Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-06-16 02:49:51

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

README.md

@@ -42,6 +42,7 @@ ArgoCD homelab project
 
 | Application | Status |
 | :--- | :---: |
+| **amnezia** | [![amnezia](https://ag.hexor.cy/api/badge?name=amnezia&revision=true)](https://ag.hexor.cy/applications/argocd/amnezia) |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
 | **furumi** | [![furumi](https://ag.hexor.cy/api/badge?name=furumi&revision=true)](https://ag.hexor.cy/applications/argocd/furumi) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
@@ -53,6 +54,7 @@ ArgoCD homelab project
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
 | **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
+| **llamacpp** | [![llamacpp](https://ag.hexor.cy/api/badge?name=llamacpp&revision=true)](https://ag.hexor.cy/applications/argocd/llamacpp) |
 | **matrix** | [![matrix](https://ag.hexor.cy/api/badge?name=matrix&revision=true)](https://ag.hexor.cy/applications/argocd/matrix) |
 | **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
 | **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |

k8s/apps/amnezia/configmap-scripts.yaml

@@ -30,21 +30,6 @@ data:
       fi
     }
 
-    delete_rule() {
-      local table_args=()
-      if [ "${1:-}" = "-t" ]; then
-        table_args=("$1" "$2")
-        shift 2
-      fi
-
-      local chain="$1"
-      shift
-
-      while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
-        true
-      done
-    }
-
     ensure_append_rule() {
       local table_args=()
       if [ "${1:-}" = "-t" ]; then
@@ -71,7 +56,6 @@ data:
 
     sysctl -w net.ipv4.ip_forward=1
 
-    delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
     ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
     ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
     ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
@@ -116,7 +100,6 @@ data:
     fi
 
     delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
-    delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
     delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
     delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
     delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT

k8s/apps/gitea/deployment.yaml

@@ -41,18 +41,18 @@ spec:
             - name: GITEA__service__REGISTER_MANUAL_CONFIRM
               value: "true"
             - name: GITEA__service__ENABLE_CAPTCHA
-              value: "true"
-            - name: GITEA__service__REQUIRE_CAPTCHA_FOR_LOGIN
               value: "false"
+            - name: GITEA__service__REQUIRE_CAPTCHA_FOR_LOGIN
+              value: "true"
             - name: GITEA__service__REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA
               value: "true"
             - name: GITEA__service__CAPTCHA_TYPE
-              value: "cfturnstile"
+              value: "hcaptcha"
             - name: GITEA__webhook__ALLOWED_HOST_LIST
               value: "*"
           envFrom:
           - secretRef:
-              name: gitea-runner-act-runner-secrets
+              name: gitea-recapcha-creds
           ports:
             - name: http
               containerPort: 3000

k8s/apps/gitea/external-secrets.yaml

@@ -13,10 +13,6 @@ spec:
       data:
         token: |-
           {{ .password }}
-        GITEA__service__CF_TURNSTILE_SITEKEY: |-
-          {{ .CF_TURNSTILE_SITEKEY }}
-        GITEA__service__CF_TURNSTILE_SECRET: |-
-          {{ .CF_TURNSTILE_SECRET }}
   data:
     - secretKey: password
       sourceRef:
@@ -26,19 +22,38 @@ spec:
       remoteRef:
         key: e475b5ab-ea3c-48a5-bb4c-a6bc552fc064
         property: login.password
-    - secretKey: CF_TURNSTILE_SITEKEY
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-recapcha-creds
+spec:
+  refreshInterval: 1m
+  target:
+    name: gitea-recapcha-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        GITEA__service__HCAPTCHA_SITEKEY: |-
+          {{ .HCAPTCHA_SITEKEY }}
+        GITEA__service__HCAPTCHA_SECRET: |-
+          {{ .HCAPTCHA_SECRET }}
+  data:
+    - secretKey: HCAPTCHA_SITEKEY
       sourceRef:
         storeRef:
           name: vaultwarden-login
           kind: ClusterSecretStore
       remoteRef:
-        key: e475b5ab-ea3c-48a5-bb4c-a6bc552fc064
+        key: 89c8d8d2-6b53-42c5-805f-38a341ef163e
-        property: fields[0].value
+        property: login.username
-    - secretKey: CF_TURNSTILE_SECRET
+    - secretKey: HCAPTCHA_SECRET
       sourceRef:
         storeRef:
           name: vaultwarden-login
           kind: ClusterSecretStore
       remoteRef:
-        key: e475b5ab-ea3c-48a5-bb4c-a6bc552fc064
+        key: 89c8d8d2-6b53-42c5-805f-38a341ef163e
-        property: fields[1].value
+        property: login.password

k8s/apps/llamacpp/configmap-cuda.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: llamacpp-cuda-config
-data:
-  LLAMA_CACHE: /models
-  LLAMA_ARG_HOST: 0.0.0.0
-  LLAMA_ARG_PORT: "8080"
-  LLAMA_ARG_HF_REPO: "unsloth/gemma-4-12b-it-GGUF:Q6_K"
-  LLAMA_ARG_CTX_SIZE: "128000"
-  LLAMA_ARG_FLASH_ATTN: auto
-  LLAMA_ARG_FIT: "on"

k8s/apps/llamacpp/deployment-cuda.yaml

@@ -1,72 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: llamacpp-cuda
-  annotations:
-    reloader.stakater.com/auto: "true"
-  labels:
-    app: llamacpp-cuda
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: llamacpp-cuda
-  template:
-    metadata:
-      labels:
-        app: llamacpp-cuda
-    spec:
-      dnsPolicy: Default
-      runtimeClassName: nvidia
-      nodeSelector:
-        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: desktop
-          effect: NoSchedule
-      containers:
-        - name: llamacpp
-          image: ghcr.io/ggml-org/llama.cpp:server-cuda-b9501
-          imagePullPolicy: IfNotPresent
-          envFrom:
-            - configMapRef:
-                name: llamacpp-cuda-config
-          env:
-            - name: HF_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: llamacpp-hf-token
-                  key: token
-                  optional: true
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          resources:
-            limits:
-              nvidia.com/gpu: 1
-          startupProbe:
-            httpGet:
-              path: /health
-              port: http
-            failureThreshold: 180
-            periodSeconds: 10
-            timeoutSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            failureThreshold: 3
-            periodSeconds: 10
-            timeoutSeconds: 5
-          volumeMounts:
-            - name: models
-              mountPath: /models
-      volumes:
-        - name: models
-          hostPath:
-            path: /data/llama.cpp/models
-            type: DirectoryOrCreate

k8s/apps/llamacpp/kustomization.yaml

@@ -3,9 +3,6 @@ kind: Kustomization
 
 resources:
   - app.yaml
-  - configmap-cuda.yaml
   - configmap.yaml
-  - deployment-cuda.yaml
   - deployment.yaml
-  - service-cuda.yaml
   - service.yaml

k8s/apps/llamacpp/service-cuda.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: llamacpp-cuda
-  labels:
-    app: llamacpp-cuda
-spec:
-  type: ClusterIP
-  selector:
-    app: llamacpp-cuda
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
-      protocol: TCP

k8s/apps/n8n/kustomization.yaml

@@ -15,14 +15,14 @@ resources:
   - service.yaml
   - ingress.yaml
 
-# helmCharts:
+helmCharts:
-#   - name: yacy
+  - name: yacy
-#     repo: https://gt.hexor.cy/api/packages/ab/helm
+    repo: https://gt.hexor.cy/api/packages/ab/helm
-#     version: 0.1.2
+    version: 0.1.2
-#     releaseName: yacy
+    releaseName: yacy
-#     namespace: n8n
+    namespace: n8n
-#     valuesFile: values-yacy.yaml
+    valuesFile: values-yacy.yaml
-#     includeCRDs: true
+    includeCRDs: true
 
 commonLabels:
   app.kubernetes.io/name: n8n

k8s/apps/pasarguard/deployment.yaml

@@ -11,7 +11,7 @@ spec:
   selector:
     matchLabels:
       app: pasarguard
-  replicas: 2
+  replicas: 1
   strategy:
     type: RollingUpdate
   template:
@@ -34,7 +34,7 @@ spec:
               mountPath: /templates/subscription
       containers:
         - name: pasarguard-web
-          image: pasarguard/panel:v5.0.3
+          image: pasarguard/panel:v5.0.1
           imagePullPolicy: Always
           envFrom:
             - secretRef:
@@ -50,10 +50,6 @@ spec:
               value: "/app/tls/tls.crt"
             - name: UVICORN_SSL_KEYFILE
               value: "/app/tls/tls.key"
-            - name: UVICORN_PROXY_HEADERS
-              value: "true"
-            - name: FORWARDED_ALLOW_IPS
-              value: "*"
             - name: CUSTOM_TEMPLATES_DIRECTORY
               value: "/code/app/templates/"
             - name: SUBSCRIPTION_PAGE_TEMPLATE

k8s/core/longhorn/kustomization.yaml

@@ -7,7 +7,7 @@ kind: Kustomization
 helmCharts:
   - name: longhorn
     repo: https://charts.longhorn.io
-    version: 1.12.0
+    version: 1.11.2
     releaseName: longhorn
     namespace: longhorn
     valuesFile: values.yaml

k8s/core/longhorn/values.yaml

@@ -1,54 +1,7 @@
-global:
-  tolerations:
-    - key: "workload"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoExecute"
-
-longhornManager:
-  tolerations:
-    - key: "workload"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoExecute"
-
-longhornDriver:
-  tolerations:
-    - key: "workload"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoExecute"
-
 longhornUI:
   replicas: 1
-  tolerations:
-    - key: "workload"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "node.kubernetes.io/unreachable"
-      operator: "Exists"
-      effect: "NoExecute"
 
 defaultSettings:
-  taintToleration: "workload=ai:NoSchedule; workload=desktop:NoSchedule; node.kubernetes.io/unreachable:NoSchedule; node.kubernetes.io/unreachable:NoExecute"
   # Keep new instance-manager pods schedulable on nodes with high CPU requests.
   guaranteedInstanceManagerCPU: '{"v1":"6","v2":"6"}'