Compare commits
12 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
4b4c0c42a3 | ||
 Ultradesu
|
6202f0f24c | ||
|
Ultradesu
|
1746d210b1 | ||
|
Ultradesu
|
8ee4d7ebbf | ||
|
Ultradesu
|
ad7fce508f | ||
 ab
|
204f794b5d | ||
|
ab
|
5a7e32336e | ||
|
Ultradesu
|
d3ee23c3de | ||
|
Ultradesu
|
0df274c0b2 | ||
|
Ultradesu
|
658ec19ff1 | ||
|
Ultradesu
|
eb27dcf65b | ||
|
Ultradesu
|
e44cf95bb2 |
@@ -17,9 +17,12 @@ ArgoCD homelab project
|
|||||||
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
||||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||||
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
||||||
|
| **kanidm** | [](https://ag.hexor.cy/applications/argocd/kanidm) |
|
||||||
|
| **keycloak** | [](https://ag.hexor.cy/applications/argocd/keycloak) |
|
||||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||||
|
| **oauth2-proxy** | [](https://ag.hexor.cy/applications/argocd/oauth2-proxy) |
|
||||||
| **postgresql** | [](https://ag.hexor.cy/applications/argocd/postgresql) |
|
| **postgresql** | [](https://ag.hexor.cy/applications/argocd/postgresql) |
|
||||||
| **prom-stack** | [](https://ag.hexor.cy/applications/argocd/prom-stack) |
|
| **prom-stack** | [](https://ag.hexor.cy/applications/argocd/prom-stack) |
|
||||||
| **system-upgrade** | [](https://ag.hexor.cy/applications/argocd/system-upgrade) |
|
| **system-upgrade** | [](https://ag.hexor.cy/applications/argocd/system-upgrade) |
|
||||||
@@ -62,9 +65,12 @@ ArgoCD homelab project
|
|||||||
| **sonarr-stack** | [](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
|
| **sonarr-stack** | [](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
|
||||||
| **stirling-pdf** | [](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
|
| **stirling-pdf** | [](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
|
||||||
| **syncthing** | [](https://ag.hexor.cy/applications/argocd/syncthing) |
|
| **syncthing** | [](https://ag.hexor.cy/applications/argocd/syncthing) |
|
||||||
|
| **teamspeak** | [](https://ag.hexor.cy/applications/argocd/teamspeak) |
|
||||||
| **tg-bots** | [](https://ag.hexor.cy/applications/argocd/tg-bots) |
|
| **tg-bots** | [](https://ag.hexor.cy/applications/argocd/tg-bots) |
|
||||||
| **vaultwarden** | [](https://ag.hexor.cy/applications/argocd/vaultwarden) |
|
| **vaultwarden** | [](https://ag.hexor.cy/applications/argocd/vaultwarden) |
|
||||||
| **vpn** | [](https://ag.hexor.cy/applications/argocd/vpn) |
|
| **vpn** | [](https://ag.hexor.cy/applications/argocd/vpn) |
|
||||||
|
| **web-petting** | [](https://ag.hexor.cy/applications/argocd/web-petting) |
|
||||||
|
| **wedding** | [](https://ag.hexor.cy/applications/argocd/wedding) |
|
||||||
| **xandikos** | [](https://ag.hexor.cy/applications/argocd/xandikos) |
|
| **xandikos** | [](https://ag.hexor.cy/applications/argocd/xandikos) |
|
||||||
|
|
||||||
</td>
|
</td>
|
||||||
|
|||||||
@@ -70,7 +70,7 @@ kind: Deployment
|
|||||||
metadata:
|
metadata:
|
||||||
name: gitea-runner
|
name: gitea-runner
|
||||||
spec:
|
spec:
|
||||||
replicas: 1
|
replicas: 2
|
||||||
selector:
|
selector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
app: gitea-runner
|
app: gitea-runner
|
||||||
@@ -79,6 +79,10 @@ spec:
|
|||||||
labels:
|
labels:
|
||||||
app: gitea-runner
|
app: gitea-runner
|
||||||
spec:
|
spec:
|
||||||
|
dnsConfig:
|
||||||
|
options:
|
||||||
|
- name: ndots
|
||||||
|
value: "2"
|
||||||
tolerations:
|
tolerations:
|
||||||
- key: workload
|
- key: workload
|
||||||
operator: Equal
|
operator: Equal
|
||||||
@@ -93,38 +97,30 @@ spec:
|
|||||||
emptyDir:
|
emptyDir:
|
||||||
sizeLimit: 30Gi
|
sizeLimit: 30Gi
|
||||||
affinity:
|
affinity:
|
||||||
|
podAntiAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app: gitea-runner
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
nodeAffinity:
|
nodeAffinity:
|
||||||
preferredDuringSchedulingIgnoredDuringExecution:
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
- weight: 100
|
|
||||||
preference:
|
|
||||||
matchExpressions:
|
|
||||||
- key: kubernetes.io/hostname
|
|
||||||
operator: In
|
|
||||||
values:
|
|
||||||
- uk-desktop.tail2fe2d.ts.net
|
|
||||||
- weight: 50
|
|
||||||
preference:
|
|
||||||
matchExpressions:
|
|
||||||
- key: kubernetes.io/hostname
|
|
||||||
operator: In
|
|
||||||
values:
|
|
||||||
- home.homenet
|
|
||||||
- weight: 30
|
|
||||||
preference:
|
|
||||||
matchExpressions:
|
|
||||||
- key: kubernetes.io/hostname
|
|
||||||
operator: In
|
|
||||||
values:
|
|
||||||
- master.tail2fe2d.ts.net
|
|
||||||
- weight: 10
|
- weight: 10
|
||||||
preference:
|
preference:
|
||||||
matchExpressions:
|
matchExpressions:
|
||||||
- key: kubernetes.io/hostname
|
- key: kubernetes.io/hostname
|
||||||
operator: In
|
operator: In
|
||||||
values:
|
values:
|
||||||
- it.tail2fe2d.ts.net
|
- uk-desktop.tail2fe2d.ts.net
|
||||||
|
- ai.tail2fe2d.ts.net
|
||||||
|
- weight: 5
|
||||||
|
preference:
|
||||||
|
matchExpressions:
|
||||||
|
- key: kubernetes.io/hostname
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- home.homenet
|
||||||
- ch.tail2fe2d.ts.net
|
- ch.tail2fe2d.ts.net
|
||||||
- us.tail2fe2d.ts.net
|
|
||||||
containers:
|
containers:
|
||||||
- name: gitea-runner
|
- name: gitea-runner
|
||||||
image: gitea/act_runner:nightly
|
image: gitea/act_runner:nightly
|
||||||
@@ -144,13 +140,18 @@ spec:
|
|||||||
mountPath: /data
|
mountPath: /data
|
||||||
env:
|
env:
|
||||||
- name: GITEA_INSTANCE_URL
|
- name: GITEA_INSTANCE_URL
|
||||||
|
#value: "http://gitea.gitea.svc.cluster.local"
|
||||||
value: "https://gt.hexor.cy"
|
value: "https://gt.hexor.cy"
|
||||||
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: gitea-runner-act-runner-secrets
|
name: gitea-runner-act-runner-secrets
|
||||||
key: token
|
key: token
|
||||||
|
- name: NODE_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: spec.nodeName
|
||||||
- name: GITEA_RUNNER_NAME
|
- name: GITEA_RUNNER_NAME
|
||||||
value: "k8s-runner"
|
value: "$(NODE_NAME)"
|
||||||
- name: GITEA_RUNNER_LABELS
|
- name: GITEA_RUNNER_LABELS
|
||||||
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
|
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
|
||||||
|
|||||||
@@ -1,5 +1,18 @@
|
|||||||
---
|
---
|
||||||
apiVersion: traefik.io/v1alpha1
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: keycloak-auth
|
||||||
|
spec:
|
||||||
|
forwardAuth:
|
||||||
|
address: http://oauth2-proxy.oauth2-proxy.svc:80
|
||||||
|
trustForwardHeader: true
|
||||||
|
authResponseHeaders:
|
||||||
|
- X-Auth-Request-User
|
||||||
|
- X-Auth-Request-Email
|
||||||
|
- X-Auth-Request-Groups
|
||||||
|
---
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
kind: IngressRoute
|
kind: IngressRoute
|
||||||
metadata:
|
metadata:
|
||||||
name: secret-reader
|
name: secret-reader
|
||||||
@@ -13,7 +26,6 @@ spec:
|
|||||||
kind: Rule
|
kind: Rule
|
||||||
middlewares:
|
middlewares:
|
||||||
- name: keycloak-auth
|
- name: keycloak-auth
|
||||||
namespace: oauth2-proxy
|
|
||||||
services:
|
services:
|
||||||
- name: secret-reader
|
- name: secret-reader
|
||||||
port: 80
|
port: 80
|
||||||
|
|||||||
@@ -10,10 +10,10 @@ spec:
|
|||||||
template:
|
template:
|
||||||
type: Opaque
|
type: Opaque
|
||||||
data:
|
data:
|
||||||
client_id: oauth2-proxy
|
client-id: oauth2-proxy
|
||||||
client_secret: |-
|
client-secret: |-
|
||||||
{{ .client_secret }}
|
{{ .client_secret }}
|
||||||
cookie_secret: |-
|
cookie-secret: |-
|
||||||
{{ .cookie_secret }}
|
{{ .cookie_secret }}
|
||||||
data:
|
data:
|
||||||
- secretKey: client_secret
|
- secretKey: client_secret
|
||||||
|
|||||||
@@ -4,7 +4,6 @@ kind: Kustomization
|
|||||||
resources:
|
resources:
|
||||||
- app.yaml
|
- app.yaml
|
||||||
- external-secrets.yaml
|
- external-secrets.yaml
|
||||||
- middleware.yaml
|
|
||||||
|
|
||||||
helmCharts:
|
helmCharts:
|
||||||
- name: oauth2-proxy
|
- name: oauth2-proxy
|
||||||
|
|||||||
@@ -1,14 +1,3 @@
|
|||||||
---
|
# Middleware is deployed per-namespace alongside each IngressRoute
|
||||||
apiVersion: traefik.io/v1alpha1
|
# because Traefik does not allow cross-namespace middleware references.
|
||||||
kind: Middleware
|
# See k8s/apps/mtproxy/secret-reader-ingress.yaml for example.
|
||||||
metadata:
|
|
||||||
name: keycloak-auth
|
|
||||||
spec:
|
|
||||||
forwardAuth:
|
|
||||||
address: http://oauth2-proxy.oauth2-proxy.svc:80/oauth2/auth
|
|
||||||
trustForwardHeader: true
|
|
||||||
authResponseHeaders:
|
|
||||||
- X-Auth-Request-User
|
|
||||||
- X-Auth-Request-Email
|
|
||||||
- X-Auth-Request-Groups
|
|
||||||
- Authorization
|
|
||||||
|
|||||||
@@ -1,6 +1,7 @@
|
|||||||
replicaCount: 1
|
replicaCount: 1
|
||||||
|
|
||||||
config:
|
config:
|
||||||
|
existingSecret: oauth2-proxy-creds
|
||||||
configFile: |-
|
configFile: |-
|
||||||
provider = "keycloak-oidc"
|
provider = "keycloak-oidc"
|
||||||
provider_display_name = "Keycloak"
|
provider_display_name = "Keycloak"
|
||||||
@@ -21,23 +22,6 @@ config:
|
|||||||
code_challenge_method = "S256"
|
code_challenge_method = "S256"
|
||||||
scope = "openid profile email"
|
scope = "openid profile email"
|
||||||
|
|
||||||
extraEnv:
|
|
||||||
- name: OAUTH2_PROXY_CLIENT_ID
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: oauth2-proxy-creds
|
|
||||||
key: client_id
|
|
||||||
- name: OAUTH2_PROXY_CLIENT_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: oauth2-proxy-creds
|
|
||||||
key: client_secret
|
|
||||||
- name: OAUTH2_PROXY_COOKIE_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: oauth2-proxy-creds
|
|
||||||
key: cookie_secret
|
|
||||||
|
|
||||||
ingress:
|
ingress:
|
||||||
enabled: true
|
enabled: true
|
||||||
className: traefik
|
className: traefik
|
||||||
|
|||||||
Reference in New Issue
Block a user