Skip to content

v0.7.0

Latest
Latest

Choose a tag to compare

View all tags
@AdamNowotny AdamNowotny released this 29 Sep 13:15
· 7 commits to main since this release
v0.7.0
1eee569
This commit was signed with the committer’s verified signature.
AdamNowotny Adam Nowotny
SSH Key Fingerprint: ksEhly44TTkTCZw3efsOByQf2EY2NL/Tji2gX8vSQ3I
Verified
Learn about vigilant mode.

Applications

Security

  • Pocket ID — OpenID Connect provider with passkey (passwordless) sign-in

IoT

  • Frigate — local NVR with realtime AI object detection
  • Mosquitto — MQTT broker for Frigate/Home Assistant
  • Matter — Matter controller for Home Assistant
  • OpenThread — Thread border router

Dev

  • Forgejo — self-hosted alternative to GitHub

Network

  • Zot — OCI registry with pull-through image cache

Features

Pocket ID Single Sign-On

Sign in to applications with a Pocket ID passkey instead of creating a separate account on every service.

Native OIDC authentication supported by: Beszel, DroppedNeedle, Grafana, Forgejo, Home Assistant, Immich, Jellyfin, Nextcloud, Open WebUI, RustFS, Technitium, Vaultwarden, Zot

Apps without OAuth support can:

  • be protected by Traefik OIDC (f.e. Longhorn UI)
  • receive profile information via forwarded request headers (Frigate)
  • appear in Pocket ID's My Apps as launcher tiles.

Use pocket-*.sh scripts to create OAuth client and generate <app>:auth/clientId and <app>:auth/clientSecret.
<app>:auth/groupMap is used to map roles to PocketID groups.

More information in pocket.md and individual component pages.

IoT

Communication and provisioning of devices based on Thread and Zigbee protocols. This allows home automation that is completely local and does not require any Google/Apple/Amazon hub device.

  • OpenThread border router - supports Home Assistant Connect ZBT-2
  • Matter server (matter.js) for Home Assistant, with WiFi and Bluetooth provisioning of devices
  • Frigate - video monitoring and AI detection (NVidia, AMD, Intel and Google Coral USB accelerator)
  • Mosquitto MQTT broker for Home Assistant/Frigate integration

Intel GPU

ollama and frigate support setting <app>:gpu=intel to use Intel integrated graphics. Nodes labeled automatically with orangelab/gpu-intel=true by NFD.

Development

Git repositories can be hosted on Forgejo, a GitHub alternative. Note: CI runners are not supported yet.

Build Docker images and push to Zot.
K3S can also be configured to use it as it's registry so all images used in the cluster will automatically be downloaded from upstream and cached.

Improvements

  • Email (SMTP): Consistent mail settings via <app>:smtp/* for Immich, Vaultwarden, Nextcloud, and Forgejo.
  • Core stack reference: Set orangelab:coreStackRef (organization/project/stack) in a module stack to inherit the core stack's custom domain and Longhorn backup policy.
  • Immich: OAuth, machine learning, and SMTP settings are now generated as a config file on every deployment instead of being configured in the UI.
  • Immich: Pin the container version instead of the release tag, fixing database migration errors during upgrades.
  • Bitcoin: Inline rpcauth lines so authentication works on Bitcoin Core (rpcauthfile is Knots-only).
  • Longhorn: Allow replicas to co-locate on a node so 3-replica volumes can rebuild when only two nodes are schedulable.

Repository Moved

The GitHub repository is now at OrangeLab-space/orange-lab (previously QC-Labs/orange-lab). Old URLs redirect, but update your git remote:

git remote set-url origin git@github.com:OrangeLab-space/orange-lab.git

⚠️ BREAKING CHANGES & UPGRADE ACTIONS

Secrets and Keys Must Be Set Before Deployment

These values were previously auto-generated. They are now required in config and must stay stable for restores:

Setting Stack Previous output path
prometheus:grafana/password core monitoring.grafanaPassword
rustfs:rootPassword core storage.rustfsUsers.admin
n8n:N8N_ENCRYPTION_KEY stacks/ai apps.n8n.encryptionKey
open-webui:WEBUI_SECRET_KEY stacks/ai apps["open-webui"].secretKey
nextcloud:adminPassword stacks/apps apps.nextcloud.users.admin
  • Action: Before upgrading, copy each deployed value into stack config. Run each block from the listed stack directory:
# core stack
pulumi config set prometheus:grafana/password "$(pulumi stack output --show-secrets --json | jq -r '.monitoring.grafanaPassword')" --secret
pulumi config set rustfs:rootPassword "$(pulumi stack output --show-secrets --json | jq -r '.storage.rustfsUsers.admin')" --secret

# stacks/ai
pulumi config set n8n:N8N_ENCRYPTION_KEY "$(pulumi stack output --show-secrets --json | jq -r '.apps.n8n.encryptionKey')" --secret
pulumi config set open-webui:WEBUI_SECRET_KEY "$(pulumi stack output --show-secrets --json | jq -r '.apps["open-webui"].secretKey')" --secret

# stacks/apps
pulumi config set nextcloud:adminPassword "$(pulumi stack output --show-secrets --json | jq -r '.apps.nextcloud.users.admin')" --secret

Without these values, logins and backup restores will not work.

Assets 2
Loading