Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
51c2af1045 |
@@ -42,7 +42,6 @@ ArgoCD homelab project
|
|||||||
|
|
||||||
| Application | Status |
|
| Application | Status |
|
||||||
| :--- | :---: |
|
| :--- | :---: |
|
||||||
| **amnezia** | [](https://ag.hexor.cy/applications/argocd/amnezia) |
|
|
||||||
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||||
| **furumi** | [](https://ag.hexor.cy/applications/argocd/furumi) |
|
| **furumi** | [](https://ag.hexor.cy/applications/argocd/furumi) |
|
||||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||||
|
|||||||
@@ -1,20 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: amnezia
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: apps
|
|
||||||
destination:
|
|
||||||
namespace: amnezia
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
source:
|
|
||||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
|
||||||
targetRevision: HEAD
|
|
||||||
path: k8s/apps/amnezia
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
selfHeal: true
|
|
||||||
prune: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,151 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: amneziawg-scripts
|
|
||||||
data:
|
|
||||||
firewall-up.sh: |
|
|
||||||
#!/usr/bin/env bash
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
PORT="${1:-5847}"
|
|
||||||
VPN_CIDR="${2:-10.8.1.0/24}"
|
|
||||||
|
|
||||||
external_interface() {
|
|
||||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
|
||||||
}
|
|
||||||
|
|
||||||
ensure_insert_rule() {
|
|
||||||
local table_args=()
|
|
||||||
if [ "${1:-}" = "-t" ]; then
|
|
||||||
table_args=("$1" "$2")
|
|
||||||
shift 2
|
|
||||||
fi
|
|
||||||
|
|
||||||
local chain="$1"
|
|
||||||
shift
|
|
||||||
|
|
||||||
if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
|
||||||
iptables "${table_args[@]}" -I "${chain}" 1 "$@"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
ensure_append_rule() {
|
|
||||||
local table_args=()
|
|
||||||
if [ "${1:-}" = "-t" ]; then
|
|
||||||
table_args=("$1" "$2")
|
|
||||||
shift 2
|
|
||||||
fi
|
|
||||||
|
|
||||||
local chain="$1"
|
|
||||||
shift
|
|
||||||
|
|
||||||
if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
|
||||||
iptables "${table_args[@]}" -A "${chain}" "$@"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
EXT_IF="$(external_interface || true)"
|
|
||||||
if [ -z "${EXT_IF}" ]; then
|
|
||||||
EXT_IF="$(ip route show default | awk '{print $5; exit}')"
|
|
||||||
fi
|
|
||||||
if [ -z "${EXT_IF}" ]; then
|
|
||||||
echo "Unable to detect external interface"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
sysctl -w net.ipv4.ip_forward=1
|
|
||||||
|
|
||||||
ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
|
||||||
ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
|
||||||
ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
|
||||||
ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
|
||||||
ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
|
||||||
ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
|
||||||
|
|
||||||
firewall-down.sh: |
|
|
||||||
#!/usr/bin/env bash
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
PORT="${1:-5847}"
|
|
||||||
VPN_CIDR="${2:-10.8.1.0/24}"
|
|
||||||
|
|
||||||
external_interface() {
|
|
||||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
|
||||||
}
|
|
||||||
|
|
||||||
delete_rule() {
|
|
||||||
local table_args=()
|
|
||||||
if [ "${1:-}" = "-t" ]; then
|
|
||||||
table_args=("$1" "$2")
|
|
||||||
shift 2
|
|
||||||
fi
|
|
||||||
|
|
||||||
local chain="$1"
|
|
||||||
shift
|
|
||||||
|
|
||||||
while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
|
||||||
true
|
|
||||||
done
|
|
||||||
}
|
|
||||||
|
|
||||||
EXT_IF="$(external_interface || true)"
|
|
||||||
if [ -z "${EXT_IF}" ]; then
|
|
||||||
EXT_IF="$(ip route show default | awk '{print $5; exit}')"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -n "${EXT_IF}" ]; then
|
|
||||||
delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
|
||||||
delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
|
||||||
fi
|
|
||||||
|
|
||||||
delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
|
||||||
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
|
||||||
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
|
||||||
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
|
||||||
|
|
||||||
run.sh: |
|
|
||||||
#!/usr/bin/env bash
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
SERVER_CONFIG="/etc/amnezia/server/awg0.conf"
|
|
||||||
CLIENTS_DIR="/etc/amnezia/clients"
|
|
||||||
RUNTIME_CONFIG="/run/amnezia/awg0.conf"
|
|
||||||
|
|
||||||
cleanup() {
|
|
||||||
if awg show awg0 >/dev/null 2>&1; then
|
|
||||||
awg-quick down "${RUNTIME_CONFIG}" || ip link delete awg0 || true
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
render_config() {
|
|
||||||
mkdir -p "$(dirname "${RUNTIME_CONFIG}")"
|
|
||||||
cp "${SERVER_CONFIG}" "${RUNTIME_CONFIG}"
|
|
||||||
chmod 0600 "${RUNTIME_CONFIG}"
|
|
||||||
|
|
||||||
local clients_found=0
|
|
||||||
for client_config in "${CLIENTS_DIR}"/*; do
|
|
||||||
[ -f "${client_config}" ] || continue
|
|
||||||
[ -s "${client_config}" ] || continue
|
|
||||||
printf '\n' >> "${RUNTIME_CONFIG}"
|
|
||||||
cat "${client_config}" >> "${RUNTIME_CONFIG}"
|
|
||||||
clients_found=1
|
|
||||||
done
|
|
||||||
|
|
||||||
if [ "${clients_found}" = "0" ]; then
|
|
||||||
echo "No client peer configs found in ${CLIENTS_DIR}; starting without peers"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
trap cleanup EXIT
|
|
||||||
trap 'exit 0' TERM INT
|
|
||||||
|
|
||||||
render_config
|
|
||||||
cleanup
|
|
||||||
awg-quick up "${RUNTIME_CONFIG}"
|
|
||||||
awg show awg0 || true
|
|
||||||
|
|
||||||
while true; do
|
|
||||||
sleep 3600 &
|
|
||||||
wait "$!"
|
|
||||||
done
|
|
||||||
@@ -1,148 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: DaemonSet
|
|
||||||
metadata:
|
|
||||||
name: amneziawg
|
|
||||||
labels:
|
|
||||||
app: amneziawg
|
|
||||||
annotations:
|
|
||||||
reloader.stakater.com/auto: "true"
|
|
||||||
secret.reloader.stakater.com/reload: "amneziawg-server,amneziawg-clients"
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: amneziawg
|
|
||||||
updateStrategy:
|
|
||||||
type: RollingUpdate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: amneziawg
|
|
||||||
spec:
|
|
||||||
serviceAccountName: amneziawg
|
|
||||||
hostNetwork: true
|
|
||||||
dnsPolicy: ClusterFirstWithHostNet
|
|
||||||
nodeSelector:
|
|
||||||
amnezia-vpn: "true"
|
|
||||||
tolerations:
|
|
||||||
- operator: Exists
|
|
||||||
initContainers:
|
|
||||||
- name: register-endpoint
|
|
||||||
image: bitnami/kubectl:latest
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
- name: NODE_NAME
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: spec.nodeName
|
|
||||||
- name: PORT
|
|
||||||
value: "5847"
|
|
||||||
command:
|
|
||||||
- /bin/bash
|
|
||||||
- -lc
|
|
||||||
- |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
NAMESPACE="$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)"
|
|
||||||
ENDPOINT="$(kubectl get node "${NODE_NAME}" -o jsonpath="{.metadata.labels['external-ipv4']}")"
|
|
||||||
|
|
||||||
if [ -z "${ENDPOINT}" ]; then
|
|
||||||
ENDPOINT="$(kubectl get node "${NODE_NAME}" -o jsonpath='{range .status.addresses[?(@.type=="ExternalIP")]}{.address}{end}')"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -z "${ENDPOINT}" ]; then
|
|
||||||
echo "ERROR: node ${NODE_NAME} has no external-ipv4 label and no ExternalIP"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
VALUE="${ENDPOINT}:${PORT}"
|
|
||||||
echo "Registering AmneziaWG endpoint: ${NODE_NAME} -> ${VALUE}"
|
|
||||||
|
|
||||||
if kubectl get secret amneziawg-endpoints -n "${NAMESPACE}" >/dev/null 2>&1; then
|
|
||||||
kubectl patch secret amneziawg-endpoints -n "${NAMESPACE}" \
|
|
||||||
--type merge -p "{\"stringData\":{\"${NODE_NAME}\":\"${VALUE}\"}}"
|
|
||||||
else
|
|
||||||
kubectl create secret generic amneziawg-endpoints -n "${NAMESPACE}" \
|
|
||||||
--from-literal="${NODE_NAME}=${VALUE}"
|
|
||||||
fi
|
|
||||||
containers:
|
|
||||||
- name: amneziawg
|
|
||||||
image: amneziavpn/amneziawg-go:latest
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
securityContext:
|
|
||||||
privileged: true
|
|
||||||
capabilities:
|
|
||||||
add:
|
|
||||||
- NET_ADMIN
|
|
||||||
- SYS_MODULE
|
|
||||||
command:
|
|
||||||
- /bin/bash
|
|
||||||
- /scripts/run.sh
|
|
||||||
ports:
|
|
||||||
- name: awg
|
|
||||||
containerPort: 5847
|
|
||||||
protocol: UDP
|
|
||||||
readinessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /bin/bash
|
|
||||||
- -lc
|
|
||||||
- awg show awg0 >/dev/null 2>&1
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 3
|
|
||||||
failureThreshold: 3
|
|
||||||
livenessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /bin/bash
|
|
||||||
- -lc
|
|
||||||
- awg show awg0 >/dev/null 2>&1
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 30
|
|
||||||
timeoutSeconds: 5
|
|
||||||
failureThreshold: 3
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "64Mi"
|
|
||||||
cpu: "50m"
|
|
||||||
limits:
|
|
||||||
memory: "256Mi"
|
|
||||||
cpu: "500m"
|
|
||||||
volumeMounts:
|
|
||||||
- name: server-config
|
|
||||||
mountPath: /etc/amnezia/server
|
|
||||||
readOnly: true
|
|
||||||
- name: client-config
|
|
||||||
mountPath: /etc/amnezia/clients
|
|
||||||
readOnly: true
|
|
||||||
- name: scripts
|
|
||||||
mountPath: /scripts
|
|
||||||
readOnly: true
|
|
||||||
- name: runtime-config
|
|
||||||
mountPath: /run/amnezia
|
|
||||||
- name: dev-net-tun
|
|
||||||
mountPath: /dev/net/tun
|
|
||||||
volumes:
|
|
||||||
- name: server-config
|
|
||||||
secret:
|
|
||||||
secretName: amneziawg-server
|
|
||||||
defaultMode: 0600
|
|
||||||
items:
|
|
||||||
- key: awg0.conf
|
|
||||||
path: awg0.conf
|
|
||||||
- name: client-config
|
|
||||||
secret:
|
|
||||||
secretName: amneziawg-clients
|
|
||||||
optional: true
|
|
||||||
defaultMode: 0600
|
|
||||||
- name: scripts
|
|
||||||
configMap:
|
|
||||||
name: amneziawg-scripts
|
|
||||||
defaultMode: 0755
|
|
||||||
- name: runtime-config
|
|
||||||
emptyDir: {}
|
|
||||||
- name: dev-net-tun
|
|
||||||
hostPath:
|
|
||||||
path: /dev/net/tun
|
|
||||||
type: CharDevice
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: amneziawg-server
|
|
||||||
spec:
|
|
||||||
target:
|
|
||||||
name: amneziawg-server
|
|
||||||
deletionPolicy: Delete
|
|
||||||
template:
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
server-public-key: |-
|
|
||||||
{{ .server_public_key }}
|
|
||||||
awg0.conf: |-
|
|
||||||
[Interface]
|
|
||||||
PrivateKey = {{ .server_private_key }}
|
|
||||||
Address = 10.8.1.1/24
|
|
||||||
ListenPort = 5847
|
|
||||||
MTU = 1376
|
|
||||||
Jc = 4
|
|
||||||
Jmin = 64
|
|
||||||
Jmax = 128
|
|
||||||
S1 = 15
|
|
||||||
S2 = 18
|
|
||||||
S3 = 20
|
|
||||||
S4 = 23
|
|
||||||
H1 = 1020325451
|
|
||||||
H2 = 3288052141
|
|
||||||
H3 = 1766607858
|
|
||||||
H4 = 2528465083
|
|
||||||
PostUp = /scripts/firewall-up.sh 5847 10.8.1.0/24
|
|
||||||
PostDown = /scripts/firewall-down.sh 5847 10.8.1.0/24
|
|
||||||
data:
|
|
||||||
- secretKey: server_private_key
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: 3092dc7c-41dd-461a-9f7a-377727f47e93
|
|
||||||
property: fields[0].value
|
|
||||||
- secretKey: server_public_key
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: 3092dc7c-41dd-461a-9f7a-377727f47e93
|
|
||||||
property: fields[1].value
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- app.yaml
|
|
||||||
- namespace.yaml
|
|
||||||
- external-secrets.yaml
|
|
||||||
- configmap-scripts.yaml
|
|
||||||
- rbac.yaml
|
|
||||||
- daemonset.yaml
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: amnezia
|
|
||||||
labels:
|
|
||||||
pod-security.kubernetes.io/enforce: privileged
|
|
||||||
pod-security.kubernetes.io/audit: privileged
|
|
||||||
pod-security.kubernetes.io/warn: privileged
|
|
||||||
@@ -1,58 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: amneziawg
|
|
||||||
labels:
|
|
||||||
app: amneziawg
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: amneziawg-node-reader
|
|
||||||
labels:
|
|
||||||
app: amneziawg
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["nodes"]
|
|
||||||
verbs: ["get", "list"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: amneziawg-node-reader
|
|
||||||
labels:
|
|
||||||
app: amneziawg
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: amneziawg-node-reader
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: amneziawg
|
|
||||||
namespace: amnezia
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: amneziawg-endpoint-manager
|
|
||||||
labels:
|
|
||||||
app: amneziawg
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["secrets"]
|
|
||||||
verbs: ["get", "create", "patch"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: amneziawg-endpoint-manager
|
|
||||||
labels:
|
|
||||||
app: amneziawg
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: amneziawg-endpoint-manager
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: amneziawg
|
|
||||||
@@ -53,8 +53,8 @@ spec:
|
|||||||
upstream_oauth2:
|
upstream_oauth2:
|
||||||
providers:
|
providers:
|
||||||
- id: 001KKV4EKY7KG98W2M9T806K6A
|
- id: 001KKV4EKY7KG98W2M9T806K6A
|
||||||
human_name: SSO Login
|
human_name: Authentik
|
||||||
issuer: https://auth.hexor.cy/auth/realms/hexor
|
issuer: https://idm.hexor.cy/application/o/matrix/
|
||||||
client_id: "{{ .oauth_client_id }}"
|
client_id: "{{ .oauth_client_id }}"
|
||||||
client_secret: "{{ .oauth_client_secret }}"
|
client_secret: "{{ .oauth_client_secret }}"
|
||||||
token_endpoint_auth_method: client_secret_post
|
token_endpoint_auth_method: client_secret_post
|
||||||
@@ -93,4 +93,3 @@ spec:
|
|||||||
metadataPolicy: None
|
metadataPolicy: None
|
||||||
key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
|
key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
|
||||||
property: fields[1].value
|
property: fields[1].value
|
||||||
on_conflict: replace
|
|
||||||
|
|||||||
@@ -18,8 +18,8 @@ spec:
|
|||||||
"openid_connect": {
|
"openid_connect": {
|
||||||
"APPS": [
|
"APPS": [
|
||||||
{
|
{
|
||||||
"provider_id": "keycloak",
|
"provider_id": "authentik",
|
||||||
"name": "Keycloak",
|
"name": "Authentik",
|
||||||
"client_id": "{{ .oauth_id }}",
|
"client_id": "{{ .oauth_id }}",
|
||||||
"secret": "{{ .oauth_secret }}",
|
"secret": "{{ .oauth_secret }}",
|
||||||
"settings": {
|
"settings": {
|
||||||
|
|||||||
@@ -46,7 +46,7 @@ spec:
|
|||||||
mountPath: /scripts
|
mountPath: /scripts
|
||||||
containers:
|
containers:
|
||||||
- name: pasarguard-node
|
- name: pasarguard-node
|
||||||
image: pasarguard/node:v0.5.2
|
image: pasarguard/node:v0.5.0
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
command:
|
command:
|
||||||
- /bin/sh
|
- /bin/sh
|
||||||
|
|||||||
@@ -34,7 +34,7 @@ spec:
|
|||||||
mountPath: /templates/subscription
|
mountPath: /templates/subscription
|
||||||
containers:
|
containers:
|
||||||
- name: pasarguard-web
|
- name: pasarguard-web
|
||||||
image: pasarguard/panel:v5.0.1
|
image: pasarguard/panel:v4.0.2
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
envFrom:
|
envFrom:
|
||||||
- secretRef:
|
- secretRef:
|
||||||
|
|||||||
@@ -6,7 +6,6 @@ resources:
|
|||||||
- nfs-storage.yaml
|
- nfs-storage.yaml
|
||||||
- coredns-internal-resolve.yaml
|
- coredns-internal-resolve.yaml
|
||||||
- https-middleware.yaml
|
- https-middleware.yaml
|
||||||
- node-external-ip-labeler.yaml
|
|
||||||
|
|
||||||
helmCharts:
|
helmCharts:
|
||||||
- name: csi-driver-nfs
|
- name: csi-driver-nfs
|
||||||
@@ -16,3 +15,4 @@ helmCharts:
|
|||||||
namespace: kube-system
|
namespace: kube-system
|
||||||
#valuesFile: values.yaml
|
#valuesFile: values.yaml
|
||||||
includeCRDs: true
|
includeCRDs: true
|
||||||
|
|
||||||
|
|||||||
@@ -1,173 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: node-external-ip-labeler
|
|
||||||
namespace: kube-system
|
|
||||||
labels:
|
|
||||||
app: node-external-ip-labeler
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: node-external-ip-labeler
|
|
||||||
labels:
|
|
||||||
app: node-external-ip-labeler
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["nodes"]
|
|
||||||
verbs: ["get", "list", "patch", "update"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: node-external-ip-labeler
|
|
||||||
labels:
|
|
||||||
app: node-external-ip-labeler
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: node-external-ip-labeler
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: node-external-ip-labeler
|
|
||||||
namespace: kube-system
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: node-external-ip-labeler
|
|
||||||
namespace: kube-system
|
|
||||||
labels:
|
|
||||||
app: node-external-ip-labeler
|
|
||||||
rules:
|
|
||||||
- apiGroups: ["batch"]
|
|
||||||
resources: ["jobs"]
|
|
||||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: node-external-ip-labeler
|
|
||||||
namespace: kube-system
|
|
||||||
labels:
|
|
||||||
app: node-external-ip-labeler
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: node-external-ip-labeler
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: node-external-ip-labeler
|
|
||||||
namespace: kube-system
|
|
||||||
---
|
|
||||||
apiVersion: batch/v1
|
|
||||||
kind: CronJob
|
|
||||||
metadata:
|
|
||||||
name: node-external-ip-labeler
|
|
||||||
namespace: kube-system
|
|
||||||
labels:
|
|
||||||
app: node-external-ip-labeler
|
|
||||||
spec:
|
|
||||||
schedule: "17 3 * * *"
|
|
||||||
concurrencyPolicy: Forbid
|
|
||||||
successfulJobsHistoryLimit: 3
|
|
||||||
failedJobsHistoryLimit: 3
|
|
||||||
jobTemplate:
|
|
||||||
spec:
|
|
||||||
backoffLimit: 1
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: node-external-ip-labeler
|
|
||||||
spec:
|
|
||||||
serviceAccountName: node-external-ip-labeler
|
|
||||||
restartPolicy: Never
|
|
||||||
tolerations:
|
|
||||||
- operator: Exists
|
|
||||||
containers:
|
|
||||||
- name: fanout
|
|
||||||
image: bitnami/kubectl:latest
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command:
|
|
||||||
- /bin/bash
|
|
||||||
- -lc
|
|
||||||
args:
|
|
||||||
- |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
clean_name() {
|
|
||||||
echo "$1" \
|
|
||||||
| tr '[:upper:]' '[:lower:]' \
|
|
||||||
| tr -c 'a-z0-9-' '-' \
|
|
||||||
| sed 's/^-*//;s/-*$//' \
|
|
||||||
| cut -c1-45
|
|
||||||
}
|
|
||||||
|
|
||||||
for NODE_NAME in $(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'); do
|
|
||||||
NODE_CLEAN="$(clean_name "${NODE_NAME}")"
|
|
||||||
JOB_NAME="node-external-ip-${NODE_CLEAN}"
|
|
||||||
|
|
||||||
kubectl delete job "${JOB_NAME}" -n kube-system --ignore-not-found=true --wait=true --timeout=60s
|
|
||||||
|
|
||||||
cat <<EOF | kubectl apply -f -
|
|
||||||
apiVersion: batch/v1
|
|
||||||
kind: Job
|
|
||||||
metadata:
|
|
||||||
name: ${JOB_NAME}
|
|
||||||
namespace: kube-system
|
|
||||||
labels:
|
|
||||||
app: node-external-ip-labeler
|
|
||||||
target-node: "${NODE_CLEAN}"
|
|
||||||
spec:
|
|
||||||
ttlSecondsAfterFinished: 86400
|
|
||||||
backoffLimit: 2
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: node-external-ip-labeler
|
|
||||||
target-node: "${NODE_CLEAN}"
|
|
||||||
spec:
|
|
||||||
serviceAccountName: node-external-ip-labeler
|
|
||||||
nodeName: "${NODE_NAME}"
|
|
||||||
hostNetwork: true
|
|
||||||
dnsPolicy: ClusterFirstWithHostNet
|
|
||||||
restartPolicy: Never
|
|
||||||
tolerations:
|
|
||||||
- operator: Exists
|
|
||||||
containers:
|
|
||||||
- name: label-node
|
|
||||||
image: bitnami/kubectl:latest
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
- name: NODE_NAME
|
|
||||||
value: "${NODE_NAME}"
|
|
||||||
command:
|
|
||||||
- /bin/bash
|
|
||||||
- -lc
|
|
||||||
args:
|
|
||||||
- |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
json_ip() {
|
|
||||||
sed -n 's/.*"ip"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p'
|
|
||||||
}
|
|
||||||
|
|
||||||
IPV4="\$(curl -fsS --connect-timeout 10 --max-time 30 'https://api.ipify.org?format=json' | json_ip)"
|
|
||||||
IP64="\$(curl -fsS --connect-timeout 10 --max-time 30 'https://api64.ipify.org?format=json' | json_ip || true)"
|
|
||||||
|
|
||||||
if [ -z "\${IPV4}" ]; then
|
|
||||||
echo "Unable to detect external IPv4 for node ${NODE_NAME}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
kubectl label node "${NODE_NAME}" external-ipv4="\${IPV4}" --overwrite
|
|
||||||
kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv4="\${IPV4}" --overwrite
|
|
||||||
|
|
||||||
if echo "\${IP64}" | grep -q ':'; then
|
|
||||||
kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv6="\${IP64}" --overwrite
|
|
||||||
elif [ -n "\${IP64}" ]; then
|
|
||||||
kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv4-api64="\${IP64}" --overwrite
|
|
||||||
fi
|
|
||||||
EOF
|
|
||||||
done
|
|
||||||
@@ -60,35 +60,4 @@ oauth2_applications = {
|
|||||||
web_origins = ["https://pet.hexor.cy", "https://xn--l1acako8eb.xn--p1ai", "https://мурняня.рф", ]
|
web_origins = ["https://pet.hexor.cy", "https://xn--l1acako8eb.xn--p1ai", "https://мурняня.рф", ]
|
||||||
post_logout_redirect_uris = ["https://pet.hexor.cy/*", "https://xn--l1acako8eb.xn--p1ai/*", "https://мурняня.рф/*"]
|
post_logout_redirect_uris = ["https://pet.hexor.cy/*", "https://xn--l1acako8eb.xn--p1ai/*", "https://мурняня.рф/*"]
|
||||||
}
|
}
|
||||||
Paperless-ngx = {
|
|
||||||
redirect_uris = ["https://docs.hexor.cy/accounts/oidc/authentik/login/callback/"]
|
|
||||||
web_origins = ["https://docs.hexor.cy"]
|
|
||||||
post_logout_redirect_uris = ["https://docs.hexor.cy/*"]
|
|
||||||
}
|
|
||||||
Immich = {
|
|
||||||
redirect_uris = [
|
|
||||||
"https://photos.hexor.cy/auth/login",
|
|
||||||
"https://photos.hexor.cy/user-settings",
|
|
||||||
"app.immich:///oauth-callback",
|
|
||||||
"http://photos.homenet:30283/auth/login",
|
|
||||||
"http://photos.homenet:30283/user-settings"
|
|
||||||
]
|
|
||||||
web_origins = ["https://photos.hexor.cy", "http://photos.homenet:30283"]
|
|
||||||
post_logout_redirect_uris = ["https://photos.hexor.cy/*", "http://photos.homenet:30283/*"]
|
|
||||||
}
|
|
||||||
HomeAssistant-LMS = {
|
|
||||||
redirect_uris = ["http://ha-lms:8123/auth/oidc/callback", "http://ha-lms.homenet:8123/auth/oidc/callback"]
|
|
||||||
web_origins = ["http://ha-lms:8123", "http://ha-lms.homenet:8123"]
|
|
||||||
post_logout_redirect_uris = ["http://ha-lms:8123/*", "http://ha-lms.homenet:8123/*"]
|
|
||||||
}
|
|
||||||
HomeAssistant-LND = {
|
|
||||||
redirect_uris = ["http://ha-london:8123/auth/oidc/callback", "http://ha-london.tail2fe2d.ts.net:8123/auth/oidc/callback"]
|
|
||||||
web_origins = ["http://ha-london:8123", "http://ha-london.tail2fe2d.ts.net:8123"]
|
|
||||||
post_logout_redirect_uris = ["http://ha-london:8123/*", "http://ha-london.tail2fe2d.ts.net:8123/*"]
|
|
||||||
}
|
|
||||||
Matrix-Chat = {
|
|
||||||
redirect_uris = ["https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A"]
|
|
||||||
web_origins = ["https://auth.matrix.hexor.cy"]
|
|
||||||
post_logout_redirect_uris = ["https://auth.matrix.hexor.cy/*"]
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user