diff --git a/RESUME.md b/RESUME.md index f9e7d91..8ebea1c 100644 --- a/RESUME.md +++ b/RESUME.md @@ -19,7 +19,7 @@ Last updated: 2026-05-23 (session continued ร—4). ### ๐ŸŸก Medium โ€” incomplete migrations / cleanup debt - [ ] **Docker disk reclaim** โ€” ~17 GB reclaimable on CT 104 (10.3 GB unused images, 6.9 GB build cache). `docker system prune -a` after confirming no needed images. See `infra/proxmox-state.md` ยง10c. - [ ] **Dormant stacks audit** โ€” 4 decommissioned 2026-05-23 (daytona, homepage, proxy, streamio โ€” composes renamed `.DECOMMISSIONED`). Remaining ~6 still to audit: dozzle (CT 104 copy), arr-stack, qdrant, etc. See `infra/proxmox-state.md` ยง10c. -- [x] ~~**Config-to-git**~~ โ€” deployed 2026-05-23. Scripts + daily 03:00 crons on CT 108, CT 102, PVE. Pushes to `fkrebs/zoraxy-conf`, `fkrebs/adguard-conf`, `fkrebs/pve-conf` (force-push). HA (`fkrebs/ha-config`) still pending โ€” needs Git Pull addon on HAOS. +- [x] ~~**Config-to-git**~~ โ€” deployed 2026-05-23. Scripts + daily 03:00 crons on CT 108, CT 102, PVE. HA added 2026-05-24: `fkrebs/home-assistant-config` (existing repo) wired up with `/config/scripts/git-push.sh`. Manual step left: paste `init_commands` block from `/docs/infra/config-to-git.md` into the Terminal & SSH addon config so the cron survives addon updates. Full fleet documented in `/docs/infra/config-to-git.md`. - [ ] **D-Link hardening** โ€” admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`. - [ ] **Vaultwarden OIDC SSO** โ€” Pocket-ID client created 2026-05-21, auth flow not wired up. Confirmed no OIDC vars in `/opt/stacks/vaultwarden/.env` as of 2026-05-22. diff --git a/infra/config-to-git.md b/infra/config-to-git.md new file mode 100644 index 0000000..58ad823 --- /dev/null +++ b/infra/config-to-git.md @@ -0,0 +1,79 @@ +# Config-to-git fleet + +Each host snapshots its critical config to a private Gitea repo on `git.nuclide.systems` daily. Force-push (mirror only โ€” history isn't sacred). Token: long-lived `fkrebs` PAT embedded in remote URLs (mode 0600 on script/config). + +## Repos + +| Host | CT/VM | Repo | Schedule | Script | Source | +|---|---|---|---|---|---| +| PVE (`nuc`) | host | [fkrebs/pve-conf](https://git.nuclide.systems/fkrebs/pve-conf) | daily 03:00 | `/usr/local/sbin/pve-conf-backup.sh` (cron `/etc/cron.d/pve-conf-backup`) | `/etc/pve/` (excludes `priv/`, `*.key`, `authkey.pub*`) | +| Zoraxy | CT 108 | [fkrebs/zoraxy-conf](https://git.nuclide.systems/fkrebs/zoraxy-conf) | daily 03:00 | `/usr/local/sbin/zoraxy-conf-backup.sh` (cron `/etc/cron.d/zoraxy-conf-backup`) | Zoraxy config dir | +| AdGuard | CT 102 | [fkrebs/adguard-conf](https://git.nuclide.systems/fkrebs/adguard-conf) | daily 03:00 | `/usr/local/sbin/adguard-conf-backup.sh` (cron `/etc/cron.d/adguard-conf-backup`) | AdGuard config dir | +| Home Assistant | VM 100 | [fkrebs/home-assistant-config](https://git.nuclide.systems/fkrebs/home-assistant-config) | manual cron via addon `init_commands` (see below) | `/config/scripts/git-push.sh` | `/config/` (sees `.gitignore` allowlist) | + +`fkrebs/ha-config` was created in error 2026-05-24 โ€” unused, can be deleted. + +## Pattern + +All scripts follow the same shape: + +```bash +#!/bin/bash +set -e +REPO_URL="https://fkrebs:@git.nuclide.systems/fkrebs/.git" +WORK="/tmp/-work" +mkdir -p "$WORK" +git -C "$WORK" init -b main -q 2>/dev/null || true +git -C "$WORK" config user.email "noreply@nuclide.systems" +git -C "$WORK" config user.name "-backup" +git -C "$WORK" remote set-url origin "$REPO_URL" 2>/dev/null \ + || git -C "$WORK" remote add origin "$REPO_URL" +rsync -a --delete --exclude='.git' [+ secret excludes] / "$WORK/" +git -C "$WORK" add -A +git -C "$WORK" commit -q -m "auto: $(date -u +%Y-%m-%dT%H:%M:%SZ)" 2>/dev/null || true +git -C "$WORK" push -q --force origin main +``` + +PVE/CT 108/CT 102 use a rsync-to-tmp-then-push pattern. HAOS uses an in-place `git add -A` on `/config` because the `.gitignore` there is hand-curated with an allowlist for `.storage/`. + +## HAOS specifics + +- **Path**: `/config/scripts/git-push.sh` (mode 0700, runs in the Terminal & SSH addon). +- **Remote**: `https://fkrebs:@git.nuclide.systems/fkrebs/home-assistant-config.git`. Token lives in `/config/.git/config` (mode 0600). +- **`.gitignore`** uses a default-deny allowlist for `.storage/` โ€” only safe registry/lovelace/helpers/energy files are tracked. Tokens (`core.config_entries`, `mobile_app`, `androidtv_adbkey*`, etc.) are explicitly excluded. See `/config/.gitignore` on HAOS for the full list. +- **Scheduling** โ€” Terminal & SSH addon container is rebuilt on update, so its `crontabs/` are not persistent. Use the addon's `init_commands` (Configuration tab): + + ```yaml + init_commands: + - 'echo "0 3 * * * /config/scripts/git-push.sh >> /config/scripts/git-push.log 2>&1" > /etc/crontabs/root && crond -b' + ``` + + Then **Restart** the addon. Alternative: HA automation calling `shell_command` is not viable โ€” the `homeassistant` container doesn't have SSH to addon containers. + +## Token rotation + +All four repos use the same PAT (`fkrebs` user, full repo scope). Rotate by: + +1. Generate new PAT in Gitea โ†’ user settings โ†’ applications. +2. `git remote set-url origin https://fkrebs:@git.nuclide.systems/fkrebs/.git` on each host. +3. Manually run each script once to verify. + +Token leak risk: tracked in [[gitea_open_issues]]; long-term move is to switch to per-host deploy keys. + +## Verification + +Last commit on each repo should be `auto: T03:0X:XXZ`. Quick check: + +```bash +for r in pve-conf zoraxy-conf adguard-conf home-assistant-config; do + echo -n "$r: " + curl -sk -H "Authorization: token " \ + "https://git.nuclide.systems/api/v1/repos/fkrebs/$r/commits?limit=1" \ + | python3 -c 'import json,sys; c=json.load(sys.stdin)[0]; print(c["commit"]["author"]["date"], c["commit"]["message"][:60])' +done +``` + +## Related + +- [[homelab-architecture]] โ€” host topology +- [[backrest-ct103]] โ€” separate, repo-style binary backup for data (not config)