Provision a dedicated Flatcar host that runs the CISA KEV RSS container
from GHCR, with a dozzle agent and hub remote entry like the other VMs.
Co-authored-by: Cursor Agent <[email protected]>
Set LITELLM_LOG=ERROR and JSON_LOGS=True so uvicorn INFO
access lines (MCP and UI traffic) are suppressed per LiteLLM docs.
Co-authored-by: Nick Trochalakis <[email protected]>
Replaces the Debian VM that hosted the Gitea Actions runner and adds two
new hosts on goose, all provisioned by Ignition instead of cloud-init:
- oswald-runner: Gitea Actions runner, keeping its registration in
/var/lib/oswald_runner on disk rather than running ephemeral, which was
leaving stale offline runners behind whenever a job was interrupted.
- ai: LiteLLM proxy and the Gitea MCP server.
- oswl-connector: tailscaled against headscale, advertising 192.168.7.0/24
and itself as an exit node.
Their registration tokens and keys come from Infisical through the new
butane_vars plumbing, so nothing secret is committed -- but each one does
land in plaintext in the rendered Ignition snippet on the node, which is
the tradeoff for having no cloud-init here.
The provider gains an ssh block on both nodes because Proxmox has no API
for uploading snippets. That, the snippets content type, and the headscale
preauth key all have to be set up by hand first; flatcar-todo.md has the
steps and the reasoning behind the awkward parts.
Co-Authored-By: Claude Opus 5 <[email protected]>
Technitium now serves and resolves on 192.168.7.2 as well as its
192.168.0.2 address. The interface was added by hand out of band; this
brings it under management so the next apply does not remove it.
Adopts the module's new nic2 object in place of the VM-only ip2 string.
The submodule bump is a single ref, so it also carries in the Flatcar
module support that the next commit starts using.
Co-Authored-By: Claude Opus 5 <[email protected]>
module.technitium was gated only on the API token being present in
Infisical, so the single way to stop Terraform reconciling DNS was to pull
the token -- which also disables anything else that needs it. This adds an
explicit switch that ANDs with the existing token check, so the token can
stay put.
Set to false for now: DNS is being moved by hand during the domain
migration, and an apply in the middle of that would fight it.
Co-Authored-By: Claude Opus 5 <[email protected]>
Moves the search domain onto a real delegated subdomain and points DNS at
Technitium's new address on the atlashorizon VLAN (192.168.7.2) instead of
1.1.1.1 / its 192.168.0.x address. The S3 state backend endpoint follows
the same rename.
Drops the manual .lan records and the bookstack Caddy proxy along with the
old zone: those hosts are served under the new domain now, and leaving
them would have recreated the retired zone on the next apply.
Co-Authored-By: Claude Opus 5 <[email protected]>
nick
Nick Trochalakis