Compare commits
8 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
f7c279a67a | ||
 Ultradesu
|
09e43ded52 | ||
|
Ultradesu
|
7d766d1cf9 | ||
|
Ultradesu
|
2b17fe67e5 | ||
|
Ultradesu
|
2b26f21649 | ||
|
Ultradesu
|
0a3430ea97 | ||
|
Ultradesu
|
1212017945 | ||
 ab
|
d11e44ad1a |
@@ -25,6 +25,7 @@ ArgoCD homelab project
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
| **postgresql** | [](https://ag.hexor.cy/applications/argocd/postgresql) |
|
||||
| **prom-stack** | [](https://ag.hexor.cy/applications/argocd/prom-stack) |
|
||||
| **reloader** | [](https://ag.hexor.cy/applications/argocd/reloader) |
|
||||
| **system-upgrade** | [](https://ag.hexor.cy/applications/argocd/system-upgrade) |
|
||||
|
||||
### Games
|
||||
|
||||
@@ -22,7 +22,7 @@ spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`secret-reader.hexor.cy`)
|
||||
- match: Host(`proxy.hexor.cy`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: auth-proxy
|
||||
@@ -30,16 +30,16 @@ spec:
|
||||
- name: secret-reader
|
||||
port: 80
|
||||
tls:
|
||||
secretName: secret-reader-tls
|
||||
secretName: proxy-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: secret-reader-tls
|
||||
name: proxy-tls
|
||||
spec:
|
||||
secretName: secret-reader-tls
|
||||
secretName: proxy-tls
|
||||
issuerRef:
|
||||
name: letsencrypt
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- secret-reader.hexor.cy
|
||||
- proxy.hexor.cy
|
||||
|
||||
@@ -9,18 +9,18 @@ resources:
|
||||
helmCharts:
|
||||
- name: ollama
|
||||
repo: https://otwld.github.io/ollama-helm/
|
||||
version: 1.49.0
|
||||
version: 1.58.0
|
||||
releaseName: ollama
|
||||
namespace: ollama
|
||||
valuesFile: ollama-values.yaml
|
||||
includeCRDs: true
|
||||
- name: open-webui
|
||||
repo: https://helm.openwebui.com/
|
||||
version: 12.10.0
|
||||
version: 14.8.0
|
||||
releaseName: openweb-ui
|
||||
namespace: ollama
|
||||
valuesFile: openweb-ui-values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
patches:
|
||||
- path: patch-runtimeclass.yaml
|
||||
- path: patch-runtimeclass.yaml
|
||||
|
||||
@@ -2,8 +2,8 @@ clusterDomain: cluster.local
|
||||
|
||||
extraEnvVars:
|
||||
GLOBAL_LOG_LEVEL: debug
|
||||
OAUTH_PROVIDER_NAME: authentik
|
||||
OPENID_PROVIDER_URL: https://idm.hexor.cy/application/o/openwebui/.well-known/openid-configuration
|
||||
OAUTH_PROVIDER_NAME: keycloak
|
||||
OPENID_PROVIDER_URL: https://auth.hexor.cy/auth/realms/hexor/.well-known/openid-configuration
|
||||
OPENID_REDIRECT_URI: https://ai.hexor.cy/oauth/oidc/callback
|
||||
WEBUI_URL: https://ai.hexor.cy
|
||||
# Allows auto-creation of new users using OAuth. Must be paired with ENABLE_LOGIN_FORM=false.
|
||||
@@ -31,7 +31,7 @@ ollama:
|
||||
- qwen3-vl:8b
|
||||
|
||||
pipelines:
|
||||
enabled: true
|
||||
enabled: false
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
@@ -57,4 +57,4 @@ ingress:
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
host: "ai.hexor.cy"
|
||||
tls: true
|
||||
existingSecret: ollama-tls
|
||||
existingSecret: ollama-tls
|
||||
|
||||
@@ -236,29 +236,52 @@ data:
|
||||
|
||||
cd /app
|
||||
|
||||
# Start main process in background
|
||||
./main &
|
||||
MAIN_PID=$!
|
||||
|
||||
# Start continuous port monitoring in background
|
||||
write_xray_api_port() {
|
||||
API_PORT="$1"
|
||||
case "$API_PORT" in
|
||||
""|*[!0-9]*)
|
||||
return
|
||||
;;
|
||||
esac
|
||||
|
||||
CURRENT_PORT=""
|
||||
if [ -f /shared/xray-api-port ]; then
|
||||
CURRENT_PORT=$(cat /shared/xray-api-port)
|
||||
fi
|
||||
|
||||
if [ "$API_PORT" != "$CURRENT_PORT" ]; then
|
||||
echo "Found xray API port: $API_PORT"
|
||||
echo -n "$API_PORT" > /shared/xray-api-port
|
||||
fi
|
||||
}
|
||||
|
||||
LOG_PIPE="/tmp/pasarguard-main.log"
|
||||
rm -f "$LOG_PIPE"
|
||||
mkfifo "$LOG_PIPE"
|
||||
|
||||
# Capture main logs so the Xray API listener is not confused with Xray's metrics listener.
|
||||
{
|
||||
sleep 10 # Wait for xray to start initially
|
||||
LAST_PORT=""
|
||||
|
||||
while true; do
|
||||
API_PORT=$(netstat -tlpn | grep xray | grep 127.0.0.1 | awk '{print $4}' | cut -d: -f2 | head -1)
|
||||
if [ -n "$API_PORT" ] && [ "$API_PORT" != "$LAST_PORT" ]; then
|
||||
echo "Found xray API port: $API_PORT"
|
||||
echo -n "$API_PORT" > /shared/xray-api-port
|
||||
LAST_PORT="$API_PORT"
|
||||
fi
|
||||
sleep 5 # Check every 5 seconds
|
||||
while IFS= read -r line; do
|
||||
echo "$line"
|
||||
case "$line" in
|
||||
*"transport/internet/tcp: listening TCP on 127.0.0.1:"*)
|
||||
API_PORT=$(echo "$line" | sed -n 's/.*listening TCP on 127\.0\.0\.1:\([0-9][0-9]*\).*/\1/p')
|
||||
write_xray_api_port "$API_PORT"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
} &
|
||||
PORT_MONITOR_PID=$!
|
||||
|
||||
} < "$LOG_PIPE" &
|
||||
LOG_READER_PID=$!
|
||||
|
||||
# Start main process in background
|
||||
./main > "$LOG_PIPE" 2>&1 &
|
||||
MAIN_PID=$!
|
||||
|
||||
# Wait for main process to finish
|
||||
wait $MAIN_PID
|
||||
|
||||
# Clean up port monitor
|
||||
kill $PORT_MONITOR_PID 2>/dev/null
|
||||
MAIN_STATUS=$?
|
||||
|
||||
# Clean up log reader
|
||||
wait $LOG_READER_PID 2>/dev/null
|
||||
rm -f "$LOG_PIPE"
|
||||
exit $MAIN_STATUS
|
||||
|
||||
@@ -46,7 +46,7 @@ spec:
|
||||
mountPath: /scripts
|
||||
containers:
|
||||
- name: pasarguard-node
|
||||
image: pasarguard/node:v0.4.0
|
||||
image: pasarguard/node:v0.5.0
|
||||
imagePullPolicy: Always
|
||||
command:
|
||||
- /bin/sh
|
||||
@@ -116,14 +116,20 @@ spec:
|
||||
- name: metrics
|
||||
containerPort: 9550
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /scrape
|
||||
port: metrics
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 36
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: metrics
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 3
|
||||
failureThreshold: 6
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /scrape
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: reloader
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: core
|
||||
destination:
|
||||
namespace: reloader
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/core/reloader
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ServerSideApply=true
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: reloader
|
||||
repo: https://stakater.github.io/stakater-charts
|
||||
version: 2.2.12
|
||||
releaseName: reloader
|
||||
namespace: reloader
|
||||
valuesFile: values.yaml
|
||||
@@ -0,0 +1,24 @@
|
||||
reloader:
|
||||
watchGlobally: true
|
||||
autoReloadAll: true
|
||||
reloadOnCreate: true
|
||||
reloadOnDelete: false
|
||||
reloadStrategy: annotations
|
||||
ignoreConfigMaps: false
|
||||
ignoreSecrets: false
|
||||
ignoreJobs: false
|
||||
ignoreCronJobs: false
|
||||
enableHA: true
|
||||
syncAfterRestart: true
|
||||
logLevel: info
|
||||
rbac:
|
||||
enabled: true
|
||||
deployment:
|
||||
replicas: 2
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 150m
|
||||
memory: 512Mi
|
||||
@@ -9,12 +9,12 @@ groups = [
|
||||
|
||||
proxy_applications = {
|
||||
secret-reader = {
|
||||
domain = "secret-reader.hexor.cy"
|
||||
allowed_groups = ["hexor-guest", "hexor-admin"]
|
||||
domain = "proxy.hexor.cy"
|
||||
allowed_groups = ["hexor-admin", "app-pass"]
|
||||
}
|
||||
pass = {
|
||||
domain = "pass.hexor.cy"
|
||||
allowed_groups = ["hexor-guest", "hexor-admin"]
|
||||
allowed_groups = ["hexor-admin", "app-pass"]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -40,6 +40,11 @@ oauth2_applications = {
|
||||
web_origins = ["https://gf.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://gf.hexor.cy/*"]
|
||||
}
|
||||
openwebui = {
|
||||
redirect_uris = ["https://ai.hexor.cy/oauth/oidc/callback"]
|
||||
web_origins = ["https://ai.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://ai.hexor.cy/*"]
|
||||
}
|
||||
FuruMusic = {
|
||||
redirect_uris = ["https://music.hexor.cy/auth/oidc/callback"]
|
||||
web_origins = ["https://music.hexor.cy"]
|
||||
@@ -56,4 +61,3 @@ oauth2_applications = {
|
||||
post_logout_redirect_uris = ["https://pet.hexor.cy/*", "https://xn--l1acako8eb.xn--p1ai/*", "https://мурняня.рф/*"]
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user