Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-02-11 19:37:43

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -45,6 +45,7 @@ ArgoCD homelab project
 | **jellyfin** | [![jellyfin](https://ag.hexor.cy/api/badge?name=jellyfin&revision=true)](https://ag.hexor.cy/applications/argocd/jellyfin) |
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
+| **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
 | **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |
 | **ollama** | [![ollama](https://ag.hexor.cy/api/badge?name=ollama&revision=true)](https://ag.hexor.cy/applications/argocd/ollama) |
 | **paperless** | [![paperless](https://ag.hexor.cy/api/badge?name=paperless&revision=true)](https://ag.hexor.cy/applications/argocd/paperless) |

k8s/apps/comfyui/app.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: comfyui
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: comfyui
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/comfyui
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true

k8s/apps/comfyui/deployment.yaml

@@ -1,57 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: comfyui
-  namespace: comfyui
-  labels:
-    app: comfyui
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: comfyui
-  template:
-    metadata:
-      labels:
-        app: comfyui
-    spec:
-      runtimeClassName: nvidia
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: desktop
-          effect: NoSchedule
-      nodeSelector:
-        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
-      # Fix permissions mismatch usually happening when mapping host paths
-      securityContext:
-        runAsUser: 0
-      initContainers:
-        - name: create-data-dir
-          image: busybox
-          command: ["sh", "-c", "mkdir -p /host.data && chown -R 1000:1000 /host.data"]
-          volumeMounts:
-            - name: data
-              mountPath: /host.data
-      containers:
-        - name: comfyui
-          image: runpod/comfyui:latest-5090
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: COMFYUI_PORT
-              value: "8188"
-          ports:
-            - containerPort: 8188
-              name: http
-              protocol: TCP
-          resources:
-            limits:
-              nvidia.com/gpu: 1
-          volumeMounts:
-            - name: data
-              # For ai-dock images, /workspace is the persistent user directory
-              mountPath: /workspace
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: comfyui-data-pvc

k8s/apps/comfyui/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - local-pv.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml

k8s/apps/comfyui/local-pv.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: comfyui-data-pv
-spec:
-  capacity:
-    storage: 200Gi
-  volumeMode: Filesystem
-  accessModes:
-  - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: local-path
-  local:
-    path: /data/comfyui
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-      - matchExpressions:
-        - key: kubernetes.io/hostname
-          operator: In
-          values:
-          - uk-desktop.tail2fe2d.ts.net

k8s/apps/comfyui/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: comfyui

k8s/apps/comfyui/pvc.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: comfyui-data-pvc
-  namespace: comfyui
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: local-path
-  resources:
-    requests:
-      storage: 200Gi

k8s/apps/comfyui/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: comfyui
-  namespace: comfyui
-  labels:
-    app: comfyui
-spec:
-  ports:
-    - name: http
-      port: 8188
-      targetPort: 8188
-      protocol: TCP
-  selector:
-    app: comfyui

k8s/apps/mtproxy/Dockerfile

@@ -1,32 +1,12 @@
-FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS builder
+FROM debian:bookworm-slim AS builder
-
-ARG TARGETARCH
 
 RUN apt-get update && apt-get install -y \
-    git curl make gcc libssl-dev zlib1g-dev \
+    git curl build-essential libssl-dev zlib1g-dev \
     && rm -rf /var/lib/apt/lists/*
 
-RUN if [ "$(dpkg --print-architecture)" != "$TARGETARCH" ]; then \
-      dpkg --add-architecture $TARGETARCH && \
-      apt-get update && \
-      case "$TARGETARCH" in \
-        arm64) apt-get install -y gcc-aarch64-linux-gnu libssl-dev:arm64 zlib1g-dev:arm64 ;; \
-        amd64) apt-get install -y gcc-x86-64-linux-gnu libssl-dev:amd64 zlib1g-dev:amd64 ;; \
-      esac && \
-      rm -rf /var/lib/apt/lists/*; \
-    fi
-
 RUN git clone https://github.com/TelegramMessenger/MTProxy.git /src
 WORKDIR /src
-
+RUN make -j$(nproc)
-RUN NATIVE=$(dpkg --print-architecture) && \
-    if [ "$NATIVE" != "$TARGETARCH" ]; then \
-      case "$TARGETARCH" in \
-        arm64) export CC=aarch64-linux-gnu-gcc ;; \
-        amd64) export CC=x86_64-linux-gnu-gcc ;; \
-      esac; \
-    fi && \
-    make -j$(nproc)
 
 FROM debian:bookworm-slim
 

k8s/apps/mtproxy/daemonset.yaml

@@ -44,16 +44,11 @@ spec:
                 secretKeyRef:
                   name: tgproxy-secret
                   key: PORT
-          volumeMounts:
-            - name: data
-              mountPath: /data
           command:
             - /bin/bash
             - -c
             - |
               set -e
-              curl -s https://core.telegram.org/getProxySecret -o /data/proxy-secret
-              curl -s https://core.telegram.org/getProxyConfig -o /data/proxy-multi.conf
               NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
               SERVER=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.mtproxy}')
               if [ -z "${SERVER}" ]; then
@@ -72,8 +67,7 @@ spec:
               echo "Done"
       containers:
         - name: mtproxy
-          image: telegrammessenger/proxy:latest
+          image: ultradesu/mtproxy:v0.02
-          # image: ultradesu/mtproxy:v0.02
           imagePullPolicy: Always
           ports:
             - name: proxy
@@ -89,8 +83,8 @@ spec:
               -H $(PORT)
               -M 1
               -S $(SECRET)
-              --aes-pwd /data/proxy-secret
+              --aes-pwd /etc/mtproxy/proxy-secret
-              /data/proxy-multi.conf
+              /etc/mtproxy/proxy-multi.conf
           env:
             - name: SECRET
               valueFrom:

k8s/apps/mtproxy/external-secrets.yaml

@@ -12,7 +12,7 @@ spec:
       data:
         SECRET: |-
           {{ .secret }}
-        PORT: "30443"
+        PORT: 30443
   data:
     - secretKey: secret
       sourceRef:

k8s/apps/mtproxy/kustomization.yaml

@@ -6,6 +6,5 @@ resources:
   - ./rbac.yaml
   - ./daemonset.yaml
   - ./external-secrets.yaml
-  - ./service.yaml
-  - ./secret-reader.yaml
 # - ./storage.yaml
+# - ./service.yaml

k8s/apps/mtproxy/secret-reader.yaml

@@ -1,63 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: secret-reader
-  labels:
-    app: secret-reader
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: secret-reader
-  template:
-    metadata:
-      labels:
-        app: secret-reader
-    spec:
-      serviceAccountName: mtproxy
-      nodeSelector:
-        kubernetes.io/os: linux
-      containers:
-      - name: secret-reader
-        image: ultradesu/k8s-secrets:0.2.1
-        imagePullPolicy: Always
-        args:
-          - "--secrets"
-          - "mtproxy-links"
-          - "--namespace"
-          - "mtproxy"
-          - "--port"
-          - "3000"
-        ports:
-        - containerPort: 3000
-          name: http
-        env:
-        - name: RUST_LOG
-          value: "info"
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "50m"
-          limits:
-            memory: "128Mi"
-            cpu: "150m"
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: http
-          initialDelaySeconds: 10
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: http
-          initialDelaySeconds: 5
-          periodSeconds: 5
-        securityContext:
-          runAsNonRoot: true
-          runAsUser: 1000
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          capabilities:
-            drop:
-            - ALL

k8s/apps/mtproxy/service.yaml

@@ -2,15 +2,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: secret-reader
+  name: mtproxy
-  labels:
-    app: secret-reader
 spec:
-  type: ClusterIP
+  type: LoadBalancer
   selector:
-    app: secret-reader
+    app: mtproxy
   ports:
-  - port: 80
+    - name: proxy
-    targetPort: 3000
+      port: 30443
-    protocol: TCP
+      targetPort: 30443
-    name: http
+      protocol: TCP
+      nodePort: 30443
+

k8s/apps/n8n/deployment-main.yaml

@@ -50,12 +50,10 @@ spec:
           runAsNonRoot: true
       containers:
       - name: n8n
-        image: n8nio/n8n:latest
+        image: docker.n8n.io/n8nio/n8n:latest
         ports:
         - containerPort: 5678
           name: http
-        - containerPort: 5679
-          name: task-broker
         env:
         - name: PATH
           value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
@@ -75,24 +73,14 @@ spec:
           value: "true"
         - name: N8N_RUNNERS_MODE
           value: "external"
-        - name: N8N_RUNNERS_BROKER_LISTEN_ADDRESS
-          value: "0.0.0.0"
-        - name: N8N_LISTEN_ADDRESS
-          value: "0.0.0.0"
-        - name: N8N_RUNNERS_BROKER_PORT
-          value: "5679"
         - name: EXECUTIONS_MODE
           value: "queue"
         - name: QUEUE_BULL_REDIS_HOST
           value: "n8n-redis"
-        - name: QUEUE_BULL_REDIS_PORT
-          value: "6379"
         - name: NODE_ENV
           value: "production"
         - name: WEBHOOK_URL
           value: "https://n8n.hexor.cy/"
-        - name: N8N_PROXY_HOPS
-          value: "1"
         - name: GENERIC_TIMEZONE
           value: "Europe/Moscow"
         - name: TZ
@@ -134,23 +122,23 @@ spec:
             memory: 512Mi
           limits:
             cpu: 4000m
-            memory: 2048Mi
+            memory: 2048Gi
         livenessProbe:
           httpGet:
             path: /healthz
             port: http
-          initialDelaySeconds: 240
+          initialDelaySeconds: 120
           periodSeconds: 30
-          timeoutSeconds: 20
+          timeoutSeconds: 10
-          failureThreshold: 10
+          failureThreshold: 6
         readinessProbe:
           httpGet:
             path: /healthz/readiness
             port: http
-          initialDelaySeconds: 120
+          initialDelaySeconds: 60
           periodSeconds: 10
           timeoutSeconds: 5
-          failureThreshold: 15
+          failureThreshold: 10
       volumes:
       - name: n8n-data
         persistentVolumeClaim:

k8s/apps/n8n/deployment-runner.yaml

@@ -1,87 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: n8n-runner
-  labels:
-    app: n8n
-    component: runner
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: n8n
-      component: runner
-  template:
-    metadata:
-      labels:
-        app: n8n
-        component: runner
-    spec:
-      serviceAccountName: n8n
-      containers:
-      - name: n8n-runner
-        image: n8nio/runners:latest
-        ports:
-        - containerPort: 5680
-          name: health
-        env:
-        - name: PATH
-          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-        - name: HOME
-          value: "/home/node"
-        - name: N8N_RUNNERS_TASK_BROKER_URI
-          value: "http://n8n:5679"
-        - name: N8N_RUNNERS_LAUNCHER_LOG_LEVEL
-          value: "info"
-        - name: N8N_RUNNERS_MAX_CONCURRENCY
-          value: "10"
-        - name: GENERIC_TIMEZONE
-          value: "Europe/Moscow"
-        - name: TZ
-          value: "Europe/Moscow"
-        - name: N8N_RUNNERS_AUTH_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: credentials
-              key: runnertoken
-        volumeMounts:
-        - name: n8n-data
-          mountPath: /home/node/.n8n
-        - name: tools
-          mountPath: /opt/tools
-        resources:
-          requests:
-            cpu: 500m
-            memory: 512Mi
-          limits:
-            cpu: 2000m
-            memory: 2048Mi
-        livenessProbe:
-          httpGet:
-            path: /healthz
-            port: 5680
-          initialDelaySeconds: 30
-          periodSeconds: 30
-          timeoutSeconds: 5
-          failureThreshold: 3
-        readinessProbe:
-          httpGet:
-            path: /healthz
-            port: 5680
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          timeoutSeconds: 5
-          failureThreshold: 3
-      volumes:
-      - name: n8n-data
-        persistentVolumeClaim:
-          claimName: n8n-data
-      - name: tools
-        persistentVolumeClaim:
-          claimName: n8n-tools
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        runAsNonRoot: true
-        fsGroup: 1000

k8s/apps/n8n/deployment-worker.yaml

@@ -21,21 +21,29 @@ spec:
       serviceAccountName: n8n
       containers:
       - name: n8n-worker
-        image: n8nio/n8n:latest
+        image: docker.n8n.io/n8nio/n8n:latest
-        command:
+        command: ["n8n", "worker"]
-        - n8n
-        - worker
         env:
+        - name: PATH
+          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
         - name: HOME
           value: "/home/node"
+        - name: NODES_EXCLUDE
+          value: "[]"
         - name: N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
           value: "true"
+        - name: N8N_RUNNERS_ENABLED
+          value: "true"
+        - name: N8N_RUNNERS_MODE
+          value: "external"
+        - name: N8N_PORT
+          value: "80"
         - name: EXECUTIONS_MODE
           value: "queue"
         - name: QUEUE_BULL_REDIS_HOST
           value: "n8n-redis"
-        - name: QUEUE_BULL_REDIS_PORT
+        - name: N8N_RUNNERS_TASK_BROKER_URI
-          value: "6379"
+          value: "http://n8n:80"
         - name: NODE_ENV
           value: "production"
         - name: GENERIC_TIMEZONE
@@ -63,20 +71,40 @@ spec:
             secretKeyRef:
               name: credentials
               key: encryptionkey
+        - name: N8N_RUNNERS_AUTH_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: credentials
+              key: runnertoken
         volumeMounts:
         - name: n8n-data
           mountPath: /home/node/.n8n
+        - name: tools
+          mountPath: /opt/tools
         resources:
           requests:
-            cpu: 500m
+            cpu: 2000m
             memory: 512Mi
           limits:
-            cpu: 2000m
+            cpu: 4000m
-            memory: 2048Mi
+            memory: 2048Gi
+        livenessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - "ps aux | grep '[n]8n worker' || exit 1"
+          initialDelaySeconds: 30
+          periodSeconds: 30
+          timeoutSeconds: 5
+          failureThreshold: 3
       volumes:
       - name: n8n-data
         persistentVolumeClaim:
           claimName: n8n-data
+      - name: tools
+        persistentVolumeClaim:
+          claimName: n8n-tools
       securityContext:
         runAsUser: 1000
         runAsGroup: 1000

k8s/apps/n8n/kustomization.yaml

@@ -7,11 +7,8 @@ resources:
   - rbac.yaml
   - redis-deployment.yaml
   - redis-service.yaml
-  - paddleocr-deployment.yaml
-  - paddleocr-service.yaml
   - deployment-main.yaml
   - deployment-worker.yaml
-  - deployment-runner.yaml
   - service.yaml
   - ingress.yaml
 

k8s/apps/n8n/paddleocr-deployment.yaml

@@ -1,43 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: paddleocr
-  labels:
-    app: paddleocr
-    component: n8n
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: paddleocr
-      component: n8n
-  template:
-    metadata:
-      labels:
-        app: paddleocr
-        component: n8n
-    spec:
-      containers:
-      - name: paddleocr
-        image: c403/paddleocr
-        ports:
-        - containerPort: 5000
-          name: http
-        resources:
-          requests:
-            cpu: 200m
-            memory: 512Mi
-          limits:
-            cpu: 1000m
-            memory: 2Gi
-        livenessProbe:
-          tcpSocket:
-            port: 5000
-          initialDelaySeconds: 60
-          periodSeconds: 30
-        readinessProbe:
-          tcpSocket:
-            port: 5000
-          initialDelaySeconds: 30
-          periodSeconds: 10

k8s/apps/n8n/paddleocr-service.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: paddleocr
-  labels:
-    app: paddleocr
-    component: n8n
-spec:
-  selector:
-    app: paddleocr
-    component: n8n
-  ports:
-  - name: http
-    port: 80
-    targetPort: 5000
-    protocol: TCP
-  type: ClusterIP

k8s/apps/n8n/service.yaml

@@ -14,8 +14,4 @@ spec:
     port: 80
     targetPort: 5678
     protocol: TCP
-  - name: task-broker
-    port: 5679
-    targetPort: 5679
-    protocol: TCP
   type: ClusterIP

k8s/apps/ollama/kustomization.yaml

@@ -3,23 +3,19 @@ kind: Kustomization
 
 resources:
   - external-secrets.yaml
-  - local-pv.yaml
   
 helmCharts:
   - name: ollama
     repo: https://otwld.github.io/ollama-helm/
-    version: 1.49.0
+    version: 0.4.0
     releaseName: ollama
     namespace: ollama
     valuesFile: ollama-values.yaml
     includeCRDs: true
   - name: open-webui
     repo: https://helm.openwebui.com/
-    version: 12.8.1
+    version: 8.14.0
     releaseName: openweb-ui
     namespace: ollama
     valuesFile: openweb-ui-values.yaml
-    includeCRDs: true
+    includeCRDs: true
-
-patches:
-  - path: patch-runtimeclass.yaml

k8s/apps/ollama/local-pv.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: ollama-local-pv
-spec:
-  capacity:
-    storage: 100Gi
-  volumeMode: Filesystem
-  accessModes:
-  - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: local-path
-  local:
-    path: /var/lib/ollama
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-      - matchExpressions:
-        - key: kubernetes.io/hostname
-          operator: In
-          values:
-          - uk-desktop.tail2fe2d.ts.net

k8s/apps/ollama/ollama-values.yaml

@@ -3,20 +3,6 @@ image:
   pullPolicy: Always
   tag: "latest"
 nodeSelector:
-  kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
+  kubernetes.io/hostname: master.tail2fe2d.ts.net
-tolerations:
-  - key: workload
-    operator: Equal
-    value: desktop
-    effect: NoSchedule
 ingress:
     enabled: false
-ollama:
-  gpu:
-    enabled: true
-    type: 'nvidia'
-    number: 1
-persistentVolume:
-  enabled: true
-  size: 100Gi
-  storageClass: "local-path"

k8s/apps/ollama/openweb-ui-values.yaml

@@ -1,4 +1,4 @@
-clusterDomain: cluster.local
+clusterDomain: ai.hexor.cy
 
 extraEnvVars:
   GLOBAL_LOG_LEVEL: debug
@@ -32,22 +32,12 @@ ollama:
         
 pipelines:
   enabled: true
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
   
 tika:
   enabled: true
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
   
 websocket:
   enabled: true
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
-  redis:
-    master:
-      nodeSelector:
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
 
 ingress:
     enabled: true
@@ -56,5 +46,7 @@ ingress:
       cert-manager.io/cluster-issuer: letsencrypt
       traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
     host: "ai.hexor.cy"
-    tls: true
+    tls:
-    existingSecret: ollama-tls
+      - hosts:
+          - '*.hexor.cy'
+        secretName: ollama-tls

k8s/apps/ollama/patch-runtimeclass.yaml

@@ -1,9 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ollama
-  namespace: ollama
-spec:
-  template:
-    spec:
-      runtimeClassName: nvidia

k8s/apps/paperless/paperless-values.yaml

@@ -1,5 +1,5 @@
 image:
-  tag: latest
+  tag: 2.20.3
 resources:
   requests:
     memory: "1Gi"
@@ -9,7 +9,7 @@ resources:
     cpu: "3000m"
 initContainers:
   install-tesseract-langs:
-    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    image: ghcr.io/paperless-ngx/paperless-ngx:2.18.2
     resources:
       requests:
         memory: "256Mi"

k8s/core/authentik/external-secrets.yaml

@@ -19,14 +19,6 @@ spec:
           {{ .password }}
         AUTHENTIK_SECRET_KEY: |-
           {{ .secret_key }}
-        POSTGRES_PASSWORD: |-
-          {{ .password }}
-        POSTGRES_USER: |-
-          {{ .username }}
-        username: |-
-          {{ .password }}
-        password: |-
-          {{ .username }}
   data:
     - secretKey: password
       sourceRef:

k8s/core/authentik/kustomization.yaml

@@ -5,12 +5,12 @@ resources:
   - app.yaml
   - external-secrets.yaml
   - https-middleware.yaml
-# - worker-restart.yaml
+  - worker-restart.yaml
 
 helmCharts:
   - name: authentik
     repo: https://charts.goauthentik.io
-    version: 2026.2.0
+    version: 2025.10.1
     releaseName: authentik
     namespace: authentik
     valuesFile: values.yaml

k8s/core/gpu/app.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: gpu-system
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: gpu-system
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/core/gpu
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true

k8s/core/gpu/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - runtime-class.yaml
-
-helmCharts:
-  - name: nvidia-device-plugin
-    repo: https://nvidia.github.io/k8s-device-plugin
-    version: 0.17.0
-    releaseName: nvidia-device-plugin
-    namespace: gpu-system
-    valuesFile: values.yaml
-    includeCRDs: true

k8s/core/gpu/runtime-class.yaml

@@ -1,5 +0,0 @@
-apiVersion: node.k8s.io/v1
-kind: RuntimeClass
-metadata:
-  name: nvidia
-handler: nvidia

k8s/core/gpu/values.yaml

@@ -1,23 +0,0 @@
-nodeSelector:
-  kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
-
-tolerations:
-  - key: workload
-    operator: Equal
-    value: desktop
-    effect: NoSchedule
-
-runtimeClassName: nvidia
-
-setAsDefault: false
-
-config:
-  default: any
-  map:
-    any: |-
-      version: v1
-      sharing:
-        timeSlicing:
-          resources:
-          - name: nvidia.com/gpu
-            replicas: 4

k8s/core/prom-stack/grafana-alerting-configmap.yaml

@@ -260,7 +260,7 @@ data:
                   to: 0
                 datasourceUid: P76F38748CEC837F0
                 model:
-                  expr: 'node_load15 / on(instance) group_left count by(instance)(node_cpu_seconds_total{mode="idle"})'
+                  expr: 'node_load5 / on(instance) group_left count by(instance)(node_cpu_seconds_total{mode="idle"})'
                   refId: A
                   intervalMs: 1000
                   maxDataPoints: 43200
@@ -273,7 +273,7 @@ data:
                   conditions:
                     - evaluator:
                         params:
-                          - 2
+                          - 0.8
                         type: gt
                       operator:
                         type: and
@@ -283,16 +283,16 @@ data:
                     type: __expr__
                     uid: __expr__
                   expression: A
-                  reducer: last
+                  reducer: max
                   refId: B
                   type: reduce
             noDataState: NoData
             execErrState: Alerting
-            for: 15m
+            for: 5m
             annotations:
               node: '{{ $labels.instance }}'
               load_average: '{{ printf "%.2f" $values.A }}'
-              summary: 'Node load average is critically high relative to CPU count'
+              summary: 'Node load average is high relative to CPU count'
             labels:
               severity: warning
 

k8s/core/prom-stack/grafana-values.yaml

@@ -0,0 +1,85 @@
+envFromSecret: grafana-admin
+nodeSelector:
+  kubernetes.io/hostname: master.tail2fe2d.ts.net
+
+admin:
+  existingSecret: grafana-admin
+  userKey: username
+  passwordKey: password
+
+grafana.ini:
+  auth:
+    signout_redirect_url: https://idm.hexor.cy/application/o/grafana/end-session/
+    # oauth_auto_login: true
+  auth.generic_oauth:
+    name: authentik
+    enabled: true
+    scopes: "openid profile email"
+    auth_url: https://idm.hexor.cy/application/o/authorize/
+    token_url: https://idm.hexor.cy/application/o/token/
+    api_url: https://idm.hexor.cy/application/o/userinfo/
+    role_attribute_path: >-
+      contains(groups, 'Grafana Admin') && 'Admin' ||
+      contains(groups, 'Grafana Editors') && 'Editor' ||
+      contains(groups, 'Grafana Viewer') && 'Viewer'
+  database:
+    type: postgres
+    host: psql.psql.svc:5432
+    name: grafana
+    user: grafana
+    ssl_mode: disable
+
+datasources:
+  datasources.yaml:
+    apiVersion: 1
+    datasources:
+      - name: Prometheus Local
+        type: prometheus
+        url: http://prometheus-kube-prometheus-prometheus.prometheus.svc:9090
+        access: proxy
+        isDefault: true
+      - name: Loki
+        type: loki
+        url: http://loki-gateway.prometheus.svc:80
+        access: proxy
+
+ingress:
+  enabled: true
+  ingressClassName: traefik
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+  hosts:
+    - gf.hexor.cy
+  tls:
+    - secretName: grafana-tls
+      hosts:
+        - '*.hexor.cy'
+
+extraConfigmapMounts:
+  - name: grafana-alerting-rules
+    mountPath: /etc/grafana/provisioning/alerting/rules.yaml
+    configMap: grafana-alerting
+    subPath: rules.yaml
+    readOnly: true
+  - name: grafana-alerting-contactpoints
+    mountPath: /etc/grafana/provisioning/alerting/contactpoints.yaml
+    configMap: grafana-alerting
+    subPath: contactpoints.yaml
+    readOnly: true
+  - name: grafana-alerting-policies
+    mountPath: /etc/grafana/provisioning/alerting/policies.yaml
+    configMap: grafana-alerting
+    subPath: policies.yaml
+    readOnly: true
+
+envValueFrom:
+  TELEGRAM_BOT_TOKEN:
+    secretKeyRef:
+      name: grafana-telegram
+      key: bot-token
+  TELEGRAM_CHAT_ID:
+    secretKeyRef:
+      name: grafana-telegram
+      key: chat-id
+

k8s/core/prom-stack/kustomization.yaml

@@ -16,6 +16,14 @@ helmCharts:
     valuesFile: prom-values.yaml
     includeCRDs: true
 
+  - name: grafana
+    repo: https://grafana.github.io/helm-charts
+    version: 10.2.0
+    releaseName: grafana
+    namespace: prometheus
+    valuesFile: grafana-values.yaml
+    includeCRDs: true
+
   - name: loki
     repo: https://grafana.github.io/helm-charts
     version: 6.29.0

k8s/core/prom-stack/prom-values.yaml

@@ -1,4 +1,5 @@
-
+grafana:
+  enabled: false
 
 alertmanager:
   config:
@@ -91,83 +92,3 @@ prometheus:
             requests:
               storage: 400Gi
 
-grafana:
-  enabled: true
-  
-  envFromSecret: grafana-admin
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
-
-  admin:
-    existingSecret: grafana-admin
-    userKey: username
-    passwordKey: password
-
-  grafana.ini:
-    auth:
-      signout_redirect_url: https://idm.hexor.cy/application/o/grafana/end-session/
-    auth.generic_oauth:
-      name: authentik
-      enabled: true
-      scopes: "openid profile email"
-      auth_url: https://idm.hexor.cy/application/o/authorize/
-      token_url: https://idm.hexor.cy/application/o/token/
-      api_url: https://idm.hexor.cy/application/o/userinfo/
-      role_attribute_path: >-
-        contains(groups, 'Grafana Admin') && 'Admin' ||
-        contains(groups, 'Grafana Editors') && 'Editor' ||
-        contains(groups, 'Grafana Viewer') && 'Viewer'
-    database:
-      type: postgres
-      host: psql.psql.svc:5432
-      name: grafana
-      user: grafana
-      ssl_mode: disable
-
-  # The Loki datasource config needs to be preserved, 
-  # but instead of "datasources.datasources.yaml", we define it like this for the prometheus-stack chart:
-  additionalDataSources:
-    - name: Loki
-      type: loki
-      url: http://loki-gateway.prometheus.svc:80
-      access: proxy
-
-  ingress:
-    enabled: true
-    ingressClassName: traefik
-    annotations:
-      cert-manager.io/cluster-issuer: letsencrypt
-      traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    hosts:
-      - gf.hexor.cy
-    tls:
-      - secretName: grafana-tls
-        hosts:
-          - '*.hexor.cy'
-
-  extraConfigmapMounts:
-    - name: grafana-alerting-rules
-      mountPath: /etc/grafana/provisioning/alerting/rules.yaml
-      configMap: grafana-alerting
-      subPath: rules.yaml
-      readOnly: true
-    - name: grafana-alerting-contactpoints
-      mountPath: /etc/grafana/provisioning/alerting/contactpoints.yaml
-      configMap: grafana-alerting
-      subPath: contactpoints.yaml
-      readOnly: true
-    - name: grafana-alerting-policies
-      mountPath: /etc/grafana/provisioning/alerting/policies.yaml
-      configMap: grafana-alerting
-      subPath: policies.yaml
-      readOnly: true
-
-  envValueFrom:
-    TELEGRAM_BOT_TOKEN:
-      secretKeyRef:
-        name: grafana-telegram
-        key: bot-token
-    TELEGRAM_CHAT_ID:
-      secretKeyRef:
-        name: grafana-telegram
-        key: chat-id

terraform/authentik/proxy-apps.tfvars

@@ -60,23 +60,7 @@ EOT
     create_group                 = true
     access_groups                = ["admins"]
   }
-  "mtproxy-links" = {
+
-    name                         = "mtproxy-links"
-    slug                         = "mtproxy-links"
-    group                        = "Core"
-    external_host                = "https://proxy.hexor.cy"
-    internal_host                = "http://secret-reader.mtproxy.svc:80"
-    internal_host_ssl_validation = false
-    meta_description             = ""
-    skip_path_regex              = <<-EOT
-/webhook
-EOT
-    meta_icon                    = "https://img.icons8.com/ios-filled/50/password.png"
-    mode                         = "proxy"
-    outpost                      = "kubernetes-outpost"
-    create_group                 = true
-    access_groups                = ["admins"]
-  }
   # Tools applications
   "vpn" = {
     name                         = "VPN"