Auto-update README with current k8s applications

Generated by CI/CD workflow on 2025-11-18 22:02:50 This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.
2025-11-18 22:02:50 +00:00
455 changed files with 2647 additions and 22141 deletions
@@ -1,10 +1,10 @@
-name: 'Keycloak Terraform'
+name: 'Terraform'
 on:
  push:
    branches: [ "main" ]
    paths:
-      - 'terraform/keycloak/**'
+      - 'terraform/authentik/**'
  pull_request:
 permissions:
@@ -25,31 +25,115 @@ jobs:
      uses: actions/checkout@v3
    - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v4.0.0
+      uses: hashicorp/setup-terraform@v2
      with:
        cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
    - name: Setup kubeconfig
      env:
        CI_KUBECONFIG: ${{ secrets.KUBECONFIG }}
      run: |
        mkdir -p ~/.kube
        printf '%s' "$CI_KUBECONFIG" > ~/.kube/config
        chmod 600 ~/.kube/config
    - name: Terraform Init
      run: terraform init
-      working-directory: ./terraform/keycloak
+      working-directory: ./terraform/authentik
    - name: Terraform Format
      run: terraform fmt -check
      continue-on-error: true
-      working-directory: ./terraform/keycloak
+      working-directory: ./terraform/authentik
    - name: Terraform Apply
-      env:
+      run: terraform apply -var-file proxy-apps.tfvars -var-file oauth2-apps.tfvars -var-file terraform.tfvars -var-file groups.tfvars -input=false -auto-approve -parallelism=100
-        TF_VAR_keycloak_client_secret: ${{ secrets.KEYCLOAK_CLIENT_SECRET }}
+      working-directory: ./terraform/authentik
-        TF_VAR_google_client_id: ${{ secrets.GOOGLE_CLIENT_ID }}
+
-        TF_VAR_google_client_secret: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+    - name: Generate Wiki Content  
-      run: terraform apply -input=false -auto-approve -parallelism=100
+      if: success()
-      working-directory: ./terraform/keycloak
+      continue-on-error: true
      run: |
        echo "📋 Starting Wiki generation..."
        cd ./terraform/authentik
        # Get terraform output
        echo "🔍 Generating Terraform output..."
        terraform output -json applications_for_wiki > terraform-raw-output.json 2>&1
        # Process output to extract clean JSON
        echo "📤 Processing Terraform output..."
        python3 ../../.gitea/scripts/process-terraform-output.py terraform-raw-output.json terraform-output.json
        # Run wiki generation
        echo "📊 Running wiki generation script..."
        if python3 ../../.gitea/scripts/generate-apps-wiki.py terraform-output.json; then
          echo "✅ Wiki content generated successfully"
        else
          echo "⚠️ Wiki generation failed, retrying with debug..."
          python3 ../../.gitea/scripts/generate-apps-wiki.py terraform-output.json --debug || echo "⚠️ Wiki generation failed"
        fi
        # Check results
        if [ -f "Applications.md" ]; then
          echo "✅ Wiki file created: $(wc -l < Applications.md) lines"
        else
          echo "⚠️ Wiki content not generated"
          exit 0
        fi
      working-directory: ./
    - name: Upload Wiki to Gitea
      if: success()  
      continue-on-error: true
      run: |
        cd ./terraform/authentik
        # Set variables
        GITEA_URL="${{ secrets.GT_URL }}"
        GITEA_TOKEN="${{ secrets.GT_WIKI_TOKEN }}"
        GITEA_OWNER="${{ secrets.GT_OWNER }}"
        GITEA_REPO="${{ secrets.GT_REPO }}"
        # Debug variables (without exposing token)
        echo "🔍 Checking variables..."
        echo "GITEA_URL: ${GITEA_URL:-NOT SET}"
        echo "GITEA_OWNER: ${GITEA_OWNER:-NOT SET}"
        echo "GITEA_REPO: ${GITEA_REPO:-NOT SET}"
        echo "GITEA_TOKEN: $(if [ -n "$GITEA_TOKEN" ]; then echo "SET"; else echo "NOT SET"; fi)"
        # Check if file exists
        if [ ! -f "Applications.md" ]; then
          echo "⚠️ Applications.md not found, skipping wiki update"
          exit 0
        fi
        echo "📤 Uploading to Gitea Wiki..."
        # Encode content to base64
        CONTENT=$(base64 -w 0 Applications.md)
        # Check if wiki page exists
        WIKI_PAGE_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" \
          -H "Authorization: token $GITEA_TOKEN" \
          "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/page/Applications" || echo "000")
        if [ "$WIKI_PAGE_EXISTS" = "200" ]; then
          echo "📝 Updating existing wiki page..."
          curl -X PATCH \
            -H "Authorization: token $GITEA_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{
              \"title\": \"Applications\",
              \"content_base64\": \"$CONTENT\",
              \"message\": \"Update applications list from CI/CD [$(date)]\"
            }" \
            "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/page/Applications" || echo "⚠️ Wiki update failed"
        else
          echo "📄 Creating new wiki page..."
          curl -X POST \
            -H "Authorization: token $GITEA_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{
              \"title\": \"Applications\", 
              \"content_base64\": \"$CONTENT\",
              \"message\": \"Create applications list from CI/CD [$(date)]\"
            }" \
            "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/new" || echo "⚠️ Wiki creation failed"
        fi
        echo "✅ Wiki update process completed"
      working-directory: ./
@@ -22,13 +22,12 @@ jobs:
    - name: Install Python dependencies
      run: |
-        python3 -m venv .venv
+        pip install pyyaml
        .venv/bin/pip install pyyaml
    - name: Generate K8s Services Wiki
      run: |
        echo "📋 Starting K8s wiki generation..."
-        .venv/bin/python .gitea/scripts/generate-k8s-wiki.py k8s/ Kubernetes-Services.md
+        python3 .gitea/scripts/generate-k8s-wiki.py k8s/ Kubernetes-Services.md
        if [ -f "Kubernetes-Services.md" ]; then
          echo "✅ Wiki content generated successfully"
@@ -13,7 +13,6 @@ crash.*.log
 *.tfvars
 *.tfvars.json
 !*terraform.tfvars
 !*.auto.tfvars
 # claude ai
 .claude/
@@ -59,6 +58,3 @@ tags
 [._]*.un~
 .DS_Store
 # Helm charts pulled by kustomize (--enable-helm) when rendering locally
 k8s-ng/**/charts/
@@ -13,19 +13,13 @@ ArgoCD homelab project
 | Application | Status |
 | :--- | :---: |
 | **argocd** | [![argocd](https://ag.hexor.cy/api/badge?name=argocd&revision=true)](https://ag.hexor.cy/applications/argocd/argocd) |
 | **auth-proxy** | [![auth-proxy](https://ag.hexor.cy/api/badge?name=auth-proxy&revision=true)](https://ag.hexor.cy/applications/argocd/auth-proxy) |
 | **authentik** | [![authentik](https://ag.hexor.cy/api/badge?name=authentik&revision=true)](https://ag.hexor.cy/applications/argocd/authentik) |
 | **cert-manager** | [![cert-manager](https://ag.hexor.cy/api/badge?name=cert-manager&revision=true)](https://ag.hexor.cy/applications/argocd/cert-manager) |
 | **external-secrets** | [![external-secrets](https://ag.hexor.cy/api/badge?name=external-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/external-secrets) |
 | **gpu** | [![gpu](https://ag.hexor.cy/api/badge?name=gpu&revision=true)](https://ag.hexor.cy/applications/argocd/gpu) |
 | **kanidm** | [![kanidm](https://ag.hexor.cy/api/badge?name=kanidm&revision=true)](https://ag.hexor.cy/applications/argocd/kanidm) |
 | **keycloak** | [![keycloak](https://ag.hexor.cy/api/badge?name=keycloak&revision=true)](https://ag.hexor.cy/applications/argocd/keycloak) |
 | **kube-system-custom** | [![kube-system-custom](https://ag.hexor.cy/api/badge?name=kube-system-custom&revision=true)](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
 | **kubernetes-dashboard** | [![kubernetes-dashboard](https://ag.hexor.cy/api/badge?name=kubernetes-dashboard&revision=true)](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
 | **longhorn** | [![longhorn](https://ag.hexor.cy/api/badge?name=longhorn&revision=true)](https://ag.hexor.cy/applications/argocd/longhorn) |
 | **postgresql** | [![postgresql](https://ag.hexor.cy/api/badge?name=postgresql&revision=true)](https://ag.hexor.cy/applications/argocd/postgresql) |
 | **prom-stack** | [![prom-stack](https://ag.hexor.cy/api/badge?name=prom-stack&revision=true)](https://ag.hexor.cy/applications/argocd/prom-stack) |
 | **reloader** | [![reloader](https://ag.hexor.cy/api/badge?name=reloader&revision=true)](https://ag.hexor.cy/applications/argocd/reloader) |
 | **system-upgrade** | [![system-upgrade](https://ag.hexor.cy/api/badge?name=system-upgrade&revision=true)](https://ag.hexor.cy/applications/argocd/system-upgrade) |
 ### Games
@@ -42,8 +36,6 @@ ArgoCD homelab project
 | Application | Status |
 | :--- | :---: |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
 | **furumi** | [![furumi](https://ag.hexor.cy/api/badge?name=furumi&revision=true)](https://ag.hexor.cy/applications/argocd/furumi) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
 | **hexound** | [![hexound](https://ag.hexor.cy/api/badge?name=hexound&revision=true)](https://ag.hexor.cy/applications/argocd/hexound) |
@@ -52,26 +44,17 @@ ArgoCD homelab project
 | **jellyfin** | [![jellyfin](https://ag.hexor.cy/api/badge?name=jellyfin&revision=true)](https://ag.hexor.cy/applications/argocd/jellyfin) |
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
 | **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
 | **matrix** | [![matrix](https://ag.hexor.cy/api/badge?name=matrix&revision=true)](https://ag.hexor.cy/applications/argocd/matrix) |
 | **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
 | **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |
 | **ollama** | [![ollama](https://ag.hexor.cy/api/badge?name=ollama&revision=true)](https://ag.hexor.cy/applications/argocd/ollama) |
 | **paperless** | [![paperless](https://ag.hexor.cy/api/badge?name=paperless&revision=true)](https://ag.hexor.cy/applications/argocd/paperless) |
 | **pasarguard** | [![pasarguard](https://ag.hexor.cy/api/badge?name=pasarguard&revision=true)](https://ag.hexor.cy/applications/argocd/pasarguard) |
 | **qbittorent-nas** | [![qbittorent-nas](https://ag.hexor.cy/api/badge?name=qbittorent-nas&revision=true)](https://ag.hexor.cy/applications/argocd/qbittorent-nas) |
 | **remnawave** | [![remnawave](https://ag.hexor.cy/api/badge?name=remnawave&revision=true)](https://ag.hexor.cy/applications/argocd/remnawave) |
 | **rustdesk** | [![rustdesk](https://ag.hexor.cy/api/badge?name=rustdesk&revision=true)](https://ag.hexor.cy/applications/argocd/rustdesk) |
 | **sonarr-stack** | [![sonarr-stack](https://ag.hexor.cy/api/badge?name=sonarr-stack&revision=true)](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
 | **stirling-pdf** | [![stirling-pdf](https://ag.hexor.cy/api/badge?name=stirling-pdf&revision=true)](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
 | **syncthing** | [![syncthing](https://ag.hexor.cy/api/badge?name=syncthing&revision=true)](https://ag.hexor.cy/applications/argocd/syncthing) |
 | **teamspeak** | [![teamspeak](https://ag.hexor.cy/api/badge?name=teamspeak&revision=true)](https://ag.hexor.cy/applications/argocd/teamspeak) |
 | **tg-bots** | [![tg-bots](https://ag.hexor.cy/api/badge?name=tg-bots&revision=true)](https://ag.hexor.cy/applications/argocd/tg-bots) |
 | **vaultwarden** | [![vaultwarden](https://ag.hexor.cy/api/badge?name=vaultwarden&revision=true)](https://ag.hexor.cy/applications/argocd/vaultwarden) |
 | **vpn** | [![vpn](https://ag.hexor.cy/api/badge?name=vpn&revision=true)](https://ag.hexor.cy/applications/argocd/vpn) |
 | **web-petting** | [![web-petting](https://ag.hexor.cy/api/badge?name=web-petting&revision=true)](https://ag.hexor.cy/applications/argocd/web-petting) |
 | **wedding** | [![wedding](https://ag.hexor.cy/api/badge?name=wedding&revision=true)](https://ag.hexor.cy/applications/argocd/wedding) |
 | **xandikos** | [![xandikos](https://ag.hexor.cy/api/badge?name=xandikos&revision=true)](https://ag.hexor.cy/applications/argocd/xandikos) |
 </td>
 </tr>
@@ -1,50 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: furumi-player
  labels:
    app: furumi-player
 spec:
  replicas: 1
  strategy:
    type: Recreate # the library is a hostPath on a single node
  selector:
    matchLabels:
      app: furumi-player
  template:
    metadata:
      labels:
        app: furumi-player
      annotations:
        reloader.stakater.com/auto: "true"
    spec:
      # The music library lives on this node's /data (LVM raid, not replicated).
      nodeSelector:
        kubernetes.io/hostname: music
      containers:
        - name: furumi-player
          image: ultradesu/furumusic:latest
          imagePullPolicy: Always
          env:
            - name: FURU_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: furumi-creds
                  key: PG_STRING
          ports:
            - name: http
              containerPort: 8000
          volumeMounts:
            - name: library
              mountPath: /media
            - name: inbox
              mountPath: /inbox
      volumes:
        - name: library
          hostPath:
            path: /data/furumi/library
            type: Directory
        - name: inbox
          hostPath:
            path: /data/furumi/inbox
            type: Directory
@@ -1,24 +0,0 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: furumi
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
  ingressClassName: traefik
  rules:
    - host: music.hexor.cy
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: furumi-player
                port:
                  number: 8000
  tls:
    - secretName: furumi-tls
      hosts:
        - music.hexor.cy
@@ -1,9 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - secrets.yaml
  - deployment.yaml
  - service.yaml
  - servicemonitor.yaml
  - ingress.yaml
@@ -1,47 +0,0 @@
 # Read-only access to the furumi-db Secret in the psql namespace
 # (see postgresql/databases/furumi.yaml for the other half).
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: db-credentials-reader
 ---
 apiVersion: external-secrets.io/v1
 kind: SecretStore
 metadata:
  name: psql-credentials
 spec:
  provider:
    kubernetes:
      remoteNamespace: psql
      server:
        caProvider:
          type: ConfigMap
          name: kube-root-ca.crt
          key: ca.crt
      auth:
        serviceAccount:
          name: db-credentials-reader
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: furumi-creds
 spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: SecretStore
    name: psql-credentials
  target:
    name: furumi-creds
    template:
      data:
        PG_STRING: "postgresql://{{ .username }}:{{ .password }}@main-rw.psql.svc:5432/furumi"
  data:
    - secretKey: username
      remoteRef:
        key: furumi-db
        property: username
    - secretKey: password
      remoteRef:
        key: furumi-db
        property: password
@@ -1,16 +0,0 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: furumi-player
  labels:
    app: furumi-player
 spec:
  type: ClusterIP
  selector:
    app: furumi-player
  ports:
    - name: http
      protocol: TCP
      port: 8000
      targetPort: 8000
@@ -1,13 +0,0 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: furumi-player
 spec:
  selector:
    matchLabels:
      app: furumi-player
  endpoints:
    - port: http
      path: /metrics
      interval: 30s
      scrapeTimeout: 10s
@@ -1,12 +0,0 @@
 # k8s-secrets
 The `k8s-secrets` Argo CD Application reads this directory through
 `core-state/values.yaml` and deploys into namespace `k8s-secret`.
 External Secrets loads the `k8s/openai/creds` Vaultwarden item into
 `openai-creds`. The reader at `pass.hexor.cy` can only read that Secret and is
 protected by the Keycloak forward-auth proxy. Its access policy is managed in
 `terraform/keycloak/terraform.tfvars`.
 The Kubernetes resource names and namespace match the former deployment so
 Argo CD can switch the source path without replacing the service or certificate.
@@ -1,32 +0,0 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: openai-creds
 spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vaultwarden-login
    kind: ClusterSecretStore
  target:
    name: openai-creds
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        USER: "{{ .user }}"
        PASS: "{{ .pass }}"
        TOTP: "{{ .totp }}"
  data:
    - secretKey: user
      remoteRef:
        key: k8s/openai/creds
        property: login.username
    - secretKey: pass
      remoteRef:
        key: k8s/openai/creds
        property: login.password
    - secretKey: totp
      remoteRef:
        key: k8s/openai/creds
        property: login.totp
@@ -1,38 +0,0 @@
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: auth-proxy
 spec:
  forwardAuth:
    address: http://auth-proxy.keycloak.svc:80/auth
    trustForwardHeader: false
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: secret-reader
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`pass.hexor.cy`)
      kind: Rule
      middlewares:
        - name: auth-proxy
      services:
        - name: secret-reader
          port: 80
  tls:
    secretName: secret-reader-tls
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: secret-reader-tls
 spec:
  secretName: secret-reader-tls
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  dnsNames:
    - pass.hexor.cy
@@ -1,7 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: k8s-secret
 resources:
  - external-secret.yaml
  - reader.yaml
  - ingress.yaml
@@ -1,109 +0,0 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: secret-reader
  labels:
    app: secret-reader
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: secret-reader
 rules:
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["openai-creds"]
    verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: secret-reader
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: secret-reader
 subjects:
  - kind: ServiceAccount
    name: secret-reader
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: secret-reader
  labels:
    app: secret-reader
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: secret-reader
  template:
    metadata:
      labels:
        app: secret-reader
    spec:
      serviceAccountName: secret-reader
      nodeSelector:
        homelab.hexor.cy/pool: core
        homelab.hexor.cy/exposure: external
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: secret-reader
          image: ultradesu/k8s-secrets:0.2.2@sha256:f206942d21ca9dcd131d6e19ba26cc17671815919217aef657b30a9f85854778
          imagePullPolicy: IfNotPresent
          args:
            - --secrets
            - openai-creds
            - --namespace
            - k8s-secret
            - --port
            - "3000"
          ports:
            - name: http
              containerPort: 3000
          env:
            - name: RUST_LOG
              value: info
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 150m
              memory: 128Mi
          readinessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: secret-reader
  labels:
    app: secret-reader
 spec:
  selector:
    app: secret-reader
  ports:
    - name: http
      port: 80
      targetPort: http
@@ -1,18 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: llamacpp-config
 data:
  LLAMA_CACHE: /models
  LLAMA_ARG_HOST: 0.0.0.0
  LLAMA_ARG_PORT: "8080"
  # The model is chosen here: <hf-user>/<repo>:<quant>. It is downloaded into
  # /models on first start; changing it restarts the pod (reloader).
  #LLAMA_ARG_HF_REPO: "unsloth/Qwen3.8-27B-GGUF:UD-Q6_K"
  LLAMA_ARG_HF_REPO: "unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q6_K"
  LLAMA_ARG_CTX_SIZE: "131072"
  LLAMA_ARG_N_GPU_LAYERS: all
  LLAMA_ARG_FLASH_ATTN: "on"
  LLAMA_ARG_FIT: "on"
  # Strix Halo: mmap-ed weights hang or corrupt on ROCm; read them directly.
  LLAMA_ARG_LOAD_MODE: dio
@@ -1,76 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: llamacpp
  annotations:
    reloader.stakater.com/auto: "true"
  labels:
    app: llamacpp
 spec:
  replicas: 1
  strategy:
    type: Recreate # one GPU, one pod
  selector:
    matchLabels:
      app: llamacpp
  template:
    metadata:
      labels:
        app: llamacpp
    spec:
      dnsPolicy: Default
      nodeSelector:
        homelab.hexor.cy/pool: core
        homelab.hexor.cy/exposure: internal
        workload/ai: "true"
      tolerations:
        - key: workload
          operator: Equal
          value: ai
          effect: NoSchedule
      containers:
        - name: llamacpp
          image: ghcr.io/ggml-org/llama.cpp:server-rocm-b11434
          imagePullPolicy: IfNotPresent
          envFrom:
            - configMapRef:
                name: llamacpp-config
          env:
            - name: HF_TOKEN
              valueFrom:
                secretKeyRef:
                  name: llamacpp-hf-token
                  key: token
                  optional: true
            # hipBLASLt gives the biggest prompt-processing gain on ROCm 7.x.
            - name: ROCBLAS_USE_HIPBLASLT
              value: "1"
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          resources:
            limits:
              amd.com/gpu: 1
          startupProbe:
            httpGet:
              path: /health
              port: http
            failureThreshold: 180 # first start downloads the model
            periodSeconds: 10
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /health
              port: http
            failureThreshold: 3
            periodSeconds: 10
            timeoutSeconds: 5
          volumeMounts:
            - name: models
              mountPath: /models
      volumes:
        - name: models
          hostPath:
            path: /var/lib/llamacpp/models
            type: DirectoryOrCreate
@@ -1,7 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - configmap.yaml
  - deployment.yaml
  - service.yaml
@@ -1,15 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: llamacpp
  labels:
    app: llamacpp
 spec:
  type: ClusterIP
  selector:
    app: llamacpp
  ports:
    - name: http
      port: 8080
      targetPort: http
      protocol: TCP
@@ -1,561 +0,0 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: nginx-config
  namespace: minecraft
 data:
  nginx.conf: |
    user nginx;
    worker_processes 1;
    error_log /var/log/nginx/error.log warn;
    pid /var/run/nginx.pid;
    events {
        worker_connections 1024;
    }
    http {
        include /etc/nginx/mime.types;
        default_type application/octet-stream;
        server {
            listen 80;
            # Custom 502 error page with auto-refresh
            error_page 502 /502.html;
            location = /502.html {
                internal;
                return 200 '<!DOCTYPE html><html><head><meta charset="utf-8"><title>Server Loading</title><style>body{font-family:Arial,sans-serif;text-align:center;margin-top:100px;background:#f0f0f0}h1{color:#333}p{color:#666;font-size:18px}</style></head><body><h1>Server is loading probably...</h1><p>Please wait a moment and try refreshing the page.</p><script>setTimeout(function(){window.location.reload();}, 10000);</script></body></html>';
                add_header Content-Type text/html;
            }
            # Main location - proxy to Minecraft Dynmap
            location / {
                # Proxy configuration for Dynmap server
                proxy_pass http://localhost:8123;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                # Inject user authentication meta tag into HTML head
                sub_filter '<head>' '<head><meta name="remote-user" content="$http_x_authentik_username">';
                # Replace default Dynmap title with custom server name
                sub_filter 'Minecraft Dynamic Map' "Hexor's MC server";
                # Inject custom script before closing body tag
                sub_filter "</body>" '<script src="/clients/inject.js"></script></body>';
                # Apply sub_filter replacements globally (not just once)
                sub_filter_once off;
            }
            # Serve inject.js and .ps1 scripts inline (no forced download)
            location = /clients/inject.js {
                alias /mc/clients/inject.js;
                default_type application/javascript;
            }
            location ~ ^/clients/(.+\.ps1)$ {
                alias /mc/clients/$1;
                default_type text/plain;
            }
            # Static file serving for client downloads
            location /clients/ {
                alias /mc/clients/;
                sendfile on;                          # Enable efficient file serving
                add_header Content-Disposition "attachment";  # Force download
                autoindex on;                         # Enable directory listing
                gzip off;                            # Disable compression for downloads
                chunked_transfer_encoding off;       # Disable chunked encoding
            }
        }
    }
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: client-scripts
  namespace: minecraft
 data:
  inject.js: |
    (function() {
      function getUsername() {
        var metas = document.querySelectorAll("meta");
        for (var i = 0; i < metas.length; i++) {
          if (metas[i].getAttribute("name") === "remote-user") {
            return metas[i].getAttribute("content");
          }
        }
        var jwt = document.cookie.split("; ").find(function(row) {
          return row.startsWith("authentik_session=");
        });
        if (jwt) {
          try {
            var token = jwt.split("=")[1];
            var payload = JSON.parse(atob(token.split(".")[1]));
            return payload.sub || payload.username || "web-user";
          } catch(e) {}
        }
        return "web-user";
      }
      var username = getUsername();
      console.log("Username found:", username);
      if (username && username !== "web-user" &&
          window.location.search.indexOf("playername=") === -1) {
        var currentUrl = new URL(window.location.href);
        currentUrl.searchParams.set("playername", username);
        console.log("Redirecting to:", currentUrl.href);
        window.location.href = currentUrl.href;
      }
      document.addEventListener("DOMContentLoaded", function() {
        // User block
        var userBlock = document.createElement("div");
        userBlock.style.cssText = "background-color:#CEC6CB;color:black;padding:8px;text-align:center;font-size:medium;border-radius:4px;position:absolute;top:10px;right:150px;max-width:200px;";
        userBlock.innerHTML = "Logged in as: <b>" + username + "</b>";
        document.body.appendChild(userBlock);
        // Info block
        var infoBlock = document.createElement("p");
        infoBlock.style.cssText = "background-color:#CEC6CB;color:black;padding:10px;text-align:center;font-size:large;display:inline-block;border-radius:4px;position:absolute;top:10px;left:150px;";
        infoBlock.innerHTML = 'GEYMERSKIY SOYUZ Server<br>'
          + 'Get <a href="https://github.com/PrismLauncher/PrismLauncher/releases/tag/8.4">Prism Launcher</a> '
          + 'and <a href="/clients/1.12.2.zip">client.zip</a> for this server. '
          + 'Server address <b>minecraft.hexor.cy:30565</b><br>'
          + 'Requires <a href="https://www.java.com/en/download/manual.jsp">Java 8</a><br><br>'
          + '<a href="#" id="showInstallBtn" style="color:black;text-decoration:underline;">Windows Install Script</a>';
        document.body.appendChild(infoBlock);
        // Modal
        var modal = document.createElement("div");
        modal.id = "installModal";
        modal.style.cssText = "display:none;position:fixed;z-index:1000;left:0;top:0;width:100%;height:100%;background-color:rgba(0,0,0,0.5);";
        modal.innerHTML = '<div style="background-color:#CEC6CB;margin:15% auto;padding:10px;border-radius:4px;width:70%;max-width:500px;text-align:center;color:black;font-size:large;">'
          + '<h3 style="margin-top:0;color:black;">Windows Installation</h3>'
          + '<p style="color:black;">Copy and paste this command into PowerShell:</p>'
          + '<textarea id="scriptCommand" readonly style="width:90%;height:60px;font-family:monospace;padding:8px;border:1px solid #888;border-radius:4px;resize:none;background-color:white;color:black;"></textarea>'
          + '<br><br>'
          + '<button id="copyButton" style="background-color:#CEC6CB;color:black;padding:10px 15px;border:1px solid #888;border-radius:4px;cursor:pointer;margin-right:10px;font-size:large;">Copy</button>'
          + '<button id="closeButton" style="background-color:#CEC6CB;color:black;padding:10px 15px;border:1px solid #888;border-radius:4px;cursor:pointer;font-size:large;">Close</button>'
          + '</div>';
        document.body.appendChild(modal);
        // Generate PowerShell command with username
        function buildPsCommand() {
          var d = "$";
          var q = "'";
          return d + 'f="' + d + 'env:TEMP\\mc-install.ps1"; iwr -useb https://minecraft.hexor.cy/clients/win-install.ps1 -OutFile '
            + d + 'f; powershell -ExecutionPolicy Bypass -File ' + d + 'f -Username ' + q + username + q + '; Remove-Item ' + d + 'f';
        }
        document.getElementById("showInstallBtn").addEventListener("click", function(e) {
          e.preventDefault();
          modal.style.display = "block";
          document.getElementById("scriptCommand").value = buildPsCommand();
        });
        document.getElementById("closeButton").addEventListener("click", function() {
          modal.style.display = "none";
        });
        document.getElementById("copyButton").addEventListener("click", function() {
          var textarea = document.getElementById("scriptCommand");
          textarea.select();
          textarea.setSelectionRange(0, 99999);
          document.execCommand("copy");
          var btn = document.getElementById("copyButton");
          btn.style.borderColor = "#4CAF50";
          setTimeout(function() { btn.style.borderColor = "#888"; }, 2000);
        });
        modal.addEventListener("click", function(event) {
          if (event.target === modal) {
            modal.style.display = "none";
          }
        });
      });
    })();
  win-install.ps1: |
    # Game Setup Script for PrismLauncher and Minecraft Client
    # This script downloads and configures PrismLauncher with Hexor client
    param(
        [string]$Username = "",
        [string]$InstallPath = "$env:USERPROFILE\Games\PrismLauncher"
    )
    # Enable TLS 1.2 for downloads
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    # Function to write colored log messages
    function Write-Log {
        param(
            [string]$Message,
            [string]$Level = "INFO"
        )
        switch ($Level) {
            "INFO" {
                Write-Host "[" -NoNewline
                Write-Host "INFO" -ForegroundColor Blue -NoNewline
                Write-Host "] $Message"
            }
            "WARN" {
                Write-Host "[" -NoNewline
                Write-Host "WARN" -ForegroundColor Yellow -NoNewline
                Write-Host "] $Message"
            }
            "ERROR" {
                Write-Host "[" -NoNewline
                Write-Host "ERROR" -ForegroundColor Red -NoNewline
                Write-Host "] $Message"
            }
            "SUCCESS" {
                Write-Host "[" -NoNewline
                Write-Host "SUCCESS" -ForegroundColor Green -NoNewline
                Write-Host "] $Message"
            }
        }
    }
    # Function to download file with progress
    function Download-File {
        param(
            [string]$Url,
            [string]$OutputPath
        )
        try {
            Write-Log "Downloading from: $Url"
            Write-Log "Saving to: $OutputPath"
            if (Test-Path $OutputPath) {
                Remove-Item $OutputPath -Force
                Write-Log "Removed existing file to avoid corruption" "WARN"
            }
            $webClient = New-Object System.Net.WebClient
            $webClient.DownloadFile($Url, $OutputPath)
            if (Test-Path $OutputPath) {
                $fileSize = (Get-Item $OutputPath).Length
                Write-Log "Download completed successfully ($fileSize bytes)" "SUCCESS"
                return $true
            } else {
                Write-Log "Download failed - file not found" "ERROR"
                return $false
            }
        }
        catch {
            Write-Log "Download failed: $($_.Exception.Message)" "ERROR"
            return $false
        }
    }
    # Function to extract ZIP archive
    function Extract-Archive {
        param(
            [string]$ArchivePath,
            [string]$DestinationPath
        )
        try {
            Write-Log "Extracting archive: $ArchivePath"
            Write-Log "Destination: $DestinationPath"
            if (!(Test-Path $ArchivePath)) {
                Write-Log "Archive file not found: $ArchivePath" "ERROR"
                return $false
            }
            $fileSize = (Get-Item $ArchivePath).Length
            if ($fileSize -lt 1000) {
                Write-Log "Archive file too small ($fileSize bytes), probably corrupted" "ERROR"
                return $false
            }
            if (!(Test-Path $DestinationPath)) {
                New-Item -ItemType Directory -Path $DestinationPath -Force | Out-Null
            }
            $existingFiles = Get-ChildItem -Path $DestinationPath -File | Where-Object { $_.Extension -ne ".zip" }
            $existingDirs = Get-ChildItem -Path $DestinationPath -Directory
            if ($existingFiles.Count -gt 0 -or $existingDirs.Count -gt 0) {
                Write-Log "Clearing existing files in destination directory" "WARN"
                $existingFiles | Remove-Item -Force -ErrorAction SilentlyContinue
                $existingDirs | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
            }
            Add-Type -AssemblyName System.IO.Compression.FileSystem
            try {
                $zip = [System.IO.Compression.ZipFile]::OpenRead($ArchivePath)
                $entryCount = $zip.Entries.Count
                $zip.Dispose()
                Write-Log "ZIP file validated ($entryCount entries)" "SUCCESS"
            }
            catch {
                Write-Log "ZIP file validation failed: $($_.Exception.Message)" "ERROR"
                return $false
            }
            [System.IO.Compression.ZipFile]::ExtractToDirectory($ArchivePath, $DestinationPath)
            Write-Log "Archive extracted successfully" "SUCCESS"
            return $true
        }
        catch {
            Write-Log "Archive extraction failed: $($_.Exception.Message)" "ERROR"
            if (Test-Path $ArchivePath) {
                Write-Log "Removing potentially corrupted archive file" "WARN"
                Remove-Item $ArchivePath -Force -ErrorAction SilentlyContinue
            }
            return $false
        }
    }
    # Function to check Java installation
    function Check-JavaInstallation {
        try {
            $javaVersion = java -version 2>&1 | Select-String "version"
            if ($javaVersion) {
                Write-Log "Java is installed: $($javaVersion.ToString().Trim())" "SUCCESS"
                return $true
            }
        }
        catch {
            Write-Log "Java is not installed or not in PATH" "WARN"
            Write-Log "Please download Java from: https://www.java.com/en/download/manual.jsp" "WARN"
            Write-Log "Look for 'Windows Offline (64-bit)' version" "WARN"
            $response = Read-Host "Do you want to continue without Java? (y/n)"
            if ($response -eq 'y' -or $response -eq 'Y') {
                Write-Log "Continuing without Java verification" "WARN"
                return $true
            } else {
                Write-Log "Installation cancelled. Please install Java first." "ERROR"
                return $false
            }
        }
    }
    # Function to generate a random hex string (UUID-like without dashes)
    function New-RandomHexId {
        param([int]$Length = 32)
        $bytes = New-Object byte[] ($Length / 2)
        $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
        $rng.GetBytes($bytes)
        $rng.Dispose()
        return ($bytes | ForEach-Object { $_.ToString("x2") }) -join ''
    }
    # Function to create accounts.json file with offline account
    function Create-AccountsFile {
        param(
            [string]$TargetPath,
            [string]$PlayerName
        )
        $accountsPath = Join-Path $TargetPath "accounts.json"
        $profileId = New-RandomHexId -Length 32
        $clientToken = New-RandomHexId -Length 32
        $iat = [int][double]::Parse((Get-Date -UFormat %s))
        $accountsObj = @{
            accounts = @(
                @{
                    entitlement = @{
                        canPlayMinecraft = $true
                        ownsMinecraft = $true
                    }
                    "msa-client-id" = ""
                    type = "MSA"
                },
                @{
                    active = $true
                    entitlement = @{
                        canPlayMinecraft = $true
                        ownsMinecraft = $true
                    }
                    profile = @{
                        capes = @()
                        id = $profileId
                        name = $PlayerName
                        skin = @{
                            id = ""
                            url = ""
                            variant = ""
                        }
                    }
                    type = "Offline"
                    ygg = @{
                        extra = @{
                            clientToken = $clientToken
                            userName = $PlayerName
                        }
                        iat = $iat
                        token = "0"
                    }
                }
            )
            formatVersion = 3
        }
        try {
            $accountsObj | ConvertTo-Json -Depth 10 | Out-File -FilePath $accountsPath -Encoding UTF8
            Write-Log "Created accounts.json at: $accountsPath" "SUCCESS"
            Write-Log "Player name: $PlayerName" "SUCCESS"
            return $true
        }
        catch {
            Write-Log "Failed to create accounts.json: $($_.Exception.Message)" "ERROR"
            return $false
        }
    }
    # Main installation process
    Write-Log "Starting PrismLauncher and Minecraft client setup"
    Write-Log "Player name: $Username"
    Write-Log "Installation path: $InstallPath"
    # Create installation directory and clear if exists (but keep ZIP files)
    if (Test-Path $InstallPath) {
        Write-Log "Installation directory exists, clearing contents" "WARN"
        $existingFiles = Get-ChildItem -Path $InstallPath -File | Where-Object { $_.Extension -ne ".zip" }
        $existingDirs = Get-ChildItem -Path $InstallPath -Directory
        $existingFiles | Remove-Item -Force -ErrorAction SilentlyContinue
        $existingDirs | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
    } else {
        New-Item -ItemType Directory -Path $InstallPath -Force | Out-Null
        Write-Log "Created installation directory: $InstallPath"
    }
    # Step 1: Download PrismLauncher
    Write-Log "Step 1: Downloading PrismLauncher..."
    $launcherUrl = "https://github.com/PrismLauncher/PrismLauncher/releases/download/8.4/PrismLauncher-Windows-MSVC-Portable-8.4.zip"
    $launcherZip = Join-Path $InstallPath "PrismLauncher-8.4.zip"
    $launcherExtractPath = Join-Path $InstallPath "PrismLauncher-Windows-MSVC-Portable-8.4"
    if (!(Download-File -Url $launcherUrl -OutputPath $launcherZip)) {
        Write-Log "Failed to download PrismLauncher. Exiting." "ERROR"
        exit 1
    }
    # Step 2: Extract PrismLauncher
    Write-Log "Step 2: Extracting PrismLauncher..."
    if (!(Extract-Archive -ArchivePath $launcherZip -DestinationPath $InstallPath)) {
        Write-Log "Failed to extract PrismLauncher. Exiting." "ERROR"
        exit 1
    }
    # Find the actual extracted directory
    $extractedDirs = Get-ChildItem -Path $InstallPath -Directory | Where-Object { $_.Name -like "*PrismLauncher*" }
    if ($extractedDirs.Count -gt 0) {
        $launcherExtractPath = $extractedDirs[0].FullName
        Write-Log "Found PrismLauncher directory: $launcherExtractPath" "SUCCESS"
    } else {
        Write-Log "Could not find extracted PrismLauncher directory. Checking for direct extraction..." "WARN"
        $prismExe = Join-Path $InstallPath "prismlauncher.exe"
        if (Test-Path $prismExe) {
            $launcherExtractPath = $InstallPath
            Write-Log "PrismLauncher extracted directly to: $launcherExtractPath" "SUCCESS"
        } else {
            Write-Log "Failed to locate PrismLauncher files. Exiting." "ERROR"
            exit 1
        }
    }
    # Step 3: Create accounts.json in InstallPath (only if username provided)
    if ($Username -and $Username -ne "web-user") {
        Write-Log "Step 3: Creating accounts configuration for $Username..."
        if (!(Create-AccountsFile -TargetPath $InstallPath -PlayerName $Username)) {
            Write-Log "Failed to create accounts.json. Exiting." "ERROR"
            exit 1
        }
    } else {
        Write-Log "Step 3: No username provided, skipping accounts.json creation" "WARN"
    }
    # Step 4: Check Java installation
    Write-Log "Step 4: Checking Java installation..."
    if (!(Check-JavaInstallation)) {
        Write-Log "Java check failed. Exiting." "ERROR"
        exit 1
    }
    # Step 5: Download Minecraft client
    Write-Log "Step 5: Downloading Minecraft client..."
    $minecraftUrl = "https://minecraft.hexor.cy/clients/1.12.2.zip"
    $minecraftZip = Join-Path $InstallPath "minecraft-1.12.2.zip"
    $instancesPath = Join-Path $launcherExtractPath "instances"
    $hexorPath = Join-Path $instancesPath "Hexor"
    if (!(Download-File -Url $minecraftUrl -OutputPath $minecraftZip)) {
        Write-Log "Failed to download Minecraft client. Exiting." "ERROR"
        exit 1
    }
    # Step 6: Create instances directory and extract Minecraft client
    Write-Log "Step 6: Setting up Minecraft client..."
    if (!(Test-Path $instancesPath)) {
        New-Item -ItemType Directory -Path $instancesPath -Force | Out-Null
        Write-Log "Created instances directory"
    }
    if (!(Test-Path $hexorPath)) {
        New-Item -ItemType Directory -Path $hexorPath -Force | Out-Null
        Write-Log "Created Hexor instance directory"
    }
    if (!(Extract-Archive -ArchivePath $minecraftZip -DestinationPath $hexorPath)) {
        Write-Log "Failed to extract Minecraft client. Exiting." "ERROR"
        exit 1
    }
    # Step 7: Cleanup temporary files
    Write-Log "Step 7: Cleaning up temporary files..."
    try {
        Remove-Item $launcherZip -Force
        Remove-Item $minecraftZip -Force
        Write-Log "Temporary files cleaned up" "SUCCESS"
    }
    catch {
        Write-Log "Could not remove temporary files: $($_.Exception.Message)" "WARN"
    }
    # Final success message
    Write-Log "=== INSTALLATION COMPLETED SUCCESSFULLY ===" "SUCCESS"
    Write-Log "PrismLauncher location: $launcherExtractPath" "SUCCESS"
    Write-Log "Executable: $(Join-Path $launcherExtractPath 'prismlauncher.exe')" "SUCCESS"
    Write-Log "Minecraft client installed in: $hexorPath" "SUCCESS"
    if ($Username -and $Username -ne "web-user") {
        Write-Log "Player name configured: $Username" "SUCCESS"
        Write-Log "Accounts file: $(Join-Path $InstallPath 'accounts.json')" "SUCCESS"
    }
    Write-Log ""
    Write-Log "You can now run PrismLauncher and the Hexor instance should be available!"
    Write-Log "If Java was not installed, please download it from: https://www.java.com/en/download/manual.jsp"
    # Ask if user wants to launch the game
    $launchResponse = Read-Host "Do you want to launch PrismLauncher now? (y/n)"
    if ($launchResponse -eq 'y' -or $launchResponse -eq 'Y') {
        $launcherExe = Join-Path $launcherExtractPath "prismlauncher.exe"
        if (Test-Path $launcherExe) {
            Write-Log "Launching PrismLauncher..." "INFO"
            Start-Process -FilePath $launcherExe -WorkingDirectory $launcherExtractPath
        } else {
            Write-Log "Launcher executable not found!" "ERROR"
        }
    }
@@ -1,137 +0,0 @@
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: minecraft
  namespace: minecraft
  labels:
    app: minecraft
 spec:
  selector:
    matchLabels:
      app: minecraft
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: minecraft
    spec:
      nodeSelector:
        kubernetes.io/hostname: music
      volumes:
      - name: storage
        hostPath:
          path: /data/k8s/mc-server/
          type: Directory
      - name: nginx-config
        configMap:
          name: nginx-config
      - name: client-scripts
        configMap:
          name: client-scripts
      terminationGracePeriodSeconds: 180
      containers:
        - name: minecraft
          image: eclipse-temurin:8-jdk-ubi10-minimal@sha256:85c943a7093a276b0f6ae13dee2ffecb98e390ab6a32fc7e4b8b1fc6bb103dd7
          command: ["java"]
          args:
            - -Xms4G
            - -Xmx4G
            - -XX:+UseG1GC
            - -XX:+ParallelRefProcEnabled
            - -XX:MaxGCPauseMillis=200
            - -XX:+UnlockExperimentalVMOptions
            - -XX:+DisableExplicitGC
            - -XX:+AlwaysPreTouch
            - -XX:G1NewSizePercent=30
            - -XX:G1MaxNewSizePercent=40
            - -XX:G1HeapRegionSize=8M
            - -XX:G1ReservePercent=20
            - -XX:G1HeapWastePercent=5
            - -XX:G1MixedGCCountTarget=4
            - -XX:InitiatingHeapOccupancyPercent=15
            - -XX:G1MixedGCLiveThresholdPercent=90
            - -XX:G1RSetUpdatingPauseTimePercent=5
            - -XX:SurvivorRatio=32
            - -XX:+PerfDisableSharedMem
            - -XX:MaxTenuringThreshold=1
            - -jar
            - forge-1.12.2-14.23.5.2854.jar
            - nogui
          workingDir: /mc/
          resources:
            requests:
              memory: "8Gi"
              cpu: "2000m"
            limits:
              memory: "12Gi"
              cpu: "4000m"
          ports:
            - name: game
              containerPort: 25565
              protocol: TCP
            - name: dynmap
              containerPort: 8123
              protocol: TCP
            - name: webstatus-mod
              containerPort: 8080
              protocol: TCP
          startupProbe:
            tcpSocket:
              port: game
            periodSeconds: 10
            failureThreshold: 90
          livenessProbe:
            tcpSocket:
              port: game
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            tcpSocket:
              port: game
            periodSeconds: 10
            timeoutSeconds: 5
          volumeMounts:
            - name: storage
              mountPath: /mc
        - name: nginx
          image: nginx@sha256:f9ea18bfa4fad859e1ed38259d711da7ccad2c3516e875cec3351a57c859f571
          resources:
            requests:
              memory: "64Mi"
              cpu: "50m"
            limits:
              memory: "256Mi"
              cpu: "200m"
          ports:
            - containerPort: 80
          volumeMounts:
            - name: nginx-config
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
            - name: storage
              mountPath: /mc
            - name: client-scripts
              mountPath: /mc/clients/win-install.ps1
              subPath: win-install.ps1
            - name: client-scripts
              mountPath: /mc/clients/inject.js
              subPath: inject.js
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: minecraft-exporter
  namespace: minecraft
 spec:
  selector:
    app: minecraft
  ports:
    - protocol: TCP
      port: 19565
      targetPort: 19565
@@ -1,24 +0,0 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: minecraft
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
  ingressClassName: traefik
  rules:
    - host: minecraft.hexor.cy
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: minecraft-dynmap
                port:
                  number: 80
  tls:
    - secretName: minecraft-tls
      hosts:
        - minecraft.hexor.cy
@@ -1,8 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: minecraft
 resources:
  - deployments.yaml
  - configmaps.yaml
  - services.yaml
  - ingress.yaml
@@ -1,39 +0,0 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: minecraft-dynmap
 spec:
  selector:
    app: minecraft
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: minecraft-webstatus-mod
 spec:
  selector:
    app: minecraft
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: minecraft-game
 spec:
  type: LoadBalancer
  externalTrafficPolicy: Cluster
  ports:
    - port: 30565
      targetPort: 25565
  selector:
    app: minecraft
@@ -1,23 +0,0 @@
 # MTProxy
 Argo CD deploys this directory through the `mtproxy` entry in
 `core-state/values.yaml`. Two telemt DaemonSets run on every node labeled
 `homelab.hexor.cy/exposure=external`: classic MTProxy on 30443/TCP and
 fake-TLS on 30444/TCP. The classic listener replaces the old amd64-only
 `telegrammessenger/proxy` image so the arm64 `spb` node is covered.
 Vaultwarden item `k8s/mtproxy/secret` must contain a custom field named
 `Secret` with the existing 32-character hexadecimal MTProxy secret. External
 Secrets renders both configurations from that field. Reloader restarts the
 DaemonSets when it changes. Changing this value invalidates existing links.
 `mtproxy-link-reconciler` lists external nodes every five minutes and creates
 `mtproxy-links` and `telemt-links` Secrets. A node's public DNS name must be
 `<node>.hexor.cy` and must point to that node. The reader at `proxy.hexor.cy`
 has read-only access to those two Secrets and is protected by Keycloak's
 forward auth; its access policy is in `terraform/keycloak/terraform.tfvars`.
 The proxy Pods have no Kubernetes API access.
 Before traffic is switched over, allow inbound 30443/TCP and 30444/TCP on
 every external node and verify both DNS and connectivity on each node.
 Neither the cluster nor host firewall is changed by these manifests.
@@ -1,149 +0,0 @@
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: mtproxy-classic
  labels:
    app: mtproxy-classic
 spec:
  selector:
    matchLabels:
      app: mtproxy-classic
  template:
    metadata:
      labels:
        app: mtproxy-classic
      annotations:
        reloader.stakater.com/auto: "true"
    spec:
      nodeSelector:
        homelab.hexor.cy/exposure: external
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: telemt
          image: ghcr.io/telemt/telemt@sha256:b311c20596213a3941dcd11f499be982de74f554eecfffe57fab51c1bf80d50a
          imagePullPolicy: IfNotPresent
          workingDir: /run/telemt
          args: ["/app/config.toml"]
          ports:
            - name: proxy
              containerPort: 30443
              hostPort: 30443
              protocol: TCP
            - name: metrics
              containerPort: 9090
              protocol: TCP
          readinessProbe:
            tcpSocket:
              port: proxy
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              memory: 256Mi
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: config
              mountPath: /app/config.toml
              subPath: classic.toml
              readOnly: true
            - name: workdir
              mountPath: /run/telemt
      volumes:
        - name: config
          secret:
            secretName: mtproxy-config
            defaultMode: 0444
            items:
              - key: classic.toml
                path: classic.toml
        - name: workdir
          emptyDir:
            medium: Memory
            sizeLimit: 4Mi
 ---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: mtproxy-tls
  labels:
    app: mtproxy-tls
 spec:
  selector:
    matchLabels:
      app: mtproxy-tls
  template:
    metadata:
      labels:
        app: mtproxy-tls
      annotations:
        reloader.stakater.com/auto: "true"
    spec:
      nodeSelector:
        homelab.hexor.cy/exposure: external
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: telemt
          image: ghcr.io/telemt/telemt@sha256:b311c20596213a3941dcd11f499be982de74f554eecfffe57fab51c1bf80d50a
          imagePullPolicy: IfNotPresent
          workingDir: /run/telemt
          args: ["/app/config.toml"]
          ports:
            - name: proxy
              containerPort: 30444
              hostPort: 30444
              protocol: TCP
            - name: metrics
              containerPort: 9090
              protocol: TCP
          readinessProbe:
            tcpSocket:
              port: proxy
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              memory: 256Mi
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: config
              mountPath: /app/config.toml
              subPath: tls.toml
              readOnly: true
            - name: workdir
              mountPath: /run/telemt
      volumes:
        - name: config
          secret:
            secretName: mtproxy-config
            defaultMode: 0444
            items:
              - key: tls.toml
                path: tls.toml
        - name: workdir
          emptyDir:
            medium: Memory
            sizeLimit: 4Mi
@@ -1,74 +0,0 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: mtproxy-config
 spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vaultwarden-fields
    kind: ClusterSecretStore
  target:
    name: mtproxy-config
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        SECRET: "{{ .secret }}"
        classic.toml: |
          [general]
          use_middle_proxy = true
          log_level = "normal"
          [general.modes]
          classic = true
          secure = false
          tls = false
          [server]
          port = 30443
          metrics_port = 9090
          metrics_whitelist = ["0.0.0.0/0"]
          [server.api]
          enabled = false
          [[server.listeners]]
          ip = "0.0.0.0"
          [access.users]
          user = "{{ .secret }}"
        tls.toml: |
          [general]
          use_middle_proxy = true
          log_level = "normal"
          [general.modes]
          classic = false
          secure = false
          tls = true
          [server]
          port = 30444
          metrics_port = 9090
          metrics_whitelist = ["0.0.0.0/0"]
          [server.api]
          enabled = false
          [[server.listeners]]
          ip = "0.0.0.0"
          [censorship]
          tls_domain = "ya.ru"
          mask = true
          tls_emulation = true
          tls_front_dir = "tlsfront"
          [access.users]
          user = "{{ .secret }}"
  data:
    - secretKey: secret
      remoteRef:
        key: k8s/mtproxy/secret
        property: Secret
@@ -1,38 +0,0 @@
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: mtproxy-auth
 spec:
  forwardAuth:
    address: http://auth-proxy.keycloak.svc:80/auth
    trustForwardHeader: false
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: mtproxy-links
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`proxy.hexor.cy`)
      kind: Rule
      middlewares:
        - name: mtproxy-auth
      services:
        - name: mtproxy-link-reader
          port: 80
  tls:
    secretName: mtproxy-links-tls
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: mtproxy-links-tls
 spec:
  secretName: mtproxy-links-tls
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  dnsNames:
    - proxy.hexor.cy
@@ -1,16 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: mtproxy
 resources:
  - external-secrets.yaml
  - daemonsets.yaml
  - metrics.yaml
  - links.yaml
  - reader.yaml
  - ingress.yaml
 configMapGenerator:
  - name: mtproxy-link-reconciler
    files:
      - reconcile.py=link-reconciler.py
 generatorOptions:
  disableNameSuffixHash: true
@@ -1,75 +0,0 @@
 """Publish client links for every external node, using its public DNS name."""
 import base64
 import json
 import urllib.error
 import urllib.parse
 import urllib.request
 API = "https://kubernetes.default.svc"
 NAMESPACE = open("/var/run/secrets/kubernetes.io/serviceaccount/namespace", encoding="utf-8").read().strip()
 TOKEN = open("/var/run/secrets/kubernetes.io/serviceaccount/token", encoding="utf-8").read().strip()
 CA = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
 def request(method, path, body=None):
    import ssl
    data = json.dumps(body).encode() if body is not None else None
    req = urllib.request.Request(
        API + path,
        data=data,
        method=method,
        headers={
            "Authorization": "Bearer " + TOKEN,
            "Content-Type": "application/json",
        },
    )
    with urllib.request.urlopen(req, context=ssl.create_default_context(cafile=CA), timeout=15) as response:
        return json.load(response)
 def publish(name, links):
    path = f"/api/v1/namespaces/{NAMESPACE}/secrets"
    data = {node: base64.b64encode(link.encode()).decode() for node, link in links.items()}
    try:
        current = request("GET", f"{path}/{name}")
    except urllib.error.HTTPError as error:
        if error.code != 404:
            raise
        request("POST", path, {"apiVersion": "v1", "kind": "Secret", "metadata": {"name": name}, "type": "Opaque", "data": data})
        return
    if current.get("data", {}) == data:
        return
    # PUT replaces the data map, removing links for nodes that are no longer external.
    request("PUT", f"{path}/{name}", {
        "apiVersion": "v1",
        "kind": "Secret",
        "metadata": {"name": name, "resourceVersion": current["metadata"]["resourceVersion"]},
        "type": "Opaque",
        "data": data,
    })
 secret = open("/config/SECRET", encoding="utf-8").read().strip()
 if len(secret) != 32 or any(char not in "0123456789abcdefABCDEF" for char in secret):
    raise ValueError("Vaultwarden Secret must be 32 hexadecimal characters")
 selector = urllib.parse.quote("homelab.hexor.cy/exposure=external", safe="")
 nodes = request("GET", f"/api/v1/nodes?labelSelector={selector}")["items"]
 if not nodes:
    raise ValueError("No external nodes found")
 classic = {}
 tls = {}
 for node in nodes:
    name = node["metadata"]["name"]
    # DNS is maintained outside the cluster; no public IP needs to be stored on a Node.
    host = f"{name}.hexor.cy"
    classic[name] = f"tg://proxy?server={host}&port=30443&secret={secret}"
    tls[name] = f"tg://proxy?server={host}&port=30444&secret=ee{secret}79612e7275"
 publish("mtproxy-links", classic)
 publish("telemt-links", tls)
 print(f"Published MTProxy links for {len(nodes)} external nodes")
@@ -1,108 +0,0 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: mtproxy-link-reconciler
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: mtproxy-external-node-reader
 rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  name: mtproxy-external-node-reader
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: mtproxy-external-node-reader
 subjects:
  - kind: ServiceAccount
    name: mtproxy-link-reconciler
    namespace: mtproxy
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: mtproxy-link-writer
 rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["mtproxy-links", "telemt-links"]
    verbs: ["get", "update"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: mtproxy-link-writer
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mtproxy-link-writer
 subjects:
  - kind: ServiceAccount
    name: mtproxy-link-reconciler
 ---
 apiVersion: batch/v1
 kind: CronJob
 metadata:
  name: mtproxy-link-reconciler
 spec:
  schedule: "*/5 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 2
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          serviceAccountName: mtproxy-link-reconciler
          restartPolicy: OnFailure
          nodeSelector:
            homelab.hexor.cy/exposure: external
          securityContext:
            runAsNonRoot: true
            runAsUser: 65534
            runAsGroup: 65534
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: reconcile
              image: python:3.13-alpine3.22@sha256:e81548ac35b07a3bd4805f275107592ef458b1e893c0e04d45aedaa19416cca5
              command: ["python", "/scripts/reconcile.py"]
              resources:
                requests:
                  cpu: 10m
                  memory: 32Mi
                limits:
                  memory: 128Mi
              securityContext:
                readOnlyRootFilesystem: true
                allowPrivilegeEscalation: false
                capabilities:
                  drop: ["ALL"]
              volumeMounts:
                - name: scripts
                  mountPath: /scripts
                  readOnly: true
                - name: config
                  mountPath: /config
                  readOnly: true
          volumes:
            - name: scripts
              configMap:
                name: mtproxy-link-reconciler
            - name: config
              secret:
                secretName: mtproxy-config
                items:
                  - key: SECRET
                    path: SECRET
@@ -1,65 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: mtproxy-classic-metrics
  labels:
    app: mtproxy-classic
 spec:
  clusterIP: None
  selector:
    app: mtproxy-classic
  ports:
    - name: metrics
      port: 9090
      targetPort: metrics
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: mtproxy-tls-metrics
  labels:
    app: mtproxy-tls
 spec:
  clusterIP: None
  selector:
    app: mtproxy-tls
  ports:
    - name: metrics
      port: 9090
      targetPort: metrics
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: mtproxy-classic
 spec:
  selector:
    matchLabels:
      app: mtproxy-classic
  endpoints:
    - port: metrics
      path: /metrics
      interval: 30s
      scrapeTimeout: 10s
      relabelings:
        - action: replace
          sourceLabels: [__meta_kubernetes_pod_node_name]
          targetLabel: node
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: mtproxy-tls
 spec:
  selector:
    matchLabels:
      app: mtproxy-tls
  endpoints:
    - port: metrics
      path: /metrics
      interval: 30s
      scrapeTimeout: 10s
      relabelings:
        - action: replace
          sourceLabels: [__meta_kubernetes_pod_node_name]
          targetLabel: node
@@ -1,96 +0,0 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: mtproxy-link-reader
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: mtproxy-link-reader
 rules:
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["mtproxy-links", "telemt-links"]
    verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: mtproxy-link-reader
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mtproxy-link-reader
 subjects:
  - kind: ServiceAccount
    name: mtproxy-link-reader
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: mtproxy-link-reader
  labels:
    app: mtproxy-link-reader
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: mtproxy-link-reader
  template:
    metadata:
      labels:
        app: mtproxy-link-reader
    spec:
      serviceAccountName: mtproxy-link-reader
      nodeSelector:
        homelab.hexor.cy/exposure: external
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: reader
          image: ultradesu/k8s-secrets:0.2.2@sha256:f206942d21ca9dcd131d6e19ba26cc17671815919217aef657b30a9f85854778
          imagePullPolicy: IfNotPresent
          args:
            - --secrets
            - mtproxy-links,telemt-links
            - --namespace
            - mtproxy
            - --port
            - "3000"
          ports:
            - name: http
              containerPort: 3000
          readinessProbe:
            httpGet:
              path: /health
              port: http
          livenessProbe:
            httpGet:
              path: /health
              port: http
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              memory: 128Mi
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: mtproxy-link-reader
 spec:
  selector:
    app: mtproxy-link-reader
  ports:
    - name: http
      port: 80
      targetPort: http
@@ -1,151 +0,0 @@
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: rustdesk-hbbs
  annotations:
    reloader.stakater.com/auto: "true"
  labels:
    app: rustdesk-hbbs
 spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: rustdesk-hbbs
  template:
    metadata:
      labels:
        app: rustdesk-hbbs
    spec:
      nodeSelector:
        kubernetes.io/hostname: music
      containers:
      - name: hbbs
        image: rustdesk/rustdesk-server@sha256:8ecdab65deb7c84652a626380e31d11a8f1fbafd97916d57f95c20628f943c00
        imagePullPolicy: Always
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "750m"
        command: ["hbbs"]
        args:
          - "--relay-servers"
          - "rd.hexor.cy:21117"
          - "--port"
          - "21116"
        ports:
        - name: registry
          containerPort: 21116
          protocol: TCP
        - name: registry-udp
          containerPort: 21116
          protocol: UDP
        - name: nat
          containerPort: 21115
          protocol: TCP
        readinessProbe:
          tcpSocket:
            port: registry
        volumeMounts:
        - name: keys
          mountPath: /data
          readOnly: true
        - name: data
          mountPath: /data-persistent
        env:
        - name: RUST_LOG
          value: "info"
        - name: DB_URL
          value: "/data-persistent/db_v2.sqlite3"
        workingDir: /data
      volumes:
      - name: keys
        secret:
          secretName: rustdesk-keys
          items:
          - key: id_ed25519
            path: id_ed25519
            mode: 0600
          - key: id_ed25519.pub
            path: id_ed25519.pub
            mode: 0644
      - name: data
        hostPath:
          path: /data/k8s/rustdesk/hbbs
          type: Directory
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: rustdesk-hbbr
  annotations:
    reloader.stakater.com/auto: "true"
  labels:
    app: rustdesk-hbbr
 spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: rustdesk-hbbr
  template:
    metadata:
      labels:
        app: rustdesk-hbbr
    spec:
      nodeSelector:
        kubernetes.io/hostname: music
      containers:
      - name: hbbr
        image: rustdesk/rustdesk-server@sha256:8ecdab65deb7c84652a626380e31d11a8f1fbafd97916d57f95c20628f943c00
        imagePullPolicy: Always
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "750m"
        command: ["hbbr"]
        args:
          - "--port"
          - "21117"
        ports:
        - name: relay
          containerPort: 21117
          protocol: TCP
        readinessProbe:
          tcpSocket:
            port: relay
        volumeMounts:
        - name: keys
          mountPath: /data
          readOnly: true
        - name: data
          mountPath: /data-persistent
        env:
        - name: RUST_LOG
          value: "info"
        workingDir: /data
      volumes:
      - name: keys
        secret:
          secretName: rustdesk-keys
          items:
          - key: id_ed25519
            path: id_ed25519
            mode: 0600
          - key: id_ed25519.pub
            path: id_ed25519.pub
            mode: 0644
      - name: data
        hostPath:
          path: /data/k8s/rustdesk/hbbr
          type: Directory
@@ -1,27 +0,0 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: rustdesk-keys
 spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vaultwarden-fields
    kind: ClusterSecretStore
  target:
    name: rustdesk-keys
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        id_ed25519: "{{ .private_key }}"
        id_ed25519.pub: "{{ .public_key }}"
  data:
    - secretKey: private_key
      remoteRef:
        key: k8s/rustdesk/secrets
        property: Cert
    - secretKey: public_key
      remoteRef:
        key: k8s/rustdesk/secrets
        property: Key
@@ -1,8 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: rustdesk
 resources:
  - external-secrets.yaml
  - deployment.yaml
  - service.yaml
  - network-policy.yaml
@@ -1,73 +0,0 @@
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: rustdesk-network-policy
 spec:
  podSelector:
    matchLabels:
      app: rustdesk-hbbs
  policyTypes:
  - Ingress
  - Egress
  ingress:
  # Allow all incoming connections to RustDesk ports
  - from: []
    ports:
    - protocol: TCP
      port: 21115
    - protocol: TCP
      port: 21116
    - protocol: UDP
      port: 21116
  egress:
  # Allow DNS
  - to: []
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
  # Allow communication between HBBS and HBBR
  - to:
    - podSelector:
        matchLabels:
          app: rustdesk-hbbr
    ports:
    - protocol: TCP
      port: 21117
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: rustdesk-hbbr-network-policy
 spec:
  podSelector:
    matchLabels:
      app: rustdesk-hbbr
  policyTypes:
  - Ingress
  - Egress
  ingress:
  # Allow all incoming connections to relay port
  - from: []
    ports:
    - protocol: TCP
      port: 21117
  # Allow connections from HBBS
  - from:
    - podSelector:
        matchLabels:
          app: rustdesk-hbbs
    ports:
    - protocol: TCP
      port: 21117
  egress:
  # Allow DNS
  - to: []
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
@@ -1,59 +0,0 @@
 # Preserve client source IPs for RustDesk NAT detection. Public DNS points to music,
 # where both servers and their persistent data live.
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: rustdesk-hbbs
  labels:
    app: rustdesk-hbbs
 spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  selector:
    app: rustdesk-hbbs
  ports:
  - name: registry-tcp
    port: 21116
    targetPort: 21116
    protocol: TCP
  - name: nat
    port: 21115
    targetPort: 21115
    protocol: TCP
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: rustdesk-hbbs-udp
  labels:
    app: rustdesk-hbbs
 spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  selector:
    app: rustdesk-hbbs
  ports:
  - name: registry-udp
    port: 21116
    targetPort: 21116
    protocol: UDP
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: rustdesk-hbbr
  labels:
    app: rustdesk-hbbr
 spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  selector:
    app: rustdesk-hbbr
  ports:
  - name: relay
    port: 21117
    targetPort: 21117
    protocol: TCP
@@ -1,18 +0,0 @@
 # Shadowsocks on spb
 One shadowsocks-rust pod runs on `spb`, exposing `8388/TCP` and `8388/UDP`
 through host ports. Client settings:
 - Server: `spb.hexor.cy`
 - Port: `8388`
 - Method: `chacha20-ietf-poly1305`
 - Password: the `Password` custom field of the Vaultwarden item named
  `k8s/shadowsocks/secrets` (exact name, not an item UUID).
 Create that item in the server secrets vault accessible to the External Secrets
 bot. Use a long random password, for example generated with `openssl rand -base64 32`.
 External Secrets creates `shadowsocks-config`; Reloader restarts the deployment
 when the Secret changes. No persistent storage is required.
 The spb NixOS configuration opens port 8388 for both protocols. Apply that
 configuration when deploying this application for the first time.
@@ -1,71 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: shadowsocks
  annotations:
    reloader.stakater.com/auto: "true"
  labels:
    app: shadowsocks
 spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: shadowsocks
  template:
    metadata:
      labels:
        app: shadowsocks
    spec:
      nodeSelector:
        kubernetes.io/hostname: spb
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        runAsGroup: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: shadowsocks
          # shadowsocks-rust v1.25.0; multi-arch image includes linux/arm64.
          image: ghcr.io/shadowsocks/ssserver-rust:v1.25.0@sha256:22240c07d8ce3a36421ede770bd775dcc5fc56d5d829943196957b05452dc36f
          imagePullPolicy: IfNotPresent
          command: ["/usr/bin/ssserver"]
          args:
            - --log-without-time
            - -c
            - /etc/shadowsocks-rust/config.json
          ports:
            - name: proxy-tcp
              containerPort: 8388
              hostPort: 8388
              protocol: TCP
            - name: proxy-udp
              containerPort: 8388
              hostPort: 8388
              protocol: UDP
          readinessProbe:
            tcpSocket:
              port: proxy-tcp
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
            limits:
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: config
              mountPath: /etc/shadowsocks-rust
              readOnly: true
      volumes:
        - name: config
          secret:
            secretName: shadowsocks-config
            defaultMode: 0444
@@ -1,29 +0,0 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: shadowsocks-config
 spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vaultwarden-fields
    kind: ClusterSecretStore
  target:
    name: shadowsocks-config
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        config.json: |
          {
            "server": "0.0.0.0",
            "server_port": 8388,
            "method": "chacha20-ietf-poly1305",
            "password": {{ .password | toJson }},
            "mode": "tcp_and_udp"
          }
  data:
    - secretKey: password
      remoteRef:
        key: k8s/shadowsocks/secrets
        property: Password
@@ -1,6 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: shadowsocks
 resources:
  - external-secrets.yaml
  - deployment.yaml
@@ -1,54 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: web-petting
  labels:
    app: web-petting
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: web-petting
  template:
    metadata:
      labels:
        app: web-petting
      annotations:
        reloader.stakater.com/auto: "true"
    spec:
      nodeSelector:
        homelab.hexor.cy/pool: core
        homelab.hexor.cy/exposure: external
      containers:
        - name: web-petting
          image: ultradesu/web-petting:latest
          imagePullPolicy: Always
          args:
            - web-petting
            - -l
            - 0.0.0.0:3000
          ports:
            - name: http
              containerPort: 3000
          env:
            - name: RUST_LOG
              value: info
            - name: WEB_PETTING_DEBUG
              value: "false"
            - name: WEB_PETTING_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: web-petting-secrets
                  key: WEB_PETTING_DATABASE_URL
          # Everything persistent is in PostgreSQL and R2; /data is scratch space only.
          volumeMounts:
            - name: data
              mountPath: /data
          resources:
            requests:
              memory: 256Mi
            limits:
              memory: 1Gi
      volumes:
        - name: data
          emptyDir: {}
@@ -1,37 +0,0 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: web-petting
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
  ingressClassName: traefik
  rules:
    - host: pet.hexor.cy
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-petting
                port:
                  number: 80
    - host: xn--l1acako8eb.xn--p1ai
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-petting
                port:
                  number: 80
  tls:
    - secretName: web-petting-tls
      hosts:
        - pet.hexor.cy
    - secretName: web-petting-murnyanya-tls
      hosts:
        - xn--l1acako8eb.xn--p1ai
@@ -1,8 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - secrets.yaml
  - deployment.yaml
  - service.yaml
  - ingress.yaml
@@ -1,47 +0,0 @@
 # Read-only access to the web-petting-db Secret in the psql namespace
 # (see postgresql/databases/web-petting.yaml for the other half).
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: db-credentials-reader
 ---
 apiVersion: external-secrets.io/v1
 kind: SecretStore
 metadata:
  name: psql-credentials
 spec:
  provider:
    kubernetes:
      remoteNamespace: psql
      server:
        caProvider:
          type: ConfigMap
          name: kube-root-ca.crt
          key: ca.crt
      auth:
        serviceAccount:
          name: db-credentials-reader
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: web-petting-secrets
 spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: SecretStore
    name: psql-credentials
  target:
    name: web-petting-secrets
    template:
      data:
        WEB_PETTING_DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@main-rw.psql.svc:5432/web_petting"
  data:
    - secretKey: username
      remoteRef:
        key: web-petting-db
        property: username
    - secretKey: password
      remoteRef:
        key: web-petting-db
        property: password
@@ -1,15 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: web-petting
  labels:
    app: web-petting
 spec:
  type: ClusterIP
  selector:
    app: web-petting
  ports:
    - name: http
      port: 80
      targetPort: 3000
      protocol: TCP
@@ -1,27 +0,0 @@
 #!/usr/bin/env bash
 # Brings the whole core state up on an empty cluster:
 #   k8s-ng/bootstrap/bootstrap.sh <kube-context>
 # Installs Argo CD (the only thing that cannot install itself) and applies the
 # root application; Argo CD then pulls every core application in wave order.
 set -euo pipefail
 ctx=${1:?usage: bootstrap.sh <kube-context>}
 here=$(cd "$(dirname "$0")" && pwd)
 k="kubectl --context $ctx"
 # Render in a scratch copy so kustomize does not leave downloaded charts in the repo.
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
 cp -r "$here/../core/argocd" "$tmp/argocd"
 kubectl kustomize --enable-helm "$tmp/argocd" > "$tmp/argocd.yaml"
 $k create namespace argocd --dry-run=client -o yaml | $k apply -f -
 # CRDs must exist before the Argo CD objects that use them: apply twice.
 $k apply --server-side --force-conflicts -f "$tmp/argocd.yaml" >/dev/null 2>&1 || true
 sleep 8
 $k apply --server-side --force-conflicts -f "$tmp/argocd.yaml"
 $k -n argocd rollout status deploy --timeout=300s
 $k -n argocd rollout status statefulset --timeout=300s
 $k apply --server-side --force-conflicts -f "$here/root.yaml"
 echo "Core state requested. Watch it with: $k -n argocd get app"
@@ -1,29 +0,0 @@
 # Root of the core state. Applying this one object makes Argo CD pull every core
 # application in wave order (see k8s-ng/core-state/values.yaml).
 # Note: there are deliberately no finalizers; deleting this Application keeps all
 # deployed services and data.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: core-state
  namespace: argocd
 spec:
  project: core
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd
  source:
    repoURL: https://gt.hexor.cy/ab/homelab.git
    targetRevision: main
    path: k8s-ng/core-state
    helm:
      # Per-cluster overrides of core-state/values.yaml, for example:
      # valuesObject:
      #   targetRevision: some-branch
      valuesObject: {}
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
    syncOptions:
      - ServerSideApply=true
@@ -1,4 +0,0 @@
 apiVersion: v2
 name: core-state
 description: App of apps for the core services of the cluster
 version: 0.1.0
@@ -1,32 +0,0 @@
 {{- range .Values.apps }}
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: {{ .name }}
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: {{ .wave | quote }}
 spec:
  project: {{ .project | default $.Values.project }}
  destination:
    server: {{ $.Values.destinationServer }}
    namespace: {{ .namespace }}
  source:
    repoURL: {{ $.Values.repoURL }}
    targetRevision: {{ $.Values.targetRevision }}
    path: {{ .path }}
  syncPolicy:
    automated:
      selfHeal: true
      prune: {{ if hasKey . "prune" }}{{ .prune }}{{ else }}true{{ end }}
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
      {{- if and (hasKey . "validate") (not .validate) }}
      - Validate=false
      {{- end }}
      {{- if .skipDryRunOnMissingResource }}
      - SkipDryRunOnMissingResource=true
      {{- end }}
 {{- end }}
@@ -1,134 +0,0 @@
 # Per-cluster variables. Override them in k8s-ng/bootstrap/root.yaml
 # (spec.source.helm.valuesObject) when the state is deployed to another cluster.
 repoURL: https://gt.hexor.cy/ab/homelab.git
 targetRevision: main
 destinationServer: https://kubernetes.default.svc
 project: core
 # Core applications. Lower waves are synced first and must be Healthy before the
 # next wave starts. Every path is a kustomize (or plain manifest) directory.
 #   wave 0: Argo CD itself and its projects
 #   wave 1: operators (their CRDs are used by the later waves)
 #   wave 2: the database cluster and its databases/users
 #   wave 3: services that need the database and secrets
 apps:
  - name: argocd
    path: k8s-ng/core/argocd
    namespace: argocd
    wave: 0
  - name: cnpg
    path: k8s-ng/core/cnpg
    namespace: cnpg-system
    wave: 1
  - name: traefik-config
    path: k8s-ng/core/traefik-config
    namespace: kube-system
    wave: 1
  - name: coredns-config
    path: k8s-ng/core/coredns-config
    namespace: kube-system
    wave: 1
    validate: false # partial Deployment: only the fields we manage
  - name: reloader
    path: k8s-ng/core/reloader
    namespace: reloader
    wave: 1
  - name: gpu-system
    path: k8s-ng/core/gpu
    namespace: gpu-system
    wave: 1
  - name: cert-manager
    path: k8s-ng/core/cert-manager
    namespace: cert-manager
    wave: 1
    skipDryRunOnMissingResource: true # ClusterIssuers need the cert-manager CRDs
  - name: external-secrets
    path: k8s-ng/core/external-secrets
    namespace: external-secrets
    wave: 1
  - name: postgresql
    path: k8s-ng/core/postgresql
    namespace: psql
    wave: 2
    prune: false # never delete databases because of a manifest change
    skipDryRunOnMissingResource: true # CRDs come from the cnpg and external-secrets apps
  - name: vaultwarden
    path: k8s-ng/core/vaultwarden
    namespace: vaultwarden
    wave: 3
    skipDryRunOnMissingResource: true
  - name: keycloak
    path: k8s-ng/core/keycloak
    namespace: keycloak
    wave: 3
    skipDryRunOnMissingResource: true # ExternalSecret/Certificate CRDs come from earlier waves
  # Not a core service: lives in k8s-ng/apps and belongs to the "apps" project.
  - name: furumi
    project: apps
    path: k8s-ng/apps/furumi
    namespace: furumi
    wave: 6 # after prom-stack installs the ServiceMonitor CRD
    skipDryRunOnMissingResource: true
  - name: web-petting
    project: apps
    path: k8s-ng/apps/web-petting
    namespace: web-petting
    wave: 5
    skipDryRunOnMissingResource: true
  - name: k8s-secrets
    project: apps
    path: k8s-ng/apps/k8s-secrets
    namespace: k8s-secret
    wave: 5 # after secret-stores and auth-proxy; independent of prom-stack health
    skipDryRunOnMissingResource: true
  - name: llamacpp
    project: apps
    path: k8s-ng/apps/llamacpp
    namespace: llamacpp
    wave: 5 # pinned to the ai node (GPU); must not hold back the other waves
    skipDryRunOnMissingResource: true
  - name: secret-stores
    path: k8s-ng/core/secret-stores
    namespace: external-secrets
    wave: 4 # reads the Vaultwarden vault, so it comes after vaultwarden
    skipDryRunOnMissingResource: true # ClusterSecretStore CRD comes from the external-secrets app
  - name: gitea
    path: k8s-ng/core/gitea
    namespace: gitea
    wave: 5 # after secret-stores (its secrets come from the vault); pinned to the music node; the runner to the ai node
    prune: false # never delete the instance because of a manifest change
    skipDryRunOnMissingResource: true
  - name: prom-stack
    path: k8s-ng/core/prom-stack
    namespace: prometheus
    wave: 5 # after secret-stores; installs monitoring before application workloads
    skipDryRunOnMissingResource: true # monitoring, cert-manager and ExternalSecret CRDs
  - name: immich-db
    path: k8s-ng/core/immich-db
    namespace: immich
    wave: 2
    prune: false
    skipDryRunOnMissingResource: true
  - name: minecraft
    project: games
    path: k8s-ng/apps/minecraft
    namespace: minecraft
    wave: 6
  - name: rustdesk
    project: apps
    path: k8s-ng/apps/rustdesk
    namespace: rustdesk
    wave: 6
    skipDryRunOnMissingResource: true
  - name: shadowsocks
    project: apps
    path: k8s-ng/apps/shadowsocks
    namespace: shadowsocks
    wave: 6
    skipDryRunOnMissingResource: true
  - name: mtproxy
    project: apps
    path: k8s-ng/apps/mtproxy
    namespace: mtproxy
    wave: 6 # after secret-stores and prom-stack
    skipDryRunOnMissingResource: true
@@ -1,66 +0,0 @@
 apiVersion: argoproj.io/v1alpha1
 kind: AppProject
 metadata:
  name: core
  namespace: argocd
 spec:
  clusterResourceWhitelist:
  - group: '*'
    kind: '*'
  description: Hexor Home Lab Core
  destinations:
  - namespace: '*'
    server: https://kubernetes.default.svc
  sourceRepos:
  - https://gt.hexor.cy/ab/homelab.git
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: AppProject
 metadata:
  name: apps
  namespace: argocd
 spec:
  clusterResourceWhitelist:
  - group: '*'
    kind: '*'
  description: Hexor Home Lab Apps
  destinations:
  - namespace: '*'
    server: https://kubernetes.default.svc
  sourceRepos:
  - https://gt.hexor.cy/ab/homelab.git
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: AppProject
 metadata:
  name: games
  namespace: argocd
 spec:
  clusterResourceWhitelist:
  - group: '*'
    kind: '*'
  description: Hexor Home Lab Games
  destinations:
  - namespace: '*'
    server: https://kubernetes.default.svc
  sourceRepos:
  - https://gt.hexor.cy/ab/homelab.git
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: AppProject
 metadata:
  name: desktop
  namespace: argocd
 spec:
  clusterResourceWhitelist:
  - group: '*'
    kind: '*'
  description: Hexor Home Lab Desktop Apps
  destinations:
  - namespace: '*'
    server: https://kubernetes.default.svc
  sourceRepos:
  - https://gt.hexor.cy/ab/homelab.git
@@ -1,26 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: argocd-dex-server
  namespace: argocd
 spec:
  template:
    spec:
      containers:
        - name: dex-server
          readinessProbe:
            tcpSocket:
              port: 5556
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 3
            successThreshold: 1
            failureThreshold: 3
          livenessProbe:
            tcpSocket:
              port: 5556
            initialDelaySeconds: 10
            periodSeconds: 30
            timeoutSeconds: 3
            successThreshold: 1
            failureThreshold: 3
@@ -1,25 +0,0 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: argocd
  namespace: argocd
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
  tls:
    - hosts:
        - ag.btwiusearch.net
      secretName: argocd-server-tls
  rules:
    - host: ag.btwiusearch.net
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: argocd-server
                port:
                  number: 80
@@ -1,18 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ingress.yaml
  - appprojects.yaml
 helmCharts:
  - name: argo-cd
    repo: https://argoproj.github.io/argo-helm
    version: 10.6.0
    releaseName: argocd
    namespace: argocd
    valuesFile: values.yaml
    includeCRDs: true
 patches:
  - path: dex-probes-patch.yaml
@@ -1,118 +0,0 @@
 # Argo CD Helm Chart Values (k8s-ng cluster)
 global:
  nodeSelector:
    homelab.hexor.cy/pool: core
    homelab.hexor.cy/exposure: external
  domain: ag.btwiusearch.net
  logging:
    format: text
    level: info
 crds:
  install: true
  keep: true # Recommended to keep true so CRDs are not deleted on uninstall
 configs:
  params:
    server.insecure: "true" # TLS is terminated by the ingress
  cm:
    create: true
    exec.enabled: true
    kustomize.buildOptions: --enable-helm
    application.instanceLabelKey: argocd.argoproj.io/instance
    # Local admin account, kept as a break-glass login next to SSO; the initial
    # password is generated by Argo CD into the argocd-initial-admin-secret secret.
    # Set to false once SSO is trusted.
    admin.enabled: true
    statusbadge.enabled: true
    timeout.reconciliation: 60s
    # Lets sync waves in an app of apps wait for child Applications to be Healthy.
    resource.customizations.health.argoproj.io_Application: |
      hs = {}
      hs.status = "Progressing"
      hs.message = ""
      if obj.status ~= nil then
        if obj.status.health ~= nil then
          hs.status = obj.status.health.status
          if obj.status.health.message ~= nil then
            hs.message = obj.status.health.message
          end
        end
      end
      return hs
    # SSO through Dex -> Keycloak. The client id/secret come from the oidc-creds
    # Secret (labelled app.kubernetes.io/part-of=argocd), created by hand until
    # Vaultwarden + External Secrets are the source.
    dex.config: |
      connectors:
      - type: oidc
        id: keycloak
        name: Keycloak
        config:
          issuer: https://auth.hexor.cy/auth/realms/hexor
          clientID: $oidc-creds:id
          clientSecret: $oidc-creds:secret
          insecureEnableGroups: true
          scopes:
            - openid
            - profile
            - email
            - offline_access
          getUserInfo: true
  rbac:
    create: true
    policy.default: ""
    policy.csv: |
      g, game-servers-managers, GameServersManagersRole
      # Role permissions
      p, GameServersManagersRole, applications, get, games/*, allow
      p, GameServersManagersRole, applications, update, games/*, allow
      p, GameServersManagersRole, applications, sync, games/*, allow
      p, GameServersManagersRole, applications, override, games/*, allow
      p, GameServersManagersRole, applications, action/*, games/*, allow
      p, GameServersManagersRole, exec, create, games/*, allow
      p, GameServersManagersRole, logs, get, games/*, allow
      p, GameServersManagersRole, applications, delete, games/*, deny
      # Admin policy
      g, argocd-admins, role:admin
  secret:
    createSecret: true
 controller:
  replicas: 1
 # Dex OIDC provider (Keycloak connector configured in configs.cm.dex.config)
 dex:
  replicas: 1
  enabled: true
 redis:
  enabled: true
 redis-ha:
  enabled: false
 server:
  replicas: 1
  ingress:
    enabled: false
  certificate:
    enabled: false
  certificateSecret:
    enabled: false
 repoServer:
  replicas: 1
  livenessProbe:
    timeoutSeconds: 10
    periodSeconds: 60
 applicationSet:
  enabled: true
  replicas: 1
 notifications:
  enabled: true
  replicas: 1
@@ -1,44 +0,0 @@
 # Public certificates through DNS-01 for the zones below and HTTP-01 (Traefik) for
 # every other domain, e.g. the .рф one. The credential Secrets are created by hand
 # (they will move to Vaultwarden + External Secrets):
 #   kubectl -n cert-manager create secret generic cloudflare-api-token --from-literal=apiToken=<token>
 #     (Zone:DNS:Edit on the btwiusearch.net zone)
 #   kubectl -n cert-manager create secret generic aws-api-key-secret \
 #     --from-literal=accessKey=<id> --from-literal=secretKey=<secret>
 #     (Route53 access to the hexor.cy zone)
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
  name: letsencrypt
 spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: k8s-master@hexor.cy
    privateKeySecretRef:
      name: letsencrypt-account-key
    solvers:
      - selector:
          dnsZones:
            - btwiusearch.net
        dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token
              key: apiToken
      - selector:
          dnsZones:
            - hexor.cy
        dns01:
          route53:
            region: eu-north-1
            accessKeyIDSecretRef:
              name: aws-api-key-secret
              key: accessKey
            secretAccessKeySecretRef:
              name: aws-api-key-secret
              key: secretKey
      # Fallback for domains outside the zones above: their A records must point
      # at the cluster nodes (Traefik answers on port 80 everywhere).
      - http01:
          ingress:
            ingressClassName: traefik
@@ -1,15 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - issuer.yaml
  - self-signed.yaml
 helmCharts:
  - name: cert-manager
    repo: https://charts.jetstack.io
    version: 1.21.1
    releaseName: cert-manager
    namespace: cert-manager
    valuesFile: values.yaml
    includeCRDs: true
@@ -1,29 +0,0 @@
 # Private CA for internal services: issuer "hexor-lab".
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
  name: selfsigned
 spec:
  selfSigned: {}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: hexor-ca-root
  namespace: cert-manager
 spec:
  isCA: true
  duration: 87600h # 10y
  commonName: hexor-ca
  secretName: hexor-ca-root-secret
  issuerRef:
    name: selfsigned
    kind: ClusterIssuer
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
  name: hexor-lab
 spec:
  ca:
    secretName: hexor-ca-root-secret
@@ -1,12 +0,0 @@
 crds:
  enabled: true
 nodeSelector: &externalCore
  homelab.hexor.cy/pool: core
  homelab.hexor.cy/exposure: external
 webhook:
  nodeSelector: *externalCore
 cainjector:
  nodeSelector: *externalCore
 startupapicheck:
  nodeSelector: *externalCore
@@ -1,11 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 helmCharts:
  - name: cloudnative-pg
    repo: https://cloudnative-pg.github.io/charts
    version: 0.29.1
    releaseName: cnpg
    namespace: cnpg-system
    valuesFile: values.yaml
    includeCRDs: true
@@ -1,8 +0,0 @@
 # CloudNativePG operator (chart 0.29.x = operator 1.30.x)
 nodeSelector:
  homelab.hexor.cy/pool: core
  homelab.hexor.cy/exposure: external
 crds:
  create: true
@@ -1,33 +0,0 @@
 # K3s owns the CoreDNS Deployment. Apply only the fields customized here so
 # upstream image, probes, Corefile mounts and topology spread stay intact.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: coredns
  namespace: kube-system
  annotations:
    argocd.argoproj.io/sync-options: Prune=false,Delete=false
 spec:
  replicas: 3
  template:
    spec:
      tolerations:
        - key: CriticalAddonsOnly
          operator: Exists
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
        # DNS also belongs on the internal core node used by Actions jobs.
        - key: workload
          operator: Equal
          value: ai
          effect: NoSchedule
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: homelab.hexor.cy/pool
                    operator: In
                    values:
                      - core
@@ -1,6 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - deployment.yaml
  - service.yaml
@@ -1,11 +0,0 @@
 # Keep DNS on the caller's node when it has a healthy CoreDNS replica. K3s owns
 # the rest of this Service; server-side apply preserves its ports and selector.
 apiVersion: v1
 kind: Service
 metadata:
  name: kube-dns
  namespace: kube-system
  annotations:
    argocd.argoproj.io/sync-options: Prune=false,Delete=false
 spec:
  trafficDistribution: PreferSameNode
@@ -1,13 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 # The Vaultwarden bridge and the ClusterSecretStores are in ../secret-stores (they need Vaultwarden).
 helmCharts:
  - name: external-secrets
    repo: https://charts.external-secrets.io
    version: 2.11.0
    releaseName: external-secrets
    namespace: external-secrets
    valuesFile: values.yaml
    includeCRDs: true
@@ -1,9 +0,0 @@
 installCRDs: true
 nodeSelector: &externalCore
  homelab.hexor.cy/pool: core
  homelab.hexor.cy/exposure: external
 webhook:
  nodeSelector: *externalCore
 certController:
  nodeSelector: *externalCore
@@ -1,72 +0,0 @@
 # Gitea with SQLite; everything (repositories, database, SSH host keys) lives in
 # /var/lib/gitea on the music node.
 # `replicas` is deliberately not set: Argo CD does not manage it, so the instance
 # can be scaled to 0 with kubectl during a data migration without being healed back.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: gitea
  labels:
    app: gitea
 spec:
  selector:
    matchLabels:
      app: gitea
  strategy:
    type: Recreate # two instances must never open the same SQLite database
  template:
    metadata:
      labels:
        app: gitea
    spec:
      nodeSelector:
        homelab.hexor.cy/pool: core
        homelab.hexor.cy/exposure: external
        kubernetes.io/hostname: music
      volumes:
        - name: storage
          hostPath:
            path: /var/lib/gitea
            type: DirectoryOrCreate
      containers:
        - name: gitea
          image: gitea/gitea:28.0.0
          resources:
            requests:
              memory: 1Gi
              cpu: "1"
            limits:
              memory: 4Gi
              cpu: "4"
          env:
            - name: GITEA__service__REGISTER_MANUAL_CONFIRM
              value: "true"
            - name: GITEA__service__ENABLE_CAPTCHA
              value: "true"
            - name: GITEA__service__REQUIRE_CAPTCHA_FOR_LOGIN
              value: "false"
            - name: GITEA__service__REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA
              value: "true"
            - name: GITEA__service__CAPTCHA_TYPE
              value: cfturnstile
            - name: GITEA__security__ALLOWED_HOST_LIST
              value: "*"
          envFrom:
            - secretRef:
                name: gitea-runner-act-runner-secrets
          ports:
            - name: http
              containerPort: 3000
              protocol: TCP
            - name: ssh
              containerPort: 22
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /api/healthz
              port: http
            periodSeconds: 10
            timeoutSeconds: 5
          volumeMounts:
            - name: storage
              mountPath: /data
@@ -1,44 +0,0 @@
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: gitea-runner-token
 spec:
  refreshInterval: 1m
  target:
    name: gitea-runner-act-runner-secrets
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        token: |-
          {{ .password }}
        GITEA__service__CF_TURNSTILE_SITEKEY: |-
          {{ .CF_TURNSTILE_SITEKEY }}
        GITEA__service__CF_TURNSTILE_SECRET: |-
          {{ .CF_TURNSTILE_SECRET }}
  data:
    - secretKey: password
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: k8s/gitea/secrets
        property: login.password
    - secretKey: CF_TURNSTILE_SITEKEY
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: k8s/gitea/secrets
        property: fields[0].value
    - secretKey: CF_TURNSTILE_SECRET
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: k8s/gitea/secrets
        property: fields[1].value
@@ -1,23 +0,0 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: gitea
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
  rules:
    - host: gt.hexor.cy
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: gitea
                port:
                  number: 80
  tls:
    - secretName: gitea-tls
      hosts:
        - gt.hexor.cy
@@ -1,11 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - external-secrets.yaml
  - deployment.yaml
  - service.yaml
  - ingress.yaml
  - runner.yaml
  - runner-rbac.yaml
  - user-unban-cronjob.yaml
@@ -1,41 +0,0 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: gitea-runner
 ---
 apiVersion: v1
 kind: Secret
 metadata:
  name: gitea-runner-kubernetes-token
  annotations:
    kubernetes.io/service-account.name: gitea-runner
 type: kubernetes.io/service-account-token
 ---
 # CI may edit the routes of the auth proxy (the ConfigMap lives in the keycloak namespace here).
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: auth-proxy-routes-manager
  namespace: keycloak
 rules:
  - apiGroups: [""]
    resources: [configmaps]
    resourceNames: [auth-proxy-routes]
    verbs: [get, update, patch]
  - apiGroups: [""]
    resources: [configmaps]
    verbs: [create]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: gitea-runner-auth-proxy-routes
  namespace: keycloak
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: auth-proxy-routes-manager
 subjects:
  - kind: ServiceAccount
    name: gitea-runner
    namespace: gitea
@@ -1,86 +0,0 @@
 # Gitea Actions runner on the ai node. Jobs run as containers in the host's Docker
 # (virtualisation.docker in hosts/ai of the nix repo) through the mounted socket.
 # `replicas` is not set (see deployment.yaml): scale it with kubectl when needed.
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: gitea-runner-config
 data:
  config.yaml: |
    runner:
      capacity: 8 # jobs in parallel; the ai node has 32 threads and 124 GiB
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: gitea-runner
  labels:
    app: gitea-runner
  annotations:
    reloader.stakater.com/auto: "true"
 spec:
  selector:
    matchLabels:
      app: gitea-runner
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: gitea-runner
    spec:
      serviceAccountName: gitea-runner
      dnsConfig:
        options:
          - name: ndots
            value: "2"
      nodeSelector:
        homelab.hexor.cy/pool: core
        homelab.hexor.cy/exposure: internal
        workload/ai: "true"
      tolerations:
        - key: workload
          operator: Equal
          value: ai
          effect: NoSchedule
      volumes:
        - name: docker-sock
          hostPath:
            path: /var/run/docker.sock
            type: Socket
        - name: runner-data
          emptyDir:
            sizeLimit: 30Gi
        - name: config
          configMap:
            name: gitea-runner-config
      containers:
        - name: gitea-runner
          image: gitea/act_runner:nightly
          volumeMounts:
            - name: docker-sock
              mountPath: /var/run/docker.sock
            - name: runner-data
              mountPath: /data
            - name: config
              mountPath: /config.yaml
              subPath: config.yaml
          env:
            - name: CONFIG_FILE
              value: /config.yaml
            - name: GITEA_INSTANCE_URL
              # Job containers run outside the cluster network, so they need the public URL.
              value: https://gt.hexor.cy
            - name: GITEA_RUNNER_REGISTRATION_TOKEN
              valueFrom:
                secretKeyRef:
                  name: gitea-runner-act-runner-secrets
                  key: token
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: GITEA_RUNNER_NAME
              value: $(NODE_NAME)
            - name: GITEA_RUNNER_LABELS
              value: ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04
@@ -1,24 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: gitea
 spec:
  selector:
    app: gitea
  ports:
    - protocol: TCP
      port: 80
      targetPort: 3000
 ---
 # Git over SSH on every node (servicelb); the node firewall opens 30022 (nix repo, k3s-base.nix).
 apiVersion: v1
 kind: Service
 metadata:
  name: gitea-ssh
 spec:
  type: LoadBalancer
  ports:
    - port: 30022
      targetPort: 22
  selector:
    app: gitea
@@ -1,61 +0,0 @@
 apiVersion: batch/v1
 kind: CronJob
 metadata:
  name: gitea-user-unban
  labels:
    app: gitea-user-unban
 spec:
  schedule: "*/10 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            app: gitea-user-unban
        spec:
          restartPolicy: OnFailure
          nodeSelector:
            homelab.hexor.cy/pool: core
            homelab.hexor.cy/exposure: external
            kubernetes.io/hostname: music
          volumes:
            - name: storage
              hostPath:
                path: /var/lib/gitea
                type: Directory
          containers:
            - name: sqlite-unban
              image: gitea/gitea:28.0.0
              imagePullPolicy: IfNotPresent
              resources:
                requests:
                  memory: 32Mi
                  cpu: 10m
                limits:
                  memory: 128Mi
                  cpu: 100m
              command:
                - /bin/sh
                - -ec
                - |
                  sqlite3 -cmd ".timeout 30000" /data/gitea/gitea.db "
                    UPDATE \"user\"
                       SET is_active = 1,
                           prohibit_login = 0,
                           updated_unix = unixepoch()
                     WHERE lower(email) = lower('ab@hexor.cy')
                       AND (is_active <> 1 OR prohibit_login <> 0);
                    SELECT printf(
                      'gitea user watchdog: id=%d login=%s email=%s is_active=%d prohibit_login=%d updated_unix=%d',
                      id, lower_name, email, is_active, prohibit_login, updated_unix
                    )
                      FROM \"user\"
                     WHERE lower(email) = lower('ab@hexor.cy');
                  "
              volumeMounts:
                - name: storage
                  mountPath: /data
@@ -1,28 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 helmCharts:
  - name: amd-gpu
    repo: https://rocm.github.io/k8s-device-plugin/
    version: 0.22.0
    releaseName: amd-gpu-device-plugin
    namespace: gpu-system
    valuesFile: values.yaml
    includeCRDs: true
 # The chart always adds the NFD label feature.node.kubernetes.io/pci-0300_1002.present
 # to the selector; NFD is not installed (and would not match this iGPU), so replace it.
 patches:
  - target:
      group: apps
      version: v1
      kind: DaemonSet
      name: amd-gpu-device-plugin-daemonset
    patch: |-
      - op: replace
        path: /spec/template/spec/nodeSelector
        value:
          homelab.hexor.cy/pool: core
          homelab.hexor.cy/exposure: internal
          kubernetes.io/arch: amd64
          workload/ai: "true"
@@ -1,37 +0,0 @@
 # AMD GPU device plugin: exposes the Strix Halo iGPU of the "ai" node as the
 # amd.com/gpu resource (and injects /dev/kfd and /dev/dri into the pod).
 nfd:
  enabled: false
 labeller:
  enabled: false
 dp:
  image:
    repository: docker.io/rocm/k8s-device-plugin
    tag: "1.31.0.9"
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
 # The ai node carries the label workload/ai=true and the taint workload=ai:NoSchedule
 # (hosts/ai in the nix repo).
 tolerations:
  - key: workload
    operator: Equal
    value: ai
    effect: NoSchedule
 node_selector_enabled: true
 node_selector:
  homelab.hexor.cy/pool: core
  homelab.hexor.cy/exposure: internal
  kubernetes.io/arch: amd64
  workload/ai: "true"
@@ -1,47 +0,0 @@
 # Keep PostgreSQL and both vector extensions identical to the source during
 # migration. The application/media migration and any upgrades happen later.
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
  name: immich
  annotations:
    argocd.argoproj.io/sync-options: Prune=false
 spec:
  description: Immich database migrated from the old cluster; media remain on NAS
  imageName: ghcr.io/tensorchord/cloudnative-pgvecto.rs:14-v0.3.0@sha256:df7848916fea2c486faee8155a481dc5009f30ec513b5561d9ab76d1e101a594
  instances: 1
  enableSuperuserAccess: true
  bootstrap:
    initdb:
      database: immich
      owner: immich
      dataChecksums: true
      encoding: UTF8
      localeCType: C
      localeCollate: C
  postgresUID: 26
  postgresGID: 26
  storage:
    size: 55Gi
    storageClass: immich-local
    pvcTemplate:
      accessModes: [ReadWriteOnce]
      selector:
        matchLabels:
          immich.hexor.cy/volume: postgres
  affinity:
    nodeSelector:
      homelab.hexor.cy/pool: core
      homelab.hexor.cy/exposure: external
      kubernetes.io/hostname: music
  postgresql:
    shared_preload_libraries: [vectors.so]
    parameters:
      shared_buffers: 512MB
      max_connections: "200"
  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      memory: 2Gi
@@ -1,6 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: immich
 resources:
  - storage.yaml
  - cluster.yaml
@@ -1,66 +0,0 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
  name: immich-db-storage-prepare
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
 spec:
  backoffLimit: 3
  template:
    spec:
      restartPolicy: OnFailure
      nodeSelector:
        homelab.hexor.cy/pool: core
        homelab.hexor.cy/exposure: external
        kubernetes.io/hostname: music
      containers:
        - name: prepare
          image: docker.io/busybox:1.37.0
          command: [sh, -ec, "mkdir -p /storage/postgresql; chown 26:26 /storage/postgresql; chmod 0700 /storage/postgresql"]
          securityContext:
            runAsUser: 0
            allowPrivilegeEscalation: false
          volumeMounts:
            - name: storage
              mountPath: /storage
      volumes:
        - name: storage
          hostPath:
            path: /data/k8s/immich
            type: DirectoryOrCreate
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
  name: immich-local
  annotations:
    argocd.argoproj.io/sync-options: Prune=false
 provisioner: kubernetes.io/no-provisioner
 volumeBindingMode: WaitForFirstConsumer
 reclaimPolicy: Retain
 ---
 apiVersion: v1
 kind: PersistentVolume
 metadata:
  name: immich-postgres-music
  labels:
    immich.hexor.cy/volume: postgres
  annotations:
    argocd.argoproj.io/sync-options: Prune=false
 spec:
  capacity:
    storage: 55Gi
  volumeMode: Filesystem
  accessModes: [ReadWriteOnce]
  persistentVolumeReclaimPolicy: Retain
  storageClassName: immich-local
  local:
    path: /data/k8s/immich/postgresql
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: kubernetes.io/hostname
              operator: In
              values: [music]
@@ -1,125 +0,0 @@
 # rsauth2-proxy: forward-auth for services that have no OIDC of their own.
 # Needs, besides this file:
 #   - Secret auth-proxy-creds (AUTH_PROXY_CLIENT_ID, AUTH_PROXY_CLIENT_SECRET,
 #     AUTH_PROXY_COOKIE_SECRET); the client secret is the one of the Keycloak
 #     client "rsauth2-proxy". Created by hand until Vaultwarden is the source.
 #   - ConfigMap auth-proxy-routes, managed by Terraform (terraform/keycloak).
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: auth-proxy
  labels:
    app: auth-proxy
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: auth-proxy
  template:
    metadata:
      labels:
        app: auth-proxy
    spec:
      nodeSelector:
        homelab.hexor.cy/pool: core
        homelab.hexor.cy/exposure: external
      containers:
        - name: auth-proxy
          image: ultradesu/rsauth2-proxy:v0.1.3
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
          envFrom:
            - secretRef:
                name: auth-proxy-creds
          env:
            - name: AUTH_PROXY_OIDC_ISSUER
              value: "https://auth.hexor.cy/auth/realms/hexor"
            - name: AUTH_PROXY_COOKIE_DOMAIN
              value: ".hexor.cy"
            - name: AUTH_PROXY_CALLBACK_URL
              value: "https://oauth.hexor.cy/callback"
            - name: AUTH_PROXY_ROUTES_FILE
              value: "/config/routes.yaml"
            - name: AUTH_PROXY_LOG_LEVEL
              value: "debug"
          volumeMounts:
            - name: routes
              mountPath: /config
              readOnly: true
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
            limits:
              cpu: 200m
              memory: 64Mi
          readinessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 3
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
            runAsGroup: 1000
            capabilities:
              drop:
                - ALL
      volumes:
        - name: routes
          configMap:
            name: auth-proxy-routes
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: auth-proxy
  labels:
    app: auth-proxy
 spec:
  ports:
    - name: http
      port: 80
      targetPort: 8080
      protocol: TCP
  selector:
    app: auth-proxy
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: auth-proxy
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`oauth.hexor.cy`)
      kind: Rule
      services:
        - name: auth-proxy
          port: 80
  tls:
    secretName: auth-proxy-tls
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: auth-proxy-tls
 spec:
  secretName: auth-proxy-tls
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  dnsNames:
    - oauth.hexor.cy
@@ -1,30 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - secrets.yaml
  - auth-proxy.yaml
 # ConfigMap auth-proxy-routes is managed by Terraform (terraform/keycloak, kubernetes_config_map_v1).
 configMapGenerator:
  - name: keycloak-hexor-lab-theme
    namespace: keycloak
    files:
      - theme.properties=themes/hexor-lab/login/theme.properties
      - template.ftl=themes/hexor-lab/login/template.ftl
      - hexor.css=themes/hexor-lab/login/resources/css/hexor.css
      - keycloak.css=themes/hexor-lab/login/resources/css/keycloak.css
      - background.js=themes/hexor-lab/login/resources/js/background.js
      - favicon.svg=themes/hexor-lab/login/resources/img/favicon.svg
 generatorOptions:
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
 helmCharts:
  - name: keycloakx
    repo: https://codecentric.github.io/helm-charts
    version: 7.3.1
    releaseName: keycloak
    namespace: keycloak
    valuesFile: values.yaml
@@ -1,110 +0,0 @@
 /* Preview behavior only. Keycloak will supply the real authentication later. */
 "use strict";
 const $ = (selector) => document.querySelector(selector);
 const screens = {
  login: ["Sign in", ""],
  otp: ["Verify identity", ""],
  reset: ["Reset password", "We’ll send a reset link to your email."],
  success: ["Access granted", ""],
 };
 function notice(message = "", error = false) {
  $("#notice").textContent = message;
  $("#notice").hidden = !message;
  $("#notice").classList.toggle("error", error);
 }
 function showScreen(requested, focus = false) {
  const screen = requested === "error" ? "login" : (Object.hasOwn(screens, requested) ? requested : "login");
  const [title, description] = screens[screen];
  document.querySelectorAll("[data-view]").forEach((element) => { element.hidden = element.dataset.view !== screen; });
  $("#page-title").replaceChildren(document.createTextNode(title));
  const cursor = document.createElement("span");
  cursor.className = "cursor";
  cursor.setAttribute("aria-hidden", "true");
  cursor.textContent = "_";
  $("#page-title").append(cursor);
  $("#page-description").textContent = description;
  $("#page-description").hidden = !description;
  document.querySelectorAll("[data-screen]").forEach((button) => button.setAttribute("aria-pressed", String(button.dataset.screen === requested)));
  document.querySelectorAll(".field-error").forEach((element) => { element.hidden = true; });
  document.querySelectorAll("[aria-invalid]").forEach((element) => element.removeAttribute("aria-invalid"));
  notice(requested === "error" ? "[ DENIED ] Invalid username or password. Please try again." : "", requested === "error");
  $("#password").value = "";
  $("#password").type = "password";
  $("#reveal-password").textContent = "SHOW";
  $("#reveal-password").setAttribute("aria-label", "Show password");
  $("#reveal-password").setAttribute("aria-pressed", "false");
  $("#otp").value = "";
  if (focus) document.querySelector(`[data-view="${screen}"] input`)?.focus();
 }
 function navigate(screen) {
  if (location.hash === `#${screen}`) showScreen(screen, true);
  else location.hash = screen;
 }
 function fieldError(field, output, message) {
  field.setAttribute("aria-invalid", "true");
  output.textContent = message;
  output.hidden = false;
  field.focus();
 }
 document.querySelectorAll("[data-screen]").forEach((button) => button.addEventListener("click", () => navigate(button.dataset.screen)));
 window.addEventListener("hashchange", () => showScreen(location.hash.slice(1), true));
 $("#login-form").addEventListener("submit", (event) => {
  event.preventDefault();
  notice();
  if (!$("#username").value.trim()) return fieldError($("#username"), $("#login-error"), "Enter your username or email address.");
  if (!$("#password").value) return fieldError($("#password"), $("#login-error"), "Enter your password.");
  $("#password").value = "";
  navigate("otp");
 });
 $("#otp-form").addEventListener("submit", (event) => {
  event.preventDefault();
  if (!/^[0-9]{6}$/.test($("#otp").value)) return fieldError($("#otp"), $("#otp-error"), "Enter a 6-digit verification code.");
  $("#otp").value = "";
  navigate("success");
 });
 $("#reset-form").addEventListener("submit", (event) => {
  event.preventDefault();
  if (!$("#reset-email").validity.valid) return fieldError($("#reset-email"), $("#reset-error"), "Enter a valid email address.");
  $("#reset-error").hidden = true;
  $("#reset-email").removeAttribute("aria-invalid");
  notice("[ OK ] Reset-link confirmation preview. No email was sent.");
 });
 $("#reveal-password").addEventListener("click", () => {
  const reveal = $("#password").type === "password";
  $("#password").type = reveal ? "text" : "password";
  $("#reveal-password").textContent = reveal ? "HIDE" : "SHOW";
  $("#reveal-password").setAttribute("aria-label", reveal ? "Hide password" : "Show password");
  $("#reveal-password").setAttribute("aria-pressed", String(reveal));
 });
 $("#passkey").addEventListener("click", () => notice("[ DEMO ] Passkey authentication will be handled by Keycloak. No device prompt is opened here."));
 $("#google").addEventListener("click", () => notice("[ DEMO ] Google sign-in will be handled by Keycloak. This preview stays local."));
 document.querySelectorAll("input").forEach((input) => input.addEventListener("input", () => {
  input.removeAttribute("aria-invalid");
  input.closest("form")?.querySelectorAll(".field-error").forEach((element) => { element.hidden = true; });
 }));
 showScreen(location.hash.slice(1));
 // The optional stdlib server reloads the page when HTML/CSS/JS files change.
 if (location.protocol === "http:" && ["127.0.0.1", "localhost"].includes(location.hostname)) {
  let version;
  let checking = false;
  setInterval(async () => {
    if (checking || document.hidden) return;
    checking = true;
    try {
      const response = await fetch("/__version", { cache: "no-store" });
      if (!response.ok || !response.headers.get("content-type")?.includes("application/json")) return;
      const current = (await response.json()).version;
      if (version !== undefined && current !== version) location.reload();
      version = current;
    } catch { /* The preview also works without the local server. */ }
    finally { checking = false; }
  }, 1000);
 }
@@ -1 +0,0 @@
 ../themes/hexor-lab/login/resources/js/background.js
@@ -1,62 +0,0 @@
 <!doctype html>
 <html lang="en">
 <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta name="color-scheme" content="dark">
  <meta name="description" content="Local prototype of the Hexor terminal login theme.">
  <title>Hexor · Access terminal</title>
  <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 64 64'%3E%3Crect width='64' height='64' fill='%230c100c'/%3E%3Ctext x='8' y='45' fill='%23b9ef70' font-family='monospace' font-size='40'%3E%26gt;_%3C/text%3E%3C/svg%3E">
  <link rel="stylesheet" href="styles.css">
  <link rel="stylesheet" href="preview.css">
  <script src="app.js" defer></script>
  <script src="background.js" defer></script>
 </head>
 <body>
  <canvas id="code-background" aria-hidden="true"></canvas>
  <header class="site-header">
    <a class="wordmark" href="#login">Hexor Lab</a>
  </header>
  <main class="page-main">
    <div class="terminal-wrap">
      <section class="terminal" aria-labelledby="page-title">
        <div class="titlebar"><span><span aria-hidden="true">&gt;_</span> auth@hexor</span></div>
        <div class="terminal-body">
          <div class="heading"><h1 id="page-title">Sign in<span class="cursor" aria-hidden="true">_</span></h1><p id="page-description" class="description" hidden></p></div>
          <div id="notice" class="notice" role="status" hidden></div>
          <form id="login-form" data-view="login" novalidate>
            <div class="field"><label for="username"><span class="prompt" aria-hidden="true">&gt;</span> username <span class="label-hint">/ email</span></label><input id="username" name="username" autocomplete="username" autocapitalize="none" spellcheck="false" placeholder="you@hexor.cy" required aria-describedby="login-error"></div>
            <div class="field"><label for="password"><span class="prompt" aria-hidden="true">&gt;</span> password</label><div class="password-wrap"><input id="password" name="password" type="password" autocomplete="current-password" placeholder="Enter your password" required aria-describedby="login-error"><button class="reveal" id="reveal-password" type="button" aria-label="Show password" aria-pressed="false">SHOW</button></div></div>
            <p class="field-error" id="login-error" role="alert" hidden></p>
            <div class="form-options"><label class="checkbox"><input type="checkbox" name="rememberMe"> Keep me signed in</label><a href="#reset">Forgot password?</a></div>
            <button class="primary" type="submit"><span>Sign in</span><span aria-hidden="true">↵</span></button>
            <div class="divider"><span>OR CONTINUE WITH</span></div>
            <div class="alternatives"><button class="secondary" id="passkey" type="button"><span aria-hidden="true">⌘</span> Passkey</button><button class="secondary" id="google" type="button"><span class="google-icon" aria-hidden="true">G</span> Google</button></div>
          </form>
          <form id="otp-form" data-view="otp" novalidate hidden>
            <div class="field"><label for="otp"><span class="prompt" aria-hidden="true">&gt;</span> verification code</label><input id="otp" name="otp" class="otp-input" type="text" inputmode="numeric" pattern="[0-9]{6}" maxlength="6" autocomplete="one-time-code" placeholder="000000" required aria-describedby="otp-help otp-error"><p id="otp-help" class="field-help">Enter the 6-digit code from your authenticator.</p></div>
            <p id="otp-error" class="field-error" role="alert" hidden></p>
            <button class="primary" type="submit"><span>Verify identity</span><span aria-hidden="true">↵</span></button><a class="back-link" href="#login">← Back to sign in</a>
          </form>
          <form id="reset-form" data-view="reset" novalidate hidden>
            <div class="field"><label for="reset-email"><span class="prompt" aria-hidden="true">&gt;</span> email address</label><input id="reset-email" name="email" type="email" autocomplete="email" autocapitalize="none" spellcheck="false" placeholder="you@hexor.cy" required aria-describedby="reset-error"></div><p id="reset-error" class="field-error" role="alert" hidden></p>
            <button class="primary" type="submit"><span>Send reset link</span><span aria-hidden="true">↵</span></button><a class="back-link" href="#login">← Back to sign in</a>
          </form>
          <div data-view="success" class="success-panel" hidden><div class="success-mark" aria-hidden="true">[ OK ]</div><p>Identity verified.</p><a class="secondary back-link" href="#login">Back to sign in →</a></div>
        </div>
      </section>
    </div>
  </main>
  <aside class="preview" aria-label="Настройки локального предпросмотра" lang="ru">
    <div class="preview-heading"><span class="preview-label">LOCAL PREVIEW</span><span>Демо · данные никуда не отправляются</span></div>
    <div class="preview-controls"><div class="preview-group" role="group" aria-label="Экран"><button type="button" data-screen="login" aria-pressed="true">Логин</button><button type="button" data-screen="otp" aria-pressed="false">OTP</button><button type="button" data-screen="reset" aria-pressed="false">Сброс</button><button type="button" data-screen="error" aria-pressed="false">Ошибка</button></div></div>
  </aside>
 </body>
 </html>
@@ -1,11 +0,0 @@
 .preview { border-top: 1px solid #ffffff0c; padding: 18px 24px 21px; color: var(--muted); font-size: 12px; background: var(--bg); }
 .preview-heading, .preview-controls { max-width: 760px; margin: 0 auto; display: flex; gap: 15px; flex-wrap: wrap; justify-content: space-between; align-items: center; }
 .preview-heading { margin-bottom: 12px; }
 .preview-label { color: var(--text); letter-spacing: 1px; font-size: 11px; }
 .preview-group { display: flex; align-items: center; gap: 7px; flex-wrap: wrap; }
 .preview button, .preview select { border: 1px solid var(--border); border-radius: 0; background: transparent; padding: 5px 9px; color: var(--muted); font-size: 13px; }
 .preview select { background: var(--bg); }
 .preview button[aria-pressed="true"] { color: var(--accent); border-color: var(--accent); }
 .preview button:hover { color: var(--text); }
 .preview .checkbox { margin-left: 8px; }
@media (max-width: 580px) { .preview { padding: 16px; } .preview-controls { gap: 12px; } }
@@ -1,49 +0,0 @@
 {
  "realm": "hexor-preview",
  "enabled": true,
  "displayName": "Hexor Lab",
  "loginTheme": "hexor-lab",
  "sslRequired": "none",
  "registrationAllowed": false,
  "resetPasswordAllowed": true,
  "rememberMe": true,
  "loginWithEmailAllowed": true,
  "clients": [
    {
      "clientId": "theme-preview",
      "enabled": true,
      "publicClient": true,
      "standardFlowEnabled": true,
      "redirectUris": ["http://127.0.0.1:8765/*"],
      "webOrigins": ["http://127.0.0.1:8765"]
    }
  ],
  "users": [
    {
      "username": "demo",
      "enabled": true,
      "emailVerified": true,
      "email": "demo@example.test",
      "firstName": "Demo",
      "lastName": "User",
      "credentials": [{"type": "password", "value": "demo-password", "temporary": false}]
    },
    {
      "username": "demo-otp",
      "enabled": true,
      "emailVerified": true,
      "email": "demo-otp@example.test",
      "firstName": "Demo",
      "lastName": "OTP",
      "credentials": [
        {"type": "password", "value": "demo-password", "temporary": false},
        {
          "type": "otp",
          "userLabel": "Local preview",
          "secretData": "{\"value\":\"local-preview-secret\"}",
          "credentialData": "{\"subType\":\"totp\",\"digits\":6,\"counter\":0,\"period\":30,\"algorithm\":\"HmacSHA1\"}"
        }
      ]
    }
  ]
 }
@@ -1,23 +0,0 @@
 #!/usr/bin/env bash
 set -euo pipefail
 # Run the real login theme in an isolated, disposable Keycloak 26.5.6 instance.
 # Test users: demo / demo-password and demo-otp / demo-password.
 # The existing deployment, Terraform and production realm are not involved.
 preview_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 theme_dir="$(cd -- "$preview_dir/../themes/hexor-lab" && pwd)"
 printf '%s\n' \
  'After Keycloak starts, open:' \
  'http://127.0.0.1:8780/realms/hexor-preview/protocol/openid-connect/auth?client_id=theme-preview&redirect_uri=http%3A%2F%2F127.0.0.1%3A8765%2F&response_type=code&scope=openid' \
  'Test account: demo / demo-password'
 docker run --rm --name hexor-lab-preview \
  --publish 127.0.0.1:8780:8080 \
  --mount "type=bind,source=$theme_dir,target=/opt/keycloak/themes/hexor-lab,readonly" \
  --mount "type=bind,source=$preview_dir/realm.json,target=/opt/keycloak/data/import/hexor-preview.json,readonly" \
  quay.io/keycloak/keycloak:26.5.6 \
  start-dev --import-realm \
  --spi-theme--static-max-age=-1 \
  --spi-theme--cache-themes=false \
  --spi-theme--cache-templates=false
@@ -1,49 +0,0 @@
 #!/usr/bin/env python3
 """Local theme preview: python3 serve.py [--port 8765]. No dependencies."""
 import argparse
 from functools import partial
 from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
 import json
 from pathlib import Path
 from urllib.parse import urlsplit
 ROOT = Path(__file__).resolve().parent
 ASSETS = ("index.html", "styles.css", "preview.css", "app.js", "background.js")
 class PreviewHandler(SimpleHTTPRequestHandler):
    def end_headers(self):
        self.send_header("Cache-Control", "no-store")
        super().end_headers()
    def do_GET(self):
        if urlsplit(self.path).path == "/__version":
            version = ":".join(str((ROOT / name).stat().st_mtime_ns) for name in ASSETS)
            body = json.dumps({"version": version}).encode()
            self.send_response(200)
            self.send_header("Content-Type", "application/json")
            self.send_header("Content-Length", str(len(body)))
            self.end_headers()
            self.wfile.write(body)
        else:
            super().do_GET()
    def log_message(self, format, *args):
        if not self.path.startswith("/__version"):
            super().log_message(format, *args)
 if __name__ == "__main__":
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--port", type=int, default=8765)
    args = parser.parse_args()
    server = ThreadingHTTPServer(("127.0.0.1", args.port), partial(PreviewHandler, directory=str(ROOT)))
    print(f"Local: http://127.0.0.1:{server.server_port}", flush=True)
    print("Edit index.html, styles.css or app.js; the browser reloads on save. Ctrl+C to stop.", flush=True)
    try:
        server.serve_forever()
    except KeyboardInterrupt:
        pass
    finally:
        server.server_close()
@@ -1 +0,0 @@
 ../themes/hexor-lab/login/resources/css/hexor.css
@@ -1,80 +0,0 @@
 # Read-only access to the keycloak-db Secret in the psql namespace
 # (see postgresql/databases/keycloak.yaml for the other half).
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: db-credentials-reader
 ---
 apiVersion: external-secrets.io/v1
 kind: SecretStore
 metadata:
  name: psql-credentials
 spec:
  provider:
    kubernetes:
      remoteNamespace: psql
      server:
        caProvider:
          type: ConfigMap
          name: kube-root-ca.crt
          key: ca.crt
      auth:
        serviceAccount:
          name: db-credentials-reader
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: keycloak-creds
 spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: SecretStore
    name: psql-credentials
  target:
    name: keycloak-creds
    template:
      data:
        KC_DB_USERNAME: "{{ .username }}"
        KC_DB_PASSWORD: "{{ .password }}"
  data:
    - secretKey: username
      remoteRef:
        key: keycloak-db
        property: username
    - secretKey: password
      remoteRef:
        key: keycloak-db
        property: password
 ---
 # Bootstrap admin: only used when the database has no admin user yet (a fresh
 # install). With the restored database the existing admin accounts are kept.
 apiVersion: generators.external-secrets.io/v1alpha1
 kind: Password
 metadata:
  name: keycloak-bootstrap
 spec:
  length: 40
  digits: 10
  symbols: 0
  noUpper: false
  allowRepeat: true
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: keycloak-bootstrap
 spec:
  refreshPolicy: CreatedOnce
  target:
    name: keycloak-bootstrap
    template:
      data:
        KC_BOOTSTRAP_ADMIN_USERNAME: admin
        KC_BOOTSTRAP_ADMIN_PASSWORD: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: keycloak-bootstrap
@@ -1,202 +0,0 @@
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/
   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
   1. Definitions.
      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.
      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.
      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.
      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.
      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.
      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.
      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).
      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.
      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."
      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.
   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.
   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.
   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:
      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and
      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and
      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and
      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.
      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.
   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.
   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.
   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.
   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.
   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.
   END OF TERMS AND CONDITIONS
   APPENDIX: How to apply the Apache License to your work.
      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.
   Copyright [yyyy] [name of copyright owner]
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at
       http://www.apache.org/licenses/LICENSE-2.0
   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
@@ -1,83 +0,0 @@
 /* Start here: all palette and layout settings are ordinary CSS variables. */
 :root {
  --bg: #0c0f0d;
  --surface: #111612;
  --input-bg: #0c110d;
  --accent: #b9ef70;
  --accent-ink: #121c09;
  --text: #e1e7dd;
  --muted: #8b9989;
  --border: #354031;
  --error: #ffa595;
  --font: "SFMono-Regular", Consolas, "Liberation Mono", monospace;
  --terminal-width: 560px;
  --code-opacity: .16;
 }
 * { box-sizing: border-box; }
 [hidden] { display: none !important; }
 body { margin: 0; min-height: 100svh; color: var(--text); background: var(--bg); font: 16px/1.6 var(--font); display: flex; flex-direction: column; isolation: isolate; }
 #code-background { position: fixed; inset: 0; width: 100%; height: 100%; pointer-events: none; z-index: -1; opacity: var(--code-opacity); mask-image: linear-gradient(to bottom, transparent, #000 15%, #000 85%, transparent); }
 button, input, select { font: inherit; }
 button, select { cursor: pointer; }
 button, a, input, select { -webkit-tap-highlight-color: transparent; }
 button, a, select { touch-action: manipulation; }
 a { color: var(--muted); text-underline-offset: 4px; text-decoration-thickness: 1px; }
 a:hover { color: var(--accent); }
 button:focus-visible, a:focus-visible, select:focus-visible { outline: 2px solid var(--accent); outline-offset: 4px; }
 ::selection { background: var(--accent); color: var(--accent-ink); }
 .site-header { padding: 27px 38px; display: flex; justify-content: space-between; gap: 20px; align-items: center; }
 .wordmark { font: 500 clamp(26px, 4vw, 34px)/1.2 var(--font); letter-spacing: -1px; text-decoration: none; color: var(--text); }
 .page-main { flex: 1; display: grid; place-items: center; padding: 35px 24px 64px; }
 .terminal-wrap { width: min(100%, var(--terminal-width)); }
 .terminal { background: var(--surface); border: 1px solid var(--border); box-shadow: 0 24px 90px #0004; }
 .titlebar { display: flex; padding: 12px 20px; border-bottom: 1px solid var(--border); font-size: 14px; color: var(--muted); }
 .titlebar span span { color: var(--accent); margin-right: 9px; }
 .terminal-body { padding: 30px 36px 34px; }
 .heading { margin: 0 0 28px; }
 h1 { margin: 0 0 8px; font-size: clamp(28px, 6vw, 34px); line-height: 1.3; font-weight: 500; letter-spacing: -1px; }
 .cursor { color: var(--accent); animation: blink 1.2s step-end infinite; }
@keyframes blink { 50% { opacity: 0; } }
 .description { color: var(--muted); margin: 0; font-size: 15px; }
 .field { margin-bottom: 21px; }
 .field > label { display: block; margin-bottom: 8px; font-size: 16px; }
 .prompt { color: var(--accent); margin-right: 7px; }
 .label-hint { color: var(--muted); font-size: 14px; }
 input:not([type="checkbox"]) { width: 100%; min-height: 50px; padding: 12px 14px; background: var(--input-bg); border: 1px solid var(--border); border-radius: 0; color: var(--text); caret-color: var(--accent); outline: none; box-shadow: none; font-size: 16px; }
 input:not([type="checkbox"]):hover { border-color: var(--muted); }
 input:not([type="checkbox"]):focus { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
 input::placeholder { color: var(--muted); opacity: .7; }
 input[aria-invalid="true"]:not([type="checkbox"]) { border-color: var(--error); }
 input:-webkit-autofill { -webkit-text-fill-color: var(--text); box-shadow: 0 0 0 1000px var(--input-bg) inset; }
 .password-wrap { position: relative; }
 .password-wrap input { padding-right: 72px; }
 .reveal { position: absolute; right: 5px; top: 5px; bottom: 5px; padding: 0 10px; background: transparent; color: var(--muted); border: 0; font-size: 12px; letter-spacing: .5px; }
 .reveal:hover { color: var(--accent); }
 .form-options { display: flex; flex-wrap: wrap; justify-content: space-between; gap: 10px; margin: 1px 0 26px; font-size: 14px; }
 .checkbox { display: inline-flex; align-items: center; gap: 8px; cursor: pointer; color: var(--muted); }
 input[type="checkbox"] { width: 16px; height: 16px; margin: 0; accent-color: var(--accent); cursor: pointer; }
 .primary { width: 100%; min-height: 50px; display: flex; align-items: center; justify-content: space-between; padding: 11px 16px; background: var(--accent); color: var(--accent-ink); border: 1px solid var(--accent); border-radius: 0; font-weight: bold; transition: filter .15s; }
 .primary:hover { filter: brightness(1.1); }
 .primary:active { transform: translateY(1px); }
 .primary span:last-child { font-size: 20px; font-weight: normal; line-height: 1; }
 .divider { display: flex; align-items: center; gap: 15px; margin: 24px 0 18px; color: var(--muted); font-size: 11px; letter-spacing: 1px; }
 .divider::before, .divider::after { content: ""; height: 1px; background: var(--border); flex: 1; }
 .alternatives { display: flex; gap: 12px; }
 .secondary { display: inline-flex; justify-content: center; align-items: center; gap: 10px; min-height: 48px; padding: 10px 15px; background: transparent; color: var(--text); border: 1px solid var(--border); border-radius: 0; font-size: 16px; text-decoration: none; }
 .alternatives .secondary { flex: 1; }
 .secondary:hover { border-color: var(--accent); color: var(--accent); background: #ffffff03; }
 .secondary > span { color: var(--muted); font-size: 16px; }
 .google-icon { font-family: sans-serif; font-weight: bold; }
 .notice { border-left: 2px solid var(--accent); padding: 10px 13px; background: #ffffff04; color: var(--text); font-size: 15px; margin: 0 0 22px; overflow-wrap: anywhere; }
 .notice.error { border-color: var(--error); color: var(--error); }
 .field-error { color: var(--error); font-size: 14px; margin: -8px 0 18px; }
 .field-help { margin: 10px 0 0; color: var(--muted); font-size: 14px; }
 input.otp-input { letter-spacing: 10px; font-size: 24px; padding: 15px; }
 .back-link { display: block; text-align: center; margin-top: 24px; font-size: 15px; }
 .success-panel { text-align: center; padding: 15px 0; }
 .success-mark { color: var(--accent); font-size: 32px; }
@media (max-width: 580px) {
  .site-header { padding: 20px; }
  .page-main { padding: 25px 16px 40px; }
  .terminal-body { padding: 24px; }
 }
@media (prefers-reduced-motion: reduce) { *, *::before, *::after { animation: none !important; transition: none !important; } }
@@ -1,130 +0,0 @@
 /* Adapt the native Keycloak 26.5.6 form components to the shared design. */
 html.login-pf {
  color-scheme: dark;
  --pf-v5-global--FontFamily--text: var(--font);
  --pf-v5-global--FontFamily--heading: var(--font);
  --pf-v5-global--FontFamily--monospace: var(--font);
  --pf-v5-global--FontSize--md: 16px;
  --pf-v5-global--Color--100: var(--text);
  --pf-v5-global--Color--200: var(--muted);
  --pf-v5-global--primary-color--100: var(--accent);
  --pf-v5-global--primary-color--200: var(--accent);
  --pf-v5-global--link--Color: var(--accent);
  --pf-v5-global--link--Color--hover: var(--text);
  --pf-v5-global--BackgroundColor--100: var(--surface);
  --pf-v5-global--BackgroundColor--200: var(--input-bg);
  --pf-v5-global--BorderColor--100: var(--border);
  --pf-v5-global--danger-color--100: var(--error);
  --pf-v5-global--success-color--100: var(--accent);
 }
 html.login-pf body#keycloak-bg {
  background: var(--bg);
  color: var(--text);
  font: 16px/1.6 var(--font);
  height: auto;
 }
 .hexor-heading { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 12px; padding: 30px 36px 0; }
 .hexor-title { margin: 0; font: 500 clamp(28px, 6vw, 34px)/1.3 var(--font); letter-spacing: -1px; }
 .hexor-title::after { content: "_"; color: var(--accent); animation: blink 1.2s step-end infinite; }
 .hexor-body { padding: 28px 36px 34px; }
 .hexor-body > :last-child { margin-bottom: 0; }
 .hexor-locale { max-width: 100%; }
 .hexor-locale select { max-width: 180px; }
 .hexor-body .pf-v5-c-form { gap: 21px; }
 .hexor-body .pf-v5-c-form__group { gap: 8px; }
 .hexor-body .pf-v5-c-form__group-label { padding-bottom: 0 !important; }
 .hexor-body .pf-v5-c-form__label { color: var(--text); font-size: 16px; line-height: 1.6; }
 .hexor-body .pf-v5-c-form__label-text::before { content: ">"; color: var(--accent); margin-inline-end: 12px; }
 .hexor-body .pf-v5-c-form__helper-text { margin-top: 10px; }
 .hexor-body .pf-v5-c-helper-text { gap: 10px; flex-wrap: wrap; }
 .hexor-body .pf-v5-c-helper-text__item-text { color: var(--muted); font-size: 14px; }
 .hexor-body .pf-v5-c-check { color: var(--muted); font-size: 14px; align-items: center; }
 .hexor-body .pf-v5-c-check__label { color: var(--muted); font-size: 14px; }
 .hexor-body .pf-v5-c-form-control, .hexor-locale .pf-v5-c-form-control {
  background: var(--input-bg);
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: 0;
  --pf-v5-c-form-control--after--BorderBottomWidth: 0;
  --pf-v5-c-form-control--before--BorderWidth: 0;
  --pf-v5-c-form-control--Height: auto;
 }
 .hexor-body .pf-v5-c-form-control::before,
 .hexor-body .pf-v5-c-form-control::after,
 .hexor-locale .pf-v5-c-form-control::before,
 .hexor-locale .pf-v5-c-form-control::after { display: none; }
 .hexor-body .pf-v5-c-form-control:focus-within { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
 .hexor-body .pf-v5-c-form-control.pf-m-error { border-color: var(--error); }
 .hexor-body .pf-v5-c-form-control > :is(input, textarea, select),
 .hexor-locale .pf-v5-c-form-control > select {
  border: 0;
  border-radius: 0;
  padding: 12px 14px;
  min-height: 50px;
  background: transparent;
  color: var(--text);
  font: 16px/1.6 var(--font);
  box-shadow: none;
 }
 .hexor-body .pf-v5-c-form-control > input:focus { box-shadow: none; }
 .hexor-body .pf-v5-c-form-control input[readonly] { color: var(--muted); }
 .hexor-body .pf-v5-c-input-group { gap: 0; }
 .hexor-body .pf-v5-c-input-group__item { min-width: 0; }
 .hexor-body .pf-v5-c-form-control__utilities { background: transparent; color: var(--muted); }
 .hexor-body .pf-v5-c-button {
  min-height: 48px;
  border: 1px solid var(--border);
  border-radius: 0;
  padding: 10px 15px;
  background: transparent;
  color: var(--text);
  font: 16px/1.6 var(--font);
  box-shadow: none;
  text-decoration: none;
  white-space: normal;
 }
 .hexor-body .pf-v5-c-button::after { display: none; }
 .hexor-body .pf-v5-c-button:hover { border-color: var(--accent); color: var(--accent); }
 .hexor-body .pf-v5-c-button:focus-visible { outline: 2px solid var(--accent); outline-offset: 4px; }
 .hexor-body .pf-v5-c-button.pf-m-primary {
  width: 100%;
  min-height: 50px;
  background: var(--accent);
  border-color: var(--accent);
  color: var(--accent-ink);
  font-weight: bold;
 }
 .hexor-body .pf-v5-c-button.pf-m-primary:hover { filter: brightness(1.1); }
 .hexor-body .pf-v5-c-button:disabled, .hexor-body .pf-m-aria-disabled { opacity: .5; pointer-events: none; }
 .hexor-body .pf-v5-c-button.pf-m-control { min-width: 46px; height: 100%; color: var(--muted); background: var(--input-bg); }
 .hexor-body .pf-v5-c-button.pf-m-link { min-height: auto; border-color: transparent; padding-inline: 0; color: var(--accent); }
 .hexor-body .pf-v5-c-form__actions { padding-top: 0 !important; }
 .hexor-body a:not(.pf-v5-c-button) { color: var(--muted); }
 .hexor-body a:not(.pf-v5-c-button):hover { color: var(--accent); }
 .hexor-body .pf-v5-c-alert { border: 0; border-inline-start: 2px solid var(--accent); padding: 10px 13px; background: #ffffff04; color: var(--text); box-shadow: none; }
 .hexor-body .pf-v5-c-alert.pf-m-danger { border-color: var(--error); }
 .hexor-body .pf-v5-c-alert__icon { display: none; }
 .hexor-body .pf-v5-c-alert__title { color: var(--text); font: 15px/1.6 var(--font); }
 .hexor-body .pf-v5-c-alert.pf-m-danger .pf-v5-c-alert__title,
 .hexor-body .pf-v5-c-helper-text__item.pf-m-error .pf-v5-c-helper-text__item-text { color: var(--error); }
 .hexor-footer:empty { display: none; }
 .hexor-footer-band { padding: 0; margin-top: 22px; color: var(--muted); font-size: 14px; }
 .hexor-divider-label { display: flex; align-items: center; gap: 15px; margin: 24px 0 18px; font-size: 11px; letter-spacing: 1px; }
 .hexor-divider-label::before, .hexor-divider-label::after { content: ""; flex: 1; height: 1px; background: var(--border); }
 #kc-social-providers ul { display: flex; flex-wrap: wrap; gap: 12px; padding: 0; margin: 0; list-style: none; }
 #kc-social-providers li { flex: 1 1 160px; padding: 0; }
 #kc-social-providers a { display: flex; justify-content: center !important; align-items: center; gap: 10px; }
 #kc-social-providers svg { width: 20px; height: 20px; flex-shrink: 0; fill: currentColor; }
 #kc-social-providers svg:not(.google) { filter: none; }
 #kc-social-providers .pf-v5-u-m-auto { margin: 0 !important; }
 #kc-select-try-another-way-form { margin-top: 20px; }
 #kc-info-wrapper, #kc-registration { color: var(--muted); font-size: 14px; }
 #kc-otp-login-form #otp { font-size: 24px; letter-spacing: 8px; }
 .hexor-body :is(.pf-v5-c-tile, .pf-v5-c-data-list__item, .pf-v5-c-panel) { background: var(--input-bg); color: var(--text); border: 1px solid var(--border); box-shadow: none; }
 .hexor-body .pf-v5-c-tile.pf-m-selected { border-color: var(--accent); }
 .hexor-body img, .hexor-body canvas, .hexor-body svg { max-width: 100%; }
 .hexor-body pre { overflow-wrap: anywhere; white-space: pre-wrap; }
@media (max-width: 580px) {
  .hexor-heading { padding: 24px 24px 0; }
  .hexor-body { padding: 24px; }
 }
@@ -1 +0,0 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" fill="#0c0f0d"/><text x="7" y="43" fill="#b9ef70" font-family="monospace" font-size="34">&gt;_</text></svg>
@@ -1,126 +0,0 @@
 /* Decorative code stream. Brightness: --code-opacity in css/hexor.css. */
 (() => {
  "use strict";
  const canvas = document.querySelector("#code-background");
  const context = canvas?.getContext("2d");
  if (!context) return;
  const source = [
    "use std::sync::Arc;",
    "use tokio::net::TcpListener;",
    "",
    "async fn main() -> Result<()> {",
    "    let config = Config::load()?;",
    "    let state = Arc::new(State::new());",
    "    let router = routes(state.clone());",
    "",
    "    server::bind(config.address)",
    "        .serve(router)",
    "        .await?;",
    "    Ok(())",
    "}",
    "",
    "impl Session {",
    "    pub fn verify(&self) -> bool {",
    "        self.expires_at > clock::now()",
    "            && self.signature.is_valid()",
    "    }",
    "}",
    "",
    "fn routes(state: Arc<State>) -> Router {",
    "    Router::new()",
    '        .route("/", get(index))',
    '        .route("/session", post(create))',
    "        .with_state(state)",
    "}",
    "",
    "match identity.authenticate().await {",
    "    Ok(session) => session.commit(),",
    "    Err(error) => trace!(?error),",
    "}",
    "",
    "let transport = Transport::builder()",
    "    .with_timeout(Duration::from_secs(30))",
    "    .with_keepalive(true)",
    "    .connect(endpoint).await?;",
    "",
  ];
  const motion = window.matchMedia("(prefers-reduced-motion: reduce)");
  const lineHeight = 24;
  let streams = [];
  let width = 0;
  let height = 0;
  let color;
  function updateColor() {
    color = getComputedStyle(document.documentElement).getPropertyValue("--accent").trim();
  }
  function resize() {
    width = window.innerWidth;
    height = window.innerHeight;
    const ratio = Math.min(window.devicePixelRatio || 1, 1.5);
    canvas.width = Math.round(width * ratio);
    canvas.height = Math.round(height * ratio);
    context.setTransform(ratio, 0, 0, ratio, 0, 0);
    context.font = '13px "SFMono-Regular", Consolas, "Liberation Mono", monospace';
    const columns = Math.max(1, Math.ceil(width / 470));
    const rows = Math.ceil(height / lineHeight);
    streams = Array.from({ length: columns }, (_, column) => {
      const start = Math.floor(Math.random() * source.length);
      const count = Math.max(4, rows - 7 + Math.floor(Math.random() * 5));
      return {
        x: column * (width / columns) + 24,
        y: 44 - Math.random() * 80,
        lines: Array.from({ length: count }, (_, i) => source[(start + i) % source.length]),
        next: (start + count) % source.length,
        typed: Math.random() * 12,
        pause: 0,
        number: 20 + start,
        speed: .55 + Math.random() * .6,
      };
    });
    draw(false);
  }
  function draw(advance) {
    context.clearRect(0, 0, width, height);
    context.fillStyle = color;
    for (const stream of streams) {
      const current = source[stream.next];
      if (advance) {
        if (stream.typed < current.length) stream.typed += stream.speed;
        else if (++stream.pause > 8) {
          stream.lines.push(current);
          stream.next = (stream.next + 1) % source.length;
          stream.typed = 0;
          stream.pause = 0;
        }
        // Scroll gently as new lines reach the bottom of the viewport.
        const overflow = stream.y + (stream.lines.length + 2) * lineHeight - height;
        if (overflow > 0) stream.y -= Math.min(1.5, overflow);
        if (stream.y < -lineHeight) {
          stream.lines.shift();
          stream.y += lineHeight;
          stream.number++;
        }
      }
      stream.lines.concat(current.slice(0, Math.floor(stream.typed))).forEach((line, i) => {
        const y = stream.y + i * lineHeight;
        context.globalAlpha = .3;
        context.fillText(String(stream.number + i).padStart(3, "0"), stream.x, y);
        context.globalAlpha = i === stream.lines.length ? .95 : .6;
        context.fillText(line, stream.x + 42, y);
      });
    }
    context.globalAlpha = 1;
  }
  updateColor();
  resize();
  window.addEventListener("resize", resize);
  // Ten frames per second is enough for slow typing; no work in hidden tabs.
  setInterval(() => {
    if (!document.hidden && !motion.matches) draw(true);
  }, 100);
 })();
@@ -1,247 +0,0 @@
 <#-- Based on Keycloak 26.5.6 keycloak.v2/login/template.ftl (Apache-2.0). -->
 <#import "field.ftl" as field>
 <#import "footer.ftl" as loginFooter>
 <#macro username>
  <#assign label>
    <#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if>
  </#assign>
  <@field.group name="username" label=label>
    <div class="${properties.kcInputGroup}">
      <div class="${properties.kcInputGroupItemClass} ${properties.kcFill}">
        <span class="${properties.kcInputClass} ${properties.kcFormReadOnlyClass}">
          <input id="kc-attempted-username" value="${auth.attemptedUsername}" readonly>
        </span>
      </div>
      <div class="${properties.kcInputGroupItemClass}">
        <button id="reset-login" class="${properties.kcFormPasswordVisibilityButtonClass} kc-login-tooltip" type="button"
              aria-label="${msg('restartLoginTooltip')}" onclick="location.href='${url.loginRestartFlowUrl}'">
            <i class="fa-sync-alt fas" aria-hidden="true"></i>
            <span class="kc-tooltip-text">${msg("restartLoginTooltip")}</span>
        </button>
      </div>
    </div>
  </@field.group>
 </#macro>
 <#macro registrationLayout bodyClass="" displayInfo=false displayMessage=true displayRequiredFields=false>
 <!DOCTYPE html>
 <html class="${properties.kcHtmlClass!}" lang="${lang}"<#if realm.internationalizationEnabled> dir="${(locale.rtl)?then('rtl','ltr')}"</#if>>
 <head>
    <meta charset="utf-8">
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta name="color-scheme" content="dark">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <#if properties.meta?has_content>
        <#list properties.meta?split(' ') as meta>
            <meta name="${meta?split('==')[0]}" content="${meta?split('==')[1]}"/>
        </#list>
    </#if>
    <title>${msg("loginTitle",(realm.displayName!''))}</title>
    <link rel="icon" href="${url.resourcesPath}/img/favicon.svg" />
    <#if properties.stylesCommon?has_content>
        <#list properties.stylesCommon?split(' ') as style>
            <link href="${url.resourcesCommonPath}/${style}" rel="stylesheet" />
        </#list>
    </#if>
    <#if properties.styles?has_content>
        <#list properties.styles?split(' ') as style>
            <link href="${url.resourcesPath}/${style}" rel="stylesheet" />
        </#list>
    </#if>
    <script type="importmap">
        {
            "imports": {
                "rfc4648": "${url.resourcesCommonPath}/vendor/rfc4648/rfc4648.js"
            }
        }
    </script>
    <#if properties.scripts?has_content>
        <#list properties.scripts?split(' ') as script>
            <script src="${url.resourcesPath}/${script}" defer></script>
        </#list>
    </#if>
    <#if scripts??>
        <#list scripts as script>
            <script src="${script}" type="text/javascript"></script>
        </#list>
    </#if>
    <script type="module" src="${url.resourcesPath}/js/passwordVisibility.js"></script>
    <script type="module">
        <#outputformat "JavaScript">
        import { startSessionPolling } from "${url.resourcesPath}/js/authChecker.js";
        startSessionPolling(
            ${url.ssoLoginInOtherTabsUrl?c}
        );
        </#outputformat>
    </script>
    <script type="module">
        document.addEventListener("click", (event) => {
            const link = event.target.closest("a[data-once-link]");
            if (!link) {
                return;
            }
            if (link.getAttribute("aria-disabled") === "true") {
                event.preventDefault();
                return;
            }
            const { disabledClass } = link.dataset;
            if (disabledClass) {
                link.classList.add(...disabledClass.trim().split(/\s+/));
            }
            link.setAttribute("role", "link");
            link.setAttribute("aria-disabled", "true");
        });
    </script>
    <#if authenticationSession??>
        <script type="module">
             <#outputformat "JavaScript">
            import { checkAuthSession } from "${url.resourcesPath}/js/authChecker.js";
            checkAuthSession(
                ${authenticationSession.authSessionIdHash?c}
            );
            </#outputformat>
        </script>
    </#if>
    <script>
      // Workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=1404468
      const isFirefox = true;
    </script>
 </head>
 <body id="keycloak-bg" class="${properties.kcBodyClass!}" data-page-id="login-${pageId}">
 <canvas id="code-background" aria-hidden="true"></canvas>
 <header class="site-header"><span class="wordmark">Hexor Lab</span></header>
 <div class="${properties.kcLogin!} page-main">
  <div class="${properties.kcLoginContainer!}">
    <main class="${properties.kcLoginMain!} terminal">
      <div class="titlebar"><span><span aria-hidden="true">&gt;_</span> auth@hexor</span></div>
      <div class="${properties.kcLoginMainHeader!}">
        <h1 class="${properties.kcLoginMainTitle!}" id="kc-page-title"><#nested "header"></h1>
        <#if realm.internationalizationEnabled  && locale.supported?size gt 1>
        <div class="${properties.kcLoginMainHeaderUtilities!}">
          <div class="${properties.kcInputClass!}">
            <select
              aria-label="${msg("languages")}"
              id="login-select-toggle"
              onchange="if (this.value) window.location.href=this.value"
            >
              <#list locale.supported?sort_by("label") as l>
                <option
                  value="${l.url}"
                  ${(l.languageTag == locale.currentLanguageTag)?then('selected','')}
                >
                  ${l.label}
                </option>
              </#list>
            </select>
            <span class="${properties.kcFormControlUtilClass}">
              <span class="${properties.kcFormControlToggleIcon!}">
                <svg
                  class="pf-v5-svg"
                  viewBox="0 0 320 512"
                  fill="currentColor"
                  aria-hidden="true"
                  role="img"
                  width="1em"
                  height="1em"
                >
                  <path
                    d="M31.3 192h257.3c17.8 0 26.7 21.5 14.1 34.1L174.1 354.8c-7.8 7.8-20.5 7.8-28.3 0L17.2 226.1C4.6 213.5 13.5 192 31.3 192z"
                  >
                  </path>
                </svg>
              </span>
            </span>
          </div>
        </div>
        </#if>
      </div>
      <div class="${properties.kcLoginMainBody!}">
        <#if !(auth?has_content && auth.showUsername() && !auth.showResetCredentials())>
            <#if displayRequiredFields>
                <div class="${properties.kcContentWrapperClass!}">
                    <div class="${properties.kcLabelWrapperClass!} subtitle">
                        <span class="${properties.kcInputHelperTextItemTextClass!}">
                          <span class="${properties.kcInputRequiredClass!}">*</span> ${msg("requiredFields")}
                        </span>
                    </div>
                </div>
            </#if>
        <#else>
            <#if displayRequiredFields>
                <div class="${properties.kcContentWrapperClass!}">
                    <div class="${properties.kcLabelWrapperClass!} subtitle">
                        <span class="${properties.kcInputHelperTextItemTextClass!}">
                          <span class="${properties.kcInputRequiredClass!}">*</span> ${msg("requiredFields")}
                        </span>
                    </div>
                    <div class="${properties.kcFormClass} ${properties.kcContentWrapperClass}">
                        <#nested "show-username">
                        <@username />
                    </div>
                </div>
            <#else>
                <div class="${properties.kcFormClass} ${properties.kcContentWrapperClass}">
                  <#nested "show-username">
                  <@username />
                </div>
            </#if>
        </#if>
        <#-- App-initiated actions should not see warning messages about the need to complete the action -->
        <#-- during login.                                                                               -->
        <#if displayMessage && message?has_content && (message.type != 'warning' || !isAppInitiatedAction??)>
            <div class="${properties.kcAlertClass!} pf-m-${(message.type = 'error')?then('danger', message.type)}">
                <div class="${properties.kcAlertIconClass!}">
                    <#if message.type = 'success'><span class="${properties.kcFeedbackSuccessIcon!}"></span></#if>
                    <#if message.type = 'warning'><span class="${properties.kcFeedbackWarningIcon!}"></span></#if>
                    <#if message.type = 'error'><span class="${properties.kcFeedbackErrorIcon!}"></span></#if>
                    <#if message.type = 'info'><span class="${properties.kcFeedbackInfoIcon!}"></span></#if>
                </div>
                <span class="${properties.kcAlertTitleClass!} kc-feedback-text">${message.summary}</span>
            </div>
        </#if>
        <#nested "form">
        <#if auth?has_content && auth.showTryAnotherWayLink()>
          <form id="kc-select-try-another-way-form" action="${url.loginAction}" method="post" novalidate="novalidate">
              <input type="hidden" name="tryAnotherWay" value="on"/>
              <a id="try-another-way" href="javascript:document.forms['kc-select-try-another-way-form'].requestSubmit()"
                  class="${properties.kcButtonSecondaryClass} ${properties.kcButtonBlockClass} ${properties.kcMarginTopClass}">
                    ${msg("doTryAnotherWay")}
              </a>
          </form>
        </#if>
          <div class="${properties.kcLoginMainFooter!}">
              <#nested "socialProviders">
              <#if displayInfo>
                  <div id="kc-info" class="${properties.kcLoginMainFooterBand!} ${properties.kcFormClass}">
                      <div id="kc-info-wrapper" class="${properties.kcLoginMainFooterBandItem!}">
                          <#nested "info">
                      </div>
                  </div>
              </#if>
          </div>
      </div>
        <div class="${properties.kcLoginMainFooter!}">
            <@loginFooter.content/>
        </div>
    </main>
  </div>
 </div>
 </body>
 </html>
 </#macro>
@@ -1,18 +0,0 @@
 parent=keycloak.v2
 import=common/keycloak
 styles=css/styles.css css/hexor.css css/keycloak.css
 scripts=js/background.js
 darkMode=false
 # Own layout; inherit Keycloak's form fields, authentication and translations.
 kcLogin=hexor-page
 kcLoginContainer=terminal-wrap
 kcLoginMain=hexor-main
 kcLoginMainHeader=hexor-heading
 kcLoginMainTitle=hexor-title
 kcLoginMainBody=hexor-body
 kcLoginMainHeaderUtilities=hexor-locale
 kcLoginMainFooter=hexor-footer
 kcLoginMainFooterBand=hexor-footer-band
 kcLoginMainFooterBandItem=hexor-footer-item
 kcLoginMainFooterHelperText=hexor-divider-label
@@ -1,89 +0,0 @@
 replicas: 1
 nodeSelector:
  homelab.hexor.cy/pool: core
  homelab.hexor.cy/exposure: external
 image:
  repository: quay.io/keycloak/keycloak
  tag: "26.5.6"
 command:
  - "/opt/keycloak/bin/kc.sh"
  - "start"
  - "--http-port=8080"
  - "--hostname-strict=false"
  - "--proxy-headers=xforwarded"
 extraEnvFrom: |
  - secretRef:
      name: keycloak-creds
  - secretRef:
      name: keycloak-bootstrap
 extraEnv: |
  - name: KC_HOSTNAME
    value: auth.hexor.cy
  - name: JAVA_OPTS_APPEND
    value: "-Djgroups.dns.query=keycloak-keycloakx-headless.keycloak.svc"
 extraVolumes: |
  - name: hexor-lab-theme
    configMap:
      name: keycloak-hexor-lab-theme
      items:
        - key: theme.properties
          path: theme.properties
        - key: template.ftl
          path: template.ftl
        - key: hexor.css
          path: resources/css/hexor.css
        - key: keycloak.css
          path: resources/css/keycloak.css
        - key: background.js
          path: resources/js/background.js
        - key: favicon.svg
          path: resources/img/favicon.svg
 extraVolumeMounts: |
  - name: hexor-lab-theme
    mountPath: /opt/keycloak/themes/hexor-lab/login
    readOnly: true
 dbchecker:
  enabled: true
 database:
  vendor: postgres
  hostname: main-rw.psql.svc
  port: 5432
  database: keycloak
  existingSecret: keycloak-creds
  existingSecretKey: KC_DB_PASSWORD
 service:
  type: ClusterIP
 # HTTP is redirected to HTTPS by the cluster-wide Traefik default (core/traefik-config).
 ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
  rules:
    - host: auth.hexor.cy
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: keycloak-tls
      hosts:
        - auth.hexor.cy
 resources:
  requests:
    cpu: 500m
    memory: 1Gi
  limits:
    cpu: "3"
    memory: 2Gi
		`@@ -1 +0,0 @@`
			`../themes/hexor-lab/login/resources/js/background.js`
		`@@ -1 +0,0 @@`
			`../themes/hexor-lab/login/resources/css/hexor.css`
		`@@ -1 +0,0 @@`
			`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" fill="#0c0f0d"/><text x="7" y="43" fill="#b9ef70" font-family="monospace" font-size="34">>_</text></svg>`