Compare commits
4 Commits
auto-updat
...
auto-updat
| Author | SHA1 | Date | |
|---|---|---|---|
|
c1ae992e2e | ||
|
751c573a48 | ||
|
|
5121dd8cfe | ||
| d0ab5c4774 |
@@ -16,6 +16,7 @@ ArgoCD homelab project
|
||||
| **authentik** | [](https://ag.hexor.cy/applications/argocd/authentik) |
|
||||
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
@@ -37,6 +38,8 @@ ArgoCD homelab project
|
||||
|
||||
| Application | Status |
|
||||
| :--- | :---: |
|
||||
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||
| **furumi-server** | [](https://ag.hexor.cy/applications/argocd/furumi-server) |
|
||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||
| **greece-notifier** | [](https://ag.hexor.cy/applications/argocd/greece-notifier) |
|
||||
| **hexound** | [](https://ag.hexor.cy/applications/argocd/hexound) |
|
||||
@@ -45,6 +48,9 @@ ArgoCD homelab project
|
||||
| **jellyfin** | [](https://ag.hexor.cy/applications/argocd/jellyfin) |
|
||||
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
||||
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
||||
| **lidarr** | [](https://ag.hexor.cy/applications/argocd/lidarr) |
|
||||
| **matrix** | [](https://ag.hexor.cy/applications/argocd/matrix) |
|
||||
| **mtproxy** | [](https://ag.hexor.cy/applications/argocd/mtproxy) |
|
||||
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
||||
| **ollama** | [](https://ag.hexor.cy/applications/argocd/ollama) |
|
||||
| **paperless** | [](https://ag.hexor.cy/applications/argocd/paperless) |
|
||||
|
||||
20
k8s/apps/matrix/app.yaml
Normal file
20
k8s/apps/matrix/app.yaml
Normal file
@@ -0,0 +1,20 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: matrix
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: matrix
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/matrix
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
82
k8s/apps/matrix/external-secrets.yaml
Normal file
82
k8s/apps/matrix/external-secrets.yaml
Normal file
@@ -0,0 +1,82 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: matrix-postgres-creds
|
||||
spec:
|
||||
target:
|
||||
name: matrix-postgres-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
synapse_db_password: |-
|
||||
{{ .synapse_db_password }}
|
||||
mas_db_password: |-
|
||||
{{ .mas_db_password }}
|
||||
data:
|
||||
- secretKey: synapse_db_password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: CHANGE_ME
|
||||
property: CHANGE_ME
|
||||
- secretKey: mas_db_password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: CHANGE_ME
|
||||
property: CHANGE_ME
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: matrix-oidc-config
|
||||
spec:
|
||||
target:
|
||||
name: matrix-oidc-config
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
mas-oidc.yaml: |
|
||||
upstream_oauth2:
|
||||
providers:
|
||||
- id: authentik
|
||||
human_name: Authentik
|
||||
issuer: https://idm.hexor.cy/application/o/matrix/
|
||||
client_id: {{ .oauth_client_id }}
|
||||
client_secret: {{ .oauth_client_secret }}
|
||||
scope: "openid profile email"
|
||||
claims_imports:
|
||||
localpart:
|
||||
action: require
|
||||
template: "{{ `{{ user.preferred_username }}` }}"
|
||||
displayname:
|
||||
action: suggest
|
||||
template: "{{ `{{ user.name }}` }}"
|
||||
email:
|
||||
action: suggest
|
||||
template: "{{ `{{ user.email }}` }}"
|
||||
set_email_verification: always
|
||||
data:
|
||||
- secretKey: oauth_client_id
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: CHANGE_ME
|
||||
property: CHANGE_ME
|
||||
- secretKey: oauth_client_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: CHANGE_ME
|
||||
property: CHANGE_ME
|
||||
15
k8s/apps/matrix/kustomization.yaml
Normal file
15
k8s/apps/matrix/kustomization.yaml
Normal file
@@ -0,0 +1,15 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- external-secrets.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: matrix-stack
|
||||
repo: oci://ghcr.io/element-hq/ess-helm
|
||||
version: 26.2.3
|
||||
releaseName: matrix-stack
|
||||
namespace: matrix
|
||||
valuesFile: matrix-stack-values.yaml
|
||||
includeCRDs: true
|
||||
85
k8s/apps/matrix/matrix-stack-values.yaml
Normal file
85
k8s/apps/matrix/matrix-stack-values.yaml
Normal file
@@ -0,0 +1,85 @@
|
||||
## Matrix server name - appears in @user:matrix.hexor.cy
|
||||
serverName: matrix.hexor.cy
|
||||
|
||||
## Use letsencrypt cluster issuer for all ingresses
|
||||
certManager:
|
||||
clusterIssuer: letsencrypt
|
||||
|
||||
## Global ingress settings
|
||||
ingress:
|
||||
className: traefik
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
|
||||
## Disable built-in PostgreSQL - using external database
|
||||
postgres:
|
||||
enabled: false
|
||||
|
||||
## Disable components we don't need yet
|
||||
matrixRTC:
|
||||
enabled: false
|
||||
hookshot:
|
||||
enabled: false
|
||||
haproxy:
|
||||
enabled: false
|
||||
|
||||
## Synapse homeserver
|
||||
synapse:
|
||||
enabled: true
|
||||
postgres:
|
||||
host: psql.psql.svc
|
||||
port: 5432
|
||||
user: synapse
|
||||
database: synapse
|
||||
sslMode: prefer
|
||||
password:
|
||||
secret: matrix-postgres-creds
|
||||
secretKey: synapse_db_password
|
||||
media:
|
||||
storage:
|
||||
size: 20Gi
|
||||
maxUploadSize: 100M
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Matrix Authentication Service
|
||||
matrixAuthenticationService:
|
||||
enabled: true
|
||||
postgres:
|
||||
host: psql.psql.svc
|
||||
port: 5432
|
||||
user: mas
|
||||
database: mas
|
||||
sslMode: prefer
|
||||
password:
|
||||
secret: matrix-postgres-creds
|
||||
secretKey: mas_db_password
|
||||
## Authentik OIDC upstream provider
|
||||
additional:
|
||||
0-oidc:
|
||||
configSecret: matrix-oidc-config
|
||||
configSecretKey: mas-oidc.yaml
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Element Web client
|
||||
elementWeb:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: chat.hexor.cy
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Element Admin panel
|
||||
elementAdmin:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: matrix-admin.hexor.cy
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Well-known delegation on the base domain
|
||||
wellKnownDelegation:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: matrix.hexor.cy
|
||||
@@ -10,7 +10,7 @@ resources:
|
||||
helmCharts:
|
||||
- name: cert-manager
|
||||
repo: https://charts.jetstack.io
|
||||
version: 1.19.1
|
||||
version: 1.20.0
|
||||
releaseName: cert-manager
|
||||
namespace: cert-manager
|
||||
valuesFile: values.yaml
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
{
|
||||
"permissions": {
|
||||
"allow": [
|
||||
"WebSearch",
|
||||
"WebFetch(domain:registry.terraform.io)",
|
||||
"Bash(C:UsersabAppDataLocalMicrosoftWinGetPackagesHashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbweterraform.exe apply -auto-approve)",
|
||||
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -auto-approve)",
|
||||
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -auto-approve -lock=false)",
|
||||
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" plan -lock=false)",
|
||||
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -replace=\"authentik_outpost.outposts[\"\"kubernetes-outpost\"\"]\" -auto-approve -lock=false)",
|
||||
"Bash(terraform plan:*)",
|
||||
"Bash(terraform state:*)",
|
||||
"Bash(TF_VAR_authentik_token=ZDTbu4OKl0UcmdYKG5XgkRThZO7vWX2xz0w5vP2d8sudIr44ccwKOby6iRUa terraform plan:*)",
|
||||
"Bash(TF_VAR_authentik_token=ZDTbu4OKl0UcmdYKG5XgkRThZO7vWX2xz0w5vP2d8sudIr44ccwKOby6iRUa terraform force-unlock:*)",
|
||||
"Bash(git:*)",
|
||||
"Bash(TF_VAR_authentik_token=ZDTbu4OKl0UcmdYKG5XgkRThZO7vWX2xz0w5vP2d8sudIr44ccwKOby6iRUa terraform state:*)",
|
||||
"Bash(terraform version:*)",
|
||||
"Bash(curl:*)"
|
||||
],
|
||||
"deny": [],
|
||||
"ask": []
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user