Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-03-16 10:31:52

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

k8s/apps/furumi-server/deployment.yaml

@@ -22,34 +22,9 @@ spec:
           imagePullPolicy: Always
           env:
             - name: FURUMI_TOKEN
-              valueFrom:
+              value: "f38387266e75effe891b7953eb9c06b4"
-                secretKeyRef:
-                  name: furumi-ng-creds
-                  key: TOKEN
-            - name: FURUMI_OIDC_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: furumi-ng-creds
-                  key: OIDC_CLIENT_ID
-            - name: FURUMI_OIDC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: furumi-ng-creds
-                  key: OIDC_CLIENT_SECRET
-            - name: FURUMI_OIDC_ISSUER_URL
-              valueFrom:
-                secretKeyRef:
-                  name: furumi-ng-creds
-                  key: OIDC_ISSUER_URL
-            - name: FURUMI_OIDC_REDIRECT_URL
-              valueFrom:
-                secretKeyRef:
-                  name: furumi-ng-creds
-                  key: OIDC_REDIRECT_URL
             - name: FURUMI_ROOT
               value: "/media"
-            - name: RUST_LOG
-              value: "debug"
           ports:
             - name: grpc
               containerPort: 50051
@@ -57,9 +32,6 @@ spec:
             - name: metrics
               containerPort: 9090
               protocol: TCP
-            - name: web-ui
-              containerPort: 8080
-              protocol: TCP
           volumeMounts:
             - name: music
               mountPath: /media

k8s/apps/furumi-server/external-secrets.yaml

@@ -1,45 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: furumi-ng-creds
-spec:
-  target:
-    name: furumi-ng-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        TOKEN: |-
-          {{ .token }}
-        OIDC_CLIENT_ID: |-
-          {{ .client_id }}
-        OIDC_CLIENT_SECRET: |-
-          {{ .client_secret }}
-        OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-ng-web/
-        OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
-  data:
-    - secretKey: token
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
-        property: fields[0].value
-    - secretKey: client_id
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
-        property: fields[1].value
-    - secretKey: client_secret
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
-        property: fields[2].value

k8s/apps/furumi-server/ingress.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: furumi-tls-ingress
-  annotations:
-    ingressClassName: traefik
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  rules:
-    - host: music.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: furumi-server-web
-                port:
-                  number: 8080
-  tls:
-    - secretName: furumi-tls
-      hosts:
-        - '*.hexor.cy'
-
-

k8s/apps/furumi-server/kustomization.yaml

@@ -6,5 +6,3 @@ resources:
   - deployment.yaml
   - service.yaml
   - servicemonitor.yaml
-  - external-secrets.yaml
-  - ingress.yaml

k8s/apps/furumi-server/service.yaml

@@ -28,19 +28,3 @@ spec:
       protocol: TCP
       port: 9090
       targetPort: 9090
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: furumi-server-web
-  labels:
-    app: furumi-server
-spec:
-  type: ClusterIP
-  selector:
-    app: furumi-server
-  ports:
-    - name: web-ui
-      protocol: TCP
-      port: 8080
-      targetPort: 8080

k8s/apps/matrix/external-secrets.yaml

@@ -52,17 +52,16 @@ spec:
         mas-oidc.yaml: |
           upstream_oauth2:
             providers:
-              - id: 001KKV4EKY7KG98W2M9T806K6A
+              - id: authentik
                 human_name: Authentik
                 issuer: https://idm.hexor.cy/application/o/matrix/
-                client_id: "{{ .oauth_client_id }}"
+                client_id: {{ .oauth_client_id }}
-                client_secret: "{{ .oauth_client_secret }}"
+                client_secret: {{ .oauth_client_secret }}
-                token_endpoint_auth_method: client_secret_post
                 scope: "openid profile email"
                 claims_imports:
                   localpart:
-                    action: suggest
+                    action: require
-                    template: "{{ `{{ user.preferred_username | split(\"@\") | first }}` }}"
+                    template: "{{ `{{ user.preferred_username }}` }}"
                   displayname:
                     action: suggest
                     template: "{{ `{{ user.name }}` }}"

k8s/apps/matrix/matrix-stack-values.yaml

@@ -16,37 +16,14 @@ postgres:
   enabled: false
 
 ## Disable components we don't need yet
+matrixRTC:
+  enabled: false
 hookshot:
   enabled: false
 
-## MatrixRTC - voice/video calls via LiveKit SFU
-matrixRTC:
-  enabled: true
-  ingress:
-    host: livekit.matrix.hexor.cy
-  sfu:
-    enabled: true
-    manualIP: "138.201.61.182"
-    nodeSelector:
-      kubernetes.io/hostname: master.tail2fe2d.ts.net
-    exposedServices:
-      rtcTcp:
-        enabled: true
-        port: 30881
-      rtcMuxedUdp:
-        enabled: true
-        port: 30882
-      turnTLS:
-        enabled: true
-        port: 31443
-        domain: turn.matrix.hexor.cy
-        tlsTerminationOnPod: true
-
 ## Synapse homeserver
 synapse:
   enabled: true
-  ingress:
-    host: synapse.matrix.hexor.cy
   postgres:
     host: psql.psql.svc
     port: 5432
@@ -66,8 +43,6 @@ synapse:
 ## Matrix Authentication Service
 matrixAuthenticationService:
   enabled: true
-  ingress:
-    host: auth.matrix.hexor.cy
   postgres:
     host: psql.psql.svc
     port: 5432
@@ -77,15 +52,9 @@ matrixAuthenticationService:
     password:
       secret: matrix-postgres-creds
       secretKey: mas_db_password
-  ## Admin policy
+  ## Authentik OIDC upstream provider
   additional:
-    0-admin-policy:
+    0-oidc:
-      config: |
-        policy:
-          data:
-            admin_users:
-              - username: ultradesu
-    1-oidc:
       configSecret: matrix-oidc-config
       configSecretKey: mas-oidc.yaml
   # nodeSelector:
@@ -95,7 +64,7 @@ matrixAuthenticationService:
 elementWeb:
   enabled: true
   ingress:
-    host: chat.matrix.hexor.cy
+    host: chat.hexor.cy
   # nodeSelector:
   #   kubernetes.io/hostname: nas.homenet
 
@@ -103,7 +72,7 @@ elementWeb:
 elementAdmin:
   enabled: true
   ingress:
-    host: admin.matrix.hexor.cy
+    host: matrix-admin.hexor.cy
   # nodeSelector:
   #   kubernetes.io/hostname: nas.homenet
 

k8s/apps/ollama/kustomization.yaml

@@ -4,7 +4,6 @@ kind: Kustomization
 resources:
   - external-secrets.yaml
   - local-pv.yaml
-  - open-terminal.yaml
   
 helmCharts:
   - name: ollama
@@ -16,7 +15,7 @@ helmCharts:
     includeCRDs: true
   - name: open-webui
     repo: https://helm.openwebui.com/
-    version: 12.10.0
+    version: 12.8.1
     releaseName: openweb-ui
     namespace: ollama
     valuesFile: openweb-ui-values.yaml

k8s/apps/ollama/open-terminal.yaml

@@ -1,53 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: open-terminal
-  labels:
-    app: open-terminal
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: open-terminal
-  template:
-    metadata:
-      labels:
-        app: open-terminal
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: desktop
-          effect: NoSchedule
-      containers:
-        - name: open-terminal
-          image: ghcr.io/open-webui/open-terminal:latest
-          ports:
-            - containerPort: 8000
-          env:
-            - name: OPEN_TERMINAL_API_KEY
-              value: "LOCAL_ACCESS_TOKEN"
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "2"
-              memory: 2Gi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: open-terminal
-  labels:
-    app: open-terminal
-spec:
-  selector:
-    app: open-terminal
-  ports:
-    - port: 8000
-      targetPort: 8000
-      protocol: TCP

k8s/core/authentik/values.yaml

@@ -54,6 +54,19 @@ server:
         traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
       hosts:
         - idm.hexor.cy
+        - nas.hexor.cy       # TrueNAS Limassol
+        - nc.hexor.cy        # NaxtCloud
+        - of.hexor.cy        # Outfleet-v2
+        - k8s.hexor.cy       # k8s dashboard
+        - qbt.hexor.cy       # qBittorent for Jellyfin
+        - prom.hexor.cy      # Prometheus
+        - khm.hexor.cy       # Known Hosts keys Manager
+        - backup.hexor.cy    # Kopia Backup UI
+        - fm.hexor.cy        # Filemanager
+        - minecraft.hexor.cy # Minecraft UI and server
+        - pass.hexor.cy      # k8s-secret for openai
+        - ps.hexor.cy        # pasarguard UI
+#       - rw.hexor.cy        # RemnaWave UI
       tls:
         - secretName: idm-tls
           hosts:

k8s/core/cert-manager/issuer.yaml

@@ -37,5 +37,4 @@ spec:
           dnsZones:
             - "ps.hexor.cy"
             - "of.hexor.cy"
-            - "matrix.hexor.cy"
 

terraform/authentik/oauth2-apps.auto.tfvars

@@ -195,9 +195,9 @@ oauth_applications = {
     meta_description = "Matrix Chat"
     meta_icon        = "https://img.icons8.com/ios/100/40C057/matrix-logo.png"
     redirect_uris = [
-      "https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A",
+      "https://matrix.hexor.cy/_matrix/client/unstable/org.matrix.msc2965/auth/upstream/callback",
     ]
-    meta_launch_url            = "https://chat.matrix.hexor.cy"
+    meta_launch_url            = "https://matrix.hexor.cy"
     client_type                = "confidential"
     include_claims_in_id_token = true
     access_code_validity       = "minutes=1"
@@ -205,27 +205,7 @@ oauth_applications = {
     refresh_token_validity     = "days=30"
     scope_mappings             = ["openid", "profile", "email"]
     access_groups              = []
-    create_group               = false
+    create_group               = true
-    signing_key                = "1b1b5bec-034a-4d96-871a-133f11322360"
-  }
-  "furumi-ng-web" = {
-    name             = "Furumi Web Player"
-    slug             = "furumi-ng-web"
-    group            = "Tools"
-    meta_description = "Furumi Web Player"
-    meta_icon        = "https://img.icons8.com/pulsar-color/48/music.png"
-    redirect_uris = [
-      "https://music.hexor.cy/auth/callback",
-    ]
-    meta_launch_url            = "https://music.hexor.cy"
-    client_type                = "confidential"
-    include_claims_in_id_token = true
-    access_code_validity       = "minutes=1"
-    access_token_validity      = "minutes=5"
-    refresh_token_validity     = "days=30"
-    scope_mappings             = ["openid", "profile", "email"]
-    access_groups              = []
-    create_group               = false
     signing_key                = "1b1b5bec-034a-4d96-871a-133f11322360"
   }
 }