|
|
cd0dacbc9a
|
feat(infra): domaine public funklab.online + HTTPS Let's Encrypt (fondation) (#88)
- traefik : values.yaml versionné (réplique existant + certResolver ACME
HTTP-01 + acme.json persistant) — appliqué par helm upgrade (hors ArgoCD).
Redirect HTTP→HTTPS scopée funklab.online (ne casse pas *.lab.local).
- gateway : DNAT 80/443 → Traefik + rate-limit
- dnsmasq : split-horizon *.funklab.online → Traefik (var public_domain)
- doc : admin/k8s/public-domain.md (archi, OVH/Freebox, helm, ajout d'app)
Appliqué et vérifié : helm upgrade OK (services *.lab.local intacts),
resolver ACME chargé, DNAT/dnsmasq en place. En attente DNS OVH + Freebox
pour l'émission des certificats.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
2026-07-07 15:59:26 +02:00 |
|
|
|
bc0e1dd53e
|
feat(wireguard): accès distant au lab via VPN (Freebox 51820/udp → s01) (#80)
- rôle wireguard : serveur wg0 (10.99.0.0/24) sur storage-01, profils
clients générés dans /etc/wireguard/clients/ (fichier .conf / QR code)
- gateway : filtrage nftables par pair — full (tout le lab) / portal
(uniquement Traefik :80 = portail Guacamole), masquerade VPN→cluster
- dnsmasq : bind-dynamic + écoute wg0 → *.lab.local résolu dans le tunnel
- pairs initiaux : alkatrazz (full), invite-01 (portal)
- vault : clés WireGuard + reprise de l'archive Authentik (remplace #78)
- doc : admin/infra/wireguard.md (onboarding pair, pièges, exploitation)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
2026-07-07 11:11:43 +02:00 |
|
alkatrazz
|
c8a1faa632
|
feat: MetalLB + Traefik + wildcard DNS lab.local
- MetalLB pool 192.168.10.200-230 (L2 mode)
- Traefik LoadBalancer sur 192.168.10.200 (HTTP/HTTPS)
- dnsmasq wildcard *.lab.local → 192.168.10.200
- Fix Flannel CrashLoopBackOff : ClusterRoleBinding corrigée (kube-flannel → kube-system)
- Doc talos.md : procédure complète MetalLB + Traefik + pièges Flannel
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-12 22:45:06 +02:00 |
|
alkatrazz
|
bb72145365
|
feat(talos): bootstrap Kubernetes cluster funk (3 nodes, v1.33.1)
- Add talconfig.yaml with compute-01/02/03 (nvme0n1, Flannel CNI)
- Add SOPS/age encryption for talsecret.sops.yaml
- Add patches: NTP/DNS → storage-01, kubelet reserved for 8GB workers
- Fix nftables: open DHCP port 67 for cluster LAN
- Add dnsmasq DHCP with static leases for all 3 compute nodes
- Add admin/talos.md: full install procedure + admin commands
- Install kubectl + talosctl on storage-01
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-12 22:11:38 +02:00 |
|
alkatrazz
|
b3fce8af5d
|
feat: initial commit — Ansible roles storage-01/gpu-01 opérationnels
|
2026-05-12 17:17:03 +02:00 |
|
