Compare commits
32 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
1a40cb14cf | ||
 Ultradesu
|
4d000080d8 | ||
|
Ultradesu
|
3881b5b3ba | ||
|
Ultradesu
|
c850ad291a | ||
 ab
|
4228217497 | ||
|
ab
|
df2e2ec68d | ||
|
ab
|
180fd33ffc | ||
|
ab
|
bbb8ca0323 | ||
|
ab
|
ec91419b36 | ||
|
ab
|
1384b96742 | ||
|
ab
|
ab138b033a | ||
|
ab
|
968e633bf8 | ||
|
ab
|
aa6c02f60b | ||
|
ab
|
60423333fe | ||
|
ab
|
4026adc04a | ||
|
ab
|
94669590b1 | ||
|
ab
|
cf6223f0b5 | ||
|
ab
|
89ade00efb | ||
|
ab
|
4f67181637 | ||
|
Ultradesu
|
2bd3d91595 | ||
|
Ultradesu
|
6f1f6c349d | ||
|
Ultradesu
|
a8ee4bd2b2 | ||
|
Ultradesu
|
0018d2b418 | ||
|
Ultradesu
|
82dbe84075 | ||
|
Ultradesu
|
6b717f5219 | ||
|
ab
|
0c1aa7d633 | ||
|
Gitea Actions Bot
|
f7c279a67a | ||
|
Ultradesu
|
09e43ded52 | ||
|
Ultradesu
|
7d766d1cf9 | ||
|
Ultradesu
|
2b17fe67e5 | ||
|
Ultradesu
|
2b26f21649 | ||
|
Ultradesu
|
0a3430ea97 |
@@ -42,6 +42,7 @@ ArgoCD homelab project
|
||||
|
||||
| Application | Status |
|
||||
| :--- | :---: |
|
||||
| **amnezia** | [](https://ag.hexor.cy/applications/argocd/amnezia) |
|
||||
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||
| **furumi** | [](https://ag.hexor.cy/applications/argocd/furumi) |
|
||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||
@@ -53,6 +54,7 @@ ArgoCD homelab project
|
||||
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
||||
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
||||
| **lidarr** | [](https://ag.hexor.cy/applications/argocd/lidarr) |
|
||||
| **llamacpp** | [](https://ag.hexor.cy/applications/argocd/llamacpp) |
|
||||
| **matrix** | [](https://ag.hexor.cy/applications/argocd/matrix) |
|
||||
| **mtproxy** | [](https://ag.hexor.cy/applications/argocd/mtproxy) |
|
||||
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: amnezia
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: amnezia
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/amnezia
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
@@ -0,0 +1,151 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: amneziawg-scripts
|
||||
data:
|
||||
firewall-up.sh: |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.1.0/24}"
|
||||
|
||||
external_interface() {
|
||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
||||
}
|
||||
|
||||
ensure_insert_rule() {
|
||||
local table_args=()
|
||||
if [ "${1:-}" = "-t" ]; then
|
||||
table_args=("$1" "$2")
|
||||
shift 2
|
||||
fi
|
||||
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
||||
iptables "${table_args[@]}" -I "${chain}" 1 "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
ensure_append_rule() {
|
||||
local table_args=()
|
||||
if [ "${1:-}" = "-t" ]; then
|
||||
table_args=("$1" "$2")
|
||||
shift 2
|
||||
fi
|
||||
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
||||
iptables "${table_args[@]}" -A "${chain}" "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
EXT_IF="$(external_interface || true)"
|
||||
if [ -z "${EXT_IF}" ]; then
|
||||
EXT_IF="$(ip route show default | awk '{print $5; exit}')"
|
||||
fi
|
||||
if [ -z "${EXT_IF}" ]; then
|
||||
echo "Unable to detect external interface"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
sysctl -w net.ipv4.ip_forward=1
|
||||
|
||||
ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
|
||||
firewall-down.sh: |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.1.0/24}"
|
||||
|
||||
external_interface() {
|
||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
||||
}
|
||||
|
||||
delete_rule() {
|
||||
local table_args=()
|
||||
if [ "${1:-}" = "-t" ]; then
|
||||
table_args=("$1" "$2")
|
||||
shift 2
|
||||
fi
|
||||
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
||||
true
|
||||
done
|
||||
}
|
||||
|
||||
EXT_IF="$(external_interface || true)"
|
||||
if [ -z "${EXT_IF}" ]; then
|
||||
EXT_IF="$(ip route show default | awk '{print $5; exit}')"
|
||||
fi
|
||||
|
||||
if [ -n "${EXT_IF}" ]; then
|
||||
delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
fi
|
||||
|
||||
delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
|
||||
run.sh: |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
SERVER_CONFIG="/etc/amnezia/server/awg0.conf"
|
||||
CLIENTS_DIR="/etc/amnezia/clients"
|
||||
RUNTIME_CONFIG="/run/amnezia/awg0.conf"
|
||||
|
||||
cleanup() {
|
||||
if awg show awg0 >/dev/null 2>&1; then
|
||||
awg-quick down "${RUNTIME_CONFIG}" || ip link delete awg0 || true
|
||||
fi
|
||||
}
|
||||
|
||||
render_config() {
|
||||
mkdir -p "$(dirname "${RUNTIME_CONFIG}")"
|
||||
cp "${SERVER_CONFIG}" "${RUNTIME_CONFIG}"
|
||||
chmod 0600 "${RUNTIME_CONFIG}"
|
||||
|
||||
local clients_found=0
|
||||
for client_config in "${CLIENTS_DIR}"/*; do
|
||||
[ -f "${client_config}" ] || continue
|
||||
[ -s "${client_config}" ] || continue
|
||||
printf '\n' >> "${RUNTIME_CONFIG}"
|
||||
cat "${client_config}" >> "${RUNTIME_CONFIG}"
|
||||
clients_found=1
|
||||
done
|
||||
|
||||
if [ "${clients_found}" = "0" ]; then
|
||||
echo "No client peer configs found in ${CLIENTS_DIR}; starting without peers"
|
||||
fi
|
||||
}
|
||||
|
||||
trap cleanup EXIT
|
||||
trap 'exit 0' TERM INT
|
||||
|
||||
render_config
|
||||
cleanup
|
||||
awg-quick up "${RUNTIME_CONFIG}"
|
||||
awg show awg0 || true
|
||||
|
||||
while true; do
|
||||
sleep 3600 &
|
||||
wait "$!"
|
||||
done
|
||||
@@ -0,0 +1,148 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: amneziawg
|
||||
labels:
|
||||
app: amneziawg
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
secret.reloader.stakater.com/reload: "amneziawg-server,amneziawg-clients"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: amneziawg
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: amneziawg
|
||||
spec:
|
||||
serviceAccountName: amneziawg
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
nodeSelector:
|
||||
amnezia-vpn: "true"
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
initContainers:
|
||||
- name: register-endpoint
|
||||
image: bitnami/kubectl:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: PORT
|
||||
value: "5847"
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- |
|
||||
set -euo pipefail
|
||||
|
||||
NAMESPACE="$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)"
|
||||
ENDPOINT="$(kubectl get node "${NODE_NAME}" -o jsonpath="{.metadata.labels['external-ipv4']}")"
|
||||
|
||||
if [ -z "${ENDPOINT}" ]; then
|
||||
ENDPOINT="$(kubectl get node "${NODE_NAME}" -o jsonpath='{range .status.addresses[?(@.type=="ExternalIP")]}{.address}{end}')"
|
||||
fi
|
||||
|
||||
if [ -z "${ENDPOINT}" ]; then
|
||||
echo "ERROR: node ${NODE_NAME} has no external-ipv4 label and no ExternalIP"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
VALUE="${ENDPOINT}:${PORT}"
|
||||
echo "Registering AmneziaWG endpoint: ${NODE_NAME} -> ${VALUE}"
|
||||
|
||||
if kubectl get secret amneziawg-endpoints -n "${NAMESPACE}" >/dev/null 2>&1; then
|
||||
kubectl patch secret amneziawg-endpoints -n "${NAMESPACE}" \
|
||||
--type merge -p "{\"stringData\":{\"${NODE_NAME}\":\"${VALUE}\"}}"
|
||||
else
|
||||
kubectl create secret generic amneziawg-endpoints -n "${NAMESPACE}" \
|
||||
--from-literal="${NODE_NAME}=${VALUE}"
|
||||
fi
|
||||
containers:
|
||||
- name: amneziawg
|
||||
image: amneziavpn/amneziawg-go:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
privileged: true
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- SYS_MODULE
|
||||
command:
|
||||
- /bin/bash
|
||||
- /scripts/run.sh
|
||||
ports:
|
||||
- name: awg
|
||||
containerPort: 5847
|
||||
protocol: UDP
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- awg show awg0 >/dev/null 2>&1
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- awg show awg0 >/dev/null 2>&1
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
memory: "64Mi"
|
||||
cpu: "50m"
|
||||
limits:
|
||||
memory: "256Mi"
|
||||
cpu: "500m"
|
||||
volumeMounts:
|
||||
- name: server-config
|
||||
mountPath: /etc/amnezia/server
|
||||
readOnly: true
|
||||
- name: client-config
|
||||
mountPath: /etc/amnezia/clients
|
||||
readOnly: true
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
readOnly: true
|
||||
- name: runtime-config
|
||||
mountPath: /run/amnezia
|
||||
- name: dev-net-tun
|
||||
mountPath: /dev/net/tun
|
||||
volumes:
|
||||
- name: server-config
|
||||
secret:
|
||||
secretName: amneziawg-server
|
||||
defaultMode: 0600
|
||||
items:
|
||||
- key: awg0.conf
|
||||
path: awg0.conf
|
||||
- name: client-config
|
||||
secret:
|
||||
secretName: amneziawg-clients
|
||||
optional: true
|
||||
defaultMode: 0600
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: amneziawg-scripts
|
||||
defaultMode: 0755
|
||||
- name: runtime-config
|
||||
emptyDir: {}
|
||||
- name: dev-net-tun
|
||||
hostPath:
|
||||
path: /dev/net/tun
|
||||
type: CharDevice
|
||||
@@ -0,0 +1,50 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: amneziawg-server
|
||||
spec:
|
||||
target:
|
||||
name: amneziawg-server
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
server-public-key: |-
|
||||
{{ .server_public_key }}
|
||||
awg0.conf: |-
|
||||
[Interface]
|
||||
PrivateKey = {{ .server_private_key }}
|
||||
Address = 10.8.1.1/24
|
||||
ListenPort = 5847
|
||||
MTU = 1376
|
||||
Jc = 4
|
||||
Jmin = 64
|
||||
Jmax = 128
|
||||
S1 = 15
|
||||
S2 = 18
|
||||
S3 = 20
|
||||
S4 = 23
|
||||
H1 = 1020325451
|
||||
H2 = 3288052141
|
||||
H3 = 1766607858
|
||||
H4 = 2528465083
|
||||
PostUp = /scripts/firewall-up.sh 5847 10.8.1.0/24
|
||||
PostDown = /scripts/firewall-down.sh 5847 10.8.1.0/24
|
||||
data:
|
||||
- secretKey: server_private_key
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 3092dc7c-41dd-461a-9f7a-377727f47e93
|
||||
property: fields[0].value
|
||||
- secretKey: server_public_key
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 3092dc7c-41dd-461a-9f7a-377727f47e93
|
||||
property: fields[1].value
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- namespace.yaml
|
||||
- external-secrets.yaml
|
||||
- configmap-scripts.yaml
|
||||
- rbac.yaml
|
||||
- daemonset.yaml
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: amnezia
|
||||
labels:
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
pod-security.kubernetes.io/audit: privileged
|
||||
pod-security.kubernetes.io/warn: privileged
|
||||
@@ -0,0 +1,58 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: amneziawg
|
||||
labels:
|
||||
app: amneziawg
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: amneziawg-node-reader
|
||||
labels:
|
||||
app: amneziawg
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: amneziawg-node-reader
|
||||
labels:
|
||||
app: amneziawg
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: amneziawg-node-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: amneziawg
|
||||
namespace: amnezia
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: amneziawg-endpoint-manager
|
||||
labels:
|
||||
app: amneziawg
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "create", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: amneziawg-endpoint-manager
|
||||
labels:
|
||||
app: amneziawg
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: amneziawg-endpoint-manager
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: amneziawg
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: llamacpp
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: llamacpp
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/llamacpp
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: llamacpp-config
|
||||
data:
|
||||
LLAMA_CACHE: /models
|
||||
LLAMA_ARG_HOST: 0.0.0.0
|
||||
LLAMA_ARG_PORT: "8080"
|
||||
LLAMA_ARG_HF_REPO: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF:UD-Q6_K"
|
||||
LLAMA_ARG_CTX_SIZE: "32768"
|
||||
LLAMA_ARG_FLASH_ATTN: auto
|
||||
LLAMA_ARG_FIT: "on"
|
||||
@@ -0,0 +1,71 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: llamacpp
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
labels:
|
||||
app: llamacpp
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: llamacpp
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: llamacpp
|
||||
spec:
|
||||
dnsPolicy: Default
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: llamacpp
|
||||
image: ghcr.io/ggml-org/llama.cpp:server-rocm-b9501
|
||||
imagePullPolicy: IfNotPresent
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: llamacpp-config
|
||||
env:
|
||||
- name: HF_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: llamacpp-hf-token
|
||||
key: token
|
||||
optional: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
resources:
|
||||
limits:
|
||||
amd.com/gpu: 1
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
failureThreshold: 180
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
failureThreshold: 3
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
volumeMounts:
|
||||
- name: models
|
||||
mountPath: /models
|
||||
volumes:
|
||||
- name: models
|
||||
hostPath:
|
||||
path: /k8s/llamacpp/models
|
||||
type: DirectoryOrCreate
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- configmap.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: llamacpp
|
||||
labels:
|
||||
app: llamacpp
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: llamacpp
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
@@ -53,8 +53,8 @@ spec:
|
||||
upstream_oauth2:
|
||||
providers:
|
||||
- id: 001KKV4EKY7KG98W2M9T806K6A
|
||||
human_name: Authentik
|
||||
issuer: https://idm.hexor.cy/application/o/matrix/
|
||||
human_name: SSO Login
|
||||
issuer: https://auth.hexor.cy/auth/realms/hexor
|
||||
client_id: "{{ .oauth_client_id }}"
|
||||
client_secret: "{{ .oauth_client_secret }}"
|
||||
token_endpoint_auth_method: client_secret_post
|
||||
@@ -93,3 +93,4 @@ spec:
|
||||
metadataPolicy: None
|
||||
key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
|
||||
property: fields[1].value
|
||||
on_conflict: replace
|
||||
|
||||
@@ -22,7 +22,7 @@ spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`secret-reader.hexor.cy`)
|
||||
- match: Host(`proxy.hexor.cy`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: auth-proxy
|
||||
@@ -30,16 +30,16 @@ spec:
|
||||
- name: secret-reader
|
||||
port: 80
|
||||
tls:
|
||||
secretName: secret-reader-tls
|
||||
secretName: proxy-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: secret-reader-tls
|
||||
name: proxy-tls
|
||||
spec:
|
||||
secretName: secret-reader-tls
|
||||
secretName: proxy-tls
|
||||
issuerRef:
|
||||
name: letsencrypt
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- secret-reader.hexor.cy
|
||||
- proxy.hexor.cy
|
||||
|
||||
@@ -9,18 +9,18 @@ resources:
|
||||
helmCharts:
|
||||
- name: ollama
|
||||
repo: https://otwld.github.io/ollama-helm/
|
||||
version: 1.49.0
|
||||
version: 1.58.0
|
||||
releaseName: ollama
|
||||
namespace: ollama
|
||||
valuesFile: ollama-values.yaml
|
||||
includeCRDs: true
|
||||
- name: open-webui
|
||||
repo: https://helm.openwebui.com/
|
||||
version: 12.10.0
|
||||
version: 14.8.0
|
||||
releaseName: openweb-ui
|
||||
namespace: ollama
|
||||
valuesFile: openweb-ui-values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
patches:
|
||||
- path: patch-runtimeclass.yaml
|
||||
- path: patch-runtimeclass.yaml
|
||||
|
||||
@@ -2,8 +2,8 @@ clusterDomain: cluster.local
|
||||
|
||||
extraEnvVars:
|
||||
GLOBAL_LOG_LEVEL: debug
|
||||
OAUTH_PROVIDER_NAME: authentik
|
||||
OPENID_PROVIDER_URL: https://idm.hexor.cy/application/o/openwebui/.well-known/openid-configuration
|
||||
OAUTH_PROVIDER_NAME: keycloak
|
||||
OPENID_PROVIDER_URL: https://auth.hexor.cy/auth/realms/hexor/.well-known/openid-configuration
|
||||
OPENID_REDIRECT_URI: https://ai.hexor.cy/oauth/oidc/callback
|
||||
WEBUI_URL: https://ai.hexor.cy
|
||||
# Allows auto-creation of new users using OAuth. Must be paired with ENABLE_LOGIN_FORM=false.
|
||||
@@ -31,7 +31,7 @@ ollama:
|
||||
- qwen3-vl:8b
|
||||
|
||||
pipelines:
|
||||
enabled: true
|
||||
enabled: false
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
@@ -57,4 +57,4 @@ ingress:
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
host: "ai.hexor.cy"
|
||||
tls: true
|
||||
existingSecret: ollama-tls
|
||||
existingSecret: ollama-tls
|
||||
|
||||
@@ -18,8 +18,8 @@ spec:
|
||||
"openid_connect": {
|
||||
"APPS": [
|
||||
{
|
||||
"provider_id": "authentik",
|
||||
"name": "Authentik",
|
||||
"provider_id": "keycloak",
|
||||
"name": "Keycloak",
|
||||
"client_id": "{{ .oauth_id }}",
|
||||
"secret": "{{ .oauth_secret }}",
|
||||
"settings": {
|
||||
|
||||
@@ -236,29 +236,52 @@ data:
|
||||
|
||||
cd /app
|
||||
|
||||
# Start main process in background
|
||||
./main &
|
||||
MAIN_PID=$!
|
||||
|
||||
# Start continuous port monitoring in background
|
||||
write_xray_api_port() {
|
||||
API_PORT="$1"
|
||||
case "$API_PORT" in
|
||||
""|*[!0-9]*)
|
||||
return
|
||||
;;
|
||||
esac
|
||||
|
||||
CURRENT_PORT=""
|
||||
if [ -f /shared/xray-api-port ]; then
|
||||
CURRENT_PORT=$(cat /shared/xray-api-port)
|
||||
fi
|
||||
|
||||
if [ "$API_PORT" != "$CURRENT_PORT" ]; then
|
||||
echo "Found xray API port: $API_PORT"
|
||||
echo -n "$API_PORT" > /shared/xray-api-port
|
||||
fi
|
||||
}
|
||||
|
||||
LOG_PIPE="/tmp/pasarguard-main.log"
|
||||
rm -f "$LOG_PIPE"
|
||||
mkfifo "$LOG_PIPE"
|
||||
|
||||
# Capture main logs so the Xray API listener is not confused with Xray's metrics listener.
|
||||
{
|
||||
sleep 10 # Wait for xray to start initially
|
||||
LAST_PORT=""
|
||||
|
||||
while true; do
|
||||
API_PORT=$(netstat -tlpn | grep xray | grep 127.0.0.1 | awk '{print $4}' | cut -d: -f2 | head -1)
|
||||
if [ -n "$API_PORT" ] && [ "$API_PORT" != "$LAST_PORT" ]; then
|
||||
echo "Found xray API port: $API_PORT"
|
||||
echo -n "$API_PORT" > /shared/xray-api-port
|
||||
LAST_PORT="$API_PORT"
|
||||
fi
|
||||
sleep 5 # Check every 5 seconds
|
||||
while IFS= read -r line; do
|
||||
echo "$line"
|
||||
case "$line" in
|
||||
*"transport/internet/tcp: listening TCP on 127.0.0.1:"*)
|
||||
API_PORT=$(echo "$line" | sed -n 's/.*listening TCP on 127\.0\.0\.1:\([0-9][0-9]*\).*/\1/p')
|
||||
write_xray_api_port "$API_PORT"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
} &
|
||||
PORT_MONITOR_PID=$!
|
||||
|
||||
} < "$LOG_PIPE" &
|
||||
LOG_READER_PID=$!
|
||||
|
||||
# Start main process in background
|
||||
./main > "$LOG_PIPE" 2>&1 &
|
||||
MAIN_PID=$!
|
||||
|
||||
# Wait for main process to finish
|
||||
wait $MAIN_PID
|
||||
|
||||
# Clean up port monitor
|
||||
kill $PORT_MONITOR_PID 2>/dev/null
|
||||
MAIN_STATUS=$?
|
||||
|
||||
# Clean up log reader
|
||||
wait $LOG_READER_PID 2>/dev/null
|
||||
rm -f "$LOG_PIPE"
|
||||
exit $MAIN_STATUS
|
||||
|
||||
@@ -46,7 +46,7 @@ spec:
|
||||
mountPath: /scripts
|
||||
containers:
|
||||
- name: pasarguard-node
|
||||
image: pasarguard/node:v0.5.0
|
||||
image: pasarguard/node:v0.5.2
|
||||
imagePullPolicy: Always
|
||||
command:
|
||||
- /bin/sh
|
||||
@@ -116,14 +116,20 @@ spec:
|
||||
- name: metrics
|
||||
containerPort: 9550
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /scrape
|
||||
port: metrics
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 36
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: metrics
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 3
|
||||
failureThreshold: 6
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /scrape
|
||||
|
||||
@@ -34,7 +34,7 @@ spec:
|
||||
mountPath: /templates/subscription
|
||||
containers:
|
||||
- name: pasarguard-web
|
||||
image: pasarguard/panel:v4.0.2
|
||||
image: pasarguard/panel:v5.0.1
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- secretRef:
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
nfd:
|
||||
enabled: false
|
||||
|
||||
labeller:
|
||||
enabled: false
|
||||
|
||||
dp:
|
||||
image:
|
||||
repository: docker.io/rocm/k8s-device-plugin
|
||||
tag: "1.31.0.9"
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
|
||||
node_selector_enabled: true
|
||||
node_selector:
|
||||
kubernetes.io/arch: amd64
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
@@ -13,3 +13,24 @@ helmCharts:
|
||||
namespace: gpu-system
|
||||
valuesFile: values.yaml
|
||||
includeCRDs: true
|
||||
- name: amd-gpu
|
||||
repo: https://rocm.github.io/k8s-device-plugin/
|
||||
version: 0.21.0
|
||||
releaseName: amd-gpu-device-plugin
|
||||
namespace: gpu-system
|
||||
valuesFile: amd-gpu-values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
patches:
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: DaemonSet
|
||||
name: amd-gpu-device-plugin-daemonset
|
||||
namespace: gpu-system
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
kubernetes.io/arch: amd64
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
|
||||
@@ -66,11 +66,11 @@ ingress:
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
limits:
|
||||
cpu: "3"
|
||||
memory: 2Gi
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
@@ -6,6 +6,7 @@ resources:
|
||||
- nfs-storage.yaml
|
||||
- coredns-internal-resolve.yaml
|
||||
- https-middleware.yaml
|
||||
- node-external-ip-labeler.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: csi-driver-nfs
|
||||
@@ -15,4 +16,3 @@ helmCharts:
|
||||
namespace: kube-system
|
||||
#valuesFile: values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
|
||||
@@ -0,0 +1,173 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "patch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-external-ip-labeler
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
rules:
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: node-external-ip-labeler
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
spec:
|
||||
schedule: "17 3 * * *"
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
spec:
|
||||
serviceAccountName: node-external-ip-labeler
|
||||
restartPolicy: Never
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
containers:
|
||||
- name: fanout
|
||||
image: bitnami/kubectl:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
args:
|
||||
- |
|
||||
set -euo pipefail
|
||||
|
||||
clean_name() {
|
||||
echo "$1" \
|
||||
| tr '[:upper:]' '[:lower:]' \
|
||||
| tr -c 'a-z0-9-' '-' \
|
||||
| sed 's/^-*//;s/-*$//' \
|
||||
| cut -c1-45
|
||||
}
|
||||
|
||||
for NODE_NAME in $(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'); do
|
||||
NODE_CLEAN="$(clean_name "${NODE_NAME}")"
|
||||
JOB_NAME="node-external-ip-${NODE_CLEAN}"
|
||||
|
||||
kubectl delete job "${JOB_NAME}" -n kube-system --ignore-not-found=true --wait=true --timeout=60s
|
||||
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: ${JOB_NAME}
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
target-node: "${NODE_CLEAN}"
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 86400
|
||||
backoffLimit: 2
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
target-node: "${NODE_CLEAN}"
|
||||
spec:
|
||||
serviceAccountName: node-external-ip-labeler
|
||||
nodeName: "${NODE_NAME}"
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
restartPolicy: Never
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
containers:
|
||||
- name: label-node
|
||||
image: bitnami/kubectl:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
value: "${NODE_NAME}"
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
args:
|
||||
- |
|
||||
set -euo pipefail
|
||||
|
||||
json_ip() {
|
||||
sed -n 's/.*"ip"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p'
|
||||
}
|
||||
|
||||
IPV4="\$(curl -fsS --connect-timeout 10 --max-time 30 'https://api.ipify.org?format=json' | json_ip)"
|
||||
IP64="\$(curl -fsS --connect-timeout 10 --max-time 30 'https://api64.ipify.org?format=json' | json_ip || true)"
|
||||
|
||||
if [ -z "\${IPV4}" ]; then
|
||||
echo "Unable to detect external IPv4 for node ${NODE_NAME}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
kubectl label node "${NODE_NAME}" external-ipv4="\${IPV4}" --overwrite
|
||||
kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv4="\${IPV4}" --overwrite
|
||||
|
||||
if echo "\${IP64}" | grep -q ':'; then
|
||||
kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv6="\${IP64}" --overwrite
|
||||
elif [ -n "\${IP64}" ]; then
|
||||
kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv4-api64="\${IP64}" --overwrite
|
||||
fi
|
||||
EOF
|
||||
done
|
||||
@@ -13,7 +13,7 @@ resources:
|
||||
helmCharts:
|
||||
- name: pgadmin4
|
||||
repo: https://helm.runix.net
|
||||
version: 1.50.0
|
||||
version: 1.64.0
|
||||
releaseName: pgmanager
|
||||
namespace: psql
|
||||
valuesFile: pgadmin4-values.yaml
|
||||
|
||||
@@ -36,7 +36,7 @@ spec:
|
||||
spec:
|
||||
nodeSelector:
|
||||
#kubernetes.io/hostname: home.homenet
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
kubernetes.io/hostname: music.tail2fe2d.ts.net
|
||||
terminationGracePeriodSeconds: 10
|
||||
containers:
|
||||
- name: prom-a2s-exporter
|
||||
|
||||
@@ -9,12 +9,12 @@ groups = [
|
||||
|
||||
proxy_applications = {
|
||||
secret-reader = {
|
||||
domain = "secret-reader.hexor.cy"
|
||||
allowed_groups = ["hexor-guest", "hexor-admin"]
|
||||
domain = "proxy.hexor.cy"
|
||||
allowed_groups = ["hexor-admin", "app-pass"]
|
||||
}
|
||||
pass = {
|
||||
domain = "pass.hexor.cy"
|
||||
allowed_groups = ["hexor-guest", "hexor-admin"]
|
||||
allowed_groups = ["hexor-admin", "app-pass"]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -40,20 +40,55 @@ oauth2_applications = {
|
||||
web_origins = ["https://gf.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://gf.hexor.cy/*"]
|
||||
}
|
||||
openwebui = {
|
||||
redirect_uris = ["https://ai.hexor.cy/oauth/oidc/callback"]
|
||||
web_origins = ["https://ai.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://ai.hexor.cy/*"]
|
||||
}
|
||||
FuruMusic = {
|
||||
redirect_uris = ["https://music.hexor.cy/auth/oidc/callback"]
|
||||
redirect_uris = ["https://music.hexor.cy/auth/oidc/callback", "https://music.hexor.cy/auth/mobile/oidc/callback"]
|
||||
web_origins = ["https://music.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://music.hexor.cy/*"]
|
||||
}
|
||||
FuruMusic-dev = {
|
||||
redirect_uris = ["https://music-dev.hexor.cy/auth/oidc/callback", "http://127.0.0.1:3000/auth/oidc/callback", "http://10.0.5.103:3000/auth/oidc/callback"]
|
||||
web_origins = ["https://music-dev.hexor.cy", "http://127.0.0.1:3000", "http://10.0.5.103:3000"]
|
||||
post_logout_redirect_uris = ["https://music-dev.hexor.cy/*", "http://127.0.0.1:3000/*", "http://10.0.5.103:3000/*"]
|
||||
redirect_uris = ["http://127.0.0.1:3000/auth/oidc/callback", "http://10.0.5.104:3000/auth/oidc/callback", "http://10.0.5.104:3000/auth/mobile/oidc/callback"]
|
||||
web_origins = ["http://127.0.0.1:3000", "http://10.0.5.104:3000"]
|
||||
post_logout_redirect_uris = ["http://127.0.0.1:3000/*", "http://10.0.5.104:3000/*"]
|
||||
}
|
||||
Web-Petting = {
|
||||
redirect_uris = ["https://pet.hexor.cy/admin/oidc/callback", "https://xn--l1acako8eb.xn--p1ai/admin/oidc/callback", "https://мурняня.рф/admin/oidc/callback"]
|
||||
web_origins = ["https://pet.hexor.cy", "https://xn--l1acako8eb.xn--p1ai", "https://мурняня.рф", ]
|
||||
post_logout_redirect_uris = ["https://pet.hexor.cy/*", "https://xn--l1acako8eb.xn--p1ai/*", "https://мурняня.рф/*"]
|
||||
}
|
||||
Paperless-ngx = {
|
||||
redirect_uris = ["https://docs.hexor.cy/accounts/oidc/authentik/login/callback/"]
|
||||
web_origins = ["https://docs.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://docs.hexor.cy/*"]
|
||||
}
|
||||
Immich = {
|
||||
redirect_uris = [
|
||||
"https://photos.hexor.cy/auth/login",
|
||||
"https://photos.hexor.cy/user-settings",
|
||||
"app.immich:///oauth-callback",
|
||||
"http://photos.homenet:30283/auth/login",
|
||||
"http://photos.homenet:30283/user-settings"
|
||||
]
|
||||
web_origins = ["https://photos.hexor.cy", "http://photos.homenet:30283"]
|
||||
post_logout_redirect_uris = ["https://photos.hexor.cy/*", "http://photos.homenet:30283/*"]
|
||||
}
|
||||
HomeAssistant-LMS = {
|
||||
redirect_uris = ["http://ha-lms:8123/auth/oidc/callback", "http://ha-lms.homenet:8123/auth/oidc/callback"]
|
||||
web_origins = ["http://ha-lms:8123", "http://ha-lms.homenet:8123"]
|
||||
post_logout_redirect_uris = ["http://ha-lms:8123/*", "http://ha-lms.homenet:8123/*"]
|
||||
}
|
||||
HomeAssistant-LND = {
|
||||
redirect_uris = ["http://ha-london:8123/auth/oidc/callback", "http://ha-london.tail2fe2d.ts.net:8123/auth/oidc/callback"]
|
||||
web_origins = ["http://ha-london:8123", "http://ha-london.tail2fe2d.ts.net:8123"]
|
||||
post_logout_redirect_uris = ["http://ha-london:8123/*", "http://ha-london.tail2fe2d.ts.net:8123/*"]
|
||||
}
|
||||
Matrix-Chat = {
|
||||
redirect_uris = ["https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A"]
|
||||
web_origins = ["https://auth.matrix.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://auth.matrix.hexor.cy/*"]
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user