2026-01-20 19:05:51 +01:00
|
|
|
---
|
|
|
|
|
# Diun configuration for {{ inventory_hostname }}
|
|
|
|
|
# Documentation: https://crazymax.dev/diun/
|
|
|
|
|
|
|
|
|
|
db:
|
|
|
|
|
path: /data/diun.db
|
|
|
|
|
|
|
|
|
|
watch:
|
|
|
|
|
workers: {{ diun_watch_workers }}
|
|
|
|
|
schedule: "{{ diun_schedule }}"
|
chore: Post-workshop state - January 23rd, 2026
This commit captures the infrastructure state immediately following
the "Post-Tyranny Tech" workshop on January 23rd, 2026.
Infrastructure Status:
- 13 client servers deployed (white, valk, zwaan, specht, das, uil, vos,
haas, wolf, ree, mees, mus, mol, kikker)
- Services: Authentik SSO, Nextcloud, Collabora Office, Traefik
- Private network architecture with edge NAT gateway
- OIDC integration between Authentik and Nextcloud
- Automated recovery flows and invitation system
- Container update monitoring with Diun
- Uptime monitoring with Uptime Kuma
Changes include:
- Multiple new client host configurations
- Network architecture improvements (private IPs + NAT)
- DNS management automation
- Container update notifications
- Email configuration via Mailgun
- SSH key generation for all clients
- Encrypted secrets for all deployments
- Health check and diagnostic scripts
Known Issues to Address:
- Nextcloud version pinned to v30 (should use 'latest' or v32)
- Zitadel references in templates (migrated to Authentik but templates not updated)
- Traefik dynamic config has obsolete static routes
🤖 Generated with Claude Code (https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-23 20:36:31 +01:00
|
|
|
firstCheckNotif: {{ diun_first_check_notif | lower }}
|
2026-01-20 19:05:51 +01:00
|
|
|
|
|
|
|
|
defaults:
|
feat: Configure Diun with Docker Hub auth and watchRepo control
This commit resolves Docker Hub rate limiting issues on all servers by:
1. Adding Docker Hub authentication support to Diun configuration
2. Making watchRepo configurable (disabled to reduce API calls)
3. Creating automation to deploy changes across all 17 servers
Changes:
- Enhanced diun.yml.j2 template to support:
- Configurable watchRepo setting (defaults to true for compatibility)
- Docker Hub authentication via regopts when credentials provided
- Created 260124-configure-diun-watchrepo.yml playbook to:
- Disable watchRepo (only checks specific tags vs entire repo)
- Enable Docker Hub authentication (5000 pulls/6h vs 100/6h)
- Change schedule to weekly (Monday 6am UTC)
- Created configure-diun-all-servers.sh automation script with:
- Proper SOPS age key file path handling
- Per-server SSH key management
- Sequential deployment across all servers
- Fixed Authentik OIDC provider meta_launch_url to use client_domain
Successfully deployed to all 17 servers (bever, das, egel, haas, kikker,
kraai, mees, mol, mus, otter, ree, specht, uil, valk, vos, wolf, zwaan).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-24 13:16:25 +01:00
|
|
|
watchRepo: {{ diun_watch_repo | default(true) | lower }}
|
2026-01-20 19:05:51 +01:00
|
|
|
notifyOn:
|
|
|
|
|
- new
|
|
|
|
|
- update
|
|
|
|
|
|
feat: Configure Diun with Docker Hub auth and watchRepo control
This commit resolves Docker Hub rate limiting issues on all servers by:
1. Adding Docker Hub authentication support to Diun configuration
2. Making watchRepo configurable (disabled to reduce API calls)
3. Creating automation to deploy changes across all 17 servers
Changes:
- Enhanced diun.yml.j2 template to support:
- Configurable watchRepo setting (defaults to true for compatibility)
- Docker Hub authentication via regopts when credentials provided
- Created 260124-configure-diun-watchrepo.yml playbook to:
- Disable watchRepo (only checks specific tags vs entire repo)
- Enable Docker Hub authentication (5000 pulls/6h vs 100/6h)
- Change schedule to weekly (Monday 6am UTC)
- Created configure-diun-all-servers.sh automation script with:
- Proper SOPS age key file path handling
- Per-server SSH key management
- Sequential deployment across all servers
- Fixed Authentik OIDC provider meta_launch_url to use client_domain
Successfully deployed to all 17 servers (bever, das, egel, haas, kikker,
kraai, mees, mol, mus, otter, ree, specht, uil, valk, vos, wolf, zwaan).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-24 13:16:25 +01:00
|
|
|
{% if diun_docker_hub_username is defined and diun_docker_hub_password is defined %}
|
|
|
|
|
regopts:
|
|
|
|
|
- selector: image
|
|
|
|
|
username: {{ diun_docker_hub_username }}
|
|
|
|
|
password: {{ diun_docker_hub_password }}
|
|
|
|
|
{% endif %}
|
|
|
|
|
|
2026-01-20 19:05:51 +01:00
|
|
|
providers:
|
|
|
|
|
docker:
|
|
|
|
|
watchByDefault: {{ diun_watch_all | lower }}
|
|
|
|
|
{% if diun_exclude_containers | length > 0 %}
|
|
|
|
|
excludeContainers:
|
|
|
|
|
{% for container in diun_exclude_containers %}
|
|
|
|
|
- {{ container }}
|
|
|
|
|
{% endfor %}
|
|
|
|
|
{% endif %}
|
|
|
|
|
|
|
|
|
|
notif:
|
|
|
|
|
{% if diun_notif_enabled and diun_notif_type == 'webhook' and diun_webhook_endpoint %}
|
|
|
|
|
webhook:
|
|
|
|
|
endpoint: {{ diun_webhook_endpoint }}
|
|
|
|
|
method: {{ diun_webhook_method }}
|
|
|
|
|
timeout: 10s
|
|
|
|
|
{% if diun_webhook_headers | length > 0 %}
|
|
|
|
|
headers:
|
|
|
|
|
{% for key, value in diun_webhook_headers.items() %}
|
|
|
|
|
{{ key }}: {{ value }}
|
|
|
|
|
{% endfor %}
|
|
|
|
|
{% endif %}
|
|
|
|
|
{% endif %}
|
|
|
|
|
|
|
|
|
|
{% if diun_slack_webhook_url %}
|
|
|
|
|
slack:
|
|
|
|
|
webhookURL: {{ diun_slack_webhook_url }}
|
|
|
|
|
{% endif %}
|
|
|
|
|
|
|
|
|
|
{% if diun_email_enabled and diun_smtp_username_final is defined and diun_smtp_password_final is defined and diun_smtp_password_final != '' %}
|
|
|
|
|
mail:
|
|
|
|
|
host: {{ diun_smtp_host }}
|
|
|
|
|
port: {{ diun_smtp_port }}
|
|
|
|
|
ssl: false
|
|
|
|
|
insecureSkipVerify: false
|
|
|
|
|
username: {{ diun_smtp_username_final }}
|
|
|
|
|
password: {{ diun_smtp_password_final }}
|
|
|
|
|
from: {{ diun_smtp_from }}
|
|
|
|
|
to: {{ diun_smtp_to }}
|
|
|
|
|
{% endif %}
|
2026-01-23 21:13:49 +01:00
|
|
|
|
|
|
|
|
{% if diun_matrix_enabled and diun_matrix_homeserver_url and diun_matrix_user and diun_matrix_room_id %}
|
|
|
|
|
matrix:
|
|
|
|
|
homeserverURL: {{ diun_matrix_homeserver_url }}
|
|
|
|
|
user: "{{ diun_matrix_user }}"
|
|
|
|
|
{% if diun_matrix_access_token %}
|
|
|
|
|
accessToken: {{ diun_matrix_access_token }}
|
|
|
|
|
{% elif diun_matrix_password %}
|
|
|
|
|
password: "{{ diun_matrix_password }}"
|
|
|
|
|
{% endif %}
|
|
|
|
|
roomID: "{{ diun_matrix_room_id }}"
|
|
|
|
|
{% endif %}
|