Auto-update README with current k8s applications

Generated by CI/CD workflow on 2025-11-07 14:35:22

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

.gitea/scripts/README-update-readme.md

@@ -0,0 +1,147 @@
+# Auto-Update README Workflow
+
+## Overview
+
+This workflow automatically updates the `README.md` file with the current list of ArgoCD applications based on the directory structure in `k8s/`.
+
+## How it works
+
+1. **Trigger**: Workflow runs automatically when changes are pushed to `k8s/**` paths
+2. **Scan**: Python script scans `k8s/` directory structure and finds all applications
+3. **Generate**: Creates README.md with badges for all found applications
+4. **Create PR**: If changes detected, creates a Merge Request for manual review
+
+## Files
+
+- `.gitea/workflows/update-readme.yaml` - GitHub Actions workflow
+- `.gitea/scripts/generate-readme.py` - Python script for README generation
+
+## Directory Structure
+
+The script expects the following k8s directory structure:
+
+```
+k8s/
+├── core/          # Core infrastructure applications
+│   ├── argocd/
+│   ├── authentik/
+│   └── ...
+├── apps/          # User applications
+│   ├── gitea/
+│   ├── immich/
+│   └── ...
+└── games/         # Game servers
+    ├── minecraft/
+    └── ...
+```
+
+Each subdirectory name becomes an application name in the README.
+
+## Required Secrets
+
+The workflow requires the following secrets to be configured in Gitea:
+
+| Secret | Description | Example |
+|--------|-------------|---------|
+| `GT_URL` | Gitea instance URL | `https://gt.hexor.cy` |
+| `GT_TOKEN` | Gitea API token with repo write access | `glpat-xxxxx...` |
+| `GT_OWNER` | Repository owner (username or org) | `ab` |
+| `GT_REPO` | Repository name | `homelab` |
+
+### How to create a Gitea Token
+
+1. Go to Settings → Applications → Generate New Token
+2. Give it a name like "README Update Bot"
+3. Select scopes: `repo` (Full control of repositories)
+4. Generate and copy the token
+5. Add it as a secret in repository settings
+
+## Badge Format
+
+Badges are generated using a predictable pattern:
+
+```markdown
+[![app-name](https://ag.hexor.cy/api/badge?name=app-name&revision=true)](https://ag.hexor.cy/applications/argocd/app-name)
+```
+
+This allows you to immediately see which applications are:
+- ✅ Healthy and synced (green badge)
+- ⚠️ Degraded or out of sync (yellow badge)
+- ❌ Unhealthy or failed (red badge)
+
+## Manual Trigger
+
+You can manually trigger the workflow from Gitea:
+
+1. Go to Actions tab
+2. Select "Auto-update README" workflow
+3. Click "Run workflow"
+4. Select branch and run
+
+## Example Output
+
+The generated README will look like:
+
+```markdown
+# homelab
+
+ArgoCD homelab project
+
+## ArgoCD Applications Status
+
+| Application | Status |
+| :--- | :---: |
+| **argocd** | [![argocd](https://ag.hexor.cy/api/badge?name=argocd&revision=true)](https://ag.hexor.cy/applications/argocd/argocd) |
+...
+```
+
+## Reviewing Pull Requests
+
+When the workflow creates a PR:
+
+1. Check the Actions tab for the workflow run details
+2. Review the PR in the Pull Requests tab
+3. Verify the application list matches your k8s/ structure
+4. Merge when ready
+
+The PR will include:
+- Updated application list
+- Timestamp of generation
+- Automatic commit message
+
+## Troubleshooting
+
+### No PR created
+
+- Check if there are actually changes in README.md
+- Verify secrets are configured correctly
+- Check workflow logs in Actions tab
+
+### Wrong applications listed
+
+- Verify k8s/ directory structure
+- Ensure folder names match expected application names
+- Check for hidden directories (starting with `.`)
+
+### Badge not loading
+
+- Verify ArgoCD badge API is accessible at `https://ag.hexor.cy`
+- Check application name matches ArgoCD application name
+- Ensure application exists in ArgoCD
+
+## Maintenance
+
+### Update badge URL
+
+If you need to change the badge URL pattern, edit:
+- `.gitea/scripts/generate-readme.py` - function `generate_badge_line()`
+
+### Change workflow trigger
+
+To modify when the workflow runs, edit:
+- `.gitea/workflows/update-readme.yaml` - `on:` section
+
+### Add new categories
+
+To add new categories (besides core/apps/games), edit:
+- `.gitea/scripts/generate-readme.py` - function `scan_k8s_directory()` and `generate_readme_content()`

.gitea/scripts/generate-readme.py

@@ -0,0 +1,161 @@
+#!/usr/bin/env python3
+"""
+Generate README.md with ArgoCD application status badges.
+Scans k8s/ directory structure to find all applications and generates badges for them.
+"""
+
+import os
+import sys
+from pathlib import Path
+from typing import Dict, List
+
+
+def scan_k8s_directory(k8s_path: str) -> Dict[str, List[str]]:
+    """
+    Scan k8s/ directory and return applications grouped by category.
+
+    Args:
+        k8s_path: Path to k8s directory
+
+    Returns:
+        Dictionary with categories as keys and lists of app names as values
+    """
+    apps_by_category = {
+        'core': [],
+        'apps': [],
+        'games': []
+    }
+
+    k8s_dir = Path(k8s_path)
+
+    for category in apps_by_category.keys():
+        category_path = k8s_dir / category
+        if category_path.exists() and category_path.is_dir():
+            # Get all subdirectories (each subdirectory is an app)
+            apps = [
+                d.name for d in category_path.iterdir()
+                if d.is_dir() and not d.name.startswith('.')
+            ]
+            apps_by_category[category] = sorted(apps)
+
+    return apps_by_category
+
+
+def generate_badge_line(app_name: str) -> str:
+    """
+    Generate markdown line with badge for an application.
+
+    Args:
+        app_name: Name of the application
+
+    Returns:
+        Markdown formatted string with badge
+    """
+    badge_url = f"https://ag.hexor.cy/api/badge?name={app_name}&revision=true"
+    app_url = f"https://ag.hexor.cy/applications/argocd/{app_name}"
+    return f"| **{app_name}** | [![{app_name}]({badge_url})]({app_url}) |"
+
+
+def generate_readme_content(apps_by_category: Dict[str, List[str]]) -> str:
+    """
+    Generate README.md content with all applications.
+
+    Args:
+        apps_by_category: Dictionary with apps grouped by category
+
+    Returns:
+        Complete README.md content
+    """
+    lines = [
+        "# homelab",
+        "",
+        "ArgoCD homelab project",
+        "",
+        "## ArgoCD Applications Status",
+        "",
+        "<table>",
+        "<tr>",
+        "<td valign=\"top\" width=\"50%\">",
+        "",
+        "### Core Applications",
+        "",
+        "| Application | Status |",
+        "| :--- | :---: |"
+    ]
+
+    # Add core applications
+    for app in apps_by_category.get('core', []):
+        lines.append(generate_badge_line(app))
+
+    lines.extend([
+        "",
+        "### Games",
+        "",
+        "| Application | Status |",
+        "| :--- | :---: |"
+    ])
+
+    # Add games
+    for app in apps_by_category.get('games', []):
+        lines.append(generate_badge_line(app))
+
+    lines.extend([
+        "</td>",
+        "<td valign=\"top\" width=\"50%\">",
+        "",
+        "### Applications",
+        "",
+        "| Application | Status |",
+        "| :--- | :---: |"
+    ])
+
+    # Add applications
+    for app in apps_by_category.get('apps', []):
+        lines.append(generate_badge_line(app))
+
+    lines.extend([
+        "",
+        "</td>",
+        "</tr>",
+        "</table>"
+    ])
+
+    return '\n'.join(lines) + '\n'
+
+
+def main():
+    if len(sys.argv) < 2:
+        print("Usage: generate-readme.py <k8s-directory> [output-file]")
+        print("Example: generate-readme.py k8s/ README.md")
+        sys.exit(1)
+
+    k8s_path = sys.argv[1]
+    output_file = sys.argv[2] if len(sys.argv) > 2 else "README.md"
+
+    if not os.path.exists(k8s_path):
+        print(f"Error: Directory {k8s_path} does not exist")
+        sys.exit(1)
+
+    print(f"📁 Scanning {k8s_path}...")
+    apps_by_category = scan_k8s_directory(k8s_path)
+
+    # Print statistics
+    total_apps = sum(len(apps) for apps in apps_by_category.values())
+    print(f"✅ Found {total_apps} applications:")
+    for category, apps in apps_by_category.items():
+        if apps:
+            print(f"   - {category}: {len(apps)} apps")
+
+    print(f"📝 Generating {output_file}...")
+    readme_content = generate_readme_content(apps_by_category)
+
+    with open(output_file, 'w', encoding='utf-8') as f:
+        f.write(readme_content)
+
+    print(f"✅ {output_file} generated successfully")
+    print(f"   Total lines: {len(readme_content.splitlines())}")
+    print(f"   File size: {len(readme_content)} bytes")
+
+
+if __name__ == "__main__":
+    main()

.gitea/workflows/update-readme.yaml

@@ -0,0 +1,164 @@
+name: 'Auto-update README'
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'k8s/**'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-readme:
+    name: 'Generate README and Create MR'
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+
+    - name: Configure Git
+      run: |
+        git config --global user.name "Gitea Actions Bot"
+        git config --global user.email "actions@gitea.local"
+
+    - name: Generate README
+      run: |
+        echo "📋 Starting README generation..."
+        python3 .gitea/scripts/generate-readme.py k8s/ README.md
+
+        if [ -f "README.md" ]; then
+          echo "✅ README generated successfully"
+          echo "📄 File size: $(wc -c < README.md) bytes"
+          echo "📄 Lines: $(wc -l < README.md)"
+        else
+          echo "❌ README not generated"
+          exit 1
+        fi
+
+    - name: Check for changes
+      id: check_changes
+      run: |
+        if git diff --quiet README.md; then
+          echo "No changes detected in README.md"
+          echo "has_changes=false" >> $GITHUB_OUTPUT
+        else
+          echo "Changes detected in README.md"
+          echo "has_changes=true" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Create Pull Request
+      if: steps.check_changes.outputs.has_changes == 'true'
+      run: |
+        # Set variables
+        GITEA_URL="${{ secrets.GT_URL }}"
+        GITEA_TOKEN="${{ secrets.GT_TOKEN }}"
+        GITEA_OWNER="${{ secrets.GT_OWNER }}"
+        GITEA_REPO="${{ secrets.GT_REPO }}"
+        BRANCH_NAME="auto-update-readme-$(date +%Y%m%d-%H%M%S)"
+
+        echo "🔍 Configuration:"
+        echo "GITEA_URL: ${GITEA_URL:-NOT SET}"
+        echo "GITEA_OWNER: ${GITEA_OWNER:-NOT SET}"
+        echo "GITEA_REPO: ${GITEA_REPO:-NOT SET}"
+        echo "BRANCH_NAME: $BRANCH_NAME"
+
+        # Create and push new branch
+        echo "🌿 Creating branch: $BRANCH_NAME"
+        git checkout -b "$BRANCH_NAME"
+        git add README.md
+        git commit -m "Auto-update README with current k8s applications" \
+                   -m "Generated by CI/CD workflow on $(date +%Y-%m-%d\ %H:%M:%S)" \
+                   -m "This PR updates the README.md file with the current list of applications found in the k8s/ directory structure."
+
+        # Push branch to remote
+        echo "📤 Pushing branch to remote..."
+        git push origin "$BRANCH_NAME"
+
+        # Create Pull Request using Gitea API
+        echo "🔀 Creating Pull Request..."
+
+        PR_TITLE="Auto-update README with k8s applications"
+
+        # Create PR body
+        cat > /tmp/pr_body.json <<EOF
+        {
+          "title": "$PR_TITLE",
+          "body": "This PR automatically updates README.md based on the current k8s/ directory structure.\n\n## Changes\n- Updated application list in README.md\n- Applications are now synced with k8s/ folders\n\n## Review\nPlease review and merge if everything looks correct.\n\n---\n🤖 This PR was automatically generated by CI/CD workflow\n⏰ Generated at: $(date '+%Y-%m-%d %H:%M:%S')",
+          "head": "$BRANCH_NAME",
+          "base": "main"
+        }
+        EOF
+
+        # Create PR via API
+        echo "Making API request to: $GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/pulls"
+        echo "Request body:"
+        cat /tmp/pr_body.json
+
+        RESPONSE=$(curl -s -w "\nHTTP_CODE:%{http_code}" -X POST \
+          -H "Authorization: token $GITEA_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d @/tmp/pr_body.json \
+          "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/pulls")
+
+        # Extract HTTP code and response body
+        HTTP_CODE=$(echo "$RESPONSE" | grep "HTTP_CODE:" | cut -d':' -f2)
+        RESPONSE_BODY=$(echo "$RESPONSE" | sed '/HTTP_CODE:/d')
+
+        echo "API Response (HTTP $HTTP_CODE):"
+        echo "$RESPONSE_BODY"
+
+        # Extract PR number and URL from response
+        PR_NUMBER=$(echo "$RESPONSE_BODY" | grep -o '"number":[0-9]*' | head -1 | cut -d':' -f2)
+
+        if [ -n "$PR_NUMBER" ] && [ "$HTTP_CODE" = "201" ]; then
+          echo "✅ Pull Request created successfully!"
+          echo "📝 PR #$PR_NUMBER"
+          echo "🔗 URL: $GITEA_URL/$GITEA_OWNER/$GITEA_REPO/pulls/$PR_NUMBER"
+
+          # Save PR info for summary
+          echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+          echo "pr_url=$GITEA_URL/$GITEA_OWNER/$GITEA_REPO/pulls/$PR_NUMBER" >> $GITHUB_OUTPUT
+        else
+          echo "⚠️ Failed to create Pull Request (HTTP $HTTP_CODE)"
+          echo "Response: $RESPONSE_BODY"
+
+          # Check if PR already exists
+          if echo "$RESPONSE_BODY" | grep -q "already exists"; then
+            echo "ℹ️ PR already exists for this branch"
+            exit 0
+          fi
+
+          exit 1
+        fi
+
+    - name: Summary
+      if: always()
+      run: |
+        echo "## 📊 README Update Summary" >> $GITHUB_STEP_SUMMARY
+
+        if [ -f "README.md" ]; then
+          echo "- ✅ README generated successfully" >> $GITHUB_STEP_SUMMARY
+
+          if [ "${{ steps.check_changes.outputs.has_changes }}" = "true" ]; then
+            echo "- ✅ Changes detected" >> $GITHUB_STEP_SUMMARY
+            echo "- ✅ Pull Request created" >> $GITHUB_STEP_SUMMARY
+
+            if [ -n "${{ steps.create_pr.outputs.pr_number }}" ]; then
+              echo "" >> $GITHUB_STEP_SUMMARY
+              echo "**PR:** [#${{ steps.create_pr.outputs.pr_number }}](${{ steps.create_pr.outputs.pr_url }})" >> $GITHUB_STEP_SUMMARY
+            fi
+          else
+            echo "- ℹ️ No changes detected - README already up to date" >> $GITHUB_STEP_SUMMARY
+          fi
+        else
+          echo "- ❌ README generation failed" >> $GITHUB_STEP_SUMMARY
+        fi
+
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "**Generated at:** $(date)" >> $GITHUB_STEP_SUMMARY

.gitignore

@@ -14,6 +14,8 @@ crash.*.log
 *.tfvars.json
 !*terraform.tfvars
 
+# claude ai
+.claude/
 # Ignore override files as they are usually used to override resources locally and so
 # are not checked in
 override.tf

README.md

@@ -16,10 +16,11 @@ ArgoCD homelab project
 | **authentik** | [![authentik](https://ag.hexor.cy/api/badge?name=authentik&revision=true)](https://ag.hexor.cy/applications/argocd/authentik) |
 | **cert-manager** | [![cert-manager](https://ag.hexor.cy/api/badge?name=cert-manager&revision=true)](https://ag.hexor.cy/applications/argocd/cert-manager) |
 | **external-secrets** | [![external-secrets](https://ag.hexor.cy/api/badge?name=external-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/external-secrets) |
-| **k3s-system-upgrade** | [![k3s-system-upgrade](https://ag.hexor.cy/api/badge?name=k3s-system-upgrade&revision=true)](https://ag.hexor.cy/applications/argocd/k3s-system-upgrade) |
+| **kube-system-custom** | [![kube-system-custom](https://ag.hexor.cy/api/badge?name=kube-system-custom&revision=true)](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
 | **kubernetes-dashboard** | [![kubernetes-dashboard](https://ag.hexor.cy/api/badge?name=kubernetes-dashboard&revision=true)](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
 | **postgresql** | [![postgresql](https://ag.hexor.cy/api/badge?name=postgresql&revision=true)](https://ag.hexor.cy/applications/argocd/postgresql) |
 | **prom-stack** | [![prom-stack](https://ag.hexor.cy/api/badge?name=prom-stack&revision=true)](https://ag.hexor.cy/applications/argocd/prom-stack) |
+| **system-upgrade** | [![system-upgrade](https://ag.hexor.cy/api/badge?name=system-upgrade&revision=true)](https://ag.hexor.cy/applications/argocd/system-upgrade) |
 
 ### Games
 
@@ -42,15 +43,18 @@ ArgoCD homelab project
 | **jellyfin** | [![jellyfin](https://ag.hexor.cy/api/badge?name=jellyfin&revision=true)](https://ag.hexor.cy/applications/argocd/jellyfin) |
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
+| **ollama** | [![ollama](https://ag.hexor.cy/api/badge?name=ollama&revision=true)](https://ag.hexor.cy/applications/argocd/ollama) |
 | **paperless** | [![paperless](https://ag.hexor.cy/api/badge?name=paperless&revision=true)](https://ag.hexor.cy/applications/argocd/paperless) |
+| **pasarguard** | [![pasarguard](https://ag.hexor.cy/api/badge?name=pasarguard&revision=true)](https://ag.hexor.cy/applications/argocd/pasarguard) |
 | **qbittorent-nas** | [![qbittorent-nas](https://ag.hexor.cy/api/badge?name=qbittorent-nas&revision=true)](https://ag.hexor.cy/applications/argocd/qbittorent-nas) |
 | **rustdesk** | [![rustdesk](https://ag.hexor.cy/api/badge?name=rustdesk&revision=true)](https://ag.hexor.cy/applications/argocd/rustdesk) |
 | **sonarr-stack** | [![sonarr-stack](https://ag.hexor.cy/api/badge?name=sonarr-stack&revision=true)](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
 | **stirling-pdf** | [![stirling-pdf](https://ag.hexor.cy/api/badge?name=stirling-pdf&revision=true)](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
 | **syncthing** | [![syncthing](https://ag.hexor.cy/api/badge?name=syncthing&revision=true)](https://ag.hexor.cy/applications/argocd/syncthing) |
+| **tg-bots** | [![tg-bots](https://ag.hexor.cy/api/badge?name=tg-bots&revision=true)](https://ag.hexor.cy/applications/argocd/tg-bots) |
 | **vaultwarden** | [![vaultwarden](https://ag.hexor.cy/api/badge?name=vaultwarden&revision=true)](https://ag.hexor.cy/applications/argocd/vaultwarden) |
 | **vpn** | [![vpn](https://ag.hexor.cy/api/badge?name=vpn&revision=true)](https://ag.hexor.cy/applications/argocd/vpn) |
 
 </td>
 </tr>
-</table>
+</table>

k8s/apps/ollama/app.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ollama
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: ollama
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/ollama
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+

k8s/apps/ollama/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+helmCharts:
+  - name: ollama
+    repo: https://otwld.github.io/ollama-helm/
+    version: 0.4.0
+    releaseName: ollama
+    namespace: ollama
+    valuesFile: ollama-values.yaml
+    includeCRDs: true

k8s/apps/ollama/ollama-values.yaml

@@ -0,0 +1,8 @@
+image:
+  repository: ollama/ollama
+  pullPolicy: Always
+  tag: "latest"
+nodeSelector:
+  kubernetes.io/hostname: master.tail2fe2d.ts.net
+ingress:
+    enabled: false

k8s/apps/pasarguard/certificate.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: pasarguard-tls
+  labels:
+    app: pasarguard
+spec:
+  secretName: pasarguard-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - ps.hexor.cy

k8s/apps/pasarguard/daemonset.yaml

@@ -97,6 +97,8 @@ spec:
         - name: init-uuid
           image: bitnami/kubectl:latest
           env:
+            - name: GODEBUG
+              value: "x509sha1=1"
             - name: NODE_NAME
               valueFrom:
                 fieldRef:
@@ -106,7 +108,7 @@ spec:
             - -c
             - |
               set -e
-
+              echo "Started"
               # NODE_NAME is already set via environment variable
               NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
 
@@ -180,25 +182,27 @@ spec:
                 echo "Certificate already exists"
               fi
 
-              # Wait for certificate to be ready (max 60 seconds)
+              # Wait for certificate to be ready
+              
               echo "Waiting for certificate to be ready..."
-              for i in {1..60}; do
+              for i in {1..600}; do
                 if kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" &>/dev/null; then
                   echo "Certificate secret is ready!"
                   break
                 fi
-                echo "Waiting for certificate... ($i/60)"
+                echo "Waiting for certificate... ($i/600)"
                 sleep 1
               done
 
               if ! kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" &>/dev/null; then
-                echo "WARNING: Certificate secret not ready after 60 seconds"
+                echo "WARNING: Certificate secret not ready after 600 seconds"
               else
                 # Extract certificate and key from secret to shared volume
                 echo "Extracting certificate and key..."
                 kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" -o jsonpath='{.data.tls\.crt}' | base64 -d > /shared/tls.crt
                 kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" -o jsonpath='{.data.tls\.key}' | base64 -d > /shared/tls.key
-                echo "Certificate and key extracted successfully"
+                echo "Certificate and key extracted successfully."
+                cat /shared/tls.crt
               fi
 
               # Create individual Service and Endpoints for this node
@@ -285,7 +289,7 @@ spec:
             - name: SERVICE_PROTOCOL
               value: "grpc"
             - name: DEBUG
-              value: "false"
+              value: "true"
             - name: SSL_CERT_FILE
               value: "/shared/tls.crt"
             - name: SSL_KEY_FILE
@@ -297,17 +301,15 @@ spec:
             - name: API_KEY
               value: "change-this-to-a-secure-uuid"
           livenessProbe:
-            httpGet:
+            tcpSocket:
               port: 62050
-              path: /health
             initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
             failureThreshold: 3
           readinessProbe:
-            httpGet:
+            tcpSocket:
               port: 62050
-              path: /health
             initialDelaySeconds: 10
             periodSeconds: 5
             timeoutSeconds: 3

k8s/apps/pasarguard/deployment.yaml

@@ -21,6 +21,17 @@ spec:
     spec:
       nodeSelector:
         kubernetes.io/hostname: master.tail2fe2d.ts.net
+      initContainers:
+        - name: download-template
+          image: busybox:latest
+          command:
+            - sh
+            - -c
+            - |
+              wget -O /templates/subscription/index.html https://github.com/PasarGuard/subscription-template/releases/latest/download/index.html
+          volumeMounts:
+            - name: subscription-template
+              mountPath: /templates/subscription
       containers:
         - name: pasarguard-web
           image: 'pasarguard/panel:v1.4.1'
@@ -29,14 +40,36 @@ spec:
             - secretRef:
                 name: pasarguard-secrets
           env:
-            - name: UVICORN_HOST 
+            - name: UVICORN_HOST
               value: "0.0.0.0"
-            - name: UVICORN_PORT 
+            - name: UVICORN_PORT
               value: "8000"
+            - name: DOCS
+              value: "true"
+            - name: UVICORN_SSL_CERTFILE
+              value: "/app/tls/tls.crt"
+            - name: UVICORN_SSL_KEYFILE
+              value: "/app/tls/tls.key"
+            - name: CUSTOM_TEMPLATES_DIRECTORY
+              value: "/code/app/templates/"
+            - name: SUBSCRIPTION_PAGE_TEMPLATE
+              value: "subscription/index.html"
           ports:
             - name: http
               containerPort: 8000
               protocol: TCP
+          volumeMounts:
+            - name: tls
+              mountPath: /app/tls
+              readOnly: true
+            - name: subscription-template
+              mountPath: /code/app/templates/subscription
+      volumes:
+        - name: tls
+          secret:
+            secretName: pasarguard-tls
+        - name: subscription-template
+          emptyDir: {}
 ---
 apiVersion: v1
 kind: Service

k8s/apps/pasarguard/kustomization.yaml

@@ -6,5 +6,6 @@ resources:
   - ./external-secrets.yaml
   - ./deployment.yaml
   - ./daemonset.yaml
+  - ./certificate.yaml
 
 

k8s/apps/tg-bots/app.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: tg-bots
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: tg-bots
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/tg-bots
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+

k8s/apps/tg-bots/desubot.yaml

@@ -0,0 +1,42 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: desubot
+  labels:
+    app: desubot
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  selector:
+    matchLabels:
+      app: desubot
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: desubot
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: home.homenet
+      containers:
+        - name: desubot
+          image: 'ultradesu/desubot:latest'
+          imagePullPolicy: Always
+          envFrom:
+            - secretRef:
+                name: desubot
+          env:
+            - name: RUST_LOG
+              value: "info"
+          volumeMounts:
+          - mountPath: /storage
+            name: storage
+      volumes:
+        - name: storage
+          nfs:
+            server: nas.homenet
+            path: /mnt/storage/Storage/k8s/desubot/
+            readOnly: false

k8s/apps/tg-bots/external-secrets.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: get-id-bot
+spec:
+  target:
+    name: get-id-bot
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        TELOXIDE_TOKEN: |-
+          {{ .token }}
+
+  data:
+    - secretKey: token
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 97bd0af9-54ab-429a-b060-09626525f4cd
+        property: fields[0].value
+
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: desubot
+spec:
+  target:
+    name: desubot
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        TELEGRAM_BOT_TOKEN: |-
+          {{ .token }}
+
+  data:
+    - secretKey: token
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 97bd0af9-54ab-429a-b060-09626525f4cd
+        property: fields[1].value

k8s/apps/tg-bots/get-id-bot.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: get-id-bot
+  labels:
+    app: get-id-bot
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  selector:
+    matchLabels:
+      app: get-id-bot
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: get-id-bot
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: get-id-bot
+          image: 'ghcr.io/house-of-vanity/get_id_bot:main'
+          imagePullPolicy: Always
+          envFrom:
+            - secretRef:
+                name: get-id-bot
+          env:
+            - name: RUST_LOG
+              value: "info"
+
+
+

k8s/apps/tg-bots/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - get-id-bot.yaml
+  - external-secrets.yaml
+  - desubot.yaml

k8s/core/authentik/values.yaml

@@ -38,7 +38,7 @@ server:
         - nas.hexor.cy       # TrueNAS Limassol
         - nc.hexor.cy        # NaxtCloud
         - of.hexor.cy        # Outfleet-v2
-        - k8s.hexor.cy    # k8s dashboard
+        - k8s.hexor.cy       # k8s dashboard
         - qbt.hexor.cy       # qBittorent for Jellyfin
         - prom.hexor.cy      # Prometheus
         - khm.hexor.cy       # Known Hosts keys Manager
@@ -46,6 +46,8 @@ server:
         - fm.hexor.cy        # Filemanager
         - minecraft.hexor.cy # Minecraft UI and server
         - pass.hexor.cy      # k8s-secret for openai
+        - ps.hexor.cy        # pasarguard UI
+        - ai.hexor.cy        # ollama API
       tls:
         - secretName: idm-tls
           hosts:

k8s/core/postgresql/nas.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: immich
 spec:
   capacity:
-    storage: 50Gi
+    storage: 55Gi
   accessModes:
     - ReadWriteOnce
   persistentVolumeReclaimPolicy: Retain
@@ -79,14 +79,14 @@ spec:
         - CREATE EXTENSION IF NOT EXISTS earthdistance;
   
   storage:
-    size: 50Gi
+    size: 55Gi
     storageClass: nfs-storage
     pvcTemplate:
       accessModes:
         - ReadWriteOnce
       resources:
         requests:
-          storage: 50Gi
+          storage: 55Gi
       storageClassName: nfs-storage
       volumeMode: Filesystem
   

k8s/core/prom-stack/app.yaml

@@ -11,7 +11,7 @@ spec:
   source:
     repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
     targetRevision: HEAD
-    path: k8s/core/prometheus
+    path: k8s/core/prom-stack
   syncPolicy:
     automated:
       selfHeal: true

k8s/core/system-upgrade/app.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: k3s-system-upgrade
+  name: system-upgrade
   namespace: argocd
 spec:
   project: core

terraform/authentik/proxy-apps.tfvars

@@ -192,11 +192,13 @@ EOT
     slug                         = "pasarguard"
     group                        = "Tools"
     external_host                = "https://ps.hexor.cy"
-    internal_host                = "http://pasarguard.pasarguard.svc"
+    internal_host                = "https://pasarguard.pasarguard.svc:80"
     internal_host_ssl_validation = false
     meta_description             = ""
     skip_path_regex              = <<-EOT
 /sub/
+/dashboard/
+/
 EOT
     meta_icon                    = "https://img.icons8.com/?size=100&id=fqAD3lAB6zTe&format=png&color=000000"
     mode                         = "proxy"
@@ -204,5 +206,19 @@ EOT
     create_group                 = true
     access_groups                = ["admins"]
   }
+  "ollama" = {
+    name                         = "Ollama API"
+    slug                         = "ollama"
+    group                        = "Tools"
+    external_host                = "https://ai.hexor.cy"
+    internal_host                = "http://ollama.ollama.svc:11434"
+    internal_host_ssl_validation = false
+    meta_description             = "Ollama API"
+    meta_icon                    = "https://ollama.com/public/ollama.png"
+    mode                         = "proxy"
+    outpost                      = "kubernetes-outpost"
+    create_group                 = true
+    access_groups                = ["admins"]
+  }
 }