Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
2026-09-09 16:47:20 +00:00
commit 88a02ababa
418 changed files with 50579 additions and 0 deletions
@@ -0,0 +1,40 @@
+# LAN-facing SMTP endpoint for hosts OUTSIDE the k3s cluster — specifically the
+# three Proxmox nodes (pve1 .4, pve2 .7, pve3 .9), which relay their system mail
+# (PVE notifications, smartd, cron) through here to M365.
+#
+# Kept SEPARATE from service.yaml on purpose: that ClusterIP service is what
+# Authelia and Gitea address by DNS name (smtp-relay.smtp-relay.svc.cluster.local),
+# and it must not change shape.
+#
+# k3s servicelb (klipper) host-binds :25 on the laptop (192.168.10.127).
+#
+# CRITICAL — why loadBalancerSourceRanges is the ONLY real access control here:
+# klipper SNATs incoming connections, so the relay sees every LAN client as
+# `_gateway[10.42.0.1]` rather than its true address. 10.42.0.1 is inside the
+# pod CIDR that MY_NETWORK already trusts, which means postfix's IP-based
+# `permit_mynetworks` CANNOT distinguish a Proxmox node from any other LAN host —
+# per-node /32 entries in MY_NETWORK are decorative. Without the source ranges
+# below this service is an OPEN RELAY to the whole LAN (verified: an untrusted
+# host got a 220 banner and would have been permitted to relay).
+# So: restrict at the LB. Do not remove this block.
+apiVersion: v1
+kind: Service
+metadata:
+  name: smtp-relay-lan
+  namespace: smtp-relay
+  labels:
+    app: smtp-relay
+spec:
+  type: LoadBalancer
+  selector:
+    app: smtp-relay
+  # Only the three Proxmox nodes may even open a TCP connection to :25.
+  loadBalancerSourceRanges:
+    - 192.168.10.4/32   # pve1
+    - 192.168.10.7/32   # pve2
+    - 192.168.10.9/32   # pve3
+  ports:
+    - name: smtp
+      port: 25
+      targetPort: 25
+      protocol: TCP