Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
bcce8503bf |
@@ -44,8 +44,6 @@ ArgoCD homelab project
|
||||
| :--- | :---: |
|
||||
| **amnezia** | [](https://ag.hexor.cy/applications/argocd/amnezia) |
|
||||
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||
| **doka2-lobby-list** | [](https://ag.hexor.cy/applications/argocd/doka2-lobby-list) |
|
||||
| **firefly-iii** | [](https://ag.hexor.cy/applications/argocd/firefly-iii) |
|
||||
| **furumi** | [](https://ag.hexor.cy/applications/argocd/furumi) |
|
||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||
| **greece-notifier** | [](https://ag.hexor.cy/applications/argocd/greece-notifier) |
|
||||
|
||||
@@ -10,16 +10,12 @@ data:
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
|
||||
IPTABLES=(iptables -w 30)
|
||||
|
||||
external_interface() {
|
||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
||||
}
|
||||
|
||||
ensure_rule() {
|
||||
local mode="$1"
|
||||
shift
|
||||
ensure_insert_rule() {
|
||||
local table_args=()
|
||||
if [ "${1:-}" = "-t" ]; then
|
||||
table_args=("$1" "$2")
|
||||
@@ -29,8 +25,8 @@ data:
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
if ! "${IPTABLES[@]}" "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
||||
"${IPTABLES[@]}" "${table_args[@]}" "${mode}" "${chain}" "$@"
|
||||
if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
||||
iptables "${table_args[@]}" -I "${chain}" 1 "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -44,15 +40,24 @@ data:
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
||||
while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
||||
true
|
||||
done
|
||||
}
|
||||
|
||||
reset_chain() {
|
||||
ensure_append_rule() {
|
||||
local table_args=()
|
||||
if [ "${1:-}" = "-t" ]; then
|
||||
table_args=("$1" "$2")
|
||||
shift 2
|
||||
fi
|
||||
|
||||
local chain="$1"
|
||||
"${IPTABLES[@]}" -N "${chain}" >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -F "${chain}"
|
||||
shift
|
||||
|
||||
if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
||||
iptables "${table_args[@]}" -A "${chain}" "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
EXT_IF="$(external_interface || true)"
|
||||
@@ -66,28 +71,13 @@ data:
|
||||
|
||||
sysctl -w net.ipv4.ip_forward=1
|
||||
|
||||
# Remove rules written by older revisions. In particular, the unqualified
|
||||
# tailscale UDP DROP also blocks Flannel VXLAN (UDP/8472).
|
||||
delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
|
||||
"${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
|
||||
|
||||
reset_chain "${FORWARD_CHAIN}"
|
||||
"${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
"${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
"${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -j RETURN
|
||||
ensure_rule -A FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
|
||||
|
||||
ensure_rule -A -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
|
||||
/scripts/firewall-check.sh "${PORT}" "${VPN_CIDR}"
|
||||
ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
|
||||
firewall-down.sh: |
|
||||
#!/usr/bin/env bash
|
||||
@@ -95,8 +85,6 @@ data:
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
|
||||
IPTABLES=(iptables -w 30)
|
||||
|
||||
external_interface() {
|
||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
||||
@@ -112,7 +100,7 @@ data:
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
||||
while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
||||
true
|
||||
done
|
||||
}
|
||||
@@ -123,7 +111,6 @@ data:
|
||||
fi
|
||||
|
||||
if [ -n "${EXT_IF}" ]; then
|
||||
delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
fi
|
||||
@@ -133,55 +120,6 @@ data:
|
||||
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
|
||||
delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
|
||||
|
||||
"${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
|
||||
|
||||
firewall-check.sh: |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
|
||||
IPTABLES=(iptables -w 5)
|
||||
|
||||
external_interface() {
|
||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
||||
}
|
||||
|
||||
EXT_IF="$(external_interface || true)"
|
||||
if [ -z "${EXT_IF}" ]; then
|
||||
EXT_IF="$(ip route show default | awk '{print $5; exit}')"
|
||||
fi
|
||||
if [ -z "${EXT_IF}" ]; then
|
||||
echo "Unable to detect external interface" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if "${IPTABLES[@]}" -C INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP >/dev/null 2>&1; then
|
||||
echo "Unsafe broad UDP DROP on tailscale0 is present" >&2
|
||||
exit 1
|
||||
fi
|
||||
if "${IPTABLES[@]}" -C INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT >/dev/null 2>&1; then
|
||||
echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
|
||||
exit 1
|
||||
fi
|
||||
if "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT >/dev/null 2>&1; then
|
||||
echo "Unexpected AmneziaWG INPUT chain is present" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
"${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
|
||||
"${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
"${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
|
||||
"${IPTABLES[@]}" -t nat -C POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
awg show awg0 >/dev/null 2>&1
|
||||
|
||||
run.sh: |
|
||||
#!/usr/bin/env bash
|
||||
|
||||
@@ -8,7 +8,7 @@ metadata:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "false"
|
||||
secret.reloader.stakater.com/reload: "amneziawg-server"
|
||||
configmap.reloader.stakater.com/reload: "amneziawg-scripts,amneziawg-exporter-redis"
|
||||
configmap.reloader.stakater.com/reload: "amneziawg-scripts"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
@@ -37,9 +37,7 @@ spec:
|
||||
- |
|
||||
set -euo pipefail
|
||||
cp /usr/bin/awg /shared-bin/awg
|
||||
cp /lib/ld-musl-x86_64.so.1 /shared-bin/ld-musl-x86_64.so.1
|
||||
cp /lib/ld-musl-x86_64.so.1 /shared-bin/libc.musl-x86_64.so.1
|
||||
chmod 0755 /shared-bin/awg /shared-bin/ld-musl-x86_64.so.1 /shared-bin/libc.musl-x86_64.so.1
|
||||
chmod 0755 /shared-bin/awg
|
||||
volumeMounts:
|
||||
- name: awg-bin
|
||||
mountPath: /shared-bin
|
||||
@@ -123,29 +121,20 @@ spec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- /scripts/firewall-check.sh 5847 10.8.0.0/16
|
||||
- awg show awg0 >/dev/null 2>&1
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 8
|
||||
failureThreshold: 2
|
||||
startupProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 15
|
||||
failureThreshold: 12
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
|
||||
- awg show awg0 >/dev/null 2>&1
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 15
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
@@ -259,14 +248,6 @@ spec:
|
||||
mountPath: /usr/bin/awg
|
||||
subPath: awg
|
||||
readOnly: true
|
||||
- name: awg-bin
|
||||
mountPath: /lib/ld-musl-x86_64.so.1
|
||||
subPath: ld-musl-x86_64.so.1
|
||||
readOnly: true
|
||||
- name: awg-bin
|
||||
mountPath: /lib/libc.musl-x86_64.so.1
|
||||
subPath: libc.musl-x86_64.so.1
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: server-config
|
||||
secret:
|
||||
|
||||
@@ -8,8 +8,8 @@ metadata:
|
||||
component: exporter
|
||||
data:
|
||||
redis.conf: |
|
||||
bind 127.0.0.1
|
||||
protected-mode yes
|
||||
bind 0.0.0.0
|
||||
protected-mode no
|
||||
port 6379
|
||||
tcp-backlog 511
|
||||
timeout 0
|
||||
@@ -21,12 +21,8 @@ data:
|
||||
databases 16
|
||||
always-show-logo no
|
||||
set-proc-title no
|
||||
save ""
|
||||
appendonly no
|
||||
save 3600 1
|
||||
stop-writes-on-bgsave-error no
|
||||
rdbcompression yes
|
||||
rdbchecksum yes
|
||||
dir /data
|
||||
rename-command CONFIG ""
|
||||
rename-command SAVE ""
|
||||
rename-command BGSAVE ""
|
||||
|
||||
@@ -48,32 +48,3 @@ spec:
|
||||
remoteRef:
|
||||
key: 3092dc7c-41dd-461a-9f7a-377727f47e93
|
||||
property: fields[1].value
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: amnezia-fellow
|
||||
spec:
|
||||
target:
|
||||
name: amnezia-fellow
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: Opaque
|
||||
data:
|
||||
database-url: |-
|
||||
postgresql://amnezia_fellow:{{ .amnezia_fellow | urlquery }}@psql.psql.svc:5432/amnezia_fellow
|
||||
postgres-password: |-
|
||||
{{ .amnezia_fellow }}
|
||||
data:
|
||||
- secretKey: amnezia_fellow
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[19].value
|
||||
|
||||
@@ -5,8 +5,6 @@ metadata:
|
||||
name: amnezia-fellow
|
||||
labels:
|
||||
app: amnezia-fellow
|
||||
annotations:
|
||||
secret.reloader.stakater.com/reload: "amnezia-fellow"
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
@@ -33,10 +31,7 @@ spec:
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: AMNEZIA_FELLOW_DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: amnezia-fellow
|
||||
key: database-url
|
||||
value: "sqlite:///data/amnezia-fellow.sqlite3?mode=rwc"
|
||||
- name: AMNEZIA_FELLOW_K8S_NAMESPACE
|
||||
value: "amnezia"
|
||||
- name: AMNEZIA_FELLOW_K8S_CLIENTS_SECRET
|
||||
@@ -70,3 +65,10 @@ spec:
|
||||
limits:
|
||||
cpu: "500m"
|
||||
memory: "512Mi"
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: amnezia-fellow-data
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: doka2-lobby-list
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: doka2-lobby-list
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/doka2-lobby-list
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
@@ -1,54 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: doka2-lobby-list
|
||||
labels:
|
||||
app: doka2-lobby-list
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: doka2-lobby-list
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: doka2-lobby-list
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
volumes:
|
||||
- name: creds
|
||||
persistentVolumeClaim:
|
||||
claimName: doka2-lobby-list-creds
|
||||
containers:
|
||||
- name: doka2-lobby-list
|
||||
image: ultradesu/doka2-lobby-list:latest
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: doka2-lobby-list-secrets
|
||||
key: ADMIN_PASSWORD
|
||||
- name: CREDS_DIR
|
||||
value: /data
|
||||
volumeMounts:
|
||||
- name: creds
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "128Mi"
|
||||
limits:
|
||||
cpu: "500m"
|
||||
memory: "512Mi"
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: doka2-lobby-list-secrets
|
||||
spec:
|
||||
target:
|
||||
name: doka2-lobby-list-secrets
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
ADMIN_PASSWORD: |-
|
||||
{{ .admin_password | trim }}
|
||||
data:
|
||||
- secretKey: admin_password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: af4618dd-6431-4b20-b617-c00bae9ceff6
|
||||
property: login.password
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: doka2-lobby-list-tls-ingress
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
acme.cert-manager.io/http01-edit-in-place: "true"
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: doka.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: doka2-lobby-list
|
||||
port:
|
||||
number: 80
|
||||
tls:
|
||||
- secretName: doka2-lobby-list-tls
|
||||
hosts:
|
||||
- doka.hexor.cy
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- deployment.yaml
|
||||
- external-secrets.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- storage.yaml
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: doka2-lobby-list
|
||||
labels:
|
||||
app: doka2-lobby-list
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: doka2-lobby-list
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
@@ -1,14 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: doka2-lobby-list-creds
|
||||
labels:
|
||||
app: doka2-lobby-list
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: longhorn
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: firefly-iii
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: firefly-iii
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/firefly-iii
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
|
||||
@@ -1,128 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: firefly-data-importer
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: data-importer
|
||||
image: fireflyiii/data-importer:version-2.3.4
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: FIREFLY_III_URL
|
||||
value: http://firefly-iii
|
||||
- name: VANITY_URL
|
||||
value: http://ff.lan
|
||||
- name: TRUSTED_PROXIES
|
||||
value: "**"
|
||||
- name: EXPECT_SECURE_URL
|
||||
value: "false"
|
||||
- name: VERIFY_TLS_SECURITY
|
||||
value: "true"
|
||||
- name: TZ
|
||||
value: Europe/London
|
||||
- name: APP_ENV
|
||||
value: production
|
||||
- name: APP_DEBUG
|
||||
value: "false"
|
||||
- name: LOG_LEVEL
|
||||
value: notice
|
||||
- name: ENABLE_BANKING_APP_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: firefly-data-importer-secrets
|
||||
key: ENABLE_BANKING_APP_ID
|
||||
- name: ENABLE_BANKING_PRIVATE_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: firefly-data-importer-secrets
|
||||
key: ENABLE_BANKING_PRIVATE_KEY
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: http
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 30
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: firefly-data-importer
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: firefly-data-importer
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
firefly.hexor.cy/private-ai: "true"
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik-ai
|
||||
spec:
|
||||
rules:
|
||||
- host: import.ff.lan
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: firefly-data-importer
|
||||
port:
|
||||
number: 80
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: firefly-secrets
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
target:
|
||||
name: firefly-secrets
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
# Firefly and CloudNativePG deliberately share this generated Secret.
|
||||
username: firefly
|
||||
password: |-
|
||||
{{ .db_password }}
|
||||
DB_PASSWORD: |-
|
||||
{{ .db_password }}
|
||||
APP_KEY: |-
|
||||
{{ .app_key }}
|
||||
STATIC_CRON_TOKEN: |-
|
||||
{{ .cron_token }}
|
||||
data:
|
||||
- secretKey: db_password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[0].value
|
||||
- secretKey: app_key
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[1].value
|
||||
- secretKey: cron_token
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[2].value
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: firefly-data-importer-secrets
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
target:
|
||||
name: firefly-data-importer-secrets
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
ENABLE_BANKING_APP_ID: |-
|
||||
{{ .app_id }}
|
||||
ENABLE_BANKING_PRIVATE_KEY: |-
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
{{ .private_key | replace "-----BEGIN PRIVATE KEY-----" "" | replace "-----END PRIVATE KEY-----" "" | replace " " "" | trim }}
|
||||
-----END PRIVATE KEY-----
|
||||
data:
|
||||
- secretKey: app_id
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[3].value
|
||||
- secretKey: private_key
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[4].value
|
||||
@@ -1,100 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- data-importer.yaml
|
||||
- external-secrets.yaml
|
||||
- postgres.yaml
|
||||
- storage.yaml
|
||||
- storage-prep.yaml
|
||||
- traefik-ai.yaml
|
||||
- network-policy.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: firefly-iii
|
||||
repo: https://harish2k01.github.io/helm-charts
|
||||
version: 0.1.2
|
||||
releaseName: firefly-iii
|
||||
namespace: firefly-iii
|
||||
valuesFile: values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
patches:
|
||||
# Chart 0.1.2 requires postgres.enabled=true. Remove its StatefulSet and
|
||||
# make the generated database Service select the CloudNativePG instance.
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: StatefulSet
|
||||
name: firefly-iii-postgres
|
||||
patch: |-
|
||||
$patch: delete
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: firefly-iii-postgres
|
||||
- target:
|
||||
version: v1
|
||||
kind: Service
|
||||
name: firefly-iii-postgres
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /spec/selector
|
||||
value:
|
||||
cnpg.io/cluster: firefly-postgres
|
||||
# The upstream chart does not expose scheduling settings for its CronJob.
|
||||
- target:
|
||||
group: batch
|
||||
version: v1
|
||||
kind: CronJob
|
||||
name: firefly-iii-cron
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/concurrencyPolicy
|
||||
value: Forbid
|
||||
- op: add
|
||||
path: /spec/jobTemplate/spec/backoffLimit
|
||||
value: 1
|
||||
- op: add
|
||||
path: /spec/jobTemplate/spec/activeDeadlineSeconds
|
||||
value: 600
|
||||
- op: add
|
||||
path: /spec/jobTemplate/spec/template/spec/nodeSelector
|
||||
value:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
- op: add
|
||||
path: /spec/jobTemplate/spec/template/spec/tolerations
|
||||
value:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
- op: replace
|
||||
path: /spec/jobTemplate/spec/template/spec/containers/0/command
|
||||
value:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
- >-
|
||||
curl --fail --silent --show-error
|
||||
--retry 30 --retry-delay 10 --retry-all-errors
|
||||
--connect-timeout 5 --max-time 30
|
||||
"http://firefly-iii:80/api/v1/cron/${STATIC_CRON_TOKEN}"
|
||||
# A second independent filter in addition to ingressClassName.
|
||||
- target:
|
||||
group: networking.k8s.io
|
||||
version: v1
|
||||
kind: Ingress
|
||||
name: firefly-iii
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /metadata/labels/firefly.hexor.cy~1private-ai
|
||||
value: "true"
|
||||
# The shared Traefik has the same controller identifier and can discover
|
||||
# IngressClass objects. The explicit annotation partitions this Ingress
|
||||
# so only the instance configured with ingressclass=traefik-ai accepts it.
|
||||
- op: add
|
||||
path: /metadata/annotations/kubernetes.io~1ingress.class
|
||||
value: traefik-ai
|
||||
- op: remove
|
||||
path: /spec/ingressClassName
|
||||
@@ -1,87 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: firefly-ingress
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: firefly-iii
|
||||
app.kubernetes.io/name: firefly-iii
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: traefik-ai
|
||||
# The chart's CronJob uses the same selector labels as the application.
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: firefly-iii
|
||||
app.kubernetes.io/name: firefly-iii
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
# hostNetwork traffic is seen as node traffic rather than Pod traffic.
|
||||
- ipBlock:
|
||||
cidr: 192.168.1.117/32
|
||||
- ipBlock:
|
||||
cidr: 100.77.155.120/32
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: firefly-postgres-ingress
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
cnpg.io/cluster: firefly-postgres
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: firefly-iii
|
||||
app.kubernetes.io/name: firefly-iii
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
cnpg.io/cluster: firefly-postgres
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5432
|
||||
# CloudNativePG operator health/status traffic to the instance manager.
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: psql
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: cloudnative-pg
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8000
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: firefly-data-importer-ingress
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
# traefik-ai uses hostNetwork and is therefore seen as node traffic.
|
||||
- from:
|
||||
- ipBlock:
|
||||
cidr: 192.168.1.117/32
|
||||
- ipBlock:
|
||||
cidr: 100.77.155.120/32
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
@@ -1,49 +0,0 @@
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: firefly-postgres
|
||||
spec:
|
||||
description: PostgreSQL for Firefly III
|
||||
instances: 1
|
||||
enableSuperuserAccess: false
|
||||
primaryUpdateStrategy: unsupervised
|
||||
bootstrap:
|
||||
initdb:
|
||||
database: firefly
|
||||
owner: firefly
|
||||
secret:
|
||||
name: firefly-secrets
|
||||
dataChecksums: true
|
||||
storage:
|
||||
size: 10Gi
|
||||
storageClass: firefly-local
|
||||
pvcTemplate:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: firefly-local
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: firefly-postgres
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
volumeMode: Filesystem
|
||||
affinity:
|
||||
enablePodAntiAffinity: false
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
monitoring:
|
||||
enablePodMonitor: true
|
||||
|
||||
@@ -1,52 +0,0 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: firefly-storage-prep
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PreSync
|
||||
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
|
||||
spec:
|
||||
backoffLimit: 3
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-storage-prep
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: prepare
|
||||
image: busybox:1.37.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
- |
|
||||
mkdir -p /host/k8s/firefly-iii/postgres
|
||||
chown 26:26 /host/k8s/firefly-iii/postgres
|
||||
chmod 0700 /host/k8s/firefly-iii/postgres
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
add:
|
||||
- CHOWN
|
||||
- DAC_OVERRIDE
|
||||
- FOWNER
|
||||
volumeMounts:
|
||||
- name: host-root
|
||||
mountPath: /host/k8s/firefly-iii
|
||||
volumes:
|
||||
- name: host-root
|
||||
hostPath:
|
||||
path: /k8s/firefly-iii
|
||||
type: DirectoryOrCreate
|
||||
@@ -1,72 +0,0 @@
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: firefly-local
|
||||
provisioner: kubernetes.io/no-provisioner
|
||||
reclaimPolicy: Retain
|
||||
volumeBindingMode: WaitForFirstConsumer
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: firefly-postgres
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-postgres
|
||||
spec:
|
||||
capacity:
|
||||
storage: 10Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: firefly-local
|
||||
volumeMode: Filesystem
|
||||
hostPath:
|
||||
path: /k8s/firefly-iii/postgres
|
||||
type: DirectoryOrCreate
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- ai.tail2fe2d.ts.net
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: firefly-uploads
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-uploads
|
||||
spec:
|
||||
capacity:
|
||||
storage: 5Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: firefly-local
|
||||
volumeMode: Filesystem
|
||||
hostPath:
|
||||
path: /k8s/firefly-iii/uploads
|
||||
type: DirectoryOrCreate
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- ai.tail2fe2d.ts.net
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: firefly-uploads
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: firefly-local
|
||||
volumeName: firefly-uploads
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
@@ -1,175 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: IngressClass
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
spec:
|
||||
controller: traefik.io/ingress-controller
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- secrets
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: traefik-ai
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik-ai
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: firefly-traefik-ai
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: firefly-traefik-ai
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: firefly-traefik-ai
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik-ai
|
||||
namespace: firefly-iii
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik-ai
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: traefik-ai
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik-ai
|
||||
spec:
|
||||
serviceAccountName: traefik-ai
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: traefik
|
||||
image: rancher/mirrored-library-traefik:3.6.13
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --entrypoints.web.address=192.168.1.117:80
|
||||
- --providers.kubernetesingress=true
|
||||
- --providers.kubernetesingress.namespaces=firefly-iii
|
||||
- --providers.kubernetesingress.ingressclass=traefik-ai
|
||||
- --providers.kubernetesingress.labelselector=firefly.hexor.cy/private-ai=true
|
||||
- --providers.kubernetescrd=false
|
||||
- --api.dashboard=false
|
||||
- --log.level=INFO
|
||||
ports:
|
||||
- name: web
|
||||
containerPort: 80
|
||||
hostPort: 80
|
||||
hostIP: 192.168.1.117
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
host: 192.168.1.117
|
||||
port: web
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
host: 192.168.1.117
|
||||
port: web
|
||||
periodSeconds: 30
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
@@ -1,68 +0,0 @@
|
||||
replicaCount: 1
|
||||
|
||||
image:
|
||||
repository: fireflyiii/core
|
||||
tag: version-6.6.1
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik-ai
|
||||
hosts:
|
||||
- host: ff.lan
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
|
||||
persistence:
|
||||
upload:
|
||||
enabled: true
|
||||
existingClaim: firefly-uploads
|
||||
|
||||
# Must remain true because chart 0.1.2 validates it. Kustomize removes the
|
||||
# generated StatefulSet and makes this Service select the CloudNativePG Pod.
|
||||
postgres:
|
||||
enabled: true
|
||||
auth:
|
||||
database: firefly
|
||||
username: firefly
|
||||
service:
|
||||
port: 5432
|
||||
|
||||
cronjob:
|
||||
enabled: true
|
||||
schedule: "0 3 * * *"
|
||||
timeZone: Europe/London
|
||||
|
||||
firefly:
|
||||
env:
|
||||
APP_ENV: production
|
||||
APP_DEBUG: "false"
|
||||
APP_URL: http://ff.lan
|
||||
SITE_OWNER: owner@ff.lan
|
||||
TZ: Europe/London
|
||||
DEFAULT_LANGUAGE: en_US
|
||||
TRUSTED_PROXIES: 10.42.0.0/16
|
||||
COOKIE_SECURE: "false"
|
||||
PGSQL_SSL_MODE: prefer
|
||||
secrets:
|
||||
existingSecret: firefly-secrets
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 1Gi
|
||||
@@ -17,8 +17,6 @@ spec:
|
||||
labels:
|
||||
app: teamspeak
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: music.tail2fe2d.ts.net
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
|
||||
@@ -45,11 +45,6 @@ spec:
|
||||
value: "info"
|
||||
- name: WEB_PETTING_DEBUG
|
||||
value: "false"
|
||||
- name: WEB_PETTING_DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: web-petting-secrets
|
||||
key: WEB_PETTING_DATABASE_URL
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: web-petting-secrets
|
||||
spec:
|
||||
target:
|
||||
name: web-petting-secrets
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
WEB_PETTING_DATABASE_URL: |-
|
||||
postgresql://web_petting:{{ .web_petting }}@psql.psql.svc:5432/web_petting
|
||||
data:
|
||||
- secretKey: web_petting
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[20].value
|
||||
@@ -4,7 +4,6 @@ kind: Kustomization
|
||||
resources:
|
||||
- app.yaml
|
||||
- deployment.yaml
|
||||
- external-secrets.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- storage.yaml
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: argocd-dex-server
|
||||
namespace: argocd
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: dex-server
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: 5556
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 5556
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 3
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
@@ -16,5 +16,3 @@ helmCharts:
|
||||
valuesFile: values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
patches:
|
||||
- path: dex-probes-patch.yaml
|
||||
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
spec:
|
||||
project: core
|
||||
destination:
|
||||
namespace: longhorn-system
|
||||
namespace: longhorn
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
|
||||
@@ -9,7 +9,7 @@ helmCharts:
|
||||
repo: https://charts.longhorn.io
|
||||
version: 1.12.0
|
||||
releaseName: longhorn
|
||||
namespace: longhorn-system
|
||||
namespace: longhorn
|
||||
valuesFile: values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
|
||||
@@ -140,10 +140,6 @@ spec:
|
||||
{{ .furumi_dev }}
|
||||
USER_keycloak: |-
|
||||
{{ .keycloak }}
|
||||
USER_amnezia_fellow: |-
|
||||
{{ .amnezia_fellow }}
|
||||
USER_web_petting: |-
|
||||
{{ .web_petting }}
|
||||
data:
|
||||
- secretKey: authentik
|
||||
sourceRef:
|
||||
@@ -343,25 +339,3 @@ spec:
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[18].value
|
||||
- secretKey: amnezia_fellow
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[19].value
|
||||
- secretKey: web_petting
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[20].value
|
||||
|
||||
Reference in New Issue
Block a user