using an alternative stack

Reviewed-on: #94

apps/adguard/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 images:
   - name: adguard/adguardhome
     newName: adguard/adguardhome
-    newTag: v0.107.46
+    newTag: v0.107.48
 
 namespace: adguard
 

apps/files/kustomization.yaml

@@ -13,4 +13,4 @@ namespace: files
 images:
   - name: ocis
     newName: owncloud/ocis
-    newTag: "5.0"
+    newTag: "5.0.3"

apps/finance/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: actualbudget
     newName: actualbudget/actual-server
-    newTag: 24.3.0
+    newTag: 24.5.0

apps/homeassistant/config.sealedsecret.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: config
-  namespace: homeassistant
-spec:
-  encryptedData:
-    configuration.yaml: AgBAcghv6dQYajqfwayHhfRIE2awjHYOw1h9vWkeM7GRWtaB61eGLbievEvDhKYYWbLCCwXEfFpk1NodWvf7fdmsIm+uXu+95VbAv7/uRGdO4VDB37fagXLqEceNRkOD4lBQxUaZM1kHkEIbMTSKaLZAUfDwNwqZzbVMNRkTCd15+DFQMVpO7wT8CJ+oRWqB4ISV+0NivxVABzqzp3djQMbLgJzxYAzYWJro+qAJnXUrr4Jmk/mwcoYKD6JEVQKFKnT6TArFU9zK9T2Uoyiye530d6yV64j+qEgRS85rSEfYvooW+8YqIWnVvwaRt0FzFDAy0ONB91TemWlidM55RYKURiOvYa3L2jH5oDfFTDil3zjTCY5/4JSi7WD0ceChRAtq881O+8iK6RiVLZfAL6N0fcm5LpGG0ug3Sn3CZKN85M70/agDhbz11ryGhPCBkuSUuT7HT1rbxzLy3wUFyD5MnTPbLZ+f88zCBUPIZk6UK9IdacOPYcn/dQzfJEeNoL2FouZbC/SWw6gxpNjcmk/ercwg4/g/WpPEeLZGpCt3gt5sbFi91+j0mocogY/DZ4Y6HC//v2KIZPy9nmLu4EDLjVzJnNcqW0t3aD9matxUiBbhOUSHmIfh3oGA4ZPr4e1UXOYRcihviD6OwNLfU337o86MOOTSLGPtUhERnHdPmz/X0n1oGMWffxcKKhS2m3WJtycAKbLwc4N/oeOFLbEAyc7xbfX0FUKlEskNJeH2toWfgOj8w7TunOi7MNCJN6zA1eclXa9axJozw7JTbAxZDPVyBr17yXgDJ0QymGxI7X0z7Vy8Y3yR4URlNaHgh2OQ1BKi4uEkrVz2lFtujPkfS9oiKYOaSJCBTFG4G9bx7QlTezlbNOeFPkilBSWhosCaLPhHKizRDOtDMu60XyvATEdKWeiFqvt69MNtETZPFfmzXYSAcwYIuMYu3twzMzEaFi3mk+wXN0fcrz/DAU3EJ+1zWr3WaDRXzVhesgf0BcfP+tRBm0zRlfS12AP7OHCTxxbR4KJzCegLcjWLqSHF4kRZgrCkfph1UKdwX+hHDNxWkPx6U/e4/4fhCuQZ7nDu62WysbDQO624Gsit4DsXFkfaX6rX98B5sjw8GYIhv53Pw5HetyjBHr/EFDeIKWmrEafrPRkzUgGq/pdDjZZ8FcfIi4SR6Yx7fHg4rKp2EA7NP0mEUEthqqpncHpE47pu0EFy1d9ZwwW8AjvXIWT+CjMEv8EPBNOJrzT36qXYWFzF3DWgf//MyUyO5IGSIhIBP6oy/3yit6Q4lNPlaxTclxATlbbf7T8OLaHc+4Tk4odRVXk6RSyrEHTphGQot5YhodlLYueZfeINOzKZ05+r/dGkoPwVKyLPV/g2YOjjtHNGEzVSjQgUnHk4rkRtaIJvWAiFQtUaiaJVQKGYlq+ARlKRJDAXk9jpuwiKoH/5zBou1jrfqaxTqstEAK8leNNZyIv8biFLipDf6xC6EoV58gMTdx20tFNGgVRgsWFHfuNW39Gn5LDRS+u9PQWVAqKxZXwJ/8pz/smki0qIWNKaa9LeNxPDHf/RPoU1PqxDt7FVzPhE7KjnpgsPxB+sv3qqOJ9H4oBdueMRWnpUdTuO6CzpvUuio19mhX3iLGToUaYyYxH0v29o8QQzLPrWdBjQ4+g3TQoDu/bJCaP/UdEmK/e73pFrZWo/jM2tdGiRi8Z+67k9RPdIAR/dJW0+mJN+w6rizxrdYMUu9iNgUCps9NZX6BB0D6fpcfbas+SzlrIBthi6s5qnJFGS+jJGn9s0KdgRrqQxyyHvYKdjreR0Y+3XcRXdYercKLILmF/LE3jPiFaDWV3rkbYyetjUx/KFO/f6m5er+tXiUZeznNvOIj8ppLivwpPbXbGBGRcYNyuSgRfPxLTDe2XSbSkROuqGPSLQc+XP6x9KeM3p6Gwq54bO2jkDVWGDjfndNz3J64ovV3ljZ1ON0AwB3i+3MTEkFpzzDXFgg1GMviVZPRT7ZWhDOCOKwJI1ylLoGrMkQQgnbm7qImG9fP7GC2J12TRzSYuxKdIjsdG3xg==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: config
-      namespace: homeassistant
-    type: Opaque

apps/homeassistant/deployment.yaml

@@ -23,9 +23,6 @@ spec:
           volumeMounts:
             - name: config-dir
               mountPath: /config
-            - name: configuration
-              mountPath: /config/configuration.yaml
-              readOnly: true
           resources:
             requests:
               cpu: "100m"
@@ -37,7 +34,4 @@ spec:
         - name: config-dir
           persistentVolumeClaim:
             claimName: config
-        - name: configuration
-          secret:
-            secretName: config
 

apps/homeassistant/ingress.yaml

@@ -6,7 +6,7 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`home.kluster.moll.re`)
+    - match: Host(`home.kluster.moll.re`) && !Path(`/api/prometheus`)
       middlewares:
         - name: homeassistant-websocket
       kind: Rule
@@ -15,7 +15,6 @@ spec:
           port: 8123
   tls:
     certResolver: default-tls
-
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
@@ -27,6 +26,3 @@ spec:
       X-Forwarded-Proto: "https"
       # enable websockets
       Upgrade: "websocket"
-
-
-

apps/homeassistant/kustomization.yaml

@@ -10,9 +10,9 @@ resources:
   - service.yaml
   - deployment.yaml
   - servicemonitor.yaml
-  - config.sealedsecret.yaml
+
 
 images:
   - name: homeassistant/home-assistant
     newName: homeassistant/home-assistant
-    newTag: "2024.1"
+    newTag: "2024.5"

apps/homeassistant/service.yaml

@@ -7,4 +7,5 @@ spec:
     app: homeassistant
   ports:
   - port: 8123
-    targetPort: 8123
+    targetPort: 8123
+    name: http

apps/homeassistant/servicemonitor.yaml

@@ -9,5 +9,5 @@ spec:
     matchLabels:
       app: homeassistant
   endpoints:
-    - port: homeassistant-web
+    - port: http
       path: /api/prometheus

apps/homepage/configmap.yaml

@@ -0,0 +1,98 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config
+  labels:
+    app.kubernetes.io/name: homepage
+data:
+  kubernetes.yaml: "" #|
+  #  mode: cluster
+  settings.yaml: |
+    title: "Homepage"
+    background: https://images.unsplash.com/photo-1547327132-5d20850c62b5?q=80&w=3870&auto=format&fit=crop
+    cardBlur: sm
+  #settings.yaml: |
+  #  providers:
+  #    longhorn:
+  #      url: https://longhorn.my.network
+  custom.css: ""
+  custom.js: ""
+  bookmarks.yaml: |
+    - Developer:
+        - Github:
+            - abbr: GH
+              href: https://github.com/moll-re
+  services.yaml: |
+    - Media:
+        - Jellyfin backend:
+            href: https://media-backend.kluster.moll.re
+            ping: media-backend.kluster.moll.re
+        - Jellyfin vue:
+            href: https://media.kluster.moll.re
+            ping: media.kluster.moll.re
+        - Immich:
+            href: https://immich.kluster.moll.re
+            ping: immich.kluster.moll.re
+
+    - Productivity:
+        - OwnCloud:
+            href: https://ocis.kluster.moll.re
+            ping: ocis.kluster.moll.re
+        - ToDo:
+            href: https://todos.kluster.moll.re
+            ping: todos.kluster.moll.re
+        - Finance:
+            href: https://finance.kluster.moll.re
+            ping: finance.kluster.moll.re
+
+    - Home:
+        - Home Assistant:
+            href: https://home.kluster.moll.re
+            ping: home.kluster.moll.re
+        - Grafana:
+            href: https://grafana.kluster.moll.re
+            ping: grafana.kluster.moll.re
+        - Recipes:
+            href: https://recipes.kluster.moll.re
+            ping: recipes.kluster.moll.re
+    
+    - Infra:
+        - Gitea:
+            href: https://git.kluster.moll.re
+            ping: git.kluster.moll.re
+        - ArgoCD:
+            href: https://argocd.kluster.moll.re
+            ping: argocd.kluster.moll.re
+
+  widgets.yaml: |
+    # - kubernetes:
+    #     cluster:
+    #       show: true
+    #       cpu: true
+    #       memory: true
+    #       showLabel: true
+    #       label: "cluster"
+    #     nodes:
+    #       show: true
+    #       cpu: true
+    #       memory: true
+    #       showLabel: true
+    - search:
+        provider: duckduckgo
+    - openmeteo:
+        label: Zürich # optional
+        latitude: 47.24236
+        longitude: 8.30439
+        units: metric # or imperial
+        cache: 30 # Time in minutes to cache API responses, to stay within limits
+        format: # optional, Intl.NumberFormat options
+            maximumFractionDigits: 1
+    - datetime:
+        locale: de
+        format:
+          dateStyle: long
+          timeStyle: short
+    - adguard:
+        url: http://adguard-home-web.adguard-home:3000
+
+  docker.yaml: ""

apps/homepage/deployment.yaml

@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homepage
+  labels:
+    app.kubernetes.io/name: homepage
+spec:
+  revisionHistoryLimit: 3
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: homepage
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: homepage
+    spec:
+      # serviceAccountName: homepage
+      # automountServiceAccountToken: true
+      dnsPolicy: ClusterFirst
+      # enableServiceLinks: true
+      containers:
+        - name: homepage
+          image: homepage
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /app/config/custom.js
+              name: config
+              subPath: custom.js
+            - mountPath: /app/config/custom.css
+              name: config
+              subPath: custom.css
+            - mountPath: /app/config/bookmarks.yaml
+              name: config
+              subPath: bookmarks.yaml
+            - mountPath: /app/config/docker.yaml
+              name: config
+              subPath: docker.yaml
+            - mountPath: /app/config/kubernetes.yaml
+              name: config
+              subPath: kubernetes.yaml
+            - mountPath: /app/config/services.yaml
+              name: config
+              subPath: services.yaml
+            - mountPath: /app/config/settings.yaml
+              name: config
+              subPath: settings.yaml
+            - mountPath: /app/config/widgets.yaml
+              name: config
+              subPath: widgets.yaml
+            - mountPath: /app/config/logs
+              name: logs
+      volumes:
+        - name: config
+          configMap:
+            name: config
+        - name: logs
+          emptyDir: {}

apps/homepage/ingress.yaml

@@ -1,16 +1,16 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: rss-ingressroute
+  name: homepage-ingressroute
 
 spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`syncthing.kluster.moll.re`)
+    - match: Host(`start.kluster.moll.re`)
       kind: Rule
       services:
-        - name: syncthing-web
-          port: 8384
+        - name: homepage-web
+          port: 3000
   tls:
     certResolver: default-tls

apps/homepage/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: homepage
+
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - configmap.yaml
+  - ingress.yaml
+
+
+images:
+  - name: homepage
+    newName: ghcr.io/gethomepage/homepage
+    newTag: v0.8.13

apps/homepage/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: homepage-web
+  labels:
+    app.kubernetes.io/name: homepage
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: homepage

apps/immich/kustomization.yaml

@@ -12,14 +12,13 @@ namespace: immich
 helmCharts:
   - name: immich
     releaseName: immich
-    version: 0.4.0
+    version: 0.6.0
     valuesFile: values.yaml
     repo: https://immich-app.github.io/immich-charts
 
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.99.0
+    newTag: v1.103.1
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.99.0
-
+    newTag: v1.103.1

apps/immich/postgres.yaml

@@ -1,4 +1,3 @@
-
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:

apps/media-downloads/jackett.deployment.yaml

@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jackett
+spec:
+  selector:
+    matchLabels:
+      app: jackett
+  template:
+    metadata:
+      labels:
+        app: jackett
+    spec:
+      containers:
+      - name: jackett
+        image: jackett
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 9117
+        volumeMounts:
+        - name: media
+          mountPath: /media
+        - name: config
+          mountPath: /config
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: media-downloads
+      - name: config
+        persistentVolumeClaim:
+          claimName: transmission-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jackett
+spec:
+  selector:
+    app: jackett
+  ports:
+    - protocol: TCP
+      port: 9117
+      targetPort: 9117
+  type: ClusterIP

apps/media-downloads/kustomization.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: media-downloads
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - transmission.deployment.yaml
+  - radarr.deployment.yaml
+  - jackett.deployment.yaml
+
+
+images:
+  - name: transmission
+    newName: haugene/transmission-openvpn
+    newTag: 5.3.1
+  - name: jackett
+    newName: lscr.io/linuxserver/jackett
+    newTag: latest
+  - name: radarr
+    newName: lscr.io/linuxserver/radarr
+    newTag: 5.4.6
+
+
+---
+# 2nd version
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: media-downloads
+
+
+resources: 
+  - namespace.yaml
+  - pvc.yaml
+  - qbittorrent.deployment.yaml
+  - qbittorrent.service.yaml
+  - qbittorrent.configmap.yaml
+  - radarr.deployment.yaml
+  - radarr.service.yaml
+  - radarr.configmap.yaml
+  - openvpn.secret.yaml
+
+images:
+  - name: qbittorrent
+    newName: binhex/arch-qbittorrentvpn
+    newTag: 5.0.1-1-02
+  - name: radarr
+    newName: hotio/radarr
+    newTag: release-5.14.0.9383

apps/media-downloads/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder
+  labels:
+    pod-security.kubernetes.io/enforce: privileged 

apps/media-downloads/pvc.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-config
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: qbittorrent-config
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "10Gi"

apps/media-downloads/qbittorrent.configmap.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: qbittorrent
+  labels:
+    app: qbittorrent
+data:
+  VPN_ENABLED: yes
+  VPN_USER: vpnbook
+  VPN_PASS: e83zu76
+  VPN_PROV: custom
+  VPN_CLIENT: openvpn
+  LAN_NETWORK: 10.244.0.0/24,10.9.0.0/24
+  WEBUI_PORT: "8080"
+  ENABLE_STARTUP_SCRIPTS: no

apps/media-downloads/qbittorrent.deployment.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrent
+spec:
+  selector:
+    matchLabels:
+      app: qbittorrent
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: qbittorrent
+    spec:
+      containers:
+      - name: qbittorrent
+        image: qbittorrent
+        ports:
+        - containerPort: 8080
+        envFrom:
+        - configMapRef:
+            name: qbittorrent
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: config
+          mountPath: /config
+
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: data
+      - name: config
+        persistentVolumeClaim:
+          claimName: qbittorrent-config

apps/media-downloads/qbittorrent.service.yaml

@@ -0,0 +1,12 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: qbittorrent
+spec:
+  selector:
+    app: qbittorrent
+  type:  ClusterIP
+  ports:
+  - name: qbittorrent
+    port:  8080
+    targetPort:  8080

apps/media-downloads/radarr.configmap.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: radarr
+  labels:
+    app: radarr
+data:
+  # VPN_ENABLED: "true"
+  # VPN_CONF: "wg0"
+  # VPN_PROVIDER: "generic"
+  # VPN_LAN_NETWORK: "192.168.1.0/24"
+  # VPN_LAN_LEAK_ENABLED: "false"
+  # VPN_EXPOSE_PORTS_ON_LAN: ""
+  # VPN_AUTO_PORT_FORWARD: "false"
+  # VPN_AUTO_PORT_FORWARD_TO_PORTS: ""
+  # VPN_KEEP_LOCAL_DNS: "false"
+  # VPN_FIREWALL_TYPE: "auto"
+  # VPN_HEALTHCHECK_ENABLED: "false"
+  # PRIVOXY_ENABLED: "false"
+  # UNBOUND_ENABLED: "false"

apps/media-downloads/radarr.deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: radarr
+spec:
+  selector:
+    matchLabels:
+      app: radarr
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: radarr
+    spec:
+      containers:
+      - name: radarr
+        image: radarr
+        ports:
+        - containerPort: 7878
+        envFrom:
+        - configMapRef:
+            name: radarr
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: config
+          mountPath: /config
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: data
+      - name: config
+        persistentVolumeClaim:
+          claimName: radarr-config

apps/media-downloads/radarr.service.yaml

@@ -0,0 +1,12 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: radarr
+spec:
+  selector:
+    app: radarr
+  type:  ClusterIP
+  ports:
+  - name: radarr
+    port:  7878
+    targetPort:  7878

apps/media-downloads/transmission.deployment.yaml

@@ -0,0 +1,81 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: transmission
+spec:
+  selector:
+    matchLabels:
+      app: transmission
+  template:
+    metadata:
+      labels:
+        app: transmission
+    spec:
+      containers:
+      - name: transmission
+        image: transmission
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 9091
+        env:
+        - name: OPENVPN_PROVIDER
+          value: PROTONVPN
+        - name: LOCAL_NETWORK
+          value: 10.42.0.0/16
+        - name: OPENVPN_CONFIG
+          valueFrom:
+            secretKeyRef:
+              name: protonvpn
+              key: country
+        - name: OPENVPN_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: protonvpn
+              key: username
+        - name: OPENVPN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: protonvpn
+              key: password
+        volumeMounts:
+        - name: media
+          mountPath: /data
+        - name: config
+          mountPath: /config
+        securityContext:
+          capabilities:
+            add: ["NET_ADMIN"]
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: media-downloads
+      - name: config
+        persistentVolumeClaim:
+          claimName: transmission-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: transmission
+spec:
+  selector:
+    app: transmission
+  ports:
+    - protocol: TCP
+      port: 9091
+      targetPort: 9091
+  type: ClusterIP
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: protonvpn
+type: Opaque
+stringData:
+  country: at.protonvpn.udp,fr.protonvpn.udp,pl.protonvpn.udp,ch.protonvpn.udp
+  username: VOYkNuZs5PHjeB8w
+  password: WvKCOPijcXKOqcL5d7zjXzOPToS4zPid

apps/media/ingress.yaml

@@ -60,4 +60,4 @@ spec:
     accessControlAllowMethods: [ "GET","HEAD","OPTIONS" ] # "POST","PUT"
     accessControlAllowOriginList:
       - "*"
-    accessControlMaxAge: 100
+    accessControlMaxAge: 100

apps/media/kustomization.yaml

@@ -10,12 +10,11 @@ resources:
   - web.deployment.yaml
   - web.service.yaml
   - ingress.yaml
-  - jellyfin.servicemonitor.yaml
 
 images:
   - name: jellyfin/jellyfin
     newName: jellyfin/jellyfin
-    newTag: 10.8.13
+    newTag: 10.9.0
   - name: ghcr.io/jellyfin/jellyfin-vue
     newName: ghcr.io/jellyfin/jellyfin-vue
     newTag: stable-rc.0.3.1

apps/minecraft/README.md

@@ -0,0 +1,7 @@
+## Sending a command
+```
+kubectl exec -it -n minecraft deploy/minecraft-server -- /bin/bash
+mc-send-to-console /help
+# or directly
+kubectl exec -it -n minecraft deploy/minecraft-server -- mc-send-to-console /help
+```

apps/minecraft/deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: minecraft-server
+spec:
+  selector:
+    matchLabels:
+      app: minecraft-server
+  template:
+    metadata:
+      labels:
+        app: minecraft-server
+    spec:
+      containers:
+      - name: minecraft-server
+        image: minecraft
+        resources:
+          limits:
+            memory: "4000Mi"
+            cpu: "2500m"
+          requests:
+            memory: "1000Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 25565
+        env:
+        - name: EULA
+          value: "TRUE"
+        - name: MODPACK
+          value: "https://www.curseforge.com/api/v1/mods/711537/files/5076228/download"
+        - name: VERSION
+          value: "1.18.2"
+        # - name: VERSION
+        #   value: "1.16.5"
+        # - name: MODPACK
+        #   value: "https://mediafilez.forgecdn.net/files/3602/5/VaultHunters-OfficialModpack-1.12.1-Server.zip"
+        - name: INIT_MEMORY
+          value: "1G"
+        - name: MAX_MEMORY
+          value: "3G"
+        - name: MOTD
+          value: "VaultHunters baby!"
+        - name: ENABLE_RCON
+          value: "false"
+        - name: CREATE_CONSOLE_IN_PIPE
+          value: "true"
+        - name: ONLINE_MODE
+          value: "true"
+        volumeMounts:
+        - name: minecraft-data
+          mountPath: /data
+
+      volumes:
+      - name: minecraft-data
+        persistentVolumeClaim:
+          claimName: minecraft-data

apps/minecraft/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: minecraft
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+
+images:
+  - name: minecraft
+    newName: itzg/minecraft-server
+    newTag: java21

apps/minecraft/namespace.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: placeholder
+  name: placeholder

apps/minecraft/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: minecraft-data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/minecraft/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: minecraft-server
+spec:
+  selector:
+    app: minecraft-server
+  ports:
+  - port: 25565
+    targetPort: 25565
+  type: LoadBalancer
+  loadBalancerIP: 192.168.3.4

apps/monitoring/grafana.values.yaml

@@ -33,10 +33,23 @@ datasources:
         type: prometheus
         url: http://thanos-querier.prometheus.svc:9090
         isDefault: true
+      - name: Prometheus
+        type: prometheus
+        url: http://prometheus.prometheus.svc:9090
+        isDefault: false
 
 dashboardProviders:
-  dashboardproviders.yaml:
-    
+ dashboardproviders.yaml:
+   apiVersion: 1
+   providers:
+   - name: 'default'
+     orgId: 1
+     folder: ''
+     type: file
+     disableDeletion: false
+     editable: true
+     options:
+       path: /var/lib/grafana/dashboards/default
 ## Reference to external ConfigMap per provider. Use provider name as key and ConfigMap name as value.
 ## A provider dashboards must be defined either by external ConfigMaps or in values.yaml, not in both.
 ## ConfigMap data example:
@@ -46,9 +59,11 @@ dashboardProviders:
 ##     RAW_JSON
 ##
 dashboardsConfigMaps:
-  home-metrics: dashboard-home-metrics
-  proxmox: dashboard-proxmox
-  gitea: dashboard-gitea
+  default: grafana-dashboards
+
 
 grafana.ini:
-  wal: true
+  wal: true
+  default_theme: dark
+  unified_alerting:
+    enabled: false

apps/monitoring/kustomization.yaml

@@ -16,17 +16,5 @@ helmCharts:
   - releaseName: grafana
     name: grafana
     repo: https://grafana.github.io/helm-charts
-    version: 7.3.7
+    version: 7.3.9
     valuesFile: grafana.values.yaml
-
-  # - releaseName: influxdb
-  #   name: influxdb2
-  #   repo: https://helm.influxdata.com/
-  #   version: 2.1.2
-  #   valuesFile: influxdb.values.yaml
-
-  # - releaseName: telegraf-speedtest
-  #   name: telegraf
-  #   repo: https://helm.influxdata.com/
-  #   version: 1.8.39
-  #   valuesFile: telegraf-speedtest.values.yaml

apps/nextcloud/README.md

@@ -1,5 +0,0 @@
-### Runninf `occ` commands:
-
-```
-su -s /bin/bash www-data -c "php occ user:list"
-```

apps/nextcloud/ingress.yaml

@@ -1,16 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: nextcloud-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`nextcloud.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: nextcloud
-      port: 8080
-  tls:
-    certResolver: default-tls 

apps/nextcloud/kustomization.yaml

@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources: 
-- namespace.yaml
-- ingress.yaml
-- pvc.yaml
-- postgres.sealedsecret.yaml
-
-namespace: nextcloud
-
-helmCharts:
-  - name: nextcloud
-    releaseName: nextcloud
-    version: 4.5.5
-    valuesFile: values.yaml
-    repo: https://nextcloud.github.io/helm/

apps/nextcloud/postgres.sealedsecret.yaml

@@ -1,22 +0,0 @@
-{
-  "kind": "SealedSecret",
-  "apiVersion": "bitnami.com/v1alpha1",
-  "metadata": {
-    "name": "postgres-password",
-    "namespace": "nextcloud",
-    "creationTimestamp": null
-  },
-  "spec": {
-    "template": {
-      "metadata": {
-        "name": "postgres-password",
-        "namespace": "nextcloud",
-        "creationTimestamp": null
-      }
-    },
-    "encryptedData": {
-      "password": "AgCTmvBe9YFnyWOdz02rxr0hTXnWuVLeUt5dpieWMzl4cVMBj7WcyyODWtNd+eQOLARRssGNZAP4C9gH90iVRFAW1aU+NeA76oceXE5Kiiqoc8T30wE5FC6/UbTjQYRH520NF4wcCQKm//iH8o5uI2+NxZW4goeuShibXK9sijFVNXxUuTeXTmaSJjEPyB+pnmPwjzw+qjhkJJADefh9oryy5+t9ecCwXDiI/2ce2n1Vawm/Nq6/0rZMUSsF8XSiTFczKMunuGMhxGEyyx/I8NZd4XMXGSnBo0YZF7jR9+eRHIjuenPHq1kfEid2Ps4fhFSE8mEecnK7w5xE3r0XeTNHQcTId1yYneK/LQfcRkzInuRddytTwTAmsoSjROcjKjAvtyZSM81pFWJsMQ7bSVXOC0K2wvEz9khDT0RIoR/8tMh2G737F15raTe9Ggbgy3DHst4mYIpoWV/slHrOF0vR9j7X+MRN9R1cVtI1coof/tVSWQsLvv0AJfB4/6dUl+i/yNO/j+4c3WolGwqyXd+oxsZK1VrSwSCBZwBO17BmePJL2QsPVRdutq06TrlvGqP4wXySH9LRuHr3sWgr2VuDV00w+UvuU7ExI+16dWh7jrn/rvIBQSJlHDhl5+VpyM0WTMy5kSfO6nits73ZzT7BAoSU7AeQOMj3t+cUiEq9f9dk7em7QxWMuWg6QIJ+ZZ2+CCBms4rSE4x2glOxanNX/HktQg==",
-      "username": "AgCxJKzhsF7yNJesK5oLJP62kjFnX4UUNQ2NrHl02Hv6MAzi/AUEV3uJSXXIi3H/uMJSMxRpJQjIDsrznYVI0YHOoz1M8/y1dx8xotFv/i0XByI9sMuGtesop7ncmQbEPMaJ3pqTJyaGkEwcsEMGmwwYiRfJHmEhhCYtzEc5IAnx+nmk//HYsrSWKpJGSWl0LvdMJsnsTxrWoJjaYTW3J0Of3VOOmgkuwIFKyXW9S2cUbAco8xVYchbyiHc8LXbS3izyAidRzg1OWyqvTGMIKJDQZ3ibIiXheon5ZeYjj0fkEkv3TrB7WoKdo0090OY1eHabqAPHT8aP+WG1g6TAzbJEtg+zFfYDKIw5Tp1WkRlsD2me4HycGuZbsaXgP5vWlxF5+rULUzUgxfmTRmYTl0H8kIlmUrusZwxR5ZXnSuBJ3n3AMEjmpmTTALakxEFEPDJJoVbgcViLtANwk72yu15FlOxczT22uyW8FMkj9kYzcq/+2a/EjaTo62SnUYJ3UTQXvgMKML1yJD+zym2+xscPNmwZFBPN5BQ/64ru/Z51nWB20fWFgW3Rw67jEQMajmVclmUcASWOjHzO87feEprHeilTH+224IHzpmC4aLz/JtIP9EEvqfDUr3fRrxcgtT1DgxV37vPj6Pqn47MHr39AA850CxjFmb1VcwfH6ygXABFlxnVByZDn7xCyBNswtKJqtw=="
-    }
-  }
-}

apps/nextcloud/pvc.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: nextcloud-nfs
-spec:
-  capacity:
-    storage: "150Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /kluster/nextcloud
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nextcloud-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "150Gi"
-  volumeName: nextcloud-nfs

apps/nextcloud/readme.md

@@ -1,17 +0,0 @@
-## Running occ commands
-
-Sometimes you need to run a command on the Nextcloud container directly. You can do that by running commands as the user www-data via the kubectl exec command.
-```
-# $NEXTCLOUD_POD should be the name of *your* nextcloud pod :)
-kubectl exec $NEXTCLOUD_POD -- su -s /bin/sh www-data -c "php occ myocccomand"
-```
-Here are some examples below.
-Putting Nextcloud into maintanence mode
-
-Some admin actions require you to put your Nextcloud instance into
-
-(e.g. backups):
-```
-# $NEXTCLOUD_POD should be the name of *your* nextcloud pod :)
-kubectl exec $NEXTCLOUD_POD -- su -s /bin/sh www-data -c "php occ maintenance:mode --on"
-```

apps/nextcloud/values.yaml

@@ -1,171 +0,0 @@
-## Official nextcloud image version
-## ref: https://hub.docker.com/r/library/nextcloud/tags/
-
-image:
-  tag: "28"
-
-ingress:
-  enabled: false
-
-
-
-nextcloud:
-  host: nextcloud.kluster.moll.re
-  username: admin
-  password: changeme
-  ## Use an existing secret
-  existingSecret:
-    enabled: false
-  update: 0
-  # If web server is not binding default port, you can define it
-  # containerPort: 8080
-  datadir: /var/www/html/data
-  persistence:
-    subPath:
-  mail:
-    enabled: false
-  # PHP Configuration files
-  # Will be injected in /usr/local/etc/php/conf.d for apache image and in /usr/local/etc/php-fpm.d when nginx.enabled: true
-  phpConfigs: {}
-  # Default config files
-  # IMPORTANT: Will be used only if you put extra configs, otherwise default will come from nextcloud itself
-  # Default confgurations can be found here: https://github.com/nextcloud/docker/tree/master/16.0/apache/config
-  defaultConfigs:
-    # To protect /var/www/html/config
-    .htaccess: true
-    # Redis default configuration
-    redis.config.php: true
-    # Apache configuration for rewrite urls
-    apache-pretty-urls.config.php: true
-    # Define APCu as local cache
-    apcu.config.php: true
-    # Apps directory configs
-    apps.config.php: true
-    # Used for auto configure database
-    autoconfig.php: true
-    # SMTP default configuration
-    smtp.config.php: true
-  # Extra config files created in /var/www/html/config/
-  # ref: https://docs.nextcloud.com/server/15/admin_manual/configuration_server/config_sample_php_parameters.html#multiple-config-php-file
-  configs: {}
-
-  # For example, to use S3 as primary storage
-  # ref: https://docs.nextcloud.com/server/13/admin_manual/configuration_files/primary_storage.html#simple-storage-service-s3
-  #
-  #  configs:
-  #    s3.config.php: |-
-  #      <?php
-  #      $CONFIG = array (
-  #        'objectstore' => array(
-  #          'class' => '\\OC\\Files\\ObjectStore\\S3',
-  #          'arguments' => array(
-  #            'bucket'     => 'my-bucket',
-  #            'autocreate' => true,
-  #            'key'        => 'xxx',
-  #            'secret'     => 'xxx',
-  #            'region'     => 'us-east-1',
-  #            'use_ssl'    => true
-  #          )
-  #        )
-  #      );
-
-nginx:
-  ## You need to set an fpm version of the image for nextcloud if you want to use nginx!
-  enabled: false
-
-internalDatabase:
-  enabled: true
-  name: nextcloud
-
-##
-## External database configuration
-##
-externalDatabase:
-  enabled: true
-
-  ## Supported database engines: mysql or postgresql
-  type: postgresql
-
-  ## Database host
-  host: postgres-postgresql.postgres
-
-  ## Database user
-  # user: nextcloud
-
-  # ## Database password
-  # password: test
-
-  ## Database name
-  database: nextcloud
-
-  ## Use a existing secret
-  existingSecret:
-    enabled: true
-    secretName: postgres-password
-    usernameKey: username
-    passwordKey: password
-
-##
-## MariaDB chart configuration
-##
-mariadb:
-  enabled: false
-
-postgresql:
-  enabled: false
-
-redis:
-  enabled: false
-
-## Cronjob to execute Nextcloud background tasks
-## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
-##
-cronjob:
-  enabled: false
-
-## Enable persistence using Persistent Volume Claims
-## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
-##
-persistence:
-  # Nextcloud Data (/var/www/html)
-  enabled: true
-  annotations: {}
-
-  ## If defined, PVC must be created manually before volume will be bound
-  existingClaim: nextcloud-nfs
-
-  ## Use an additional pvc for the data directory rather than a subpath of the default PVC
-  ## Useful to store data on a different storageClass (e.g. on slower disks)
-  nextcloudData:
-    enabled: false
-
-resources:
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  limits:
-   cpu: 2000m
-   memory: 2Gi
-  requests:
-   cpu: 100m
-   memory: 128Mi
-
-livenessProbe:
-  enabled: true
-  # disable when upgrading from a previous chart version
-
-## Enable pod autoscaling using HorizontalPodAutoscaler
-## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
-##
-hpa:
-  enabled: false
-
-## Prometheus Exporter / Metrics
-##
-metrics:
-  enabled: false
-
-
-rbac:
-  enabled: false

apps/recipes/kustomization.yaml

@@ -12,5 +12,5 @@ resources:
 
 images:
   - name: mealie
-    newTag: v1.3.2
+    newTag: v1.6.0
     newName: ghcr.io/mealie-recipes/mealie

apps/rss/namespace.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: placeholder
+  name: placeholder

apps/syncthing/deployment.yaml

@@ -1,35 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: syncthing
-spec:
-  selector:
-    matchLabels:
-      app: syncthing
-  template:
-    metadata:
-      labels:
-        app: syncthing
-    spec:
-      containers:
-      - name: syncthing
-        image: syncthing
-        resources:
-          limits:
-            memory: "256Mi"
-            cpu: "500m"
-        ports:
-        - containerPort: 8384
-          protocol: TCP
-          name: syncthing-web
-        - containerPort: 22000
-          protocol: TCP
-        - containerPort: 22000
-          protocol: UDP
-        volumeMounts:
-        - name: persistence
-          mountPath: /var/syncthing
-      volumes:
-      - name: persistence
-        persistentVolumeClaim:
-          claimName: syncthing-claim

apps/syncthing/kustomization.yaml

@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: syncthing
-
-resources:
-  - namespace.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - servicemonitor.yaml
-  - syncthing-api.sealedsecret.yaml
-
-images:
-  - name: syncthing
-    newName: syncthing/syncthing
-    newTag: "1.27"

apps/syncthing/pvc.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: syncthing-data
-spec:
-  capacity:
-    storage: "50Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /kluster/syncthing
-    server: 192.168.1.157
----
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: syncthing-claim
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  volumeName: syncthing

apps/syncthing/service.yaml

@@ -1,46 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: syncthing-web
-  labels:
-    app: syncthing
-spec:
-  selector:
-    app: syncthing
-  type: ClusterIP
-  ports:
-  - port: 8384
-    targetPort: 8384
-    name: syncthing-web
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: syncthing-listen
-  annotations:
-    metallb.universe.tf/allow-shared-ip: syncthing-service
-spec:
-  selector:
-    app: syncthing
-  type: LoadBalancer
-  LoadBalancerIP: 192.168.3.4
-  ports:
-  - port: 22000
-    targetPort: 22000
-    protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: syncthing-discover
-  annotations:
-    metallb.universe.tf/allow-shared-ip: syncthing-service
-spec:
-  selector:
-    app: syncthing
-  type: LoadBalancer
-  LoadBalancerIP: 192.168.3.4
-  ports:
-  - port: 22000
-    targetPort: 22000
-    protocol: UDP

apps/syncthing/servicemonitor.yaml

@@ -1,17 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: syncthing-servicemonitor
-  labels:
-    app: syncthing
-spec:
-  selector:
-    matchLabels:
-      app: syncthing
-  endpoints:
-    - port: syncthing-web
-      path: /metrics
-      bearerTokenSecret:
-        name: syncthing-api
-        key: token
-        namespace: syncthing

apps/syncthing/syncthing-api.sealedsecret.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: syncthing-api
-  namespace: syncthing
-spec:
-  encryptedData:
-    token: AgC1hG1aguLIWBgA1R19MGrXDq7BONAldMEXtCeGXLO9Xar08f7qFqprtRJAMOID4trUEBMAkF96m7rH7QHTpO0WzRLrJctLi7U6NgESUJBDxusqjij3RAANS69Xt27mu2oa+rhm605CfFJT6Gpx/2CxrFtUD3yCijilDnEVvw4WvTLHvVQMCd8cM8ZDlpBsSYbxvtCUN1+B02DCucLpMphspxV2SGPAdc04xQD7d0vUhNLekFi0xSgu0jiRGVDHOG5Egd9d/BGeNOBgiUVxJxqqdXc6EmkslcSUtMQJ5luSxjogf+p3jdOqt4aPpUeR8sSPb6OSEIZD/Cfs9X4akHdpUAqkycu+V24lDxeHWAtIviCMBPttrwNAEytgwqaiT0U4UmL5GqR97jpmy3Tx+jYKuXkt4Igb6VByreuL9aZacRrqRhCCgbg95Y/UrYlLAbZYOI/+KsFzB5akGpZXUDcW9h2IkTUmcT+QxWXqEoNpoTI5qAnKiu/9T5elDKghjMHYX+CnPj+rXlQIJzX7NkZ0Q6HpKQ4B2Vd1Ewkvadf963jBodUe7WiMt8UeYgzCa33F4U23JjExIrL8t3r8MQ/IIdtfUvyz6Da1vp5hjpBUnUCk8rca/6VC3GO1GP3DLdIXiZQY1OOTHJlyLG7+bIL35zVfkmLMzmlIdaFsfeYiL4P+hYRbLABPAJk8lY7MEdiczpvI9HlmFVatJaPrFJwx9jyhzqIOq5eGt0OIkFt+fw==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: syncthing-api
-      namespace: syncthing
-    type: Opaque

infrastructure/argocd/argo-apps.application.yaml

@@ -12,7 +12,9 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd
-  syncPolicy:
-    automated:
-      prune: true
-      # selfHeal: true
+  # syncPolicy:
+  #   automated:
+  #     prune: true
+  #     selfHeal: false
+  # DO NOT AUTO SYNC THE APP OF APPS.
+  # all other apps are auto-synced, but adding new apps should be done manually.

infrastructure/backup/README.md

@@ -0,0 +1,15 @@
+# How to restore
+
+1.  Port forward the rest api for gcloud
+    ```bash
+    kubectl port-forward -n backup service/rclone-gcloud 8000
+    ```
+
+2. Load the snapshots locally
+    ```bash
+    restic -r rest:http://127.0.0.1:8000/kluster mount /mnt/restic
+    ```
+    (The password is in a secret)
+
+3. Copy relevant files to the correct location on the NAS
+    

infrastructure/external-dns/kustomization.yaml

@@ -11,7 +11,7 @@ resources:
 images:
   - name: octodns
     newName: octodns/octodns # has all plugins
-    newTag: "2024.03"
+    newTag: "2024.05"
 
   - name: git
     newName: alpine/git

infrastructure/gitea/actions.deployment.yaml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: actions-runner
+spec:
+  selector:
+    matchLabels:
+      app: actions-runner
+  template:
+    metadata:
+      labels:
+        app: actions-runner
+    spec:
+      hostname: kube-runner
+      serviceAccountName: actions-runner
+      containers:
+      - name: actions-runner
+        image: actions-runner
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "500m"
+        env:
+        - name: GITEA_INSTANCE_URL
+          value: "https://git.kluster.moll.re"
+        - name: GITEA_RUNNER_REGISTRATION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: actions-runner-secret
+              key: runner-token
+        - name: GITEA_RUNNER_LABELS
+          value: k8s
+        volumeMounts:
+        - name: runner-data
+          mountPath: /data
+      volumes:
+      - name: runner-data
+        emptyDir: {}
+

infrastructure/gitea/actions.rbac.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: actions-runner
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: actions-role
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "create", "delete"]
+- apiGroups: [""]
+  resources: ["pods/exec"]
+  verbs: ["get", "create"]
+- apiGroups: [""]
+  resources: ["pods/log"]
+  verbs: ["get", "list", "watch",]
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "create", "delete"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "create", "delete"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: actions-role-binding
+subjects:
+- kind: ServiceAccount
+  name: actions-runner
+  apiGroup: ""
+roleRef:
+  kind: Role
+  name: actions-role
+  apiGroup: rbac.authorization.k8s.io

infrastructure/gitea/actions.sealedsecret.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: actions-runner-secret
+  namespace: gitea
+spec:
+  encryptedData:
+    runner-token: AgBHwek/Aj/0oOnI/bnZ4FgtRoeJw4tIKvcDzBhaPdQ7bMVHyHUKYUNP7lkPgZrIN+7rhMY7C/j13iGWx4iTdhTgipLiJvyZ70pXKLSix4IpcypJTElggWkW0JW79x1HyJfBtn9iJiHnEZXPi7sEnyKhA0asAOR0ae8NS6mxxei0TIImaPaC2RHL6MOi40xsXpHz2ZaVhDQaTSRWjv0U6+WkCGcueqM2HLYfF1gqqkzGCjjhdOTK1CKvIvApZ5n8x6x94IiywCXJraDCwLz+acF2c2vA/Jb/3p7TwyyRZ5uIF5LZufhTJ6+5sFJSReHYxO4CpPA8KvM880vtiEjN7LxVo/Jruj2459OvjviKZS03ZwLHHrjanom1+HA9Sx2ffRLiR5ayGkfj/6kvpIRt5x1F7BbPp+a0LXuxJX+1nGDyEa1D1WzVKvZASav6/v7cXcom/nKGO91Zb8qHlOv7ZTs5guGQ9G9VCOHOG8szwpW3ZmQwWfFoWsShzqbDqszBYOGeIjIiDllLzTZ8A9dv9J2ELngZ1IPGIkfpQNEW8hsbNXTYhdVIrkh7BIFkRWfYDNWxqZd4iE6XllQcT1rqndusgiNEJX2r+P4nT8dPewATXQ79wzvZU3kB+VHzM8cLymlVGADi7v/qTY9RcrhuE0oMLzHRShr6JU05VfLGbMsttrYKmW7smvBp3lRJitO5A8+r8cRniS1+Xr8mIx87vCvnoWSH6BKkl9pCdDeCGylAWfkJN9UpkaKg
+  template:
+    metadata:
+      creationTimestamp: null
+      name: actions-runner-secret
+      namespace: gitea
+    type: Opaque

infrastructure/gitea/gitea.values.yaml

@@ -111,6 +111,15 @@ gitea:
       SSH_PORT: 2222
     actions:
       ENABLED: true
+    session:
+      PROVIDER: db
+    cache:
+      ADAPTER: memory
+    queue:
+      TYPE: level
+    indexer:
+      ISSUE_INDEXER_TYPE: bleve
+      REPO_INDEXER_ENABLED: true
 
 
 
@@ -154,12 +163,7 @@ postgresql:
 
 
 redis-cluster:
-  enabled: true
-  usePassword: false
-  cluster:
-    nodes: 3 # default: 6
-    replicas: 0 # default: 1
-
+  enabled: false
 
 postgresql-ha:
   enabled: false

infrastructure/gitea/kustomization.yaml

@@ -8,14 +8,23 @@ resources:
   - drone-kube-runner.deployment.yaml
   - drone-server.deployment.yaml
   - drone-server.sealedsecret.yaml
+  - actions.deployment.yaml
+  - actions.sealedsecret.yaml
+  - actions.rbac.yaml
+
 
 namespace: gitea
 
+images:
+  - name: actions-runner
+    newName: ghcr.io/christopherhx/gitea-actions-runner
+    newTag: v0.0.11
+
 
 helmCharts:
   - name: gitea
     namespace: gitea # needs to be set explicitly for svc to be referenced correctly
     releaseName: gitea
-    version: 10.1.3
+    version: 10.1.4
     valuesFile: gitea.values.yaml
     repo: https://dl.gitea.io/charts/

infrastructure/metallb-system/kustomization.yaml

@@ -10,6 +10,6 @@ namespace: metallb-system
 helmCharts:
   - name: metallb
     repo: https://metallb.github.io/metallb
-    version: 0.14.4
+    version: 0.14.5
     releaseName: metallb
     valuesFile: values.yaml

infrastructure/pg-ha/kustomization.yaml

@@ -9,6 +9,6 @@ namespace: pg-ha
 helmCharts:
   - name: cloudnative-pg
     releaseName: pg-controller
-    version: 0.20.2
+    version: 0.21.0
     valuesFile: values.yaml
     repo: https://cloudnative-pg.io/charts/

infrastructure/postgres/adding.md

@@ -1,13 +0,0 @@
-Create a new role by executing the createuser command. With the options below, the new role will not be a superuser and will not have privileges for creating new databases or new roles (this is usually the default for the createuser command).
-
-k exec -it -n postgres postgres-postgresql-0 -- bash
-
-```
-createuser -U postgres USER_NAME -S -D -R -P
-```
-You will be prompted to enter first the password for the new role and to reenter it, and then to enter the postgres role password.
-
-Create a new database with the new role as the owner:
-```
-createdb -U postgres DATABASE_NAME -O USER_NAME
-```

infrastructure/postgres/config.values.yaml

@@ -1,2 +0,0 @@
-name: postgres
-chart: bitnami/postgresql

infrastructure/postgres/postgres-password.sealedsecret.yaml

@@ -1,21 +0,0 @@
-{
-  "kind": "SealedSecret",
-  "apiVersion": "bitnami.com/v1alpha1",
-  "metadata": {
-    "name": "postgres-password",
-    "namespace": "postgres",
-    "creationTimestamp": null
-  },
-  "spec": {
-    "template": {
-      "metadata": {
-        "name": "postgres-password",
-        "namespace": "postgres",
-        "creationTimestamp": null
-      }
-    },
-    "encryptedData": {
-      "password": "AgBZ6tzoD2xnUNujT5eDjzmVcUuDZIjDz5PG1aEImvm+5iNdn8/s5etnU04Jq2gfWoJPgzaZZVWuBc7ZGRzy0+4FcHriMxx3A78MSfS6ucCjIpfxWXhzm+ZUqUq/D3on8tMSFpf6BVosxw26uI414pLp4v2xDrKACB/6xZFeHZnWEVEHSLWniRzIxewA56LlJQ/4MNj7uGMhB5IX4WgGullKP1g2/WFuYp524jOHMWkaWhSXXpvRLfmSStDIrgobgjilmUKCxGO7y7m+L+qCzfNvXLCvRjhRbHWzINwjkN6X7BG7hMA9LjhN4aXglO68EdIU5vn+ekRh7FdrMt29sCm0JSWiMpE8HXNGdyuiuol8uMWIMeu8Em3rJah5LA38sSwsP7cZ74wM1ySNePtDagkb2pnqzCEg5e6eF54dpBuDbkQ9qm8q2+czDFovDUK2F4i3x7u5quQ5+qzem7kQsOi9fs/TKISFPHDSgJtVgp8z+kxbQIwa3hHa2Rhahm6PMGcN++V0gYVSdI04UmywX+DmcUPaOF2wP2ABYbpHWr96smbE5/iBG1l3qBFTxhl7FiZV6MZwiCZ4z0DCr59quhKAcEhxla0OEcUN+VXkyEHN16PVVKMh8uKPHOyXVGsBf4zQw5bWFwcZ8zBMdfQknK5pPwbUvSTEaPPW9lMZZW29tVOyZ+lb4l6iZkzGOzn9/VqWjwhLKiI="
-    }
-  }
-}

infrastructure/postgres/pvc.yaml

@@ -1,29 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  namespace: postgres
-  name: postgres-nfs
-spec:
-  # storageClassName: fast
-  capacity:
-    storage: "50Gi"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /export/kluster/postgres
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: postgres
-  name: postgres-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: "50Gi"
-  volumeName: postgres-nfs

infrastructure/prometheus/prometheus.yaml

@@ -4,7 +4,7 @@ metadata:
   name: prometheus
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+knd: ClusterRole
 metadata:
   name: prometheus
 rules:
@@ -39,7 +39,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: prometheus
-  namespace: monitoring # needs to be the same as in the kustomization.yaml
+  namespace: prometheus # needs to be the same as in the kustomization.yaml
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: Prometheus
@@ -51,6 +51,8 @@ spec:
   resources:
     requests:
       memory: 400Mi
+  retention: 730d
+  retentionSize: 50Gi
   serviceAccountName: prometheus
   enableAdminAPI: false
   serviceMonitorNamespaceSelector: {}
@@ -61,7 +63,15 @@ spec:
       # loads the config from a secret named thanos-objstore-config in the same namespace
       key: thanos.yaml
       name: thanos-objstore-config
-
+  volumeClaimTemplate:
+    metadata:
+      name: prometheus-data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 50Gi
 ---
 apiVersion: v1
 kind: Service

infrastructure/prometheus/thanos-query.deployment.yaml

@@ -22,6 +22,7 @@ spec:
         - --log.level=debug
         - --query.replica-label=replica
         - --endpoint=dnssrv+_grpc._tcp.thanos-store:10901
+        - --endpoint=dnssrv+_grpc._tcp.prometheus:9090
         ports:
         - name: http
           containerPort: 10902
@@ -38,6 +39,20 @@ spec:
 ---
 apiVersion: v1
 kind: Service
+metadata:
+  name: thanos-querier
+spec:
+  selector:
+    app: thanos-querier
+  ports:
+    - name: http
+      protocol: TCP
+      port: 10902
+      targetPort: http
+    - name: grpc
+      protocol: TCP
+      port: 10901
+      targetPort: grpc
 metadata:
   labels:
     app: thanos-querier

infrastructure/sealedsecrets/kustomization.yaml

@@ -9,4 +9,4 @@ resources:
 images:
   - name: controller
     newName: docker.io/bitnami/sealed-secrets-controller
-    newTag: 0.26.1
+    newTag: 0.26.2

infrastructure/traefik-system/kustomization.yaml

@@ -13,6 +13,6 @@ namespace: traefik-system
 helmCharts:
   - name: traefik
     releaseName: traefik
-    version: 26.1.0
+    version: 27.0.2
     valuesFile: values.yaml
     repo: https://traefik.github.io/charts

kluster-deployments/homepage/application.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: syncthing-application
+  name: homepage-application
   namespace: argocd
 
 spec:
@@ -9,10 +9,10 @@ spec:
   source:
     repoURL: ssh://git@git.kluster.moll.re:2222/remoll/k3s-infra.git
     targetRevision: main
-    path: apps/syncthing
+    path: apps/homepage
   destination:
     server: https://kubernetes.default.svc
-    namespace: syncthing
+    namespace: homepage
   syncPolicy:
     automated:
       prune: true

kluster-deployments/kustomization.yaml

@@ -28,14 +28,13 @@ resources:
   - files/
   - finance/
   - homeassistant/
+  - homepage/application.yaml
   - immich/
   - journal/
   - media/
   - monitoring/
-  # - nextcloud/
   - ntfy/
   - recipes/
   - rss/
-  # - syncthing/
   - whoami/
   - todos/

kluster-deployments/nextcloud/application.yaml

@@ -1,18 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: nextcloud-application
-  namespace: argocd
-spec:
-  project: apps
-  source:
-    repoURL: ssh://git@git.kluster.moll.re:2222/remoll/k3s-infra.git
-    targetRevision: main
-    path: apps/nextcloud/
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: nextcloud
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

kluster-deployments/nextcloud/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - application.yaml

kluster-deployments/pg-ha/application.yaml

@@ -17,3 +17,6 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    syncOptions:
+      - Replace=true
+    # because the crd annotations exceed the default 256Ki limit

kluster-deployments/syncthing/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - application.yaml