Compare commits
23 Commits
auto-updat
...
auto-updat
| Author | SHA1 | Date | |
|---|---|---|---|
|
32e4c85ece | ||
|
0a9af8f7bd | ||
|
|
b52676e8c7 | ||
|
|
51fa410231 | ||
|
|
8e69b134a4 | ||
|
|
ecb611cf5f | ||
|
|
1843cb2beb | ||
|
|
cfda43e116 | ||
|
|
d39069ca2c | ||
| dad43693bb | |||
|
|
5d811bd021 | ||
|
|
07b4b7bdf8 | ||
|
|
4be4b1168c | ||
|
|
5588eff8c8 | ||
| 2a5d5af180 | |||
| 0e733f0e3e | |||
|
|
b4eacf2bd3 | ||
|
|
14cbcc8579 | ||
| c5153115da | |||
|
|
56699cd2c6 | ||
|
|
4feed32f94 | ||
|
|
9d67f443c3 | ||
| b12276072a |
@@ -16,6 +16,7 @@ ArgoCD homelab project
|
||||
| **authentik** | [](https://ag.hexor.cy/applications/argocd/authentik) |
|
||||
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
@@ -37,6 +38,8 @@ ArgoCD homelab project
|
||||
|
||||
| Application | Status |
|
||||
| :--- | :---: |
|
||||
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||
| **furumi-server** | [](https://ag.hexor.cy/applications/argocd/furumi-server) |
|
||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||
| **greece-notifier** | [](https://ag.hexor.cy/applications/argocd/greece-notifier) |
|
||||
| **hexound** | [](https://ag.hexor.cy/applications/argocd/hexound) |
|
||||
@@ -45,6 +48,9 @@ ArgoCD homelab project
|
||||
| **jellyfin** | [](https://ag.hexor.cy/applications/argocd/jellyfin) |
|
||||
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
||||
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
||||
| **lidarr** | [](https://ag.hexor.cy/applications/argocd/lidarr) |
|
||||
| **matrix** | [](https://ag.hexor.cy/applications/argocd/matrix) |
|
||||
| **mtproxy** | [](https://ag.hexor.cy/applications/argocd/mtproxy) |
|
||||
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
||||
| **ollama** | [](https://ag.hexor.cy/applications/argocd/ollama) |
|
||||
| **paperless** | [](https://ag.hexor.cy/applications/argocd/paperless) |
|
||||
|
||||
@@ -22,9 +22,34 @@ spec:
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: FURUMI_TOKEN
|
||||
value: "f38387266e75effe891b7953eb9c06b4"
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: TOKEN
|
||||
- name: FURUMI_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_ID
|
||||
- name: FURUMI_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_SECRET
|
||||
- name: FURUMI_OIDC_ISSUER_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_ISSUER_URL
|
||||
- name: FURUMI_OIDC_REDIRECT_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_REDIRECT_URL
|
||||
- name: FURUMI_ROOT
|
||||
value: "/media"
|
||||
- name: RUST_LOG
|
||||
value: "debug"
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: 50051
|
||||
@@ -32,6 +57,9 @@ spec:
|
||||
- name: metrics
|
||||
containerPort: 9090
|
||||
protocol: TCP
|
||||
- name: web-ui
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: music
|
||||
mountPath: /media
|
||||
|
||||
45
k8s/apps/furumi-server/external-secrets.yaml
Normal file
45
k8s/apps/furumi-server/external-secrets.yaml
Normal file
@@ -0,0 +1,45 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: furumi-ng-creds
|
||||
spec:
|
||||
target:
|
||||
name: furumi-ng-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
TOKEN: |-
|
||||
{{ .token }}
|
||||
OIDC_CLIENT_ID: |-
|
||||
{{ .client_id }}
|
||||
OIDC_CLIENT_SECRET: |-
|
||||
{{ .client_secret }}
|
||||
OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-ng-web/
|
||||
OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
|
||||
data:
|
||||
- secretKey: token
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[0].value
|
||||
- secretKey: client_id
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[1].value
|
||||
- secretKey: client_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[2].value
|
||||
28
k8s/apps/furumi-server/ingress.yaml
Normal file
28
k8s/apps/furumi-server/ingress.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: furumi-tls-ingress
|
||||
annotations:
|
||||
ingressClassName: traefik
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
acme.cert-manager.io/http01-edit-in-place: "true"
|
||||
spec:
|
||||
rules:
|
||||
- host: music.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: furumi-server-web
|
||||
port:
|
||||
number: 8080
|
||||
tls:
|
||||
- secretName: furumi-tls
|
||||
hosts:
|
||||
- '*.hexor.cy'
|
||||
|
||||
|
||||
@@ -6,3 +6,5 @@ resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- servicemonitor.yaml
|
||||
- external-secrets.yaml
|
||||
- ingress.yaml
|
||||
|
||||
@@ -28,3 +28,19 @@ spec:
|
||||
protocol: TCP
|
||||
port: 9090
|
||||
targetPort: 9090
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: furumi-server-web
|
||||
labels:
|
||||
app: furumi-server
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: furumi-server
|
||||
ports:
|
||||
- name: web-ui
|
||||
protocol: TCP
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
|
||||
@@ -61,8 +61,8 @@ spec:
|
||||
scope: "openid profile email"
|
||||
claims_imports:
|
||||
localpart:
|
||||
action: require
|
||||
template: "{{ `{{ user.preferred_username }}` }}"
|
||||
action: suggest
|
||||
template: "{{ `{{ user.preferred_username | split(\"@\") | first }}` }}"
|
||||
displayname:
|
||||
action: suggest
|
||||
template: "{{ `{{ user.name }}` }}"
|
||||
|
||||
@@ -16,16 +16,37 @@ postgres:
|
||||
enabled: false
|
||||
|
||||
## Disable components we don't need yet
|
||||
matrixRTC:
|
||||
enabled: false
|
||||
hookshot:
|
||||
enabled: false
|
||||
|
||||
## MatrixRTC - voice/video calls via LiveKit SFU
|
||||
matrixRTC:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: livekit.matrix.hexor.cy
|
||||
sfu:
|
||||
enabled: true
|
||||
manualIP: "138.201.61.182"
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
exposedServices:
|
||||
rtcTcp:
|
||||
enabled: true
|
||||
port: 30881
|
||||
rtcMuxedUdp:
|
||||
enabled: true
|
||||
port: 30882
|
||||
turnTLS:
|
||||
enabled: true
|
||||
port: 31443
|
||||
domain: turn.matrix.hexor.cy
|
||||
tlsTerminationOnPod: true
|
||||
|
||||
## Synapse homeserver
|
||||
synapse:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: matrix.hexor.cy
|
||||
host: synapse.matrix.hexor.cy
|
||||
postgres:
|
||||
host: psql.psql.svc
|
||||
port: 5432
|
||||
@@ -35,11 +56,6 @@ synapse:
|
||||
password:
|
||||
secret: matrix-postgres-creds
|
||||
secretKey: synapse_db_password
|
||||
additional:
|
||||
0-unsafe-locale:
|
||||
config: |
|
||||
database:
|
||||
allow_unsafe_locale: true
|
||||
media:
|
||||
storage:
|
||||
size: 20Gi
|
||||
@@ -61,9 +77,15 @@ matrixAuthenticationService:
|
||||
password:
|
||||
secret: matrix-postgres-creds
|
||||
secretKey: mas_db_password
|
||||
## Authentik OIDC upstream provider
|
||||
## Admin policy
|
||||
additional:
|
||||
0-oidc:
|
||||
0-admin-policy:
|
||||
config: |
|
||||
policy:
|
||||
data:
|
||||
admin_users:
|
||||
- username: ultradesu
|
||||
1-oidc:
|
||||
configSecret: matrix-oidc-config
|
||||
configSecretKey: mas-oidc.yaml
|
||||
# nodeSelector:
|
||||
@@ -73,7 +95,7 @@ matrixAuthenticationService:
|
||||
elementWeb:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: chat.hexor.cy
|
||||
host: chat.matrix.hexor.cy
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
@@ -81,7 +103,7 @@ elementWeb:
|
||||
elementAdmin:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: matrix-admin.hexor.cy
|
||||
host: admin.matrix.hexor.cy
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
|
||||
@@ -4,6 +4,7 @@ kind: Kustomization
|
||||
resources:
|
||||
- external-secrets.yaml
|
||||
- local-pv.yaml
|
||||
- open-terminal.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: ollama
|
||||
@@ -15,7 +16,7 @@ helmCharts:
|
||||
includeCRDs: true
|
||||
- name: open-webui
|
||||
repo: https://helm.openwebui.com/
|
||||
version: 12.8.1
|
||||
version: 12.10.0
|
||||
releaseName: openweb-ui
|
||||
namespace: ollama
|
||||
valuesFile: openweb-ui-values.yaml
|
||||
|
||||
53
k8s/apps/ollama/open-terminal.yaml
Normal file
53
k8s/apps/ollama/open-terminal.yaml
Normal file
@@ -0,0 +1,53 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: open-terminal
|
||||
labels:
|
||||
app: open-terminal
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: open-terminal
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: open-terminal
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: desktop
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: open-terminal
|
||||
image: ghcr.io/open-webui/open-terminal:latest
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
env:
|
||||
- name: OPEN_TERMINAL_API_KEY
|
||||
value: "LOCAL_ACCESS_TOKEN"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 2Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: open-terminal
|
||||
labels:
|
||||
app: open-terminal
|
||||
spec:
|
||||
selector:
|
||||
app: open-terminal
|
||||
ports:
|
||||
- port: 8000
|
||||
targetPort: 8000
|
||||
protocol: TCP
|
||||
@@ -54,19 +54,6 @@ server:
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
hosts:
|
||||
- idm.hexor.cy
|
||||
- nas.hexor.cy # TrueNAS Limassol
|
||||
- nc.hexor.cy # NaxtCloud
|
||||
- of.hexor.cy # Outfleet-v2
|
||||
- k8s.hexor.cy # k8s dashboard
|
||||
- qbt.hexor.cy # qBittorent for Jellyfin
|
||||
- prom.hexor.cy # Prometheus
|
||||
- khm.hexor.cy # Known Hosts keys Manager
|
||||
- backup.hexor.cy # Kopia Backup UI
|
||||
- fm.hexor.cy # Filemanager
|
||||
- minecraft.hexor.cy # Minecraft UI and server
|
||||
- pass.hexor.cy # k8s-secret for openai
|
||||
- ps.hexor.cy # pasarguard UI
|
||||
# - rw.hexor.cy # RemnaWave UI
|
||||
tls:
|
||||
- secretName: idm-tls
|
||||
hosts:
|
||||
|
||||
@@ -37,4 +37,5 @@ spec:
|
||||
dnsZones:
|
||||
- "ps.hexor.cy"
|
||||
- "of.hexor.cy"
|
||||
- "matrix.hexor.cy"
|
||||
|
||||
|
||||
@@ -195,9 +195,9 @@ oauth_applications = {
|
||||
meta_description = "Matrix Chat"
|
||||
meta_icon = "https://img.icons8.com/ios/100/40C057/matrix-logo.png"
|
||||
redirect_uris = [
|
||||
"https://matrix.hexor.cy/_matrix/client/unstable/org.matrix.msc2965/auth/upstream/callback",
|
||||
"https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A",
|
||||
]
|
||||
meta_launch_url = "https://matrix.hexor.cy"
|
||||
meta_launch_url = "https://chat.matrix.hexor.cy"
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
@@ -205,7 +205,27 @@ oauth_applications = {
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = []
|
||||
create_group = true
|
||||
create_group = false
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
"furumi-ng-web" = {
|
||||
name = "Furumi Web Player"
|
||||
slug = "furumi-ng-web"
|
||||
group = "Tools"
|
||||
meta_description = "Furumi Web Player"
|
||||
meta_icon = "https://img.icons8.com/pulsar-color/48/music.png"
|
||||
redirect_uris = [
|
||||
"https://music.hexor.cy/auth/callback",
|
||||
]
|
||||
meta_launch_url = "https://music.hexor.cy"
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = []
|
||||
create_group = false
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user