91 lines
2.6 KiB
Markdown
91 lines
2.6 KiB
Markdown
# the-hub
|
|
|
|
**Glance** dashboard for mk-labs, deployed on `fastpass` (Talos/Kubernetes).
|
|
Managed by ArgoCD. All config is code. No manual kubectl required after initial bootstrap.
|
|
|
|
---
|
|
|
|
## Repo layout
|
|
|
|
```
|
|
cluster/
|
|
argocd/
|
|
the-hub-application.yaml # ArgoCD Application — drop this in with your platform apps
|
|
applications/
|
|
the-hub/
|
|
namespace.yaml
|
|
rbac.yaml # ServiceAccount + ClusterRole (read-only K8s access)
|
|
externalsecret.yaml # ESO ExternalSecret — pulls tokens from 1Password
|
|
deployment.yaml
|
|
service.yaml
|
|
ingress.yaml
|
|
configmap.yaml # glance.yml lives here — this is where you edit the dashboard
|
|
```
|
|
|
|
---
|
|
|
|
## URL
|
|
|
|
`https://the-hub.local.mk-labs.cloud`
|
|
|
|
TLS via cert-manager + Cloudflare DNS-01 (`letsencrypt-prod` ClusterIssuer).
|
|
|
|
---
|
|
|
|
## Secrets (1Password → ESO)
|
|
|
|
Create a 1Password vault item named **`the-hub`** with these fields:
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| `proxmox_token` | `user@pam!token-name=<uuid>` |
|
|
| `pbs_token` | `PBSAPIToken=user@pam!token-name=<uuid>` |
|
|
| `grafana_token` | Grafana service account token (read-only) |
|
|
| `gitea_token` | Gitea personal access token (read-only) |
|
|
|
|
ESO syncs these into the `the-hub-secrets` Kubernetes Secret. The Deployment mounts
|
|
them as environment variables, which `glance.yml` references via `${VAR_NAME}` syntax.
|
|
|
|
---
|
|
|
|
## Proxmox API token setup
|
|
|
|
Create a **read-only** API token in Proxmox:
|
|
|
|
1. Datacenter → Permissions → API Tokens → Add
|
|
2. User: any read-only user (or `root@pam` for lab use)
|
|
3. Token ID: `glance`
|
|
4. Uncheck "Privilege Separation" only if you want full access
|
|
5. Assign role `PVEAuditor` to the token at the `/` path
|
|
|
|
Token format in 1Password: `user@pam!glance=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`
|
|
|
|
---
|
|
|
|
## SSO (Authentik forward-auth)
|
|
|
|
SSO annotations are present but commented out in `ingress.yaml`. Uncomment when
|
|
`guest-relations` Authentik SSO is configured for `fastpass` ingress.
|
|
|
|
---
|
|
|
|
## Editing the dashboard
|
|
|
|
The entire dashboard lives in `configmap.yaml` under the `glance.yml` key.
|
|
|
|
1. Edit `cluster/applications/the-hub/configmap.yaml`
|
|
2. Commit + push
|
|
3. ArgoCD syncs automatically (or `argocd app sync the-hub`)
|
|
4. Glance hot-reloads the config — no pod restart needed for content changes
|
|
(pod restarts only needed when env var secrets change)
|
|
|
|
---
|
|
|
|
## Pages
|
|
|
|
| Page | Purpose |
|
|
|---|---|
|
|
| **Overview** | Service health monitors + bookmarks + Gitea repo activity |
|
|
| **Infrastructure** | Proxmox node stats, PBS status, Grafana iframe |
|
|
| **Updates** | Homelab YouTuber RSS, K8s/Argo release tracking, tech news |
|