Commit Graph

10 Commits

Author SHA1 Message Date
Adyrem 3bb01ddaaf Add Jellyfin media stack (LXC 106, NVIDIA GTX 1060)
- New Ansible role: jellyfin — Docker + nvidia-container-toolkit setup,
  full *arr stack compose file (Jellyfin, qBittorrent, Radarr, Sonarr,
  Prowlarr, FlareSolverr, Jellyseerr), systemd service for auto-start
- New playbook: jellyfin.yml targeting media_servers group
- Inventory: add media LXC (10.10.1.50) to media_servers group
- Traefik: add internal .homelab routes for all 6 media services
- Pi-hole: add DNS records for all 6 media services → Traefik
- network-interfaces: DNAT port 6881 TCP+UDP → 10.10.1.50 for BitTorrent
- homelab-requirements.md: document full Jellyfin stack requirements
  including NVIDIA GTX 1060 passthrough approach and driver notes
- jellyfin-tools: original reference compose file from upstream

Infrastructure created on Proxmox:
- LXC 106 (media, Debian 12, privileged, nesting=1, 10.10.1.50/vmbr1)
- ZFS dataset hdd/media mounted at /media in LXC
- NVIDIA device passthrough entries in /etc/pve/lxc/106.conf

Note: NVIDIA driver 580.159.03 (.run) installed on Proxmox host — not
managed by apt (Debian only has 550.x which doesn't support kernel 7.x
or GTX 1060 Pascal as of this driver version).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-18 13:28:37 +02:00
Adyrem 1d878a8d45 Scope port 80/443 DNAT to Proxmox public IP only
Without -d 192.168.1.10, the DNAT rule intercepted all TCP port 80/443
traffic arriving on vmbr0 — including LAN or routed traffic destined for
internal VMs like Pi-hole (10.10.1.2), redirecting it to Traefik instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 13:46:48 +02:00
Adyrem 1cf6c81ac5 Add sanoid Ansible role for ZFS snapshots and replication
Replaces manually deployed config files with a fully idempotent role:
installs sanoid, templates sanoid.conf and syncoid service/timer from
variables, enables both systemd timers. Removes static proxmox/sanoid.*
files. README rebuild section updated accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 04:22:05 +02:00
Adyrem 7ba749c620 Add Proxmox host role, WireGuard VPN, and public Gitea via Traefik HTTPS
Ansible Lint / lint (push) Successful in 4s
Proxmox host role:
- Admin user setup, SSH hardening (port 2222, no root login)
- claude-code SFTP chroot user
- Unattended upgrades, DuckDNS dynamic DNS updater (vault-encrypted token)
- WireGuard VPN server (10.10.10.0/24) with Fedora client registered
- Proxmox firewall management via pvesh API (idempotent Python script)

Public Gitea exposure:
- Traefik: add HTTPS entrypoint, Let's Encrypt ACME (HTTP-01), StripPrefix
  middleware for /git subpath, HTTP→HTTPS redirect
- Gitea ROOT_URL updated to https://adyrem.duckdns.org/git/
- Pi-hole split DNS: adyrem.duckdns.org → 10.10.1.3 for internal hairpin bypass

SSH config fixes:
- StrictHostKeyChecking no → accept-new across all hosts
- Proxmox jump host: port 2222, user adyrem (root login disabled)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 04:06:56 +02:00
Adyrem d1d38df0e4 Track LXC container configs and fix network-interfaces
- proxmox/lxc/103.conf: Pi-hole LXC (firewall=0 to fix NAT via fwbr)
- proxmox/lxc/104.conf: Traefik LXC
- proxmox/network-interfaces: Proxmox network config with DNAT/MASQUERADE
  rules; fixes tpost-up typo so DNS DNAT persists across reboots

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-15 19:52:43 +02:00
Adyrem 62e5027d24 Add Proxmox firewall configs and Grafana dashboards
- proxmox/firewall/host.fw: host firewall rules (SSH/Proxmox UI/SPICE
  from LAN, DNS from internal subnets, ICMP)
- proxmox/firewall/cluster.fw: cluster firewall with network aliases
- files/grafana-dashboards/node-exporter-full.json: Node Exporter Full
  (grafana.com/dashboards/1860)
- files/grafana-dashboards/loki-logs.json: Logs/App dashboard for Loki
  (grafana.com/dashboards/13639)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-15 18:35:36 +02:00
Adyrem 3d596b984b Add Claude Code VM (105) with cloud-init provisioning
Arch Linux cloud image, 4 cores/8GB, dev-net (10.10.2.10), autostart.
Cloud-init handles user/SSH key/network on first boot. Ansible role
installs Claude Code CLI, tmux, SSH keys, SSH config for all managed
VMs via ProxyJump, homelab repo clone.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-15 17:41:52 +02:00
Adyrem c626177daa Enable autostart for Gitea and monitoring VMs
Set onboot=1 on VM 100 (gitea) and VM 101 (monitoring) so they start
automatically on Proxmox host boot.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-15 16:18:49 +02:00
Adyrem d50451fde4 Add Windows VM config and update remote access docs
VM 102: Windows 11 Home N, 8 cores/16GB, OVMF+TPM2, QXL/SPICE display,
vmbr3 (desktop-net). SPICE used instead of RDP — Home N has no RDP server.
Clean-install snapshot taken and synced to HDD.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-15 16:14:50 +02:00
Adyrem 81a2a4ba54 Add sanoid/syncoid ZFS snapshot and replication config
- sanoid: daily snapshots (7d) + weekly (4w) for rpool/data (VM disks)
  and rpool/ROOT (Proxmox OS); runs every 15 min via systemd timer
- syncoid: daily replication from rpool/data and pve-root to hdd/backups
  at 02:00; first full sync completed successfully
- All VM disks (gitea, monitoring) now backed up to HDD pool

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-15 14:45:18 +02:00