Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

platform/observability/traces/helm.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Deploy tracing: VictoriaTraces (VTSingle CR, operator-managed) + the OpenTelemetry
+# Collector that fronts it. Apps send OTLP to otel-collector.monitoring.svc:4317 (gRPC)
+# / :4318 (HTTP); the collector batches and forwards to VictoriaTraces.
+#
+# NOTE: we use the operator's VTSingle CRD (traces/vtsingle.yaml) rather than the
+# victoria-traces-single Helm chart — one operator manages metrics, logs, and traces.
+# traces-values.yaml is kept only as a reference for the standalone-chart alternative.
+set -euo pipefail
+
+kubectl apply -f vtsingle.yaml
+kubectl -n monitoring wait --for=jsonpath='{.status.updateStatus}'=operational vtsingle/main --timeout=120s || true
+kubectl apply -f otel-collector.yaml

platform/observability/traces/otel-collector.yaml

@@ -0,0 +1,117 @@
+# OpenTelemetry Collector — OTLP ingress point for app traces. Receives OTLP over
+# gRPC (4317) and HTTP (4318), batches, and exports to VictoriaTraces' OTLP endpoint.
+# Point your apps' OTEL_EXPORTER_OTLP_ENDPOINT at otel-collector.monitoring.svc:4317.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: otel-collector
+  namespace: monitoring
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: otel-collector-config
+  namespace: monitoring
+data:
+  config.yaml: |
+    receivers:
+      otlp:
+        protocols:
+          grpc:
+            endpoint: 0.0.0.0:4317
+          http:
+            endpoint: 0.0.0.0:4318
+    processors:
+      memory_limiter:
+        check_interval: 5s
+        limit_percentage: 80
+        spike_limit_percentage: 25
+      batch:
+        timeout: 5s
+    exporters:
+      otlphttp/victoriatraces:
+        # VictoriaTraces (VTSingle CR) OTLP-over-HTTP ingestion endpoint.
+        traces_endpoint: http://vtsingle-main.monitoring.svc:10428/insert/opentelemetry/v1/traces
+        tls:
+          insecure: true
+    service:
+      pipelines:
+        traces:
+          receivers: [otlp]
+          processors: [memory_limiter, batch]
+          exporters: [otlphttp/victoriatraces]
+      telemetry:
+        metrics:
+          address: 0.0.0.0:8888
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: otel-collector
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: otel-collector
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: otel-collector
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: otel-collector
+    spec:
+      serviceAccountName: otel-collector
+      containers:
+        - name: otel-collector
+          # Pin to a current release; check https://github.com/open-telemetry/opentelemetry-collector-releases
+          image: otel/opentelemetry-collector-contrib:0.119.0
+          args: ["--config=/etc/otel/config.yaml"]
+          ports:
+            - { name: otlp-grpc, containerPort: 4317 }
+            - { name: otlp-http, containerPort: 4318 }
+            - { name: metrics, containerPort: 8888 }
+          volumeMounts:
+            - name: config
+              mountPath: /etc/otel
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+      volumes:
+        - name: config
+          configMap:
+            name: otel-collector-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: otel-collector
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: otel-collector
+spec:
+  selector:
+    app.kubernetes.io/name: otel-collector
+  ports:
+    - { name: otlp-grpc, port: 4317, targetPort: 4317 }
+    - { name: otlp-http, port: 4318, targetPort: 4318 }
+    - { name: metrics, port: 8888, targetPort: 8888 }
+---
+# Self-scrape the collector's own telemetry into VictoriaMetrics.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: otel-collector
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/part-of: victoria-metrics
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: otel-collector
+  endpoints:
+    - port: metrics

platform/observability/traces/traces-values.yaml

@@ -0,0 +1,21 @@
+# victoria-traces-single — single-node distributed tracing backend. No external
+# storage deps. Ingests OTLP (from the OTel Collector) and exposes a Jaeger Query
+# API that Grafana reads via a Jaeger datasource.
+# Service: victoria-traces-single-server.monitoring.svc:10428
+#
+# NOTE: confirm key names against the installed chart before applying:
+#   helm show values vm/victoria-traces-single
+
+server:
+  retentionPeriod: 30d
+  persistentVolume:
+    enabled: true
+    storageClassName: localpv-zfs-ceph
+    size: 20Gi
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1"
+      memory: 2Gi

platform/observability/traces/vtsingle.yaml

@@ -0,0 +1,25 @@
+# Single-node VictoriaTraces, managed by the VM operator (no separate Helm chart needed
+# — the operator ships the VTSingle CRD). Ingests OTLP from the OTel Collector and
+# exposes a Jaeger-compatible query API that Grafana reads.
+# Service: vtsingle-main.monitoring.svc:10428
+apiVersion: operator.victoriametrics.com/v1
+kind: VTSingle
+metadata:
+  name: main
+  namespace: monitoring
+spec:
+  retentionPeriod: "30d"
+  storage:
+    accessModes:
+      - ReadWriteOnce
+    storageClassName: localpv-zfs-ceph
+    resources:
+      requests:
+        storage: 20Gi
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1"
+      memory: 2Gi