937e138f7d
chore(neuron): deploy d3d72a5adbdddfd6c18ae674c921469d410dc7da
2026-04-06 13:44:50 +00:00
55f4eab6ae
chore(neuron): deploy bf185a6b19bfce25a3c67d4d13fa4e39b6fc6685
2026-04-06 13:38:05 +00:00
3ba1bf5c08
fix: neuron probes — use tcpSocket, /mcp returns 406 on plain GET
2026-04-06 04:17:11 -05:00
c138982fcf
fix: neuron health probes — /health 404, use /mcp endpoint
2026-04-06 04:14:51 -05:00
49b5604860
chore(neuron): deploy 2476e1167826cf320375143c09e94852b4330114
2026-04-06 07:54:36 +00:00
bf40bd7f15
feat: add Listmonk newsletter platform on Legion k3s
...
- Namespace, ExternalSecrets (Vault), DB init job, deployment, service, PVC, ingress
- Routes newsletter.harmonic-framework.com via existing Cloudflare tunnel
- Uses shared platform postgres with dedicated listmonk DB/user
- Credentials stored at secret/data/listmonk in Vault
2026-04-04 18:43:44 -05:00
6b546b6168
ci: bump runner pod to pick up valid_volumes config change
2026-04-04 10:27:06 -05:00
f3898d4c8e
ci: allow /var/run/docker.sock as valid volume for Docker builds
2026-04-04 10:24:37 -05:00
82ed0eb10b
feat: add Redpanda and wp-deploy-coordinator to Legion
...
- Redpanda single-node StatefulSet in platform namespace
- wp-coordinator deployment consuming wp.deploy topic
- RBAC for coordinator to exec into harmonic-wordpress pods
- R2 credentials via ExternalSecret (no SSH key needed on coordinator)
- Sites config as ConfigMap — add new WP sites without code changes
2026-04-04 10:18:09 -05:00
6a9db2094e
feat: add harmonic-wordpress dev environment on Legion
...
- Add harmonic-wordpress namespace
- WordPress + MySQL deployment with PVCs and ExternalSecrets
- Ingress for dev.harmonic-framework.com via Traefik + cert-manager
- Argo CD Application watching k8s/harmonic-wordpress/
- Add public Gitea repo credential for git.neuralplatform.ai
2026-04-04 09:47:41 -05:00
b23dc7a5c5
chore(neuron): deploy 3527a5c04037f8f2d24b67c9eab2c507e97b873c
2026-03-30 01:11:02 +00:00
e4d209ac03
chore(neuron): deploy 56718f795b875bfecf263d5f3a6c36beee665b6b
2026-03-30 00:58:15 +00:00
4515fd7fba
chore(neuron): deploy 9c86e158a5c45c5006da23a7bb7d826d0bbca8b3
2026-03-30 00:19:18 +00:00
1cf47477d3
Add MUDCraft Minecraft server infrastructure
...
- Purpur 1.21.4 server via itzg/docker-minecraft-server (java21)
- StatefulSet with 3 PVCs: worlds (20Gi), plugins (5Gi), logs (5Gi)
- Aikar G1GC JVM flags, 6GB heap (sized for Legion's 15GB RAM)
- Postgres: mudcraft database + user in existing platform/postgres
- RCON secret + DB password via ExternalSecret → Vault
- Traefik TCP entrypoint on port 25565 for mudcraft.nook.family
- mudcraft namespace via Terraform
- Argo CD app watching k8s/mudcraft/
2026-03-29 18:17:48 -05:00
9161ab0104
chore(neuron): deploy bc7035d932d72112ebd5bb7c0c20f7ff8b7c9a04
2026-03-27 16:31:42 +00:00
fda9a9d9fb
chore(neuron): deploy 2e06323389bd37eaabb5c0fa3bae72fa6a3459d0
2026-03-27 16:15:57 +00:00
e510207857
chore(neuron): deploy 56e092b61e9eb1b92ba753c0ba17914212ad58af
2026-03-27 16:05:11 +00:00
58448a445f
chore(neuron): deploy 87b0bad5c66abf7218dd51319d23eea3d1bfbd29
2026-03-27 16:00:05 +00:00
ff2b9238fd
chore(neuron): deploy 8e87d7057235151e430bbc78015732f463d6d323
2026-03-27 15:51:49 +00:00
f78b9b0d75
chore(neuron): deploy c8eeba5783de3f388ed0266d850fc0b26db219fd
2026-03-27 15:39:40 +00:00
485e09532e
scale down github-runner — no longer needed
2026-03-27 10:38:33 -05:00
7a53d14cf0
chore(neuron): deploy d69b7bf14a8b641c5685adc3171e7acf9b3b7112
2026-03-27 14:36:29 +00:00
076b3562f0
ci: map runner labels to ci-base image via docker:// scheme
2026-03-26 13:39:25 -05:00
aff34f061f
ci: set default_image to ci-base so all jobs get full tooling
2026-03-26 13:17:19 -05:00
a40897fd5d
ci: add ubuntu-latest, ubuntu-24.04 labels to runner
2026-03-26 12:48:38 -05:00
db08c5a208
ci: set runner default_image to ubuntu:24.04
...
Replace pantheon-ci:latest (custom, potentially stale) with ubuntu:24.04
as the fallback container for jobs that don't specify container:.
2026-03-26 11:41:55 -05:00
9595a18f3a
refactor: rebase CI runner on Ubuntu 24.04, rename to ci-base
...
Replace Alpine-based legion-runner with a minimal Ubuntu 24.04 image.
The act_runner binary is copied from the official image via multi-stage
build. Job-specific tooling (Ruby, Node, Python, etc.) belongs in
per-job container images specified via container: in workflows, not
in the base runner image.
Rename: legion-runner → ci-base
2026-03-26 11:32:52 -05:00
206873e83b
fix: set DEFAULT_ACTIONS_URL to Forgejo action mirrors
...
code.forgejo.org maintains up-to-date mirrors of common GitHub Actions
(checkout, upload-artifact, etc.) and is the recommended source for
Gitea Actions runners.
2026-03-26 11:06:43 -05:00
8425f0988c
fix: set Gitea DEFAULT_ACTIONS_URL to self
...
https://gitea.com is no longer a valid value in Gitea 1.25 — causes
startup crash. Use 'self' to point action references at this instance.
2026-03-26 10:41:54 -05:00
d8f2c822f8
fix: DEFAULT_ACTIONS_URL must be a full URL, not 'gitea'
2026-03-26 10:36:31 -05:00
f3477ac102
ci: fix gitea runner URL and set DEFAULT_ACTIONS_URL
...
- external-secrets.yaml: GITEA_INSTANCE_URL changed from cluster-internal
URL to https://git.neuralplatform.ai so runner can register externally
- gitea.yaml: add GITEA__actions__DEFAULT_ACTIONS_URL=gitea so all
actions/* references resolve from gitea.com, not github.com
- Dockerfile: track runner image (Python 3.12 + build deps) in repo
2026-03-26 10:35:13 -05:00
737fb27a5c
gitea-runner: use lean legion-runner base image
2026-03-26 08:01:41 -05:00
5f984e1fc2
gitea-runner: revert to pantheon-runner (container: directive unsupported in host mode)
2026-03-26 07:53:48 -05:00
4e9d3287d4
gitea-runner: use lean legion-runner base image
2026-03-26 07:51:21 -05:00
f409c06e65
gitea-runner: use pantheon-runner image (act_runner + all CI tools)
2026-03-25 20:39:32 -05:00
08d4ab1d72
gitea-runner: set default_image in container config to use pantheon-ci for all jobs
2026-03-25 20:37:17 -05:00
d5c5d753c7
ci: use custom pantheon-ci image; fix registry 413 with Traefik buffering middleware
2026-03-25 20:36:20 -05:00
ebb42a6dd2
gitea-runner: switch to native host execution with Legion tool mounts
2026-03-25 20:27:58 -05:00
672a890659
upgrade gitea 1.23 → 1.25.5
2026-03-25 20:22:54 -05:00
35055ec783
upgrade gitea to 1.23
2026-03-25 20:04:05 -05:00
24f2dcbf9b
Fix headscale DNS nameservers: use LAN IP and Cloudflare fallback
2026-03-25 10:59:45 -05:00
3737ff0bcb
fix: pin PVCs to existing PVs; fix kube-prometheus-stack grafana auth
...
PVC manifests: add volumeName to bind new PVCs to existing PVs whose
old PVCs were accidentally deleted during Terraform->ArgoCD migration.
All PVs patched to Retain to prevent data loss on pod restart.
kube-prometheus-stack: replace invalid adminPassword.valueFrom.secretKeyRef
(Helm values don't support k8s secretKeyRef syntax) with correct
admin.existingSecret + admin.passwordKey pattern.
2026-03-25 10:48:10 -05:00
4d0cfb1bbf
Migrate k8s config from Terraform to Argo CD + ESO
...
Phase 1: Install External Secrets Operator via Argo CD app
- apps/external-secrets.yaml — ESO Helm chart install
- apps/external-secrets-config.yaml — ClusterSecretStore deployment
- k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret
Phase 2: Create k8s manifests for all services
- k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress
- k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress
- k8s/github-runner/ — ExternalSecret (github-runner-secret)
- k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret)
- k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress
- k8s/postgres/ — ExternalSecret (postgres-passwords)
- k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault)
- k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret
- k8s/ollama/ — PVC, Ingress
- k8s/headscale/ — PVC
- k8s/packages/ — PVCs, ConfigMap, Ingresses
- k8s/registry/ — PVC, Ingresses
- k8s/backup/ — CronJob, ExternalSecret (backup-credentials)
New Argo CD apps for Helm releases:
- apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml
- apps/postgres.yaml, redis.yaml, vault.yaml
New Argo CD apps for k8s config paths:
- apps/neuron-config, gitea-config, ci-config, gitea-runner-config
- apps/monitoring-config, adguard-config, ollama-config, headscale-config
- apps/packages-config, registry-config, postgres-config, vault-config, backup
Phase 3: Strip Terraform to infrastructure-only
- All kubernetes_* and helm_release resources removed from service .tf files
- Each service .tf now contains only kubernetes_namespace (bootstrap dependency)
- variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token
- namespaces.tf gains external-secrets namespace
- ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/)
- cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)
2026-03-25 10:29:14 -05:00
abe2dad093
headscale: fix base_domain conflict, set ts.neuralplatform.ai for MagicDNS
2026-03-25 08:35:59 -05:00
a461172473
headscale: rename coordination endpoint to vpn.neuralplatform.ai
2026-03-25 08:16:47 -05:00
5334881d3f
infra: add Headscale — self-hosted Tailscale control plane
...
- headscale.tf: namespace + 1Gi PVC for SQLite state
- apps/headscale.yaml: Deployment (headscale/headscale:0.23) + Service + ConfigMap
- server_url: https://headscale.neuralplatform.ai
- sqlite3 backend, DERP via Tailscale's map
- MagicDNS base: vpn.neuralplatform.ai
- Cloudflare tunnel: headscale.neuralplatform.ai → headscale.headscale.svc:8080
- DNS CNAME added via API
Next: install tailscaled on Legion host, enroll as subnet router
2026-03-25 07:59:46 -05:00
1312be1a03
runner: bind-mount host kubectl into job containers; registry domain → neuralplatform.ai
...
gitea-runner: add container.options to mount /usr/local/bin/kubectl:ro
from the Legion host into every act_runner job container. Eliminates
per-run curl download in CI workflows.
ingress: change registry ingress hostname from registry.nook.family to
registry.neuralplatform.ai. Matches the domain used in Neuron CI and
neuron.yaml image reference. DNS CNAME + tunnel route already added.
2026-03-24 14:39:57 -05:00
455797745c
fix: runner container network=host for k8s DNS resolution
...
Job containers use bridge network by default, so they can't resolve
gitea.git.svc.cluster.local. host network inherits k3s host routing
which can reach cluster service IPs directly.
2026-03-24 13:20:44 -05:00
05973b50bd
fix: remove duplicate docker.sock mount in runner config
...
The socket is already mounted via the pod volume mount; specifying it
again in container.options causes 'Duplicate mount point' on job containers.
2026-03-24 13:14:43 -05:00
e91d6c0b09
fix: gitea runner Docker execution mode with catthehacker/ubuntu
...
Switch from :host to :docker execution so jobs run inside containers.
- Labels use docker://ghcr.io/catthehacker/ubuntu:act-22.04 (Python 3.10,
Node 18, Docker CLI — everything CI jobs need pre-installed)
- config.yaml passes docker.sock through to job containers for build/push
- Capacity set to 2 parallel jobs
Fixes: 'Cannot find: node in PATH' — actions/checkout@v4 requires Node
2026-03-24 13:07:56 -05:00
Gitea CI