Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-04-20 08:43:00

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -17,7 +17,6 @@ ArgoCD homelab project
 | **cert-manager** | [![cert-manager](https://ag.hexor.cy/api/badge?name=cert-manager&revision=true)](https://ag.hexor.cy/applications/argocd/cert-manager) |
 | **external-secrets** | [![external-secrets](https://ag.hexor.cy/api/badge?name=external-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/external-secrets) |
 | **gpu** | [![gpu](https://ag.hexor.cy/api/badge?name=gpu&revision=true)](https://ag.hexor.cy/applications/argocd/gpu) |
-| **kanidm** | [![kanidm](https://ag.hexor.cy/api/badge?name=kanidm&revision=true)](https://ag.hexor.cy/applications/argocd/kanidm) |
 | **kube-system-custom** | [![kube-system-custom](https://ag.hexor.cy/api/badge?name=kube-system-custom&revision=true)](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
 | **kubernetes-dashboard** | [![kubernetes-dashboard](https://ag.hexor.cy/api/badge?name=kubernetes-dashboard&revision=true)](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
 | **longhorn** | [![longhorn](https://ag.hexor.cy/api/badge?name=longhorn&revision=true)](https://ag.hexor.cy/applications/argocd/longhorn) |
@@ -67,7 +66,6 @@ ArgoCD homelab project
 | **tg-bots** | [![tg-bots](https://ag.hexor.cy/api/badge?name=tg-bots&revision=true)](https://ag.hexor.cy/applications/argocd/tg-bots) |
 | **vaultwarden** | [![vaultwarden](https://ag.hexor.cy/api/badge?name=vaultwarden&revision=true)](https://ag.hexor.cy/applications/argocd/vaultwarden) |
 | **vpn** | [![vpn](https://ag.hexor.cy/api/badge?name=vpn&revision=true)](https://ag.hexor.cy/applications/argocd/vpn) |
-| **web-petting** | [![web-petting](https://ag.hexor.cy/api/badge?name=web-petting&revision=true)](https://ag.hexor.cy/applications/argocd/web-petting) |
 | **wedding** | [![wedding](https://ag.hexor.cy/api/badge?name=wedding&revision=true)](https://ag.hexor.cy/applications/argocd/wedding) |
 | **xandikos** | [![xandikos](https://ag.hexor.cy/api/badge?name=xandikos&revision=true)](https://ag.hexor.cy/applications/argocd/xandikos) |
 

k8s/apps/gitea/deployment.yaml

@@ -48,8 +48,6 @@ spec:
               value: "true"
             - name: GITEA__service__CAPTCHA_TYPE
               value: "hcaptcha"
-            - name: GITEA__webhook__ALLOWED_HOST_LIST
-              value: "*"
           envFrom:
           - secretRef:
               name: gitea-recapcha-creds

k8s/apps/matrix/matrix-stack-values.yaml

@@ -26,9 +26,9 @@ matrixRTC:
     host: livekit.matrix.hexor.cy
   sfu:
     enabled: true
-    manualIP: "78.24.180.234"
+    manualIP: "138.201.61.182"
     nodeSelector:
-      kubernetes.io/hostname: spb.tail2fe2d.ts.net
+      kubernetes.io/hostname: master.tail2fe2d.ts.net
     exposedServices:
       rtcTcp:
         enabled: true
@@ -45,14 +45,6 @@ matrixRTC:
 ## Synapse homeserver
 synapse:
   enabled: true
-  additional:
-    0-search-config:
-      config: |
-        user_directory:
-          enabled: true
-          search_all_users: true
-          prefer_local_users: true
-        enable_room_list_search: true
   ingress:
     host: synapse.matrix.hexor.cy
   postgres:
@@ -64,12 +56,12 @@ synapse:
     password:
       secret: matrix-postgres-creds
       secretKey: synapse_db_password
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
   media:
     storage:
       size: 20Gi
     maxUploadSize: 100M
+  # nodeSelector:
+  #   kubernetes.io/hostname: nas.homenet
 
 ## Matrix Authentication Service
 matrixAuthenticationService:
@@ -96,24 +88,24 @@ matrixAuthenticationService:
     1-oidc:
       configSecret: matrix-oidc-config
       configSecretKey: mas-oidc.yaml
-  nodeSelector:
+  # nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  #   kubernetes.io/hostname: nas.homenet
 
 ## Element Web client
 elementWeb:
   enabled: true
   ingress:
     host: chat.matrix.hexor.cy
-  nodeSelector:
+  # nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  #   kubernetes.io/hostname: nas.homenet
 
 ## Element Admin panel
 elementAdmin:
   enabled: true
   ingress:
     host: admin.matrix.hexor.cy
-  nodeSelector:
+  # nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  #   kubernetes.io/hostname: nas.homenet
 
 ## Well-known delegation on the base domain (host is derived from serverName)
 wellKnownDelegation:

k8s/apps/pasarguard/daemonset.yaml

@@ -1,5 +1,71 @@
 ---
-image: &image 'pasarguard/node:v0.4.0'
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pasarguard-node
+  labels:
+    app: pasarguard-node
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pasarguard-node-configmap
+  labels:
+    app: pasarguard-node
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "create", "update", "patch"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pasarguard-node-configmap
+  labels:
+    app: pasarguard-node
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pasarguard-node-configmap
+subjects:
+  - kind: ServiceAccount
+    name: pasarguard-node
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pasarguard-node-reader
+  labels:
+    app: pasarguard-node
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: pasarguard-node-reader
+  labels:
+    app: pasarguard-node
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: pasarguard-node-reader
+subjects:
+  - kind: ServiceAccount
+    name: pasarguard-node
+    namespace: pasarguard
+---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -47,7 +113,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: pasarguard-node
-          image: *image
+          image: 'pasarguard/node:v0.3.0'
           imagePullPolicy: Always
           command:
             - /bin/sh
@@ -153,71 +219,3 @@ spec:
           configMap:
             name: pasarguard-scripts
             defaultMode: 0755
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: pasarguard-node
-  labels:
-    app: pasarguard-node
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: pasarguard-node-configmap
-  labels:
-    app: pasarguard-node
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["get", "list", "create", "update", "patch"]
-  - apiGroups: ["cert-manager.io"]
-    resources: ["certificates"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["services", "endpoints"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: pasarguard-node-configmap
-  labels:
-    app: pasarguard-node
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: pasarguard-node-configmap
-subjects:
-  - kind: ServiceAccount
-    name: pasarguard-node
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: pasarguard-node-reader
-  labels:
-    app: pasarguard-node
-rules:
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: pasarguard-node-reader
-  labels:
-    app: pasarguard-node
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: pasarguard-node-reader
-subjects:
-  - kind: ServiceAccount
-    name: pasarguard-node
-    namespace: pasarguard

k8s/apps/pasarguard/deployment.yaml

@@ -1,5 +1,4 @@
 ---
-image: &image 'pasarguard/panel:v3.1.0'
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -35,7 +34,7 @@ spec:
               mountPath: /templates/subscription
       containers:
         - name: pasarguard-web
-          image: *image
+          image: 'pasarguard/panel:dev'
           imagePullPolicy: Always
           envFrom:
             - secretRef:
@@ -76,9 +75,6 @@ apiVersion: v1
 kind: Service
 metadata:
   name: pasarguard
-  annotations:
-    traefik.ingress.kubernetes.io/service.serversscheme: https
-    traefik.ingress.kubernetes.io/service.serverstransport: pasarguard-pasarguard-transport@kubernetescrd
 spec:
   selector:
     app: pasarguard

k8s/apps/pasarguard/ingress.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: pasarguard-transport
-spec:
-  insecureSkipVerify: true
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: pasarguard-ingress
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: ps.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: pasarguard
-                port:
-                  number: 80
-  tls:
-    - secretName: pasarguard-tls
-      hosts:
-        - ps.hexor.cy

k8s/apps/pasarguard/kustomization.yaml

@@ -9,4 +9,3 @@ resources:
   - ./certificate.yaml
   - ./configmap-scripts.yaml
   - ./servicemonitor.yaml
-  - ./ingress.yaml

k8s/apps/web-petting/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: web-petting
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: web-petting
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/web-petting
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-

k8s/apps/web-petting/deployment.yaml

@@ -1,49 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: web-petting
-  labels:
-    app: web-petting
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: web-petting
-  template:
-    metadata:
-      labels:
-        app: web-petting
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: web-petting-data
-      containers:
-      - name: web-petting
-        image: ultradesu/web-petting:0.1.0
-        imagePullPolicy: Always
-        args:
-#         - "tail"
-#         - "-F"
-#         - "/1"
-          - "web-petting"
-          - "-l"
-          - "0.0.0.0:3000"
-        ports:
-        - containerPort: 3000
-          name: http
-        volumeMounts:
-          - name: data
-            mountPath: /data
-        env:
-        - name: RUST_LOG
-          value: "info"
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "50m"
-          limits:
-            memory: "128Mi"
-            cpu: "150m"

k8s/apps/web-petting/ingress.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: web-petting-tls-ingress
-  annotations:
-    ingressClassName: traefik
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  rules:
-    - host: pet.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: web-petting
-                port:
-                  number: 80
-  tls:
-    - secretName: web-petting-tls
-      hosts:
-        - pet.hexor.cy
-

k8s/apps/web-petting/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - storage.yaml
-

k8s/apps/web-petting/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: web-petting
-  labels:
-    app: web-petting
-spec:
-  type: ClusterIP
-  selector:
-    app: web-petting
-  ports:
-  - port: 80
-    targetPort: 3000
-    protocol: TCP
-    name: http

k8s/apps/web-petting/storage.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: web-petting-data
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 10Gi

k8s/core/kanidm/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: kanidm
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: kanidm
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/core/kanidm
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

k8s/core/kanidm/certificate.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: kanidm-tls
-spec:
-  secretName: kanidm-tls
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-  dnsNames:
-    - auth.hexor.cy

k8s/core/kanidm/configmap.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kanidm-config
-data:
-  server.toml: |
-    bindaddress = "[::]:443"
-    db_path = "/data/kanidm.db"
-    tls_chain = "/certs/tls.crt"
-    tls_key = "/certs/tls.key"
-    domain = "auth.hexor.cy"
-    origin = "https://auth.hexor.cy"
-    log_level = "info"
-
-    [online_backup]
-    path = "/data/backups/"
-    schedule = "00 22 * * *"
-    versions = 7

k8s/core/kanidm/ingress.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: kanidm
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`auth.hexor.cy`)
-      kind: Rule
-      services:
-        - name: kanidm
-          port: 443
-          scheme: https
-          serversTransport: kanidm-transport
-  tls:
-    secretName: kanidm-ingress-tls

k8s/core/kanidm/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - configmap.yaml
-  - certificate.yaml
-  - statefulset.yaml
-  - service.yaml
-  - ingress.yaml
-  - servers-transport.yaml

k8s/core/kanidm/servers-transport.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: kanidm-transport
-spec:
-  insecureSkipVerify: true

k8s/core/kanidm/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kanidm
-  labels:
-    app: kanidm
-spec:
-  ports:
-    - name: https
-      port: 443
-      targetPort: 443
-      protocol: TCP
-  selector:
-    app: kanidm

k8s/core/kanidm/statefulset.yaml

@@ -1,86 +0,0 @@
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: kanidm
-  labels:
-    app: kanidm
-spec:
-  serviceName: kanidm
-  replicas: 1
-  selector:
-    matchLabels:
-      app: kanidm
-  template:
-    metadata:
-      labels:
-        app: kanidm
-    spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-      containers:
-        - name: kanidm
-          image: kanidm/server:1.9.3
-          ports:
-            - containerPort: 443
-              name: https
-              protocol: TCP
-          volumeMounts:
-            - name: kanidm-data
-              mountPath: /data
-            - name: kanidm-config
-              mountPath: /data/server.toml
-              subPath: server.toml
-              readOnly: true
-            - name: kanidm-tls
-              mountPath: /certs
-              readOnly: true
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "500m"
-          readinessProbe:
-            httpGet:
-              path: /status
-              port: 443
-              scheme: HTTPS
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /status
-              port: 443
-              scheme: HTTPS
-            initialDelaySeconds: 15
-            periodSeconds: 30
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-            runAsUser: 1000
-            runAsGroup: 1000
-      volumes:
-        - name: kanidm-config
-          configMap:
-            name: kanidm-config
-        - name: kanidm-tls
-          secret:
-            secretName: kanidm-tls
-      nodeSelector:
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
-  volumeClaimTemplates:
-    - metadata:
-        name: kanidm-data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        storageClassName: longhorn
-        resources:
-          requests:
-            storage: 1Gi

k8s/core/system-upgrade/plan.yaml

@@ -7,8 +7,6 @@ metadata:
 spec:
   concurrency: 1
   cordon: true
-  tolerations:
-  - operator: Exists
   nodeSelector:
     matchExpressions:
     - key: node-role.kubernetes.io/control-plane
@@ -18,7 +16,7 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  version: v1.35.4+k3s1
+  version: v1.35.2+k3s1
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -29,8 +27,6 @@ metadata:
 spec:
   concurrency: 1
   cordon: true
-  tolerations:
-  - operator: Exists
   nodeSelector:
     matchExpressions:
     - key: node-role.kubernetes.io/control-plane
@@ -43,4 +39,4 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  version: v1.35.4+k3s1
+  version: v1.35.2+k3s1