Bastian de BylandClaude Opus 5
fb09a01c88
restorecon -Frv over the podman volumes tree descends into two SMB shares mounted inside it -- volumes/photos/immich and volumes/photos/storage, both from truenas -- so it was relabelling the entire remote photo library over the network, on a filesystem that cannot store SELinux xattrs at all. On 2026-08-28 that pinned CPU#0 at 100% system time and the kernel logged six escalating soft lockups: watchdog: BUG: soft lockup - CPU#0 stuck for 1423s! [restorecon:132780] New process creation starved, so sshd accepted connections and then hung during session setup, and the host needed a hard reboot. An earlier run the same day had already been SIGKILLed at 49s, which was the same bug surfacing quietly. -x keeps it on the local filesystem. Measured: 1,279,231 local files walked and relabelled in 29.2s, against never finishing before. The mounts are also x-systemd.automount, so merely walking into them triggers a mount -- there was never anything there to relabel. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Deploy Home
There's no place like home!
Just as Dorothy managed the simple task of clicking her heels together, the desire for an equally simple one-button push deployment was in my heart. Thus, this repository was made.
Ansible
Ansible, along with double encrypted secrets, deploys the necessary configurations to make the home fit for certain needs and desires. Namely, having access to my home from anywhere, securely, and a self-hosted CI server that easily ties into existing workflows.
Makefile
The makefile is primarily used as a wrapper script to ensure that necessary
files, such as the secret vault password file, are provisioned as part of this.
One such addition to the task is utilizing dependency pinning through the
utilization of Python's virtualenv to lock down the specific dependency
versions within the requirements.txt file. This, ideally, prevents any
deployment issues with dependency version woes (e.g. version conflicts, major
updates in newest versions, etc.)
| Target Name | Description |
|---|---|
lint |
(default) Runs yamllint and ansible-lint on all YAML files in ansible/ |
deploy |
Deploys everything, or only tasks specified in TAGS= environment variable |
check |
Runs deploy in a "dry-run", showing diff-style outputs on tasks indicating changes |
vault |
Opens the Ansible vault file for editing |