Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-04-12 11:38:44

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -13,13 +13,10 @@ ArgoCD homelab project
 | Application | Status |
 | :--- | :---: |
 | **argocd** | [![argocd](https://ag.hexor.cy/api/badge?name=argocd&revision=true)](https://ag.hexor.cy/applications/argocd/argocd) |
-| **auth-proxy** | [![auth-proxy](https://ag.hexor.cy/api/badge?name=auth-proxy&revision=true)](https://ag.hexor.cy/applications/argocd/auth-proxy) |
 | **authentik** | [![authentik](https://ag.hexor.cy/api/badge?name=authentik&revision=true)](https://ag.hexor.cy/applications/argocd/authentik) |
 | **cert-manager** | [![cert-manager](https://ag.hexor.cy/api/badge?name=cert-manager&revision=true)](https://ag.hexor.cy/applications/argocd/cert-manager) |
 | **external-secrets** | [![external-secrets](https://ag.hexor.cy/api/badge?name=external-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/external-secrets) |
 | **gpu** | [![gpu](https://ag.hexor.cy/api/badge?name=gpu&revision=true)](https://ag.hexor.cy/applications/argocd/gpu) |
-| **kanidm** | [![kanidm](https://ag.hexor.cy/api/badge?name=kanidm&revision=true)](https://ag.hexor.cy/applications/argocd/kanidm) |
-| **keycloak** | [![keycloak](https://ag.hexor.cy/api/badge?name=keycloak&revision=true)](https://ag.hexor.cy/applications/argocd/keycloak) |
 | **kube-system-custom** | [![kube-system-custom](https://ag.hexor.cy/api/badge?name=kube-system-custom&revision=true)](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
 | **kubernetes-dashboard** | [![kubernetes-dashboard](https://ag.hexor.cy/api/badge?name=kubernetes-dashboard&revision=true)](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
 | **longhorn** | [![longhorn](https://ag.hexor.cy/api/badge?name=longhorn&revision=true)](https://ag.hexor.cy/applications/argocd/longhorn) |
@@ -65,12 +62,9 @@ ArgoCD homelab project
 | **sonarr-stack** | [![sonarr-stack](https://ag.hexor.cy/api/badge?name=sonarr-stack&revision=true)](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
 | **stirling-pdf** | [![stirling-pdf](https://ag.hexor.cy/api/badge?name=stirling-pdf&revision=true)](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
 | **syncthing** | [![syncthing](https://ag.hexor.cy/api/badge?name=syncthing&revision=true)](https://ag.hexor.cy/applications/argocd/syncthing) |
-| **teamspeak** | [![teamspeak](https://ag.hexor.cy/api/badge?name=teamspeak&revision=true)](https://ag.hexor.cy/applications/argocd/teamspeak) |
 | **tg-bots** | [![tg-bots](https://ag.hexor.cy/api/badge?name=tg-bots&revision=true)](https://ag.hexor.cy/applications/argocd/tg-bots) |
 | **vaultwarden** | [![vaultwarden](https://ag.hexor.cy/api/badge?name=vaultwarden&revision=true)](https://ag.hexor.cy/applications/argocd/vaultwarden) |
 | **vpn** | [![vpn](https://ag.hexor.cy/api/badge?name=vpn&revision=true)](https://ag.hexor.cy/applications/argocd/vpn) |
-| **web-petting** | [![web-petting](https://ag.hexor.cy/api/badge?name=web-petting&revision=true)](https://ag.hexor.cy/applications/argocd/web-petting) |
-| **wedding** | [![wedding](https://ag.hexor.cy/api/badge?name=wedding&revision=true)](https://ag.hexor.cy/applications/argocd/wedding) |
 | **xandikos** | [![xandikos](https://ag.hexor.cy/api/badge?name=xandikos&revision=true)](https://ag.hexor.cy/applications/argocd/xandikos) |
 
 </td>

k8s/apps/gitea/deployment.yaml

@@ -48,8 +48,6 @@ spec:
               value: "true"
             - name: GITEA__service__CAPTCHA_TYPE
               value: "hcaptcha"
-            - name: GITEA__webhook__ALLOWED_HOST_LIST
-              value: "*"
           envFrom:
           - secretRef:
               name: gitea-recapcha-creds
@@ -70,7 +68,7 @@ kind: Deployment
 metadata:
   name: gitea-runner
 spec:
-  replicas: 2
+  replicas: 1
   selector:
     matchLabels:
       app: gitea-runner
@@ -79,19 +77,11 @@ spec:
       labels:
         app: gitea-runner
     spec:
-      dnsConfig:
-        options:
-          - name: ndots
-            value: "2"
       tolerations:
         - key: workload
           operator: Equal
           value: desktop
           effect: NoSchedule
-        - key: workload
-          operator: Equal
-          value: ai
-          effect: NoSchedule
       volumes:
         - name: docker-sock
           hostPath:
@@ -101,12 +91,6 @@ spec:
           emptyDir:
             sizeLimit: 30Gi
       affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app: gitea-runner
-              topologyKey: kubernetes.io/hostname
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
           - weight: 100
@@ -116,7 +100,6 @@ spec:
                 operator: In
                 values:
                 - uk-desktop.tail2fe2d.ts.net
-                - ai.tail2fe2d.ts.net
           - weight: 50
             preference:
               matchExpressions:
@@ -124,7 +107,22 @@ spec:
                 operator: In
                 values:
                 - home.homenet
+          - weight: 30
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - master.tail2fe2d.ts.net
+          - weight: 10
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
                 - it.tail2fe2d.ts.net
+                - ch.tail2fe2d.ts.net
+                - us.tail2fe2d.ts.net
       containers:
         - name: gitea-runner
           image: gitea/act_runner:nightly
@@ -144,18 +142,13 @@ spec:
               mountPath: /data
           env:
             - name: GITEA_INSTANCE_URL
-              #value: "http://gitea.gitea.svc.cluster.local"
               value: "https://gt.hexor.cy"
             - name: GITEA_RUNNER_REGISTRATION_TOKEN
               valueFrom:
                 secretKeyRef:
                   name: gitea-runner-act-runner-secrets
                   key: token
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
             - name: GITEA_RUNNER_NAME
-              value: "$(NODE_NAME)"
+              value: "k8s-runner"
             - name: GITEA_RUNNER_LABELS
               value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"

k8s/apps/matrix/matrix-stack-values.yaml

@@ -26,9 +26,9 @@ matrixRTC:
     host: livekit.matrix.hexor.cy
   sfu:
     enabled: true
-    manualIP: "78.24.180.234"
+    manualIP: "138.201.61.182"
     nodeSelector:
-      kubernetes.io/hostname: spb.tail2fe2d.ts.net
+      kubernetes.io/hostname: master.tail2fe2d.ts.net
     exposedServices:
       rtcTcp:
         enabled: true
@@ -45,14 +45,6 @@ matrixRTC:
 ## Synapse homeserver
 synapse:
   enabled: true
-  additional:
-    0-search-config:
-      config: |
-        user_directory:
-          enabled: true
-          search_all_users: true
-          prefer_local_users: true
-        enable_room_list_search: true
   ingress:
     host: synapse.matrix.hexor.cy
   postgres:
@@ -64,12 +56,12 @@ synapse:
     password:
       secret: matrix-postgres-creds
       secretKey: synapse_db_password
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
   media:
     storage:
       size: 20Gi
     maxUploadSize: 100M
+  # nodeSelector:
+  #   kubernetes.io/hostname: nas.homenet
 
 ## Matrix Authentication Service
 matrixAuthenticationService:
@@ -96,24 +88,24 @@ matrixAuthenticationService:
     1-oidc:
       configSecret: matrix-oidc-config
       configSecretKey: mas-oidc.yaml
-  nodeSelector:
+  # nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  #   kubernetes.io/hostname: nas.homenet
 
 ## Element Web client
 elementWeb:
   enabled: true
   ingress:
     host: chat.matrix.hexor.cy
-  nodeSelector:
+  # nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  #   kubernetes.io/hostname: nas.homenet
 
 ## Element Admin panel
 elementAdmin:
   enabled: true
   ingress:
     host: admin.matrix.hexor.cy
-  nodeSelector:
+  # nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  #   kubernetes.io/hostname: nas.homenet
 
 ## Well-known delegation on the base domain (host is derived from serverName)
 wellKnownDelegation:

k8s/apps/mtproxy/kustomization.yaml

@@ -12,5 +12,4 @@ resources:
   - ./telemt-servicemonitor.yaml
   - ./service.yaml
   - ./secret-reader.yaml
-  - ./secret-reader-ingress.yaml
 # - ./storage.yaml

k8s/apps/mtproxy/secret-reader-ingress.yaml

@@ -1,45 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: auth-proxy
-spec:
-  forwardAuth:
-    address: http://auth-proxy.auth-proxy.svc:80/auth
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-Auth-Request-User
-      - X-Auth-Request-Email
-      - X-Auth-Request-Groups
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: secret-reader
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`secret-reader.hexor.cy`)
-      kind: Rule
-      middlewares:
-        - name: auth-proxy
-      services:
-        - name: secret-reader
-          port: 80
-  tls:
-    secretName: secret-reader-tls
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: secret-reader-tls
-spec:
-  secretName: secret-reader-tls
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-  dnsNames:
-    - secret-reader.hexor.cy

k8s/apps/pasarguard/daemonset.yaml

@@ -1,5 +1,71 @@
 ---
-image: &image 'pasarguard/node:v0.4.0'
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pasarguard-node
+  labels:
+    app: pasarguard-node
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pasarguard-node-configmap
+  labels:
+    app: pasarguard-node
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "create", "update", "patch"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pasarguard-node-configmap
+  labels:
+    app: pasarguard-node
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pasarguard-node-configmap
+subjects:
+  - kind: ServiceAccount
+    name: pasarguard-node
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pasarguard-node-reader
+  labels:
+    app: pasarguard-node
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: pasarguard-node-reader
+  labels:
+    app: pasarguard-node
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: pasarguard-node-reader
+subjects:
+  - kind: ServiceAccount
+    name: pasarguard-node
+    namespace: pasarguard
+---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -47,7 +113,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: pasarguard-node
-          image: *image
+          image: 'pasarguard/node:v0.3.0'
           imagePullPolicy: Always
           command:
             - /bin/sh
@@ -153,71 +219,3 @@ spec:
           configMap:
             name: pasarguard-scripts
             defaultMode: 0755
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: pasarguard-node
-  labels:
-    app: pasarguard-node
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: pasarguard-node-configmap
-  labels:
-    app: pasarguard-node
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["get", "list", "create", "update", "patch"]
-  - apiGroups: ["cert-manager.io"]
-    resources: ["certificates"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["services", "endpoints"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: pasarguard-node-configmap
-  labels:
-    app: pasarguard-node
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: pasarguard-node-configmap
-subjects:
-  - kind: ServiceAccount
-    name: pasarguard-node
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: pasarguard-node-reader
-  labels:
-    app: pasarguard-node
-rules:
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: pasarguard-node-reader
-  labels:
-    app: pasarguard-node
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: pasarguard-node-reader
-subjects:
-  - kind: ServiceAccount
-    name: pasarguard-node
-    namespace: pasarguard

k8s/apps/pasarguard/deployment.yaml

@@ -1,5 +1,4 @@
 ---
-image: &image 'pasarguard/panel:v3.1.0'
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -35,7 +34,7 @@ spec:
               mountPath: /templates/subscription
       containers:
         - name: pasarguard-web
-          image: *image
+          image: 'pasarguard/panel:dev'
           imagePullPolicy: Always
           envFrom:
             - secretRef:
@@ -76,9 +75,6 @@ apiVersion: v1
 kind: Service
 metadata:
   name: pasarguard
-  annotations:
-    traefik.ingress.kubernetes.io/service.serversscheme: https
-    traefik.ingress.kubernetes.io/service.serverstransport: pasarguard-pasarguard-transport@kubernetescrd
 spec:
   selector:
     app: pasarguard

k8s/apps/pasarguard/ingress.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: pasarguard-transport
-spec:
-  insecureSkipVerify: true
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: pasarguard-ingress
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: ps.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: pasarguard
-                port:
-                  number: 80
-  tls:
-    - secretName: pasarguard-tls
-      hosts:
-        - ps.hexor.cy

k8s/apps/pasarguard/kustomization.yaml

@@ -9,4 +9,3 @@ resources:
   - ./certificate.yaml
   - ./configmap-scripts.yaml
   - ./servicemonitor.yaml
-  - ./ingress.yaml

k8s/apps/teamspeak/app.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: teamspeak
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: teamspeak
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/teamspeak
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true

k8s/apps/teamspeak/deployment.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: teamspeak
-  labels:
-    app: teamspeak
-spec:
-  selector:
-    matchLabels:
-      app: teamspeak
-  replicas: 1
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: teamspeak
-    spec:
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: teamspeak-data
-      containers:
-        - name: teamspeak
-          image: 'teamspeak:latest'
-          env:
-            - name: TS3SERVER_LICENSE
-              value: "accept"
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "1000m"
-          ports:
-            - name: voice
-              containerPort: 9987
-              protocol: UDP
-            - name: filetransfer
-              containerPort: 30033
-              protocol: TCP
-            - name: serverquery
-              containerPort: 10011
-              protocol: TCP
-          volumeMounts:
-            - name: data
-              mountPath: /var/ts3server

k8s/apps/teamspeak/kustomization.yaml

@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - storage.yaml
-  - deployment.yaml
-  - service.yaml

k8s/apps/teamspeak/service.yaml

@@ -1,22 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: teamspeak
-spec:
-  type: LoadBalancer
-  selector:
-    app: teamspeak
-  ports:
-    - name: voice
-      protocol: UDP
-      port: 9987
-      targetPort: 9987
-    - name: filetransfer
-      protocol: TCP
-      port: 30033
-      targetPort: 30033
-    - name: serverquery
-      protocol: TCP
-      port: 10011
-      targetPort: 10011

k8s/apps/teamspeak/storage.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: teamspeak-data
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 5Gi

k8s/apps/web-petting/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: web-petting
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: web-petting
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/web-petting
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-

k8s/apps/web-petting/deployment.yaml

@@ -1,49 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: web-petting
-  labels:
-    app: web-petting
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: web-petting
-  template:
-    metadata:
-      labels:
-        app: web-petting
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: web-petting-data
-      containers:
-      - name: web-petting
-        image: ultradesu/web-petting:0.1.0
-        imagePullPolicy: Always
-        args:
-#         - "tail"
-#         - "-F"
-#         - "/1"
-          - "web-petting"
-          - "-l"
-          - "0.0.0.0:3000"
-        ports:
-        - containerPort: 3000
-          name: http
-        volumeMounts:
-          - name: data
-            mountPath: /data
-        env:
-        - name: RUST_LOG
-          value: "info"
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "50m"
-          limits:
-            memory: "128Mi"
-            cpu: "150m"

k8s/apps/web-petting/ingress.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: web-petting-tls-ingress
-  annotations:
-    ingressClassName: traefik
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  rules:
-    - host: pet.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: web-petting
-                port:
-                  number: 80
-  tls:
-    - secretName: web-petting-tls
-      hosts:
-        - pet.hexor.cy
-

k8s/apps/web-petting/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - storage.yaml
-

k8s/apps/web-petting/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: web-petting
-  labels:
-    app: web-petting
-spec:
-  type: ClusterIP
-  selector:
-    app: web-petting
-  ports:
-  - port: 80
-    targetPort: 3000
-    protocol: TCP
-    name: http

k8s/apps/web-petting/storage.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: web-petting-data
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 10Gi

k8s/apps/wedding/app.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: wedding
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: wedding
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/wedding
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true

k8s/apps/wedding/deployment.yaml

@@ -1,69 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wedding
-  labels:
-    app: wedding
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: wedding
-  template:
-    metadata:
-      labels:
-        app: wedding
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: spb.tail2fe2d.ts.net
-      initContainers:
-        - name: git-clone
-          image: alpine/git:latest
-          command:
-            - sh
-            - -c
-            - git clone --depth 1 https://gt.hexor.cy/ab/wedding.git /src
-          volumeMounts:
-            - name: source
-              mountPath: /src
-        - name: zola-build
-          image: ghcr.io/getzola/zola:v0.22.1
-          command:
-            - /bin/zola
-          args:
-            - --root
-            - /src
-            - build
-            - --base-url
-            - https://wedding.hexor.cy/
-            - --output-dir
-            - /public/html
-          volumeMounts:
-            - name: source
-              mountPath: /src
-            - name: public
-              mountPath: /public
-      containers:
-        - name: nginx
-          image: nginx:alpine
-          ports:
-            - containerPort: 80
-              protocol: TCP
-          volumeMounts:
-            - name: public
-              mountPath: /usr/share/nginx/html
-              subPath: html
-              readOnly: true
-          resources:
-            requests:
-              memory: 32Mi
-              cpu: 10m
-            limits:
-              memory: 64Mi
-              cpu: 100m
-      volumes:
-        - name: source
-          emptyDir: {}
-        - name: public
-          emptyDir: {}

k8s/apps/wedding/ingress.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: wedding-tls-ingress
-  annotations:
-    ingressClassName: traefik
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  rules:
-    - host: wedding.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: wedding
-                port:
-                  number: 80
-  tls:
-    - secretName: wedding-tls
-      hosts:
-        - wedding.hexor.cy

k8s/apps/wedding/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - rbac.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - webhook.yaml

k8s/apps/wedding/rbac.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: wedding-deployer
-  namespace: wedding
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: wedding-deployer-token
-  namespace: wedding
-  annotations:
-    kubernetes.io/service-account.name: wedding-deployer
-type: kubernetes.io/service-account-token
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: wedding-restart
-  namespace: wedding
-rules:
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    verbs: ["get", "patch"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: wedding-deployer-restart
-  namespace: wedding
-subjects:
-  - kind: ServiceAccount
-    name: wedding-deployer
-    namespace: wedding
-roleRef:
-  kind: Role
-  name: wedding-restart
-  apiGroup: rbac.authorization.k8s.io

k8s/apps/wedding/service.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wedding
-spec:
-  selector:
-    app: wedding
-  ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP

k8s/apps/wedding/webhook.yaml

@@ -1,71 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: webhook-script
-data:
-  serve.sh: |
-    #!/bin/sh
-    echo "Webhook server listening on :8080"
-    while true; do
-      echo -e "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok" \
-        | nc -l -p 8080 > /dev/null
-      echo "Received webhook, restarting deployment..."
-      kubectl rollout restart deployment/wedding
-    done
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wedding-webhook
-  labels:
-    app: wedding-webhook
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: wedding-webhook
-  template:
-    metadata:
-      labels:
-        app: wedding-webhook
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: spb.tail2fe2d.ts.net
-      serviceAccountName: wedding-deployer
-      containers:
-        - name: webhook
-          image: alpine/k8s:1.32.3
-          command: ["sh", "/scripts/serve.sh"]
-          ports:
-            - containerPort: 8080
-              protocol: TCP
-          volumeMounts:
-            - name: script
-              mountPath: /scripts
-              readOnly: true
-          resources:
-            requests:
-              memory: 16Mi
-              cpu: 5m
-            limits:
-              memory: 32Mi
-              cpu: 50m
-      volumes:
-        - name: script
-          configMap:
-            name: webhook-script
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wedding-webhook
-spec:
-  selector:
-    app: wedding-webhook
-  ports:
-    - port: 8080
-      targetPort: 8080
-      protocol: TCP

k8s/core/auth-proxy/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: auth-proxy
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: auth-proxy
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/core/auth-proxy
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

k8s/core/auth-proxy/deployment.yaml

@@ -1,79 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: auth-proxy
-  labels:
-    app: auth-proxy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: auth-proxy
-  template:
-    metadata:
-      labels:
-        app: auth-proxy
-    spec:
-      containers:
-        - name: auth-proxy
-          image: ultradesu/rsauth2-proxy:0.1.0
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          envFrom:
-            - secretRef:
-                name: auth-proxy-creds
-          env:
-            - name: AUTH_PROXY_OIDC_ISSUER
-              value: "https://auth.hexor.cy/auth/realms/hexor"
-            - name: AUTH_PROXY_COOKIE_DOMAIN
-              value: ".hexor.cy"
-            - name: AUTH_PROXY_CALLBACK_URL
-              value: "https://oauth.hexor.cy/callback"
-            - name: AUTH_PROXY_ROUTES_FILE
-              value: "/config/routes.yaml"
-            - name: AUTH_PROXY_LOG_LEVEL
-              value: "info"
-          volumeMounts:
-            - name: routes
-              mountPath: /config
-              readOnly: true
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: 8080
-            initialDelaySeconds: 3
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 8080
-            initialDelaySeconds: 5
-            periodSeconds: 30
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            runAsUser: 1000
-            runAsGroup: 1000
-            capabilities:
-              drop:
-                - ALL
-      volumes:
-        - name: routes
-          configMap:
-            name: auth-proxy-routes
-      nodeSelector:
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule

k8s/core/auth-proxy/external-secrets.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: auth-proxy-creds
-spec:
-  target:
-    name: auth-proxy-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        AUTH_PROXY_CLIENT_ID: rsauth2-proxy
-        AUTH_PROXY_CLIENT_SECRET: |-
-          {{ .client_secret }}
-        AUTH_PROXY_COOKIE_SECRET: |-
-          {{ .cookie_secret }}
-  data:
-    - secretKey: client_secret
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
-        property: login.password
-    - secretKey: cookie_secret
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
-        property: fields[0].value

k8s/core/auth-proxy/ingress.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: auth-proxy
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`oauth.hexor.cy`)
-      kind: Rule
-      services:
-        - name: auth-proxy
-          port: 80
-  tls:
-    secretName: auth-proxy-tls
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: auth-proxy-tls
-spec:
-  secretName: auth-proxy-tls
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-  dnsNames:
-    - oauth.hexor.cy

k8s/core/auth-proxy/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - external-secrets.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-# routes.yaml ConfigMap is managed by Terraform (kubernetes_config_map)

k8s/core/auth-proxy/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: auth-proxy
-  labels:
-    app: auth-proxy
-spec:
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: auth-proxy

k8s/core/kanidm/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: kanidm
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: kanidm
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/core/kanidm
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

k8s/core/kanidm/certificate.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: kanidm-tls
-spec:
-  secretName: kanidm-tls
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-  dnsNames:
-    - auth.hexor.cy

k8s/core/kanidm/configmap.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kanidm-config
-data:
-  server.toml: |
-    bindaddress = "[::]:443"
-    db_path = "/data/kanidm.db"
-    tls_chain = "/certs/tls.crt"
-    tls_key = "/certs/tls.key"
-    domain = "auth.hexor.cy"
-    origin = "https://auth.hexor.cy"
-    log_level = "info"
-
-    [online_backup]
-    path = "/data/backups/"
-    schedule = "00 22 * * *"
-    versions = 7

k8s/core/kanidm/ingress.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: kanidm
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`auth.hexor.cy`)
-      kind: Rule
-      services:
-        - name: kanidm
-          port: 443
-          scheme: https
-          serversTransport: kanidm-transport
-  tls:
-    secretName: kanidm-ingress-tls

k8s/core/kanidm/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - configmap.yaml
-  - certificate.yaml
-  - statefulset.yaml
-  - service.yaml
-  - ingress.yaml
-  - servers-transport.yaml

k8s/core/kanidm/servers-transport.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: kanidm-transport
-spec:
-  insecureSkipVerify: true

k8s/core/kanidm/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kanidm
-  labels:
-    app: kanidm
-spec:
-  ports:
-    - name: https
-      port: 443
-      targetPort: 443
-      protocol: TCP
-  selector:
-    app: kanidm

k8s/core/kanidm/statefulset.yaml

@@ -1,86 +0,0 @@
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: kanidm
-  labels:
-    app: kanidm
-spec:
-  serviceName: kanidm
-  replicas: 1
-  selector:
-    matchLabels:
-      app: kanidm
-  template:
-    metadata:
-      labels:
-        app: kanidm
-    spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-      containers:
-        - name: kanidm
-          image: kanidm/server:1.9.3
-          ports:
-            - containerPort: 443
-              name: https
-              protocol: TCP
-          volumeMounts:
-            - name: kanidm-data
-              mountPath: /data
-            - name: kanidm-config
-              mountPath: /data/server.toml
-              subPath: server.toml
-              readOnly: true
-            - name: kanidm-tls
-              mountPath: /certs
-              readOnly: true
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "500m"
-          readinessProbe:
-            httpGet:
-              path: /status
-              port: 443
-              scheme: HTTPS
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /status
-              port: 443
-              scheme: HTTPS
-            initialDelaySeconds: 15
-            periodSeconds: 30
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-            runAsUser: 1000
-            runAsGroup: 1000
-      volumes:
-        - name: kanidm-config
-          configMap:
-            name: kanidm-config
-        - name: kanidm-tls
-          secret:
-            secretName: kanidm-tls
-      nodeSelector:
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
-  volumeClaimTemplates:
-    - metadata:
-        name: kanidm-data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        storageClassName: longhorn
-        resources:
-          requests:
-            storage: 1Gi

k8s/core/keycloak/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: keycloak
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: keycloak
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/core/keycloak
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

k8s/core/keycloak/external-secrets.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: keycloak-creds
-spec:
-  target:
-    name: keycloak-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        KC_DB_USERNAME: keycloak
-        KC_DB_PASSWORD: |-
-          {{ .db_password }}
-        KC_BOOTSTRAP_ADMIN_USERNAME: admin
-        KC_BOOTSTRAP_ADMIN_PASSWORD: |-
-          {{ .admin_password }}
-  data:
-    - secretKey: db_password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[18].value
-    - secretKey: admin_password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 9422b636-a91d-40e4-bf98-925b2a3f831d
-        property: login.password

k8s/core/keycloak/kustomization.yaml

@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - external-secrets.yaml
-
-helmCharts:
-  - name: keycloakx
-    repo: https://codecentric.github.io/helm-charts
-    version: 7.1.11
-    releaseName: keycloak
-    namespace: keycloak
-    valuesFile: values.yaml

k8s/core/keycloak/values.yaml

@@ -1,67 +0,0 @@
-replicas: 1
-
-image:
-  repository: quay.io/keycloak/keycloak
-  tag: "26.5.6"
-
-command:
-  - "/opt/keycloak/bin/kc.sh"
-  - "start"
-  - "--http-port=8080"
-  - "--hostname-strict=false"
-  - "--proxy-headers=xforwarded"
-
-extraEnvFrom: |
-  - secretRef:
-      name: keycloak-creds
-
-extraEnv: |
-  - name: KC_HOSTNAME
-    value: auth.hexor.cy
-  - name: JAVA_OPTS_APPEND
-    value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc"
-
-dbchecker:
-  enabled: true
-
-database:
-  vendor: postgres
-  hostname: psql.psql.svc
-  port: 5432
-  database: keycloak
-  existingSecret: keycloak-creds
-  existingSecretKey: KC_DB_PASSWORD
-
-service:
-  type: ClusterIP
-
-ingress:
-  enabled: true
-  ingressClassName: traefik
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-  rules:
-    - host: auth.hexor.cy
-      paths:
-        - path: /
-          pathType: Prefix
-  tls:
-    - secretName: keycloak-tls
-      hosts:
-        - auth.hexor.cy
-
-resources:
-  requests:
-    cpu: 200m
-    memory: 512Mi
-  limits:
-    cpu: "1"
-    memory: 1Gi
-
-nodeSelector:
-  kubernetes.io/hostname: master.tail2fe2d.ts.net
-
-tolerations:
-  - key: node-role.kubernetes.io/master
-    effect: NoSchedule

k8s/core/postgresql/external-secrets.yaml

@@ -135,8 +135,6 @@ spec:
           {{ .furumi }}
         USER_furumi_dev: |-
           {{ .furumi_dev }}
-        USER_keycloak: |-
-          {{ .keycloak }}
   data:
     - secretKey: authentik
       sourceRef:
@@ -325,14 +323,4 @@ spec:
         metadataPolicy: None
         key: 2a9deb39-ef22-433e-a1be-df1555625e22
         property: fields[17].value
-    - secretKey: keycloak
+
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[18].value

k8s/core/prom-stack/loki-values.yaml

@@ -22,7 +22,6 @@ loki:
       rules_directory: /var/loki/rules
   compactor:
     retention_enabled: true
-    delete_request_store: filesystem
   limits_config:
     reject_old_samples: false
     retention_period: 1440h

k8s/core/system-upgrade/plan.yaml

@@ -7,8 +7,6 @@ metadata:
 spec:
   concurrency: 1
   cordon: true
-  tolerations:
-  - operator: Exists
   nodeSelector:
     matchExpressions:
     - key: node-role.kubernetes.io/control-plane
@@ -18,7 +16,7 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  version: v1.35.4+k3s1
+  version: v1.35.2+k3s1
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -29,8 +27,6 @@ metadata:
 spec:
   concurrency: 1
   cordon: true
-  tolerations:
-  - operator: Exists
   nodeSelector:
     matchExpressions:
     - key: node-role.kubernetes.io/control-plane
@@ -43,4 +39,4 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  version: v1.35.4+k3s1
+  version: v1.35.2+k3s1

k8s/games/minecraft/deployments.yaml

@@ -35,7 +35,7 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
         - name: minecraft
-          image: 'eclipse-temurin:8-jdk-ubi10-minimal'
+          image: 'openjdk:8-jdk-alpine'
           command: ["java"]
           args:
             - -Xms4G

terraform/keycloak/.terraform.lock.hcl

@@ -1,47 +0,0 @@
-# This file is maintained automatically by "terraform init".
-# Manual edits may be lost in future updates.
-
-provider "registry.terraform.io/hashicorp/kubernetes" {
-  version     = "3.1.0"
-  constraints = ">= 2.0.0"
-  hashes = [
-    "h1:G9QqKNpcztBRqrywtlNylFJSpGzDfRFtO8hcWLdkvRY=",
-    "zh:0215c5c60be62028c09a2f22458e89cda3ef5830a632299f1d401eb3538874b0",
-    "zh:09ebb9f442431e278a310a9423f32caf467cb4b3cad3fe59573ca71fa7b14e20",
-    "zh:0c4e5912f83bb35846ae0a9ae54fc320706ee61894cd21cc6b4181b1c5a2fa5c",
-    "zh:1678c982853ad461e65ccb5e79d585e13ed109dd47dab2a66d3a7a304faeef65",
-    "zh:1c050a5c15e330457a9c18caacf61a923c59d663e13f2962e4b32f04fef523a0",
-    "zh:2c55bcec83be58ec132c7cb0a1ac644758b800d794fdc636d53a0eada0358a3a",
-    "zh:a062bb0aa316c08d8460c66a5d68da71da40de5d3bc3b31abcf3a1a9a19650f1",
-    "zh:a26fdea0afaa9b247c73c0b42843ca51ba7db0ac2571f9d3d50dcabd20ca1b98",
-    "zh:c872c9385a78d502bf5823d61cd3bb0f9a0585030e025eb12585c83451beeaa1",
-    "zh:f180879af931182beee4c8c0d9dab62b81d86f17ddcbe3786ef4c7cec9163a4e",
-    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
-    "zh:f70f5789264069e0eef06f9b5d5fde955ef7206f7d446d1ce51a4c37a3f3e02f",
-  ]
-}
-
-provider "registry.terraform.io/keycloak/keycloak" {
-  version     = "5.7.0"
-  constraints = ">= 5.0.0"
-  hashes = [
-    "h1:3DuKdVeOxwULh7l6bvJKWZvsgSZo92rtnrdvyp+X2Lc=",
-    "zh:19be4505b17e4818db121a82917cb6723019cf379cfb82b720eaa2886f15bede",
-    "zh:2bd1565ed22db6a9fb50d60626e22c277f3b034a71f65e6c0011e42f56cad2bb",
-    "zh:34a9e2dfb06331dc6146491c4a0721001195c6a769cdc2d4546edb2acf2b39bd",
-    "zh:3f86bf9eac6d73eeaa926471826b6888da77950f68e6a3a95dc2d9201a4a88fa",
-    "zh:4b9053fde2c8dee6469c8b273bf5491a27228a1df28e30b86714118f0f876baf",
-    "zh:522aa6bcecc6b8d517415237f4ec079488ef7de0e980a634bf6a8b481c13effc",
-    "zh:52f85208815ca65b8d3cd5465b28005ba63f854122bc61fbf04925c986d48e78",
-    "zh:636555042a6051d2e1113e5f945edb9f432e2d09b81cf6e50a59a534819d98dd",
-    "zh:73a1fecfb3d9666bf87c2eb7d001281b8cfcd7132573b8c3d4febc2db55f0a2f",
-    "zh:76fa26d055ceeb0869a50e4b63871f4b07f55045af6b46b83686016531e9fb22",
-    "zh:8df147e619d7ac3d3f9840ba0d1895d34bde179e818863e2e7b52e2c05c12f58",
-    "zh:9c830253990e13ec284d0d312fea562938e4a8fc664dacb3af5f1eb16dcae1ae",
-    "zh:abd0bd630b362cd6f77fbb33625bc6f515782eb58cb096b4ce69dea252254aef",
-    "zh:d1474a67ffc3288b2d0c99f6e8edc937ac8ef54afed0306e3c6f033aa836a5f6",
-    "zh:ed19408f15667bfb572120858bdde929a20ce2d1f29468973905980c03299767",
-    "zh:ef8bc311f7d1ad821b65ba43af92e2ce835e739d391098b13e01a61747b5c648",
-    "zh:f57319d9a7ac387d5070c909fd0084ccfc296f1f3193efde995ae24aa1729a39",
-  ]
-}

terraform/keycloak/main.tf

@@ -1,172 +0,0 @@
-# =============================================================================
-# Realm
-# =============================================================================
-
-resource "keycloak_realm" "hexor" {
-  realm   = "hexor"
-  enabled = true
-
-  display_name = "Hexor"
-
-  login_theme   = "keycloak"
-  account_theme = "keycloak.v3"
-
-  registration_allowed     = false
-  reset_password_allowed   = true
-  remember_me              = true
-  verify_email             = false
-  login_with_email_allowed = true
-  duplicate_emails_allowed = false
-
-  ssl_required = "external"
-}
-
-# =============================================================================
-# Google Identity Provider
-# =============================================================================
-
-resource "keycloak_oidc_google_identity_provider" "google" {
-  realm         = keycloak_realm.hexor.id
-  client_id     = var.google_client_id
-  client_secret = var.google_client_secret
-
-  trust_email = true
-  sync_mode   = "IMPORT"
-}
-
-# =============================================================================
-# Standalone groups
-# =============================================================================
-
-resource "keycloak_group" "standalone" {
-  for_each = toset(var.groups)
-
-  realm_id = keycloak_realm.hexor.id
-  name     = each.value
-}
-
-resource "keycloak_default_groups" "default" {
-  realm_id  = keycloak_realm.hexor.id
-  group_ids = [for g in keycloak_group.standalone : g.id if g.name == "users"]
-}
-
-# =============================================================================
-# rsauth2-proxy client (production)
-# =============================================================================
-
-resource "keycloak_openid_client" "rsauth2_proxy" {
-  realm_id  = keycloak_realm.hexor.id
-  client_id = "rsauth2-proxy"
-
-  name                         = "rsauth2-proxy"
-  enabled                      = true
-  access_type                  = "CONFIDENTIAL"
-  standard_flow_enabled        = true
-  direct_access_grants_enabled = false
-
-  valid_redirect_uris = [
-    "https://oauth.hexor.cy/callback",
-  ]
-
-  web_origins = [
-    "https://oauth.hexor.cy",
-  ]
-}
-
-resource "keycloak_openid_group_membership_protocol_mapper" "rsauth2_proxy_groups" {
-  realm_id   = keycloak_realm.hexor.id
-  client_id  = keycloak_openid_client.rsauth2_proxy.id
-  name       = "groups"
-  claim_name = "groups"
-  full_path  = false
-}
-
-resource "keycloak_openid_client_default_scopes" "rsauth2_proxy" {
-  realm_id  = keycloak_realm.hexor.id
-  client_id = keycloak_openid_client.rsauth2_proxy.id
-
-  default_scopes = [
-    "openid",
-    "profile",
-    "email",
-  ]
-}
-
-# =============================================================================
-# rsauth2-proxy client (localhost testing)
-# =============================================================================
-
-resource "keycloak_openid_client" "rsauth2_proxy_dev" {
-  realm_id  = keycloak_realm.hexor.id
-  client_id = "rsauth2-proxy-dev"
-
-  name                         = "rsauth2-proxy (dev)"
-  enabled                      = true
-  access_type                  = "CONFIDENTIAL"
-  standard_flow_enabled        = true
-  direct_access_grants_enabled = false
-
-  valid_redirect_uris = [
-    "http://localhost:8080/callback",
-  ]
-
-  web_origins = [
-    "http://localhost:8080",
-  ]
-}
-
-resource "keycloak_openid_group_membership_protocol_mapper" "rsauth2_proxy_dev_groups" {
-  realm_id   = keycloak_realm.hexor.id
-  client_id  = keycloak_openid_client.rsauth2_proxy_dev.id
-  name       = "groups"
-  claim_name = "groups"
-  full_path  = false
-}
-
-resource "keycloak_openid_client_default_scopes" "rsauth2_proxy_dev" {
-  realm_id  = keycloak_realm.hexor.id
-  client_id = keycloak_openid_client.rsauth2_proxy_dev.id
-
-  default_scopes = [
-    "openid",
-    "profile",
-    "email",
-  ]
-}
-
-# =============================================================================
-# Proxy applications — auto-created groups + routes ConfigMap
-# =============================================================================
-
-resource "keycloak_group" "app" {
-  for_each = var.proxy_applications
-
-  realm_id = keycloak_realm.hexor.id
-  name     = "app-${each.key}"
-}
-
-locals {
-  app_allowed_groups = {
-    for k, v in var.proxy_applications : k => concat(
-      ["app-${k}"],
-      v.allowed_groups
-    )
-  }
-}
-
-resource "kubernetes_config_map" "auth_proxy_routes" {
-  metadata {
-    name      = "auth-proxy-routes"
-    namespace = "auth-proxy"
-  }
-
-  data = {
-    "routes.yaml" = yamlencode({
-      routes = {
-        for k, v in var.proxy_applications : v.domain => {
-          allowed_groups = local.app_allowed_groups[k]
-        }
-      }
-    })
-  }
-}

terraform/keycloak/outputs.tf

@@ -1,37 +0,0 @@
-output "realm_id" {
-  value = keycloak_realm.hexor.id
-}
-
-output "google_idp_alias" {
-  value = keycloak_oidc_google_identity_provider.google.alias
-}
-
-output "rsauth2_proxy_client_id" {
-  value = keycloak_openid_client.rsauth2_proxy.client_id
-}
-
-output "rsauth2_proxy_client_secret" {
-  value     = keycloak_openid_client.rsauth2_proxy.client_secret
-  sensitive = true
-}
-
-output "rsauth2_proxy_dev_client_id" {
-  value = keycloak_openid_client.rsauth2_proxy_dev.client_id
-}
-
-output "rsauth2_proxy_dev_client_secret" {
-  value     = keycloak_openid_client.rsauth2_proxy_dev.client_secret
-  sensitive = true
-}
-
-output "standalone_groups" {
-  value = [for g in keycloak_group.standalone : g.name]
-}
-
-output "app_groups" {
-  value = { for k, g in keycloak_group.app : k => g.name }
-}
-
-output "app_allowed_groups" {
-  value = local.app_allowed_groups
-}

terraform/keycloak/providers.tf

@@ -1,23 +0,0 @@
-terraform {
-  required_providers {
-    keycloak = {
-      source  = "keycloak/keycloak"
-      version = ">= 5.0.0"
-    }
-    kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = ">= 2.0.0"
-    }
-  }
-}
-
-provider "keycloak" {
-  url           = var.keycloak_url
-  base_path     = "/auth"
-  client_id     = var.keycloak_client_id
-  client_secret = var.keycloak_client_secret
-}
-
-provider "kubernetes" {
-  config_path = var.kubeconfig_path
-}

terraform/keycloak/state.tf

@@ -1,8 +0,0 @@
-terraform {
-  cloud {
-    organization = "ultradesu"
-    workspaces {
-      name = "Keycloak"
-    }
-  }
-}

terraform/keycloak/variables.tf

@@ -1,49 +0,0 @@
-variable "keycloak_url" {
-  description = "Keycloak URL (set via TF_VAR_keycloak_url)"
-  type        = string
-  default     = "https://auth.hexor.cy"
-}
-
-variable "keycloak_client_id" {
-  description = "Keycloak Terraform client ID (set via TF_VAR_keycloak_client_id)"
-  type        = string
-  default     = "terraform"
-}
-
-variable "keycloak_client_secret" {
-  description = "Keycloak Terraform client secret (set via TF_VAR_keycloak_client_secret)"
-  type        = string
-  sensitive   = true
-}
-
-variable "kubeconfig_path" {
-  description = "Path to kubeconfig (set via TF_VAR_kubeconfig_path or KUBE_CONFIG_PATH)"
-  type        = string
-  default     = "~/.kube/config"
-}
-
-variable "google_client_id" {
-  description = "Google OAuth client ID (set via TF_VAR_google_client_id)"
-  type        = string
-}
-
-variable "google_client_secret" {
-  description = "Google OAuth client secret (set via TF_VAR_google_client_secret)"
-  type        = string
-  sensitive   = true
-}
-
-variable "groups" {
-  description = "Standalone Keycloak groups"
-  type        = list(string)
-  default     = []
-}
-
-variable "proxy_applications" {
-  description = "Proxy applications protected by rsauth2-proxy"
-  type = map(object({
-    domain         = string
-    allowed_groups = optional(list(string), [])
-  }))
-  default = {}
-}