Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-07-30 15:21:43

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

k8s/apps/firefly-iii/data-importer-ingress.yaml

@@ -0,0 +1,53 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: firefly-data-importer-auth
+spec:
+  forwardAuth:
+    address: http://auth-proxy.auth-proxy.svc:80/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-Auth-Request-User
+      - X-Auth-Request-Email
+      - X-Auth-Request-Groups
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: firefly-data-importer
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # OAuth callback is intentionally public. Data Importer validates both the
+    # state parameter and its browser session before exchanging the code.
+    - match: Host(`import.hexor.cy`) && Path(`/eb-callback`)
+      kind: Rule
+      priority: 200
+      services:
+        - name: firefly-data-importer
+          port: 80
+    # Everything else requires a valid auth-proxy session and group.
+    - match: Host(`import.hexor.cy`)
+      kind: Rule
+      priority: 100
+      middlewares:
+        - name: firefly-data-importer-auth
+      services:
+        - name: firefly-data-importer
+          port: 80
+  tls:
+    secretName: firefly-data-importer-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: firefly-data-importer-tls
+spec:
+  secretName: firefly-data-importer-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - import.hexor.cy
+

k8s/apps/firefly-iii/data-importer.yaml

@@ -103,26 +103,3 @@ spec:
       port: 80
       targetPort: http
       protocol: TCP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: firefly-data-importer
-  labels:
-    app.kubernetes.io/name: firefly-data-importer
-    firefly.hexor.cy/private-ai: "true"
-  annotations:
-    kubernetes.io/ingress.class: traefik-ai
-spec:
-  rules:
-    - host: import.ff.lan
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: firefly-data-importer
-                port:
-                  number: 80
-

k8s/apps/firefly-iii/external-secrets.yaml

@@ -63,7 +63,9 @@ spec:
         ENABLE_BANKING_APP_ID: |-
           {{ .app_id }}
         ENABLE_BANKING_PRIVATE_KEY: |-
-          {{ .private_key }}
+          -----BEGIN PRIVATE KEY-----
+          {{ .private_key | replace "-----BEGIN PRIVATE KEY-----" "" | replace "-----END PRIVATE KEY-----" "" | replace " " "" | trim }}
+          -----END PRIVATE KEY-----
   data:
     - secretKey: app_id
       sourceRef:

k8s/apps/firefly-iii/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - app.yaml
   - data-importer.yaml
+  - data-importer-ingress.yaml
   - external-secrets.yaml
   - postgres.yaml
   - storage.yaml
@@ -50,6 +51,15 @@ patches:
       kind: CronJob
       name: firefly-iii-cron
     patch: |-
+      - op: add
+        path: /spec/concurrencyPolicy
+        value: Forbid
+      - op: add
+        path: /spec/jobTemplate/spec/backoffLimit
+        value: 1
+      - op: add
+        path: /spec/jobTemplate/spec/activeDeadlineSeconds
+        value: 600
       - op: add
         path: /spec/jobTemplate/spec/template/spec/nodeSelector
         value:
@@ -61,6 +71,16 @@ patches:
             operator: Equal
             value: ai
             effect: NoSchedule
+      - op: replace
+        path: /spec/jobTemplate/spec/template/spec/containers/0/command
+        value:
+          - /bin/sh
+          - -ec
+          - >-
+            curl --fail --silent --show-error
+            --retry 30 --retry-delay 10 --retry-all-errors
+            --connect-timeout 5 --max-time 30
+            "http://firefly-iii:80/api/v1/cron/${STATIC_CRON_TOKEN}"
   # A second independent filter in addition to ingressClassName.
   - target:
       group: networking.k8s.io

k8s/apps/firefly-iii/network-policy.yaml

@@ -19,6 +19,9 @@ spec:
             matchLabels:
               app.kubernetes.io/instance: firefly-iii
               app.kubernetes.io/name: firefly-iii
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: firefly-data-importer
         # hostNetwork traffic is seen as node traffic rather than Pod traffic.
         - ipBlock:
             cidr: 192.168.1.117/32
@@ -73,7 +76,18 @@ spec:
   policyTypes:
     - Ingress
   ingress:
-    # traefik-ai uses hostNetwork and is therefore seen as node traffic.
+    # Shared Traefik serves the public HTTPS importer.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+    # Keep node traffic allowed for probes and local diagnostics.
     - from:
         - ipBlock:
             cidr: 192.168.1.117/32