Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-07-30 15:31:25

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -42,7 +42,10 @@ ArgoCD homelab project
 
 | Application | Status |
 | :--- | :---: |
+| **amnezia** | [![amnezia](https://ag.hexor.cy/api/badge?name=amnezia&revision=true)](https://ag.hexor.cy/applications/argocd/amnezia) |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
+| **doka2-lobby-list** | [![doka2-lobby-list](https://ag.hexor.cy/api/badge?name=doka2-lobby-list&revision=true)](https://ag.hexor.cy/applications/argocd/doka2-lobby-list) |
+| **firefly-iii** | [![firefly-iii](https://ag.hexor.cy/api/badge?name=firefly-iii&revision=true)](https://ag.hexor.cy/applications/argocd/firefly-iii) |
 | **furumi** | [![furumi](https://ag.hexor.cy/api/badge?name=furumi&revision=true)](https://ag.hexor.cy/applications/argocd/furumi) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
@@ -53,6 +56,7 @@ ArgoCD homelab project
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
 | **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
+| **llamacpp** | [![llamacpp](https://ag.hexor.cy/api/badge?name=llamacpp&revision=true)](https://ag.hexor.cy/applications/argocd/llamacpp) |
 | **matrix** | [![matrix](https://ag.hexor.cy/api/badge?name=matrix&revision=true)](https://ag.hexor.cy/applications/argocd/matrix) |
 | **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
 | **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |

k8s/apps/amnezia/configmap-scripts.yaml

@@ -10,12 +10,16 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
+    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
+    IPTABLES=(iptables -w 30)
 
     external_interface() {
       ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
     }
 
-    ensure_insert_rule() {
+    ensure_rule() {
+      local mode="$1"
+      shift
       local table_args=()
       if [ "${1:-}" = "-t" ]; then
         table_args=("$1" "$2")
@@ -25,8 +29,8 @@ data:
       local chain="$1"
       shift
 
-      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
+      if ! "${IPTABLES[@]}" "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        iptables "${table_args[@]}" -I "${chain}" 1 "$@"
+        "${IPTABLES[@]}" "${table_args[@]}" "${mode}" "${chain}" "$@"
       fi
     }
 
@@ -40,24 +44,15 @@ data:
       local chain="$1"
       shift
 
-      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
         true
       done
     }
 
-    ensure_append_rule() {
+    reset_chain() {
-      local table_args=()
-      if [ "${1:-}" = "-t" ]; then
-        table_args=("$1" "$2")
-        shift 2
-      fi
-
       local chain="$1"
-      shift
+      "${IPTABLES[@]}" -N "${chain}" >/dev/null 2>&1 || true
-
+      "${IPTABLES[@]}" -F "${chain}"
-      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        iptables "${table_args[@]}" -A "${chain}" "$@"
-      fi
     }
 
     EXT_IF="$(external_interface || true)"
@@ -71,13 +66,28 @@ data:
 
     sysctl -w net.ipv4.ip_forward=1
 
+    # Remove rules written by older revisions. In particular, the unqualified
+    # tailscale UDP DROP also blocks Flannel VXLAN (UDP/8472).
     delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
-    ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
-    ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
-    ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
+    delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
-    ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
-    ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
+    delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
+    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
+
+    reset_chain "${FORWARD_CHAIN}"
+    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -j RETURN
+    ensure_rule -A FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
+
+    ensure_rule -A -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
+
+    /scripts/firewall-check.sh "${PORT}" "${VPN_CIDR}"
 
   firewall-down.sh: |
     #!/usr/bin/env bash
@@ -85,6 +95,8 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
+    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
+    IPTABLES=(iptables -w 30)
 
     external_interface() {
       ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
@@ -100,7 +112,7 @@ data:
       local chain="$1"
       shift
 
-      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
         true
       done
     }
@@ -111,6 +123,7 @@ data:
     fi
 
     if [ -n "${EXT_IF}" ]; then
+      delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
       delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
       delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
     fi
@@ -120,14 +133,66 @@ data:
     delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
     delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
     delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
+    delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
+
+    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
+
+  firewall-check.sh: |
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    PORT="${1:-5847}"
+    VPN_CIDR="${2:-10.8.0.0/16}"
+    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
+    IPTABLES=(iptables -w 5)
+
+    external_interface() {
+      ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
+    }
+
+    EXT_IF="$(external_interface || true)"
+    if [ -z "${EXT_IF}" ]; then
+      EXT_IF="$(ip route show default | awk '{print $5; exit}')"
+    fi
+    if [ -z "${EXT_IF}" ]; then
+      echo "Unable to detect external interface" >&2
+      exit 1
+    fi
+
+    if "${IPTABLES[@]}" -C INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP >/dev/null 2>&1; then
+      echo "Unsafe broad UDP DROP on tailscale0 is present" >&2
+      exit 1
+    fi
+    if "${IPTABLES[@]}" -C INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT >/dev/null 2>&1; then
+      echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
+      exit 1
+    fi
+    if "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT >/dev/null 2>&1; then
+      echo "Unexpected AmneziaWG INPUT chain is present" >&2
+      exit 1
+    fi
+
+    "${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
+    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+
+    "${IPTABLES[@]}" -t nat -C POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
+    awg show awg0 >/dev/null 2>&1
 
   run.sh: |
     #!/usr/bin/env bash
     set -euo pipefail
 
     SERVER_CONFIG="/etc/amnezia/server/awg0.conf"
-    CLIENTS_DIR="/etc/amnezia/clients"
+    CLIENTS_DIR="${AMNEZIAWG_CLIENTS_DIR:-/run/amnezia/clients}"
     RUNTIME_CONFIG="/run/amnezia/awg0.conf"
+    SYNC_CONFIG="/run/amnezia/awg0.sync.conf"
+    STATUS_FILE="/run/amnezia/reload-status"
+    RELOAD_INTERVAL="${AMNEZIAWG_RELOAD_INTERVAL:-10}"
 
     cleanup() {
       if awg show awg0 >/dev/null 2>&1; then
@@ -137,32 +202,181 @@ data:
 
     render_config() {
       mkdir -p "$(dirname "${RUNTIME_CONFIG}")"
-      cp "${SERVER_CONFIG}" "${RUNTIME_CONFIG}"
+      local tmp_config="${RUNTIME_CONFIG}.tmp"
-      chmod 0600 "${RUNTIME_CONFIG}"
+      cp "${SERVER_CONFIG}" "${tmp_config}"
+      chmod 0600 "${tmp_config}"
 
       local clients_found=0
       for client_config in "${CLIENTS_DIR}"/*; do
         [ -f "${client_config}" ] || continue
         [ -s "${client_config}" ] || continue
-        printf '\n' >> "${RUNTIME_CONFIG}"
+        printf '\n' >> "${tmp_config}"
-        cat "${client_config}" >> "${RUNTIME_CONFIG}"
+        cat "${client_config}" >> "${tmp_config}"
         clients_found=1
       done
 
       if [ "${clients_found}" = "0" ]; then
         echo "No client peer configs found in ${CLIENTS_DIR}; starting without peers"
       fi
+
+      mv "${tmp_config}" "${RUNTIME_CONFIG}"
+      chmod 0600 "${RUNTIME_CONFIG}"
+    }
+
+    client_config_hash() {
+      {
+        for client_config in "${CLIENTS_DIR}"/*; do
+          [ -f "${client_config}" ] || continue
+          sha256sum "${client_config}"
+        done
+      } | sha256sum | awk '{print $1}'
+    }
+
+    write_reload_status() {
+      local state="${1}"
+      local hash="${2:-}"
+      local applied_at_ms=""
+      if [ "${state}" = "applied" ]; then
+        applied_at_ms="$(($(date +%s) * 1000))"
+      fi
+
+      mkdir -p "$(dirname "${STATUS_FILE}")"
+      {
+        printf 'state=%s\n' "${state}"
+        printf 'hash=%s\n' "${hash}"
+        printf 'applied_at_ms=%s\n' "${applied_at_ms}"
+      } > "${STATUS_FILE}.tmp"
+      mv "${STATUS_FILE}.tmp" "${STATUS_FILE}"
+    }
+
+    apply_live_config() {
+      render_config
+      awg-quick strip "${RUNTIME_CONFIG}" > "${SYNC_CONFIG}"
+      chmod 0600 "${SYNC_CONFIG}"
+      awg syncconf awg0 "${SYNC_CONFIG}"
+    }
+
+    watch_client_config() {
+      local last_hash="${1}"
+      while true; do
+        sleep "${RELOAD_INTERVAL}" &
+        wait "$!" || return 0
+
+        local current_hash
+        current_hash="$(client_config_hash)"
+        if [ "${current_hash}" = "${last_hash}" ]; then
+          continue
+        fi
+
+        echo "Detected AmneziaWG client peer config change; applying with awg syncconf"
+        if apply_live_config; then
+          last_hash="${current_hash}"
+          write_reload_status applied "${current_hash}"
+          awg show awg0 || true
+        else
+          echo "ERROR: failed to hot-reload AmneziaWG client peer config" >&2
+          write_reload_status error "${current_hash}"
+        fi
+      done
     }
 
     trap cleanup EXIT
     trap 'exit 0' TERM INT
 
+    initial_hash="$(client_config_hash)"
     render_config
     cleanup
     awg-quick up "${RUNTIME_CONFIG}"
     awg show awg0 || true
+    write_reload_status applied "${initial_hash}"
+    watch_client_config "${initial_hash}"
+
+  client-secret-sync.sh: |
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    CLIENT_SECRET="${AMNEZIAWG_CLIENT_SECRET:-amneziawg-clients}"
+    CLIENT_SECRET_KEY="${AMNEZIAWG_CLIENT_SECRET_KEY:-peers.conf}"
+    CLIENTS_DIR="${AMNEZIAWG_CLIENTS_DIR:-/run/amnezia/clients}"
+    PEERS_FILE="${CLIENTS_DIR}/peers.conf"
+    SYNC_INTERVAL="${AMNEZIAWG_CLIENT_SECRET_SYNC_INTERVAL:-5}"
+    NAMESPACE="${POD_NAMESPACE:-$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)}"
+
+    write_empty_once() {
+      mkdir -p "${CLIENTS_DIR}"
+      if [ ! -f "${PEERS_FILE}" ]; then
+        : > "${PEERS_FILE}"
+        chmod 0600 "${PEERS_FILE}"
+      fi
+    }
+
+    sync_once() {
+      mkdir -p "${CLIENTS_DIR}"
+      local tmp_file="${PEERS_FILE}.tmp"
+      local encoded=""
+
+      if ! encoded="$(kubectl get secret "${CLIENT_SECRET}" -n "${NAMESPACE}" -o "go-template={{ index .data \"${CLIENT_SECRET_KEY}\" }}" 2>/dev/null)"; then
+        echo "WARN: failed to read Secret ${NAMESPACE}/${CLIENT_SECRET}; keeping current peers" >&2
+        write_empty_once
+        return 0
+      fi
+
+      if [ -n "${encoded}" ]; then
+        printf '%s' "${encoded}" | base64 -d > "${tmp_file}"
+      else
+        : > "${tmp_file}"
+      fi
+      chmod 0600 "${tmp_file}"
+
+      if [ -f "${PEERS_FILE}" ] && cmp -s "${tmp_file}" "${PEERS_FILE}"; then
+        rm -f "${tmp_file}"
+        return 0
+      fi
+
+      mv "${tmp_file}" "${PEERS_FILE}"
+      echo "Synced AmneziaWG client peers from Secret ${NAMESPACE}/${CLIENT_SECRET}:${CLIENT_SECRET_KEY}"
+    }
+
+    if [ "${1:-}" = "once" ]; then
+      sync_once
+      exit 0
+    fi
 
     while true; do
-      sleep 3600 &
+      sync_once || true
-      wait "$!"
+      sleep "${SYNC_INTERVAL}"
+    done
+
+  status-patch.sh: |
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    STATUS_FILE="/run/amnezia/reload-status"
+    PATCH_INTERVAL="${AMNEZIAWG_STATUS_PATCH_INTERVAL:-5}"
+    NAMESPACE="${POD_NAMESPACE:-$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)}"
+    : "${POD_NAME:?POD_NAME is required}"
+
+    last_file_hash=""
+
+    patch_status() {
+      local state="unknown"
+      local hash=""
+      local applied_at_ms=""
+
+      # The file is generated by run.sh and contains only shell assignments.
+      # shellcheck disable=SC1090
+      source "${STATUS_FILE}"
+
+      kubectl patch pod "${POD_NAME}" -n "${NAMESPACE}" --type merge -p "{\"metadata\":{\"annotations\":{\"amnezia-fellow.hexor.cy/client-secret-reload-status\":\"${state}\",\"amnezia-fellow.hexor.cy/client-secret-applied-at-ms\":\"${applied_at_ms}\",\"amnezia-fellow.hexor.cy/client-secret-applied-hash\":\"${hash}\"}}}"
+    }
+
+    while true; do
+      if [ -f "${STATUS_FILE}" ]; then
+        file_hash="$(sha256sum "${STATUS_FILE}" | awk '{print $1}')"
+        if [ "${file_hash}" != "${last_file_hash}" ]; then
+          patch_status || true
+          last_file_hash="${file_hash}"
+        fi
+      fi
+      sleep "${PATCH_INTERVAL}"
     done

k8s/apps/amnezia/daemonset.yaml

@@ -6,8 +6,9 @@ metadata:
   labels:
     app: amneziawg
   annotations:
-    reloader.stakater.com/auto: "true"
+    reloader.stakater.com/auto: "false"
-    secret.reloader.stakater.com/reload: "amneziawg-server,amneziawg-clients"
+    secret.reloader.stakater.com/reload: "amneziawg-server"
+    configmap.reloader.stakater.com/reload: "amneziawg-scripts,amneziawg-exporter-redis"
 spec:
   selector:
     matchLabels:
@@ -27,6 +28,21 @@ spec:
       tolerations:
         - operator: Exists
       initContainers:
+        - name: install-awg
+          image: amneziavpn/amneziawg-go:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/bash
+            - -lc
+            - |
+              set -euo pipefail
+              cp /usr/bin/awg /shared-bin/awg
+              cp /lib/ld-musl-x86_64.so.1 /shared-bin/ld-musl-x86_64.so.1
+              cp /lib/ld-musl-x86_64.so.1 /shared-bin/libc.musl-x86_64.so.1
+              chmod 0755 /shared-bin/awg /shared-bin/ld-musl-x86_64.so.1 /shared-bin/libc.musl-x86_64.so.1
+          volumeMounts:
+            - name: awg-bin
+              mountPath: /shared-bin
         - name: register-endpoint
           image: bitnami/kubectl:latest
           imagePullPolicy: IfNotPresent
@@ -65,6 +81,26 @@ spec:
                 kubectl create secret generic amneziawg-endpoints -n "${NAMESPACE}" \
                   --from-literal="${NODE_NAME}=${VALUE}"
               fi
+        - name: sync-client-secret
+          image: bitnami/kubectl:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/bash
+            - /scripts/client-secret-sync.sh
+            - once
+          resources:
+            requests:
+              memory: "32Mi"
+              cpu: "10m"
+            limits:
+              memory: "128Mi"
+              cpu: "100m"
+          volumeMounts:
+            - name: scripts
+              mountPath: /scripts
+              readOnly: true
+            - name: runtime-config
+              mountPath: /run/amnezia
       containers:
         - name: amneziawg
           image: amneziavpn/amneziawg-go:latest
@@ -87,20 +123,29 @@ spec:
               command:
                 - /bin/bash
                 - -lc
-                - awg show awg0 >/dev/null 2>&1
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16
             initialDelaySeconds: 5
             periodSeconds: 10
-            timeoutSeconds: 3
+            timeoutSeconds: 8
-            failureThreshold: 3
+            failureThreshold: 2
+          startupProbe:
+            exec:
+              command:
+                - /bin/bash
+                - -lc
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
+            periodSeconds: 5
+            timeoutSeconds: 15
+            failureThreshold: 12
           livenessProbe:
             exec:
               command:
                 - /bin/bash
                 - -lc
-                - awg show awg0 >/dev/null 2>&1
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
             initialDelaySeconds: 30
             periodSeconds: 30
-            timeoutSeconds: 5
+            timeoutSeconds: 15
             failureThreshold: 3
           resources:
             requests:
@@ -113,9 +158,6 @@ spec:
             - name: server-config
               mountPath: /etc/amnezia/server
               readOnly: true
-            - name: client-config
-              mountPath: /etc/amnezia/clients
-              readOnly: true
             - name: scripts
               mountPath: /scripts
               readOnly: true
@@ -123,6 +165,108 @@ spec:
               mountPath: /run/amnezia
             - name: dev-net-tun
               mountPath: /dev/net/tun
+        - name: reload-status
+          image: bitnami/kubectl:latest
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          command:
+            - /bin/bash
+            - /scripts/status-patch.sh
+          resources:
+            requests:
+              memory: "32Mi"
+              cpu: "10m"
+            limits:
+              memory: "128Mi"
+              cpu: "100m"
+          volumeMounts:
+            - name: scripts
+              mountPath: /scripts
+              readOnly: true
+            - name: runtime-config
+              mountPath: /run/amnezia
+        - name: client-secret-sync
+          image: bitnami/kubectl:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/bash
+            - /scripts/client-secret-sync.sh
+          resources:
+            requests:
+              memory: "32Mi"
+              cpu: "10m"
+            limits:
+              memory: "128Mi"
+              cpu: "100m"
+          volumeMounts:
+            - name: scripts
+              mountPath: /scripts
+              readOnly: true
+            - name: runtime-config
+              mountPath: /run/amnezia
+        - name: amneziawg-exporter-redis
+          image: redis:alpine
+          imagePullPolicy: IfNotPresent
+          command:
+            - redis-server
+            - /etc/redis/redis.conf
+          ports:
+            - name: redis
+              containerPort: 6379
+              protocol: TCP
+          resources:
+            requests:
+              memory: "32Mi"
+              cpu: "10m"
+            limits:
+              memory: "128Mi"
+              cpu: "100m"
+          volumeMounts:
+            - name: exporter-redis-config
+              mountPath: /etc/redis
+              readOnly: true
+            - name: exporter-redis-data
+              mountPath: /data
+        - name: amneziawg-exporter
+          image: amneziavpn/amneziawg-exporter:latest
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+          env:
+            - name: AWG_EXPORTER_REDIS_HOST
+              value: "127.0.0.1"
+            - name: AWG_EXPORTER_REDIS_PORT
+              value: "6379"
+          ports:
+            - name: metrics
+              containerPort: 9351
+              protocol: TCP
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "25m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+          volumeMounts:
+            - name: awg-bin
+              mountPath: /usr/bin/awg
+              subPath: awg
+              readOnly: true
+            - name: awg-bin
+              mountPath: /lib/ld-musl-x86_64.so.1
+              subPath: ld-musl-x86_64.so.1
+              readOnly: true
+            - name: awg-bin
+              mountPath: /lib/libc.musl-x86_64.so.1
+              subPath: libc.musl-x86_64.so.1
+              readOnly: true
       volumes:
         - name: server-config
           secret:
@@ -131,17 +275,19 @@ spec:
             items:
               - key: awg0.conf
                 path: awg0.conf
-        - name: client-config
-          secret:
-            secretName: amneziawg-clients
-            optional: true
-            defaultMode: 0600
         - name: scripts
           configMap:
             name: amneziawg-scripts
             defaultMode: 0755
         - name: runtime-config
           emptyDir: {}
+        - name: awg-bin
+          emptyDir: {}
+        - name: exporter-redis-config
+          configMap:
+            name: amneziawg-exporter-redis
+        - name: exporter-redis-data
+          emptyDir: {}
         - name: dev-net-tun
           hostPath:
             path: /dev/net/tun

k8s/apps/amnezia/exporter-redis-configmap.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: amneziawg-exporter-redis
+  labels:
+    app: amneziawg
+    component: exporter
+data:
+  redis.conf: |
+    bind 127.0.0.1
+    protected-mode yes
+    port 6379
+    tcp-backlog 511
+    timeout 0
+    tcp-keepalive 300
+    daemonize no
+    pidfile /run/redis.pid
+    loglevel warning
+    logfile ""
+    databases 16
+    always-show-logo no
+    set-proc-title no
+    save ""
+    appendonly no
+    stop-writes-on-bgsave-error no
+    rdbcompression yes
+    rdbchecksum yes
+    dir /data
+    rename-command CONFIG ""
+    rename-command SAVE ""
+    rename-command BGSAVE ""

k8s/apps/amnezia/exporter-service.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: amneziawg-exporter
+  labels:
+    app: amneziawg
+    component: exporter
+spec:
+  type: ClusterIP
+  selector:
+    app: amneziawg
+  ports:
+    - name: metrics
+      protocol: TCP
+      port: 9351
+      targetPort: 9351

k8s/apps/amnezia/external-secrets.yaml

@@ -48,3 +48,32 @@ spec:
       remoteRef:
         key: 3092dc7c-41dd-461a-9f7a-377727f47e93
         property: fields[1].value
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: amnezia-fellow
+spec:
+  target:
+    name: amnezia-fellow
+    deletionPolicy: Delete
+    template:
+      engineVersion: v2
+      type: Opaque
+      data:
+        database-url: |-
+          postgresql://amnezia_fellow:{{ .amnezia_fellow | urlquery }}@psql.psql.svc:5432/amnezia_fellow
+        postgres-password: |-
+          {{ .amnezia_fellow }}
+  data:
+    - secretKey: amnezia_fellow
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[19].value

k8s/apps/amnezia/fellow-deployment.yaml

@@ -0,0 +1,72 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: amnezia-fellow
+  labels:
+    app: amnezia-fellow
+  annotations:
+    secret.reloader.stakater.com/reload: "amnezia-fellow"
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: amnezia-fellow
+  template:
+    metadata:
+      labels:
+        app: amnezia-fellow
+    spec:
+      serviceAccountName: amnezia-fellow
+      nodeSelector:
+        kubernetes.io/os: linux
+        kubernetes.io/hostname: cy.tail2fe2d.ts.net
+      containers:
+        - name: amnezia-fellow
+          image: ultradesu/amnezia-fellow:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 8000
+              protocol: TCP
+          env:
+            - name: AMNEZIA_FELLOW_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: amnezia-fellow
+                  key: database-url
+            - name: AMNEZIA_FELLOW_K8S_NAMESPACE
+              value: "amnezia"
+            - name: AMNEZIA_FELLOW_K8S_CLIENTS_SECRET
+              value: "amneziawg-clients"
+            - name: AMNEZIA_FELLOW_K8S_CLIENTS_SECRET_KEY
+              value: "peers.conf"
+            - name: AMNEZIA_FELLOW_K8S_SERVER_SECRET
+              value: "amneziawg-server"
+            - name: AMNEZIA_FELLOW_K8S_ENDPOINTS_SECRET
+              value: "amneziawg-endpoints"
+            - name: AMNEZIA_FELLOW_VPN_CLIENT_CIDR
+              value: "10.8.0.0/16"
+            - name: AMNEZIA_FELLOW_VPN_MTU
+              value: "1376"
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: "50m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"

k8s/apps/amnezia/fellow-ingress.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: amnezia-fellow-tls-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: awg.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: amnezia-fellow
+                port:
+                  number: 8000
+  tls:
+    - secretName: amnezia-fellow-tls
+      hosts:
+        - awg.hexor.cy

k8s/apps/amnezia/fellow-rbac.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: amnezia-fellow
+  labels:
+    app: amnezia-fellow
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: amnezia-fellow
+  labels:
+    app: amnezia-fellow
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: amnezia-fellow
+  labels:
+    app: amnezia-fellow
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: amnezia-fellow
+subjects:
+  - kind: ServiceAccount
+    name: amnezia-fellow

k8s/apps/amnezia/fellow-service.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: amnezia-fellow
+  labels:
+    app: amnezia-fellow
+spec:
+  type: ClusterIP
+  selector:
+    app: amnezia-fellow
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8000
+      targetPort: 8000

k8s/apps/amnezia/fellow-storage.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: amnezia-fellow-data
+  labels:
+    app: amnezia-fellow
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 3Gi

k8s/apps/amnezia/kustomization.yaml

@@ -7,4 +7,12 @@ resources:
   - external-secrets.yaml
   - configmap-scripts.yaml
   - rbac.yaml
+  - fellow-rbac.yaml
+  - fellow-storage.yaml
+  - fellow-service.yaml
+  - fellow-ingress.yaml
+  - fellow-deployment.yaml
+  - exporter-redis-configmap.yaml
+  - exporter-service.yaml
+  - servicemonitor.yaml
   - daemonset.yaml

k8s/apps/amnezia/rbac.yaml

@@ -42,6 +42,9 @@ rules:
   - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["get", "create", "patch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

k8s/apps/amnezia/servicemonitor.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: amneziawg-exporter
+  labels:
+    app: amneziawg
+    component: exporter
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      app: amneziawg
+      component: exporter
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      honorLabels: true
+  namespaceSelector:
+    matchNames:
+      - amnezia

k8s/apps/doka2-lobby-list/app.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: doka2-lobby-list
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: doka2-lobby-list
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/doka2-lobby-list
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true

k8s/apps/doka2-lobby-list/deployment.yaml

@@ -0,0 +1,54 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: doka2-lobby-list
+  labels:
+    app: doka2-lobby-list
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: doka2-lobby-list
+  template:
+    metadata:
+      labels:
+        app: doka2-lobby-list
+    spec:
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+      volumes:
+        - name: creds
+          persistentVolumeClaim:
+            claimName: doka2-lobby-list-creds
+      containers:
+        - name: doka2-lobby-list
+          image: ultradesu/doka2-lobby-list:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: doka2-lobby-list-secrets
+                  key: ADMIN_PASSWORD
+            - name: CREDS_DIR
+              value: /data
+          volumeMounts:
+            - name: creds
+              mountPath: /data
+          resources:
+            requests:
+              cpu: "50m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"

k8s/apps/doka2-lobby-list/external-secrets.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: doka2-lobby-list-secrets
+spec:
+  target:
+    name: doka2-lobby-list-secrets
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        ADMIN_PASSWORD: |-
+          {{ .admin_password | trim }}
+  data:
+    - secretKey: admin_password
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: af4618dd-6431-4b20-b617-c00bae9ceff6
+        property: login.password

k8s/apps/doka2-lobby-list/ingress.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: doka2-lobby-list-tls-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: doka.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: doka2-lobby-list
+                port:
+                  number: 80
+  tls:
+    - secretName: doka2-lobby-list-tls
+      hosts:
+        - doka.hexor.cy

k8s/apps/doka2-lobby-list/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - deployment.yaml
+  - external-secrets.yaml
+  - service.yaml
+  - ingress.yaml
+  - storage.yaml

k8s/apps/doka2-lobby-list/service.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: doka2-lobby-list
+  labels:
+    app: doka2-lobby-list
+spec:
+  type: ClusterIP
+  selector:
+    app: doka2-lobby-list
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http

k8s/apps/doka2-lobby-list/storage.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: doka2-lobby-list-creds
+  labels:
+    app: doka2-lobby-list
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi

k8s/apps/firefly-iii/app.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: firefly-iii
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: firefly-iii
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/firefly-iii
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+

k8s/apps/firefly-iii/data-importer-ingress.yaml

@@ -0,0 +1,53 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: firefly-data-importer-auth
+spec:
+  forwardAuth:
+    address: http://auth-proxy.auth-proxy.svc:80/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-Auth-Request-User
+      - X-Auth-Request-Email
+      - X-Auth-Request-Groups
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: firefly-data-importer
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # OAuth callback is intentionally public. Data Importer validates both the
+    # state parameter and its browser session before exchanging the code.
+    - match: Host(`import.hexor.cy`) && Path(`/eb-callback`)
+      kind: Rule
+      priority: 200
+      services:
+        - name: firefly-data-importer
+          port: 80
+    # Everything else requires a valid auth-proxy session and group.
+    - match: Host(`import.hexor.cy`)
+      kind: Rule
+      priority: 100
+      middlewares:
+        - name: firefly-data-importer-auth
+      services:
+        - name: firefly-data-importer
+          port: 80
+  tls:
+    secretName: firefly-data-importer-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: firefly-data-importer-tls
+spec:
+  secretName: firefly-data-importer-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - import.hexor.cy
+

k8s/apps/firefly-iii/data-importer.yaml

@@ -0,0 +1,105 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: firefly-data-importer
+  labels:
+    app.kubernetes.io/name: firefly-data-importer
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: firefly-data-importer
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: firefly-data-importer
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: ai.tail2fe2d.ts.net
+      tolerations:
+        - key: workload
+          operator: Equal
+          value: ai
+          effect: NoSchedule
+      containers:
+        - name: data-importer
+          image: fireflyiii/data-importer:version-2.3.4
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: FIREFLY_III_URL
+              value: http://firefly-iii
+            - name: VANITY_URL
+              value: http://ff.lan
+            - name: TRUSTED_PROXIES
+              value: "**"
+            - name: EXPECT_SECURE_URL
+              value: "false"
+            - name: VERIFY_TLS_SECURITY
+              value: "true"
+            - name: TZ
+              value: Europe/London
+            - name: APP_ENV
+              value: production
+            - name: APP_DEBUG
+              value: "false"
+            - name: LOG_LEVEL
+              value: notice
+            - name: ENABLE_BANKING_APP_ID
+              valueFrom:
+                secretKeyRef:
+                  name: firefly-data-importer-secrets
+                  key: ENABLE_BANKING_APP_ID
+            - name: ENABLE_BANKING_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: firefly-data-importer-secrets
+                  key: ENABLE_BANKING_PRIVATE_KEY
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: firefly-data-importer
+  labels:
+    app.kubernetes.io/name: firefly-data-importer
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: firefly-data-importer
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP

k8s/apps/firefly-iii/external-secrets.yaml

@@ -0,0 +1,85 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: firefly-secrets
+spec:
+  refreshInterval: 1h
+  target:
+    name: firefly-secrets
+    creationPolicy: Owner
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # Firefly and CloudNativePG deliberately share this generated Secret.
+        username: firefly
+        password: |-
+          {{ .db_password }}
+        DB_PASSWORD: |-
+          {{ .db_password }}
+        APP_KEY: |-
+          {{ .app_key }}
+        STATIC_CRON_TOKEN: |-
+          {{ .cron_token }}
+  data:
+    - secretKey: db_password
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: a1867c81-715c-47cd-978d-14ea5bcedea9
+        property: fields[0].value
+    - secretKey: app_key
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: a1867c81-715c-47cd-978d-14ea5bcedea9
+        property: fields[1].value
+    - secretKey: cron_token
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: a1867c81-715c-47cd-978d-14ea5bcedea9
+        property: fields[2].value
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: firefly-data-importer-secrets
+spec:
+  refreshInterval: 1h
+  target:
+    name: firefly-data-importer-secrets
+    creationPolicy: Owner
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        ENABLE_BANKING_APP_ID: |-
+          {{ .app_id }}
+        ENABLE_BANKING_PRIVATE_KEY: |-
+          -----BEGIN PRIVATE KEY-----
+          {{ .private_key | replace "-----BEGIN PRIVATE KEY-----" "" | replace "-----END PRIVATE KEY-----" "" | replace " " "" | trim }}
+          -----END PRIVATE KEY-----
+  data:
+    - secretKey: app_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: a1867c81-715c-47cd-978d-14ea5bcedea9
+        property: fields[3].value
+    - secretKey: private_key
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: a1867c81-715c-47cd-978d-14ea5bcedea9
+        property: fields[4].value

k8s/apps/firefly-iii/kustomization.yaml

@@ -0,0 +1,101 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - data-importer.yaml
+  - data-importer-ingress.yaml
+  - external-secrets.yaml
+  - postgres.yaml
+  - storage.yaml
+  - storage-prep.yaml
+  - traefik-ai.yaml
+  - network-policy.yaml
+
+helmCharts:
+  - name: firefly-iii
+    repo: https://harish2k01.github.io/helm-charts
+    version: 0.1.2
+    releaseName: firefly-iii
+    namespace: firefly-iii
+    valuesFile: values.yaml
+    includeCRDs: true
+
+patches:
+  # Chart 0.1.2 requires postgres.enabled=true. Remove its StatefulSet and
+  # make the generated database Service select the CloudNativePG instance.
+  - target:
+      group: apps
+      version: v1
+      kind: StatefulSet
+      name: firefly-iii-postgres
+    patch: |-
+      $patch: delete
+      apiVersion: apps/v1
+      kind: StatefulSet
+      metadata:
+        name: firefly-iii-postgres
+  - target:
+      version: v1
+      kind: Service
+      name: firefly-iii-postgres
+    patch: |-
+      - op: replace
+        path: /spec/selector
+        value:
+          cnpg.io/cluster: firefly-postgres
+  # The upstream chart does not expose scheduling settings for its CronJob.
+  - target:
+      group: batch
+      version: v1
+      kind: CronJob
+      name: firefly-iii-cron
+    patch: |-
+      - op: add
+        path: /spec/concurrencyPolicy
+        value: Forbid
+      - op: add
+        path: /spec/jobTemplate/spec/backoffLimit
+        value: 1
+      - op: add
+        path: /spec/jobTemplate/spec/activeDeadlineSeconds
+        value: 600
+      - op: add
+        path: /spec/jobTemplate/spec/template/spec/nodeSelector
+        value:
+          kubernetes.io/hostname: ai.tail2fe2d.ts.net
+      - op: add
+        path: /spec/jobTemplate/spec/template/spec/tolerations
+        value:
+          - key: workload
+            operator: Equal
+            value: ai
+            effect: NoSchedule
+      - op: replace
+        path: /spec/jobTemplate/spec/template/spec/containers/0/command
+        value:
+          - /bin/sh
+          - -ec
+          - >-
+            curl --fail --silent --show-error
+            --retry 30 --retry-delay 10 --retry-all-errors
+            --connect-timeout 5 --max-time 30
+            "http://firefly-iii:80/api/v1/cron/${STATIC_CRON_TOKEN}"
+  # A second independent filter in addition to ingressClassName.
+  - target:
+      group: networking.k8s.io
+      version: v1
+      kind: Ingress
+      name: firefly-iii
+    patch: |-
+      - op: add
+        path: /metadata/labels/firefly.hexor.cy~1private-ai
+        value: "true"
+      # The shared Traefik has the same controller identifier and can discover
+      # IngressClass objects. The explicit annotation partitions this Ingress
+      # so only the instance configured with ingressclass=traefik-ai accepts it.
+      - op: add
+        path: /metadata/annotations/kubernetes.io~1ingress.class
+        value: traefik-ai
+      - op: remove
+        path: /spec/ingressClassName

k8s/apps/firefly-iii/network-policy.yaml

@@ -0,0 +1,98 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: firefly-ingress
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: firefly-iii
+      app.kubernetes.io/name: firefly-iii
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik-ai
+        # The chart's CronJob uses the same selector labels as the application.
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: firefly-iii
+              app.kubernetes.io/name: firefly-iii
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: firefly-data-importer
+        # hostNetwork traffic is seen as node traffic rather than Pod traffic.
+        - ipBlock:
+            cidr: 192.168.1.117/32
+        - ipBlock:
+            cidr: 100.77.155.120/32
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: firefly-postgres-ingress
+spec:
+  podSelector:
+    matchLabels:
+      cnpg.io/cluster: firefly-postgres
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: firefly-iii
+              app.kubernetes.io/name: firefly-iii
+        - podSelector:
+            matchLabels:
+              cnpg.io/cluster: firefly-postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+    # CloudNativePG operator health/status traffic to the instance manager.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: psql
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: cloudnative-pg
+      ports:
+        - protocol: TCP
+          port: 8000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: firefly-data-importer-ingress
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: firefly-data-importer
+  policyTypes:
+    - Ingress
+  ingress:
+    # Shared Traefik serves the public HTTPS importer.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+    # Keep node traffic allowed for probes and local diagnostics.
+    - from:
+        - ipBlock:
+            cidr: 192.168.1.117/32
+        - ipBlock:
+            cidr: 100.77.155.120/32
+      ports:
+        - protocol: TCP
+          port: 8080

k8s/apps/firefly-iii/postgres.yaml

@@ -0,0 +1,49 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: firefly-postgres
+spec:
+  description: PostgreSQL for Firefly III
+  instances: 1
+  enableSuperuserAccess: false
+  primaryUpdateStrategy: unsupervised
+  bootstrap:
+    initdb:
+      database: firefly
+      owner: firefly
+      secret:
+        name: firefly-secrets
+      dataChecksums: true
+  storage:
+    size: 10Gi
+    storageClass: firefly-local
+    pvcTemplate:
+      accessModes:
+        - ReadWriteOnce
+      storageClassName: firefly-local
+      selector:
+        matchLabels:
+          app.kubernetes.io/name: firefly-postgres
+      resources:
+        requests:
+          storage: 10Gi
+      volumeMode: Filesystem
+  affinity:
+    enablePodAntiAffinity: false
+    nodeSelector:
+      kubernetes.io/hostname: ai.tail2fe2d.ts.net
+    tolerations:
+      - key: workload
+        operator: Equal
+        value: ai
+        effect: NoSchedule
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi
+  monitoring:
+    enablePodMonitor: true
+

k8s/apps/firefly-iii/storage-prep.yaml

@@ -0,0 +1,52 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: firefly-storage-prep
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: firefly-storage-prep
+    spec:
+      restartPolicy: OnFailure
+      nodeSelector:
+        kubernetes.io/hostname: ai.tail2fe2d.ts.net
+      tolerations:
+        - key: workload
+          operator: Equal
+          value: ai
+          effect: NoSchedule
+      containers:
+        - name: prepare
+          image: busybox:1.37.0
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              mkdir -p /host/k8s/firefly-iii/postgres
+              chown 26:26 /host/k8s/firefly-iii/postgres
+              chmod 0700 /host/k8s/firefly-iii/postgres
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - CHOWN
+                - DAC_OVERRIDE
+                - FOWNER
+          volumeMounts:
+            - name: host-root
+              mountPath: /host/k8s/firefly-iii
+      volumes:
+        - name: host-root
+          hostPath:
+            path: /k8s/firefly-iii
+            type: DirectoryOrCreate

k8s/apps/firefly-iii/storage.yaml

@@ -0,0 +1,72 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: firefly-local
+provisioner: kubernetes.io/no-provisioner
+reclaimPolicy: Retain
+volumeBindingMode: WaitForFirstConsumer
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: firefly-postgres
+  labels:
+    app.kubernetes.io/name: firefly-postgres
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: firefly-local
+  volumeMode: Filesystem
+  hostPath:
+    path: /k8s/firefly-iii/postgres
+    type: DirectoryOrCreate
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - ai.tail2fe2d.ts.net
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: firefly-uploads
+  labels:
+    app.kubernetes.io/name: firefly-uploads
+spec:
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: firefly-local
+  volumeMode: Filesystem
+  hostPath:
+    path: /k8s/firefly-iii/uploads
+    type: DirectoryOrCreate
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - ai.tail2fe2d.ts.net
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: firefly-uploads
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: firefly-local
+  volumeName: firefly-uploads
+  resources:
+    requests:
+      storage: 5Gi

k8s/apps/firefly-iii/traefik-ai.yaml

@@ -0,0 +1,175 @@
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  name: traefik-ai
+spec:
+  controller: traefik.io/ingress-controller
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik-ai
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: traefik-ai
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - secrets
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: traefik-ai
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: traefik-ai
+subjects:
+  - kind: ServiceAccount
+    name: traefik-ai
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: firefly-traefik-ai
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingressclasses
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: firefly-traefik-ai
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: firefly-traefik-ai
+subjects:
+  - kind: ServiceAccount
+    name: traefik-ai
+    namespace: firefly-iii
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik-ai
+  labels:
+    app.kubernetes.io/name: traefik-ai
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: traefik-ai
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: traefik-ai
+    spec:
+      serviceAccountName: traefik-ai
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      nodeSelector:
+        kubernetes.io/hostname: ai.tail2fe2d.ts.net
+      tolerations:
+        - key: workload
+          operator: Equal
+          value: ai
+          effect: NoSchedule
+      containers:
+        - name: traefik
+          image: rancher/mirrored-library-traefik:3.6.13
+          imagePullPolicy: IfNotPresent
+          args:
+            - --entrypoints.web.address=192.168.1.117:80
+            - --providers.kubernetesingress=true
+            - --providers.kubernetesingress.namespaces=firefly-iii
+            - --providers.kubernetesingress.ingressclass=traefik-ai
+            - --providers.kubernetesingress.labelselector=firefly.hexor.cy/private-ai=true
+            - --providers.kubernetescrd=false
+            - --api.dashboard=false
+            - --log.level=INFO
+          ports:
+            - name: web
+              containerPort: 80
+              hostPort: 80
+              hostIP: 192.168.1.117
+              protocol: TCP
+          readinessProbe:
+            tcpSocket:
+              host: 192.168.1.117
+              port: web
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              host: 192.168.1.117
+              port: web
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - NET_BIND_SERVICE
+            readOnlyRootFilesystem: true
+            runAsNonRoot: false
+            runAsUser: 0
+            runAsGroup: 0
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault

k8s/apps/firefly-iii/values.yaml

@@ -0,0 +1,68 @@
+replicaCount: 1
+
+image:
+  repository: fireflyiii/core
+  tag: version-6.6.1
+  pullPolicy: IfNotPresent
+
+service:
+  type: ClusterIP
+  port: 80
+  targetPort: 8080
+
+ingress:
+  enabled: true
+  className: traefik-ai
+  hosts:
+    - host: ff.lan
+      paths:
+        - path: /
+          pathType: Prefix
+
+persistence:
+  upload:
+    enabled: true
+    existingClaim: firefly-uploads
+
+# Must remain true because chart 0.1.2 validates it. Kustomize removes the
+# generated StatefulSet and makes this Service select the CloudNativePG Pod.
+postgres:
+  enabled: true
+  auth:
+    database: firefly
+    username: firefly
+  service:
+    port: 5432
+
+cronjob:
+  enabled: true
+  schedule: "0 3 * * *"
+  timeZone: Europe/London
+
+firefly:
+  env:
+    APP_ENV: production
+    APP_DEBUG: "false"
+    APP_URL: http://ff.lan
+    SITE_OWNER: owner@ff.lan
+    TZ: Europe/London
+    DEFAULT_LANGUAGE: en_US
+    TRUSTED_PROXIES: 10.42.0.0/16
+    COOKIE_SECURE: "false"
+    PGSQL_SSL_MODE: prefer
+  secrets:
+    existingSecret: firefly-secrets
+  nodeSelector:
+    kubernetes.io/hostname: ai.tail2fe2d.ts.net
+  tolerations:
+    - key: workload
+      operator: Equal
+      value: ai
+      effect: NoSchedule
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "2"
+      memory: 1Gi

k8s/apps/gitea/kustomization.yaml

@@ -5,6 +5,6 @@ resources:
   - app.yaml
   - external-secrets.yaml
   - deployment.yaml
+  - user-unban-cronjob.yaml
   - service.yaml
   - ingress.yaml
-

k8s/apps/gitea/user-unban-cronjob.yaml

@@ -0,0 +1,60 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: gitea-user-unban
+  labels:
+    app: gitea-user-unban
+spec:
+  schedule: "*/10 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: gitea-user-unban
+        spec:
+          restartPolicy: OnFailure
+          nodeSelector:
+            kubernetes.io/hostname: master.tail2fe2d.ts.net
+          volumes:
+            - name: storage
+              hostPath:
+                path: /k8s/gitea
+                type: Directory
+          containers:
+            - name: sqlite-unban
+              image: 'gitea/gitea:latest'
+              imagePullPolicy: IfNotPresent
+              resources:
+                requests:
+                  memory: "32Mi"
+                  cpu: "10m"
+                limits:
+                  memory: "128Mi"
+                  cpu: "100m"
+              command:
+                - /bin/sh
+                - -ec
+                - |
+                  sqlite3 -cmd ".timeout 30000" /data/gitea/gitea.db "
+                    UPDATE \"user\"
+                       SET is_active = 1,
+                           prohibit_login = 0,
+                           updated_unix = unixepoch()
+                     WHERE lower(email) = lower('ab@hexor.cy')
+                       AND (is_active <> 1 OR prohibit_login <> 0);
+
+                    SELECT printf(
+                      'gitea user watchdog: id=%d login=%s email=%s is_active=%d prohibit_login=%d updated_unix=%d',
+                      id, lower_name, email, is_active, prohibit_login, updated_unix
+                    )
+                      FROM \"user\"
+                     WHERE lower(email) = lower('ab@hexor.cy');
+                  "
+              volumeMounts:
+                - name: storage
+                  mountPath: /data

k8s/apps/teamspeak/deployment.yaml

@@ -17,6 +17,8 @@ spec:
       labels:
         app: teamspeak
     spec:
+      nodeSelector:
+        kubernetes.io/hostname: music.tail2fe2d.ts.net
       volumes:
         - name: data
           persistentVolumeClaim:

k8s/apps/web-petting/deployment.yaml

@@ -45,6 +45,11 @@ spec:
           value: "info"
         - name: WEB_PETTING_DEBUG
           value: "false"
+        - name: WEB_PETTING_DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: web-petting-secrets
+              key: WEB_PETTING_DATABASE_URL
         resources:
           requests:
             memory: "256Mi"

k8s/apps/web-petting/external-secrets.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: web-petting-secrets
+spec:
+  target:
+    name: web-petting-secrets
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        WEB_PETTING_DATABASE_URL: |-
+          postgresql://web_petting:{{ .web_petting }}@psql.psql.svc:5432/web_petting
+  data:
+    - secretKey: web_petting
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[20].value

k8s/apps/web-petting/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - app.yaml
   - deployment.yaml
+  - external-secrets.yaml
   - service.yaml
   - ingress.yaml
   - storage.yaml

k8s/core/argocd/dex-probes-patch.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex-server
+  namespace: argocd
+spec:
+  template:
+    spec:
+      containers:
+        - name: dex-server
+          readinessProbe:
+            tcpSocket:
+              port: 5556
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3
+          livenessProbe:
+            tcpSocket:
+              port: 5556
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3

k8s/core/argocd/kustomization.yaml

@@ -10,9 +10,11 @@ resources:
 helmCharts:
   - name: argo-cd
     repo: https://argoproj.github.io/argo-helm
-    version: 9.4.10
+    version: 10.2.1
     releaseName: argocd
     namespace: argocd
     valuesFile: values.yaml
     includeCRDs: true
 
+patches:
+  - path: dex-probes-patch.yaml

k8s/core/longhorn/app.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: core
   destination:
-    namespace: longhorn
+    namespace: longhorn-system
     server: https://kubernetes.default.svc
   source:
     repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git

k8s/core/longhorn/kustomization.yaml

@@ -9,7 +9,7 @@ helmCharts:
     repo: https://charts.longhorn.io
     version: 1.12.0
     releaseName: longhorn
-    namespace: longhorn
+    namespace: longhorn-system
     valuesFile: values.yaml
     includeCRDs: true
 

k8s/core/postgresql/external-secrets.yaml

@@ -140,6 +140,10 @@ spec:
           {{ .furumi_dev }}
         USER_keycloak: |-
           {{ .keycloak }}
+        USER_amnezia_fellow: |-
+          {{ .amnezia_fellow }}
+        USER_web_petting: |-
+          {{ .web_petting }}
   data:
     - secretKey: authentik
       sourceRef:
@@ -339,3 +343,25 @@ spec:
         metadataPolicy: None
         key: 2a9deb39-ef22-433e-a1be-df1555625e22
         property: fields[18].value
+    - secretKey: amnezia_fellow
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[19].value
+    - secretKey: web_petting
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[20].value

k8s/core/prom-stack/ingress.yaml

@@ -0,0 +1,45 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: auth-proxy
+spec:
+  forwardAuth:
+    address: http://auth-proxy.auth-proxy.svc:80/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-Auth-Request-User
+      - X-Auth-Request-Email
+      - X-Auth-Request-Groups
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: prometheus
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`prom.hexor.cy`)
+      kind: Rule
+      middlewares:
+        - name: auth-proxy
+      services:
+        - name: prometheus-kube-prometheus-prometheus
+          port: 9090
+  tls:
+    secretName: prometheus-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: prometheus-tls
+spec:
+  secretName: prometheus-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - prom.hexor.cy

k8s/core/prom-stack/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - persistentVolume.yaml
   - external-secrets.yaml
+  - ingress.yaml
   - grafana-alerting-configmap.yaml
   - alertmanager-config.yaml
   - dashboards/telemt-dashboard-cm.yaml

k8s/core/prom-stack/prom-values.yaml

@@ -1,4 +1,3 @@
-
 alertmanager:
   config:
     global:
@@ -25,7 +24,7 @@ alertmanager:
               {{ end }}
 
   ingress:
-    enabled: true
+    enabled: false
     ingressClassName: traefik
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt
@@ -46,7 +45,7 @@ alertmanager:
 
 prometheus:
   ingress:
-    enabled: true
+    enabled: false
     ingressClassName: traefik
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt

terraform/keycloak/terraform.tfvars

@@ -16,6 +16,10 @@ proxy_applications = {
     domain         = "pass.hexor.cy"
     allowed_groups = ["hexor-admin", "app-pass"]
   }
+  Prometheus = {
+    domain         = "prom.hexor.cy"
+    allowed_groups = ["hexor-admin"]
+  }
 }
 
 oauth2_applications = {
@@ -91,4 +95,9 @@ oauth2_applications = {
     web_origins               = ["https://auth.matrix.hexor.cy"]
     post_logout_redirect_uris = ["https://auth.matrix.hexor.cy/*"]
   }
+  Amnezia-Fellow = {
+    redirect_uris             = ["https://awg.hexor.cy/auth/oidc/callback"]
+    web_origins               = ["https://awg.hexor.cy"]
+    post_logout_redirect_uris = ["https://awg.hexor.cy/*"]
+  }
 }