K3s-Nm on Janusworx

2026-02-03 Notes

feedback@janusworx.com (Mario Jason Braganza) — Tue, 03 Feb 2026 11:06:30 +0530

Goals + Recap
#

Play with and configure Kitty as another option for my terminal
Work on ZNC

2026-02-03 11:00
#

While I got the basics working the other day, I finished the rest of the work and got Kitty working just the way I want it. I can now launch kitty via ulauncher or gnome-terminal and get a Kitty layout for writing just like I used to¹, with Tmux and Zellij. And now I can copy and paste text as well! Blessed relief!
Now on to getting my ZNC up and running!
2026-02-03 11:34: Note to self: I am calling ZNC images in two places in my deployment. Make sure their versions always stay in sync via flux updations
2026-02-03 12:12: Ok, figured out the reason for my znc misery. ZNC can accept both irc as well as http traffic on the same port. And if I want traefik to be able to route both sorts of traffic to znc then I cannot terminate tls at traefik. Which I really, really want. Because I don’t want the headache of keeping track of which applications can maintain their own certs and which don’t. Simplest thing (which ZNC supports) is to add another listener port to ZNC. IRC traffic goes to one port, web traffic to another and hopefully all will be well. That’s the idea, in theory at least. Now to go try it out.
2026-02-03 12:22: Ok. Change znc config to accept web connections on another port and redeployed the pod. Now to get web traffic working first
2026-02-03 12:29: It works! My ZNC website is up! Now to go figure out how to route IRC traffic.
2026-02-03 12:47: Lunch!

2026-02-03 13:10
#

Back
2026-02-03 13:32: Ok sorta kinda wrote the ingressRouteTCP rule. Now to deploy and test
2026-02-03 14:38: It works! ZNC is alive! Will know tomorrow if my history buffers hold :)
2026-02-03 14:49: Tried a reboot. Still lost history. Need to configure ZNC probably. Checking that now.
2026-02-03 15:30: Tea time
2026-02-03 16:00: Walk

2026-02-03 17:40
#

Back
Trying to quickly see if there’s any Lightroom alternative out there in Linux land, that is not Darktable.
2026-02-03 18:00: Found one. It’s Darktable! But I found that it now has a Sigmoid workflow, that gives me a very Lightroom-esque workflow. Or maybe it’s just that the interface has changed to where I find it familiar. Anyhoo, this makes me so happy! Finally, I can now invest the time in a new tool :)
Now to some NMC work.
2026-02-03 18:48: Done. Now to get ZNC to update itself. 19:15: Done!
2026-02-03 19:25: Schedule, shutdown complete!

Feedback on this post?
Mail me at feedback at this domain.

3 paned layout.
Large pane on the right. For me. For writing or commands or whatever.
Top left pane to run Hugo Liveserver; bottom left pane to run a script that watches today’s daily note and keeps committing to it to the code repo to auto publish ↩︎

2026-01-29 Notes

feedback@janusworx.com (Mario Jason Braganza) — Thu, 29 Jan 2026 10:34:21 +0530

Goals + Recap
#

Play with and configure Kitty as another option for my terminal
Work on ZNC

2026-01-29 10:40
#

Got tired of being unable to cut and paste out of Tmux and Zellij. Realised what I want is a terminal that lets me do that, not necessarily a muxer. Something that lets me cut and paste text and have layout my little windows in the way I want. The Kitty docs suggest this is possible. So I’m giving it a spin.
2026-01-29 10:41: Do some NMC work first.
2026-01-29 10:41: Some tea first!
2026-01-29 11:05: Ok, now NMC work.
2026-01-29 11:26: Alright, now to go play with Kitty.
2026-01-29 12:16: Found a theme I liked. (Github Dark. The default theme is called default)
2026-01-29 15:45: Still struggling. Break.

2026-01-29 18:45
#

Back at work. Found an exact sample of what I wanted done in the Kitty docs.
2026-01-29 19:30: Adapted it. Applied it. It works. Done!
Calling it a night

Feedback on this post?
Mail me at feedback at this domain.

2026-01-28 Notes

feedback@janusworx.com (Mario Jason Braganza) — Wed, 28 Jan 2026 11:03:17 +0530

Goals + Recap
#

Work on ZNC
Attend my first contribex meeting

2026-01-28 12:00
#

Picking up the pieces after a break is darned hard

2026-01-28 19:00
#

Got halfway up to speed.
Will struggle more tomorrow

Feedback on this post?
Mail me at feedback at this domain.

2026-01-15 Notes

feedback@janusworx.com (Mario Jason Braganza) — Thu, 15 Jan 2026 10:48:18 +0530

Goals + Recap
#

I completely borked my Traefik deployment yesterday and brought down all my sites and web apps. Spent the day fixing it.
Today:

Vote in the local elections
Continue with my IRC+ZNC quest

2026-01-15 10:50
#

Starting with my Duolingo
2026-01-15 11:32: Break.

2026-01-15 14:20
#

Upgrading Mint.

Feedback on this post?
Mail me at feedback at this domain.

2026-01-14 Notes

feedback@janusworx.com (Mario Jason Braganza) — Wed, 14 Jan 2026 08:21:12 +0530

Goals + Recap
#

First day with new time table and I’m already behind. Will need to track how much time I spend on morning tasks and be more realistic
Continue with my work to get IRC+ZNC working on th cluster.

2026-01-14 10:15
#

Switched to doing Duoling on the desktop. It feels slightly better. Will keep at it.
Tea time.

2026-01-14 10:30
#

Now to start on my IRC+ZNC travails
2026-01-14 11:14: Think I am going to split them into two separate deployments. They are not going to talk to each other internally anyway. Tackling ~~ZNC~~ theLounge first.
2026-01-14 12:08: theLounge is up. Moving on to getting ZNC up and running.
2026-01-14 12:42: Creating deployments isn’t the hard part. Creating deployments that are gitops ready is.
2026-01-14 12:52: Lunch

2026-01-14 13:10
#

Back
Figured it out. Needed an init container.
2026-01-14 14:26: Nap

2026-01-14 16:55
#

Back from a walk
2026-01-14 18:35: Borked my traefik totally
2026-01-14 19:42: Got Traefik running. Will do the rest tomorrow.

Feedback on this post?
Mail me at feedback at this domain.

2026-01-13 Notes

feedback@janusworx.com (Mario Jason Braganza) — Tue, 13 Jan 2026 10:37:19 +0530

Goals + Recap
#

Get out of my slump
Do NMC work
Start Duolingo again
Redo morning routine to better fit my morning energy
Redo my IRC deployment on Janus

2026-01-13 10:40
#

Instant distraction. Trying to figure out if my writing life will get any simpler by switching to ox-hugo. (A few moments later … No it won’t. My weird workflow, still works for me.)
2026-01-13 11:05: Ok, buckled down and finished up with my day organisation
2026-01-13 11:51: Done with Duolingo
2026-01-13 13:15: Lunch

2026-01-13 14:15
#

Back
Slowly working on my IRC+ZNC combo
2026-01-13 16:06: Got distracted with a issue with my network. Back to work
Move all the old files out. Deleted my namespace. Deleted the deploy on the cluster
2026-01-13 18:25: Break

2026-01-13 20:25
#

Been thinking hard about how to achieve two way sync between a container and my home machine. Syncthing still seems to be the best bet
2026-01-13 20:56: Working on getting a folder setup for ZNC to use
2026-01-13 22:00: Got syncthing to work and got znc to look at the folder. But it does not seem to login. Will continue tomorrow

Feedback on this post?
Mail me at feedback at this domain.

2026-01-05 Notes

feedback@janusworx.com (Mario Jason Braganza) — Mon, 05 Jan 2026 08:26:33 +0530

Goals + Recap
#

Happy New Year! 🎉
Nothing much happened over Chrismas break.
I wanted to finish a couple of long pending books on IPv6 and Computer Architecture, but I couldn’t find the time.
Today I decided to add a new service to the cluster. Am going to hunt for some book tracking service and use that to for my books.
143 posts in 2025. This once I feel pretty proud. Most of them are these notes. But even that counts. I wanted a sustained writing habit, and this was the first year, I wrote all throughout.

2026-01-05 08:45
#

Coffee time!
I need to be done by 2!
2026-01-05 08:55: Got distracted, went looking for updates on Alecto, instead of looking for my book software
2026-01-05 09:00: Found Booklogr. Trying it out.
2026-01-05 09:10: Nope. Not for me.
2026-01-05 09:13: Found Jelu.
2026-01-05 09:17: Nope. Continuing Search
2026-01-05 09:23: Found Tome
2026-01-05 09:49: Nope
2026-01-05 10:02: Not booktracker
2026-01-05 10:23: Not Koha. Break

2026-01-05 10:50
#

Back. If I don’t find stuff, then I probably will use one of the above tools.
2026-01-05 11:12: Just remembered a fan of the Cal Newport podcast had built a similar page in Notion. Looking at if I can do something similar with Obsidian or Affine
2026-01-05 11:25: Too fidgety
2026-01-05 11:33: Trying booklogr again. Nope. Back to Obsidian
2026-01-05 12:45: Gave up on Obsidian. It’s not fun. I’m going to have to install Bookwyrm, aren’t I?
2026-01-05 13:14: Gave up. Will stick to the same old, same old, plain reading post this year. And keep an eye out for something that’ll help me.
2026-01-05 13:36: Created a new page for this years reading. Lunch

2026-01-05 19:15
#

Time for bed

Feedback on this post?
Mail me at feedback at this domain.

2025-12-19 Notes

feedback@janusworx.com (Mario Jason Braganza) — Fri, 19 Dec 2025 07:04:20 +0530

Goals + Recap
#

Everything came to a head yesterday. Was able to bend the last two months of learning towards quickly moving most of my remaining services across. All that’s left is Anki and a few finishing touches.
Today
- Look at The Big Plan!, to see if anything needs adding or changing.
- Add my CI/CD runner key to the new VM via Ansible
- Move Anki to the server.
- Figure out if image updations for the new apps and create them if warranted.
  - Hedgedoc
  - Huginn: do it the old fashioned way. Reminder in org mode to check for a new release every quarter and upgrade manually
  - Joplin
  - Mastodon Archive Blog
- Decommission the old VM. Au revoir, mon ami!

2025-12-19 08:10
#

Begin!
2025-12-19 08:15: All this work has proven itself. All I had to do to update Lego on the VM was update a variable and run my ansible-pull script!
2025-12-19 08:20: Break

2025-12-19 08:55
#

Back
Reading up on how to wrangle a Python container
2025-12-19 09:15: Moved Anki’s DNS to point to the new VM. That’s the last of it. All my records now point to the new VM.
2025-12-19 09:28: Break

2025-12-19 11:00
#

Back
2025-12-19 12:03: Built a small Anki image, by pip installing into the standard Python image
2025-12-19 12:41: Slimmed the image and uploaded it. Lunch break

2025-12-19 13:10
#

Back

2025-12-19 14:15
#

And we’re done!
Goodbye Janus! You were a good VM!

2025-12-19 14:30
#

Break. Back later.

2025-12-19 16:25
#

Back
2025-12-19 16:48: Got ansible to install the public key for Forgejo blog deploys to the VM.
2025-12-19 17:50: Most all apps now update themselves thanks to Flux CD.
The doing was fun! And now to slow down and think and write about all I’ve done.
Also think of some project that I could deploy on AWS, so I can show that off as part of my portfolio.
But right now, to enjoy Christmas break. I will be sporadic until the next year.

Feedback on this post?
Mail me at feedback at this domain.

2025-12-18 Notes

feedback@janusworx.com (Mario Jason Braganza) — Thu, 18 Dec 2025 08:34:56 +0530

Goals + Recap
#

Got Sendy to move. It felt like pushing Pinko’s (my big stray mutt) butt across the floor when he does not want to move. I can now craft and send emails to my little list from the cluster! My old sysadmin skills are proving darned handy here.
Am also getting better at troubleshooting stuff when it does not work …
Today
- Look at The Big Plan!, to see if anything needs adding or changing
- Move Joplin Server to the cluster
- Move Hedgedoc to the cluster

2025-12-18 08:40
#

Let’s begin.
Pointing Joplin to the new server location so that the original one stops serving requests and lets me back it up
2025-12-18 09:30: Zipped up all the data and moved it from the old server to the new one. Thank you Syncthing!
Created a namespace and dumped all the environment variables from the old .env file into a secret.
2025-12-18 09:52: Moved some data out into a configmap
2025-12-18 12:48: Lunch. Was struggling with two containers in the same pod. This approach does not seem to jibe well with the Joplin image. Will come back and split it into two pods.

2025-12-18 14:00
#

Back at it
2025-12-18 14:38: And now that there are multiple containers, everything just works. Joplin has moved over. Hedgedoc is next!
2025-12-18 18:13: Hedgedoc done.
2025-12-18 19:13: Got the mastodon archive site down to my local machine, committed to git and publishing to the new server, just like the main site.
2025-12-18 21:05: Only one service remaining. All the others have moved! 🎉
Tomorrow:
- Add Moi’s key to authorised keys on the remote machine, via Ansible
- Create a folder for moi to publish files to
- Move Anki

Feedback on this post?
Mail me at feedback at this domain.

2025-12-17 Notes

feedback@janusworx.com (Mario Jason Braganza) — Wed, 17 Dec 2025 07:48:01 +0530

Goals + Recap
#

Sendy is proving to be quite hard. Continuing work on moving it today.
Today
- Look at The Big Plan!, to see if anything needs adding or changing
- Move Sendy (my email list software) to the cluster

2025-12-17 07:50
#

Let’s dive in.
Will first start with trying to replace the current php/apache image I am using with one from Ubuntu. (A few minutes later … nope!)
2025-12-17 08:07: From Sendy’s docs, it looks like I need more php extensions than are provided. There are good folks on the net, who have already done this work! Will copy and adapt.
2025-12-17 08:08: Screw adapt. I think I will just copy. The only adaptation I think I will do is figure out how to enable Docker repos on forgejo and use them as a private repo, so I can do this in a private pipeline. Quite a bit of yak shaving this is turning out to be!

2025-12-17 09:15
#

Created a new user and transferred most of the git repos I did not use to it.
2025-12-17 09:41: Modified my git backup services and ensured they were still running.
2025-12-17 10:03: Update profile. Tea break.

2025-12-17 10:35
#

Back. Trying to figure out docker login for forgejo now
2025-12-17 10:52: Forgejo confige changed. Docker login succeeded. Now to figure out how to make and upload one there
2025-12-17 12:15: Built and pushed and used and tested a basic apache+php image to the private repo
2025-12-17 12:16: I always wondered what it would be like to build my own docker image. Well, I don’t have to wonder any longer 😂 Now to spend the rest of the day, beavering at creating one for sendy
2025-12-17 12:24: Lunch break

2025-12-17 12:50
#

Back. Getting something sorta kinda working locally.
2025-12-17 13:55: Nap

2025-12-17 14:08
#

Now trying my tiny custom apache/php image on the cluster
Figured that I need a secret of the type:docker-registry to stuff my code forge’s credentials into
2025-12-17 15:30: Got the basic install working with my custom image! Needs a bit of tweaking to automate mail sending. Manual stuff works! Tea break.

2025-12-17 16:00
#

2025-12-17 17:26: Most of my stumbles seem to be something I never could have foreseen. Am struggling with cron jobs in a container as I write this
2025-12-17 18:06: One final tweak to cronjobs and everything clicked into place and started working!
2025-12-17 18:20: Cleaning up everything.
2025-12-17 18:22: Packing up for today. Tomorrow, Joplin!

Feedback on this post?
Mail me at feedback at this domain.

2025-12-16 Notes

feedback@janusworx.com (Mario Jason Braganza) — Tue, 16 Dec 2025 09:13:12 +0530

Goals + Recap
#

Yesterday was was quite hard, but it ended in the traefik on the cluster, managing its own certificates rather than me having to provide it manually. My IRC client (theLounge IRC) moved as well.
Today
- Look at The Big Plan!, to see if anything needs adding or changing
- Move Sendy (my email list software) to the cluster

2025-12-16 09:20
#

Let’s start (at the very beginning … )
I like the fact, that despite all the upheavel, my writing process has essentially remained unaffected. I don’t think I had a single day I could not write and publish my thoughts and updates as I go through the move. I am grateful to the muses and the kindly ones for that
2025-12-16 10:22: Been doing research on sendy migrations. Tea break

2025-12-16 10:45
#

Back. Continuing research
2025-12-16 11:18: Too tough to do directly online in production. Trying stuff on the home cluster first
2025-12-16 12:28: Lunch

2025-12-16 12:55
#

Back to work
2025-12-16 13:57: Overwhelmed. Doing some other chores for a bit
2025-12-16 14:32: Back at work
2025-12-16 14:56: Gave up on the idea of locally doing this. Too cumbersome. Will try it online
2025-12-16 17:10: Figured that I’d use the hostpath approach just like I did for the Hugo blog. Being single node makes a lot of things really easy. I really need to do a bigger multi-node cluster to understand what’s on the other side though. I’d hazard that data and databases are out in some shared thing somewhere, not in the cluster
2025-12-16 17:19: Also realised that there’s a fantastic MariaDB helm chart, but I’m sticking to my manual copy/paste/adapt of a simpler docker image, since my needs are not complex.
2025-12-16 19:35: Giving up for today. Will continue tomorrow

Feedback on this post?
Mail me at feedback at this domain.

2025-12-15 Notes

feedback@janusworx.com (Mario Jason Braganza) — Mon, 15 Dec 2025 08:40:19 +0530

Goals + Recap
#

Had some time yesterday and realised, I must have gotten out of Letsencrypt jail by now. So I decided to tackle my certificate situation. Figured out how to generate a cert and renew it. And put them into my Ansible tasks
Low hanging yet extremely important to me, my contacts and calendar moved from the old VM to the new cluster on Saturday
Today
- Look at The Big Plan!, to see if anything needs adding or changing
- Figure out to get the newly minted certificates into the cluster (Settled on traefik generating certs independantly in-cluster)
- ~~ ~~Move Sendy (Email list)~~ ~~ not today
- Move IRC (theLounge), if there is time

2025-12-15 09:10
#

Update the Big Plan to make the why more explicit do near future Jason, when he decides to tear his hair out, or tries to overengineer things
2025-12-15 09:43: Break

2025-12-15 10:25
#

Back
While I was on the break, I was thinking about the certs, and whether I’m missing something. I need the certs on the node. At least for now. Ok. Now the question becomes, how do I convert it into a sealed secret and push it into the cluster itself? Do it on the VM? That’ll mean putting kubeseal on the VM. Do it at home on my main machine? What happens when I am not there and the machine is off? Do it on a third machine? How do I now integrate that bugger into my flow? Hmmm. Thinking a bit more …
2025-12-15 10:33: Should a runner on my code forge do it? I’ll need to save the sealed-secret there then? Do I have something against having a copy of my repo on the VM? That happens with Ansible Pull anyway? Oh, but that is a different repo.
2025-12-15 10:46: Taking the simplest (and most secure) route for now and doing it all locally. The only (only but BIG) con I see to this approach is if my main machine is off for a few days or I am travelling and that period coincides with a cert expiry.
Hmmmm. So should Traefik take over cert generation renewal stuff for the cluster then? I was trying to avoid multiple requests to Letsencrypt as much as possible, but then this seems to be the cleanest approach rather then.
2025-12-15 10:52: Ok. I seem to enjoy making more work for myself. Let’s knuckle down and figure this out then. How would Traefik get certs?
2025-12-15 12:05: Got my porkbun creds as a sealed secret into the cluster
2025-12-15 12:44: Been reading Traefik docs. Lunch break.

2025-12-15 14:02
#

Back

2025-12-15 15:07: Tea break. The traefik documentation is driving me nuts!
2025-12-15 15:30: Back at it
2025-12-15 17:05: Alright! Done! Took a lot of search, looking at examples, asking ChatGPT and fixing typos. But it got done. I had the sense this time, to try it all out with Letsencrypt staging first! :)

2025-12-15 17:30
#

cleaned stuff up as much as I could. Love Flux CD and containers now!
2025-12-15 17:36: Starting with theLounge now. Hopefully this should not be hard (fingers crossed!). This is just setting up a new instance, with no data coming over.
2025-12-15 17:45: Am getting pretty good at translating docker-compose files into kubernetes manifests 😂
2025-12-15 18:23: Well not that good. Still miss plenty of stuff.
2025-12-15 19:12: Done. I forgot to make a note of what channels I was in, before I retired the old ZNC/TheLounge setup. But never mind. The important ones I have rejoined.
Tomorrow: Move Sendy (Also only pick up one task a day now onwards.)

Feedback on this post?
Mail me at feedback at this domain.

2025-12-13 Notes

feedback@janusworx.com (Mario Jason Braganza) — Sat, 13 Dec 2025 08:00:18 +0530

Goals + Recap
#

Look at The Big Plan (Done! 🎉🎉🎉), to see if anything needs adding or changing
Made steady progress yesterday. Got both my websites moved over
Sent my last newsletter of the year. Decided to do that, in case Sendy crashed and burned during the move and I couldn’t send stuff
Today
- Change fan on the Pi 5
- Move kanboard to the cluster
- Update image repositories for both websites + kanboard + miniflux, so they update automatically
- Client call
- Move baikal to the cluster (if possible)

2025-12-13 07:30
#

The 3rd party fan/heatsink on the Pi5 finally gave up the ghost. Thankfully, I saw it coming and ordered an officially Raspberry Pi fan now. I’d kept the original case as well. So off came the old and in went the new fan. My music server is back online!
2025-12-13 08:00: Updated my Papermod theme. Everything went off without a hitch.
2025-12-13 08:14: Got today’s note up and running. Now to tackle kanboard, before the client call at 11.

2025-12-13 08:20
#

Beginning work on Kanboard
2025-12-13 08:41: Got sidetracked by two hungry stray doggies. Back to work
Pointed the domain at kanboard.
2025-12-13 09:02: Moved Kanboard. Moved the data. All good!

2025-12-13 09:05
#

Will move Baikal first before doing creating image updations for all the stuff I’ve moved
Pointed the URL to the new server, and disabled the site in nginx, so that nothing touches the old stuff now. Hopefully DNS will timeout and point to the new server shortly

2025-12-13 10:45
#

Done with Baikal. Moved data from the old machine and into the new cluster. All is well!
Everything’s changed behind the scenes and my phone and computer just chug along like nothing’s happened. Gives me quite a thrill!
Now to go do my client call
*2025-12-13 13:40: Done with the meeting. Off to my lunch break.

2025-12-13 17:30
#

Back at work. Had another meeting and then a tea break
Now I understand why PVC. The backing storage could change tomorrow, but as long as I can mount it with a name at a path, nothing changes for my app. The other way around too. The app could keep changing, but as long as the data is kept away from it and accessed in the right manner, (is it a db that allows multiple access? or a file that only a single thread can touch at one time?), it’s all cool
2025-12-13 17:55: Not touching image stuff for Baikal. Need to figure out how to filter out a custom thing from a tag.
Got Kanboard to update! Now to Nginx for both the websites
2025-12-13 18:27: Both sites automatically updated to the latest version of Nginx!
2025-12-13 19:20: Got baikal up and updating too! It needed a tiny bit of regex to filter the tag.
2025-12-13 19:40: Think I’ve done all the low hanging fruit. Now to tackle the rest, one by one Monday onwards Some will mean moving things to my desktop (the Mastodon mirror script) and some will probably mean creating my own docker images (anki) and finally some I’ll just have to be really careful migrating data over (sendy)

Feedback on this post?
Mail me at feedback at this domain.

2025-12-12 Notes

feedback@janusworx.com (Mario Jason Braganza) — Fri, 12 Dec 2025 08:15:59 +0530

Goals + Recap
#

Read a book on Traefik, yesterday. Pretty helpful. It covered the older version of Traefik though, so I’ll have to adapt the advice to my new version. I tried reading the actual documentation next, but they are umm, I cannot put my finger on it, but I keep getting lost. What is written, is pretty well written, but I think there is a lack of a connecting link from the big picture to the nitty gritty, or if there is, is just glossed over. If it wasn’t for the book, I’d be pretty lost. But as a reference though, it is really good.
The cluster is still up and running well. Miniflux works. Been using it all day yesterday and today. Pretty please with the decision to move to a cluster, now that it is set up.
Look at The Big Plan (Done! 🎉🎉🎉), to see if anything needs adding or changing
Today, figure out http to https redirects. And move the main site https://janusworx.com to the cluster

2025-12-12 09:15
#

Let’s get to work!
2025-12-12 09:30: Changed all my Hugo archetypes to no longer include links to my discourse. Will need to maket the time someday to remove existing links from all the pages.
2025-12-12 10:04: Got my http to https redirect working! Also fixed my tls sealed-secret for traefix. Nothing big, but in my haste, yesterday, I forgot to export it in yaml. And today, I wondered why my manifest was formatted so queerly, until I realisde I was looking at json. Surprisingly, Traefik had taken that json-in-yaml manifest and worked without complaint! Tea break.

2025-12-12 10:30
#

Thoughts to move https://janusworx.com to the new cluster.
- Doing this first, because this is the most public facing part of my VM. If there are any issues here, better get them out as soon as possible.
- Have a folder that I can rsync all my new posts to (like it is on the old one)
- Have an nginx container look at it via some hostpath pvc?
- Serve!
Now to go stumble about doing it and fixing any hiccoughs along the way
Disabled miniflux on the old VM as well
2025-12-12 10:45: Ok think I will first fix my deploy action to sync to the new VM
2025-12-12 11:27: Use ansible to create a folder for my hugo deploy
Switched variables in my forgejo action to the new VM, gave it my new key, as well as updated known hosts (No other change)
Manually running the action now. Did not realise how big my site has grown in size over the years
2025-12-12 11:33: Ok my action timed out. Think I will manually move stuff first with a syncthing sync. (Thank god i set it up yesterday!)
2025-12-12 11:40: Running action again. It works! It works!
Now I know why gitops! Change a few variables, drink some soup et voilà, your new site deploy is done! Wow! Love this!
2025-12-12 11:45: Also realised my original manual action run had not timed out. It was, in fact, interrupted by a subsequent automated run, which had succeeded!
Now that the data is in place, I’m off to get nginx working in the cluster.
2025-12-12 12:45: Just realised, I might have to have two containers. One for https://fr.janusworx.com as well. Seems wasteful. Checking to see, if one pod / nginx instance can do both.
2025-12-12 12:57: Realised, I am then asking Nginx to do another level of routing. Hmm, no thank you. I’ll keep things simple, be a little wasteful and run two nginx containers.
Lunch break

2025-12-12 13:30
#

Back for a while
2025-12-12 14:28: Yay! Done! https://janusworx.com is now served from the cluster! Done with work for the day :)

2025-12-12 14:45
#

Some NMC work now
2025-12-12 15:00: Tea. Be back later.

2025-12-12 16:20
#

Done with French. Off for a walk.

2025-12-12 17:30
#

2025-12-12 18:00: Send out a mail to the newsletter list. I might not be able to later, with this migration.
2025-12-12 19:20: Moved the french version of the site over as well. One less thing to do tomorrow.

Tomorrow
#

Enable image updation of the nginx image for both jw and fr.jw
Figure out how to go about moving the mastodon archive and keeping it updated

Feedback on this post?
Mail me at feedback at this domain.

2025-12-11 Notes

feedback@janusworx.com (Mario Jason Braganza) — Thu, 11 Dec 2025 08:18:29 +0530

Goals + Recap
#

I think, I think, that most of the fundamental pieces are in places after yesterday’s work.
The Big Plan is done!
Now to move each production item from the old VM to the new cluster.
Today, figure out http to https redirects. And move one app.
Note to Self: Quit at 1p. Get back to life.

The Big Plan (Done! 🎉🎉🎉)
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- ~~Certmanager~~ (Not using it)
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate deployment of manual manifests
- Figure out how to migrate there if there is any in an old app
- Figue out how to automate updation of images in manual manifests
- Get another app (Miniflux) deployed
- Figure out what needs to happen as part of the lifecycle. What you want in the cluster, what stays out, do they intersect, how do updates of cluster happen? VM (node) updates as well?
- Then begin to think along the lines of Live Deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)
Go live! Git is source of truth. Two repos.
- One for the Main node and its update
  - Terraform will provision node and install package, setup firewall
  - Figure out how to get Terraform to get the node talking to the git forge
  - Structure repo, copy every thing node related there, and make sure stuff gets updated periodically and idempotantly, via ansible pull and a systemd timer
- The other one for k3s and flux
  - Convert everything I have done locally to run on prod. Add more steps as you do them below

2025-12-11 09:30
#

The night passed well for the new VM. It rebooted on time, just as scheduled. Hetzner backed it up, just as instructed.
2025-12-11 09:37: Also, Oi, wot? Traefik natively supports what I have been trying to do with Lego! Get Lego to generate certs and install them as a sealed secret into the cluster for Traefik to use. Will try to figure out what to do once my Letsencrypt jail time gets over. Maybe do both. Traefik can handle stuff for the cluster and Lego can get them as well and keep them in another place in the VM in case I need it outside the cluster.
2025-12-11 09:55: Don’t think I want to work on the VM today. Will sit and read a book about Traefik. Tea Break

2025-12-11 10:15
#

Back. Begin reading!
2025-12-11 12:42: Lunch. Finished half of the book. Will do the rest after lunch.

2025-12-11 13:05
#

Back to the book.
2025-12-11 13:30: Done with the book. Nap time!

2025-12-11 17:15
#

Did my Duolingo and had a long walk after quite a few weeks
2025-12-11 17:16: Reading Traefik docs
2025-12-11 17:54: Client call

2025-12-11 18:35
#

Back.
2025-12-11 19:12: Shutting down for the day!

Feedback on this post?
Mail me at feedback at this domain.

2025-12-10 Notes

feedback@janusworx.com (Mario Jason Braganza) — Wed, 10 Dec 2025 08:26:26 +0530

Goals + Recap
#

Got Ansible Pull working, so now I can update a playbook and the VM fetches it and does what I tell to! Who’s a good VM?
Struggled with getting LEGO to generate a first time cert. And then like a ignorant fool, I made too many requests of Letsencrypt and got locked out. Shoulda done dry runs! I forgot! Will simply copy over my certs from ye olde plaice and then figure out a way to do the renew script. Even for later, methinks I will leave initial certificate generation to be a manual thing. For the big AWS project, I will figure something else out.
Will focus on getting Lego and certs working and getting an app or two at most deployed on the new production cluster.
Note to Self: Quit at 3p. Get back to life.

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- ~~Certmanager~~ (Not using it)
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate deployment of manual manifests
- Figure out how to migrate there if there is any in an old app
- Figue out how to automate updation of images in manual manifests
- Get another app (Miniflux) deployed
- Figure out what needs to happen as part of the lifecycle. What you want in the cluster, what stays out, do they intersect, how do updates of cluster happen? VM (node) updates as well?
- Then begin to think along the lines of Live Deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)
Go live! Git is source of truth. Two repos.
- One for the Main node and its update
  - Terraform will provision node and install package, setup firewall
  - Figure out how to get Terraform to get the node talking to the git forge
  - Structure repo, copy every thing node related there, and make sure stuff gets updated periodically and idempotantly, via ansible pull and a systemd timer
- The other one for k3s and flux
  - Convert everything I have done locally to run on prod. Add more steps as you do them below

2025-12-10 09:50
#

Paused a systemd service via Ansible-Pull. Feels very cool!
2025-12-10 10:21: I keep getting distracted with the bigger picture and what ifs rather than focussing on what is right in front of me.
2025-12-10 13:00: Lots of ansible work. Good progress. Lunch break. I used to think that Ansible roles were too granular and now I seem to be doing the same with my tasks 😂

2025-12-10 14:15
#

Will just copy the certs for now
2025-12-10 17:23: Got the plays structured nad worknig just the way i want
Got syncthing installed, service installed, and working through the firewall.
2025-12-10 18:14: Copied files and got sealed secrets up and runnig within seconds!
2025-12-10 18:35: Got Kubeseal installed via ansible, without a single hitch!
2025-12-10 19:24: Manually put in the secret to the cluster. Will look at automation after a few days when Letsencrypt decides to talk to me.
2025-12-10 19:25: And just like that Traefik is up!
2025-12-10 20:06: Couldn’t get Miniflux working. Will work on it tomorrow. Calling it a night.
2025-12-10 20:30: Couldn’t quite leave it alone. I think I forgot to encrypt the cert with the new cluster’s sealed certificate. Will give that a try. If it works good. If not, we try again tomorrow! :)
2025-12-10 21:00: It was the damned cert! Ok, now I know I was not going batty :)
Figure out http to https tomorrow. Haproxy was doing it here. Need to figure out how to do it with Traefix directly. Time for bed.

Feedback on this post?
Mail me at feedback at this domain.

2025-12-09 Notes

feedback@janusworx.com (Mario Jason Braganza) — Tue, 09 Dec 2025 09:05:32 +0530

Goals + Recap
#

Got Terraform working and the node is now up, exactly the way I want it!
The cluster also got installed perfectly and I was able to connect to it.
Today will work on Ansible, so that local updates are easy.

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- ~~Certmanager~~ (Not using it)
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate deployment of manual manifests
- Figure out how to migrate there if there is any in an old app
- Figue out how to automate updation of images in manual manifests
- Get another app (Miniflux) deployed
- Figure out what needs to happen as part of the lifecycle. What you want in the cluster, what stays out, do they intersect, how do updates of cluster happen? VM (node) updates as well?
- Then begin to think along the lines of Live Deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)
Go live! Git is source of truth. Two repos.
- One for the Main node and its update
  - Terraform will provision node and install package, setup firewall
  - Figure out how to get Terraform to get the node talking to the git forge
  - Structure repo, copy every thing node related there, and make sure stuff gets updated periodically and idempotantly, via ansible pull and a systemd timer
- The other one for k3s and flux
  - Convert everything I have done locally to run on prod. Add more steps as you do them below

2025-12-09 09:00
#

2025-12-09 10:13: The net is down, so am trying to work via codeberg. Makes me thankful, that I worked out of a private repo and didn’t commit private stuff to it
2025-12-09 10:13: Tea break

2025-12-09 10:52
#

Back
2025-12-09 11:21: Now learing the push/pull dance with ansible-pull. Making changes here. Pushing to the forge and then pulling in on the VM is a novel experience. As compared to editing conf files on the VM itself
2025-12-09 13:12: Lunch. making steady progress though

2025-12-09 13:39
#

Back. Got ansible pull working as well.
Now, to take all the changes I’ve done, commit them to git and rebuild the cluster, hopefully, one last time
2025-12-09 15:00: It worked! It all worked! Tea break.

2025-12-09 17:20
#

Bootstrapped flux on the VM cluster

2025-12-09 21:01
#

Bootstrapping a Letencrypt cert with lego is causing no end of problems.
Tomrrow will just import. and then use the current certs
And adapt the ansible playbook to just do an install

Feedback on this post?
Mail me at feedback at this domain.

2025-12-08 Notes

feedback@janusworx.com (Mario Jason Braganza) — Mon, 08 Dec 2025 09:25:33 +0530

Goals + Recap
#

Thank you PS, for being my sounding board.
Created repos and moved around directories and fixed scripts so that most of my infrastructure stuff is properly organised. Created the repos I needed for the new VM and the single node cluster that will run on it.

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- ~~Certmanager~~ (Not using it)
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate deployment of manual manifests
- Figure out how to migrate there if there is any in an old app
- Figue out how to automate updation of images in manual manifests
- Get another app (Miniflux) deployed
- Figure out what needs to happen as part of the lifecycle. What you want in the cluster, what stays out, do they intersect, how do updates of cluster happen? VM (node) updates as well?
- Then begin to think along the lines of Live Deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)
Go live! Git is source of truth. Two repos.
- One for the Main node and its update
  - Terraform will provision node and install package, setup firewall
  - Figure out how to get Terraform to get the node talking to the git forge
  - Structure repo, copy every thing node related there, and make sure stuff gets updated periodically and idempotantly, via ansible pull and a systemd timer
- The other one for k3s and flux
  - Convert everything I have done locally to run on prod. Add more steps as you do them below

2025-12-08 09:00
#

Client call

2025-12-08 10:30
#

Beginning work
Installed the 1Password CLI tool and figured out how to read stuff into an environment variable. Will see how to integrate this with scripts over time. I am getting tired of copy pasting stuff. Plus a few critical secrets are on text files on the disk. The disk is encrypted, so I’m not that worried; but still.
2025-12-08 11:10: Found https://yaml-multiline.info/. Pretty handy!
2025-12-08 12:16: Lunch Break. Got into a flow state after a long time

2025-12-08 13:30
#

Back
Currently working on setting up and getting ansible-pull installed and working.
Ansible lint wasn’t working. Got it to work. Ansible and Ansible Lint
2025-12-08 16:15: Tea Break

2025-12-08 17:15
#

Back.
Thought I had it all setup, and the VM gets deployed, but I cannot seem to login
Simplifying my cloud-init and doing things one by one
TIL, even if I botch my cloud-init config, keys are inserted into the root login, so I can do a root login and diagnose. This helps!
Stuff was getting stuck, because point 1. an operation had to be deferred to the end. Checking the second thing now
Figured it out. It was some multiline data, that is sticking in cloud-init’s craw. Now to base64 encode it and pass it.
Done! At least the Terraform bit :) The cluster’s up.
Most of the plumbing for Ansible updates is done as well. I can talk to my Git forge from the VM. Next step is to get VM updates working tomorrow.

Feedback on this post?
Mail me at feedback at this domain.

2025-12-06 Notes

feedback@janusworx.com (Mario Jason Braganza) — Sat, 06 Dec 2025 08:08:02 +0530

Goals + Recap
#

Tried a long day yesterday, to finish Miniflux out of spite.
Body gave up and I went to be 9.30ish.
Did figure and learn a lot as I re-did things yesterday.
More confident operating the cluster
Today, will try to finish Miniflux.

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- ~~Certmanager~~ (Not using it)
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate deployment of manual manifests
- Figure out how to migrate there if there is any in an old app
- Figue out how to automate updation of images in manual manifests
- Get another app (Miniflux) deployed
- Figure out what needs to happen as part of the lifecycle. What you want in the cluster, what stays out, do they intersect, how do updates of cluster happen? VM (node) updates as well?
- Then begin to think along the lines of Live Deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)
Go live! Git is source of truth. Two repos.
- One for the Main node and its update
  - Terraform will provision node and install package, setup firewall
  - Figure out how to get Terraform to get the node talking to the git forge
  - Structure repo, copy every thing node related there, and make sure stuff gets updated periodically and idempotantly, via ansible pull and a systemd timer
- The other one for k3s and flux
  - Convert everything I have done locally to run on prod. Add more steps as you do them below

2025-12-06 08:10
#

Beginning today. Setting everything up.
2025-12-06 08:20: Coffee!
2025-12-06 09:00: Fed the strays. Now to work.
2025-12-06 10:04: Got miniflux running manually! First multi container pod! and first readiness check! Yay! Break.

2025-12-06 10:35
#

2025-12-06 11:04: Got Miniflux working via flux. Now to use it a bit to test if storage works
2025-12-06 11:35: Yes. Got state and storage working as well!
Now to don thinking cap again and figure out what needs to happen live.
2025-12-06 11:45: Decided to reboot the machine to see what happens. All state is safe :)
Back to thinking
- A cloud init is a one time thing. Cannot use terraform to keep messing with the machine. So all I will use it for is to bring up the cluster? And a few select tools.
- Ansible needs to handle the rest. So now figure out a playbook to manage the new server.
- Spoke to PS to make sure, I wasn’t being a boob.
2025-12-06 12:23: Oof! forgot that Miniflux needs automatic image updation. Alright. Hard hat on. Work in progress
2025-12-06 12:57: Miniflux updated itself to the latest version! Lunch break

2025-12-06 19:00
#

Back. Had a client meeting.
2025-12-06 19:35: Done for the day. Did a lot of thinking about how I want to provision and update my Hetzner node. Will try and put it into practice on Monday. Stuff is up in the plan above
2025-12-06 20:20: Shutdown!

Feedback on this post?
Mail me at feedback at this domain.

2025-12-05 Notes

feedback@janusworx.com (Mario Jason Braganza) — Fri, 05 Dec 2025 08:12:48 +0530

Goals + Recap
#

Yesterday was filled with client meetings
And K3s was one unmitigated disaster after another. The cluster died by the end of the day.
I got lucky with my late night slog, and got back up not just the cluster, but even Traefik, Sealed Secrets and my Kanboard app!
Now I realise the power of declarative files. I did not have to screw around with the command line much last night, with a couple of exceptions. I got things out of my backups¹ and then copied and pasted them around and adapted and simplified them and everything came back up like magic!
And on the bright side of this morbid situation, I do know more about the innards of cluster administration than I did before.
Today will be an attempt and getting old data from an existing install into an app.
And if that works, spend the rest of the day, spinning up and setting up the production cluster on Hetzner, so that I can then test here and then deploy there. Right now I am keeping the two (home and production) separate and apart in different repos, even though Flux does let me have the option of having multiple environments. I am just being my usual paranoid self.
Note to Self: Remember! There is no tearing down this VM once it comes up. Time for play is over!
Also Note to Self: Monday onwards, strict cutoff at 2p. Work meetings, try to schedule as much as possible, in the evening block between 4p-8p

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- Certmanager
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate deployment of manual manifests
- Figure out how to migrate there if there is any in an old app
- Figue out how to automate updation of images in manual manifests
- Once another app is done, then start live deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)

2025-12-05 00:45
#

Got the cluster back up in its entirety, pretty much the way I want it.
With Kanboard working! Woohooooo! 🎉
Time for bed.

2025-12-05 08:15
#

Starting up slowly … still sleepy
2025-12-05 08:40: Everything is booted up and ready. Time for work!
2025-12-05 08:56: Slightly sluggish. Note to self: Do things slowly and carefully!
2025-12-05 09:14: The all Terraform + Flux driven cluster dream of mine probably needs a little compromise. I will have to get Ansible or some automation tool into the mix, because I will have to use at least a couple of things natively on my VM. Syncthing is one thing that comes to mind. Runing something like that on/via a cluster is really overkill to me. It also seems a bit antithetical in terms of values. Syncthing concerns itself entirely with state and data, while Kubernetes veers in the other direction. OS updates are another thing. I don’t want to keep deploying new os images and moving data around. I am not made of money, to run that kind of setup. Will need to figure such a use case to build up the big portfolio project on AWS though.
2025-12-05 09:30: While the dream is always, oh everything is driven by code, there comes a time when stuff cannot be automated completely. So for most deployments folks do VMs and apps on the cloud, where the computer has been abstracted away. In my case, it hasn’t so I can’t treat my single VM as a fungible, disposable thing. Similarly even in the “cloud”, I’m sure there are worker bees, buzzing around machines in datacenters, babysitting them.
2025-12-05 09:35: Break

2025-12-05 10:30
#

Back
2025-12-05 10:54: Moved old data into Kanboard. It just works!
Learned to pause flux while I work on something:
flux suspend kustomization <name> and
flux resume kustomization <name>
Same with helmrelease
2025-12-05 11:04: Trying to install extra controllers into flux
2025-12-05 11:13: image-reflector-controller and image-automation-controller installed
2025-12-05 12:18: Break. Tried everything, but the image won’t update. Need to clear my head
2025-12-05 12:19: Lunch

2025-12-05 12:40
#

Back
2025-12-05 13:22: Got it to work. I had pointed the automation manifest to the wrong folder
2025-12-05 13:22: Break

2025-12-05 13:50
#

Back. Thought up a rule of thumb. Anything exposed out to the web, ought to run in the cluster. Anything local, or exposed only to me, can stay on the node (would prefer it on the cluster, but if not, that’s fine too)
2025-12-05 14:10: And now I have figured out how to convert a docker compose into auto updating Kubernetes manifests, that relieves me of the need to desperately hunt down Helm packages.
2025-12-05 14:21: Starting with Miniflux locally. If all goes well, then off to the production races we go
2025-12-05 14:31: Just realised, Miniflux runs on Postgres. So production work will have to wait. This is going to take a while
2025-12-05 16:07: Struggling to figure out why my letsencrypt certs aren’t updating within the cluster.
2025-12-05 17:00: Fixed it. Cron has limited access to an environment and the KUBECONFIG variable is not set and so no secret or sealed secret was being generated. All I had were empty yaml files. Told the bash script to set KUBECONFIG=/dev/null since I was only generating manifests, not talking to a cluster. And everything started working.

2025-12-05 17:15
#

Back to figuring out Miniflux
2025-12-05 19:30: Dinner

2025-12-05 20:30
#

Back to try and finish this
2025-12-05 21:46: Still struggling. So just packing up and going to bed

Feedback on this post?
Mail me at feedback at this domain.

Paranoid backups save your ass. Who knew? I did! I have been bitten more times than I can count. Ergo, the habit! ↩︎

2025-12-04 Notes

feedback@janusworx.com (Mario Jason Braganza) — Thu, 04 Dec 2025 07:16:00 +0530

Goals + Recap
#

Figured out every thing I needed that I needed to spin up the cluster the way I wanted it. (Update 2025-12-04: Figured out everything I need to deploy and expose an app, as well)
Figured things out at a brisk clip yesterday (not fast, not slow either). Got Kanboard up and running!
Will try and redo Kanboard (once again); this time with an gitopsy Flux CD approach
And leave it at that, since the rest of the day is filled with meeetings

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- Certmanager
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate manual manifests
- Once another app is done, then start live deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)

2025-12-04 08:05
#

Updated my reading list for November
Did my NMC run. It’s always fun getting new members into the Kubernetes community
Now to focussed work
2025-12-04 08:25: I love Kubernetes namespaces! Lets me delete everything in a jiffy!
2025-12-04 08:50: Client call

2025-12-04 09:30
#

Back
2025-12-04 09:50: Client call

2025-12-04 10:10
#

Back
2025-12-04 11:18: Learning to handwrite kubernetes manifests with the help of IDE completion
2025-12-04 11:55: Troubleshot my first yaml mistyped key. I should not depend on the IDE so much. I know I have to use ReadWriteOnce and yet, somehow I have ReadWriteMany!
But the speed at which I can tear down and recreate stuff and iterate is amazing!
2025-12-04 12:30: Bumped version in a yaml, Flux made the deployment follow suit! Woohoo!
2025-12-04 12:43: Both my automation controllers are borked. Need to figure out what to do.
2025-12-04 12:58: Lunch

2025-12-04 13:20
#

Killing cluster. Rebuilding bit by bit. paying attention.
Besides one more good thing to try is to move even my cluster state to the big hdd
2025-12-04 13:42: Got cluster up! Verified data is now stored on the big hdd
2025-12-04 14:23: Installed flux without the additional image controllers. So far so good
2025-12-04 14:33: Troubleshooting errors comes more easily now
2025-12-04 14:41: Sealed secrets installed. It also took my letsencrypt cert that I create with the new key
2025-12-04 14:42: Client call

2025-12-04 16:50
#

Trying to get back into the swing of things
2025-12-04 16:52: Realised the new cluster is a clean sweep too.
2025-12-04 16:58: Traefik and kanboard deployed in minutes! Gitops is amazing!
2025-12-04 17:00: Client call

2025-12-04 20:33
#

Somehow managed to screw up Traefik. Redoing
Fat fingered and deleted both my flux repo and my files. That should teach me not to do things at night after a stressful day
Well, one advantage is this will let me do things even more simpler! Now that I’ve gotten a grasp on things.
Worst case, I had made a paranoid backup in the morning. I can refer to that and redo things
2025-12-04 21:38: Simplified the config maps I use for Helm Releases
2025-12-04 22:31: Cert ready for Traefik
2025-12-04 23:12: Nothing seems to work Traefik wise. Calling it a night. Will start afresh with a new cluster tomorrow.

Feedback on this post?
Mail me at feedback at this domain.

2025-12-03 Notes

feedback@janusworx.com (Mario Jason Braganza) — Wed, 03 Dec 2025 09:16:22 +0530

Goals + Recap
#

Figured out every thing I needed that I needed to spin up the cluster the way I wanted it.
Apps are a different thing apparently. This now, is my next windmill to tilt at. I assumed most apps I use would have neatly created Helm packages available. There aren’t. So will learn how to convert from docker-compose to kubernetes manifests and deploy accordingly

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- Certmanager
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Once another app is done, then start live deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)

2025-12-03 09:30
#

Writing the recap daily helps me focus!
2025-12-03 11:54: Ok, went down a rabbit hole. I think I need to figure out how to write my own yaml
2025-12-03 12:10: Realised most code editors generate scratch manifests from templates to fill in. This should hopefully make things easier. IntelliJ Idea for e.g.¹, lets me just type in kdeployment and it creates one with the most frequent values
2025-12-03 12:44: Lunch. Think I watched enough videos to get a grasp on what I need to write. Will begin with Kanboard when I come back

2025-12-03 14:00
#

Ok, back to work
2025-12-03 18:00: Been so busy, I forgot to update here
It’s been a steady iterative process. Have gotten the namespace, a configmap, a pv/pvc combo and a deployment all working for a test kanboard install
Figured out how to move the location of where my containers will store data by modifying the local path provisioner’s settings. They now save to my big hard disk
Trying to figure out how to expose the app to the outside world! (reading up tells me I need a clusterip service and a Traefik Ingress Route)
2025-12-03 19:06: It works! I think I have most of my bases covered!
2025-12-03 19:12: Stopping for the day. Time for dinner and bed. Note to Self: Can slow down to a normal routine tomorrow onwards

Feedback on this post?
Mail me at feedback at this domain.

after installing the Kubernetes plugin ↩︎

2025-12-02 Notes

feedback@janusworx.com (Mario Jason Braganza) — Tue, 02 Dec 2025 07:49:58 +0530

Goals + Recap
#

I crashed Traefik at the end of the day yesterday. At least that shows me what’ll happen when stuff crashes in my cluster and how good a job I’ve done with setting things up. This is the first order of the day today.
Stand Traefik back up and figure out how to get it to accept my wildcard cert
Yesterday I learned that an “ingress” and an “ingressRule” were two different beasts. Ingress is a Kubernetes native thing and IngressRule is a Traefik definition. I could use either, but better to do IngressRules for now. Go all in on Traefik.
Pat on the back for setting up my Haproxy well enough, that network routing from the outside to the cluster worked without a hitch! (2025-12-02 11:09: Spoke too soon. Local sites on the network are borked 😂)

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- Certmanager
- ~~Letsencrypt~~ (using pre existing certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?)
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy (Traefik does this natively)
- Figure out other apps later

2025-12-02 08:30
#

Fixed the bloody traefik cert issue. Classic case of fat fingers and I didn’t know any better. At least this will teach me to always check my yaml indentation.
I did:

1
2
3
4


tlsStore:
 default:
 defaultCertificate:
 secretName: letsencrypt-cert

instead of the actual (Line 4’s indentation is fixed):

1
2
3
4


tlsStore: 
 default:
 defaultCertificate:
 secretName: letsencrypt-cert

2025-12-02 09:44: Figured out a way to get my remote certs into my machine.
Dumped the commands into a bash script. Here’s the command for the cert. I have to to the same with the key.

ssh user@certificate-host 'sudo cat /path/to/certificates/wildcard.crt' > \
/local/directory/certificates/wildcard.crt

Since the key and the cert are protected file and I don’t want to mess with remote file permissions, I just cat each file with sudo access and then dump the contents into a local file.

2025-12-02 09:49: Tea break

2025-12-02 10:20
#

Back, now to scribble another script to update the wildcard sealed secret
2025-12-02 11:15: I wrote about borking my Haproxy. No it wasn’t. It was just a caching issue. All is fine! Claps all around 👏
2025-12-02 11:17: Think I got the cert thing working. Now to put them into cron
2025-12-02 11:18: Trying to force flux to update the secret to see if it works
2025-12-02 12:06: Does not seem to make a difference. Will see when the cert changes itself.
2025-12-02 12:07: Client Meeting
2025-12-02 13:57: Lunch

2025-12-02 14:25
#

2025-12-02 14:46: Ok scripts in place. One script gets certs into the local node. The other creates a sealed secret and commits it to git
2025-12-02 16:20: Client meeting

2025-12-02 18:48
#

Trying to get some work done now!
2025-12-02 19:25: Kanboard does not seem to be Kubernetes ready. Will need one of my apps that is compatible with what I have done so far, so I can see if it all works. Maybe Miniflux or Hedgedoc if they have ready made helm charts. Converting one of the other apps to a kubernetes deployment is something to tackle later
2025-12-02 20:10: Ok nothing is available. I’ll just have to go do it myself. Will write straight deployments and use flux to reconcile them. That seems to be the most straightforward approach. I need automatic upgrades and that Flux can do with its annotations and ImageRepository/ImageUpdateAutomation stuff. Time for bed.

Feedback on this post?
Mail me at feedback at this domain.

2025-12-01 Notes

feedback@janusworx.com (Mario Jason Braganza) — Mon, 01 Dec 2025 09:51:41 +0530

Goals + Recap
#

Last we heard, our intrepid explorer was at an impasse on how to do wild card certificates for his apps. There is no golden path to follow ala Funky Penguin, because there is no direct cert-manager for DNS challenges via Porkbun. The alternatives then are to get a bit more complex and bring Vault into the mix or …
Simplify and do some shell script / cron job / kubeseal / kubectl hackery and get the certificates Lego generates already into my cluster and use them as the default Traefik certificate. Think this is what I’ll do.
What about internal tls traffic between apps using cert manager? I have none currently, so that can wait until I come to that bridge

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- Certmanager
- ~~Letsencrypt~~ (using pre existing certs)
- Get Traefik Ingress to work
And once that is done, do kanboard again
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-12-01 09:55
#

Starting slow, today
2025-12-01 10:30: Figuring out Traefik basics
2025-12-01 10:35: Tea Break
2025-12-01 10:55: Back
2025-12-01 11:28: Ok manually got the certs over from the other machine, created a tls secret with kubectl, converted it into a sealed-secret with kubeseal and pushed it to the git repo. Et voilà! I have it as a secret in my cluster barely a minute later! Thank you flux!
Trying to figure out how to replicate my secrets clusterwide now
2025-12-01 11:54: Decided not to do it. If I run into such a need, I shall later
2025-12-01 12:15: Getting into the swing of creating a primitive, committing to git and then watching flux create it live and then fix my mistakes and then iterate. This is fun!
2025-12-01 12:30: Also getting confident enough to write stuff and push knowing Flux will handle the rest.
Need to remember to later change these frequent intervals to something reasonable. If I need something right now, I can always manually trigger stuff
2025-12-01 13:05: Off to lunch

2025-12-01 13:25
#

Back. Continuing with Traefik. There seems to be some hiccough with the default values I provided
2025-12-01 14:00: Botched my podinfo deploy. Flux is not fixing it. Troubleshooting in progress
2025-12-01 14:10: Got podinfo working there is something wrong with my values. Commenting them all out did the trick. Trying it one more time.
2025-12-01 14:15: Attemping a manual deletion of podinfo. Hoping to get it back via flux
2025-12-01 14:22: Got it working. Figured out the offending bits in the values.yaml
2025-12-01 14:24: Alos getting fluent*-er* with the limited subset of flux / kubectl commands I am learning
2025-12-01 14:38: Accessed podinfo from outside! Basically means the network works! Not available over ssl. Need to check why. That can wait until tomorrow. Done with K3s for the day

2025-12-01 15:15
#

Doing some NMC work
2025-12-01 15:30: Done for the day. Will do tea, walk, some french and then bed
Tomorrow, redo Traefik and figure out why it is not taking my wildcard cert

Feedback on this post?
Mail me at feedback at this domain.

2025-11-30 Notes

feedback@janusworx.com (Mario Jason Braganza) — Sun, 30 Nov 2025 11:02:34 +0530

Goals + Recap
#

Trying to do a tiny bit today
Got secrets to work yesterday. Now to get certs working
The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- Certmanager
- ~~Letsencrypt~~ (using pre existing certs)
- Get Traefik Ingress to work
And once that is done, do kanboard again
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-11-30 11:15
#

Funky Penguin has an External DNS guide, but I’d rather point to the services manually. They don’t change that often.
I already have a wild card certificate going with Lego. Web+LLM searches tell me I can have two different sources request wild card certs. Let’s see how this goes
I, sort of like the idea, that the Funky Penguin guide is a little out of date. So while I get at the principles and the big ideas, the execution of everything is now up to me
And now that I know what I am doing, it’s easier to go search for and adapt things. Cert Manager, for example has a page that does exactly what I want with Flux. I would not have know earlier though
2025-11-30 13:40: Did my first app deploy with zero errors! Hopefully more practice will lend me speed

2025-11-30 14:30
#

Back after a short break
Now to move on to configuring Letsencrypt as a certificate issuer with Cert Manager
2025-11-30 16:00: Hiccough! Porkbun isn’t natively supported as a DNS challenge solver. Need to figure out what to do next. Get Porkbun challenges working somehow? Or change my domain’s DNS to a cert-manager supported DNS provider? Or can it use my existing lego generated certs? Pondering hat on …
2025-11-30 18:00: Break

2025-11-30 18:50
#

Back
Think I won’t touch cert-manager for now. Will probably use it for inter app communication if needed later
Will just use the existing lego wildcard certs, use sealed secrets to post them to git, and then have flux pull it in as a tls secret for use by traefik. Ok this is the big idea. Now to put it into practice
2025-11-30 20:15: Was still reading up. Rubber hits the road tomorrow morn

Feedback on this post?
Mail me at feedback at this domain.

2025-11-29 Notes

feedback@janusworx.com (Mario Jason Braganza) — Sat, 29 Nov 2025 09:01:00 +0530

Goals + Recap
#

Got the cluster up and running finally yesterday. Figured out how git and flux and kubernetes interact
The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- Letsencrypt and Certmanager
- Get Traefik Ingress to work
And once that is done, do kanboard again
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-11-29 09:15
#

Short day today. Have a client meeting coming up
Was confused between whether to do Traefik first. But past Jason seems to have already figured that out for me. Looking at Sealed Secrets next
I think I want to change my mind. Looking at vault
Mind changed again. Back to Sealed Secrets. Implementing another running service to herd, is not what I want to do right now. But it is important. I ought to look at Vault someday. I was worried about what would happen if my K3s cluster crashed, taking my secrets along with it. Most LLMs suggest that I can backup the key and reuse it. So mind relieved. Worst case, I can just create new secrets by resealing. I do have all my secrets “unencrypted”, but stored in a password manager anyway
2025-11-29 11:00: Off to work

2025-11-29 19:00
#

2025-11-29 20:00 Got sealed secrets installed. Did all the yaml and the wiring myself. Gettingt the hang of installing apps (as well as troubleshooting flux, when things don’t work)

Feedback on this post?
Mail me at feedback at this domain.

2025-11-28 Notes

feedback@janusworx.com (Mario Jason Braganza) — Fri, 28 Nov 2025 09:34:32 +0530

Goals + Recap
#

Had a busy few days, consulting out in the field with clients last week + the early part of this week and then lost steam over the next few days. Will slow down and not push to hard. Do tiny bits.
Other goals, same as Monday, considering I tore everything down at the end of the day
So think I’ll noodle a bit to see if I can get something done today. No pressure
The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- Letsencrypt and Certmanager
- Get Traefik Ingress to work
And once that is done, do kanboard again
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-11-28 17:45
#

Been at it slowly all day
Nothing works yet. But a few more things have clicked in my head

2025-11-28 19:00
#

Got it working! I got it to work, gosh darn it! Yippeee!

2025-11-28 20:00
#

Ok, tried it all again, so that I know this was not a fluke. Wrote down all the commands
Will try to do auto updation of this demo app on Monday

Feedback on this post?
Mail me at feedback at this domain.

2025-11-17 Notes

feedback@janusworx.com (Mario Jason Braganza) — Mon, 17 Nov 2025 08:53:01 +0530

Goals + Recap
#

Saturday was slow progress!
So think I’ll noodle a bit to see if I can get something done today. No pressure
The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- Letsencrypt and Certmanager
- Get Traefik Ingress to work
And once that is done, do kanboard again
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-11-17 17:45
#

Struggling to get cert-manager installed. No dice
2025-11-17 18:15: Got frustrated. Tore it all down. Will be back day after

Feedback on this post?
Mail me at feedback at this domain.

2025-11-15 Notes

feedback@janusworx.com (Mario Jason Braganza) — Sat, 15 Nov 2025 08:11:40 +0530

Goals + Recap
#

Yesterday was a another long day!
But I think I’ve finally got my arms around Flux CD and how it can help me with my cluster. I was trying to follow Funky Penugin’s guide, since it did nearly everything that I needed done. But it does it, in its own opinionated way, and that is a little restricting for me
So what I think I’ll do is do it may way with what I learned yesterday, using FP as an ideal. It may well be, that I might come to implement things the way they do with time
So the plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- Letsencrypt and Certmanager
- Get Traefik Ingress to work
And once that is done, do kanboard again
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-11-15 08:50
#

Let’s get to work
A wee bit of thinking and I seem to be creating the same kind of folder structure on my own as FP 😂
Stopped a while to listen to this
2025-11-15 09:58: Tea time. Did a lot of reading to figure out how to deal with the fact thta I might undersize PVs for my pods to store data in (tldr; possible for the pv to retain data. set it that way. and then the old pvc needs to be deleted and the new one attached to the PV that still carries the data. Take backups!)

2025-11-15 10:30
#

2025-11-15 11:13: No OIDC for me, but definitely for the project. The problem for future Jason is to find a project that will give me the excuse to implement all this
2025-11-15 11:43: Tore down the old cluster
2025-11-15 13:04: Got k3s and flux up. Breaking for lunch

2025-11-15 14:25
#

2025-11-15 16:13: Got my first service/deployment done via flux! Sealed secrets is now installed. I can now push secret stuff with ease! Tea break
2025-11-15 18:39: Try as I might, I could not get cert manager installed. Will try on Monday now.

Feedback on this post?
Mail me at feedback at this domain.

2025-11-14 Notes

feedback@janusworx.com (Mario Jason Braganza) — Fri, 14 Nov 2025 07:36:20 +0530

Goals + Recap
#

Yesterday was a doozy!
And stuff just worked today morning! I didn’t have to do anything at all! I had done everything correctly last night and then my tired brain was testing stuff with a typo in my commands. It also taught me that most stuff is easy. And I should be open to learning new stuff if it interests me. I stuck with Nginx out of inertia for far to long. HAProxy actually fits my mental model of a proxy / load balancer. I find its config easier and more intuitive. Should have switched long ago
Continue with doing MetalLB
Once that is done, do kanboard again
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-11-14 09:35
#

Slow start today. Was trying to figure out what Metal LB meant by a pool and did it mean my DHCP pool (No. it does note)
2025-11-14 09:45: Tea break.

2025-11-14 10:15
#

Back to work
2025-11-14 11:35: Giving up on MetalLB for now. Sticking to the inbuilt load balancer. Nothing’s quite clicking right and I don’t know where to start troubleshooting. Maybe I’ll give myself until lunch and then decide
2025-11-14 11:37: Yea, no. Tearing down the cluster and bringing it back up with ServiceLB
2025-11-14 12:56: Lunch.
2025-11-14 13:21: Cleared the decks so I could work afternoon as well
2025-11-14 15:36: Got sealed secrets installed. Trying to copy paste and modify these things myself now. Tea break. External DNS is next on the list

2025-11-14 16:20
#

2025-11-14 17:26: Decided not to do External DNS. Another one for the AWS project list. I want to retain control by some manual work. External DNS does not help or hinder in this regard. Better off without it for my personal use. Will come back to it, if needs change
2025-11-14 18:01: Reading flux documentation
2025-11-14 18:09: Switched to a video course
2025-11-14 20:41: Going through the course makes me realise that Funky Penguin’s structure is maybe a little too strict for me. Will have to look into adapting it a bit to my liking
2025-11-14 21:58: Making good progress with the course
2025-11-14 22:57: Done. Calling it a night!

Feedback on this post?
Mail me at feedback at this domain.

2025-11-13 Notes

feedback@janusworx.com (Mario Jason Braganza) — Thu, 13 Nov 2025 08:05:52 +0530

Goals
#

Flux setup yesterday! Try and get Metal LB working.
Found [Funky Penguin’s guide][]. Will use it to, uhm, guide me through my setup.e
Once the CD stuff works, do kanboard again
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-11-13 08:40
#

Updated hcloud cli and lego on both my machines
2025-11-13 09:51: Utterly botched all my network machines Will do a tea break and then go look at the mess I made
2025-11-13 10:44: Fixed the network
2025-11-13 11:22: Trying to get Nginx stream proxying to work. Grrrr
2025-11-13 13:23: Completely buggered up the Nginx machine now. Needs a complete redo!
2025-11-13 14:14: MetalLB seems like a distant dream right now!
2025-11-13 14:14: Trying to get myself an alternative to Nginx which (hopefully) does better layer 4 routing? Looking at haproxy.
2025-11-13 18:17: Got haproxy working for the forgejo instance somehow with a lot of help from the docs and various llms
2025-11-13 19:01: The haproxy tutorials page is dammed helpful!
2025-11-13 21:31: Calling it a night. Exhausted. Most everything is done. Need to figure out a way to somehow serve static files at the files path for the forgejo instance

Feedback on this post?
Mail me at feedback at this domain.

2025-11-12 Notes

feedback@janusworx.com (Mario Jason Braganza) — Wed, 12 Nov 2025 07:11:15 +0530

Goals
#

Kanboard moved yesterday! Now to do it again!
Found Funky Penguin’s guide. Will use it to, uhm, guide me through my setup.
One change: decided to switch to Flux instead of Argo for continuous deployment. Why? Just because. Just because I fancy Flux more. And because I am new and learning still and these decisions have few consequence at this stage
I also figured out the easiest, most manual way of proxying my traffic to the cluster from my other machine that runs nginx. The home router is (obviously) incapable of routing at layer 7. So http/https traffic is routed to Nginx on my always running NUC, from where the traffic for the apps on the cluster will come, thanks to Nginx proxying it forward. I tried a blind stream proxy approach with Nginx, but that did not seem to play nice with my existing setup and local sites
Once the CD stuff works, do kanboard again
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-11-12 07:35
#

Alright, let’s begin
2025-11-12 08:26: Bootstrapping flux via forgejo failed. will try github first.
2025-11-12 08:43: Redoing K3s install. Trying without serviceLB this time
2025-11-12 09:11: Running into reconciliation issues. Ok this is good practice with troubleshooting
2025-11-12 09:42: Tea break

2025-11-12 10:00
#

Realised that K3s was running slightly degraded. Note to self, try and keep only one NIC active when installing + make sure that I open up the proper ports
2025-11-12 10:14: Running into the same issues on Github as I did with my Forgejo. It’s both a relief that I did do things right, as well as slightly maddening at the same time
2025-11-12 10:30: Ok stuff seems to have changed in FluxCD world ever since the guide was done. Had to update api versions and remove a field from a yaml file
2025-11-12 10:31: Now to try replicating this with Forgejo.
2025-11-12 10:39: Et voilà! It now works with Forgejo too!
2025-11-12 13:02: Break for lunch. Be back in the eve. MetalLB is hard to configure!

2025-11-12 18:30
#

Come back really late. Will continue tomorrow

Feedback on this post?
Mail me at feedback at this domain.

2025-11-11 Notes

feedback@janusworx.com (Mario Jason Braganza) — Tue, 11 Nov 2025 07:27:15 +0530

Goals
#

Continue moving Kanboard. We got it up yesterday. Data does not show up though
Once the manual approach works, move it to
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-11-11 08:05
#

Wrote up a post on load balancers that bit me
Continuing with yesterday’s work now
2025-11-11 09:05: Switching folders, enabling and disabling deploys, setting permissions and now I realise why I need charts and gitops
2025-11-11 09:28: Yea baby yea! Dumb permissions issue! Kanboard migrated successfully! Now to make it accessible from the outside
2025-11-11 09:30: Tea Break
2025-11-11 11:14: Struggled for close to 45 minutes before I realised I had not brought up a service after deleting it!
2025-11-11 11:22: I have made my way step by step from a docker file to a working app on kubernetes. Feels good
2025-11-11 11:37: Now that I seem to have a good handle on making things work, I should make it a habit of reading the docs bit by bit
2025-11-11 12:34: Found Funky Penguin!
2025-11-11 12:43: Tore everything down. Again!
Will do more in the evening sesssion using Funky Penguin’s suggestions, most of which, I arrived at independantly. So that gives me a lot of self confidence

2025-11-11 16:50
#

The hard part now is to somehow proxy requests from my nginx gateway to this here k3s cluster
2025-11-11 19:24: Calling it a night. Will follow the Penguin tomorrow, because he is doing the same thing that I want

Feedback on this post?
Mail me at feedback at this domain.

2025-11-10 Notes

feedback@janusworx.com (Mario Jason Braganza) — Mon, 10 Nov 2025 07:35:11 +0530

Goals
#

Same as Friday with one change! We begin by moving Kanboard (an app to do Kanban project tracking (by the same fine folks who make Miniflux))
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Miniflux next, followed by Hedgedoc

2025-11-10 07:40
#

Monday! Sluggish as a snail right now. Slightly lost as well. Slowly ramping up to speed
I need to work faster, more purposefully and with more intent in the mornings. I always underestimate, how much time I have and before I know it, the morning’s flown and I (feel like I) have hardly made progress.
2025-11-10 08:03: Torn between just doing the move vs actually trying to figure out each step. Think I’ll stick to the move and learn via troubleshooting. The intentional learning I will keep for the AWS project I’ll tackle next
2025-11-10 09:15: Migrated Kanboard data to my local desktop and ensured the local install is running
2025-11-10 11:59: Yes, I said I wouldn’t fiddle with my terraform plan any more, but cert manager was something I just had to install into the cluster at init time
2025-11-10 12:38: Grr. SSH! solved it anyhoo. logged into the new cluster. all works fine. really appreciate terraform now!
2025-11-10 19:07: Got a basic service running. I can access the kanboard page. It does not seem to have taken my data though. Will continue tomorrow

Feedback on this post?
Mail me at feedback at this domain.

2025-11-08 Notes

feedback@janusworx.com (Mario Jason Braganza) — Sat, 08 Nov 2025 08:34:30 +0530

Goals
#

Same as yesterday!
Begin by moving (lifting and shifting in popular parlance) Miniflux to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Hedgedoc next

2025-11-08 08:40
#

Reading a Kubernetes book
More like exploring. Finding some new term, something clicks, go and find out about it, then come back to book. Slow, but interesting going
2025-11-08 16:50: Have read and learned enough about Kuberntes to have finally gotten the big picture and to be able to ask intelligent “dumb” questions now
2025-11-08 18:47: Calling it a night! Full steam ahead Monday now! Look into Kompose and Katenary! Both are installed

Feedback on this post?
Mail me at feedback at this domain.

2025-11-07 Notes

feedback@janusworx.com (Mario Jason Braganza) — Fri, 07 Nov 2025 07:44:06 +0530

Goals
#

The cluster’s up! Learn to deploy apps to it.
Begin by moving (lifting and shifting in popular parlance) Miniflux to the cluster
- Cert will probably be needed
- Learn how to configure an app with code
- Figure out secrets, if there are any
- Learn how to tunnel through and reverse proxy
- Learn how to store data and back it up
Move Hedgedoc next

2025-11-07 07:55
#

Quickly skim through the Helm book
Dumb thought: Backups should get easier. All the data will probably lie in one directory somewhere on disk and configs will lie in code
2025-11-07 09:02: Think I’ll install things manually and then “gitops” it. Because right now, everything feels turtles all the way down AND chicken and egg to me
2025-11-07 09:41: Trying to get a local cluster environment going
2025-11-07 09:56: Tea break

2025-11-07 10:25
#

Back at it, attempting to install traefik on a local cluster
2025-11-07 12:09: Got tired trying to adapt Kind to the K3s way of doing things. Switching to K3s on the local system as well, because I keep forgetting that kind itself runs inside a docker container. K3s is light enough to run on my local system as well.
2025-11-07 12:35: K3s installed and configured. One happy accident is that I don’t have to install Traefik (plus associated sofware like load balancers) any more
2025-11-07 12:54: Lunch

2025-11-07 16:25
#

Back.
Installing argocd on the home cluster as well. the cloud-init for my hetzer vm has come in really handy!
2025-11-07 16:52: Back to the helm book
2025-11-07 19:31: Still with the book. Will come back to it and the rest of work tomorrow. Calling it a night

Feedback on this post?
Mail me at feedback at this domain.

2025-11-06 Notes aka The Plan for My New Hetzner VM

feedback@janusworx.com (Mario Jason Braganza) — Thu, 06 Nov 2025 08:03:54 +0530

Update: 2025-12-11
#

I got it done!

Preamble
#

If this post is weird and stream of consciousness like, that’s by design.
You are seeing a notes and miscellanea post, in the work category.
I want to be able to think through what I am doing. Mostly to clarify, document and explicitly state what I want. To avoid shifting goalposts (or rather to shift them intentionally, if need be.)
I’ll be updating and revising this post as I think and learn and experience things

Goals
#

Think about and write what I want to get done with my hetzner
For now, the how does not matter

What I want
#

A VM running K3s, that I can deploy my Hugo website to, as well all the apps that I choose to run on Janusworx
My main need with a cluster is the GitOps aspect. Not the scaling or redundancy. I want infrastructure as code and automated updates, as much as possible.
Everything goes through my Forgejo instance at home
I write a post and it should deploy to the website somehow
Apps that I put in there, either just my config files of already published images/deployments, or my own custom things, ought to be pushed to or pulled by the cluster and deployed. Upgrades should be a matter of manipulating code
Secrets should be self hosted, via environment variables or some self hosted solution. Never at a third party service

2025-11-06 09:35
#

Got tangled with Hugo in the morning.
I think I got the basics down, the VM comes up. K3s in installed, but in what order do I move my apps over?
Think I’ll the root domail last. And try beginning with the “simpler” apps first
Begin with familiarising myself with Helm
2025-11-06 10:06: Tea break
2025-11-06 13:06: Lunch break

2025-11-06 16:00
#

Back. Trying to port my dev terraform setup to production. It should just work. But it does not.
2025-11-06 16:59: Solved. I had somehow borked my Terraform state. Nuked it. And then things started working again
Show stopper now. My GPG key has expired. Need to figure out how to sign my git commits with SSH now
2025-11-06 18:26: I think I’ve licked it. Both Github and Forgejo don’t seem to be complaining. Let’s see what else I’ve broken over the coming days
2025-11-06 20:00: Done! My production cluster is up! And I can tear it down and build it up consistently. Now to work with it tomorrow.

Feedback on this post?
Mail me at feedback at this domain.

K3s-Nm on Janusworx

2026-02-03 Notes

Goals + Recap #

2026-02-03 11:00 #

2026-02-03 13:10 #

2026-02-03 17:40 #

2026-01-29 Notes

Goals + Recap #

2026-01-29 10:40 #

2026-01-29 18:45 #

2026-01-28 Notes

Goals + Recap #

2026-01-28 12:00 #

2026-01-28 19:00 #

2026-01-15 Notes

Goals + Recap #

2026-01-15 10:50 #

2026-01-15 14:20 #

2026-01-14 Notes

Goals + Recap #

2026-01-14 10:15 #

2026-01-14 10:30 #

2026-01-14 13:10 #

2026-01-14 16:55 #

2026-01-13 Notes

Goals + Recap #

2026-01-13 10:40 #

2026-01-13 14:15 #

2026-01-13 20:25 #

2026-01-05 Notes

Goals + Recap #

2026-01-05 08:45 #

2026-01-05 10:50 #

2026-01-05 19:15 #

2025-12-19 Notes

Goals + Recap #

2025-12-19 08:10 #

2025-12-19 08:55 #

2025-12-19 11:00 #

2025-12-19 13:10 #

2025-12-19 14:15 #

2025-12-19 14:30 #

2025-12-19 16:25 #

2025-12-18 Notes

Goals + Recap #

2025-12-18 08:40 #

2025-12-18 14:00 #

2025-12-17 Notes

Goals + Recap #

2025-12-17 07:50 #

2025-12-17 09:15 #

2025-12-17 10:35 #

2025-12-17 12:50 #

2025-12-17 14:08 #

2025-12-17 16:00 #

2025-12-16 Notes

Goals + Recap #

2025-12-16 09:20 #

2025-12-16 10:45 #

2025-12-16 12:55 #

2025-12-15 Notes

Goals + Recap #

2025-12-15 09:10 #

2025-12-15 10:25 #

2025-12-15 14:02 #

2025-12-15 17:30 #

2025-12-13 Notes

Goals + Recap #

2025-12-13 07:30 #

2025-12-13 08:20 #

2025-12-13 09:05 #

2025-12-13 10:45 #

2025-12-13 17:30 #

2025-12-12 Notes

Goals + Recap #

2025-12-12 09:15 #

2025-12-12 10:30 #

2025-12-12 13:30 #

2025-12-12 14:45 #

2025-12-12 16:20 #

Goals + Recap
#

2026-02-03 11:00
#

2026-02-03 13:10
#

2026-02-03 17:40
#

Goals + Recap
#

2026-01-29 10:40
#

2026-01-29 18:45
#

Goals + Recap
#

2026-01-28 12:00
#

2026-01-28 19:00
#

Goals + Recap
#

2026-01-15 10:50
#

2026-01-15 14:20
#

Goals + Recap
#

2026-01-14 10:15
#

2026-01-14 10:30
#

2026-01-14 13:10
#

2026-01-14 16:55
#

Goals + Recap
#

2026-01-13 10:40
#

2026-01-13 14:15
#

2026-01-13 20:25
#

Goals + Recap
#

2026-01-05 08:45
#

2026-01-05 10:50
#

2026-01-05 19:15
#

Goals + Recap
#

2025-12-19 08:10
#

2025-12-19 08:55
#

2025-12-19 11:00
#

2025-12-19 13:10
#

2025-12-19 14:15
#

2025-12-19 14:30
#

2025-12-19 16:25
#

Goals + Recap
#

2025-12-18 08:40
#

2025-12-18 14:00
#

Goals + Recap
#

2025-12-17 07:50
#

2025-12-17 09:15
#

2025-12-17 10:35
#

2025-12-17 12:50
#

2025-12-17 14:08
#

2025-12-17 16:00
#

Goals + Recap
#

2025-12-16 09:20
#

2025-12-16 10:45
#

2025-12-16 12:55
#

Goals + Recap
#

2025-12-15 09:10
#

2025-12-15 10:25
#

2025-12-15 14:02
#

2025-12-15 17:30
#

Goals + Recap
#

2025-12-13 07:30
#

2025-12-13 08:20
#

2025-12-13 09:05
#

2025-12-13 10:45
#

2025-12-13 17:30
#

Goals + Recap
#

2025-12-12 09:15
#

2025-12-12 10:30
#

2025-12-12 13:30
#

2025-12-12 14:45
#

2025-12-12 16:20
#

2025-12-12 17:30
#

Tomorrow
#

Goals + Recap
#

The Big Plan (Done! 🎉🎉🎉)
#

2025-12-11 09:30
#

2025-12-11 10:15
#

2025-12-11 13:05
#

2025-12-11 17:15
#

2025-12-11 18:35
#

Goals + Recap
#

The Big Plan
#

2025-12-10 09:50
#

2025-12-10 14:15
#

Goals + Recap
#

The Big Plan
#