From 41f22c2d85debbef46a5465da67229bd40551c6b Mon Sep 17 00:00:00 2001 From: dtoro Date: Wed, 24 Jun 2026 18:06:56 +0200 Subject: [PATCH] trmnl (128): auto-deploy pipeline + LAN DNS record wired - auto-deploy.md: dtoro/terminalito pipeline (webhook 12, :9797), ALLOWED_HOST_LIST += 192.168.8.211, changelog - 128-trmnl.md: auto-deploy now wired, Technitium A record done, changelog - 107-dns.md: A record trmnl -> 192.168.8.175 (changelog) - 104-gitea.md: webhook id 12 + allowed host (changelog) Co-Authored-By: Claude Opus 4.8 --- containers/104-gitea.md | 3 +++ containers/107-dns.md | 3 +++ containers/128-trmnl.md | 7 +++++-- infrastructure/auto-deploy.md | 5 +++++ 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/containers/104-gitea.md b/containers/104-gitea.md index 09e75f8..95e40c9 100644 --- a/containers/104-gitea.md +++ b/containers/104-gitea.md @@ -45,6 +45,9 @@ LXC has `/etc/hosts` override mapping `auth.hubris.network → 192.168.8.175` (r ## Changelog +### 2026-06-24 — terminalito deploy webhook (id 12) +Push webhook on `dtoro/terminalito` → `http://192.168.8.211:9797/deploy` ([trmnl (128)](128-trmnl.md)); `app.ini` `ALLOWED_HOST_LIST` extended with `192.168.8.211`. See [auto-deploy](../infrastructure/auto-deploy.md). + ### 2026-04-28 — wiki entry created Initial documentation. diff --git a/containers/107-dns.md b/containers/107-dns.md index 3525f99..a07e2e7 100644 --- a/containers/107-dns.md +++ b/containers/107-dns.md @@ -48,6 +48,9 @@ Replaces the DHCP that was previously served by the Slate AX router. Static-IP L ## Changelog +### 2026-06-24 — A record `trmnl.hubris.network → 192.168.8.175` +Added for [trmnl (128)](128-trmnl.md) (LAN path via [Caddy (121)](121-caddy.md)); propagated to the NetBird managed zone by `dns-sync`. + ### 2026-06-06 — dns-sync cron installed (had been missing since deployment) Although the 2026-06-03 changelog claimed "cron */10", **no crontab was actually configured** on the LXC. The sync was running only via ad-hoc manual invocations during incident debugging. Fixed by adding `/etc/cron.d/dns-sync`. diff --git a/containers/128-trmnl.md b/containers/128-trmnl.md index 36fbf36..e15e569 100644 --- a/containers/128-trmnl.md +++ b/containers/128-trmnl.md @@ -25,7 +25,7 @@ Runs one FastAPI aggregator (`server.app:app`, port 9851) that mounts a router p - `/etc/systemd/system/trmnl-plugins.service` ## Auto-deploy -Not yet wired. Manual deploy: `pct exec 128 -- /opt/terminalito/server/deploy/deploy.sh`. When wired it follows [auto-deploy](../infrastructure/auto-deploy.md) Shape B (`/opt/terminalito-deploy/`, gitea webhook on `dtoro/terminalito`, add `192.168.8.211` to gitea `ALLOWED_HOST_LIST`). +Wired — [auto-deploy](../infrastructure/auto-deploy.md) Shape B, webhook id 12 on `dtoro/terminalito` → `http://192.168.8.211:9797/deploy` (`terminalito-deploy.service`). Push to `main` → `server/deploy/deploy.sh` (`git pull` + pip + reinstall units + restart `trmnl-plugins`). Secret `/etc/terminalito-deploy/secret`; git creds `/etc/terminalito-deploy/git-credentials` wired as a repo-local `credential.helper`. Manual: `pct exec 128 -- /opt/terminalito/server/deploy/deploy.sh`. ## Secrets Not yet SOPS-enrolled. The poll token is set directly in `/etc/trmnl-plugins/env`. Google Calendar + MVG creds are pending: enroll via `homelab client add trmnl` + bootstrap, add `secrets/trmnl-oauth.yaml`, then `server/deploy/render-env.sh` builds the env from `homelab secret trmnl-oauth`. Until then calendar/transit cards degrade to empty; weather works. @@ -33,11 +33,14 @@ Not yet SOPS-enrolled. The poll token is set directly in `/etc/trmnl-plugins/env ## Related - [Caddy (121)](121-caddy.md) — LAN reverse proxy (`trmnl.hubris.network → 192.168.8.211:9851`) - [VPS ingress](../infrastructure/ingress.md) — public edge (cert mirror + traefik router) -- [DNS (107)](107-dns.md) — needs Technitium A record `trmnl → 192.168.8.175` (pending) +- [DNS (107)](107-dns.md) — Technitium A record `trmnl → 192.168.8.175` (LAN path via Caddy) - [Gitea (104)](104-gitea.md) — source repo `dtoro/terminalito` - [Plan: 2026-06-24 TRMNL plugins LXC](../plans/2026-06-24-trmnl-plugins-lxc.md) ## Changelog +### 2026-06-24 — auto-deploy + LAN DNS wired +Gitea Shape-B deploy pipeline (webhook id 12, `:9797`) — push to `dtoro/terminalito` redeploys; verified end-to-end. Technitium A record `trmnl.hubris.network → 192.168.8.175` added on [dns (107)](107-dns.md) (propagated to the NetBird managed zone via dns-sync), so LAN clients take the short path through [Caddy (121)](121-caddy.md). See [auto-deploy](../infrastructure/auto-deploy.md). + ### 2026-06-24 — public path live Verified end-to-end from the internet: `https://trmnl.hubris.network/munich-home/dashboard` → 200 with token, 401 without; `/health` 200. The provision-time outage was the netbird `home-lab-network` (192.168.8.0/24) route having no active routing peer — the **mac-mini routing peer's netbird daemon was down** (artifacto/blog were 504 too). Bringing netbird up on mac-mini restored the route; the edge recovered with no config change. See [ingress](../infrastructure/ingress.md) / [mesh](../infrastructure/mesh.md). diff --git a/infrastructure/auto-deploy.md b/infrastructure/auto-deploy.md index 9910251..9c8d65f 100644 --- a/infrastructure/auto-deploy.md +++ b/infrastructure/auto-deploy.md @@ -24,6 +24,7 @@ The app repo at `/opt/` is the working tree, but the deploy tooling (`web - `192.168.8.136` ([mule-images (120)](../containers/120-mule-images.md)) - `192.168.8.77` ([hubris host](../hosts/hubris.md) — backup-library) - `192.168.8.190` ([plato (126)](../containers/126-plato.md)) + - `192.168.8.211` ([trmnl (128)](../containers/128-trmnl.md) — terminalito) **Don't strip these when editing app.ini.** @@ -42,6 +43,7 @@ The app repo at `/opt/` is the working tree, but the deploy tooling (`web | `dtoro/backup-library` | [hubris host](../hosts/hubris.md) `/opt/backup-library/` | A | `http://192.168.8.77:9798/deploy` | (orig) | runs `deploy.sh` (preserves admin-edited `/etc/restic/include-*.list`) | | `dtoro/Homelab-Docs` → homelab-mcp | [apps (105)](../containers/105-apps.md) `/opt/homelab-mcp/` | B | `http://192.168.8.205:9811/deploy` | 10 | reinstalls `homelab-mcp.service` + restart | | `dtoro/Homelab-Docs` → secrets-issuance | [apps (105)](../containers/105-apps.md) `/opt/secrets-issuance/` | B | `http://192.168.8.205:9821/deploy` | 11 | reinstalls `secrets-issuance.service` + restart | +| `dtoro/terminalito` | [trmnl (128)](../containers/128-trmnl.md) `/opt/terminalito/` | B | `http://192.168.8.211:9797/deploy` | 12 | reinstalls units + `systemctl restart trmnl-plugins` | > Note: `dtoro/Homelab-Docs` has **two webhooks** firing on the same push. > Each owns its own clone on LXC 105. They don't conflict because each @@ -123,6 +125,9 @@ If you're not sure what's already lurking, run `homelab apt-audit --fleet` and l ## Changelog +### 2026-06-24 — terminalito pipeline added +Webhook id 12 on `dtoro/terminalito` → `http://192.168.8.211:9797/deploy` on [trmnl (128)](../containers/128-trmnl.md). Shape B (`server/deploy/webhook.py` receiver, in-repo `server/deploy/deploy.sh`; secret `/etc/terminalito-deploy/secret`). `app.ini` `ALLOWED_HOST_LIST` extended with `192.168.8.211`. Verified end-to-end with a push. Repo-local `credential.helper` in `/opt/terminalito/.git/config` (the unit can't read root's global git config). + ### 2026-05-20 — homelab-mcp + secrets-issuance pipelines added Webhook ids 10 + 11 on `dtoro/Homelab-Docs` (ports `9811` + `9821` on [apps (105)](../containers/105-apps.md)). Two webhooks on one repo — each owns its own clone (`/opt/homelab-mcp`, `/opt/secrets-issuance`) and only restarts its own service. See [homelab-context](homelab-context.md) for why both services live in one repo.