Lumpiasty/klaster
0
1
Fork 0
Code Issues Pull Requests 3 Packages Projects Releases Wiki Activity

Compare commits

base: Lumpiasty/klaster:fresh-start
Branches Tags
Lumpiasty/klaster:fresh-start Lumpiasty/klaster:renovate/valkey-0.x Lumpiasty/klaster:renovate/alpine-k8s-1.x Lumpiasty/klaster:renovate/openebs-4.x
..
compare: Lumpiasty/klaster:3e6107d0624d6f2c2c3b7d8fa264f13e6cd8701b
Branches Tags
Lumpiasty/klaster:fresh-start Lumpiasty/klaster:renovate/valkey-0.x Lumpiasty/klaster:renovate/alpine-k8s-1.x Lumpiasty/klaster:renovate/openebs-4.x
1 Commits
fresh-start .. 3e6107d062
Author SHA1 Message Date
Renovate 3e6107d062 Update renovate/renovate Docker tag to v43.214.1 2026-06-06 02:02:49 +00:00
52 changed files with 1143 additions and 1158 deletions
Expand all files Collapse all files
.woodpecker/build-images.yaml
-70
View File
@@ -1,70 +0,0 @@
when:
- event: push
path:
include:
- docker/**
- .woodpecker/build-images.yaml
steps:
- name: Get registry creds from OpenBao
image: quay.io/openbao/openbao:2.6.2
environment:
VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
ROLE_ID:
from_secret: renovate_role_id
SECRET_ID:
from_secret: renovate_secret_id
commands:
- bao write -field token auth/approle/login
role_id=$ROLE_ID
secret_id=$SECRET_ID > /woodpecker/.vault_id
- export VAULT_TOKEN=$(cat /woodpecker/.vault_id)
- 'printf "PLUGIN_USERNAME=%s\n" "$(bao kv get -mount secret -field REGISTRY_USERNAME container-registry)" > /woodpecker/registry.env'
- 'printf "PLUGIN_PASSWORD=%s\n" "$(bao kv get -mount secret -field REGISTRY_PASSWORD container-registry)" >> /woodpecker/registry.env'
- name: Build and push mikrotik coredns
image: woodpeckerci/plugin-docker-buildx:6.1.1
privileged: true
settings:
registry: gitea.lumpiasty.xyz
repo: gitea.lumpiasty.xyz/lumpiasty/coredns-mikrotik
platforms: linux/arm64
tags:
- latest
- ${CI_COMMIT_SHA:0:8}
dockerfile: docker/coredns/Dockerfile
context: docker/coredns/
env_file: /woodpecker/registry.env
cache_images:
- gitea.lumpiasty.xyz/lumpiasty/coredns-mikrotik:buildcache
depends_on: ["Get registry creds from OpenBao"]
- name: Build and push supervisord
image: woodpeckerci/plugin-docker-buildx:6.1.1
privileged: true
settings:
registry: gitea.lumpiasty.xyz
repo: gitea.lumpiasty.xyz/lumpiasty/supervisord
platforms: linux/amd64
tags:
- latest
- ${CI_COMMIT_SHA:0:8}
dockerfile: docker/supervisord/Dockerfile
context: docker/supervisord/
env_file: /woodpecker/registry.env
cache_images:
- gitea.lumpiasty.xyz/lumpiasty/supervisord:buildcache
depends_on: ["Get registry creds from OpenBao"]
- name: Invalidate OpenBao token
image: quay.io/openbao/openbao:2.6.2
environment:
VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
commands:
- export VAULT_TOKEN=$(cat /woodpecker/.vault_id)
- bao write -f auth/token/revoke-self
when:
- status: [success, failure]
depends_on:
- Build and push mikrotik coredns
- Build and push supervisord
.woodpecker/flux-reconcile-source.yaml
+4 -4
View File
@@ -6,7 +6,7 @@ skip_clone: true
steps:
- name: Get kubernetes access from OpenBao
image: quay.io/openbao/openbao:2.6.2
image: quay.io/openbao/openbao:2.5.4
environment:
VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
ROLE_ID:
@@ -20,7 +20,7 @@ steps:
- export VAULT_TOKEN=$(cat /woodpecker/.vault_id)
- bao write -format json -f /kubernetes/creds/flux-reconcile > /woodpecker/kube_credentials
- name: Construct Kubeconfig
image: alpine/k8s:1.36.2
image: alpine/k8s:1.36.1
environment:
KUBECONFIG: /woodpecker/kubeconfig
commands:
@@ -35,13 +35,13 @@ steps:
--namespace flux-system
- kubectl config use-context cluster
- name: Reconcile git source
image: ghcr.io/fluxcd/flux-cli:v2.9.5
image: ghcr.io/fluxcd/flux-cli:v2.8.8
environment:
KUBECONFIG: /woodpecker/kubeconfig
commands:
- flux reconcile source git flux-system
- name: Invalidate OpenBao token
image: quay.io/openbao/openbao:2.6.2
image: quay.io/openbao/openbao:2.5.4
environment:
VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
commands:
.woodpecker/renovate.yaml
+3 -4
View File
@@ -6,7 +6,7 @@ skip_clone: true
steps:
- name: Get renovate token from OpenBao
image: quay.io/openbao/openbao:2.6.2
image: quay.io/openbao/openbao:2.5.4
environment:
VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
ROLE_ID:
@@ -21,8 +21,7 @@ steps:
- bao kv get -mount secret -field RENOVATE_TOKEN renovate > /woodpecker/renovate_token
- bao kv get -mount secret -field GITHUB_COM_TOKEN renovate > /woodpecker/github_com_token
- name: Run Renovate
image: renovate/renovate:44
pull: true
image: renovate/renovate:43.214.1
environment:
RENOVATE_AUTODISCOVER: "true"
RENOVATE_ENDPOINT: https://gitea.lumpiasty.xyz/api/v1
@@ -35,7 +34,7 @@ steps:
- export GITHUB_COM_TOKEN=$(cat /woodpecker/github_com_token)
- /usr/local/sbin/renovate-entrypoint.sh renovate
- name: Invalidate OpenBao token
image: quay.io/openbao/openbao:2.6.2
image: quay.io/openbao/openbao:2.5.4
environment:
VAULT_ADDR: https://openbao.lumpiasty.xyz:8200
commands:
ansible/roles/openwrt/tasks/wireless.yml
-6
View File
@@ -25,12 +25,6 @@
network: iot
mode: ap
ssid: szafa
hidden: '1' # Stop broadcasting SSID
macfilter: allow # Apply MAC filter allowing only specific addresses
maclist:
- 80:64:7c:99:21:20 # Thermomether
- C0:F8:53:89:E5:EF # Smart plug
- C0:F8:53:89:E3:42 # smart plug
encryption: psk2
key: "{{ openwrt_iot_wifi_password }}"
disabled: '0'
ansible/roles/routeros/tasks/addressing.yml
+4 -6
View File
@@ -40,18 +40,16 @@
- address: 2001:470:70:dd::2/64
advertise: false
interface: sit1
# Static instead of from-pool: pool allocation is dynamic (first free /64,
# e.g. ...:0::/64) which made the RDNSS address advertised in ND config
# point at a nonexistent router address. HE prefix is static, so static
# per-VLAN addressing is deterministic and matches docs/network.md.
- address: 2001:470:61a3:9:ffff:ffff:ffff:ffff/64
- address: ::ffff:ffff:ffff:ffff/64
from-pool: pool1
interface: vlan2
- address: 2001:470:61a3:500:ffff:ffff:ffff:ffff/64
interface: containers
- address: 2001:470:61a3:100::1/64
advertise: false
interface: vlan4
- address: 2001:470:61a3:a:ffff:ffff:ffff:ffff/64
- address: ::ffff:ffff:ffff:ffff/64
from-pool: pool1
interface: vlan5
- address: 2001:470:61a3:600::1/64
advertise: false
ansible/roles/routeros/tasks/base.yml
+19 -49
View File
@@ -65,9 +65,6 @@
- bridge: containers
interface: veth-tailscale
comment: Tailscale container interface
- bridge: containers
interface: veth-coredns
comment: CoreDNS container interface
- bridge: bridge1
interface: ether1
pvid: 2
@@ -155,9 +152,24 @@
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
# Pool is no longer referenced — vlan2/vlan5 now use static addresses
# (addressing.yml) so the RDNSS addresses in ND config are deterministic.
# Kept defined for one run after migration; safe to delete afterwards.
- name: Configure DHCP networks
community.routeros.api_modify:
path: ip dhcp-server network
data:
- address: 192.168.0.0/24
dns-server: 192.168.0.1
gateway: 192.168.0.1
- address: 192.168.255.0/24
dns-none: true
gateway: 192.168.255.10
- address: 192.168.5.0/24
dns-server: 192.168.5.1
gateway: 192.168.5.1
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
# TODO: IPv6 pools are useful when we have dynamic prefix, but we don't
# We can remove it now
- name: Configure IPv6 pools
community.routeros.api_modify:
path: ipv6 pool
@@ -176,9 +188,7 @@
values:
allow-remote-requests: true
cache-size: 20480
# CoreDNS container: plain forwarder with selective AAAA suppression.
# Forwards upstream to 1.1.1.1/8.8.8.8.
servers: 172.20.0.3
servers: 1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001
- name: Configure DNS static entries
community.routeros.api_modify:
@@ -189,12 +199,6 @@
forward-to: 100.100.100.100
match-subdomain: true
comment: Tailscale MagicDNS
# Do NOT add a lumpiasty.xyz FWD entry here. RouterOS FWD entries return
# NOERROR with an empty answer instead of relaying NXDOMAIN, which breaks
# getaddrinfo search-domain processing (ENOTFOUND for valid names in k8s
# pods). Our own zone is handled in the CoreDNS Corefile (lumpiasty.xyz
# server block, AAAA kept) which relays rcodes correctly.
# See docs/coredns.md.
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
@@ -240,22 +244,6 @@
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
- name: Configure DHCP networks
community.routeros.api_modify:
path: ip dhcp-server network
data:
- address: 192.168.0.0/24
dns-server: 192.168.0.1
gateway: 192.168.0.1
- address: 192.168.255.0/24
dns-none: true
gateway: 192.168.255.10
- address: 192.168.5.0/24
dns-server: 192.168.5.1
gateway: 192.168.5.1
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
- name: Configure IPv6 ND defaults
community.routeros.api_find_and_modify:
ignore_dynamic: false
@@ -264,21 +252,3 @@
default: true
values:
advertise-dns: true
# RDNSS (RFC 8106): advertise an IPv6 DNS server in RAs so dual-stack clients
# have an IPv6 resolver. Points at the router's per-VLAN IPv6 address; RouterOS
# DNS forwards to CoreDNS. No pref64 — NAT64 has been removed (see docs/coredns.md);
# AAAA suppression now happens in CoreDNS, no client-side translation needed.
- name: Configure IPv6 ND per-interface (RDNSS)
community.routeros.api_modify:
path: ipv6 nd
data:
# advertise-dns must be explicitly enabled — RouterOS creates new ND
# entries with advertise-dns=no, which suppresses the RDNSS option
# entirely even when a static dns= list is configured.
- interface: vlan2
advertise-dns: true
dns: 2001:470:61a3:9:ffff:ffff:ffff:ffff
- interface: vlan5
advertise-dns: true
dns: 2001:470:61a3:a:ffff:ffff:ffff:ffff
ansible/roles/routeros/tasks/containers.yml
+3 -10
View File
@@ -20,15 +20,15 @@
data:
- dst: /var/lib/tailscale
list: tailscale_state
src: /tailscale/state
src: tailscale/state
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
- name: Configure containers
- name: Configure tailscale container
community.routeros.api_modify:
path: container
data:
- dns: 172.20.0.1
- dns: 172.17.0.1
interface: veth-tailscale
logging: true
mountlists: tailscale_state
@@ -36,12 +36,5 @@
remote-image: gitea.lumpiasty.xyz/lumpiasty/mikrotik-tailscale:stable
root-dir: tailscale/root
start-on-boot: true
- dns: 172.20.0.1
interface: veth-coredns
logging: true
name: coredns
remote-image: gitea.lumpiasty.xyz/lumpiasty/coredns-mikrotik:latest
root-dir: coredns/root
start-on-boot: true
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
ansible/roles/routeros/tasks/firewall.yml
-59
View File
@@ -1,56 +1,8 @@
---
- name: Configure WAN connection marking
community.routeros.api_modify:
path: ip firewall mangle
data:
- action: mark-connection
chain: forward
connection-state: new
new-connection-mark: wan-gpon
out-interface: pppoe-gpon
passthrough: true
comment: Mark connections going out GPON
- action: mark-connection
chain: forward
connection-state: new
new-connection-mark: wan-lte
out-interface: vlan6
passthrough: true
comment: Mark connections going out LTE
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
ensure_order: true
- name: Configure IPv4 firewall filter rules
community.routeros.api_modify:
path: ip firewall filter
data:
- action: reject
chain: forward
connection-mark: wan-gpon
out-interface: vlan6
protocol: tcp
reject-with: tcp-reset
comment: Fast-fail TCP connections that shifted from GPON to LTE
- action: reject
chain: forward
connection-mark: wan-gpon
out-interface: vlan6
reject-with: icmp-network-unreachable
comment: Fast-fail non-TCP connections that shifted from GPON to LTE
- action: reject
chain: forward
connection-mark: wan-lte
out-interface: pppoe-gpon
protocol: tcp
reject-with: tcp-reset
comment: Fast-fail TCP connections that shifted from LTE to GPON
- action: reject
chain: forward
connection-mark: wan-lte
out-interface: pppoe-gpon
reject-with: icmp-network-unreachable
comment: Fast-fail non-TCP connections that shifted from LTE to GPON
- action: fasttrack-connection
chain: forward
connection-state: established,related
@@ -256,11 +208,6 @@
dst-port: 30033
out-interface: vlan4
protocol: tcp
- action: accept
chain: allow-ports
dst-port: 10011
out-interface: vlan4
protocol: tcp
- action: accept
chain: allow-ports
comment: Allow HTTP
@@ -320,12 +267,6 @@
dst-port: 30033
protocol: tcp
to-addresses: 10.44.0.0
- action: dst-nat
chain: dstnat
dst-address: 139.28.40.212
dst-port: 10011
protocol: tcp
to-addresses: 10.44.0.0
- action: src-nat
chain: srcnat
comment: src-nat from LAN to TS3 to some Greenland address
ansible/roles/routeros/tasks/routing.yml
+4 -34
View File
@@ -12,44 +12,15 @@
scope: 30
suppress-hw-offload: false
target-scope: 10
- comment: GPON Monitor 1
disabled: false
distance: 1
dst-address: 1.0.0.1/32
gateway: pppoe-gpon
routing-table: main
scope: 10
suppress-hw-offload: false
target-scope: 10
- comment: GPON Monitor 2
disabled: false
distance: 1
dst-address: 8.8.4.4/32
gateway: pppoe-gpon
routing-table: main
scope: 10
suppress-hw-offload: false
target-scope: 10
- comment: GPON Default 1
disabled: false
- disabled: false
distance: 1
dst-address: 0.0.0.0/0
gateway: 1.0.0.1
check-gateway: ping
gateway: pppoe-gpon
routing-table: main
scope: 30
suppress-hw-offload: false
target-scope: 11
- comment: GPON Default 2
disabled: false
distance: 2
dst-address: 0.0.0.0/0
gateway: 8.8.4.4
check-gateway: ping
routing-table: main
scope: 30
suppress-hw-offload: false
target-scope: 11
target-scope: 10
vrf-interface: pppoe-gpon
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
@@ -61,7 +32,6 @@
distance: 1
dst-address: 2000::/3
gateway: 2001:470:70:dd::1
check-gateway: ping
scope: 30
target-scope: 10
- comment: Tailnet
ansible/roles/routeros/tasks/wan.yml
+1 -8
View File
@@ -8,9 +8,7 @@
keepalive-timeout: 2
name: pppoe-gpon
password: "{{ routeros_pppoe_password }}"
# Using CoreDNS container with DNS64
use-peer-dns: false
add-default-route: false
use-peer-dns: true
user: "{{ routeros_pppoe_username }}"
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
@@ -39,10 +37,5 @@
mac-address: 7E:7E:A1:B1:2A:7B
name: veth-tailscale
comment: Tailscale container
- address: 172.20.0.3/24
dhcp: false
gateway: 172.20.0.1
name: veth-coredns
comment: CoreDNS container
handle_absent_entries: remove
handle_entries_content: remove_as_much_as_possible
apps/authentik/release.yaml
+1 -1
View File
@@ -18,7 +18,7 @@ spec:
chart:
spec:
chart: authentik
version: 2026.8.1
version: 2026.5.2
sourceRef:
kind: HelmRepository
name: authentik
apps/gitea/gitea-shared-volume.yaml
+3 -3
View File
@@ -7,7 +7,7 @@ metadata:
name: gitea-shared-storage-lvmhdd
namespace: openebs
spec:
capacity: "21474836480"
capacity: 10Gi
ownerNodeID: anapistula-delrosalae
shared: "yes"
thinProvision: "no"
@@ -20,7 +20,7 @@ metadata:
name: gitea-shared-storage-lvmhdd
spec:
capacity:
storage: 20Gi
storage: 10Gi
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
@@ -41,6 +41,6 @@ spec:
- ReadWriteOnce
resources:
requests:
storage: 20Gi
storage: 10Gi
storageClassName: hdd-lvmpv
volumeName: gitea-shared-storage-lvmhdd
apps/gitea/release.yaml
+1 -3
View File
@@ -17,15 +17,13 @@ spec:
chart:
spec:
chart: gitea
version: 12.7.0
version: 12.6.0
sourceRef:
kind: HelmRepository
name: gitea-charts
namespace: gitea
interval: 12h
values:
image:
tag: 1.27.2 # REMOVE ME after new helm chart version includes this update
postgresql-ha:
enabled: false
apps/gitea/valkey-volume.yaml
+3 -3
View File
@@ -7,7 +7,7 @@ metadata:
name: gitea-valkey-primary-lvmhdd-0
namespace: openebs
spec:
capacity: "4294967296"
capacity: 1Gi
ownerNodeID: anapistula-delrosalae
shared: "yes"
thinProvision: "no"
@@ -20,7 +20,7 @@ metadata:
name: gitea-valkey-primary-lvmhdd-0
spec:
capacity:
storage: 4Gi
storage: 1Gi
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
@@ -41,6 +41,6 @@ spec:
- ReadWriteOnce
resources:
requests:
storage: 4Gi
storage: 1Gi
storageClassName: hdd-lvmpv
volumeName: gitea-valkey-primary-lvmhdd-0
apps/immich/redis.yaml
+1 -1
View File
@@ -18,7 +18,7 @@ spec:
chart:
spec:
chart: valkey
version: 0.11.0
version: 0.9.4
sourceRef:
kind: HelmRepository
name: valkey
apps/immich/release.yaml
+1 -1
View File
@@ -18,7 +18,7 @@ spec:
chart:
spec:
chart: immich
version: 2.0.3
version: 1.2.6
sourceRef:
kind: HelmRepository
name: secustor
apps/ispeak3/service.yaml
-4
View File
@@ -15,10 +15,6 @@ spec:
protocol: TCP
port: 30033
targetPort: 30033
- name: rawquery
protocol: TCP
port: 10011
targetPort: 10011
type: LoadBalancer
externalTrafficPolicy: Local
ipFamilyPolicy: PreferDualStack
apps/kaneo/app-secret.yaml
-23
View File
@@ -1,23 +0,0 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: kaneo-app-secret
namespace: kaneo
spec:
type: kv-v2
mount: secret
path: kaneo
destination:
create: true
name: kaneo-app-secret
type: Opaque
transformation:
excludeRaw: true
templates:
auth_secret:
text: '{{ get .Secrets "auth_secret" }}'
vaultAuthRef: kaneo
apps/kaneo/kustomization.yaml
-1
View File
@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- app-secret.yaml
- oauth-secret.yaml
- postgres-volume.yaml
- postgres-cluster.yaml
apps/kaneo/release.yaml
+3 -5
View File
@@ -8,7 +8,7 @@ spec:
interval: 24h
url: https://github.com/usekaneo/kaneo.git
ref:
tag: v2.22.0
tag: v2.7.7
ignore: |
# exclude all
/*
@@ -53,13 +53,11 @@ spec:
enabled: false
kaneo:
image:
tag: "2.7.3" # renovate: depName=ghcr.io/usekaneo/kaneo registryUrl=https://ghcr.io
env:
clientUrl: "https://kaneo.lumpiasty.xyz"
disablePasswordRegistration: true
existingSecret:
enabled: true
name: kaneo-app-secret
key: auth_secret
database:
external:
enabled: true
apps/llama/configs/config.yaml
+272
View File
@@ -0,0 +1,272 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/mostlygeek/llama-swap/refs/heads/main/config-schema.json
healthCheckTimeout: 600
logToStdout: "both" # proxy and upstream
macros:
base_args: "--no-warmup --port ${PORT} --mlock --no-mmap"
common_args: "--fit-target 256 --no-warmup --port ${PORT} --no-mmap -tb 12 -t 6"
cpu_args: "--no-warmup --port ${PORT} -ngl 0"
ctx_64k: "--ctx-size 65536"
ctx_128k: "--ctx-size 131072"
ctx_256k: "--ctx-size 131072"
qwen35_think_args: "--temp 1.0 --top-p 0.95 --top-k 20 --min-p 0.00 -ctk q4_0 -ctv q4_0 --presence_penalty 1.5 --reasoning on"
qwen35_nothink_args: "--temp 0.7 --top-p 0.80 --top-k 20 --min-p 0.00 -ctk q4_0 -ctv q4_0 --presence_penalty 1.5 --reasoning off"
qwen35_35b_heretic_mmproj: "--mmproj-url https://huggingface.co/unsloth/Qwen3.5-35B-A3B-GGUF/resolve/main/mmproj-F16.gguf --mmproj /root/.cache/llama.cpp/unsloth_Qwen3.5-35B-A3B-GGUF_mmproj-F16.gguf"
qwen35_4b_heretic_mmproj: "--mmproj-url https://huggingface.co/unsloth/Qwen3.5-4B-GGUF/resolve/main/mmproj-F16.gguf --mmproj /root/.cache/llama.cpp/unsloth_Qwen3.5-4B-GGUF_mmproj-F16.gguf"
gemma4_sampling: "--temp 1.0 --top-p 0.95 --top-k 64 -ctk q4_0 -ctv q4_0"
hooks:
on_startup:
preload:
- "Qwen3.5-0.8B-GGUF-nothink:Q4_K_XL"
- "whisper-small"
# matrix replaces groups (they are mutually exclusive).
# The small 0.8B model runs alongside any LLM.
# FLUX runs alone — it needs all available VRAM and will evict the 0.8B first.
matrix:
vars:
q8: "Qwen3.5-0.8B-GGUF-nothink:Q4_K_XL"
stt: "whisper-small"
flux: "flux2-klein-4b:Q4_K_M"
coder: "Qwen3-Coder-Next-GGUF:Q4_K_M"
q35t: "Qwen3.5-35B-A3B-GGUF:Q4_K_M"
q35nt: "Qwen3.5-35B-A3B-GGUF-nothink:Q4_K_M"
q35ht: "Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M"
q35hnt: "Qwen3.5-35B-A3B-heretic-GGUF-nothink:Q4_K_M"
q4t: "Qwen3.5-4B-GGUF:Q4_K_M"
q4nt: "Qwen3.5-4B-GGUF-nothink:Q4_K_M"
q4ht: "Qwen3.5-4B-heretic-GGUF:Q4_K_M"
q4hnt: "Qwen3.5-4B-heretic-GGUF-nothink:Q4_K_M"
g26xl: "gemma-4-26B-A4B-it:UD-Q4_K_XL"
g26q2: "gemma-4-26B-A4B-it:UD-Q2_K_XL"
ge4xl: "unsloth/gemma-4-E4B-it-GGUF:UD-Q4_K_XL"
ge2xl: "unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL"
q36t: "unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL"
q36nt: "unsloth/Qwen3.6-35B-A3B-GGUF-nothink:UD-Q4_K_XL"
haut: "HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M"
haunt: "HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-nothink:Q4_K_M"
mtpt: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M"
mtpnt: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF-nothink:Q4_K_M"
evict_costs:
flux: 10 # large files, slow to reload
sets:
# any LLM can run alongside the small always-on model + STT + TTS (all CPU, no VRAM cost)
with_q8: "(coder | q35t | q35nt | q35ht | q35hnt | q4t | q4nt | q4ht | q4hnt | g26xl | g26q2 | ge4xl | ge2xl | q36t | q36nt | haut | haunt | mtpt | mtpnt) & q8 & stt"
# FLUX runs alone — evicts everything including q8, but keeps STT for voice during image gen
image_gen: "flux & stt"
models:
"Qwen3-Coder-Next-GGUF:Q4_K_M":
cmd: |
llama-server
-hf unsloth/Qwen3-Coder-Next-GGUF:Q4_K_M
--ctx-size 65536
--predict 8192
--temp 1.0
--min-p 0.01
--top-p 0.95
--top-k 40
--repeat-penalty 1.0
-ctk q4_0 -ctv q4_0
${common_args}
"Qwen3.5-35B-A3B-GGUF:Q4_K_M":
cmd: |
llama-server
-hf unsloth/Qwen3.5-35B-A3B-GGUF:Q4_K_M
${ctx_256k}
${qwen35_think_args}
${common_args}
"Qwen3.5-35B-A3B-GGUF-nothink:Q4_K_M":
cmd: |
llama-server
-hf unsloth/Qwen3.5-35B-A3B-GGUF:Q4_K_M
${ctx_256k}
${qwen35_nothink_args}
${common_args}
# The "heretic" version does not provide the mmproj
# so providing url to the one from the non-heretic version.
"Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M":
cmd: |
llama-server
-hf mradermacher/Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M
${qwen35_35b_heretic_mmproj}
${ctx_256k}
${qwen35_think_args}
${common_args}
"Qwen3.5-35B-A3B-heretic-GGUF-nothink:Q4_K_M":
cmd: |
llama-server
-hf mradermacher/Qwen3.5-35B-A3B-heretic-GGUF:Q4_K_M
${qwen35_35b_heretic_mmproj}
${ctx_256k}
${qwen35_nothink_args}
${common_args}
"Qwen3.5-0.8B-GGUF-nothink:Q4_K_XL":
cmd: |
llama-server
-hf unsloth/Qwen3.5-0.8B-GGUF:Q4_K_XL
--ctx-size 4096
${qwen35_nothink_args}
${base_args}
"Qwen3.5-4B-GGUF:Q4_K_M":
cmd: |
llama-server
-hf unsloth/Qwen3.5-4B-GGUF:Q4_K_M
${ctx_128k}
${qwen35_think_args}
${common_args}
"Qwen3.5-4B-GGUF-nothink:Q4_K_M":
cmd: |
llama-server
-hf unsloth/Qwen3.5-4B-GGUF:Q4_K_M
${ctx_128k}
${qwen35_nothink_args}
${common_args}
"Qwen3.5-4B-heretic-GGUF:Q4_K_M":
cmd: |
llama-server
-hf mradermacher/Qwen3.5-4B-heretic-GGUF:Q4_K_M
${qwen35_4b_heretic_mmproj}
${ctx_128k}
${qwen35_think_args}
${common_args}
"Qwen3.5-4B-heretic-GGUF-nothink:Q4_K_M":
cmd: |
llama-server
-hf mradermacher/Qwen3.5-4B-heretic-GGUF:Q4_K_M
${qwen35_4b_heretic_mmproj}
${ctx_128k}
${qwen35_nothink_args}
${common_args}
"gemma-4-26B-A4B-it:UD-Q4_K_XL":
cmd: |
llama-server
-hf unsloth/gemma-4-26B-A4B-it-GGUF:UD-Q4_K_XL \
${ctx_256k}
${gemma4_sampling}
${common_args}
"gemma-4-26B-A4B-it:UD-Q2_K_XL":
cmd: |
llama-server
-hf unsloth/gemma-4-26B-A4B-it-GGUF:UD-Q2_K_XL \
${ctx_256k}
${gemma4_sampling}
${common_args}
"unsloth/gemma-4-E4B-it-GGUF:UD-Q4_K_XL":
cmd: |
llama-server
-hf unsloth/gemma-4-E4B-it-GGUF:UD-Q4_K_XL \
${ctx_128k}
${gemma4_sampling}
${common_args}
"unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL":
cmd: |
llama-server
-hf unsloth/gemma-4-E2B-it-GGUF:UD-Q4_K_XL \
${ctx_128k}
${gemma4_sampling}
${common_args}
"unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL":
cmd: |
llama-server
-hf unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL
${ctx_256k}
${qwen35_think_args}
${common_args}
"unsloth/Qwen3.6-35B-A3B-GGUF-nothink:UD-Q4_K_XL":
cmd: |
llama-server
-hf unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL
${ctx_256k}
${qwen35_nothink_args}
${common_args}
"HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M":
cmd: |
llama-server
-hf HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M
${ctx_256k}
${qwen35_think_args}
${common_args}
"HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-nothink:Q4_K_M":
cmd: |
llama-server
-hf HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive:Q4_K_M
${ctx_256k}
${qwen35_nothink_args}
${common_args}
"unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M":
cmd: |
llama-server
-hf unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M
${ctx_256k}
${qwen35_think_args}
--spec-type draft-mtp --spec-draft-n-max 1
--parallel 1
${common_args}
"unsloth/Qwen3.6-35B-A3B-MTP-GGUF-nothink:Q4_K_M":
cmd: |
llama-server
-hf unsloth/Qwen3.6-35B-A3B-MTP-GGUF:Q4_K_M
${ctx_256k}
${qwen35_nothink_args}
--spec-type draft-mtp --spec-draft-n-max 1
--parallel 1
${common_args}
# STT via whisper.cpp (Vulkan GPU on RX 580, always loaded, ~600MB VRAM)
# Model auto-downloaded by init container, see deployment.yaml
# Note: Vulkan whisper on AMD GPUs has known quality issues on some cards;
# if transcriptions come out as garbage/gibberish, add --no-gpu to fall back.
"whisper-small":
checkEndpoint: none
cmd: |
whisper-server
--port ${PORT}
-m /root/.cache/whisper/ggml-small.bin
--request-path /v1/audio
--inference-path /transcriptions
--convert
--threads 6
# Image generation via stable-diffusion.cpp (sd-server)
# Models must be pre-downloaded to /root/.cache/sd/
# FLUX.2-klein-4B: fast unified text-to-image and image editing model (Apache 2.0)
# Download: uv run --with huggingface_hub hf download unsloth/FLUX.2-klein-4B-GGUF flux-2-klein-4b-Q4_K_M.gguf --local-dir /root/.cache/sd
# Download VAE: uv run --with huggingface_hub hf download Comfy-Org/flux2-klein-4B split_files/vae/flux2-vae.safetensors --local-dir /root/.cache/sd/flux2-klein && cp /root/.cache/sd/flux2-klein/split_files/vae/flux2-vae.safetensors /root/.cache/sd/
# Download LLM: uv run --with huggingface_hub hf download ponpoke/flux2-klein-4b-uncensored-text-encoder flux2-klein-4b-uncensored-q4_k_m.gguf --local-dir /root/.cache/sd
"flux2-klein-4b:Q4_K_M":
checkEndpoint: "/"
cmd: |
sd-server
--listen-port ${PORT}
--diffusion-model /root/.cache/sd/flux-2-klein-4b-Q4_K_M.gguf
--vae /root/.cache/sd/flux2-vae.safetensors
--llm /root/.cache/sd/flux2-klein-4b-uncensored-q4_k_m.gguf
--cfg-scale 1.0
--sampling-method euler
--steps 4
--diffusion-fa
--offload-to-cpu
apps/llama/deployment.yaml
+50 -7
View File
@@ -2,7 +2,7 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: supervisord
name: llama-swap
namespace: llama
spec:
replicas: 1
@@ -16,24 +16,64 @@ spec:
labels:
app: llama-swap
spec:
initContainers:
- name: download-whisper
image: ghcr.io/mostlygeek/llama-swap:unified-vulkan-2026-06-04
command:
- sh
- -c
- |
mkdir -p /root/.cache/whisper
if [ ! -f /root/.cache/whisper/ggml-small.bin ]; then
echo "Downloading whisper-small model..."
curl -L -o /root/.cache/whisper/ggml-small.bin \
https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-small.bin
else
echo "whisper-small model already present, skipping download"
fi
if [ ! -f /root/.cache/ffmpeg/ffmpeg ]; then
echo "Downloading static ffmpeg..."
mkdir -p /root/.cache/ffmpeg
apt-get update -qq && apt-get install -y --no-install-recommends xz-utils
curl -L -o /root/.cache/ffmpeg/ffmpeg.tar.xz \
https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-linux64-gpl.tar.xz
tar -xJf /root/.cache/ffmpeg/ffmpeg.tar.xz -C /root/.cache/ffmpeg --wildcards '*/ffmpeg' --strip-components=2
rm /root/.cache/ffmpeg/ffmpeg.tar.xz
chmod +x /root/.cache/ffmpeg/ffmpeg
else
echo "ffmpeg already present, skipping download"
fi
volumeMounts:
- name: models
mountPath: /root/.cache
containers:
- name: supervisord
image: gitea.lumpiasty.xyz/lumpiasty/supervisord:latest@sha256:2676d13df2a0833b27ab8ec441da78c6c43d3f7bf75837d35723eefb40a82ce1
- name: llama-swap
image: ghcr.io/mostlygeek/llama-swap:unified-vulkan-2026-06-04
imagePullPolicy: IfNotPresent
command:
- llama-swap
args:
- --config=/config/config.yaml
- --watch-config
env:
- name: RADV_EXPERIMENTAL
value: transfer_queue
ports:
- containerPort: 8080
name: http
protocol: TCP
env:
- name: WORKSPACE
value: /root
volumeMounts:
- name: models
mountPath: /root
mountPath: /root/.cache
- name: models
mountPath: /usr/local/bin/ffmpeg
subPath: ffmpeg/ffmpeg
- mountPath: /dev/kfd
name: kfd
- mountPath: /dev/dri
name: dri
- mountPath: /config
name: config
securityContext:
privileged: true
volumes:
@@ -48,6 +88,9 @@ spec:
hostPath:
path: /dev/dri
type: Directory
- name: config
configMap:
name: llama-swap
---
apiVersion: v1
kind: Service
apps/llama/kokoro.yaml
+1 -1
View File
@@ -21,7 +21,7 @@ spec:
# OpenAI-compatible Kokoro-FastAPI TTS server, CPU PyTorch backend.
# Models baked into the image (no PVC needed).
# v0.3.0 includes fix for per-request voice tensor memory leak (#459).
image: ghcr.io/remsky/kokoro-fastapi-cpu:v0.8.2
image: ghcr.io/remsky/kokoro-fastapi-cpu:v0.4.0
ports:
- containerPort: 8880
name: http
apps/llama/kustomization.yaml
+5
View File
@@ -8,3 +8,8 @@ resources:
- pvc-ssd.yaml
- deployment.yaml
- kokoro.yaml
configMapGenerator:
- name: llama-swap
namespace: llama
files:
- config.yaml=configs/config.yaml
apps/nas/deployment.yaml
+1 -1
View File
@@ -15,7 +15,7 @@ spec:
spec:
initContainers:
- name: prepare-home
image: alpine:3.24.1
image: alpine:3.23.4
imagePullPolicy: IfNotPresent
command:
- /bin/sh
apps/openwebui/release.yaml
+5 -3
View File
@@ -18,7 +18,7 @@ spec:
chart:
spec:
chart: open-webui
version: 16.5.0
version: 14.8.0
sourceRef:
kind: HelmRepository
name: open-webui
@@ -84,7 +84,7 @@ spec:
value: "Users"
- name: OAUTH_AUTO_REDIRECT
value: "true"
# STT via parakeet-server (routed through llama-swap)
# STT via whisper-server (routed through llama-swap)
- name: AUDIO_STT_ENGINE
value: "openai"
- name: AUDIO_STT_OPENAI_API_BASE_URL
@@ -92,7 +92,9 @@ spec:
- name: AUDIO_STT_OPENAI_API_KEY
value: "ignored"
- name: AUDIO_STT_MODEL
value: "parakeet-tdt_ctc-1.1b"
value: "whisper-small"
- name: AUDIO_STT_SUPPORTED_CONTENT_TYPES
value: "audio/wav,audio/wave"
# TTS via OuteTTS (routed through llama-swap)
# TTS via dedicated Kokoro server (CPU-only, separate pod)
- name: AUDIO_TTS_ENGINE
apps/woodpecker/release.yaml
+1 -1
View File
@@ -18,7 +18,7 @@ spec:
chart:
spec:
chart: woodpecker
version: 3.7.3
version: 3.6.4
sourceRef:
kind: HelmRepository
name: woodpecker
cluster/flux-system/gotk-components.yaml
+736 -391
View File
File diff suppressed because it is too large Load Diff
docker/coredns/Corefile
-53
View File
@@ -1,53 +0,0 @@
# CoreDNS as a plain forwarding resolver with selective AAAA suppression.
#
# Background: the ISP provides no native IPv6, only a Hurricane Electric tunnel.
# HE addresses are flagged as datacenter ranges by some sites (endless CAPTCHAs,
# bot detection). To avoid this, IPv6 (AAAA) resolution is suppressed by default
# so clients use IPv4, while a whitelist keeps AAAA for domains where native
# IPv6 is wanted (our own services reachable over the HE prefix, and any domain
# explicitly trusted over IPv6).
#
# NAT64/DNS64 was tried and removed: it forced most traffic through a userspace
# Tayga translator, capping throughput at ~250 Mbps on the RB-class CPU (line
# rate is 1 Gbps) and adding two containers as a SPOF — all to avoid IPv6 egress
# we don't want in the first place. Plain AAAA suppression achieves the same
# IPv4-preferred outcome with zero datapath overhead.
#
# TODO: replace the global template suppression + whitelist with a plugin that
# suppresses AAAA only when the domain has no A record (so IPv6-only
# destinations still work). No such in-tree plugin exists yet.
# Whitelist: domains that keep AAAA resolution (native IPv6 via HE tunnel).
(aaaa_allowed) {
forward . 1.1.1.1 8.8.8.8 {
prefer_udp
}
cache 300
errors
log . {
class error
}
}
# Our own zone: services have native IPv6 on the HE prefix, keep AAAA.
lumpiasty.xyz:53 {
import aaaa_allowed
}
# Default: forward everything, but suppress AAAA so clients use IPv4 and
# avoid the HE tunnel's datacenter-flagged egress.
.:53 {
template IN AAAA {
rcode NOERROR
}
forward . 1.1.1.1 8.8.8.8 {
prefer_udp
}
cache 300
errors
log . {
class error
}
reload
health :8080
}
docker/coredns/Dockerfile
-32
View File
@@ -1,32 +0,0 @@
# Stage 1: build CoreDNS with minimal plugin set
FROM golang:1.27-alpine AS build
RUN apk add --no-cache git make bash
WORKDIR /src
RUN git clone --depth 1 --branch v1.12.1 \
https://github.com/coredns/coredns .
# Overwrite plugin.cfg with our trimmed list before compilation
COPY plugin.cfg .
RUN go generate && make
# Stage 2: extract CA certificates from a full image
FROM debian:stable-slim AS certs
RUN apt-get update && apt-get install -y --no-install-recommends \
ca-certificates && rm -rf /var/lib/apt/lists/*
# Stage 3: minimal runtime — scratch + binary + certs only
FROM scratch
COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=build /src/coredns /coredns
COPY Corefile /Corefile
# 53: DNS (UDP + TCP)
# 8080: health endpoint
EXPOSE 53/udp 53/tcp 8080/tcp
# RouterOS requires root to bind port 53 — no USER directive
ENTRYPOINT ["/coredns", "-conf", "/Corefile"]
docker/coredns/plugin.cfg
-7
View File
@@ -1,7 +0,0 @@
errors:errors
log:log
health:health
template:template
cache:cache
forward:forward
reload:reload
docker/supervisord/Dockerfile
-15
View File
@@ -1,15 +0,0 @@
FROM debian:13.6
ENV DEBIAN_FRONTEND=noninteractive
RUN apt update && apt install -y --no-install-recommends\
curl wget vim \
ca-certificates \
build-essential cmake libvulkan-dev glslc spirv-headers libssl-dev git \
mesa-utils mesa-vulkan-drivers \
supervisor \
&& rm -rf /var/lib/apt/lists/*
ADD --chmod=755 entrypoint.sh /
ENTRYPOINT ["/entrypoint.sh"]
docker/supervisord/entrypoint.sh
-8
View File
@@ -1,8 +0,0 @@
#!/usr/bin/env bash
WORKSPACE="${WORKSPACE:-/workspace}"
CONF=$WORKSPACE/supervisord.conf
[[ -f "$CONF" ]] || (echo_supervisord_conf > $CONF )
exec supervisord -n -c $CONF "$@"
docs/coredns.md
-110
View File
@@ -1,110 +0,0 @@
# CoreDNS resolver
## Goal
Replace the RouterOS built-in DNS forwarder with a CoreDNS container for
configurability, and suppress IPv6 (AAAA) resolution by default to keep traffic
on IPv4.
## Background
The ISP provides no native IPv6 — only a Hurricane Electric (HE) tunnel
(`2001:470:61a3::/48`). HE addresses fall in ranges some sites flag as
datacenter/bot traffic, producing endless CAPTCHAs. The goal is to prefer IPv4
egress while keeping IPv6 available for our own services and any domain
explicitly trusted over IPv6.
## What this is NOT (and why)
An earlier iteration used **DNS64 + NAT64 (Tayga)** to force traffic through
IPv4. It was removed:
- **Performance**: Tayga is a userspace translator with no hardware offload.
Every translated packet crossed RouterOS twice (v6 in, v4 out) plus a
userspace hop, capping throughput at ~250 Mbps against a 1 Gbps line.
- **SPOF**: two containers (CoreDNS + Tayga) in the datapath of nearly all
traffic on a router whose native forwarder had been rock-solid.
- **Architectural inversion**: NAT64 exists to let IPv6-only clients reach IPv4.
We don't want IPv6 egress at all — using NAT64 to avoid IPv6 was solving the
problem backwards.
Plain AAAA suppression in CoreDNS achieves the same IPv4-preferred outcome with
zero datapath overhead — DNS is the only thing touched, packet forwarding stays
on the RouterOS fastpath at line rate.
The full account of the NAT64/IPv6-mostly attempt and why it was abandoned is in
[nat64-dns64-postmortem.md](./nat64-dns64-postmortem.md).
## How it works
CoreDNS runs as a single container (`172.20.0.3`), reachable from RouterOS DNS
which forwards client queries to it. The [Corefile](../mikrotik/coredns/Corefile)
has three server blocks:
1. **`lumpiasty.xyz`** — our own zone. Forwards normally, keeps AAAA, so internal
services reachable over the HE prefix resolve to their real IPv6 addresses.
2. **`.` (default)** — forwards everything else, but a `template IN AAAA` block
returns empty NOERROR for all AAAA queries, so clients fall back to IPv4 and
avoid the HE tunnel's flagged egress. A records and all other types pass
through untouched.
The whitelist is implemented as a reusable `(aaaa_allowed)` snippet imported by
zones that should keep AAAA. To trust another domain over IPv6, add a server
block for it that imports `aaaa_allowed`.
### Why suppression, not NXDOMAIN
The AAAA template returns NOERROR with an empty answer (NODATA), not NXDOMAIN.
This is correct: the name exists, it just has no (advertised) AAAA. Clients
treat it as "no IPv6 address" and use the A record. Returning NXDOMAIN would
wrongly imply the name doesn't exist and break the A lookup.
## Future improvement
The current global-suppress-plus-whitelist is coarse: a domain that is genuinely
IPv6-only (no A record) and not whitelisted becomes unreachable. The intended
end state is a plugin that suppresses AAAA only when the domain also has an A
record, so IPv6-only destinations keep working without manual whitelisting. No
in-tree CoreDNS plugin does this today.
## Custom image
Built from source with a minimal plugin set (`errors`, `log`, `health`,
`template`, `cache`, `forward`, `reload`) instead of the default ~40, producing
a ~6-8 MB image. The `dns64` plugin is no longer compiled in.
Source: [`mikrotik/coredns/`](../mikrotik/coredns/). Built by Woodpecker
([`.woodpecker/coredns-build.yaml`](../.woodpecker/coredns-build.yaml)) on pushes
touching `mikrotik/coredns/**`, pushed to `gitea.lumpiasty.xyz/lumpiasty/coredns-mikrotik`.
## RouterOS integration
- `/ip/dns servers=172.20.0.3` — RouterOS forwards client queries to CoreDNS
- RDNSS in RA (`/ipv6/nd dns=...` on vlan2/vlan5) advertises an IPv6 resolver
(the router's per-VLAN address) to dual-stack clients; RouterOS DNS relays to
CoreDNS
- No DHCP option 108, no PREF64 — those belonged to the removed IPv6-mostly setup
## Pitfalls learned (kept for reference)
These were hit during the NAT64 era and the migration; some still apply:
1. **RouterOS static FWD entries corrupt NXDOMAIN.** A `type=FWD match-subdomain=yes`
entry returns NOERROR/empty instead of relaying NXDOMAIN. Combined with
`ndots:5` and kubernetes pod search domains, `getaddrinfo` stops at the first
search-suffixed NODATA candidate and never tries the absolute name — apps fail
with `ENOTFOUND` for valid hostnames while `nslookup` (absolute query) works.
Our own zone is therefore handled in the Corefile, not via a RouterOS FWD
entry. RouterOS DNS does plain forwarding only (plus the Tailscale `ts.net`
FWD, which is acceptable as its subdomains genuinely don't exist publicly).
2. **`advertise-dns=no` on new ND entries.** RouterOS creates per-interface
`ipv6 nd` entries with `advertise-dns=no`, suppressing the RDNSS option even
when a static `dns=` list is set. Must be enabled explicitly.
3. **Per-interface ND entries must be created, not modified.** Only the
`interface=all` default ships out of the box; `api_find_and_modify` matching a
specific interface silently matches nothing. Use `api_modify`.
Verification: `rdisc6` (NixOS package `ndisc6`) dumps RA contents. The CoreDNS
`log` plugin output is visible via `/log print` on the router (container
`logging=yes`) and shows the rcode CoreDNS returned — comparing it to what the
client received isolates which hop corrupts a response.
docs/lte-failover-design.md
+7 -19
View File
@@ -84,10 +84,9 @@ subnets would fail routing lookup with "net unreachable" without it.
| Destination | Source | Distance | Active when |
|---|---|---|---|
| `1.0.0.1/32`, `8.8.4.4/32` | static via `pppoe-gpon` | 1 | always |
| `0.0.0.0/0` | static via `1.0.0.1`, `8.8.4.4` (recursive) | 1, 2 | GPON ping check succeeds |
| `0.0.0.0/0` | static via `pppoe-gpon` | 1 | GPON up |
| `0.0.0.0/0` | BGP from D-Link via `192.168.6.2` | 200 | wwan up on D-Link |
| `2000::/3` | static via `2001:470:70:dd::1` (HE tunnel) | 1 | HE tunnel ping check succeeds |
| `2000::/3` | static via `sit1` (HE tunnel) | 1 | sit1 active (HE tunnel works) |
| `2000::/3` | BGP from D-Link via `2001:470:61a3:600::2` | 200 | wwan up on D-Link |
RouterOS distance comparison is straightforward: distance 1 always wins
@@ -137,12 +136,11 @@ preferred route for D-Link's own traffic.
- **wwan modem goes down** → BIRD2 device protocol detects wwan0 down →
static `lte_default` / `lte_default6` become unreachable → BGP withdraws
announcements → CRS removes BGP-learned default
- **GPON drops or blackholes** → recursive ping checks (1.0.0.1, 8.8.4.4) over `pppoe-gpon`
fail (takes ~20s: 10s ping interval + 10s timeout) → CRS distance-1/2 default routes inactive → distance-200 BGP route
activates → CRS withdraws its default-originate announcement to D-Link (loop
prevention prevents reflecting D-Link's own route) → D-Link's kernel
default-via-CRS is removed → D-Link uses wwan kernel default → traffic flows
from CRS via vlan6 → D-Link → wwan
- **GPON drops** → `pppoe-gpon` interface down → CRS distance-1 default
route inactive → distance-200 BGP route activates → CRS withdraws its
default-originate announcement to D-Link (since no default is installed
any more) → D-Link's kernel default-via-CRS is removed → D-Link uses
wwan kernel default → traffic flows from CRS via vlan6 → D-Link → wwan
All transitions are automatic and driven by interface state. No active
probing (Netwatch / mwan3), no scripts toggling routes.
@@ -243,16 +241,6 @@ QMI initialization within ~1 second.
Full investigation: see [wwan-bm806c-qmi-workaround.md](./wwan-bm806c-qmi-workaround.md).
## Multi-WAN Stale Connection Tracking
When the routing table fails over from GPON to LTE (or vice versa), RouterOS does not automatically clear existing connection tracking entries. If an established TCP/UDP connection is routed out the new WAN interface, it retains the NAT translation state (source IP) of the old WAN interface. The packet is sent to the ISP with the wrong source IP and is silently dropped, causing clients (like Tailscale) to hang for minutes until their internal sockets time out.
To solve this purely declaratively without scripts or blanket connection flushes, the `forward` chain is configured to "fast-fail" these shifted connections:
1. Connections are marked with their egress WAN upon establishment (`wan-gpon` or `wan-lte`) via the `mangle` table.
2. If an established connection with a `wan-gpon` mark attempts to route out `vlan6` (LTE), or a `wan-lte` mark routes out `pppoe-gpon`, it is explicitly rejected (`tcp-reset` for TCP, `icmp-network-unreachable` for UDP) before reaching the NAT table.
3. This rejection immediately signals the client OS that the route is dead, forcing the application (Tailscale, SIP clients, etc.) to instantly close the socket and establish a new one, which successfully binds to the new WAN interface and NAT state.
## Implementation files
| File | Role |
docs/nat64-dns64-postmortem.md
-136
View File
@@ -1,136 +0,0 @@
# Postmortem: NAT64 / IPv6-mostly attempt
A record of an architecture that was built, run for ~2 days, and removed. Kept
so the reasoning isn't re-discovered the hard way. For the current DNS setup see
[coredns.md](./coredns.md); for network overview see [network.md](./network.md).
## The original problem
The ISP provides no native IPv6 — only a Hurricane Electric (HE) 6in4 tunnel
(`2001:470:61a3::/48`). HE address ranges are widely classified as
datacenter/hosting space, so some sites (Google, Cloudflare-fronted services,
various login flows) treat IPv6 traffic from them as bot/VPN traffic: endless
CAPTCHAs, "unusual traffic" interstitials, or outright blocks. IPv4 egress
(the ISP's residential PPPoE address) is unaffected.
The goal: keep using the network normally without IPv6 triggering these flags,
while still wanting some IPv6 (e.g. inbound to self-hosted services).
## What was built
An **IPv6-mostly** network (RFC 8925) with **DNS64 + NAT64**, intended to push
egress onto IPv4 while presenting IPv6 to clients:
- **CoreDNS container** with the `dns64` plugin (`translate_all`): synthesized
`64:ff9b::/96` AAAA records from A records for *all* names, so even dual-stack
destinations resolved to a NAT64 address.
- **Tayga container** (`ghcr.io/apalrd/tayga-nat64`): stateless NAT64 translator.
IPv6 traffic to `64:ff9b::/96` was routed to it, translated to IPv4, and
masqueraded out the GPON PPPoE interface. So all "IPv6" egress actually left
as IPv4 on the residential address — bypassing the HE tunnel and its flagging.
- **RouterOS RA + DHCP**: DHCP option 108 (IPv6-only preferred) to make capable
clients drop IPv4, PREF64 (RFC 8781) to advertise the NAT64 prefix for CLAT,
RDNSS (RFC 8106) to hand IPv6-only clients a resolver.
- Dedicated `nat64` bridge, `fc64::/126` link, `192.168.240.0/20` Tayga pool,
static routes, and firewall rules (including NAT64-mapped RFC1918 blocks to
prevent the translator being used as a policy bypass).
## Why it was removed
### 1. Performance — the dealbreaker
Throughput collapsed from line rate (~1 Gbps) to **~200-300 Mbps**, saturating
the router CPU. Causes, all structural:
- Tayga is a **userspace** translator. Every translated packet leaves the kernel
fastpath, is copied to userspace, translated, and re-injected.
- Translated traffic crosses RouterOS **twice** — once as IPv6 (LAN → Tayga),
once as IPv4 (Tayga → WAN, with masquerade) — doubling firewall/conntrack work.
- No hardware offload or fasttrack applies to either leg.
With `translate_all`, *nearly all* internet traffic went through this path, so
the penalty hit everything, not just IPv4-only destinations.
### 2. Single point of failure
DNS (CoreDNS) and most of the datapath (Tayga) became two containers in the
critical path on a router whose built-in forwarder had been completely reliable.
Container restarts, image pulls, or a crash now took down connectivity.
### 3. Architectural inversion
NAT64 exists to let **IPv6-only** clients reach the **IPv4** internet. The actual
goal here was the opposite — *avoid* IPv6 egress entirely. Building an IPv6-only
client environment (option 108, CLAT, PREF64) and then translating all of it back
to IPv4 was solving the problem backwards. The complexity existed only to route
around a property of the HE tunnel.
### 4. Firewall complexity and a translation bypass hole
NAT64 punched a hole in the firewall model. RouterOS filters IPv4 and IPv6
independently, but NAT64 traffic enters as IPv6 and *leaves* as IPv4 after
translation — so the carefully-built IPv4 forward policy (inter-VLAN isolation,
RFC1918-to-WAN blocks) was simply bypassed for anything arriving via the
translator. A client could reach a private IPv4 range by encoding it in the
NAT64 prefix (`64:ff9b::c0a8:xxyy` = `192.168.x.y`), and the IPv4 rules would
never see it because the packet was IPv6 until Tayga rewrote it.
Plugging this required mirroring the IPv4 policy in the IPv6 chain: explicit
`reject` rules for every NAT64-mapped RFC1918 block (`64:ff9b::a00:0/104`,
`64:ff9b::ac10:0/108`, `64:ff9b::c0a8:0/112`), per-VLAN accept rules toward the
`nat64` interface, plus a separate masquerade and LB hairpin-accept for the
Tayga pool. That is a parallel, easy-to-get-wrong copy of the existing ruleset,
whose correctness depended on getting CIDR-to-prefix arithmetic right. Removing
NAT64 deleted all of it.
### 5. Operational fragility (see coredns.md for detail)
The setup had a long tail of subtle failure modes, each presenting identically
as "client can't connect":
- RouterOS static `FWD` entries return `NOERROR`/empty instead of relaying
`NXDOMAIN`, which broke `getaddrinfo` search-domain handling in Kubernetes
pods (`ENOTFOUND` for valid names).
- `translate_all` discarded real AAAA for IPv6-only internal services, and
returned empty answers for names with no A record.
- Per-interface RouterOS `ipv6 nd` entries default to `advertise-dns=no` and must
be *created* (not modified), so RDNSS/PREF64 silently never advertised.
- Dynamic `from-pool` VLAN addressing made advertised RDNSS addresses point at
nonexistent router addresses.
- Option 108 honoured by clients before the NAT64 path was verified working left
them stuck "obtaining IP address".
Each was individually fixable, but the aggregate was a brittle system whose
benefit didn't justify the surface area.
## What replaced it
Plain CoreDNS forwarder with **AAAA suppression by default** plus a whitelist for
domains that should keep IPv6 (our own zone over the HE prefix, and any explicitly
trusted domain). Clients prefer IPv4 because they simply don't receive AAAA for
most names — no translation, no extra datapath hop, packet forwarding stays on the
RouterOS fastpath at line rate. DNS is the only thing in the path. See
[coredns.md](./coredns.md).
Tradeoff accepted: a non-whitelisted IPv6-only destination (no A record) is
unreachable. In practice essentially everything on the public internet still has
an A record. The intended future refinement is a CoreDNS plugin that suppresses
AAAA only when an A record also exists, removing the need for the whitelist; no
in-tree plugin does this today.
## Lessons
- **Measure throughput before committing to an in-path translator on SOHO-class
hardware.** Userspace NAT64 (Tayga/Jool-in-container) on a MikroTik CPU is
fine for a few hundred Mbps, not for saturating a gigabit line.
- **Match the mechanism to the actual goal.** The goal was "prefer IPv4 egress",
which is a one-line DNS policy, not a transition technology.
- **Prefer solutions that stay on the fastpath.** Anything that pulls bulk
traffic into userspace or doubles the forwarding work will dominate the CPU.
- **Fewer moving parts in the critical path.** Two containers carrying all DNS
and most traffic is a worse availability story than the stock forwarder, for a
cosmetic benefit (avoiding CAPTCHAs on some sites).
- **Protocol translation breaks the firewall model.** When traffic changes L3
protocol mid-path, the two firewall policies must be kept in sync by hand, and
any gap is a silent bypass. A solution that doesn't translate keeps a single
coherent policy.
docs/network.md
+3 -7
View File
@@ -50,7 +50,7 @@ Network is divided to multiple VLANs to enforce strict access control rules usin
Internet access only<br>
IP: 192.168.5.0/24 / 2001:470:61a3:a::/64<br>
Gateway: 192.168.5.1 / 2001:470:61a3:a:ffff:ffff:ffff:ffff<br>
DHCP / SLAAC, accessible via separate, hidden WiFi network "szafa" from D-Link with strict MAC filtering for absolutely untrusted Tuya and like devices
DHCP / SLAAC, accessible via separate WiFi network "szafa" from D-Link for absolutely untrusted Tuya and like devices
- 6: Internet access for OpenWRT<br>
Internet access only<br>
IP: 192.168.6.0/24 / 2001:470:61a3:600::/64<br>
@@ -93,8 +93,8 @@ There are also networks, which are not VLANs, but are routed:
Static assignment on CRS, access to factory IP of ONU
- Containers on CRS<br>
Access to every other network<br>
IP: 172.20.0.1/24, 2001:470:61a3:500::/64<br>
Static IP management, hosts Tailscale and CoreDNS containers
IP: 172.17.0.1/16, 2001:470:61a3:500::/64<br>
Static IP management
Whole network is designed to eliminate VLANs, overlays where unnecessary to keep things simple. Only NAT rules are:
@@ -105,10 +105,6 @@ Whole network is designed to eliminate VLANs, overlays where unnecessary to keep
Tailscale assigns IPv6 from private subnet with no way to configure it, so the assigned IPs are not routable
- IPv4 port forwards from GPON PPPoE to respective services
## DNS and IPv6 preference
DNS is served by a CoreDNS container (`172.20.0.3`); RouterOS forwards client queries to it. CoreDNS suppresses AAAA records by default so clients prefer IPv4, avoiding the HE tunnel's datacenter-flagged egress (which triggers CAPTCHAs on some sites). Our own zone (`lumpiasty.xyz`) and any explicitly whitelisted domains keep AAAA for native IPv6. See [CoreDNS resolver](./coredns.md). An earlier NAT64/IPv6-mostly approach to the same problem was built and abandoned; see the [postmortem](./nat64-dns64-postmortem.md).
There is also an UPnP and NAT-PMP enabled to automatically configure port forwards from LAN.
## Uplink
infra/configs/bgp-cluster-config.yaml
-1
View File
@@ -56,7 +56,6 @@ spec:
addresses:
# Not advertising ClusterIP - kubeproxyreplacement should? translate them directly to pod ips
# Not advertising ExternalIP - they should be reachable via static config
- ClusterIP
- LoadBalancerIP
selector:
matchExpressions:
infra/controllers/cert-manager-webhook-ovh.yaml
+1 -1
View File
@@ -18,7 +18,7 @@ spec:
chart:
spec:
chart: cert-manager-webhook-ovh
version: 0.9.16
version: 0.9.10
sourceRef:
kind: HelmRepository
name: cert-manager-webhook-ovh
infra/controllers/cert-manager.yaml
+1 -1
View File
@@ -23,7 +23,7 @@ spec:
chart:
spec:
chart: cert-manager
version: v1.21.1
version: v1.20.2
sourceRef:
kind: HelmRepository
name: cert-manager
infra/controllers/cilium.yaml
+1 -1
View File
@@ -23,7 +23,7 @@ spec:
chart:
spec:
chart: cilium
version: 1.20.1
version: 1.19.4
sourceRef:
kind: HelmRepository
name: cilium
infra/controllers/cloudnative-pg.yaml
+1 -1
View File
@@ -23,7 +23,7 @@ spec:
chart:
spec:
chart: cloudnative-pg
version: 0.29.0
version: 0.28.2
sourceRef:
kind: HelmRepository
name: cnpg
infra/controllers/coredns.yaml
+1 -1
View File
@@ -110,7 +110,7 @@ spec:
kubernetes.io/os: linux
containers:
- name: coredns
image: registry.k8s.io/coredns/coredns:v1.14.7
image: registry.k8s.io/coredns/coredns:v1.14.3
imagePullPolicy: IfNotPresent
args: ["-conf", "/etc/coredns/Corefile"]
ports:
infra/controllers/dns-public.yaml
+1 -1
View File
@@ -97,7 +97,7 @@ spec:
env:
- name: GOMEMLIMIT
value: 161MiB
image: registry.k8s.io/coredns/coredns:v1.14.7
image: registry.k8s.io/coredns/coredns:v1.14.3
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 5
infra/controllers/k8up.yaml
+1 -1
View File
@@ -23,7 +23,7 @@ spec:
chart:
spec:
chart: k8up
version: 4.10.0
version: 4.9.0
sourceRef:
kind: HelmRepository
name: k8up-io
infra/controllers/openbao.yaml
+1 -1
View File
@@ -23,7 +23,7 @@ spec:
chart:
spec:
chart: openbao
version: 0.29.4
version: 0.28.3
sourceRef:
kind: HelmRepository
name: openbao
infra/controllers/openebs.yaml
+1 -1
View File
@@ -23,7 +23,7 @@ spec:
chart:
spec:
chart: openebs
version: 4.5.1
version: 4.4.0
sourceRef:
kind: HelmRepository
name: openebs
infra/controllers/vault-secrets-operator.yaml
+1 -1
View File
@@ -23,7 +23,7 @@ spec:
chart:
spec:
chart: vault-secrets-operator
version: 1.5.1
version: 1.4.0
sourceRef:
kind: HelmRepository
name: hashicorp
mikrotik/README.md
-43
View File
@@ -1,43 +0,0 @@
# Mikrotik containers
RouterOS containers running on the CRS418 providing network services that
RouterOS cannot handle natively.
## CoreDNS
Replaces the built-in RouterOS DNS forwarder. Plain forwarding resolver with
selective AAAA suppression: AAAA is suppressed by default so clients prefer IPv4
(avoiding the HE tunnel's datacenter-flagged egress), while our own zone and any
whitelisted domains keep AAAA for native IPv6.
Source: [`coredns/`](coredns/). Image built by Woodpecker CI
([`.woodpecker/coredns-build.yaml`](../.woodpecker/coredns-build.yaml)), pushed to
`gitea.lumpiasty.xyz/lumpiasty/coredns-mikrotik`.
The Corefile is baked into the image — edit [`coredns/Corefile`](coredns/Corefile)
and push; the pipeline rebuilds and pushes a new image. Custom-built with a
minimal plugin set (~6-8 MB vs the official ~20 MB image) to fit the CRS flash.
See [docs/coredns.md](../docs/coredns.md) for design rationale, including why
the earlier NAT64/DNS64 approach was removed.
### Why not the official coredns/coredns image?
The official image ships ~40 plugins and weighs ~20 MB compressed. A custom build with the 7 plugins we actually need fits in ~6-8 MB — important for the CRS internal flash.
## Deployment
The router configuration (container definitions, veth interfaces, bridge ports,
DNS settings, firewall) is managed declaratively via Ansible, not by manual CLI
commands. See [`ansible/roles/routeros/`](../ansible/roles/routeros/) and run:
```sh
cd ansible && ansible-playbook playbooks/routeros.yml
```
Containers do not auto-start on first image pull; after the initial deploy,
start manually once (subsequent boots are handled by `start-on-boot=yes`):
```
/container/start [find name=coredns]
```
renovate.json
+1 -13
View File
@@ -11,18 +11,6 @@
]
},
"prHourlyLimit": 9,
"customManagers": [
{
"customType": "regex",
"fileMatch": [
"apps/.+\\.yaml$"
],
"matchStrings": [
"tag:\\s*[\"']?(?<currentValue>[^\"' \\n]+)[\"']?\\s*#\\s*renovate:\\s*(?:datasource=(?<datasource>[^\\s]+)\\s+)?depName=(?<depName>[^\\s]+)(?:\\s+registryUrl=(?<registryUrl>[^\\s]+))?"
],
"datasourceTemplate": "{{#if datasource}}{{{datasource}}}{{else}}docker{{/if}}"
}
],
"packageRules": [
{
"matchPackageNames": ["usekaneo/kaneo", "ghcr.io/usekaneo/kaneo"],
@@ -37,7 +25,7 @@
"platformAutomerge": true
},
{
"matchUpdateTypes": ["patch", "digest"],
"matchUpdateTypes": ["patch"],
"automerge": true,
"automergeType": "pr",
"platformAutomerge": true
talos/patches/anapistula-delrosalae.patch
-1
View File
@@ -28,4 +28,3 @@ machine:
# arrives too late. Work around using kernel args:
extraKernelArgs:
- amdgpu.runpm=1
- amdgpu.lockup_timeout=0,120000,0,0
vault/policy/kaneo.hcl
-4
View File
@@ -1,7 +1,3 @@
path "secret/data/authentik/kaneo" {
capabilities = ["read"]
}
path "secret/data/kaneo" {
capabilities = ["read"]
}