config-to-git: document fleet (PVE, Zoraxy, AdGuard, HAOS)
Add /docs/infra/config-to-git.md listing all 4 repos, schedules, script paths, and HAOS-specific addon init_commands pattern. RESUME updated to reflect HAOS bootstrap done 2026-05-24.
This commit is contained in:
@@ -19,7 +19,7 @@ Last updated: 2026-05-23 (session continued ×4).
|
|||||||
### 🟡 Medium — incomplete migrations / cleanup debt
|
### 🟡 Medium — incomplete migrations / cleanup debt
|
||||||
- [ ] **Docker disk reclaim** — ~17 GB reclaimable on CT 104 (10.3 GB unused images, 6.9 GB build cache). `docker system prune -a` after confirming no needed images. See `infra/proxmox-state.md` §10c.
|
- [ ] **Docker disk reclaim** — ~17 GB reclaimable on CT 104 (10.3 GB unused images, 6.9 GB build cache). `docker system prune -a` after confirming no needed images. See `infra/proxmox-state.md` §10c.
|
||||||
- [ ] **Dormant stacks audit** — 4 decommissioned 2026-05-23 (daytona, homepage, proxy, streamio — composes renamed `.DECOMMISSIONED`). Remaining ~6 still to audit: dozzle (CT 104 copy), arr-stack, qdrant, etc. See `infra/proxmox-state.md` §10c.
|
- [ ] **Dormant stacks audit** — 4 decommissioned 2026-05-23 (daytona, homepage, proxy, streamio — composes renamed `.DECOMMISSIONED`). Remaining ~6 still to audit: dozzle (CT 104 copy), arr-stack, qdrant, etc. See `infra/proxmox-state.md` §10c.
|
||||||
- [x] ~~**Config-to-git**~~ — deployed 2026-05-23. Scripts + daily 03:00 crons on CT 108, CT 102, PVE. Pushes to `fkrebs/zoraxy-conf`, `fkrebs/adguard-conf`, `fkrebs/pve-conf` (force-push). HA (`fkrebs/ha-config`) still pending — needs Git Pull addon on HAOS.
|
- [x] ~~**Config-to-git**~~ — deployed 2026-05-23. Scripts + daily 03:00 crons on CT 108, CT 102, PVE. HA added 2026-05-24: `fkrebs/home-assistant-config` (existing repo) wired up with `/config/scripts/git-push.sh`. Manual step left: paste `init_commands` block from `/docs/infra/config-to-git.md` into the Terminal & SSH addon config so the cron survives addon updates. Full fleet documented in `/docs/infra/config-to-git.md`.
|
||||||
- [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`.
|
- [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`.
|
||||||
- [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21, auth flow not wired up. Confirmed no OIDC vars in `/opt/stacks/vaultwarden/.env` as of 2026-05-22.
|
- [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21, auth flow not wired up. Confirmed no OIDC vars in `/opt/stacks/vaultwarden/.env` as of 2026-05-22.
|
||||||
|
|
||||||
|
|||||||
@@ -0,0 +1,79 @@
|
|||||||
|
# Config-to-git fleet
|
||||||
|
|
||||||
|
Each host snapshots its critical config to a private Gitea repo on `git.nuclide.systems` daily. Force-push (mirror only — history isn't sacred). Token: long-lived `fkrebs` PAT embedded in remote URLs (mode 0600 on script/config).
|
||||||
|
|
||||||
|
## Repos
|
||||||
|
|
||||||
|
| Host | CT/VM | Repo | Schedule | Script | Source |
|
||||||
|
|---|---|---|---|---|---|
|
||||||
|
| PVE (`nuc`) | host | [fkrebs/pve-conf](https://git.nuclide.systems/fkrebs/pve-conf) | daily 03:00 | `/usr/local/sbin/pve-conf-backup.sh` (cron `/etc/cron.d/pve-conf-backup`) | `/etc/pve/` (excludes `priv/`, `*.key`, `authkey.pub*`) |
|
||||||
|
| Zoraxy | CT 108 | [fkrebs/zoraxy-conf](https://git.nuclide.systems/fkrebs/zoraxy-conf) | daily 03:00 | `/usr/local/sbin/zoraxy-conf-backup.sh` (cron `/etc/cron.d/zoraxy-conf-backup`) | Zoraxy config dir |
|
||||||
|
| AdGuard | CT 102 | [fkrebs/adguard-conf](https://git.nuclide.systems/fkrebs/adguard-conf) | daily 03:00 | `/usr/local/sbin/adguard-conf-backup.sh` (cron `/etc/cron.d/adguard-conf-backup`) | AdGuard config dir |
|
||||||
|
| Home Assistant | VM 100 | [fkrebs/home-assistant-config](https://git.nuclide.systems/fkrebs/home-assistant-config) | manual cron via addon `init_commands` (see below) | `/config/scripts/git-push.sh` | `/config/` (sees `.gitignore` allowlist) |
|
||||||
|
|
||||||
|
`fkrebs/ha-config` was created in error 2026-05-24 — unused, can be deleted.
|
||||||
|
|
||||||
|
## Pattern
|
||||||
|
|
||||||
|
All scripts follow the same shape:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
#!/bin/bash
|
||||||
|
set -e
|
||||||
|
REPO_URL="https://fkrebs:<TOKEN>@git.nuclide.systems/fkrebs/<repo>.git"
|
||||||
|
WORK="/tmp/<name>-work"
|
||||||
|
mkdir -p "$WORK"
|
||||||
|
git -C "$WORK" init -b main -q 2>/dev/null || true
|
||||||
|
git -C "$WORK" config user.email "noreply@nuclide.systems"
|
||||||
|
git -C "$WORK" config user.name "<name>-backup"
|
||||||
|
git -C "$WORK" remote set-url origin "$REPO_URL" 2>/dev/null \
|
||||||
|
|| git -C "$WORK" remote add origin "$REPO_URL"
|
||||||
|
rsync -a --delete --exclude='.git' [+ secret excludes] <source>/ "$WORK/"
|
||||||
|
git -C "$WORK" add -A
|
||||||
|
git -C "$WORK" commit -q -m "auto: $(date -u +%Y-%m-%dT%H:%M:%SZ)" 2>/dev/null || true
|
||||||
|
git -C "$WORK" push -q --force origin main
|
||||||
|
```
|
||||||
|
|
||||||
|
PVE/CT 108/CT 102 use a rsync-to-tmp-then-push pattern. HAOS uses an in-place `git add -A` on `/config` because the `.gitignore` there is hand-curated with an allowlist for `.storage/`.
|
||||||
|
|
||||||
|
## HAOS specifics
|
||||||
|
|
||||||
|
- **Path**: `/config/scripts/git-push.sh` (mode 0700, runs in the Terminal & SSH addon).
|
||||||
|
- **Remote**: `https://fkrebs:<TOKEN>@git.nuclide.systems/fkrebs/home-assistant-config.git`. Token lives in `/config/.git/config` (mode 0600).
|
||||||
|
- **`.gitignore`** uses a default-deny allowlist for `.storage/` — only safe registry/lovelace/helpers/energy files are tracked. Tokens (`core.config_entries`, `mobile_app`, `androidtv_adbkey*`, etc.) are explicitly excluded. See `/config/.gitignore` on HAOS for the full list.
|
||||||
|
- **Scheduling** — Terminal & SSH addon container is rebuilt on update, so its `crontabs/` are not persistent. Use the addon's `init_commands` (Configuration tab):
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
init_commands:
|
||||||
|
- 'echo "0 3 * * * /config/scripts/git-push.sh >> /config/scripts/git-push.log 2>&1" > /etc/crontabs/root && crond -b'
|
||||||
|
```
|
||||||
|
|
||||||
|
Then **Restart** the addon. Alternative: HA automation calling `shell_command` is not viable — the `homeassistant` container doesn't have SSH to addon containers.
|
||||||
|
|
||||||
|
## Token rotation
|
||||||
|
|
||||||
|
All four repos use the same PAT (`fkrebs` user, full repo scope). Rotate by:
|
||||||
|
|
||||||
|
1. Generate new PAT in Gitea → user settings → applications.
|
||||||
|
2. `git remote set-url origin https://fkrebs:<NEW>@git.nuclide.systems/fkrebs/<repo>.git` on each host.
|
||||||
|
3. Manually run each script once to verify.
|
||||||
|
|
||||||
|
Token leak risk: tracked in [[gitea_open_issues]]; long-term move is to switch to per-host deploy keys.
|
||||||
|
|
||||||
|
## Verification
|
||||||
|
|
||||||
|
Last commit on each repo should be `auto: <today>T03:0X:XXZ`. Quick check:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
for r in pve-conf zoraxy-conf adguard-conf home-assistant-config; do
|
||||||
|
echo -n "$r: "
|
||||||
|
curl -sk -H "Authorization: token <TOKEN>" \
|
||||||
|
"https://git.nuclide.systems/api/v1/repos/fkrebs/$r/commits?limit=1" \
|
||||||
|
| python3 -c 'import json,sys; c=json.load(sys.stdin)[0]; print(c["commit"]["author"]["date"], c["commit"]["message"][:60])'
|
||||||
|
done
|
||||||
|
```
|
||||||
|
|
||||||
|
## Related
|
||||||
|
|
||||||
|
- [[homelab-architecture]] — host topology
|
||||||
|
- [[backrest-ct103]] — separate, repo-style binary backup for data (not config)
|
||||||
Reference in New Issue
Block a user