small fixes

Reviewed-on: #94

apps/affine/deployment.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: affine
+spec:
+  selector:
+    matchLabels:
+      app: affine
+  template:
+    metadata:
+      labels:
+        app: affine
+    spec:
+      containers:
+      - name: affine
+        image: affine
+        resources:
+          limits:
+            memory: "512Mi"
+            cpu: "1"
+        env:
+        - name: AFFINE_SERVER_HOST
+          value: "affine.kluster.moll.re"
+        - name: AFFINE_SERVER_PORT
+          value: "443"
+        - name: AFFINE_SERVER_HTTPS
+          value: "true"
+        - name: AFFINE_CONFIG_PATH
+          value: "/root/.affine/config"
+        - name: AFFINE_ADMIN_EMAIL
+          value: "me@moll.re"
+        - name: AFFINE_ADMIN_PASSWORD
+          value: "password"
+        - name: TELEMETRY_ENABLE
+          value: "false"
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: postgres-credentials
+              key: url
+        - name: NODE_OPTIONS
+          value: "--import=./scripts/register.js"
+        - name: NODE_ENV
+          value: "production"
+        ports:
+        - containerPort: 3010
+        volumeMounts:
+        - name: affine-data
+          mountPath: /root/.affine/storage
+        - name: affine-config
+          mountPath: /root/.affine/config
+      volumes:
+      - name: affine-data
+        persistentVolumeClaim:
+          claimName: affine-data
+      - name: affine-config
+        persistentVolumeClaim:
+          claimName: affine-config

apps/affine/ingress.yaml

@@ -0,0 +1,15 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: affine-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`affine.kluster.moll.re`)
+      kind: Rule
+      services:
+        - name: affine-web
+          port: 3010
+  tls:
+    certResolver: default-tls

apps/affine/kustomization.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+
+namespace: affine
+
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - postgres.yaml
+  - pvc.yaml
+  - postgres-credentials.secret.yaml
+
+
+images:
+  - name: affine
+    newName: ghcr.io/toeverything/affine-graphql
+    newTag: stable

apps/affine/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/affine/postgres.yaml

@@ -0,0 +1,20 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: affine-postgres
+spec:
+  instances: 1
+  bootstrap:
+    initdb:
+      owner: affine
+      database: affine
+      secret:
+        name: postgres-credentials
+
+  storage:
+    size: 1Gi
+    pvcTemplate:
+      storageClassName: "nfs-client"
+      resources:
+        requests:
+          storage: "1Gi"

apps/affine/pvc.yaml

@@ -0,0 +1,23 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: affine-data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 15Gi
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: affine-config
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/affine/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: affine-web
+spec:
+  selector:
+    app: affine
+  ports:
+  - port: 3010
+    targetPort: 3010

apps/homeassistant/kustomization.yaml

@@ -15,4 +15,4 @@ resources:
 images:
   - name: homeassistant/home-assistant
     newName: homeassistant/home-assistant
-    newTag: "2024.4"
+    newTag: "2024.5"

apps/homepage/kustomization.yaml

@@ -14,4 +14,4 @@ resources:
 images:
   - name: homepage
     newName: ghcr.io/gethomepage/homepage
-    newTag: v0.8.12
+    newTag: v0.8.13

apps/immich/kustomization.yaml

@@ -19,7 +19,6 @@ helmCharts:
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.102.3
+    newTag: v1.103.1
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.102.3
-
+    newTag: v1.103.1

apps/immich/postgres.yaml

@@ -1,4 +1,3 @@
-
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:

apps/media/ingress.yaml

@@ -0,0 +1,63 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: jellyfin-vue-ingress
+  namespace: media
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`media.kluster.moll.re`)
+      middlewares:
+        - name: jellyfin-websocket
+      kind: Rule
+      services:
+        - name: jellyfin-web
+          port: 80
+  tls:
+    certResolver: default-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: jellyfin-backend-ingress
+  namespace: media
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`media-backend.kluster.moll.re`) && !Path(`/metrics`)
+      middlewares:
+        - name: jellyfin-websocket
+        - name: jellyfin-server-headers
+      kind: Rule
+      services:
+        - name: jellyfin-server
+          port: 8096
+  tls:
+    certResolver: default-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: jellyfin-websocket
+  namespace: media
+spec:
+  headers:
+    customRequestHeaders:
+      Connection: keep-alive, Upgrade
+      Upgrade: WebSocket
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: jellyfin-server-headers
+  namespace: media
+spec:
+  headers:
+    accessControlAllowCredentials: true
+    accessControlAllowHeaders: [ "Authorization","Content-Type" ] # "Accept","Origin"
+    accessControlAllowMethods: [ "GET","HEAD","OPTIONS" ] # "POST","PUT"
+    accessControlAllowOriginList:
+      - "*"
+    accessControlMaxAge: 100

apps/media/kustomization.yaml

@@ -14,7 +14,7 @@ resources:
 images:
   - name: jellyfin/jellyfin
     newName: jellyfin/jellyfin
-    newTag: 10.8.13
+    newTag: 10.9.0
   - name: ghcr.io/jellyfin/jellyfin-vue
     newName: ghcr.io/jellyfin/jellyfin-vue
     newTag: stable-rc.0.3.1

apps/minecraft/README.md

@@ -0,0 +1,7 @@
+## Sending a command
+```
+kubectl exec -it -n minecraft deploy/minecraft-server -- /bin/bash
+mc-send-to-console /help
+# or directly
+kubectl exec -it -n minecraft deploy/minecraft-server -- mc-send-to-console /help
+```

apps/minecraft/deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: minecraft-server
+spec:
+  selector:
+    matchLabels:
+      app: minecraft-server
+  template:
+    metadata:
+      labels:
+        app: minecraft-server
+    spec:
+      containers:
+      - name: minecraft-server
+        image: minecraft
+        resources:
+          limits:
+            memory: "4000Mi"
+            cpu: "2500m"
+          requests:
+            memory: "1000Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 25565
+        env:
+        - name: EULA
+          value: "TRUE"
+        - name: MODPACK
+          value: "https://www.curseforge.com/api/v1/mods/711537/files/5076228/download"
+        - name: VERSION
+          value: "1.18.2"
+        # - name: VERSION
+        #   value: "1.16.5"
+        # - name: MODPACK
+        #   value: "https://mediafilez.forgecdn.net/files/3602/5/VaultHunters-OfficialModpack-1.12.1-Server.zip"
+        - name: INIT_MEMORY
+          value: "1G"
+        - name: MAX_MEMORY
+          value: "3G"
+        - name: MOTD
+          value: "VaultHunters baby!"
+        - name: ENABLE_RCON
+          value: "false"
+        - name: CREATE_CONSOLE_IN_PIPE
+          value: "true"
+        - name: ONLINE_MODE
+          value: "true"
+        volumeMounts:
+        - name: minecraft-data
+          mountPath: /data
+
+      volumes:
+      - name: minecraft-data
+        persistentVolumeClaim:
+          claimName: minecraft-data

apps/minecraft/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: minecraft
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+
+images:
+  - name: minecraft
+    newName: itzg/minecraft-server
+    newTag: java21

apps/minecraft/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/minecraft/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: minecraft-data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/minecraft/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: minecraft-server
+spec:
+  selector:
+    app: minecraft-server
+  ports:
+  - port: 25565
+    targetPort: 25565
+  type: LoadBalancer
+  loadBalancerIP: 192.168.3.4

apps/recipes/kustomization.yaml

@@ -12,5 +12,5 @@ resources:
 
 images:
   - name: mealie
-    newTag: v1.5.1
+    newTag: v1.6.0
     newName: ghcr.io/mealie-recipes/mealie

infrastructure/external-dns/kustomization.yaml

@@ -11,7 +11,7 @@ resources:
 images:
   - name: octodns
     newName: octodns/octodns # has all plugins
-    newTag: "2024.04"
+    newTag: "2024.05"
 
   - name: git
     newName: alpine/git

infrastructure/gitea/actions.deployment.yaml

@@ -11,19 +11,15 @@ spec:
       labels:
         app: actions-runner
     spec:
+      hostname: kube-runner
+      serviceAccountName: actions-runner
       containers:
       - name: actions-runner
-        hostname: kube-runner
         image: actions-runner
-        securityContext:
-          privileged: true  # Add this line to allow running Docker
         resources:
           requests:
             memory: "128Mi"
             cpu: "500m"
-          limits:
-            memory: "256Mi"
-            cpu: "1000m"
         env:
         - name: GITEA_INSTANCE_URL
           value: "https://git.kluster.moll.re"
@@ -34,3 +30,10 @@ spec:
               key: runner-token
         - name: GITEA_RUNNER_LABELS
           value: k8s
+        volumeMounts:
+        - name: runner-data
+          mountPath: /data
+      volumes:
+      - name: runner-data
+        emptyDir: {}
+

infrastructure/gitea/actions.rbac.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: actions-runner
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: actions-role
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "create", "delete"]
+- apiGroups: [""]
+  resources: ["pods/exec"]
+  verbs: ["get", "create"]
+- apiGroups: [""]
+  resources: ["pods/log"]
+  verbs: ["get", "list", "watch",]
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "create", "delete"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "create", "delete"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: actions-role-binding
+subjects:
+- kind: ServiceAccount
+  name: actions-runner
+  apiGroup: ""
+roleRef:
+  kind: Role
+  name: actions-role
+  apiGroup: rbac.authorization.k8s.io

infrastructure/gitea/kustomization.yaml

@@ -10,6 +10,8 @@ resources:
   - drone-server.sealedsecret.yaml
   - actions.deployment.yaml
   - actions.sealedsecret.yaml
+  - actions.rbac.yaml
+
 
 namespace: gitea