Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
3460ceda66 |
@@ -17,12 +17,9 @@ ArgoCD homelab project
|
||||
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
||||
| **kanidm** | [](https://ag.hexor.cy/applications/argocd/kanidm) |
|
||||
| **keycloak** | [](https://ag.hexor.cy/applications/argocd/keycloak) |
|
||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
| **oauth2-proxy** | [](https://ag.hexor.cy/applications/argocd/oauth2-proxy) |
|
||||
| **postgresql** | [](https://ag.hexor.cy/applications/argocd/postgresql) |
|
||||
| **prom-stack** | [](https://ag.hexor.cy/applications/argocd/prom-stack) |
|
||||
| **system-upgrade** | [](https://ag.hexor.cy/applications/argocd/system-upgrade) |
|
||||
@@ -65,12 +62,9 @@ ArgoCD homelab project
|
||||
| **sonarr-stack** | [](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
|
||||
| **stirling-pdf** | [](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
|
||||
| **syncthing** | [](https://ag.hexor.cy/applications/argocd/syncthing) |
|
||||
| **teamspeak** | [](https://ag.hexor.cy/applications/argocd/teamspeak) |
|
||||
| **tg-bots** | [](https://ag.hexor.cy/applications/argocd/tg-bots) |
|
||||
| **vaultwarden** | [](https://ag.hexor.cy/applications/argocd/vaultwarden) |
|
||||
| **vpn** | [](https://ag.hexor.cy/applications/argocd/vpn) |
|
||||
| **web-petting** | [](https://ag.hexor.cy/applications/argocd/web-petting) |
|
||||
| **wedding** | [](https://ag.hexor.cy/applications/argocd/wedding) |
|
||||
| **xandikos** | [](https://ag.hexor.cy/applications/argocd/xandikos) |
|
||||
|
||||
</td>
|
||||
|
||||
@@ -20,6 +20,8 @@ spec:
|
||||
{{ .session_secret }}
|
||||
PG_STRING: |-
|
||||
postgres://furumi_dev:{{ .pg_pass }}@psql.psql.svc:5432/furumi_dev
|
||||
PLAYER_API_KEY: |-
|
||||
{{ .player_api_key }}
|
||||
data:
|
||||
- secretKey: client_id
|
||||
sourceRef:
|
||||
@@ -45,6 +47,14 @@ spec:
|
||||
remoteRef:
|
||||
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
|
||||
property: fields[2].value
|
||||
- secretKey: player_api_key
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
|
||||
property: fields[3].value
|
||||
- secretKey: pg_pass
|
||||
sourceRef:
|
||||
storeRef:
|
||||
|
||||
@@ -22,20 +22,13 @@ spec:
|
||||
- host: music-dev.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /api
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: furumi-dev-web-player
|
||||
port:
|
||||
number: 8080
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: furumi-dev-node-player
|
||||
port:
|
||||
number: 3001
|
||||
tls:
|
||||
- secretName: furumi-tls
|
||||
hosts:
|
||||
|
||||
@@ -7,5 +7,4 @@ resources:
|
||||
- external-secrets.yaml
|
||||
- ingress.yaml
|
||||
- web-player.yaml
|
||||
- node-player.yaml
|
||||
- metadata-agent.yaml
|
||||
|
||||
@@ -31,9 +31,9 @@ spec:
|
||||
- name: FURUMI_AGENT_STORAGE_DIR
|
||||
value: "/media"
|
||||
- name: FURUMI_AGENT_OLLAMA_URL
|
||||
value: "http://100.120.76.49:1234"
|
||||
value: "http://ollama.ollama.svc:11434"
|
||||
- name: FURUMI_AGENT_OLLAMA_MODEL
|
||||
value: "qwen2.5-32b-instruct"
|
||||
value: "qwen3:14b"
|
||||
- name: FURUMI_AGENT_POLL_INTERVAL_SECS
|
||||
value: "10"
|
||||
- name: RUST_LOG
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: furumi-dev-node-player
|
||||
labels:
|
||||
app: furumi-dev-node-player
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: furumi-dev-node-player
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: furumi-dev-node-player
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: furumi-dev-node-player
|
||||
image: ultradesu/furumi-node-player:dev
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: PORT
|
||||
value: "3001"
|
||||
- name: BASE_URL
|
||||
value: "https://music-dev.hexor.cy"
|
||||
- name: FRONTEND_ORIGIN
|
||||
value: "https://music-dev.hexor.cy"
|
||||
- name: SESSION_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_SESSION_SECRET
|
||||
- name: OIDC_ISSUER_BASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_ISSUER_URL
|
||||
- name: OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_ID
|
||||
- name: OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_SECRET
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 3001
|
||||
protocol: TCP
|
||||
@@ -26,23 +26,7 @@ spec:
|
||||
selector:
|
||||
app: furumi-dev-web-player
|
||||
ports:
|
||||
- name: http
|
||||
- name: web-ui
|
||||
protocol: TCP
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: furumi-dev-node-player
|
||||
labels:
|
||||
app: furumi-dev-node-player
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: furumi-dev-node-player
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 3001
|
||||
targetPort: 3001
|
||||
|
||||
@@ -51,12 +51,17 @@ spec:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: PG_STRING
|
||||
- name: FURUMI_PLAYER_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: PLAYER_API_KEY
|
||||
- name: FURUMI_PLAYER_STORAGE_DIR
|
||||
value: "/media"
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
ports:
|
||||
- name: http
|
||||
- name: web-ui
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
@@ -67,3 +72,4 @@ spec:
|
||||
hostPath:
|
||||
path: /k8s/furumi-dev/library
|
||||
type: DirectoryOrCreate
|
||||
|
||||
|
||||
@@ -31,9 +31,9 @@ spec:
|
||||
- name: FURUMI_AGENT_STORAGE_DIR
|
||||
value: "/media"
|
||||
- name: FURUMI_AGENT_OLLAMA_URL
|
||||
value: "http://100.120.76.49:1234"
|
||||
value: "http://ollama.ollama.svc:11434"
|
||||
- name: FURUMI_AGENT_OLLAMA_MODEL
|
||||
value: "google/gemma-4-26b-a4b"
|
||||
value: "qwen3.5:9b"
|
||||
- name: FURUMI_AGENT_POLL_INTERVAL_SECS
|
||||
value: "10"
|
||||
- name: RUST_LOG
|
||||
|
||||
@@ -48,8 +48,6 @@ spec:
|
||||
value: "true"
|
||||
- name: GITEA__service__CAPTCHA_TYPE
|
||||
value: "hcaptcha"
|
||||
- name: GITEA__webhook__ALLOWED_HOST_LIST
|
||||
value: "*"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: gitea-recapcha-creds
|
||||
@@ -129,14 +127,14 @@ spec:
|
||||
- name: gitea-runner
|
||||
image: gitea/act_runner:nightly
|
||||
resources:
|
||||
#requests:
|
||||
# cpu: "100m"
|
||||
# memory: "256Mi"
|
||||
# ephemeral-storage: "1Gi"
|
||||
#limits:
|
||||
# cpu: "3000m"
|
||||
# memory: "4Gi"
|
||||
# ephemeral-storage: "28Gi"
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
ephemeral-storage: "1Gi"
|
||||
limits:
|
||||
cpu: "3000m"
|
||||
memory: "4Gi"
|
||||
ephemeral-storage: "28Gi"
|
||||
volumeMounts:
|
||||
- name: docker-sock
|
||||
mountPath: /var/run/docker.sock
|
||||
|
||||
@@ -26,9 +26,9 @@ matrixRTC:
|
||||
host: livekit.matrix.hexor.cy
|
||||
sfu:
|
||||
enabled: true
|
||||
manualIP: "78.24.180.234"
|
||||
manualIP: "138.201.61.182"
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: spb.tail2fe2d.ts.net
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
exposedServices:
|
||||
rtcTcp:
|
||||
enabled: true
|
||||
@@ -45,14 +45,6 @@ matrixRTC:
|
||||
## Synapse homeserver
|
||||
synapse:
|
||||
enabled: true
|
||||
additional:
|
||||
0-search-config:
|
||||
config: |
|
||||
user_directory:
|
||||
enabled: true
|
||||
search_all_users: true
|
||||
prefer_local_users: true
|
||||
enable_room_list_search: true
|
||||
ingress:
|
||||
host: synapse.matrix.hexor.cy
|
||||
postgres:
|
||||
@@ -64,12 +56,12 @@ synapse:
|
||||
password:
|
||||
secret: matrix-postgres-creds
|
||||
secretKey: synapse_db_password
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
media:
|
||||
storage:
|
||||
size: 20Gi
|
||||
maxUploadSize: 100M
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Matrix Authentication Service
|
||||
matrixAuthenticationService:
|
||||
@@ -96,24 +88,24 @@ matrixAuthenticationService:
|
||||
1-oidc:
|
||||
configSecret: matrix-oidc-config
|
||||
configSecretKey: mas-oidc.yaml
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Element Web client
|
||||
elementWeb:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: chat.matrix.hexor.cy
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Element Admin panel
|
||||
elementAdmin:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: admin.matrix.hexor.cy
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Well-known delegation on the base domain (host is derived from serverName)
|
||||
wellKnownDelegation:
|
||||
|
||||
@@ -12,5 +12,4 @@ resources:
|
||||
- ./telemt-servicemonitor.yaml
|
||||
- ./service.yaml
|
||||
- ./secret-reader.yaml
|
||||
- ./secret-reader-ingress.yaml
|
||||
# - ./storage.yaml
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: keycloak-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://oauth2-proxy.oauth2-proxy.svc:80
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-User
|
||||
- X-Auth-Request-Email
|
||||
- X-Auth-Request-Groups
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: secret-reader
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`secret-reader.hexor.cy`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: keycloak-auth
|
||||
services:
|
||||
- name: secret-reader
|
||||
port: 80
|
||||
tls:
|
||||
secretName: secret-reader-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: secret-reader-tls
|
||||
spec:
|
||||
secretName: secret-reader-tls
|
||||
issuerRef:
|
||||
name: letsencrypt
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- secret-reader.hexor.cy
|
||||
@@ -1,5 +1,71 @@
|
||||
---
|
||||
image: &image 'pasarguard/node:v0.4.0'
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pasarguard-node
|
||||
labels:
|
||||
app: pasarguard-node
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pasarguard-node-configmap
|
||||
labels:
|
||||
app: pasarguard-node
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "list", "create", "update", "patch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "endpoints"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pasarguard-node-configmap
|
||||
labels:
|
||||
app: pasarguard-node
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pasarguard-node-configmap
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pasarguard-node
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: pasarguard-node-reader
|
||||
labels:
|
||||
app: pasarguard-node
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: pasarguard-node-reader
|
||||
labels:
|
||||
app: pasarguard-node
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: pasarguard-node-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pasarguard-node
|
||||
namespace: pasarguard
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
@@ -47,7 +113,7 @@ spec:
|
||||
mountPath: /scripts
|
||||
containers:
|
||||
- name: pasarguard-node
|
||||
image: *image
|
||||
image: 'pasarguard/node:v0.2.1'
|
||||
imagePullPolicy: Always
|
||||
command:
|
||||
- /bin/sh
|
||||
@@ -153,71 +219,3 @@ spec:
|
||||
configMap:
|
||||
name: pasarguard-scripts
|
||||
defaultMode: 0755
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pasarguard-node
|
||||
labels:
|
||||
app: pasarguard-node
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pasarguard-node-configmap
|
||||
labels:
|
||||
app: pasarguard-node
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "list", "create", "update", "patch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "endpoints"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pasarguard-node-configmap
|
||||
labels:
|
||||
app: pasarguard-node
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pasarguard-node-configmap
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pasarguard-node
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: pasarguard-node-reader
|
||||
labels:
|
||||
app: pasarguard-node
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: pasarguard-node-reader
|
||||
labels:
|
||||
app: pasarguard-node
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: pasarguard-node-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pasarguard-node
|
||||
namespace: pasarguard
|
||||
@@ -1,5 +1,4 @@
|
||||
---
|
||||
image: &image 'pasarguard/panel:v3.1.0'
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
@@ -35,7 +34,7 @@ spec:
|
||||
mountPath: /templates/subscription
|
||||
containers:
|
||||
- name: pasarguard-web
|
||||
image: *image
|
||||
image: 'pasarguard/panel:latest'
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- secretRef:
|
||||
@@ -76,9 +75,6 @@ apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: pasarguard
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/service.serversscheme: https
|
||||
traefik.ingress.kubernetes.io/service.serverstransport: pasarguard-pasarguard-transport@kubernetescrd
|
||||
spec:
|
||||
selector:
|
||||
app: pasarguard
|
||||
|
||||
@@ -1,31 +0,0 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: pasarguard-transport
|
||||
spec:
|
||||
insecureSkipVerify: true
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: pasarguard-ingress
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: ps.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: pasarguard
|
||||
port:
|
||||
number: 80
|
||||
tls:
|
||||
- secretName: pasarguard-tls
|
||||
hosts:
|
||||
- ps.hexor.cy
|
||||
@@ -9,4 +9,3 @@ resources:
|
||||
- ./certificate.yaml
|
||||
- ./configmap-scripts.yaml
|
||||
- ./servicemonitor.yaml
|
||||
- ./ingress.yaml
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: teamspeak
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: teamspeak
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/teamspeak
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: teamspeak
|
||||
labels:
|
||||
app: teamspeak
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: teamspeak
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: teamspeak
|
||||
spec:
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: teamspeak-data
|
||||
containers:
|
||||
- name: teamspeak
|
||||
image: 'teamspeak:latest'
|
||||
env:
|
||||
- name: TS3SERVER_LICENSE
|
||||
value: "accept"
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "100m"
|
||||
limits:
|
||||
memory: "512Mi"
|
||||
cpu: "1000m"
|
||||
ports:
|
||||
- name: voice
|
||||
containerPort: 9987
|
||||
protocol: UDP
|
||||
- name: filetransfer
|
||||
containerPort: 30033
|
||||
protocol: TCP
|
||||
- name: serverquery
|
||||
containerPort: 10011
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/ts3server
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- storage.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
@@ -1,22 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: teamspeak
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: teamspeak
|
||||
ports:
|
||||
- name: voice
|
||||
protocol: UDP
|
||||
port: 9987
|
||||
targetPort: 9987
|
||||
- name: filetransfer
|
||||
protocol: TCP
|
||||
port: 30033
|
||||
targetPort: 30033
|
||||
- name: serverquery
|
||||
protocol: TCP
|
||||
port: 10011
|
||||
targetPort: 10011
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: teamspeak-data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: longhorn
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: web-petting
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: web-petting
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/web-petting
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: web-petting
|
||||
labels:
|
||||
app: web-petting
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: web-petting
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: web-petting
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: web-petting-data
|
||||
containers:
|
||||
- name: web-petting
|
||||
image: ultradesu/web-petting:0.1.0
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
# - "tail"
|
||||
# - "-F"
|
||||
# - "/1"
|
||||
- "web-petting"
|
||||
- "-l"
|
||||
- "0.0.0.0:3000"
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
env:
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
resources:
|
||||
requests:
|
||||
memory: "64Mi"
|
||||
cpu: "50m"
|
||||
limits:
|
||||
memory: "128Mi"
|
||||
cpu: "150m"
|
||||
@@ -1,27 +0,0 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: web-petting-tls-ingress
|
||||
annotations:
|
||||
ingressClassName: traefik
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
acme.cert-manager.io/http01-edit-in-place: "true"
|
||||
spec:
|
||||
rules:
|
||||
- host: pet.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: web-petting
|
||||
port:
|
||||
number: 80
|
||||
tls:
|
||||
- secretName: web-petting-tls
|
||||
hosts:
|
||||
- pet.hexor.cy
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- storage.yaml
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: web-petting
|
||||
labels:
|
||||
app: web-petting
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: web-petting
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 3000
|
||||
protocol: TCP
|
||||
name: http
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: web-petting-data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: longhorn
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: wedding
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: wedding
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/wedding
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
@@ -1,69 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: wedding
|
||||
labels:
|
||||
app: wedding
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: wedding
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: wedding
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: spb.tail2fe2d.ts.net
|
||||
initContainers:
|
||||
- name: git-clone
|
||||
image: alpine/git:latest
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- git clone --depth 1 https://gt.hexor.cy/ab/wedding.git /src
|
||||
volumeMounts:
|
||||
- name: source
|
||||
mountPath: /src
|
||||
- name: zola-build
|
||||
image: ghcr.io/getzola/zola:v0.22.1
|
||||
command:
|
||||
- /bin/zola
|
||||
args:
|
||||
- --root
|
||||
- /src
|
||||
- build
|
||||
- --base-url
|
||||
- https://wedding.hexor.cy/
|
||||
- --output-dir
|
||||
- /public/html
|
||||
volumeMounts:
|
||||
- name: source
|
||||
mountPath: /src
|
||||
- name: public
|
||||
mountPath: /public
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:alpine
|
||||
ports:
|
||||
- containerPort: 80
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: public
|
||||
mountPath: /usr/share/nginx/html
|
||||
subPath: html
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 32Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 64Mi
|
||||
cpu: 100m
|
||||
volumes:
|
||||
- name: source
|
||||
emptyDir: {}
|
||||
- name: public
|
||||
emptyDir: {}
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: wedding-tls-ingress
|
||||
annotations:
|
||||
ingressClassName: traefik
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
acme.cert-manager.io/http01-edit-in-place: "true"
|
||||
spec:
|
||||
rules:
|
||||
- host: wedding.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: wedding
|
||||
port:
|
||||
number: 80
|
||||
tls:
|
||||
- secretName: wedding-tls
|
||||
hosts:
|
||||
- wedding.hexor.cy
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- rbac.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- webhook.yaml
|
||||
@@ -1,42 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: wedding-deployer
|
||||
namespace: wedding
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: wedding-deployer-token
|
||||
namespace: wedding
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: wedding-deployer
|
||||
type: kubernetes.io/service-account-token
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: wedding-restart
|
||||
namespace: wedding
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "patch"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: wedding-deployer-restart
|
||||
namespace: wedding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: wedding-deployer
|
||||
namespace: wedding
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: wedding-restart
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: wedding
|
||||
spec:
|
||||
selector:
|
||||
app: wedding
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
protocol: TCP
|
||||
@@ -1,71 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: webhook-script
|
||||
data:
|
||||
serve.sh: |
|
||||
#!/bin/sh
|
||||
echo "Webhook server listening on :8080"
|
||||
while true; do
|
||||
echo -e "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok" \
|
||||
| nc -l -p 8080 > /dev/null
|
||||
echo "Received webhook, restarting deployment..."
|
||||
kubectl rollout restart deployment/wedding
|
||||
done
|
||||
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: wedding-webhook
|
||||
labels:
|
||||
app: wedding-webhook
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: wedding-webhook
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: wedding-webhook
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: spb.tail2fe2d.ts.net
|
||||
serviceAccountName: wedding-deployer
|
||||
containers:
|
||||
- name: webhook
|
||||
image: alpine/k8s:1.32.3
|
||||
command: ["sh", "/scripts/serve.sh"]
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: script
|
||||
mountPath: /scripts
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 16Mi
|
||||
cpu: 5m
|
||||
limits:
|
||||
memory: 32Mi
|
||||
cpu: 50m
|
||||
volumes:
|
||||
- name: script
|
||||
configMap:
|
||||
name: webhook-script
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: wedding-webhook
|
||||
spec:
|
||||
selector:
|
||||
app: wedding-webhook
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
@@ -11,7 +11,7 @@ resources:
|
||||
helmCharts:
|
||||
- name: authentik
|
||||
repo: https://charts.goauthentik.io
|
||||
version: 2026.2.2
|
||||
version: 2026.2.1
|
||||
releaseName: authentik
|
||||
namespace: authentik
|
||||
valuesFile: values.yaml
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
global:
|
||||
image:
|
||||
tag: "2026.2.2"
|
||||
tag: "2026.2.1"
|
||||
|
||||
authentik:
|
||||
error_reporting:
|
||||
|
||||
@@ -18,9 +18,11 @@ spec:
|
||||
key: apiKey
|
||||
selector:
|
||||
dnsZones:
|
||||
- "*.hexor.cy"
|
||||
- "*.hexor.ru"
|
||||
- "*.btwiusearch.net"
|
||||
- "hexor.ru"
|
||||
- "hexor.cy"
|
||||
- "btwiusearch.net"
|
||||
- dns01:
|
||||
route53:
|
||||
@@ -33,6 +35,7 @@ spec:
|
||||
key: secretKey
|
||||
selector:
|
||||
dnsZones:
|
||||
- "*.hexor.cy"
|
||||
- "hexor.cy"
|
||||
- "ps.hexor.cy"
|
||||
- "of.hexor.cy"
|
||||
- "matrix.hexor.cy"
|
||||
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: core
|
||||
destination:
|
||||
namespace: kanidm
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/core/kanidm
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ServerSideApply=true
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: kanidm-tls
|
||||
spec:
|
||||
secretName: kanidm-tls
|
||||
issuerRef:
|
||||
name: letsencrypt
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- auth.hexor.cy
|
||||
@@ -1,19 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kanidm-config
|
||||
data:
|
||||
server.toml: |
|
||||
bindaddress = "[::]:443"
|
||||
db_path = "/data/kanidm.db"
|
||||
tls_chain = "/certs/tls.crt"
|
||||
tls_key = "/certs/tls.key"
|
||||
domain = "auth.hexor.cy"
|
||||
origin = "https://auth.hexor.cy"
|
||||
log_level = "info"
|
||||
|
||||
[online_backup]
|
||||
path = "/data/backups/"
|
||||
schedule = "00 22 * * *"
|
||||
versions = 7
|
||||
@@ -1,20 +0,0 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: kanidm
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`auth.hexor.cy`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: kanidm
|
||||
port: 443
|
||||
scheme: https
|
||||
serversTransport: kanidm-transport
|
||||
tls:
|
||||
secretName: kanidm-ingress-tls
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- configmap.yaml
|
||||
- certificate.yaml
|
||||
- statefulset.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- servers-transport.yaml
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: kanidm-transport
|
||||
spec:
|
||||
insecureSkipVerify: true
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kanidm
|
||||
labels:
|
||||
app: kanidm
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
port: 443
|
||||
targetPort: 443
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: kanidm
|
||||
@@ -1,86 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: kanidm
|
||||
labels:
|
||||
app: kanidm
|
||||
spec:
|
||||
serviceName: kanidm
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: kanidm
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: kanidm
|
||||
spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
containers:
|
||||
- name: kanidm
|
||||
image: kanidm/server:1.9.3
|
||||
ports:
|
||||
- containerPort: 443
|
||||
name: https
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: kanidm-data
|
||||
mountPath: /data
|
||||
- name: kanidm-config
|
||||
mountPath: /data/server.toml
|
||||
subPath: server.toml
|
||||
readOnly: true
|
||||
- name: kanidm-tls
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
memory: "128Mi"
|
||||
cpu: "100m"
|
||||
limits:
|
||||
memory: "512Mi"
|
||||
cpu: "500m"
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /status
|
||||
port: 443
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /status
|
||||
port: 443
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 30
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
volumes:
|
||||
- name: kanidm-config
|
||||
configMap:
|
||||
name: kanidm-config
|
||||
- name: kanidm-tls
|
||||
secret:
|
||||
secretName: kanidm-tls
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: kanidm-data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
storageClassName: longhorn
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: keycloak
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: core
|
||||
destination:
|
||||
namespace: keycloak
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/core/keycloak
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ServerSideApply=true
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: keycloak-creds
|
||||
spec:
|
||||
target:
|
||||
name: keycloak-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
KC_DB_USERNAME: keycloak
|
||||
KC_DB_PASSWORD: |-
|
||||
{{ .db_password }}
|
||||
KC_BOOTSTRAP_ADMIN_USERNAME: admin
|
||||
KC_BOOTSTRAP_ADMIN_PASSWORD: |-
|
||||
{{ .admin_password }}
|
||||
data:
|
||||
- secretKey: db_password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[18].value
|
||||
- secretKey: admin_password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 9422b636-a91d-40e4-bf98-925b2a3f831d
|
||||
property: login.password
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- external-secrets.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: keycloakx
|
||||
repo: https://codecentric.github.io/helm-charts
|
||||
version: 7.1.11
|
||||
releaseName: keycloak
|
||||
namespace: keycloak
|
||||
valuesFile: values.yaml
|
||||
@@ -1,67 +0,0 @@
|
||||
replicas: 1
|
||||
|
||||
image:
|
||||
repository: quay.io/keycloak/keycloak
|
||||
tag: "26.5.6"
|
||||
|
||||
command:
|
||||
- "/opt/keycloak/bin/kc.sh"
|
||||
- "start"
|
||||
- "--http-port=8080"
|
||||
- "--hostname-strict=false"
|
||||
- "--proxy-headers=xforwarded"
|
||||
|
||||
extraEnvFrom: |
|
||||
- secretRef:
|
||||
name: keycloak-creds
|
||||
|
||||
extraEnv: |
|
||||
- name: KC_HOSTNAME
|
||||
value: auth.hexor.cy
|
||||
- name: JAVA_OPTS_APPEND
|
||||
value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc"
|
||||
|
||||
dbchecker:
|
||||
enabled: true
|
||||
|
||||
database:
|
||||
vendor: postgres
|
||||
hostname: psql.psql.svc
|
||||
port: 5432
|
||||
database: keycloak
|
||||
existingSecret: keycloak-creds
|
||||
existingSecretKey: KC_DB_PASSWORD
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: traefik
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
rules:
|
||||
- host: auth.hexor.cy
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: keycloak-tls
|
||||
hosts:
|
||||
- auth.hexor.cy
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: oauth2-proxy
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: core
|
||||
destination:
|
||||
namespace: oauth2-proxy
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/core/oauth2-proxy
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ServerSideApply=true
|
||||
@@ -1,40 +0,0 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: oauth2-proxy-creds
|
||||
spec:
|
||||
target:
|
||||
name: oauth2-proxy-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
client-id: oauth2-proxy
|
||||
client-secret: |-
|
||||
{{ .client_secret }}
|
||||
cookie-secret: |-
|
||||
{{ .cookie_secret }}
|
||||
data:
|
||||
- secretKey: client_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
|
||||
property: login.password
|
||||
- secretKey: cookie_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
|
||||
property: fields[0].value
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- external-secrets.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: oauth2-proxy
|
||||
repo: https://oauth2-proxy.github.io/manifests
|
||||
version: 10.4.3
|
||||
releaseName: oauth2-proxy
|
||||
namespace: oauth2-proxy
|
||||
valuesFile: values.yaml
|
||||
@@ -1,3 +0,0 @@
|
||||
# Middleware is deployed per-namespace alongside each IngressRoute
|
||||
# because Traefik does not allow cross-namespace middleware references.
|
||||
# See k8s/apps/mtproxy/secret-reader-ingress.yaml for example.
|
||||
@@ -1,51 +0,0 @@
|
||||
replicaCount: 1
|
||||
|
||||
config:
|
||||
existingSecret: oauth2-proxy-creds
|
||||
configFile: |-
|
||||
provider = "keycloak-oidc"
|
||||
provider_display_name = "Keycloak"
|
||||
oidc_issuer_url = "https://auth.hexor.cy/auth/realms/hexor"
|
||||
redirect_url = "https://oauth.hexor.cy/oauth2/callback"
|
||||
email_domains = ["*"]
|
||||
cookie_domains = [".hexor.cy"]
|
||||
whitelist_domains = [".hexor.cy"]
|
||||
cookie_secure = true
|
||||
cookie_samesite = "lax"
|
||||
upstreams = ["static://200"]
|
||||
reverse_proxy = true
|
||||
set_xauthrequest = true
|
||||
set_authorization_header = true
|
||||
pass_access_token = true
|
||||
pass_authorization_header = true
|
||||
skip_provider_button = true
|
||||
code_challenge_method = "S256"
|
||||
scope = "openid profile email"
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
hosts:
|
||||
- oauth.hexor.cy
|
||||
tls:
|
||||
- secretName: oauth2-proxy-tls
|
||||
hosts:
|
||||
- oauth.hexor.cy
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
@@ -135,8 +135,6 @@ spec:
|
||||
{{ .furumi }}
|
||||
USER_furumi_dev: |-
|
||||
{{ .furumi_dev }}
|
||||
USER_keycloak: |-
|
||||
{{ .keycloak }}
|
||||
data:
|
||||
- secretKey: authentik
|
||||
sourceRef:
|
||||
@@ -325,14 +323,4 @@ spec:
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[17].value
|
||||
- secretKey: keycloak
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[18].value
|
||||
|
||||
|
||||
@@ -20,12 +20,8 @@ loki:
|
||||
filesystem:
|
||||
chunks_directory: /var/loki/chunks
|
||||
rules_directory: /var/loki/rules
|
||||
compactor:
|
||||
retention_enabled: true
|
||||
delete_request_store: filesystem
|
||||
limits_config:
|
||||
reject_old_samples: false
|
||||
retention_period: 1440h
|
||||
ingestion_rate_mb: 16
|
||||
ingestion_burst_size_mb: 32
|
||||
max_query_parallelism: 32
|
||||
|
||||
@@ -78,7 +78,7 @@ prometheus:
|
||||
- targets: ['prom-a2s-exporter.counter-strike.svc:9841']
|
||||
labels: {instance: master}
|
||||
|
||||
retention: "380d"
|
||||
retention: "99999d"
|
||||
retentionSize: "0"
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
@@ -7,8 +7,6 @@ metadata:
|
||||
spec:
|
||||
concurrency: 1
|
||||
cordon: true
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
nodeSelector:
|
||||
matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
@@ -18,7 +16,7 @@ spec:
|
||||
serviceAccountName: system-upgrade
|
||||
upgrade:
|
||||
image: rancher/k3s-upgrade
|
||||
version: v1.35.4+k3s1
|
||||
version: v1.35.2+k3s1
|
||||
---
|
||||
# Agent plan
|
||||
apiVersion: upgrade.cattle.io/v1
|
||||
@@ -29,8 +27,6 @@ metadata:
|
||||
spec:
|
||||
concurrency: 1
|
||||
cordon: true
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
nodeSelector:
|
||||
matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
@@ -43,4 +39,4 @@ spec:
|
||||
serviceAccountName: system-upgrade
|
||||
upgrade:
|
||||
image: rancher/k3s-upgrade
|
||||
version: v1.35.4+k3s1
|
||||
version: v1.35.2+k3s1
|
||||
@@ -35,7 +35,7 @@ spec:
|
||||
terminationGracePeriodSeconds: 10
|
||||
containers:
|
||||
- name: minecraft
|
||||
image: 'eclipse-temurin:8-jdk-ubi10-minimal'
|
||||
image: 'openjdk:8-jdk-alpine'
|
||||
command: ["java"]
|
||||
args:
|
||||
- -Xms4G
|
||||
|
||||
Reference in New Issue
Block a user