bc838dfcb6
Add jellyfin media stack with full service automation
...
Ansible Lint / lint (push) Successful in 7s
- New jellyfin Ansible role: Docker stack (Jellyfin, qBittorrent, Radarr,
Sonarr, Prowlarr, FlareSolverr, Jellyseerr) with NVIDIA GPU passthrough
- configure_services.yml automates download clients, root folders, Prowlarr
indexers/apps, qBittorrent credential pre-seeding, and Jellyseerr setup
- Fix TPB Cardigann season search: apibay.org returns 0 for season-level
queries (e.g. the.boys.s05); patch strips season/ep from tv-search params
and locks the definition file read-only to survive Prowlarr refreshes
- Fix Pi-hole update_hosts.py regex: use re.DOTALL + count=1 to handle
multi-line arrays without overwriting the DHCP section
- Add phone WireGuard peer, devbox Traefik/DNS entries, TLS cert plumbing,
firewall rule for Traefik IP to Proxmox web UI
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-18 18:31:30 +02:00
30b2d42fcc
Enforce firewall=0 on vmbr2 VMs to prevent NAT breakage
...
Ansible Lint / lint (push) Successful in 5s
When a VM has firewall=1, Proxmox inserts a fwbr bridge and iptables
POSTROUTING fires at the bridge step (OUT=fwbrNNNi0) rather than at
vmbr0. The MASQUERADE rule (-o vmbr0) never matches, so the VM loses
internet access.
Adds an idempotent task to the proxmox_host role that strips
firewall=1 from VM 105's net0 config whenever the playbook runs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-18 11:39:08 +02:00
7ba749c620
Add Proxmox host role, WireGuard VPN, and public Gitea via Traefik HTTPS
...
Ansible Lint / lint (push) Successful in 4s
Proxmox host role:
- Admin user setup, SSH hardening (port 2222, no root login)
- claude-code SFTP chroot user
- Unattended upgrades, DuckDNS dynamic DNS updater (vault-encrypted token)
- WireGuard VPN server (10.10.10.0/24) with Fedora client registered
- Proxmox firewall management via pvesh API (idempotent Python script)
Public Gitea exposure:
- Traefik: add HTTPS entrypoint, Let's Encrypt ACME (HTTP-01), StripPrefix
middleware for /git subpath, HTTP→HTTPS redirect
- Gitea ROOT_URL updated to https://adyrem.duckdns.org/git/
- Pi-hole split DNS: adyrem.duckdns.org → 10.10.1.3 for internal hairpin bypass
SSH config fixes:
- StrictHostKeyChecking no → accept-new across all hosts
- Proxmox jump host: port 2222, user adyrem (root login disabled)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-16 04:06:56 +02:00
Adyrem