100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	0ef9c8d6e5	feat(mcpo): sync config.json to Gitea as source of truth ... Adds powerautomate entry with Azure app registration credentials. Auth dir (/volume1/docker/mcpo/powerautomate-auth/) and config stub already exist on host from prior session. NOTE: powerautomate-mcp package not yet on npm - npx will fail until published. Tracked here for GitOps pipeline; will update command when package is available or we switch to build-from-source approach.	2026-07-25 15:10:07 -07:00
admin	b6c3fcdd58	litellm: upgrade v1.92.1 -> v1.93.0 to fix Bedrock parallel tool call truncation bug	2026-07-24 22:16:39 -07:00
admin	9b6322208c	feat(mcpo): sync config.json from host (real PA_MCP_CLIENT_ID + TENANT_ID)	2026-07-24 22:06:24 -07:00
admin	26dc2b50bc	chore(ai): remove flat ai.yaml, superseded by ai/ai.yaml	2026-07-24 22:02:22 -07:00
admin	81ab653402	feat(ai): add ai/ai.env (sourced from host, LITELLM_MODIFY_PARAMS=False)	2026-07-24 22:02:14 -07:00
admin	d12ac4daa9	feat(ai): migrate to folder-based stack layout	2026-07-24 22:01:45 -07:00
admin	c79ade9914	feat(woodpecker): add PA_MCP_CLIENT_ID secret provisioning for ai stack	2026-07-19 14:23:22 -07:00
admin	c38e41c741	chore(mcpo): sync config.json from live disk - adds powerautomate entry	2026-07-19 14:20:27 -07:00
admin	712516ac29	feat(mcpo): add config.json to source control with powerautomate, ms365 fixes ... - Pin ms365 to 0.129.0 with --discovery flag (fixes MCPO schema parse error) - Add powerautomate entry (PA_MCP_CLIENT_ID placeholder - needs Azure app reg) - Update authentik token (was expired) - teams-mcp-auth volume now source of truth for ms365/teams auth cache - powerautomate-auth volume wired for future PA auth cache NOTE: config.json was previously managed manually on disk only. This commit brings it under GitOps control.	2026-07-19 14:16:40 -07:00
admin	bf13c74c1d	chore(renovate): remove unused TEAMS_WEBHOOK env - notifications via Gitea webhook	2026-07-19 07:00:37 -07:00
admin	d456c96454	chore(renovate): revert postUpgradeTasks - notifications via Gitea webhook instead	2026-07-19 07:00:17 -07:00
admin	ab20c708a0	chore(renovate): add postUpgradeTasks Teams notification via Power Automate webhook	2026-07-19 06:59:49 -07:00
admin	835e534ec1	chore(renovate): pass TEAMS_WEBHOOK secret into renovate container	2026-07-19 06:59:28 -07:00
admin	a2b52c5ba1	chore(renovate): add Teams webhook notification via Power Automate	2026-07-19 06:59:02 -07:00
admin	9a18cda853	chore(renovate): fix config warnings - remove global-only options, disable woodpecker manager	2026-07-18 22:48:22 -07:00
admin	0f3901152a	feat: add woodpecker cron pipeline for renovate (v3 syntax)	2026-07-18 22:05:19 -07:00
admin	afdd23184d	feat: add renovate.json configuration	2026-07-18 22:05:01 -07:00
admin	6f65326890	feat: add renovate env example	2026-07-18 22:05:01 -07:00
admin	f212fa07b7	feat: add renovate stack (image update automation)	2026-07-18 22:05:00 -07:00
admin	ae605838c3	traefik: fix update order for host-mode/VRRP services (start-first -> stop-first) ... reverse-proxy publishes host-mode ports (80/443/1883/5201/5431) — start-first can never bind while the old task holds the ports, deadlocking every rolling update. keepalived master/backup run VRRP on the host network — concurrent old+new speakers with the same router-id risk VIP flapping. Both now use stop-first (global mode + parallelism=1 + VIP failover keeps ingress up). Stateless helpers (whoami, speedtest, iperf3, certs-dumper) keep start-first. Step 1 of Tier 0/1 pipeline inclusion (prep for removing traefik/woodpecker from the bootstrap manual-deploy guard).	2026-07-16 23:04:00 -07:00
admin	2c8db4118d	fix(pipeline): sync bootstrap stack files before guard, not after	2026-07-16 22:29:36 -07:00
admin	e1a7fb59e3	Add bootstrap-tier guard to deploy step (traefik/woodpecker/postgresql skip auto-deploy)	2026-07-16 21:44:53 -07:00
admin	45b0d7109e	Add update_config/rollback_config start-first rolling deploy; fix depends_on indent bug	2026-07-16 21:44:47 -07:00
admin	1659b5b861	Add update_config/rollback_config rolling deploy to all traefik services (start-first, parallelism=1)	2026-07-16 21:44:41 -07:00
admin	40fb1329c3	chore: bump litellm-database v1.90.3 -> v1.92.0 ... Latest stable release. Includes Bedrock fixes since 1.90.x (anthropic-beta header forwarding, converse stream handling, STS region decoupling).	2026-07-15 22:00:16 -07:00
admin	308ac008ba	fix(security): correct crowdsec-web-ui image typo — thebluffman85 -> theduffman85 ... Image ghcr.io/thebluffman85/crowdsec-web-ui:latest never existed (typo in org name). Correct upstream project is TheDuffman85/crowdsec-web-ui on GitHub. Fixed to ghcr.io/theduffman85/crowdsec-web-ui:latest. Deployed and verified live on docker-2 prior to this commit: - security_crowdsec-web-ui now pulls successfully and is Running - Host(`secure.bryanmail.net`) rule intact, all CROWDSEC_* env vars correct - security_crowdsec unaffected, still running	2026-07-10 15:43:01 -07:00
admin	b6bf14f917	feat(postgresql): complete Pattern C migration — remove leftover env_file directives ... Docker secrets (postgresql_password, postgresql_pgadmin_password) already handled POSTGRES_PASSWORD_FILE/PGADMIN_DEFAULT_PASSWORD_FILE. This removes the two remaining `env_file: - postgresql.env` lines (postgresql + pgadmin services) which were redundant and left the stack in a half-migrated hybrid state. Non-secret vars (POSTGRES_USER, PGADMIN_DEFAULT_EMAIL, DATABASUS_HOST, PGADMIN_HOST) continue to be supplied via stack-deploy.sh's envsubst mechanism from postgresql.env at deploy time — no functional change to those values. Deployed and verified live on docker-2 prior to this commit: - postgresql_postgresql: pg_isready OK, all 21 databases intact, psql auth via Docker secret confirmed - postgresql_pgadmin: Host(`dba.bryanmail.net`) rule + PGADMIN_DEFAULT_EMAIL correct - postgresql_databasus: running - All dependent stacks (mealie, vaultwarden, auth, media, homeassistant, guacamole, security) remained healthy throughout, zero reconnect issues	2026-07-10 15:36:15 -07:00
admin	3a5483cf53	chore(guacamole): remove DOMAIN - provided by global.env	2026-07-10 15:31:30 -07:00
admin	5454f7acf4	chore(mealie): remove DOMAIN - provided by global.env	2026-07-10 15:31:29 -07:00
admin	48d20d613f	chore(security): remove DOMAIN - provided by global.env	2026-07-10 15:31:29 -07:00
admin	cf82e36380	chore(vaultwarden): remove DOMAIN+ALT_DOMAIN - provided by global.env	2026-07-10 15:31:28 -07:00
admin	b25429091f	chore(homeassistant): remove DOMAIN - provided by global.env	2026-07-10 15:31:28 -07:00
admin	5f0459eb35	chore(maintenance): remove DOMAIN - provided by global.env	2026-07-10 15:31:27 -07:00
admin	c3c05b7164	chore(traefik): remove DOMAIN - provided by global.env	2026-07-10 15:31:27 -07:00
admin	97cdb74506	chore(auth): remove DOMAIN - provided by global.env	2026-07-10 15:31:27 -07:00
admin	09e97b1572	chore(media): remove DOMAIN - provided by global.env	2026-07-10 15:31:26 -07:00
admin	8884e9c0ff	fix(global.env): ALT_DOMAIN=whooshh.net	2026-07-10 15:31:26 -07:00
admin	2b6e937b57	feat(stack-deploy): load global.env as base, stack env overrides on top	2026-07-08 21:29:15 -07:00
admin	b664e9d41d	feat(envparse): add merge mode for global+stack env layering	2026-07-08 21:29:13 -07:00
admin	78fe8092ad	feat(deploy): add global.env for shared vars (DOMAIN, DOMAIN_NAME, ALT_DOMAIN)	2026-07-08 21:29:12 -07:00
admin	9f7dcc3970	fix(media): add DOMAIN to media.env — was missing, causing blank Traefik hostnames	2026-07-08 21:25:34 -07:00
admin	2b4332896e	fix(ci): verify step fails pipeline on zero running tasks; increase settle time	2026-07-08 21:23:00 -07:00
admin	33f63924fc	feat(postgresql): migrate to Pattern C — Docker secrets for POSTGRES_PASSWORD and PGADMIN_DEFAULT_PASSWORD (_FILE convention)	2026-07-06 23:37:16 -07:00
admin	01469a7138	ci: trigger pipeline for ai stack (litellm-database:main-latest)	2026-07-05 21:50:20 -07:00
admin	2b547de27a	Update README.md	2026-07-05 21:42:27 -07:00
admin	76815f93e4	fix(ai): litellm image litellm-database:main-latest to match running stack	2026-07-05 21:41:49 -07:00
admin	c55eae3f24	ci: update .woodpecker.yml ai provision to Pattern B no-op	2026-07-04 22:35:54 -07:00
admin	db27239e68	ci: add ai.yaml (Pattern B - remove env_file, inline env vars)	2026-07-04 22:35:54 -07:00
admin	eff099eddf	immich: restore yaml default to :-release, version controlled via immich.env	2026-07-02 07:32:38 -07:00
admin	988ad3b573	woodpecker: immich moves to Pattern C - provision immich_db_password + immich_kiosk_basicauth	2026-07-02 07:26:44 -07:00
admin	7421a2406e	immich: Pattern C - DB_PASSWORD to Docker secret, version v3, remove env_file	2026-07-02 07:24:42 -07:00
admin	cbdb2f809a	refactor(security): move to folder-based layout	2026-06-30 23:36:02 -07:00
admin	86b41567c2	refactor(guacamole): move to folder-based layout	2026-06-30 23:36:02 -07:00
admin	eb7d6031f8	refactor(homeassistant): move to folder-based layout	2026-06-30 23:36:01 -07:00
admin	9ff21ff018	refactor(unifi): move to folder-based layout	2026-06-30 23:36:01 -07:00
admin	e40a1b5e00	refactor(meshcentral): move to folder-based layout	2026-06-30 23:36:01 -07:00
admin	b48b3db068	remove vaultwarden.yaml — superseded by vaultwarden/ folder	2026-06-30 23:34:34 -07:00
admin	d05b86af70	remove mealie.yaml — superseded by mealie/ folder	2026-06-30 23:34:32 -07:00
admin	5264e69f60	remove ddm.yaml — superseded by ddm/ folder	2026-06-30 23:34:32 -07:00
admin	86eb59ab79	remove maintenance.yaml — superseded by maintenance/ folder	2026-06-30 23:34:31 -07:00
admin	a6ec9073bc	remove media.yaml — superseded by media/ folder	2026-06-30 23:34:31 -07:00
admin	1511999279	refactor(vaultwarden): move to folder-based layout	2026-06-30 23:34:14 -07:00
admin	26eedf0e3d	refactor(mealie): move to folder-based layout	2026-06-30 23:34:14 -07:00
admin	4d810efa17	refactor(ddm): move to folder-based layout	2026-06-30 23:34:14 -07:00
admin	597d449666	refactor(maintenance): move to folder-based layout	2026-06-30 23:34:13 -07:00
admin	ee2cc8d1eb	refactor(media): move to folder-based layout	2026-06-30 23:34:13 -07:00
admin	493b4e12ac	add immich/hwaccel.transcoding.yml — quicksync transcoding extension	2026-06-30 23:19:18 -07:00
admin	72e46d0388	add immich/hwaccel.ml.yml — openvino ML acceleration extension	2026-06-30 23:19:17 -07:00
admin	7b7f858c02	add immich/immich.yml — folder-based stack, Pattern B	2026-06-30 23:19:17 -07:00
admin	8936daa469	remove hwaccel.transcoding.yml — superseded by immich/ folder	2026-06-30 23:18:40 -07:00
admin	80f37f37ea	remove hwaccel.ml.yml — superseded by immich/ folder	2026-06-30 23:18:40 -07:00
admin	4e5e58a4fc	remove immich.yaml — superseded by immich/ folder	2026-06-30 23:18:39 -07:00
admin	7ee270f58d	refactor(.woodpecker.yml): data-driven folder + flat stack support ... - validate: handles both flat *.yaml and folder-based stacks - provision-secrets: detects stacks from flat files AND changed folder contents - deploy: rsync folder or flat file as appropriate, then stack-deploy.sh - verify: same stack detection logic as deploy - immich, meshcentral, ddm explicitly listed as Pattern B no-op - all existing flat stacks unchanged — zero regression"	2026-06-30 23:18:21 -07:00
admin	e760979cb9	refactor(deploy/stack-deploy.sh): add folder-based multi-compose support ... - Detect <stack>/ folder vs flat <stack>.yaml automatically - Main file must be named <stack>.yml or <stack>.yaml inside folder - Extra *.yml/*.yaml files in folder merged via docker compose config - Env file resolved from folder/<stack>.env or flat <stack>.env - Flat path unchanged — zero regression for existing stacks - envsubst applied after compose config merge in folder mode"	2026-06-30 23:12:47 -07:00
admin	4cb29a7fd3	Add ddm.yaml — Device Mapping Manager, Pattern A (no secrets)	2026-06-30 22:58:28 -07:00
admin	ebf2ca8743	refactor(.woodpecker.yml): add immich to no-op provision case (Pattern B — secrets in host .env)	2026-06-28 22:03:43 -07:00
admin	3bc1b4acbf	Add hwaccel.transcoding.yml — hardware-accelerated transcoding config (quicksync active)	2026-06-28 22:02:58 -07:00
admin	f999799462	Add hwaccel.ml.yml — hardware-accelerated ML config (openvino active)	2026-06-28 22:02:57 -07:00
admin	f8f440fcec	Add immich.yaml — Pattern B migration, env_file removed, secrets in host .env	2026-06-28 22:02:56 -07:00
admin	b0dba66349	refactor(.woodpecker.yml): move auth to no-op provision case (Pattern B), remove AUTH_* env vars	2026-06-27 06:43:04 -07:00
admin	70e74e5b6e	Add auth.yaml — Pattern B migration, no env_file, domain parameterized, secrets in host .env	2026-06-27 06:41:19 -07:00
admin	a5d7e26727	refactor(.woodpecker.yml): move security to no-op provision case (Pattern B), remove unused SECURITY_* env vars from provision step	2026-06-27 06:26:35 -07:00
admin	5c0f59f00c	Add security.yaml — Pattern B migration, no env_file, domain parameterized, secrets in host .env	2026-06-27 06:24:07 -07:00
admin	e7842fda6b	refactor(.woodpecker.yml): add guacamole to no-op provision case (Pattern B — secrets in host .env), remove unused guacamole env vars from provision step	2026-06-26 23:15:23 -07:00
admin	2f1685f5a9	Add guacamole.yaml — Pattern B migration, all secrets/OIDC via host .env vars	2026-06-26 23:13:45 -07:00
admin	d48b64cc9a	fix(.woodpecker.yml): add || true to ssh-keyscan — from_secret injection confirmed working (SWARM_MANAGER_IP len=12)	2026-06-26 06:59:36 -07:00
admin	1a9684067a	fix(.woodpecker.yml): migrate from deprecated secrets: list to from_secret syntax (Woodpecker v3 requires environment: VAR: from_secret: name)	2026-06-26 06:54:41 -07:00
admin	e48caa643c	debug: add secret env dump step + slim provision-secrets to diagnose SWARM_MANAGER_IP injection	2026-06-26 06:47:29 -07:00
admin	028bda5e8e	ci: trigger fresh pipeline to verify SWARM_MANAGER_IP injection after DB fix	2026-06-26 06:29:46 -07:00
admin	729065e66b	fix(.woodpecker.yml): restore SWARM_MANAGER_IP — root cause was corrupted value '192_168_4_32' in DB (id=88), now fixed to '192.168.4.32'	2026-06-26 06:25:18 -07:00
admin	369255490b	fix(.woodpecker.yml): revert to hardcoded IP — new repo-level secret injection broken in Woodpecker v3 (TODO: investigate)	2026-06-25 23:54:30 -07:00
admin	16b358cc52	fix(.woodpecker.yml): rename docker_manager_ip -> swarm_manager_ip (avoid DOCKER_ prefix reserved by Docker runtime)	2026-06-25 23:36:55 -07:00
admin	9dd97a5fcc	ci: trigger pipeline to verify DOCKER_MANAGER_IP injection after server restart	2026-06-25 23:34:19 -07:00
admin	cae2e1bc0c	fix(.woodpecker.yml): uppercase env var refs match Woodpecker injection (secret docker_manager_ip -> $DOCKER_MANAGER_IP)	2026-06-25 23:25:53 -07:00
admin	922dd06c9b	fix(.woodpecker.yml): use lowercase secret names matching Woodpecker injection convention	2026-06-25 23:22:52 -07:00
admin	dae8e25bda	fix(.woodpecker.yml): add DOCKER_MANAGER_IP and WOODPECKER_HOST to step secrets lists	2026-06-25 23:17:09 -07:00
admin	1096cf5586	refactor(.woodpecker.yml): replace hardcoded 192.168.4.32 with DOCKER_MANAGER_IP and woodpecker URL with WOODPECKER_HOST	2026-06-25 23:00:54 -07:00
admin	25f9bab3b0	refactor(woodpecker.env.example): replace hardcoded URLs with variable references	2026-06-25 22:58:02 -07:00
admin	82c3dfb6d1	refactor(git.env.example): parameterize POSTGRES_HOST, POSTGRES_PORT, and GITEA_HOST	2026-06-25 22:58:02 -07:00
admin	4fe91f001c	refactor(git): parameterize Traefik Host() rule and MCP GITEA_HOST via GITEA_HOST variable	2026-06-25 22:58:01 -07:00