Two self-hosted apps behind traefik, both keeping their state on the
GlusterFS volume that is mounted on every node:
- dashwise (home.wittyoneoff.com) is an all-in-one image running its web
server, a bundled PocketBase and valkey side by side. Only port 3000 is
published: the frontend resolves its backend as window.location.origin
and every PocketBase call is made server-side, so 8090 stays inside the
pod. It is on the service so the PocketBase admin UI can be reached with
kubectl port-forward.
- tududi (tududi.wittyoneoff.com) stores a SQLite database and user
uploads. Both are VOLUMEs in the image, so both are backed by the claim
-- as one volume mounted twice with subPath, because naming the same
claim as two volume entries wedges kubelet, which is what happened with
limesurvey.
Both images are pinned to tags that publish an arm64 manifest. dashwise
:latest and :stable are amd64 only and would not start on these nodes.
Namespaces and secrets are applied out of band, as with the other apps.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
unbound was bundled inside apps/pihole/ and invisible in the apps/
listing. Now apps/unbound/ (deployment + service + kustomization); it
stays in the pihole namespace, whose Namespace object remains owned by
apps/pihole. No resource changes — server-side dry-run clean (36
resources).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Captured 2026-07-26 from rpi-master (k3s v1.30.3) and cleaned of runtime
fields. Six apps as per-app kustomizations: vaultwarden, searxng,
home-assistant, nginx, pihole(+unbound), unified-streaming.
Intentional divergences from live state:
- pihole WEBPASSWORD and USP_LICENSE_KEY moved from inline plaintext env
to secretKeyRef (secrets gitignored; templates in secret.example.yaml)
- HA ingress defaultBackend fixed (pointed at nonexistent service)
- unifiedstreaming-svc kept as ClusterIP (LoadBalancer could never bind
port 80 behind svclb-traefik)
Validated against the live cluster with kubectl apply --dry-run=server:
no immutable-field conflicts; one-time kubectl replace procedure for the
two env->secretKeyRef migrations documented in README.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
jasonwitty