Compare commits
1 Commits
main
...
auto-updat
| Author | SHA1 | Date | |
|---|---|---|---|
|
8546cac2b2 |
@@ -25,7 +25,7 @@ jobs:
|
|||||||
uses: actions/checkout@v3
|
uses: actions/checkout@v3
|
||||||
|
|
||||||
- name: Setup Terraform
|
- name: Setup Terraform
|
||||||
uses: hashicorp/setup-terraform@v4.0.0
|
uses: hashicorp/setup-terraform@v2
|
||||||
with:
|
with:
|
||||||
cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
|
cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
|
||||||
|
|
||||||
@@ -45,7 +45,7 @@ jobs:
|
|||||||
- name: Terraform Apply
|
- name: Terraform Apply
|
||||||
env:
|
env:
|
||||||
TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
|
TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
|
||||||
run: terraform apply -input=false -auto-approve -parallelism=100
|
run: terraform apply -var-file proxy-apps.tfvars -var-file oauth2-apps.tfvars -var-file terraform.tfvars -var-file groups.tfvars -input=false -auto-approve -parallelism=100
|
||||||
working-directory: ./terraform/authentik
|
working-directory: ./terraform/authentik
|
||||||
|
|
||||||
- name: Generate Wiki Content
|
- name: Generate Wiki Content
|
||||||
|
|||||||
1
.gitignore
vendored
1
.gitignore
vendored
@@ -13,7 +13,6 @@ crash.*.log
|
|||||||
*.tfvars
|
*.tfvars
|
||||||
*.tfvars.json
|
*.tfvars.json
|
||||||
!*terraform.tfvars
|
!*terraform.tfvars
|
||||||
!*.auto.tfvars
|
|
||||||
|
|
||||||
# claude ai
|
# claude ai
|
||||||
.claude/
|
.claude/
|
||||||
|
|||||||
@@ -16,6 +16,7 @@ ArgoCD homelab project
|
|||||||
| **authentik** | [](https://ag.hexor.cy/applications/argocd/authentik) |
|
| **authentik** | [](https://ag.hexor.cy/applications/argocd/authentik) |
|
||||||
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
| **cert-manager** | [](https://ag.hexor.cy/applications/argocd/cert-manager) |
|
||||||
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
| **external-secrets** | [](https://ag.hexor.cy/applications/argocd/external-secrets) |
|
||||||
|
| **gpu** | [](https://ag.hexor.cy/applications/argocd/gpu) |
|
||||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||||
@@ -37,6 +38,7 @@ ArgoCD homelab project
|
|||||||
|
|
||||||
| Application | Status |
|
| Application | Status |
|
||||||
| :--- | :---: |
|
| :--- | :---: |
|
||||||
|
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||||
| **greece-notifier** | [](https://ag.hexor.cy/applications/argocd/greece-notifier) |
|
| **greece-notifier** | [](https://ag.hexor.cy/applications/argocd/greece-notifier) |
|
||||||
| **hexound** | [](https://ag.hexor.cy/applications/argocd/hexound) |
|
| **hexound** | [](https://ag.hexor.cy/applications/argocd/hexound) |
|
||||||
@@ -45,6 +47,7 @@ ArgoCD homelab project
|
|||||||
| **jellyfin** | [](https://ag.hexor.cy/applications/argocd/jellyfin) |
|
| **jellyfin** | [](https://ag.hexor.cy/applications/argocd/jellyfin) |
|
||||||
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
||||||
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
||||||
|
| **mtproxy** | [](https://ag.hexor.cy/applications/argocd/mtproxy) |
|
||||||
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
||||||
| **ollama** | [](https://ag.hexor.cy/applications/argocd/ollama) |
|
| **ollama** | [](https://ag.hexor.cy/applications/argocd/ollama) |
|
||||||
| **paperless** | [](https://ag.hexor.cy/applications/argocd/paperless) |
|
| **paperless** | [](https://ag.hexor.cy/applications/argocd/paperless) |
|
||||||
|
|||||||
@@ -1,20 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: furumi-dev
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: apps
|
|
||||||
destination:
|
|
||||||
namespace: furumi-dev
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
source:
|
|
||||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
|
||||||
targetRevision: HEAD
|
|
||||||
path: k8s/apps/furumi-dev
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
selfHeal: true
|
|
||||||
prune: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
spec:
|
|
||||||
target:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
deletionPolicy: Delete
|
|
||||||
template:
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
OIDC_CLIENT_ID: |-
|
|
||||||
{{ .client_id }}
|
|
||||||
OIDC_CLIENT_SECRET: |-
|
|
||||||
{{ .client_secret }}
|
|
||||||
OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-dev/
|
|
||||||
OIDC_REDIRECT_URL: https://music-dev.hexor.cy/auth/callback
|
|
||||||
OIDC_SESSION_SECRET: |-
|
|
||||||
{{ .session_secret }}
|
|
||||||
PG_STRING: |-
|
|
||||||
postgres://furumi_dev:{{ .pg_pass }}@psql.psql.svc:5432/furumi_dev
|
|
||||||
data:
|
|
||||||
- secretKey: client_id
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
|
|
||||||
property: fields[0].value
|
|
||||||
- secretKey: client_secret
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
|
|
||||||
property: fields[1].value
|
|
||||||
- secretKey: session_secret
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
|
|
||||||
property: fields[2].value
|
|
||||||
- secretKey: pg_pass
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
|
||||||
property: fields[17].value
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: Middleware
|
|
||||||
metadata:
|
|
||||||
name: admin-strip
|
|
||||||
spec:
|
|
||||||
stripPrefix:
|
|
||||||
prefixes:
|
|
||||||
- /admin
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: furumi-tls-ingress
|
|
||||||
annotations:
|
|
||||||
ingressClassName: traefik
|
|
||||||
cert-manager.io/cluster-issuer: letsencrypt
|
|
||||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
|
||||||
acme.cert-manager.io/http01-edit-in-place: "true"
|
|
||||||
spec:
|
|
||||||
rules:
|
|
||||||
- host: music-dev.hexor.cy
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: furumi-dev-web-player
|
|
||||||
port:
|
|
||||||
number: 8080
|
|
||||||
tls:
|
|
||||||
- secretName: furumi-tls
|
|
||||||
hosts:
|
|
||||||
- '*.hexor.cy'
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: furumi-dev-admin-ingress
|
|
||||||
annotations:
|
|
||||||
ingressClassName: traefik
|
|
||||||
traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
|
|
||||||
spec:
|
|
||||||
rules:
|
|
||||||
- host: music-dev.hexor.cy
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- path: /admin
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: furumi-dev-metadata-agent
|
|
||||||
port:
|
|
||||||
number: 8090
|
|
||||||
tls:
|
|
||||||
- secretName: furumi-tls
|
|
||||||
hosts:
|
|
||||||
- '*.hexor.cy'
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- app.yaml
|
|
||||||
- service.yaml
|
|
||||||
- external-secrets.yaml
|
|
||||||
- ingress.yaml
|
|
||||||
- web-player.yaml
|
|
||||||
- metadata-agent.yaml
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: furumi-dev-metadata-agent
|
|
||||||
labels:
|
|
||||||
app: furumi-dev-metadata-agent
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: furumi-dev-metadata-agent
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: furumi-dev-metadata-agent
|
|
||||||
spec:
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
|
||||||
containers:
|
|
||||||
- name: furumi-dev-metadata-agent
|
|
||||||
image: ultradesu/furumi-metadata-agent:dev
|
|
||||||
imagePullPolicy: Always
|
|
||||||
env:
|
|
||||||
- name: FURUMI_AGENT_DATABASE_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: PG_STRING
|
|
||||||
- name: FURUMI_AGENT_INBOX_DIR
|
|
||||||
value: "/inbox"
|
|
||||||
- name: FURUMI_AGENT_STORAGE_DIR
|
|
||||||
value: "/media"
|
|
||||||
- name: FURUMI_AGENT_OLLAMA_URL
|
|
||||||
value: "http://ollama.ollama.svc:11434"
|
|
||||||
- name: FURUMI_AGENT_OLLAMA_MODEL
|
|
||||||
value: "qwen3:14b"
|
|
||||||
- name: FURUMI_AGENT_POLL_INTERVAL_SECS
|
|
||||||
value: "10"
|
|
||||||
- name: RUST_LOG
|
|
||||||
value: "info"
|
|
||||||
ports:
|
|
||||||
- name: admin-ui
|
|
||||||
containerPort: 8090
|
|
||||||
protocol: TCP
|
|
||||||
volumeMounts:
|
|
||||||
- name: library
|
|
||||||
mountPath: /media
|
|
||||||
- name: inbox
|
|
||||||
mountPath: /inbox
|
|
||||||
volumes:
|
|
||||||
- name: library
|
|
||||||
hostPath:
|
|
||||||
path: /k8s/furumi-dev/library
|
|
||||||
type: DirectoryOrCreate
|
|
||||||
- name: inbox
|
|
||||||
hostPath:
|
|
||||||
path: /k8s/furumi-dev/inbox
|
|
||||||
type: DirectoryOrCreate
|
|
||||||
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: furumi-dev-metadata-agent
|
|
||||||
labels:
|
|
||||||
app: furumi-dev-metadata-agent
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
selector:
|
|
||||||
app: furumi-dev-metadata-agent
|
|
||||||
ports:
|
|
||||||
- name: admin-ui
|
|
||||||
protocol: TCP
|
|
||||||
port: 8090
|
|
||||||
targetPort: 8090
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: furumi-dev-web-player
|
|
||||||
labels:
|
|
||||||
app: furumi-dev-web-player
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
selector:
|
|
||||||
app: furumi-dev-web-player
|
|
||||||
ports:
|
|
||||||
- name: web-ui
|
|
||||||
protocol: TCP
|
|
||||||
port: 8080
|
|
||||||
targetPort: 8080
|
|
||||||
@@ -1,70 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: furumi-dev-web-player
|
|
||||||
labels:
|
|
||||||
app: furumi-dev-web-player
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: furumi-dev-web-player
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: furumi-dev-web-player
|
|
||||||
spec:
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
|
||||||
containers:
|
|
||||||
- name: furumi-dev-web-player
|
|
||||||
image: ultradesu/furumi-web-player:dev
|
|
||||||
imagePullPolicy: Always
|
|
||||||
env:
|
|
||||||
- name: FURUMI_PLAYER_OIDC_CLIENT_ID
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_CLIENT_ID
|
|
||||||
- name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_CLIENT_SECRET
|
|
||||||
- name: FURUMI_PLAYER_OIDC_ISSUER_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_ISSUER_URL
|
|
||||||
- name: FURUMI_PLAYER_OIDC_REDIRECT_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_REDIRECT_URL
|
|
||||||
- name: FURUMI_PLAYER_OIDC_SESSION_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_SESSION_SECRET
|
|
||||||
- name: FURUMI_PLAYER_DATABASE_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: PG_STRING
|
|
||||||
- name: FURUMI_PLAYER_STORAGE_DIR
|
|
||||||
value: "/media"
|
|
||||||
- name: RUST_LOG
|
|
||||||
value: "info"
|
|
||||||
ports:
|
|
||||||
- name: web-ui
|
|
||||||
containerPort: 8080
|
|
||||||
protocol: TCP
|
|
||||||
volumeMounts:
|
|
||||||
- name: music
|
|
||||||
mountPath: /media
|
|
||||||
volumes:
|
|
||||||
- name: music
|
|
||||||
hostPath:
|
|
||||||
path: /k8s/furumi-dev/library
|
|
||||||
type: DirectoryOrCreate
|
|
||||||
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: furumi-server
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: apps
|
|
||||||
destination:
|
|
||||||
namespace: furumi-server
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
source:
|
|
||||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
|
||||||
targetRevision: HEAD
|
|
||||||
path: k8s/apps/furumi-server
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
selfHeal: true
|
|
||||||
prune: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,75 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: furumi-server
|
|
||||||
labels:
|
|
||||||
app: furumi-server
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: furumi-server
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: furumi-server
|
|
||||||
spec:
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
|
||||||
containers:
|
|
||||||
- name: furumi-server
|
|
||||||
image: ultradesu/furumi-server:trunk
|
|
||||||
imagePullPolicy: Always
|
|
||||||
env:
|
|
||||||
- name: FURUMI_TOKEN
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: TOKEN
|
|
||||||
- name: FURUMI_OIDC_CLIENT_ID
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_CLIENT_ID
|
|
||||||
- name: FURUMI_OIDC_CLIENT_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_CLIENT_SECRET
|
|
||||||
- name: FURUMI_OIDC_ISSUER_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_ISSUER_URL
|
|
||||||
- name: FURUMI_OIDC_REDIRECT_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_REDIRECT_URL
|
|
||||||
- name: FURUMI_OIDC_SESSION_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_SESSION_SECRET
|
|
||||||
- name: FURUMI_ROOT
|
|
||||||
value: "/media"
|
|
||||||
- name: RUST_LOG
|
|
||||||
value: "info"
|
|
||||||
ports:
|
|
||||||
- name: grpc
|
|
||||||
containerPort: 50051
|
|
||||||
protocol: TCP
|
|
||||||
- name: metrics
|
|
||||||
containerPort: 9090
|
|
||||||
protocol: TCP
|
|
||||||
- name: web-ui
|
|
||||||
containerPort: 8080
|
|
||||||
protocol: TCP
|
|
||||||
volumeMounts:
|
|
||||||
- name: music
|
|
||||||
mountPath: /media
|
|
||||||
volumes:
|
|
||||||
- name: music
|
|
||||||
hostPath:
|
|
||||||
path: /k8s/media/downloads/Lidarr_Music
|
|
||||||
type: DirectoryOrCreate
|
|
||||||
@@ -1,65 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
spec:
|
|
||||||
target:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
deletionPolicy: Delete
|
|
||||||
template:
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
TOKEN: |-
|
|
||||||
{{ .token }}
|
|
||||||
OIDC_CLIENT_ID: |-
|
|
||||||
{{ .client_id }}
|
|
||||||
OIDC_CLIENT_SECRET: |-
|
|
||||||
{{ .client_secret }}
|
|
||||||
OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-ng-web/
|
|
||||||
OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
|
|
||||||
OIDC_SESSION_SECRET: |-
|
|
||||||
{{ .session_secret }}
|
|
||||||
PG_STRING: |-
|
|
||||||
postgres://furumi:{{ .pg_pass }}@psql.psql.svc:5432/furumi
|
|
||||||
data:
|
|
||||||
- secretKey: token
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
|
||||||
property: fields[0].value
|
|
||||||
- secretKey: client_id
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
|
||||||
property: fields[1].value
|
|
||||||
- secretKey: client_secret
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
|
||||||
property: fields[2].value
|
|
||||||
- secretKey: session_secret
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
|
||||||
property: fields[3].value
|
|
||||||
- secretKey: pg_pass
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
|
||||||
property: fields[16].value
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: Middleware
|
|
||||||
metadata:
|
|
||||||
name: admin-strip
|
|
||||||
spec:
|
|
||||||
stripPrefix:
|
|
||||||
prefixes:
|
|
||||||
- /admin
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: furumi-tls-ingress
|
|
||||||
annotations:
|
|
||||||
ingressClassName: traefik
|
|
||||||
cert-manager.io/cluster-issuer: letsencrypt
|
|
||||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
|
||||||
acme.cert-manager.io/http01-edit-in-place: "true"
|
|
||||||
spec:
|
|
||||||
rules:
|
|
||||||
- host: music.hexor.cy
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: furumi-web-player
|
|
||||||
port:
|
|
||||||
number: 8080
|
|
||||||
tls:
|
|
||||||
- secretName: furumi-tls
|
|
||||||
hosts:
|
|
||||||
- '*.hexor.cy'
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: furumi-admin-ingress
|
|
||||||
annotations:
|
|
||||||
ingressClassName: traefik
|
|
||||||
traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
|
|
||||||
spec:
|
|
||||||
rules:
|
|
||||||
- host: music.hexor.cy
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- path: /admin
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: furumi-metadata-agent
|
|
||||||
port:
|
|
||||||
number: 8090
|
|
||||||
tls:
|
|
||||||
- secretName: furumi-tls
|
|
||||||
hosts:
|
|
||||||
- '*.hexor.cy'
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- app.yaml
|
|
||||||
- deployment.yaml
|
|
||||||
- service.yaml
|
|
||||||
- servicemonitor.yaml
|
|
||||||
- external-secrets.yaml
|
|
||||||
- ingress.yaml
|
|
||||||
- web-player.yaml
|
|
||||||
- metadata-agent.yaml
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: furumi-metadata-agent
|
|
||||||
labels:
|
|
||||||
app: furumi-metadata-agent
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: furumi-metadata-agent
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: furumi-metadata-agent
|
|
||||||
spec:
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
|
||||||
containers:
|
|
||||||
- name: furumi-metadata-agent
|
|
||||||
image: ultradesu/furumi-metadata-agent:trunk
|
|
||||||
imagePullPolicy: Always
|
|
||||||
env:
|
|
||||||
- name: FURUMI_AGENT_DATABASE_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: PG_STRING
|
|
||||||
- name: FURUMI_AGENT_INBOX_DIR
|
|
||||||
value: "/inbox"
|
|
||||||
- name: FURUMI_AGENT_STORAGE_DIR
|
|
||||||
value: "/media"
|
|
||||||
- name: FURUMI_AGENT_OLLAMA_URL
|
|
||||||
value: "http://ollama.ollama.svc:11434"
|
|
||||||
- name: FURUMI_AGENT_OLLAMA_MODEL
|
|
||||||
value: "qwen3.5:9b"
|
|
||||||
- name: FURUMI_AGENT_POLL_INTERVAL_SECS
|
|
||||||
value: "10"
|
|
||||||
- name: RUST_LOG
|
|
||||||
value: "info"
|
|
||||||
ports:
|
|
||||||
- name: admin-ui
|
|
||||||
containerPort: 8090
|
|
||||||
protocol: TCP
|
|
||||||
volumeMounts:
|
|
||||||
- name: library
|
|
||||||
mountPath: /media
|
|
||||||
- name: inbox
|
|
||||||
mountPath: /inbox
|
|
||||||
volumes:
|
|
||||||
- name: library
|
|
||||||
hostPath:
|
|
||||||
path: /k8s/furumi/library
|
|
||||||
type: DirectoryOrCreate
|
|
||||||
- name: inbox
|
|
||||||
hostPath:
|
|
||||||
path: /k8s/furumi/inbox
|
|
||||||
type: DirectoryOrCreate
|
|
||||||
|
|
||||||
@@ -1,62 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: furumi-server-grpc
|
|
||||||
spec:
|
|
||||||
type: LoadBalancer
|
|
||||||
selector:
|
|
||||||
app: furumi-server
|
|
||||||
ports:
|
|
||||||
- name: grpc
|
|
||||||
protocol: TCP
|
|
||||||
port: 50051
|
|
||||||
targetPort: 50051
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: furumi-server-metrics
|
|
||||||
labels:
|
|
||||||
app: furumi-server
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
selector:
|
|
||||||
app: furumi-server
|
|
||||||
ports:
|
|
||||||
- name: metrics
|
|
||||||
protocol: TCP
|
|
||||||
port: 9090
|
|
||||||
targetPort: 9090
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: furumi-metadata-agent
|
|
||||||
labels:
|
|
||||||
app: furumi-metadata-agent
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
selector:
|
|
||||||
app: furumi-metadata-agent
|
|
||||||
ports:
|
|
||||||
- name: admin-ui
|
|
||||||
protocol: TCP
|
|
||||||
port: 8090
|
|
||||||
targetPort: 8090
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: furumi-web-player
|
|
||||||
labels:
|
|
||||||
app: furumi-web-player
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
selector:
|
|
||||||
app: furumi-web-player
|
|
||||||
ports:
|
|
||||||
- name: web-ui
|
|
||||||
protocol: TCP
|
|
||||||
port: 8080
|
|
||||||
targetPort: 8080
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: monitoring.coreos.com/v1
|
|
||||||
kind: ServiceMonitor
|
|
||||||
metadata:
|
|
||||||
name: furumi-server-metrics
|
|
||||||
labels:
|
|
||||||
app: furumi-server
|
|
||||||
release: prometheus
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: furumi-server
|
|
||||||
endpoints:
|
|
||||||
- port: metrics
|
|
||||||
path: /metrics
|
|
||||||
interval: 30s
|
|
||||||
scrapeTimeout: 10s
|
|
||||||
honorLabels: true
|
|
||||||
namespaceSelector:
|
|
||||||
matchNames:
|
|
||||||
- furumi-server
|
|
||||||
@@ -1,70 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: furumi-web-player
|
|
||||||
labels:
|
|
||||||
app: furumi-web-player
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: furumi-web-player
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: furumi-web-player
|
|
||||||
spec:
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
|
||||||
containers:
|
|
||||||
- name: furumi-web-player
|
|
||||||
image: ultradesu/furumi-web-player:trunk
|
|
||||||
imagePullPolicy: Always
|
|
||||||
env:
|
|
||||||
- name: FURUMI_PLAYER_OIDC_CLIENT_ID
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_CLIENT_ID
|
|
||||||
- name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_CLIENT_SECRET
|
|
||||||
- name: FURUMI_PLAYER_OIDC_ISSUER_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_ISSUER_URL
|
|
||||||
- name: FURUMI_PLAYER_OIDC_REDIRECT_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_REDIRECT_URL
|
|
||||||
- name: FURUMI_PLAYER_OIDC_SESSION_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: OIDC_SESSION_SECRET
|
|
||||||
- name: FURUMI_PLAYER_DATABASE_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: furumi-ng-creds
|
|
||||||
key: PG_STRING
|
|
||||||
- name: FURUMI_PLAYER_STORAGE_DIR
|
|
||||||
value: "/media"
|
|
||||||
- name: RUST_LOG
|
|
||||||
value: "info"
|
|
||||||
ports:
|
|
||||||
- name: web-ui
|
|
||||||
containerPort: 8080
|
|
||||||
protocol: TCP
|
|
||||||
volumeMounts:
|
|
||||||
- name: music
|
|
||||||
mountPath: /media
|
|
||||||
volumes:
|
|
||||||
- name: music
|
|
||||||
hostPath:
|
|
||||||
path: /k8s/furumi/library
|
|
||||||
type: DirectoryOrCreate
|
|
||||||
|
|
||||||
@@ -77,11 +77,8 @@ spec:
|
|||||||
labels:
|
labels:
|
||||||
app: gitea-runner
|
app: gitea-runner
|
||||||
spec:
|
spec:
|
||||||
tolerations:
|
#nodeSelector:
|
||||||
- key: workload
|
# kubernetes.io/hostname: home.homenet
|
||||||
operator: Equal
|
|
||||||
value: desktop
|
|
||||||
effect: NoSchedule
|
|
||||||
volumes:
|
volumes:
|
||||||
- name: docker-sock
|
- name: docker-sock
|
||||||
hostPath:
|
hostPath:
|
||||||
@@ -93,28 +90,21 @@ spec:
|
|||||||
affinity:
|
affinity:
|
||||||
nodeAffinity:
|
nodeAffinity:
|
||||||
preferredDuringSchedulingIgnoredDuringExecution:
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
- weight: 100
|
- weight: 1
|
||||||
preference:
|
|
||||||
matchExpressions:
|
|
||||||
- key: kubernetes.io/hostname
|
|
||||||
operator: In
|
|
||||||
values:
|
|
||||||
- uk-desktop.tail2fe2d.ts.net
|
|
||||||
- weight: 50
|
|
||||||
preference:
|
preference:
|
||||||
matchExpressions:
|
matchExpressions:
|
||||||
- key: kubernetes.io/hostname
|
- key: kubernetes.io/hostname
|
||||||
operator: In
|
operator: In
|
||||||
values:
|
values:
|
||||||
- home.homenet
|
- home.homenet
|
||||||
- weight: 30
|
- weight: 2
|
||||||
preference:
|
preference:
|
||||||
matchExpressions:
|
matchExpressions:
|
||||||
- key: kubernetes.io/hostname
|
- key: kubernetes.io/hostname
|
||||||
operator: In
|
operator: In
|
||||||
values:
|
values:
|
||||||
- master.tail2fe2d.ts.net
|
- master.tail2fe2d.ts.net
|
||||||
- weight: 10
|
- weight: 3
|
||||||
preference:
|
preference:
|
||||||
matchExpressions:
|
matchExpressions:
|
||||||
- key: kubernetes.io/hostname
|
- key: kubernetes.io/hostname
|
||||||
@@ -123,6 +113,18 @@ spec:
|
|||||||
- it.tail2fe2d.ts.net
|
- it.tail2fe2d.ts.net
|
||||||
- ch.tail2fe2d.ts.net
|
- ch.tail2fe2d.ts.net
|
||||||
- us.tail2fe2d.ts.net
|
- us.tail2fe2d.ts.net
|
||||||
|
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
nodeSelectorTerms:
|
||||||
|
- matchExpressions:
|
||||||
|
- key: kubernetes.io/hostname
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- home.homenet
|
||||||
|
- it.tail2fe2d.ts.net
|
||||||
|
- ch.tail2fe2d.ts.net
|
||||||
|
- us.tail2fe2d.ts.net
|
||||||
|
- master.tail2fe2d.ts.net
|
||||||
containers:
|
containers:
|
||||||
- name: gitea-runner
|
- name: gitea-runner
|
||||||
image: gitea/act_runner:nightly
|
image: gitea/act_runner:nightly
|
||||||
@@ -130,11 +132,11 @@ spec:
|
|||||||
requests:
|
requests:
|
||||||
cpu: "100m"
|
cpu: "100m"
|
||||||
memory: "256Mi"
|
memory: "256Mi"
|
||||||
ephemeral-storage: "1Gi"
|
ephemeral-storage: "1Gi" # reserve ephemeral storage
|
||||||
limits:
|
limits:
|
||||||
cpu: "3000m"
|
cpu: "3000m"
|
||||||
memory: "4Gi"
|
memory: "4Gi"
|
||||||
ephemeral-storage: "28Gi"
|
ephemeral-storage: "28Gi" # hard cap for /data usage
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: docker-sock
|
- name: docker-sock
|
||||||
mountPath: /var/run/docker.sock
|
mountPath: /var/run/docker.sock
|
||||||
|
|||||||
@@ -1,20 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: lidarr
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: apps
|
|
||||||
destination:
|
|
||||||
namespace: lidarr
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
source:
|
|
||||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
|
||||||
targetRevision: HEAD
|
|
||||||
path: k8s/apps/lidarr
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
selfHeal: true
|
|
||||||
prune: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- app.yaml
|
|
||||||
|
|
||||||
helmCharts:
|
|
||||||
- name: lidarr
|
|
||||||
repo: https://k8s-home-lab.github.io/helm-charts/
|
|
||||||
version: 15.3.0
|
|
||||||
releaseName: lidarr
|
|
||||||
namespace: lidarr
|
|
||||||
valuesFile: lidarr-values.yaml
|
|
||||||
includeCRDs: true
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
env:
|
|
||||||
TZ: Asia/Nicosia
|
|
||||||
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "512Mi"
|
|
||||||
cpu: "200m"
|
|
||||||
limits:
|
|
||||||
memory: "2Gi"
|
|
||||||
cpu: "1500m"
|
|
||||||
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
|
||||||
|
|
||||||
persistence:
|
|
||||||
config:
|
|
||||||
enabled: true
|
|
||||||
type: hostPath
|
|
||||||
hostPath: /k8s/lidarr
|
|
||||||
mountPath: /config
|
|
||||||
|
|
||||||
downloads:
|
|
||||||
enabled: true
|
|
||||||
type: hostPath
|
|
||||||
hostPath: /k8s/media/downloads
|
|
||||||
mountPath: /downloads
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: matrix
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: apps
|
|
||||||
destination:
|
|
||||||
namespace: matrix
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
source:
|
|
||||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
|
||||||
targetRevision: HEAD
|
|
||||||
path: k8s/apps/matrix
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
selfHeal: true
|
|
||||||
prune: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,95 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: matrix-postgres-creds
|
|
||||||
spec:
|
|
||||||
target:
|
|
||||||
name: matrix-postgres-creds
|
|
||||||
deletionPolicy: Delete
|
|
||||||
template:
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
synapse_db_password: |-
|
|
||||||
{{ .synapse_db_password }}
|
|
||||||
mas_db_password: |-
|
|
||||||
{{ .mas_db_password }}
|
|
||||||
data:
|
|
||||||
- secretKey: synapse_db_password
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
|
||||||
property: fields[14].value
|
|
||||||
- secretKey: mas_db_password
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
|
||||||
property: fields[15].value
|
|
||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: matrix-oidc-config
|
|
||||||
spec:
|
|
||||||
target:
|
|
||||||
name: matrix-oidc-config
|
|
||||||
deletionPolicy: Delete
|
|
||||||
template:
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
mas-oidc.yaml: |
|
|
||||||
upstream_oauth2:
|
|
||||||
providers:
|
|
||||||
- id: 001KKV4EKY7KG98W2M9T806K6A
|
|
||||||
human_name: Authentik
|
|
||||||
issuer: https://idm.hexor.cy/application/o/matrix/
|
|
||||||
client_id: "{{ .oauth_client_id }}"
|
|
||||||
client_secret: "{{ .oauth_client_secret }}"
|
|
||||||
token_endpoint_auth_method: client_secret_post
|
|
||||||
scope: "openid profile email"
|
|
||||||
claims_imports:
|
|
||||||
localpart:
|
|
||||||
action: suggest
|
|
||||||
template: "{{ `{{ user.preferred_username | split(\"@\") | first }}` }}"
|
|
||||||
displayname:
|
|
||||||
action: suggest
|
|
||||||
template: "{{ `{{ user.name }}` }}"
|
|
||||||
email:
|
|
||||||
action: suggest
|
|
||||||
template: "{{ `{{ user.email }}` }}"
|
|
||||||
set_email_verification: always
|
|
||||||
data:
|
|
||||||
- secretKey: oauth_client_id
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
|
|
||||||
property: fields[0].value
|
|
||||||
- secretKey: oauth_client_secret
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
|
|
||||||
property: fields[1].value
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- app.yaml
|
|
||||||
- external-secrets.yaml
|
|
||||||
|
|
||||||
helmCharts:
|
|
||||||
- name: matrix-stack
|
|
||||||
repo: oci://ghcr.io/element-hq/ess-helm
|
|
||||||
version: 26.2.3
|
|
||||||
releaseName: matrix-stack
|
|
||||||
namespace: matrix
|
|
||||||
valuesFile: matrix-stack-values.yaml
|
|
||||||
includeCRDs: true
|
|
||||||
@@ -1,112 +0,0 @@
|
|||||||
## Matrix server name - appears in @user:matrix.hexor.cy
|
|
||||||
serverName: matrix.hexor.cy
|
|
||||||
|
|
||||||
## Use letsencrypt cluster issuer for all ingresses
|
|
||||||
certManager:
|
|
||||||
clusterIssuer: letsencrypt
|
|
||||||
|
|
||||||
## Global ingress settings
|
|
||||||
ingress:
|
|
||||||
className: traefik
|
|
||||||
annotations:
|
|
||||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
|
||||||
|
|
||||||
## Disable built-in PostgreSQL - using external database
|
|
||||||
postgres:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## Disable components we don't need yet
|
|
||||||
hookshot:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## MatrixRTC - voice/video calls via LiveKit SFU
|
|
||||||
matrixRTC:
|
|
||||||
enabled: true
|
|
||||||
ingress:
|
|
||||||
host: livekit.matrix.hexor.cy
|
|
||||||
sfu:
|
|
||||||
enabled: true
|
|
||||||
manualIP: "138.201.61.182"
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
|
||||||
exposedServices:
|
|
||||||
rtcTcp:
|
|
||||||
enabled: true
|
|
||||||
port: 30881
|
|
||||||
rtcMuxedUdp:
|
|
||||||
enabled: true
|
|
||||||
port: 30882
|
|
||||||
turnTLS:
|
|
||||||
enabled: true
|
|
||||||
port: 31443
|
|
||||||
domain: turn.matrix.hexor.cy
|
|
||||||
tlsTerminationOnPod: true
|
|
||||||
|
|
||||||
## Synapse homeserver
|
|
||||||
synapse:
|
|
||||||
enabled: true
|
|
||||||
ingress:
|
|
||||||
host: synapse.matrix.hexor.cy
|
|
||||||
postgres:
|
|
||||||
host: psql.psql.svc
|
|
||||||
port: 5432
|
|
||||||
user: synapse
|
|
||||||
database: synapse
|
|
||||||
sslMode: prefer
|
|
||||||
password:
|
|
||||||
secret: matrix-postgres-creds
|
|
||||||
secretKey: synapse_db_password
|
|
||||||
media:
|
|
||||||
storage:
|
|
||||||
size: 20Gi
|
|
||||||
maxUploadSize: 100M
|
|
||||||
# nodeSelector:
|
|
||||||
# kubernetes.io/hostname: nas.homenet
|
|
||||||
|
|
||||||
## Matrix Authentication Service
|
|
||||||
matrixAuthenticationService:
|
|
||||||
enabled: true
|
|
||||||
ingress:
|
|
||||||
host: auth.matrix.hexor.cy
|
|
||||||
postgres:
|
|
||||||
host: psql.psql.svc
|
|
||||||
port: 5432
|
|
||||||
user: mas
|
|
||||||
database: mas
|
|
||||||
sslMode: prefer
|
|
||||||
password:
|
|
||||||
secret: matrix-postgres-creds
|
|
||||||
secretKey: mas_db_password
|
|
||||||
## Admin policy
|
|
||||||
additional:
|
|
||||||
0-admin-policy:
|
|
||||||
config: |
|
|
||||||
policy:
|
|
||||||
data:
|
|
||||||
admin_users:
|
|
||||||
- username: ultradesu
|
|
||||||
1-oidc:
|
|
||||||
configSecret: matrix-oidc-config
|
|
||||||
configSecretKey: mas-oidc.yaml
|
|
||||||
# nodeSelector:
|
|
||||||
# kubernetes.io/hostname: nas.homenet
|
|
||||||
|
|
||||||
## Element Web client
|
|
||||||
elementWeb:
|
|
||||||
enabled: true
|
|
||||||
ingress:
|
|
||||||
host: chat.matrix.hexor.cy
|
|
||||||
# nodeSelector:
|
|
||||||
# kubernetes.io/hostname: nas.homenet
|
|
||||||
|
|
||||||
## Element Admin panel
|
|
||||||
elementAdmin:
|
|
||||||
enabled: true
|
|
||||||
ingress:
|
|
||||||
host: admin.matrix.hexor.cy
|
|
||||||
# nodeSelector:
|
|
||||||
# kubernetes.io/hostname: nas.homenet
|
|
||||||
|
|
||||||
## Well-known delegation on the base domain (host is derived from serverName)
|
|
||||||
wellKnownDelegation:
|
|
||||||
enabled: true
|
|
||||||
@@ -4,7 +4,6 @@ kind: Kustomization
|
|||||||
resources:
|
resources:
|
||||||
- external-secrets.yaml
|
- external-secrets.yaml
|
||||||
- local-pv.yaml
|
- local-pv.yaml
|
||||||
- open-terminal.yaml
|
|
||||||
|
|
||||||
helmCharts:
|
helmCharts:
|
||||||
- name: ollama
|
- name: ollama
|
||||||
@@ -16,7 +15,7 @@ helmCharts:
|
|||||||
includeCRDs: true
|
includeCRDs: true
|
||||||
- name: open-webui
|
- name: open-webui
|
||||||
repo: https://helm.openwebui.com/
|
repo: https://helm.openwebui.com/
|
||||||
version: 12.10.0
|
version: 12.8.1
|
||||||
releaseName: openweb-ui
|
releaseName: openweb-ui
|
||||||
namespace: ollama
|
namespace: ollama
|
||||||
valuesFile: openweb-ui-values.yaml
|
valuesFile: openweb-ui-values.yaml
|
||||||
|
|||||||
@@ -1,53 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: open-terminal
|
|
||||||
labels:
|
|
||||||
app: open-terminal
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: open-terminal
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: open-terminal
|
|
||||||
spec:
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
|
|
||||||
tolerations:
|
|
||||||
- key: workload
|
|
||||||
operator: Equal
|
|
||||||
value: desktop
|
|
||||||
effect: NoSchedule
|
|
||||||
containers:
|
|
||||||
- name: open-terminal
|
|
||||||
image: ghcr.io/open-webui/open-terminal:latest
|
|
||||||
ports:
|
|
||||||
- containerPort: 8000
|
|
||||||
env:
|
|
||||||
- name: OPEN_TERMINAL_API_KEY
|
|
||||||
value: "LOCAL_ACCESS_TOKEN"
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 256Mi
|
|
||||||
limits:
|
|
||||||
cpu: "2"
|
|
||||||
memory: 2Gi
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: open-terminal
|
|
||||||
labels:
|
|
||||||
app: open-terminal
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: open-terminal
|
|
||||||
ports:
|
|
||||||
- port: 8000
|
|
||||||
targetPort: 8000
|
|
||||||
protocol: TCP
|
|
||||||
@@ -18,5 +18,4 @@ spec:
|
|||||||
prune: true
|
prune: true
|
||||||
syncOptions:
|
syncOptions:
|
||||||
- CreateNamespace=true
|
- CreateNamespace=true
|
||||||
- ServerSideApply=true
|
|
||||||
|
|
||||||
|
|||||||
@@ -23,9 +23,6 @@ spec:
|
|||||||
name: vaultwarden-login
|
name: vaultwarden-login
|
||||||
kind: ClusterSecretStore
|
kind: ClusterSecretStore
|
||||||
remoteRef:
|
remoteRef:
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 1062e5b4-5380-49f1-97c3-340f26f3487e
|
key: 1062e5b4-5380-49f1-97c3-340f26f3487e
|
||||||
property: fields[0].value
|
property: fields[0].value
|
||||||
- secretKey: client_secret
|
- secretKey: client_secret
|
||||||
@@ -34,9 +31,6 @@ spec:
|
|||||||
name: vaultwarden-login
|
name: vaultwarden-login
|
||||||
kind: ClusterSecretStore
|
kind: ClusterSecretStore
|
||||||
remoteRef:
|
remoteRef:
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 1062e5b4-5380-49f1-97c3-340f26f3487e
|
key: 1062e5b4-5380-49f1-97c3-340f26f3487e
|
||||||
property: fields[1].value
|
property: fields[1].value
|
||||||
|
|
||||||
|
|||||||
@@ -10,7 +10,7 @@ resources:
|
|||||||
helmCharts:
|
helmCharts:
|
||||||
- name: argo-cd
|
- name: argo-cd
|
||||||
repo: https://argoproj.github.io/argo-helm
|
repo: https://argoproj.github.io/argo-helm
|
||||||
version: 9.4.10
|
version: 9.1.4
|
||||||
releaseName: argocd
|
releaseName: argocd
|
||||||
namespace: argocd
|
namespace: argocd
|
||||||
valuesFile: values.yaml
|
valuesFile: values.yaml
|
||||||
|
|||||||
@@ -28,9 +28,8 @@ configs:
|
|||||||
issuer: https://idm.hexor.cy/application/o/argocd/
|
issuer: https://idm.hexor.cy/application/o/argocd/
|
||||||
clientID: $oidc-creds:id
|
clientID: $oidc-creds:id
|
||||||
clientSecret: $oidc-creds:secret
|
clientSecret: $oidc-creds:secret
|
||||||
requestedScopes: ["openid", "profile", "email", "groups", "offline_access"]
|
requestedScopes: ["openid", "profile", "email", "groups"]
|
||||||
requestedIDTokenClaims: {"groups": {"essential": true}}
|
requestedIDTokenClaims: {"groups": {"essential": true}}
|
||||||
refreshTokenThreshold: 2m
|
|
||||||
rbac:
|
rbac:
|
||||||
create: true
|
create: true
|
||||||
policy.default: ""
|
policy.default: ""
|
||||||
|
|||||||
@@ -18,4 +18,4 @@ spec:
|
|||||||
prune: true
|
prune: true
|
||||||
syncOptions:
|
syncOptions:
|
||||||
- CreateNamespace=true
|
- CreateNamespace=true
|
||||||
- ServerSideApply=true
|
|
||||||
|
|||||||
@@ -34,9 +34,6 @@ spec:
|
|||||||
name: vaultwarden-login
|
name: vaultwarden-login
|
||||||
kind: ClusterSecretStore
|
kind: ClusterSecretStore
|
||||||
remoteRef:
|
remoteRef:
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
|
key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
|
||||||
property: login.password
|
property: login.password
|
||||||
- secretKey: username
|
- secretKey: username
|
||||||
@@ -45,9 +42,6 @@ spec:
|
|||||||
name: vaultwarden-login
|
name: vaultwarden-login
|
||||||
kind: ClusterSecretStore
|
kind: ClusterSecretStore
|
||||||
remoteRef:
|
remoteRef:
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
|
key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
|
||||||
property: login.username
|
property: login.username
|
||||||
- secretKey: secret_key
|
- secretKey: secret_key
|
||||||
@@ -56,9 +50,6 @@ spec:
|
|||||||
name: vaultwarden-login
|
name: vaultwarden-login
|
||||||
kind: ClusterSecretStore
|
kind: ClusterSecretStore
|
||||||
remoteRef:
|
remoteRef:
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
|
key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
|
||||||
property: fields[0].value
|
property: fields[0].value
|
||||||
|
|
||||||
|
|||||||
@@ -5,13 +5,12 @@ resources:
|
|||||||
- app.yaml
|
- app.yaml
|
||||||
- external-secrets.yaml
|
- external-secrets.yaml
|
||||||
- https-middleware.yaml
|
- https-middleware.yaml
|
||||||
- outpost-selector-fix.yaml
|
|
||||||
# - worker-restart.yaml
|
# - worker-restart.yaml
|
||||||
|
|
||||||
helmCharts:
|
helmCharts:
|
||||||
- name: authentik
|
- name: authentik
|
||||||
repo: https://charts.goauthentik.io
|
repo: https://charts.goauthentik.io
|
||||||
version: 2026.2.1
|
version: 2026.2.0
|
||||||
releaseName: authentik
|
releaseName: authentik
|
||||||
namespace: authentik
|
namespace: authentik
|
||||||
valuesFile: values.yaml
|
valuesFile: values.yaml
|
||||||
|
|||||||
@@ -1,81 +0,0 @@
|
|||||||
## Workaround for authentik bug: embedded outpost controller creates
|
|
||||||
## a Service with selectors that don't match the pod labels it sets.
|
|
||||||
## Remove this after upgrading to a version with the fix.
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: outpost-selector-fix
|
|
||||||
namespace: authentik
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: outpost-selector-fix
|
|
||||||
namespace: authentik
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["services"]
|
|
||||||
verbs: ["get", "patch"]
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["endpoints"]
|
|
||||||
verbs: ["get"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: outpost-selector-fix
|
|
||||||
namespace: authentik
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: outpost-selector-fix
|
|
||||||
namespace: authentik
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: outpost-selector-fix
|
|
||||||
---
|
|
||||||
apiVersion: batch/v1
|
|
||||||
kind: CronJob
|
|
||||||
metadata:
|
|
||||||
name: outpost-selector-fix
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
schedule: "* * * * *"
|
|
||||||
successfulJobsHistoryLimit: 1
|
|
||||||
failedJobsHistoryLimit: 3
|
|
||||||
concurrencyPolicy: Replace
|
|
||||||
jobTemplate:
|
|
||||||
spec:
|
|
||||||
ttlSecondsAfterFinished: 300
|
|
||||||
template:
|
|
||||||
spec:
|
|
||||||
serviceAccountName: outpost-selector-fix
|
|
||||||
restartPolicy: OnFailure
|
|
||||||
containers:
|
|
||||||
- name: fix
|
|
||||||
image: bitnami/kubectl:latest
|
|
||||||
command:
|
|
||||||
- /bin/sh
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
SVC="ak-outpost-authentik-embedded-outpost"
|
|
||||||
# check if endpoints are populated
|
|
||||||
ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
|
|
||||||
if [ -n "$ADDRS" ]; then
|
|
||||||
echo "Endpoints OK ($ADDRS), nothing to fix"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
echo "No endpoints for $SVC, patching selector..."
|
|
||||||
kubectl patch svc "$SVC" -n authentik --type=json -p '[
|
|
||||||
{"op":"remove","path":"/spec/selector/app.kubernetes.io~1component"},
|
|
||||||
{"op":"replace","path":"/spec/selector/app.kubernetes.io~1name","value":"authentik-outpost-proxy"}
|
|
||||||
]'
|
|
||||||
echo "Patched. Verifying..."
|
|
||||||
sleep 2
|
|
||||||
ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
|
|
||||||
if [ -n "$ADDRS" ]; then
|
|
||||||
echo "Fix confirmed, endpoints: $ADDRS"
|
|
||||||
else
|
|
||||||
echo "WARNING: still no endpoints after patch"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
@@ -1,6 +1,8 @@
|
|||||||
global:
|
global:
|
||||||
image:
|
image:
|
||||||
tag: "2026.2.1"
|
tag: "2025.10.1"
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||||
|
|
||||||
authentik:
|
authentik:
|
||||||
error_reporting:
|
error_reporting:
|
||||||
@@ -13,35 +15,14 @@ worker:
|
|||||||
envFrom:
|
envFrom:
|
||||||
- secretRef:
|
- secretRef:
|
||||||
name: authentik-creds
|
name: authentik-creds
|
||||||
# volumes:
|
volumes:
|
||||||
# - name: dshm
|
- name: dshm
|
||||||
# emptyDir:
|
emptyDir:
|
||||||
# medium: Memory
|
medium: Memory
|
||||||
# sizeLimit: 512Mi
|
sizeLimit: 512Mi
|
||||||
# volumeMounts:
|
volumeMounts:
|
||||||
# - name: dshm
|
- name: dshm
|
||||||
# mountPath: /dev/shm
|
mountPath: /dev/shm
|
||||||
# livenessProbe:
|
|
||||||
# exec:
|
|
||||||
# command: ["/bin/sh", "-c", "kill -0 1"]
|
|
||||||
# initialDelaySeconds: 5
|
|
||||||
# periodSeconds: 10
|
|
||||||
# failureThreshold: 3
|
|
||||||
# timeoutSeconds: 3
|
|
||||||
# readinessProbe:
|
|
||||||
# exec:
|
|
||||||
# command: ["/bin/sh", "-c", "kill -0 1"]
|
|
||||||
# initialDelaySeconds: 5
|
|
||||||
# periodSeconds: 10
|
|
||||||
# failureThreshold: 3
|
|
||||||
# timeoutSeconds: 3
|
|
||||||
# startupProbe:
|
|
||||||
# exec:
|
|
||||||
# command: ["/bin/sh", "-c", "kill -0 1"]
|
|
||||||
# initialDelaySeconds: 30
|
|
||||||
# periodSeconds: 10
|
|
||||||
# failureThreshold: 60
|
|
||||||
# timeoutSeconds: 3
|
|
||||||
server:
|
server:
|
||||||
envFrom:
|
envFrom:
|
||||||
- secretRef:
|
- secretRef:
|
||||||
@@ -54,10 +35,23 @@ server:
|
|||||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||||
hosts:
|
hosts:
|
||||||
- idm.hexor.cy
|
- idm.hexor.cy
|
||||||
|
- nas.hexor.cy # TrueNAS Limassol
|
||||||
|
- nc.hexor.cy # NaxtCloud
|
||||||
|
- of.hexor.cy # Outfleet-v2
|
||||||
|
- k8s.hexor.cy # k8s dashboard
|
||||||
|
- qbt.hexor.cy # qBittorent for Jellyfin
|
||||||
|
- prom.hexor.cy # Prometheus
|
||||||
|
- khm.hexor.cy # Known Hosts keys Manager
|
||||||
|
- backup.hexor.cy # Kopia Backup UI
|
||||||
|
- fm.hexor.cy # Filemanager
|
||||||
|
- minecraft.hexor.cy # Minecraft UI and server
|
||||||
|
- pass.hexor.cy # k8s-secret for openai
|
||||||
|
- ps.hexor.cy # pasarguard UI
|
||||||
|
# - rw.hexor.cy # RemnaWave UI
|
||||||
tls:
|
tls:
|
||||||
- secretName: idm-tls
|
- secretName: idm-tls
|
||||||
hosts:
|
hosts:
|
||||||
- '*.hexor.cy'
|
- '*.hexor.cy'
|
||||||
redis:
|
redis:
|
||||||
enabled: false
|
enabled: true
|
||||||
|
|
||||||
|
|||||||
@@ -37,5 +37,4 @@ spec:
|
|||||||
dnsZones:
|
dnsZones:
|
||||||
- "ps.hexor.cy"
|
- "ps.hexor.cy"
|
||||||
- "of.hexor.cy"
|
- "of.hexor.cy"
|
||||||
- "matrix.hexor.cy"
|
|
||||||
|
|
||||||
|
|||||||
@@ -10,7 +10,7 @@ resources:
|
|||||||
helmCharts:
|
helmCharts:
|
||||||
- name: cert-manager
|
- name: cert-manager
|
||||||
repo: https://charts.jetstack.io
|
repo: https://charts.jetstack.io
|
||||||
version: 1.20.0
|
version: 1.19.1
|
||||||
releaseName: cert-manager
|
releaseName: cert-manager
|
||||||
namespace: cert-manager
|
namespace: cert-manager
|
||||||
valuesFile: values.yaml
|
valuesFile: values.yaml
|
||||||
|
|||||||
@@ -127,14 +127,6 @@ spec:
|
|||||||
{{ .mmdl }}
|
{{ .mmdl }}
|
||||||
USER_n8n: |-
|
USER_n8n: |-
|
||||||
{{ .n8n }}
|
{{ .n8n }}
|
||||||
USER_synapse: |-
|
|
||||||
{{ .synapse }}
|
|
||||||
USER_mas: |-
|
|
||||||
{{ .mas }}
|
|
||||||
USER_furumi: |-
|
|
||||||
{{ .furumi }}
|
|
||||||
USER_furumi_dev: |-
|
|
||||||
{{ .furumi_dev }}
|
|
||||||
data:
|
data:
|
||||||
- secretKey: authentik
|
- secretKey: authentik
|
||||||
sourceRef:
|
sourceRef:
|
||||||
@@ -279,48 +271,4 @@ spec:
|
|||||||
metadataPolicy: None
|
metadataPolicy: None
|
||||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||||
property: fields[13].value
|
property: fields[13].value
|
||||||
- secretKey: synapse
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
|
||||||
property: fields[14].value
|
|
||||||
- secretKey: mas
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
|
||||||
property: fields[15].value
|
|
||||||
- secretKey: furumi
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
|
||||||
property: fields[16].value
|
|
||||||
- secretKey: furumi_dev
|
|
||||||
sourceRef:
|
|
||||||
storeRef:
|
|
||||||
name: vaultwarden-login
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
remoteRef:
|
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
|
||||||
property: fields[17].value
|
|
||||||
|
|
||||||
|
|||||||
@@ -1,647 +0,0 @@
|
|||||||
{
|
|
||||||
"annotations": {
|
|
||||||
"list": [
|
|
||||||
{
|
|
||||||
"builtIn": 1,
|
|
||||||
"datasource": {
|
|
||||||
"type": "grafana",
|
|
||||||
"uid": "-- Grafana --"
|
|
||||||
},
|
|
||||||
"enable": true,
|
|
||||||
"hide": true,
|
|
||||||
"iconColor": "rgba(0, 211, 255, 1)",
|
|
||||||
"name": "Annotations & Alerts",
|
|
||||||
"type": "dashboard"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"editable": true,
|
|
||||||
"fiscalYearStartMonth": 0,
|
|
||||||
"graphTooltip": 0,
|
|
||||||
"id": null,
|
|
||||||
"links": [],
|
|
||||||
"liveNow": false,
|
|
||||||
"panels": [
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 4,
|
|
||||||
"w": 6,
|
|
||||||
"x": 0,
|
|
||||||
"y": 0
|
|
||||||
},
|
|
||||||
"id": 1,
|
|
||||||
"options": {
|
|
||||||
"colorMode": "value",
|
|
||||||
"graphMode": "area",
|
|
||||||
"justifyMode": "auto",
|
|
||||||
"orientation": "auto",
|
|
||||||
"reduceOptions": {
|
|
||||||
"calc": "lastNotNull",
|
|
||||||
"fields": "",
|
|
||||||
"values": false
|
|
||||||
},
|
|
||||||
"textMode": "auto"
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "furumi_active_streams",
|
|
||||||
"refId": "A"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Active Streams",
|
|
||||||
"type": "stat"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 4,
|
|
||||||
"w": 6,
|
|
||||||
"x": 6,
|
|
||||||
"y": 0
|
|
||||||
},
|
|
||||||
"id": 2,
|
|
||||||
"options": {
|
|
||||||
"colorMode": "value",
|
|
||||||
"graphMode": "area",
|
|
||||||
"justifyMode": "auto",
|
|
||||||
"orientation": "auto",
|
|
||||||
"reduceOptions": {
|
|
||||||
"calc": "rate",
|
|
||||||
"fields": "",
|
|
||||||
"values": false
|
|
||||||
},
|
|
||||||
"textMode": "auto"
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "rate(furumi_bytes_read_total[$__rate_interval])",
|
|
||||||
"refId": "A"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Bytes Read / Sec",
|
|
||||||
"type": "stat",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "palette-classic"
|
|
||||||
},
|
|
||||||
"custom": {
|
|
||||||
"axisBorderShow": false,
|
|
||||||
"axisCenteredZero": false,
|
|
||||||
"axisColorMode": "text",
|
|
||||||
"axisLabel": "",
|
|
||||||
"axisPlacement": "auto",
|
|
||||||
"barAlignment": 0,
|
|
||||||
"drawStyle": "line",
|
|
||||||
"fillOpacity": 0,
|
|
||||||
"gradientMode": "none",
|
|
||||||
"hideFrom": {
|
|
||||||
"legend": false,
|
|
||||||
"tooltip": false,
|
|
||||||
"viz": false
|
|
||||||
},
|
|
||||||
"insertNulls": false,
|
|
||||||
"lineInterpolation": "linear",
|
|
||||||
"lineWidth": 1,
|
|
||||||
"pointSize": 5,
|
|
||||||
"scaleDistribution": {
|
|
||||||
"type": "linear"
|
|
||||||
},
|
|
||||||
"showPoints": "auto",
|
|
||||||
"spanNulls": false,
|
|
||||||
"stacking": {
|
|
||||||
"group": "A",
|
|
||||||
"mode": "none"
|
|
||||||
},
|
|
||||||
"thresholdsStyle": {
|
|
||||||
"mode": "off"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{
|
|
||||||
"color": "green",
|
|
||||||
"value": null
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"unit": "Bps"
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 4,
|
|
||||||
"w": 6,
|
|
||||||
"x": 12,
|
|
||||||
"y": 0
|
|
||||||
},
|
|
||||||
"id": 3,
|
|
||||||
"options": {
|
|
||||||
"colorMode": "value",
|
|
||||||
"graphMode": "area",
|
|
||||||
"justifyMode": "auto",
|
|
||||||
"orientation": "auto",
|
|
||||||
"reduceOptions": {
|
|
||||||
"calc": "lastNotNull",
|
|
||||||
"fields": "",
|
|
||||||
"values": false
|
|
||||||
},
|
|
||||||
"textMode": "auto"
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "sum(increase(furumi_file_open_errors_total[$__rate_interval]))",
|
|
||||||
"refId": "A"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "File Open Errors (Rate)",
|
|
||||||
"type": "stat",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "thresholds"
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{ "color": "green", "value": null },
|
|
||||||
{ "color": "red", "value": 1 }
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 4,
|
|
||||||
"w": 6,
|
|
||||||
"x": 18,
|
|
||||||
"y": 0
|
|
||||||
},
|
|
||||||
"id": 4,
|
|
||||||
"options": {
|
|
||||||
"colorMode": "value",
|
|
||||||
"graphMode": "area",
|
|
||||||
"justifyMode": "auto",
|
|
||||||
"orientation": "auto",
|
|
||||||
"reduceOptions": {
|
|
||||||
"calc": "lastNotNull",
|
|
||||||
"fields": "",
|
|
||||||
"values": false
|
|
||||||
},
|
|
||||||
"textMode": "auto"
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "sum(increase(furumi_auth_failures_total[$__rate_interval]))",
|
|
||||||
"refId": "A"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Auth Failures (Rate)",
|
|
||||||
"type": "stat",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "thresholds"
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{ "color": "green", "value": null },
|
|
||||||
{ "color": "red", "value": 1 }
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 8,
|
|
||||||
"w": 12,
|
|
||||||
"x": 0,
|
|
||||||
"y": 4
|
|
||||||
},
|
|
||||||
"id": 5,
|
|
||||||
"options": {
|
|
||||||
"legend": {
|
|
||||||
"calcs": [],
|
|
||||||
"displayMode": "list",
|
|
||||||
"placement": "bottom",
|
|
||||||
"showLegend": true
|
|
||||||
},
|
|
||||||
"tooltip": {
|
|
||||||
"mode": "single",
|
|
||||||
"sort": "none"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "sum by (method, status) (rate(furumi_grpc_requests_total[$__rate_interval]))",
|
|
||||||
"legendFormat": "{{method}} - {{status}}",
|
|
||||||
"refId": "A"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "gRPC Request Rate by Method & Status",
|
|
||||||
"type": "timeseries",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "palette-classic"
|
|
||||||
},
|
|
||||||
"custom": {
|
|
||||||
"axisBorderShow": false,
|
|
||||||
"axisCenteredZero": false,
|
|
||||||
"axisColorMode": "text",
|
|
||||||
"axisLabel": "",
|
|
||||||
"axisPlacement": "auto",
|
|
||||||
"barAlignment": 0,
|
|
||||||
"drawStyle": "line",
|
|
||||||
"fillOpacity": 10,
|
|
||||||
"gradientMode": "none",
|
|
||||||
"hideFrom": {
|
|
||||||
"legend": false,
|
|
||||||
"tooltip": false,
|
|
||||||
"viz": false
|
|
||||||
},
|
|
||||||
"insertNulls": false,
|
|
||||||
"lineInterpolation": "linear",
|
|
||||||
"lineWidth": 2,
|
|
||||||
"pointSize": 5,
|
|
||||||
"scaleDistribution": {
|
|
||||||
"type": "linear"
|
|
||||||
},
|
|
||||||
"showPoints": "auto",
|
|
||||||
"spanNulls": false,
|
|
||||||
"stacking": {
|
|
||||||
"group": "A",
|
|
||||||
"mode": "none"
|
|
||||||
},
|
|
||||||
"thresholdsStyle": {
|
|
||||||
"mode": "off"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{
|
|
||||||
"color": "green",
|
|
||||||
"value": null
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"unit": "reqps"
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 8,
|
|
||||||
"w": 12,
|
|
||||||
"x": 12,
|
|
||||||
"y": 4
|
|
||||||
},
|
|
||||||
"id": 6,
|
|
||||||
"options": {
|
|
||||||
"legend": {
|
|
||||||
"calcs": [],
|
|
||||||
"displayMode": "list",
|
|
||||||
"placement": "bottom",
|
|
||||||
"showLegend": true
|
|
||||||
},
|
|
||||||
"tooltip": {
|
|
||||||
"mode": "single",
|
|
||||||
"sort": "none"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "histogram_quantile(0.95, sum(rate(furumi_grpc_request_duration_seconds_bucket[$__rate_interval])) by (le, method))",
|
|
||||||
"legendFormat": "p95 {{method}}",
|
|
||||||
"refId": "A"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "histogram_quantile(0.99, sum(rate(furumi_grpc_request_duration_seconds_bucket[$__rate_interval])) by (le, method))",
|
|
||||||
"legendFormat": "p99 {{method}}",
|
|
||||||
"refId": "B"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "gRPC Request Duration (p95, p99)",
|
|
||||||
"type": "timeseries",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "palette-classic"
|
|
||||||
},
|
|
||||||
"custom": {
|
|
||||||
"axisBorderShow": false,
|
|
||||||
"axisCenteredZero": false,
|
|
||||||
"axisColorMode": "text",
|
|
||||||
"axisLabel": "",
|
|
||||||
"axisPlacement": "auto",
|
|
||||||
"barAlignment": 0,
|
|
||||||
"drawStyle": "line",
|
|
||||||
"fillOpacity": 0,
|
|
||||||
"gradientMode": "none",
|
|
||||||
"hideFrom": {
|
|
||||||
"legend": false,
|
|
||||||
"tooltip": false,
|
|
||||||
"viz": false
|
|
||||||
},
|
|
||||||
"insertNulls": false,
|
|
||||||
"lineInterpolation": "linear",
|
|
||||||
"lineWidth": 2,
|
|
||||||
"pointSize": 5,
|
|
||||||
"scaleDistribution": {
|
|
||||||
"type": "linear"
|
|
||||||
},
|
|
||||||
"showPoints": "auto",
|
|
||||||
"spanNulls": false,
|
|
||||||
"stacking": {
|
|
||||||
"group": "A",
|
|
||||||
"mode": "none"
|
|
||||||
},
|
|
||||||
"thresholdsStyle": {
|
|
||||||
"mode": "off"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{
|
|
||||||
"color": "green",
|
|
||||||
"value": null
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"unit": "s"
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 8,
|
|
||||||
"w": 12,
|
|
||||||
"x": 0,
|
|
||||||
"y": 12
|
|
||||||
},
|
|
||||||
"id": 7,
|
|
||||||
"options": {
|
|
||||||
"legend": {
|
|
||||||
"calcs": [],
|
|
||||||
"displayMode": "list",
|
|
||||||
"placement": "bottom",
|
|
||||||
"showLegend": true
|
|
||||||
},
|
|
||||||
"tooltip": {
|
|
||||||
"mode": "single",
|
|
||||||
"sort": "none"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "sum(process_resident_memory_bytes) / 1024 / 1024",
|
|
||||||
"legendFormat": "Resident Memory",
|
|
||||||
"refId": "A"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "sum(process_virtual_memory_bytes) / 1024 / 1024",
|
|
||||||
"legendFormat": "Virtual Memory",
|
|
||||||
"refId": "B"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Process Memory Usage",
|
|
||||||
"type": "timeseries",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "palette-classic"
|
|
||||||
},
|
|
||||||
"custom": {
|
|
||||||
"axisBorderShow": false,
|
|
||||||
"axisCenteredZero": false,
|
|
||||||
"axisColorMode": "text",
|
|
||||||
"axisLabel": "",
|
|
||||||
"axisPlacement": "auto",
|
|
||||||
"barAlignment": 0,
|
|
||||||
"drawStyle": "line",
|
|
||||||
"fillOpacity": 15,
|
|
||||||
"gradientMode": "none",
|
|
||||||
"hideFrom": {
|
|
||||||
"legend": false,
|
|
||||||
"tooltip": false,
|
|
||||||
"viz": false
|
|
||||||
},
|
|
||||||
"insertNulls": false,
|
|
||||||
"lineInterpolation": "linear",
|
|
||||||
"lineWidth": 2,
|
|
||||||
"pointSize": 5,
|
|
||||||
"scaleDistribution": {
|
|
||||||
"type": "linear"
|
|
||||||
},
|
|
||||||
"showPoints": "auto",
|
|
||||||
"spanNulls": false,
|
|
||||||
"stacking": {
|
|
||||||
"group": "A",
|
|
||||||
"mode": "none"
|
|
||||||
},
|
|
||||||
"thresholdsStyle": {
|
|
||||||
"mode": "off"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{ "color": "green", "value": null }
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"unit": "megbytes"
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 8,
|
|
||||||
"w": 12,
|
|
||||||
"x": 12,
|
|
||||||
"y": 12
|
|
||||||
},
|
|
||||||
"id": 8,
|
|
||||||
"options": {
|
|
||||||
"legend": {
|
|
||||||
"calcs": [],
|
|
||||||
"displayMode": "list",
|
|
||||||
"placement": "bottom",
|
|
||||||
"showLegend": true
|
|
||||||
},
|
|
||||||
"tooltip": {
|
|
||||||
"mode": "single",
|
|
||||||
"sort": "none"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "process_open_fds",
|
|
||||||
"legendFormat": "Open FDs",
|
|
||||||
"refId": "A"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "process_max_fds",
|
|
||||||
"legendFormat": "Max FDs",
|
|
||||||
"refId": "B"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Process File Descriptors",
|
|
||||||
"type": "timeseries",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "palette-classic"
|
|
||||||
},
|
|
||||||
"custom": {
|
|
||||||
"axisBorderShow": false,
|
|
||||||
"axisCenteredZero": false,
|
|
||||||
"axisColorMode": "text",
|
|
||||||
"axisLabel": "",
|
|
||||||
"axisPlacement": "auto",
|
|
||||||
"barAlignment": 0,
|
|
||||||
"drawStyle": "line",
|
|
||||||
"fillOpacity": 10,
|
|
||||||
"gradientMode": "none",
|
|
||||||
"hideFrom": {
|
|
||||||
"legend": false,
|
|
||||||
"tooltip": false,
|
|
||||||
"viz": false
|
|
||||||
},
|
|
||||||
"insertNulls": false,
|
|
||||||
"lineInterpolation": "linear",
|
|
||||||
"lineWidth": 2,
|
|
||||||
"pointSize": 5,
|
|
||||||
"scaleDistribution": {
|
|
||||||
"type": "linear"
|
|
||||||
},
|
|
||||||
"showPoints": "auto",
|
|
||||||
"spanNulls": false,
|
|
||||||
"stacking": {
|
|
||||||
"group": "A",
|
|
||||||
"mode": "none"
|
|
||||||
},
|
|
||||||
"thresholdsStyle": {
|
|
||||||
"mode": "off"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{ "color": "green", "value": null }
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"unit": "short"
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"refresh": "10s",
|
|
||||||
"schemaVersion": 38,
|
|
||||||
"style": "dark",
|
|
||||||
"tags": [
|
|
||||||
"furumi-server",
|
|
||||||
"grpc"
|
|
||||||
],
|
|
||||||
"templating": {
|
|
||||||
"list": [
|
|
||||||
{
|
|
||||||
"current": {
|
|
||||||
"selected": false,
|
|
||||||
"text": "Prometheus",
|
|
||||||
"value": "Prometheus"
|
|
||||||
},
|
|
||||||
"hide": 0,
|
|
||||||
"includeAll": false,
|
|
||||||
"multi": false,
|
|
||||||
"name": "datasource",
|
|
||||||
"options": [],
|
|
||||||
"query": "prometheus",
|
|
||||||
"refresh": 1,
|
|
||||||
"regex": "",
|
|
||||||
"skipUrlSync": false,
|
|
||||||
"type": "datasource"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"time": {
|
|
||||||
"from": "now-1h",
|
|
||||||
"to": "now"
|
|
||||||
},
|
|
||||||
"timepicker": {},
|
|
||||||
"timezone": "",
|
|
||||||
"title": "Furumi Server Metrics",
|
|
||||||
"uid": "furumi-metrics",
|
|
||||||
"version": 1
|
|
||||||
}
|
|
||||||
@@ -1,669 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: furumi-server-dashboard
|
|
||||||
labels:
|
|
||||||
grafana_dashboard: "1"
|
|
||||||
data:
|
|
||||||
furumi-server.json: |-
|
|
||||||
{
|
|
||||||
"annotations": {
|
|
||||||
"list": [
|
|
||||||
{
|
|
||||||
"builtIn": 1,
|
|
||||||
"datasource": {
|
|
||||||
"type": "grafana",
|
|
||||||
"uid": "-- Grafana --"
|
|
||||||
},
|
|
||||||
"enable": true,
|
|
||||||
"hide": true,
|
|
||||||
"iconColor": "rgba(0, 211, 255, 1)",
|
|
||||||
"name": "Annotations & Alerts",
|
|
||||||
"type": "dashboard"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"editable": true,
|
|
||||||
"fiscalYearStartMonth": 0,
|
|
||||||
"graphTooltip": 0,
|
|
||||||
"id": null,
|
|
||||||
"links": [],
|
|
||||||
"liveNow": false,
|
|
||||||
"panels": [
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 4,
|
|
||||||
"w": 6,
|
|
||||||
"x": 0,
|
|
||||||
"y": 0
|
|
||||||
},
|
|
||||||
"id": 1,
|
|
||||||
"options": {
|
|
||||||
"colorMode": "value",
|
|
||||||
"graphMode": "area",
|
|
||||||
"justifyMode": "auto",
|
|
||||||
"orientation": "auto",
|
|
||||||
"reduceOptions": {
|
|
||||||
"calc": "lastNotNull",
|
|
||||||
"fields": "",
|
|
||||||
"values": false
|
|
||||||
},
|
|
||||||
"textMode": "auto"
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "sum(furumi_active_streams)",
|
|
||||||
"refId": "A"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Active Streams",
|
|
||||||
"type": "stat"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 4,
|
|
||||||
"w": 6,
|
|
||||||
"x": 6,
|
|
||||||
"y": 0
|
|
||||||
},
|
|
||||||
"id": 2,
|
|
||||||
"options": {
|
|
||||||
"colorMode": "value",
|
|
||||||
"graphMode": "area",
|
|
||||||
"justifyMode": "auto",
|
|
||||||
"orientation": "auto",
|
|
||||||
"reduceOptions": {
|
|
||||||
"calc": "rate",
|
|
||||||
"fields": "",
|
|
||||||
"values": false
|
|
||||||
},
|
|
||||||
"textMode": "auto"
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "sum(rate(furumi_bytes_read_total[$__rate_interval]))",
|
|
||||||
"refId": "A"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Bytes Read / Sec",
|
|
||||||
"type": "stat",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "palette-classic"
|
|
||||||
},
|
|
||||||
"custom": {
|
|
||||||
"axisBorderShow": false,
|
|
||||||
"axisCenteredZero": false,
|
|
||||||
"axisColorMode": "text",
|
|
||||||
"axisLabel": "",
|
|
||||||
"axisPlacement": "auto",
|
|
||||||
"barAlignment": 0,
|
|
||||||
"drawStyle": "line",
|
|
||||||
"fillOpacity": 0,
|
|
||||||
"gradientMode": "none",
|
|
||||||
"hideFrom": {
|
|
||||||
"legend": false,
|
|
||||||
"tooltip": false,
|
|
||||||
"viz": false
|
|
||||||
},
|
|
||||||
"insertNulls": false,
|
|
||||||
"lineInterpolation": "linear",
|
|
||||||
"lineWidth": 1,
|
|
||||||
"pointSize": 5,
|
|
||||||
"scaleDistribution": {
|
|
||||||
"type": "linear"
|
|
||||||
},
|
|
||||||
"showPoints": "auto",
|
|
||||||
"spanNulls": false,
|
|
||||||
"stacking": {
|
|
||||||
"group": "A",
|
|
||||||
"mode": "none"
|
|
||||||
},
|
|
||||||
"thresholdsStyle": {
|
|
||||||
"mode": "off"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{
|
|
||||||
"color": "green",
|
|
||||||
"value": null
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"unit": "Bps"
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 4,
|
|
||||||
"w": 6,
|
|
||||||
"x": 12,
|
|
||||||
"y": 0
|
|
||||||
},
|
|
||||||
"id": 3,
|
|
||||||
"options": {
|
|
||||||
"colorMode": "value",
|
|
||||||
"graphMode": "area",
|
|
||||||
"justifyMode": "auto",
|
|
||||||
"orientation": "auto",
|
|
||||||
"reduceOptions": {
|
|
||||||
"calc": "lastNotNull",
|
|
||||||
"fields": "",
|
|
||||||
"values": false
|
|
||||||
},
|
|
||||||
"textMode": "auto"
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "sum(increase(furumi_file_open_errors_total[$__rate_interval]))",
|
|
||||||
"refId": "A"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "File Open Errors (Rate)",
|
|
||||||
"type": "stat",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "thresholds"
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{ "color": "green", "value": null },
|
|
||||||
{ "color": "red", "value": 1 }
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 4,
|
|
||||||
"w": 6,
|
|
||||||
"x": 18,
|
|
||||||
"y": 0
|
|
||||||
},
|
|
||||||
"id": 4,
|
|
||||||
"options": {
|
|
||||||
"colorMode": "value",
|
|
||||||
"graphMode": "area",
|
|
||||||
"justifyMode": "auto",
|
|
||||||
"orientation": "auto",
|
|
||||||
"reduceOptions": {
|
|
||||||
"calc": "lastNotNull",
|
|
||||||
"fields": "",
|
|
||||||
"values": false
|
|
||||||
},
|
|
||||||
"textMode": "auto"
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "sum(increase(furumi_auth_failures_total[$__rate_interval]))",
|
|
||||||
"refId": "A"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Auth Failures (Rate)",
|
|
||||||
"type": "stat",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "thresholds"
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{ "color": "green", "value": null },
|
|
||||||
{ "color": "red", "value": 1 }
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 8,
|
|
||||||
"w": 12,
|
|
||||||
"x": 0,
|
|
||||||
"y": 4
|
|
||||||
},
|
|
||||||
"id": 5,
|
|
||||||
"options": {
|
|
||||||
"legend": {
|
|
||||||
"calcs": [],
|
|
||||||
"displayMode": "list",
|
|
||||||
"placement": "bottom",
|
|
||||||
"showLegend": true
|
|
||||||
},
|
|
||||||
"tooltip": {
|
|
||||||
"mode": "single",
|
|
||||||
"sort": "none"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "sum by (method, status) (rate(furumi_grpc_requests_total[$__rate_interval]))",
|
|
||||||
"legendFormat": "{{method}} - {{status}}",
|
|
||||||
"refId": "A"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "gRPC Request Rate by Method & Status",
|
|
||||||
"type": "timeseries",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "palette-classic"
|
|
||||||
},
|
|
||||||
"custom": {
|
|
||||||
"axisBorderShow": false,
|
|
||||||
"axisCenteredZero": false,
|
|
||||||
"axisColorMode": "text",
|
|
||||||
"axisLabel": "",
|
|
||||||
"axisPlacement": "auto",
|
|
||||||
"barAlignment": 0,
|
|
||||||
"drawStyle": "line",
|
|
||||||
"fillOpacity": 10,
|
|
||||||
"gradientMode": "none",
|
|
||||||
"hideFrom": {
|
|
||||||
"legend": false,
|
|
||||||
"tooltip": false,
|
|
||||||
"viz": false
|
|
||||||
},
|
|
||||||
"insertNulls": false,
|
|
||||||
"lineInterpolation": "linear",
|
|
||||||
"lineWidth": 2,
|
|
||||||
"pointSize": 5,
|
|
||||||
"scaleDistribution": {
|
|
||||||
"type": "linear"
|
|
||||||
},
|
|
||||||
"showPoints": "auto",
|
|
||||||
"spanNulls": false,
|
|
||||||
"stacking": {
|
|
||||||
"group": "A",
|
|
||||||
"mode": "none"
|
|
||||||
},
|
|
||||||
"thresholdsStyle": {
|
|
||||||
"mode": "off"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{
|
|
||||||
"color": "green",
|
|
||||||
"value": null
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"unit": "reqps"
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 8,
|
|
||||||
"w": 12,
|
|
||||||
"x": 12,
|
|
||||||
"y": 4
|
|
||||||
},
|
|
||||||
"id": 6,
|
|
||||||
"options": {
|
|
||||||
"legend": {
|
|
||||||
"calcs": [],
|
|
||||||
"displayMode": "list",
|
|
||||||
"placement": "bottom",
|
|
||||||
"showLegend": true
|
|
||||||
},
|
|
||||||
"tooltip": {
|
|
||||||
"mode": "single",
|
|
||||||
"sort": "none"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "histogram_quantile(0.95, sum(rate(furumi_grpc_request_duration_seconds_bucket[$__rate_interval])) by (le, method))",
|
|
||||||
"legendFormat": "p95 {{method}}",
|
|
||||||
"refId": "A"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "histogram_quantile(0.99, sum(rate(furumi_grpc_request_duration_seconds_bucket[$__rate_interval])) by (le, method))",
|
|
||||||
"legendFormat": "p99 {{method}}",
|
|
||||||
"refId": "B"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "gRPC Request Duration (p95, p99)",
|
|
||||||
"type": "timeseries",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "palette-classic"
|
|
||||||
},
|
|
||||||
"custom": {
|
|
||||||
"axisBorderShow": false,
|
|
||||||
"axisCenteredZero": false,
|
|
||||||
"axisColorMode": "text",
|
|
||||||
"axisLabel": "",
|
|
||||||
"axisPlacement": "auto",
|
|
||||||
"barAlignment": 0,
|
|
||||||
"drawStyle": "line",
|
|
||||||
"fillOpacity": 0,
|
|
||||||
"gradientMode": "none",
|
|
||||||
"hideFrom": {
|
|
||||||
"legend": false,
|
|
||||||
"tooltip": false,
|
|
||||||
"viz": false
|
|
||||||
},
|
|
||||||
"insertNulls": false,
|
|
||||||
"lineInterpolation": "linear",
|
|
||||||
"lineWidth": 2,
|
|
||||||
"pointSize": 5,
|
|
||||||
"scaleDistribution": {
|
|
||||||
"type": "linear"
|
|
||||||
},
|
|
||||||
"showPoints": "auto",
|
|
||||||
"spanNulls": false,
|
|
||||||
"stacking": {
|
|
||||||
"group": "A",
|
|
||||||
"mode": "none"
|
|
||||||
},
|
|
||||||
"thresholdsStyle": {
|
|
||||||
"mode": "off"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{
|
|
||||||
"color": "green",
|
|
||||||
"value": null
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"unit": "s"
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"collapsed": true,
|
|
||||||
"gridPos": {
|
|
||||||
"h": 1,
|
|
||||||
"w": 24,
|
|
||||||
"x": 0,
|
|
||||||
"y": 12
|
|
||||||
},
|
|
||||||
"id": 99,
|
|
||||||
"panels": [
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 8,
|
|
||||||
"w": 12,
|
|
||||||
"x": 0,
|
|
||||||
"y": 13
|
|
||||||
},
|
|
||||||
"id": 7,
|
|
||||||
"options": {
|
|
||||||
"legend": {
|
|
||||||
"calcs": [],
|
|
||||||
"displayMode": "list",
|
|
||||||
"placement": "bottom",
|
|
||||||
"showLegend": true
|
|
||||||
},
|
|
||||||
"tooltip": {
|
|
||||||
"mode": "single",
|
|
||||||
"sort": "none"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "process_resident_memory_bytes / 1024 / 1024",
|
|
||||||
"legendFormat": "Resident Memory",
|
|
||||||
"refId": "A"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "process_virtual_memory_bytes / 1024 / 1024",
|
|
||||||
"legendFormat": "Virtual Memory",
|
|
||||||
"refId": "B"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Process Memory Usage",
|
|
||||||
"type": "timeseries",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "palette-classic"
|
|
||||||
},
|
|
||||||
"custom": {
|
|
||||||
"axisBorderShow": false,
|
|
||||||
"axisCenteredZero": false,
|
|
||||||
"axisColorMode": "text",
|
|
||||||
"axisLabel": "",
|
|
||||||
"axisPlacement": "auto",
|
|
||||||
"barAlignment": 0,
|
|
||||||
"drawStyle": "line",
|
|
||||||
"fillOpacity": 15,
|
|
||||||
"gradientMode": "none",
|
|
||||||
"hideFrom": {
|
|
||||||
"legend": false,
|
|
||||||
"tooltip": false,
|
|
||||||
"viz": false
|
|
||||||
},
|
|
||||||
"insertNulls": false,
|
|
||||||
"lineInterpolation": "linear",
|
|
||||||
"lineWidth": 2,
|
|
||||||
"pointSize": 5,
|
|
||||||
"scaleDistribution": {
|
|
||||||
"type": "linear"
|
|
||||||
},
|
|
||||||
"showPoints": "auto",
|
|
||||||
"spanNulls": false,
|
|
||||||
"stacking": {
|
|
||||||
"group": "A",
|
|
||||||
"mode": "none"
|
|
||||||
},
|
|
||||||
"thresholdsStyle": {
|
|
||||||
"mode": "off"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{ "color": "green", "value": null }
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"unit": "megbytes"
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"gridPos": {
|
|
||||||
"h": 8,
|
|
||||||
"w": 12,
|
|
||||||
"x": 12,
|
|
||||||
"y": 13
|
|
||||||
},
|
|
||||||
"id": 8,
|
|
||||||
"options": {
|
|
||||||
"legend": {
|
|
||||||
"calcs": [],
|
|
||||||
"displayMode": "list",
|
|
||||||
"placement": "bottom",
|
|
||||||
"showLegend": true
|
|
||||||
},
|
|
||||||
"tooltip": {
|
|
||||||
"mode": "single",
|
|
||||||
"sort": "none"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"pluginVersion": "10.0.0",
|
|
||||||
"targets": [
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "process_open_fds",
|
|
||||||
"legendFormat": "Open FDs",
|
|
||||||
"refId": "A"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"datasource": {
|
|
||||||
"type": "prometheus",
|
|
||||||
"uid": "${datasource}"
|
|
||||||
},
|
|
||||||
"expr": "process_max_fds",
|
|
||||||
"legendFormat": "Max FDs",
|
|
||||||
"refId": "B"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Process File Descriptors",
|
|
||||||
"type": "timeseries",
|
|
||||||
"fieldConfig": {
|
|
||||||
"defaults": {
|
|
||||||
"color": {
|
|
||||||
"mode": "palette-classic"
|
|
||||||
},
|
|
||||||
"custom": {
|
|
||||||
"axisBorderShow": false,
|
|
||||||
"axisCenteredZero": false,
|
|
||||||
"axisColorMode": "text",
|
|
||||||
"axisLabel": "",
|
|
||||||
"axisPlacement": "auto",
|
|
||||||
"barAlignment": 0,
|
|
||||||
"drawStyle": "line",
|
|
||||||
"fillOpacity": 10,
|
|
||||||
"gradientMode": "none",
|
|
||||||
"hideFrom": {
|
|
||||||
"legend": false,
|
|
||||||
"tooltip": false,
|
|
||||||
"viz": false
|
|
||||||
},
|
|
||||||
"insertNulls": false,
|
|
||||||
"lineInterpolation": "linear",
|
|
||||||
"lineWidth": 2,
|
|
||||||
"pointSize": 5,
|
|
||||||
"scaleDistribution": {
|
|
||||||
"type": "linear"
|
|
||||||
},
|
|
||||||
"showPoints": "auto",
|
|
||||||
"spanNulls": false,
|
|
||||||
"stacking": {
|
|
||||||
"group": "A",
|
|
||||||
"mode": "none"
|
|
||||||
},
|
|
||||||
"thresholdsStyle": {
|
|
||||||
"mode": "off"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"mappings": [],
|
|
||||||
"thresholds": {
|
|
||||||
"mode": "absolute",
|
|
||||||
"steps": [
|
|
||||||
{ "color": "green", "value": null }
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"unit": "short"
|
|
||||||
},
|
|
||||||
"overrides": []
|
|
||||||
}
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"title": "Process Metrics (Memory, FDs)",
|
|
||||||
"type": "row"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"refresh": "10s",
|
|
||||||
"schemaVersion": 38,
|
|
||||||
"style": "dark",
|
|
||||||
"tags": [
|
|
||||||
"furumi-server",
|
|
||||||
"grpc"
|
|
||||||
],
|
|
||||||
"templating": {
|
|
||||||
"list": [
|
|
||||||
{
|
|
||||||
"current": {
|
|
||||||
"selected": false,
|
|
||||||
"text": "Prometheus",
|
|
||||||
"value": "Prometheus"
|
|
||||||
},
|
|
||||||
"hide": 0,
|
|
||||||
"includeAll": false,
|
|
||||||
"multi": false,
|
|
||||||
"name": "datasource",
|
|
||||||
"options": [],
|
|
||||||
"query": "prometheus",
|
|
||||||
"refresh": 1,
|
|
||||||
"regex": "",
|
|
||||||
"skipUrlSync": false,
|
|
||||||
"type": "datasource"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"time": {
|
|
||||||
"from": "now-1h",
|
|
||||||
"to": "now"
|
|
||||||
},
|
|
||||||
"timepicker": {},
|
|
||||||
"timezone": "",
|
|
||||||
"title": "Furumi Server Metrics",
|
|
||||||
"uid": "furumi-metrics",
|
|
||||||
"version": 1
|
|
||||||
}
|
|
||||||
@@ -20,7 +20,7 @@ data:
|
|||||||
relativeTimeRange:
|
relativeTimeRange:
|
||||||
from: 600
|
from: 600
|
||||||
to: 0
|
to: 0
|
||||||
datasourceUid: prometheus
|
datasourceUid: P76F38748CEC837F0
|
||||||
model:
|
model:
|
||||||
expr: 'rate(container_cpu_cfs_throttled_periods_total{container="pasarguard-node"}[5m])'
|
expr: 'rate(container_cpu_cfs_throttled_periods_total{container="pasarguard-node"}[5m])'
|
||||||
refId: A
|
refId: A
|
||||||
@@ -73,7 +73,7 @@ data:
|
|||||||
relativeTimeRange:
|
relativeTimeRange:
|
||||||
from: 600
|
from: 600
|
||||||
to: 0
|
to: 0
|
||||||
datasourceUid: prometheus
|
datasourceUid: P76F38748CEC837F0
|
||||||
model:
|
model:
|
||||||
expr: 'kube_node_status_condition{condition="Ready",status="false"}'
|
expr: 'kube_node_status_condition{condition="Ready",status="false"}'
|
||||||
refId: A
|
refId: A
|
||||||
@@ -119,7 +119,7 @@ data:
|
|||||||
relativeTimeRange:
|
relativeTimeRange:
|
||||||
from: 300
|
from: 300
|
||||||
to: 0
|
to: 0
|
||||||
datasourceUid: prometheus
|
datasourceUid: P76F38748CEC837F0
|
||||||
model:
|
model:
|
||||||
expr: '(1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100'
|
expr: '(1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100'
|
||||||
refId: A
|
refId: A
|
||||||
@@ -165,7 +165,7 @@ data:
|
|||||||
relativeTimeRange:
|
relativeTimeRange:
|
||||||
from: 300
|
from: 300
|
||||||
to: 0
|
to: 0
|
||||||
datasourceUid: prometheus
|
datasourceUid: P76F38748CEC837F0
|
||||||
model:
|
model:
|
||||||
expr: '100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)'
|
expr: '100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)'
|
||||||
refId: A
|
refId: A
|
||||||
@@ -211,7 +211,7 @@ data:
|
|||||||
relativeTimeRange:
|
relativeTimeRange:
|
||||||
from: 300
|
from: 300
|
||||||
to: 0
|
to: 0
|
||||||
datasourceUid: prometheus
|
datasourceUid: P76F38748CEC837F0
|
||||||
model:
|
model:
|
||||||
expr: '(1 - (node_filesystem_avail_bytes{fstype=~"ext[234]|xfs|zfs|btrfs"} / node_filesystem_size_bytes)) * 100'
|
expr: '(1 - (node_filesystem_avail_bytes{fstype=~"ext[234]|xfs|zfs|btrfs"} / node_filesystem_size_bytes)) * 100'
|
||||||
refId: A
|
refId: A
|
||||||
@@ -258,9 +258,9 @@ data:
|
|||||||
relativeTimeRange:
|
relativeTimeRange:
|
||||||
from: 300
|
from: 300
|
||||||
to: 0
|
to: 0
|
||||||
datasourceUid: prometheus
|
datasourceUid: P76F38748CEC837F0
|
||||||
model:
|
model:
|
||||||
expr: 'node_load15 / on(instance) group_left count by(instance)(node_cpu_seconds_total{mode="idle"})'
|
expr: 'node_load5 / on(instance) group_left count by(instance)(node_cpu_seconds_total{mode="idle"})'
|
||||||
refId: A
|
refId: A
|
||||||
intervalMs: 1000
|
intervalMs: 1000
|
||||||
maxDataPoints: 43200
|
maxDataPoints: 43200
|
||||||
@@ -273,7 +273,7 @@ data:
|
|||||||
conditions:
|
conditions:
|
||||||
- evaluator:
|
- evaluator:
|
||||||
params:
|
params:
|
||||||
- 2
|
- 0.8
|
||||||
type: gt
|
type: gt
|
||||||
operator:
|
operator:
|
||||||
type: and
|
type: and
|
||||||
@@ -283,16 +283,16 @@ data:
|
|||||||
type: __expr__
|
type: __expr__
|
||||||
uid: __expr__
|
uid: __expr__
|
||||||
expression: A
|
expression: A
|
||||||
reducer: last
|
reducer: max
|
||||||
refId: B
|
refId: B
|
||||||
type: reduce
|
type: reduce
|
||||||
noDataState: NoData
|
noDataState: NoData
|
||||||
execErrState: Alerting
|
execErrState: Alerting
|
||||||
for: 15m
|
for: 5m
|
||||||
annotations:
|
annotations:
|
||||||
node: '{{ $labels.instance }}'
|
node: '{{ $labels.instance }}'
|
||||||
load_average: '{{ printf "%.2f" $values.A }}'
|
load_average: '{{ printf "%.2f" $values.A }}'
|
||||||
summary: 'Node load average is critically high relative to CPU count'
|
summary: 'Node load average is high relative to CPU count'
|
||||||
labels:
|
labels:
|
||||||
severity: warning
|
severity: warning
|
||||||
|
|
||||||
@@ -304,7 +304,7 @@ data:
|
|||||||
relativeTimeRange:
|
relativeTimeRange:
|
||||||
from: 300
|
from: 300
|
||||||
to: 0
|
to: 0
|
||||||
datasourceUid: prometheus
|
datasourceUid: P76F38748CEC837F0
|
||||||
model:
|
model:
|
||||||
expr: 'up{job="node-exporter"}'
|
expr: 'up{job="node-exporter"}'
|
||||||
refId: A
|
refId: A
|
||||||
|
|||||||
85
k8s/core/prom-stack/grafana-values.yaml
Normal file
85
k8s/core/prom-stack/grafana-values.yaml
Normal file
@@ -0,0 +1,85 @@
|
|||||||
|
envFromSecret: grafana-admin
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||||
|
|
||||||
|
admin:
|
||||||
|
existingSecret: grafana-admin
|
||||||
|
userKey: username
|
||||||
|
passwordKey: password
|
||||||
|
|
||||||
|
grafana.ini:
|
||||||
|
auth:
|
||||||
|
signout_redirect_url: https://idm.hexor.cy/application/o/grafana/end-session/
|
||||||
|
# oauth_auto_login: true
|
||||||
|
auth.generic_oauth:
|
||||||
|
name: authentik
|
||||||
|
enabled: true
|
||||||
|
scopes: "openid profile email"
|
||||||
|
auth_url: https://idm.hexor.cy/application/o/authorize/
|
||||||
|
token_url: https://idm.hexor.cy/application/o/token/
|
||||||
|
api_url: https://idm.hexor.cy/application/o/userinfo/
|
||||||
|
role_attribute_path: >-
|
||||||
|
contains(groups, 'Grafana Admin') && 'Admin' ||
|
||||||
|
contains(groups, 'Grafana Editors') && 'Editor' ||
|
||||||
|
contains(groups, 'Grafana Viewer') && 'Viewer'
|
||||||
|
database:
|
||||||
|
type: postgres
|
||||||
|
host: psql.psql.svc:5432
|
||||||
|
name: grafana
|
||||||
|
user: grafana
|
||||||
|
ssl_mode: disable
|
||||||
|
|
||||||
|
datasources:
|
||||||
|
datasources.yaml:
|
||||||
|
apiVersion: 1
|
||||||
|
datasources:
|
||||||
|
- name: Prometheus Local
|
||||||
|
type: prometheus
|
||||||
|
url: http://prometheus-kube-prometheus-prometheus.prometheus.svc:9090
|
||||||
|
access: proxy
|
||||||
|
isDefault: true
|
||||||
|
- name: Loki
|
||||||
|
type: loki
|
||||||
|
url: http://loki-gateway.prometheus.svc:80
|
||||||
|
access: proxy
|
||||||
|
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
ingressClassName: traefik
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt
|
||||||
|
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||||
|
hosts:
|
||||||
|
- gf.hexor.cy
|
||||||
|
tls:
|
||||||
|
- secretName: grafana-tls
|
||||||
|
hosts:
|
||||||
|
- '*.hexor.cy'
|
||||||
|
|
||||||
|
extraConfigmapMounts:
|
||||||
|
- name: grafana-alerting-rules
|
||||||
|
mountPath: /etc/grafana/provisioning/alerting/rules.yaml
|
||||||
|
configMap: grafana-alerting
|
||||||
|
subPath: rules.yaml
|
||||||
|
readOnly: true
|
||||||
|
- name: grafana-alerting-contactpoints
|
||||||
|
mountPath: /etc/grafana/provisioning/alerting/contactpoints.yaml
|
||||||
|
configMap: grafana-alerting
|
||||||
|
subPath: contactpoints.yaml
|
||||||
|
readOnly: true
|
||||||
|
- name: grafana-alerting-policies
|
||||||
|
mountPath: /etc/grafana/provisioning/alerting/policies.yaml
|
||||||
|
configMap: grafana-alerting
|
||||||
|
subPath: policies.yaml
|
||||||
|
readOnly: true
|
||||||
|
|
||||||
|
envValueFrom:
|
||||||
|
TELEGRAM_BOT_TOKEN:
|
||||||
|
secretKeyRef:
|
||||||
|
name: grafana-telegram
|
||||||
|
key: bot-token
|
||||||
|
TELEGRAM_CHAT_ID:
|
||||||
|
secretKeyRef:
|
||||||
|
name: grafana-telegram
|
||||||
|
key: chat-id
|
||||||
|
|
||||||
@@ -6,17 +6,24 @@ resources:
|
|||||||
- external-secrets.yaml
|
- external-secrets.yaml
|
||||||
- grafana-alerting-configmap.yaml
|
- grafana-alerting-configmap.yaml
|
||||||
- alertmanager-config.yaml
|
- alertmanager-config.yaml
|
||||||
- furumi-dashboard-cm.yaml
|
|
||||||
|
|
||||||
helmCharts:
|
helmCharts:
|
||||||
- name: kube-prometheus-stack
|
- name: kube-prometheus-stack
|
||||||
repo: https://prometheus-community.github.io/helm-charts
|
repo: https://prometheus-community.github.io/helm-charts
|
||||||
version: 82.10.3
|
version: 79.7.1
|
||||||
releaseName: prometheus
|
releaseName: prometheus
|
||||||
namespace: prometheus
|
namespace: prometheus
|
||||||
valuesFile: prom-values.yaml
|
valuesFile: prom-values.yaml
|
||||||
includeCRDs: true
|
includeCRDs: true
|
||||||
|
|
||||||
|
- name: grafana
|
||||||
|
repo: https://grafana.github.io/helm-charts
|
||||||
|
version: 10.2.0
|
||||||
|
releaseName: grafana
|
||||||
|
namespace: prometheus
|
||||||
|
valuesFile: grafana-values.yaml
|
||||||
|
includeCRDs: true
|
||||||
|
|
||||||
- name: loki
|
- name: loki
|
||||||
repo: https://grafana.github.io/helm-charts
|
repo: https://grafana.github.io/helm-charts
|
||||||
version: 6.29.0
|
version: 6.29.0
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
@@ -1,4 +1,5 @@
|
|||||||
|
grafana:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
alertmanager:
|
alertmanager:
|
||||||
config:
|
config:
|
||||||
@@ -91,88 +92,3 @@ prometheus:
|
|||||||
requests:
|
requests:
|
||||||
storage: 400Gi
|
storage: 400Gi
|
||||||
|
|
||||||
grafana:
|
|
||||||
enabled: true
|
|
||||||
|
|
||||||
serviceAccount:
|
|
||||||
create: true
|
|
||||||
name: "prom-grafana-sa"
|
|
||||||
|
|
||||||
envFromSecret: grafana-admin
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
|
||||||
|
|
||||||
admin:
|
|
||||||
existingSecret: grafana-admin
|
|
||||||
userKey: username
|
|
||||||
passwordKey: password
|
|
||||||
|
|
||||||
grafana.ini:
|
|
||||||
auth:
|
|
||||||
signout_redirect_url: https://idm.hexor.cy/application/o/grafana/end-session/
|
|
||||||
auth.generic_oauth:
|
|
||||||
name: authentik
|
|
||||||
enabled: true
|
|
||||||
scopes: "openid profile email"
|
|
||||||
auth_url: https://idm.hexor.cy/application/o/authorize/
|
|
||||||
token_url: https://idm.hexor.cy/application/o/token/
|
|
||||||
api_url: https://idm.hexor.cy/application/o/userinfo/
|
|
||||||
role_attribute_path: >-
|
|
||||||
contains(groups, 'Grafana Admin') && 'Admin' ||
|
|
||||||
contains(groups, 'Grafana Editors') && 'Editor' ||
|
|
||||||
contains(groups, 'Grafana Viewer') && 'Viewer'
|
|
||||||
database:
|
|
||||||
type: postgres
|
|
||||||
host: psql.psql.svc:5432
|
|
||||||
name: grafana
|
|
||||||
user: grafana
|
|
||||||
ssl_mode: disable
|
|
||||||
|
|
||||||
# The Loki datasource config needs to be preserved,
|
|
||||||
# but instead of "datasources.datasources.yaml", we define it like this for the prometheus-stack chart:
|
|
||||||
additionalDataSources:
|
|
||||||
- name: Loki
|
|
||||||
type: loki
|
|
||||||
url: http://loki-gateway.prometheus.svc:80
|
|
||||||
access: proxy
|
|
||||||
orgId: 1
|
|
||||||
|
|
||||||
ingress:
|
|
||||||
enabled: true
|
|
||||||
ingressClassName: traefik
|
|
||||||
annotations:
|
|
||||||
cert-manager.io/cluster-issuer: letsencrypt
|
|
||||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
|
||||||
hosts:
|
|
||||||
- gf.hexor.cy
|
|
||||||
tls:
|
|
||||||
- secretName: grafana-tls
|
|
||||||
hosts:
|
|
||||||
- '*.hexor.cy'
|
|
||||||
|
|
||||||
extraConfigmapMounts:
|
|
||||||
- name: grafana-alerting-rules
|
|
||||||
mountPath: /etc/grafana/provisioning/alerting/rules.yaml
|
|
||||||
configMap: grafana-alerting
|
|
||||||
subPath: rules.yaml
|
|
||||||
readOnly: true
|
|
||||||
- name: grafana-alerting-contactpoints
|
|
||||||
mountPath: /etc/grafana/provisioning/alerting/contactpoints.yaml
|
|
||||||
configMap: grafana-alerting
|
|
||||||
subPath: contactpoints.yaml
|
|
||||||
readOnly: true
|
|
||||||
- name: grafana-alerting-policies
|
|
||||||
mountPath: /etc/grafana/provisioning/alerting/policies.yaml
|
|
||||||
configMap: grafana-alerting
|
|
||||||
subPath: policies.yaml
|
|
||||||
readOnly: true
|
|
||||||
|
|
||||||
envValueFrom:
|
|
||||||
TELEGRAM_BOT_TOKEN:
|
|
||||||
secretKeyRef:
|
|
||||||
name: grafana-telegram
|
|
||||||
key: bot-token
|
|
||||||
TELEGRAM_CHAT_ID:
|
|
||||||
secretKeyRef:
|
|
||||||
name: grafana-telegram
|
|
||||||
key: chat-id
|
|
||||||
|
|||||||
@@ -16,7 +16,7 @@ spec:
|
|||||||
serviceAccountName: system-upgrade
|
serviceAccountName: system-upgrade
|
||||||
upgrade:
|
upgrade:
|
||||||
image: rancher/k3s-upgrade
|
image: rancher/k3s-upgrade
|
||||||
version: v1.35.2+k3s1
|
version: v1.34.3+k3s1
|
||||||
---
|
---
|
||||||
# Agent plan
|
# Agent plan
|
||||||
apiVersion: upgrade.cattle.io/v1
|
apiVersion: upgrade.cattle.io/v1
|
||||||
@@ -39,4 +39,5 @@ spec:
|
|||||||
serviceAccountName: system-upgrade
|
serviceAccountName: system-upgrade
|
||||||
upgrade:
|
upgrade:
|
||||||
image: rancher/k3s-upgrade
|
image: rancher/k3s-upgrade
|
||||||
version: v1.35.2+k3s1
|
version: v1.34.3+k3s1
|
||||||
|
|
||||||
|
|||||||
16
terraform/authentik/.claude/settings.local.json
Normal file
16
terraform/authentik/.claude/settings.local.json
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
{
|
||||||
|
"permissions": {
|
||||||
|
"allow": [
|
||||||
|
"WebSearch",
|
||||||
|
"WebFetch(domain:registry.terraform.io)",
|
||||||
|
"Bash(C:UsersabAppDataLocalMicrosoftWinGetPackagesHashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbweterraform.exe apply -auto-approve)",
|
||||||
|
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -auto-approve)",
|
||||||
|
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -auto-approve -lock=false)",
|
||||||
|
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" plan -lock=false)",
|
||||||
|
"Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -replace=\"authentik_outpost.outposts[\"\"kubernetes-outpost\"\"]\" -auto-approve -lock=false)",
|
||||||
|
"Bash(terraform plan:*)"
|
||||||
|
],
|
||||||
|
"deny": [],
|
||||||
|
"ask": []
|
||||||
|
}
|
||||||
|
}
|
||||||
60
terraform/authentik/.terraform.lock.hcl
generated
60
terraform/authentik/.terraform.lock.hcl
generated
@@ -2,43 +2,43 @@
|
|||||||
# Manual edits may be lost in future updates.
|
# Manual edits may be lost in future updates.
|
||||||
|
|
||||||
provider "registry.terraform.io/goauthentik/authentik" {
|
provider "registry.terraform.io/goauthentik/authentik" {
|
||||||
version = "2025.12.1"
|
version = "2025.8.1"
|
||||||
constraints = ">= 2023.10.0, 2025.12.1"
|
constraints = ">= 2023.10.0, 2025.8.1"
|
||||||
hashes = [
|
hashes = [
|
||||||
"h1:p9AGeRqK50wTHEIp7z7O4MUP83cs+lt7wPajZ9m9TB8=",
|
"h1:R3h8ADB0Kkv/aoY0AaHkBiX2/P4+GnW8sSgkN30kJfQ=",
|
||||||
"zh:0e856d3b13614bc32346a236a8e84ba55ecd17238c2008d4b3e71aa8cb49f515",
|
"zh:0c3f1083fd48f20ed06959401ff1459fbb5d454d81c8175b5b6d321b308c0be3",
|
||||||
"zh:2dcc44cd499c18ebbc4f763eff97a7b725763c8ac8fbb5d69c935413ccdc4962",
|
"zh:21c6d93f8d26e688da38a660d121b5624e3597c426c671289f31a17a9771abbf",
|
||||||
"zh:434100fc75ec7cd6b64cc9497e8273e79325fa8d285e9fd9d341c1a67421643b",
|
"zh:301b5763ffc4c5fe47aa7e851ce0b19f71bab4fae5c81003ad81b38775e85f78",
|
||||||
"zh:483484f66d2e8ce6fa4bfd91e824ceebf07d10acb5df5f366397c55227c4ae91",
|
"zh:4f7ee6473f6a687340538ddac0ec4a0453664186b15fdb0bb2fb5fcd8fb3ad30",
|
||||||
"zh:596743a6f1c77a6f103b06ef8d932fe8f2376793b92478853dc84571d17c429f",
|
"zh:7927f4f634c9e072d4aa6620d09e97dc83eeb1dbd0667102086779cd5fc495c1",
|
||||||
"zh:5ed2d5eb7db13229baaf042c725d5c64b58ffdcc641370175e0a88900af94bf1",
|
"zh:84e7c2a3f3de721a54abe4c971d9a163127f5e4af91d023260fea305ac74bcf4",
|
||||||
"zh:8aecd4cf782c82bee01098f72fe4ffff83707516007b32a01c7fcb19a9260338",
|
"zh:92af52aaac518c426164eb731d282f51a5825e64e6a02b0695952177a7af7d9c",
|
||||||
"zh:928c05ecac309287ff7d73ed6e478350fe3003557658ae5dc2be817a4268dba7",
|
"zh:a6920a54d5df69342f4ea2d903676145b00e7375d2f2eecc0840858d83b3b4a8",
|
||||||
"zh:9b9fd36dfb3e75da8b4478485272505ae9a3c67b10db173e1d2d76cfe2b637b8",
|
"zh:ac8a60801fc55fd05b3471778f908ed43072e046997c0082644c9602b84dafec",
|
||||||
"zh:ab7cd8c61ab67a045854e32f0be1940a92746770dbf3c17bbe923e0259c4f897",
|
"zh:b1cc29e2878aa94a3827fd5e1dd8cffb98397aa4093d6a4852c6e53157e9b35f",
|
||||||
"zh:bb1360ec19a4fc1095d0ef1b7b6c5c3c1a91daac7cd1957d43a4cdbb7356a2e3",
|
"zh:c2d78f308c4d70a16ef4f6d1f4822a64f8f160d0a207f2121904cdd6f4942db4",
|
||||||
"zh:d2186f4063aa1a547b52a53745d472e43f5343bc1674f2bbb91421c61b0fab50",
|
"zh:ca970e5776f408059a84b4e17f6ac257ec92afae956be74f3807c548e4567eaa",
|
||||||
"zh:d74bbb67a77951b18ffd7b2863954e70ac03450ad2023cc305c66a5ff25d8d18",
|
"zh:eb2e3650ee0eec033207b6d72fcb938dc5846c6feb8a61ae30d61981ea411269",
|
||||||
"zh:f5970569ea0a479bbfbf2d452f5962e1c9bd472b82756db822d0e951363daa25",
|
"zh:fcb93e51c84ba592bc2b075d7342e475126e5029620959666999b5b1bd11cb98",
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
provider "registry.terraform.io/hashicorp/random" {
|
provider "registry.terraform.io/hashicorp/random" {
|
||||||
version = "3.8.1"
|
version = "3.7.2"
|
||||||
constraints = ">= 3.5.0"
|
constraints = ">= 3.5.0"
|
||||||
hashes = [
|
hashes = [
|
||||||
"h1:u8AKlWVDTH5r9YLSeswoVEjiY72Rt4/ch7U+61ZDkiQ=",
|
"h1:356j/3XnXEKr9nyicLUufzoF4Yr6hRy481KIxRVpK0c=",
|
||||||
"zh:08dd03b918c7b55713026037c5400c48af5b9f468f483463321bd18e17b907b4",
|
"zh:14829603a32e4bc4d05062f059e545a91e27ff033756b48afbae6b3c835f508f",
|
||||||
"zh:0eee654a5542dc1d41920bbf2419032d6f0d5625b03bd81339e5b33394a3e0ae",
|
"zh:1527fb07d9fea400d70e9e6eb4a2b918d5060d604749b6f1c361518e7da546dc",
|
||||||
"zh:229665ddf060aa0ed315597908483eee5b818a17d09b6417a0f52fd9405c4f57",
|
"zh:1e86bcd7ebec85ba336b423ba1db046aeaa3c0e5f921039b3f1a6fc2f978feab",
|
||||||
"zh:2469d2e48f28076254a2a3fc327f184914566d9e40c5780b8d96ebf7205f8bc0",
|
"zh:24536dec8bde66753f4b4030b8f3ef43c196d69cccbea1c382d01b222478c7a3",
|
||||||
"zh:37d7eb334d9561f335e748280f5535a384a88675af9a9eac439d4cfd663bcb66",
|
"zh:29f1786486759fad9b0ce4fdfbbfece9343ad47cd50119045075e05afe49d212",
|
||||||
"zh:741101426a2f2c52dee37122f0f4a2f2d6af6d852cb1db634480a86398fa3511",
|
"zh:4d701e978c2dd8604ba1ce962b047607701e65c078cb22e97171513e9e57491f",
|
||||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||||
"zh:a902473f08ef8df62cfe6116bd6c157070a93f66622384300de235a533e9d4a9",
|
"zh:7b8434212eef0f8c83f5a90c6d76feaf850f6502b61b53c329e85b3b281cba34",
|
||||||
"zh:b85c511a23e57a2147355932b3b6dce2a11e856b941165793a0c3d7578d94d05",
|
"zh:ac8a23c212258b7976e1621275e3af7099e7e4a3d4478cf8d5d2a27f3bc3e967",
|
||||||
"zh:c5172226d18eaac95b1daac80172287b69d4ce32750c82ad77fa0768be4ea4b8",
|
"zh:b516ca74431f3df4c6cf90ddcdb4042c626e026317a33c53f0b445a3d93b720d",
|
||||||
"zh:dab4434dba34aad569b0bc243c2d3f3ff86dd7740def373f2a49816bd2ff819b",
|
"zh:dc76e4326aec2490c1600d6871a95e78f9050f9ce427c71707ea412a2f2f1a62",
|
||||||
"zh:f49fd62aa8c5525a5c17abd51e27ca5e213881d58882fd42fec4a545b53c9699",
|
"zh:eac7b63e86c749c7d48f527671c7aee5b4e26c10be6ad7232d6860167f99dbb0",
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,81 +1,55 @@
|
|||||||
# Authentik Terraform Configuration
|
# Authentik Terraform Module
|
||||||
|
|
||||||
Root Terraform configuration for managing Authentik SSO — applications (OAuth2/OIDC, Proxy, SAML), groups, outposts, flows, certificates, and property mappings.
|
Terraform module for managing Authentik applications with OAuth2/OpenID and Proxy providers, including automatic Outpost assignment.
|
||||||
|
|
||||||
State is stored in Terraform Cloud (organization `ultradesu`, workspace `Authentik`).
|
|
||||||
|
|
||||||
## Structure
|
|
||||||
|
|
||||||
```
|
|
||||||
.
|
|
||||||
├── main.tf # Resources: groups, outposts, policy bindings, module calls
|
|
||||||
├── variables.tf # Input variable definitions
|
|
||||||
├── outputs.tf # Outputs (app details, groups, flows, wiki data)
|
|
||||||
├── providers.tf # Authentik provider (goauthentik/authentik 2025.12.1)
|
|
||||||
├── state.tf # Terraform Cloud backend
|
|
||||||
├── terraform.tfvars # General settings: authentik_url, outposts, flows, tags
|
|
||||||
├── oauth2-apps.auto.tfvars # OAuth2/OIDC application definitions
|
|
||||||
├── proxy-apps.auto.tfvars # Proxy application definitions
|
|
||||||
├── groups.auto.tfvars # Group definitions
|
|
||||||
└── modules/
|
|
||||||
├── oauth-provider/ # OAuth2/OIDC provider + application
|
|
||||||
├── proxy-provider/ # Proxy provider + application
|
|
||||||
└── saml-provider/ # SAML provider + application
|
|
||||||
```
|
|
||||||
|
|
||||||
## Usage
|
## Usage
|
||||||
|
|
||||||
```bash
|
|
||||||
# Set the API token
|
|
||||||
export TF_VAR_authentik_token="..."
|
|
||||||
|
|
||||||
terraform init
|
|
||||||
terraform plan
|
|
||||||
terraform apply
|
|
||||||
```
|
|
||||||
|
|
||||||
All `*.auto.tfvars` files are loaded automatically — no `-var-file` flags needed.
|
|
||||||
|
|
||||||
## Adding applications
|
|
||||||
|
|
||||||
OAuth2/OIDC — add to `oauth2-apps.auto.tfvars`:
|
|
||||||
|
|
||||||
```hcl
|
```hcl
|
||||||
oauth_applications = {
|
module "authentik" {
|
||||||
"my-app" = {
|
source = "./authentik"
|
||||||
name = "My App"
|
|
||||||
slug = "my-app"
|
authentik_url = "https://auth.example.com"
|
||||||
group = "Tools"
|
authentik_token = var.authentik_token
|
||||||
redirect_uris = ["https://my-app.example.com/callback"]
|
|
||||||
create_group = true
|
oauth_applications = {
|
||||||
access_groups = ["admins"]
|
"gitlab" = {
|
||||||
|
name = "GitLab OAuth"
|
||||||
|
slug = "gitlab"
|
||||||
|
redirect_uris = ["https://gitlab.example.com/users/auth/openid_connect/callback"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
proxy_applications = {
|
||||||
|
"portainer" = {
|
||||||
|
name = "Portainer"
|
||||||
|
slug = "portainer"
|
||||||
|
external_host = "https://portainer.example.com"
|
||||||
|
internal_host = "http://portainer:9000"
|
||||||
|
outpost = "k8s-outpost"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
outposts = {
|
||||||
|
"k8s-outpost" = {
|
||||||
|
name = "Kubernetes Outpost"
|
||||||
|
type = "proxy"
|
||||||
|
service_connection = "k8s-local"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
Proxy — add to `proxy-apps.auto.tfvars`:
|
## Structure
|
||||||
|
|
||||||
```hcl
|
- `main.tf` - Main configuration
|
||||||
proxy_applications = {
|
- `variables.tf` - Input variables
|
||||||
"my-proxy" = {
|
- `outputs.tf` - Output values
|
||||||
name = "My Proxy"
|
- `modules/oauth-provider/` - OAuth2/OIDC provider module
|
||||||
slug = "my-proxy"
|
- `modules/proxy-provider/` - Proxy provider module
|
||||||
group = "Tools"
|
- `terraform.tfvars.example` - Configuration example
|
||||||
external_host = "https://my-proxy.example.com"
|
|
||||||
internal_host = "http://my-service.namespace.svc:80"
|
|
||||||
outpost = "kubernetes-outpost"
|
|
||||||
create_group = true
|
|
||||||
access_groups = ["admins"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
## CI/CD
|
|
||||||
|
|
||||||
Managed via Gitea Actions (`.gitea/workflows/authentik-apps.yaml`). Runs `terraform apply` on push to `main` when files in `terraform/authentik/` change. Also generates a wiki page with the applications list.
|
|
||||||
|
|
||||||
## Requirements
|
## Requirements
|
||||||
|
|
||||||
- Terraform >= 1.0
|
- Terraform >= 1.0
|
||||||
- goauthentik/authentik provider 2025.12.1
|
- Authentik provider >= 2023.10.0
|
||||||
- Authentik API token with admin permissions
|
- Authentik API token with admin permissions
|
||||||
@@ -31,7 +31,7 @@ resource "authentik_group" "child_groups" {
|
|||||||
|
|
||||||
name = each.value.name
|
name = each.value.name
|
||||||
is_superuser = each.value.is_superuser
|
is_superuser = each.value.is_superuser
|
||||||
parents = authentik_group.root_groups[each.value.parent].id
|
parent = authentik_group.root_groups[each.value.parent].id
|
||||||
attributes = jsonencode(each.value.attributes)
|
attributes = jsonencode(each.value.attributes)
|
||||||
|
|
||||||
depends_on = [authentik_group.root_groups]
|
depends_on = [authentik_group.root_groups]
|
||||||
@@ -292,60 +292,7 @@ resource "authentik_outpost" "outposts" {
|
|||||||
authentik_host_browser = ""
|
authentik_host_browser = ""
|
||||||
object_naming_template = "ak-outpost-%(name)s"
|
object_naming_template = "ak-outpost-%(name)s"
|
||||||
authentik_host_insecure = false
|
authentik_host_insecure = false
|
||||||
kubernetes_json_patches = {
|
kubernetes_json_patches = null
|
||||||
deployment = [
|
|
||||||
{
|
|
||||||
op = "add"
|
|
||||||
path = "/spec/template/spec/containers/0/env/-"
|
|
||||||
value = {
|
|
||||||
name = "AUTHENTIK_POSTGRESQL__HOST"
|
|
||||||
value = "psql.psql.svc"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
op = "add"
|
|
||||||
path = "/spec/template/spec/containers/0/env/-"
|
|
||||||
value = {
|
|
||||||
name = "AUTHENTIK_POSTGRESQL__PORT"
|
|
||||||
value = "5432"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
op = "add"
|
|
||||||
path = "/spec/template/spec/containers/0/env/-"
|
|
||||||
value = {
|
|
||||||
name = "AUTHENTIK_POSTGRESQL__NAME"
|
|
||||||
value = "authentik"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
op = "add"
|
|
||||||
path = "/spec/template/spec/containers/0/env/-"
|
|
||||||
value = {
|
|
||||||
name = "AUTHENTIK_POSTGRESQL__USER"
|
|
||||||
valueFrom = {
|
|
||||||
secretKeyRef = {
|
|
||||||
name = "authentik-creds"
|
|
||||||
key = "AUTHENTIK_POSTGRESQL__USER"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
op = "add"
|
|
||||||
path = "/spec/template/spec/containers/0/env/-"
|
|
||||||
value = {
|
|
||||||
name = "AUTHENTIK_POSTGRESQL__PASSWORD"
|
|
||||||
valueFrom = {
|
|
||||||
secretKeyRef = {
|
|
||||||
name = "authentik-creds"
|
|
||||||
key = "AUTHENTIK_POSTGRESQL__PASSWORD"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
kubernetes_service_type = "ClusterIP"
|
kubernetes_service_type = "ClusterIP"
|
||||||
kubernetes_image_pull_secrets = []
|
kubernetes_image_pull_secrets = []
|
||||||
kubernetes_ingress_class_name = null
|
kubernetes_ingress_class_name = null
|
||||||
@@ -358,4 +305,4 @@ resource "authentik_outpost" "outposts" {
|
|||||||
module.oauth_applications,
|
module.oauth_applications,
|
||||||
module.proxy_applications
|
module.proxy_applications
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@@ -126,15 +126,15 @@ oauth_applications = {
|
|||||||
}
|
}
|
||||||
|
|
||||||
"home-assistant-lms" = {
|
"home-assistant-lms" = {
|
||||||
name = "Home Assistant LMS"
|
name = "Home Assistant LMS"
|
||||||
slug = "home-assistant-lms"
|
slug = "home-assistant-lms"
|
||||||
group = "Internal"
|
group = "Internal"
|
||||||
meta_description = "Home Assistant Limassol"
|
meta_description = "Home Assistant Limassol"
|
||||||
meta_icon = "https://img.icons8.com/stickers/100/smart-home-automation.png"
|
meta_icon = "https://img.icons8.com/stickers/100/smart-home-automation.png"
|
||||||
redirect_uris = [
|
redirect_uris = [
|
||||||
"http://ha-lms:8123/auth/oidc/callback",
|
"http://ha-lms:8123/auth/oidc/callback",
|
||||||
"http://ha-lms.homenet:8123/auth/oidc/callback",
|
"http://ha-lms.homenet:8123/auth/oidc/callback",
|
||||||
]
|
]
|
||||||
meta_launch_url = "http://ha-lms:8123/auth/oidc/welcome"
|
meta_launch_url = "http://ha-lms:8123/auth/oidc/welcome"
|
||||||
client_type = "confidential"
|
client_type = "confidential"
|
||||||
include_claims_in_id_token = true
|
include_claims_in_id_token = true
|
||||||
@@ -147,15 +147,15 @@ oauth_applications = {
|
|||||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||||
}
|
}
|
||||||
"home-assistant-london" = {
|
"home-assistant-london" = {
|
||||||
name = "Home Assistant London"
|
name = "Home Assistant London"
|
||||||
slug = "home-assistant-london"
|
slug = "home-assistant-london"
|
||||||
group = "Internal"
|
group = "Internal"
|
||||||
meta_description = "Home Assistant London"
|
meta_description = "Home Assistant London"
|
||||||
meta_icon = "https://img.icons8.com/stickers/100/smart-home-automation.png"
|
meta_icon = "https://img.icons8.com/stickers/100/smart-home-automation.png"
|
||||||
redirect_uris = [
|
redirect_uris = [
|
||||||
"http://ha-london:8123/auth/oidc/callback",
|
"http://ha-london:8123/auth/oidc/callback",
|
||||||
"http://ha-london.tail2fe2d.ts.net:8123/auth/oidc/callback",
|
"http://ha-london.tail2fe2d.ts.net:8123/auth/oidc/callback",
|
||||||
]
|
]
|
||||||
meta_launch_url = "http://ha-london:8123/auth/oidc/welcome"
|
meta_launch_url = "http://ha-london:8123/auth/oidc/welcome"
|
||||||
client_type = "confidential"
|
client_type = "confidential"
|
||||||
include_claims_in_id_token = true
|
include_claims_in_id_token = true
|
||||||
@@ -169,14 +169,14 @@ oauth_applications = {
|
|||||||
}
|
}
|
||||||
|
|
||||||
"openwebui" = {
|
"openwebui" = {
|
||||||
name = "OpenWeb UI"
|
name = "OpenWeb UI"
|
||||||
slug = "openwebui"
|
slug = "openwebui"
|
||||||
group = "Tools"
|
group = "Tools"
|
||||||
meta_description = "OpenWeb UI"
|
meta_description = "OpenWeb UI"
|
||||||
meta_icon = "https://ollama.com/public/ollama.png"
|
meta_icon = "https://ollama.com/public/ollama.png"
|
||||||
redirect_uris = [
|
redirect_uris = [
|
||||||
"https://ai.hexor.cy/oauth/oidc/callback",
|
"https://ai.hexor.cy/oauth/oidc/callback",
|
||||||
]
|
]
|
||||||
meta_launch_url = "https://ai.hexor.cy"
|
meta_launch_url = "https://ai.hexor.cy"
|
||||||
client_type = "confidential"
|
client_type = "confidential"
|
||||||
include_claims_in_id_token = true
|
include_claims_in_id_token = true
|
||||||
@@ -188,45 +188,5 @@ oauth_applications = {
|
|||||||
create_group = true
|
create_group = true
|
||||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||||
}
|
}
|
||||||
"matrix" = {
|
|
||||||
name = "Matrix Chat"
|
|
||||||
slug = "matrix"
|
|
||||||
group = "Tools"
|
|
||||||
meta_description = "Matrix Chat"
|
|
||||||
meta_icon = "https://img.icons8.com/ios/100/40C057/matrix-logo.png"
|
|
||||||
redirect_uris = [
|
|
||||||
"https://auth.matrix.hexor.cy/upstream/callback/001KKV4EKY7KG98W2M9T806K6A",
|
|
||||||
]
|
|
||||||
meta_launch_url = "https://chat.matrix.hexor.cy"
|
|
||||||
client_type = "confidential"
|
|
||||||
include_claims_in_id_token = true
|
|
||||||
access_code_validity = "minutes=1"
|
|
||||||
access_token_validity = "minutes=5"
|
|
||||||
refresh_token_validity = "days=30"
|
|
||||||
scope_mappings = ["openid", "profile", "email"]
|
|
||||||
access_groups = []
|
|
||||||
create_group = false
|
|
||||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
|
||||||
}
|
|
||||||
"furumi-ng-web" = {
|
|
||||||
name = "Furumi Web Player"
|
|
||||||
slug = "furumi-ng-web"
|
|
||||||
group = "Tools"
|
|
||||||
meta_description = "Furumi Web Player"
|
|
||||||
meta_icon = "https://img.icons8.com/pulsar-color/48/music.png"
|
|
||||||
redirect_uris = [
|
|
||||||
"https://music.hexor.cy/auth/callback",
|
|
||||||
]
|
|
||||||
meta_launch_url = "https://music.hexor.cy"
|
|
||||||
client_type = "confidential"
|
|
||||||
include_claims_in_id_token = true
|
|
||||||
access_code_validity = "minutes=1"
|
|
||||||
access_token_validity = "minutes=5"
|
|
||||||
refresh_token_validity = "days=30"
|
|
||||||
scope_mappings = ["openid", "profile", "email"]
|
|
||||||
access_groups = []
|
|
||||||
create_group = true
|
|
||||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -2,7 +2,7 @@ terraform {
|
|||||||
required_providers {
|
required_providers {
|
||||||
authentik = {
|
authentik = {
|
||||||
source = "goauthentik/authentik"
|
source = "goauthentik/authentik"
|
||||||
version = "2025.12.1"
|
version = "2025.8.1"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -10,4 +10,4 @@ terraform {
|
|||||||
provider "authentik" {
|
provider "authentik" {
|
||||||
url = var.authentik_url
|
url = var.authentik_url
|
||||||
token = var.authentik_token
|
token = var.authentik_token
|
||||||
}
|
}
|
||||||
@@ -77,8 +77,46 @@ EOT
|
|||||||
create_group = true
|
create_group = true
|
||||||
access_groups = ["admins"]
|
access_groups = ["admins"]
|
||||||
}
|
}
|
||||||
|
|
||||||
# Tools applications
|
# Tools applications
|
||||||
|
"vpn" = {
|
||||||
|
name = "VPN"
|
||||||
|
slug = "vpn"
|
||||||
|
group = "Tools"
|
||||||
|
external_host = "https://of.hexor.cy"
|
||||||
|
internal_host = "http://outfleet.vpn.svc"
|
||||||
|
internal_host_ssl_validation = false
|
||||||
|
meta_description = ""
|
||||||
|
skip_path_regex = <<-EOT
|
||||||
|
/u/
|
||||||
|
/stat/
|
||||||
|
/ss/
|
||||||
|
/xray/
|
||||||
|
/dynamic/
|
||||||
|
EOT
|
||||||
|
meta_icon = "https://img.icons8.com/?size=100&id=fqAD3lAB6zTe&format=png&color=000000"
|
||||||
|
mode = "proxy"
|
||||||
|
outpost = "kubernetes-outpost"
|
||||||
|
create_group = true
|
||||||
|
access_groups = ["admins"]
|
||||||
|
}
|
||||||
|
|
||||||
|
"outfleet-rs" = {
|
||||||
|
name = "OutFleet"
|
||||||
|
slug = "outfleet-rs"
|
||||||
|
group = "Tools"
|
||||||
|
external_host = "https://vpn.hexor.cy"
|
||||||
|
internal_host = "http://outfleet-rs.vpn.svc"
|
||||||
|
internal_host_ssl_validation = false
|
||||||
|
meta_description = ""
|
||||||
|
skip_path_regex = <<-EOT
|
||||||
|
/sub/
|
||||||
|
EOT
|
||||||
|
meta_icon = "https://img.icons8.com/?size=100&id=fqAD3lAB6zTe&format=png&color=000000"
|
||||||
|
mode = "proxy"
|
||||||
|
outpost = "kubernetes-outpost"
|
||||||
|
create_group = true
|
||||||
|
access_groups = ["admins"]
|
||||||
|
}
|
||||||
"qbittorrent" = {
|
"qbittorrent" = {
|
||||||
name = "qBittorent"
|
name = "qBittorent"
|
||||||
slug = "qbittorent"
|
slug = "qbittorent"
|
||||||
@@ -151,7 +189,7 @@ EOT
|
|||||||
meta_icon = "https://img.icons8.com/liquid-glass/48/key.png"
|
meta_icon = "https://img.icons8.com/liquid-glass/48/key.png"
|
||||||
mode = "proxy"
|
mode = "proxy"
|
||||||
outpost = "kubernetes-outpost"
|
outpost = "kubernetes-outpost"
|
||||||
access_groups = ["admins", "khm"]
|
access_groups = ["admins", "khm"] # Используем существующие группы
|
||||||
create_group = true
|
create_group = true
|
||||||
access_groups = ["admins"]
|
access_groups = ["admins"]
|
||||||
}
|
}
|
||||||
@@ -191,20 +229,5 @@ EOT
|
|||||||
create_group = true
|
create_group = true
|
||||||
access_groups = ["admins"]
|
access_groups = ["admins"]
|
||||||
}
|
}
|
||||||
"ollama-public" = {
|
|
||||||
name = "Ollama Public"
|
|
||||||
slug = "ollama-public"
|
|
||||||
group = "AI"
|
|
||||||
external_host = "https://ollama.hexor.cy"
|
|
||||||
internal_host = "http://ollama.ollama.svc:11434"
|
|
||||||
internal_host_ssl_validation = false
|
|
||||||
meta_description = ""
|
|
||||||
meta_icon = "https://img.icons8.com/external-icongeek26-outline-icongeek26/64/external-llama-animal-head-icongeek26-outline-icongeek26.png"
|
|
||||||
mode = "proxy"
|
|
||||||
outpost = "kubernetes-outpost"
|
|
||||||
intercept_header_auth = true
|
|
||||||
create_group = true
|
|
||||||
access_groups = ["admins"]
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -4,7 +4,7 @@ variable "oauth_applications" {
|
|||||||
name = string
|
name = string
|
||||||
slug = string
|
slug = string
|
||||||
group = optional(string, "")
|
group = optional(string, "")
|
||||||
policy_engine_mode = optional(string, "any")
|
policy_engine_mode = optional(string, "all")
|
||||||
meta_description = optional(string, "")
|
meta_description = optional(string, "")
|
||||||
meta_launch_url = optional(string, "")
|
meta_launch_url = optional(string, "")
|
||||||
meta_icon = optional(string, "")
|
meta_icon = optional(string, "")
|
||||||
@@ -32,7 +32,7 @@ variable "proxy_applications" {
|
|||||||
name = string
|
name = string
|
||||||
slug = string
|
slug = string
|
||||||
group = optional(string, "")
|
group = optional(string, "")
|
||||||
policy_engine_mode = optional(string, "any")
|
policy_engine_mode = optional(string, "all")
|
||||||
meta_description = optional(string, "")
|
meta_description = optional(string, "")
|
||||||
meta_launch_url = optional(string, "")
|
meta_launch_url = optional(string, "")
|
||||||
meta_icon = optional(string, "")
|
meta_icon = optional(string, "")
|
||||||
@@ -60,7 +60,7 @@ variable "saml_applications" {
|
|||||||
name = string
|
name = string
|
||||||
slug = string
|
slug = string
|
||||||
group = optional(string, "")
|
group = optional(string, "")
|
||||||
policy_engine_mode = optional(string, "any")
|
policy_engine_mode = optional(string, "all")
|
||||||
meta_description = optional(string, "")
|
meta_description = optional(string, "")
|
||||||
meta_launch_url = optional(string, "")
|
meta_launch_url = optional(string, "")
|
||||||
meta_icon = optional(string, "")
|
meta_icon = optional(string, "")
|
||||||
@@ -95,7 +95,7 @@ variable "flows" {
|
|||||||
title = string
|
title = string
|
||||||
slug = string
|
slug = string
|
||||||
designation = string
|
designation = string
|
||||||
policy_engine_mode = optional(string, "any")
|
policy_engine_mode = optional(string, "all")
|
||||||
compatibility_mode = optional(bool, false)
|
compatibility_mode = optional(bool, false)
|
||||||
layout = optional(string, "stacked")
|
layout = optional(string, "stacked")
|
||||||
denied_action = optional(string, "message_continue")
|
denied_action = optional(string, "message_continue")
|
||||||
|
|||||||
Reference in New Issue
Block a user