Compare commits
1 Commits
auto-updat
...
auto-updat
| Author | SHA1 | Date | |
|---|---|---|---|
|
f29a04a922 |
@@ -18,7 +18,6 @@ ArgoCD homelab project
|
||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
| **postgresql** | [](https://ag.hexor.cy/applications/argocd/postgresql) |
|
||||
| **prom-stack** | [](https://ag.hexor.cy/applications/argocd/prom-stack) |
|
||||
| **system-upgrade** | [](https://ag.hexor.cy/applications/argocd/system-upgrade) |
|
||||
@@ -45,7 +44,6 @@ ArgoCD homelab project
|
||||
| **jellyfin** | [](https://ag.hexor.cy/applications/argocd/jellyfin) |
|
||||
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
||||
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
||||
| **mtproxy** | [](https://ag.hexor.cy/applications/argocd/mtproxy) |
|
||||
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
||||
| **ollama** | [](https://ag.hexor.cy/applications/argocd/ollama) |
|
||||
| **paperless** | [](https://ag.hexor.cy/applications/argocd/paperless) |
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS builder
|
||||
|
||||
ARG TARGETARCH
|
||||
|
||||
RUN apt-get update && apt-get install -y \
|
||||
git curl make gcc libssl-dev zlib1g-dev \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN if [ "$(dpkg --print-architecture)" != "$TARGETARCH" ]; then \
|
||||
dpkg --add-architecture $TARGETARCH && \
|
||||
apt-get update && \
|
||||
case "$TARGETARCH" in \
|
||||
arm64) apt-get install -y gcc-aarch64-linux-gnu libssl-dev:arm64 zlib1g-dev:arm64 ;; \
|
||||
amd64) apt-get install -y gcc-x86-64-linux-gnu libssl-dev:amd64 zlib1g-dev:amd64 ;; \
|
||||
esac && \
|
||||
rm -rf /var/lib/apt/lists/*; \
|
||||
fi
|
||||
|
||||
RUN git clone https://github.com/TelegramMessenger/MTProxy.git /src
|
||||
WORKDIR /src
|
||||
|
||||
RUN NATIVE=$(dpkg --print-architecture) && \
|
||||
if [ "$NATIVE" != "$TARGETARCH" ]; then \
|
||||
case "$TARGETARCH" in \
|
||||
arm64) export CC=aarch64-linux-gnu-gcc ;; \
|
||||
amd64) export CC=x86_64-linux-gnu-gcc ;; \
|
||||
esac; \
|
||||
fi && \
|
||||
make -j$(nproc)
|
||||
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
ENV PROXY_PORT=30443
|
||||
ENV STATS_PORT=8888
|
||||
ENV WORKERS=1
|
||||
ENV RUN_USER=nobody
|
||||
|
||||
RUN apt-get update && apt-get install -y \
|
||||
curl libssl3 zlib1g xxd \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
COPY --from=builder /src/objs/bin/mtproto-proxy /usr/local/bin/mtproto-proxy
|
||||
|
||||
RUN curl -s https://core.telegram.org/getProxySecret -o /etc/mtproxy/proxy-secret --create-dirs && \
|
||||
curl -s https://core.telegram.org/getProxyConfig -o /etc/mtproxy/proxy-multi.conf
|
||||
|
||||
ENTRYPOINT mtproto-proxy \
|
||||
-u ${RUN_USER} \
|
||||
-p ${STATS_PORT} \
|
||||
-H ${PROXY_PORT} \
|
||||
-M ${WORKERS} \
|
||||
--aes-pwd /etc/mtproxy/proxy-secret \
|
||||
/etc/mtproxy/proxy-multi.conf
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: mtproxy
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: mtproxy
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/mtproxy
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
@@ -1,117 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: mtproxy
|
||||
labels:
|
||||
app: mtproxy
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mtproxy
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mtproxy
|
||||
spec:
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: mtproxy
|
||||
operator: Exists
|
||||
serviceAccountName: mtproxy
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
initContainers:
|
||||
- name: register-proxy
|
||||
image: bitnami/kubectl:latest
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: tgproxy-secret
|
||||
key: SECRET
|
||||
- name: PORT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: tgproxy-secret
|
||||
key: PORT
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
curl -s https://core.telegram.org/getProxySecret -o /data/proxy-secret
|
||||
curl -s https://core.telegram.org/getProxyConfig -o /data/proxy-multi.conf
|
||||
NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
|
||||
SERVER=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.mtproxy}')
|
||||
if [ -z "${SERVER}" ]; then
|
||||
echo "ERROR: node ${NODE_NAME} has no mtproxy label"
|
||||
exit 1
|
||||
fi
|
||||
LINK="tg://proxy?server=${SERVER}&port=${PORT}&secret=${SECRET}"
|
||||
echo "Registering: ${SERVER} -> ${LINK}"
|
||||
if kubectl get secret mtproxy-links -n "${NAMESPACE}" &>/dev/null; then
|
||||
kubectl patch secret mtproxy-links -n "${NAMESPACE}" \
|
||||
--type merge -p "{\"stringData\":{\"${SERVER}\":\"${LINK}\"}}"
|
||||
else
|
||||
kubectl create secret generic mtproxy-links -n "${NAMESPACE}" \
|
||||
--from-literal="${SERVER}=${LINK}"
|
||||
fi
|
||||
echo "Done"
|
||||
containers:
|
||||
- name: mtproxy
|
||||
image: telegrammessenger/proxy:latest
|
||||
# image: ultradesu/mtproxy:v0.02
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: proxy
|
||||
containerPort: 30443
|
||||
protocol: TCP
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- >-
|
||||
mtproto-proxy
|
||||
-u nobody
|
||||
-p 8888
|
||||
-H $(PORT)
|
||||
-M 1
|
||||
-S $(SECRET)
|
||||
--aes-pwd /data/proxy-secret
|
||||
/data/proxy-multi.conf
|
||||
env:
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: tgproxy-secret
|
||||
key: SECRET
|
||||
- name: PORT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: tgproxy-secret
|
||||
key: PORT
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
#resources:
|
||||
# requests:
|
||||
# memory: "128Mi"
|
||||
# cpu: "100m"
|
||||
# limits:
|
||||
# memory: "256Mi"
|
||||
# cpu: "500m"
|
||||
volumes:
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
@@ -1,25 +0,0 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: tgproxy-secret
|
||||
spec:
|
||||
target:
|
||||
name: tgproxy-secret
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
SECRET: |-
|
||||
{{ .secret }}
|
||||
PORT: "30443"
|
||||
data:
|
||||
- secretKey: secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 58a37daf-72d8-430d-86bd-6152aa8f888d
|
||||
property: fields[0].value
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ./app.yaml
|
||||
- ./rbac.yaml
|
||||
- ./daemonset.yaml
|
||||
- ./external-secrets.yaml
|
||||
- ./service.yaml
|
||||
- ./secret-reader.yaml
|
||||
# - ./storage.yaml
|
||||
@@ -1,58 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: mtproxy
|
||||
labels:
|
||||
app: mtproxy
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: mtproxy-node-reader
|
||||
labels:
|
||||
app: mtproxy
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: mtproxy-node-reader
|
||||
labels:
|
||||
app: mtproxy
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: mtproxy-node-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: mtproxy
|
||||
namespace: mtproxy
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: mtproxy-secret-manager
|
||||
labels:
|
||||
app: mtproxy
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "create", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: mtproxy-secret-manager
|
||||
labels:
|
||||
app: mtproxy
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: mtproxy-secret-manager
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: mtproxy
|
||||
@@ -1,63 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: secret-reader
|
||||
labels:
|
||||
app: secret-reader
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: secret-reader
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: secret-reader
|
||||
spec:
|
||||
serviceAccountName: mtproxy
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
containers:
|
||||
- name: secret-reader
|
||||
image: ultradesu/k8s-secrets:0.2.1
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
- "--secrets"
|
||||
- "mtproxy-links"
|
||||
- "--namespace"
|
||||
- "mtproxy"
|
||||
- "--port"
|
||||
- "3000"
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
env:
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
resources:
|
||||
requests:
|
||||
memory: "64Mi"
|
||||
cpu: "50m"
|
||||
limits:
|
||||
memory: "128Mi"
|
||||
cpu: "150m"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: secret-reader
|
||||
labels:
|
||||
app: secret-reader
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: secret-reader
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 3000
|
||||
protocol: TCP
|
||||
name: http
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mtproxy-data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: longhorn
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -1,153 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: n8n-main
|
||||
labels:
|
||||
app: n8n
|
||||
component: main
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: n8n
|
||||
component: main
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: n8n
|
||||
component: main
|
||||
spec:
|
||||
serviceAccountName: n8n
|
||||
initContainers:
|
||||
- name: install-tools
|
||||
image: alpine:3.22
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
if [ -x /tools/kubectl ]; then
|
||||
echo "kubectl already exists, skipping download"
|
||||
/tools/kubectl version --client
|
||||
exit 0
|
||||
fi
|
||||
echo "Downloading kubectl..."
|
||||
ARCH=$(uname -m)
|
||||
case $ARCH in
|
||||
x86_64) ARCH="amd64" ;;
|
||||
aarch64) ARCH="arm64" ;;
|
||||
esac
|
||||
wget -O /tools/kubectl "https://dl.k8s.io/release/$(wget -qO- https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
|
||||
chmod +x /tools/kubectl
|
||||
/tools/kubectl version --client
|
||||
volumeMounts:
|
||||
- name: tools
|
||||
mountPath: /tools
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
containers:
|
||||
- name: n8n
|
||||
image: docker.n8n.io/n8nio/n8n:latest
|
||||
ports:
|
||||
- containerPort: 5678
|
||||
name: http
|
||||
env:
|
||||
- name: PATH
|
||||
value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
- name: HOME
|
||||
value: "/home/node"
|
||||
- name: N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
|
||||
value: "true"
|
||||
- name: NODES_EXCLUDE
|
||||
value: "[]"
|
||||
- name: N8N_HOST
|
||||
value: "n8n.hexor.cy"
|
||||
- name: N8N_PORT
|
||||
value: "5678"
|
||||
- name: N8N_PROTOCOL
|
||||
value: "https"
|
||||
- name: N8N_RUNNERS_ENABLED
|
||||
value: "true"
|
||||
- name: N8N_RUNNERS_MODE
|
||||
value: "external"
|
||||
- name: EXECUTIONS_MODE
|
||||
value: "queue"
|
||||
- name: QUEUE_BULL_REDIS_HOST
|
||||
value: "n8n-redis"
|
||||
- name: NODE_ENV
|
||||
value: "production"
|
||||
- name: WEBHOOK_URL
|
||||
value: "https://n8n.hexor.cy/"
|
||||
- name: GENERIC_TIMEZONE
|
||||
value: "Europe/Moscow"
|
||||
- name: TZ
|
||||
value: "Europe/Moscow"
|
||||
- name: DB_TYPE
|
||||
value: "postgresdb"
|
||||
- name: DB_POSTGRESDB_HOST
|
||||
value: "psql.psql.svc"
|
||||
- name: DB_POSTGRESDB_DATABASE
|
||||
value: "n8n"
|
||||
- name: DB_POSTGRESDB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: credentials
|
||||
key: username
|
||||
- name: DB_POSTGRESDB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: credentials
|
||||
key: password
|
||||
- name: N8N_ENCRYPTION_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: credentials
|
||||
key: encryptionkey
|
||||
- name: N8N_RUNNERS_AUTH_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: credentials
|
||||
key: runnertoken
|
||||
volumeMounts:
|
||||
- name: n8n-data
|
||||
mountPath: /home/node/.n8n
|
||||
- name: tools
|
||||
mountPath: /opt/tools
|
||||
resources:
|
||||
requests:
|
||||
cpu: 2000m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 4000m
|
||||
memory: 2048Gi
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
initialDelaySeconds: 240
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 20
|
||||
failureThreshold: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/readiness
|
||||
port: http
|
||||
initialDelaySeconds: 120
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 15
|
||||
volumes:
|
||||
- name: n8n-data
|
||||
persistentVolumeClaim:
|
||||
claimName: n8n-data
|
||||
- name: tools
|
||||
persistentVolumeClaim:
|
||||
claimName: n8n-tools
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
fsGroup: 1000
|
||||
@@ -1,112 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: n8n-worker
|
||||
labels:
|
||||
app: n8n
|
||||
component: worker
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: n8n
|
||||
component: worker
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: n8n
|
||||
component: worker
|
||||
spec:
|
||||
serviceAccountName: n8n
|
||||
containers:
|
||||
- name: n8n-worker
|
||||
image: docker.n8n.io/n8nio/n8n:latest
|
||||
command: ["n8n", "worker"]
|
||||
env:
|
||||
- name: PATH
|
||||
value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
- name: HOME
|
||||
value: "/home/node"
|
||||
- name: NODES_EXCLUDE
|
||||
value: "[]"
|
||||
- name: N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
|
||||
value: "true"
|
||||
- name: N8N_RUNNERS_ENABLED
|
||||
value: "true"
|
||||
- name: N8N_RUNNERS_MODE
|
||||
value: "external"
|
||||
- name: N8N_PORT
|
||||
value: "80"
|
||||
- name: EXECUTIONS_MODE
|
||||
value: "queue"
|
||||
- name: QUEUE_BULL_REDIS_HOST
|
||||
value: "n8n-redis"
|
||||
- name: N8N_RUNNERS_TASK_BROKER_URI
|
||||
value: "http://n8n:80"
|
||||
- name: NODE_ENV
|
||||
value: "production"
|
||||
- name: GENERIC_TIMEZONE
|
||||
value: "Europe/Moscow"
|
||||
- name: TZ
|
||||
value: "Europe/Moscow"
|
||||
- name: DB_TYPE
|
||||
value: "postgresdb"
|
||||
- name: DB_POSTGRESDB_HOST
|
||||
value: "psql.psql.svc"
|
||||
- name: DB_POSTGRESDB_DATABASE
|
||||
value: "n8n"
|
||||
- name: DB_POSTGRESDB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: credentials
|
||||
key: username
|
||||
- name: DB_POSTGRESDB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: credentials
|
||||
key: password
|
||||
- name: N8N_ENCRYPTION_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: credentials
|
||||
key: encryptionkey
|
||||
- name: N8N_RUNNERS_AUTH_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: credentials
|
||||
key: runnertoken
|
||||
volumeMounts:
|
||||
- name: n8n-data
|
||||
mountPath: /home/node/.n8n
|
||||
- name: tools
|
||||
mountPath: /opt/tools
|
||||
resources:
|
||||
requests:
|
||||
cpu: 2000m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 4000m
|
||||
memory: 2048Gi
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- "ps aux | grep '[n]8n worker' || exit 1"
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
volumes:
|
||||
- name: n8n-data
|
||||
persistentVolumeClaim:
|
||||
claimName: n8n-data
|
||||
- name: tools
|
||||
persistentVolumeClaim:
|
||||
claimName: n8n-tools
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
fsGroup: 1000
|
||||
@@ -10,10 +10,8 @@ spec:
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
password: "{{ .psql | trim }}"
|
||||
username: "n8n"
|
||||
encryptionkey: "{{ .enc_pass | trim }}"
|
||||
runnertoken: "{{ .runner_token | trim }}"
|
||||
postgres-password: "{{ .psql | trim }}"
|
||||
N8N_ENCRYPTION_KEY: "{{ .enc_pass | trim }}"
|
||||
data:
|
||||
- secretKey: psql
|
||||
sourceRef:
|
||||
@@ -36,15 +34,4 @@ spec:
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 18c92d73-9637-4419-8642-7f7b308460cb
|
||||
property: fields[0].value
|
||||
- secretKey: runner_token
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 18c92d73-9637-4419-8642-7f7b308460cb
|
||||
property: fields[1].value
|
||||
property: fields[0].value
|
||||
@@ -1,28 +0,0 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: n8n
|
||||
labels:
|
||||
app: n8n
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- n8n.hexor.cy
|
||||
secretName: n8n-tls
|
||||
rules:
|
||||
- host: n8n.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: n8n
|
||||
port:
|
||||
number: 80
|
||||
@@ -4,24 +4,26 @@ kind: Kustomization
|
||||
resources:
|
||||
- external-secrets.yaml
|
||||
- storage.yaml
|
||||
- rbac.yaml
|
||||
- redis-deployment.yaml
|
||||
- redis-service.yaml
|
||||
- paddleocr-deployment.yaml
|
||||
- paddleocr-service.yaml
|
||||
- deployment-main.yaml
|
||||
- deployment-worker.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: n8n
|
||||
repo: https://community-charts.github.io/helm-charts
|
||||
version: 1.16.28
|
||||
releaseName: n8n
|
||||
namespace: n8n
|
||||
valuesFile: values-n8n.yaml
|
||||
includeCRDs: true
|
||||
- name: searxng
|
||||
repo: https://unknowniq.github.io/helm-charts/
|
||||
version: 0.1.3
|
||||
releaseName: searxng
|
||||
namespace: n8n
|
||||
valuesFile: values-searxng.yaml
|
||||
includeCRDs: true
|
||||
- name: yacy
|
||||
repo: https://gt.hexor.cy/api/packages/ab/helm
|
||||
version: 0.1.2
|
||||
repo: https://github.com/yacy/yacy_search_server.git
|
||||
path: charts/yacy
|
||||
releaseName: yacy
|
||||
namespace: n8n
|
||||
valuesFile: values-yacy.yaml
|
||||
includeCRDs: true
|
||||
|
||||
commonLabels:
|
||||
app.kubernetes.io/name: n8n
|
||||
|
||||
@@ -1,43 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: paddleocr
|
||||
labels:
|
||||
app: paddleocr
|
||||
component: n8n
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: paddleocr
|
||||
component: n8n
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: paddleocr
|
||||
component: n8n
|
||||
spec:
|
||||
containers:
|
||||
- name: paddleocr
|
||||
image: c403/paddleocr
|
||||
ports:
|
||||
- containerPort: 5000
|
||||
name: http
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 2Gi
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 5000
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: 5000
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: paddleocr
|
||||
labels:
|
||||
app: paddleocr
|
||||
component: n8n
|
||||
spec:
|
||||
selector:
|
||||
app: paddleocr
|
||||
component: n8n
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 5000
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -1,45 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: n8n
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: n8n-clusterrole
|
||||
rules:
|
||||
# Core API group ("")
|
||||
- apiGroups: [""]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# Common built-in API groups
|
||||
- apiGroups: ["apps", "batch", "autoscaling", "extensions", "policy"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
- apiGroups: ["networking.k8s.io", "rbac.authorization.k8s.io", "apiextensions.k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
- apiGroups: ["coordination.k8s.io", "discovery.k8s.io", "events.k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
- apiGroups: ["storage.k8s.io", "admissionregistration.k8s.io", "authentication.k8s.io", "authorization.k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: n8n-clusterrolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: n8n-clusterrole
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: n8n
|
||||
namespace: n8n
|
||||
@@ -1,57 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: n8n-redis
|
||||
labels:
|
||||
app: redis
|
||||
component: n8n
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: redis
|
||||
component: n8n
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: redis
|
||||
component: n8n
|
||||
spec:
|
||||
containers:
|
||||
- name: redis
|
||||
image: redis:7-alpine
|
||||
ports:
|
||||
- containerPort: 6379
|
||||
name: redis
|
||||
command:
|
||||
- redis-server
|
||||
- --appendonly
|
||||
- "yes"
|
||||
- --save
|
||||
- "900 1"
|
||||
volumeMounts:
|
||||
- name: redis-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 6379
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- redis-cli
|
||||
- ping
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumes:
|
||||
- name: redis-data
|
||||
emptyDir: {}
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: n8n-redis
|
||||
labels:
|
||||
app: redis
|
||||
component: n8n
|
||||
spec:
|
||||
selector:
|
||||
app: redis
|
||||
component: n8n
|
||||
ports:
|
||||
- name: redis
|
||||
port: 6379
|
||||
targetPort: 6379
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: n8n
|
||||
labels:
|
||||
app: n8n
|
||||
spec:
|
||||
selector:
|
||||
app: n8n
|
||||
component: main
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 5678
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -2,23 +2,11 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: n8n-data
|
||||
name: n8n-home
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
storageClassName: longhorn
|
||||
storageClassName: nfs-csi
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: n8n-tools
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
storageClassName: longhorn
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
|
||||
53
k8s/apps/n8n/values-n8n.yaml
Normal file
53
k8s/apps/n8n/values-n8n.yaml
Normal file
@@ -0,0 +1,53 @@
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
db:
|
||||
type: postgresdb
|
||||
|
||||
main:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 512m
|
||||
memory: 512Mi
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim: n8n-home
|
||||
mountPath: /home/node/.n8n
|
||||
|
||||
worker:
|
||||
mode: regular
|
||||
|
||||
webhook:
|
||||
url: https://n8n.hexor.cy
|
||||
|
||||
redis:
|
||||
enabled: true
|
||||
|
||||
existingEncryptionKeySecret: credentials
|
||||
|
||||
externalPostgresql:
|
||||
existingSecret: credentials
|
||||
host: "psql.psql.svc"
|
||||
username: "n8n"
|
||||
database: "n8n"
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
|
||||
hosts:
|
||||
- host: n8n.hexor.cy
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: n8n-tls
|
||||
hosts:
|
||||
- '*.hexor.cy'
|
||||
|
||||
24
k8s/apps/n8n/values-searxng.yaml
Normal file
24
k8s/apps/n8n/values-searxng.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
config:
|
||||
general:
|
||||
instance_name: "HexorSearXNG"
|
||||
debug: true
|
||||
server:
|
||||
limiter: false
|
||||
public_instance: false
|
||||
method: "POST"
|
||||
search:
|
||||
safe_search: 0
|
||||
|
||||
extraConfig:
|
||||
botdetection:
|
||||
ip_lists:
|
||||
pass_ip:
|
||||
- '0.0.0.0/0'
|
||||
- '::0/0'
|
||||
ip_limit:
|
||||
filter_link_local: false
|
||||
link_token: false
|
||||
valkey:
|
||||
enabled: true
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
@@ -1,24 +1,61 @@
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
replicaCount: 1
|
||||
|
||||
image:
|
||||
repository: yacy/yacy_search_server
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "latest"
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
automount: true
|
||||
annotations: {}
|
||||
name: ""
|
||||
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: false
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8090
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
resources:
|
||||
limits:
|
||||
memory: 2Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 1Gi
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
size: 10Gi
|
||||
accessMode: ReadWriteOnce
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
yacy:
|
||||
adminPassword: "yacy123"
|
||||
initCrawlURLs:
|
||||
- "https://www.example.com/"
|
||||
memory: "Xmx1024m"
|
||||
network:
|
||||
mode: "intranet"
|
||||
config:
|
||||
network.unit.bootstrap.seedlist: ""
|
||||
network.unit.remotecrawl: "false"
|
||||
network.unit.dhtredundancy.junior: "1"
|
||||
network.unit.dhtredundancy.senior: "1"
|
||||
index.receive.allow: "false"
|
||||
index.distribute.allow: "false"
|
||||
crawl.response.timeout: "10000"
|
||||
mode: "intranet" # standalone mode for local usage
|
||||
@@ -10,11 +10,5 @@ parameters:
|
||||
reclaimPolicy: Retain
|
||||
volumeBindingMode: Immediate
|
||||
mountOptions:
|
||||
- nfsvers=4.1
|
||||
- rsize=1048576
|
||||
- wsize=1048576
|
||||
- timeo=14
|
||||
- intr
|
||||
- bg
|
||||
- soft
|
||||
- noatime
|
||||
- vers=4
|
||||
- hard
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: longhorn
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: core
|
||||
destination:
|
||||
namespace: longhorn
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/core/longhorn
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
#resources:
|
||||
# - app.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: longhorn
|
||||
repo: https://charts.longhorn.io
|
||||
version: 1.11.0
|
||||
releaseName: longhorn
|
||||
namespace: longhorn
|
||||
valuesFile: values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
longhornUI:
|
||||
replicas: 1
|
||||
persistence:
|
||||
reclaimPolicy: "Retain"
|
||||
@@ -1,46 +0,0 @@
|
||||
apiVersion: monitoring.coreos.com/v1alpha1
|
||||
kind: AlertmanagerConfig
|
||||
metadata:
|
||||
name: telegram-notifications
|
||||
namespace: prometheus
|
||||
labels:
|
||||
app: kube-prometheus-stack-alertmanager
|
||||
release: prometheus
|
||||
spec:
|
||||
route:
|
||||
groupBy: ['alertname', 'cluster', 'service']
|
||||
groupWait: 10s
|
||||
groupInterval: 5m
|
||||
repeatInterval: 12h
|
||||
receiver: telegram
|
||||
routes:
|
||||
- matchers:
|
||||
- name: alertname
|
||||
value: Watchdog
|
||||
matchType: "="
|
||||
receiver: 'null'
|
||||
receivers:
|
||||
- name: telegram
|
||||
telegramConfigs:
|
||||
- botToken:
|
||||
name: alertmanager-telegram-secret
|
||||
key: TELEGRAM_BOT_TOKEN
|
||||
chatID: 124317807
|
||||
parseMode: HTML
|
||||
sendResolved: true
|
||||
disableNotifications: false
|
||||
message: |
|
||||
{{ if eq .Status "firing" }}🔥 FIRING{{ else }}✅ RESOLVED{{ end }}
|
||||
|
||||
{{ range .Alerts }}
|
||||
📊 <b>{{ .Labels.alertname }}</b>
|
||||
{{ .Annotations.summary }}
|
||||
|
||||
{{ if .Annotations.node }}🖥 <b>Node:</b> <code>{{ .Annotations.node }}</code>{{ end }}
|
||||
{{ if .Annotations.pod }}📦 <b>Pod:</b> <code>{{ .Annotations.pod }}</code>{{ end }}
|
||||
{{ if .Annotations.namespace }}📁 <b>Namespace:</b> <code>{{ .Annotations.namespace }}</code>{{ end }}
|
||||
{{ if .Annotations.throttle_rate }}⚠️ <b>Throttling rate:</b> {{ .Annotations.throttle_rate }}{{ end }}
|
||||
|
||||
🔗 <a href="{{ .GeneratorURL }}">View in Grafana</a>
|
||||
{{ end }}
|
||||
- name: 'null'
|
||||
@@ -45,7 +45,7 @@ data:
|
||||
type: __expr__
|
||||
uid: __expr__
|
||||
expression: A
|
||||
reducer: min
|
||||
reducer: last
|
||||
refId: B
|
||||
type: reduce
|
||||
noDataState: NoData
|
||||
@@ -63,7 +63,7 @@ data:
|
||||
- orgId: 1
|
||||
name: kubernetes_alerts
|
||||
folder: Kubernetes
|
||||
interval: 2m
|
||||
interval: 30s
|
||||
rules:
|
||||
- uid: node_not_ready
|
||||
title: Kubernetes Node Not Ready
|
||||
@@ -71,17 +71,17 @@ data:
|
||||
data:
|
||||
- refId: A
|
||||
relativeTimeRange:
|
||||
from: 600
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: P76F38748CEC837F0
|
||||
model:
|
||||
expr: 'kube_node_status_condition{condition="Ready",status="false"}'
|
||||
expr: 'kube_node_status_condition{condition="Ready",status="true"} == 0'
|
||||
refId: A
|
||||
intervalMs: 1000
|
||||
maxDataPoints: 43200
|
||||
- refId: B
|
||||
relativeTimeRange:
|
||||
from: 600
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: __expr__
|
||||
model:
|
||||
@@ -98,248 +98,18 @@ data:
|
||||
type: __expr__
|
||||
uid: __expr__
|
||||
expression: A
|
||||
reducer: min
|
||||
reducer: last
|
||||
refId: B
|
||||
type: reduce
|
||||
noDataState: NoData
|
||||
noDataState: Alerting
|
||||
execErrState: Alerting
|
||||
for: 10m
|
||||
for: 0s
|
||||
annotations:
|
||||
node: '{{ $labels.node }}'
|
||||
condition: '{{ $labels.condition }}'
|
||||
summary: 'Kubernetes node is not ready'
|
||||
labels:
|
||||
severity: critical
|
||||
|
||||
- uid: node_high_memory_usage
|
||||
title: High Node Memory Usage
|
||||
condition: B
|
||||
data:
|
||||
- refId: A
|
||||
relativeTimeRange:
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: P76F38748CEC837F0
|
||||
model:
|
||||
expr: '(1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100'
|
||||
refId: A
|
||||
intervalMs: 1000
|
||||
maxDataPoints: 43200
|
||||
- refId: B
|
||||
relativeTimeRange:
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: __expr__
|
||||
model:
|
||||
conditions:
|
||||
- evaluator:
|
||||
params:
|
||||
- 80
|
||||
type: gt
|
||||
operator:
|
||||
type: and
|
||||
query:
|
||||
params: []
|
||||
datasource:
|
||||
type: __expr__
|
||||
uid: __expr__
|
||||
expression: A
|
||||
reducer: max
|
||||
refId: B
|
||||
type: reduce
|
||||
noDataState: NoData
|
||||
execErrState: Alerting
|
||||
for: 5m
|
||||
annotations:
|
||||
node: '{{ $labels.instance }}'
|
||||
memory_usage: '{{ printf "%.1f%%" $values.A }}'
|
||||
summary: 'Node memory usage is critically high'
|
||||
labels:
|
||||
severity: warning
|
||||
|
||||
- uid: node_high_cpu_usage
|
||||
title: High Node CPU Usage
|
||||
condition: B
|
||||
data:
|
||||
- refId: A
|
||||
relativeTimeRange:
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: P76F38748CEC837F0
|
||||
model:
|
||||
expr: '100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)'
|
||||
refId: A
|
||||
intervalMs: 1000
|
||||
maxDataPoints: 43200
|
||||
- refId: B
|
||||
relativeTimeRange:
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: __expr__
|
||||
model:
|
||||
conditions:
|
||||
- evaluator:
|
||||
params:
|
||||
- 80
|
||||
type: gt
|
||||
operator:
|
||||
type: and
|
||||
query:
|
||||
params: []
|
||||
datasource:
|
||||
type: __expr__
|
||||
uid: __expr__
|
||||
expression: A
|
||||
reducer: max
|
||||
refId: B
|
||||
type: reduce
|
||||
noDataState: NoData
|
||||
execErrState: Alerting
|
||||
for: 10m
|
||||
annotations:
|
||||
node: '{{ $labels.instance }}'
|
||||
cpu_usage: '{{ printf "%.1f%%" $values.A }}'
|
||||
summary: 'Node CPU usage is critically high'
|
||||
labels:
|
||||
severity: warning
|
||||
|
||||
- uid: node_high_disk_usage
|
||||
title: High Node Disk Usage
|
||||
condition: B
|
||||
data:
|
||||
- refId: A
|
||||
relativeTimeRange:
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: P76F38748CEC837F0
|
||||
model:
|
||||
expr: '(1 - (node_filesystem_avail_bytes{fstype=~"ext[234]|xfs|zfs|btrfs"} / node_filesystem_size_bytes)) * 100'
|
||||
refId: A
|
||||
intervalMs: 1000
|
||||
maxDataPoints: 43200
|
||||
- refId: B
|
||||
relativeTimeRange:
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: __expr__
|
||||
model:
|
||||
conditions:
|
||||
- evaluator:
|
||||
params:
|
||||
- 85
|
||||
type: gt
|
||||
operator:
|
||||
type: and
|
||||
query:
|
||||
params: []
|
||||
datasource:
|
||||
type: __expr__
|
||||
uid: __expr__
|
||||
expression: A
|
||||
reducer: max
|
||||
refId: B
|
||||
type: reduce
|
||||
noDataState: NoData
|
||||
execErrState: Alerting
|
||||
for: 5m
|
||||
annotations:
|
||||
node: '{{ $labels.instance }}'
|
||||
filesystem: '{{ $labels.mountpoint }}'
|
||||
disk_usage: '{{ printf "%.1f%%" $values.A }}'
|
||||
summary: 'Node disk usage is critically high'
|
||||
labels:
|
||||
severity: critical
|
||||
|
||||
- uid: node_load_average_high
|
||||
title: High Node Load Average
|
||||
condition: B
|
||||
data:
|
||||
- refId: A
|
||||
relativeTimeRange:
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: P76F38748CEC837F0
|
||||
model:
|
||||
expr: 'node_load5 / on(instance) group_left count by(instance)(node_cpu_seconds_total{mode="idle"})'
|
||||
refId: A
|
||||
intervalMs: 1000
|
||||
maxDataPoints: 43200
|
||||
- refId: B
|
||||
relativeTimeRange:
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: __expr__
|
||||
model:
|
||||
conditions:
|
||||
- evaluator:
|
||||
params:
|
||||
- 0.8
|
||||
type: gt
|
||||
operator:
|
||||
type: and
|
||||
query:
|
||||
params: []
|
||||
datasource:
|
||||
type: __expr__
|
||||
uid: __expr__
|
||||
expression: A
|
||||
reducer: max
|
||||
refId: B
|
||||
type: reduce
|
||||
noDataState: NoData
|
||||
execErrState: Alerting
|
||||
for: 5m
|
||||
annotations:
|
||||
node: '{{ $labels.instance }}'
|
||||
load_average: '{{ printf "%.2f" $values.A }}'
|
||||
summary: 'Node load average is high relative to CPU count'
|
||||
labels:
|
||||
severity: warning
|
||||
|
||||
- uid: node_exporter_down
|
||||
title: Node Exporter Down
|
||||
condition: B
|
||||
data:
|
||||
- refId: A
|
||||
relativeTimeRange:
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: P76F38748CEC837F0
|
||||
model:
|
||||
expr: 'up{job="node-exporter"}'
|
||||
refId: A
|
||||
intervalMs: 1000
|
||||
maxDataPoints: 43200
|
||||
- refId: B
|
||||
relativeTimeRange:
|
||||
from: 300
|
||||
to: 0
|
||||
datasourceUid: __expr__
|
||||
model:
|
||||
conditions:
|
||||
- evaluator:
|
||||
params:
|
||||
- 1
|
||||
type: lt
|
||||
operator:
|
||||
type: and
|
||||
query:
|
||||
params: []
|
||||
datasource:
|
||||
type: __expr__
|
||||
uid: __expr__
|
||||
expression: A
|
||||
reducer: min
|
||||
refId: B
|
||||
type: reduce
|
||||
noDataState: NoData
|
||||
execErrState: Alerting
|
||||
for: 2m
|
||||
annotations:
|
||||
node: '{{ $labels.instance }}'
|
||||
summary: 'Node exporter is down - unable to collect metrics'
|
||||
labels:
|
||||
severity: critical
|
||||
|
||||
contactpoints.yaml: |
|
||||
apiVersion: 1
|
||||
@@ -379,4 +149,4 @@ data:
|
||||
- alertname
|
||||
group_wait: 10s
|
||||
group_interval: 5m
|
||||
repeat_interval: 12h
|
||||
repeat_interval: 4h
|
||||
|
||||
@@ -5,7 +5,6 @@ resources:
|
||||
- persistentVolume.yaml
|
||||
- external-secrets.yaml
|
||||
- grafana-alerting-configmap.yaml
|
||||
- alertmanager-config.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: kube-prometheus-stack
|
||||
|
||||
@@ -26,41 +26,11 @@ alertmanager:
|
||||
{{ if .Annotations.description }}<b>Description:</b> {{ .Annotations.description }}{{ end }}
|
||||
{{ end }}
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: traefik
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
hosts:
|
||||
- prom.hexor.cy
|
||||
paths:
|
||||
- /alertmanager
|
||||
tls:
|
||||
- secretName: alertmanager-tls
|
||||
hosts:
|
||||
- prom.hexor.cy
|
||||
alertmanagerSpec:
|
||||
secrets:
|
||||
- alertmanager-telegram-secret
|
||||
externalUrl: https://prom.hexor.cy/alertmanager
|
||||
routePrefix: /alertmanager
|
||||
|
||||
prometheus:
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: traefik
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
hosts:
|
||||
- prom.hexor.cy
|
||||
paths:
|
||||
- /
|
||||
tls:
|
||||
- secretName: prometheus-tls
|
||||
hosts:
|
||||
- prom.hexor.cy
|
||||
prometheusSpec:
|
||||
enableRemoteWriteReceiver: true
|
||||
additionalScrapeConfigs:
|
||||
|
||||
@@ -1,563 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nginx-config
|
||||
namespace: minecraft
|
||||
data:
|
||||
nginx.conf: |
|
||||
user nginx;
|
||||
worker_processes 1;
|
||||
error_log /var/log/nginx/error.log warn;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
|
||||
# Custom 502 error page with auto-refresh
|
||||
error_page 502 /502.html;
|
||||
location = /502.html {
|
||||
internal;
|
||||
return 200 '<!DOCTYPE html><html><head><meta charset="utf-8"><title>Server Loading</title><style>body{font-family:Arial,sans-serif;text-align:center;margin-top:100px;background:#f0f0f0}h1{color:#333}p{color:#666;font-size:18px}</style></head><body><h1>Server is loading probably...</h1><p>Please wait a moment and try refreshing the page.</p><script>setTimeout(function(){window.location.reload();}, 10000);</script></body></html>';
|
||||
add_header Content-Type text/html;
|
||||
}
|
||||
|
||||
# Main location - proxy to Minecraft Dynmap
|
||||
location / {
|
||||
# Proxy configuration for Dynmap server
|
||||
proxy_pass http://localhost:8123;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Inject user authentication meta tag into HTML head
|
||||
sub_filter '<head>' '<head><meta name="remote-user" content="$http_x_authentik_username">';
|
||||
|
||||
# Replace default Dynmap title with custom server name
|
||||
sub_filter 'Minecraft Dynamic Map' "Hexor's MC server";
|
||||
|
||||
# Inject custom script before closing body tag
|
||||
sub_filter "</body>" '<script src="/clients/inject.js"></script></body>';
|
||||
|
||||
# Apply sub_filter replacements globally (not just once)
|
||||
sub_filter_once off;
|
||||
}
|
||||
|
||||
# Serve inject.js and .ps1 scripts inline (no forced download)
|
||||
location = /clients/inject.js {
|
||||
alias /mc/clients/inject.js;
|
||||
default_type application/javascript;
|
||||
}
|
||||
|
||||
location ~ ^/clients/(.+\.ps1)$ {
|
||||
alias /mc/clients/$1;
|
||||
default_type text/plain;
|
||||
}
|
||||
|
||||
# Static file serving for client downloads
|
||||
location /clients/ {
|
||||
alias /mc/clients/;
|
||||
sendfile on; # Enable efficient file serving
|
||||
add_header Content-Disposition "attachment"; # Force download
|
||||
autoindex on; # Enable directory listing
|
||||
gzip off; # Disable compression for downloads
|
||||
chunked_transfer_encoding off; # Disable chunked encoding
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: client-scripts
|
||||
namespace: minecraft
|
||||
data:
|
||||
inject.js: |
|
||||
(function() {
|
||||
function getUsername() {
|
||||
var metas = document.querySelectorAll("meta");
|
||||
for (var i = 0; i < metas.length; i++) {
|
||||
if (metas[i].getAttribute("name") === "remote-user") {
|
||||
return metas[i].getAttribute("content");
|
||||
}
|
||||
}
|
||||
var jwt = document.cookie.split("; ").find(function(row) {
|
||||
return row.startsWith("authentik_session=");
|
||||
});
|
||||
if (jwt) {
|
||||
try {
|
||||
var token = jwt.split("=")[1];
|
||||
var payload = JSON.parse(atob(token.split(".")[1]));
|
||||
return payload.sub || payload.username || "web-user";
|
||||
} catch(e) {}
|
||||
}
|
||||
return "web-user";
|
||||
}
|
||||
|
||||
var username = getUsername();
|
||||
console.log("Username found:", username);
|
||||
|
||||
if (username && username !== "web-user" &&
|
||||
window.location.search.indexOf("playername=") === -1) {
|
||||
var currentUrl = new URL(window.location.href);
|
||||
currentUrl.searchParams.set("playername", username);
|
||||
console.log("Redirecting to:", currentUrl.href);
|
||||
window.location.href = currentUrl.href;
|
||||
}
|
||||
|
||||
document.addEventListener("DOMContentLoaded", function() {
|
||||
// User block
|
||||
var userBlock = document.createElement("div");
|
||||
userBlock.style.cssText = "background-color:#CEC6CB;color:black;padding:8px;text-align:center;font-size:medium;border-radius:4px;position:absolute;top:10px;right:150px;max-width:200px;";
|
||||
userBlock.innerHTML = "Logged in as: <b>" + username + "</b>";
|
||||
document.body.appendChild(userBlock);
|
||||
|
||||
// Info block
|
||||
var infoBlock = document.createElement("p");
|
||||
infoBlock.style.cssText = "background-color:#CEC6CB;color:black;padding:10px;text-align:center;font-size:large;display:inline-block;border-radius:4px;position:absolute;top:10px;left:150px;";
|
||||
infoBlock.innerHTML = 'GEYMERSKIY SOYUZ Server<br>'
|
||||
+ 'Get <a href="https://github.com/PrismLauncher/PrismLauncher/releases/tag/8.4">Prism Launcher</a> '
|
||||
+ 'and <a href="/clients/1.12.2.zip">client.zip</a> for this server. '
|
||||
+ 'Server address <b>minecraft.hexor.cy:30565</b><br>'
|
||||
+ 'Requires <a href="https://www.java.com/en/download/manual.jsp">Java 8</a><br><br>'
|
||||
+ '<a href="#" id="showInstallBtn" style="color:black;text-decoration:underline;">Windows Install Script</a>';
|
||||
document.body.appendChild(infoBlock);
|
||||
|
||||
// Modal
|
||||
var modal = document.createElement("div");
|
||||
modal.id = "installModal";
|
||||
modal.style.cssText = "display:none;position:fixed;z-index:1000;left:0;top:0;width:100%;height:100%;background-color:rgba(0,0,0,0.5);";
|
||||
modal.innerHTML = '<div style="background-color:#CEC6CB;margin:15% auto;padding:10px;border-radius:4px;width:70%;max-width:500px;text-align:center;color:black;font-size:large;">'
|
||||
+ '<h3 style="margin-top:0;color:black;">Windows Installation</h3>'
|
||||
+ '<p style="color:black;">Copy and paste this command into PowerShell:</p>'
|
||||
+ '<textarea id="scriptCommand" readonly style="width:90%;height:60px;font-family:monospace;padding:8px;border:1px solid #888;border-radius:4px;resize:none;background-color:white;color:black;"></textarea>'
|
||||
+ '<br><br>'
|
||||
+ '<button id="copyButton" style="background-color:#CEC6CB;color:black;padding:10px 15px;border:1px solid #888;border-radius:4px;cursor:pointer;margin-right:10px;font-size:large;">Copy</button>'
|
||||
+ '<button id="closeButton" style="background-color:#CEC6CB;color:black;padding:10px 15px;border:1px solid #888;border-radius:4px;cursor:pointer;font-size:large;">Close</button>'
|
||||
+ '</div>';
|
||||
document.body.appendChild(modal);
|
||||
|
||||
// Generate PowerShell command with username
|
||||
function buildPsCommand() {
|
||||
var d = "$";
|
||||
var q = "'";
|
||||
return d + 'f="' + d + 'env:TEMP\\mc-install.ps1"; iwr -useb https://minecraft.hexor.cy/clients/win-install.ps1 -OutFile '
|
||||
+ d + 'f; powershell -ExecutionPolicy Bypass -File ' + d + 'f -Username ' + q + username + q + '; Remove-Item ' + d + 'f';
|
||||
}
|
||||
|
||||
document.getElementById("showInstallBtn").addEventListener("click", function(e) {
|
||||
e.preventDefault();
|
||||
modal.style.display = "block";
|
||||
document.getElementById("scriptCommand").value = buildPsCommand();
|
||||
});
|
||||
|
||||
document.getElementById("closeButton").addEventListener("click", function() {
|
||||
modal.style.display = "none";
|
||||
});
|
||||
|
||||
document.getElementById("copyButton").addEventListener("click", function() {
|
||||
var textarea = document.getElementById("scriptCommand");
|
||||
textarea.select();
|
||||
textarea.setSelectionRange(0, 99999);
|
||||
document.execCommand("copy");
|
||||
var btn = document.getElementById("copyButton");
|
||||
btn.style.borderColor = "#4CAF50";
|
||||
setTimeout(function() { btn.style.borderColor = "#888"; }, 2000);
|
||||
});
|
||||
|
||||
modal.addEventListener("click", function(event) {
|
||||
if (event.target === modal) {
|
||||
modal.style.display = "none";
|
||||
}
|
||||
});
|
||||
});
|
||||
})();
|
||||
|
||||
win-install.ps1: |
|
||||
# Game Setup Script for PrismLauncher and Minecraft Client
|
||||
# This script downloads and configures PrismLauncher with Hexor client
|
||||
|
||||
param(
|
||||
[string]$Username = "",
|
||||
[string]$InstallPath = "$env:USERPROFILE\Games\PrismLauncher"
|
||||
)
|
||||
|
||||
# Enable TLS 1.2 for downloads
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
||||
|
||||
# Function to write colored log messages
|
||||
function Write-Log {
|
||||
param(
|
||||
[string]$Message,
|
||||
[string]$Level = "INFO"
|
||||
)
|
||||
|
||||
switch ($Level) {
|
||||
"INFO" {
|
||||
Write-Host "[" -NoNewline
|
||||
Write-Host "INFO" -ForegroundColor Blue -NoNewline
|
||||
Write-Host "] $Message"
|
||||
}
|
||||
"WARN" {
|
||||
Write-Host "[" -NoNewline
|
||||
Write-Host "WARN" -ForegroundColor Yellow -NoNewline
|
||||
Write-Host "] $Message"
|
||||
}
|
||||
"ERROR" {
|
||||
Write-Host "[" -NoNewline
|
||||
Write-Host "ERROR" -ForegroundColor Red -NoNewline
|
||||
Write-Host "] $Message"
|
||||
}
|
||||
"SUCCESS" {
|
||||
Write-Host "[" -NoNewline
|
||||
Write-Host "SUCCESS" -ForegroundColor Green -NoNewline
|
||||
Write-Host "] $Message"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Function to download file with progress
|
||||
function Download-File {
|
||||
param(
|
||||
[string]$Url,
|
||||
[string]$OutputPath
|
||||
)
|
||||
|
||||
try {
|
||||
Write-Log "Downloading from: $Url"
|
||||
Write-Log "Saving to: $OutputPath"
|
||||
|
||||
if (Test-Path $OutputPath) {
|
||||
Remove-Item $OutputPath -Force
|
||||
Write-Log "Removed existing file to avoid corruption" "WARN"
|
||||
}
|
||||
|
||||
$webClient = New-Object System.Net.WebClient
|
||||
$webClient.DownloadFile($Url, $OutputPath)
|
||||
|
||||
if (Test-Path $OutputPath) {
|
||||
$fileSize = (Get-Item $OutputPath).Length
|
||||
Write-Log "Download completed successfully ($fileSize bytes)" "SUCCESS"
|
||||
return $true
|
||||
} else {
|
||||
Write-Log "Download failed - file not found" "ERROR"
|
||||
return $false
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Log "Download failed: $($_.Exception.Message)" "ERROR"
|
||||
return $false
|
||||
}
|
||||
}
|
||||
|
||||
# Function to extract ZIP archive
|
||||
function Extract-Archive {
|
||||
param(
|
||||
[string]$ArchivePath,
|
||||
[string]$DestinationPath
|
||||
)
|
||||
|
||||
try {
|
||||
Write-Log "Extracting archive: $ArchivePath"
|
||||
Write-Log "Destination: $DestinationPath"
|
||||
|
||||
if (!(Test-Path $ArchivePath)) {
|
||||
Write-Log "Archive file not found: $ArchivePath" "ERROR"
|
||||
return $false
|
||||
}
|
||||
|
||||
$fileSize = (Get-Item $ArchivePath).Length
|
||||
if ($fileSize -lt 1000) {
|
||||
Write-Log "Archive file too small ($fileSize bytes), probably corrupted" "ERROR"
|
||||
return $false
|
||||
}
|
||||
|
||||
if (!(Test-Path $DestinationPath)) {
|
||||
New-Item -ItemType Directory -Path $DestinationPath -Force | Out-Null
|
||||
}
|
||||
|
||||
$existingFiles = Get-ChildItem -Path $DestinationPath -File | Where-Object { $_.Extension -ne ".zip" }
|
||||
$existingDirs = Get-ChildItem -Path $DestinationPath -Directory
|
||||
|
||||
if ($existingFiles.Count -gt 0 -or $existingDirs.Count -gt 0) {
|
||||
Write-Log "Clearing existing files in destination directory" "WARN"
|
||||
$existingFiles | Remove-Item -Force -ErrorAction SilentlyContinue
|
||||
$existingDirs | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
Add-Type -AssemblyName System.IO.Compression.FileSystem
|
||||
|
||||
try {
|
||||
$zip = [System.IO.Compression.ZipFile]::OpenRead($ArchivePath)
|
||||
$entryCount = $zip.Entries.Count
|
||||
$zip.Dispose()
|
||||
Write-Log "ZIP file validated ($entryCount entries)" "SUCCESS"
|
||||
}
|
||||
catch {
|
||||
Write-Log "ZIP file validation failed: $($_.Exception.Message)" "ERROR"
|
||||
return $false
|
||||
}
|
||||
|
||||
[System.IO.Compression.ZipFile]::ExtractToDirectory($ArchivePath, $DestinationPath)
|
||||
|
||||
Write-Log "Archive extracted successfully" "SUCCESS"
|
||||
return $true
|
||||
}
|
||||
catch {
|
||||
Write-Log "Archive extraction failed: $($_.Exception.Message)" "ERROR"
|
||||
|
||||
if (Test-Path $ArchivePath) {
|
||||
Write-Log "Removing potentially corrupted archive file" "WARN"
|
||||
Remove-Item $ArchivePath -Force -ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
return $false
|
||||
}
|
||||
}
|
||||
|
||||
# Function to check Java installation
|
||||
function Check-JavaInstallation {
|
||||
try {
|
||||
$javaVersion = java -version 2>&1 | Select-String "version"
|
||||
if ($javaVersion) {
|
||||
Write-Log "Java is installed: $($javaVersion.ToString().Trim())" "SUCCESS"
|
||||
return $true
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Log "Java is not installed or not in PATH" "WARN"
|
||||
Write-Log "Please download Java from: https://www.java.com/en/download/manual.jsp" "WARN"
|
||||
Write-Log "Look for 'Windows Offline (64-bit)' version" "WARN"
|
||||
|
||||
$response = Read-Host "Do you want to continue without Java? (y/n)"
|
||||
if ($response -eq 'y' -or $response -eq 'Y') {
|
||||
Write-Log "Continuing without Java verification" "WARN"
|
||||
return $true
|
||||
} else {
|
||||
Write-Log "Installation cancelled. Please install Java first." "ERROR"
|
||||
return $false
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Function to generate a random hex string (UUID-like without dashes)
|
||||
function New-RandomHexId {
|
||||
param([int]$Length = 32)
|
||||
$bytes = New-Object byte[] ($Length / 2)
|
||||
$rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
|
||||
$rng.GetBytes($bytes)
|
||||
$rng.Dispose()
|
||||
return ($bytes | ForEach-Object { $_.ToString("x2") }) -join ''
|
||||
}
|
||||
|
||||
# Function to create accounts.json file with offline account
|
||||
function Create-AccountsFile {
|
||||
param(
|
||||
[string]$TargetPath,
|
||||
[string]$PlayerName
|
||||
)
|
||||
|
||||
$accountsPath = Join-Path $TargetPath "accounts.json"
|
||||
$profileId = New-RandomHexId -Length 32
|
||||
$clientToken = New-RandomHexId -Length 32
|
||||
$iat = [int][double]::Parse((Get-Date -UFormat %s))
|
||||
|
||||
$accountsObj = @{
|
||||
accounts = @(
|
||||
@{
|
||||
entitlement = @{
|
||||
canPlayMinecraft = $true
|
||||
ownsMinecraft = $true
|
||||
}
|
||||
"msa-client-id" = ""
|
||||
type = "MSA"
|
||||
},
|
||||
@{
|
||||
active = $true
|
||||
entitlement = @{
|
||||
canPlayMinecraft = $true
|
||||
ownsMinecraft = $true
|
||||
}
|
||||
profile = @{
|
||||
capes = @()
|
||||
id = $profileId
|
||||
name = $PlayerName
|
||||
skin = @{
|
||||
id = ""
|
||||
url = ""
|
||||
variant = ""
|
||||
}
|
||||
}
|
||||
type = "Offline"
|
||||
ygg = @{
|
||||
extra = @{
|
||||
clientToken = $clientToken
|
||||
userName = $PlayerName
|
||||
}
|
||||
iat = $iat
|
||||
token = "0"
|
||||
}
|
||||
}
|
||||
)
|
||||
formatVersion = 3
|
||||
}
|
||||
|
||||
try {
|
||||
$accountsObj | ConvertTo-Json -Depth 10 | Out-File -FilePath $accountsPath -Encoding UTF8
|
||||
Write-Log "Created accounts.json at: $accountsPath" "SUCCESS"
|
||||
Write-Log "Player name: $PlayerName" "SUCCESS"
|
||||
return $true
|
||||
}
|
||||
catch {
|
||||
Write-Log "Failed to create accounts.json: $($_.Exception.Message)" "ERROR"
|
||||
return $false
|
||||
}
|
||||
}
|
||||
|
||||
# Main installation process
|
||||
Write-Log "Starting PrismLauncher and Minecraft client setup"
|
||||
Write-Log "Player name: $Username"
|
||||
Write-Log "Installation path: $InstallPath"
|
||||
|
||||
# Create installation directory and clear if exists (but keep ZIP files)
|
||||
if (Test-Path $InstallPath) {
|
||||
Write-Log "Installation directory exists, clearing contents" "WARN"
|
||||
$existingFiles = Get-ChildItem -Path $InstallPath -File | Where-Object { $_.Extension -ne ".zip" }
|
||||
$existingDirs = Get-ChildItem -Path $InstallPath -Directory
|
||||
|
||||
$existingFiles | Remove-Item -Force -ErrorAction SilentlyContinue
|
||||
$existingDirs | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
|
||||
} else {
|
||||
New-Item -ItemType Directory -Path $InstallPath -Force | Out-Null
|
||||
Write-Log "Created installation directory: $InstallPath"
|
||||
}
|
||||
|
||||
# Step 1: Download PrismLauncher
|
||||
Write-Log "Step 1: Downloading PrismLauncher..."
|
||||
$launcherUrl = "https://github.com/PrismLauncher/PrismLauncher/releases/download/8.4/PrismLauncher-Windows-MSVC-Portable-8.4.zip"
|
||||
$launcherZip = Join-Path $InstallPath "PrismLauncher-8.4.zip"
|
||||
$launcherExtractPath = Join-Path $InstallPath "PrismLauncher-Windows-MSVC-Portable-8.4"
|
||||
|
||||
if (!(Download-File -Url $launcherUrl -OutputPath $launcherZip)) {
|
||||
Write-Log "Failed to download PrismLauncher. Exiting." "ERROR"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Step 2: Extract PrismLauncher
|
||||
Write-Log "Step 2: Extracting PrismLauncher..."
|
||||
if (!(Extract-Archive -ArchivePath $launcherZip -DestinationPath $InstallPath)) {
|
||||
Write-Log "Failed to extract PrismLauncher. Exiting." "ERROR"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Find the actual extracted directory
|
||||
$extractedDirs = Get-ChildItem -Path $InstallPath -Directory | Where-Object { $_.Name -like "*PrismLauncher*" }
|
||||
if ($extractedDirs.Count -gt 0) {
|
||||
$launcherExtractPath = $extractedDirs[0].FullName
|
||||
Write-Log "Found PrismLauncher directory: $launcherExtractPath" "SUCCESS"
|
||||
} else {
|
||||
Write-Log "Could not find extracted PrismLauncher directory. Checking for direct extraction..." "WARN"
|
||||
$prismExe = Join-Path $InstallPath "prismlauncher.exe"
|
||||
if (Test-Path $prismExe) {
|
||||
$launcherExtractPath = $InstallPath
|
||||
Write-Log "PrismLauncher extracted directly to: $launcherExtractPath" "SUCCESS"
|
||||
} else {
|
||||
Write-Log "Failed to locate PrismLauncher files. Exiting." "ERROR"
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
# Step 3: Create accounts.json in InstallPath (only if username provided)
|
||||
if ($Username -and $Username -ne "web-user") {
|
||||
Write-Log "Step 3: Creating accounts configuration for $Username..."
|
||||
if (!(Create-AccountsFile -TargetPath $InstallPath -PlayerName $Username)) {
|
||||
Write-Log "Failed to create accounts.json. Exiting." "ERROR"
|
||||
exit 1
|
||||
}
|
||||
} else {
|
||||
Write-Log "Step 3: No username provided, skipping accounts.json creation" "WARN"
|
||||
}
|
||||
|
||||
# Step 4: Check Java installation
|
||||
Write-Log "Step 4: Checking Java installation..."
|
||||
if (!(Check-JavaInstallation)) {
|
||||
Write-Log "Java check failed. Exiting." "ERROR"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Step 5: Download Minecraft client
|
||||
Write-Log "Step 5: Downloading Minecraft client..."
|
||||
$minecraftUrl = "https://minecraft.hexor.cy/clients/1.12.2.zip"
|
||||
$minecraftZip = Join-Path $InstallPath "minecraft-1.12.2.zip"
|
||||
$instancesPath = Join-Path $launcherExtractPath "instances"
|
||||
$hexorPath = Join-Path $instancesPath "Hexor"
|
||||
|
||||
if (!(Download-File -Url $minecraftUrl -OutputPath $minecraftZip)) {
|
||||
Write-Log "Failed to download Minecraft client. Exiting." "ERROR"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Step 6: Create instances directory and extract Minecraft client
|
||||
Write-Log "Step 6: Setting up Minecraft client..."
|
||||
if (!(Test-Path $instancesPath)) {
|
||||
New-Item -ItemType Directory -Path $instancesPath -Force | Out-Null
|
||||
Write-Log "Created instances directory"
|
||||
}
|
||||
|
||||
if (!(Test-Path $hexorPath)) {
|
||||
New-Item -ItemType Directory -Path $hexorPath -Force | Out-Null
|
||||
Write-Log "Created Hexor instance directory"
|
||||
}
|
||||
|
||||
if (!(Extract-Archive -ArchivePath $minecraftZip -DestinationPath $hexorPath)) {
|
||||
Write-Log "Failed to extract Minecraft client. Exiting." "ERROR"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Step 7: Cleanup temporary files
|
||||
Write-Log "Step 7: Cleaning up temporary files..."
|
||||
try {
|
||||
Remove-Item $launcherZip -Force
|
||||
Remove-Item $minecraftZip -Force
|
||||
Write-Log "Temporary files cleaned up" "SUCCESS"
|
||||
}
|
||||
catch {
|
||||
Write-Log "Could not remove temporary files: $($_.Exception.Message)" "WARN"
|
||||
}
|
||||
|
||||
# Final success message
|
||||
Write-Log "=== INSTALLATION COMPLETED SUCCESSFULLY ===" "SUCCESS"
|
||||
Write-Log "PrismLauncher location: $launcherExtractPath" "SUCCESS"
|
||||
Write-Log "Executable: $(Join-Path $launcherExtractPath 'prismlauncher.exe')" "SUCCESS"
|
||||
Write-Log "Minecraft client installed in: $hexorPath" "SUCCESS"
|
||||
if ($Username -and $Username -ne "web-user") {
|
||||
Write-Log "Player name configured: $Username" "SUCCESS"
|
||||
Write-Log "Accounts file: $(Join-Path $InstallPath 'accounts.json')" "SUCCESS"
|
||||
}
|
||||
Write-Log ""
|
||||
Write-Log "You can now run PrismLauncher and the Hexor instance should be available!"
|
||||
Write-Log "If Java was not installed, please download it from: https://www.java.com/en/download/manual.jsp"
|
||||
|
||||
# Ask if user wants to launch the game
|
||||
$launchResponse = Read-Host "Do you want to launch PrismLauncher now? (y/n)"
|
||||
if ($launchResponse -eq 'y' -or $launchResponse -eq 'Y') {
|
||||
$launcherExe = Join-Path $launcherExtractPath "prismlauncher.exe"
|
||||
if (Test-Path $launcherExe) {
|
||||
Write-Log "Launching PrismLauncher..." "INFO"
|
||||
Start-Process -FilePath $launcherExe -WorkingDirectory $launcherExtractPath
|
||||
} else {
|
||||
Write-Log "Launcher executable not found!" "ERROR"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,3 +1,69 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nginx-config
|
||||
namespace: minecraft
|
||||
data:
|
||||
nginx.conf: |
|
||||
user nginx;
|
||||
worker_processes 1;
|
||||
error_log /var/log/nginx/error.log warn;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
|
||||
# Custom 502 error page with auto-refresh
|
||||
error_page 502 /502.html;
|
||||
location = /502.html {
|
||||
internal;
|
||||
return 200 '<!DOCTYPE html><html><head><meta charset="utf-8"><title>Server Loading</title><style>body{font-family:Arial,sans-serif;text-align:center;margin-top:100px;background:#f0f0f0}h1{color:#333}p{color:#666;font-size:18px}</style></head><body><h1>Server is loading probably...</h1><p>Please wait a moment and try refreshing the page.</p><script>setTimeout(function(){window.location.reload();}, 10000);</script></body></html>';
|
||||
add_header Content-Type text/html;
|
||||
}
|
||||
|
||||
# Main location - proxy to Minecraft Dynmap
|
||||
location / {
|
||||
# Proxy configuration for Dynmap server
|
||||
proxy_pass http://localhost:8123;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Inject user authentication meta tag into HTML head
|
||||
sub_filter '<head>' '<head><meta name="remote-user" content="$http_x_authentik_username">';
|
||||
|
||||
# Replace default Dynmap title with custom server name
|
||||
sub_filter 'Minecraft Dynamic Map' "Hexor's MC server";
|
||||
|
||||
# Inject all custom content before closing body tag (single replacement)
|
||||
sub_filter "</body>" '<script>function getUsername(){var headers=document.querySelectorAll("meta");for(var i=0;i<headers.length;i++){if(headers[i].getAttribute("name")==="remote-user"){return headers[i].getAttribute("content");}}var jwt=document.cookie.split("; ").find(row=>row.startsWith("authentik_session="));if(jwt){try{var token=jwt.split("=")[1];var payload=JSON.parse(atob(token.split(".")[1]));return payload.sub||payload.username||"web-user";}catch(e){}}return "web-user";}var username=getUsername();console.log("Username found:", username);if(username && username!=="web-user" && window.location.search.indexOf("playername=")===-1){var currentUrl=new URL(window.location.href);currentUrl.searchParams.set("playername",username);console.log("Redirecting to:", currentUrl.href);window.location.href=currentUrl.href;}document.addEventListener("DOMContentLoaded",function(){var userBlock=document.createElement("div");userBlock.style.cssText="background-color: #CEC6CB; color: black; padding: 8px; text-align: center; font-size: medium; border-radius: 4px; position: absolute; top: 10px; right: 150px; max-width: 200px;";userBlock.innerHTML="Logged in as: <b>"+username+"</b>";document.body.appendChild(userBlock);});</script><p style="background-color: #CEC6CB; color: black; padding: 10px 10px; text-align: center; font-size: large; text-decoration: none; display: inline-block; border-radius: 4px; position: absolute; top: 10px; left: 150px;">GEYMERSKIY SOYUZ Server <br>Get <a href="https://github.com/PrismLauncher/PrismLauncher/releases/tag/8.4" >Prism Launcher</a> and <a href="/clients/1.12.2.zip" >client.zip</a> for this server. Server address <b>minecraft.hexor.cy:30565</b><br><br><a href="#" onclick="showInstallModal(); return false;" style="color: black; text-decoration: underline;">Windows Install Script</a></p><div id="installModal" style="display: none; position: fixed; z-index: 1000; left: 0; top: 0; width: 100%; height: 100%; background-color: rgba(0,0,0,0.5);"><div style="background-color: #CEC6CB; margin: 15% auto; padding: 10px; border-radius: 4px; width: 70%; max-width: 500px; text-align: center; color: black; font-size: large;"><h3 style="margin-top: 0; color: black;">Windows Installation</h3><p style="color: black;">Copy and paste this command into PowerShell:</p><textarea id="scriptCommand" readonly style="width: 90%; height: 60px; font-family: monospace; padding: 8px; border: 1px solid #888; border-radius: 4px; resize: none; background-color: white; color: black;">iwr -useb https://minecraft.hexor.cy/clients/win-install.ps1 | iex</textarea><br><br><button id="copyButton" onclick="copyToClipboard()" style="background-color: #CEC6CB; color: black; padding: 10px 15px; border: 1px solid #888; border-radius: 4px; cursor: pointer; margin-right: 10px; font-size: large; text-decoration: none;">Copy</button><button onclick="closeInstallModal()" style="background-color: #CEC6CB; color: black; padding: 10px 15px; border: 1px solid #888; border-radius: 4px; cursor: pointer; font-size: large; text-decoration: none;">Close</button></div></div><script>function showInstallModal() { document.getElementById("installModal").style.display = "block"; } function closeInstallModal() { document.getElementById("installModal").style.display = "none"; } function copyToClipboard() { var textarea = document.getElementById("scriptCommand"); textarea.select(); textarea.setSelectionRange(0, 99999); if (document.execCommand("copy")) { var button = document.getElementById("copyButton"); button.style.borderColor = "#4CAF50"; setTimeout(function() { button.style.borderColor = "#888"; }, 2000); } } window.onclick = function(event) { var modal = document.getElementById("installModal"); if (event.target == modal) { closeInstallModal(); } }</script></body>';
|
||||
|
||||
# Apply sub_filter replacements globally (not just once)
|
||||
sub_filter_once off;
|
||||
}
|
||||
|
||||
# Static file serving for client downloads
|
||||
location /clients/ {
|
||||
alias /mc/clients/;
|
||||
sendfile on; # Enable efficient file serving
|
||||
add_header Content-Disposition "attachment"; # Force download
|
||||
autoindex on; # Enable directory listing
|
||||
gzip off; # Disable compression for downloads
|
||||
chunked_transfer_encoding off; # Disable chunked encoding
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
@@ -28,9 +94,6 @@ spec:
|
||||
- name: nginx-config
|
||||
configMap:
|
||||
name: nginx-config
|
||||
- name: client-scripts
|
||||
configMap:
|
||||
name: client-scripts
|
||||
|
||||
terminationGracePeriodSeconds: 10
|
||||
containers:
|
||||
@@ -79,22 +142,6 @@ spec:
|
||||
- name: webstatus-mod
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8123
|
||||
initialDelaySeconds: 120
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8123
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
volumeMounts:
|
||||
- name: storage
|
||||
mountPath: /mc
|
||||
@@ -115,12 +162,6 @@ spec:
|
||||
subPath: nginx.conf
|
||||
- name: storage
|
||||
mountPath: /mc
|
||||
- name: client-scripts
|
||||
mountPath: /mc/clients/win-install.ps1
|
||||
subPath: win-install.ps1
|
||||
- name: client-scripts
|
||||
mountPath: /mc/clients/inject.js
|
||||
subPath: inject.js
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -5,4 +5,4 @@ resources:
|
||||
- app.yaml
|
||||
- deployments.yaml
|
||||
- services.yaml
|
||||
- configmaps.yaml
|
||||
#- ingress.yaml
|
||||
|
||||
@@ -60,23 +60,7 @@ EOT
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
"mtproxy-links" = {
|
||||
name = "mtproxy-links"
|
||||
slug = "mtproxy-links"
|
||||
group = "Core"
|
||||
external_host = "https://proxy.hexor.cy"
|
||||
internal_host = "http://secret-reader.mtproxy.svc:80"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
skip_path_regex = <<-EOT
|
||||
/webhook
|
||||
EOT
|
||||
meta_icon = "https://img.icons8.com/ios-filled/50/password.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
|
||||
# Tools applications
|
||||
"vpn" = {
|
||||
name = "VPN"
|
||||
@@ -205,9 +189,6 @@ EOT
|
||||
meta_icon = "https://img.icons8.com/color/48/minecraft-grass-cube.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
skip_path_regex = <<-EOT
|
||||
/clients
|
||||
EOT
|
||||
}
|
||||
"pasarguard" = {
|
||||
name = "PasarGuard"
|
||||
|
||||
Reference in New Issue
Block a user