Compare commits

...

17 Commits

Author SHA1 Message Date
Gitea Actions Bot
a9f02e4bb9 Auto-update README with current k8s applications
All checks were successful
Terraform / Terraform (pull_request) Successful in 35s
Generated by CI/CD workflow on 2026-03-18 03:15:55

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.
2026-03-18 03:15:55 +00:00
935b9e0a51 Update furumi
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 11s
Check with kubeconform / lint (push) Successful in 7s
Auto-update README / Generate README and Create MR (push) Successful in 21s
2026-03-18 03:15:13 +00:00
9e68fc91a2 Update furumi
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 8s
Check with kubeconform / lint (push) Successful in 8s
Auto-update README / Generate README and Create MR (push) Successful in 15s
2026-03-18 03:13:51 +00:00
ab
a613ca086c Update k8s/core/postgresql/external-secrets.yaml
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 12s
Check with kubeconform / lint (push) Successful in 8s
Auto-update README / Generate README and Create MR (push) Successful in 7s
2026-03-18 02:55:32 +00:00
Ultradesu
dcd15b296f Fixed docker CI
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 10s
Check with kubeconform / lint (push) Successful in 14s
Auto-update README / Generate README and Create MR (push) Successful in 25s
2026-03-17 19:17:51 +00:00
Ultradesu
f21c9f548b Improve web UI
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 6s
Check with kubeconform / lint (push) Successful in 7s
Auto-update README / Generate README and Create MR (push) Successful in 6s
2026-03-17 16:19:04 +00:00
Ultradesu
c4bc80eed2 Improve web UI
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 9s
Check with kubeconform / lint (push) Successful in 8s
Auto-update README / Generate README and Create MR (push) Successful in 19s
2026-03-17 16:13:23 +00:00
Ultradesu
176c6e910e Fixed furumi oauth app
All checks were successful
Terraform / Terraform (push) Successful in 34s
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 8s
2026-03-17 15:19:12 +00:00
Ultradesu
5834fc23a7 Fixed UI
Some checks failed
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Has been cancelled
Check with kubeconform / lint (push) Successful in 13s
Auto-update README / Generate README and Create MR (push) Successful in 28s
2026-03-17 15:18:10 +00:00
Ultradesu
567e62e48c Gitea affinity runner
All checks were successful
Check with kubeconform / lint (push) Successful in 7s
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 11s
Auto-update README / Generate README and Create MR (push) Successful in 21s
2026-03-17 14:57:02 +00:00
Ultradesu
0a9af8f7bd Furumi: Added web ui with OIDC SSO
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 11s
Check with kubeconform / lint (push) Successful in 11s
Auto-update README / Generate README and Create MR (push) Successful in 29s
2026-03-17 14:49:47 +00:00
Ultradesu
b52676e8c7 Furumi: Added web ui with OIDC SSO
All checks were successful
Check with kubeconform / lint (push) Successful in 9s
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 14s
Auto-update README / Generate README and Create MR (push) Successful in 30s
2026-03-17 14:49:01 +00:00
Ultradesu
51fa410231 Furumi: Added web ui with OIDC SSO
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 10s
Check with kubeconform / lint (push) Successful in 11s
Auto-update README / Generate README and Create MR (push) Successful in 19s
2026-03-17 14:47:19 +00:00
Ultradesu
8e69b134a4 Furumi: Added web ui with OIDC SSO
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 9s
Check with kubeconform / lint (push) Successful in 8s
Auto-update README / Generate README and Create MR (push) Successful in 13s
2026-03-17 14:43:40 +00:00
Ultradesu
ecb611cf5f Furumi: Added web ui with OIDC SSO
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 9s
Check with kubeconform / lint (push) Successful in 12s
Auto-update README / Generate README and Create MR (push) Successful in 24s
2026-03-17 14:42:59 +00:00
Ultradesu
1843cb2beb Furumi: Added web ui with OIDC SSO
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 13s
Check with kubeconform / lint (push) Successful in 7s
Auto-update README / Generate README and Create MR (push) Successful in 8s
2026-03-17 14:35:13 +00:00
Ultradesu
cfda43e116 Added web player
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 14s
Terraform / Terraform (push) Successful in 43s
2026-03-17 14:00:41 +00:00
11 changed files with 348 additions and 100 deletions

View File

@@ -16,6 +16,7 @@ ArgoCD homelab project
| **authentik** | [![authentik](https://ag.hexor.cy/api/badge?name=authentik&revision=true)](https://ag.hexor.cy/applications/argocd/authentik) |
| **cert-manager** | [![cert-manager](https://ag.hexor.cy/api/badge?name=cert-manager&revision=true)](https://ag.hexor.cy/applications/argocd/cert-manager) |
| **external-secrets** | [![external-secrets](https://ag.hexor.cy/api/badge?name=external-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/external-secrets) |
| **gpu** | [![gpu](https://ag.hexor.cy/api/badge?name=gpu&revision=true)](https://ag.hexor.cy/applications/argocd/gpu) |
| **kube-system-custom** | [![kube-system-custom](https://ag.hexor.cy/api/badge?name=kube-system-custom&revision=true)](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
| **kubernetes-dashboard** | [![kubernetes-dashboard](https://ag.hexor.cy/api/badge?name=kubernetes-dashboard&revision=true)](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
| **longhorn** | [![longhorn](https://ag.hexor.cy/api/badge?name=longhorn&revision=true)](https://ag.hexor.cy/applications/argocd/longhorn) |
@@ -37,6 +38,8 @@ ArgoCD homelab project
| Application | Status |
| :--- | :---: |
| **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
| **furumi-server** | [![furumi-server](https://ag.hexor.cy/api/badge?name=furumi-server&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-server) |
| **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
| **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
| **hexound** | [![hexound](https://ag.hexor.cy/api/badge?name=hexound&revision=true)](https://ag.hexor.cy/applications/argocd/hexound) |
@@ -45,6 +48,9 @@ ArgoCD homelab project
| **jellyfin** | [![jellyfin](https://ag.hexor.cy/api/badge?name=jellyfin&revision=true)](https://ag.hexor.cy/applications/argocd/jellyfin) |
| **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
| **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
| **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
| **matrix** | [![matrix](https://ag.hexor.cy/api/badge?name=matrix&revision=true)](https://ag.hexor.cy/applications/argocd/matrix) |
| **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
| **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |
| **ollama** | [![ollama](https://ag.hexor.cy/api/badge?name=ollama&revision=true)](https://ag.hexor.cy/applications/argocd/ollama) |
| **paperless** | [![paperless](https://ag.hexor.cy/api/badge?name=paperless&revision=true)](https://ag.hexor.cy/applications/argocd/paperless) |

View File

@@ -18,16 +18,43 @@ spec:
kubernetes.io/hostname: master.tail2fe2d.ts.net
containers:
- name: furumi-server
image: ultradesu/furumi-server:latest
image: ultradesu/furumi-server:trunk
imagePullPolicy: Always
env:
- name: FURUMI_TOKEN
valueFrom:
secretKeyRef:
name: furumi-ng-token
name: furumi-ng-creds
key: TOKEN
- name: FURUMI_OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_CLIENT_ID
- name: FURUMI_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_CLIENT_SECRET
- name: FURUMI_OIDC_ISSUER_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_ISSUER_URL
- name: FURUMI_OIDC_REDIRECT_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_REDIRECT_URL
- name: FURUMI_OIDC_SESSION_SECRET
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_SESSION_SECRET
- name: FURUMI_ROOT
value: "/media"
- name: RUST_LOG
value: "info"
ports:
- name: grpc
containerPort: 50051
@@ -35,6 +62,9 @@ spec:
- name: metrics
containerPort: 9090
protocol: TCP
- name: web-ui
containerPort: 8080
protocol: TCP
volumeMounts:
- name: music
mountPath: /media

View File

@@ -2,16 +2,26 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: furumi-ng-token
name: furumi-ng-creds
spec:
target:
name: furumi-ng-token
name: furumi-ng-creds
deletionPolicy: Delete
template:
type: Opaque
data:
TOKEN: |-
{{ .token }}
OIDC_CLIENT_ID: |-
{{ .client_id }}
OIDC_CLIENT_SECRET: |-
{{ .client_secret }}
OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-ng-web/
OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
OIDC_SESSION_SECRET: |-
{{ .session_secret }}
PG_STRING: |-
postgres://furumi:{{ .pg_pass }}@psql.psql.svc:5432/furumi
data:
- secretKey: token
sourceRef:
@@ -21,3 +31,35 @@ spec:
remoteRef:
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
property: fields[0].value
- secretKey: client_id
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
property: fields[1].value
- secretKey: client_secret
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
property: fields[2].value
- secretKey: session_secret
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
property: fields[3].value
- secretKey: pg_pass
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: 2a9deb39-ef22-433e-a1be-df1555625e22
property: fields[16].value

View File

@@ -0,0 +1,35 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: furumi-tls-ingress
annotations:
ingressClassName: traefik
cert-manager.io/cluster-issuer: letsencrypt
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
acme.cert-manager.io/http01-edit-in-place: "true"
spec:
rules:
- host: music.hexor.cy
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: furumi-web-player
port:
number: 8080
- path: /admin
pathType: Prefix
backend:
service:
name: furumi-metadata-agent
port:
number: 8090
tls:
- secretName: furumi-tls
hosts:
- '*.hexor.cy'

View File

@@ -7,3 +7,6 @@ resources:
- service.yaml
- servicemonitor.yaml
- external-secrets.yaml
- ingress.yaml
- web-player.yaml
- metadata-agent.yaml

View File

@@ -0,0 +1,59 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: furumi-metadata-agent
labels:
app: furumi-metadata-agent
spec:
replicas: 1
selector:
matchLabels:
app: furumi-metadata-agent
template:
metadata:
labels:
app: furumi-metadata-agent
spec:
nodeSelector:
kubernetes.io/hostname: master.tail2fe2d.ts.net
containers:
- name: furumi-metadata-agent
image: ultradesu/furumi-metadata-agent:trunk
imagePullPolicy: Always
env:
- name: FURUMI_AGENT_DATABASE_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: PG_STRING
- name: FURUMI_AGENT_INBOX_DIR
value: "/inbox"
- name: FURUMI_AGENT_STORAGE_DIR
value: "/media"
- name: FURUMI_AGENT_OLLAMA_URL
value: "http://ollama.ollama.svc:11434"
- name: FURUMI_AGENT_OLLAMA_MODEL
value: "qwen3:14b"
- name: FURUMI_AGENT_POLL_INTERVAL_SECS
value: "10"
- name: RUST_LOG
value: "info"
ports:
- name: admin-ui
containerPort: 8090
protocol: TCP
volumeMounts:
- name: library
mountPath: /media
- name: inbox
mountPath: /inbox
volumes:
- name: library
hostPath:
path: /k8s/furumi/library
type: DirectoryOrCreate
- name: inbox
hostPath:
path: /k8s/furumi/inbox
type: DirectoryOrCreate

View File

@@ -28,3 +28,35 @@ spec:
protocol: TCP
port: 9090
targetPort: 9090
---
apiVersion: v1
kind: Service
metadata:
name: furumi-metadata-agent
labels:
app: furumi-metadata-agent
spec:
type: ClusterIP
selector:
app: furumi-metadata-agent
ports:
- name: admin-ui
protocol: TCP
port: 8090
targetPort: 8090
---
apiVersion: v1
kind: Service
metadata:
name: furumi-web-player
labels:
app: furumi-web-player
spec:
type: ClusterIP
selector:
app: furumi-web-player
ports:
- name: web-ui
protocol: TCP
port: 8080
targetPort: 8080

View File

@@ -0,0 +1,70 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: furumi-web-player
labels:
app: furumi-web-player
spec:
replicas: 1
selector:
matchLabels:
app: furumi-web-player
template:
metadata:
labels:
app: furumi-web-player
spec:
nodeSelector:
kubernetes.io/hostname: master.tail2fe2d.ts.net
containers:
- name: furumi-web-player
image: ultradesu/furumi-web-player:trunk
imagePullPolicy: Always
env:
- name: FURUMI_OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_CLIENT_ID
- name: FURUMI_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_CLIENT_SECRET
- name: FURUMI_OIDC_ISSUER_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_ISSUER_URL
- name: FURUMI_OIDC_REDIRECT_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_REDIRECT_URL
- name: FURUMI_OIDC_SESSION_SECRET
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_SESSION_SECRET
- name: FURUMI_PLAYER_DATABASE_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: PG_STRING
- name: FURUMI_PLAYER_STORAGE_DIR
value: "/media"
- name: RUST_LOG
value: "info"
ports:
- name: web-ui
containerPort: 8080
protocol: TCP
volumeMounts:
- name: music
mountPath: /media
volumes:
- name: music
hostPath:
path: /k8s/furumi/library
type: DirectoryOrCreate

View File

@@ -77,101 +77,6 @@ spec:
labels:
app: gitea-runner
spec:
#nodeSelector:
# kubernetes.io/hostname: home.homenet
volumes:
- name: docker-sock
hostPath:
path: /var/run/docker.sock
type: Socket
- name: runner-data
emptyDir:
sizeLimit: 30Gi
affinity:
nodeAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 1
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- home.homenet
- weight: 2
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- master.tail2fe2d.ts.net
- weight: 3
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- it.tail2fe2d.ts.net
- ch.tail2fe2d.ts.net
- us.tail2fe2d.ts.net
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- home.homenet
- it.tail2fe2d.ts.net
- ch.tail2fe2d.ts.net
- us.tail2fe2d.ts.net
- master.tail2fe2d.ts.net
containers:
- name: gitea-runner
image: gitea/act_runner:nightly
resources:
requests:
cpu: "100m"
memory: "256Mi"
ephemeral-storage: "1Gi" # reserve ephemeral storage
limits:
cpu: "3000m"
memory: "4Gi"
ephemeral-storage: "28Gi" # hard cap for /data usage
volumeMounts:
- name: docker-sock
mountPath: /var/run/docker.sock
- name: runner-data
mountPath: /data
env:
- name: GITEA_INSTANCE_URL
value: "https://gt.hexor.cy"
- name: GITEA_RUNNER_REGISTRATION_TOKEN
valueFrom:
secretKeyRef:
name: gitea-runner-act-runner-secrets
key: token
- name: GITEA_RUNNER_NAME
value: "k8s-runner"
- name: GITEA_RUNNER_LABELS
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: gitea-runner-desktop
spec:
replicas: 1
selector:
matchLabels:
app: gitea-runner-desktop
template:
metadata:
labels:
app: gitea-runner-desktop
spec:
nodeSelector:
kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
tolerations:
- key: workload
operator: Equal
@@ -185,6 +90,39 @@ spec:
- name: runner-data
emptyDir:
sizeLimit: 30Gi
affinity:
nodeAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- uk-desktop.tail2fe2d.ts.net
- weight: 50
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- home.homenet
- weight: 30
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- master.tail2fe2d.ts.net
- weight: 10
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- it.tail2fe2d.ts.net
- ch.tail2fe2d.ts.net
- us.tail2fe2d.ts.net
containers:
- name: gitea-runner
image: gitea/act_runner:nightly
@@ -211,6 +149,6 @@ spec:
name: gitea-runner-act-runner-secrets
key: token
- name: GITEA_RUNNER_NAME
value: "k8s-runner-desktop"
value: "k8s-runner"
- name: GITEA_RUNNER_LABELS
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"

View File

@@ -131,6 +131,8 @@ spec:
{{ .synapse }}
USER_mas: |-
{{ .mas }}
USER_furumi: |-
{{ .furumi }}
data:
- secretKey: authentik
sourceRef:
@@ -297,4 +299,15 @@ spec:
metadataPolicy: None
key: 2a9deb39-ef22-433e-a1be-df1555625e22
property: fields[15].value
- secretKey: furumi
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
conversionStrategy: Default
decodingStrategy: None
metadataPolicy: None
key: 2a9deb39-ef22-433e-a1be-df1555625e22
property: fields[16].value

View File

@@ -208,5 +208,25 @@ oauth_applications = {
create_group = false
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
}
"furumi-ng-web" = {
name = "Furumi Web Player"
slug = "furumi-ng-web"
group = "Tools"
meta_description = "Furumi Web Player"
meta_icon = "https://img.icons8.com/pulsar-color/48/music.png"
redirect_uris = [
"https://music.hexor.cy/auth/callback",
]
meta_launch_url = "https://music.hexor.cy"
client_type = "confidential"
include_claims_in_id_token = true
access_code_validity = "minutes=1"
access_token_validity = "minutes=5"
refresh_token_validity = "days=30"
scope_mappings = ["openid", "profile", "email"]
access_groups = []
create_group = true
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
}
}