- Add VPN section with Headscale DNS configuration notes
- Add tea CLI section (replaces raw Gitea API examples)
- Expand namespace table with service detail and cert-manager note
- Terraform now owns infra only (namespaces, Cloudflare, R2), not k8s config
- Argo CD manages all k8s resources via git
- Secrets: Vault -> ExternalSecret -> ESO -> k8s Secret (no Terraform secrets)
- Updated Common Operations for new GitOps flow
- Added tea CLI note, corrected repo paths
PVC manifests: add volumeName to bind new PVCs to existing PVs whose
old PVCs were accidentally deleted during Terraform->ArgoCD migration.
All PVs patched to Retain to prevent data loss on pod restart.
kube-prometheus-stack: replace invalid adminPassword.valueFrom.secretKeyRef
(Helm values don't support k8s secretKeyRef syntax) with correct
admin.existingSecret + admin.passwordKey pattern.
- Fix gitea_domain default from git.neuralplatform.dev → git.neuralplatform.ai
so Traefik serves the correct Let's Encrypt cert when accessed via VPN/LAN
- Add docs/vpn-comparison.md: full evaluation of WireGuard/Tailscale/Headscale/Netbird/Netmaker
gitea-runner: add container.options to mount /usr/local/bin/kubectl:ro
from the Legion host into every act_runner job container. Eliminates
per-run curl download in CI workflows.
ingress: change registry ingress hostname from registry.nook.family to
registry.neuralplatform.ai. Matches the domain used in Neuron CI and
neuron.yaml image reference. DNS CNAME + tunnel route already added.
- Added Cloudflare Access bypass for git.neuralplatform.ai/api/actions/*
restricted to Legion public IP (72.204.75.49)
- Runner now registers and communicates with git.neuralplatform.ai directly
- Job containers clone from https://git.neuralplatform.ai (proper name)
Job containers use bridge network by default, so they can't resolve
gitea.git.svc.cluster.local. host network inherits k3s host routing
which can reach cluster service IPs directly.
Switch from :host to :docker execution so jobs run inside containers.
- Labels use docker://ghcr.io/catthehacker/ubuntu:act-22.04 (Python 3.10,
Node 18, Docker CLI — everything CI jobs need pre-installed)
- config.yaml passes docker.sock through to job containers for build/push
- Capacity set to 2 parallel jobs
Fixes: 'Cannot find: node in PATH' — actions/checkout@v4 requires Node
- Fix act-runner workingDir: /data on both init and main containers so
.runner registration file is found at daemon startup
- Add servers/legion/README.md with full service catalog and deploy docs
- Update root README.md to be an index pointing to key docs
- Fix monitoring.tf comment: grafana.neuralplatform.ai (not nook.family)
- Fix AGENTS.md router model to TP-Link Deco BE5000
- gitea-runner.tf: Secret for Gitea runner registration token
- apps/gitea-runner.yaml: Gitea act-runner deployment (init container
registers with Gitea, main container runs daemon) — serves all Gitea
Actions CI jobs on self-hosted,linux,x64,legion labels
- variables.tf: Add gitea_runner_token variable
- ddclient.tf: Switch to official ghcr.io/ddclient/ddclient image,
remove linuxserver wrapper that was exhausting inotify instances
- ddclient.tf: dynamic DNS daemon that keeps dot.nook.family A record
pointing at the home public IP via Cloudflare API (updates every 5m)
- adguard.tf: cert-manager Certificate for dot.nook.family via DNS-01,
updated TLS config block with DoT paths and port 853
- apps/adguard.yaml: mount adguard-dot-tls secret, expose port 853,
init container enforces TLS/DoT settings on every restart
- adguard.tf: fix stale neuralplatform.dev → neuralplatform.ai rewrite
Android Private DNS: set to dot.nook.family
Router: forward TCP 853 → 192.168.68.77
Routes all warning/critical alerts to the Neural Platform Slack workspace.
Suppresses Watchdog and info-level noise. Groups by namespace+alertname,
repeats every 4h. Uses bot token auth via chat.postMessage API.
ConfigMap adguard-defaults holds desired settings (upstreams, bootstrap DNS,
filter lists, rewrites). Init container merges them into the PVC config on
every pod start — no more manual kubectl edits needed.
- Switch upstreams to Cloudflare + Google DoH (Quad9 was failing)
- Bootstrap DNS IPv4-only (removes IPv6 timeout errors)
- Add OISD Big, EasyList, EasyPrivacy filter lists
- Fix DNS rewrites pointing to old IP 192.168.0.105
Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio,
devpi, registry, and registry-ui deployments+services to apps/*.yaml
so Argo CD manages the app layer. Terraform retains namespaces, PVCs,
ConfigMaps, Secrets, and Ingresses.
New Secrets in Terraform:
- kubernetes_secret.github_runner_secret (ci/github-runner-secret)
- kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret)
Hardcoded service names in ingress.tf and neuron.tf to remove
dependency on removed kubernetes_service resources.
Will Anderson