Auto-update README with current k8s applications

Generated by CI/CD workflow on 2025-12-23 01:09:08

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

k8s/apps/gitea/deployment.yaml

@@ -77,8 +77,8 @@ spec:
       labels:
         app: gitea-runner
     spec:
-      #nodeSelector:
+      nodeSelector:
-      #  kubernetes.io/hostname: home.homenet
+        kubernetes.io/hostname: home.homenet
       volumes:
         - name: docker-sock
           hostPath:
@@ -90,30 +90,27 @@ spec:
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 1
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - home.homenet
-          - weight: 2
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - master.tail2fe2d.ts.net
           - weight: 3
             preference:
               matchExpressions:
               - key: kubernetes.io/hostname
                 operator: In
                 values:
-                - it.tail2fe2d.ts.net
+                - home.homenet
-                - ch.tail2fe2d.ts.net
+          - weight: 1
-                - us.tail2fe2d.ts.net
+            preference:
-
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - master.tail2fe2d.ts.net
+          - weight: 2
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - nas.homenet
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
@@ -121,9 +118,7 @@ spec:
                 operator: In
                 values:
                 - home.homenet
-                - it.tail2fe2d.ts.net
+                - nas.homenet
-                - ch.tail2fe2d.ts.net
-                - us.tail2fe2d.ts.net
                 - master.tail2fe2d.ts.net
       containers:
         - name: gitea-runner

k8s/apps/k8s-secrets/deployment.yaml

@@ -19,7 +19,7 @@ spec:
         kubernetes.io/os: linux
       containers:
       - name: secret-reader
-        image: ultradesu/k8s-secrets:0.2.1
+        image: ultradesu/k8s-secrets:0.1.1
         imagePullPolicy: Always
         args:
           - "--secrets"
@@ -28,7 +28,6 @@ spec:
           - "k8s-secret"
           - "--port"
           - "3000"
-          - "--webhook"
         ports:
         - containerPort: 3000
           name: http

k8s/apps/xandikos/deployment.yaml

@@ -49,14 +49,14 @@ spec:
               cpu: "1000m"
           livenessProbe:
             httpGet:
-              path: /
+              path: /health
               port: 8081
             initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
           readinessProbe:
             httpGet:
-              path: /
+              path: /health
               port: 8081
             initialDelaySeconds: 10
             periodSeconds: 5

k8s/apps/xandikos/external-secrets.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mmdl-secrets
-spec:
-  target:
-    name: mmdl-secrets
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        DB_DIALECT: 'postgres'
-        DB_HOST: psql.psql.svc
-        DB_USER: mmdl
-        DB_NAME: mmdl
-        DB_PORT: "5432"
-        DB_PASS: |-
-          {{ .pg_pass }}
-        AES_PASSWORD: |-
-          {{ .pg_pass }}
-
-  data:
-    - secretKey: pg_pass
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[12].value

k8s/apps/xandikos/ingress.yaml

@@ -13,13 +13,6 @@ spec:
     - host: cal.hexor.cy
       http:
         paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: mmdl
-                port:
-                  number: 3000
           - path: /dav
             pathType: Prefix
             backend:

k8s/apps/xandikos/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 resources:
   - deployment.yaml
   - service.yaml
-  - mmdl-deployment.yaml
-  - mmdl-service.yaml
   - ingress.yaml
-  - external-secrets.yaml
+
 

k8s/apps/xandikos/mmdl-deployment.yaml

@@ -1,61 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mmdl
-  labels:
-    app: mmdl
-spec:
-  selector:
-    matchLabels:
-      app: mmdl
-  replicas: 1
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  template:
-    metadata:
-      labels:
-        app: mmdl
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
-      containers:
-        - name: mmdl
-          image: intriin/mmdl:latest
-          imagePullPolicy: Always
-          envFrom:
-            - secretRef:
-                name: mmdl-secrets
-          env:
-            - name: NEXTAUTH_URL
-              value: "https://cal.hexor.cy"
-            - name: CALDAV_SERVER_URL
-              value: "https://cal.hexor.cy/dav"
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "1000m"
-          livenessProbe:
-            httpGet:
-              path: /
-              port: 3000
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            timeoutSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /
-              port: 3000
-            initialDelaySeconds: 10
-            periodSeconds: 5
-            timeoutSeconds: 3
-          ports:
-            - name: http
-              containerPort: 3000
-              protocol: TCP

k8s/apps/xandikos/mmdl-service.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: mmdl
-spec:
-  selector:
-    app: mmdl
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 3000
-      protocol: TCP
-      targetPort: 3000

k8s/core/argocd/appprojects.yaml

@@ -47,20 +47,3 @@ spec:
     server: https://kubernetes.default.svc
   sourceRepos:
   - ssh://git@gt.hexor.cy:30022/ab/homelab.git
-
----
-apiVersion: argoproj.io/v1alpha1
-kind: AppProject
-metadata:
-  name: desktop
-  namespace: argocd
-spec:
-  clusterResourceWhitelist:
-  - group: '*'
-    kind: '*'
-  description: Hexor Home Lab Desktop Apps
-  destinations:
-  - namespace: '*'
-    server: https://kubernetes.default.svc
-  sourceRepos:
-  - ssh://git@gt.hexor.cy:30022/ab/homelab.git

k8s/core/argocd/values.yaml

@@ -99,9 +99,6 @@ server:
 # Repository Server
 repoServer:
   replicas: 1
-  livenessProbe:
-    timeoutSeconds: 10
-    periodSeconds: 60
   nodeSelector:
     kubernetes.io/hostname: master.tail2fe2d.ts.net
   # Add resources (requests/limits), PDB etc. if needed

k8s/core/postgresql/external-secrets.yaml

@@ -123,8 +123,6 @@ spec:
           {{ .remnawave }}
         USER_umami: |-
           {{ .umami }}
-        USER_mmdl: |-
-          {{ .mmdl }}
   data:
     - secretKey: authentik
       sourceRef:
@@ -247,14 +245,3 @@ spec:
         metadataPolicy: None
         key: 2a9deb39-ef22-433e-a1be-df1555625e22
         property: fields[11].value
-    - secretKey: mmdl
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[12].value

k8s/desktop/jellyfin/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: jellyfin-uk
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: jellyfin-uk
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/desktop/jellyfin
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-

k8s/desktop/jellyfin/kustomization.yaml

@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - qbittorent.yaml
-
-helmCharts:
-  - name: jellyfin
-    repo: https://utkuozdemir.org/helm-charts
-    version: 2.0.0
-    releaseName: jellyfin
-    namespace: jellyfin
-    valuesFile: values.yaml
-    includeCRDs: true
-

k8s/desktop/jellyfin/qbittorent.yaml

@@ -1,123 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vpn-creds
-spec:
-  target:
-    name: vpn-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        ss_link: |-
-          {{ .ss_link }}
-  data:
-    - secretKey: ss_link
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: cfee6f62-fb06-4a4c-b6d8-92da4908c65a
-        property: fields[0].value
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qbittorrent
-  labels:
-    app: qbittorrent
-  annotations:
-    reloader.stakater.com/auto: "true"
-spec:
-  selector:
-    matchLabels:
-      app: qbittorrent
-  replicas: 1
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  template:
-    metadata:
-      labels:
-        app: qbittorrent
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: desktop
-          effect: NoSchedule
-      volumes:
-        - name: config
-          hostPath:
-            path: /k8s/qbt-config
-            type: DirectoryOrCreate
-        - name: media
-          hostPath:
-            path: /k8s/media/downloads
-            type: DirectoryOrCreate
-      containers:
-        - name: qbittorrent
-          image: 'linuxserver/qbittorrent:latest'
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media
-              mountPath: /downloads
-        - name: shadowsocks-proxy
-          image: teddysun/shadowsocks-rust:latest
-          env:
-            - name: SS_LINK
-              valueFrom:
-                secretKeyRef:
-                  name: vpn-creds
-                  key: ss_link
-          command: ["/bin/bash", "-c", "rm /etc/shadowsocks-rust/config.json && sslocal --server-url $SS_LINK --local-addr 127.0.0.1:8081 -U --protocol http"]
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "300m"
-            limits:
-              memory: "128Mi"
-              cpu: "300m"
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent
-spec:
-  selector:
-    app: qbittorrent
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
-
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: jf-local-ingress
-  annotations:
-    ingressClassName: traefik
-spec:
-  rules:
-    - host: tr.uk
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: qbittorrent
-                port:
-                  number: 80

k8s/desktop/jellyfin/values.yaml

@@ -1,41 +0,0 @@
-image:
-  tag: 10.11.4
-resources:
-  requests:
-    memory: "2Gi"
-    cpu: "1000m"
-  limits:
-    memory: "8Gi"
-    cpu: "6000m"
-nodeSelector:
-  kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
-tolerations:
-  - key: workload
-    operator: Equal
-    value: desktop
-    effect: NoSchedule
-persistence:
-  config:
-    enabled: true
-    isPvc: false
-    customVolume:
-      hostPath:
-        path: /k8s/jellyfin
-        type: DirectoryOrCreate
-  data:
-    enabled: true
-    isPvc: false
-    customVolume:
-      hostPath:
-        path: /k8s/media/downloads
-        type: DirectoryOrCreate
-
-ingress:
-    enabled: true
-    className: traefik
-    hosts:
-      - host: jf.uk
-        paths:
-          - path: /
-            pathType: Prefix
-

k8s/desktop/khm/app.yaml

@@ -1,18 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: khm-client
-  namespace: argocd
-spec:
-  project: desktop
-  destination:
-    namespace: khm
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/desktop/khm
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true

k8s/desktop/khm/external-secrets.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: khm-client-creds
-spec:
-  target:
-    name: khm-client-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        USERNAME: |-
-          {{ .username }}
-        PASSWORD: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 19c06480-0814-4d1f-aa80-710105989188
-        property: login.username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 19c06480-0814-4d1f-aa80-710105989188
-        property: login.password

k8s/desktop/khm/khm-client-cronjob.yaml

@@ -1,69 +0,0 @@
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: khm-client
-  labels:
-    app: khm-client
-spec:
-  schedule: "15 * * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: khm-client
-        spec:
-          restartPolicy: OnFailure
-          hostNetwork: true
-          nodeSelector:
-            node-role.kubernetes.io/desktop: ""
-          tolerations:
-            - key: workload
-              operator: Equal
-              value: desktop
-              effect: NoSchedule
-          containers:
-            - name: khm-client
-              image: 'ultradesu/khm:latest'
-              imagePullPolicy: Always
-              securityContext:
-                privileged: false
-              resources:
-                requests:
-                  memory: "64Mi"
-                  cpu: "50m"
-                limits:
-                  memory: "256Mi"
-                  cpu: "200m"
-              command:
-                - /bin/sh
-                - -c
-                - |
-                  /usr/local/bin/khm \
-                    --known-hosts /host-ssh/known_hosts \
-                    --host https://khm.hexor.cy \
-                    --flow=private \
-                    --basic-auth="${USERNAME}:${PASSWORD}" \
-                    --in-place
-              env:
-                - name: USERNAME
-                  valueFrom:
-                    secretKeyRef:
-                      name: khm-client-creds
-                      key: USERNAME
-                - name: PASSWORD
-                  valueFrom:
-                    secretKeyRef:
-                      name: khm-client-creds
-                      key: PASSWORD
-              volumeMounts:
-                - name: known-hosts
-                  mountPath: /host-ssh/known_hosts
-          volumes:
-            - name: known-hosts
-              hostPath:
-                path: /home/ab/.ssh/known_hosts

k8s/desktop/khm/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - external-secrets.yaml
-  - khm-client-cronjob.yaml

terraform/authentik/proxy-apps.tfvars

@@ -51,9 +51,6 @@ proxy_applications = {
     internal_host                = "http://secret-reader.k8s-secret.svc:80"
     internal_host_ssl_validation = false
     meta_description             = ""
-    skip_path_regex              = <<-EOT
-/webhook
-EOT
     meta_icon                    = "https://img.icons8.com/ios-filled/50/password.png"
     mode                         = "proxy"
     outpost                      = "kubernetes-outpost"
@@ -199,7 +196,6 @@ EOT
     internal_host_ssl_validation = false
     meta_description             = ""
     skip_path_regex              = <<-EOT
-/
 /sub/
 /dashboard/
 /api/