Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-07-30 15:21:43

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -42,7 +42,10 @@ ArgoCD homelab project
 
 | Application | Status |
 | :--- | :---: |
+| **amnezia** | [![amnezia](https://ag.hexor.cy/api/badge?name=amnezia&revision=true)](https://ag.hexor.cy/applications/argocd/amnezia) |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
+| **doka2-lobby-list** | [![doka2-lobby-list](https://ag.hexor.cy/api/badge?name=doka2-lobby-list&revision=true)](https://ag.hexor.cy/applications/argocd/doka2-lobby-list) |
+| **firefly-iii** | [![firefly-iii](https://ag.hexor.cy/api/badge?name=firefly-iii&revision=true)](https://ag.hexor.cy/applications/argocd/firefly-iii) |
 | **furumi** | [![furumi](https://ag.hexor.cy/api/badge?name=furumi&revision=true)](https://ag.hexor.cy/applications/argocd/furumi) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
@@ -53,6 +56,7 @@ ArgoCD homelab project
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
 | **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
+| **llamacpp** | [![llamacpp](https://ag.hexor.cy/api/badge?name=llamacpp&revision=true)](https://ag.hexor.cy/applications/argocd/llamacpp) |
 | **matrix** | [![matrix](https://ag.hexor.cy/api/badge?name=matrix&revision=true)](https://ag.hexor.cy/applications/argocd/matrix) |
 | **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
 | **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |

k8s/apps/firefly-iii/data-importer-ingress.yaml

@@ -0,0 +1,53 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: firefly-data-importer-auth
+spec:
+  forwardAuth:
+    address: http://auth-proxy.auth-proxy.svc:80/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-Auth-Request-User
+      - X-Auth-Request-Email
+      - X-Auth-Request-Groups
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: firefly-data-importer
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # OAuth callback is intentionally public. Data Importer validates both the
+    # state parameter and its browser session before exchanging the code.
+    - match: Host(`import.hexor.cy`) && Path(`/eb-callback`)
+      kind: Rule
+      priority: 200
+      services:
+        - name: firefly-data-importer
+          port: 80
+    # Everything else requires a valid auth-proxy session and group.
+    - match: Host(`import.hexor.cy`)
+      kind: Rule
+      priority: 100
+      middlewares:
+        - name: firefly-data-importer-auth
+      services:
+        - name: firefly-data-importer
+          port: 80
+  tls:
+    secretName: firefly-data-importer-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: firefly-data-importer-tls
+spec:
+  secretName: firefly-data-importer-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - import.hexor.cy
+

k8s/apps/firefly-iii/data-importer.yaml

@@ -103,26 +103,3 @@ spec:
       port: 80
       targetPort: http
       protocol: TCP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: firefly-data-importer
-  labels:
-    app.kubernetes.io/name: firefly-data-importer
-    firefly.hexor.cy/private-ai: "true"
-  annotations:
-    kubernetes.io/ingress.class: traefik-ai
-spec:
-  rules:
-    - host: import.ff.lan
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: firefly-data-importer
-                port:
-                  number: 80
-

k8s/apps/firefly-iii/external-secrets.yaml

@@ -63,7 +63,9 @@ spec:
         ENABLE_BANKING_APP_ID: |-
           {{ .app_id }}
         ENABLE_BANKING_PRIVATE_KEY: |-
-          {{ .private_key }}
+          -----BEGIN PRIVATE KEY-----
+          {{ .private_key | replace "-----BEGIN PRIVATE KEY-----" "" | replace "-----END PRIVATE KEY-----" "" | replace " " "" | trim }}
+          -----END PRIVATE KEY-----
   data:
     - secretKey: app_id
       sourceRef:

k8s/apps/firefly-iii/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - app.yaml
   - data-importer.yaml
+  - data-importer-ingress.yaml
   - external-secrets.yaml
   - postgres.yaml
   - storage.yaml

k8s/apps/firefly-iii/network-policy.yaml

@@ -76,7 +76,18 @@ spec:
   policyTypes:
     - Ingress
   ingress:
-    # traefik-ai uses hostNetwork and is therefore seen as node traffic.
+    # Shared Traefik serves the public HTTPS importer.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+    # Keep node traffic allowed for probes and local diagnostics.
     - from:
         - ipBlock:
             cidr: 192.168.1.117/32