Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-07-16 09:40:34

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

k8s/apps/amnezia/configmap-scripts.yaml

@@ -10,16 +10,12 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
-    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
-    IPTABLES=(iptables -w 30)
 
     external_interface() {
       ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
     }
 
-    ensure_rule() {
-      local mode="$1"
-      shift
+    ensure_insert_rule() {
       local table_args=()
       if [ "${1:-}" = "-t" ]; then
         table_args=("$1" "$2")
@@ -29,8 +25,8 @@ data:
       local chain="$1"
       shift
 
-      if ! "${IPTABLES[@]}" "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        "${IPTABLES[@]}" "${table_args[@]}" "${mode}" "${chain}" "$@"
+      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
+        iptables "${table_args[@]}" -I "${chain}" 1 "$@"
       fi
     }
 
@@ -44,15 +40,24 @@ data:
       local chain="$1"
       shift
 
-      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
         true
       done
     }
 
-    reset_chain() {
+    ensure_append_rule() {
+      local table_args=()
+      if [ "${1:-}" = "-t" ]; then
+        table_args=("$1" "$2")
+        shift 2
+      fi
+
       local chain="$1"
-      "${IPTABLES[@]}" -N "${chain}" >/dev/null 2>&1 || true
-      "${IPTABLES[@]}" -F "${chain}"
+      shift
+
+      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
+        iptables "${table_args[@]}" -A "${chain}" "$@"
+      fi
     }
 
     EXT_IF="$(external_interface || true)"
@@ -66,28 +71,13 @@ data:
 
     sysctl -w net.ipv4.ip_forward=1
 
-    # Remove rules written by older revisions. In particular, the unqualified
-    # tailscale UDP DROP also blocks Flannel VXLAN (UDP/8472).
     delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
-    delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
-    delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
-    delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
-    delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
-    delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
-    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-
-    reset_chain "${FORWARD_CHAIN}"
-    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -j RETURN
-    ensure_rule -A FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
-
-    ensure_rule -A -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
-
-    /scripts/firewall-check.sh "${PORT}" "${VPN_CIDR}"
+    ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
+    ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
 
   firewall-down.sh: |
     #!/usr/bin/env bash
@@ -95,8 +85,6 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
-    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
-    IPTABLES=(iptables -w 30)
 
     external_interface() {
       ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
@@ -112,7 +100,7 @@ data:
       local chain="$1"
       shift
 
-      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
         true
       done
     }
@@ -123,7 +111,6 @@ data:
     fi
 
     if [ -n "${EXT_IF}" ]; then
-      delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
       delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
       delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
     fi
@@ -133,55 +120,6 @@ data:
     delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
     delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
     delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
-    delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
-
-    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
-
-  firewall-check.sh: |
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    PORT="${1:-5847}"
-    VPN_CIDR="${2:-10.8.0.0/16}"
-    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
-    IPTABLES=(iptables -w 5)
-
-    external_interface() {
-      ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
-    }
-
-    EXT_IF="$(external_interface || true)"
-    if [ -z "${EXT_IF}" ]; then
-      EXT_IF="$(ip route show default | awk '{print $5; exit}')"
-    fi
-    if [ -z "${EXT_IF}" ]; then
-      echo "Unable to detect external interface" >&2
-      exit 1
-    fi
-
-    if "${IPTABLES[@]}" -C INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP >/dev/null 2>&1; then
-      echo "Unsafe broad UDP DROP on tailscale0 is present" >&2
-      exit 1
-    fi
-    if "${IPTABLES[@]}" -C INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT >/dev/null 2>&1; then
-      echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
-      exit 1
-    fi
-    if "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT >/dev/null 2>&1; then
-      echo "Unexpected AmneziaWG INPUT chain is present" >&2
-      exit 1
-    fi
-
-    "${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
-    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-
-    "${IPTABLES[@]}" -t nat -C POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
-    awg show awg0 >/dev/null 2>&1
 
   run.sh: |
     #!/usr/bin/env bash

k8s/apps/amnezia/daemonset.yaml

@@ -123,29 +123,20 @@ spec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16
+                - awg show awg0 >/dev/null 2>&1
             initialDelaySeconds: 5
             periodSeconds: 10
-            timeoutSeconds: 8
-            failureThreshold: 2
-          startupProbe:
-            exec:
-              command:
-                - /bin/bash
-                - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
-            periodSeconds: 5
-            timeoutSeconds: 15
-            failureThreshold: 12
+            timeoutSeconds: 3
+            failureThreshold: 3
           livenessProbe:
             exec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
+                - awg show awg0 >/dev/null 2>&1
             initialDelaySeconds: 30
             periodSeconds: 30
-            timeoutSeconds: 15
+            timeoutSeconds: 5
             failureThreshold: 3
           resources:
             requests:

k8s/apps/teamspeak/deployment.yaml

@@ -17,8 +17,6 @@ spec:
       labels:
         app: teamspeak
     spec:
-      nodeSelector:
-        kubernetes.io/hostname: music.tail2fe2d.ts.net
       volumes:
         - name: data
           persistentVolumeClaim:

k8s/core/argocd/dex-probes-patch.yaml

@@ -1,26 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: argocd-dex-server
-  namespace: argocd
-spec:
-  template:
-    spec:
-      containers:
-        - name: dex-server
-          readinessProbe:
-            tcpSocket:
-              port: 5556
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 3
-            successThreshold: 1
-            failureThreshold: 3
-          livenessProbe:
-            tcpSocket:
-              port: 5556
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 3
-            successThreshold: 1
-            failureThreshold: 3

k8s/core/argocd/kustomization.yaml

@@ -16,5 +16,3 @@ helmCharts:
     valuesFile: values.yaml
     includeCRDs: true
 
-patches:
-  - path: dex-probes-patch.yaml

k8s/core/longhorn/app.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: core
   destination:
-    namespace: longhorn-system
+    namespace: longhorn
     server: https://kubernetes.default.svc
   source:
     repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git

k8s/core/longhorn/kustomization.yaml

@@ -9,7 +9,7 @@ helmCharts:
     repo: https://charts.longhorn.io
     version: 1.12.0
     releaseName: longhorn
-    namespace: longhorn-system
+    namespace: longhorn
     valuesFile: values.yaml
     includeCRDs: true