trying some steam containers

apps/games/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: games
+
+resources: 
+  - namespace.yaml
+
+helmCharts:
+  - name: games-on-whales
+    releaseName: games-on-whales
+    version: 2.0.0
+    valuesFile: values.yaml
+    repo: https://angelnu.github.io/helm-charts
+

apps/games/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder
+  labels:
+    pod-security.kubernetes.io/enforce: privileged 

apps/games/values.yaml

@@ -0,0 +1,143 @@
+#
+# IMPORTANT NOTE
+#
+# This chart inherits from our common library chart. You can check the default values/options here:
+# https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml
+#
+
+ingress:
+  # -- Enable and configure ingress settings for the chart under this key.
+  # @default -- See values.yaml
+  main:
+    enabled: false
+
+service:
+  # -- Enable and configure TCP service settings for the chart under this key.
+  # @default -- See values.yaml
+  main: {}
+  # type: LoadBalancer
+  # loadBalancerIP: 192.168.1.129
+
+  # -- Enable and configure UDP service settings for the chart under this key.
+  # @default -- See values.yaml
+  udp: {}
+  # type: LoadBalancer
+  # loadBalancerIP: 192.168.1.129
+
+# -- Configure persistence settings for the chart under this key.
+# @default -- See values.yaml
+persistence:
+  home:
+    enabled: true
+    type: emptyDir
+    mountPath: /home/retro
+
+# -- (object) Pass GPU resources to Xorg, steam and retroarch containers
+# See Custom configuration section in the Readme
+graphic_resources:
+
+sunshine:
+  image:
+    # -- sunshine image repository
+    repository: ghcr.io/games-on-whales/sunshine
+    # -- sunshine image tag
+    tag: 1.0.0
+    # -- sunshine image pull policy
+    pullPolicy: IfNotPresent
+  # -- sunshine web interface user
+  user: admin
+  # -- sunshine web interface pasword
+  password: admin
+  # -- sunshine log level
+  logLevel: info
+  # -- sunshine additional env settings
+  env: {}
+xorg:
+  image:
+    # -- xorg image repository
+    repository: ghcr.io/games-on-whales/xorg
+    # -- xorg image tag
+    tag: 1.0.0
+    # -- xorg image pull policy
+    pullPolicy: IfNotPresent
+  # -- xorg display ID
+  # display: :99
+  # -- xorg refresh rate
+  # refreshrate: 60
+  # -- xorg resolution
+  resolution: 1920x1080
+pulseaudio:
+  image:
+    # -- pulseaudio image repository
+    repository: ghcr.io/games-on-whales/pulseaudio
+    # -- pulseaudio image tag
+    tag: 1.0.0
+    # -- pulseaudio image pull policy
+    pullPolicy: IfNotPresent
+retroarch:
+  # -- enable/disable retroarch container
+  enabled: true
+  image:
+    # -- retroarch image repository
+    repository: ghcr.io/games-on-whales/retroarch
+    # -- retroarch image tag
+    tag: 1.0.0
+    # -- retroarch image pull policy
+    pullPolicy: IfNotPresent
+  # -- retroarch log level
+  logLevel: info
+  # -- retroarch extra volume mounts
+  volumeMounts: []
+steam:
+  # -- enable/disable steam container
+  enabled: true
+  image:
+    # -- steam image repository
+    repository: ghcr.io/games-on-whales/steam
+    # -- steam image tag
+    tag: 1.0.0
+    # -- steam image pull policy
+    pullPolicy: IfNotPresent
+  # -- enable proton log
+  protonLog: 1
+  # -- steam extra volume mounts
+  volumeMounts: []
+firefox:
+  # -- enable/disable firefox container
+  enabled: true
+  image:
+    # -- image repository
+    repository: andrewmackrodt/firefox-x11
+    # -- image tag
+    tag: 125.0.2-r1
+    # -- image pull policy
+    pullPolicy: IfNotPresent
+  # -- firefox log level
+  logLevel: info
+  # -- firefox extra volume mounts
+  volumeMounts: []
+mkhomeretrodirs:
+  image:
+    # -- image repository
+    repository: busybox
+    # -- image tag
+    tag: 1.36.1
+    # -- image pull policy
+    pullPolicy: IfNotPresent
+
+# -- Configure pulse audio settings
+# @default -- See values.yaml
+pulse:
+  config:
+    default.pa: |-
+      .fail
+          load-module module-null-sink sink_name=sunshine
+          set-default-sink sunshine
+          load-module module-native-protocol-unix auth-anonymous=1 socket=/tmp/pulse/pulse-socket
+    client.conf: |-
+      default-sink = sink-sunshine-stereo
+      autospawn = no
+      daemon-binary = /bin/true
+    daemon.conf: |-
+      exit-idle-time = -1
+      flat-volumes = yes

apps/immich/kustomization.yaml

@@ -21,9 +21,9 @@ helmCharts:
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.114.0
+    newTag: v1.116.2
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.114.0
+    newTag: v1.116.2
 
 
 patches:

apps/steam/deployment.yaml

@@ -0,0 +1,106 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: steam-headless
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: steam-headless
+  template:
+    metadata:
+      labels:
+        app: steam-headless
+    spec:
+      hostNetwork: true
+      securityContext:
+        fsGroup: 1000
+      nodeSelector:
+        gpu: full
+      containers:
+      - name: steam-headless
+        securityContext:
+          privileged: true
+        image: josh5/steam-headless:latest
+        resources: #Change CPU and Memory below
+          requests:
+            memory: "4G"
+            cpu: "1"
+          limits:
+            memory: "12G"
+            cpu: "4"
+        # set nodeSelector to the node label that matches the node you want to run the pod on
+        volumeMounts:
+        - name: home-dir
+          mountPath: /home/default/
+        - name: games-dir
+          mountPath: /mnt/games/
+        - name: input-devices
+          mountPath: /dev/input/
+        - name: dshm
+          mountPath: /dev/shm
+        - name: dri
+          mountPath: /dev/dri/
+        env: #Environmental Vars
+        - name: NAME
+          value: 'SteamHeadless'
+        - name: TZ
+          value: 'Europe/Zurich'
+        - name: USER_LOCALES
+          value: 'en_US.UTF-8 UTF-8'
+        - name: DISPLAY
+          value: ':55'
+        - name: SHM_SIZE
+          value: '2G'
+        - name: PUID
+          value: '1000'
+        - name: PGID
+          value: '1000'
+        - name: UMASK
+          value: '000'
+        - name: USER_PASSWORD
+          value: 'password' #changeme
+        - name: MODE
+          value: 'primary'
+        - name: WEB_UI_MODE
+          value: 'vnc'
+        - name: ENABLE_VNC_AUDIO
+          value: 'false'
+        - name: PORT_NOVNC_WEB
+          value: '8083'
+        - name: ENABLE_SUNSHINE
+          value: 'true'
+        - name: SUNSHINE_USER
+          value: 'sam'
+        - name: SUNSHINE_PASS
+          value: 'password'
+        - name: ENABLE_EVDEV_INPUTS
+          value: 'false'
+        ports:
+        # novnc
+        - containerPort: 8083
+        # moonlight webui
+        - containerPort: 47990
+        # moonlight stream
+        - containerPort: 47989
+        - containerPort: 47984
+        - containerPort: 48010
+        - containerPort: 47998
+        - containerPort: 47999
+        - containerPort: 47800
+      volumes:
+      - name: home-dir
+        persistentVolumeClaim:
+          claimName: home
+      - name: games-dir
+        persistentVolumeClaim:
+          claimName: games
+      - name: input-devices
+        hostPath:
+          path: /dev/input/
+      - name: dri
+        hostPath:
+          path: /dev/dri/
+      - name: dshm
+        emptyDir:
+          medium: Memory

apps/steam/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: steam
+
+resources: 
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - pvc.yaml
+
+

apps/steam/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder
+  labels:
+    pod-security.kubernetes.io/enforce: privileged 

apps/steam/pvc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: games
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "25Gi"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: home
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "5Gi"

apps/steam/service.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: steam-vnc
+spec:
+  selector:
+    app: steam-headless
+  ports:
+  - port: 8083
+    targetPort: 8083
+    name: novnc
+  - port: 47990
+    targetPort: 47990
+    name: moonlight-web
+  - port: 47989
+    targetPort: 47989
+    name: moonlight0
+  - port: 47984
+    targetPort: 47984
+    name: moonlight1
+  - port: 48010
+    targetPort: 48010
+    name: moonlight2
+    protocol: UDP
+  - port: 47998
+    targetPort: 47998
+    name: moonlight3
+    protocol: UDP
+  - port: 47999
+    targetPort: 47999
+    name: moonlight4
+    protocol: UDP
+  - port: 47800
+    targetPort: 47800
+    name: moonlight5
+    protocol: UDP
+  type: LoadBalancer
+  loadBalancerIP: 192.168.3.5

infrastructure/backup/backblaze-credentials.sealedsecret.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: backblaze-credentials
+  namespace: backup
+spec:
+  encryptedData:
+    bucket-id: AgBwwjlkGjskxMXXpXrnfcT9fJGgDXtbOO/6WcpqsX0exoADw31dADjLTHztiddsGYipiGFf2DBWge69UEnL04NXIzh/xTwWtWaqlz6yOJm/89FMQE1mfbrrLc7tk98TO3oS8i+IDAnkUiYyvDXJexgJg56QLY595PXkpplYit2bAk43mAB02yUZAK0gMs3KRDIvhHFsMq8Uiqx78En5KGGXwEg6KbVDyNvI2k8suEyy+C0yNO/M6dlczoUQiIJbllQzbqIzuxbOp609PfvGFAYHuPlz1kwsg+feZJ3kNsHYi4hWvpd64BWb30iO9J3dAYfW6d7C61t3S5uabmnd9E7bMYZA/OppD8SCknBFalXF91BUiJao9qBVd/BB7TCZOzhdzhxTW+FhgARcA+GIfg+nIzgBqHfAfQQmAOO2RZnsWrvMysyZaUpODvU8kSsLWZJ3CESVRVU3BHmJZpyxjX/s6QEXShQXZaLq54zoFJULZU/kbom5yFNNDWW5sKbURPvbKJcf/J9QabY5toO4yOwDk96Sr/FI+CHHvMh8/amigva0Upq6naiTHXMf4BR6+w3VKP5ALn5cbD5jG7EpUA/j1roMoLn68GMAtTJDLvSq2BGeJENWrUpOmjWZHDKZy8DEKorJk/Wbp46ksteSALE8eXpi4DRKXYDPvDb57EhzoJGQ9NMXgAvU9+1vw2nyTZE4gAWKpg0JkiHglu4Om79HfuGuewzJXlY=
+    key-id: AgBe4Iytjw9CkT7CqqNLHWyG4F8F+R6m8W1fnQZdGJvLy7D81+nB2ZDMCUZgUQV/mppGnXCkSxHyelcyTYCswQ9bD8hZsAIiQACq39v2UFxdORFEgNMj4bTWPo65fwhSK2giozPqN/4lzPopP91uyq1Z0gQaiqn/HDtbfNjq+Nu9kPmV06O1NUj1f7QqvfsMK+Xadv0G+DAA+ClGaq1q3fZPDkl2MSDdbEPGq+fLPK2DSdYu9fr1bc9TPyaU5JDFvGrCg8Nyigugi4wVGjQFtVwR1QsHAADmnoDAdXoj1Sz65QO5F+zNaDZWvnLnVFxAFrXJHihilc4ilAc8hSpE6YHQm7dGO5gGejLRNaaCspb/fPJD1g2XlnkckhFCSwd9sHNrXb07BZk8gFTHfndEC0t2UyUNloYpXsfap6fvehPK91ey35jbxDk9zYdgKZ7bz/tY0450CkofSbhisf2DwS3prt5YCEDaXasrpUqlk4dSbmLaGm6aee8lM5VpO8qYE56nvXY7qr0yB6z/NGWuLX3oH3fV+C8hH1P4mxDjvVEFdtewlF50Bf9WFoE7KpboSvmChZhBfjOkbtsGmQE41ZuNoYVupetXn6IfvYo6MzGoG6dTRVpJ5S2KLQDtsUljQfXJDFCSYwo87DD2dGBEn/z9GFCIPAYNO2ewzU4RUgcXPuDD4I2tdNIC+xdEBZq7BaWn/46Yfc1+FAWUA9VWEL/9kz5tK6hFD3Ww
+    key-secret: AgBcKSHdXHeNBzkZRtbaOEZra7AAWVlzmubaQoklECr14gKNL7rTReqX87qQObjQjmGKXtnJlKXIVHGDuiuHGkqfxQ9PCxccvpA3/7LdbFZnZtlFDWpAv+VB6Tp7H7Quho/GeAo8u6de0BXz85lz7+RyDCssBpuuzpchMgOlcEmhhfgQM5E6ye7bD6LpAZWcay3PV6FW2xTrJvLobpCcJordye6iTdSySPKdk6zflkon9h1KuQT+njmW4cfTQg/u7iS/NDQYcHdCpDHRLCor4GkVmi7NW8q+WuYhUSGWBy55SGvcUobhUL7GEHFJZpKmyrBOwSbwiWUDoN+NjI2TR5xvG0Ldjd/Hj32Vk29I+xSnj/O7pZj5ho35qExlZ/WCe42i0VHjzHFbOoU1MkqB+Skm24L1cLufhyNBtA8NNN3GWZhkcozpe164gpx4H/Vfe0UyzxUn4VJIws/IXYiLb4DgDkGrV+wzigN2QfSgTgs6syQkSs4UJ4gUZeN0jsyq0YHIhq1VZ8qPtLH310d8LZLxpTjZdO0obBwJfnHkg3blwSABEt5756C5DvjKmvO1pjG+JX/PJ0yAINL9Sc+FsY7TnGlItVzD830NcZ3Gg9C4Tg4xBEHybUWCSl1rJjwMvmUvVKNcIzLBHPAOyle1VLTZ37zb13MnhwNwdUtBu7+RZTy9wVO26iqemXTtFVj13kgZkJsyLjM6bo2y2wvFmjBCV9EKQtm87ROStM7iKB46
+    repository-string: AgAEYSqT6VR4OKW9/ZDgjYV+rm4tK3uucZsQG2u7W+8rRO0Rowkuba1AbybjgTE+G3q8si/GtlgsB1J8suvztHcVLNxg0y0Olb40pn2sZjKd85Q8AzsM0pFMkzme1lvnwu1Bcgd6Ck+FCr4CuUnh+UvJM5iWhAoSHJtdBb/EKw2F1BhewAqMXSX4oWM7V/T8RTtW2wBUk4wgX4ia+gCBPMpTo6i00ZtSpRB3Ub9VfGJfRmiXZA7oh5j3yN9nJlXonbJYBp4DNWod76CF7s35HBnSzS7YfIV80R4lH4xAPgRbZ0tvPWkTLMhSBX8rJCEnxT7DjL2lS7WfyboLdL4Uy8WmP7n2difZSr7p2iic6SCP44YgQ8JY5UgXh2QZENQ6oLvjK/PpFTjQ4bfw3E1/dakg1EdCYc/6DPyK3YekccUe/pXvVBrazpgObxXWeKKT6RMDeYWLUXTBHWhJ5OaJHHePD5t9IM65FlFTtkuUFbxExTi/u+RczBlWWcy10Yow3I3LGrDPJ/PfBy4RPfHCeQDQ+WoLJkNT20nu5mBXEYYKgNvgdn4yogifSiNG8vsNpo4dO89aHppbnHdmdp7F9asfbn27btEoFoHzIFku/mEnY5srs+Smrhhzy0+iPKge9LOuW33Gi4oJban1UYFvLAjq8YsZGkbIO82r2p+v15UjwU3girWPl1KBUc8WzLJtnqBvRPWS1ul6/X9JIdmmrHJjC0KlcGiVMU/Ls9ljnQj7dgLXuDW7JzuK3MhTWV3Y2kS39ze3TskCKcbL
+  template:
+    metadata:
+      creationTimestamp: null
+      name: backblaze-credentials
+      namespace: backup
+    type: Opaque

infrastructure/backup/cronjobs-base/cronjob.yaml

@@ -46,14 +46,27 @@ spec:
                 name: backup-nfs-access
 
             env:
-              - name: RESTIC_REPOSITORY
-                value: rest:http://rclone-gcloud:8000/kluster
-                # lives in the same namespace
+              # secrets live in the same namespace as per kustomization.yaml
               - name: RESTIC_PASSWORD
                 valueFrom:
                   secretKeyRef:
                     name: restic-gdrive-credentials
                     key: restic-password
+              - name: RESTIC_REPOSITORY
+                valueFrom:
+                  secretKeyRef:
+                    name: backblaze-credentials
+                    key: repository-string
+              - name: AWS_ACCESS_KEY_ID
+                valueFrom:
+                  secretKeyRef:
+                    name: backblaze-credentials
+                    key: key-id
+              - name: AWS_ACCESS_KEY
+                valueFrom:
+                  secretKeyRef:
+                    name: backblaze-credentials
+                    key: key-secret
           volumes:
             - name: backup-nfs-access
               persistentVolumeClaim:

infrastructure/backup/kustomization.yaml

@@ -8,7 +8,6 @@ resources:
   - namespace.yaml
   - pvc.yaml
   - restic-password.sealedsecret.yaml
-  - rclone-config.sealedsecret.yaml
-  - rclone-gcloud.deployment.yaml
+  - backblaze-credentials.sealedsecret.yaml
   - cronjobs-overlays/prune/
   - cronjobs-overlays/backup/