Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-06-29 17:46:46

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -44,8 +44,6 @@ ArgoCD homelab project
 | :--- | :---: |
 | **amnezia** | [![amnezia](https://ag.hexor.cy/api/badge?name=amnezia&revision=true)](https://ag.hexor.cy/applications/argocd/amnezia) |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
-| **doka2-lobby-list** | [![doka2-lobby-list](https://ag.hexor.cy/api/badge?name=doka2-lobby-list&revision=true)](https://ag.hexor.cy/applications/argocd/doka2-lobby-list) |
-| **firefly-iii** | [![firefly-iii](https://ag.hexor.cy/api/badge?name=firefly-iii&revision=true)](https://ag.hexor.cy/applications/argocd/firefly-iii) |
 | **furumi** | [![furumi](https://ag.hexor.cy/api/badge?name=furumi&revision=true)](https://ag.hexor.cy/applications/argocd/furumi) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |

k8s/apps/amnezia/configmap-scripts.yaml

@@ -10,16 +10,12 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
-    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
-    IPTABLES=(iptables -w 30)
 
     external_interface() {
       ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
     }
 
-    ensure_rule() {
+    ensure_insert_rule() {
-      local mode="$1"
-      shift
       local table_args=()
       if [ "${1:-}" = "-t" ]; then
         table_args=("$1" "$2")
@@ -29,8 +25,8 @@ data:
       local chain="$1"
       shift
 
-      if ! "${IPTABLES[@]}" "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
+      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
-        "${IPTABLES[@]}" "${table_args[@]}" "${mode}" "${chain}" "$@"
+        iptables "${table_args[@]}" -I "${chain}" 1 "$@"
       fi
     }
 
@@ -44,15 +40,24 @@ data:
       local chain="$1"
       shift
 
-      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
         true
       done
     }
 
-    reset_chain() {
+    ensure_append_rule() {
+      local table_args=()
+      if [ "${1:-}" = "-t" ]; then
+        table_args=("$1" "$2")
+        shift 2
+      fi
+
       local chain="$1"
-      "${IPTABLES[@]}" -N "${chain}" >/dev/null 2>&1 || true
+      shift
-      "${IPTABLES[@]}" -F "${chain}"
+
+      if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
+        iptables "${table_args[@]}" -A "${chain}" "$@"
+      fi
     }
 
     EXT_IF="$(external_interface || true)"
@@ -66,28 +71,13 @@ data:
 
     sysctl -w net.ipv4.ip_forward=1
 
-    # Remove rules written by older revisions. In particular, the unqualified
-    # tailscale UDP DROP also blocks Flannel VXLAN (UDP/8472).
     delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
-    delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
+    ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
-    delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
-    delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
-    delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
+    ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
+    ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
+    ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
-    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
-    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-
-    reset_chain "${FORWARD_CHAIN}"
-    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -j RETURN
-    ensure_rule -A FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
-
-    ensure_rule -A -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
-
-    /scripts/firewall-check.sh "${PORT}" "${VPN_CIDR}"
 
   firewall-down.sh: |
     #!/usr/bin/env bash
@@ -95,8 +85,6 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
-    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
-    IPTABLES=(iptables -w 30)
 
     external_interface() {
       ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
@@ -112,7 +100,7 @@ data:
       local chain="$1"
       shift
 
-      while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
+      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
         true
       done
     }
@@ -123,7 +111,6 @@ data:
     fi
 
     if [ -n "${EXT_IF}" ]; then
-      delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
       delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
       delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
     fi
@@ -133,62 +120,13 @@ data:
     delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
     delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
     delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
-    delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
-
-    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
-
-  firewall-check.sh: |
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    PORT="${1:-5847}"
-    VPN_CIDR="${2:-10.8.0.0/16}"
-    FORWARD_CHAIN="AMNEZIAWG-FORWARD"
-    IPTABLES=(iptables -w 5)
-
-    external_interface() {
-      ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
-    }
-
-    EXT_IF="$(external_interface || true)"
-    if [ -z "${EXT_IF}" ]; then
-      EXT_IF="$(ip route show default | awk '{print $5; exit}')"
-    fi
-    if [ -z "${EXT_IF}" ]; then
-      echo "Unable to detect external interface" >&2
-      exit 1
-    fi
-
-    if "${IPTABLES[@]}" -C INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP >/dev/null 2>&1; then
-      echo "Unsafe broad UDP DROP on tailscale0 is present" >&2
-      exit 1
-    fi
-    if "${IPTABLES[@]}" -C INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT >/dev/null 2>&1; then
-      echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
-      exit 1
-    fi
-    if "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT >/dev/null 2>&1; then
-      echo "Unexpected AmneziaWG INPUT chain is present" >&2
-      exit 1
-    fi
-
-    "${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
-    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
-    "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-
-    "${IPTABLES[@]}" -t nat -C POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
-    awg show awg0 >/dev/null 2>&1
 
   run.sh: |
     #!/usr/bin/env bash
     set -euo pipefail
 
     SERVER_CONFIG="/etc/amnezia/server/awg0.conf"
-    CLIENTS_DIR="${AMNEZIAWG_CLIENTS_DIR:-/run/amnezia/clients}"
+    CLIENTS_DIR="/etc/amnezia/clients"
     RUNTIME_CONFIG="/run/amnezia/awg0.conf"
     SYNC_CONFIG="/run/amnezia/awg0.sync.conf"
     STATUS_FILE="/run/amnezia/reload-status"
@@ -291,62 +229,6 @@ data:
     write_reload_status applied "${initial_hash}"
     watch_client_config "${initial_hash}"
 
-  client-secret-sync.sh: |
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    CLIENT_SECRET="${AMNEZIAWG_CLIENT_SECRET:-amneziawg-clients}"
-    CLIENT_SECRET_KEY="${AMNEZIAWG_CLIENT_SECRET_KEY:-peers.conf}"
-    CLIENTS_DIR="${AMNEZIAWG_CLIENTS_DIR:-/run/amnezia/clients}"
-    PEERS_FILE="${CLIENTS_DIR}/peers.conf"
-    SYNC_INTERVAL="${AMNEZIAWG_CLIENT_SECRET_SYNC_INTERVAL:-5}"
-    NAMESPACE="${POD_NAMESPACE:-$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)}"
-
-    write_empty_once() {
-      mkdir -p "${CLIENTS_DIR}"
-      if [ ! -f "${PEERS_FILE}" ]; then
-        : > "${PEERS_FILE}"
-        chmod 0600 "${PEERS_FILE}"
-      fi
-    }
-
-    sync_once() {
-      mkdir -p "${CLIENTS_DIR}"
-      local tmp_file="${PEERS_FILE}.tmp"
-      local encoded=""
-
-      if ! encoded="$(kubectl get secret "${CLIENT_SECRET}" -n "${NAMESPACE}" -o "go-template={{ index .data \"${CLIENT_SECRET_KEY}\" }}" 2>/dev/null)"; then
-        echo "WARN: failed to read Secret ${NAMESPACE}/${CLIENT_SECRET}; keeping current peers" >&2
-        write_empty_once
-        return 0
-      fi
-
-      if [ -n "${encoded}" ]; then
-        printf '%s' "${encoded}" | base64 -d > "${tmp_file}"
-      else
-        : > "${tmp_file}"
-      fi
-      chmod 0600 "${tmp_file}"
-
-      if [ -f "${PEERS_FILE}" ] && cmp -s "${tmp_file}" "${PEERS_FILE}"; then
-        rm -f "${tmp_file}"
-        return 0
-      fi
-
-      mv "${tmp_file}" "${PEERS_FILE}"
-      echo "Synced AmneziaWG client peers from Secret ${NAMESPACE}/${CLIENT_SECRET}:${CLIENT_SECRET_KEY}"
-    }
-
-    if [ "${1:-}" = "once" ]; then
-      sync_once
-      exit 0
-    fi
-
-    while true; do
-      sync_once || true
-      sleep "${SYNC_INTERVAL}"
-    done
-
   status-patch.sh: |
     #!/usr/bin/env bash
     set -euo pipefail

k8s/apps/amnezia/daemonset.yaml

@@ -6,9 +6,8 @@ metadata:
   labels:
     app: amneziawg
   annotations:
-    reloader.stakater.com/auto: "false"
     secret.reloader.stakater.com/reload: "amneziawg-server"
-    configmap.reloader.stakater.com/reload: "amneziawg-scripts,amneziawg-exporter-redis"
+    configmap.reloader.stakater.com/reload: "amneziawg-scripts"
 spec:
   selector:
     matchLabels:
@@ -37,9 +36,7 @@ spec:
             - |
               set -euo pipefail
               cp /usr/bin/awg /shared-bin/awg
-              cp /lib/ld-musl-x86_64.so.1 /shared-bin/ld-musl-x86_64.so.1
+              chmod 0755 /shared-bin/awg
-              cp /lib/ld-musl-x86_64.so.1 /shared-bin/libc.musl-x86_64.so.1
-              chmod 0755 /shared-bin/awg /shared-bin/ld-musl-x86_64.so.1 /shared-bin/libc.musl-x86_64.so.1
           volumeMounts:
             - name: awg-bin
               mountPath: /shared-bin
@@ -81,26 +78,6 @@ spec:
                 kubectl create secret generic amneziawg-endpoints -n "${NAMESPACE}" \
                   --from-literal="${NODE_NAME}=${VALUE}"
               fi
-        - name: sync-client-secret
-          image: bitnami/kubectl:latest
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/bash
-            - /scripts/client-secret-sync.sh
-            - once
-          resources:
-            requests:
-              memory: "32Mi"
-              cpu: "10m"
-            limits:
-              memory: "128Mi"
-              cpu: "100m"
-          volumeMounts:
-            - name: scripts
-              mountPath: /scripts
-              readOnly: true
-            - name: runtime-config
-              mountPath: /run/amnezia
       containers:
         - name: amneziawg
           image: amneziavpn/amneziawg-go:latest
@@ -123,29 +100,20 @@ spec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16
+                - awg show awg0 >/dev/null 2>&1
             initialDelaySeconds: 5
             periodSeconds: 10
-            timeoutSeconds: 8
+            timeoutSeconds: 3
-            failureThreshold: 2
+            failureThreshold: 3
-          startupProbe:
-            exec:
-              command:
-                - /bin/bash
-                - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
-            periodSeconds: 5
-            timeoutSeconds: 15
-            failureThreshold: 12
           livenessProbe:
             exec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
+                - awg show awg0 >/dev/null 2>&1
             initialDelaySeconds: 30
             periodSeconds: 30
-            timeoutSeconds: 15
+            timeoutSeconds: 5
             failureThreshold: 3
           resources:
             requests:
@@ -158,6 +126,9 @@ spec:
             - name: server-config
               mountPath: /etc/amnezia/server
               readOnly: true
+            - name: client-config
+              mountPath: /etc/amnezia/clients
+              readOnly: true
             - name: scripts
               mountPath: /scripts
               readOnly: true
@@ -189,25 +160,6 @@ spec:
               readOnly: true
             - name: runtime-config
               mountPath: /run/amnezia
-        - name: client-secret-sync
-          image: bitnami/kubectl:latest
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/bash
-            - /scripts/client-secret-sync.sh
-          resources:
-            requests:
-              memory: "32Mi"
-              cpu: "10m"
-            limits:
-              memory: "128Mi"
-              cpu: "100m"
-          volumeMounts:
-            - name: scripts
-              mountPath: /scripts
-              readOnly: true
-            - name: runtime-config
-              mountPath: /run/amnezia
         - name: amneziawg-exporter-redis
           image: redis:alpine
           imagePullPolicy: IfNotPresent
@@ -259,14 +211,6 @@ spec:
               mountPath: /usr/bin/awg
               subPath: awg
               readOnly: true
-            - name: awg-bin
-              mountPath: /lib/ld-musl-x86_64.so.1
-              subPath: ld-musl-x86_64.so.1
-              readOnly: true
-            - name: awg-bin
-              mountPath: /lib/libc.musl-x86_64.so.1
-              subPath: libc.musl-x86_64.so.1
-              readOnly: true
       volumes:
         - name: server-config
           secret:
@@ -275,6 +219,11 @@ spec:
             items:
               - key: awg0.conf
                 path: awg0.conf
+        - name: client-config
+          secret:
+            secretName: amneziawg-clients
+            optional: true
+            defaultMode: 0600
         - name: scripts
           configMap:
             name: amneziawg-scripts

k8s/apps/amnezia/exporter-redis-configmap.yaml

@@ -8,8 +8,8 @@ metadata:
     component: exporter
 data:
   redis.conf: |
-    bind 127.0.0.1
+    bind 0.0.0.0
-    protected-mode yes
+    protected-mode no
     port 6379
     tcp-backlog 511
     timeout 0
@@ -21,12 +21,8 @@ data:
     databases 16
     always-show-logo no
     set-proc-title no
-    save ""
+    save 3600 1
-    appendonly no
     stop-writes-on-bgsave-error no
     rdbcompression yes
     rdbchecksum yes
     dir /data
-    rename-command CONFIG ""
-    rename-command SAVE ""
-    rename-command BGSAVE ""

k8s/apps/amnezia/external-secrets.yaml

@@ -48,32 +48,3 @@ spec:
       remoteRef:
         key: 3092dc7c-41dd-461a-9f7a-377727f47e93
         property: fields[1].value
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: amnezia-fellow
-spec:
-  target:
-    name: amnezia-fellow
-    deletionPolicy: Delete
-    template:
-      engineVersion: v2
-      type: Opaque
-      data:
-        database-url: |-
-          postgresql://amnezia_fellow:{{ .amnezia_fellow | urlquery }}@psql.psql.svc:5432/amnezia_fellow
-        postgres-password: |-
-          {{ .amnezia_fellow }}
-  data:
-    - secretKey: amnezia_fellow
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[19].value

k8s/apps/amnezia/fellow-deployment.yaml

@@ -5,8 +5,6 @@ metadata:
   name: amnezia-fellow
   labels:
     app: amnezia-fellow
-  annotations:
-    secret.reloader.stakater.com/reload: "amnezia-fellow"
 spec:
   replicas: 1
   strategy:
@@ -33,10 +31,7 @@ spec:
               protocol: TCP
           env:
             - name: AMNEZIA_FELLOW_DATABASE_URL
-              valueFrom:
+              value: "sqlite:///data/amnezia-fellow.sqlite3?mode=rwc"
-                secretKeyRef:
-                  name: amnezia-fellow
-                  key: database-url
             - name: AMNEZIA_FELLOW_K8S_NAMESPACE
               value: "amnezia"
             - name: AMNEZIA_FELLOW_K8S_CLIENTS_SECRET
@@ -70,3 +65,10 @@ spec:
             limits:
               cpu: "500m"
               memory: "512Mi"
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: amnezia-fellow-data

k8s/apps/doka2-lobby-list/app.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: doka2-lobby-list
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: doka2-lobby-list
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/doka2-lobby-list
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true

k8s/apps/doka2-lobby-list/deployment.yaml

@@ -1,54 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: doka2-lobby-list
-  labels:
-    app: doka2-lobby-list
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: doka2-lobby-list
-  template:
-    metadata:
-      labels:
-        app: doka2-lobby-list
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-      securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-      volumes:
-        - name: creds
-          persistentVolumeClaim:
-            claimName: doka2-lobby-list-creds
-      containers:
-        - name: doka2-lobby-list
-          image: ultradesu/doka2-lobby-list:latest
-          imagePullPolicy: Always
-          ports:
-            - name: http
-              containerPort: 3000
-              protocol: TCP
-          env:
-            - name: ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: doka2-lobby-list-secrets
-                  key: ADMIN_PASSWORD
-            - name: CREDS_DIR
-              value: /data
-          volumeMounts:
-            - name: creds
-              mountPath: /data
-          resources:
-            requests:
-              cpu: "50m"
-              memory: "128Mi"
-            limits:
-              cpu: "500m"
-              memory: "512Mi"

k8s/apps/doka2-lobby-list/external-secrets.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: doka2-lobby-list-secrets
-spec:
-  target:
-    name: doka2-lobby-list-secrets
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        ADMIN_PASSWORD: |-
-          {{ .admin_password | trim }}
-  data:
-    - secretKey: admin_password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: af4618dd-6431-4b20-b617-c00bae9ceff6
-        property: login.password

k8s/apps/doka2-lobby-list/ingress.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: doka2-lobby-list-tls-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: doka.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: doka2-lobby-list
-                port:
-                  number: 80
-  tls:
-    - secretName: doka2-lobby-list-tls
-      hosts:
-        - doka.hexor.cy

k8s/apps/doka2-lobby-list/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - deployment.yaml
-  - external-secrets.yaml
-  - service.yaml
-  - ingress.yaml
-  - storage.yaml

k8s/apps/doka2-lobby-list/service.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: doka2-lobby-list
-  labels:
-    app: doka2-lobby-list
-spec:
-  type: ClusterIP
-  selector:
-    app: doka2-lobby-list
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http

k8s/apps/doka2-lobby-list/storage.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: doka2-lobby-list-creds
-  labels:
-    app: doka2-lobby-list
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 1Gi

k8s/apps/firefly-iii/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: firefly-iii
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: firefly-iii
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/firefly-iii
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-

k8s/apps/firefly-iii/data-importer.yaml

@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: firefly-data-importer
-  labels:
-    app.kubernetes.io/name: firefly-data-importer
-  annotations:
-    reloader.stakater.com/auto: "true"
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: firefly-data-importer
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: firefly-data-importer
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: ai.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: ai
-          effect: NoSchedule
-      containers:
-        - name: data-importer
-          image: fireflyiii/data-importer:version-2.3.4
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: FIREFLY_III_URL
-              value: http://firefly-iii
-            - name: VANITY_URL
-              value: http://ff.lan
-            - name: TRUSTED_PROXIES
-              value: "**"
-            - name: EXPECT_SECURE_URL
-              value: "false"
-            - name: VERIFY_TLS_SECURITY
-              value: "true"
-            - name: TZ
-              value: Europe/London
-            - name: APP_ENV
-              value: production
-            - name: APP_DEBUG
-              value: "false"
-            - name: LOG_LEVEL
-              value: notice
-            - name: ENABLE_BANKING_APP_ID
-              valueFrom:
-                secretKeyRef:
-                  name: firefly-data-importer-secrets
-                  key: ENABLE_BANKING_APP_ID
-            - name: ENABLE_BANKING_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: firefly-data-importer-secrets
-                  key: ENABLE_BANKING_PRIVATE_KEY
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          readinessProbe:
-            tcpSocket:
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          livenessProbe:
-            tcpSocket:
-              port: http
-            initialDelaySeconds: 20
-            periodSeconds: 30
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-      securityContext:
-        seccompProfile:
-          type: RuntimeDefault
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: firefly-data-importer
-  labels:
-    app.kubernetes.io/name: firefly-data-importer
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: firefly-data-importer
-  ports:
-    - name: http
-      port: 80
-      targetPort: http
-      protocol: TCP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: firefly-data-importer
-  labels:
-    app.kubernetes.io/name: firefly-data-importer
-    firefly.hexor.cy/private-ai: "true"
-  annotations:
-    kubernetes.io/ingress.class: traefik-ai
-spec:
-  rules:
-    - host: import.ff.lan
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: firefly-data-importer
-                port:
-                  number: 80
-

k8s/apps/firefly-iii/external-secrets.yaml

@@ -1,83 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: firefly-secrets
-spec:
-  refreshInterval: 1h
-  target:
-    name: firefly-secrets
-    creationPolicy: Owner
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        # Firefly and CloudNativePG deliberately share this generated Secret.
-        username: firefly
-        password: |-
-          {{ .db_password }}
-        DB_PASSWORD: |-
-          {{ .db_password }}
-        APP_KEY: |-
-          {{ .app_key }}
-        STATIC_CRON_TOKEN: |-
-          {{ .cron_token }}
-  data:
-    - secretKey: db_password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: a1867c81-715c-47cd-978d-14ea5bcedea9
-        property: fields[0].value
-    - secretKey: app_key
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: a1867c81-715c-47cd-978d-14ea5bcedea9
-        property: fields[1].value
-    - secretKey: cron_token
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: a1867c81-715c-47cd-978d-14ea5bcedea9
-        property: fields[2].value
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: firefly-data-importer-secrets
-spec:
-  refreshInterval: 1h
-  target:
-    name: firefly-data-importer-secrets
-    creationPolicy: Owner
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        ENABLE_BANKING_APP_ID: |-
-          {{ .app_id }}
-        ENABLE_BANKING_PRIVATE_KEY: |-
-          {{ .private_key }}
-  data:
-    - secretKey: app_id
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: a1867c81-715c-47cd-978d-14ea5bcedea9
-        property: fields[3].value
-    - secretKey: private_key
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: a1867c81-715c-47cd-978d-14ea5bcedea9
-        property: fields[4].value

k8s/apps/firefly-iii/kustomization.yaml

@@ -1,100 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - data-importer.yaml
-  - external-secrets.yaml
-  - postgres.yaml
-  - storage.yaml
-  - storage-prep.yaml
-  - traefik-ai.yaml
-  - network-policy.yaml
-
-helmCharts:
-  - name: firefly-iii
-    repo: https://harish2k01.github.io/helm-charts
-    version: 0.1.2
-    releaseName: firefly-iii
-    namespace: firefly-iii
-    valuesFile: values.yaml
-    includeCRDs: true
-
-patches:
-  # Chart 0.1.2 requires postgres.enabled=true. Remove its StatefulSet and
-  # make the generated database Service select the CloudNativePG instance.
-  - target:
-      group: apps
-      version: v1
-      kind: StatefulSet
-      name: firefly-iii-postgres
-    patch: |-
-      $patch: delete
-      apiVersion: apps/v1
-      kind: StatefulSet
-      metadata:
-        name: firefly-iii-postgres
-  - target:
-      version: v1
-      kind: Service
-      name: firefly-iii-postgres
-    patch: |-
-      - op: replace
-        path: /spec/selector
-        value:
-          cnpg.io/cluster: firefly-postgres
-  # The upstream chart does not expose scheduling settings for its CronJob.
-  - target:
-      group: batch
-      version: v1
-      kind: CronJob
-      name: firefly-iii-cron
-    patch: |-
-      - op: add
-        path: /spec/concurrencyPolicy
-        value: Forbid
-      - op: add
-        path: /spec/jobTemplate/spec/backoffLimit
-        value: 1
-      - op: add
-        path: /spec/jobTemplate/spec/activeDeadlineSeconds
-        value: 600
-      - op: add
-        path: /spec/jobTemplate/spec/template/spec/nodeSelector
-        value:
-          kubernetes.io/hostname: ai.tail2fe2d.ts.net
-      - op: add
-        path: /spec/jobTemplate/spec/template/spec/tolerations
-        value:
-          - key: workload
-            operator: Equal
-            value: ai
-            effect: NoSchedule
-      - op: replace
-        path: /spec/jobTemplate/spec/template/spec/containers/0/command
-        value:
-          - /bin/sh
-          - -ec
-          - >-
-            curl --fail --silent --show-error
-            --retry 30 --retry-delay 10 --retry-all-errors
-            --connect-timeout 5 --max-time 30
-            "http://firefly-iii:80/api/v1/cron/${STATIC_CRON_TOKEN}"
-  # A second independent filter in addition to ingressClassName.
-  - target:
-      group: networking.k8s.io
-      version: v1
-      kind: Ingress
-      name: firefly-iii
-    patch: |-
-      - op: add
-        path: /metadata/labels/firefly.hexor.cy~1private-ai
-        value: "true"
-      # The shared Traefik has the same controller identifier and can discover
-      # IngressClass objects. The explicit annotation partitions this Ingress
-      # so only the instance configured with ingressclass=traefik-ai accepts it.
-      - op: add
-        path: /metadata/annotations/kubernetes.io~1ingress.class
-        value: traefik-ai
-      - op: remove
-        path: /spec/ingressClassName

k8s/apps/firefly-iii/network-policy.yaml

@@ -1,87 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: firefly-ingress
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/instance: firefly-iii
-      app.kubernetes.io/name: firefly-iii
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: traefik-ai
-        # The chart's CronJob uses the same selector labels as the application.
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/instance: firefly-iii
-              app.kubernetes.io/name: firefly-iii
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: firefly-data-importer
-        # hostNetwork traffic is seen as node traffic rather than Pod traffic.
-        - ipBlock:
-            cidr: 192.168.1.117/32
-        - ipBlock:
-            cidr: 100.77.155.120/32
-      ports:
-        - protocol: TCP
-          port: 8080
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: firefly-postgres-ingress
-spec:
-  podSelector:
-    matchLabels:
-      cnpg.io/cluster: firefly-postgres
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/instance: firefly-iii
-              app.kubernetes.io/name: firefly-iii
-        - podSelector:
-            matchLabels:
-              cnpg.io/cluster: firefly-postgres
-      ports:
-        - protocol: TCP
-          port: 5432
-    # CloudNativePG operator health/status traffic to the instance manager.
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: psql
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: cloudnative-pg
-      ports:
-        - protocol: TCP
-          port: 8000
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: firefly-data-importer-ingress
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: firefly-data-importer
-  policyTypes:
-    - Ingress
-  ingress:
-    # traefik-ai uses hostNetwork and is therefore seen as node traffic.
-    - from:
-        - ipBlock:
-            cidr: 192.168.1.117/32
-        - ipBlock:
-            cidr: 100.77.155.120/32
-      ports:
-        - protocol: TCP
-          port: 8080

k8s/apps/firefly-iii/postgres.yaml

@@ -1,49 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: firefly-postgres
-spec:
-  description: PostgreSQL for Firefly III
-  instances: 1
-  enableSuperuserAccess: false
-  primaryUpdateStrategy: unsupervised
-  bootstrap:
-    initdb:
-      database: firefly
-      owner: firefly
-      secret:
-        name: firefly-secrets
-      dataChecksums: true
-  storage:
-    size: 10Gi
-    storageClass: firefly-local
-    pvcTemplate:
-      accessModes:
-        - ReadWriteOnce
-      storageClassName: firefly-local
-      selector:
-        matchLabels:
-          app.kubernetes.io/name: firefly-postgres
-      resources:
-        requests:
-          storage: 10Gi
-      volumeMode: Filesystem
-  affinity:
-    enablePodAntiAffinity: false
-    nodeSelector:
-      kubernetes.io/hostname: ai.tail2fe2d.ts.net
-    tolerations:
-      - key: workload
-        operator: Equal
-        value: ai
-        effect: NoSchedule
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      cpu: "1"
-      memory: 1Gi
-  monitoring:
-    enablePodMonitor: true
-

k8s/apps/firefly-iii/storage-prep.yaml

@@ -1,52 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: firefly-storage-prep
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
-spec:
-  backoffLimit: 3
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: firefly-storage-prep
-    spec:
-      restartPolicy: OnFailure
-      nodeSelector:
-        kubernetes.io/hostname: ai.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: ai
-          effect: NoSchedule
-      containers:
-        - name: prepare
-          image: busybox:1.37.0
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/sh
-            - -ec
-            - |
-              mkdir -p /host/k8s/firefly-iii/postgres
-              chown 26:26 /host/k8s/firefly-iii/postgres
-              chmod 0700 /host/k8s/firefly-iii/postgres
-          securityContext:
-            runAsUser: 0
-            runAsGroup: 0
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-              add:
-                - CHOWN
-                - DAC_OVERRIDE
-                - FOWNER
-          volumeMounts:
-            - name: host-root
-              mountPath: /host/k8s/firefly-iii
-      volumes:
-        - name: host-root
-          hostPath:
-            path: /k8s/firefly-iii
-            type: DirectoryOrCreate

k8s/apps/firefly-iii/storage.yaml

@@ -1,72 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: firefly-local
-provisioner: kubernetes.io/no-provisioner
-reclaimPolicy: Retain
-volumeBindingMode: WaitForFirstConsumer
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: firefly-postgres
-  labels:
-    app.kubernetes.io/name: firefly-postgres
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: firefly-local
-  volumeMode: Filesystem
-  hostPath:
-    path: /k8s/firefly-iii/postgres
-    type: DirectoryOrCreate
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values:
-                - ai.tail2fe2d.ts.net
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: firefly-uploads
-  labels:
-    app.kubernetes.io/name: firefly-uploads
-spec:
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: firefly-local
-  volumeMode: Filesystem
-  hostPath:
-    path: /k8s/firefly-iii/uploads
-    type: DirectoryOrCreate
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values:
-                - ai.tail2fe2d.ts.net
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: firefly-uploads
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: firefly-local
-  volumeName: firefly-uploads
-  resources:
-    requests:
-      storage: 5Gi

k8s/apps/firefly-iii/traefik-ai.yaml

@@ -1,175 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: IngressClass
-metadata:
-  name: traefik-ai
-spec:
-  controller: traefik.io/ingress-controller
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: traefik-ai
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: traefik-ai
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-      - secrets
-      - endpoints
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses/status
-    verbs:
-      - update
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: traefik-ai
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: traefik-ai
-subjects:
-  - kind: ServiceAccount
-    name: traefik-ai
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: firefly-traefik-ai
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: firefly-traefik-ai
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: firefly-traefik-ai
-subjects:
-  - kind: ServiceAccount
-    name: traefik-ai
-    namespace: firefly-iii
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: traefik-ai
-  labels:
-    app.kubernetes.io/name: traefik-ai
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: traefik-ai
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: traefik-ai
-    spec:
-      serviceAccountName: traefik-ai
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-      nodeSelector:
-        kubernetes.io/hostname: ai.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: ai
-          effect: NoSchedule
-      containers:
-        - name: traefik
-          image: rancher/mirrored-library-traefik:3.6.13
-          imagePullPolicy: IfNotPresent
-          args:
-            - --entrypoints.web.address=192.168.1.117:80
-            - --providers.kubernetesingress=true
-            - --providers.kubernetesingress.namespaces=firefly-iii
-            - --providers.kubernetesingress.ingressclass=traefik-ai
-            - --providers.kubernetesingress.labelselector=firefly.hexor.cy/private-ai=true
-            - --providers.kubernetescrd=false
-            - --api.dashboard=false
-            - --log.level=INFO
-          ports:
-            - name: web
-              containerPort: 80
-              hostPort: 80
-              hostIP: 192.168.1.117
-              protocol: TCP
-          readinessProbe:
-            tcpSocket:
-              host: 192.168.1.117
-              port: web
-            periodSeconds: 10
-          livenessProbe:
-            tcpSocket:
-              host: 192.168.1.117
-              port: web
-            periodSeconds: 30
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-              add:
-                - NET_BIND_SERVICE
-            readOnlyRootFilesystem: true
-            runAsNonRoot: false
-            runAsUser: 0
-            runAsGroup: 0
-      securityContext:
-        seccompProfile:
-          type: RuntimeDefault

k8s/apps/firefly-iii/values.yaml

@@ -1,68 +0,0 @@
-replicaCount: 1
-
-image:
-  repository: fireflyiii/core
-  tag: version-6.6.1
-  pullPolicy: IfNotPresent
-
-service:
-  type: ClusterIP
-  port: 80
-  targetPort: 8080
-
-ingress:
-  enabled: true
-  className: traefik-ai
-  hosts:
-    - host: ff.lan
-      paths:
-        - path: /
-          pathType: Prefix
-
-persistence:
-  upload:
-    enabled: true
-    existingClaim: firefly-uploads
-
-# Must remain true because chart 0.1.2 validates it. Kustomize removes the
-# generated StatefulSet and makes this Service select the CloudNativePG Pod.
-postgres:
-  enabled: true
-  auth:
-    database: firefly
-    username: firefly
-  service:
-    port: 5432
-
-cronjob:
-  enabled: true
-  schedule: "0 3 * * *"
-  timeZone: Europe/London
-
-firefly:
-  env:
-    APP_ENV: production
-    APP_DEBUG: "false"
-    APP_URL: http://ff.lan
-    SITE_OWNER: owner@ff.lan
-    TZ: Europe/London
-    DEFAULT_LANGUAGE: en_US
-    TRUSTED_PROXIES: 10.42.0.0/16
-    COOKIE_SECURE: "false"
-    PGSQL_SSL_MODE: prefer
-  secrets:
-    existingSecret: firefly-secrets
-  nodeSelector:
-    kubernetes.io/hostname: ai.tail2fe2d.ts.net
-  tolerations:
-    - key: workload
-      operator: Equal
-      value: ai
-      effect: NoSchedule
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      cpu: "2"
-      memory: 1Gi

k8s/apps/teamspeak/deployment.yaml

@@ -17,8 +17,6 @@ spec:
       labels:
         app: teamspeak
     spec:
-      nodeSelector:
-        kubernetes.io/hostname: music.tail2fe2d.ts.net
       volumes:
         - name: data
           persistentVolumeClaim:

k8s/apps/web-petting/deployment.yaml

@@ -45,11 +45,6 @@ spec:
           value: "info"
         - name: WEB_PETTING_DEBUG
           value: "false"
-        - name: WEB_PETTING_DATABASE_URL
-          valueFrom:
-            secretKeyRef:
-              name: web-petting-secrets
-              key: WEB_PETTING_DATABASE_URL
         resources:
           requests:
             memory: "256Mi"

k8s/apps/web-petting/external-secrets.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: web-petting-secrets
-spec:
-  target:
-    name: web-petting-secrets
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        WEB_PETTING_DATABASE_URL: |-
-          postgresql://web_petting:{{ .web_petting }}@psql.psql.svc:5432/web_petting
-  data:
-    - secretKey: web_petting
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[20].value

k8s/apps/web-petting/kustomization.yaml

@@ -4,7 +4,6 @@ kind: Kustomization
 resources:
   - app.yaml
   - deployment.yaml
-  - external-secrets.yaml
   - service.yaml
   - ingress.yaml
   - storage.yaml

k8s/core/argocd/dex-probes-patch.yaml

@@ -1,26 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: argocd-dex-server
-  namespace: argocd
-spec:
-  template:
-    spec:
-      containers:
-        - name: dex-server
-          readinessProbe:
-            tcpSocket:
-              port: 5556
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 3
-            successThreshold: 1
-            failureThreshold: 3
-          livenessProbe:
-            tcpSocket:
-              port: 5556
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 3
-            successThreshold: 1
-            failureThreshold: 3

k8s/core/argocd/kustomization.yaml

@@ -16,5 +16,3 @@ helmCharts:
     valuesFile: values.yaml
     includeCRDs: true
 
-patches:
-  - path: dex-probes-patch.yaml

k8s/core/longhorn/app.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: core
   destination:
-    namespace: longhorn-system
+    namespace: longhorn
     server: https://kubernetes.default.svc
   source:
     repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git

k8s/core/longhorn/kustomization.yaml

@@ -9,7 +9,7 @@ helmCharts:
     repo: https://charts.longhorn.io
     version: 1.12.0
     releaseName: longhorn
-    namespace: longhorn-system
+    namespace: longhorn
     valuesFile: values.yaml
     includeCRDs: true
 

k8s/core/postgresql/external-secrets.yaml

@@ -140,10 +140,6 @@ spec:
           {{ .furumi_dev }}
         USER_keycloak: |-
           {{ .keycloak }}
-        USER_amnezia_fellow: |-
-          {{ .amnezia_fellow }}
-        USER_web_petting: |-
-          {{ .web_petting }}
   data:
     - secretKey: authentik
       sourceRef:
@@ -343,25 +339,3 @@ spec:
         metadataPolicy: None
         key: 2a9deb39-ef22-433e-a1be-df1555625e22
         property: fields[18].value
-    - secretKey: amnezia_fellow
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[19].value
-    - secretKey: web_petting
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[20].value