From 7db703fcc9030c21aff9c2024597d983e188ce38 Mon Sep 17 00:00:00 2001 From: Peter Stefka Date: Tue, 31 Dec 2024 23:38:47 +0100 Subject: [PATCH 1/3] Update README.md --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 9f6fd54..2a50b67 100644 --- a/README.md +++ b/README.md @@ -130,6 +130,12 @@ flowchart TD ### Backup +### Remote Access + ## Setup +### Code + - ansible + +### Manual From 2120b1ecbbd40812148e840dabd160415ce83b14 Mon Sep 17 00:00:00 2001 From: Peter Stefka Date: Tue, 31 Dec 2024 23:45:23 +0100 Subject: [PATCH 2/3] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 2a50b67..78b7f17 100644 --- a/README.md +++ b/README.md @@ -104,7 +104,7 @@ flowchart TD |Name|Pihole|Adguard Home|Blocky| |---|---|---|---| -|Description|- config using GUI only|- config using GUI / config file|- manual declarative configuration only| +|Description|- config using GUI and ENV|- config using GUI / config file|- manual declarative configuration only| |||- sync between instances available as a project|| |||- available as an HAOS addon|| From 7c99056848d7a067e9892f338fbc44a04f2cd048 Mon Sep 17 00:00:00 2001 From: Peter Stefka Date: Sun, 12 Jan 2025 22:45:30 +0100 Subject: [PATCH 3/3] more updates --- README.md | 122 +++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 111 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 78b7f17..e345f02 100644 --- a/README.md +++ b/README.md @@ -15,24 +15,40 @@ flowchart TD W --> NUC[Intel NUC] RX --> HUE[Philip HUE] RX --> PC + RX --> RASPI? ``` ### Compute +- Intel NUC running docker containers - N100 running Proxmox - HAOS with addons (containers) - - Ubuntu running docker containers -- Intel NUC running docker containers + - one of: + +|Name|HAOS Addons|Talos OS|K3s|Proxmox LXC|Containers| +|---|---|---|---|---|---| +|Description|- running inside HAOS VM|- immutable OS, with declarative config|- running on top of Ubuntu|- Proxmox native|- running on top of Ubuntu| +||- nested virtualization|- nested virtualization|- nested virtualization|- **native virtualization**|- nested virtualization| +||- extremly easy|- interesting approach, could learn something new|- similar to RKE2|- probably harder management, upgrades|- same old approach| +||- lifecycle dependent on HAOS|- slightly higher resource usage than k3s|- very lightweight|- ultra lightweight|| +|||- K8s *|- K8s *|- LXC containers|- Docker containers| + +\* many new options, like gitops, operators .. ### DNS - DHCP at Wifi serves 2 custom DNS + - features + - adblocking + - malware blocking + - safe search + - parental control - provided by Adguard Home - lives at N100 (primary) & Intel NUC (secondary) - synchronized using [Adguard Home Sync](https://github.com/bakito/adguardhome-sync) - - DHCP hostname resolution is forwarded to the Wifi router + - DHCP hostname resolution is forwarded to the DHCP provider - allows custom FQDN resolution - - including subdomain / *, e.g. either resolve every subdomain if not defined using nuc.local record, or enable definition of a *.nuc.local record + - including subdomain / *, e.g. either resolve every subdomain if not defined using parent record, e.g. budabuda.duckdns.org for everything.budabuda.duckdns.org, or enable definition of a asterisk record, i.e. *.budabuda.duckdns.org - TXT records resolution is forwarded to upstream DNS
Adguard implementationdetails (click to expand) @@ -108,34 +124,118 @@ flowchart TD |||- sync between instances available as a project|| |||- available as an HAOS addon|| +### Certificates + +- use of Let's Encrypt certificates everywhere +- usage of DNS01 challenge required with duckdns.org (management of TXT records) + +- services with native support + - Proxmox + - Nginx / Traefik / Caddy + +- appliances without native support, i.e. certificate push required, e.g. using ansible running within Semaphore + - Asus Wifi (missing DNS01 challenge) + - Ubiquiti RouterX + - NAS (Synology v6) + ### HTTP Load Balancing -- reverse proxy -- allows usage of Let's Encrypt DNS01 challenge -- DNS01 challenge integrates with DuckDNS (management of TXT records) +- used as reverse proxy for services running on Compute (N100, nuc) +- manages [Let's Encrypt certificate](#certificates) - ideally has interface to Docker for dynamic provisioning -#### Other options considered - **\*\* TODO \*\*** |Name|Nginx Proxy Manager|Traefik|Caddy| |---|---|---|---| -|Description|- manual config using GUI|- static declarative configuration + first class dynamic integration with Docker|- manual declarative configuration only| +|Description|- manual config using GUI|- static declarative configuration|- manual declarative configuration only| +||- no Docker integration|- first class dynamic integration with Docker|- integration with Docker| ||- available as an HAOS addon||| ### Services +- N100 + - HAOS + - Uptime kuma + - Zero tier + - Heimdall + - Adguard + - Nginx / Traefik / Caddy + - Semaphore (Ansible) + - MQTT broker + - Node-RED + - ZwareJS Server + - Portainer + - SSHwifty + - Room Assistant ??? + - Ombi + - ***arr + - Jackett + +- NUC + - Adguard + Adguard sync + - Duplicati + - Nginx / Traefik / Caddy + - Music Assistant + Squeeze lite + - Jellyfin + - Zero tier + - Youtube DL + - Prometheus + Blackbox exporter + Alertmanager <- to be deprecated + - Room Assistant ??? + ### Monitoring +- Uptime Kuma + - pings deviced + - DNS resolving + - primary DNS + - custom DNS + - DHCP DNS + - Internet DNS + - secondary DNS + - custom DNS + - https (with certicate expiration) for services +- Prometheus + Blackbox exporter + Alertmanager <- to be deprecated + +- Telegram notification target + ### Backup +- using HASS native backup with Telegram integration +- using Proxmox with webhook notification to hass endpoint to send notification to Telegram +- using Duplicati with Telegram integration on error / fatal + +- appliance backup + - wifi + - routerx + - pornonas + - proxmox + ### Remote Access +- zerotier = current setup +- tailscale (uses Wireguard under the hood) + ## Setup -### Code +### Automation + +- targeting this repo + - authentication using personal access tokens + - validity monitoring ? - ansible + - running inside Semaphore + - reads code + config from Gitrepo + - secrets are local to Semaphore + +- Gitops using ArgoCD + +### Upgrades + +- unattended Ubuntu upgrades +- monitoring for available upgrades + - appliances + - services ### Manual