Skip to content

Check-in — 2026-07-25

Managed SonarQube LXC plus Komodo multi-server for phoenix and sonarqube. Closes the long-open “Phoenix outside GitOps” gap from the July Komodo audit.

TL;DR

The unmanaged community-scripts SonarQube on Prox was destroyed and rebuilt as inventory-backed Ubuntu LXC 101 with compose in this repo and Traefik / Authentik on infra-services. Phoenix’s snowflake /opt/homelab is now a real git clone, and both LXCs run systemd Komodo periphery so deploy-infra can own their stacks after merge. Docs (including this journal) publish to Cloudflare Pages on push to main.

Phase status

Area Status Notes
Rogue SonarQube (helper script) Destroyed No migration / no vzdump (owner wipe)
Managed SonarQube LXC 101 Live 192.168.6.101, compose + Postgres, API UP
Traefik / Authentik edge Live sonarqube.infra.realemail.app → 302 SSO
Phoenix /opt/homelab Fixed Full clone; stack still healthy
Komodo periphery (phoenix + sonarqube) Installed Inbound TLS :8120; Servers land via Sync after merge
resources.toml multi-server In PR #126
Cloudflare Pages docs Pending merge Deploy Docs workflow on main when docs/** / mkdocs.yml change

What shipped

  • Inventory + generators for sonarqube (inventory/hosts/sonarqube.yaml)
  • services/sonarqube/ compose, SOPS env, backup tier-2, README
  • Traefik file provider services/traefik/config/dynamic/sonarqube.yml
  • Runbook komodo-connect-lxc-server.md (inbound [[server]] preferred; outbound onboarding-key alternate)
  • Komodo [[server]] / [[repo]] / [[stack]] for phoenix + sonarqube; deploy-infra pulls all three repos
  • Host docs + mkdocs nav for phoenix / sonarqube / LXC runbook

Known gaps / drift

  • Komodo UI will not show phoenix/sonarqube Servers OK until #126 merges and Sync / deploy-infra applies resources.toml
  • SonarQube LXC checkout is still on feature/sonarqube-managed-lxc until merge; then switch back to main
  • proxmox-scan.py --write-baseline was not refreshed (missing PVE_HOST on infra-services agent path) — reconcile when convenient
  • Default Sonar admin password not yet rotated; Authentik app entry may still need an owner click if forward-auth is incomplete for the new host rule

What remains

Item Owner Priority
Merge #126 Owner P0
Confirm phoenix + sonarqube Servers OK in Komodo; stacks reconcile Owner + Agent P0
Rotate Sonar admin password; Authentik provider if needed Owner P0
Point sonarqube (and phoenix if needed) /opt/homelab at main Agent P1
Refresh Prox scan baseline Agent P2
Komodo Alerter (still open from July audit) Owner P1

Mermaid: rogue helper → managed LXC + Komodo

flowchart LR
  rogue["Rogue LXC 101 community-scripts"] -->|destroy wipe| gone["Gone"]
  gone --> lxc["Managed Ubuntu LXC 101"]
  lxc --> compose["services/sonarqube compose"]
  compose --> edge["infra Traefik + Authentik"]
  phoenix["Phoenix LXC 124"] --> clone["Full /opt/homelab clone"]
  lxc --> peri["systemd periphery :8120"]
  phoenix --> peri
  peri --> core["Komodo Core"]
  core --> sync["resources.toml Sync after merge"]
  docs["docs/ + journal"] --> cf["Cloudflare Pages on main"]