Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-05-05 17:51:13 This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.
Added monitoring for auth-proxy
2026-05-05 17:51:13 +00:00 · 2026-05-05 18:50:43 +01:00 · 2026-05-05 18:49:58 +01:00 · 2026-05-05 17:43:25 +00:00 · 2026-05-05 17:37:20 +00:00 · 2026-05-05 16:57:26 +00:00
88 changed files with 3107 additions and 224 deletions
@@ -13,9 +13,13 @@ ArgoCD homelab project
 | Application | Status |
 | :--- | :---: |
 | **argocd** | [![argocd](https://ag.hexor.cy/api/badge?name=argocd&revision=true)](https://ag.hexor.cy/applications/argocd/argocd) |
 | **auth-proxy** | [![auth-proxy](https://ag.hexor.cy/api/badge?name=auth-proxy&revision=true)](https://ag.hexor.cy/applications/argocd/auth-proxy) |
 | **authentik** | [![authentik](https://ag.hexor.cy/api/badge?name=authentik&revision=true)](https://ag.hexor.cy/applications/argocd/authentik) |
 | **cert-manager** | [![cert-manager](https://ag.hexor.cy/api/badge?name=cert-manager&revision=true)](https://ag.hexor.cy/applications/argocd/cert-manager) |
 | **external-secrets** | [![external-secrets](https://ag.hexor.cy/api/badge?name=external-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/external-secrets) |
 | **gpu** | [![gpu](https://ag.hexor.cy/api/badge?name=gpu&revision=true)](https://ag.hexor.cy/applications/argocd/gpu) |
 | **kanidm** | [![kanidm](https://ag.hexor.cy/api/badge?name=kanidm&revision=true)](https://ag.hexor.cy/applications/argocd/kanidm) |
 | **keycloak** | [![keycloak](https://ag.hexor.cy/api/badge?name=keycloak&revision=true)](https://ag.hexor.cy/applications/argocd/keycloak) |
 | **kube-system-custom** | [![kube-system-custom](https://ag.hexor.cy/api/badge?name=kube-system-custom&revision=true)](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
 | **kubernetes-dashboard** | [![kubernetes-dashboard](https://ag.hexor.cy/api/badge?name=kubernetes-dashboard&revision=true)](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
 | **longhorn** | [![longhorn](https://ag.hexor.cy/api/badge?name=longhorn&revision=true)](https://ag.hexor.cy/applications/argocd/longhorn) |
@@ -37,6 +41,9 @@ ArgoCD homelab project
 | Application | Status |
 | :--- | :---: |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
 | **furumi-dev** | [![furumi-dev](https://ag.hexor.cy/api/badge?name=furumi-dev&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-dev) |
 | **furumi-server** | [![furumi-server](https://ag.hexor.cy/api/badge?name=furumi-server&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-server) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
 | **hexound** | [![hexound](https://ag.hexor.cy/api/badge?name=hexound&revision=true)](https://ag.hexor.cy/applications/argocd/hexound) |
@@ -45,6 +52,9 @@ ArgoCD homelab project
 | **jellyfin** | [![jellyfin](https://ag.hexor.cy/api/badge?name=jellyfin&revision=true)](https://ag.hexor.cy/applications/argocd/jellyfin) |
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
 | **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
 | **matrix** | [![matrix](https://ag.hexor.cy/api/badge?name=matrix&revision=true)](https://ag.hexor.cy/applications/argocd/matrix) |
 | **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
 | **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |
 | **ollama** | [![ollama](https://ag.hexor.cy/api/badge?name=ollama&revision=true)](https://ag.hexor.cy/applications/argocd/ollama) |
 | **paperless** | [![paperless](https://ag.hexor.cy/api/badge?name=paperless&revision=true)](https://ag.hexor.cy/applications/argocd/paperless) |
@@ -55,9 +65,12 @@ ArgoCD homelab project
 | **sonarr-stack** | [![sonarr-stack](https://ag.hexor.cy/api/badge?name=sonarr-stack&revision=true)](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
 | **stirling-pdf** | [![stirling-pdf](https://ag.hexor.cy/api/badge?name=stirling-pdf&revision=true)](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
 | **syncthing** | [![syncthing](https://ag.hexor.cy/api/badge?name=syncthing&revision=true)](https://ag.hexor.cy/applications/argocd/syncthing) |
 | **teamspeak** | [![teamspeak](https://ag.hexor.cy/api/badge?name=teamspeak&revision=true)](https://ag.hexor.cy/applications/argocd/teamspeak) |
 | **tg-bots** | [![tg-bots](https://ag.hexor.cy/api/badge?name=tg-bots&revision=true)](https://ag.hexor.cy/applications/argocd/tg-bots) |
 | **vaultwarden** | [![vaultwarden](https://ag.hexor.cy/api/badge?name=vaultwarden&revision=true)](https://ag.hexor.cy/applications/argocd/vaultwarden) |
 | **vpn** | [![vpn](https://ag.hexor.cy/api/badge?name=vpn&revision=true)](https://ag.hexor.cy/applications/argocd/vpn) |
 | **web-petting** | [![web-petting](https://ag.hexor.cy/api/badge?name=web-petting&revision=true)](https://ag.hexor.cy/applications/argocd/web-petting) |
 | **wedding** | [![wedding](https://ag.hexor.cy/api/badge?name=wedding&revision=true)](https://ag.hexor.cy/applications/argocd/wedding) |
 | **xandikos** | [![xandikos](https://ag.hexor.cy/api/badge?name=xandikos&revision=true)](https://ag.hexor.cy/applications/argocd/xandikos) |
 </td>
@@ -0,0 +1,20 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: furumi-dev
  namespace: argocd
 spec:
  project: apps
  destination:
    namespace: furumi-dev
    server: https://kubernetes.default.svc
  source:
    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
    targetRevision: HEAD
    path: k8s/apps/furumi-dev
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
    syncOptions:
      - CreateNamespace=true
@@ -0,0 +1,55 @@
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: furumi-ng-creds
 spec:
  target:
    name: furumi-ng-creds
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        OIDC_CLIENT_ID: |-
          {{ .client_id }}
        OIDC_CLIENT_SECRET: |-
          {{ .client_secret }}
        OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-dev/
        OIDC_REDIRECT_URL: https://music-dev.hexor.cy/auth/callback
        OIDC_SESSION_SECRET: |-
          {{ .session_secret }}
        PG_STRING: |-
          postgres://furumi_dev:{{ .pg_pass }}@psql.psql.svc:5432/furumi_dev
  data:
    - secretKey: client_id
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
        property: fields[0].value
    - secretKey: client_secret
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
        property: fields[1].value
    - secretKey: session_secret
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
        property: fields[2].value
    - secretKey: pg_pass
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[17].value
@@ -0,0 +1,66 @@
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: admin-strip
 spec:
  stripPrefix:
    prefixes:
      - /admin
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: furumi-tls-ingress
  annotations:
    ingressClassName: traefik
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
    acme.cert-manager.io/http01-edit-in-place: "true"
 spec:
  rules:
    - host: music-dev.hexor.cy
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: furumi-dev-web-player
                port:
                  number: 8080
          - path: /
            pathType: Prefix
            backend:
              service:
                name: furumi-dev-node-player
                port:
                  number: 3001
  tls:
    - secretName: furumi-tls
      hosts:
        - '*.hexor.cy'
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: furumi-dev-admin-ingress
  annotations:
    ingressClassName: traefik
    traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
 spec:
  rules:
    - host: music-dev.hexor.cy
      http:
        paths:
          - path: /admin
            pathType: Prefix
            backend:
              service:
                name: furumi-dev-metadata-agent
                port:
                  number: 8090
  tls:
    - secretName: furumi-tls
      hosts:
        - '*.hexor.cy'
@@ -0,0 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - app.yaml
  - service.yaml
  - external-secrets.yaml
  - ingress.yaml
  - web-player.yaml
  - node-player.yaml
  - metadata-agent.yaml
@@ -0,0 +1,59 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: furumi-dev-metadata-agent
  labels:
    app: furumi-dev-metadata-agent
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: furumi-dev-metadata-agent
  template:
    metadata:
      labels:
        app: furumi-dev-metadata-agent
    spec:
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-dev-metadata-agent
          image: ultradesu/furumi-metadata-agent:dev
          imagePullPolicy: Always
          env:
            - name: FURUMI_AGENT_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: PG_STRING
            - name: FURUMI_AGENT_INBOX_DIR
              value: "/inbox"
            - name: FURUMI_AGENT_STORAGE_DIR
              value: "/media"
            - name: FURUMI_AGENT_OLLAMA_URL
              value: "http://100.120.76.49:1234"
            - name: FURUMI_AGENT_OLLAMA_MODEL
              value: "qwen2.5-32b-instruct"
            - name: FURUMI_AGENT_POLL_INTERVAL_SECS
              value: "10"
            - name: RUST_LOG
              value: "info"
          ports:
            - name: admin-ui
              containerPort: 8090
              protocol: TCP
          volumeMounts:
            - name: library
              mountPath: /media
            - name: inbox
              mountPath: /inbox
      volumes:
        - name: library
          hostPath:
            path: /k8s/furumi-dev/library
            type: DirectoryOrCreate
        - name: inbox
          hostPath:
            path: /k8s/furumi-dev/inbox
            type: DirectoryOrCreate
@@ -0,0 +1,53 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: furumi-dev-node-player
  labels:
    app: furumi-dev-node-player
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: furumi-dev-node-player
  template:
    metadata:
      labels:
        app: furumi-dev-node-player
    spec:
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-dev-node-player
          image: ultradesu/furumi-node-player:dev
          imagePullPolicy: Always
          env:
            - name: PORT
              value: "3001"
            - name: BASE_URL
              value: "https://music-dev.hexor.cy"
            - name: FRONTEND_ORIGIN
              value: "https://music-dev.hexor.cy"
            - name: SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_SESSION_SECRET
            - name: OIDC_ISSUER_BASE_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_ISSUER_URL
            - name: OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_CLIENT_ID
            - name: OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_CLIENT_SECRET
          ports:
            - name: http
              containerPort: 3001
              protocol: TCP
@@ -0,0 +1,48 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: furumi-dev-metadata-agent
  labels:
    app: furumi-dev-metadata-agent
 spec:
  type: ClusterIP
  selector:
    app: furumi-dev-metadata-agent
  ports:
    - name: admin-ui
      protocol: TCP
      port: 8090
      targetPort: 8090
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: furumi-dev-web-player
  labels:
    app: furumi-dev-web-player
 spec:
  type: ClusterIP
  selector:
    app: furumi-dev-web-player
  ports:
    - name: http
      protocol: TCP
      port: 8080
      targetPort: 8080
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: furumi-dev-node-player
  labels:
    app: furumi-dev-node-player
 spec:
  type: ClusterIP
  selector:
    app: furumi-dev-node-player
  ports:
    - name: http
      protocol: TCP
      port: 3001
      targetPort: 3001
@@ -0,0 +1,69 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: furumi-dev-web-player
  labels:
    app: furumi-dev-web-player
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: furumi-dev-web-player
  template:
    metadata:
      labels:
        app: furumi-dev-web-player
    spec:
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-dev-web-player
          image: ultradesu/furumi-web-player:dev
          imagePullPolicy: Always
          env:
            - name: FURUMI_PLAYER_OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_CLIENT_ID
            - name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_CLIENT_SECRET
            - name: FURUMI_PLAYER_OIDC_ISSUER_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_ISSUER_URL
            - name: FURUMI_PLAYER_OIDC_REDIRECT_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_REDIRECT_URL
            - name: FURUMI_PLAYER_OIDC_SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_SESSION_SECRET
            - name: FURUMI_PLAYER_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: PG_STRING
            - name: FURUMI_PLAYER_STORAGE_DIR
              value: "/media"
            - name: RUST_LOG
              value: "info"
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          volumeMounts:
            - name: music
              mountPath: /media
      volumes:
        - name: music
          hostPath:
            path: /k8s/furumi-dev/library
            type: DirectoryOrCreate
@@ -18,7 +18,7 @@ spec:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-server
-          image: ultradesu/furumi-server:latest
+          image: ultradesu/furumi-server:trunk
          imagePullPolicy: Always
          env:
            - name: FURUMI_TOKEN
@@ -46,8 +46,15 @@ spec:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_REDIRECT_URL
            - name: FURUMI_OIDC_SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_SESSION_SECRET
            - name: FURUMI_ROOT
              value: "/media"
            - name: RUST_LOG
              value: "info"
          ports:
            - name: grpc
              containerPort: 50051
@@ -18,6 +18,10 @@ spec:
          {{ .client_secret }}
        OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-ng-web/
        OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
        OIDC_SESSION_SECRET: |-
          {{ .session_secret }}
        PG_STRING: |-
          postgres://furumi:{{ .pg_pass }}@psql.psql.svc:5432/furumi
  data:
    - secretKey: token
      sourceRef:
@@ -43,3 +47,19 @@ spec:
      remoteRef:
        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
        property: fields[2].value
    - secretKey: session_secret
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
        property: fields[3].value
    - secretKey: pg_pass
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[16].value
@@ -1,4 +1,13 @@
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: admin-strip
 spec:
  stripPrefix:
    prefixes:
      - /admin
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -17,12 +26,34 @@ spec:
            pathType: Prefix
            backend:
              service:
-                name: furumi-server-web
+                name: furumi-web-player
                port:
                  number: 8080
  tls:
    - secretName: furumi-tls
      hosts:
        - '*.hexor.cy'
-
+---
-
+apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: furumi-admin-ingress
  annotations:
    ingressClassName: traefik
    traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
 spec:
  rules:
    - host: music.hexor.cy
      http:
        paths:
          - path: /admin
            pathType: Prefix
            backend:
              service:
                name: furumi-metadata-agent
                port:
                  number: 8090
  tls:
    - secretName: furumi-tls
      hosts:
        - '*.hexor.cy'
@@ -8,3 +8,5 @@ resources:
  - servicemonitor.yaml
  - external-secrets.yaml
  - ingress.yaml
  - web-player.yaml
  - metadata-agent.yaml
@@ -0,0 +1,59 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: furumi-metadata-agent
  labels:
    app: furumi-metadata-agent
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: furumi-metadata-agent
  template:
    metadata:
      labels:
        app: furumi-metadata-agent
    spec:
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-metadata-agent
          image: ultradesu/furumi-metadata-agent:trunk
          imagePullPolicy: Always
          env:
            - name: FURUMI_AGENT_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: PG_STRING
            - name: FURUMI_AGENT_INBOX_DIR
              value: "/inbox"
            - name: FURUMI_AGENT_STORAGE_DIR
              value: "/media"
            - name: FURUMI_AGENT_OLLAMA_URL
              value: "http://100.120.76.49:1234"
            - name: FURUMI_AGENT_OLLAMA_MODEL
              value: "google/gemma-4-26b-a4b"
            - name: FURUMI_AGENT_POLL_INTERVAL_SECS
              value: "10"
            - name: RUST_LOG
              value: "info"
          ports:
            - name: admin-ui
              containerPort: 8090
              protocol: TCP
          volumeMounts:
            - name: library
              mountPath: /media
            - name: inbox
              mountPath: /inbox
      volumes:
        - name: library
          hostPath:
            path: /k8s/furumi/library
            type: DirectoryOrCreate
        - name: inbox
          hostPath:
            path: /k8s/furumi/inbox
            type: DirectoryOrCreate
@@ -32,13 +32,29 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: furumi-server-web
+  name: furumi-metadata-agent
  labels:
-    app: furumi-server
+    app: furumi-metadata-agent
 spec:
  type: ClusterIP
  selector:
-    app: furumi-server
+    app: furumi-metadata-agent
  ports:
    - name: admin-ui
      protocol: TCP
      port: 8090
      targetPort: 8090
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: furumi-web-player
  labels:
    app: furumi-web-player
 spec:
  type: ClusterIP
  selector:
    app: furumi-web-player
  ports:
    - name: web-ui
      protocol: TCP
@@ -0,0 +1,70 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: furumi-web-player
  labels:
    app: furumi-web-player
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: furumi-web-player
  template:
    metadata:
      labels:
        app: furumi-web-player
    spec:
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-web-player
          image: ultradesu/furumi-web-player:trunk
          imagePullPolicy: Always
          env:
            - name: FURUMI_PLAYER_OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_CLIENT_ID
            - name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_CLIENT_SECRET
            - name: FURUMI_PLAYER_OIDC_ISSUER_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_ISSUER_URL
            - name: FURUMI_PLAYER_OIDC_REDIRECT_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_REDIRECT_URL
            - name: FURUMI_PLAYER_OIDC_SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: OIDC_SESSION_SECRET
            - name: FURUMI_PLAYER_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-ng-creds
                  key: PG_STRING
            - name: FURUMI_PLAYER_STORAGE_DIR
              value: "/media"
            - name: RUST_LOG
              value: "info"
          ports:
            - name: web-ui
              containerPort: 8080
              protocol: TCP
          volumeMounts:
            - name: music
              mountPath: /media
      volumes:
        - name: music
          hostPath:
            path: /k8s/furumi/library
            type: DirectoryOrCreate
@@ -48,6 +48,8 @@ spec:
              value: "true"
            - name: GITEA__service__CAPTCHA_TYPE
              value: "hcaptcha"
            - name: GITEA__webhook__ALLOWED_HOST_LIST
              value: "*"
          envFrom:
          - secretRef:
              name: gitea-recapcha-creds
@@ -68,7 +70,7 @@ kind: Deployment
 metadata:
  name: gitea-runner
 spec:
-  replicas: 1
+  replicas: 2
  selector:
    matchLabels:
      app: gitea-runner
@@ -77,106 +79,19 @@ spec:
      labels:
        app: gitea-runner
    spec:
-      #nodeSelector:
+      dnsConfig:
-      #  kubernetes.io/hostname: home.homenet
+        options:
-      volumes:
+          - name: ndots
-        - name: docker-sock
+            value: "2"
          hostPath:
            path: /var/run/docker.sock
            type: Socket
        - name: runner-data
          emptyDir:
            sizeLimit: 30Gi
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 1
            preference:
              matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
                - home.homenet
          - weight: 2
            preference:
              matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
                - master.tail2fe2d.ts.net
          - weight: 3
            preference:
              matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
                - it.tail2fe2d.ts.net
                - ch.tail2fe2d.ts.net
                - us.tail2fe2d.ts.net
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
                - home.homenet
                - it.tail2fe2d.ts.net
                - ch.tail2fe2d.ts.net
                - us.tail2fe2d.ts.net
                - master.tail2fe2d.ts.net
      containers:
        - name: gitea-runner
          image: gitea/act_runner:nightly
          resources:
            requests:
              cpu: "100m"
              memory: "256Mi"
              ephemeral-storage: "1Gi"   # reserve ephemeral storage
            limits:
              cpu: "3000m"
              memory: "4Gi"
              ephemeral-storage: "28Gi"   # hard cap for /data usage
          volumeMounts:
            - name: docker-sock
              mountPath: /var/run/docker.sock
            - name: runner-data
              mountPath: /data
          env:
            - name: GITEA_INSTANCE_URL
              value: "https://gt.hexor.cy"
            - name: GITEA_RUNNER_REGISTRATION_TOKEN
              valueFrom:
                secretKeyRef:
                  name: gitea-runner-act-runner-secrets
                  key: token
            - name: GITEA_RUNNER_NAME
              value: "k8s-runner"
            - name: GITEA_RUNNER_LABELS
              value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: gitea-runner-desktop
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea-runner-desktop
  template:
    metadata:
      labels:
        app: gitea-runner-desktop
    spec:
      nodeSelector:
        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
      tolerations:
        - key: workload
          operator: Equal
          value: desktop
          effect: NoSchedule
        - key: workload
          operator: Equal
          value: ai
          effect: NoSchedule
      volumes:
        - name: docker-sock
          hostPath:
@@ -185,18 +100,43 @@ spec:
        - name: runner-data
          emptyDir:
            sizeLimit: 30Gi
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app: gitea-runner
              topologyKey: kubernetes.io/hostname
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            preference:
              matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
                - uk-desktop.tail2fe2d.ts.net
                - ai.tail2fe2d.ts.net
          - weight: 50
            preference:
              matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
                - home.homenet
                - it.tail2fe2d.ts.net
      containers:
        - name: gitea-runner
          image: gitea/act_runner:nightly
          resources:
-            requests:
+            #requests:
-              cpu: "100m"
+            #  cpu: "100m"
-              memory: "256Mi"
+            #  memory: "256Mi"
-              ephemeral-storage: "1Gi"
+            #  ephemeral-storage: "1Gi"
-            limits:
+            #limits:
-              cpu: "3000m"
+            #  cpu: "3000m"
-              memory: "4Gi"
+            #  memory: "4Gi"
-              ephemeral-storage: "28Gi"
+            #  ephemeral-storage: "28Gi"
          volumeMounts:
            - name: docker-sock
              mountPath: /var/run/docker.sock
@@ -204,13 +144,18 @@ spec:
              mountPath: /data
          env:
            - name: GITEA_INSTANCE_URL
              #value: "http://gitea.gitea.svc.cluster.local"
              value: "https://gt.hexor.cy"
            - name: GITEA_RUNNER_REGISTRATION_TOKEN
              valueFrom:
                secretKeyRef:
                  name: gitea-runner-act-runner-secrets
                  key: token
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: GITEA_RUNNER_NAME
-              value: "k8s-runner-desktop"
+              value: "$(NODE_NAME)"
            - name: GITEA_RUNNER_LABELS
              value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
@@ -0,0 +1,46 @@
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: auth-proxy
 spec:
  forwardAuth:
    address: http://auth-proxy.auth-proxy.svc:80/auth
    trustForwardHeader: true
    authResponseHeaders:
      - X-Auth-Request-User
      - X-Auth-Request-Email
      - X-Auth-Request-Groups
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: secret-reader
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`pass.hexor.cy`)
      kind: Rule
      middlewares:
        - name: auth-proxy
      services:
        - name: secret-reader
          port: 80
  tls:
    secretName: secret-reader-tls
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: secret-reader-tls
 spec:
  secretName: secret-reader-tls
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  dnsNames:
    - pass.hexor.cy
@@ -26,9 +26,9 @@ matrixRTC:
    host: livekit.matrix.hexor.cy
  sfu:
    enabled: true
-    manualIP: "138.201.61.182"
+    manualIP: "78.24.180.234"
    nodeSelector:
-      kubernetes.io/hostname: master.tail2fe2d.ts.net
+      kubernetes.io/hostname: spb.tail2fe2d.ts.net
    exposedServices:
      rtcTcp:
        enabled: true
@@ -45,6 +45,14 @@ matrixRTC:
 ## Synapse homeserver
 synapse:
  enabled: true
  additional:
    0-search-config:
      config: |
        user_directory:
          enabled: true
          search_all_users: true
          prefer_local_users: true
        enable_room_list_search: true
  ingress:
    host: synapse.matrix.hexor.cy
  postgres:
@@ -56,12 +64,12 @@ synapse:
    password:
      secret: matrix-postgres-creds
      secretKey: synapse_db_password
  nodeSelector:
    kubernetes.io/hostname: master.tail2fe2d.ts.net
  media:
    storage:
      size: 20Gi
    maxUploadSize: 100M
  # nodeSelector:
  #   kubernetes.io/hostname: nas.homenet
 ## Matrix Authentication Service
 matrixAuthenticationService:
@@ -88,24 +96,24 @@ matrixAuthenticationService:
    1-oidc:
      configSecret: matrix-oidc-config
      configSecretKey: mas-oidc.yaml
-  # nodeSelector:
+  nodeSelector:
-  #   kubernetes.io/hostname: nas.homenet
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
 ## Element Web client
 elementWeb:
  enabled: true
  ingress:
    host: chat.matrix.hexor.cy
-  # nodeSelector:
+  nodeSelector:
-  #   kubernetes.io/hostname: nas.homenet
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
 ## Element Admin panel
 elementAdmin:
  enabled: true
  ingress:
    host: admin.matrix.hexor.cy
-  # nodeSelector:
+  nodeSelector:
-  #   kubernetes.io/hostname: nas.homenet
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
 ## Well-known delegation on the base domain (host is derived from serverName)
 wellKnownDelegation:
@@ -5,7 +5,12 @@ resources:
  - ./app.yaml
  - ./rbac.yaml
  - ./daemonset.yaml
  - ./telemt-daemonset.yaml
  - ./external-secrets.yaml
  - ./telemt-external-secrets.yaml
  - ./telemt-service.yaml
  - ./telemt-servicemonitor.yaml
  - ./service.yaml
  - ./secret-reader.yaml
  - ./secret-reader-ingress.yaml
 # - ./storage.yaml
@@ -0,0 +1,45 @@
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: auth-proxy
 spec:
  forwardAuth:
    address: http://auth-proxy.auth-proxy.svc:80/auth
    trustForwardHeader: true
    authResponseHeaders:
      - X-Auth-Request-User
      - X-Auth-Request-Email
      - X-Auth-Request-Groups
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: secret-reader
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`secret-reader.hexor.cy`)
      kind: Rule
      middlewares:
        - name: auth-proxy
      services:
        - name: secret-reader
          port: 80
  tls:
    secretName: secret-reader-tls
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: secret-reader-tls
 spec:
  secretName: secret-reader-tls
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  dnsNames:
    - secret-reader.hexor.cy
@@ -23,7 +23,7 @@ spec:
        imagePullPolicy: Always
        args:
          - "--secrets"
-          - "mtproxy-links"
+          - "mtproxy-links,telemt-links"
          - "--namespace"
          - "mtproxy"
          - "--port"
@@ -0,0 +1,115 @@
 ---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: telemt
  labels:
    app: telemt
 spec:
  selector:
    matchLabels:
      app: telemt
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: telemt
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: mtproxy
                    operator: Exists
      serviceAccountName: mtproxy
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      initContainers:
        - name: register-proxy
          image: bitnami/kubectl:latest
          env:
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: SECRET
              valueFrom:
                secretKeyRef:
                  name: tgproxy-secret
                  key: SECRET
            - name: TELEMT_PORT
              valueFrom:
                secretKeyRef:
                  name: telemt-secret
                  key: PORT
          command:
            - /bin/bash
            - -c
            - |
              set -e
              NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
              SERVER=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.mtproxy}')
              if [ -z "${SERVER}" ]; then
                echo "ERROR: node ${NODE_NAME} has no mtproxy label"
                exit 1
              fi
              # Build ee-prefixed secret: ee + secret + hex(tls_domain)
              # "ya.ru" = 79612e7275
              EE_SECRET="ee${SECRET}79612e7275"
              LINK="tg://proxy?server=${SERVER}&port=${TELEMT_PORT}&secret=${EE_SECRET}"
              echo "Registering telemt: ${SERVER} -> ${LINK}"
              if kubectl get secret telemt-links -n "${NAMESPACE}" &>/dev/null; then
                kubectl patch secret telemt-links -n "${NAMESPACE}" \
                  --type merge -p "{\"stringData\":{\"${SERVER}\":\"${LINK}\"}}"
              else
                kubectl create secret generic telemt-links -n "${NAMESPACE}" \
                  --from-literal="${SERVER}=${LINK}"
              fi
              echo "Done"
      containers:
        - name: telemt
          image: ghcr.io/telemt/telemt:latest
          imagePullPolicy: Always
          ports:
            - name: proxy
              containerPort: 30444
              protocol: TCP
            - name: api
              containerPort: 9091
              protocol: TCP
          workingDir: /run/telemt
          env:
            - name: RUST_LOG
              value: info
          volumeMounts:
            - name: workdir
              mountPath: /run/telemt
            - name: config
              mountPath: /run/telemt/config.toml
              subPath: config.toml
              readOnly: true
            - name: etcdir
              mountPath: /etc/telemt
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
      volumes:
        - name: config
          secret:
            secretName: telemt-secret
            items:
              - key: config.toml
                path: config.toml
        - name: workdir
          emptyDir:
            medium: Memory
            sizeLimit: 1Mi
        - name: etcdir
          emptyDir:
            medium: Memory
            sizeLimit: 1Mi
@@ -0,0 +1,59 @@
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: telemt-secret
 spec:
  target:
    name: telemt-secret
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        SECRET: |-
          {{ .secret }}
        PORT: "30444"
        config.toml: |
          [general]
          use_middle_proxy = true
          log_level = "normal"
          [general.modes]
          classic = false
          secure = false
          tls = true
          [general.links]
          show = "*"
          public_port = 30444
          [server]
          port = 30444
          metrics_port = 9090
          metrics_whitelist = ["0.0.0.0/0"]
          [server.api]
          enabled = true
          listen = "0.0.0.0:9091"
          whitelist = ["0.0.0.0/0"]
          [[server.listeners]]
          ip = "0.0.0.0"
          [censorship]
          tls_domain = "ya.ru"
          mask = true
          tls_emulation = true
          tls_front_dir = "tlsfront"
          [access.users]
          user = "{{ .secret }}"
  data:
    - secretKey: secret
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 58a37daf-72d8-430d-86bd-6152aa8f888d
        property: fields[0].value
@@ -0,0 +1,17 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: telemt-metrics
  labels:
    app: telemt
 spec:
  type: ClusterIP
  clusterIP: None
  selector:
    app: telemt
  ports:
    - port: 9090
      targetPort: 9090
      protocol: TCP
      name: metrics
@@ -0,0 +1,24 @@
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: telemt-metrics
  labels:
    app: telemt
    release: prometheus
 spec:
  selector:
    matchLabels:
      app: telemt
  endpoints:
    - port: metrics
      path: /metrics
      interval: 30s
      scrapeTimeout: 10s
      honorLabels: true
      relabelings:
        - sourceLabels: [__meta_kubernetes_pod_node_name]
          targetLabel: node
  namespaceSelector:
    matchNames:
      - mtproxy
@@ -1,71 +1,5 @@
 ---
-apiVersion: v1
+image: &image 'pasarguard/node:v0.4.0'
 kind: ServiceAccount
 metadata:
  name: pasarguard-node
  labels:
    app: pasarguard-node
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: pasarguard-node-configmap
  labels:
    app: pasarguard-node
 rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "create", "update", "patch"]
  - apiGroups: ["cert-manager.io"]
    resources: ["certificates"]
    verbs: ["get", "list", "create", "update", "patch", "delete"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["services", "endpoints"]
    verbs: ["get", "list", "create", "update", "patch", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: pasarguard-node-configmap
  labels:
    app: pasarguard-node
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pasarguard-node-configmap
 subjects:
  - kind: ServiceAccount
    name: pasarguard-node
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: pasarguard-node-reader
  labels:
    app: pasarguard-node
 rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  name: pasarguard-node-reader
  labels:
    app: pasarguard-node
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: pasarguard-node-reader
 subjects:
  - kind: ServiceAccount
    name: pasarguard-node
    namespace: pasarguard
 ---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -113,7 +47,7 @@ spec:
              mountPath: /scripts
      containers:
        - name: pasarguard-node
-          image: 'pasarguard/node:v0.2.1'
+          image: *image
          imagePullPolicy: Always
          command:
            - /bin/sh
@@ -219,3 +153,71 @@ spec:
          configMap:
            name: pasarguard-scripts
            defaultMode: 0755
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: pasarguard-node
  labels:
    app: pasarguard-node
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: pasarguard-node-configmap
  labels:
    app: pasarguard-node
 rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "create", "update", "patch"]
  - apiGroups: ["cert-manager.io"]
    resources: ["certificates"]
    verbs: ["get", "list", "create", "update", "patch", "delete"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["services", "endpoints"]
    verbs: ["get", "list", "create", "update", "patch", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: pasarguard-node-configmap
  labels:
    app: pasarguard-node
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pasarguard-node-configmap
 subjects:
  - kind: ServiceAccount
    name: pasarguard-node
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: pasarguard-node-reader
  labels:
    app: pasarguard-node
 rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  name: pasarguard-node-reader
  labels:
    app: pasarguard-node
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: pasarguard-node-reader
 subjects:
  - kind: ServiceAccount
    name: pasarguard-node
    namespace: pasarguard
@@ -1,4 +1,5 @@
 ---
 image: &image 'pasarguard/panel:v3.1.0'
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -34,7 +35,7 @@ spec:
              mountPath: /templates/subscription
      containers:
        - name: pasarguard-web
-          image: 'pasarguard/panel:latest'
+          image: *image
          imagePullPolicy: Always
          envFrom:
            - secretRef:
@@ -75,6 +76,9 @@ apiVersion: v1
 kind: Service
 metadata:
  name: pasarguard
  annotations:
    traefik.ingress.kubernetes.io/service.serversscheme: https
    traefik.ingress.kubernetes.io/service.serverstransport: pasarguard-pasarguard-transport@kubernetescrd
 spec:
  selector:
    app: pasarguard
@@ -0,0 +1,31 @@
 ---
 apiVersion: traefik.io/v1alpha1
 kind: ServersTransport
 metadata:
  name: pasarguard-transport
 spec:
  insecureSkipVerify: true
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: pasarguard-ingress
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
  ingressClassName: traefik
  rules:
    - host: ps.hexor.cy
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: pasarguard
                port:
                  number: 80
  tls:
    - secretName: pasarguard-tls
      hosts:
        - ps.hexor.cy
@@ -9,3 +9,4 @@ resources:
  - ./certificate.yaml
  - ./configmap-scripts.yaml
  - ./servicemonitor.yaml
  - ./ingress.yaml
@@ -0,0 +1,20 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: teamspeak
  namespace: argocd
 spec:
  project: apps
  destination:
    namespace: teamspeak
    server: https://kubernetes.default.svc
  source:
    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
    targetRevision: HEAD
    path: k8s/apps/teamspeak
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
    syncOptions:
      - CreateNamespace=true
@@ -0,0 +1,49 @@
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: teamspeak
  labels:
    app: teamspeak
 spec:
  selector:
    matchLabels:
      app: teamspeak
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: teamspeak
    spec:
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: teamspeak-data
      containers:
        - name: teamspeak
          image: 'teamspeak:latest'
          env:
            - name: TS3SERVER_LICENSE
              value: "accept"
          resources:
            requests:
              memory: "256Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "1000m"
          ports:
            - name: voice
              containerPort: 9987
              protocol: UDP
            - name: filetransfer
              containerPort: 30033
              protocol: TCP
            - name: serverquery
              containerPort: 10011
              protocol: TCP
          volumeMounts:
            - name: data
              mountPath: /var/ts3server
@@ -0,0 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - app.yaml
  - storage.yaml
  - deployment.yaml
  - service.yaml
@@ -0,0 +1,22 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: teamspeak
 spec:
  type: LoadBalancer
  selector:
    app: teamspeak
  ports:
    - name: voice
      protocol: UDP
      port: 9987
      targetPort: 9987
    - name: filetransfer
      protocol: TCP
      port: 30033
      targetPort: 30033
    - name: serverquery
      protocol: TCP
      port: 10011
      targetPort: 10011
@@ -0,0 +1,12 @@
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: teamspeak-data
 spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: longhorn
  resources:
    requests:
      storage: 5Gi
@@ -0,0 +1,21 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: web-petting
  namespace: argocd
 spec:
  project: apps
  destination:
    namespace: web-petting
    server: https://kubernetes.default.svc
  source:
    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
    targetRevision: HEAD
    path: k8s/apps/web-petting
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
    syncOptions:
      - CreateNamespace=true
@@ -0,0 +1,49 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: web-petting
  labels:
    app: web-petting
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: web-petting
  template:
    metadata:
      labels:
        app: web-petting
    spec:
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: web-petting-data
      containers:
      - name: web-petting
        image: ultradesu/web-petting:0.1.0
        imagePullPolicy: Always
        args:
 #         - "tail"
 #         - "-F"
 #         - "/1"
          - "web-petting"
          - "-l"
          - "0.0.0.0:3000"
        ports:
        - containerPort: 3000
          name: http
        volumeMounts:
          - name: data
            mountPath: /data
        env:
        - name: RUST_LOG
          value: "info"
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "150m"
@@ -0,0 +1,27 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: web-petting-tls-ingress
  annotations:
    ingressClassName: traefik
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
    acme.cert-manager.io/http01-edit-in-place: "true"
 spec:
  rules:
    - host: pet.hexor.cy
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-petting
                port:
                  number: 80
  tls:
    - secretName: web-petting-tls
      hosts:
        - pet.hexor.cy
@@ -0,0 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - app.yaml
  - deployment.yaml
  - service.yaml
  - ingress.yaml
  - storage.yaml
@@ -0,0 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: web-petting
  labels:
    app: web-petting
 spec:
  type: ClusterIP
  selector:
    app: web-petting
  ports:
  - port: 80
    targetPort: 3000
    protocol: TCP
    name: http
@@ -0,0 +1,12 @@
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: web-petting-data
 spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: longhorn
  resources:
    requests:
      storage: 10Gi
@@ -0,0 +1,20 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: wedding
  namespace: argocd
 spec:
  project: apps
  destination:
    namespace: wedding
    server: https://kubernetes.default.svc
  source:
    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
    targetRevision: HEAD
    path: k8s/apps/wedding
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
    syncOptions:
      - CreateNamespace=true
@@ -0,0 +1,69 @@
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: wedding
  labels:
    app: wedding
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: wedding
  template:
    metadata:
      labels:
        app: wedding
    spec:
      nodeSelector:
        kubernetes.io/hostname: spb.tail2fe2d.ts.net
      initContainers:
        - name: git-clone
          image: alpine/git:latest
          command:
            - sh
            - -c
            - git clone --depth 1 https://gt.hexor.cy/ab/wedding.git /src
          volumeMounts:
            - name: source
              mountPath: /src
        - name: zola-build
          image: ghcr.io/getzola/zola:v0.22.1
          command:
            - /bin/zola
          args:
            - --root
            - /src
            - build
            - --base-url
            - https://wedding.hexor.cy/
            - --output-dir
            - /public/html
          volumeMounts:
            - name: source
              mountPath: /src
            - name: public
              mountPath: /public
      containers:
        - name: nginx
          image: nginx:alpine
          ports:
            - containerPort: 80
              protocol: TCP
          volumeMounts:
            - name: public
              mountPath: /usr/share/nginx/html
              subPath: html
              readOnly: true
          resources:
            requests:
              memory: 32Mi
              cpu: 10m
            limits:
              memory: 64Mi
              cpu: 100m
      volumes:
        - name: source
          emptyDir: {}
        - name: public
          emptyDir: {}
@@ -0,0 +1,26 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: wedding-tls-ingress
  annotations:
    ingressClassName: traefik
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
    acme.cert-manager.io/http01-edit-in-place: "true"
 spec:
  rules:
    - host: wedding.hexor.cy
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: wedding
                port:
                  number: 80
  tls:
    - secretName: wedding-tls
      hosts:
        - wedding.hexor.cy
@@ -0,0 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - app.yaml
  - rbac.yaml
  - deployment.yaml
  - service.yaml
  - ingress.yaml
  - webhook.yaml
@@ -0,0 +1,42 @@
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: wedding-deployer
  namespace: wedding
 ---
 apiVersion: v1
 kind: Secret
 metadata:
  name: wedding-deployer-token
  namespace: wedding
  annotations:
    kubernetes.io/service-account.name: wedding-deployer
 type: kubernetes.io/service-account-token
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: wedding-restart
  namespace: wedding
 rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: wedding-deployer-restart
  namespace: wedding
 subjects:
  - kind: ServiceAccount
    name: wedding-deployer
    namespace: wedding
 roleRef:
  kind: Role
  name: wedding-restart
  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,12 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: wedding
 spec:
  selector:
    app: wedding
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
@@ -0,0 +1,71 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: webhook-script
 data:
  serve.sh: |
    #!/bin/sh
    echo "Webhook server listening on :8080"
    while true; do
      echo -e "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok" \
        | nc -l -p 8080 > /dev/null
      echo "Received webhook, restarting deployment..."
      kubectl rollout restart deployment/wedding
    done
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: wedding-webhook
  labels:
    app: wedding-webhook
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: wedding-webhook
  template:
    metadata:
      labels:
        app: wedding-webhook
    spec:
      nodeSelector:
        kubernetes.io/hostname: spb.tail2fe2d.ts.net
      serviceAccountName: wedding-deployer
      containers:
        - name: webhook
          image: alpine/k8s:1.32.3
          command: ["sh", "/scripts/serve.sh"]
          ports:
            - containerPort: 8080
              protocol: TCP
          volumeMounts:
            - name: script
              mountPath: /scripts
              readOnly: true
          resources:
            requests:
              memory: 16Mi
              cpu: 5m
            limits:
              memory: 32Mi
              cpu: 50m
      volumes:
        - name: script
          configMap:
            name: webhook-script
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: wedding-webhook
 spec:
  selector:
    app: wedding-webhook
  ports:
    - port: 8080
      targetPort: 8080
      protocol: TCP
@@ -24,31 +24,30 @@ configs:
    statusbadge.enabled: true
    timeout.reconciliation: 60s
    oidc.config: |
-      name: Authentik
+      name: Keycloak
-      issuer: https://idm.hexor.cy/application/o/argocd/
+      issuer: https://auth.hexor.cy/auth/realms/hexor
      clientID: $oidc-creds:id
      clientSecret: $oidc-creds:secret
-      requestedScopes: ["openid", "profile", "email", "groups", "offline_access"]
+      requestedScopes: ["openid", "profile", "email", "offline_access"]
      requestedIDTokenClaims: {"groups": {"essential": true}}
      refreshTokenThreshold: 2m
  rbac:
    create: true
    policy.default: ""
    policy.csv: |
-      # Bound OIDC Group and internal role
+        g, game-servers-managers, GameServersManagersRole
-      g, Game Servers Managers, GameServersManagersRole
+        # Role permissions
-      # Role permissions
+        p, GameServersManagersRole, applications, get, games/*, allow
-      p, GameServersManagersRole, applications, get, games/*, allow
+        p, GameServersManagersRole, applications, update, games/*, allow
-      p, GameServersManagersRole, applications, update, games/*, allow
+        p, GameServersManagersRole, applications, sync, games/*, allow
-      p, GameServersManagersRole, applications, sync, games/*, allow
+        p, GameServersManagersRole, applications, override, games/*, allow
-      p, GameServersManagersRole, applications, override, games/*, allow
+        p, GameServersManagersRole, applications, action/*, games/*, allow
-      p, GameServersManagersRole, applications, action/*, games/*, allow
+        p, GameServersManagersRole, exec, create, games/*, allow
-      p, GameServersManagersRole, exec, create, games/*, allow
+        p, GameServersManagersRole, logs, get, games/*, allow
-      p, GameServersManagersRole, logs, get, games/*, allow
+        p, GameServersManagersRole, applications, delete, games/*, deny
-      p, GameServersManagersRole, applications, delete, games/*, deny
+    
-
+        # Admin policy
-      # Admin policy
+        g, argocd-admins, role:admin
      g, ArgoCD Admins, role:admin
  secret:
    createSecret: true
@@ -0,0 +1,21 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: auth-proxy
  namespace: argocd
 spec:
  project: core
  destination:
    namespace: auth-proxy
    server: https://kubernetes.default.svc
  source:
    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
    targetRevision: HEAD
    path: k8s/core/auth-proxy
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
@@ -0,0 +1,79 @@
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: auth-proxy
  labels:
    app: auth-proxy
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: auth-proxy
  template:
    metadata:
      labels:
        app: auth-proxy
    spec:
      containers:
        - name: auth-proxy
          image: ultradesu/rsauth2-proxy:latest
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
          envFrom:
            - secretRef:
                name: auth-proxy-creds
          env:
            - name: AUTH_PROXY_OIDC_ISSUER
              value: "https://auth.hexor.cy/auth/realms/hexor"
            - name: AUTH_PROXY_COOKIE_DOMAIN
              value: ".hexor.cy"
            - name: AUTH_PROXY_CALLBACK_URL
              value: "https://oauth.hexor.cy/callback"
            - name: AUTH_PROXY_ROUTES_FILE
              value: "/config/routes.yaml"
            - name: AUTH_PROXY_LOG_LEVEL
              value: "debug"
          volumeMounts:
            - name: routes
              mountPath: /config
              readOnly: true
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
            limits:
              cpu: 200m
              memory: 64Mi
          readinessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 3
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
            runAsGroup: 1000
            capabilities:
              drop:
                - ALL
      volumes:
        - name: routes
          configMap:
            name: auth-proxy-routes
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
@@ -0,0 +1,40 @@
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: auth-proxy-creds
 spec:
  target:
    name: auth-proxy-creds
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        AUTH_PROXY_CLIENT_ID: rsauth2-proxy
        AUTH_PROXY_CLIENT_SECRET: |-
          {{ .client_secret }}
        AUTH_PROXY_COOKIE_SECRET: |-
          {{ .cookie_secret }}
  data:
    - secretKey: client_secret
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
        key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
        property: login.password
    - secretKey: cookie_secret
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
        key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
        property: fields[0].value
@@ -0,0 +1,28 @@
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: auth-proxy
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`oauth.hexor.cy`)
      kind: Rule
      services:
        - name: auth-proxy
          port: 80
  tls:
    secretName: auth-proxy-tls
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: auth-proxy-tls
 spec:
  secretName: auth-proxy-tls
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  dnsNames:
    - oauth.hexor.cy
@@ -0,0 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - app.yaml
  - external-secrets.yaml
  - deployment.yaml
  - service.yaml
  - ingress.yaml
  - servicemonitor.yaml
 # routes.yaml ConfigMap is managed by Terraform (kubernetes_config_map)
@@ -0,0 +1,15 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: auth-proxy
  labels:
    app: auth-proxy
 spec:
  ports:
    - name: http
      port: 80
      targetPort: 8080
      protocol: TCP
  selector:
    app: auth-proxy
@@ -0,0 +1,21 @@
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: auth-proxy-metrics
  labels:
    app: auth-proxy
    release: prometheus
 spec:
  selector:
    matchLabels:
      app: auth-proxy
  endpoints:
    - port: http
      path: /metrics
      interval: 30s
      scrapeTimeout: 10s
      honorLabels: true
  namespaceSelector:
    matchNames:
      - auth-proxy
@@ -5,12 +5,13 @@ resources:
  - app.yaml
  - external-secrets.yaml
  - https-middleware.yaml
  - outpost-selector-fix.yaml
 # - worker-restart.yaml
 helmCharts:
  - name: authentik
    repo: https://charts.goauthentik.io
-    version: 2026.2.1
+    version: 2026.2.2
    releaseName: authentik
    namespace: authentik
    valuesFile: values.yaml
@@ -0,0 +1,81 @@
 ## Workaround for authentik bug: embedded outpost controller creates
 ## a Service with selectors that don't match the pod labels it sets.
 ## Remove this after upgrading to a version with the fix.
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: outpost-selector-fix
  namespace: authentik
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: outpost-selector-fix
  namespace: authentik
 rules:
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get", "patch"]
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: outpost-selector-fix
  namespace: authentik
 subjects:
  - kind: ServiceAccount
    name: outpost-selector-fix
    namespace: authentik
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: outpost-selector-fix
 ---
 apiVersion: batch/v1
 kind: CronJob
 metadata:
  name: outpost-selector-fix
  namespace: authentik
 spec:
  schedule: "* * * * *"
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  concurrencyPolicy: Replace
  jobTemplate:
    spec:
      ttlSecondsAfterFinished: 300
      template:
        spec:
          serviceAccountName: outpost-selector-fix
          restartPolicy: OnFailure
          containers:
            - name: fix
              image: bitnami/kubectl:latest
              command:
                - /bin/sh
                - -c
                - |
                  SVC="ak-outpost-authentik-embedded-outpost"
                  # check if endpoints are populated
                  ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
                  if [ -n "$ADDRS" ]; then
                    echo "Endpoints OK ($ADDRS), nothing to fix"
                    exit 0
                  fi
                  echo "No endpoints for $SVC, patching selector..."
                  kubectl patch svc "$SVC" -n authentik --type=json -p '[
                    {"op":"remove","path":"/spec/selector/app.kubernetes.io~1component"},
                    {"op":"replace","path":"/spec/selector/app.kubernetes.io~1name","value":"authentik-outpost-proxy"}
                  ]'
                  echo "Patched. Verifying..."
                  sleep 2
                  ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
                  if [ -n "$ADDRS" ]; then
                    echo "Fix confirmed, endpoints: $ADDRS"
                  else
                    echo "WARNING: still no endpoints after patch"
                    exit 1
                  fi
@@ -1,6 +1,6 @@
 global:
  image:
-    tag: "2026.2.1"
+    tag: "2026.2.2"
 authentik:
    error_reporting:
@@ -18,11 +18,9 @@ spec:
              key: apiKey
        selector:
          dnsZones:
            - "*.hexor.cy"
            - "*.hexor.ru"
            - "*.btwiusearch.net"
            - "hexor.ru"
            - "hexor.cy"
            - "btwiusearch.net"
      - dns01:
          route53:
@@ -35,7 +33,6 @@ spec:
              key: secretKey
        selector:
          dnsZones:
-            - "ps.hexor.cy"
+            - "*.hexor.cy"
-            - "of.hexor.cy"
+            - "hexor.cy"
            - "matrix.hexor.cy"
@@ -0,0 +1,21 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: kanidm
  namespace: argocd
 spec:
  project: core
  destination:
    namespace: kanidm
    server: https://kubernetes.default.svc
  source:
    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
    targetRevision: HEAD
    path: k8s/core/kanidm
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
@@ -0,0 +1,12 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: kanidm-tls
 spec:
  secretName: kanidm-tls
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  dnsNames:
    - auth.hexor.cy
@@ -0,0 +1,19 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: kanidm-config
 data:
  server.toml: |
    bindaddress = "[::]:443"
    db_path = "/data/kanidm.db"
    tls_chain = "/certs/tls.crt"
    tls_key = "/certs/tls.key"
    domain = "auth.hexor.cy"
    origin = "https://auth.hexor.cy"
    log_level = "info"
    [online_backup]
    path = "/data/backups/"
    schedule = "00 22 * * *"
    versions = 7
@@ -0,0 +1,20 @@
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: kanidm
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`auth.hexor.cy`)
      kind: Rule
      services:
        - name: kanidm
          port: 443
          scheme: https
          serversTransport: kanidm-transport
  tls:
    secretName: kanidm-ingress-tls
@@ -0,0 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - app.yaml
  - configmap.yaml
  - certificate.yaml
  - statefulset.yaml
  - service.yaml
  - ingress.yaml
  - servers-transport.yaml
@@ -0,0 +1,7 @@
 ---
 apiVersion: traefik.io/v1alpha1
 kind: ServersTransport
 metadata:
  name: kanidm-transport
 spec:
  insecureSkipVerify: true
@@ -0,0 +1,15 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: kanidm
  labels:
    app: kanidm
 spec:
  ports:
    - name: https
      port: 443
      targetPort: 443
      protocol: TCP
  selector:
    app: kanidm
@@ -0,0 +1,86 @@
 ---
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  name: kanidm
  labels:
    app: kanidm
 spec:
  serviceName: kanidm
  replicas: 1
  selector:
    matchLabels:
      app: kanidm
  template:
    metadata:
      labels:
        app: kanidm
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: kanidm
          image: kanidm/server:1.9.3
          ports:
            - containerPort: 443
              name: https
              protocol: TCP
          volumeMounts:
            - name: kanidm-data
              mountPath: /data
            - name: kanidm-config
              mountPath: /data/server.toml
              subPath: server.toml
              readOnly: true
            - name: kanidm-tls
              mountPath: /certs
              readOnly: true
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"
          readinessProbe:
            httpGet:
              path: /status
              port: 443
              scheme: HTTPS
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /status
              port: 443
              scheme: HTTPS
            initialDelaySeconds: 15
            periodSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
            runAsUser: 1000
            runAsGroup: 1000
      volumes:
        - name: kanidm-config
          configMap:
            name: kanidm-config
        - name: kanidm-tls
          secret:
            secretName: kanidm-tls
      nodeSelector:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
  volumeClaimTemplates:
    - metadata:
        name: kanidm-data
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: longhorn
        resources:
          requests:
            storage: 1Gi
@@ -0,0 +1,21 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: keycloak
  namespace: argocd
 spec:
  project: core
  destination:
    namespace: keycloak
    server: https://kubernetes.default.svc
  source:
    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
    targetRevision: HEAD
    path: k8s/core/keycloak
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
@@ -0,0 +1,41 @@
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: keycloak-creds
 spec:
  target:
    name: keycloak-creds
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        KC_DB_USERNAME: keycloak
        KC_DB_PASSWORD: |-
          {{ .db_password }}
        KC_BOOTSTRAP_ADMIN_USERNAME: admin
        KC_BOOTSTRAP_ADMIN_PASSWORD: |-
          {{ .admin_password }}
  data:
    - secretKey: db_password
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[18].value
    - secretKey: admin_password
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
        key: 9422b636-a91d-40e4-bf98-925b2a3f831d
        property: login.password
@@ -0,0 +1,14 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - app.yaml
  - external-secrets.yaml
 helmCharts:
  - name: keycloakx
    repo: https://codecentric.github.io/helm-charts
    version: 7.1.11
    releaseName: keycloak
    namespace: keycloak
    valuesFile: values.yaml
@@ -0,0 +1,67 @@
 replicas: 1
 image:
  repository: quay.io/keycloak/keycloak
  tag: "26.5.6"
 command:
  - "/opt/keycloak/bin/kc.sh"
  - "start"
  - "--http-port=8080"
  - "--hostname-strict=false"
  - "--proxy-headers=xforwarded"
 extraEnvFrom: |
  - secretRef:
      name: keycloak-creds
 extraEnv: |
  - name: KC_HOSTNAME
    value: auth.hexor.cy
  - name: JAVA_OPTS_APPEND
    value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc"
 dbchecker:
  enabled: true
 database:
  vendor: postgres
  hostname: psql.psql.svc
  port: 5432
  database: keycloak
  existingSecret: keycloak-creds
  existingSecretKey: KC_DB_PASSWORD
 service:
  type: ClusterIP
 ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
  rules:
    - host: auth.hexor.cy
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: keycloak-tls
      hosts:
        - auth.hexor.cy
 resources:
  requests:
    cpu: 200m
    memory: 512Mi
  limits:
    cpu: "1"
    memory: 1Gi
 nodeSelector:
  kubernetes.io/hostname: master.tail2fe2d.ts.net
 tolerations:
  - key: node-role.kubernetes.io/master
    effect: NoSchedule
@@ -131,6 +131,12 @@ spec:
          {{ .synapse }}
        USER_mas: |-
          {{ .mas }}
        USER_furumi: |-
          {{ .furumi }}
        USER_furumi_dev: |-
          {{ .furumi_dev }}
        USER_keycloak: |-
          {{ .keycloak }}
  data:
    - secretKey: authentik
      sourceRef:
@@ -297,4 +303,36 @@ spec:
        metadataPolicy: None
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[15].value
-
+    - secretKey: furumi
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[16].value
    - secretKey: furumi_dev
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[17].value
    - secretKey: keycloak
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[18].value
@@ -7,6 +7,7 @@ resources:
  - grafana-alerting-configmap.yaml
  - alertmanager-config.yaml
  - furumi-dashboard-cm.yaml
  - telemt-dashboard-cm.yaml
 helmCharts:
  - name: kube-prometheus-stack
@@ -20,8 +20,12 @@ loki:
    filesystem:
      chunks_directory: /var/loki/chunks
      rules_directory: /var/loki/rules
  compactor:
    retention_enabled: true
    delete_request_store: filesystem
  limits_config:
    reject_old_samples: false
    retention_period: 1440h
    ingestion_rate_mb: 16
    ingestion_burst_size_mb: 32
    max_query_parallelism: 32
@@ -78,7 +78,7 @@ prometheus:
          - targets: ['prom-a2s-exporter.counter-strike.svc:9841']
            labels: {instance: master}
-    retention: "99999d"
+    retention: "380d"
    retentionSize: "0"
    nodeSelector:
      kubernetes.io/hostname: master.tail2fe2d.ts.net
@@ -0,0 +1,409 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: telemt-dashboard
  labels:
    grafana_dashboard: "1"
 data:
  telemt.json: |-
    {
      "annotations": { "list": [] },
      "editable": true,
      "fiscalYearStartMonth": 0,
      "graphTooltip": 1,
      "id": null,
      "links": [],
      "liveNow": false,
      "panels": [
        {
          "title": "Nodes Overview",
          "type": "table",
          "gridPos": { "h": 8, "w": 24, "x": 0, "y": 0 },
          "id": 1,
          "fieldConfig": {
            "defaults": {
              "custom": {
                "align": "auto",
                "cellOptions": { "type": "auto" },
                "inspect": false
              },
              "thresholds": {
                "mode": "absolute",
                "steps": [
                  { "color": "green", "value": null }
                ]
              }
            },
            "overrides": [
              {
                "matcher": { "id": "byName", "options": "Uptime" },
                "properties": [
                  { "id": "unit", "value": "dtdurations" },
                  { "id": "custom.width", "value": 140 }
                ]
              },
              {
                "matcher": { "id": "byName", "options": "Bad Conn" },
                "properties": [
                  { "id": "thresholds", "value": { "mode": "absolute", "steps": [{ "color": "green", "value": null }, { "color": "yellow", "value": 10 }, { "color": "red", "value": 100 }] } },
                  { "id": "custom.cellOptions", "value": { "type": "color-background", "mode": "basic" } }
                ]
              },
              {
                "matcher": { "id": "byName", "options": "Writers" },
                "properties": [
                  { "id": "thresholds", "value": { "mode": "absolute", "steps": [{ "color": "red", "value": null }, { "color": "green", "value": 1 }] } },
                  { "id": "custom.cellOptions", "value": { "type": "color-background", "mode": "basic" } }
                ]
              }
            ]
          },
          "options": {
            "showHeader": true,
            "sortBy": [{ "displayName": "Node", "desc": false }],
            "frameIndex": 0,
            "footer": { "show": false }
          },
          "transformations": [
            {
              "id": "joinByField",
              "options": { "byField": "node", "mode": "outer" }
            },
            {
              "id": "filterFieldsByName",
              "options": {
                "include": { "pattern": "^(node|Value.*)$" }
              }
            },
            {
              "id": "organize",
              "options": {
                "renameByName": {
                  "node": "Node",
                  "Value #uptime": "Uptime",
                  "Value #writers": "Writers",
                  "Value #buffers": "Buffers In Use",
                  "Value #connections": "Connections",
                  "Value #bad": "Bad Conn",
                  "Value #hs_timeout": "HS Timeouts"
                }
              }
            }
          ],
          "targets": [
            {
              "expr": "telemt_uptime_seconds{node=~\"$node\"}",
              "legendFormat": "",
              "refId": "uptime",
              "format": "table",
              "instant": true
            },
            {
              "expr": "telemt_me_writers_active_current{node=~\"$node\"}",
              "legendFormat": "",
              "refId": "writers",
              "format": "table",
              "instant": true
            },
            {
              "expr": "telemt_buffer_pool_buffers_total{node=~\"$node\", kind=\"in_use\"}",
              "legendFormat": "",
              "refId": "buffers",
              "format": "table",
              "instant": true
            },
            {
              "expr": "telemt_connections_total{node=~\"$node\"}",
              "legendFormat": "",
              "refId": "connections",
              "format": "table",
              "instant": true
            },
            {
              "expr": "telemt_connections_bad_total{node=~\"$node\"}",
              "legendFormat": "",
              "refId": "bad",
              "format": "table",
              "instant": true
            },
            {
              "expr": "telemt_handshake_timeouts_total{node=~\"$node\"}",
              "legendFormat": "",
              "refId": "hs_timeout",
              "format": "table",
              "instant": true
            }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        },
        {
          "title": "Connections Rate",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 8 },
          "id": 10,
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
              "unit": "cps",
              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
            },
            "overrides": []
          },
          "options": {
            "tooltip": { "mode": "multi", "sort": "desc" },
            "legend": { "displayMode": "list", "placement": "bottom" }
          },
          "targets": [
            { "expr": "rate(telemt_connections_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} accepted", "refId": "A" },
            { "expr": "rate(telemt_connections_bad_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} bad", "refId": "B" },
            { "expr": "rate(telemt_handshake_timeouts_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} hs timeout", "refId": "C" }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        },
        {
          "title": "Upstream Connect",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 8 },
          "id": 11,
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
              "unit": "cps",
              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
            },
            "overrides": []
          },
          "options": {
            "tooltip": { "mode": "multi", "sort": "desc" },
            "legend": { "displayMode": "list", "placement": "bottom" }
          },
          "targets": [
            { "expr": "rate(telemt_upstream_connect_success_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} success", "refId": "A" },
            { "expr": "rate(telemt_upstream_connect_fail_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} fail", "refId": "B" }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        },
        {
          "title": "Upstream Connect Duration (success)",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 16 },
          "id": 12,
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "bars", "fillOpacity": 50, "stacking": { "mode": "normal" } },
              "unit": "short",
              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
            },
            "overrides": []
          },
          "options": {
            "tooltip": { "mode": "multi", "sort": "desc" },
            "legend": { "displayMode": "list", "placement": "bottom" }
          },
          "targets": [
            { "expr": "increase(telemt_upstream_connect_duration_success_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} {{bucket}}", "refId": "A" }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        },
        {
          "title": "ME Writers & Pool",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 16 },
          "id": 13,
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
            },
            "overrides": []
          },
          "options": {
            "tooltip": { "mode": "multi", "sort": "desc" },
            "legend": { "displayMode": "list", "placement": "bottom" }
          },
          "targets": [
            { "expr": "telemt_me_writers_active_current{node=~\"$node\"}", "legendFormat": "{{node}} active", "refId": "A" },
            { "expr": "telemt_me_writers_warm_current{node=~\"$node\"}", "legendFormat": "{{node}} warm", "refId": "B" },
            { "expr": "telemt_pool_drain_active{node=~\"$node\"}", "legendFormat": "{{node}} draining", "refId": "C" }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        },
        {
          "title": "Per-User Active Connections",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 24 },
          "id": 20,
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
            },
            "overrides": []
          },
          "options": {
            "tooltip": { "mode": "multi", "sort": "desc" },
            "legend": { "displayMode": "list", "placement": "bottom" }
          },
          "targets": [
            { "expr": "telemt_user_connections_current{node=~\"$node\"}", "legendFormat": "{{node}} {{user}}", "refId": "A" }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        },
        {
          "title": "Per-User Traffic",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 24 },
          "id": 21,
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
              "unit": "Bps",
              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
            },
            "overrides": []
          },
          "options": {
            "tooltip": { "mode": "multi", "sort": "desc" },
            "legend": { "displayMode": "list", "placement": "bottom" }
          },
          "targets": [
            { "expr": "rate(telemt_user_octets_from_client{node=~\"$node\"}[5m])", "legendFormat": "{{node}} {{user}} rx", "refId": "A" },
            { "expr": "rate(telemt_user_octets_to_client{node=~\"$node\"}[5m])", "legendFormat": "{{node}} {{user}} tx", "refId": "B" }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        },
        {
          "title": "DC->Client Payload",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 32 },
          "id": 30,
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
              "unit": "Bps",
              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
            },
            "overrides": []
          },
          "options": {
            "tooltip": { "mode": "multi", "sort": "desc" },
            "legend": { "displayMode": "list", "placement": "bottom" }
          },
          "targets": [
            { "expr": "rate(telemt_me_d2c_payload_bytes_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} payload", "refId": "A" }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        },
        {
          "title": "ME Errors & Anomalies",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 32 },
          "id": 31,
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
              "unit": "cps",
              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
            },
            "overrides": []
          },
          "options": {
            "tooltip": { "mode": "multi", "sort": "desc" },
            "legend": { "displayMode": "list", "placement": "bottom" }
          },
          "targets": [
            { "expr": "rate(telemt_me_reconnect_attempts_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} reconnect", "refId": "A" },
            { "expr": "rate(telemt_me_handshake_reject_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} hs reject", "refId": "B" },
            { "expr": "rate(telemt_me_crc_mismatch_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} crc mismatch", "refId": "C" },
            { "expr": "rate(telemt_desync_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} desync", "refId": "D" }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        },
        {
          "title": "Per-User Unique IPs",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 40 },
          "id": 40,
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
            },
            "overrides": []
          },
          "options": {
            "tooltip": { "mode": "multi", "sort": "desc" },
            "legend": { "displayMode": "list", "placement": "bottom" }
          },
          "targets": [
            { "expr": "telemt_user_unique_ips_current{node=~\"$node\"}", "legendFormat": "{{node}} {{user}} active", "refId": "A" },
            { "expr": "telemt_user_unique_ips_recent_window{node=~\"$node\"}", "legendFormat": "{{node}} {{user}} recent", "refId": "B" }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        },
        {
          "title": "Conntrack",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 40 },
          "id": 41,
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
              "unit": "cps",
              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
            },
            "overrides": []
          },
          "options": {
            "tooltip": { "mode": "multi", "sort": "desc" },
            "legend": { "displayMode": "list", "placement": "bottom" }
          },
          "targets": [
            { "expr": "rate(telemt_conntrack_delete_total{node=~\"$node\", result=\"attempt\"}[5m])", "legendFormat": "{{node}} delete attempt", "refId": "A" },
            { "expr": "rate(telemt_conntrack_delete_total{node=~\"$node\", result=\"error\"}[5m])", "legendFormat": "{{node}} delete error", "refId": "B" },
            { "expr": "telemt_conntrack_event_queue_depth{node=~\"$node\"}", "legendFormat": "{{node}} queue depth", "refId": "C" }
          ],
          "datasource": { "type": "prometheus", "uid": "${datasource}" }
        }
      ],
      "refresh": "30s",
      "schemaVersion": 39,
      "tags": ["telemt", "mtproxy", "telegram"],
      "templating": {
        "list": [
          {
            "current": {},
            "hide": 0,
            "includeAll": false,
            "label": "Datasource",
            "multi": false,
            "name": "datasource",
            "options": [],
            "query": "prometheus",
            "refresh": 1,
            "regex": "",
            "skipUrlSync": false,
            "type": "datasource"
          },
          {
            "current": {},
            "datasource": { "type": "prometheus", "uid": "${datasource}" },
            "definition": "label_values(telemt_uptime_seconds, node)",
            "hide": 0,
            "includeAll": true,
            "label": "Node",
            "multi": true,
            "name": "node",
            "query": "label_values(telemt_uptime_seconds, node)",
            "refresh": 2,
            "regex": "",
            "skipUrlSync": false,
            "sort": 1,
            "type": "query"
          }
        ]
      },
      "time": { "from": "now-6h", "to": "now" },
      "title": "Telemt MTProxy",
      "uid": "telemt-mtproxy"
    }
@@ -7,6 +7,8 @@ metadata:
 spec:
  concurrency: 1
  cordon: true
  tolerations:
  - operator: Exists
  nodeSelector:
    matchExpressions:
    - key: node-role.kubernetes.io/control-plane
@@ -16,7 +18,7 @@ spec:
  serviceAccountName: system-upgrade
  upgrade:
    image: rancher/k3s-upgrade
-  version: v1.35.2+k3s1
+  version: v1.35.4+k3s1
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -27,6 +29,8 @@ metadata:
 spec:
  concurrency: 1
  cordon: true
  tolerations:
  - operator: Exists
  nodeSelector:
    matchExpressions:
    - key: node-role.kubernetes.io/control-plane
@@ -39,4 +43,4 @@ spec:
  serviceAccountName: system-upgrade
  upgrade:
    image: rancher/k3s-upgrade
-  version: v1.35.2+k3s1
+  version: v1.35.4+k3s1
@@ -35,7 +35,7 @@ spec:
      terminationGracePeriodSeconds: 10
      containers:
        - name: minecraft
-          image: 'openjdk:8-jdk-alpine'
+          image: 'eclipse-temurin:8-jdk-ubi10-minimal'
          command: ["java"]
          args:
            - -Xms4G
@@ -292,7 +292,60 @@ resource "authentik_outpost" "outposts" {
    authentik_host_browser         = ""
    object_naming_template         = "ak-outpost-%(name)s"
    authentik_host_insecure        = false
-    kubernetes_json_patches        = null
+    kubernetes_json_patches = {
      deployment = [
        {
          op   = "add"
          path = "/spec/template/spec/containers/0/env/-"
          value = {
            name  = "AUTHENTIK_POSTGRESQL__HOST"
            value = "psql.psql.svc"
          }
        },
        {
          op   = "add"
          path = "/spec/template/spec/containers/0/env/-"
          value = {
            name  = "AUTHENTIK_POSTGRESQL__PORT"
            value = "5432"
          }
        },
        {
          op   = "add"
          path = "/spec/template/spec/containers/0/env/-"
          value = {
            name  = "AUTHENTIK_POSTGRESQL__NAME"
            value = "authentik"
          }
        },
        {
          op   = "add"
          path = "/spec/template/spec/containers/0/env/-"
          value = {
            name = "AUTHENTIK_POSTGRESQL__USER"
            valueFrom = {
              secretKeyRef = {
                name = "authentik-creds"
                key  = "AUTHENTIK_POSTGRESQL__USER"
              }
            }
          }
        },
        {
          op   = "add"
          path = "/spec/template/spec/containers/0/env/-"
          value = {
            name = "AUTHENTIK_POSTGRESQL__PASSWORD"
            valueFrom = {
              secretKeyRef = {
                name = "authentik-creds"
                key  = "AUTHENTIK_POSTGRESQL__PASSWORD"
              }
            }
          }
        }
      ]
    }
    kubernetes_service_type        = "ClusterIP"
    kubernetes_image_pull_secrets  = []
    kubernetes_ingress_class_name  = null
@@ -225,7 +225,7 @@ oauth_applications = {
    refresh_token_validity     = "days=30"
    scope_mappings             = ["openid", "profile", "email"]
    access_groups              = []
-    create_group               = false
+    create_group               = true
    signing_key                = "1b1b5bec-034a-4d96-871a-133f11322360"
  }
 }
@@ -151,7 +151,7 @@ EOT
    meta_icon                    = "https://img.icons8.com/liquid-glass/48/key.png"
    mode                         = "proxy"
    outpost                      = "kubernetes-outpost"
-    access_groups                = ["admins", "khm"] # Используем существующие группы
+    access_groups                = ["admins", "khm"]
    create_group                 = true
    access_groups                = ["admins"]
  }
@@ -191,5 +191,20 @@ EOT
    create_group                 = true
    access_groups                = ["admins"]
  }
  "ollama-public" = {
    name                         = "Ollama Public"
    slug                         = "ollama-public"
    group                        = "AI"
    external_host                = "https://ollama.hexor.cy"
    internal_host                = "http://ollama.ollama.svc:11434"
    internal_host_ssl_validation = false
    meta_description             = ""
    meta_icon                    = "https://img.icons8.com/external-icongeek26-outline-icongeek26/64/external-llama-animal-head-icongeek26-outline-icongeek26.png"
    mode                         = "proxy"
    outpost                      = "kubernetes-outpost"
    intercept_header_auth        = true
    create_group                 = true
    access_groups                = ["admins"]
  }
 }
@@ -0,0 +1,47 @@
 # This file is maintained automatically by "terraform init".
 # Manual edits may be lost in future updates.
 provider "registry.terraform.io/hashicorp/kubernetes" {
  version     = "3.1.0"
  constraints = ">= 2.0.0"
  hashes = [
    "h1:G9QqKNpcztBRqrywtlNylFJSpGzDfRFtO8hcWLdkvRY=",
    "zh:0215c5c60be62028c09a2f22458e89cda3ef5830a632299f1d401eb3538874b0",
    "zh:09ebb9f442431e278a310a9423f32caf467cb4b3cad3fe59573ca71fa7b14e20",
    "zh:0c4e5912f83bb35846ae0a9ae54fc320706ee61894cd21cc6b4181b1c5a2fa5c",
    "zh:1678c982853ad461e65ccb5e79d585e13ed109dd47dab2a66d3a7a304faeef65",
    "zh:1c050a5c15e330457a9c18caacf61a923c59d663e13f2962e4b32f04fef523a0",
    "zh:2c55bcec83be58ec132c7cb0a1ac644758b800d794fdc636d53a0eada0358a3a",
    "zh:a062bb0aa316c08d8460c66a5d68da71da40de5d3bc3b31abcf3a1a9a19650f1",
    "zh:a26fdea0afaa9b247c73c0b42843ca51ba7db0ac2571f9d3d50dcabd20ca1b98",
    "zh:c872c9385a78d502bf5823d61cd3bb0f9a0585030e025eb12585c83451beeaa1",
    "zh:f180879af931182beee4c8c0d9dab62b81d86f17ddcbe3786ef4c7cec9163a4e",
    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
    "zh:f70f5789264069e0eef06f9b5d5fde955ef7206f7d446d1ce51a4c37a3f3e02f",
  ]
 }
 provider "registry.terraform.io/keycloak/keycloak" {
  version     = "5.7.0"
  constraints = ">= 5.0.0"
  hashes = [
    "h1:3DuKdVeOxwULh7l6bvJKWZvsgSZo92rtnrdvyp+X2Lc=",
    "zh:19be4505b17e4818db121a82917cb6723019cf379cfb82b720eaa2886f15bede",
    "zh:2bd1565ed22db6a9fb50d60626e22c277f3b034a71f65e6c0011e42f56cad2bb",
    "zh:34a9e2dfb06331dc6146491c4a0721001195c6a769cdc2d4546edb2acf2b39bd",
    "zh:3f86bf9eac6d73eeaa926471826b6888da77950f68e6a3a95dc2d9201a4a88fa",
    "zh:4b9053fde2c8dee6469c8b273bf5491a27228a1df28e30b86714118f0f876baf",
    "zh:522aa6bcecc6b8d517415237f4ec079488ef7de0e980a634bf6a8b481c13effc",
    "zh:52f85208815ca65b8d3cd5465b28005ba63f854122bc61fbf04925c986d48e78",
    "zh:636555042a6051d2e1113e5f945edb9f432e2d09b81cf6e50a59a534819d98dd",
    "zh:73a1fecfb3d9666bf87c2eb7d001281b8cfcd7132573b8c3d4febc2db55f0a2f",
    "zh:76fa26d055ceeb0869a50e4b63871f4b07f55045af6b46b83686016531e9fb22",
    "zh:8df147e619d7ac3d3f9840ba0d1895d34bde179e818863e2e7b52e2c05c12f58",
    "zh:9c830253990e13ec284d0d312fea562938e4a8fc664dacb3af5f1eb16dcae1ae",
    "zh:abd0bd630b362cd6f77fbb33625bc6f515782eb58cb096b4ce69dea252254aef",
    "zh:d1474a67ffc3288b2d0c99f6e8edc937ac8ef54afed0306e3c6f033aa836a5f6",
    "zh:ed19408f15667bfb572120858bdde929a20ce2d1f29468973905980c03299767",
    "zh:ef8bc311f7d1ad821b65ba43af92e2ce835e739d391098b13e01a61747b5c648",
    "zh:f57319d9a7ac387d5070c909fd0084ccfc296f1f3193efde995ae24aa1729a39",
  ]
 }
@@ -0,0 +1,172 @@
 # =============================================================================
 # Realm
 # =============================================================================
 resource "keycloak_realm" "hexor" {
  realm   = "hexor"
  enabled = true
  display_name = "Hexor"
  login_theme   = "keycloak"
  account_theme = "keycloak.v3"
  registration_allowed     = false
  reset_password_allowed   = true
  remember_me              = true
  verify_email             = false
  login_with_email_allowed = true
  duplicate_emails_allowed = false
  ssl_required = "external"
 }
 # =============================================================================
 # Google Identity Provider
 # =============================================================================
 resource "keycloak_oidc_google_identity_provider" "google" {
  realm         = keycloak_realm.hexor.id
  client_id     = var.google_client_id
  client_secret = var.google_client_secret
  trust_email = true
  sync_mode   = "IMPORT"
 }
 # =============================================================================
 # Standalone groups
 # =============================================================================
 resource "keycloak_group" "standalone" {
  for_each = toset(var.groups)
  realm_id = keycloak_realm.hexor.id
  name     = each.value
 }
 resource "keycloak_default_groups" "default" {
  realm_id  = keycloak_realm.hexor.id
  group_ids = [for g in keycloak_group.standalone : g.id if g.name == "users"]
 }
 # =============================================================================
 # rsauth2-proxy client (production)
 # =============================================================================
 resource "keycloak_openid_client" "rsauth2_proxy" {
  realm_id  = keycloak_realm.hexor.id
  client_id = "rsauth2-proxy"
  name                         = "rsauth2-proxy"
  enabled                      = true
  access_type                  = "CONFIDENTIAL"
  standard_flow_enabled        = true
  direct_access_grants_enabled = false
  valid_redirect_uris = [
    "https://oauth.hexor.cy/callback",
  ]
  web_origins = [
    "https://oauth.hexor.cy",
  ]
 }
 resource "keycloak_openid_group_membership_protocol_mapper" "rsauth2_proxy_groups" {
  realm_id   = keycloak_realm.hexor.id
  client_id  = keycloak_openid_client.rsauth2_proxy.id
  name       = "groups"
  claim_name = "groups"
  full_path  = false
 }
 resource "keycloak_openid_client_default_scopes" "rsauth2_proxy" {
  realm_id  = keycloak_realm.hexor.id
  client_id = keycloak_openid_client.rsauth2_proxy.id
  default_scopes = [
    "openid",
    "profile",
    "email",
  ]
 }
 # =============================================================================
 # rsauth2-proxy client (localhost testing)
 # =============================================================================
 resource "keycloak_openid_client" "rsauth2_proxy_dev" {
  realm_id  = keycloak_realm.hexor.id
  client_id = "rsauth2-proxy-dev"
  name                         = "rsauth2-proxy (dev)"
  enabled                      = true
  access_type                  = "CONFIDENTIAL"
  standard_flow_enabled        = true
  direct_access_grants_enabled = false
  valid_redirect_uris = [
    "http://localhost:8080/callback",
  ]
  web_origins = [
    "http://localhost:8080",
  ]
 }
 resource "keycloak_openid_group_membership_protocol_mapper" "rsauth2_proxy_dev_groups" {
  realm_id   = keycloak_realm.hexor.id
  client_id  = keycloak_openid_client.rsauth2_proxy_dev.id
  name       = "groups"
  claim_name = "groups"
  full_path  = false
 }
 resource "keycloak_openid_client_default_scopes" "rsauth2_proxy_dev" {
  realm_id  = keycloak_realm.hexor.id
  client_id = keycloak_openid_client.rsauth2_proxy_dev.id
  default_scopes = [
    "openid",
    "profile",
    "email",
  ]
 }
 # =============================================================================
 # Proxy applications — auto-created groups + routes ConfigMap
 # =============================================================================
 resource "keycloak_group" "app" {
  for_each = var.proxy_applications
  realm_id = keycloak_realm.hexor.id
  name     = "app-${each.key}"
 }
 locals {
  app_allowed_groups = {
    for k, v in var.proxy_applications : k => concat(
      ["app-${k}"],
      v.allowed_groups
    )
  }
 }
 resource "kubernetes_config_map" "auth_proxy_routes" {
  metadata {
    name      = "auth-proxy-routes"
    namespace = "auth-proxy"
  }
  data = {
    "routes.yaml" = yamlencode({
      routes = {
        for k, v in var.proxy_applications : v.domain => {
          allowed_groups = local.app_allowed_groups[k]
        }
      }
    })
  }
 }
@@ -0,0 +1,37 @@
 output "realm_id" {
  value = keycloak_realm.hexor.id
 }
 output "google_idp_alias" {
  value = keycloak_oidc_google_identity_provider.google.alias
 }
 output "rsauth2_proxy_client_id" {
  value = keycloak_openid_client.rsauth2_proxy.client_id
 }
 output "rsauth2_proxy_client_secret" {
  value     = keycloak_openid_client.rsauth2_proxy.client_secret
  sensitive = true
 }
 output "rsauth2_proxy_dev_client_id" {
  value = keycloak_openid_client.rsauth2_proxy_dev.client_id
 }
 output "rsauth2_proxy_dev_client_secret" {
  value     = keycloak_openid_client.rsauth2_proxy_dev.client_secret
  sensitive = true
 }
 output "standalone_groups" {
  value = [for g in keycloak_group.standalone : g.name]
 }
 output "app_groups" {
  value = { for k, g in keycloak_group.app : k => g.name }
 }
 output "app_allowed_groups" {
  value = local.app_allowed_groups
 }
@@ -0,0 +1,23 @@
 terraform {
  required_providers {
    keycloak = {
      source  = "keycloak/keycloak"
      version = ">= 5.0.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = ">= 2.0.0"
    }
  }
 }
 provider "keycloak" {
  url           = var.keycloak_url
  base_path     = "/auth"
  client_id     = var.keycloak_client_id
  client_secret = var.keycloak_client_secret
 }
 provider "kubernetes" {
  config_path = var.kubeconfig_path
 }
@@ -0,0 +1,8 @@
 terraform {
  cloud {
    organization = "ultradesu"
    workspaces {
      name = "Keycloak"
    }
  }
 }
@@ -0,0 +1,49 @@
 variable "keycloak_url" {
  description = "Keycloak URL (set via TF_VAR_keycloak_url)"
  type        = string
  default     = "https://auth.hexor.cy"
 }
 variable "keycloak_client_id" {
  description = "Keycloak Terraform client ID (set via TF_VAR_keycloak_client_id)"
  type        = string
  default     = "terraform"
 }
 variable "keycloak_client_secret" {
  description = "Keycloak Terraform client secret (set via TF_VAR_keycloak_client_secret)"
  type        = string
  sensitive   = true
 }
 variable "kubeconfig_path" {
  description = "Path to kubeconfig (set via TF_VAR_kubeconfig_path or KUBE_CONFIG_PATH)"
  type        = string
  default     = "~/.kube/config"
 }
 variable "google_client_id" {
  description = "Google OAuth client ID (set via TF_VAR_google_client_id)"
  type        = string
 }
 variable "google_client_secret" {
  description = "Google OAuth client secret (set via TF_VAR_google_client_secret)"
  type        = string
  sensitive   = true
 }
 variable "groups" {
  description = "Standalone Keycloak groups"
  type        = list(string)
  default     = []
 }
 variable "proxy_applications" {
  description = "Proxy applications protected by rsauth2-proxy"
  type = map(object({
    domain         = string
    allowed_groups = optional(list(string), [])
  }))
  default = {}
 }