Compare commits
22 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
0707becf61 | ||
 Ultradesu
|
3cd60a353e | ||
|
Ultradesu
|
4d000080d8 | ||
|
Ultradesu
|
3881b5b3ba | ||
|
Ultradesu
|
c850ad291a | ||
 ab
|
4228217497 | ||
|
ab
|
df2e2ec68d | ||
|
ab
|
180fd33ffc | ||
|
ab
|
bbb8ca0323 | ||
|
ab
|
ec91419b36 | ||
|
ab
|
1384b96742 | ||
|
ab
|
ab138b033a | ||
|
ab
|
968e633bf8 | ||
|
ab
|
aa6c02f60b | ||
|
ab
|
60423333fe | ||
|
ab
|
4026adc04a | ||
|
ab
|
94669590b1 | ||
|
ab
|
cf6223f0b5 | ||
|
ab
|
89ade00efb | ||
|
ab
|
4f67181637 | ||
|
Ultradesu
|
2bd3d91595 | ||
|
Ultradesu
|
6f1f6c349d |
@@ -42,6 +42,7 @@ ArgoCD homelab project
|
||||
|
||||
| Application | Status |
|
||||
| :--- | :---: |
|
||||
| **amnezia** | [](https://ag.hexor.cy/applications/argocd/amnezia) |
|
||||
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||
| **furumi** | [](https://ag.hexor.cy/applications/argocd/furumi) |
|
||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||
@@ -53,6 +54,7 @@ ArgoCD homelab project
|
||||
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
||||
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
||||
| **lidarr** | [](https://ag.hexor.cy/applications/argocd/lidarr) |
|
||||
| **llamacpp** | [](https://ag.hexor.cy/applications/argocd/llamacpp) |
|
||||
| **matrix** | [](https://ag.hexor.cy/applications/argocd/matrix) |
|
||||
| **mtproxy** | [](https://ag.hexor.cy/applications/argocd/mtproxy) |
|
||||
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: amnezia
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: amnezia
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/amnezia
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
@@ -0,0 +1,151 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: amneziawg-scripts
|
||||
data:
|
||||
firewall-up.sh: |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
|
||||
external_interface() {
|
||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
||||
}
|
||||
|
||||
ensure_insert_rule() {
|
||||
local table_args=()
|
||||
if [ "${1:-}" = "-t" ]; then
|
||||
table_args=("$1" "$2")
|
||||
shift 2
|
||||
fi
|
||||
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
||||
iptables "${table_args[@]}" -I "${chain}" 1 "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
ensure_append_rule() {
|
||||
local table_args=()
|
||||
if [ "${1:-}" = "-t" ]; then
|
||||
table_args=("$1" "$2")
|
||||
shift 2
|
||||
fi
|
||||
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
||||
iptables "${table_args[@]}" -A "${chain}" "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
EXT_IF="$(external_interface || true)"
|
||||
if [ -z "${EXT_IF}" ]; then
|
||||
EXT_IF="$(ip route show default | awk '{print $5; exit}')"
|
||||
fi
|
||||
if [ -z "${EXT_IF}" ]; then
|
||||
echo "Unable to detect external interface"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
sysctl -w net.ipv4.ip_forward=1
|
||||
|
||||
ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
|
||||
firewall-down.sh: |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
|
||||
external_interface() {
|
||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
||||
}
|
||||
|
||||
delete_rule() {
|
||||
local table_args=()
|
||||
if [ "${1:-}" = "-t" ]; then
|
||||
table_args=("$1" "$2")
|
||||
shift 2
|
||||
fi
|
||||
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
||||
true
|
||||
done
|
||||
}
|
||||
|
||||
EXT_IF="$(external_interface || true)"
|
||||
if [ -z "${EXT_IF}" ]; then
|
||||
EXT_IF="$(ip route show default | awk '{print $5; exit}')"
|
||||
fi
|
||||
|
||||
if [ -n "${EXT_IF}" ]; then
|
||||
delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
fi
|
||||
|
||||
delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
|
||||
run.sh: |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
SERVER_CONFIG="/etc/amnezia/server/awg0.conf"
|
||||
CLIENTS_DIR="/etc/amnezia/clients"
|
||||
RUNTIME_CONFIG="/run/amnezia/awg0.conf"
|
||||
|
||||
cleanup() {
|
||||
if awg show awg0 >/dev/null 2>&1; then
|
||||
awg-quick down "${RUNTIME_CONFIG}" || ip link delete awg0 || true
|
||||
fi
|
||||
}
|
||||
|
||||
render_config() {
|
||||
mkdir -p "$(dirname "${RUNTIME_CONFIG}")"
|
||||
cp "${SERVER_CONFIG}" "${RUNTIME_CONFIG}"
|
||||
chmod 0600 "${RUNTIME_CONFIG}"
|
||||
|
||||
local clients_found=0
|
||||
for client_config in "${CLIENTS_DIR}"/*; do
|
||||
[ -f "${client_config}" ] || continue
|
||||
[ -s "${client_config}" ] || continue
|
||||
printf '\n' >> "${RUNTIME_CONFIG}"
|
||||
cat "${client_config}" >> "${RUNTIME_CONFIG}"
|
||||
clients_found=1
|
||||
done
|
||||
|
||||
if [ "${clients_found}" = "0" ]; then
|
||||
echo "No client peer configs found in ${CLIENTS_DIR}; starting without peers"
|
||||
fi
|
||||
}
|
||||
|
||||
trap cleanup EXIT
|
||||
trap 'exit 0' TERM INT
|
||||
|
||||
render_config
|
||||
cleanup
|
||||
awg-quick up "${RUNTIME_CONFIG}"
|
||||
awg show awg0 || true
|
||||
|
||||
while true; do
|
||||
sleep 3600 &
|
||||
wait "$!"
|
||||
done
|
||||
@@ -0,0 +1,148 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: amneziawg
|
||||
labels:
|
||||
app: amneziawg
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
secret.reloader.stakater.com/reload: "amneziawg-server,amneziawg-clients"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: amneziawg
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: amneziawg
|
||||
spec:
|
||||
serviceAccountName: amneziawg
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
nodeSelector:
|
||||
amnezia-vpn: "true"
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
initContainers:
|
||||
- name: register-endpoint
|
||||
image: bitnami/kubectl:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: PORT
|
||||
value: "5847"
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- |
|
||||
set -euo pipefail
|
||||
|
||||
NAMESPACE="$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)"
|
||||
ENDPOINT="$(kubectl get node "${NODE_NAME}" -o jsonpath="{.metadata.labels['external-ipv4']}")"
|
||||
|
||||
if [ -z "${ENDPOINT}" ]; then
|
||||
ENDPOINT="$(kubectl get node "${NODE_NAME}" -o jsonpath='{range .status.addresses[?(@.type=="ExternalIP")]}{.address}{end}')"
|
||||
fi
|
||||
|
||||
if [ -z "${ENDPOINT}" ]; then
|
||||
echo "ERROR: node ${NODE_NAME} has no external-ipv4 label and no ExternalIP"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
VALUE="${ENDPOINT}:${PORT}"
|
||||
echo "Registering AmneziaWG endpoint: ${NODE_NAME} -> ${VALUE}"
|
||||
|
||||
if kubectl get secret amneziawg-endpoints -n "${NAMESPACE}" >/dev/null 2>&1; then
|
||||
kubectl patch secret amneziawg-endpoints -n "${NAMESPACE}" \
|
||||
--type merge -p "{\"stringData\":{\"${NODE_NAME}\":\"${VALUE}\"}}"
|
||||
else
|
||||
kubectl create secret generic amneziawg-endpoints -n "${NAMESPACE}" \
|
||||
--from-literal="${NODE_NAME}=${VALUE}"
|
||||
fi
|
||||
containers:
|
||||
- name: amneziawg
|
||||
image: amneziavpn/amneziawg-go:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
privileged: true
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- SYS_MODULE
|
||||
command:
|
||||
- /bin/bash
|
||||
- /scripts/run.sh
|
||||
ports:
|
||||
- name: awg
|
||||
containerPort: 5847
|
||||
protocol: UDP
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- awg show awg0 >/dev/null 2>&1
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- awg show awg0 >/dev/null 2>&1
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
memory: "64Mi"
|
||||
cpu: "50m"
|
||||
limits:
|
||||
memory: "256Mi"
|
||||
cpu: "500m"
|
||||
volumeMounts:
|
||||
- name: server-config
|
||||
mountPath: /etc/amnezia/server
|
||||
readOnly: true
|
||||
- name: client-config
|
||||
mountPath: /etc/amnezia/clients
|
||||
readOnly: true
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
readOnly: true
|
||||
- name: runtime-config
|
||||
mountPath: /run/amnezia
|
||||
- name: dev-net-tun
|
||||
mountPath: /dev/net/tun
|
||||
volumes:
|
||||
- name: server-config
|
||||
secret:
|
||||
secretName: amneziawg-server
|
||||
defaultMode: 0600
|
||||
items:
|
||||
- key: awg0.conf
|
||||
path: awg0.conf
|
||||
- name: client-config
|
||||
secret:
|
||||
secretName: amneziawg-clients
|
||||
optional: true
|
||||
defaultMode: 0600
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: amneziawg-scripts
|
||||
defaultMode: 0755
|
||||
- name: runtime-config
|
||||
emptyDir: {}
|
||||
- name: dev-net-tun
|
||||
hostPath:
|
||||
path: /dev/net/tun
|
||||
type: CharDevice
|
||||
@@ -0,0 +1,50 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: amneziawg-server
|
||||
spec:
|
||||
target:
|
||||
name: amneziawg-server
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
server-public-key: |-
|
||||
{{ .server_public_key }}
|
||||
awg0.conf: |-
|
||||
[Interface]
|
||||
PrivateKey = {{ .server_private_key }}
|
||||
Address = 10.8.0.1/16
|
||||
ListenPort = 5847
|
||||
MTU = 1376
|
||||
Jc = 4
|
||||
Jmin = 64
|
||||
Jmax = 128
|
||||
S1 = 15
|
||||
S2 = 18
|
||||
S3 = 20
|
||||
S4 = 23
|
||||
H1 = 1020325451
|
||||
H2 = 3288052141
|
||||
H3 = 1766607858
|
||||
H4 = 2528465083
|
||||
PostUp = /scripts/firewall-up.sh 5847 10.8.0.0/16
|
||||
PostDown = /scripts/firewall-down.sh 5847 10.8.0.0/16
|
||||
data:
|
||||
- secretKey: server_private_key
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 3092dc7c-41dd-461a-9f7a-377727f47e93
|
||||
property: fields[0].value
|
||||
- secretKey: server_public_key
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 3092dc7c-41dd-461a-9f7a-377727f47e93
|
||||
property: fields[1].value
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- namespace.yaml
|
||||
- external-secrets.yaml
|
||||
- configmap-scripts.yaml
|
||||
- rbac.yaml
|
||||
- daemonset.yaml
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: amnezia
|
||||
labels:
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
pod-security.kubernetes.io/audit: privileged
|
||||
pod-security.kubernetes.io/warn: privileged
|
||||
@@ -0,0 +1,58 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: amneziawg
|
||||
labels:
|
||||
app: amneziawg
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: amneziawg-node-reader
|
||||
labels:
|
||||
app: amneziawg
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: amneziawg-node-reader
|
||||
labels:
|
||||
app: amneziawg
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: amneziawg-node-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: amneziawg
|
||||
namespace: amnezia
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: amneziawg-endpoint-manager
|
||||
labels:
|
||||
app: amneziawg
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "create", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: amneziawg-endpoint-manager
|
||||
labels:
|
||||
app: amneziawg
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: amneziawg-endpoint-manager
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: amneziawg
|
||||
@@ -6,7 +6,7 @@ data:
|
||||
LLAMA_CACHE: /models
|
||||
LLAMA_ARG_HOST: 0.0.0.0
|
||||
LLAMA_ARG_PORT: "8080"
|
||||
LLAMA_ARG_HF_REPO: unsloth/Qwen3.6-35B-A3B-MTP-GGUF:UD-Q6_K
|
||||
LLAMA_ARG_HF_REPO: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF:UD-Q6_K"
|
||||
LLAMA_ARG_CTX_SIZE: "32768"
|
||||
LLAMA_ARG_FLASH_ATTN: auto
|
||||
LLAMA_ARG_FIT: "on"
|
||||
|
||||
@@ -18,6 +18,7 @@ spec:
|
||||
labels:
|
||||
app: llamacpp
|
||||
spec:
|
||||
dnsPolicy: Default
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
|
||||
@@ -53,8 +53,8 @@ spec:
|
||||
upstream_oauth2:
|
||||
providers:
|
||||
- id: 001KKV4EKY7KG98W2M9T806K6A
|
||||
human_name: Authentik
|
||||
issuer: https://idm.hexor.cy/application/o/matrix/
|
||||
human_name: SSO Login
|
||||
issuer: https://auth.hexor.cy/auth/realms/hexor
|
||||
client_id: "{{ .oauth_client_id }}"
|
||||
client_secret: "{{ .oauth_client_secret }}"
|
||||
token_endpoint_auth_method: client_secret_post
|
||||
@@ -93,3 +93,4 @@ spec:
|
||||
metadataPolicy: None
|
||||
key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
|
||||
property: fields[1].value
|
||||
on_conflict: replace
|
||||
|
||||
@@ -18,8 +18,8 @@ spec:
|
||||
"openid_connect": {
|
||||
"APPS": [
|
||||
{
|
||||
"provider_id": "authentik",
|
||||
"name": "Authentik",
|
||||
"provider_id": "keycloak",
|
||||
"name": "Keycloak",
|
||||
"client_id": "{{ .oauth_id }}",
|
||||
"secret": "{{ .oauth_secret }}",
|
||||
"settings": {
|
||||
|
||||
@@ -46,7 +46,7 @@ spec:
|
||||
mountPath: /scripts
|
||||
containers:
|
||||
- name: pasarguard-node
|
||||
image: pasarguard/node:v0.5.0
|
||||
image: pasarguard/node:v0.5.2
|
||||
imagePullPolicy: Always
|
||||
command:
|
||||
- /bin/sh
|
||||
|
||||
@@ -34,7 +34,7 @@ spec:
|
||||
mountPath: /templates/subscription
|
||||
containers:
|
||||
- name: pasarguard-web
|
||||
image: pasarguard/panel:v4.0.2
|
||||
image: pasarguard/panel:v5.0.1
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- secretRef:
|
||||
|
||||
@@ -66,11 +66,11 @@ ingress:
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
limits:
|
||||
cpu: "3"
|
||||
memory: 2Gi
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
@@ -6,6 +6,7 @@ resources:
|
||||
- nfs-storage.yaml
|
||||
- coredns-internal-resolve.yaml
|
||||
- https-middleware.yaml
|
||||
- node-external-ip-labeler.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: csi-driver-nfs
|
||||
@@ -15,4 +16,3 @@ helmCharts:
|
||||
namespace: kube-system
|
||||
#valuesFile: values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
|
||||
@@ -0,0 +1,173 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "patch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-external-ip-labeler
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
rules:
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: node-external-ip-labeler
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: node-external-ip-labeler
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
spec:
|
||||
schedule: "17 3 * * *"
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
spec:
|
||||
serviceAccountName: node-external-ip-labeler
|
||||
restartPolicy: Never
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
containers:
|
||||
- name: fanout
|
||||
image: bitnami/kubectl:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
args:
|
||||
- |
|
||||
set -euo pipefail
|
||||
|
||||
clean_name() {
|
||||
echo "$1" \
|
||||
| tr '[:upper:]' '[:lower:]' \
|
||||
| tr -c 'a-z0-9-' '-' \
|
||||
| sed 's/^-*//;s/-*$//' \
|
||||
| cut -c1-45
|
||||
}
|
||||
|
||||
for NODE_NAME in $(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'); do
|
||||
NODE_CLEAN="$(clean_name "${NODE_NAME}")"
|
||||
JOB_NAME="node-external-ip-${NODE_CLEAN}"
|
||||
|
||||
kubectl delete job "${JOB_NAME}" -n kube-system --ignore-not-found=true --wait=true --timeout=60s
|
||||
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: ${JOB_NAME}
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
target-node: "${NODE_CLEAN}"
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 86400
|
||||
backoffLimit: 2
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: node-external-ip-labeler
|
||||
target-node: "${NODE_CLEAN}"
|
||||
spec:
|
||||
serviceAccountName: node-external-ip-labeler
|
||||
nodeName: "${NODE_NAME}"
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
restartPolicy: Never
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
containers:
|
||||
- name: label-node
|
||||
image: bitnami/kubectl:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
value: "${NODE_NAME}"
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
args:
|
||||
- |
|
||||
set -euo pipefail
|
||||
|
||||
json_ip() {
|
||||
sed -n 's/.*"ip"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p'
|
||||
}
|
||||
|
||||
IPV4="\$(curl -fsS --connect-timeout 10 --max-time 30 'https://api.ipify.org?format=json' | json_ip)"
|
||||
IP64="\$(curl -fsS --connect-timeout 10 --max-time 30 'https://api64.ipify.org?format=json' | json_ip || true)"
|
||||
|
||||
if [ -z "\${IPV4}" ]; then
|
||||
echo "Unable to detect external IPv4 for node ${NODE_NAME}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
kubectl label node "${NODE_NAME}" external-ipv4="\${IPV4}" --overwrite
|
||||
kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv4="\${IPV4}" --overwrite
|
||||
|
||||
if echo "\${IP64}" | grep -q ':'; then
|
||||
kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv6="\${IP64}" --overwrite
|
||||
elif [ -n "\${IP64}" ]; then
|
||||
kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv4-api64="\${IP64}" --overwrite
|
||||
fi
|
||||
EOF
|
||||
done
|
||||
@@ -13,7 +13,7 @@ resources:
|
||||
helmCharts:
|
||||
- name: pgadmin4
|
||||
repo: https://helm.runix.net
|
||||
version: 1.50.0
|
||||
version: 1.64.0
|
||||
releaseName: pgmanager
|
||||
namespace: psql
|
||||
valuesFile: pgadmin4-values.yaml
|
||||
|
||||
@@ -36,7 +36,7 @@ spec:
|
||||
spec:
|
||||
nodeSelector:
|
||||
#kubernetes.io/hostname: home.homenet
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
kubernetes.io/hostname: music.tail2fe2d.ts.net
|
||||
terminationGracePeriodSeconds: 10
|
||||
containers:
|
||||
- name: prom-a2s-exporter
|
||||
|
||||
@@ -46,18 +46,49 @@ oauth2_applications = {
|
||||
post_logout_redirect_uris = ["https://ai.hexor.cy/*"]
|
||||
}
|
||||
FuruMusic = {
|
||||
redirect_uris = ["https://music.hexor.cy/auth/oidc/callback"]
|
||||
redirect_uris = ["https://music.hexor.cy/auth/oidc/callback", "https://music.hexor.cy/auth/mobile/oidc/callback"]
|
||||
web_origins = ["https://music.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://music.hexor.cy/*"]
|
||||
}
|
||||
FuruMusic-dev = {
|
||||
redirect_uris = ["https://music-dev.hexor.cy/auth/oidc/callback", "http://127.0.0.1:3000/auth/oidc/callback", "http://10.0.5.103:3000/auth/oidc/callback"]
|
||||
web_origins = ["https://music-dev.hexor.cy", "http://127.0.0.1:3000", "http://10.0.5.103:3000"]
|
||||
post_logout_redirect_uris = ["https://music-dev.hexor.cy/*", "http://127.0.0.1:3000/*", "http://10.0.5.103:3000/*"]
|
||||
redirect_uris = ["http://127.0.0.1:3000/auth/oidc/callback", "http://10.0.5.104:3000/auth/oidc/callback", "http://10.0.5.104:3000/auth/mobile/oidc/callback"]
|
||||
web_origins = ["http://127.0.0.1:3000", "http://10.0.5.104:3000"]
|
||||
post_logout_redirect_uris = ["http://127.0.0.1:3000/*", "http://10.0.5.104:3000/*"]
|
||||
}
|
||||
Web-Petting = {
|
||||
redirect_uris = ["https://pet.hexor.cy/admin/oidc/callback", "https://xn--l1acako8eb.xn--p1ai/admin/oidc/callback", "https://мурняня.рф/admin/oidc/callback"]
|
||||
web_origins = ["https://pet.hexor.cy", "https://xn--l1acako8eb.xn--p1ai", "https://мурняня.рф", ]
|
||||
post_logout_redirect_uris = ["https://pet.hexor.cy/*", "https://xn--l1acako8eb.xn--p1ai/*", "https://мурняня.рф/*"]
|
||||
}
|
||||
Paperless-ngx = {
|
||||
redirect_uris = ["https://docs.hexor.cy/accounts/oidc/authentik/login/callback/"]
|
||||
web_origins = ["https://docs.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://docs.hexor.cy/*"]
|
||||
}
|
||||
Immich = {
|
||||
redirect_uris = [
|
||||
"https://photos.hexor.cy/auth/login",
|
||||
"https://photos.hexor.cy/user-settings",
|
||||
"app.immich:///oauth-callback",
|
||||
"http://photos.homenet:30283/auth/login",
|
||||
"http://photos.homenet:30283/user-settings"
|
||||
]
|
||||
web_origins = ["https://photos.hexor.cy", "http://photos.homenet:30283"]
|
||||
post_logout_redirect_uris = ["https://photos.hexor.cy/*", "http://photos.homenet:30283/*"]
|
||||
}
|
||||
HomeAssistant-LMS = {
|
||||
redirect_uris = ["http://ha-lms:8123/auth/oidc/callback", "http://ha-lms.homenet:8123/auth/oidc/callback"]
|
||||
web_origins = ["http://ha-lms:8123", "http://ha-lms.homenet:8123"]
|
||||
post_logout_redirect_uris = ["http://ha-lms:8123/*", "http://ha-lms.homenet:8123/*"]
|
||||
}
|
||||
HomeAssistant-LND = {
|
||||
redirect_uris = ["http://ha-london:8123/auth/oidc/callback", "http://ha-london.tail2fe2d.ts.net:8123/auth/oidc/callback"]
|
||||
web_origins = ["http://ha-london:8123", "http://ha-london.tail2fe2d.ts.net:8123"]
|
||||
post_logout_redirect_uris = ["http://ha-london:8123/*", "http://ha-london.tail2fe2d.ts.net:8123/*"]
|
||||
}
|
||||
Matrix-Chat = {
|
||||
redirect_uris = ["https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A"]
|
||||
web_origins = ["https://auth.matrix.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://auth.matrix.hexor.cy/*"]
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user