summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-05claude: update CLAUDE.mdHEADmasterArseney300
2026-03-05jenkins: add example of Dockerfile for u-boot-builderArseney300
2026-03-05nexus: add nexus to jenkins_networkArseney300
2026-03-04doc: add last security auditArseney300
2026-03-04doc: add color palette of projectArseney300
2026-03-04docs: update CLAUDE.md with Netdata service and auth notesArseney300
- Add Netdata service entry (monitoring_network, auth_request, Cache-Control) - Fix Authelia forward-auth list (Nexus is bypass, not forward-auth) - Add rule ordering warning to Authelia entry - Add Cookie header forwarding note to Nginx entry - Add monitoring_network to networking and startup order sections Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-04Add Netdata auth-request protection and fix Authelia rule orderingArseney300
- nginx: add /netdata/ location with auth_request and Cache-Control: no-store to prevent browser-cached pages from triggering CORS errors on API calls - nginx: add explicit Cookie header forwarding to all /_authelia-auth subrequest locations (swave.lol, jenkins, gerrit server blocks) - authelia: fix access_control rule ordering — move netdata/cockpit one_factor rules before the general swave.lol bypass rule so they are evaluated first (Authelia stops at first match) - authelia: split blog/ghost bypass from swave.lol catch-all so the main domain bypass only applies after protected paths are checked Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-04docs: add Authelia user management section to setup guideArseney300
Added section 12 covering how to add, change password, and remove Authelia users — including hash generation, YAML format, single-quote requirement for argon2id hashes, and live reload via SIGHUP. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-04Remove Authelia gate from Nexus and Docker registryArseney300
Nexus and registry.swave.lol now bypass Authelia entirely — Nexus handles its own authentication for both the web UI and Docker clients. auth_request removed from all nexus/registry nginx locations. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-04Add Authelia SSO, Jenkins OIDC, Gerrit HTTP auth, and related configArseney300
- authelia/: Full Authelia stack (docker-compose, config, setup guide, nginx snippet) - Forward-auth for Netdata, Cockpit, Nexus, registry - OIDC provider for Jenkins (oic-auth plugin, authorization_policy: one_factor) - HTTP header auth for Gerrit (X-Forwarded-User on /login/ only) - authelia_network: 172.26.0.0/16 - nginx/nginx.conf: - auth.swave.lol server block - /_authelia-auth internal subrequest locations (resolver 127.0.0.11) - auth_request on Gerrit /login/, Jenkins, Nexus, registry - OIDC finishLogin bypass for Jenkins - swave.lol/gerrit and swave.lol/jenkins redirect to subdomains - proxy_redirect for Gerrit container hostname rewrites - nginx/docker-compose.yaml: joined authelia_network - nginx/run_certbot.sh: added auth.swave.lol - jenkins/docker-compose.yaml: removed --prefix=/jenkins (Jenkins now at /) - cockpit/nginx-authelia.conf, netdata/nginx-netdata.conf: added auth_request - git-server/gerrit.config.example: Gerrit config template (real config gitignored) - .gitignore: added users_database.yml, gerrit.config - CLAUDE.md: updated Jenkins, Gerrit, Authelia entries; added key files - doc/setup-guide.md: Authelia section, updated startup order and service table Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-02Reduce JVM memory for Nexus and Jenkins to fit 8GB serverArseney300
Nexus: cap heap at 1024m (down from default 2703m) Jenkins: cap heap at 512m (was unbounded) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02Add Nexus Repository Manager with Docker registry and Authelia authArseney300
Nexus provides artifact storage (Maven, raw, etc.) and a private Docker registry at registry.swave.lol. Authelia forward-auth protects Gerrit, Jenkins, and Nexus behind SSO. Includes setup guide, nginx config, certbot domains, and a Jenkins pipeline example for artifact uploads. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02Update CLAUDE.md with ghost.swave.lol, error pages, and git-performance docArseney300
Add ghost.swave.lol subdomain, Ghost URL config notes, nginx catch-all error page, and git-performance.md to key files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02ghost: remove 2368 port from DOMAIN for ghostArseney300
2026-03-02Switch Ghost URL config from http to httpsArseney300
SSL is now in place, so Ghost should use https:// for its URL and admin URL. Fixes the membership portal failing to load due to mixed content / SSL protocol errors on API calls. Note: DOMAIN in stack.env must be set to the bare domain (e.g. swave.lol) without a port number. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02Add Cockpit & Netdata to setup guide and update nginx configArseney300
- Document Cockpit and Netdata setup in section 8 of setup guide - Add monitoring_network to nginx compose with host-gateway for Cockpit - Update network diagram, startup order, services table and ports summary - Minor CLAUDE.md Jenkins description improvements Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-02Add Cockpit server admin setupArseney300
Native host install accessed at swave.lol/cockpit/ via nginx reverse proxy. Requires UrlRoot=/cockpit in /etc/cockpit/cockpit.conf for subpath support. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-02Add ghost.swave.lol alias and catch-all for unknown subdomainsArseney300
Add ghost.swave.lol as Ghost alias in nginx and certbot. Add default server blocks that serve a styled 404 error page for any subdomain not configured on the server. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21Add Netdata monitoring stackArseney300
Docker Compose setup for Netdata with monitoring_network (172.24.0.0/16). Includes nginx location blocks for path-based access at swave.lol/netdata/. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-21Add git server performance tuning guideArseney300
Cover repacking, bitmap indexes, commit graphs, compression tuning, protocol choice, partial/shallow clones, container CPU limits, and a quick setup script to apply all optimizations to a repo. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21Fix cgit links when accessed via swave.lol/cgit pathArseney300
Use sub_filter to rewrite href/action attributes (both quote styles) to include /cgit prefix, and proxy_redirect to catch cgit's HTTP redirects. Fixes broken navigation on path-based access while leaving cgit.swave.lol subdomain unaffected. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21Fix jenkins.swave.lol 404 by proxying through /jenkins prefixArseney300
Jenkins requires --prefix=/jenkins for path-based access on swave.lol. Redirect subdomain root to /jenkins/ and proxy the prefix path to Jenkins, avoiding double-prefix redirect loops. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-21Add permanent build agent setup instructions to setup guideArseney300
Document how to add dedicated build agents via SSH, configure labels for routing jobs, and disable builds on the controller for scaling. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Document workspace persistence and cleanup methodsArseney300
Explain incremental builds, Docker image caching vs container lifecycle, and two ways to clean the workspace for Pipeline jobs (host deletion and cleanWs plugin). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add pipeline durability fix and stuck build cleanup scriptArseney300
Mount jenkins/init.groovy.d/ into the container to auto-clean corrupted flow executions on startup (JENKINS-50407). Document both the prevention (Performance-optimized durability setting) and recovery (groovy cleanup script) in the setup guide. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Document SCM checkout behavior and large repo settingsArseney300
Explain that Jenkins auto-clones the repo before running the Jenkinsfile so a manual checkout stage is unnecessary. Add guidance on configuring shallow clone and extended timeout for large repositories like the kernel. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add importing existing repositories to setup guideArseney300
Cover bare clone for one-time copies and mirror clone for keeping repos synced with an upstream source. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add kernel-builder and Jenkinsfile.kernel-example to key files in CLAUDE.mdArseney300
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add kernel-builder Docker image and Jenkinsfile exampleArseney300
Custom Debian bookworm image with all dependencies for building the Linux kernel (gcc, flex, bison, libelf, libssl, dwarves, etc.). Includes example Jenkinsfile showing kernel build with artifact archiving. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add build artifacts section to Jenkins C++ build guideArseney300
Explain that Docker build containers are ephemeral and show how to use archiveArtifacts to persist compiled binaries in Jenkins storage. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add jenkins-cpp-build.md to key files in CLAUDE.mdArseney300
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add guide for building C++ apps in Jenkins with Docker agentArseney300
Covers repo setup, Jenkinsfile examples (g++ and CMake), pipeline job creation, SCM configuration, and automatic build triggers via polling or git post-receive hooks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Fix docker.sock permission denied by matching host docker GIDArseney300
Set the container's docker group GID to 990 to match the host's docker socket ownership, allowing Jenkins to spawn sibling containers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add git-server to jenkins_network with static IPsArseney300
Define subnet 172.23.0.0/16 for jenkins_network with static IPs: jenkins (172.23.0.2), git-server (172.23.0.3), gerrit (172.23.0.4). This allows git-server to communicate directly with Jenkins for build triggers and webhook integrations. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add Gerrit code review service to git-server stackArseney300
Gerrit joins git-network (repo access) and jenkins_network (build triggers), uses the official gerritcodereview/gerrit image with persistent storage under /var/gerrit, and is reverse-proxied via nginx at gerrit.swave.lol and swave.lol/gerrit. Updated certbot, setup guide, and project docs accordingly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Fix cgit doubled repo name by setting virtual-rootArseney300
Without virtual-root, cgit generates incorrect URLs that duplicate the repository name in the path. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Set static IP 172.22.0.3 for cgit on git-networkArseney300
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add servers.drawio files to .gitignoreArseney300
Prevent accidentally re-committing files that contain credentials. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20git-server: add build options to docker imageArseney300
2026-02-20Fix jenkins.swave.lol double prefix causing 404Arseney300
The subdomain proxy was passing /jenkins to Jenkins which already adds the prefix via --prefix=/jenkins, resulting in /jenkinsjenkins/. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20nginx: fix certs path in nginx.confArseney300
2026-02-20Merge branch 'fix/cgit-css'Arseney300
2026-02-20Fix ghost network name to prevent project name prefixArseney300
Without an explicit name, Compose creates ghost_ghost_network instead of ghost_network, breaking nginx reverse proxy. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add chown step for jenkins_home in setup guideArseney300
Jenkins runs as UID 1000 and needs write access to /var/jenkins_home. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Fix cgit CSS 404 by setting explicit asset pathsArseney300
Cgit was generating links to /cgit.css which, when accessed via swave.lol/cgit, routed to Ghost instead of the cgit container. Set css/logo paths to /cgit-css/ in cgitrc and add a /cgit-css/ proxy location in the main nginx config. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20nginx: fix certs path in nginx.confArseney300
2026-02-20Fix nginx port mappings broken by comment indentationArseney300
The commented-out 8000 port had extra indentation that made YAML parse it as part of the 80:80 value, causing no ports to be published. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Update CLAUDE.md with cgit service contextArseney300
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20Add cgit web interface to git-server stackArseney300
Adds a lightweight cgit container (Alpine + fcgiwrap + nginx) that auto-discovers bare repos via scan-path and serves them read-only. Accessible at both cgit.swave.lol and swave.lol/cgit through the main nginx reverse proxy. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20git-server: add in doc how to clone repo via gitArseney300
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-05 11:50:01 +0000