Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-07-28 12:05:00 This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.
Fix amnezia iptables rules
2026-07-28 12:05:00 +00:00 · 2026-07-28 13:04:19 +01:00 · 2026-07-20 03:38:16 +03:00 · 2026-07-20 02:23:09 +03:00 · 2026-07-20 01:26:36 +03:00 · 2026-07-20 01:19:39 +03:00
10 changed files with 140 additions and 34 deletions
@@ -42,7 +42,9 @@ ArgoCD homelab project

 | Application | Status |
 | :--- | :---: |
+| **amnezia** | [![amnezia](https://ag.hexor.cy/api/badge?name=amnezia&revision=true)](https://ag.hexor.cy/applications/argocd/amnezia) |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
+| **doka2-lobby-list** | [![doka2-lobby-list](https://ag.hexor.cy/api/badge?name=doka2-lobby-list&revision=true)](https://ag.hexor.cy/applications/argocd/doka2-lobby-list) |
 | **furumi** | [![furumi](https://ag.hexor.cy/api/badge?name=furumi&revision=true)](https://ag.hexor.cy/applications/argocd/furumi) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
@@ -53,6 +55,7 @@ ArgoCD homelab project
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
 | **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
+| **llamacpp** | [![llamacpp](https://ag.hexor.cy/api/badge?name=llamacpp&revision=true)](https://ag.hexor.cy/applications/argocd/llamacpp) |
 | **matrix** | [![matrix](https://ag.hexor.cy/api/badge?name=matrix&revision=true)](https://ag.hexor.cy/applications/argocd/matrix) |
 | **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
 | **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |
@@ -10,12 +10,17 @@ data:

    PORT="${1:-5847}"
    VPN_CIDR="${2:-10.8.0.0/16}"
+    INPUT_CHAIN="AMNEZIAWG-INPUT"
+    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
+    IPTABLES=(iptables -w 30)

    external_interface() {
      ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
    }

-    ensure_insert_rule() {
+    ensure_rule() {
+      local mode="$1"
+      shift
      local table_args=()
      if [ "${1:-}" = "-t" ]; then
        table_args=("$1" "$2")
@@ -25,8 +30,8 @@ data:
      local chain="$1"
      shift

-      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        iptables "${table_args[@]}" -I "${chain}" 1 "$@"
+      if ! "${IPTABLES[@]}" "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
+        "${IPTABLES[@]}" "${table_args[@]}" "${mode}" "${chain}" "$@"
      fi
    }

@@ -40,24 +45,15 @@ data:
      local chain="$1"
      shift

-      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
        true
      done
    }

-    ensure_append_rule() {
-      local table_args=()
-      if [ "${1:-}" = "-t" ]; then
-        table_args=("$1" "$2")
-        shift 2
-      fi
-
+    reset_chain() {
      local chain="$1"
-      shift
-
-      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        iptables "${table_args[@]}" -A "${chain}" "$@"
-      fi
+      "${IPTABLES[@]}" -N "${chain}" >/dev/null 2>&1 || true
+      "${IPTABLES[@]}" -F "${chain}"
    }

    EXT_IF="$(external_interface || true)"
@@ -71,13 +67,32 @@ data:

    sysctl -w net.ipv4.ip_forward=1

+    # Remove rules written by older revisions. In particular, the unqualified
+    # tailscale UDP DROP also blocks Flannel VXLAN (UDP/8472).
    delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
-    ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
-    ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
-    ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
-    ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
+    delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
+    delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
+    delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+
+    reset_chain "${INPUT_CHAIN}"
+    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
+    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -j RETURN
+    ensure_rule -I INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
+
+    reset_chain "${FORWARD_CHAIN}"
+    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -j RETURN
+    ensure_rule -A FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
+
+    ensure_rule -A -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
+
+    /scripts/firewall-check.sh "${PORT}" "${VPN_CIDR}"

  firewall-down.sh: |
    #!/usr/bin/env bash
@@ -85,6 +100,9 @@ data:

    PORT="${1:-5847}"
    VPN_CIDR="${2:-10.8.0.0/16}"
+    INPUT_CHAIN="AMNEZIAWG-INPUT"
+    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
+    IPTABLES=(iptables -w 30)

    external_interface() {
      ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
@@ -100,7 +118,7 @@ data:
      local chain="$1"
      shift

-      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
        true
      done
    }
@@ -111,6 +129,7 @@ data:
    fi

    if [ -n "${EXT_IF}" ]; then
+      delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
      delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
      delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
    fi
@@ -120,6 +139,57 @@ data:
    delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
    delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
    delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    delete_rule INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
+    delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
+
+    "${IPTABLES[@]}" -F "${INPUT_CHAIN}" >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -X "${INPUT_CHAIN}" >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
+
+  firewall-check.sh: |
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    PORT="${1:-5847}"
+    VPN_CIDR="${2:-10.8.0.0/16}"
+    INPUT_CHAIN="AMNEZIAWG-INPUT"
+    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
+    IPTABLES=(iptables -w 5)
+
+    external_interface() {
+      ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
+    }
+
+    EXT_IF="$(external_interface || true)"
+    if [ -z "${EXT_IF}" ]; then
+      EXT_IF="$(ip route show default | awk '{print $5; exit}')"
+    fi
+    if [ -z "${EXT_IF}" ]; then
+      echo "Unable to detect external interface" >&2
+      exit 1
+    fi
+
+    if "${IPTABLES[@]}" -C INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP >/dev/null 2>&1; then
+      echo "Unsafe broad UDP DROP on tailscale0 is present" >&2
+      exit 1
+    fi
+    if "${IPTABLES[@]}" -C INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT >/dev/null 2>&1; then
+      echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
+      exit 1
+    fi
+
+    "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
+    "${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    "${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    "${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
+
+    "${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
+    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+
+    "${IPTABLES[@]}" -t nat -C POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
+    awg show awg0 >/dev/null 2>&1

  run.sh: |
    #!/usr/bin/env bash
@@ -123,20 +123,20 @@ spec:
              command:
                - /bin/bash
                - -lc
-                - awg show awg0 >/dev/null 2>&1
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16
            initialDelaySeconds: 5
            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
+            timeoutSeconds: 8
+            failureThreshold: 2
          livenessProbe:
            exec:
              command:
                - /bin/bash
                - -lc
-                - awg show awg0 >/dev/null 2>&1
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16
            initialDelaySeconds: 30
            periodSeconds: 30
-            timeoutSeconds: 5
+            timeoutSeconds: 8
            failureThreshold: 3
          resources:
            requests:
@@ -19,6 +19,9 @@ spec:
    spec:
      nodeSelector:
        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
      volumes:
        - name: creds
          persistentVolumeClaim:
@@ -29,7 +32,7 @@ spec:
          imagePullPolicy: Always
          ports:
            - name: http
-              containerPort: 8000
+              containerPort: 3000
              protocol: TCP
          env:
            - name: ADMIN_PASSWORD
@@ -38,10 +41,10 @@ spec:
                  name: doka2-lobby-list-secrets
                  key: ADMIN_PASSWORD
            - name: CREDS_DIR
-              value: /data/creds
+              value: /data
          volumeMounts:
            - name: creds
-              mountPath: /data/creds
+              mountPath: /data
          resources:
            requests:
              cpu: "50m"
@@ -23,4 +23,4 @@ spec:
        decodingStrategy: None
        metadataPolicy: None
        key: af4618dd-6431-4b20-b617-c00bae9ceff6
-        property: password
+        property: login.password
@@ -17,6 +17,8 @@ spec:
      labels:
        app: teamspeak
    spec:
+      nodeSelector:
+        kubernetes.io/hostname: music.tail2fe2d.ts.net
      volumes:
        - name: data
          persistentVolumeClaim:
@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex-server
+  namespace: argocd
+spec:
+  template:
+    spec:
+      containers:
+        - name: dex-server
+          readinessProbe:
+            tcpSocket:
+              port: 5556
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3
+          livenessProbe:
+            tcpSocket:
+              port: 5556
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3
@@ -16,3 +16,5 @@ helmCharts:
    valuesFile: values.yaml
    includeCRDs: true

+patches:
+  - path: dex-probes-patch.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
  project: core
  destination:
-    namespace: longhorn
+    namespace: longhorn-system
    server: https://kubernetes.default.svc
  source:
    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
@@ -9,7 +9,7 @@ helmCharts:
    repo: https://charts.longhorn.io
    version: 1.12.0
    releaseName: longhorn
-    namespace: longhorn
+    namespace: longhorn-system
    valuesFile: values.yaml
    includeCRDs: true
Author	SHA1	Message	Date
Gitea Actions Bot	62224a585b	Auto-update README with current k8s applications Keycloak Terraform / Terraform (pull_request) Failing after 22s Details Generated by CI/CD workflow on 2026-07-28 12:05:00 This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.	2026-07-28 12:05:00 +00:00
Ultradesu	1059e430a0	Fix amnezia iptables rules Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 11s Details Check with kubeconform / lint (push) Successful in 9s Details Auto-update README / Generate README and Create MR (push) Successful in 8s Details	2026-07-28 13:04:19 +01:00
Ultradesu	f3d199415f	moved TS Check with kubeconform / lint (push) Successful in 14s Details Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 11s Details Auto-update README / Generate README and Create MR (push) Successful in 14s Details	2026-07-20 03:38:16 +03:00
Ultradesu	ef0123b5fb	fixed longhorn Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 30s Details Check with kubeconform / lint (push) Successful in 2m43s Details Auto-update README / Generate README and Create MR (push) Successful in 17s Details	2026-07-20 02:23:09 +03:00
Ultradesu	207b04d0a8	Moved longhorn to new NS Auto-update README / Generate README and Create MR (push) Successful in 1m14s Details Check with kubeconform / lint (push) Successful in 24s Details Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Failing after 11m44s Details	2026-07-20 01:26:36 +03:00
Ultradesu	5ef058fbef	Fixed dex probes Check with kubeconform / lint (push) Successful in 2m46s Details Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 15s Details Auto-update README / Generate README and Create MR (push) Successful in 18s Details	2026-07-20 01:19:39 +03:00
Ultradesu	ff57d1a07c	Fixed doka2-lobby-list steam creds storage Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 6s Details Check with kubeconform / lint (push) Successful in 6s Details Auto-update README / Generate README and Create MR (push) Successful in 4s Details	2026-07-16 12:40:09 +03:00
ab	a93a29655b	added doka2-lobby-list Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 6s Details Check with kubeconform / lint (push) Successful in 6s Details Auto-update README / Generate README and Create MR (push) Successful in 5s Details	2026-07-13 16:07:43 +03:00
ab	bd8963bcb9	added doka2-lobby-list Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 5s Details Check with kubeconform / lint (push) Successful in 5s Details Auto-update README / Generate README and Create MR (push) Successful in 5s Details	2026-07-13 16:05:46 +03:00