Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
8adbc57686 | ||
 Ultradesu
|
4662797118 | ||
|
Ultradesu
|
505bfec45a | ||
|
Ultradesu
|
a3b5811b83 | ||
|
Ultradesu
|
f58f979b3b | ||
|
Ultradesu
|
c4a3623e55 | ||
|
Ultradesu
|
dd3693095f | ||
|
Ultradesu
|
4273e62d68 | ||
|
Ultradesu
|
5d8a582e1e | ||
|
Ultradesu
|
31714fe357 | ||
|
Ultradesu
|
2e22f98eb4 |
@@ -42,7 +42,10 @@ ArgoCD homelab project
|
||||
|
||||
| Application | Status |
|
||||
| :--- | :---: |
|
||||
| **amnezia** | [](https://ag.hexor.cy/applications/argocd/amnezia) |
|
||||
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||
| **doka2-lobby-list** | [](https://ag.hexor.cy/applications/argocd/doka2-lobby-list) |
|
||||
| **firefly-iii** | [](https://ag.hexor.cy/applications/argocd/firefly-iii) |
|
||||
| **furumi** | [](https://ag.hexor.cy/applications/argocd/furumi) |
|
||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||
| **greece-notifier** | [](https://ag.hexor.cy/applications/argocd/greece-notifier) |
|
||||
@@ -53,6 +56,7 @@ ArgoCD homelab project
|
||||
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
||||
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
||||
| **lidarr** | [](https://ag.hexor.cy/applications/argocd/lidarr) |
|
||||
| **llamacpp** | [](https://ag.hexor.cy/applications/argocd/llamacpp) |
|
||||
| **matrix** | [](https://ag.hexor.cy/applications/argocd/matrix) |
|
||||
| **mtproxy** | [](https://ag.hexor.cy/applications/argocd/mtproxy) |
|
||||
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
||||
|
||||
@@ -0,0 +1,128 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: firefly-data-importer
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: data-importer
|
||||
image: fireflyiii/data-importer:version-2.3.4
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: FIREFLY_III_URL
|
||||
value: http://firefly-iii
|
||||
- name: VANITY_URL
|
||||
value: http://ff.lan
|
||||
- name: TRUSTED_PROXIES
|
||||
value: "**"
|
||||
- name: EXPECT_SECURE_URL
|
||||
value: "false"
|
||||
- name: VERIFY_TLS_SECURITY
|
||||
value: "true"
|
||||
- name: TZ
|
||||
value: Europe/London
|
||||
- name: APP_ENV
|
||||
value: production
|
||||
- name: APP_DEBUG
|
||||
value: "false"
|
||||
- name: LOG_LEVEL
|
||||
value: notice
|
||||
- name: ENABLE_BANKING_APP_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: firefly-data-importer-secrets
|
||||
key: ENABLE_BANKING_APP_ID
|
||||
- name: ENABLE_BANKING_PRIVATE_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: firefly-data-importer-secrets
|
||||
key: ENABLE_BANKING_PRIVATE_KEY
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: http
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 30
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: firefly-data-importer
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: firefly-data-importer
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
firefly.hexor.cy/private-ai: "true"
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik-ai
|
||||
spec:
|
||||
rules:
|
||||
- host: import.ff.lan
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: firefly-data-importer
|
||||
port:
|
||||
number: 80
|
||||
|
||||
@@ -46,4 +46,38 @@ spec:
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[2].value
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: firefly-data-importer-secrets
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
target:
|
||||
name: firefly-data-importer-secrets
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
ENABLE_BANKING_APP_ID: |-
|
||||
{{ .app_id }}
|
||||
ENABLE_BANKING_PRIVATE_KEY: |-
|
||||
{{ .private_key }}
|
||||
data:
|
||||
- secretKey: app_id
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[3].value
|
||||
- secretKey: private_key
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[4].value
|
||||
|
||||
@@ -3,9 +3,11 @@ kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- data-importer.yaml
|
||||
- external-secrets.yaml
|
||||
- postgres.yaml
|
||||
- storage.yaml
|
||||
- storage-prep.yaml
|
||||
- traefik-ai.yaml
|
||||
- network-policy.yaml
|
||||
|
||||
@@ -20,7 +22,7 @@ helmCharts:
|
||||
|
||||
patches:
|
||||
# Chart 0.1.2 requires postgres.enabled=true. Remove its StatefulSet and
|
||||
# redirect the generated database Service to the CloudNativePG primary.
|
||||
# make the generated database Service select the CloudNativePG instance.
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
@@ -37,14 +39,10 @@ patches:
|
||||
kind: Service
|
||||
name: firefly-iii-postgres
|
||||
patch: |-
|
||||
- op: remove
|
||||
path: /spec/selector
|
||||
- op: replace
|
||||
path: /spec/type
|
||||
value: ExternalName
|
||||
- op: add
|
||||
path: /spec/externalName
|
||||
value: firefly-postgres-rw.firefly-iii.svc.cluster.local
|
||||
path: /spec/selector
|
||||
value:
|
||||
cnpg.io/cluster: firefly-postgres
|
||||
# The upstream chart does not expose scheduling settings for its CronJob.
|
||||
- target:
|
||||
group: batch
|
||||
@@ -52,6 +50,15 @@ patches:
|
||||
kind: CronJob
|
||||
name: firefly-iii-cron
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/concurrencyPolicy
|
||||
value: Forbid
|
||||
- op: add
|
||||
path: /spec/jobTemplate/spec/backoffLimit
|
||||
value: 1
|
||||
- op: add
|
||||
path: /spec/jobTemplate/spec/activeDeadlineSeconds
|
||||
value: 600
|
||||
- op: add
|
||||
path: /spec/jobTemplate/spec/template/spec/nodeSelector
|
||||
value:
|
||||
@@ -63,6 +70,16 @@ patches:
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
- op: replace
|
||||
path: /spec/jobTemplate/spec/template/spec/containers/0/command
|
||||
value:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
- >-
|
||||
curl --fail --silent --show-error
|
||||
--retry 30 --retry-delay 10 --retry-all-errors
|
||||
--connect-timeout 5 --max-time 30
|
||||
"http://firefly-iii:80/api/v1/cron/${STATIC_CRON_TOKEN}"
|
||||
# A second independent filter in addition to ingressClassName.
|
||||
- target:
|
||||
group: networking.k8s.io
|
||||
@@ -73,3 +90,11 @@ patches:
|
||||
- op: add
|
||||
path: /metadata/labels/firefly.hexor.cy~1private-ai
|
||||
value: "true"
|
||||
# The shared Traefik has the same controller identifier and can discover
|
||||
# IngressClass objects. The explicit annotation partitions this Ingress
|
||||
# so only the instance configured with ingressclass=traefik-ai accepts it.
|
||||
- op: add
|
||||
path: /metadata/annotations/kubernetes.io~1ingress.class
|
||||
value: traefik-ai
|
||||
- op: remove
|
||||
path: /spec/ingressClassName
|
||||
|
||||
@@ -19,6 +19,14 @@ spec:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: firefly-iii
|
||||
app.kubernetes.io/name: firefly-iii
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
# hostNetwork traffic is seen as node traffic rather than Pod traffic.
|
||||
- ipBlock:
|
||||
cidr: 192.168.1.117/32
|
||||
- ipBlock:
|
||||
cidr: 100.77.155.120/32
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
@@ -56,4 +64,24 @@ spec:
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8000
|
||||
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: firefly-data-importer-ingress
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
# traefik-ai uses hostNetwork and is therefore seen as node traffic.
|
||||
- from:
|
||||
- ipBlock:
|
||||
cidr: 192.168.1.117/32
|
||||
- ipBlock:
|
||||
cidr: 100.77.155.120/32
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: firefly-storage-prep
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PreSync
|
||||
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
|
||||
spec:
|
||||
backoffLimit: 3
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-storage-prep
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: prepare
|
||||
image: busybox:1.37.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
- |
|
||||
mkdir -p /host/k8s/firefly-iii/postgres
|
||||
chown 26:26 /host/k8s/firefly-iii/postgres
|
||||
chmod 0700 /host/k8s/firefly-iii/postgres
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
add:
|
||||
- CHOWN
|
||||
- DAC_OVERRIDE
|
||||
- FOWNER
|
||||
volumeMounts:
|
||||
- name: host-root
|
||||
mountPath: /host/k8s/firefly-iii
|
||||
volumes:
|
||||
- name: host-root
|
||||
hostPath:
|
||||
path: /k8s/firefly-iii
|
||||
type: DirectoryOrCreate
|
||||
@@ -70,4 +70,3 @@ spec:
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
|
||||
|
||||
@@ -65,6 +65,14 @@ kind: ClusterRole
|
||||
metadata:
|
||||
name: firefly-traefik-ai
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
@@ -106,6 +114,8 @@ spec:
|
||||
app.kubernetes.io/name: traefik-ai
|
||||
spec:
|
||||
serviceAccountName: traefik-ai
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
@@ -118,7 +128,7 @@ spec:
|
||||
image: rancher/mirrored-library-traefik:3.6.13
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --entrypoints.web.address=:8000
|
||||
- --entrypoints.web.address=192.168.1.117:80
|
||||
- --providers.kubernetesingress=true
|
||||
- --providers.kubernetesingress.namespaces=firefly-iii
|
||||
- --providers.kubernetesingress.ingressclass=traefik-ai
|
||||
@@ -128,15 +138,18 @@ spec:
|
||||
- --log.level=INFO
|
||||
ports:
|
||||
- name: web
|
||||
containerPort: 8000
|
||||
containerPort: 80
|
||||
hostPort: 80
|
||||
hostIP: 192.168.1.117
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
host: 192.168.1.117
|
||||
port: web
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
host: 192.168.1.117
|
||||
port: web
|
||||
periodSeconds: 30
|
||||
resources:
|
||||
@@ -151,10 +164,12 @@ spec:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
|
||||
@@ -25,7 +25,7 @@ persistence:
|
||||
existingClaim: firefly-uploads
|
||||
|
||||
# Must remain true because chart 0.1.2 validates it. Kustomize removes the
|
||||
# generated StatefulSet and redirects this Service to CloudNativePG.
|
||||
# generated StatefulSet and makes this Service select the CloudNativePG Pod.
|
||||
postgres:
|
||||
enabled: true
|
||||
auth:
|
||||
@@ -66,4 +66,3 @@ firefly:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 1Gi
|
||||
|
||||
|
||||
Reference in New Issue
Block a user