Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-07-28 12:18:08

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -44,6 +44,7 @@ ArgoCD homelab project
 | :--- | :---: |
 | **amnezia** | [![amnezia](https://ag.hexor.cy/api/badge?name=amnezia&revision=true)](https://ag.hexor.cy/applications/argocd/amnezia) |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
+| **doka2-lobby-list** | [![doka2-lobby-list](https://ag.hexor.cy/api/badge?name=doka2-lobby-list&revision=true)](https://ag.hexor.cy/applications/argocd/doka2-lobby-list) |
 | **furumi** | [![furumi](https://ag.hexor.cy/api/badge?name=furumi&revision=true)](https://ag.hexor.cy/applications/argocd/furumi) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |

k8s/apps/amnezia/configmap-scripts.yaml

@@ -10,12 +10,16 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
+    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
+    IPTABLES=(iptables -w 30)
 
     external_interface() {
       ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
     }
 
-    ensure_insert_rule() {
+    ensure_rule() {
+      local mode="$1"
+      shift
       local table_args=()
       if [ "${1:-}" = "-t" ]; then
         table_args=("$1" "$2")
@@ -25,8 +29,8 @@ data:
       local chain="$1"
       shift
 
-      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        iptables "${table_args[@]}" -I "${chain}" 1 "$@"
+      if ! "${IPTABLES[@]}" "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
+        "${IPTABLES[@]}" "${table_args[@]}" "${mode}" "${chain}" "$@"
       fi
     }
 
@@ -40,24 +44,15 @@ data:
       local chain="$1"
       shift
 
-      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
         true
       done
     }
 
-    ensure_append_rule() {
-      local table_args=()
-      if [ "${1:-}" = "-t" ]; then
-        table_args=("$1" "$2")
-        shift 2
-      fi
-
+    reset_chain() {
       local chain="$1"
-      shift
-
-      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        iptables "${table_args[@]}" -A "${chain}" "$@"
-      fi
+      "${IPTABLES[@]}" -N "${chain}" >/dev/null 2>&1 || true
+      "${IPTABLES[@]}" -F "${chain}"
     }
 
     EXT_IF="$(external_interface || true)"
@@ -71,13 +66,28 @@ data:
 
     sysctl -w net.ipv4.ip_forward=1
 
+    # Remove rules written by older revisions. In particular, the unqualified
+    # tailscale UDP DROP also blocks Flannel VXLAN (UDP/8472).
     delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
-    ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
-    ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
-    ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
-    ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
+    delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
+    delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
+    delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
+    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
+
+    reset_chain "${FORWARD_CHAIN}"
+    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -j RETURN
+    ensure_rule -A FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
+
+    ensure_rule -A -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
+
+    /scripts/firewall-check.sh "${PORT}" "${VPN_CIDR}"
 
   firewall-down.sh: |
     #!/usr/bin/env bash
@@ -85,6 +95,8 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
+    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
+    IPTABLES=(iptables -w 30)
 
     external_interface() {
       ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
@@ -100,7 +112,7 @@ data:
       local chain="$1"
       shift
 
-      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
         true
       done
     }
@@ -111,6 +123,7 @@ data:
     fi
 
     if [ -n "${EXT_IF}" ]; then
+      delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
       delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
       delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
     fi
@@ -120,6 +133,55 @@ data:
     delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
     delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
     delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
+    delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
+
+    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
+
+  firewall-check.sh: |
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    PORT="${1:-5847}"
+    VPN_CIDR="${2:-10.8.0.0/16}"
+    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
+    IPTABLES=(iptables -w 5)
+
+    external_interface() {
+      ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
+    }
+
+    EXT_IF="$(external_interface || true)"
+    if [ -z "${EXT_IF}" ]; then
+      EXT_IF="$(ip route show default | awk '{print $5; exit}')"
+    fi
+    if [ -z "${EXT_IF}" ]; then
+      echo "Unable to detect external interface" >&2
+      exit 1
+    fi
+
+    if "${IPTABLES[@]}" -C INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP >/dev/null 2>&1; then
+      echo "Unsafe broad UDP DROP on tailscale0 is present" >&2
+      exit 1
+    fi
+    if "${IPTABLES[@]}" -C INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT >/dev/null 2>&1; then
+      echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
+      exit 1
+    fi
+    if "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT >/dev/null 2>&1; then
+      echo "Unexpected AmneziaWG INPUT chain is present" >&2
+      exit 1
+    fi
+
+    "${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
+    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+
+    "${IPTABLES[@]}" -t nat -C POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
+    awg show awg0 >/dev/null 2>&1
 
   run.sh: |
     #!/usr/bin/env bash

k8s/apps/amnezia/daemonset.yaml

@@ -123,20 +123,29 @@ spec:
               command:
                 - /bin/bash
                 - -lc
-                - awg show awg0 >/dev/null 2>&1
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16
             initialDelaySeconds: 5
             periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
+            timeoutSeconds: 8
+            failureThreshold: 2
+          startupProbe:
+            exec:
+              command:
+                - /bin/bash
+                - -lc
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
+            periodSeconds: 5
+            timeoutSeconds: 15
+            failureThreshold: 12
           livenessProbe:
             exec:
               command:
                 - /bin/bash
                 - -lc
-                - awg show awg0 >/dev/null 2>&1
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
             initialDelaySeconds: 30
             periodSeconds: 30
-            timeoutSeconds: 5
+            timeoutSeconds: 15
             failureThreshold: 3
           resources:
             requests:

k8s/apps/doka2-lobby-list/app.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: doka2-lobby-list
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: doka2-lobby-list
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/doka2-lobby-list
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true

k8s/apps/doka2-lobby-list/deployment.yaml

@@ -0,0 +1,54 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: doka2-lobby-list
+  labels:
+    app: doka2-lobby-list
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: doka2-lobby-list
+  template:
+    metadata:
+      labels:
+        app: doka2-lobby-list
+    spec:
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+      volumes:
+        - name: creds
+          persistentVolumeClaim:
+            claimName: doka2-lobby-list-creds
+      containers:
+        - name: doka2-lobby-list
+          image: ultradesu/doka2-lobby-list:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: doka2-lobby-list-secrets
+                  key: ADMIN_PASSWORD
+            - name: CREDS_DIR
+              value: /data
+          volumeMounts:
+            - name: creds
+              mountPath: /data
+          resources:
+            requests:
+              cpu: "50m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"

k8s/apps/doka2-lobby-list/external-secrets.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: doka2-lobby-list-secrets
+spec:
+  target:
+    name: doka2-lobby-list-secrets
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        ADMIN_PASSWORD: |-
+          {{ .admin_password | trim }}
+  data:
+    - secretKey: admin_password
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: af4618dd-6431-4b20-b617-c00bae9ceff6
+        property: login.password

k8s/apps/doka2-lobby-list/ingress.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: doka2-lobby-list-tls-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: doka.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: doka2-lobby-list
+                port:
+                  number: 80
+  tls:
+    - secretName: doka2-lobby-list-tls
+      hosts:
+        - doka.hexor.cy

k8s/apps/doka2-lobby-list/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - deployment.yaml
+  - external-secrets.yaml
+  - service.yaml
+  - ingress.yaml
+  - storage.yaml

k8s/apps/doka2-lobby-list/service.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: doka2-lobby-list
+  labels:
+    app: doka2-lobby-list
+spec:
+  type: ClusterIP
+  selector:
+    app: doka2-lobby-list
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http

k8s/apps/doka2-lobby-list/storage.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: doka2-lobby-list-creds
+  labels:
+    app: doka2-lobby-list
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi

k8s/apps/teamspeak/deployment.yaml

@@ -17,6 +17,8 @@ spec:
       labels:
         app: teamspeak
     spec:
+      nodeSelector:
+        kubernetes.io/hostname: music.tail2fe2d.ts.net
       volumes:
         - name: data
           persistentVolumeClaim:

k8s/core/argocd/dex-probes-patch.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex-server
+  namespace: argocd
+spec:
+  template:
+    spec:
+      containers:
+        - name: dex-server
+          readinessProbe:
+            tcpSocket:
+              port: 5556
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3
+          livenessProbe:
+            tcpSocket:
+              port: 5556
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3

k8s/core/argocd/kustomization.yaml

@@ -16,3 +16,5 @@ helmCharts:
     valuesFile: values.yaml
     includeCRDs: true
 
+patches:
+  - path: dex-probes-patch.yaml

k8s/core/longhorn/app.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: core
   destination:
-    namespace: longhorn
+    namespace: longhorn-system
     server: https://kubernetes.default.svc
   source:
     repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git

k8s/core/longhorn/kustomization.yaml

@@ -9,7 +9,7 @@ helmCharts:
     repo: https://charts.longhorn.io
     version: 1.12.0
     releaseName: longhorn
-    namespace: longhorn
+    namespace: longhorn-system
     valuesFile: values.yaml
     includeCRDs: true