Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
71e30c1115 | ||
 Ultradesu
|
d41171955b | ||
|
Ultradesu
|
f038016d46 | ||
 Aleksandr Bogomiakov
|
1091d6bd14 | ||
|
Aleksandr Bogomiakov
|
9f56045009 | ||
|
Aleksandr Bogomiakov
|
2583236f6d |
@@ -42,7 +42,10 @@ ArgoCD homelab project
|
||||
|
||||
| Application | Status |
|
||||
| :--- | :---: |
|
||||
| **amnezia** | [](https://ag.hexor.cy/applications/argocd/amnezia) |
|
||||
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||
| **doka2-lobby-list** | [](https://ag.hexor.cy/applications/argocd/doka2-lobby-list) |
|
||||
| **firefly-iii** | [](https://ag.hexor.cy/applications/argocd/firefly-iii) |
|
||||
| **furumi** | [](https://ag.hexor.cy/applications/argocd/furumi) |
|
||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||
| **greece-notifier** | [](https://ag.hexor.cy/applications/argocd/greece-notifier) |
|
||||
@@ -52,7 +55,9 @@ ArgoCD homelab project
|
||||
| **jellyfin** | [](https://ag.hexor.cy/applications/argocd/jellyfin) |
|
||||
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
||||
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
||||
| **lan-play** | [](https://ag.hexor.cy/applications/argocd/lan-play) |
|
||||
| **lidarr** | [](https://ag.hexor.cy/applications/argocd/lidarr) |
|
||||
| **llamacpp** | [](https://ag.hexor.cy/applications/argocd/llamacpp) |
|
||||
| **matrix** | [](https://ag.hexor.cy/applications/argocd/matrix) |
|
||||
| **mtproxy** | [](https://ag.hexor.cy/applications/argocd/mtproxy) |
|
||||
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
||||
|
||||
@@ -0,0 +1,106 @@
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: firefly-data-importer-sync
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-data-importer-sync
|
||||
spec:
|
||||
schedule: "17 */6 * * *"
|
||||
timeZone: Europe/London
|
||||
concurrencyPolicy: Forbid
|
||||
startingDeadlineSeconds: 1800
|
||||
successfulJobsHistoryLimit: 2
|
||||
failedJobsHistoryLimit: 5
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 1
|
||||
activeDeadlineSeconds: 1200
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: firefly-data-importer-sync
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
restartPolicy: Never
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: data-importer-sync
|
||||
image: fireflyiii/data-importer:version-2.3.4
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |-
|
||||
php artisan importer:import /import/import.json
|
||||
status=$?
|
||||
if [ "${status}" -eq 73 ]; then
|
||||
echo "No new transactions; considering the sync successful."
|
||||
exit 0
|
||||
fi
|
||||
exit "${status}"
|
||||
env:
|
||||
- name: FIREFLY_III_URL
|
||||
value: http://firefly-iii
|
||||
- name: VANITY_URL
|
||||
value: http://ff.lan
|
||||
- name: FIREFLY_III_ACCESS_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: firefly-data-importer-secrets
|
||||
key: FIREFLY_III_ACCESS_TOKEN
|
||||
- name: ENABLE_BANKING_APP_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: firefly-data-importer-secrets
|
||||
key: ENABLE_BANKING_APP_ID
|
||||
- name: ENABLE_BANKING_PRIVATE_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: firefly-data-importer-secrets
|
||||
key: ENABLE_BANKING_PRIVATE_KEY
|
||||
- name: IMPORT_DIR_ALLOWLIST
|
||||
value: /import
|
||||
# Recurring imports intentionally overlap their date range.
|
||||
# Keep rejecting duplicates, but do not fail the Job for them.
|
||||
- name: IGNORE_DUPLICATE_ERRORS
|
||||
value: "true"
|
||||
- name: TZ
|
||||
value: Europe/London
|
||||
- name: APP_ENV
|
||||
value: production
|
||||
- name: APP_DEBUG
|
||||
value: "false"
|
||||
- name: LOG_LEVEL
|
||||
value: notice
|
||||
volumeMounts:
|
||||
- name: import-config
|
||||
mountPath: /import
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
volumes:
|
||||
- name: import-config
|
||||
secret:
|
||||
secretName: firefly-data-importer-secrets
|
||||
items:
|
||||
- key: import.json
|
||||
path: import.json
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
@@ -66,6 +66,10 @@ spec:
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
{{ .private_key | replace "-----BEGIN PRIVATE KEY-----" "" | replace "-----END PRIVATE KEY-----" "" | replace " " "" | trim }}
|
||||
-----END PRIVATE KEY-----
|
||||
FIREFLY_III_ACCESS_TOKEN: |-
|
||||
{{ .firefly_access_token }}
|
||||
import.json: |-
|
||||
{{ .import_config }}
|
||||
data:
|
||||
- secretKey: app_id
|
||||
sourceRef:
|
||||
@@ -83,3 +87,19 @@ spec:
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[4].value
|
||||
- secretKey: firefly_access_token
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[6].value
|
||||
- secretKey: import_config
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: a1867c81-715c-47cd-978d-14ea5bcedea9
|
||||
property: fields[5].value
|
||||
|
||||
@@ -4,12 +4,12 @@ kind: Kustomization
|
||||
resources:
|
||||
- app.yaml
|
||||
- data-importer.yaml
|
||||
- data-importer-sync.yaml
|
||||
- data-importer-ingress.yaml
|
||||
- external-secrets.yaml
|
||||
- postgres.yaml
|
||||
- storage.yaml
|
||||
- storage-prep.yaml
|
||||
- traefik-ai.yaml
|
||||
- network-policy.yaml
|
||||
|
||||
helmCharts:
|
||||
|
||||
@@ -22,6 +22,9 @@ spec:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: firefly-data-importer
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: firefly-data-importer-sync
|
||||
# hostNetwork traffic is seen as node traffic rather than Pod traffic.
|
||||
- ipBlock:
|
||||
cidr: 192.168.1.117/32
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: lan-play
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: lan-play
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/lan-play
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
@@ -0,0 +1,63 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: lan-play
|
||||
labels:
|
||||
app.kubernetes.io/name: lan-play
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: lan-play
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: lan-play
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: ai.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: lan-play
|
||||
image: ultradesu/lan-play:latest
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: media
|
||||
mountPath: /media
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: http
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 30
|
||||
resources:
|
||||
requests:
|
||||
cpu: "2"
|
||||
memory: 2Gi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
volumes:
|
||||
- name: media
|
||||
hostPath:
|
||||
path: /k8s/lan-play
|
||||
type: DirectoryOrCreate
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
@@ -0,0 +1,63 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: lan-play-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://auth-proxy.auth-proxy.svc:80/auth
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-User
|
||||
- X-Auth-Request-Email
|
||||
- X-Auth-Request-Groups
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: lan-play-public
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lp.hexor.cy`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: lan-play-auth
|
||||
services:
|
||||
- name: lan-play
|
||||
port: 80
|
||||
tls:
|
||||
secretName: lan-play-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: lan-play-tls
|
||||
spec:
|
||||
secretName: lan-play-tls
|
||||
issuerRef:
|
||||
name: letsencrypt
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- lp.hexor.cy
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: lan-play-local
|
||||
labels:
|
||||
firefly.hexor.cy/private-ai: "true"
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik-ai
|
||||
spec:
|
||||
rules:
|
||||
- host: video.lan
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: lan-play
|
||||
port:
|
||||
number: 80
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: lan-play
|
||||
labels:
|
||||
app.kubernetes.io/name: lan-play
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: lan-play
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
@@ -7,6 +7,7 @@ resources:
|
||||
- coredns-internal-resolve.yaml
|
||||
- https-middleware.yaml
|
||||
- node-external-ip-labeler.yaml
|
||||
- traefik-ai.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: csi-driver-nfs
|
||||
|
||||
@@ -9,11 +9,13 @@ apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
namespace: firefly-iii
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
@@ -52,6 +54,7 @@ apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
namespace: firefly-iii
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
@@ -59,11 +62,65 @@ roleRef:
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik-ai
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
namespace: lan-play
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- secrets
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
namespace: lan-play
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: traefik-ai
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik-ai
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: firefly-traefik-ai
|
||||
name: traefik-ai
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
@@ -85,20 +142,21 @@ rules:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: firefly-traefik-ai
|
||||
name: traefik-ai
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: firefly-traefik-ai
|
||||
name: traefik-ai
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik-ai
|
||||
namespace: firefly-iii
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik-ai
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik-ai
|
||||
spec:
|
||||
@@ -130,7 +188,7 @@ spec:
|
||||
args:
|
||||
- --entrypoints.web.address=192.168.1.117:80
|
||||
- --providers.kubernetesingress=true
|
||||
- --providers.kubernetesingress.namespaces=firefly-iii
|
||||
- --providers.kubernetesingress.namespaces=firefly-iii,lan-play
|
||||
- --providers.kubernetesingress.ingressclass=traefik-ai
|
||||
- --providers.kubernetesingress.labelselector=firefly.hexor.cy/private-ai=true
|
||||
- --providers.kubernetescrd=false
|
||||
@@ -24,6 +24,10 @@ proxy_applications = {
|
||||
domain = "import.hexor.cy"
|
||||
allowed_groups = ["hexor-admin"]
|
||||
}
|
||||
LanPlay = {
|
||||
domain = "lp.hexor.cy"
|
||||
allowed_groups = ["hexor-admin"]
|
||||
}
|
||||
}
|
||||
|
||||
oauth2_applications = {
|
||||
|
||||
Reference in New Issue
Block a user