Compare commits
1 Commits
main
...
auto-updat
| Author | SHA1 | Date | |
|---|---|---|---|
|
4990680c91 |
@@ -16,6 +16,7 @@ ArgoCD homelab project
|
||||
| **authentik** | [](https://ag.hexor.cy/applications/argocd/authentik) |
|
||||
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
@@ -37,6 +38,8 @@ ArgoCD homelab project
|
||||
|
||||
| Application | Status |
|
||||
| :--- | :---: |
|
||||
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||
| **furumi-server** | [](https://ag.hexor.cy/applications/argocd/furumi-server) |
|
||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||
| **greece-notifier** | [](https://ag.hexor.cy/applications/argocd/greece-notifier) |
|
||||
| **hexound** | [](https://ag.hexor.cy/applications/argocd/hexound) |
|
||||
@@ -45,6 +48,8 @@ ArgoCD homelab project
|
||||
| **jellyfin** | [](https://ag.hexor.cy/applications/argocd/jellyfin) |
|
||||
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
||||
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
||||
| **lidarr** | [](https://ag.hexor.cy/applications/argocd/lidarr) |
|
||||
| **mtproxy** | [](https://ag.hexor.cy/applications/argocd/mtproxy) |
|
||||
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
||||
| **ollama** | [](https://ag.hexor.cy/applications/argocd/ollama) |
|
||||
| **paperless** | [](https://ag.hexor.cy/applications/argocd/paperless) |
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: furumi-dev
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: furumi-dev
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/furumi-dev
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
@@ -1,55 +0,0 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: furumi-ng-creds
|
||||
spec:
|
||||
target:
|
||||
name: furumi-ng-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
OIDC_CLIENT_ID: |-
|
||||
{{ .client_id }}
|
||||
OIDC_CLIENT_SECRET: |-
|
||||
{{ .client_secret }}
|
||||
OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-dev/
|
||||
OIDC_REDIRECT_URL: https://music-dev.hexor.cy/auth/callback
|
||||
OIDC_SESSION_SECRET: |-
|
||||
{{ .session_secret }}
|
||||
PG_STRING: |-
|
||||
postgres://furumi_dev:{{ .pg_pass }}@psql.psql.svc:5432/furumi_dev
|
||||
data:
|
||||
- secretKey: client_id
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
|
||||
property: fields[0].value
|
||||
- secretKey: client_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
|
||||
property: fields[1].value
|
||||
- secretKey: session_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
|
||||
property: fields[2].value
|
||||
- secretKey: pg_pass
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[17].value
|
||||
@@ -1,59 +0,0 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: admin-strip
|
||||
spec:
|
||||
stripPrefix:
|
||||
prefixes:
|
||||
- /admin
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: furumi-tls-ingress
|
||||
annotations:
|
||||
ingressClassName: traefik
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
acme.cert-manager.io/http01-edit-in-place: "true"
|
||||
spec:
|
||||
rules:
|
||||
- host: music-dev.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: furumi-dev-web-player
|
||||
port:
|
||||
number: 8080
|
||||
tls:
|
||||
- secretName: furumi-tls
|
||||
hosts:
|
||||
- '*.hexor.cy'
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: furumi-dev-admin-ingress
|
||||
annotations:
|
||||
ingressClassName: traefik
|
||||
traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
|
||||
spec:
|
||||
rules:
|
||||
- host: music-dev.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /admin
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: furumi-dev-metadata-agent
|
||||
port:
|
||||
number: 8090
|
||||
tls:
|
||||
- secretName: furumi-tls
|
||||
hosts:
|
||||
- '*.hexor.cy'
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- service.yaml
|
||||
- external-secrets.yaml
|
||||
- ingress.yaml
|
||||
- web-player.yaml
|
||||
- metadata-agent.yaml
|
||||
@@ -1,59 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: furumi-dev-metadata-agent
|
||||
labels:
|
||||
app: furumi-dev-metadata-agent
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: furumi-dev-metadata-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: furumi-dev-metadata-agent
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: furumi-dev-metadata-agent
|
||||
image: ultradesu/furumi-metadata-agent:dev
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: FURUMI_AGENT_DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: PG_STRING
|
||||
- name: FURUMI_AGENT_INBOX_DIR
|
||||
value: "/inbox"
|
||||
- name: FURUMI_AGENT_STORAGE_DIR
|
||||
value: "/media"
|
||||
- name: FURUMI_AGENT_OLLAMA_URL
|
||||
value: "http://ollama.ollama.svc:11434"
|
||||
- name: FURUMI_AGENT_OLLAMA_MODEL
|
||||
value: "qwen3:14b"
|
||||
- name: FURUMI_AGENT_POLL_INTERVAL_SECS
|
||||
value: "10"
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
ports:
|
||||
- name: admin-ui
|
||||
containerPort: 8090
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: library
|
||||
mountPath: /media
|
||||
- name: inbox
|
||||
mountPath: /inbox
|
||||
volumes:
|
||||
- name: library
|
||||
hostPath:
|
||||
path: /k8s/furumi-dev/library
|
||||
type: DirectoryOrCreate
|
||||
- name: inbox
|
||||
hostPath:
|
||||
path: /k8s/furumi-dev/inbox
|
||||
type: DirectoryOrCreate
|
||||
|
||||
@@ -1,32 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: furumi-dev-metadata-agent
|
||||
labels:
|
||||
app: furumi-dev-metadata-agent
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: furumi-dev-metadata-agent
|
||||
ports:
|
||||
- name: admin-ui
|
||||
protocol: TCP
|
||||
port: 8090
|
||||
targetPort: 8090
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: furumi-dev-web-player
|
||||
labels:
|
||||
app: furumi-dev-web-player
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: furumi-dev-web-player
|
||||
ports:
|
||||
- name: web-ui
|
||||
protocol: TCP
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
@@ -1,70 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: furumi-dev-web-player
|
||||
labels:
|
||||
app: furumi-dev-web-player
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: furumi-dev-web-player
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: furumi-dev-web-player
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: furumi-dev-web-player
|
||||
image: ultradesu/furumi-web-player:dev
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: FURUMI_PLAYER_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_ID
|
||||
- name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_SECRET
|
||||
- name: FURUMI_PLAYER_OIDC_ISSUER_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_ISSUER_URL
|
||||
- name: FURUMI_PLAYER_OIDC_REDIRECT_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_REDIRECT_URL
|
||||
- name: FURUMI_PLAYER_OIDC_SESSION_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_SESSION_SECRET
|
||||
- name: FURUMI_PLAYER_DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: PG_STRING
|
||||
- name: FURUMI_PLAYER_STORAGE_DIR
|
||||
value: "/media"
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
ports:
|
||||
- name: web-ui
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: music
|
||||
mountPath: /media
|
||||
volumes:
|
||||
- name: music
|
||||
hostPath:
|
||||
path: /k8s/furumi-dev/library
|
||||
type: DirectoryOrCreate
|
||||
|
||||
@@ -18,43 +18,13 @@ spec:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: furumi-server
|
||||
image: ultradesu/furumi-server:trunk
|
||||
image: ultradesu/furumi-server:latest
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: FURUMI_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: TOKEN
|
||||
- name: FURUMI_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_ID
|
||||
- name: FURUMI_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_SECRET
|
||||
- name: FURUMI_OIDC_ISSUER_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_ISSUER_URL
|
||||
- name: FURUMI_OIDC_REDIRECT_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_REDIRECT_URL
|
||||
- name: FURUMI_OIDC_SESSION_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_SESSION_SECRET
|
||||
value: "f38387266e75effe891b7953eb9c06b4"
|
||||
- name: FURUMI_ROOT
|
||||
value: "/media"
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: 50051
|
||||
@@ -62,9 +32,6 @@ spec:
|
||||
- name: metrics
|
||||
containerPort: 9090
|
||||
protocol: TCP
|
||||
- name: web-ui
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: music
|
||||
mountPath: /media
|
||||
|
||||
@@ -1,65 +0,0 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: furumi-ng-creds
|
||||
spec:
|
||||
target:
|
||||
name: furumi-ng-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
TOKEN: |-
|
||||
{{ .token }}
|
||||
OIDC_CLIENT_ID: |-
|
||||
{{ .client_id }}
|
||||
OIDC_CLIENT_SECRET: |-
|
||||
{{ .client_secret }}
|
||||
OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-ng-web/
|
||||
OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
|
||||
OIDC_SESSION_SECRET: |-
|
||||
{{ .session_secret }}
|
||||
PG_STRING: |-
|
||||
postgres://furumi:{{ .pg_pass }}@psql.psql.svc:5432/furumi
|
||||
data:
|
||||
- secretKey: token
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[0].value
|
||||
- secretKey: client_id
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[1].value
|
||||
- secretKey: client_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[2].value
|
||||
- secretKey: session_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[3].value
|
||||
- secretKey: pg_pass
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[16].value
|
||||
@@ -1,59 +0,0 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: admin-strip
|
||||
spec:
|
||||
stripPrefix:
|
||||
prefixes:
|
||||
- /admin
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: furumi-tls-ingress
|
||||
annotations:
|
||||
ingressClassName: traefik
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
acme.cert-manager.io/http01-edit-in-place: "true"
|
||||
spec:
|
||||
rules:
|
||||
- host: music.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: furumi-web-player
|
||||
port:
|
||||
number: 8080
|
||||
tls:
|
||||
- secretName: furumi-tls
|
||||
hosts:
|
||||
- '*.hexor.cy'
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: furumi-admin-ingress
|
||||
annotations:
|
||||
ingressClassName: traefik
|
||||
traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
|
||||
spec:
|
||||
rules:
|
||||
- host: music.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /admin
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: furumi-metadata-agent
|
||||
port:
|
||||
number: 8090
|
||||
tls:
|
||||
- secretName: furumi-tls
|
||||
hosts:
|
||||
- '*.hexor.cy'
|
||||
@@ -6,7 +6,3 @@ resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- servicemonitor.yaml
|
||||
- external-secrets.yaml
|
||||
- ingress.yaml
|
||||
- web-player.yaml
|
||||
- metadata-agent.yaml
|
||||
|
||||
@@ -1,59 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: furumi-metadata-agent
|
||||
labels:
|
||||
app: furumi-metadata-agent
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: furumi-metadata-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: furumi-metadata-agent
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: furumi-metadata-agent
|
||||
image: ultradesu/furumi-metadata-agent:trunk
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: FURUMI_AGENT_DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: PG_STRING
|
||||
- name: FURUMI_AGENT_INBOX_DIR
|
||||
value: "/inbox"
|
||||
- name: FURUMI_AGENT_STORAGE_DIR
|
||||
value: "/media"
|
||||
- name: FURUMI_AGENT_OLLAMA_URL
|
||||
value: "http://ollama.ollama.svc:11434"
|
||||
- name: FURUMI_AGENT_OLLAMA_MODEL
|
||||
value: "qwen3.5:9b"
|
||||
- name: FURUMI_AGENT_POLL_INTERVAL_SECS
|
||||
value: "10"
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
ports:
|
||||
- name: admin-ui
|
||||
containerPort: 8090
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: library
|
||||
mountPath: /media
|
||||
- name: inbox
|
||||
mountPath: /inbox
|
||||
volumes:
|
||||
- name: library
|
||||
hostPath:
|
||||
path: /k8s/furumi/library
|
||||
type: DirectoryOrCreate
|
||||
- name: inbox
|
||||
hostPath:
|
||||
path: /k8s/furumi/inbox
|
||||
type: DirectoryOrCreate
|
||||
|
||||
@@ -28,35 +28,3 @@ spec:
|
||||
protocol: TCP
|
||||
port: 9090
|
||||
targetPort: 9090
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: furumi-metadata-agent
|
||||
labels:
|
||||
app: furumi-metadata-agent
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: furumi-metadata-agent
|
||||
ports:
|
||||
- name: admin-ui
|
||||
protocol: TCP
|
||||
port: 8090
|
||||
targetPort: 8090
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: furumi-web-player
|
||||
labels:
|
||||
app: furumi-web-player
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: furumi-web-player
|
||||
ports:
|
||||
- name: web-ui
|
||||
protocol: TCP
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
|
||||
@@ -1,70 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: furumi-web-player
|
||||
labels:
|
||||
app: furumi-web-player
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: furumi-web-player
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: furumi-web-player
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: furumi-web-player
|
||||
image: ultradesu/furumi-web-player:trunk
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: FURUMI_PLAYER_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_ID
|
||||
- name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_SECRET
|
||||
- name: FURUMI_PLAYER_OIDC_ISSUER_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_ISSUER_URL
|
||||
- name: FURUMI_PLAYER_OIDC_REDIRECT_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_REDIRECT_URL
|
||||
- name: FURUMI_PLAYER_OIDC_SESSION_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_SESSION_SECRET
|
||||
- name: FURUMI_PLAYER_DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: PG_STRING
|
||||
- name: FURUMI_PLAYER_STORAGE_DIR
|
||||
value: "/media"
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
ports:
|
||||
- name: web-ui
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: music
|
||||
mountPath: /media
|
||||
volumes:
|
||||
- name: music
|
||||
hostPath:
|
||||
path: /k8s/furumi/library
|
||||
type: DirectoryOrCreate
|
||||
|
||||
@@ -77,6 +77,101 @@ spec:
|
||||
labels:
|
||||
app: gitea-runner
|
||||
spec:
|
||||
#nodeSelector:
|
||||
# kubernetes.io/hostname: home.homenet
|
||||
volumes:
|
||||
- name: docker-sock
|
||||
hostPath:
|
||||
path: /var/run/docker.sock
|
||||
type: Socket
|
||||
- name: runner-data
|
||||
emptyDir:
|
||||
sizeLimit: 30Gi
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 1
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- home.homenet
|
||||
- weight: 2
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- master.tail2fe2d.ts.net
|
||||
- weight: 3
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- it.tail2fe2d.ts.net
|
||||
- ch.tail2fe2d.ts.net
|
||||
- us.tail2fe2d.ts.net
|
||||
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- home.homenet
|
||||
- it.tail2fe2d.ts.net
|
||||
- ch.tail2fe2d.ts.net
|
||||
- us.tail2fe2d.ts.net
|
||||
- master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: gitea-runner
|
||||
image: gitea/act_runner:nightly
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
ephemeral-storage: "1Gi" # reserve ephemeral storage
|
||||
limits:
|
||||
cpu: "3000m"
|
||||
memory: "4Gi"
|
||||
ephemeral-storage: "28Gi" # hard cap for /data usage
|
||||
volumeMounts:
|
||||
- name: docker-sock
|
||||
mountPath: /var/run/docker.sock
|
||||
- name: runner-data
|
||||
mountPath: /data
|
||||
env:
|
||||
- name: GITEA_INSTANCE_URL
|
||||
value: "https://gt.hexor.cy"
|
||||
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-runner-act-runner-secrets
|
||||
key: token
|
||||
- name: GITEA_RUNNER_NAME
|
||||
value: "k8s-runner"
|
||||
- name: GITEA_RUNNER_LABELS
|
||||
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
|
||||
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: gitea-runner-desktop
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: gitea-runner-desktop
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: gitea-runner-desktop
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
@@ -90,39 +185,6 @@ spec:
|
||||
- name: runner-data
|
||||
emptyDir:
|
||||
sizeLimit: 30Gi
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- uk-desktop.tail2fe2d.ts.net
|
||||
- weight: 50
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- home.homenet
|
||||
- weight: 30
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- master.tail2fe2d.ts.net
|
||||
- weight: 10
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- it.tail2fe2d.ts.net
|
||||
- ch.tail2fe2d.ts.net
|
||||
- us.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: gitea-runner
|
||||
image: gitea/act_runner:nightly
|
||||
@@ -149,6 +211,6 @@ spec:
|
||||
name: gitea-runner-act-runner-secrets
|
||||
key: token
|
||||
- name: GITEA_RUNNER_NAME
|
||||
value: "k8s-runner"
|
||||
value: "k8s-runner-desktop"
|
||||
- name: GITEA_RUNNER_LABELS
|
||||
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: matrix
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: apps
|
||||
destination:
|
||||
namespace: matrix
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/apps/matrix
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
@@ -1,95 +0,0 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: matrix-postgres-creds
|
||||
spec:
|
||||
target:
|
||||
name: matrix-postgres-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
synapse_db_password: |-
|
||||
{{ .synapse_db_password }}
|
||||
mas_db_password: |-
|
||||
{{ .mas_db_password }}
|
||||
data:
|
||||
- secretKey: synapse_db_password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[14].value
|
||||
- secretKey: mas_db_password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[15].value
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: matrix-oidc-config
|
||||
spec:
|
||||
target:
|
||||
name: matrix-oidc-config
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
mas-oidc.yaml: |
|
||||
upstream_oauth2:
|
||||
providers:
|
||||
- id: 001KKV4EKY7KG98W2M9T806K6A
|
||||
human_name: Authentik
|
||||
issuer: https://idm.hexor.cy/application/o/matrix/
|
||||
client_id: "{{ .oauth_client_id }}"
|
||||
client_secret: "{{ .oauth_client_secret }}"
|
||||
token_endpoint_auth_method: client_secret_post
|
||||
scope: "openid profile email"
|
||||
claims_imports:
|
||||
localpart:
|
||||
action: suggest
|
||||
template: "{{ `{{ user.preferred_username | split(\"@\") | first }}` }}"
|
||||
displayname:
|
||||
action: suggest
|
||||
template: "{{ `{{ user.name }}` }}"
|
||||
email:
|
||||
action: suggest
|
||||
template: "{{ `{{ user.email }}` }}"
|
||||
set_email_verification: always
|
||||
data:
|
||||
- secretKey: oauth_client_id
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
|
||||
property: fields[0].value
|
||||
- secretKey: oauth_client_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
|
||||
property: fields[1].value
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- external-secrets.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: matrix-stack
|
||||
repo: oci://ghcr.io/element-hq/ess-helm
|
||||
version: 26.2.3
|
||||
releaseName: matrix-stack
|
||||
namespace: matrix
|
||||
valuesFile: matrix-stack-values.yaml
|
||||
includeCRDs: true
|
||||
@@ -1,112 +0,0 @@
|
||||
## Matrix server name - appears in @user:matrix.hexor.cy
|
||||
serverName: matrix.hexor.cy
|
||||
|
||||
## Use letsencrypt cluster issuer for all ingresses
|
||||
certManager:
|
||||
clusterIssuer: letsencrypt
|
||||
|
||||
## Global ingress settings
|
||||
ingress:
|
||||
className: traefik
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
|
||||
## Disable built-in PostgreSQL - using external database
|
||||
postgres:
|
||||
enabled: false
|
||||
|
||||
## Disable components we don't need yet
|
||||
hookshot:
|
||||
enabled: false
|
||||
|
||||
## MatrixRTC - voice/video calls via LiveKit SFU
|
||||
matrixRTC:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: livekit.matrix.hexor.cy
|
||||
sfu:
|
||||
enabled: true
|
||||
manualIP: "138.201.61.182"
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
exposedServices:
|
||||
rtcTcp:
|
||||
enabled: true
|
||||
port: 30881
|
||||
rtcMuxedUdp:
|
||||
enabled: true
|
||||
port: 30882
|
||||
turnTLS:
|
||||
enabled: true
|
||||
port: 31443
|
||||
domain: turn.matrix.hexor.cy
|
||||
tlsTerminationOnPod: true
|
||||
|
||||
## Synapse homeserver
|
||||
synapse:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: synapse.matrix.hexor.cy
|
||||
postgres:
|
||||
host: psql.psql.svc
|
||||
port: 5432
|
||||
user: synapse
|
||||
database: synapse
|
||||
sslMode: prefer
|
||||
password:
|
||||
secret: matrix-postgres-creds
|
||||
secretKey: synapse_db_password
|
||||
media:
|
||||
storage:
|
||||
size: 20Gi
|
||||
maxUploadSize: 100M
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Matrix Authentication Service
|
||||
matrixAuthenticationService:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: auth.matrix.hexor.cy
|
||||
postgres:
|
||||
host: psql.psql.svc
|
||||
port: 5432
|
||||
user: mas
|
||||
database: mas
|
||||
sslMode: prefer
|
||||
password:
|
||||
secret: matrix-postgres-creds
|
||||
secretKey: mas_db_password
|
||||
## Admin policy
|
||||
additional:
|
||||
0-admin-policy:
|
||||
config: |
|
||||
policy:
|
||||
data:
|
||||
admin_users:
|
||||
- username: ultradesu
|
||||
1-oidc:
|
||||
configSecret: matrix-oidc-config
|
||||
configSecretKey: mas-oidc.yaml
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Element Web client
|
||||
elementWeb:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: chat.matrix.hexor.cy
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Element Admin panel
|
||||
elementAdmin:
|
||||
enabled: true
|
||||
ingress:
|
||||
host: admin.matrix.hexor.cy
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: nas.homenet
|
||||
|
||||
## Well-known delegation on the base domain (host is derived from serverName)
|
||||
wellKnownDelegation:
|
||||
enabled: true
|
||||
@@ -4,7 +4,6 @@ kind: Kustomization
|
||||
resources:
|
||||
- external-secrets.yaml
|
||||
- local-pv.yaml
|
||||
- open-terminal.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: ollama
|
||||
@@ -16,7 +15,7 @@ helmCharts:
|
||||
includeCRDs: true
|
||||
- name: open-webui
|
||||
repo: https://helm.openwebui.com/
|
||||
version: 12.10.0
|
||||
version: 12.8.1
|
||||
releaseName: openweb-ui
|
||||
namespace: ollama
|
||||
valuesFile: openweb-ui-values.yaml
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: open-terminal
|
||||
labels:
|
||||
app: open-terminal
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: open-terminal
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: open-terminal
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: desktop
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: open-terminal
|
||||
image: ghcr.io/open-webui/open-terminal:latest
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
env:
|
||||
- name: OPEN_TERMINAL_API_KEY
|
||||
value: "LOCAL_ACCESS_TOKEN"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 2Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: open-terminal
|
||||
labels:
|
||||
app: open-terminal
|
||||
spec:
|
||||
selector:
|
||||
app: open-terminal
|
||||
ports:
|
||||
- port: 8000
|
||||
targetPort: 8000
|
||||
protocol: TCP
|
||||
@@ -5,7 +5,6 @@ resources:
|
||||
- app.yaml
|
||||
- external-secrets.yaml
|
||||
- https-middleware.yaml
|
||||
- outpost-selector-fix.yaml
|
||||
# - worker-restart.yaml
|
||||
|
||||
helmCharts:
|
||||
|
||||
@@ -1,81 +0,0 @@
|
||||
## Workaround for authentik bug: embedded outpost controller creates
|
||||
## a Service with selectors that don't match the pod labels it sets.
|
||||
## Remove this after upgrading to a version with the fix.
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: outpost-selector-fix
|
||||
namespace: authentik
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: outpost-selector-fix
|
||||
namespace: authentik
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services"]
|
||||
verbs: ["get", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["endpoints"]
|
||||
verbs: ["get"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: outpost-selector-fix
|
||||
namespace: authentik
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: outpost-selector-fix
|
||||
namespace: authentik
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: outpost-selector-fix
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: outpost-selector-fix
|
||||
namespace: authentik
|
||||
spec:
|
||||
schedule: "* * * * *"
|
||||
successfulJobsHistoryLimit: 1
|
||||
failedJobsHistoryLimit: 3
|
||||
concurrencyPolicy: Replace
|
||||
jobTemplate:
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 300
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: outpost-selector-fix
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: fix
|
||||
image: bitnami/kubectl:latest
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
SVC="ak-outpost-authentik-embedded-outpost"
|
||||
# check if endpoints are populated
|
||||
ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
|
||||
if [ -n "$ADDRS" ]; then
|
||||
echo "Endpoints OK ($ADDRS), nothing to fix"
|
||||
exit 0
|
||||
fi
|
||||
echo "No endpoints for $SVC, patching selector..."
|
||||
kubectl patch svc "$SVC" -n authentik --type=json -p '[
|
||||
{"op":"remove","path":"/spec/selector/app.kubernetes.io~1component"},
|
||||
{"op":"replace","path":"/spec/selector/app.kubernetes.io~1name","value":"authentik-outpost-proxy"}
|
||||
]'
|
||||
echo "Patched. Verifying..."
|
||||
sleep 2
|
||||
ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
|
||||
if [ -n "$ADDRS" ]; then
|
||||
echo "Fix confirmed, endpoints: $ADDRS"
|
||||
else
|
||||
echo "WARNING: still no endpoints after patch"
|
||||
exit 1
|
||||
fi
|
||||
@@ -54,6 +54,19 @@ server:
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
hosts:
|
||||
- idm.hexor.cy
|
||||
- nas.hexor.cy # TrueNAS Limassol
|
||||
- nc.hexor.cy # NaxtCloud
|
||||
- of.hexor.cy # Outfleet-v2
|
||||
- k8s.hexor.cy # k8s dashboard
|
||||
- qbt.hexor.cy # qBittorent for Jellyfin
|
||||
- prom.hexor.cy # Prometheus
|
||||
- khm.hexor.cy # Known Hosts keys Manager
|
||||
- backup.hexor.cy # Kopia Backup UI
|
||||
- fm.hexor.cy # Filemanager
|
||||
- minecraft.hexor.cy # Minecraft UI and server
|
||||
- pass.hexor.cy # k8s-secret for openai
|
||||
- ps.hexor.cy # pasarguard UI
|
||||
# - rw.hexor.cy # RemnaWave UI
|
||||
tls:
|
||||
- secretName: idm-tls
|
||||
hosts:
|
||||
|
||||
@@ -37,5 +37,4 @@ spec:
|
||||
dnsZones:
|
||||
- "ps.hexor.cy"
|
||||
- "of.hexor.cy"
|
||||
- "matrix.hexor.cy"
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ resources:
|
||||
helmCharts:
|
||||
- name: cert-manager
|
||||
repo: https://charts.jetstack.io
|
||||
version: 1.20.0
|
||||
version: 1.19.1
|
||||
releaseName: cert-manager
|
||||
namespace: cert-manager
|
||||
valuesFile: values.yaml
|
||||
|
||||
@@ -127,14 +127,6 @@ spec:
|
||||
{{ .mmdl }}
|
||||
USER_n8n: |-
|
||||
{{ .n8n }}
|
||||
USER_synapse: |-
|
||||
{{ .synapse }}
|
||||
USER_mas: |-
|
||||
{{ .mas }}
|
||||
USER_furumi: |-
|
||||
{{ .furumi }}
|
||||
USER_furumi_dev: |-
|
||||
{{ .furumi_dev }}
|
||||
data:
|
||||
- secretKey: authentik
|
||||
sourceRef:
|
||||
@@ -279,48 +271,4 @@ spec:
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[13].value
|
||||
- secretKey: synapse
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[14].value
|
||||
- secretKey: mas
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[15].value
|
||||
- secretKey: furumi
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[16].value
|
||||
- secretKey: furumi_dev
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[17].value
|
||||
|
||||
|
||||
23
terraform/authentik/.claude/settings.local.json
Normal file
23
terraform/authentik/.claude/settings.local.json
Normal file
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"permissions": {
|
||||
"allow": [
|
||||
"WebSearch",
|
||||
"WebFetch(domain:registry.terraform.io)",
|
||||
"Bash(C:UsersabAppDataLocalMicrosoftWinGetPackagesHashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbweterraform.exe apply -auto-approve)",
|
||||
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -auto-approve)",
|
||||
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -auto-approve -lock=false)",
|
||||
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" plan -lock=false)",
|
||||
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -replace=\"authentik_outpost.outposts[\"\"kubernetes-outpost\"\"]\" -auto-approve -lock=false)",
|
||||
"Bash(terraform plan:*)",
|
||||
"Bash(terraform state:*)",
|
||||
"Bash(TF_VAR_authentik_token=ZDTbu4OKl0UcmdYKG5XgkRThZO7vWX2xz0w5vP2d8sudIr44ccwKOby6iRUa terraform plan:*)",
|
||||
"Bash(TF_VAR_authentik_token=ZDTbu4OKl0UcmdYKG5XgkRThZO7vWX2xz0w5vP2d8sudIr44ccwKOby6iRUa terraform force-unlock:*)",
|
||||
"Bash(git:*)",
|
||||
"Bash(TF_VAR_authentik_token=ZDTbu4OKl0UcmdYKG5XgkRThZO7vWX2xz0w5vP2d8sudIr44ccwKOby6iRUa terraform state:*)",
|
||||
"Bash(terraform version:*)",
|
||||
"Bash(curl:*)"
|
||||
],
|
||||
"deny": [],
|
||||
"ask": []
|
||||
}
|
||||
}
|
||||
@@ -292,60 +292,7 @@ resource "authentik_outpost" "outposts" {
|
||||
authentik_host_browser = ""
|
||||
object_naming_template = "ak-outpost-%(name)s"
|
||||
authentik_host_insecure = false
|
||||
kubernetes_json_patches = {
|
||||
deployment = [
|
||||
{
|
||||
op = "add"
|
||||
path = "/spec/template/spec/containers/0/env/-"
|
||||
value = {
|
||||
name = "AUTHENTIK_POSTGRESQL__HOST"
|
||||
value = "psql.psql.svc"
|
||||
}
|
||||
},
|
||||
{
|
||||
op = "add"
|
||||
path = "/spec/template/spec/containers/0/env/-"
|
||||
value = {
|
||||
name = "AUTHENTIK_POSTGRESQL__PORT"
|
||||
value = "5432"
|
||||
}
|
||||
},
|
||||
{
|
||||
op = "add"
|
||||
path = "/spec/template/spec/containers/0/env/-"
|
||||
value = {
|
||||
name = "AUTHENTIK_POSTGRESQL__NAME"
|
||||
value = "authentik"
|
||||
}
|
||||
},
|
||||
{
|
||||
op = "add"
|
||||
path = "/spec/template/spec/containers/0/env/-"
|
||||
value = {
|
||||
name = "AUTHENTIK_POSTGRESQL__USER"
|
||||
valueFrom = {
|
||||
secretKeyRef = {
|
||||
name = "authentik-creds"
|
||||
key = "AUTHENTIK_POSTGRESQL__USER"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
op = "add"
|
||||
path = "/spec/template/spec/containers/0/env/-"
|
||||
value = {
|
||||
name = "AUTHENTIK_POSTGRESQL__PASSWORD"
|
||||
valueFrom = {
|
||||
secretKeyRef = {
|
||||
name = "authentik-creds"
|
||||
key = "AUTHENTIK_POSTGRESQL__PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
kubernetes_json_patches = null
|
||||
kubernetes_service_type = "ClusterIP"
|
||||
kubernetes_image_pull_secrets = []
|
||||
kubernetes_ingress_class_name = null
|
||||
|
||||
@@ -188,45 +188,5 @@ oauth_applications = {
|
||||
create_group = true
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
"matrix" = {
|
||||
name = "Matrix Chat"
|
||||
slug = "matrix"
|
||||
group = "Tools"
|
||||
meta_description = "Matrix Chat"
|
||||
meta_icon = "https://img.icons8.com/ios/100/40C057/matrix-logo.png"
|
||||
redirect_uris = [
|
||||
"https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A",
|
||||
]
|
||||
meta_launch_url = "https://chat.matrix.hexor.cy"
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = []
|
||||
create_group = false
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
"furumi-ng-web" = {
|
||||
name = "Furumi Web Player"
|
||||
slug = "furumi-ng-web"
|
||||
group = "Tools"
|
||||
meta_description = "Furumi Web Player"
|
||||
meta_icon = "https://img.icons8.com/pulsar-color/48/music.png"
|
||||
redirect_uris = [
|
||||
"https://music.hexor.cy/auth/callback",
|
||||
]
|
||||
meta_launch_url = "https://music.hexor.cy"
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = []
|
||||
create_group = true
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -151,7 +151,7 @@ EOT
|
||||
meta_icon = "https://img.icons8.com/liquid-glass/48/key.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
access_groups = ["admins", "khm"]
|
||||
access_groups = ["admins", "khm"] # Используем существующие группы
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
@@ -191,20 +191,5 @@ EOT
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
"ollama-public" = {
|
||||
name = "Ollama Public"
|
||||
slug = "ollama-public"
|
||||
group = "AI"
|
||||
external_host = "https://ollama.hexor.cy"
|
||||
internal_host = "http://ollama.ollama.svc:11434"
|
||||
internal_host_ssl_validation = false
|
||||
meta_description = ""
|
||||
meta_icon = "https://img.icons8.com/external-icongeek26-outline-icongeek26/64/external-llama-animal-head-icongeek26-outline-icongeek26.png"
|
||||
mode = "proxy"
|
||||
outpost = "kubernetes-outpost"
|
||||
intercept_header_auth = true
|
||||
create_group = true
|
||||
access_groups = ["admins"]
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user