Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-07-19 23:27:07

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -45,7 +45,6 @@ ArgoCD homelab project
 | **amnezia** | [![amnezia](https://ag.hexor.cy/api/badge?name=amnezia&revision=true)](https://ag.hexor.cy/applications/argocd/amnezia) |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
 | **doka2-lobby-list** | [![doka2-lobby-list](https://ag.hexor.cy/api/badge?name=doka2-lobby-list&revision=true)](https://ag.hexor.cy/applications/argocd/doka2-lobby-list) |
-| **firefly-iii** | [![firefly-iii](https://ag.hexor.cy/api/badge?name=firefly-iii&revision=true)](https://ag.hexor.cy/applications/argocd/firefly-iii) |
 | **furumi** | [![furumi](https://ag.hexor.cy/api/badge?name=furumi&revision=true)](https://ag.hexor.cy/applications/argocd/furumi) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |

k8s/apps/amnezia/configmap-scripts.yaml

@@ -10,16 +10,12 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
-    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
-    IPTABLES=(iptables -w 30)
 
     external_interface() {
       ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
     }
 
-    ensure_rule() {
+    ensure_insert_rule() {
-      local mode="$1"
-      shift
       local table_args=()
       if [ "${1:-}" = "-t" ]; then
         table_args=("$1" "$2")
@@ -29,8 +25,8 @@ data:
       local chain="$1"
       shift
 
-      if ! "${IPTABLES[@]}" "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
+      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        "${IPTABLES[@]}" "${table_args[@]}" "${mode}" "${chain}" "$@"
+        iptables "${table_args[@]}" -I "${chain}" 1 "$@"
       fi
     }
 
@@ -44,15 +40,24 @@ data:
       local chain="$1"
       shift
 
-      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
         true
       done
     }
 
-    reset_chain() {
+    ensure_append_rule() {
+      local table_args=()
+      if [ "${1:-}" = "-t" ]; then
+        table_args=("$1" "$2")
+        shift 2
+      fi
+
       local chain="$1"
-      "${IPTABLES[@]}" -N "${chain}" >/dev/null 2>&1 || true
+      shift
-      "${IPTABLES[@]}" -F "${chain}"
+
+      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
+        iptables "${table_args[@]}" -A "${chain}" "$@"
+      fi
     }
 
     EXT_IF="$(external_interface || true)"
@@ -66,28 +71,13 @@ data:
 
     sysctl -w net.ipv4.ip_forward=1
 
-    # Remove rules written by older revisions. In particular, the unqualified
-    # tailscale UDP DROP also blocks Flannel VXLAN (UDP/8472).
     delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
-    delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
+    ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
-    delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
-    delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
-    delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
+    ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
-    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
-    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-
-    reset_chain "${FORWARD_CHAIN}"
-    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -j RETURN
-    ensure_rule -A FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
-
-    ensure_rule -A -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
-
-    /scripts/firewall-check.sh "${PORT}" "${VPN_CIDR}"
 
   firewall-down.sh: |
     #!/usr/bin/env bash
@@ -95,8 +85,6 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
-    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
-    IPTABLES=(iptables -w 30)
 
     external_interface() {
       ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
@@ -112,7 +100,7 @@ data:
       local chain="$1"
       shift
 
-      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
         true
       done
     }
@@ -123,7 +111,6 @@ data:
     fi
 
     if [ -n "${EXT_IF}" ]; then
-      delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
       delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
       delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
     fi
@@ -133,55 +120,6 @@ data:
     delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
     delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
     delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
-    delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
-
-    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
-
-  firewall-check.sh: |
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    PORT="${1:-5847}"
-    VPN_CIDR="${2:-10.8.0.0/16}"
-    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
-    IPTABLES=(iptables -w 5)
-
-    external_interface() {
-      ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
-    }
-
-    EXT_IF="$(external_interface || true)"
-    if [ -z "${EXT_IF}" ]; then
-      EXT_IF="$(ip route show default | awk '{print $5; exit}')"
-    fi
-    if [ -z "${EXT_IF}" ]; then
-      echo "Unable to detect external interface" >&2
-      exit 1
-    fi
-
-    if "${IPTABLES[@]}" -C INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP >/dev/null 2>&1; then
-      echo "Unsafe broad UDP DROP on tailscale0 is present" >&2
-      exit 1
-    fi
-    if "${IPTABLES[@]}" -C INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT >/dev/null 2>&1; then
-      echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
-      exit 1
-    fi
-    if "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT >/dev/null 2>&1; then
-      echo "Unexpected AmneziaWG INPUT chain is present" >&2
-      exit 1
-    fi
-
-    "${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
-    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-
-    "${IPTABLES[@]}" -t nat -C POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
-    awg show awg0 >/dev/null 2>&1
 
   run.sh: |
     #!/usr/bin/env bash

k8s/apps/amnezia/daemonset.yaml

@@ -123,29 +123,20 @@ spec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16
+                - awg show awg0 >/dev/null 2>&1
             initialDelaySeconds: 5
             periodSeconds: 10
-            timeoutSeconds: 8
+            timeoutSeconds: 3
-            failureThreshold: 2
+            failureThreshold: 3
-          startupProbe:
-            exec:
-              command:
-                - /bin/bash
-                - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
-            periodSeconds: 5
-            timeoutSeconds: 15
-            failureThreshold: 12
           livenessProbe:
             exec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
+                - awg show awg0 >/dev/null 2>&1
             initialDelaySeconds: 30
             periodSeconds: 30
-            timeoutSeconds: 15
+            timeoutSeconds: 5
             failureThreshold: 3
           resources:
             requests:

k8s/apps/firefly-iii/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: firefly-iii
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: firefly-iii
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/firefly-iii
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-

k8s/apps/firefly-iii/external-secrets.yaml

@@ -1,49 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: firefly-secrets
-spec:
-  refreshInterval: 1h
-  target:
-    name: firefly-secrets
-    creationPolicy: Owner
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        # Firefly and CloudNativePG deliberately share this generated Secret.
-        username: firefly
-        password: |-
-          {{ .db_password }}
-        DB_PASSWORD: |-
-          {{ .db_password }}
-        APP_KEY: |-
-          {{ .app_key }}
-        STATIC_CRON_TOKEN: |-
-          {{ .cron_token }}
-  data:
-    - secretKey: db_password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: a1867c81-715c-47cd-978d-14ea5bcedea9
-        property: fields[0].value
-    - secretKey: app_key
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: a1867c81-715c-47cd-978d-14ea5bcedea9
-        property: fields[1].value
-    - secretKey: cron_token
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: a1867c81-715c-47cd-978d-14ea5bcedea9
-        property: fields[2].value
-

k8s/apps/firefly-iii/kustomization.yaml

@@ -1,80 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - external-secrets.yaml
-  - postgres.yaml
-  - storage.yaml
-  - storage-prep.yaml
-  - traefik-ai.yaml
-  - network-policy.yaml
-
-helmCharts:
-  - name: firefly-iii
-    repo: https://harish2k01.github.io/helm-charts
-    version: 0.1.2
-    releaseName: firefly-iii
-    namespace: firefly-iii
-    valuesFile: values.yaml
-    includeCRDs: true
-
-patches:
-  # Chart 0.1.2 requires postgres.enabled=true. Remove its StatefulSet and
-  # make the generated database Service select the CloudNativePG instance.
-  - target:
-      group: apps
-      version: v1
-      kind: StatefulSet
-      name: firefly-iii-postgres
-    patch: |-
-      $patch: delete
-      apiVersion: apps/v1
-      kind: StatefulSet
-      metadata:
-        name: firefly-iii-postgres
-  - target:
-      version: v1
-      kind: Service
-      name: firefly-iii-postgres
-    patch: |-
-      - op: replace
-        path: /spec/selector
-        value:
-          cnpg.io/cluster: firefly-postgres
-  # The upstream chart does not expose scheduling settings for its CronJob.
-  - target:
-      group: batch
-      version: v1
-      kind: CronJob
-      name: firefly-iii-cron
-    patch: |-
-      - op: add
-        path: /spec/jobTemplate/spec/template/spec/nodeSelector
-        value:
-          kubernetes.io/hostname: ai.tail2fe2d.ts.net
-      - op: add
-        path: /spec/jobTemplate/spec/template/spec/tolerations
-        value:
-          - key: workload
-            operator: Equal
-            value: ai
-            effect: NoSchedule
-  # A second independent filter in addition to ingressClassName.
-  - target:
-      group: networking.k8s.io
-      version: v1
-      kind: Ingress
-      name: firefly-iii
-    patch: |-
-      - op: add
-        path: /metadata/labels/firefly.hexor.cy~1private-ai
-        value: "true"
-      # The shared Traefik has the same controller identifier and can discover
-      # IngressClass objects. The explicit annotation partitions this Ingress
-      # so only the instance configured with ingressclass=traefik-ai accepts it.
-      - op: add
-        path: /metadata/annotations/kubernetes.io~1ingress.class
-        value: traefik-ai
-      - op: remove
-        path: /spec/ingressClassName

k8s/apps/firefly-iii/network-policy.yaml

@@ -1,63 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: firefly-ingress
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/instance: firefly-iii
-      app.kubernetes.io/name: firefly-iii
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: traefik-ai
-        # The chart's CronJob uses the same selector labels as the application.
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/instance: firefly-iii
-              app.kubernetes.io/name: firefly-iii
-        # hostNetwork traffic is seen as node traffic rather than Pod traffic.
-        - ipBlock:
-            cidr: 192.168.1.117/32
-        - ipBlock:
-            cidr: 100.77.155.120/32
-      ports:
-        - protocol: TCP
-          port: 8080
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: firefly-postgres-ingress
-spec:
-  podSelector:
-    matchLabels:
-      cnpg.io/cluster: firefly-postgres
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/instance: firefly-iii
-              app.kubernetes.io/name: firefly-iii
-        - podSelector:
-            matchLabels:
-              cnpg.io/cluster: firefly-postgres
-      ports:
-        - protocol: TCP
-          port: 5432
-    # CloudNativePG operator health/status traffic to the instance manager.
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: psql
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: cloudnative-pg
-      ports:
-        - protocol: TCP
-          port: 8000

k8s/apps/firefly-iii/postgres.yaml

@@ -1,49 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: firefly-postgres
-spec:
-  description: PostgreSQL for Firefly III
-  instances: 1
-  enableSuperuserAccess: false
-  primaryUpdateStrategy: unsupervised
-  bootstrap:
-    initdb:
-      database: firefly
-      owner: firefly
-      secret:
-        name: firefly-secrets
-      dataChecksums: true
-  storage:
-    size: 10Gi
-    storageClass: firefly-local
-    pvcTemplate:
-      accessModes:
-        - ReadWriteOnce
-      storageClassName: firefly-local
-      selector:
-        matchLabels:
-          app.kubernetes.io/name: firefly-postgres
-      resources:
-        requests:
-          storage: 10Gi
-      volumeMode: Filesystem
-  affinity:
-    enablePodAntiAffinity: false
-    nodeSelector:
-      kubernetes.io/hostname: ai.tail2fe2d.ts.net
-    tolerations:
-      - key: workload
-        operator: Equal
-        value: ai
-        effect: NoSchedule
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      cpu: "1"
-      memory: 1Gi
-  monitoring:
-    enablePodMonitor: true
-

k8s/apps/firefly-iii/storage-prep.yaml

@@ -1,52 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: firefly-storage-prep
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
-spec:
-  backoffLimit: 3
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: firefly-storage-prep
-    spec:
-      restartPolicy: OnFailure
-      nodeSelector:
-        kubernetes.io/hostname: ai.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: ai
-          effect: NoSchedule
-      containers:
-        - name: prepare
-          image: busybox:1.37.0
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/sh
-            - -ec
-            - |
-              mkdir -p /host/k8s/firefly-iii/postgres
-              chown 26:26 /host/k8s/firefly-iii/postgres
-              chmod 0700 /host/k8s/firefly-iii/postgres
-          securityContext:
-            runAsUser: 0
-            runAsGroup: 0
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-              add:
-                - CHOWN
-                - DAC_OVERRIDE
-                - FOWNER
-          volumeMounts:
-            - name: host-root
-              mountPath: /host/k8s/firefly-iii
-      volumes:
-        - name: host-root
-          hostPath:
-            path: /k8s/firefly-iii
-            type: DirectoryOrCreate

k8s/apps/firefly-iii/storage.yaml

@@ -1,72 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: firefly-local
-provisioner: kubernetes.io/no-provisioner
-reclaimPolicy: Retain
-volumeBindingMode: WaitForFirstConsumer
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: firefly-postgres
-  labels:
-    app.kubernetes.io/name: firefly-postgres
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: firefly-local
-  volumeMode: Filesystem
-  hostPath:
-    path: /k8s/firefly-iii/postgres
-    type: DirectoryOrCreate
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values:
-                - ai.tail2fe2d.ts.net
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: firefly-uploads
-  labels:
-    app.kubernetes.io/name: firefly-uploads
-spec:
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: firefly-local
-  volumeMode: Filesystem
-  hostPath:
-    path: /k8s/firefly-iii/uploads
-    type: DirectoryOrCreate
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values:
-                - ai.tail2fe2d.ts.net
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: firefly-uploads
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: firefly-local
-  volumeName: firefly-uploads
-  resources:
-    requests:
-      storage: 5Gi

k8s/apps/firefly-iii/traefik-ai.yaml

@@ -1,175 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: IngressClass
-metadata:
-  name: traefik-ai
-spec:
-  controller: traefik.io/ingress-controller
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: traefik-ai
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: traefik-ai
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-      - secrets
-      - endpoints
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses/status
-    verbs:
-      - update
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: traefik-ai
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: traefik-ai
-subjects:
-  - kind: ServiceAccount
-    name: traefik-ai
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: firefly-traefik-ai
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: firefly-traefik-ai
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: firefly-traefik-ai
-subjects:
-  - kind: ServiceAccount
-    name: traefik-ai
-    namespace: firefly-iii
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: traefik-ai
-  labels:
-    app.kubernetes.io/name: traefik-ai
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: traefik-ai
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: traefik-ai
-    spec:
-      serviceAccountName: traefik-ai
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-      nodeSelector:
-        kubernetes.io/hostname: ai.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: ai
-          effect: NoSchedule
-      containers:
-        - name: traefik
-          image: rancher/mirrored-library-traefik:3.6.13
-          imagePullPolicy: IfNotPresent
-          args:
-            - --entrypoints.web.address=192.168.1.117:80
-            - --providers.kubernetesingress=true
-            - --providers.kubernetesingress.namespaces=firefly-iii
-            - --providers.kubernetesingress.ingressclass=traefik-ai
-            - --providers.kubernetesingress.labelselector=firefly.hexor.cy/private-ai=true
-            - --providers.kubernetescrd=false
-            - --api.dashboard=false
-            - --log.level=INFO
-          ports:
-            - name: web
-              containerPort: 80
-              hostPort: 80
-              hostIP: 192.168.1.117
-              protocol: TCP
-          readinessProbe:
-            tcpSocket:
-              host: 192.168.1.117
-              port: web
-            periodSeconds: 10
-          livenessProbe:
-            tcpSocket:
-              host: 192.168.1.117
-              port: web
-            periodSeconds: 30
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-              add:
-                - NET_BIND_SERVICE
-            readOnlyRootFilesystem: true
-            runAsNonRoot: false
-            runAsUser: 0
-            runAsGroup: 0
-      securityContext:
-        seccompProfile:
-          type: RuntimeDefault

k8s/apps/firefly-iii/values.yaml

@@ -1,68 +0,0 @@
-replicaCount: 1
-
-image:
-  repository: fireflyiii/core
-  tag: version-6.6.1
-  pullPolicy: IfNotPresent
-
-service:
-  type: ClusterIP
-  port: 80
-  targetPort: 8080
-
-ingress:
-  enabled: true
-  className: traefik-ai
-  hosts:
-    - host: ff.lan
-      paths:
-        - path: /
-          pathType: Prefix
-
-persistence:
-  upload:
-    enabled: true
-    existingClaim: firefly-uploads
-
-# Must remain true because chart 0.1.2 validates it. Kustomize removes the
-# generated StatefulSet and makes this Service select the CloudNativePG Pod.
-postgres:
-  enabled: true
-  auth:
-    database: firefly
-    username: firefly
-  service:
-    port: 5432
-
-cronjob:
-  enabled: true
-  schedule: "0 3 * * *"
-  timeZone: Europe/London
-
-firefly:
-  env:
-    APP_ENV: production
-    APP_DEBUG: "false"
-    APP_URL: http://ff.lan
-    SITE_OWNER: owner@ff.lan
-    TZ: Europe/London
-    DEFAULT_LANGUAGE: en_US
-    TRUSTED_PROXIES: 10.42.0.0/16
-    COOKIE_SECURE: "false"
-    PGSQL_SSL_MODE: prefer
-  secrets:
-    existingSecret: firefly-secrets
-  nodeSelector:
-    kubernetes.io/hostname: ai.tail2fe2d.ts.net
-  tolerations:
-    - key: workload
-      operator: Equal
-      value: ai
-      effect: NoSchedule
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      cpu: "2"
-      memory: 1Gi

k8s/apps/teamspeak/deployment.yaml

@@ -17,8 +17,6 @@ spec:
       labels:
         app: teamspeak
     spec:
-      nodeSelector:
-        kubernetes.io/hostname: music.tail2fe2d.ts.net
       volumes:
         - name: data
           persistentVolumeClaim: