Auto-update README with current k8s applications

Generated by CI/CD workflow on 2025-11-24 14:34:09

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

.gitea/workflows/authentik-apps.yaml

@@ -30,29 +30,21 @@ jobs:
         cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
 
     - name: Terraform Init
-      env:
-        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
       run: terraform init
       working-directory: ./terraform/authentik
 
     - name: Terraform Format
-      env:
-        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
       run: terraform fmt -check
       continue-on-error: true
       working-directory: ./terraform/authentik
 
     - name: Terraform Apply
-      env:
-        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
       run: terraform apply -var-file proxy-apps.tfvars -var-file oauth2-apps.tfvars -var-file terraform.tfvars -var-file groups.tfvars -input=false -auto-approve -parallelism=100
       working-directory: ./terraform/authentik
 
     - name: Generate Wiki Content  
       if: success()
       continue-on-error: true
-      env:
-        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
       run: |
         echo "📋 Starting Wiki generation..."
         cd ./terraform/authentik

README.md

@@ -56,7 +56,6 @@ ArgoCD homelab project
 | **tg-bots** | [![tg-bots](https://ag.hexor.cy/api/badge?name=tg-bots&revision=true)](https://ag.hexor.cy/applications/argocd/tg-bots) |
 | **vaultwarden** | [![vaultwarden](https://ag.hexor.cy/api/badge?name=vaultwarden&revision=true)](https://ag.hexor.cy/applications/argocd/vaultwarden) |
 | **vpn** | [![vpn](https://ag.hexor.cy/api/badge?name=vpn&revision=true)](https://ag.hexor.cy/applications/argocd/vpn) |
-| **xandikos** | [![xandikos](https://ag.hexor.cy/api/badge?name=xandikos&revision=true)](https://ag.hexor.cy/applications/argocd/xandikos) |
 
 </td>
 </tr>

k8s/apps/gitea/deployment.yaml

@@ -77,8 +77,8 @@ spec:
       labels:
         app: gitea-runner
     spec:
-      #nodeSelector:
+      nodeSelector:
-      #  kubernetes.io/hostname: home.homenet
+        kubernetes.io/hostname: home.homenet
       volumes:
         - name: docker-sock
           hostPath:
@@ -90,30 +90,27 @@ spec:
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 1
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - home.homenet
-          - weight: 2
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - master.tail2fe2d.ts.net
           - weight: 3
             preference:
               matchExpressions:
               - key: kubernetes.io/hostname
                 operator: In
                 values:
-                - it.tail2fe2d.ts.net
+                - home.homenet
-                - ch.tail2fe2d.ts.net
+          - weight: 1
-                - us.tail2fe2d.ts.net
+            preference:
-
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - master.tail2fe2d.ts.net
+          - weight: 2
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - nas.homenet
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
@@ -121,9 +118,7 @@ spec:
                 operator: In
                 values:
                 - home.homenet
-                - it.tail2fe2d.ts.net
+                - nas.homenet
-                - ch.tail2fe2d.ts.net
-                - us.tail2fe2d.ts.net
                 - master.tail2fe2d.ts.net
       containers:
         - name: gitea-runner

k8s/apps/jellyfin/values.yaml

@@ -1,5 +1,5 @@
 image:
-  tag: 10.11.4
+  tag: 10.10.7
 resources:
   requests:
     memory: "2Gi"
@@ -36,40 +36,8 @@ ingress:
         paths:
           - path: /
             pathType: Prefix
-      - host: us.hexor.cy
-        paths:
-          - path: /
-            pathType: Prefix
-      - host: ch.hexor.cy
-        paths:
-          - path: /
-            pathType: Prefix
-      - host: jp.hexor.cy
-        paths:
-          - path: /
-            pathType: Prefix
-      - host: spb.hexor.cy
-        paths:
-          - path: /
-            pathType: Prefix
-      - host: cy.hexor.cy
-        paths:
-          - path: /
-            pathType: Prefix
-      - host: am.hexor.cy
-        paths:
-          - path: /
-            pathType: Prefix
-      - host: de.hexor.cy
-        paths:
-          - path: /
-            pathType: Prefix
-      - host: it.hexor.cy
-        paths:
-          - path: /
-            pathType: Prefix
     tls:
       - secretName: jellyfin-tls
         hosts:
-          - '*.hexor.cy'
+          - 'jf.hexor.cy'
 

k8s/apps/k8s-secrets/deployment.yaml

@@ -19,7 +19,7 @@ spec:
         kubernetes.io/os: linux
       containers:
       - name: secret-reader
-        image: ultradesu/k8s-secrets:0.2.1
+        image: ultradesu/k8s-secrets:0.1.1
         imagePullPolicy: Always
         args:
           - "--secrets"
@@ -28,7 +28,6 @@ spec:
           - "k8s-secret"
           - "--port"
           - "3000"
-          - "--webhook"
         ports:
         - containerPort: 3000
           name: http

k8s/apps/paperless/kustomization.yaml

@@ -27,11 +27,4 @@ helmCharts:
     namespace: paperless
     valuesFile: gotenberg-values.yaml
     includeCRDs: true
-  #- name: redis
-  #  repo: oci://registry-1.docker.io/bitnamicharts/redis
-  #  version: 24.1.0
-  #  releaseName: redis
-  #  namespace: paperless
-  #  includeCRDs: true
-  #  valuesFile: bazarr-values.yaml
 

k8s/apps/paperless/paperless-values.yaml

@@ -107,8 +107,6 @@ persistence:
       - path: /usr/src/paperless/consume
 redis:
   enabled: true
-  image:
-    tag: latest
   master:
     nodeSelector:
       kubernetes.io/hostname: nas.homenet

k8s/apps/pasarguard/configmap-scripts-ingress.yaml

@@ -1,212 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pasarguard-scripts-ingress
-  labels:
-    app: pasarguard-node-ingress
-data:
-  init-uuid-ingress.sh: |
-    #!/bin/bash
-    set -e
-    echo "Started"
-    # NODE_NAME is already set via environment variable
-    NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
-
-    # Get DNS name from node label xray-public-address
-    DNS_NAME=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.xray-public-address}')
-
-    if [ -z "${DNS_NAME}" ]; then
-      echo "ERROR: Node ${NODE_NAME} does not have label 'xray-public-address'"
-      exit 1
-    fi
-
-    echo "Node: ${NODE_NAME}"
-    echo "DNS Name from label: ${DNS_NAME}"
-
-    # Use DNS name for ConfigMap name to ensure uniqueness
-    CONFIGMAP_NAME="node-uuid-ingress-${DNS_NAME//./-}"
-
-    echo "Checking ConfigMap: ${CONFIGMAP_NAME}"
-
-    # Check if ConfigMap exists and get UUID
-    if kubectl get configmap "${CONFIGMAP_NAME}" -n "${NAMESPACE}" &>/dev/null; then
-      echo "ConfigMap exists, reading UUID..."
-      API_KEY=$(kubectl get configmap "${CONFIGMAP_NAME}" -n "${NAMESPACE}" -o jsonpath='{.data.API_KEY}')
-
-      if [ -z "${API_KEY}" ]; then
-        echo "UUID not found in ConfigMap, generating new one..."
-        API_KEY=$(cat /proc/sys/kernel/random/uuid)
-        kubectl patch configmap "${CONFIGMAP_NAME}" -n "${NAMESPACE}" --type merge -p "{\"data\":{\"API_KEY\":\"${API_KEY}\"}}"
-      else
-        echo "Using existing UUID from ConfigMap"
-      fi
-    else
-      echo "ConfigMap does not exist, creating new one..."
-      API_KEY=$(cat /proc/sys/kernel/random/uuid)
-      kubectl create configmap "${CONFIGMAP_NAME}" -n "${NAMESPACE}" \
-        --from-literal=API_KEY="${API_KEY}" \
-        --from-literal=NODE_NAME="${NODE_NAME}"
-    fi
-
-    # Save UUID and node info to shared volume for the main container
-    echo -n "${API_KEY}" > /shared/api-key
-    echo -n "${NODE_NAME}" > /shared/node-name
-    echo -n "${CONFIGMAP_NAME}" > /shared/configmap-name
-    echo "UUID initialized: ${API_KEY}"
-    echo "Node name: ${NODE_NAME}"
-    echo "ConfigMap: ${CONFIGMAP_NAME}"
-
-    # Create Certificate for this node using DNS name from label
-    CERT_NAME="pasarguard-node-ingress-${DNS_NAME//./-}"
-
-    echo "Creating Certificate: ${CERT_NAME} for ${DNS_NAME}"
-
-    # Check if Certificate already exists
-    if ! kubectl get certificate "${CERT_NAME}" -n "${NAMESPACE}" &>/dev/null; then
-      echo "Certificate does not exist, creating..."
-      cat <<EOF | kubectl apply -f -
-    apiVersion: cert-manager.io/v1
-    kind: Certificate
-    metadata:
-      name: ${CERT_NAME}
-      namespace: ${NAMESPACE}
-    spec:
-      secretName: ${CERT_NAME}-tls
-      issuerRef:
-        name: letsencrypt
-        kind: ClusterIssuer
-      dnsNames:
-        - ${DNS_NAME}
-    EOF
-    else
-      echo "Certificate already exists"
-    fi
-
-    # Wait for certificate to be ready
-    
-    echo "Waiting for certificate to be ready..."
-    for i in {1..600}; do
-      if kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" &>/dev/null; then
-        echo "Certificate secret is ready!"
-        break
-      fi
-      echo "Waiting for certificate... ($i/600)"
-      sleep 1
-    done
-
-    if ! kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" &>/dev/null; then
-      echo "WARNING: Certificate secret not ready after 600 seconds"
-    else
-      # Extract certificate and key from secret to shared volume
-      echo "Extracting certificate and key..."
-      kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" -o jsonpath='{.data.tls\.crt}' | base64 -d > /shared/tls.crt
-      kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" -o jsonpath='{.data.tls\.key}' | base64 -d > /shared/tls.key
-      echo "Certificate and key extracted successfully."
-      cat /shared/tls.crt
-    fi
-
-    # Create ClusterIP Service for this node (pod selector based)
-    NODE_SHORT_NAME="${NODE_NAME%%.*}"
-    SERVICE_NAME="${NODE_SHORT_NAME}-ingress"
-
-    echo "Creating Service: ${SERVICE_NAME} for node ${NODE_NAME} (short: ${NODE_SHORT_NAME})"
-
-    # Create Service with pod selector including node name
-    cat <<EOF | kubectl apply -f -
-    apiVersion: v1
-    kind: Service
-    metadata:
-      name: ${SERVICE_NAME}
-      namespace: ${NAMESPACE}
-      labels:
-        app: pasarguard-node-ingress
-        node: ${NODE_NAME}
-    spec:
-      type: ClusterIP
-      selector:
-        app: pasarguard-node-ingress
-        node-name: ${NODE_SHORT_NAME}
-      ports:
-        - name: proxy
-          port: 443
-          protocol: TCP
-          targetPort: 443
-        - name: api
-          port: 62050
-          protocol: TCP
-          targetPort: 62050
-    EOF
-
-    echo "Service created: ${SERVICE_NAME}.${NAMESPACE}.svc.cluster.local"
-
-    # Create IngressRouteTCP for this DNS name with TLS passthrough
-    INGRESS_NAME="pasarguard-tcp-${DNS_NAME//./-}"
-
-    echo "Creating IngressRouteTCP: ${INGRESS_NAME} for ${DNS_NAME}"
-
-    cat <<EOF | kubectl apply -f -
-    apiVersion: traefik.io/v1alpha1
-    kind: IngressRouteTCP
-    metadata:
-      name: ${INGRESS_NAME}
-      namespace: ${NAMESPACE}
-      labels:
-        app: pasarguard-node-ingress
-        node: ${NODE_NAME}
-    spec:
-      entryPoints:
-        - websecure
-      routes:
-        - match: HostSNI(\`${DNS_NAME}\`)
-          services:
-            - name: ${SERVICE_NAME}
-              port: 443
-      tls:
-        passthrough: true
-    EOF
-
-    echo "IngressRouteTCP created: ${INGRESS_NAME}"
-    echo "Traffic to ${DNS_NAME}:443 will be routed to ${SERVICE_NAME}:443"
-
-    # Create second IngressRouteTCP for API port 62051
-    INGRESS_API_NAME="pasarguard-api-${DNS_NAME//./-}"
-
-    echo "Creating IngressRouteTCP for API: ${INGRESS_API_NAME} for ${DNS_NAME}:62051"
-
-    cat <<EOF | kubectl apply -f -
-    apiVersion: traefik.io/v1alpha1
-    kind: IngressRouteTCP
-    metadata:
-      name: ${INGRESS_API_NAME}
-      namespace: ${NAMESPACE}
-      labels:
-        app: pasarguard-node-ingress
-        node: ${NODE_NAME}
-    spec:
-      entryPoints:
-        - pasarguard-api
-      routes:
-        - match: HostSNI(\`${DNS_NAME}\`)
-          services:
-            - name: ${SERVICE_NAME}
-              port: 62050
-      tls:
-        passthrough: true
-    EOF
-
-    echo "IngressRouteTCP API created: ${INGRESS_API_NAME}"
-    echo "Traffic to ${DNS_NAME}:62051 will be routed to ${SERVICE_NAME}:62050"
-
-  pasarguard-start.sh: |
-    #!/bin/sh
-    # Read API_KEY from shared volume created by init container
-    if [ -f /shared/api-key ]; then
-      export API_KEY=$(cat /shared/api-key)
-      echo "Loaded API_KEY from shared volume"
-    else
-      echo "WARNING: API_KEY file not found, using default"
-    fi
-
-    cd /app
-    exec ./main

k8s/apps/pasarguard/daemonset-ingress.yaml

@@ -1,211 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: pasarguard-node-ingress
-  labels:
-    app: pasarguard-node-ingress
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: pasarguard-node-ingress-configmap
-  labels:
-    app: pasarguard-node-ingress
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["get", "list", "create", "update", "patch"]
-  - apiGroups: ["cert-manager.io"]
-    resources: ["certificates"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["services", "endpoints"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
-  - apiGroups: ["traefik.io", "traefik.containo.us"]
-    resources: ["ingressroutetcps"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list", "patch", "update"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: pasarguard-node-ingress-configmap
-  labels:
-    app: pasarguard-node-ingress
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: pasarguard-node-ingress-configmap
-subjects:
-  - kind: ServiceAccount
-    name: pasarguard-node-ingress
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: pasarguard-node-ingress-reader
-  labels:
-    app: pasarguard-node-ingress
-rules:
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: pasarguard-node-ingress-reader
-  labels:
-    app: pasarguard-node-ingress
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: pasarguard-node-ingress-reader
-subjects:
-  - kind: ServiceAccount
-    name: pasarguard-node-ingress
-    namespace: pasarguard
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: pasarguard-node-ingress
-  labels:
-    app: pasarguard-node-ingress
-spec:
-  selector:
-    matchLabels:
-      app: pasarguard-node-ingress
-  revisionHistoryLimit: 3
-  updateStrategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: pasarguard-node-ingress
-    spec:
-      serviceAccountName: pasarguard-node-ingress
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: xray-public-address
-                operator: Exists
-      initContainers:
-        - name: label-pod
-          image: bitnami/kubectl:latest
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-          command:
-            - /bin/bash
-            - -c
-            - |
-              # Add node label to pod
-              NODE_SHORT=$(echo ${NODE_NAME} | cut -d. -f1)
-              kubectl label pod ${POD_NAME} -n ${POD_NAMESPACE} node-name=${NODE_SHORT} --overwrite
-        - name: init-uuid
-          image: bitnami/kubectl:latest
-          env:
-            - name: GODEBUG
-              value: "x509sha1=1"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-          command:
-            - /bin/bash
-            - /scripts/init-uuid-ingress.sh
-          volumeMounts:
-            - name: shared-data
-              mountPath: /shared
-            - name: scripts
-              mountPath: /scripts
-      containers:
-        - name: pasarguard-node
-          image: 'pasarguard/node:v0.1.3'
-          imagePullPolicy: Always
-          command:
-            - /bin/sh
-            - /scripts/pasarguard-start.sh
-          ports:
-            - name: api
-              containerPort: 62050
-              protocol: TCP
-            - name: proxy
-              containerPort: 443
-              protocol: TCP
-          env:
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: NODE_HOST
-              value: "0.0.0.0"
-            - name: SERVICE_PORT
-              value: "62050"
-            - name: SERVICE_PROTOCOL
-              value: "grpc"
-            - name: DEBUG
-              value: "true"
-            - name: SSL_CERT_FILE
-              value: "/shared/tls.crt"
-            - name: SSL_KEY_FILE
-              value: "/shared/tls.key"
-            - name: XRAY_EXECUTABLE_PATH
-              value: "/usr/local/bin/xray"
-            - name: XRAY_ASSETS_PATH
-              value: "/usr/local/share/xray"
-            - name: API_KEY
-              value: "change-this-to-a-secure-uuid"
-          livenessProbe:
-            tcpSocket:
-              port: 62050
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            tcpSocket:
-              port: 62050
-            initialDelaySeconds: 10
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 3
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "750m"
-          volumeMounts:
-            - name: shared-data
-              mountPath: /shared
-              readOnly: false
-            - name: scripts
-              mountPath: /scripts
-      volumes:
-        - name: shared-data
-          emptyDir: {}
-        - name: scripts
-          configMap:
-            name: pasarguard-scripts-ingress
-            defaultMode: 0755

k8s/apps/pasarguard/daemonset.yaml

@@ -112,8 +112,47 @@ spec:
             - name: scripts
               mountPath: /scripts
       containers:
+        - name: xray-exporter
+          image: alpine:3.18
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - /scripts/exporter-start.sh
+          ports:
+            - name: metrics
+              containerPort: 9550
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /scrape
+              port: metrics
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /scrape
+              port: metrics
+            initialDelaySeconds: 45
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "128Mi"
+              cpu: "150m"
+          volumeMounts:
+            - name: shared-data
+              mountPath: /shared
+              readOnly: true
+            - name: scripts
+              mountPath: /scripts
         - name: pasarguard-node
-          image: 'pasarguard/node:v0.1.3'
+          image: 'pasarguard/node:v0.1.1'
           imagePullPolicy: Always
           command:
             - /bin/sh
@@ -172,46 +211,6 @@ spec:
               readOnly: false
             - name: scripts
               mountPath: /scripts
-
-        - name: xray-exporter
-          image: alpine:3.18
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/sh
-            - /scripts/exporter-start.sh
-          ports:
-            - name: metrics
-              containerPort: 9550
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /scrape
-              port: metrics
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            timeoutSeconds: 10
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /scrape
-              port: metrics
-            initialDelaySeconds: 45
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "128Mi"
-              cpu: "150m"
-          volumeMounts:
-            - name: shared-data
-              mountPath: /shared
-              readOnly: true
-            - name: scripts
-              mountPath: /scripts
       volumes:
         - name: shared-data
           emptyDir: {}

k8s/apps/pasarguard/deployment.yaml

@@ -34,7 +34,7 @@ spec:
               mountPath: /templates/subscription
       containers:
         - name: pasarguard-web
-          image: 'pasarguard/panel:latest'
+          image: 'pasarguard/panel:v1.7.2'
           imagePullPolicy: Always
           envFrom:
             - secretRef:

k8s/apps/pasarguard/kustomization.yaml

@@ -9,6 +9,3 @@ resources:
   - ./certificate.yaml
   - ./configmap-scripts.yaml
   - ./servicemonitor.yaml
-  - ./configmap-scripts-ingress.yaml
-# - ./daemonset-ingress.yaml
-# - ./traefik-pasarguard-entrypoint.yaml

k8s/apps/pasarguard/traefik-pasarguard-entrypoint.yaml

@@ -1,66 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: traefik
-  namespace: kube-system
-spec:
-  template:
-    spec:
-      containers:
-      - name: traefik
-        args:
-        - --entryPoints.metrics.address=:9100/tcp
-        - --entryPoints.traefik.address=:8080/tcp
-        - --entryPoints.web.address=:8000/tcp
-        - --entryPoints.websecure.address=:8443/tcp
-        - --entryPoints.pasarguard-api.address=:62051/tcp
-        - --api.dashboard=true
-        - --ping=true
-        - --metrics.prometheus=true
-        - --metrics.prometheus.entrypoint=metrics
-        - --providers.kubernetescrd
-        - --providers.kubernetescrd.allowEmptyServices=true
-        - --providers.kubernetesingress
-        - --providers.kubernetesingress.allowEmptyServices=true
-        - --providers.kubernetesingress.ingressendpoint.publishedservice=kube-system/traefik
-        - --entryPoints.websecure.http.tls=true
-        - --log.level=INFO
-        - --entryPoints.web.transport.respondingTimeouts.readTimeout=0s
-        - --entryPoints.websecure.transport.respondingTimeouts.readTimeout=0s
-        ports:
-        - containerPort: 9100
-          name: metrics
-          protocol: TCP
-        - containerPort: 8080
-          name: traefik
-          protocol: TCP
-        - containerPort: 8000
-          name: web
-          protocol: TCP
-        - containerPort: 8443
-          name: websecure
-          protocol: TCP
-        - containerPort: 62051
-          name: pasarguard-api
-          protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: traefik
-  namespace: kube-system
-spec:
-  ports:
-  - name: web
-    port: 80
-    protocol: TCP
-    targetPort: web
-  - name: websecure
-    port: 443
-    protocol: TCP
-    targetPort: websecure
-  - name: pasarguard-api
-    port: 62051
-    protocol: TCP
-    targetPort: pasarguard-api

k8s/apps/remnawave/external-secrets.yaml

@@ -10,22 +10,16 @@ spec:
     template:
       type: Opaque
       data:
-        METRICS_USER: admin
-        FRONT_END_DOMAIN: rw.hexor.cy
-        SUB_PUBLIC_DOMAIN: sub.hexor.cy
-        REDIS_HOST: remnawave-redis
-        REDIS_PORT: "6379"
-
         DATABASE_URL: |-
           postgresql://remnawave:{{ .pg_pass }}@psql.psql.svc:5432/remnawave
-        JWT_AUTH_SECRET: |-
+#       JWT_AUTH_SECRET: |-
-          {{ .jwt_auth_secret }}
+#         {{ .jwt_auth_secret }}
-        JWT_API_TOKENS_SECRET: |-
+#       JWT_API_TOKENS_SECRET: |-
-          {{ .jwt_api_tokens_secret }}
+#         {{ .jwt_api_tokens_secret }}
-        METRICS_PASS: |-
+#       METRICS_USER: |-
-          {{ .metrics_pass }}
+#         {{ .metrics_user }}
-        WEBHOOK_SECRET_HEADER: |-
+#       METRICS_PASS: |-
-          {{ .webhook_secret }}
+#         {{ .metrics_pass }}
 
   data:
     - secretKey: pg_pass
@@ -36,35 +30,35 @@ spec:
       remoteRef:
         key: 2a9deb39-ef22-433e-a1be-df1555625e22
         property: fields[10].value
-    - secretKey: jwt_auth_secret
+#   - secretKey: jwt_auth_secret
-      sourceRef:
+#     sourceRef:
-        storeRef:
+#       storeRef:
-          name: vaultwarden-login
+#         name: vaultwarden-login
-          kind: ClusterSecretStore
+#         kind: ClusterSecretStore
-      remoteRef:
+#     remoteRef:
-        key: 0d090436-5e82-453a-914c-19cec2abded1
+#       key: 35ec5880-2576-401b-a89a-3c9d56b9c1de
-        property: fields[0].value
+#       property: login.password
-    - secretKey: jwt_api_tokens_secret
+#   - secretKey: jwt_api_tokens_secret
-      sourceRef:
+#     sourceRef:
-        storeRef:
+#       storeRef:
-          name: vaultwarden-login
+#         name: vaultwarden-login
-          kind: ClusterSecretStore
+#         kind: ClusterSecretStore
-      remoteRef:
+#     remoteRef:
-        key: 0d090436-5e82-453a-914c-19cec2abded1
+#       key: 35ec5880-2576-401b-a89a-3c9d56b9c1de
-        property: fields[1].value
+#       property: login.password
-    - secretKey: metrics_pass
+#   - secretKey: metrics_user
-      sourceRef:
+#     sourceRef:
-        storeRef:
+#       storeRef:
-          name: vaultwarden-login
+#         name: vaultwarden-login
-          kind: ClusterSecretStore
+#         kind: ClusterSecretStore
-      remoteRef:
+#     remoteRef:
-        key: 0d090436-5e82-453a-914c-19cec2abded1
+#       key: 35ec5880-2576-401b-a89a-3c9d56b9c1de
-        property: fields[2].value
+#       property: login.username
-    - secretKey: webhook_secret
+#   - secretKey: metrics_pass
-      sourceRef:
+#     sourceRef:
-        storeRef:
+#       storeRef:
-          name: vaultwarden-login
+#         name: vaultwarden-login
-          kind: ClusterSecretStore
+#         kind: ClusterSecretStore
-      remoteRef:
+#     remoteRef:
-        key: 0d090436-5e82-453a-914c-19cec2abded1
+#       key: 35ec5880-2576-401b-a89a-3c9d56b9c1de
-        property: fields[3].value
+#       property: login.password

k8s/apps/remnawave/kustomization.yaml

@@ -5,8 +5,4 @@ resources:
   - ./external-secrets.yaml
   - ./deployment.yaml
   - ./redis-deployment.yaml
-  - ./subscription-page-configmap.yaml
-  - ./subscription-page-deployment.yaml
   - ./servicemonitor.yaml
-  - ./user-ui-ingress.yaml
-  - ./panel-ingress.yaml

k8s/apps/remnawave/panel-ingress.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: panel-ui
-  annotations:
-    ingressClassName: traefik
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  rules:
-    - host: rw.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: remnawave
-                port:
-                  number: 3000
-    - host: rw.hexor.ru
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: remnawave
-                port:
-                  number: 3000
-  tls:
-    - secretName: remnawave-panel-tls
-      hosts:
-        - rw.hexor.cy
-        - rw.hexor.ru

k8s/apps/remnawave/subscription-page-configmap.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: remnawave-subscription-page-config
-  labels:
-    app: remnawave-subscription-page
-data:
-  APP_PORT: "3010"
-  REMNAWAVE_PANEL_URL: "https://rw.hexor.cy"
-  META_TITLE: "RemnaWave Subscription"
-  META_DESCRIPTION: "Your VPN subscription portal"
-  META_KEYWORDS: "vpn,subscription,remnawave"
-  META_AUTHOR: "RemnaWave"
-  ENABLE_ANALYTICS: "false"
-  ANALYTICS_MEASUREMENT_ID: ""
-  CUSTOM_SUB_PREFIX: ""
-  THEME: "dark"
-  CUSTOM_LOGO_URL: ""
-  SHOW_SUBSCRIPTION_INFO: "true"
-  SHOW_CONNECTION_INFO: "true"
-  SHOW_QR_CODE: "true"
-  QR_CODE_SIZE: "256"
-  REFRESH_INTERVAL: "30000"
-  SUBSCRIPTION_TEXT_COLOR: "#ffffff"
-  BACKGROUND_COLOR: "#1a1a1a"
-  ACCENT_COLOR: "#007bff"

k8s/apps/remnawave/subscription-page-deployment.yaml

@@ -1,52 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: remnawave-subscription-page
-  labels:
-    app: remnawave-subscription-page
-spec:
-  selector:
-    matchLabels:
-      app: remnawave-subscription-page
-  replicas: 1
-  strategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: remnawave-subscription-page
-    spec:
-      containers:
-        - name: subscription-page
-          image: 'remnawave/subscription-page:latest'
-          imagePullPolicy: Always
-          envFrom:
-            - configMapRef:
-                name: remnawave-subscription-page-config
-          ports:
-            - name: http
-              containerPort: 3010
-              protocol: TCP
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: remnawave-subscription-page
-  labels:
-    app: remnawave-subscription-page
-spec:
-  selector:
-    app: remnawave-subscription-page
-  ports:
-    - name: http
-      protocol: TCP
-      port: 3010
-      targetPort: 3010

k8s/apps/remnawave/user-ui-ingress.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: user-ui
-  annotations:
-    ingressClassName: traefik
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  rules:
-    - host: sub.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: remnawave-subscription-page
-                port:
-                  number: 3010
-    - host: sub.hexor.ru
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: remnawave-subscription-page
-                port:
-                  number: 3010
-  tls:
-    - secretName: remnawave-user-ui-tls
-      hosts:
-        - sub.hexor.cy
-        - sub.hexor.ru

k8s/apps/tg-bots/get-id-bot.yaml

@@ -30,7 +30,7 @@ spec:
                 name: get-id-bot
           env:
             - name: RUST_LOG
-              value: "info,teloxide::error_handlers=off"
+              value: "info"
 
 
 

k8s/apps/tg-bots/kustomization.yaml

@@ -7,4 +7,3 @@ resources:
   - get-id-bot.yaml
   - external-secrets.yaml
   - desubot.yaml
-  - restart-job.yaml

k8s/apps/tg-bots/restart-job.yaml

@@ -1,56 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tg-bots-restart-sa
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: tg-bots-restart-role
-rules:
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    verbs: ["get", "patch"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: tg-bots-restart-rb
-subjects:
-  - kind: ServiceAccount
-    name: tg-bots-restart-sa
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: tg-bots-restart-role
-
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: tg-bots-daily-restart
-spec:
-  schedule: "0 4 * * *" # every day at 04:00
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          serviceAccountName: tg-bots-restart-sa
-          restartPolicy: OnFailure
-          containers:
-            - name: kubectl
-              image: bitnami/kubectl:latest
-              env:
-                - name: POD_NAMESPACE
-                  valueFrom:
-                    fieldRef:
-                      fieldPath: metadata.namespace
-              command:
-                - /bin/sh
-                - -c
-                - |
-                  kubectl -n "$POD_NAMESPACE" rollout restart deployment/desubot
-                  kubectl -n "$POD_NAMESPACE" rollout restart deployment/get-id-bot

k8s/apps/xandikos/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: xandikos
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: xandikos
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/xandikos
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-

k8s/apps/xandikos/deployment.yaml

@@ -1,70 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: xandikos
-  labels:
-    app: xandikos
-spec:
-  selector:
-    matchLabels:
-      app: xandikos
-  replicas: 1
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  template:
-    metadata:
-      labels:
-        app: xandikos
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
-      volumes:
-        - name: storage
-          hostPath:
-            path: /k8s/xandikos
-            type: Directory
-      containers:
-        - name: xandikos
-          image: ghcr.io/jelmer/xandikos:latest
-          imagePullPolicy: Always
-          command:
-            - "python3"
-            - "-m"
-            - "xandikos.web"
-            - "--port=8081"
-            - "-d/data"
-            - "--defaults"
-            - "--listen-address=0.0.0.0"
-            - "--route-prefix=/dav"
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "1000m"
-          livenessProbe:
-            httpGet:
-              path: /
-              port: 8081
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            timeoutSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /
-              port: 8081
-            initialDelaySeconds: 10
-            periodSeconds: 5
-            timeoutSeconds: 3
-          ports:
-            - name: http
-              containerPort: 8081
-              protocol: TCP
-          volumeMounts:
-            - name: storage
-              mountPath: /data

k8s/apps/xandikos/external-secrets.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mmdl-secrets
-spec:
-  target:
-    name: mmdl-secrets
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        DB_DIALECT: 'postgres'
-        DB_HOST: psql.psql.svc
-        DB_USER: mmdl
-        DB_NAME: mmdl
-        DB_PORT: "5432"
-        DB_PASS: |-
-          {{ .pg_pass }}
-        AES_PASSWORD: |-
-          {{ .pg_pass }}
-
-  data:
-    - secretKey: pg_pass
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[12].value

k8s/apps/xandikos/ingress.yaml

@@ -1,47 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: xandikos
-  annotations:
-    ingressClassName: traefik
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  rules:
-    - host: cal.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: mmdl
-                port:
-                  number: 3000
-          - path: /dav
-            pathType: Prefix
-            backend:
-              service:
-                name: xandikos
-                port:
-                  number: 8081
-          - path: /.well-known/carddav
-            pathType: Exact
-            backend:
-              service:
-                name: xandikos
-                port:
-                  number: 8081
-          - path: /.well-known/caldav
-            pathType: Exact
-            backend:
-              service:
-                name: xandikos
-                port:
-                  number: 8081
-  tls:
-    - secretName: xandikos-tls
-      hosts:
-        - cal.hexor.cy

k8s/apps/xandikos/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - deployment.yaml
-  - service.yaml
-  - mmdl-deployment.yaml
-  - mmdl-service.yaml
-  - ingress.yaml
-  - external-secrets.yaml
-

k8s/apps/xandikos/mmdl-deployment.yaml

@@ -1,61 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mmdl
-  labels:
-    app: mmdl
-spec:
-  selector:
-    matchLabels:
-      app: mmdl
-  replicas: 1
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  template:
-    metadata:
-      labels:
-        app: mmdl
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
-      containers:
-        - name: mmdl
-          image: intriin/mmdl:latest
-          imagePullPolicy: Always
-          envFrom:
-            - secretRef:
-                name: mmdl-secrets
-          env:
-            - name: NEXTAUTH_URL
-              value: "https://cal.hexor.cy"
-            - name: CALDAV_SERVER_URL
-              value: "https://cal.hexor.cy/dav"
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "1000m"
-          livenessProbe:
-            httpGet:
-              path: /
-              port: 3000
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            timeoutSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /
-              port: 3000
-            initialDelaySeconds: 10
-            periodSeconds: 5
-            timeoutSeconds: 3
-          ports:
-            - name: http
-              containerPort: 3000
-              protocol: TCP

k8s/apps/xandikos/mmdl-service.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: mmdl
-spec:
-  selector:
-    app: mmdl
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 3000
-      protocol: TCP
-      targetPort: 3000

k8s/apps/xandikos/service.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: xandikos
-  labels:
-    app: xandikos
-spec:
-  selector:
-    app: xandikos
-  ports:
-    - protocol: TCP
-      port: 8081
-      targetPort: 8081
-      name: http
-  type: ClusterIP

k8s/core/argocd/appprojects.yaml

@@ -47,20 +47,3 @@ spec:
     server: https://kubernetes.default.svc
   sourceRepos:
   - ssh://git@gt.hexor.cy:30022/ab/homelab.git
-
----
-apiVersion: argoproj.io/v1alpha1
-kind: AppProject
-metadata:
-  name: desktop
-  namespace: argocd
-spec:
-  clusterResourceWhitelist:
-  - group: '*'
-    kind: '*'
-  description: Hexor Home Lab Desktop Apps
-  destinations:
-  - namespace: '*'
-    server: https://kubernetes.default.svc
-  sourceRepos:
-  - ssh://git@gt.hexor.cy:30022/ab/homelab.git

k8s/core/argocd/values.yaml

@@ -99,9 +99,6 @@ server:
 # Repository Server
 repoServer:
   replicas: 1
-  livenessProbe:
-    timeoutSeconds: 10
-    periodSeconds: 60
   nodeSelector:
     kubernetes.io/hostname: master.tail2fe2d.ts.net
   # Add resources (requests/limits), PDB etc. if needed

k8s/core/authentik/values.yaml

@@ -47,7 +47,6 @@ server:
         - minecraft.hexor.cy # Minecraft UI and server
         - pass.hexor.cy      # k8s-secret for openai
         - ps.hexor.cy        # pasarguard UI
-#       - rw.hexor.cy        # RemnaWave UI
       tls:
         - secretName: idm-tls
           hosts:

k8s/core/postgresql/external-secrets.yaml

@@ -121,10 +121,6 @@ spec:
           {{ .pasarguard }}
         USER_remnawave: |-
           {{ .remnawave }}
-        USER_umami: |-
-          {{ .umami }}
-        USER_mmdl: |-
-          {{ .mmdl }}
   data:
     - secretKey: authentik
       sourceRef:
@@ -236,25 +232,3 @@ spec:
         metadataPolicy: None
         key: 2a9deb39-ef22-433e-a1be-df1555625e22
         property: fields[10].value
-    - secretKey: umami
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[11].value
-    - secretKey: mmdl
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[12].value

k8s/core/postgresql/main-db.yaml

@@ -28,7 +28,7 @@ spec:
             type: DirectoryOrCreate
       containers:
         - name: psql
-          image: 'bitnamilegacy/postgresql:17'
+          image: 'bitnami/postgresql:17'
           env:
             - name: POSTGRESQL_PASSWORD
               valueFrom:
@@ -63,7 +63,7 @@ spec:
               containerPort: 9187
               protocol: TCP
         - name: user-creation
-          image: 'bitnamilegacy/postgresql:17'
+          image: 'bitnami/postgresql:17'
           command:
             - /bin/bash
             - -c

k8s/core/postgresql/nas-db.yaml

@@ -28,7 +28,7 @@ spec:
             type: DirectoryOrCreate
       containers:
         - name: psql
-          image: 'bitnamilegacy/postgresql:17'
+          image: 'bitnami/postgresql:17'
           env:
             - name: POSTGRESQL_PASSWORD
               valueFrom:
@@ -60,7 +60,7 @@ spec:
               containerPort: 9187
               protocol: TCP
         - name: user-creation
-          image: 'bitnamilegacy/postgresql:17'
+          image: 'bitnami/postgresql:17'
           command:
             - /bin/bash
             - -c

k8s/core/postgresql/pgadmin4-values.yaml

@@ -1,5 +1,5 @@
 image:
-  tag: "latest"
+  tag: "9.9"
   pullPolicy: Always
 env:
   email: "postgres@hexor.cy"

k8s/core/system-upgrade/plan.yaml

@@ -16,7 +16,7 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  version: v1.34.2+k3s1
+  version: v1.34.1+k3s1
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -39,5 +39,5 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  version: v1.34.2+k3s1
+  version: v1.34.1+k3s1
 

k8s/desktop/jellyfin/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: jellyfin-uk
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: jellyfin-uk
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/desktop/jellyfin
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-

k8s/desktop/jellyfin/kustomization.yaml

@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - qbittorent.yaml
-
-helmCharts:
-  - name: jellyfin
-    repo: https://utkuozdemir.org/helm-charts
-    version: 2.0.0
-    releaseName: jellyfin
-    namespace: jellyfin
-    valuesFile: values.yaml
-    includeCRDs: true
-

k8s/desktop/jellyfin/qbittorent.yaml

@@ -1,123 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: vpn-creds
-spec:
-  target:
-    name: vpn-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        ss_link: |-
-          {{ .ss_link }}
-  data:
-    - secretKey: ss_link
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: cfee6f62-fb06-4a4c-b6d8-92da4908c65a
-        property: fields[0].value
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qbittorrent
-  labels:
-    app: qbittorrent
-  annotations:
-    reloader.stakater.com/auto: "true"
-spec:
-  selector:
-    matchLabels:
-      app: qbittorrent
-  replicas: 1
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  template:
-    metadata:
-      labels:
-        app: qbittorrent
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: desktop
-          effect: NoSchedule
-      volumes:
-        - name: config
-          hostPath:
-            path: /k8s/qbt-config
-            type: DirectoryOrCreate
-        - name: media
-          hostPath:
-            path: /k8s/media/downloads
-            type: DirectoryOrCreate
-      containers:
-        - name: qbittorrent
-          image: 'linuxserver/qbittorrent:latest'
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: media
-              mountPath: /downloads
-        - name: shadowsocks-proxy
-          image: teddysun/shadowsocks-rust:latest
-          env:
-            - name: SS_LINK
-              valueFrom:
-                secretKeyRef:
-                  name: vpn-creds
-                  key: ss_link
-          command: ["/bin/bash", "-c", "rm /etc/shadowsocks-rust/config.json && sslocal --server-url $SS_LINK --local-addr 127.0.0.1:8081 -U --protocol http"]
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "300m"
-            limits:
-              memory: "128Mi"
-              cpu: "300m"
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent
-spec:
-  selector:
-    app: qbittorrent
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
-
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: jf-local-ingress
-  annotations:
-    ingressClassName: traefik
-spec:
-  rules:
-    - host: tr.uk
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: qbittorrent
-                port:
-                  number: 80

k8s/desktop/jellyfin/values.yaml

@@ -1,41 +0,0 @@
-image:
-  tag: 10.11.4
-resources:
-  requests:
-    memory: "2Gi"
-    cpu: "1000m"
-  limits:
-    memory: "8Gi"
-    cpu: "6000m"
-nodeSelector:
-  kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
-tolerations:
-  - key: workload
-    operator: Equal
-    value: desktop
-    effect: NoSchedule
-persistence:
-  config:
-    enabled: true
-    isPvc: false
-    customVolume:
-      hostPath:
-        path: /k8s/jellyfin
-        type: DirectoryOrCreate
-  data:
-    enabled: true
-    isPvc: false
-    customVolume:
-      hostPath:
-        path: /k8s/media/downloads
-        type: DirectoryOrCreate
-
-ingress:
-    enabled: true
-    className: traefik
-    hosts:
-      - host: jf.uk
-        paths:
-          - path: /
-            pathType: Prefix
-

k8s/desktop/khm/app.yaml

@@ -1,18 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: khm-client
-  namespace: argocd
-spec:
-  project: desktop
-  destination:
-    namespace: khm
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/desktop/khm
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true

k8s/desktop/khm/external-secrets.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: khm-client-creds
-spec:
-  target:
-    name: khm-client-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        USERNAME: |-
-          {{ .username }}
-        PASSWORD: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 19c06480-0814-4d1f-aa80-710105989188
-        property: login.username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 19c06480-0814-4d1f-aa80-710105989188
-        property: login.password

k8s/desktop/khm/khm-client-cronjob.yaml

@@ -1,69 +0,0 @@
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: khm-client
-  labels:
-    app: khm-client
-spec:
-  schedule: "15 * * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: khm-client
-        spec:
-          restartPolicy: OnFailure
-          hostNetwork: true
-          nodeSelector:
-            node-role.kubernetes.io/desktop: ""
-          tolerations:
-            - key: workload
-              operator: Equal
-              value: desktop
-              effect: NoSchedule
-          containers:
-            - name: khm-client
-              image: 'ultradesu/khm:latest'
-              imagePullPolicy: Always
-              securityContext:
-                privileged: false
-              resources:
-                requests:
-                  memory: "64Mi"
-                  cpu: "50m"
-                limits:
-                  memory: "256Mi"
-                  cpu: "200m"
-              command:
-                - /bin/sh
-                - -c
-                - |
-                  /usr/local/bin/khm \
-                    --known-hosts /host-ssh/known_hosts \
-                    --host https://khm.hexor.cy \
-                    --flow=private \
-                    --basic-auth="${USERNAME}:${PASSWORD}" \
-                    --in-place
-              env:
-                - name: USERNAME
-                  valueFrom:
-                    secretKeyRef:
-                      name: khm-client-creds
-                      key: USERNAME
-                - name: PASSWORD
-                  valueFrom:
-                    secretKeyRef:
-                      name: khm-client-creds
-                      key: PASSWORD
-              volumeMounts:
-                - name: known-hosts
-                  mountPath: /host-ssh/known_hosts
-          volumes:
-            - name: known-hosts
-              hostPath:
-                path: /home/ab/.ssh/known_hosts

k8s/desktop/khm/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - external-secrets.yaml
-  - khm-client-cronjob.yaml

terraform/authentik/providers.tf

@@ -8,6 +8,6 @@ terraform {
 }
 
 provider "authentik" {
-  url   = var.authentik_url
+  url   = "https://idm.hexor.cy"
-  token = var.authentik_token
+  token = "qXcuoCg77JaRgqnU6rqIIBa8MBJ4UNyLPTL89dZI8zeC2jfaWqQ7k56BJs8F"
 }

terraform/authentik/proxy-apps.tfvars

@@ -51,9 +51,6 @@ proxy_applications = {
     internal_host                = "http://secret-reader.k8s-secret.svc:80"
     internal_host_ssl_validation = false
     meta_description             = ""
-    skip_path_regex              = <<-EOT
-/webhook
-EOT
     meta_icon                    = "https://img.icons8.com/ios-filled/50/password.png"
     mode                         = "proxy"
     outpost                      = "kubernetes-outpost"
@@ -132,12 +129,12 @@ EOT
     access_groups                = ["admins"]
   }
 
-  "syncthing-router" = {
+  "syncthing-master" = {
-    name                         = "Syncthing"
+    name                         = "Syncthing-master"
-    slug                         = "syncthing"
+    slug                         = "syncthing-master"
     group                        = "Media and Storage"
     external_host                = "https://ss.hexor.cy"
-    internal_host                = "http://syncthing-router.syncthing.svc:80"
+    internal_host                = "https://syncthing-master.syncthing.svc:8384"
     internal_host_ssl_validation = false
     meta_description             = ""
     meta_icon                    = "https://img.icons8.com/?size=100&id=Id4NcEcXcYzF&format=png&color=000000"
@@ -199,10 +196,9 @@ EOT
     internal_host_ssl_validation = false
     meta_description             = ""
     skip_path_regex              = <<-EOT
-/
 /sub/
 /dashboard/
-/api/
+/
 EOT
     meta_icon                    = "https://img.icons8.com/?size=100&id=fqAD3lAB6zTe&format=png&color=000000"
     mode                         = "proxy"

terraform/authentik/variables.tf

@@ -166,9 +166,3 @@ variable "authentik_url" {
   type        = string
   default     = "https://idm.hexor.cy"
 }
-
-variable "authentik_token" {
-  description = "Authentik API token (set via TF_VAR_authentik_token env var)"
-  type        = string
-  sensitive   = true
-}