Compare commits

..

1 Commits

Author SHA1 Message Date
Gitea Actions Bot
2e53db22ad Auto-update README with current k8s applications
Some checks failed
Terraform / Terraform (pull_request) Failing after 23s
Generated by CI/CD workflow on 2026-03-16 10:10:26

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.
2026-03-16 10:10:26 +00:00
14 changed files with 136 additions and 330 deletions

View File

@@ -22,39 +22,9 @@ spec:
imagePullPolicy: Always
env:
- name: FURUMI_TOKEN
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: TOKEN
- name: FURUMI_OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_CLIENT_ID
- name: FURUMI_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_CLIENT_SECRET
- name: FURUMI_OIDC_ISSUER_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_ISSUER_URL
- name: FURUMI_OIDC_REDIRECT_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_REDIRECT_URL
- name: FURUMI_OIDC_SESSION_SECRET
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_SESSION_SECRET
value: "f38387266e75effe891b7953eb9c06b4"
- name: FURUMI_ROOT
value: "/media"
- name: RUST_LOG
value: "debug"
ports:
- name: grpc
containerPort: 50051
@@ -62,9 +32,6 @@ spec:
- name: metrics
containerPort: 9090
protocol: TCP
- name: web-ui
containerPort: 8080
protocol: TCP
volumeMounts:
- name: music
mountPath: /media

View File

@@ -1,55 +0,0 @@
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: furumi-ng-creds
spec:
target:
name: furumi-ng-creds
deletionPolicy: Delete
template:
type: Opaque
data:
TOKEN: |-
{{ .token }}
OIDC_CLIENT_ID: |-
{{ .client_id }}
OIDC_CLIENT_SECRET: |-
{{ .client_secret }}
OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-ng-web/
OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
OIDC_SESSION_SECRET: |-
{{ .session_secret }}
data:
- secretKey: token
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
property: fields[0].value
- secretKey: client_id
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
property: fields[1].value
- secretKey: client_secret
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
property: fields[2].value
- secretKey: session_secret
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
property: fields[3].value

View File

@@ -1,28 +0,0 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: furumi-tls-ingress
annotations:
ingressClassName: traefik
cert-manager.io/cluster-issuer: letsencrypt
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
acme.cert-manager.io/http01-edit-in-place: "true"
spec:
rules:
- host: music.hexor.cy
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: furumi-server-web
port:
number: 8080
tls:
- secretName: furumi-tls
hosts:
- '*.hexor.cy'

View File

@@ -6,5 +6,3 @@ resources:
- deployment.yaml
- service.yaml
- servicemonitor.yaml
- external-secrets.yaml
- ingress.yaml

View File

@@ -28,19 +28,3 @@ spec:
protocol: TCP
port: 9090
targetPort: 9090
---
apiVersion: v1
kind: Service
metadata:
name: furumi-server-web
labels:
app: furumi-server
spec:
type: ClusterIP
selector:
app: furumi-server
ports:
- name: web-ui
protocol: TCP
port: 8080
targetPort: 8080

View File

@@ -77,6 +77,101 @@ spec:
labels:
app: gitea-runner
spec:
#nodeSelector:
# kubernetes.io/hostname: home.homenet
volumes:
- name: docker-sock
hostPath:
path: /var/run/docker.sock
type: Socket
- name: runner-data
emptyDir:
sizeLimit: 30Gi
affinity:
nodeAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 1
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- home.homenet
- weight: 2
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- master.tail2fe2d.ts.net
- weight: 3
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- it.tail2fe2d.ts.net
- ch.tail2fe2d.ts.net
- us.tail2fe2d.ts.net
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- home.homenet
- it.tail2fe2d.ts.net
- ch.tail2fe2d.ts.net
- us.tail2fe2d.ts.net
- master.tail2fe2d.ts.net
containers:
- name: gitea-runner
image: gitea/act_runner:nightly
resources:
requests:
cpu: "100m"
memory: "256Mi"
ephemeral-storage: "1Gi" # reserve ephemeral storage
limits:
cpu: "3000m"
memory: "4Gi"
ephemeral-storage: "28Gi" # hard cap for /data usage
volumeMounts:
- name: docker-sock
mountPath: /var/run/docker.sock
- name: runner-data
mountPath: /data
env:
- name: GITEA_INSTANCE_URL
value: "https://gt.hexor.cy"
- name: GITEA_RUNNER_REGISTRATION_TOKEN
valueFrom:
secretKeyRef:
name: gitea-runner-act-runner-secrets
key: token
- name: GITEA_RUNNER_NAME
value: "k8s-runner"
- name: GITEA_RUNNER_LABELS
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: gitea-runner-desktop
spec:
replicas: 1
selector:
matchLabels:
app: gitea-runner-desktop
template:
metadata:
labels:
app: gitea-runner-desktop
spec:
nodeSelector:
kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
tolerations:
- key: workload
operator: Equal
@@ -90,39 +185,6 @@ spec:
- name: runner-data
emptyDir:
sizeLimit: 30Gi
affinity:
nodeAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- uk-desktop.tail2fe2d.ts.net
- weight: 50
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- home.homenet
- weight: 30
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- master.tail2fe2d.ts.net
- weight: 10
preference:
matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- it.tail2fe2d.ts.net
- ch.tail2fe2d.ts.net
- us.tail2fe2d.ts.net
containers:
- name: gitea-runner
image: gitea/act_runner:nightly
@@ -149,6 +211,6 @@ spec:
name: gitea-runner-act-runner-secrets
key: token
- name: GITEA_RUNNER_NAME
value: "k8s-runner"
value: "k8s-runner-desktop"
- name: GITEA_RUNNER_LABELS
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"

View File

@@ -21,22 +21,16 @@ spec:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
conversionStrategy: Default
decodingStrategy: None
metadataPolicy: None
key: 2a9deb39-ef22-433e-a1be-df1555625e22
property: fields[14].value
key: CHANGE_ME
property: CHANGE_ME
- secretKey: mas_db_password
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
conversionStrategy: Default
decodingStrategy: None
metadataPolicy: None
key: 2a9deb39-ef22-433e-a1be-df1555625e22
property: fields[15].value
key: CHANGE_ME
property: CHANGE_ME
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
@@ -52,17 +46,16 @@ spec:
mas-oidc.yaml: |
upstream_oauth2:
providers:
- id: 001KKV4EKY7KG98W2M9T806K6A
- id: authentik
human_name: Authentik
issuer: https://idm.hexor.cy/application/o/matrix/
client_id: "{{ .oauth_client_id }}"
client_secret: "{{ .oauth_client_secret }}"
token_endpoint_auth_method: client_secret_post
client_id: {{ .oauth_client_id }}
client_secret: {{ .oauth_client_secret }}
scope: "openid profile email"
claims_imports:
localpart:
action: suggest
template: "{{ `{{ user.preferred_username | split(\"@\") | first }}` }}"
action: require
template: "{{ `{{ user.preferred_username }}` }}"
displayname:
action: suggest
template: "{{ `{{ user.name }}` }}"
@@ -77,19 +70,13 @@ spec:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
conversionStrategy: Default
decodingStrategy: None
metadataPolicy: None
key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
property: fields[0].value
key: CHANGE_ME
property: CHANGE_ME
- secretKey: oauth_client_secret
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
conversionStrategy: Default
decodingStrategy: None
metadataPolicy: None
key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
property: fields[1].value
key: CHANGE_ME
property: CHANGE_ME

View File

@@ -16,37 +16,16 @@ postgres:
enabled: false
## Disable components we don't need yet
matrixRTC:
enabled: false
hookshot:
enabled: false
## MatrixRTC - voice/video calls via LiveKit SFU
matrixRTC:
enabled: true
ingress:
host: livekit.matrix.hexor.cy
sfu:
enabled: true
manualIP: "138.201.61.182"
nodeSelector:
kubernetes.io/hostname: master.tail2fe2d.ts.net
exposedServices:
rtcTcp:
enabled: true
port: 30881
rtcMuxedUdp:
enabled: true
port: 30882
turnTLS:
enabled: true
port: 31443
domain: turn.matrix.hexor.cy
tlsTerminationOnPod: true
haproxy:
enabled: false
## Synapse homeserver
synapse:
enabled: true
ingress:
host: synapse.matrix.hexor.cy
postgres:
host: psql.psql.svc
port: 5432
@@ -66,8 +45,6 @@ synapse:
## Matrix Authentication Service
matrixAuthenticationService:
enabled: true
ingress:
host: auth.matrix.hexor.cy
postgres:
host: psql.psql.svc
port: 5432
@@ -77,15 +54,9 @@ matrixAuthenticationService:
password:
secret: matrix-postgres-creds
secretKey: mas_db_password
## Admin policy
## Authentik OIDC upstream provider
additional:
0-admin-policy:
config: |
policy:
data:
admin_users:
- username: ultradesu
1-oidc:
0-oidc:
configSecret: matrix-oidc-config
configSecretKey: mas-oidc.yaml
# nodeSelector:
@@ -95,7 +66,7 @@ matrixAuthenticationService:
elementWeb:
enabled: true
ingress:
host: chat.matrix.hexor.cy
host: chat.hexor.cy
# nodeSelector:
# kubernetes.io/hostname: nas.homenet
@@ -103,10 +74,12 @@ elementWeb:
elementAdmin:
enabled: true
ingress:
host: admin.matrix.hexor.cy
host: matrix-admin.hexor.cy
# nodeSelector:
# kubernetes.io/hostname: nas.homenet
## Well-known delegation on the base domain (host is derived from serverName)
## Well-known delegation on the base domain
wellKnownDelegation:
enabled: true
ingress:
host: matrix.hexor.cy

View File

@@ -4,7 +4,6 @@ kind: Kustomization
resources:
- external-secrets.yaml
- local-pv.yaml
- open-terminal.yaml
helmCharts:
- name: ollama
@@ -16,7 +15,7 @@ helmCharts:
includeCRDs: true
- name: open-webui
repo: https://helm.openwebui.com/
version: 12.10.0
version: 12.8.1
releaseName: openweb-ui
namespace: ollama
valuesFile: openweb-ui-values.yaml

View File

@@ -1,53 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: open-terminal
labels:
app: open-terminal
spec:
replicas: 1
selector:
matchLabels:
app: open-terminal
template:
metadata:
labels:
app: open-terminal
spec:
nodeSelector:
kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
tolerations:
- key: workload
operator: Equal
value: desktop
effect: NoSchedule
containers:
- name: open-terminal
image: ghcr.io/open-webui/open-terminal:latest
ports:
- containerPort: 8000
env:
- name: OPEN_TERMINAL_API_KEY
value: "LOCAL_ACCESS_TOKEN"
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: "2"
memory: 2Gi
---
apiVersion: v1
kind: Service
metadata:
name: open-terminal
labels:
app: open-terminal
spec:
selector:
app: open-terminal
ports:
- port: 8000
targetPort: 8000
protocol: TCP

View File

@@ -54,6 +54,19 @@ server:
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
hosts:
- idm.hexor.cy
- nas.hexor.cy # TrueNAS Limassol
- nc.hexor.cy # NaxtCloud
- of.hexor.cy # Outfleet-v2
- k8s.hexor.cy # k8s dashboard
- qbt.hexor.cy # qBittorent for Jellyfin
- prom.hexor.cy # Prometheus
- khm.hexor.cy # Known Hosts keys Manager
- backup.hexor.cy # Kopia Backup UI
- fm.hexor.cy # Filemanager
- minecraft.hexor.cy # Minecraft UI and server
- pass.hexor.cy # k8s-secret for openai
- ps.hexor.cy # pasarguard UI
# - rw.hexor.cy # RemnaWave UI
tls:
- secretName: idm-tls
hosts:

View File

@@ -37,5 +37,4 @@ spec:
dnsZones:
- "ps.hexor.cy"
- "of.hexor.cy"
- "matrix.hexor.cy"

View File

@@ -129,7 +129,7 @@ spec:
{{ .n8n }}
USER_synapse: |-
{{ .synapse }}
USER_mas: |-
USER_mas: |-
{{ .mas }}
data:
- secretKey: authentik

View File

@@ -188,45 +188,5 @@ oauth_applications = {
create_group = true
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
}
"matrix" = {
name = "Matrix Chat"
slug = "matrix"
group = "Tools"
meta_description = "Matrix Chat"
meta_icon = "https://img.icons8.com/ios/100/40C057/matrix-logo.png"
redirect_uris = [
"https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A",
]
meta_launch_url = "https://chat.matrix.hexor.cy"
client_type = "confidential"
include_claims_in_id_token = true
access_code_validity = "minutes=1"
access_token_validity = "minutes=5"
refresh_token_validity = "days=30"
scope_mappings = ["openid", "profile", "email"]
access_groups = []
create_group = false
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
}
"furumi-ng-web" = {
name = "Furumi Web Player"
slug = "furumi-ng-web"
group = "Tools"
meta_description = "Furumi Web Player"
meta_icon = "https://img.icons8.com/pulsar-color/48/music.png"
redirect_uris = [
"https://music.hexor.cy/auth/callback",
]
meta_launch_url = "https://music.hexor.cy"
client_type = "confidential"
include_claims_in_id_token = true
access_code_validity = "minutes=1"
access_token_validity = "minutes=5"
refresh_token_validity = "days=30"
scope_mappings = ["openid", "profile", "email"]
access_groups = []
create_group = true
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
}
}