Erich Blume
27d8f3cf1f
## Summary - **Doc review:** Reviewed `gandi-operations.md` — added `last-reviewed` frontmatter, verified all wiki-links, confirmed Pulumi state has no drift - **Gandi reference fix:** Added missing `cv.eblu.me` CNAME row to `gandi.md` DNS records table (was present in Pulumi but undocumented) - **Pulumi comment fix:** Updated stale `README.md` reference in `__main__.py` to point to `docs/how-to/gandi-operations.md` - **How-to reorg:** Moved 14 how-to guides into 3 subdirectories (`deployment/`, `configuration/`, `operations/`), collapsed the Documentation and Database index sections into Configuration and Operations respectively ## Verification - `docs-check-links` — all 180 wiki-links valid - `docs-check-filenames` — all 90 filenames unique - `dns-preview` — 5 resources unchanged, no drift - All pre-commit hooks pass ## Test plan - [ ] Verify docs site builds correctly with new paths - [ ] Spot-check a few wiki-links from other pages to moved how-to guides Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/200 |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| __main__.py | ||
| Pulumi.eblu-me.yaml | ||
| Pulumi.yaml | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||
Gandi DNS Management
This Pulumi project manages DNS records for eblu.me via Gandi LiveDNS.
What It Does
Creates DNS records that point *.ops.eblu.me to indri's Tailscale IP.
Why indri? indri hosts Caddy, the reverse proxy for all blumeops services.
All *.ops.eblu.me requests route through Caddy, which proxies to the appropriate
backend service (either on indri itself or in the k8s cluster).
Since Tailscale IPs (100.x.x.x) are not routable on the public internet, these DNS records effectively make services accessible only from within the tailnet, while still using real, resolvable DNS names.
The target IP is resolved dynamically from indri.tail8d86e.ts.net at deploy time,
so if indri's Tailscale IP changes, just re-run the deployment.
Setup
cd pulumi/gandi
uv sync
pulumi stack select eblu-me # or: pulumi stack init eblu-me
Authentication
This project requires a Gandi Personal Access Token (PAT) with LiveDNS permissions.
The PAT expires every 30 days and must be cycled manually.
Cycling the PAT
-
Go to Gandi PAT Management
-
Create a new PAT:
- Name:
blumeops-pulumi(or similar) - Expiration: 30 days (maximum is 90; shorter is fine if used rarely)
- Permissions required:
- Manage domain name technical configurations (required for DNS records)
- See and renew domain names
- Optional permissions (enabled but not strictly required):
- See & download SSL certificates
- Manage Cloud resources
- See Cloud resources
- View Organization
- Deploy Web Hosting instances
- Manage Web Hosting instances
- See and renew Web Hosting instances
- Name:
-
Update 1Password:
# Update the existing item with the new PAT value op item edit mco6ka3dc3rmw7zkg2dhia5d2m pat="<NEW_PAT_VALUE>" --vault vg6xf6vvfmoh5hqjjhlhbeoaie -
Delete the old PAT from Gandi admin console
Running with Authentication
The mise task handles fetching the PAT from 1Password:
mise run dns-up # Preview and apply changes
mise run dns-preview # Preview only
Or manually:
export GANDI_PERSONAL_ACCESS_TOKEN=$(op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/mco6ka3dc3rmw7zkg2dhia5d2m/pat")
pulumi up
DNS Records Created
| Record | Type | Value | Purpose |
|---|---|---|---|
*.ops.eblu.me |
A | (indri's Tailscale IP) | Wildcard for all services |
ops.eblu.me |
A | (indri's Tailscale IP) | Base subdomain |
Service Hostnames
Once Caddy is configured on indri, services will be accessible at:
forge.ops.eblu.me- Forgejo git serverregistry.ops.eblu.me- Zot container registrygrafana.ops.eblu.me- Grafana dashboardsargocd.ops.eblu.me- ArgoCDfeed.ops.eblu.me- Miniflux RSS readerpypi.ops.eblu.me- DevPI Python indexkiwix.ops.eblu.me- Kiwix offline contenttesla.ops.eblu.me- TeslaMatetorrent.ops.eblu.me- Transmissionprometheus.ops.eblu.me- Prometheus metricsloki.ops.eblu.me- Loki logs