- gitea-runner.tf: Secret for Gitea runner registration token
- apps/gitea-runner.yaml: Gitea act-runner deployment (init container
registers with Gitea, main container runs daemon) — serves all Gitea
Actions CI jobs on self-hosted,linux,x64,legion labels
- variables.tf: Add gitea_runner_token variable
- ddclient.tf: Switch to official ghcr.io/ddclient/ddclient image,
remove linuxserver wrapper that was exhausting inotify instances
- ddclient.tf: dynamic DNS daemon that keeps dot.nook.family A record
pointing at the home public IP via Cloudflare API (updates every 5m)
- adguard.tf: cert-manager Certificate for dot.nook.family via DNS-01,
updated TLS config block with DoT paths and port 853
- apps/adguard.yaml: mount adguard-dot-tls secret, expose port 853,
init container enforces TLS/DoT settings on every restart
- adguard.tf: fix stale neuralplatform.dev → neuralplatform.ai rewrite
Android Private DNS: set to dot.nook.family
Router: forward TCP 853 → 192.168.68.77
ConfigMap adguard-defaults holds desired settings (upstreams, bootstrap DNS,
filter lists, rewrites). Init container merges them into the PVC config on
every pod start — no more manual kubectl edits needed.
- Switch upstreams to Cloudflare + Google DoH (Quad9 was failing)
- Bootstrap DNS IPv4-only (removes IPv6 timeout errors)
- Add OISD Big, EasyList, EasyPrivacy filter lists
- Fix DNS rewrites pointing to old IP 192.168.0.105
Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio,
devpi, registry, and registry-ui deployments+services to apps/*.yaml
so Argo CD manages the app layer. Terraform retains namespaces, PVCs,
ConfigMaps, Secrets, and Ingresses.
New Secrets in Terraform:
- kubernetes_secret.github_runner_secret (ci/github-runner-secret)
- kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret)
Hardcoded service names in ingress.tf and neuron.tf to remove
dependency on removed kubernetes_service resources.
Will Anderson