Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-07-28 12:05:00

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

k8s/apps/amnezia/configmap-scripts.yaml

@@ -10,6 +10,7 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
+    INPUT_CHAIN="AMNEZIAWG-INPUT"
     FORWARD_CHAIN="AMNEZIAWG-FORWARD"
     IPTABLES=(iptables -w 30)
 
@@ -75,9 +76,13 @@ data:
     delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
     delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
     delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
-    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
+
+    reset_chain "${INPUT_CHAIN}"
+    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
+    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -j RETURN
+    ensure_rule -I INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
 
     reset_chain "${FORWARD_CHAIN}"
     "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
@@ -95,6 +100,7 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
+    INPUT_CHAIN="AMNEZIAWG-INPUT"
     FORWARD_CHAIN="AMNEZIAWG-FORWARD"
     IPTABLES=(iptables -w 30)
 
@@ -133,11 +139,11 @@ data:
     delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
     delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
     delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
+    delete_rule INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
     delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
 
-    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -F "${INPUT_CHAIN}" >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -X "${INPUT_CHAIN}" >/dev/null 2>&1 || true
     "${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
     "${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
 
@@ -147,6 +153,7 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
+    INPUT_CHAIN="AMNEZIAWG-INPUT"
     FORWARD_CHAIN="AMNEZIAWG-FORWARD"
     IPTABLES=(iptables -w 5)
 
@@ -171,10 +178,11 @@ data:
       echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
       exit 1
     fi
-    if "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT >/dev/null 2>&1; then
-      echo "Unexpected AmneziaWG INPUT chain is present" >&2
-      exit 1
-    fi
+
+    "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
+    "${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    "${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    "${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
 
     "${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
     "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT

k8s/apps/amnezia/daemonset.yaml

@@ -128,24 +128,15 @@ spec:
             periodSeconds: 10
             timeoutSeconds: 8
             failureThreshold: 2
-          startupProbe:
-            exec:
-              command:
-                - /bin/bash
-                - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
-            periodSeconds: 5
-            timeoutSeconds: 15
-            failureThreshold: 12
           livenessProbe:
             exec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16
             initialDelaySeconds: 30
             periodSeconds: 30
-            timeoutSeconds: 15
+            timeoutSeconds: 8
             failureThreshold: 3
           resources:
             requests: