tommy/homelab-configs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
48 Commits 1 Branch 0 Tags
5c66bbacdd6d299f068a5019633d346a9ae9c2a5
Commit Graph

4 Commits

Author SHA1 Message Date
tommy 4b69f74f40 lubelogger+homepage: dedicated PBS tokens 
- backup job -> dedicated root@pam!lubelogger-backup token (DatastoreBackup);
  prune made non-fatal pending a group-scoped PBS prune-job (Datastore.Prune deferred).
- Homepage PBS widget -> homepage@pbs!widget (Datastore.Audit); Proxmox Beast
  (root@pam!homepage) left intact, deferred. Secrets in vault/.env only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-02 23:40:32 -05:00
tommy 9559b219bf lubelogger probe: use read-only x-api-key instead of admin basic-auth 
Non-admin service credential (View-scoped LubeLogger API key 'homepage-svc') for
the reminder probe; admin password removed from /etc/lubelogger-reminders.env.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-02 22:35:59 -05:00
tommy 6de37c8712 LubeLogger: back up data+keys volumes to PBS via the playbook 
Close the volume-backup gap: the pg_dump covered Postgres only; the ASP.NET
DataProtection keyring (root-user credential) and uploaded docs live in the
lubelogger-{data,keys} volumes. The docker-volume-backup sidecar can't target PBS
natively, so both volumes now ride the same proxmox-backup-client job as the SQL
dump — one host/lubelogger snapshot, three .pxar archives, keep-daily 14. Backup
script+units are now installed by the Ansible playbook (idempotent, changed=0);
PBS token from ansible-vault. Restore verified: keyring XML + sentinel doc
byte-identical (sha256). Removes the now-playbook-managed standalone script/units.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-02 15:28:31 -05:00
tommy c9aac20e73 Add LubeLogger deployment (docker-node01) 
Ansible-managed (inline-compose, file-provider router, host :8099), idempotent
(changed=0). PBS-backed pg_dump (daily, keep 14) with verified round-trip restore;
ntfy 'garage' reminder probe (.190); Diun repo-watch for new tags; Homepage
tile+widget. Secrets via ansible-vault / /etc env files / HOMEPAGE_VAR — none in repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-02 15:14:20 -05:00