84 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
pi-ux-ce	2a6c05c01c	add state and changes	2026-08-17 09:35:41 +01:00
pi-ux-ce	71919fe861	🗑️ cleaning old certs	2026-08-11 15:06:58 +01:00
pi-ux-ce	a44f48333a	🗑️ cleaning	2026-08-11 15:05:15 +01:00
pi-ux-ce	8af49191fd	🗑️ cleaning old certs	2026-08-11 15:04:30 +01:00
pi-ux-ce	1bda70bd8b	switching to volumes for ssl certs	2026-08-11 15:03:31 +01:00
pi-ux-ce	b3a780b882	new modification before transiution to volume for the ssl certs	2026-08-11 14:49:43 +01:00
pi-ux-ce	6861c7b28a	add new file	2026-08-11 14:43:25 +01:00
pi-ux-ce	3ca891b0b5	new volume for the geeraert.eu certs	2026-08-11 14:38:10 +01:00
pi-ux-ce	d664077a58	add before adding new stuff	2026-08-11 13:59:37 +01:00
pi-ux-ce	763788d455	creating the configmap, not used yet by netdata	2026-08-04 16:18:37 +01:00
pi-ux-ce	0b09d50e7f	add before change	2026-08-04 16:05:14 +01:00
pi-ux-ce	9349bc5122	watcher struggling	2026-07-30 11:02:29 +01:00
pi-ux-ce	93f8d41aac	fix(reverse-proxy): preserve real client IP in nginx logs ... Nginx logs showed internal cluster IPs instead of public client IPs. Root cause was three stacked issues in the traffic path from MetalLB LoadBalancer VIP to the reverse-proxy pods: 1. Service was using externalTrafficPolicy: Cluster, allowing kube-proxy to forward traffic cross-node and SNAT the source IP in the process. Changed to externalTrafficPolicy: Local so traffic is only handled by pods on the node that received it. 2. reverse-proxy DaemonSet had a pinned in the pod template, forcing all replicas onto a single node instead of scheduling one per node as expected for a DaemonSet. Removed nodeName so the DaemonSet scheduler places one pod per eligible node (both control-plane nodes, tolerations already in place). 3. Even with the above fixed, flannel's CNI masquerade rule was still SNAT'ing traffic to the pod network address (10.244.x.x) before it reached nginx, since traffic into the pod overlay network gets masqueraded regardless of kube-proxy's policy. Switched the DaemonSet to hostNetwork: true (with dnsPolicy: ClusterFirstWithHostNet) so nginx binds directly to the node's network namespace and bypasses the overlay masquerade entirely. Result: nginx access logs now show the real public client IP for every request instead of node/pod-internal addresses.	2026-07-23 10:06:43 +01:00
pi-ux-ce	f5a786386f	adding before converting to daemonset	2026-07-23 09:35:12 +01:00
pi-ux-ce	03d2743507	removing fail2ban policy as well	2026-07-22 23:33:00 +01:00
pi-ux-ce	f957ca2545	removing the auto deny rule for now until I figure out the network problem, nginx receive a private ip instead of the public one	2026-07-22 23:32:33 +01:00
pi-ux-ce	b1def329e9	adding specifiy geoip option	2026-04-15 09:29:59 +01:00
pi-ux-ce	9335e0ac24	adding the terradfrom module just in case	2026-03-19 23:34:22 +00:00
pi-ux-ce	2d4a96098c	revert the change made	2026-03-19 23:22:50 +00:00
pi-ux-ce	f457e9ae18	revert the change made	2026-03-19 23:21:54 +00:00
pi-ux-ce	b61f613e3c	revert the change made	2026-03-19 23:20:32 +00:00
pi-ux-ce	d6b428258e	try this but too much restriction, probaly gonna use this safety in the future though	2026-03-19 23:19:07 +00:00
pi-ux-ce	1ea92b8e6d	trying the certifcate check as well	2026-03-19 23:05:37 +00:00
pi-ux-ce	f96e93eab1	display the country in the logs	2026-03-13 15:17:43 +00:00
pi-ux-ce	5e0ad69cd8	removing template as we use terraform now	2026-03-13 11:23:46 +00:00
pi-ux-ce	4107c11651	trying different inotifywait command	2026-03-13 10:49:44 +00:00
pi-ux-ce	6923977cd1	putting the inotify file into a shared memory medium	2026-03-13 10:41:47 +00:00
pi-ux-ce	669be9f97e	rename to watched for easy access	2026-03-13 10:25:37 +00:00
pi-ux-ce	dd4b8df134	remove random.conf as not sure why it's there in the first place	2026-03-13 10:24:41 +00:00
pi-ux-ce	ffb076cf47	removing geoip as built inside the image	2026-03-13 10:23:49 +00:00
pi-ux-ce	ceb7fb6479	building a sidecar to watch the blacklisted file	2026-03-13 10:21:51 +00:00
pi-ux-ce	a378e0a41d	blocking every requests coming to scan wp-content	2026-03-13 10:06:27 +00:00
pi-ux-ce	3570e436f8	success with geoip2	2026-03-13 00:33:43 +00:00
pi-ux-ce	2ea483265b	UK = GB	2026-03-13 00:09:56 +00:00
pi-ux-ce	5847aed43e	blocking every country instead of allowing all	2026-03-13 00:07:31 +00:00
pi-ux-ce	79ef0ab640	trying geoip2	2026-03-12 23:59:39 +00:00
pi-ux-ce	b09999a8d0	removing all the fail2ban stuff	2026-02-02 21:50:23 +00:00
pi-ux-ce	800d23ac8e	adding before some work	2026-01-26 22:17:14 +00:00
pi-ux-ce	f3aa767cd5	adding before some work	2026-01-26 22:16:52 +00:00
pi-ux-ce	6d7897e2a6	work to add oauth	2025-07-08 00:14:56 +01:00
pi-ux-ce	347103b9f9	change to publish only the enabled one	2025-06-18 23:41:35 +01:00
pi-ux-ce	b7a0e73665	work on a configmap to store these infos for django	2025-06-18 23:36:38 +01:00
pi-ux-ce	04aab9b16e	save before servarr migration	2025-05-13 09:35:57 +01:00
pi-ux-ce	6009e6a4f7	add all unstaged files	2025-04-23 10:24:52 +01:00
pi-ux-ce	c8e2a94826	remove bookstack.tryton.geeraert.eu.conf.configmap.yaml	2025-04-23 10:23:34 +01:00
pi-ux-ce	cbce88af18	add all unstaged files	2025-04-23 10:21:52 +01:00
pi-ux-ce	706673a4a3	enable disabling https redirection and allowing port 80	2025-04-23 10:21:39 +01:00
pi-ux-ce	e45b2e703b	add logging format	2025-04-23 10:21:10 +01:00
pi-ux-ce	089504b76d	clean manifest	2025-04-23 10:15:12 +01:00
pi-ux-ce	a947004e54	add nginx.conf logging option	2025-04-23 10:13:42 +01:00