panxiao81andClaude Opus 5.5
0cd4a67e12
- 数据库主机上按实例运行 prometheus-community/postgres_exporter 0.20.1， 以实例 OS 用户走本地 socket，经 peer + ident 映射到仅有 pg_monitor 的 homelab_monitor 角色；无密码、不经 Bao。版本与官方 sha256sums.txt 同源。 - prod/dev 启用 pg_stat_statements；monitoring.yml 仅在未生效时 reload/重启 （prod 走 Patroni pending restart），重复执行 changed=0。 - 告警以上游 postgres_mixin 为底改写为 PrometheusRule，阈值对齐 Patroni failover lag 与 max_slot_wal_keep_size；抓取目标带 env 标签。 - Alertmanager 新增 env="dev" 路由到独立 dev 频道，dev SQL 检查告警补 env。 Co-Authored-By: Claude Opus 5.5 <[email protected]>
homelab-infra
Infrastructure and service configuration for the homelab. Git is the source of intent; the live estate is being adopted gradually, so a file being present does not yet imply that Flux or CI owns the corresponding resource.
Layout
| directory | purpose |
|---|---|
clusters/homelab/ |
Flux composition and cluster-specific reconciliation entrypoint |
platform/ |
cluster-wide controllers, ingress, storage and observability |
apps/ |
user-facing and supporting applications |
infrastructure/ |
Proxmox, local hosts/VMs, identity, secrets, Cloudflare and OCI |
archive/ |
retired implementations retained for operational history |
docs/ |
architecture decisions, migration plans and runbooks |
Each component remains independently deployable. There is no shared root package or Terraform root, and service-specific Terraform states must remain isolated.
Safety
- Treat the homelab as household production.
- Run Terraform plan and Ansible check/diff before mutation.
- Existing resources require a zero-change adoption plan before CI may apply.
- Never commit Terraform plans/states, live Kubernetes Secrets or plaintext keys.
- Kubernetes will be reconciled by Flux; Backstage is a portal, not a deployer.
- Recovery of PVE, OpenBao and Git must not depend on k3s being healthy.
See the redesign record for the target architecture and phased migration.