Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-06-04 16:39:52

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -42,7 +42,6 @@ ArgoCD homelab project
 
 | Application | Status |
 | :--- | :---: |
-| **amnezia** | [![amnezia](https://ag.hexor.cy/api/badge?name=amnezia&revision=true)](https://ag.hexor.cy/applications/argocd/amnezia) |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
 | **furumi** | [![furumi](https://ag.hexor.cy/api/badge?name=furumi&revision=true)](https://ag.hexor.cy/applications/argocd/furumi) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |

k8s/apps/amnezia/app.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: amnezia
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: amnezia
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/amnezia
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true

k8s/apps/amnezia/configmap-scripts.yaml

@@ -1,320 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: amneziawg-scripts
-data:
-  firewall-up.sh: |
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    PORT="${1:-5847}"
-    VPN_CIDR="${2:-10.8.0.0/16}"
-
-    external_interface() {
-      ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
-    }
-
-    ensure_insert_rule() {
-      local table_args=()
-      if [ "${1:-}" = "-t" ]; then
-        table_args=("$1" "$2")
-        shift 2
-      fi
-
-      local chain="$1"
-      shift
-
-      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        iptables "${table_args[@]}" -I "${chain}" 1 "$@"
-      fi
-    }
-
-    delete_rule() {
-      local table_args=()
-      if [ "${1:-}" = "-t" ]; then
-        table_args=("$1" "$2")
-        shift 2
-      fi
-
-      local chain="$1"
-      shift
-
-      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
-        true
-      done
-    }
-
-    ensure_append_rule() {
-      local table_args=()
-      if [ "${1:-}" = "-t" ]; then
-        table_args=("$1" "$2")
-        shift 2
-      fi
-
-      local chain="$1"
-      shift
-
-      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        iptables "${table_args[@]}" -A "${chain}" "$@"
-      fi
-    }
-
-    EXT_IF="$(external_interface || true)"
-    if [ -z "${EXT_IF}" ]; then
-      EXT_IF="$(ip route show default | awk '{print $5; exit}')"
-    fi
-    if [ -z "${EXT_IF}" ]; then
-      echo "Unable to detect external interface"
-      exit 1
-    fi
-
-    sysctl -w net.ipv4.ip_forward=1
-
-    delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
-    ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
-    ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
-    ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
-    ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
-
-  firewall-down.sh: |
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    PORT="${1:-5847}"
-    VPN_CIDR="${2:-10.8.0.0/16}"
-
-    external_interface() {
-      ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
-    }
-
-    delete_rule() {
-      local table_args=()
-      if [ "${1:-}" = "-t" ]; then
-        table_args=("$1" "$2")
-        shift 2
-      fi
-
-      local chain="$1"
-      shift
-
-      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
-        true
-      done
-    }
-
-    EXT_IF="$(external_interface || true)"
-    if [ -z "${EXT_IF}" ]; then
-      EXT_IF="$(ip route show default | awk '{print $5; exit}')"
-    fi
-
-    if [ -n "${EXT_IF}" ]; then
-      delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
-      delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
-    fi
-
-    delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
-    delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
-    delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
-    delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-
-  run.sh: |
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    SERVER_CONFIG="/etc/amnezia/server/awg0.conf"
-    CLIENTS_DIR="${AMNEZIAWG_CLIENTS_DIR:-/run/amnezia/clients}"
-    RUNTIME_CONFIG="/run/amnezia/awg0.conf"
-    SYNC_CONFIG="/run/amnezia/awg0.sync.conf"
-    STATUS_FILE="/run/amnezia/reload-status"
-    RELOAD_INTERVAL="${AMNEZIAWG_RELOAD_INTERVAL:-10}"
-
-    cleanup() {
-      if awg show awg0 >/dev/null 2>&1; then
-        awg-quick down "${RUNTIME_CONFIG}" || ip link delete awg0 || true
-      fi
-    }
-
-    render_config() {
-      mkdir -p "$(dirname "${RUNTIME_CONFIG}")"
-      local tmp_config="${RUNTIME_CONFIG}.tmp"
-      cp "${SERVER_CONFIG}" "${tmp_config}"
-      chmod 0600 "${tmp_config}"
-
-      local clients_found=0
-      for client_config in "${CLIENTS_DIR}"/*; do
-        [ -f "${client_config}" ] || continue
-        [ -s "${client_config}" ] || continue
-        printf '\n' >> "${tmp_config}"
-        cat "${client_config}" >> "${tmp_config}"
-        clients_found=1
-      done
-
-      if [ "${clients_found}" = "0" ]; then
-        echo "No client peer configs found in ${CLIENTS_DIR}; starting without peers"
-      fi
-
-      mv "${tmp_config}" "${RUNTIME_CONFIG}"
-      chmod 0600 "${RUNTIME_CONFIG}"
-    }
-
-    client_config_hash() {
-      {
-        for client_config in "${CLIENTS_DIR}"/*; do
-          [ -f "${client_config}" ] || continue
-          sha256sum "${client_config}"
-        done
-      } | sha256sum | awk '{print $1}'
-    }
-
-    write_reload_status() {
-      local state="${1}"
-      local hash="${2:-}"
-      local applied_at_ms=""
-      if [ "${state}" = "applied" ]; then
-        applied_at_ms="$(($(date +%s) * 1000))"
-      fi
-
-      mkdir -p "$(dirname "${STATUS_FILE}")"
-      {
-        printf 'state=%s\n' "${state}"
-        printf 'hash=%s\n' "${hash}"
-        printf 'applied_at_ms=%s\n' "${applied_at_ms}"
-      } > "${STATUS_FILE}.tmp"
-      mv "${STATUS_FILE}.tmp" "${STATUS_FILE}"
-    }
-
-    apply_live_config() {
-      render_config
-      awg-quick strip "${RUNTIME_CONFIG}" > "${SYNC_CONFIG}"
-      chmod 0600 "${SYNC_CONFIG}"
-      awg syncconf awg0 "${SYNC_CONFIG}"
-    }
-
-    watch_client_config() {
-      local last_hash="${1}"
-      while true; do
-        sleep "${RELOAD_INTERVAL}" &
-        wait "$!" || return 0
-
-        local current_hash
-        current_hash="$(client_config_hash)"
-        if [ "${current_hash}" = "${last_hash}" ]; then
-          continue
-        fi
-
-        echo "Detected AmneziaWG client peer config change; applying with awg syncconf"
-        if apply_live_config; then
-          last_hash="${current_hash}"
-          write_reload_status applied "${current_hash}"
-          awg show awg0 || true
-        else
-          echo "ERROR: failed to hot-reload AmneziaWG client peer config" >&2
-          write_reload_status error "${current_hash}"
-        fi
-      done
-    }
-
-    trap cleanup EXIT
-    trap 'exit 0' TERM INT
-
-    initial_hash="$(client_config_hash)"
-    render_config
-    cleanup
-    awg-quick up "${RUNTIME_CONFIG}"
-    awg show awg0 || true
-    write_reload_status applied "${initial_hash}"
-    watch_client_config "${initial_hash}"
-
-  client-secret-sync.sh: |
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    CLIENT_SECRET="${AMNEZIAWG_CLIENT_SECRET:-amneziawg-clients}"
-    CLIENT_SECRET_KEY="${AMNEZIAWG_CLIENT_SECRET_KEY:-peers.conf}"
-    CLIENTS_DIR="${AMNEZIAWG_CLIENTS_DIR:-/run/amnezia/clients}"
-    PEERS_FILE="${CLIENTS_DIR}/peers.conf"
-    SYNC_INTERVAL="${AMNEZIAWG_CLIENT_SECRET_SYNC_INTERVAL:-5}"
-    NAMESPACE="${POD_NAMESPACE:-$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)}"
-
-    write_empty_once() {
-      mkdir -p "${CLIENTS_DIR}"
-      if [ ! -f "${PEERS_FILE}" ]; then
-        : > "${PEERS_FILE}"
-        chmod 0600 "${PEERS_FILE}"
-      fi
-    }
-
-    sync_once() {
-      mkdir -p "${CLIENTS_DIR}"
-      local tmp_file="${PEERS_FILE}.tmp"
-      local encoded=""
-
-      if ! encoded="$(kubectl get secret "${CLIENT_SECRET}" -n "${NAMESPACE}" -o "go-template={{ index .data \"${CLIENT_SECRET_KEY}\" }}" 2>/dev/null)"; then
-        echo "WARN: failed to read Secret ${NAMESPACE}/${CLIENT_SECRET}; keeping current peers" >&2
-        write_empty_once
-        return 0
-      fi
-
-      if [ -n "${encoded}" ]; then
-        printf '%s' "${encoded}" | base64 -d > "${tmp_file}"
-      else
-        : > "${tmp_file}"
-      fi
-      chmod 0600 "${tmp_file}"
-
-      if [ -f "${PEERS_FILE}" ] && cmp -s "${tmp_file}" "${PEERS_FILE}"; then
-        rm -f "${tmp_file}"
-        return 0
-      fi
-
-      mv "${tmp_file}" "${PEERS_FILE}"
-      echo "Synced AmneziaWG client peers from Secret ${NAMESPACE}/${CLIENT_SECRET}:${CLIENT_SECRET_KEY}"
-    }
-
-    if [ "${1:-}" = "once" ]; then
-      sync_once
-      exit 0
-    fi
-
-    while true; do
-      sync_once || true
-      sleep "${SYNC_INTERVAL}"
-    done
-
-  status-patch.sh: |
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    STATUS_FILE="/run/amnezia/reload-status"
-    PATCH_INTERVAL="${AMNEZIAWG_STATUS_PATCH_INTERVAL:-5}"
-    NAMESPACE="${POD_NAMESPACE:-$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)}"
-    : "${POD_NAME:?POD_NAME is required}"
-
-    last_file_hash=""
-
-    patch_status() {
-      local state="unknown"
-      local hash=""
-      local applied_at_ms=""
-
-      # The file is generated by run.sh and contains only shell assignments.
-      # shellcheck disable=SC1090
-      source "${STATUS_FILE}"
-
-      kubectl patch pod "${POD_NAME}" -n "${NAMESPACE}" --type merge -p "{\"metadata\":{\"annotations\":{\"amnezia-fellow.hexor.cy/client-secret-reload-status\":\"${state}\",\"amnezia-fellow.hexor.cy/client-secret-applied-at-ms\":\"${applied_at_ms}\",\"amnezia-fellow.hexor.cy/client-secret-applied-hash\":\"${hash}\"}}}"
-    }
-
-    while true; do
-      if [ -f "${STATUS_FILE}" ]; then
-        file_hash="$(sha256sum "${STATUS_FILE}" | awk '{print $1}')"
-        if [ "${file_hash}" != "${last_file_hash}" ]; then
-          patch_status || true
-          last_file_hash="${file_hash}"
-        fi
-      fi
-      sleep "${PATCH_INTERVAL}"
-    done

k8s/apps/amnezia/daemonset.yaml

@@ -1,274 +0,0 @@
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: amneziawg
-  labels:
-    app: amneziawg
-  annotations:
-    secret.reloader.stakater.com/reload: "amneziawg-server"
-    configmap.reloader.stakater.com/reload: "amneziawg-scripts"
-spec:
-  selector:
-    matchLabels:
-      app: amneziawg
-  updateStrategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: amneziawg
-    spec:
-      serviceAccountName: amneziawg
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-      nodeSelector:
-        amnezia-vpn: "true"
-      tolerations:
-        - operator: Exists
-      initContainers:
-        - name: install-awg
-          image: amneziavpn/amneziawg-go:latest
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/bash
-            - -lc
-            - |
-              set -euo pipefail
-              cp /usr/bin/awg /shared-bin/awg
-              chmod 0755 /shared-bin/awg
-          volumeMounts:
-            - name: awg-bin
-              mountPath: /shared-bin
-        - name: register-endpoint
-          image: bitnami/kubectl:latest
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: PORT
-              value: "5847"
-          command:
-            - /bin/bash
-            - -lc
-            - |
-              set -euo pipefail
-
-              NAMESPACE="$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)"
-              ENDPOINT="$(kubectl get node "${NODE_NAME}" -o jsonpath="{.metadata.labels['external-ipv4']}")"
-
-              if [ -z "${ENDPOINT}" ]; then
-                ENDPOINT="$(kubectl get node "${NODE_NAME}" -o jsonpath='{range .status.addresses[?(@.type=="ExternalIP")]}{.address}{end}')"
-              fi
-
-              if [ -z "${ENDPOINT}" ]; then
-                echo "ERROR: node ${NODE_NAME} has no external-ipv4 label and no ExternalIP"
-                exit 1
-              fi
-
-              VALUE="${ENDPOINT}:${PORT}"
-              echo "Registering AmneziaWG endpoint: ${NODE_NAME} -> ${VALUE}"
-
-              if kubectl get secret amneziawg-endpoints -n "${NAMESPACE}" >/dev/null 2>&1; then
-                kubectl patch secret amneziawg-endpoints -n "${NAMESPACE}" \
-                  --type merge -p "{\"stringData\":{\"${NODE_NAME}\":\"${VALUE}\"}}"
-              else
-                kubectl create secret generic amneziawg-endpoints -n "${NAMESPACE}" \
-                  --from-literal="${NODE_NAME}=${VALUE}"
-              fi
-        - name: sync-client-secret
-          image: bitnami/kubectl:latest
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/bash
-            - /scripts/client-secret-sync.sh
-            - once
-          resources:
-            requests:
-              memory: "32Mi"
-              cpu: "10m"
-            limits:
-              memory: "128Mi"
-              cpu: "100m"
-          volumeMounts:
-            - name: scripts
-              mountPath: /scripts
-              readOnly: true
-            - name: runtime-config
-              mountPath: /run/amnezia
-      containers:
-        - name: amneziawg
-          image: amneziavpn/amneziawg-go:latest
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            privileged: true
-            capabilities:
-              add:
-                - NET_ADMIN
-                - SYS_MODULE
-          command:
-            - /bin/bash
-            - /scripts/run.sh
-          ports:
-            - name: awg
-              containerPort: 5847
-              protocol: UDP
-          readinessProbe:
-            exec:
-              command:
-                - /bin/bash
-                - -lc
-                - awg show awg0 >/dev/null 2>&1
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          livenessProbe:
-            exec:
-              command:
-                - /bin/bash
-                - -lc
-                - awg show awg0 >/dev/null 2>&1
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "500m"
-          volumeMounts:
-            - name: server-config
-              mountPath: /etc/amnezia/server
-              readOnly: true
-            - name: scripts
-              mountPath: /scripts
-              readOnly: true
-            - name: runtime-config
-              mountPath: /run/amnezia
-            - name: dev-net-tun
-              mountPath: /dev/net/tun
-        - name: reload-status
-          image: bitnami/kubectl:latest
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          command:
-            - /bin/bash
-            - /scripts/status-patch.sh
-          resources:
-            requests:
-              memory: "32Mi"
-              cpu: "10m"
-            limits:
-              memory: "128Mi"
-              cpu: "100m"
-          volumeMounts:
-            - name: scripts
-              mountPath: /scripts
-              readOnly: true
-            - name: runtime-config
-              mountPath: /run/amnezia
-        - name: client-secret-sync
-          image: bitnami/kubectl:latest
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/bash
-            - /scripts/client-secret-sync.sh
-          resources:
-            requests:
-              memory: "32Mi"
-              cpu: "10m"
-            limits:
-              memory: "128Mi"
-              cpu: "100m"
-          volumeMounts:
-            - name: scripts
-              mountPath: /scripts
-              readOnly: true
-            - name: runtime-config
-              mountPath: /run/amnezia
-        - name: amneziawg-exporter-redis
-          image: redis:alpine
-          imagePullPolicy: IfNotPresent
-          command:
-            - redis-server
-            - /etc/redis/redis.conf
-          ports:
-            - name: redis
-              containerPort: 6379
-              protocol: TCP
-          resources:
-            requests:
-              memory: "32Mi"
-              cpu: "10m"
-            limits:
-              memory: "128Mi"
-              cpu: "100m"
-          volumeMounts:
-            - name: exporter-redis-config
-              mountPath: /etc/redis
-              readOnly: true
-            - name: exporter-redis-data
-              mountPath: /data
-        - name: amneziawg-exporter
-          image: amneziavpn/amneziawg-exporter:latest
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            capabilities:
-              add:
-                - NET_ADMIN
-          env:
-            - name: AWG_EXPORTER_REDIS_HOST
-              value: "127.0.0.1"
-            - name: AWG_EXPORTER_REDIS_PORT
-              value: "6379"
-          ports:
-            - name: metrics
-              containerPort: 9351
-              protocol: TCP
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "25m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"
-          volumeMounts:
-            - name: awg-bin
-              mountPath: /usr/bin/awg
-              subPath: awg
-              readOnly: true
-      volumes:
-        - name: server-config
-          secret:
-            secretName: amneziawg-server
-            defaultMode: 0600
-            items:
-              - key: awg0.conf
-                path: awg0.conf
-        - name: scripts
-          configMap:
-            name: amneziawg-scripts
-            defaultMode: 0755
-        - name: runtime-config
-          emptyDir: {}
-        - name: awg-bin
-          emptyDir: {}
-        - name: exporter-redis-config
-          configMap:
-            name: amneziawg-exporter-redis
-        - name: exporter-redis-data
-          emptyDir: {}
-        - name: dev-net-tun
-          hostPath:
-            path: /dev/net/tun
-            type: CharDevice

k8s/apps/amnezia/exporter-redis-configmap.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: amneziawg-exporter-redis
-  labels:
-    app: amneziawg
-    component: exporter
-data:
-  redis.conf: |
-    bind 0.0.0.0
-    protected-mode no
-    port 6379
-    tcp-backlog 511
-    timeout 0
-    tcp-keepalive 300
-    daemonize no
-    pidfile /run/redis.pid
-    loglevel warning
-    logfile ""
-    databases 16
-    always-show-logo no
-    set-proc-title no
-    save 3600 1
-    stop-writes-on-bgsave-error no
-    rdbcompression yes
-    rdbchecksum yes
-    dir /data

k8s/apps/amnezia/exporter-service.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: amneziawg-exporter
-  labels:
-    app: amneziawg
-    component: exporter
-spec:
-  type: ClusterIP
-  selector:
-    app: amneziawg
-  ports:
-    - name: metrics
-      protocol: TCP
-      port: 9351
-      targetPort: 9351

k8s/apps/amnezia/external-secrets.yaml

@@ -1,50 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: amneziawg-server
-spec:
-  target:
-    name: amneziawg-server
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        server-public-key: |-
-          {{ .server_public_key }}
-        awg0.conf: |-
-          [Interface]
-          PrivateKey = {{ .server_private_key }}
-          Address = 10.8.0.1/16
-          ListenPort = 5847
-          MTU = 1376
-          Jc = 4
-          Jmin = 64
-          Jmax = 128
-          S1 = 15
-          S2 = 18
-          S3 = 20
-          S4 = 23
-          H1 = 1020325451
-          H2 = 3288052141
-          H3 = 1766607858
-          H4 = 2528465083
-          PostUp = /scripts/firewall-up.sh 5847 10.8.0.0/16
-          PostDown = /scripts/firewall-down.sh 5847 10.8.0.0/16
-  data:
-    - secretKey: server_private_key
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 3092dc7c-41dd-461a-9f7a-377727f47e93
-        property: fields[0].value
-    - secretKey: server_public_key
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 3092dc7c-41dd-461a-9f7a-377727f47e93
-        property: fields[1].value

k8s/apps/amnezia/fellow-deployment.yaml

@@ -1,74 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: amnezia-fellow
-  labels:
-    app: amnezia-fellow
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: amnezia-fellow
-  template:
-    metadata:
-      labels:
-        app: amnezia-fellow
-    spec:
-      serviceAccountName: amnezia-fellow
-      nodeSelector:
-        kubernetes.io/os: linux
-        kubernetes.io/hostname: cy.tail2fe2d.ts.net
-      containers:
-        - name: amnezia-fellow
-          image: ultradesu/amnezia-fellow:latest
-          imagePullPolicy: Always
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: AMNEZIA_FELLOW_DATABASE_URL
-              value: "sqlite:///data/amnezia-fellow.sqlite3?mode=rwc"
-            - name: AMNEZIA_FELLOW_K8S_NAMESPACE
-              value: "amnezia"
-            - name: AMNEZIA_FELLOW_K8S_CLIENTS_SECRET
-              value: "amneziawg-clients"
-            - name: AMNEZIA_FELLOW_K8S_CLIENTS_SECRET_KEY
-              value: "peers.conf"
-            - name: AMNEZIA_FELLOW_K8S_SERVER_SECRET
-              value: "amneziawg-server"
-            - name: AMNEZIA_FELLOW_K8S_ENDPOINTS_SECRET
-              value: "amneziawg-endpoints"
-            - name: AMNEZIA_FELLOW_VPN_CLIENT_CIDR
-              value: "10.8.0.0/16"
-            - name: AMNEZIA_FELLOW_VPN_MTU
-              value: "1376"
-          readinessProbe:
-            tcpSocket:
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 3
-          livenessProbe:
-            tcpSocket:
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-          resources:
-            requests:
-              cpu: "50m"
-              memory: "128Mi"
-            limits:
-              cpu: "500m"
-              memory: "512Mi"
-          volumeMounts:
-            - name: data
-              mountPath: /data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: amnezia-fellow-data

k8s/apps/amnezia/fellow-ingress.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: amnezia-fellow-tls-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: awg.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: amnezia-fellow
-                port:
-                  number: 8000
-  tls:
-    - secretName: amnezia-fellow-tls
-      hosts:
-        - awg.hexor.cy

k8s/apps/amnezia/fellow-rbac.yaml

@@ -1,35 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: amnezia-fellow
-  labels:
-    app: amnezia-fellow
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: amnezia-fellow
-  labels:
-    app: amnezia-fellow
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "create", "update", "patch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: amnezia-fellow
-  labels:
-    app: amnezia-fellow
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: amnezia-fellow
-subjects:
-  - kind: ServiceAccount
-    name: amnezia-fellow

k8s/apps/amnezia/fellow-service.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: amnezia-fellow
-  labels:
-    app: amnezia-fellow
-spec:
-  type: ClusterIP
-  selector:
-    app: amnezia-fellow
-  ports:
-    - name: http
-      protocol: TCP
-      port: 8000
-      targetPort: 8000

k8s/apps/amnezia/fellow-storage.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: amnezia-fellow-data
-  labels:
-    app: amnezia-fellow
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 3Gi

k8s/apps/amnezia/kustomization.yaml

@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - namespace.yaml
-  - external-secrets.yaml
-  - configmap-scripts.yaml
-  - rbac.yaml
-  - fellow-rbac.yaml
-  - fellow-storage.yaml
-  - fellow-service.yaml
-  - fellow-ingress.yaml
-  - fellow-deployment.yaml
-  - exporter-redis-configmap.yaml
-  - exporter-service.yaml
-  - servicemonitor.yaml
-  - daemonset.yaml

k8s/apps/amnezia/namespace.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: amnezia
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged

k8s/apps/amnezia/rbac.yaml

@@ -1,61 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: amneziawg
-  labels:
-    app: amneziawg
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: amneziawg-node-reader
-  labels:
-    app: amneziawg
-rules:
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: amneziawg-node-reader
-  labels:
-    app: amneziawg
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: amneziawg-node-reader
-subjects:
-  - kind: ServiceAccount
-    name: amneziawg
-    namespace: amnezia
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: amneziawg-endpoint-manager
-  labels:
-    app: amneziawg
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "create", "patch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: amneziawg-endpoint-manager
-  labels:
-    app: amneziawg
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: amneziawg-endpoint-manager
-subjects:
-  - kind: ServiceAccount
-    name: amneziawg

k8s/apps/amnezia/servicemonitor.yaml

@@ -1,23 +0,0 @@
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: amneziawg-exporter
-  labels:
-    app: amneziawg
-    component: exporter
-    release: prometheus
-spec:
-  selector:
-    matchLabels:
-      app: amneziawg
-      component: exporter
-  endpoints:
-    - port: metrics
-      path: /metrics
-      interval: 30s
-      scrapeTimeout: 10s
-      honorLabels: true
-  namespaceSelector:
-    matchNames:
-      - amnezia

k8s/apps/gitea/deployment.yaml

@@ -41,18 +41,18 @@ spec:
             - name: GITEA__service__REGISTER_MANUAL_CONFIRM
               value: "true"
             - name: GITEA__service__ENABLE_CAPTCHA
-              value: "true"
-            - name: GITEA__service__REQUIRE_CAPTCHA_FOR_LOGIN
               value: "false"
+            - name: GITEA__service__REQUIRE_CAPTCHA_FOR_LOGIN
+              value: "true"
             - name: GITEA__service__REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA
               value: "true"
             - name: GITEA__service__CAPTCHA_TYPE
-              value: "cfturnstile"
+              value: "hcaptcha"
             - name: GITEA__webhook__ALLOWED_HOST_LIST
               value: "*"
           envFrom:
           - secretRef:
-              name: gitea-runner-act-runner-secrets
+              name: gitea-recapcha-creds
           ports:
             - name: http
               containerPort: 3000

k8s/apps/gitea/external-secrets.yaml

@@ -13,10 +13,6 @@ spec:
       data:
         token: |-
           {{ .password }}
-        GITEA__service__CF_TURNSTILE_SITEKEY: |-
-          {{ .CF_TURNSTILE_SITEKEY }}
-        GITEA__service__CF_TURNSTILE_SECRET: |-
-          {{ .CF_TURNSTILE_SECRET }}
   data:
     - secretKey: password
       sourceRef:
@@ -26,19 +22,38 @@ spec:
       remoteRef:
         key: e475b5ab-ea3c-48a5-bb4c-a6bc552fc064
         property: login.password
-    - secretKey: CF_TURNSTILE_SITEKEY
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-recapcha-creds
+spec:
+  refreshInterval: 1m
+  target:
+    name: gitea-recapcha-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        GITEA__service__HCAPTCHA_SITEKEY: |-
+          {{ .HCAPTCHA_SITEKEY }}
+        GITEA__service__HCAPTCHA_SECRET: |-
+          {{ .HCAPTCHA_SECRET }}
+  data:
+    - secretKey: HCAPTCHA_SITEKEY
       sourceRef:
         storeRef:
           name: vaultwarden-login
           kind: ClusterSecretStore
       remoteRef:
-        key: e475b5ab-ea3c-48a5-bb4c-a6bc552fc064
+        key: 89c8d8d2-6b53-42c5-805f-38a341ef163e
-        property: fields[0].value
+        property: login.username
-    - secretKey: CF_TURNSTILE_SECRET
+    - secretKey: HCAPTCHA_SECRET
       sourceRef:
         storeRef:
           name: vaultwarden-login
           kind: ClusterSecretStore
       remoteRef:
-        key: e475b5ab-ea3c-48a5-bb4c-a6bc552fc064
+        key: 89c8d8d2-6b53-42c5-805f-38a341ef163e
-        property: fields[1].value
+        property: login.password

k8s/apps/gitea/kustomization.yaml

@@ -5,6 +5,6 @@ resources:
   - app.yaml
   - external-secrets.yaml
   - deployment.yaml
-  - user-unban-cronjob.yaml
   - service.yaml
   - ingress.yaml
+

k8s/apps/gitea/user-unban-cronjob.yaml

@@ -1,60 +0,0 @@
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: gitea-user-unban
-  labels:
-    app: gitea-user-unban
-spec:
-  schedule: "*/10 * * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: gitea-user-unban
-        spec:
-          restartPolicy: OnFailure
-          nodeSelector:
-            kubernetes.io/hostname: master.tail2fe2d.ts.net
-          volumes:
-            - name: storage
-              hostPath:
-                path: /k8s/gitea
-                type: Directory
-          containers:
-            - name: sqlite-unban
-              image: 'gitea/gitea:latest'
-              imagePullPolicy: IfNotPresent
-              resources:
-                requests:
-                  memory: "32Mi"
-                  cpu: "10m"
-                limits:
-                  memory: "128Mi"
-                  cpu: "100m"
-              command:
-                - /bin/sh
-                - -ec
-                - |
-                  sqlite3 -cmd ".timeout 30000" /data/gitea/gitea.db "
-                    UPDATE \"user\"
-                       SET is_active = 1,
-                           prohibit_login = 0,
-                           updated_unix = unixepoch()
-                     WHERE lower(email) = lower('ab@hexor.cy')
-                       AND (is_active <> 1 OR prohibit_login <> 0);
-
-                    SELECT printf(
-                      'gitea user watchdog: id=%d login=%s email=%s is_active=%d prohibit_login=%d updated_unix=%d',
-                      id, lower_name, email, is_active, prohibit_login, updated_unix
-                    )
-                      FROM \"user\"
-                     WHERE lower(email) = lower('ab@hexor.cy');
-                  "
-              volumeMounts:
-                - name: storage
-                  mountPath: /data

k8s/apps/llamacpp/configmap-cuda.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: llamacpp-cuda-config
-data:
-  LLAMA_CACHE: /models
-  LLAMA_ARG_HOST: 0.0.0.0
-  LLAMA_ARG_PORT: "8080"
-  LLAMA_ARG_HF_REPO: "unsloth/gemma-4-12b-it-GGUF:Q6_K"
-  LLAMA_ARG_CTX_SIZE: "128000"
-  LLAMA_ARG_FLASH_ATTN: auto
-  LLAMA_ARG_FIT: "on"

k8s/apps/llamacpp/deployment-cuda.yaml

@@ -1,72 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: llamacpp-cuda
-  annotations:
-    reloader.stakater.com/auto: "true"
-  labels:
-    app: llamacpp-cuda
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: llamacpp-cuda
-  template:
-    metadata:
-      labels:
-        app: llamacpp-cuda
-    spec:
-      dnsPolicy: Default
-      runtimeClassName: nvidia
-      nodeSelector:
-        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: desktop
-          effect: NoSchedule
-      containers:
-        - name: llamacpp
-          image: ghcr.io/ggml-org/llama.cpp:server-cuda-b9501
-          imagePullPolicy: IfNotPresent
-          envFrom:
-            - configMapRef:
-                name: llamacpp-cuda-config
-          env:
-            - name: HF_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: llamacpp-hf-token
-                  key: token
-                  optional: true
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          resources:
-            limits:
-              nvidia.com/gpu: 1
-          startupProbe:
-            httpGet:
-              path: /health
-              port: http
-            failureThreshold: 180
-            periodSeconds: 10
-            timeoutSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            failureThreshold: 3
-            periodSeconds: 10
-            timeoutSeconds: 5
-          volumeMounts:
-            - name: models
-              mountPath: /models
-      volumes:
-        - name: models
-          hostPath:
-            path: /data/llama.cpp/models
-            type: DirectoryOrCreate

k8s/apps/llamacpp/deployment.yaml

@@ -18,7 +18,6 @@ spec:
       labels:
         app: llamacpp
     spec:
-      dnsPolicy: Default
       nodeSelector:
         kubernetes.io/hostname: ai.tail2fe2d.ts.net
       tolerations:

k8s/apps/llamacpp/kustomization.yaml

@@ -3,9 +3,6 @@ kind: Kustomization
 
 resources:
   - app.yaml
-  - configmap-cuda.yaml
   - configmap.yaml
-  - deployment-cuda.yaml
   - deployment.yaml
-  - service-cuda.yaml
   - service.yaml

k8s/apps/llamacpp/service-cuda.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: llamacpp-cuda
-  labels:
-    app: llamacpp-cuda
-spec:
-  type: ClusterIP
-  selector:
-    app: llamacpp-cuda
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
-      protocol: TCP

k8s/apps/matrix/external-secrets.yaml

@@ -53,8 +53,8 @@ spec:
           upstream_oauth2:
             providers:
               - id: 001KKV4EKY7KG98W2M9T806K6A
-                human_name: SSO Login
+                human_name: Authentik
-                issuer: https://auth.hexor.cy/auth/realms/hexor
+                issuer: https://idm.hexor.cy/application/o/matrix/
                 client_id: "{{ .oauth_client_id }}"
                 client_secret: "{{ .oauth_client_secret }}"
                 token_endpoint_auth_method: client_secret_post
@@ -93,4 +93,3 @@ spec:
         metadataPolicy: None
         key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
         property: fields[1].value
-                    on_conflict: replace

k8s/apps/n8n/kustomization.yaml

@@ -15,14 +15,14 @@ resources:
   - service.yaml
   - ingress.yaml
 
-# helmCharts:
+helmCharts:
-#   - name: yacy
+  - name: yacy
-#     repo: https://gt.hexor.cy/api/packages/ab/helm
+    repo: https://gt.hexor.cy/api/packages/ab/helm
-#     version: 0.1.2
+    version: 0.1.2
-#     releaseName: yacy
+    releaseName: yacy
-#     namespace: n8n
+    namespace: n8n
-#     valuesFile: values-yacy.yaml
+    valuesFile: values-yacy.yaml
-#     includeCRDs: true
+    includeCRDs: true
 
 commonLabels:
   app.kubernetes.io/name: n8n

k8s/apps/paperless/external-secrets.yaml

@@ -18,8 +18,8 @@ spec:
             "openid_connect": {
               "APPS": [
                 {
-                  "provider_id": "keycloak",
+                  "provider_id": "authentik",
-                  "name": "Keycloak",
+                  "name": "Authentik",
                   "client_id": "{{ .oauth_id }}",
                   "secret": "{{ .oauth_secret }}",
                   "settings": {

k8s/apps/pasarguard/daemonset.yaml

@@ -46,7 +46,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: pasarguard-node
-          image: pasarguard/node:v0.5.2
+          image: pasarguard/node:v0.5.0
           imagePullPolicy: Always
           command:
             - /bin/sh

k8s/apps/pasarguard/deployment.yaml

@@ -11,7 +11,7 @@ spec:
   selector:
     matchLabels:
       app: pasarguard
-  replicas: 2
+  replicas: 1
   strategy:
     type: RollingUpdate
   template:
@@ -34,7 +34,7 @@ spec:
               mountPath: /templates/subscription
       containers:
         - name: pasarguard-web
-          image: pasarguard/panel:v5.0.3
+          image: pasarguard/panel:v4.0.2
           imagePullPolicy: Always
           envFrom:
             - secretRef:
@@ -50,10 +50,6 @@ spec:
               value: "/app/tls/tls.crt"
             - name: UVICORN_SSL_KEYFILE
               value: "/app/tls/tls.key"
-            - name: UVICORN_PROXY_HEADERS
-              value: "true"
-            - name: FORWARDED_ALLOW_IPS
-              value: "*"
             - name: CUSTOM_TEMPLATES_DIRECTORY
               value: "/code/app/templates/"
             - name: SUBSCRIPTION_PAGE_TEMPLATE

k8s/core/keycloak/values.yaml

@@ -66,11 +66,11 @@ ingress:
 
 resources:
   requests:
-    cpu: 500m
+    cpu: 200m
-    memory: 1Gi
+    memory: 512Mi
   limits:
-    cpu: "3"
+    cpu: "1"
-    memory: 2Gi
+    memory: 1Gi
 
 nodeSelector:
   kubernetes.io/hostname: master.tail2fe2d.ts.net

k8s/core/kube-system-custom/kustomization.yaml

@@ -6,7 +6,6 @@ resources:
   - nfs-storage.yaml
   - coredns-internal-resolve.yaml
   - https-middleware.yaml
-  - node-external-ip-labeler.yaml
 
 helmCharts:
   - name: csi-driver-nfs
@@ -16,3 +15,4 @@ helmCharts:
     namespace: kube-system
     #valuesFile: values.yaml
     includeCRDs: true
+

k8s/core/kube-system-custom/node-external-ip-labeler.yaml

@@ -1,173 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: node-external-ip-labeler
-  namespace: kube-system
-  labels:
-    app: node-external-ip-labeler
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: node-external-ip-labeler
-  labels:
-    app: node-external-ip-labeler
-rules:
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list", "patch", "update"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: node-external-ip-labeler
-  labels:
-    app: node-external-ip-labeler
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: node-external-ip-labeler
-subjects:
-  - kind: ServiceAccount
-    name: node-external-ip-labeler
-    namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: node-external-ip-labeler
-  namespace: kube-system
-  labels:
-    app: node-external-ip-labeler
-rules:
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: node-external-ip-labeler
-  namespace: kube-system
-  labels:
-    app: node-external-ip-labeler
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: node-external-ip-labeler
-subjects:
-  - kind: ServiceAccount
-    name: node-external-ip-labeler
-    namespace: kube-system
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: node-external-ip-labeler
-  namespace: kube-system
-  labels:
-    app: node-external-ip-labeler
-spec:
-  schedule: "17 3 * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      backoffLimit: 1
-      template:
-        metadata:
-          labels:
-            app: node-external-ip-labeler
-        spec:
-          serviceAccountName: node-external-ip-labeler
-          restartPolicy: Never
-          tolerations:
-            - operator: Exists
-          containers:
-            - name: fanout
-              image: bitnami/kubectl:latest
-              imagePullPolicy: IfNotPresent
-              command:
-                - /bin/bash
-                - -lc
-              args:
-                - |
-                  set -euo pipefail
-
-                  clean_name() {
-                    echo "$1" \
-                      | tr '[:upper:]' '[:lower:]' \
-                      | tr -c 'a-z0-9-' '-' \
-                      | sed 's/^-*//;s/-*$//' \
-                      | cut -c1-45
-                  }
-
-                  for NODE_NAME in $(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'); do
-                    NODE_CLEAN="$(clean_name "${NODE_NAME}")"
-                    JOB_NAME="node-external-ip-${NODE_CLEAN}"
-
-                    kubectl delete job "${JOB_NAME}" -n kube-system --ignore-not-found=true --wait=true --timeout=60s
-
-                    cat <<EOF | kubectl apply -f -
-                  apiVersion: batch/v1
-                  kind: Job
-                  metadata:
-                    name: ${JOB_NAME}
-                    namespace: kube-system
-                    labels:
-                      app: node-external-ip-labeler
-                      target-node: "${NODE_CLEAN}"
-                  spec:
-                    ttlSecondsAfterFinished: 86400
-                    backoffLimit: 2
-                    template:
-                      metadata:
-                        labels:
-                          app: node-external-ip-labeler
-                          target-node: "${NODE_CLEAN}"
-                      spec:
-                        serviceAccountName: node-external-ip-labeler
-                        nodeName: "${NODE_NAME}"
-                        hostNetwork: true
-                        dnsPolicy: ClusterFirstWithHostNet
-                        restartPolicy: Never
-                        tolerations:
-                          - operator: Exists
-                        containers:
-                          - name: label-node
-                            image: bitnami/kubectl:latest
-                            imagePullPolicy: IfNotPresent
-                            env:
-                              - name: NODE_NAME
-                                value: "${NODE_NAME}"
-                            command:
-                              - /bin/bash
-                              - -lc
-                            args:
-                              - |
-                                set -euo pipefail
-
-                                json_ip() {
-                                  sed -n 's/.*"ip"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p'
-                                }
-
-                                IPV4="\$(curl -fsS --connect-timeout 10 --max-time 30 'https://api.ipify.org?format=json' | json_ip)"
-                                IP64="\$(curl -fsS --connect-timeout 10 --max-time 30 'https://api64.ipify.org?format=json' | json_ip || true)"
-
-                                if [ -z "\${IPV4}" ]; then
-                                  echo "Unable to detect external IPv4 for node ${NODE_NAME}"
-                                  exit 1
-                                fi
-
-                                kubectl label node "${NODE_NAME}" external-ipv4="\${IPV4}" --overwrite
-                                kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv4="\${IPV4}" --overwrite
-
-                                if echo "\${IP64}" | grep -q ':'; then
-                                  kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv6="\${IP64}" --overwrite
-                                elif [ -n "\${IP64}" ]; then
-                                  kubectl annotate node "${NODE_NAME}" homelab.hexor.cy/external-ipv4-api64="\${IP64}" --overwrite
-                                fi
-                  EOF
-                  done

k8s/core/longhorn/kustomization.yaml

@@ -7,7 +7,7 @@ kind: Kustomization
 helmCharts:
   - name: longhorn
     repo: https://charts.longhorn.io
-    version: 1.12.0
+    version: 1.11.2
     releaseName: longhorn
     namespace: longhorn
     valuesFile: values.yaml

k8s/core/longhorn/values.yaml

@@ -1,54 +1,7 @@
-global:
-  tolerations:
-    - key: "workload"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoExecute"
-
-longhornManager:
-  tolerations:
-    - key: "workload"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoExecute"
-
-longhornDriver:
-  tolerations:
-    - key: "workload"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoExecute"
-
 longhornUI:
   replicas: 1
-  tolerations:
-    - key: "workload"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoExecute"
 
 defaultSettings:
-  taintToleration: "workload=ai:NoSchedule; workload=desktop:NoSchedule; node.kubernetes.io/unreachable:NoSchedule; node.kubernetes.io/unreachable:NoExecute"
   # Keep new instance-manager pods schedulable on nodes with high CPU requests.
   guaranteedInstanceManagerCPU: '{"v1":"6","v2":"6"}'
 

k8s/core/postgresql/kustomization.yaml

@@ -13,7 +13,7 @@ resources:
 helmCharts:
   - name: pgadmin4
     repo: https://helm.runix.net
-    version: 1.64.0
+    version: 1.50.0
     releaseName: pgmanager
     namespace: psql
     valuesFile: pgadmin4-values.yaml

k8s/core/prom-stack/ingress.yaml

@@ -1,45 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: auth-proxy
-spec:
-  forwardAuth:
-    address: http://auth-proxy.auth-proxy.svc:80/auth
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-Auth-Request-User
-      - X-Auth-Request-Email
-      - X-Auth-Request-Groups
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: prometheus
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`prom.hexor.cy`)
-      kind: Rule
-      middlewares:
-        - name: auth-proxy
-      services:
-        - name: prometheus-kube-prometheus-prometheus
-          port: 9090
-  tls:
-    secretName: prometheus-tls
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: prometheus-tls
-spec:
-  secretName: prometheus-tls
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-  dnsNames:
-    - prom.hexor.cy

k8s/core/prom-stack/kustomization.yaml

@@ -4,7 +4,6 @@ kind: Kustomization
 resources:
   - persistentVolume.yaml
   - external-secrets.yaml
-  - ingress.yaml
   - grafana-alerting-configmap.yaml
   - alertmanager-config.yaml
   - dashboards/telemt-dashboard-cm.yaml

k8s/core/prom-stack/prom-values.yaml

@@ -1,3 +1,4 @@
+
 alertmanager:
   config:
     global:
@@ -24,7 +25,7 @@ alertmanager:
               {{ end }}
 
   ingress:
-    enabled: false
+    enabled: true
     ingressClassName: traefik
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt
@@ -45,7 +46,7 @@ alertmanager:
 
 prometheus:
   ingress:
-    enabled: false
+    enabled: true
     ingressClassName: traefik
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt

k8s/games/counter-strike-16/deployments.yaml

@@ -36,7 +36,7 @@ spec:
     spec:
       nodeSelector:
         #kubernetes.io/hostname: home.homenet
-        kubernetes.io/hostname: music.tail2fe2d.ts.net
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
       terminationGracePeriodSeconds: 10
       containers:
         - name: prom-a2s-exporter

terraform/keycloak/terraform.tfvars

@@ -16,10 +16,6 @@ proxy_applications = {
     domain         = "pass.hexor.cy"
     allowed_groups = ["hexor-admin", "app-pass"]
   }
-  Prometheus = {
-    domain         = "prom.hexor.cy"
-    allowed_groups = ["hexor-admin"]
-  }
 }
 
 oauth2_applications = {
@@ -50,54 +46,18 @@ oauth2_applications = {
     post_logout_redirect_uris = ["https://ai.hexor.cy/*"]
   }
   FuruMusic = {
-    redirect_uris             = ["https://music.hexor.cy/auth/oidc/callback", "https://music.hexor.cy/auth/mobile/oidc/callback"]
+    redirect_uris             = ["https://music.hexor.cy/auth/oidc/callback"]
     web_origins               = ["https://music.hexor.cy"]
     post_logout_redirect_uris = ["https://music.hexor.cy/*"]
   }
   FuruMusic-dev = {
-    redirect_uris             = ["http://127.0.0.1:3000/auth/oidc/callback", "http://10.0.5.104:3000/auth/oidc/callback", "http://10.0.5.104:3000/auth/mobile/oidc/callback"]
+    redirect_uris             = ["https://music-dev.hexor.cy/auth/oidc/callback", "http://127.0.0.1:3000/auth/oidc/callback", "http://10.0.5.103:3000/auth/oidc/callback"]
-    web_origins               = ["http://127.0.0.1:3000", "http://10.0.5.104:3000"]
+    web_origins               = ["https://music-dev.hexor.cy", "http://127.0.0.1:3000", "http://10.0.5.103:3000"]
-    post_logout_redirect_uris = ["http://127.0.0.1:3000/*", "http://10.0.5.104:3000/*"]
+    post_logout_redirect_uris = ["https://music-dev.hexor.cy/*", "http://127.0.0.1:3000/*", "http://10.0.5.103:3000/*"]
   }
   Web-Petting = {
     redirect_uris             = ["https://pet.hexor.cy/admin/oidc/callback", "https://xn--l1acako8eb.xn--p1ai/admin/oidc/callback", "https://мурняня.рф/admin/oidc/callback"]
     web_origins               = ["https://pet.hexor.cy", "https://xn--l1acako8eb.xn--p1ai", "https://мурняня.рф", ]
     post_logout_redirect_uris = ["https://pet.hexor.cy/*", "https://xn--l1acako8eb.xn--p1ai/*", "https://мурняня.рф/*"]
   }
-  Paperless-ngx = {
-    redirect_uris             = ["https://docs.hexor.cy/accounts/oidc/authentik/login/callback/"]
-    web_origins               = ["https://docs.hexor.cy"]
-    post_logout_redirect_uris = ["https://docs.hexor.cy/*"]
-  }
-  Immich = {
-    redirect_uris             = [
-      "https://photos.hexor.cy/auth/login",
-      "https://photos.hexor.cy/user-settings",
-      "app.immich:///oauth-callback",
-      "http://photos.homenet:30283/auth/login",
-      "http://photos.homenet:30283/user-settings"
-    ]
-    web_origins               = ["https://photos.hexor.cy", "http://photos.homenet:30283"]
-    post_logout_redirect_uris = ["https://photos.hexor.cy/*", "http://photos.homenet:30283/*"]
-  }
-  HomeAssistant-LMS = {
-    redirect_uris             = ["http://ha-lms:8123/auth/oidc/callback", "http://ha-lms.homenet:8123/auth/oidc/callback"]
-    web_origins               = ["http://ha-lms:8123", "http://ha-lms.homenet:8123"]
-    post_logout_redirect_uris = ["http://ha-lms:8123/*", "http://ha-lms.homenet:8123/*"]
-  }
-  HomeAssistant-LND = {
-    redirect_uris             = ["http://ha-london:8123/auth/oidc/callback", "http://ha-london.tail2fe2d.ts.net:8123/auth/oidc/callback"]
-    web_origins               = ["http://ha-london:8123", "http://ha-london.tail2fe2d.ts.net:8123"]
-    post_logout_redirect_uris = ["http://ha-london:8123/*", "http://ha-london.tail2fe2d.ts.net:8123/*"]
-  }
-  Matrix-Chat = {
-    redirect_uris             = ["https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A"]
-    web_origins               = ["https://auth.matrix.hexor.cy"]
-    post_logout_redirect_uris = ["https://auth.matrix.hexor.cy/*"]
-  }
-  Amnezia-Fellow = {
-    redirect_uris             = ["https://awg.hexor.cy/auth/oidc/callback"]
-    web_origins               = ["https://awg.hexor.cy"]
-    post_logout_redirect_uris = ["https://awg.hexor.cy/*"]
-  }
 }