Compare commits

...

13 Commits

Author SHA1 Message Date
Gitea Actions Bot
a5e390714d Auto-update README with current k8s applications
All checks were successful
Terraform / Terraform (pull_request) Successful in 25s
Generated by CI/CD workflow on 2026-03-20 09:37:41

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.
2026-03-20 09:37:41 +00:00
Ultradesu
4151deca72 Authentik hostfix
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 13s
Check with kubeconform / lint (push) Successful in 9s
Auto-update README / Generate README and Create MR (push) Successful in 8s
2026-03-20 09:37:05 +00:00
ab
c3e0064412 Update k8s/apps/furumi-server/metadata-agent.yaml
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 6s
Check with kubeconform / lint (push) Successful in 10s
Auto-update README / Generate README and Create MR (push) Successful in 8s
2026-03-20 00:48:07 +00:00
8a4401fe0b Added furumi-dev
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 7s
Check with kubeconform / lint (push) Successful in 8s
Auto-update README / Generate README and Create MR (push) Successful in 10s
2026-03-19 13:51:36 +00:00
704a19f864 Added furumi-dev
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 14s
Check with kubeconform / lint (push) Successful in 8s
Auto-update README / Generate README and Create MR (push) Successful in 15s
2026-03-19 13:46:02 +00:00
ab
5e4e82296f Update k8s/core/postgresql/external-secrets.yaml
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 9s
Check with kubeconform / lint (push) Successful in 8s
Auto-update README / Generate README and Create MR (push) Successful in 18s
2026-03-19 13:41:27 +00:00
27bc3f31c9 Fixed IDM outpust
Some checks failed
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 7s
Terraform / Terraform (push) Failing after 12s
2026-03-18 11:59:13 +00:00
1ba9226a3b Fixed IDM outpust
Some checks failed
Terraform / Terraform (push) Failing after 15s
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 9s
2026-03-18 11:57:40 +00:00
4f7477ee94 Fixed IDM outpust
All checks were successful
Terraform / Terraform (push) Successful in 41s
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 5s
Check with kubeconform / lint (push) Successful in 6s
Auto-update README / Generate README and Create MR (push) Successful in 7s
2026-03-18 11:39:11 +00:00
87627e5ffb Fixed IDM outpust 2026-03-18 11:39:09 +00:00
ab
87e38501e3 Update k8s/core/authentik/values.yaml
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 9s
Check with kubeconform / lint (push) Successful in 7s
Auto-update README / Generate README and Create MR (push) Successful in 22s
2026-03-18 11:30:53 +00:00
ab
ae211ac7d0 Update terraform/authentik/proxy-apps.auto.tfvars
All checks were successful
Terraform / Terraform (push) Successful in 32s
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 6s
2026-03-18 11:26:42 +00:00
086f9e17df Update furumi
All checks were successful
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 7s
Check with kubeconform / lint (push) Successful in 8s
Auto-update README / Generate README and Create MR (push) Successful in 19s
2026-03-18 03:51:32 +00:00
15 changed files with 483 additions and 8 deletions

View File

@@ -16,6 +16,7 @@ ArgoCD homelab project
| **authentik** | [![authentik](https://ag.hexor.cy/api/badge?name=authentik&revision=true)](https://ag.hexor.cy/applications/argocd/authentik) |
| **cert-manager** | [![cert-manager](https://ag.hexor.cy/api/badge?name=cert-manager&revision=true)](https://ag.hexor.cy/applications/argocd/cert-manager) |
| **external-secrets** | [![external-secrets](https://ag.hexor.cy/api/badge?name=external-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/external-secrets) |
| **gpu** | [![gpu](https://ag.hexor.cy/api/badge?name=gpu&revision=true)](https://ag.hexor.cy/applications/argocd/gpu) |
| **kube-system-custom** | [![kube-system-custom](https://ag.hexor.cy/api/badge?name=kube-system-custom&revision=true)](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
| **kubernetes-dashboard** | [![kubernetes-dashboard](https://ag.hexor.cy/api/badge?name=kubernetes-dashboard&revision=true)](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
| **longhorn** | [![longhorn](https://ag.hexor.cy/api/badge?name=longhorn&revision=true)](https://ag.hexor.cy/applications/argocd/longhorn) |
@@ -37,6 +38,9 @@ ArgoCD homelab project
| Application | Status |
| :--- | :---: |
| **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
| **furumi-dev** | [![furumi-dev](https://ag.hexor.cy/api/badge?name=furumi-dev&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-dev) |
| **furumi-server** | [![furumi-server](https://ag.hexor.cy/api/badge?name=furumi-server&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-server) |
| **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
| **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
| **hexound** | [![hexound](https://ag.hexor.cy/api/badge?name=hexound&revision=true)](https://ag.hexor.cy/applications/argocd/hexound) |
@@ -45,6 +49,9 @@ ArgoCD homelab project
| **jellyfin** | [![jellyfin](https://ag.hexor.cy/api/badge?name=jellyfin&revision=true)](https://ag.hexor.cy/applications/argocd/jellyfin) |
| **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
| **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
| **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
| **matrix** | [![matrix](https://ag.hexor.cy/api/badge?name=matrix&revision=true)](https://ag.hexor.cy/applications/argocd/matrix) |
| **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
| **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |
| **ollama** | [![ollama](https://ag.hexor.cy/api/badge?name=ollama&revision=true)](https://ag.hexor.cy/applications/argocd/ollama) |
| **paperless** | [![paperless](https://ag.hexor.cy/api/badge?name=paperless&revision=true)](https://ag.hexor.cy/applications/argocd/paperless) |

View File

@@ -0,0 +1,20 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: furumi-dev
namespace: argocd
spec:
project: apps
destination:
namespace: furumi-dev
server: https://kubernetes.default.svc
source:
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
targetRevision: HEAD
path: k8s/apps/furumi-dev
syncPolicy:
automated:
selfHeal: true
prune: true
syncOptions:
- CreateNamespace=true

View File

@@ -0,0 +1,55 @@
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: furumi-ng-creds
spec:
target:
name: furumi-ng-creds
deletionPolicy: Delete
template:
type: Opaque
data:
OIDC_CLIENT_ID: |-
{{ .client_id }}
OIDC_CLIENT_SECRET: |-
{{ .client_secret }}
OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-dev/
OIDC_REDIRECT_URL: https://music-dev.hexor.cy/auth/callback
OIDC_SESSION_SECRET: |-
{{ .session_secret }}
PG_STRING: |-
postgres://furumi_dev:{{ .pg_pass }}@psql.psql.svc:5432/furumi_dev
data:
- secretKey: client_id
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
property: fields[0].value
- secretKey: client_secret
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
property: fields[1].value
- secretKey: session_secret
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
property: fields[2].value
- secretKey: pg_pass
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
key: 2a9deb39-ef22-433e-a1be-df1555625e22
property: fields[17].value

View File

@@ -0,0 +1,59 @@
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: admin-strip
spec:
stripPrefix:
prefixes:
- /admin
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: furumi-tls-ingress
annotations:
ingressClassName: traefik
cert-manager.io/cluster-issuer: letsencrypt
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
acme.cert-manager.io/http01-edit-in-place: "true"
spec:
rules:
- host: music-dev.hexor.cy
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: furumi-dev-web-player
port:
number: 8080
tls:
- secretName: furumi-tls
hosts:
- '*.hexor.cy'
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: furumi-dev-admin-ingress
annotations:
ingressClassName: traefik
traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
spec:
rules:
- host: music-dev.hexor.cy
http:
paths:
- path: /admin
pathType: Prefix
backend:
service:
name: furumi-dev-metadata-agent
port:
number: 8090
tls:
- secretName: furumi-tls
hosts:
- '*.hexor.cy'

View File

@@ -0,0 +1,10 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- app.yaml
- service.yaml
- external-secrets.yaml
- ingress.yaml
- web-player.yaml
- metadata-agent.yaml

View File

@@ -0,0 +1,59 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: furumi-dev-metadata-agent
labels:
app: furumi-dev-metadata-agent
spec:
replicas: 1
selector:
matchLabels:
app: furumi-dev-metadata-agent
template:
metadata:
labels:
app: furumi-dev-metadata-agent
spec:
nodeSelector:
kubernetes.io/hostname: master.tail2fe2d.ts.net
containers:
- name: furumi-dev-metadata-agent
image: ultradesu/furumi-metadata-agent:dev
imagePullPolicy: Always
env:
- name: FURUMI_AGENT_DATABASE_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: PG_STRING
- name: FURUMI_AGENT_INBOX_DIR
value: "/inbox"
- name: FURUMI_AGENT_STORAGE_DIR
value: "/media"
- name: FURUMI_AGENT_OLLAMA_URL
value: "http://ollama.ollama.svc:11434"
- name: FURUMI_AGENT_OLLAMA_MODEL
value: "qwen3:14b"
- name: FURUMI_AGENT_POLL_INTERVAL_SECS
value: "10"
- name: RUST_LOG
value: "info"
ports:
- name: admin-ui
containerPort: 8090
protocol: TCP
volumeMounts:
- name: library
mountPath: /media
- name: inbox
mountPath: /inbox
volumes:
- name: library
hostPath:
path: /k8s/furumi-dev/library
type: DirectoryOrCreate
- name: inbox
hostPath:
path: /k8s/furumi-dev/inbox
type: DirectoryOrCreate

View File

@@ -0,0 +1,32 @@
---
apiVersion: v1
kind: Service
metadata:
name: furumi-dev-metadata-agent
labels:
app: furumi-dev-metadata-agent
spec:
type: ClusterIP
selector:
app: furumi-dev-metadata-agent
ports:
- name: admin-ui
protocol: TCP
port: 8090
targetPort: 8090
---
apiVersion: v1
kind: Service
metadata:
name: furumi-dev-web-player
labels:
app: furumi-dev-web-player
spec:
type: ClusterIP
selector:
app: furumi-dev-web-player
ports:
- name: web-ui
protocol: TCP
port: 8080
targetPort: 8080

View File

@@ -0,0 +1,70 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: furumi-dev-web-player
labels:
app: furumi-dev-web-player
spec:
replicas: 1
selector:
matchLabels:
app: furumi-dev-web-player
template:
metadata:
labels:
app: furumi-dev-web-player
spec:
nodeSelector:
kubernetes.io/hostname: master.tail2fe2d.ts.net
containers:
- name: furumi-dev-web-player
image: ultradesu/furumi-web-player:dev
imagePullPolicy: Always
env:
- name: FURUMI_PLAYER_OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_CLIENT_ID
- name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_CLIENT_SECRET
- name: FURUMI_PLAYER_OIDC_ISSUER_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_ISSUER_URL
- name: FURUMI_PLAYER_OIDC_REDIRECT_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_REDIRECT_URL
- name: FURUMI_PLAYER_OIDC_SESSION_SECRET
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_SESSION_SECRET
- name: FURUMI_PLAYER_DATABASE_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: PG_STRING
- name: FURUMI_PLAYER_STORAGE_DIR
value: "/media"
- name: RUST_LOG
value: "info"
ports:
- name: web-ui
containerPort: 8080
protocol: TCP
volumeMounts:
- name: music
mountPath: /media
volumes:
- name: music
hostPath:
path: /k8s/furumi-dev/library
type: DirectoryOrCreate

View File

@@ -33,7 +33,7 @@ spec:
- name: FURUMI_AGENT_OLLAMA_URL
value: "http://ollama.ollama.svc:11434"
- name: FURUMI_AGENT_OLLAMA_MODEL
value: "qwen3:14b"
value: "qwen3.5:9b"
- name: FURUMI_AGENT_POLL_INTERVAL_SECS
value: "10"
- name: RUST_LOG

View File

@@ -21,27 +21,27 @@ spec:
image: ultradesu/furumi-web-player:trunk
imagePullPolicy: Always
env:
- name: FURUMI_OIDC_CLIENT_ID
- name: FURUMI_PLAYER_OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_CLIENT_ID
- name: FURUMI_OIDC_CLIENT_SECRET
- name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_CLIENT_SECRET
- name: FURUMI_OIDC_ISSUER_URL
- name: FURUMI_PLAYER_OIDC_ISSUER_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_ISSUER_URL
- name: FURUMI_OIDC_REDIRECT_URL
- name: FURUMI_PLAYER_OIDC_REDIRECT_URL
valueFrom:
secretKeyRef:
name: furumi-ng-creds
key: OIDC_REDIRECT_URL
- name: FURUMI_OIDC_SESSION_SECRET
- name: FURUMI_PLAYER_OIDC_SESSION_SECRET
valueFrom:
secretKeyRef:
name: furumi-ng-creds

View File

@@ -5,6 +5,7 @@ resources:
- app.yaml
- external-secrets.yaml
- https-middleware.yaml
- outpost-selector-fix.yaml
# - worker-restart.yaml
helmCharts:

View File

@@ -0,0 +1,81 @@
## Workaround for authentik bug: embedded outpost controller creates
## a Service with selectors that don't match the pod labels it sets.
## Remove this after upgrading to a version with the fix.
apiVersion: v1
kind: ServiceAccount
metadata:
name: outpost-selector-fix
namespace: authentik
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: outpost-selector-fix
namespace: authentik
rules:
- apiGroups: [""]
resources: ["services"]
verbs: ["get", "patch"]
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: outpost-selector-fix
namespace: authentik
subjects:
- kind: ServiceAccount
name: outpost-selector-fix
namespace: authentik
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: outpost-selector-fix
---
apiVersion: batch/v1
kind: CronJob
metadata:
name: outpost-selector-fix
namespace: authentik
spec:
schedule: "*/5 * * * *"
successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 3
concurrencyPolicy: Replace
jobTemplate:
spec:
ttlSecondsAfterFinished: 300
template:
spec:
serviceAccountName: outpost-selector-fix
restartPolicy: OnFailure
containers:
- name: fix
image: bitnami/kubectl:latest
command:
- /bin/sh
- -c
- |
SVC="ak-outpost-authentik-embedded-outpost"
# check if endpoints are populated
ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
if [ -n "$ADDRS" ]; then
echo "Endpoints OK ($ADDRS), nothing to fix"
exit 0
fi
echo "No endpoints for $SVC, patching selector..."
kubectl patch svc "$SVC" -n authentik --type=json -p '[
{"op":"remove","path":"/spec/selector/app.kubernetes.io~1component"},
{"op":"replace","path":"/spec/selector/app.kubernetes.io~1name","value":"authentik-outpost-proxy"}
]'
echo "Patched. Verifying..."
sleep 2
ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
if [ -n "$ADDRS" ]; then
echo "Fix confirmed, endpoints: $ADDRS"
else
echo "WARNING: still no endpoints after patch"
exit 1
fi

View File

@@ -133,6 +133,8 @@ spec:
{{ .mas }}
USER_furumi: |-
{{ .furumi }}
USER_furumi_dev: |-
{{ .furumi_dev }}
data:
- secretKey: authentik
sourceRef:
@@ -310,4 +312,15 @@ spec:
metadataPolicy: None
key: 2a9deb39-ef22-433e-a1be-df1555625e22
property: fields[16].value
- secretKey: furumi_dev
sourceRef:
storeRef:
name: vaultwarden-login
kind: ClusterSecretStore
remoteRef:
conversionStrategy: Default
decodingStrategy: None
metadataPolicy: None
key: 2a9deb39-ef22-433e-a1be-df1555625e22
property: fields[17].value

View File

@@ -292,7 +292,60 @@ resource "authentik_outpost" "outposts" {
authentik_host_browser = ""
object_naming_template = "ak-outpost-%(name)s"
authentik_host_insecure = false
kubernetes_json_patches = null
kubernetes_json_patches = {
deployment = [
{
op = "add"
path = "/spec/template/spec/containers/0/env/-"
value = {
name = "AUTHENTIK_POSTGRESQL__HOST"
value = "psql.psql.svc"
}
},
{
op = "add"
path = "/spec/template/spec/containers/0/env/-"
value = {
name = "AUTHENTIK_POSTGRESQL__PORT"
value = "5432"
}
},
{
op = "add"
path = "/spec/template/spec/containers/0/env/-"
value = {
name = "AUTHENTIK_POSTGRESQL__NAME"
value = "authentik"
}
},
{
op = "add"
path = "/spec/template/spec/containers/0/env/-"
value = {
name = "AUTHENTIK_POSTGRESQL__USER"
valueFrom = {
secretKeyRef = {
name = "authentik-creds"
key = "AUTHENTIK_POSTGRESQL__USER"
}
}
}
},
{
op = "add"
path = "/spec/template/spec/containers/0/env/-"
value = {
name = "AUTHENTIK_POSTGRESQL__PASSWORD"
valueFrom = {
secretKeyRef = {
name = "authentik-creds"
key = "AUTHENTIK_POSTGRESQL__PASSWORD"
}
}
}
}
]
}
kubernetes_service_type = "ClusterIP"
kubernetes_image_pull_secrets = []
kubernetes_ingress_class_name = null

View File

@@ -151,7 +151,7 @@ EOT
meta_icon = "https://img.icons8.com/liquid-glass/48/key.png"
mode = "proxy"
outpost = "kubernetes-outpost"
access_groups = ["admins", "khm"] # Используем существующие группы
access_groups = ["admins", "khm"]
create_group = true
access_groups = ["admins"]
}
@@ -191,5 +191,20 @@ EOT
create_group = true
access_groups = ["admins"]
}
"ollama-public" = {
name = "Ollama Public"
slug = "ollama-public"
group = "AI"
external_host = "https://ollama.hexor.cy"
internal_host = "http://ollama.ollama.svc:11434"
internal_host_ssl_validation = false
meta_description = ""
meta_icon = "https://img.icons8.com/external-icongeek26-outline-icongeek26/64/external-llama-animal-head-icongeek26-outline-icongeek26.png"
mode = "proxy"
outpost = "kubernetes-outpost"
intercept_header_auth = true
create_group = true
access_groups = ["admins"]
}
}