Auto-update README with current k8s applications

Generated by CI/CD workflow on 2025-11-24 16:40:09

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -48,6 +48,7 @@ ArgoCD homelab project
 | **paperless** | [![paperless](https://ag.hexor.cy/api/badge?name=paperless&revision=true)](https://ag.hexor.cy/applications/argocd/paperless) |
 | **pasarguard** | [![pasarguard](https://ag.hexor.cy/api/badge?name=pasarguard&revision=true)](https://ag.hexor.cy/applications/argocd/pasarguard) |
 | **qbittorent-nas** | [![qbittorent-nas](https://ag.hexor.cy/api/badge?name=qbittorent-nas&revision=true)](https://ag.hexor.cy/applications/argocd/qbittorent-nas) |
+| **remnawave** | [![remnawave](https://ag.hexor.cy/api/badge?name=remnawave&revision=true)](https://ag.hexor.cy/applications/argocd/remnawave) |
 | **rustdesk** | [![rustdesk](https://ag.hexor.cy/api/badge?name=rustdesk&revision=true)](https://ag.hexor.cy/applications/argocd/rustdesk) |
 | **sonarr-stack** | [![sonarr-stack](https://ag.hexor.cy/api/badge?name=sonarr-stack&revision=true)](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
 | **stirling-pdf** | [![stirling-pdf](https://ag.hexor.cy/api/badge?name=stirling-pdf&revision=true)](https://ag.hexor.cy/applications/argocd/stirling-pdf) |

k8s/apps/gitea/deployment.yaml

@@ -36,7 +36,7 @@ spec:
               cpu: "200m"
             limits:
               memory: "2Gi"
-              cpu: "1000m"
+              cpu: "1500m"
           env:
             - name: GITEA__service__REGISTER_MANUAL_CONFIRM
               value: "true"
@@ -129,7 +129,7 @@ spec:
               memory: "256Mi"
               ephemeral-storage: "1Gi"   # reserve ephemeral storage
             limits:
-              cpu: "2000m"
+              cpu: "3000m"
               memory: "4Gi"
               ephemeral-storage: "28Gi"   # hard cap for /data usage
           volumeMounts:

k8s/apps/gitea/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: gitea-runner-token
@@ -24,7 +24,7 @@ spec:
         property: login.password
 
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: gitea-recapcha-creds

k8s/apps/greece-notifier/deployment.yaml

@@ -30,7 +30,7 @@ spec:
               cpu: "100m"
               memory: "256Mi"
             limits:
-              cpu: "2000m"
+              cpu: "3000m"
               memory: "1Gi"
           volumeMounts:
             - name: data

k8s/apps/greece-notifier/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: greece-notifier-creds

k8s/apps/hexound/deployment.yaml

@@ -30,7 +30,7 @@ spec:
               cpu: "50m"
             limits:
               memory: "128Mi"
-              cpu: "200m"
+              cpu: "300m"
           command:
             - git
             - clone
@@ -49,7 +49,7 @@ spec:
               cpu: "50m"
             limits:
               memory: "256Mi"
-              cpu: "200m"
+              cpu: "300m"
           volumeMounts:
             - name: hexound-repo
               mountPath: /var/www/html

k8s/apps/immich/deployments.yaml

@@ -23,7 +23,7 @@ spec:
             cpu: "500m"
           limits:
             memory: "4Gi"
-            cpu: "2000m"
+            cpu: "3000m"
         ports:
         - containerPort: 2283
         env:
@@ -160,7 +160,7 @@ spec:
             cpu: "1000m"
           limits:
             memory: "8Gi"
-            cpu: "4000m"
+            cpu: "6000m"
         env:
         - name: TZ
           value: Asia/Nicosia
@@ -201,7 +201,7 @@ spec:
               cpu: "100m"
             limits:
               memory: "512Mi"
-              cpu: "500m"
+              cpu: "750m"
           readinessProbe:
             exec:
               command: ["redis-cli", "ping"]

k8s/apps/iperf3/daemonset.yaml

@@ -11,23 +11,61 @@ spec:
       labels:
         app: iperf3-server
     spec:
+      serviceAccountName: iperf3-server
       subdomain: iperf3
       initContainers:
-      - name: set-hostname
+      - name: create-service
-        image: busybox:1.35
+        image: bitnami/kubectl:latest
-        command: ['sh', '-c']
-        args:
-          - |
-            NODE_NAME=$(echo $NODE_NAME | cut -d'.' -f1 | tr '[:upper:]' '[:lower:]')
-            echo "iperf3-${NODE_NAME}" > /etc/hostname
-            hostname "iperf3-${NODE_NAME}"
-        securityContext:
-          privileged: true
         env:
         - name: NODE_NAME
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        command:
+          - /bin/bash
+          - -c
+          - |
+            # Clean node name for service name
+            NODE_CLEAN=$(echo "$NODE_NAME" | cut -d'.' -f1 | tr '[:upper:]' '[:lower:]' | tr '_' '-')
+            SERVICE_NAME="iperf3-${NODE_CLEAN}"
+            
+            # Create service for this pod
+            kubectl apply -f - <<EOF
+            apiVersion: v1
+            kind: Service
+            metadata:
+              name: ${SERVICE_NAME}
+              namespace: iperf3
+              labels:
+                app: iperf3-node-service
+                target-node: "${NODE_NAME}"
+            spec:
+              type: ClusterIP
+              ports:
+                - name: iperf3
+                  port: 5201
+                  protocol: TCP
+            ---
+            apiVersion: v1
+            kind: Endpoints
+            metadata:
+              name: ${SERVICE_NAME}
+              namespace: iperf3
+              labels:
+                app: iperf3-node-service
+                target-node: "${NODE_NAME}"
+            subsets:
+              - addresses:
+                  - ip: ${POD_IP}
+                ports:
+                  - name: iperf3
+                    port: 5201
+                    protocol: TCP
+            EOF
       containers:
       - name: iperf3-server
         image: networkstatic/iperf3:latest
@@ -40,15 +78,13 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        - name: HOSTNAME
-          value: $(NODE_NAME)
         resources:
           requests:
             memory: "64Mi"
             cpu: "100m"
           limits:
             memory: "256Mi"
-            cpu: "500m"
+            cpu: "750m"
       tolerations:
       - effect: NoSchedule
         operator: Exists

k8s/apps/iperf3/iperf3-exporter-daemonset.yaml

@@ -14,6 +14,58 @@ spec:
       labels:
         app: iperf3-exporter
     spec:
+      serviceAccountName: iperf3-server
+      initContainers:
+      - name: create-exporter-service
+        image: bitnami/kubectl:latest
+        env:
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        command:
+          - /bin/bash
+          - -c
+          - |
+            NODE_CLEAN=$(echo "$NODE_NAME" | cut -d'.' -f1 | tr '[:upper:]' '[:lower:]' | tr '_' '-')
+            SERVICE_NAME="iperf3-exporter-${NODE_CLEAN}"
+            
+            kubectl apply -f - <<EOF
+            apiVersion: v1
+            kind: Service
+            metadata:
+              name: ${SERVICE_NAME}
+              namespace: iperf3
+              labels:
+                app: iperf3-exporter-service
+                target-node: "${NODE_NAME}"
+            spec:
+              type: ClusterIP
+              ports:
+                - name: metrics
+                  port: 9579
+                  protocol: TCP
+            ---
+            apiVersion: v1
+            kind: Endpoints
+            metadata:
+              name: ${SERVICE_NAME}
+              namespace: iperf3
+              labels:
+                app: iperf3-exporter-service
+                target-node: "${NODE_NAME}"
+            subsets:
+              - addresses:
+                  - ip: ${POD_IP}
+                ports:
+                  - name: metrics
+                    port: 9579
+                    protocol: TCP
+            EOF
       containers:
       - name: iperf3-exporter
         image: ghcr.io/edgard/iperf3_exporter:1.2.2
@@ -27,7 +79,7 @@ spec:
             cpu: "50m"
           limits:
             memory: "128Mi"
-            cpu: "200m"
+            cpu: "300m"
         env:
         - name: NODE_NAME
           valueFrom:

k8s/apps/iperf3/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - rbac.yaml
   - daemonset.yaml
   - service-headless.yaml
   - iperf3-exporter-daemonset.yaml

k8s/apps/iperf3/rbac.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: iperf3-server
+  namespace: iperf3
+  labels:
+    app: iperf3-server
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: iperf3-service-manager
+  namespace: iperf3
+  labels:
+    app: iperf3-server
+rules:
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: iperf3-service-manager
+  namespace: iperf3
+  labels:
+    app: iperf3-server
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: iperf3-service-manager
+subjects:
+  - kind: ServiceAccount
+    name: iperf3-server
+    namespace: iperf3

k8s/apps/iperf3/servicemonitor.yaml

@@ -3,7 +3,6 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: iperf3-exporter
-  namespace: default
   labels:
     app: iperf3-exporter
     release: prometheus
@@ -17,21 +16,107 @@ spec:
       interval: 5m
       scrapeTimeout: 30s
       params:
-        duration:
+        target: ['iperf3-ch.iperf3.svc.cluster.local:5201']
-          - "10"
+        period: ['10s']
-        streams:
+        streams: ['4']
-          - "4"
       relabelings:
-        - sourceLabels: [__address__]
-          targetLabel: __param_target
-          regex: (.+):9579
-          replacement: iperf3-${1}.iperf3.default.svc.cluster.local:5201
         - sourceLabels: [__param_target]
           targetLabel: instance
         - targetLabel: __address__
-          replacement: iperf3-exporter.default.svc.cluster.local:9579
+          replacement: iperf3-exporter-ch.iperf3.svc:9579
+    - port: metrics
+      path: /probe
+      interval: 5m
+      scrapeTimeout: 30s
+      params:
+        target: ['iperf3-us.iperf3.svc.cluster.local:5201']
+        period: ['10s']
+        streams: ['4']
+      relabelings:
+        - sourceLabels: [__param_target]
+          targetLabel: instance
+        - targetLabel: __address__
+          replacement: iperf3-exporter-us.iperf3.svc:9579
+    - port: metrics
+      path: /probe
+      interval: 5m
+      scrapeTimeout: 30s
+      params:
+        target: ['iperf3-iris.iperf3.svc.cluster.local:5201']
+        period: ['10s']
+        streams: ['4']
+      relabelings:
+        - sourceLabels: [__param_target]
+          targetLabel: instance
+        - targetLabel: __address__
+          replacement: iperf3-exporter-iris.iperf3.svc:9579
+    - port: metrics
+      path: /probe
+      interval: 5m
+      scrapeTimeout: 30s
+      params:
+        target: ['iperf3-home.iperf3.svc.cluster.local:5201']
+        period: ['10s']
+        streams: ['4']
+      relabelings:
+        - sourceLabels: [__param_target]
+          targetLabel: instance
+        - targetLabel: __address__
+          replacement: iperf3-exporter-home.iperf3.svc:9579
+    - port: metrics
+      path: /probe
+      interval: 5m
+      scrapeTimeout: 30s
+      params:
+        target: ['iperf3-master.iperf3.svc.cluster.local:5201']
+        period: ['10s']
+        streams: ['4']
+      relabelings:
+        - sourceLabels: [__param_target]
+          targetLabel: instance
+        - targetLabel: __address__
+          replacement: iperf3-exporter-master.iperf3.svc:9579
+    - port: metrics
+      path: /probe
+      interval: 5m
+      scrapeTimeout: 30s
+      params:
+        target: ['iperf3-it.iperf3.svc.cluster.local:5201']
+        period: ['10s']
+        streams: ['4']
+      relabelings:
+        - sourceLabels: [__param_target]
+          targetLabel: instance
+        - targetLabel: __address__
+          replacement: iperf3-exporter-it.iperf3.svc:9579
+    - port: metrics
+      path: /probe
+      interval: 5m
+      scrapeTimeout: 30s
+      params:
+        target: ['iperf3-nas.iperf3.svc.cluster.local:5201']
+        period: ['10s']
+        streams: ['4']
+      relabelings:
+        - sourceLabels: [__param_target]
+          targetLabel: instance
+        - targetLabel: __address__
+          replacement: iperf3-exporter-nas.iperf3.svc:9579
+    - port: metrics
+      path: /probe
+      interval: 5m
+      scrapeTimeout: 30s
+      params:
+        target: ['iperf3-spb.iperf3.svc.cluster.local:5201']
+        period: ['10s']
+        streams: ['4']
+      relabelings:
+        - sourceLabels: [__param_target]
+          targetLabel: instance
+        - targetLabel: __address__
+          replacement: iperf3-exporter-spb.iperf3.svc:9579
       metricRelabelings:
         - sourceLabels: [__name__]
           regex: iperf3_(.+)
           targetLabel: __name__
-          replacement: network_${1}
+          replacement: network_${1}

k8s/apps/jellyfin/qbittorent.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: vpn-creds
@@ -76,11 +76,14 @@ spec:
                 secretKeyRef:
                   name: vpn-creds
                   key: ss_link
-          command: ["/bin/bash", "-c", "rm /etc/shadowsocks-rust/config.json && sslocal  --online-config-url $SS_LINK --local-addr 127.0.0.1:8081 -U --protocol http"]
+          command: ["/bin/bash", "-c", "rm /etc/shadowsocks-rust/config.json && sslocal --server-url $SS_LINK --local-addr 127.0.0.1:8081 -U --protocol http"]
           resources:
             requests:
               memory: "64Mi"
-              cpu: "200m"
+              cpu: "300m"
+            limits:
+              memory: "128Mi"
+              cpu: "300m"
 ---
 apiVersion: v1
 kind: Service

k8s/apps/jellyfin/values.yaml

@@ -6,7 +6,7 @@ resources:
     cpu: "1000m"
   limits:
     memory: "8Gi"
-    cpu: "4000m"
+    cpu: "6000m"
 nodeSelector:
   kubernetes.io/hostname: master.tail2fe2d.ts.net
 persistence:

k8s/apps/k8s-secrets/deployment.yaml

@@ -40,7 +40,7 @@ spec:
             cpu: "50m"
           limits:
             memory: "128Mi"
-            cpu: "100m"
+            cpu: "150m"
         livenessProbe:
           httpGet:
             path: /health

k8s/apps/k8s-secrets/external-secret.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: openai-creds

k8s/apps/khm/deployment.yaml

@@ -29,7 +29,7 @@ spec:
               cpu: "100m"
             limits:
               memory: "1Gi"
-              cpu: "500m"
+              cpu: "750m"
           command:
             - /bin/sh
             - -c

k8s/apps/khm/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: khm-pg-creds

k8s/apps/ollama/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: oidc-secret

k8s/apps/paperless/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: postgres-and-oauth-creds

k8s/apps/paperless/gotenberg-values.yaml

@@ -13,7 +13,7 @@ resources:
     cpu: "200m"
   limits:
     memory: "2Gi"
-    cpu: "1000m"
+    cpu: "1500m"
 
 service:
   type: ClusterIP

k8s/apps/paperless/paperless-values.yaml

@@ -6,7 +6,7 @@ resources:
     cpu: "500m"
   limits:
     memory: "4Gi"
-    cpu: "2000m"
+    cpu: "3000m"
 initContainers:
   install-tesseract-langs:
     image: ghcr.io/paperless-ngx/paperless-ngx:2.18.2
@@ -16,7 +16,7 @@ initContainers:
         cpu: "100m"
       limits:
         memory: "1Gi"
-        cpu: "500m"
+        cpu: "750m"
     command: ["/bin/sh", "-c"]
     args:
       - apt-get update && apt-get install -y --reinstall tesseract-ocr-rus tesseract-ocr-jpn tesseract-ocr-chi-sim tesseract-ocr-eng tesseract-ocr-ell && cp -v -r /usr/share/tesseract-ocr/5/tessdata/* /custom-tessdata/

k8s/apps/paperless/tika-values.yaml

@@ -13,7 +13,7 @@ resources:
     cpu: "100m"
   limits:
     memory: "1Gi"
-    cpu: "500m"
+    cpu: "750m"
 
 service:
   type: ClusterIP

k8s/apps/pasarguard/daemonset.yaml

@@ -144,7 +144,7 @@ spec:
               cpu: "50m"
             limits:
               memory: "128Mi"
-              cpu: "100m"
+              cpu: "150m"
           volumeMounts:
             - name: shared-data
               mountPath: /shared
@@ -204,7 +204,7 @@ spec:
               cpu: "100m"
             limits:
               memory: "512Mi"
-              cpu: "500m"
+              cpu: "750m"
           volumeMounts:
             - name: shared-data
               mountPath: /shared

k8s/apps/pasarguard/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: pasarguard-secrets

k8s/apps/remnawave/app.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: remnawave
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: remnawave
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/remnawave
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+

k8s/apps/remnawave/deployment.yaml

@@ -0,0 +1,71 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: remnawave
+  labels:
+    app: remnawave
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  selector:
+    matchLabels:
+      app: remnawave
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: remnawave
+    spec:
+      containers:
+        - name: remnawave
+          image: 'remnawave/backend:2'
+          imagePullPolicy: Always
+          envFrom:
+            - secretRef:
+                name: remnawave-secrets
+          env:
+            - name: REDIS_URL
+              value: "redis://remnawave-redis:6379"
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+            - name: metrics
+              containerPort: 3001
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 3001
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 3001
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: remnawave
+spec:
+  selector:
+    app: remnawave
+  ports:
+    - name: http
+      protocol: TCP
+      port: 3000
+      targetPort: 3000
+    - name: metrics
+      protocol: TCP
+      port: 3001
+      targetPort: 3001

k8s/apps/remnawave/external-secrets.yaml

@@ -0,0 +1,70 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: remnawave-secrets
+spec:
+  target:
+    name: remnawave-secrets
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        METRICS_USER: admin
+        FRONT_END_DOMAIN: rw.hexor.cy
+        SUB_PUBLIC_DOMAIN: sub.hexor.cy
+        REDIS_HOST: remnawave-redis
+        REDIS_PORT: "6379"
+
+        DATABASE_URL: |-
+          postgresql://remnawave:{{ .pg_pass }}@psql.psql.svc:5432/remnawave
+        JWT_AUTH_SECRET: |-
+          {{ .jwt_auth_secret }}
+        JWT_API_TOKENS_SECRET: |-
+          {{ .jwt_api_tokens_secret }}
+        METRICS_PASS: |-
+          {{ .metrics_pass }}
+        WEBHOOK_SECRET_HEADER: |-
+          {{ .webhook_secret }}
+
+  data:
+    - secretKey: pg_pass
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[10].value
+    - secretKey: jwt_auth_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 0d090436-5e82-453a-914c-19cec2abded1
+        property: fields[0].value
+    - secretKey: jwt_api_tokens_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 0d090436-5e82-453a-914c-19cec2abded1
+        property: fields[1].value
+    - secretKey: metrics_pass
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 0d090436-5e82-453a-914c-19cec2abded1
+        property: fields[2].value
+    - secretKey: webhook_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 0d090436-5e82-453a-914c-19cec2abded1
+        property: fields[3].value

k8s/apps/remnawave/ingress.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: remnawave-tls-ingress
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: sub.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: remnawave-subscription-page
+                port:
+                  number: 3010
+    - host: sub.hexor.ru
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: remnawave-subscription-page
+                port:
+                  number: 3010
+  tls:
+    - secretName: remnawave-tls
+      hosts:
+        - sub.hexor.cy
+        - sub.hexor.ru

k8s/apps/remnawave/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./external-secrets.yaml
+  - ./deployment.yaml
+  - ./redis-deployment.yaml
+  - ./subscription-page-configmap.yaml
+  - ./subscription-page-deployment.yaml
+  - ./servicemonitor.yaml

k8s/apps/remnawave/redis-deployment.yaml

@@ -0,0 +1,71 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: remnawave-redis
+  labels:
+    app: remnawave-redis
+spec:
+  selector:
+    matchLabels:
+      app: remnawave-redis
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: remnawave-redis
+    spec:
+      containers:
+        - name: redis
+          image: 'valkey/valkey:8.1-alpine'
+          imagePullPolicy: Always
+          ports:
+            - name: redis
+              containerPort: 6379
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+                - valkey-cli
+                - ping
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            exec:
+              command:
+                - valkey-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+      volumes:
+        - name: redis-data
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: remnawave-redis
+spec:
+  selector:
+    app: remnawave-redis
+  ports:
+    - name: redis
+      protocol: TCP
+      port: 6379
+      targetPort: 6379

k8s/apps/remnawave/servicemonitor.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: remnawave-metrics
+  labels:
+    app: remnawave
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      app: remnawave
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      honorLabels: true
+  namespaceSelector:
+    matchNames:
+      - remnawave

k8s/apps/remnawave/subscription-page-configmap.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: remnawave-subscription-page-config
+  labels:
+    app: remnawave-subscription-page
+data:
+  APP_PORT: "3010"
+  REMNAWAVE_PANEL_URL: "http://remnawave.remnawave.svc:3000"
+  META_TITLE: "RemnaWave Subscription"
+  META_DESCRIPTION: "Your VPN subscription portal"
+  META_KEYWORDS: "vpn,subscription,remnawave"
+  META_AUTHOR: "RemnaWave"
+  ENABLE_ANALYTICS: "false"
+  ANALYTICS_MEASUREMENT_ID: ""
+  CUSTOM_SUB_PREFIX: ""
+  THEME: "dark"
+  CUSTOM_LOGO_URL: ""
+  SHOW_SUBSCRIPTION_INFO: "true"
+  SHOW_CONNECTION_INFO: "true"
+  SHOW_QR_CODE: "true"
+  QR_CODE_SIZE: "256"
+  REFRESH_INTERVAL: "30000"
+  SUBSCRIPTION_TEXT_COLOR: "#ffffff"
+  BACKGROUND_COLOR: "#1a1a1a"
+  ACCENT_COLOR: "#007bff"

k8s/apps/remnawave/subscription-page-deployment.yaml

@@ -0,0 +1,68 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: remnawave-subscription-page
+  labels:
+    app: remnawave-subscription-page
+spec:
+  selector:
+    matchLabels:
+      app: remnawave-subscription-page
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: remnawave-subscription-page
+    spec:
+      containers:
+        - name: subscription-page
+          image: 'remnawave/subscription-page:latest'
+          imagePullPolicy: Always
+          envFrom:
+            - configMapRef:
+                name: remnawave-subscription-page-config
+          ports:
+            - name: http
+              containerPort: 3010
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3010
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3010
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: remnawave-subscription-page
+  labels:
+    app: remnawave-subscription-page
+spec:
+  selector:
+    app: remnawave-subscription-page
+  ports:
+    - name: http
+      protocol: TCP
+      port: 3010
+      targetPort: 3010

k8s/apps/rustdesk/deployment.yaml

@@ -27,7 +27,7 @@ spec:
             cpu: "100m"
           limits:
             memory: "512Mi"
-            cpu: "500m"
+            cpu: "750m"
         command: ["hbbs"]
         args:
           - "--relay-servers"
@@ -98,7 +98,7 @@ spec:
             cpu: "100m"
           limits:
             memory: "512Mi"
-            cpu: "500m"
+            cpu: "750m"
         command: ["hbbr"]
         args:
           - "--port"

k8s/apps/rustdesk/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: rustdesk-keys

k8s/apps/sonarr-stack/bazarr-values.yaml

@@ -4,7 +4,7 @@ resources:
     cpu: "100m"
   limits:
     memory: "1Gi"
-    cpu: "500m"
+    cpu: "750m"
 nodeSelector:
   kubernetes.io/hostname: master.tail2fe2d.ts.net
 

k8s/apps/sonarr-stack/prowlarr-values.yaml

@@ -6,7 +6,7 @@ resources:
     cpu: "100m"
   limits:
     memory: "1Gi"
-    cpu: "500m"
+    cpu: "750m"
 nodeSelector:
   kubernetes.io/hostname: master.tail2fe2d.ts.net
 

k8s/apps/sonarr-stack/sonarr-values.yaml

@@ -6,7 +6,7 @@ resources:
     cpu: "200m"
   limits:
     memory: "2Gi"
-    cpu: "1000m"
+    cpu: "1500m"
 nodeSelector:
   kubernetes.io/hostname: master.tail2fe2d.ts.net
 

k8s/apps/stirling-pdf/values.yaml

@@ -33,7 +33,7 @@ resources:
     cpu: "200m"
   limits:
     memory: "2Gi"
-    cpu: "1000m"
+    cpu: "1500m"
 
 probes:
   liveness:

k8s/apps/tg-bots/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: get-id-bot
@@ -24,7 +24,7 @@ spec:
         property: fields[0].value
 
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: desubot

k8s/apps/vaultwarden/deployment.yaml

@@ -37,7 +37,7 @@ spec:
               cpu: "100m"
             limits:
               memory: "1Gi"
-              cpu: "500m"
+              cpu: "750m"
           env:
             - name: DOMAIN
               value: https://vw.hexor.cy

k8s/apps/vaultwarden/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: admin-token

k8s/apps/vpn/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: outfleet-secrets
@@ -51,7 +51,7 @@ spec:
         property: fields[1].value
 
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: outline-config

k8s/apps/vpn/xray.yaml

@@ -174,7 +174,7 @@ spec:
         resources:
           limits:
             memory: "512Mi"
-            cpu: "500m"
+            cpu: "750m"
           requests:
             memory: "256Mi"
             cpu: "250m"

k8s/core/argocd/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: oidc-creds

k8s/core/argocd/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 helmCharts:
   - name: argo-cd
     repo: https://argoproj.github.io/argo-helm
-    version: 8.1.3
+    version: 9.1.4
     releaseName: argocd
     namespace: argocd
     valuesFile: values.yaml

k8s/core/authentik/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: authentik-creds

k8s/core/authentik/values.yaml

@@ -47,6 +47,7 @@ server:
         - minecraft.hexor.cy # Minecraft UI and server
         - pass.hexor.cy      # k8s-secret for openai
         - ps.hexor.cy        # pasarguard UI
+#       - rw.hexor.cy        # RemnaWave UI
       tls:
         - secretName: idm-tls
           hosts:

k8s/core/cert-manager/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: cloudflare-creds
@@ -22,7 +22,7 @@ spec:
         key: 8ae1dcb1-1182-48a1-8733-ca1144ea754b
         property: fields[0].value
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: aws-creds

k8s/core/cert-manager/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 helmCharts:
   - name: cert-manager
     repo: https://charts.jetstack.io
-    version: 1.17.1
+    version: 1.19.1
     releaseName: cert-manager
     namespace: cert-manager
     valuesFile: values.yaml

k8s/core/cert-manager/values.yaml

@@ -1,2 +1,6 @@
 crds:
   enabled: true
+prometheus:
+  enabled: true
+  servicemonitor:
+    enabled: true

k8s/core/external-secrets/app.yaml

@@ -18,4 +18,4 @@ spec:
       prune: true
     syncOptions:
       - CreateNamespace=true
-
+      - ServerSideApply=true

k8s/core/external-secrets/bitwarden-store.yaml

@@ -128,7 +128,7 @@ spec:
               app.kubernetes.io/name: external-secrets
 
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: vaultwarden-login
@@ -141,7 +141,7 @@ spec:
       result:
         jsonPath: "$.data.{{ .remoteRef.property }}"
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: vaultwarden-fields

k8s/core/external-secrets/kustomization.yaml

@@ -2,13 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - app.yaml
   - bitwarden-store.yaml
 
 helmCharts:
   - name: external-secrets
     repo: https://charts.external-secrets.io
-    version: 0.16.2
+    version: 1.1.0
     releaseName: external-secrets
     namespace: external-secrets
     valuesFile: values.yaml

k8s/core/postgresql/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: postgres-creds
@@ -90,7 +90,7 @@ spec:
         key: 832042b9-7edb-4f4c-9254-3c8884ba9733
         property: fields[2].value
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: postgres-users
@@ -119,6 +119,8 @@ spec:
           {{ .outfleet_rs }}
         USER_pasarguard: |-
           {{ .pasarguard }}
+        USER_remnawave: |-
+          {{ .remnawave }}
   data:
     - secretKey: authentik
       sourceRef:
@@ -219,3 +221,14 @@ spec:
         metadataPolicy: None
         key: 2a9deb39-ef22-433e-a1be-df1555625e22
         property: fields[9].value
+    - secretKey: remnawave
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[10].value

k8s/core/prom-stack/external-secrets.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: grafana-admin

k8s/core/prom-stack/kustomization.yaml

@@ -9,7 +9,7 @@ resources:
 helmCharts:
   - name: kube-prometheus-stack
     repo: https://prometheus-community.github.io/helm-charts
-    version: 70.4.2
+    version: 79.7.1
     releaseName: prometheus
     namespace: prometheus
     valuesFile: prom-values.yaml
@@ -17,7 +17,7 @@ helmCharts:
 
   - name: grafana
     repo: https://grafana.github.io/helm-charts
-    version: 8.11.4
+    version: 10.2.0
     releaseName: grafana
     namespace: prometheus
     valuesFile: grafana-values.yaml

terraform/authentik/proxy-apps.tfvars

@@ -206,5 +206,22 @@ EOT
     create_group                 = true
     access_groups                = ["admins"]
   }
+  "remnawave" = {
+    name                         = "RemnaWave"
+    slug                         = "remnawave"
+    group                        = "Tools"
+    external_host                = "https://rw.hexor.cy"
+    internal_host                = "http://remnawave.remnawave.svc:3000"
+    internal_host_ssl_validation = false
+    meta_description             = ""
+    skip_path_regex              = <<-EOT
+/api/sub/
+EOT
+    meta_icon                    = "https://camo.githubusercontent.com/0fbcff9dfaebb0363774139d00ef58d7f128eed3ddabaaf2bf7d18b68fd296a1/68747470733a2f2f63646e2e72656d6e612e73742f6c6f676f732f6c6f676f2e737667"
+    mode                         = "proxy"
+    outpost                      = "kubernetes-outpost"
+    create_group                 = true
+    access_groups                = ["admins"]
+  }
 }