small fixes

apps/adguard/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 images:
   - name: adguard/adguardhome
     newName: adguard/adguardhome
-    newTag: v0.107.49
+    newTag: v0.107.48
 
 namespace: adguard
 

apps/affine/deployment.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: affine
+spec:
+  selector:
+    matchLabels:
+      app: affine
+  template:
+    metadata:
+      labels:
+        app: affine
+    spec:
+      containers:
+      - name: affine
+        image: affine
+        resources:
+          limits:
+            memory: "512Mi"
+            cpu: "1"
+        env:
+        - name: AFFINE_SERVER_HOST
+          value: "affine.kluster.moll.re"
+        - name: AFFINE_SERVER_PORT
+          value: "443"
+        - name: AFFINE_SERVER_HTTPS
+          value: "true"
+        - name: AFFINE_CONFIG_PATH
+          value: "/root/.affine/config"
+        - name: AFFINE_ADMIN_EMAIL
+          value: "me@moll.re"
+        - name: AFFINE_ADMIN_PASSWORD
+          value: "password"
+        - name: TELEMETRY_ENABLE
+          value: "false"
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: postgres-credentials
+              key: url
+        - name: NODE_OPTIONS
+          value: "--import=./scripts/register.js"
+        - name: NODE_ENV
+          value: "production"
+        ports:
+        - containerPort: 3010
+        volumeMounts:
+        - name: affine-data
+          mountPath: /root/.affine/storage
+        - name: affine-config
+          mountPath: /root/.affine/config
+      volumes:
+      - name: affine-data
+        persistentVolumeClaim:
+          claimName: affine-data
+      - name: affine-config
+        persistentVolumeClaim:
+          claimName: affine-config

apps/affine/ingress.yaml

@@ -0,0 +1,15 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: affine-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`affine.kluster.moll.re`)
+      kind: Rule
+      services:
+        - name: affine-web
+          port: 3010
+  tls:
+    certResolver: default-tls

apps/affine/kustomization.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+
+namespace: affine
+
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - postgres.yaml
+  - pvc.yaml
+  - postgres-credentials.secret.yaml
+
+
+images:
+  - name: affine
+    newName: ghcr.io/toeverything/affine-graphql
+    newTag: stable

apps/affine/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/affine/postgres.yaml

@@ -0,0 +1,20 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: affine-postgres
+spec:
+  instances: 1
+  bootstrap:
+    initdb:
+      owner: affine
+      database: affine
+      secret:
+        name: postgres-credentials
+
+  storage:
+    size: 1Gi
+    pvcTemplate:
+      storageClassName: "nfs-client"
+      resources:
+        requests:
+          storage: "1Gi"

apps/affine/pvc.yaml

@@ -0,0 +1,23 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: affine-data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 15Gi
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: affine-config
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/affine/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: affine-web
+spec:
+  selector:
+    app: affine
+  ports:
+  - port: 3010
+    targetPort: 3010

apps/files/kustomization.yaml

@@ -13,4 +13,4 @@ namespace: files
 images:
   - name: ocis
     newName: owncloud/ocis
-    newTag: "5.0.5"
+    newTag: "5.0.3"

apps/immich/kustomization.yaml

@@ -19,6 +19,6 @@ helmCharts:
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.105.1
+    newTag: v1.103.1
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.105.1
+    newTag: v1.103.1

apps/media/kustomization.yaml

@@ -14,7 +14,7 @@ resources:
 images:
   - name: jellyfin/jellyfin
     newName: jellyfin/jellyfin
-    newTag: 10.9.2
+    newTag: 10.9.0
   - name: ghcr.io/jellyfin/jellyfin-vue
     newName: ghcr.io/jellyfin/jellyfin-vue
     newTag: stable-rc.0.3.1

apps/minecraft/curseforge.sealedsecret.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: curseforge-api
-  namespace: minecraft
-spec:
-  encryptedData:
-    key: AgBYeAiejdmxDBorvgnxQX5YvUhR3NId2vfWybMKlc27e6D/bKglLNyZMk70xSnFAPjcDmZ20mYjFPYvDOr9T6IU/REJ8QlzoKAn0xW779R4SkIxRToT+dJv+OM2avgQ9uqp7vja29xeXMjYAnQML+QGZKcrT8mE04G/Ty8rdUiv3yUXK5HFAR3SUF35aVLdlthLjpRkv1s0R7GAP4L2pNzBJNV3i37viceUSSjU0zpOa23fsQOkPAs67AIukAJBqh/hyF/hR9H1GeYZNTI3OcHcvC2iNk/XGstvv0Zy6ApzoebsfWGdsbVn+QUI0EBw+mSTPqpl71cbkz0v4S4XAVndosxWpe6AIgm5MBTU0FXIyGyoFDe1aMPq8BXiQikYVwB48oVNh9KF0xXX5AOG0whB/FEsL3OJsiNQvQ3R/Hru43JBn64oxjVtLfM3E7u8v/xr1VQahX8dylDmb4s5EV01U6O4y19Ou4td1eEMlhpJb0fBPDRUYuWxZAEDGmp+U4tAakyPed11VkcZPPn9fKAAcv8sGs3TYAbbF18hqsBnv2Wd+i7ZEvKwmdmfR/T0r1TJGsvKI7jaW0QtH256XrSxQp7a52qMKMVQWOSKw2k27t/IkRhxT2Prw4GfJvaVr4RozUaBf3LV/hfDWlDfmM2zg3X9W8HkzjotGg021OLxsa0Wzmhffvb8h4bvZwxeq3U1xaJocqXui7z0rT2pF4z3wYHR/lPtexHcOA2M8gfBGKb1rBKh+kW+N+/ZfVLNI0mokg5vrTO2nR2rb4c=
-  template:
-    metadata:
-      creationTimestamp: null
-      name: curseforge-api
-      namespace: minecraft
-    type: Opaque

apps/minecraft/deployment.yaml

@@ -16,31 +16,28 @@ spec:
         image: minecraft
         resources:
           limits:
-            memory: "6000Mi"
-            cpu: "3"
+            memory: "4000Mi"
+            cpu: "2500m"
           requests:
-            memory: "1500Mi"
+            memory: "1000Mi"
             cpu: "500m"
         ports:
         - containerPort: 25565
         env:
         - name: EULA
           value: "TRUE"
-        - name: TYPE
-          value: "AUTO_CURSEFORGE"
-        - name: CF_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: curseforge-api
-              key: key
-        - name: CF_SLUG
-          value: "vault-hunters-1-18-2"
+        - name: MODPACK
+          value: "https://www.curseforge.com/api/v1/mods/711537/files/5076228/download"
         - name: VERSION
           value: "1.18.2"
+        # - name: VERSION
+        #   value: "1.16.5"
+        # - name: MODPACK
+        #   value: "https://mediafilez.forgecdn.net/files/3602/5/VaultHunters-OfficialModpack-1.12.1-Server.zip"
         - name: INIT_MEMORY
           value: "1G"
         - name: MAX_MEMORY
-          value: "5G"
+          value: "3G"
         - name: MOTD
           value: "VaultHunters baby!"
         - name: ENABLE_RCON
@@ -49,10 +46,6 @@ spec:
           value: "true"
         - name: ONLINE_MODE
           value: "true"
-        - name: ENABLE_AUTOPAUSE
-          value: "true"
-        - name: AUTOPAUSE_TIMEOUT_EST
-          value: "1800"
         volumeMounts:
         - name: minecraft-data
           mountPath: /data

apps/minecraft/kustomization.yaml

@@ -8,8 +8,6 @@ resources:
   - pvc.yaml
   - deployment.yaml
   - service.yaml
-  - curseforge.sealedsecret.yaml
-
 
 images:
   - name: minecraft

apps/ntfy/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: binwiederhier/ntfy
     newName: binwiederhier/ntfy
-    newTag: v2.11.0
+    newTag: v2.10.0

infrastructure/external-dns/kustomization.yaml

@@ -15,4 +15,4 @@ images:
 
   - name: git
     newName: alpine/git
-    newTag: "v2.43.4"
+    newTag: "2.43.0"

infrastructure/external/kustomization.yaml

@@ -8,5 +8,4 @@ resources:
   - namespace.yaml
   - omv-s3.ingress.yaml
   - openmediavault.ingress.yaml
-  - proxmox.ingress.yaml
-  - wireguard.ingress.yaml
+  - proxmox.ingress.yaml

infrastructure/external/wireguard.ingress.yaml

@@ -1,38 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: wireguard-ingressroute
-  namespace: external
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`wireguard.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: wireguard
-      port: 443
-      scheme: https
-  tls:
-    certResolver: default-tls
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: wireguard
-  namespace: external
-subsets:
-  - addresses:
-      - ip: 192.168.2.1
-    ports:
-      - port: 443
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wireguard
-  namespace: external
-spec:
-  ports:
-    - port: 443
-      targetPort: 443

infrastructure/gitea/actions.deployment.yaml

@@ -20,16 +20,7 @@ spec:
           requests:
             memory: "128Mi"
             cpu: "500m"
-          limits:
-            memory: "2Gi"
-            cpu: "2"
         env:
-        - name: DOCKER_HOST
-          value: tcp://localhost:2376
-        - name: DOCKER_CERT_PATH
-          value: /certs/client
-        - name: DOCKER_TLS_VERIFY
-          value: "1"
         - name: GITEA_INSTANCE_URL
           value: "https://git.kluster.moll.re"
         - name: GITEA_RUNNER_REGISTRATION_TOKEN
@@ -37,56 +28,12 @@ spec:
             secretKeyRef:
               name: actions-runner-secret
               key: runner-token
-        # - name: GITEA_RUNNER_LABELS
-        #   value: ubuntu-latest:docker://node:16-bullseye,ubuntu-22.04:docker://node:16-bullseye
-        - name: ACTIONS_RUNNER_POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
-          value: "true"
-        - name: ACTIONS_RUNNER_CONTAINER_HOOKS
-          value: /home/runner/k8s/index.js
-        - name: ACTIONS_RUNNER_CLAIM_NAME
-          value: runner-workdir
         - name: GITEA_RUNNER_LABELS
           value: k8s
         volumeMounts:
-        - name: runner-workdir
-          mountPath: /home/runner/_work
         - name: runner-data
           mountPath: /data
-    
       volumes:
-      - name: runner-workdir
-        persistentVolumeClaim:
-          claimName: runner-workdir
       - name: runner-data
-        persistentVolumeClaim:
-          claimName: runner-data
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: runner-data
-spec:
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: "nfs-client"
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: runner-workdir
-spec:
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: "nfs-client"
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
+        emptyDir: {}
+

infrastructure/gitea/kustomization.yaml

@@ -18,7 +18,7 @@ namespace: gitea
 images:
   - name: actions-runner
     newName: ghcr.io/christopherhx/gitea-actions-runner
-    newTag: nightly
+    newTag: v0.0.11
 
 
 helmCharts:

kluster-deployments/kustomization.yaml

@@ -32,7 +32,6 @@ resources:
   - immich/
   - journal/
   - media/
-  - minecraft/application.yaml
   - monitoring/
   - ntfy/
   - recipes/

kluster-deployments/minecraft/application.yaml

@@ -1,18 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: minecraft-application
-  namespace: argocd
-spec:
-  project: apps
-  source:
-    repoURL: ssh://git@git.kluster.moll.re:2222/remoll/k3s-infra.git
-    targetRevision: main
-    path: apps/minecraft
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: minecraft
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: false