Commit Graph

4 Commits

Author SHA1 Message Date
Adyrem 3bb01ddaaf Add Jellyfin media stack (LXC 106, NVIDIA GTX 1060)
- New Ansible role: jellyfin — Docker + nvidia-container-toolkit setup,
  full *arr stack compose file (Jellyfin, qBittorrent, Radarr, Sonarr,
  Prowlarr, FlareSolverr, Jellyseerr), systemd service for auto-start
- New playbook: jellyfin.yml targeting media_servers group
- Inventory: add media LXC (10.10.1.50) to media_servers group
- Traefik: add internal .homelab routes for all 6 media services
- Pi-hole: add DNS records for all 6 media services → Traefik
- network-interfaces: DNAT port 6881 TCP+UDP → 10.10.1.50 for BitTorrent
- homelab-requirements.md: document full Jellyfin stack requirements
  including NVIDIA GTX 1060 passthrough approach and driver notes
- jellyfin-tools: original reference compose file from upstream

Infrastructure created on Proxmox:
- LXC 106 (media, Debian 12, privileged, nesting=1, 10.10.1.50/vmbr1)
- ZFS dataset hdd/media mounted at /media in LXC
- NVIDIA device passthrough entries in /etc/pve/lxc/106.conf

Note: NVIDIA driver 580.159.03 (.run) installed on Proxmox host — not
managed by apt (Debian only has 550.x which doesn't support kernel 7.x
or GTX 1060 Pascal as of this driver version).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-18 13:28:37 +02:00
Adyrem 80a3250cf6 Add /mtg route to Traefik and Pi-hole DNS
Routes adyrem.duckdns.org/mtg → http://10.10.2.10:3000 (claude-code-vm)
with StripPrefix so the app sees requests at /.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-18 10:24:33 +02:00
Adyrem 7ba749c620 Add Proxmox host role, WireGuard VPN, and public Gitea via Traefik HTTPS
Ansible Lint / lint (push) Successful in 4s
Proxmox host role:
- Admin user setup, SSH hardening (port 2222, no root login)
- claude-code SFTP chroot user
- Unattended upgrades, DuckDNS dynamic DNS updater (vault-encrypted token)
- WireGuard VPN server (10.10.10.0/24) with Fedora client registered
- Proxmox firewall management via pvesh API (idempotent Python script)

Public Gitea exposure:
- Traefik: add HTTPS entrypoint, Let's Encrypt ACME (HTTP-01), StripPrefix
  middleware for /git subpath, HTTP→HTTPS redirect
- Gitea ROOT_URL updated to https://adyrem.duckdns.org/git/
- Pi-hole split DNS: adyrem.duckdns.org → 10.10.1.3 for internal hairpin bypass

SSH config fixes:
- StrictHostKeyChecking no → accept-new across all hosts
- Proxmox jump host: port 2222, user adyrem (root login disabled)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 04:06:56 +02:00
Adyrem afd240de86 Add Pi-hole and Traefik LXC containers
- LXC 103 (pihole): Debian 12, 10.10.1.2, Pi-hole v6 with local DNS for
  gitea/grafana/traefik/pihole.homelab, Proxmox dnsmasq updated to use
  Pi-hole upstream
- LXC 104 (traefik): Debian 12, 10.10.1.3, Traefik v3 routing
  gitea.homelab → 10.10.1.125:3000, grafana.homelab → 10.10.1.137:3000
- DNAT rules on vmbr0 forwarding :80/:443 to Traefik, persisted in
  /etc/network/interfaces
- Ansible roles: pihole, traefik; playbooks: pihole.yml, traefik.yml
- site.yml excludes Debian containers from Arch-specific common role

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-15 16:52:20 +02:00