home assistant dashboard improvements

Reviewed-on: #138

apps/adguard/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 images:
   - name: adguard/adguardhome
     newName: adguard/adguardhome
-    newTag: v0.107.48
+    newTag: v0.107.52
 
 namespace: adguard
 

apps/affine/deployment.yaml

@@ -1,58 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: affine
-spec:
-  selector:
-    matchLabels:
-      app: affine
-  template:
-    metadata:
-      labels:
-        app: affine
-    spec:
-      containers:
-      - name: affine
-        image: affine
-        resources:
-          limits:
-            memory: "512Mi"
-            cpu: "1"
-        env:
-        - name: AFFINE_SERVER_HOST
-          value: "affine.kluster.moll.re"
-        - name: AFFINE_SERVER_PORT
-          value: "443"
-        - name: AFFINE_SERVER_HTTPS
-          value: "true"
-        - name: AFFINE_CONFIG_PATH
-          value: "/root/.affine/config"
-        - name: AFFINE_ADMIN_EMAIL
-          value: "me@moll.re"
-        - name: AFFINE_ADMIN_PASSWORD
-          value: "password"
-        - name: TELEMETRY_ENABLE
-          value: "false"
-        - name: DATABASE_URL
-          valueFrom:
-            secretKeyRef:
-              name: postgres-credentials
-              key: url
-        - name: NODE_OPTIONS
-          value: "--import=./scripts/register.js"
-        - name: NODE_ENV
-          value: "production"
-        ports:
-        - containerPort: 3010
-        volumeMounts:
-        - name: affine-data
-          mountPath: /root/.affine/storage
-        - name: affine-config
-          mountPath: /root/.affine/config
-      volumes:
-      - name: affine-data
-        persistentVolumeClaim:
-          claimName: affine-data
-      - name: affine-config
-        persistentVolumeClaim:
-          claimName: affine-config

apps/affine/ingress.yaml

@@ -1,15 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: affine-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`affine.kluster.moll.re`)
-      kind: Rule
-      services:
-        - name: affine-web
-          port: 3010
-  tls:
-    certResolver: default-tls

apps/affine/kustomization.yaml

@@ -1,20 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-
-namespace: affine
-
-resources:
-  - namespace.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - postgres.yaml
-  - pvc.yaml
-  - postgres-credentials.secret.yaml
-
-
-images:
-  - name: affine
-    newName: ghcr.io/toeverything/affine-graphql
-    newTag: stable

apps/affine/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder

apps/affine/postgres.yaml

@@ -1,20 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: affine-postgres
-spec:
-  instances: 1
-  bootstrap:
-    initdb:
-      owner: affine
-      database: affine
-      secret:
-        name: postgres-credentials
-
-  storage:
-    size: 1Gi
-    pvcTemplate:
-      storageClassName: "nfs-client"
-      resources:
-        requests:
-          storage: "1Gi"

apps/affine/pvc.yaml

@@ -1,23 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: affine-data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 15Gi
----
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: affine-config
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

apps/affine/service.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: affine-web
-spec:
-  selector:
-    app: affine
-  ports:
-  - port: 3010
-    targetPort: 3010

apps/files/kustomization.yaml

@@ -13,4 +13,4 @@ namespace: files
 images:
   - name: ocis
     newName: owncloud/ocis
-    newTag: "5.0.3"
+    newTag: "5.0.5"

apps/finance/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: actualbudget
     newName: actualbudget/actual-server
-    newTag: 24.5.0
+    newTag: 24.7.0

apps/homeassistant/kustomization.yaml

@@ -15,4 +15,4 @@ resources:
 images:
   - name: homeassistant/home-assistant
     newName: homeassistant/home-assistant
-    newTag: "2024.5"
+    newTag: "2024.7"

apps/homeassistant/service.yaml

@@ -2,6 +2,8 @@ apiVersion: v1
 kind: Service
 metadata:
   name: homeassistant-web
+  labels:
+    app: homeassistant
 spec:
   selector:
     app: homeassistant

apps/homepage/configmap.yaml

@@ -1,98 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: config
-  labels:
-    app.kubernetes.io/name: homepage
-data:
-  kubernetes.yaml: "" #|
-  #  mode: cluster
-  settings.yaml: |
-    title: "Homepage"
-    background: https://images.unsplash.com/photo-1547327132-5d20850c62b5?q=80&w=3870&auto=format&fit=crop
-    cardBlur: sm
-  #settings.yaml: |
-  #  providers:
-  #    longhorn:
-  #      url: https://longhorn.my.network
-  custom.css: ""
-  custom.js: ""
-  bookmarks.yaml: |
-    - Developer:
-        - Github:
-            - abbr: GH
-              href: https://github.com/moll-re
-  services.yaml: |
-    - Media:
-        - Jellyfin backend:
-            href: https://media-backend.kluster.moll.re
-            ping: media-backend.kluster.moll.re
-        - Jellyfin vue:
-            href: https://media.kluster.moll.re
-            ping: media.kluster.moll.re
-        - Immich:
-            href: https://immich.kluster.moll.re
-            ping: immich.kluster.moll.re
-
-    - Productivity:
-        - OwnCloud:
-            href: https://ocis.kluster.moll.re
-            ping: ocis.kluster.moll.re
-        - ToDo:
-            href: https://todos.kluster.moll.re
-            ping: todos.kluster.moll.re
-        - Finance:
-            href: https://finance.kluster.moll.re
-            ping: finance.kluster.moll.re
-
-    - Home:
-        - Home Assistant:
-            href: https://home.kluster.moll.re
-            ping: home.kluster.moll.re
-        - Grafana:
-            href: https://grafana.kluster.moll.re
-            ping: grafana.kluster.moll.re
-        - Recipes:
-            href: https://recipes.kluster.moll.re
-            ping: recipes.kluster.moll.re
-    
-    - Infra:
-        - Gitea:
-            href: https://git.kluster.moll.re
-            ping: git.kluster.moll.re
-        - ArgoCD:
-            href: https://argocd.kluster.moll.re
-            ping: argocd.kluster.moll.re
-
-  widgets.yaml: |
-    # - kubernetes:
-    #     cluster:
-    #       show: true
-    #       cpu: true
-    #       memory: true
-    #       showLabel: true
-    #       label: "cluster"
-    #     nodes:
-    #       show: true
-    #       cpu: true
-    #       memory: true
-    #       showLabel: true
-    - search:
-        provider: duckduckgo
-    - openmeteo:
-        label: Zürich # optional
-        latitude: 47.24236
-        longitude: 8.30439
-        units: metric # or imperial
-        cache: 30 # Time in minutes to cache API responses, to stay within limits
-        format: # optional, Intl.NumberFormat options
-            maximumFractionDigits: 1
-    - datetime:
-        locale: de
-        format:
-          dateStyle: long
-          timeStyle: short
-    - adguard:
-        url: http://adguard-home-web.adguard-home:3000
-
-  docker.yaml: ""

apps/homepage/deployment.yaml

@@ -1,64 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: homepage
-  labels:
-    app.kubernetes.io/name: homepage
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: RollingUpdate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: homepage
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: homepage
-    spec:
-      # serviceAccountName: homepage
-      # automountServiceAccountToken: true
-      dnsPolicy: ClusterFirst
-      # enableServiceLinks: true
-      containers:
-        - name: homepage
-          image: homepage
-          imagePullPolicy: Always
-          ports:
-            - name: http
-              containerPort: 3000
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /app/config/custom.js
-              name: config
-              subPath: custom.js
-            - mountPath: /app/config/custom.css
-              name: config
-              subPath: custom.css
-            - mountPath: /app/config/bookmarks.yaml
-              name: config
-              subPath: bookmarks.yaml
-            - mountPath: /app/config/docker.yaml
-              name: config
-              subPath: docker.yaml
-            - mountPath: /app/config/kubernetes.yaml
-              name: config
-              subPath: kubernetes.yaml
-            - mountPath: /app/config/services.yaml
-              name: config
-              subPath: services.yaml
-            - mountPath: /app/config/settings.yaml
-              name: config
-              subPath: settings.yaml
-            - mountPath: /app/config/widgets.yaml
-              name: config
-              subPath: widgets.yaml
-            - mountPath: /app/config/logs
-              name: logs
-      volumes:
-        - name: config
-          configMap:
-            name: config
-        - name: logs
-          emptyDir: {}

apps/homepage/ingress.yaml

@@ -1,16 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: homepage-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`start.kluster.moll.re`)
-      kind: Rule
-      services:
-        - name: homepage-web
-          port: 3000
-  tls:
-    certResolver: default-tls

apps/homepage/kustomization.yaml

@@ -1,17 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: homepage
-
-resources:
-  - namespace.yaml
-  - deployment.yaml
-  - service.yaml
-  - configmap.yaml
-  - ingress.yaml
-
-
-images:
-  - name: homepage
-    newName: ghcr.io/gethomepage/homepage
-    newTag: v0.8.13

apps/homepage/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder

apps/homepage/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: homepage-web
-  labels:
-    app.kubernetes.io/name: homepage
-spec:
-  type: ClusterIP
-  ports:
-    - port: 3000
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/name: homepage

apps/immich/kustomization.yaml

@@ -12,13 +12,13 @@ namespace: immich
 helmCharts:
   - name: immich
     releaseName: immich
-    version: 0.6.0
+    version: 0.7.0
     valuesFile: values.yaml
     repo: https://immich-app.github.io/immich-charts
 
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.103.1
+    newTag: v1.106.4
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.103.1
+    newTag: v1.106.4

apps/immich/values.yaml

@@ -22,10 +22,13 @@ env:
       secretKeyRef:
         name: postgres-password
         key: password
-  IMMICH_WEB_URL: '{{ printf "http://%s-web:3000" .Release.Name }}'
   IMMICH_MACHINE_LEARNING_URL: '{{ printf "http://%s-machine-learning:3003" .Release.Name }}'
+  IMMICH_METRICS: true
 
 immich:
+  metrics:
+    # Enabling this will create the service monitors needed to monitor immich with the prometheus operator
+    enabled: true
   persistence:
     # Main data store for all photos shared between different components.
     library:
@@ -52,16 +55,6 @@ server:
     main:
       enabled: false
 
-microservices:
-  enabled: true
-  persistence:
-    geodata-cache:
-      enabled: true
-      size: 1Gi
-      # Optional: Set this to pvc to avoid downloading the geodata every start.
-      type: emptyDir
-      accessMode: ReadWriteMany
-
 machine-learning:
   enabled: true
   persistence:

apps/media/deployment.yaml

@@ -18,6 +18,9 @@ spec:
           limits:
             memory: "2Gi"
             cpu: "2"
+          requests:
+            memory: "128Mi"
+            cpu: "250m"
         ports:
         - containerPort: 8096
           name: jellyfin

apps/media/ingress.yaml

@@ -1,24 +1,5 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
-metadata:
-  name: jellyfin-vue-ingress
-  namespace: media
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`media.kluster.moll.re`)
-      middlewares:
-        - name: jellyfin-websocket
-      kind: Rule
-      services:
-        - name: jellyfin-web
-          port: 80
-  tls:
-    certResolver: default-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
 metadata:
   name: jellyfin-backend-ingress
   namespace: media
@@ -26,7 +7,7 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`media-backend.kluster.moll.re`) && !Path(`/metrics`)
+    - match: Host(`media.kluster.moll.re`) && !Path(`/metrics`)
       middlewares:
         - name: jellyfin-websocket
         - name: jellyfin-server-headers

apps/media/jellyfin.servicemonitor.yaml

@@ -1,17 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: jellyfin
-  labels:
-    metrics: prometheus
-spec:
-  selector:
-    matchLabels:
-      app: jellyfin-server-service
-  endpoints:
-  - path: /metrics
-    targetPort: jellyfin
-
-# this exposes metrics on port 8096 as enabled in the jellyfin config
-# https://jellyfin.org/docs/general/networking/monitoring/
-# the metrics are available at /metrics but blocked by the ingress

apps/media/kustomization.yaml

@@ -5,16 +5,11 @@ namespace: media
 resources: 
   - namespace.yaml
   - pvc.yaml
-  - server.deployment.yaml
-  - server.service.yaml
-  - web.deployment.yaml
-  - web.service.yaml
+  - deployment.yaml
+  - service.yaml
   - ingress.yaml
 
 images:
   - name: jellyfin/jellyfin
     newName: jellyfin/jellyfin
-    newTag: 10.9.0
-  - name: ghcr.io/jellyfin/jellyfin-vue
-    newName: ghcr.io/jellyfin/jellyfin-vue
-    newTag: stable-rc.0.3.1
+    newTag: 10.9.7

apps/media/web.deployment.yaml

@@ -1,27 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: jellyfin-web
-spec:
-  selector:
-    matchLabels:
-      app: jellyfin-web
-  template:
-    metadata:
-      labels:
-        app: jellyfin-web
-    spec:
-      containers:
-      - name: jellyfin-web
-        image: ghcr.io/jellyfin/jellyfin-vue
-        resources:
-          limits:
-            memory: "128Mi"
-            cpu: "30m"
-        ports:
-        - containerPort: 80
-        env:
-        - name: TZ
-          value: Europe/Berlin
-        - name: DEFAULT_SERVERS
-          value: "https://media-backend.kluster.moll.re"

apps/media/web.service.yaml

@@ -1,12 +0,0 @@
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: jellyfin-web
-spec:
-  selector:
-    app: jellyfin-web
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 80

apps/minecraft/curseforge.sealedsecret.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: curseforge-api
+  namespace: minecraft
+spec:
+  encryptedData:
+    key: AgBYeAiejdmxDBorvgnxQX5YvUhR3NId2vfWybMKlc27e6D/bKglLNyZMk70xSnFAPjcDmZ20mYjFPYvDOr9T6IU/REJ8QlzoKAn0xW779R4SkIxRToT+dJv+OM2avgQ9uqp7vja29xeXMjYAnQML+QGZKcrT8mE04G/Ty8rdUiv3yUXK5HFAR3SUF35aVLdlthLjpRkv1s0R7GAP4L2pNzBJNV3i37viceUSSjU0zpOa23fsQOkPAs67AIukAJBqh/hyF/hR9H1GeYZNTI3OcHcvC2iNk/XGstvv0Zy6ApzoebsfWGdsbVn+QUI0EBw+mSTPqpl71cbkz0v4S4XAVndosxWpe6AIgm5MBTU0FXIyGyoFDe1aMPq8BXiQikYVwB48oVNh9KF0xXX5AOG0whB/FEsL3OJsiNQvQ3R/Hru43JBn64oxjVtLfM3E7u8v/xr1VQahX8dylDmb4s5EV01U6O4y19Ou4td1eEMlhpJb0fBPDRUYuWxZAEDGmp+U4tAakyPed11VkcZPPn9fKAAcv8sGs3TYAbbF18hqsBnv2Wd+i7ZEvKwmdmfR/T0r1TJGsvKI7jaW0QtH256XrSxQp7a52qMKMVQWOSKw2k27t/IkRhxT2Prw4GfJvaVr4RozUaBf3LV/hfDWlDfmM2zg3X9W8HkzjotGg021OLxsa0Wzmhffvb8h4bvZwxeq3U1xaJocqXui7z0rT2pF4z3wYHR/lPtexHcOA2M8gfBGKb1rBKh+kW+N+/ZfVLNI0mokg5vrTO2nR2rb4c=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: curseforge-api
+      namespace: minecraft
+    type: Opaque

apps/minecraft/job.yaml

@@ -1,43 +1,41 @@
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
-  name: minecraft-server
+  name: start-server
 spec:
-  selector:
-    matchLabels:
-      app: minecraft-server
   template:
-    metadata:
-      labels:
-        app: minecraft-server
     spec:
+      restartPolicy: OnFailure
       containers:
       - name: minecraft-server
         image: minecraft
         resources:
           limits:
-            memory: "4000Mi"
-            cpu: "2500m"
+            memory: "10000Mi"
+            cpu: "5"
           requests:
-            memory: "1000Mi"
+            memory: "1500Mi"
             cpu: "500m"
         ports:
         - containerPort: 25565
         env:
         - name: EULA
           value: "TRUE"
-        - name: MODPACK
-          value: "https://www.curseforge.com/api/v1/mods/711537/files/5076228/download"
+        - name: TYPE
+          value: "AUTO_CURSEFORGE"
+        - name: CF_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: curseforge-api
+              key: key
+        - name: CF_PAGE_URL
+          value: "https://www.curseforge.com/minecraft/modpacks/vault-hunters-1-18-2/files/5413446"
         - name: VERSION
           value: "1.18.2"
-        # - name: VERSION
-        #   value: "1.16.5"
-        # - name: MODPACK
-        #   value: "https://mediafilez.forgecdn.net/files/3602/5/VaultHunters-OfficialModpack-1.12.1-Server.zip"
         - name: INIT_MEMORY
           value: "1G"
         - name: MAX_MEMORY
-          value: "3G"
+          value: "8G"
         - name: MOTD
           value: "VaultHunters baby!"
         - name: ENABLE_RCON
@@ -46,6 +44,9 @@ spec:
           value: "true"
         - name: ONLINE_MODE
           value: "true"
+        - name: ENABLE_AUTOSTOP
+          value: "true"
+        
         volumeMounts:
         - name: minecraft-data
           mountPath: /data

apps/minecraft/kustomization.yaml

@@ -6,8 +6,10 @@ namespace: minecraft
 resources:
   - namespace.yaml
   - pvc.yaml
-  - deployment.yaml
+  - job.yaml
   - service.yaml
+  - curseforge.sealedsecret.yaml
+
 
 images:
   - name: minecraft

apps/monitoring/grafana.pvc.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: grafana-nfs
-spec:
-  capacity:
-    storage: "1Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/grafana
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: grafana-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
-  volumeName: grafana-nfs

apps/monitoring/grafana.values.yaml

@@ -31,7 +31,7 @@ datasources:
     datasources:
       - name: Thanos
         type: prometheus
-        url: http://thanos-querier.prometheus.svc:9090
+        url: http://thanos-querier.prometheus.svc:10902
         isDefault: true
       - name: Prometheus
         type: prometheus

apps/monitoring/influxdb.pvc.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: influxdb-nfs
-spec:
-  capacity:
-    storage: "10Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/influxdb
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: influxdb-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "10Gi"
-  volumeName: influxdb-nfs

apps/monitoring/influxdb.values.yaml

@@ -1,26 +0,0 @@
-## Create default user through docker entrypoint
-## Defaults indicated below
-##
-adminUser:
-  organization: "influxdata"
-  bucket: "default"
-  user: "admin"
-  retention_policy: "0s"
-  ## Leave empty to generate a random password and token.
-  ## Or fill any of these values to use fixed values.
-  password: ""
-  token: ""
-
-
-## Persist data to a persistent volume
-##
-persistence:
-  enabled: true
-  ## If true will use an existing PVC instead of creating one
-  useExisting: true
-  ## Name of existing PVC to be used in the influx deployment
-  name: influxdb-nfs
-
-
-ingress:
-  enabled: false

apps/monitoring/kustomization.yaml

@@ -5,7 +5,7 @@ namespace: monitoring
 
 resources: 
   - namespace.yaml
-  - grafana.pvc.yaml
+  # - grafana.pvc.yaml
   # - influxdb.pvc.yaml
   - grafana.ingress.yaml
   - grafana-admin.sealedsecret.yaml
@@ -16,5 +16,5 @@ helmCharts:
   - releaseName: grafana
     name: grafana
     repo: https://grafana.github.io/helm-charts
-    version: 7.3.9
+    version: 8.3.2
     valuesFile: grafana.values.yaml

apps/monitoring/telegraf-speedtest.values.yaml

@@ -1,52 +0,0 @@
-env:
-  - name: HOSTNAME
-    value: "telegraf-speedtest"
-
-service:
-  enabled: false
-rbac:
-  # Specifies whether RBAC resources should be created
-  create: false
-
-serviceAccount:
-  # Specifies whether a ServiceAccount should be created
-  create: false
-
-
-## Exposed telegraf configuration
-## For full list of possible values see `/docs/all-config-values.yaml` and `/docs/all-config-values.toml`
-## ref: https://docs.influxdata.com/telegraf/v1.1/administration/configuration/
-config:
-  agent:
-    interval: "2h"
-    round_interval: true
-    metric_batch_size: 1000
-    metric_buffer_limit: 10000
-    collection_jitter: "0s"
-    flush_interval: "10s"
-    flush_jitter: "0s"
-    precision: ""
-    debug: false
-    quiet: false
-    logfile: ""
-    hostname: "$HOSTNAME"
-    omit_hostname: false
-  processors:
-    - enum:
-        mapping:
-          field: "status"
-          dest: "status_code"
-          value_mappings:
-            healthy: 1
-            problem: 2
-            critical: 3
-  outputs:
-    - influxdb_v2:
-        urls:
-          - "http://influxdb-influxdb2.monitoring:80"
-        token: We64mk4L4bqYCL77x3fAUSYfOse9Kktyf2eBLyrryG9c3-y8PQFiKPIh9EvSWuq78QSQz6hUcsm7XSFR2Zj1MA==
-        organization: "influxdata"
-        bucket: "homeassistant"
-  inputs:
-    - internet_speed:
-        enable_file_download: false

apps/ntfy/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: binwiederhier/ntfy
     newName: binwiederhier/ntfy
-    newTag: v2.10.0
+    newTag: v2.11.0

apps/recipes/kustomization.yaml

@@ -12,5 +12,5 @@ resources:
 
 images:
   - name: mealie
-    newTag: v1.6.0
+    newTag: v1.10.2
     newName: ghcr.io/mealie-recipes/mealie

infrastructure/external-dns/kustomization.yaml

@@ -11,8 +11,8 @@ resources:
 images:
   - name: octodns
     newName: octodns/octodns # has all plugins
-    newTag: "2024.05"
+    newTag: "2024.06"
 
   - name: git
     newName: alpine/git
-    newTag: "2.43.0"
+    newTag: "v2.45.2"

infrastructure/gitea/README.md

@@ -0,0 +1,31 @@
+# Using gitea actions
+The actions deployment allows to use gitea actions from repositories within this instance.
+
+### Building docker images
+Docker builds use the kubernetes runner to build the images. For this to work, the pipeline needs to be able to access the kube-api. A service-account is created for this purpose.
+
+To use the correct docker builder use the following action
+```yaml
+    ...
+
+    - name: Create Kubeconfig
+      run: |
+        mkdir $HOME/.kube
+        echo "${{ secrets.BUILDX_KUBECONFIG }}" > $HOME/.kube/config
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+        driver: kubernetes
+        driver-opts: |
+          namespace=act-runner
+          qemu.install=true
+
+    ...
+
+    - name: Build and push
+      uses: docker/build-push-action@v5
+      with:
+        context: .
+        <other config>
+```

infrastructure/gitea/actions.deployment.yaml

@@ -1,25 +1,23 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: actions-runner
+  labels:
+    app: act-runner
+  name: act-runner
 spec:
+  replicas: 1
   selector:
     matchLabels:
-      app: actions-runner
+      app: act-runner
   template:
     metadata:
       labels:
-        app: actions-runner
+        app: act-runner
     spec:
-      hostname: kube-runner
-      serviceAccountName: actions-runner
+      restartPolicy: Always
       containers:
-      - name: actions-runner
-        image: actions-runner
-        resources:
-          requests:
-            memory: "128Mi"
-            cpu: "500m"
+      - name: runner
+        image: vegardit/gitea-act-runner:dind-latest
         env:
         - name: GITEA_INSTANCE_URL
           value: "https://git.kluster.moll.re"
@@ -28,12 +26,35 @@ spec:
             secretKeyRef:
               name: actions-runner-secret
               key: runner-token
-        - name: GITEA_RUNNER_LABELS
-          value: k8s
+        - name: ACTIONS_RUNNER_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: GITEA_RUNNER_UID
+          value: '1000'
+        - name: GITEA_RUNNER_GID
+          value: '1000'
+        - name: GITEA_RUNNER_JOB_CONTAINER_PRIVILEGED
+          value: 'true'
+        securityContext:
+          privileged: true
         volumeMounts:
         - name: runner-data
           mountPath: /data
       volumes:
       - name: runner-data
-        emptyDir: {}
-
+        persistentVolumeClaim:
+          claimName: runner-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: runner-data
+spec:
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: "nfs-client"
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany

infrastructure/gitea/actions.rbac.yaml

@@ -1,38 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: actions-runner
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: actions-role
-rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "list", "create", "delete"]
-- apiGroups: [""]
-  resources: ["pods/exec"]
-  verbs: ["get", "create"]
-- apiGroups: [""]
-  resources: ["pods/log"]
-  verbs: ["get", "list", "watch",]
-- apiGroups: ["batch"]
-  resources: ["jobs"]
-  verbs: ["get", "list", "create", "delete"]
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "list", "create", "delete"]
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: actions-role-binding
-subjects:
-- kind: ServiceAccount
-  name: actions-runner
-  apiGroup: ""
-roleRef:
-  kind: Role
-  name: actions-role
-  apiGroup: rbac.authorization.k8s.io

infrastructure/gitea/actions.sealedsecret.yaml

@@ -7,7 +7,7 @@ metadata:
   namespace: gitea
 spec:
   encryptedData:
-    runner-token: AgBHwek/Aj/0oOnI/bnZ4FgtRoeJw4tIKvcDzBhaPdQ7bMVHyHUKYUNP7lkPgZrIN+7rhMY7C/j13iGWx4iTdhTgipLiJvyZ70pXKLSix4IpcypJTElggWkW0JW79x1HyJfBtn9iJiHnEZXPi7sEnyKhA0asAOR0ae8NS6mxxei0TIImaPaC2RHL6MOi40xsXpHz2ZaVhDQaTSRWjv0U6+WkCGcueqM2HLYfF1gqqkzGCjjhdOTK1CKvIvApZ5n8x6x94IiywCXJraDCwLz+acF2c2vA/Jb/3p7TwyyRZ5uIF5LZufhTJ6+5sFJSReHYxO4CpPA8KvM880vtiEjN7LxVo/Jruj2459OvjviKZS03ZwLHHrjanom1+HA9Sx2ffRLiR5ayGkfj/6kvpIRt5x1F7BbPp+a0LXuxJX+1nGDyEa1D1WzVKvZASav6/v7cXcom/nKGO91Zb8qHlOv7ZTs5guGQ9G9VCOHOG8szwpW3ZmQwWfFoWsShzqbDqszBYOGeIjIiDllLzTZ8A9dv9J2ELngZ1IPGIkfpQNEW8hsbNXTYhdVIrkh7BIFkRWfYDNWxqZd4iE6XllQcT1rqndusgiNEJX2r+P4nT8dPewATXQ79wzvZU3kB+VHzM8cLymlVGADi7v/qTY9RcrhuE0oMLzHRShr6JU05VfLGbMsttrYKmW7smvBp3lRJitO5A8+r8cRniS1+Xr8mIx87vCvnoWSH6BKkl9pCdDeCGylAWfkJN9UpkaKg
+    runner-token: AgCexZDTtbYOdG3XgvmOh9CwxzTT+dhPVCPYv/arp8cM9R45PFIfwDvFCThnTHQYZJIYpsaUvoxdXSYYdhLyBVhmuAdD0NeH47q7qRh4U6WYUF6RMqUV3Dpri00nrROx2MN8Q+uGN+wq2xloSbkDzLiS+0sD8m+ItIKhEjIMcn9PyA2OheUmbCVfyOVzCEEaOt98nweTlOXgQLJBLPhxUJFCMePfGHudAlu2lZO3dH+T8G9cC86akZnAODuI69iScuIVOtGJvj1EhPNg9d7QjmjWZOKlk0ryPdwEoR/+kD069Jp4STX7IsVqKxZcvnY8yUICbmvj2TzJWzUDMit3leBopO+8+ECSng4uANGwp3QyankmyWD8SXN3fTuASoeoWa5mYN/qCih9m5ih7FxsDNqAFumUzX1QtAN3LDmzgcomdC7D6FHc1PIaOjoEF96TaDgBc8ODMRBWDtjCzD5sTLQ3zGLRieFsOxkdb0d9E+E4pestmnbdtwNTpfgtyT0pr2847FyAmS0DhA6bb4i+JohNswo+83koJQWf1UNyKhQ14kPhPiBRp1cnYieswFjSuvBbWAjB+SYrFIns97qJon2UjwcnlJ6/KewKj5KTOWnTel1Sgxgn4y7qXFnLvReIEKc6SCz+aFFEa4qAqJVmS1STMEwcqkiM7gA+he/8mdEB0BmfwdnGK0pA1I+RD4hOhDqIQlGyTtWGQINqFulbNUS2PcLmf5nX/ERRRPLlwmZNwR27pP3iQg29
   template:
     metadata:
       creationTimestamp: null

infrastructure/gitea/drone-kube-runner.deployment.yaml

@@ -1,84 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: drone-runner
----
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: drone-runner
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - create
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/log
-  verbs:
-  - get
-  - create
-  - delete
-  - list
-  - watch
-  - update
-
----
-
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: drone-runner
-subjects:
-- kind: ServiceAccount
-  name: drone-runner
-roleRef:
-  kind: Role
-  name: drone-runner
-  apiGroup: rbac.authorization.k8s.io
-
----
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: drone-runner
-  labels:
-    app.kubernetes.io/name: drone-runner
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: drone-runner
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: drone-runner
-    spec:
-      serviceAccountName: drone-runner
-      containers:
-      - name: runner
-        image: drone/drone-runner-kube:latest
-        ports:
-        - containerPort: 3000
-        env:
-        - name: DRONE_RPC_HOST
-          value: drone-server:80
-        - name: DRONE_RPC_PROTO
-          value: http
-        - name: DRONE_RPC_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: drone-server-secret
-              key: rpc_secret
-        - name: DRONE_NAMESPACE_DEFAULT
-          value: gitea
-        # - name: DRONE_NAMESPACE_RULES
-        #   value: "drone-runner:*"
-        - name: DRONE_SERVICE_ACCOUNT_DEFAULT
-          value: drone-runner

infrastructure/gitea/drone-server.deployment.yaml

@@ -1,117 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: drone-server
-  labels:
-    app: drone-server
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: drone-server
-  template:
-    metadata:
-      labels:
-        app: drone-server
-    spec:
-      containers:
-      - name: drone
-        image: drone/drone:latest
-        env:
-          - name: DRONE_SERVER_PORT # because the deployment is called drone-server, override this var again!
-            value: ":80"
-          - name: DRONE_GITEA_SERVER
-            value: https://git.kluster.moll.re
-          - name: DRONE_USER_CREATE
-            value: username:remoll,admin:true
-          - name: DRONE_GITEA_CLIENT_ID
-            valueFrom:
-              secretKeyRef:
-                name: drone-server-secret
-                key: client_id
-          - name: DRONE_GITEA_CLIENT_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: drone-server-secret
-                key: client_secret
-          - name: DRONE_RPC_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: drone-server-secret
-                key: rpc_secret
-          - name: DRONE_SERVER_HOST
-            value: drone.kluster.moll.re
-          - name: DRONE_SERVER_PROTO
-            value: https
-        resources:
-          requests:
-            memory: "1Gi"
-            cpu: 1.5
-        volumeMounts:
-        - mountPath: /data
-          name: drone-data-nfs
-      volumes:
-      - name: drone-data-nfs
-        persistentVolumeClaim:
-          claimName: drone-data-nfs
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: drone-server
-  labels:
-    app: drone-server
-
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    name: http
-  selector:
-    app: drone-server
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: drone-server-ingress
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`drone.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: drone-server
-      port: 80
-  tls:
-    certResolver: default-tls
-
-
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: drone-data-nfs
-spec:
-  capacity:
-    storage: "1Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/drone
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: drone-data-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
-  volumeName: drone-data-nfs

infrastructure/gitea/drone-server.sealedsecret.yaml

@@ -1,23 +0,0 @@
-{
-  "kind": "SealedSecret",
-  "apiVersion": "bitnami.com/v1alpha1",
-  "metadata": {
-    "name": "drone-server-secret",
-    "namespace": "gitea",
-    "creationTimestamp": null
-  },
-  "spec": {
-    "template": {
-      "metadata": {
-        "name": "drone-server-secret",
-        "namespace": "gitea",
-        "creationTimestamp": null
-      }
-    },
-    "encryptedData": {
-      "client_id": "AgA53a7kGJ6zZcx2ooTvTNwxaW2FvfzHJnxg6co54+HXinTJKsc4+GJ1PtdIbsZ7Dgu/sLi/4X90fT+PT2sgEx9jIilmHPdJeRtwV1UID3Y46A7cJlfcAKwNOFzp2PWvBvizbNp7tbJwxeAYnVX8GfN6fi700QxBGqAI3u8qQvLpU6UGW2RM96gCXI7s1QhE1Le6TgoESy5HX95pB7csDRNSwVE02OWfDHKEjH8QD8UvBB9xct6uwDfu7KrsJiNJvWMP6arvpfhy/X+UtCTFmj5wmFYL7oc6vSiCkq+QyHgQTEHTmGpEjEGKcQxPQaus3KhbhcxQBYLMEMYRlLPH0AEAA4dzbSpoVXM3LuIe9FppgrTCknK1uRB8wyrHUeInWO8mG7UraV6m5PUS+UYODMvfjwY3PyiGhTSf6LgMlhMl8e+2rb+OsWphT8Pbeom33PucrYaRFr9RpQkJSwE6HU3JEh25YLfIJ7caqRND8C/p8kD679C8UMcNpBN8WS4Cswn5jzmwbeJNM5DGp9yQVZNx7Bv3dHzx9i3ShjJ6QQnR/zWJZ/dWLy6weGYmdZMMXRAO8CCdruvcX5YyeieXZfchSIlZ/GqqBHptdcLpwLiZsfmyTWeBvk5pMAsZaKJ1tfWpQ84s4epzMoieTfhTueGXmeRKX+DJBBcriU+5YoqNxpU1lPL+LoInorJSKN7c3ouFx78N3GDOCq7mlWI94lY0bIs5zhrfUN137ITCcED62AJ7vks=",
-      "client_secret": "AgDQXU7x6RLhE9Hc+goeR2+3rW316SLLLA8tfqx3tsykL+vxhRkY5UCEaak3Rgei0k14jB/Rmme+/O/D1/5tc/i885+sGn0yjU7Jo4L5nkIssUOHlmRSGkRJDb9ABPauFXAjap9KLix9bd8ewI7R0lS3tOK9ZhThYhcfDUqV9qkkbSHzwNptkH7gYWt9qzG/rqqqpFP+PCtjzKVve4LCBgaxetcnh1t+d5oh7VAFnSI9Bt1G/DRzi+K3YZ+YG5+XKevBp06GMiLUMiv/eUvmOfAB/KO79LnNVbOcRsAHfnqLbXgNjFzspr5xDiGMC/ma1245LavywqXDp0S9jjNEe48i51PPQMwHWV8XEovsM6LHcteluNogt+VkL4mOnmP+sba/V3NO51rt1WXl+ca+U4kBq4dLMsdpWUKemz9BlIRC4etEXjwKJ5DznT7u6GUTrXx2RCm1j0OYWM++P10SdyD6tGjKnZf88a33Wrwm8Y7c47JrPTlP4PqLq9gzvD310uVfs1vGYGULaToGy+D/th8qiWWlu7BIfwqlIj8lruVnOhQ4GeEZmUAsqYf8JfsBwuDc0Y+8qbwjFrr2z+5x+2XBL8KGZVopyme45SHijlBZs7YsJqTBsg5oW09grM8/oO731GtzSYmpat2VZlaILuTjALqo/cu//kxwmqh7UX+jnTJ/2N3bKKSAfHWbHDeHeS2XJ+eKaI4onNYW9J70EfAP3vOpU+zmQ8rOzJuJjRt0HarLwzc5CXb1Xhlgsaoj7zKXPQMnqIDngg==",
-      "rpc_secret": "AgAcJNCFtOhK28vnLredkTgsVpnMPwaXss5NT5ysc0IbVid2vWRk2CTjBZc5DzjxxLwI1Ok88MFXHP08ZGCYy4rIbwoi7Ei1OEevGWfaI4n5CvAxr4ZamQHSfIX9dVAm9BSSx2M/mDtCKqVEGJEzyHCedrxf6LXM/YTNgjD43BuCZZMu35mRsHItpYFZQSttlHiUvR8y2YKrhV2P7fiWRD3cCVao8ldzKfGuvRfal8ByGoxpsYLj2D9CdtPvRF/TQsWUJJWwzbI9DmbW1MMI4/b26Jfa5TBvHxS1MQxFJpSXuMIengO+b0bi7WaR36y/FrKSNxIrQDHI7XCb00yYaSfj3RkSBVoAD0a2p8vNupHCqsKBoaWd8tMv/wGP8wbBk4DgGeQiTIvfhbQZU/Q2/LVDDficjXVn3IuKP/cqgGVf6lUh5YsUSs8qwpMil7XySiHvaZn+iFAnsXoejd4S2e/pbRvyaxP1aa7TCxnINjpU7IrnUEUiI4glQmAte3MqZWLXcc0Uk3Qz9PP0cD+V8qCOryrPMP2kTAI8LT/K4DgcEMAEGes4Vx1l0oBMF0xJvhM2kZXcEcf0NzuQJvYTgZpQF5xp0TchezLshmEUSIkII9NvAvn+iEYJeHsJUDijjmBloSYe4+QTgdYh6FakVUwYI5U4ztDNrvgqhWjExfbn8HxaFzsNTsuzGoYs+jwXH8Wk2z1Q1oQjDdO5YTjmdqvkSTdin/5CiuCDHaQX6a4gNQ=="
-    }
-  }
-}

infrastructure/gitea/gitea.values.yaml

@@ -119,7 +119,7 @@ gitea:
       TYPE: level
     indexer:
       ISSUE_INDEXER_TYPE: bleve
-      REPO_INDEXER_ENABLED: true
+      REPO_INDEXER_ENABLED: false
 
 
 

infrastructure/gitea/kustomization.yaml

@@ -5,26 +5,18 @@ resources:
   - gitea.pvc.yaml
   - gitea.ingress.yaml
   - gitea.servicemonitor.yaml
-  - drone-kube-runner.deployment.yaml
-  - drone-server.deployment.yaml
-  - drone-server.sealedsecret.yaml
   - actions.deployment.yaml
   - actions.sealedsecret.yaml
-  - actions.rbac.yaml
+  # - actions.rbac.yaml
 
 
 namespace: gitea
 
-images:
-  - name: actions-runner
-    newName: ghcr.io/christopherhx/gitea-actions-runner
-    newTag: v0.0.11
-
 
 helmCharts:
   - name: gitea
     namespace: gitea # needs to be set explicitly for svc to be referenced correctly
     releaseName: gitea
-    version: 10.1.4
+    version: 10.2.0
     valuesFile: gitea.values.yaml
     repo: https://dl.gitea.io/charts/

infrastructure/prometheus/kustomization.yaml

@@ -17,4 +17,4 @@ resources:
 images:
   - name: thanos
     newName: quay.io/thanos/thanos
-    newTag: v0.34.1
+    newTag: v0.35.1

infrastructure/prometheus/prometheus.yaml

@@ -4,7 +4,7 @@ metadata:
   name: prometheus
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-knd: ClusterRole
+kind: ClusterRole
 metadata:
   name: prometheus
 rules:
@@ -52,26 +52,17 @@ spec:
     requests:
       memory: 400Mi
   retention: 730d
-  retentionSize: 50Gi
+  retentionSize: 3GiB
   serviceAccountName: prometheus
   enableAdminAPI: false
   serviceMonitorNamespaceSelector: {}
   serviceMonitorSelector: {}
   thanos:
-    version: v0.33.0
+    version: v0.34.1
     objectStorageConfig:
       # loads the config from a secret named thanos-objstore-config in the same namespace
       key: thanos.yaml
       name: thanos-objstore-config
-  volumeClaimTemplate:
-    metadata:
-      name: prometheus-data
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 50Gi
 ---
 apiVersion: v1
 kind: Service

infrastructure/prometheus/thanos-query.deployment.yaml

@@ -53,15 +53,3 @@ spec:
       protocol: TCP
       port: 10901
       targetPort: grpc
-metadata:
-  labels:
-    app: thanos-querier
-  name: thanos-querier
-spec:
-  ports:
-  - port: 9090
-    protocol: TCP
-    targetPort: http
-    name: http
-  selector:
-    app: thanos-querier

infrastructure/prometheus/thanos-store.statefulset.yaml

@@ -1,33 +1,32 @@
 apiVersion: apps/v1
-kind: StatefulSet
+kind: Deployment
 metadata:
-  name: thanos-store-gateway
+  name: thanos-store
   labels:
-    app: thanos-store-gateway
+    app: thanos-store
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: thanos-store-gateway
-  serviceName: thanos-store-gateway
+      app: thanos-store
   template:
     metadata:
       labels:
-        app: thanos-store-gateway
+        app: thanos-store
         thanos-store-api: "true"
     spec:
       containers:
         - name: thanos
           image: thanos
           args:
-          - "store"
-          - "--log.level=debug"
-          - "--data-dir=/data"
-          - "--grpc-address=0.0.0.0:10901"
-          - "--http-address=0.0.0.0:10902"
-          - "--objstore.config-file=/etc/secret/thanos.yaml"
-          - "--index-cache-size=500MB"
-          - "--chunk-pool-size=500MB"
+          - store
+          - --log.level=debug
+          - --data-dir=/data
+          - --grpc-address=0.0.0.0:10901
+          - --http-address=0.0.0.0:10902
+          - --objstore.config-file=/etc/secret/thanos.yaml
+          - --index-cache-size=500MB
+          - --chunk-pool-size=500MB
           ports:
           - name: http
             containerPort: 10902
@@ -61,7 +60,6 @@ metadata:
     app.kubernetes.io/name: thanos-store
   name: thanos-store
 spec:
-  clusterIP: None
   ports:
   - name: grpc
     port: 10901
@@ -70,4 +68,4 @@ spec:
     port: 10902
     targetPort: 10902
   selector:
-    app: thanos-store-gateway
+    app: thanos-store

infrastructure/traefik-system/configmap.yaml

@@ -77,8 +77,12 @@ data:
         address = ":853"
         # route dns over https to other pods but provide own certificate
 
+      [entryPoints.name.http3]
+        advertisedPort = 443
+
     [metrics]
       [metrics.prometheus]
+      # metrics are enabled and scraping is ensured through a servicemonitor
       entryPoint = "metrics"
       addEntryPointsLabels = true
       addServicesLabels = true

infrastructure/traefik-system/kustomization.yaml

@@ -13,6 +13,6 @@ namespace: traefik-system
 helmCharts:
   - name: traefik
     releaseName: traefik
-    version: 27.0.2
+    version: 28.2.0
     valuesFile: values.yaml
     repo: https://traefik.github.io/charts

kluster-deployments/kustomization.yaml

@@ -28,10 +28,10 @@ resources:
   - files/
   - finance/
   - homeassistant/
-  - homepage/application.yaml
   - immich/
   - journal/
   - media/
+  - minecraft/application.yaml
   - monitoring/
   - ntfy/
   - recipes/

kluster-deployments/minecraft/application.yaml

@@ -1,19 +1,18 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: homepage-application
+  name: minecraft-application
   namespace: argocd
-
 spec:
   project: apps
   source:
     repoURL: ssh://git@git.kluster.moll.re:2222/remoll/k3s-infra.git
     targetRevision: main
-    path: apps/homepage
+    path: apps/minecraft
   destination:
     server: https://kubernetes.default.svc
-    namespace: homepage
+    namespace: minecraft
   syncPolicy:
     automated:
       prune: true
-      selfHeal: true
+      selfHeal: false