add matrix deployment

Reviewed-on: #210

apps/adguard/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 images:
   - name: adguard/adguardhome
     newName: adguard/adguardhome
-    newTag: v0.107.52
+    newTag: v0.107.53
 
 namespace: adguard
 

apps/audiobookshelf/kustomization.yaml

@@ -12,4 +12,4 @@ namespace: audiobookshelf
 images:
   - name: audiobookshelf
     newName: ghcr.io/advplyr/audiobookshelf
-    newTag: "2.13.4"
+    newTag: "2.15.0"

apps/dendrite/ingress.yaml

@@ -0,0 +1,18 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dendrite-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`dendrite.kluster.moll.re`)
+    kind: Rule
+    services:
+    - name: dendrite
+      port: 8008
+      # scheme: https
+
+  tls:
+    certResolver: default-tls 

apps/dendrite/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: 
+  - namespace.yaml
+  - postgres.yaml
+  - postgres-user.secret.yaml
+  - ingress.yaml
+
+namespace: dendrite
+
+helmCharts:
+  - name: dendrite
+    releaseName: dendrite
+    version: 0.13.5
+    valuesFile: values.yaml
+    repo: https://matrix-org.github.io/dendrite/

apps/dendrite/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/dendrite/postgres.yaml

@@ -0,0 +1,25 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: dendrite-postgres
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.4
+  bootstrap:
+    initdb:
+      owner: dendrite
+      database: dendrite
+      secret:
+        name: postgres-password
+
+  # Persistent storage configuration
+  storage:
+    size: 2Gi
+    pvcTemplate:
+      accessModes:
+        - ReadWriteOnce
+      resources:
+        requests:
+          storage: 2Gi
+      storageClassName: nfs-client
+      volumeMode: Filesystem

apps/dendrite/values.yaml

@@ -0,0 +1,287 @@
+
+# signing key to use
+signing_key:
+  # -- Create a new signing key, if not exists
+  create: true
+
+persistence:
+  jetstream:
+    # -- PVC Storage Request for the jetstream volume
+    capacity: "1Gi"
+    # -- The storage class to use for volume claims.
+    storageClass: "nfs-client"
+  media:
+    # -- PVC Storage Request for the media volume
+    capacity: "1Gi"
+    # -- The storage class to use for volume claims.
+    storageClass: "nfs-client"
+  search:
+    # -- PVC Storage Request for the search volume
+    capacity: "1Gi"
+    # -- The storage class to use for volume claims.
+    storageClass: "nfs-client"
+
+
+
+dendrite_config:
+  version: 2
+  global:
+    # -- **REQUIRED** Servername for this Dendrite deployment.
+    server_name: "dendrite.kluster.moll.re"
+
+    # -- The server name to delegate server-server communications to, with optional port
+    # e.g. localhost:443
+    well_known_server_name: ""
+
+    # -- The server name to delegate client-server communications to, with optional port
+    # e.g. localhost:443
+    well_known_client_name: ""
+
+    # -- Lists of domains that the server will trust as identity servers to verify third
+    # party identifiers such as phone numbers and email addresses.
+    trusted_third_party_id_servers:
+      - matrix.org
+      - vector.im
+
+    # -- The paths and expiry timestamps (as a UNIX timestamp in millisecond precision)
+    # to old signing keys that were formerly in use on this domain name. These
+    # keys will not be used for federation request or event signing, but will be
+    # provided to any other homeserver that asks when trying to verify old events.
+    old_private_keys:
+    #  If the old private key file is available:
+    #  - private_key: old_matrix_key.pem
+    #    expired_at: 1601024554498
+    #  If only the public key (in base64 format) and key ID are known:
+    #  - public_key: mn59Kxfdq9VziYHSBzI7+EDPDcBS2Xl7jeUdiiQcOnM=
+    #    key_id: ed25519:mykeyid
+    #    expired_at: 1601024554498
+
+    # -- Disable federation. Dendrite will not be able to make any outbound HTTP requests
+    # to other servers and the federation API will not be exposed.
+    disable_federation: false
+
+    key_validity_period: 168h0m0s
+
+    database:
+      # -- The connection string for connections to Postgres.
+      # This will be set automatically if using the Postgres dependency
+      connection_string: "postgresql://dendrite:supersecretpassword!@dendrite-postgres-rw/dendrite"
+      # -- Default database maximum open connections
+      max_open_conns: 90
+      # -- Default database maximum idle connections
+      max_idle_conns: 5
+      # -- Default database maximum lifetime
+      conn_max_lifetime: -1
+
+    jetstream:
+      # -- Persistent directory to store JetStream streams in.
+      storage_path: "/data/jetstream"
+      # -- NATS JetStream server addresses if not using internal NATS.
+      addresses: []
+      # -- The prefix for JetStream streams
+      topic_prefix: "Dendrite"
+      # -- Keep all data in memory. (**NOTE**: This is overriden in Helm to `false`)
+      in_memory: false
+      # -- Disables TLS validation. This should **NOT** be used in production.
+      disable_tls_validation: true
+
+    cache:
+      # -- The estimated maximum size for the global cache in bytes, or in terabytes,
+      # gigabytes, megabytes or kilobytes when the appropriate 'tb', 'gb', 'mb' or
+      # 'kb' suffix is specified. Note that this is not a hard limit, nor is it a
+      # memory limit for the entire process. A cache that is too small may ultimately
+      # provide little or no benefit.
+      max_size_estimated: 1gb
+      # -- The maximum amount of time that a cache entry can live for in memory before
+      # it will be evicted and/or refreshed from the database. Lower values result in
+      # easier admission of new cache entries but may also increase database load in
+      # comparison to higher values, so adjust conservatively. Higher values may make
+      # it harder for new items to make it into the cache, e.g. if new rooms suddenly
+      # become popular.
+      max_age: 1h
+
+    report_stats:
+      # -- Configures phone-home statistics reporting. These statistics contain the server
+      # name, number of active users and some information on your deployment config.
+      # We use this information to understand how Dendrite is being used in the wild.
+      enabled: false
+
+    presence:
+      # -- Controls whether we receive presence events from other servers
+      enable_inbound: false
+      # -- Controls whether we send presence events for our local users to other servers.
+      # (_May increase CPU/memory usage_)
+      enable_outbound: false
+
+    server_notices:
+      # -- Server notices allows server admins to send messages to all users on the server.
+      enabled: false
+      # -- The local part for the user sending server notices.
+      local_part: "_server"
+      # -- The display name for the user sending server notices.
+      display_name: "Server Alerts"
+      # -- The avatar URL (as a mxc:// URL) name for the user sending server notices.
+      avatar_url: ""
+      # The room name to be used when sending server notices. This room name will
+      # appear in user clients.
+      room_name: "Server Alerts"
+
+    # prometheus metrics
+    metrics:
+      # -- Whether or not Prometheus metrics are enabled.
+      enabled: false
+      # HTTP basic authentication to protect access to monitoring.
+      basic_auth:
+        # -- HTTP basic authentication username
+        user: "metrics"
+        # -- HTTP basic authentication password
+        password: metrics
+
+  app_service_api:
+    # -- Disable the validation of TLS certificates of appservices. This is
+    # not recommended in production since it may allow appservice traffic
+    # to be sent to an insecure endpoint.
+    disable_tls_validation: false
+    # -- Appservice config files to load on startup. (**NOTE**: This is overriden by Helm, if a folder `./appservices/` exists)
+    config_files: []
+
+  client_api:
+    # -- Prevents new users from being able to register on this homeserver, except when
+    # using the registration shared secret below.
+    registration_disabled: true
+
+    # Prevents new guest accounts from being created. Guest registration is also
+    # disabled implicitly by setting 'registration_disabled' above.
+    guests_disabled: true
+
+    # -- If set, allows registration by anyone who knows the shared secret, regardless of
+    # whether registration is otherwise disabled.
+    registration_shared_secret: "supersecretpassword"
+
+
+    # TURN server information that this homeserver should send to clients.
+    turn:
+      # -- Duration for how long users should be considered valid ([see time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more)
+      turn_user_lifetime: "24h"
+      turn_uris: []
+      turn_shared_secret: ""
+      # -- The TURN username
+      turn_username: ""
+      # -- The TURN password
+      turn_password: ""
+
+    rate_limiting:
+      # -- Enable rate limiting
+      enabled: true
+      # -- After how many requests a rate limit should be activated
+      threshold: 20
+      # -- Cooloff time in milliseconds
+      cooloff_ms: 500
+      # -- Users which should be exempt from rate limiting
+      exempt_user_ids:
+
+  federation_api:
+    # -- Federation failure threshold. How many consecutive failures that we should
+    # tolerate when sending federation requests to a specific server. The backoff
+    # is 2**x seconds, so 1 = 2 seconds, 2 = 4 seconds, 3 = 8 seconds, etc.
+    # The default value is 16 if not specified, which is circa 18 hours.
+    send_max_retries: 16
+    # -- Disable TLS validation. This should **NOT** be used in production.
+    disable_tls_validation: false
+    prefer_direct_fetch: false
+    # -- Prevents Dendrite from keeping HTTP connections
+    # open for reuse for future requests. Connections will be closed quicker
+    # but we may spend more time on TLS handshakes instead.
+    disable_http_keepalives: false
+    # -- Perspective keyservers, to use as a backup when direct key fetch
+    # requests don't succeed.
+    # @default -- See value.yaml
+    key_perspectives:
+      - server_name: matrix.org
+        keys:
+          - key_id: ed25519:auto
+            public_key: Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw
+          - key_id: ed25519:a_RXGa
+            public_key: l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ
+
+  media_api:
+    # -- The path to store media files (e.g. avatars) in
+    base_path: "/data/media_store"
+    # -- The max file size for uploaded media files
+    max_file_size_bytes: 10485760
+    # Whether to dynamically generate thumbnails if needed.
+    dynamic_thumbnails: false
+    # -- The maximum number of simultaneous thumbnail generators to run.
+    max_thumbnail_generators: 10
+    # -- A list of thumbnail sizes to be generated for media content.
+    # @default -- See value.yaml
+    thumbnail_sizes:
+      - width: 32
+        height: 32
+        method: crop
+      - width: 96
+        height: 96
+        method: crop
+      - width: 640
+        height: 480
+        method: scale
+
+  sync_api:
+    # -- This option controls which HTTP header to inspect to find the real remote IP
+    # address of the client. This is likely required if Dendrite is running behind
+    # a reverse proxy server.
+    real_ip_header: X-Real-IP
+    # -- Configuration for the full-text search engine.
+    search:
+      # -- Whether fulltext search is enabled.
+      enabled: true
+      # -- The path to store the search index in.
+      index_path: "/data/search"
+      # -- The language most likely to be used on the server - used when indexing, to
+      # ensure the returned results match expectations. A full list of possible languages
+      # can be found [here](https://github.com/matrix-org/dendrite/blob/76db8e90defdfb9e61f6caea8a312c5d60bcc005/internal/fulltext/bleve.go#L25-L46)
+      language: "en"
+
+  user_api:
+    # -- bcrypt cost to use when hashing passwords.
+    # (ranges from 4-31; 4 being least secure, 31 being most secure; _NOTE: Using a too high value can cause clients to timeout and uses more CPU._)
+    bcrypt_cost: 10
+    # -- OpenID Token lifetime in milliseconds.
+    openid_token_lifetime_ms: 3600000
+    # - Disable TLS validation when hitting push gateways. This should **NOT** be used in production.
+    push_gateway_disable_tls_validation: false
+    # -- Rooms to join users to after registration
+    auto_join_rooms: []
+
+  # -- Default logging configuration
+  logging:
+  - type: std
+    level: info
+
+postgresql:
+  # -- Enable and configure postgres as the database for dendrite.
+  # @default -- See value.yaml
+  enabled: false
+
+ingress:
+  # -- Create an ingress for the deployment
+  enabled: false
+
+service:
+  type: ClusterIP
+  port: 8008
+
+prometheus:
+  servicemonitor:
+    # -- Enable ServiceMonitor for Prometheus-Operator for scrape metric-endpoint
+    enabled: false
+    # -- Extra Labels on ServiceMonitor for selector of Prometheus Instance
+    labels: {}
+  rules:
+    # -- Enable PrometheusRules for Prometheus-Operator for setup alerting
+    enabled: false
+    # -- Extra Labels on PrometheusRules for selector of Prometheus Instance
+    labels: {}
+    # -- additional alertrules (no default alertrules are provided)
+    additionalRules: []
+

apps/files/kustomization.yaml

@@ -13,4 +13,4 @@ namespace: files
 images:
   - name: ocis
     newName: owncloud/ocis
-    newTag: "5.0.7"
+    newTag: "5.0.8"

apps/finance/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: actualbudget
     newName: actualbudget/actual-server
-    newTag: 24.9.0
+    newTag: 24.10.1

apps/homeassistant/kustomization.yaml

@@ -15,4 +15,4 @@ resources:
 images:
   - name: homeassistant/home-assistant
     newName: homeassistant/home-assistant
-    newTag: "2024.9"
+    newTag: "2024.10"

apps/immich/kustomization.yaml

@@ -14,16 +14,16 @@ namespace: immich
 helmCharts:
   - name: immich
     releaseName: immich
-    version: 0.7.2
+    version: 0.8.1
     valuesFile: values.yaml
     repo: https://immich-app.github.io/immich-charts
 
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.116.2
+    newTag: v1.117.0
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.116.2
+    newTag: v1.117.0
 
 
 patches:

apps/monitoring/grafana-auth.sealedsecret.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: grafana-auth
+  namespace: monitoring
+spec:
+  encryptedData:
+    client_secret: AgCcKsnS3u2eI+fNVC9hAZ3QRFOHFErAzs5aQgX51CSdJwM03SZUoTyrDi5JPcHUVyS3MbevFH5piMhDTARMI3bLOjYlcwMbpf77JCPa7o95Y9asA/FW3lXicYt3biN9xBXJBz7Ws3fVRtEzyf6DmbGedT9gaX8aPwrUVbP19RdyJiuu76oB1A/jdUkX4K+X6kVvmoP/BWdypk/kdQJrzBNt00DIXF4NHfYey36AuhpBtqYZs4faA/tBXMXLE4RxPNtcHwNfVjnRj3v3qzNufD1fnweJvLq2UfLMrQjoR9XDVnM0zkpautylkI7yrvcoEH7ljnf6b1FMogOEZUfH1BIdqTd/WwrrlCqE58OPfJWthIfN+pQ8LvdHsGo3jc9gXvfXS2cStyhP06eTZ4D79kG+RtDQGOsD/Wpx7EcM6hbB3+dIjcs3wEAIGjpIVtY9JayW8YeRnFApMuhDST1+hscm+LdoGvaSTlAuGzv9BbVrPX/Fo9XKeYHlbG/x71Er+vF8WbW0wUa46MHLvbEy376XIdJDYi+vjl4eqznZ6YhvPbawhoKXT8ZcKUcUAjVcMue/O/jCSPZplbn3vdSCeqPTiqVqDw9PTMIeWFUepgPMxiGpFRAqdwIecFBnYItq0dXoGlFrZpo0S6AECgZjxzUR5EgdkdPlDDs2CN+d9yP7f2S+gmL7AIlQr74NW1GrTGw2x/rD4IJhunh7
+  template:
+    metadata:
+      creationTimestamp: null
+      name: grafana-auth
+      namespace: monitoring
+    type: Opaque

apps/monitoring/grafana.values.yaml

@@ -16,6 +16,12 @@ serviceMonitor:
   ##
   enabled: false
 
+envValueFrom:
+  AUTH_GRAFANA_CLIENT_SECRET:
+    secretKeyRef:
+      name: grafana-auth
+      key: client_secret
+
 ingress:
   enabled: false
 
@@ -67,3 +73,21 @@ grafana.ini:
   default_theme: dark
   unified_alerting:
     enabled: false
+  analytics:
+    check_for_updates: false
+  server:
+    domain: grafana.kluster.moll.re
+    root_url: https://grafana.kluster.moll.re
+  auth.generic_oauth:
+    name: Authelia
+    enabled: true
+    allow_sign_up: true
+    client_id: grafana
+    client_secret: ${AUTH_GRAFANA_CLIENT_SECRET}
+    scopes: openid profile email groups
+    auth_url: https://auth.kluster.moll.re/api/oidc/authorization
+    token_url: https://auth.kluster.moll.re/api/oidc/token
+    api_url: https://auth.kluster.moll.re/api/oidc/authorization/userinfo
+    tls_skip_verify_insecure: true
+    auto_login: true
+    use_pkce: true

apps/monitoring/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - namespace.yaml
   - grafana.ingress.yaml
   - grafana-admin.sealedsecret.yaml
+  - grafana-auth.sealedsecret.yaml
   # grafana dashboards are provisioned from a git repository
   # in the initial bootstrap of the app of apps, the git repo won't be available, so this sync will initially fail
   - https://git.kluster.moll.re/remoll/grafana-dashboards//?timeout=10&ref=main
@@ -16,5 +17,5 @@ helmCharts:
   - releaseName: grafana
     name: grafana
     repo: https://grafana.github.io/helm-charts
-    version: 8.5.1
+    version: 8.5.4
     valuesFile: grafana.values.yaml

apps/ollama/backend.deployment.yaml

@@ -1,55 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ollama-rocm
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: ollama-rocm
-  template:
-    metadata:
-      labels:
-        app: ollama-rocm
-    spec:
-      nodeSelector:
-        gpu: full
-      containers:
-      - name: ollama
-        image: ollama
-        env:
-        - name: HSA_OVERRIDE_GFX_VERSION
-          # allows to run on IGPU as well
-          value: "11.0.0"
-        ports:
-        - containerPort: 11434
-          name: ollama
-        volumeMounts:
-        - name: ollama-data
-          mountPath: /root/.ollama
-        - name: dshm
-          mountPath: /dev/shm
-        - name: dri
-          mountPath: /dev/dri/
-        - name: kfd
-          mountPath: /dev/kfd
-        resources:
-          requests:
-            memory: "1Gi"
-            cpu: "1"
-          limits:
-            memory: "16Gi"
-            cpu: "8"
-
-
-      volumes:
-      - name: ollama-data
-        emptyDir: {}
-      - name: dri
-        hostPath:
-          path: /dev/dri/
-      - name: dshm
-        emptyDir:
-          medium: Memory
-      - name: kfd
-        hostPath: /dev/kfd

apps/ollama/backend.service.yaml

@@ -1,13 +0,0 @@
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: ollama-service
-spec:
-  selector:
-    app: ollama-rocm
-  ports:
-  - protocol: TCP
-    port: 11434
-    targetPort: 11434
-    name: ollama

apps/ollama/frontend.deployment.yaml

@@ -1,30 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ollama-ui
-  labels:
-    app: ollama-ui
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: ollama-ui
-  template:
-    metadata:
-      labels:
-        app: ollama-ui
-    spec:
-      containers:
-        - name: ollama-ui
-          image: ollama-ui
-          ports:
-            - containerPort: 8080
-          env:
-            - name: OLLAMA_BASE_URL
-              value: http://ollama-service:11434
-          volumeMounts:
-            - name: ollama-ui-data
-              mountPath: /app/backend/data
-      volumes:
-        - name: ollama-ui-data
-          emptyDir: {}

apps/ollama/frontend.service.yaml

@@ -1,13 +0,0 @@
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: ollama-ui-service
-spec:
-  selector:
-    app: ollama-ui
-  ports:
-  - protocol: TCP
-    port: 8080
-    targetPort: 8080
-    name: ollama-ui

apps/ollama/ingress.yaml

@@ -1,21 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: ollama-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`llm.kluster.moll.re`)
-      kind: Rule
-      services:
-        - name: ollama-ui-service
-          port: 8080
-    # - match: Host(`todos.kluster.moll.re`) && PathPrefix(`/`)
-    #   kind: Rule
-    #   services:
-    #     - name: todos-frontend
-    #       port: 80
-  tls:
-    certResolver: default-tls

apps/ollama/kustomization.yaml

@@ -1,23 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: ollama
-
-resources:
-  - namespace.yaml
-  - backend.deployment.yaml
-  - backend.service.yaml
-  - frontend.deployment.yaml
-  - frontend.service.yaml
-  - ingress.yaml
-
-
-images:
-  - name: ollama
-    newName: ollama/ollama
-    newTag: 0.3.6-rocm
-  - name: ollama-ui
-    newName: ghcr.io/open-webui/open-webui
-    newTag: main
-
-

apps/ollama/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder
-  labels:
-    pod-security.kubernetes.io/enforce: privileged 

apps/paperless/deployment.yaml

@@ -26,6 +26,8 @@ spec:
             value: deu+eng+fra
           - name: PAPERLESS_URL
             value: https://paperless.kluster.moll.re
+          - name: PAPERLESS_OCR_USER_ARGS
+            value: '{"invalidate_digital_signatures": true}'
           - name: PAPERLESS_SECRET_KEY
             valueFrom:
               secretKeyRef:
@@ -35,6 +37,15 @@ spec:
             value: /data
           - name: PAPERLESS_MEDIA_ROOT
             value: /data
+          - name: PAPERLESS_APPS
+            value: allauth.socialaccount.providers.openid_connect
+          - name: PAPERLESS_SOCIALACCOUNT_PROVIDERS
+            valueFrom:
+              secretKeyRef:
+                name: paperless-oauth
+                key: provider-config
+          # - name: PAPERLESS_DISABLE_REGULAR_LOGIN
+          #   value: "True"
           volumeMounts:
             - name: data
               mountPath: /data

apps/paperless/ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: paperless-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`paperless.kluster.moll.re`)
+    kind: Rule
+    services:
+    - name: paperless-web
+      port: 8000
+
+  tls:
+    certResolver: default-tls 

apps/paperless/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - service.yaml
   - ingress.yaml
   - paperless-secret-key.sealedsecret.yaml
+  - paperless-oauth.sealedsecret.yaml
 
 namespace: paperless
 

apps/paperless/paperless-oauth.sealedsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: paperless-oauth
+  namespace: paperless
+spec:
+  encryptedData:
+    provider-config: AgBI9IcNOfBevjUtIMwNTd0MTnr1WGxMKJ0cPnHzAS3cddmI+LTrkxxdRBuz2PFKTrhJ6/vh/2tiI9FBWMVm/YqTB64drbF3v13GfZMk/9c7W4SFyMoMcoE4xe6gs4SOm1ggTVxWT6O8IQ0gt7+FRUFaiLmwa08dxTkzrT0/zfQfYg+0aV8qS0eCJIrQk/IA1N31RpUoNV5Jl6vF7oE+cKIVyZ6LVMdecmFnuUgU+1qTC7ncgxxhWQekDQXJQnfYpgsQTF5GaHkGV8kvqJOa2Ohnk7MIeQEz5WuiKaXzU1ZMCYq3D8q/kaf/itLLBlL5MQh/hkuksCVG13aWxvulA/zIw3rSDujjZcSrD8LWH6oCMCn8zVcZjYQQBcTKUYEyYNvHLsmm0fOFIkUmFfBOS4WdHhjsBudz+941Wuc2EX5i6eLind7dk6gOlCL1HEyvbQRV6W50T104DQSNHslRG9CIjPh0BueGJ5fiaFoQa/UuM/JI8R/7cv3y5VkCG6j4gax9FVFgZKxPMtOTxB3gKolT25JHPDOqbDo996T4lsmiYRrYShni4JFZ8ALhcr7pKwlg+gVbDVaqMrVaSz1xzTP0MNxPMsojXVLtG3/Zv0/iXSVW4DPY67pFITEbZBWB3bHLvL9MiwKbWNwsDwPUylWkXTTFHsNbuRUnAXhRxcLn43uIv98JFTQcMVl2J9qrYkHm7w0FVImUr3oC+Ny/Z6j89ARposNx27B4FBgW7H7+yWMKRsAObC8cAjBOkBdXue0x5bEl7Al2BRRG7/WUKHXZvTOlvlj7GFTpLOQbPYjnBo8V8h42uOjGbiMLaCeN5sWlMtWD+7mpHV3XGdcGtPAZlIzgpUs2si/XIRNun2oDoUmJhb7YcGmugodcAK9+aYBThIkNU3guXdrM6Vc7CO2RP8PFpKBpcI9pUHgYA8dyYY+TaBqfYGrKFlGgoVcgh6oVkeOuctTX90XkojVFfqkCqab93faMh2pGCGcH4IZ81sdTYeWwNIvz1RGoi9GhUhQU5NfDeUBn2eHdOpfdsf4FkWe0kgE6TBPlQx7GQy56FldIc0G4QA8H8utL3E/MXYrao70ek/GHIxuev1/hzljJDk+5HJz5itBtKiW4s/5j2ZMD7MMBu/voDQW14XEK5pM9EbwmC6kRg6ljXvTlnUVmw1s04iUvIzF/dO6bCgaOEwFPjZj8oZs0dt64Ov+ZPLwTrmezFgHtfh4dyiRgHt4cO/WYFmzzYwd532p2De3JqjHUzT0iQIpkaz4jrF7+fdtDxtj7XgkJIg==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: paperless-oauth
+      namespace: paperless

apps/recipes/deployment.yaml

@@ -21,12 +21,15 @@ spec:
         ports:
         - containerPort: 9000
         env:
-          - name: ALLOW_SIGNUP
-            value: "true"
           - name: TZ
             value: Europe/Paris
           - name: BASE_URL
             value: https://recipes.kluster.moll.re
+          - name: ALLOW_SIGNUP
+            value: "true"
+        envFrom:
+          - secretRef:
+              name: mealie-oauth
         volumeMounts:
         - name: mealie-data
           mountPath: /app/data

apps/recipes/kustomization.yaml

@@ -6,6 +6,7 @@ namespace: recipes
 resources:
   - namespace.yaml
   - deployment.yaml
+  - mealie-oauth.sealedsecret.yaml
   - pvc.yaml
   - service.yaml
   - ingress.yaml

apps/recipes/mealie-oauth.sealedsecret.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: mealie-oauth
+  namespace: recipes
+spec:
+  encryptedData:
+    OIDC_ADMIN_GROUP: AgCTE4M54XEyKP1cHcsosZwIp5GYcvZPIzb7sgOpvVJb7mzKT9kYFOqUkwc1eyn4bjqaXu6SJyP3M4ss3K7CgkNWMsSjBVrYpP6yqsREoWqoETwwecSxRS7hrK8pJb6kRKBKyLDd2oaFMxeg0y1lm9+ul4HwNL+uPcNLSX7KRue1Hy5xqjDNlwL2mzU9JVVZGqEW8FyvPCRKMPliQtK7WpTUbadKbltN9RKrRa4PqFW9xyBrg8Al35Xj7HrNfwt8YAUDeq+73QMLtbP3y2orSck2I46h9DKW4foqYWGnVh/272fvQSXDr3tr8Il969o5M/IfVzpRS74f4zU0LeI4POxT9EgBL2sALoKhxil0EZGJ3dsPREvSS7eccCMY8n0AQE8rOT8AHyRDhd8RzsCoyPoDTAJJWf4oGS4aSH/N7f6CvsMF2EdOSCghBWC7klfRFxraWcbTiFRi5ICxlFL4GkiB9svNWpQlCkiduR9RZTop1DU+xJK2XgBmTampbjlEiS+yf9L7tXpCRvp+vRcxHwlvsMUncIxUzY3CPTST6FrVOL0BMtLeKI+MmgaCxgzo6BBAUKBZSCJbJKLTrcnhviLJnxYXKYPah5ozfk5XBzcz4C7dWuhN6N1Uwa08nDtHbuN9Mj0AWElT3HAqf3naowVBeXgLV6vRNTwYOIVoqGhyVG0O65DpwuxUdFZMUBpmhFz1QTpAZ6cbDZbL
+    OIDC_AUTH_ENABLED: AgAQ48wodtQ11peCbSpBL61n28GMeMJPq6cmb0a39x/n+AJGOZbjcE2e/xdFu06J+ahHTehi2QtwWxlRBi4Op6sbjdn5cXkTZ+8vGB3v/JQZQzJpGraFT1WTPZ9onYXTLl8iGsZSteF3iaxSOMzLswMahDvk/DCNrIY78mkTpqSC3Pggf9GnAWTQKOnuTFYyStBaL9ExyDBiJkbFahm/bC8h7QG9OXD93bDQrApS/W6LF+3CU6TOKj1VXmeVuMpxGdasC4B5ShL9kvBz66i5P7BJYjPfTEJfIACIFzZQmLJwxzfST1kV0urdQ9PZmcvQLapxGI4xUssD275hSPrUE6XXMLyo0BzVEBPq5QsMW5UZB1sOPQMcIajdzWagByFJWcBU1mFMwJXVUHQXlsMDEl1pDTGbSS660XCS1aAtmVb19ToXH/GIEkWlohiNpVqI+D8ypoAwMzF1FnHGvyxF6maHV4vZA4zDE7bT4S+E6dEmXM2cc0essUDlbwgOTLi/3fuqxIar3Dub857H0B9++SeriHrSUJD1A/9IOZQQNsAOwEOylK+9BuyhHYFVzk9l2lKnCRYqif75wusyoly+4yBS69LGzg4mc4Bk6LejZe91VnZLlZB3M6fZzS87qWoSKuEibxJ469KVrCPNc5mn33gfg5nW/05rSYcBnl1VazPmA18sZyX1nWnQUwwErg98jGn7Ft0q
+    OIDC_AUTO_REDIRECT: AgBuLoXhaCs86FfeiagJQg2bnz99Poebydj212AdXpt66Lx1nciFlJMzZ03ahJiF5T8lalxPLSzkHnc5VHBT8yRSrKe1lCisDmXVv9SBBoZHntu9zQdJeChkkHImxILlJVZk4steD2CyIBDj2xjbjUfRjFYJX4F1WrzSDXG4Vf5bal8tPXNuqbHEGfx7xw9CRetMD4cfDESyKl7FgbXi4vyLgGyNTnKTAvY1w72Y7WKminiScj7S39TZZIVH7wJyvvsNEv7MCgwaPeT+W5pNwpx34oqfumTHTeJUwQWccwCnZknhOl9jwNRJ4cHFAsVArT1yvjLCbMir9p1DvP2w0R/A8CzPgDQxbJno1QKeGnw02YVlsYH5KiOKkQQdT6/kT+kk444Mg0JLPbG7XZSUZXGmVl5n31DuDFvTGum5BQOwFzYfOim1MM1OJyFiM7XuaCZCzSMNUQHtLGv3kBHZFhIS5PXqMjfdV/RAv3QhZgAnJzGYLEDawOwy4KwIXTk9b55OX7AyEwQzwMlJUujg/+IJP28BH71tgVtgQsVDnWVT2GtWW+UMamXhqh+YK6VD2BZ/81D/p0BEGq8m/dweP/qv3MK/CGBjgtIFOHnEcNZkqMH4HhrxFeu6fabUpT6+C5cGNyYJSEFpbUqjJRb7vBPIu/ewb8Y43SNikzaSp3/1A2LtkGDyzcRckQYTuFIiIg5r3jcg
+    OIDC_CLIENT_ID: AgBQiUtbuXKJABinO8VfjQ+yIj0a4AEvKboHd544CxYdx1OfZd0DZLsKpkowZS+Wl5QiheC/+8HFqsRzzwKas2i4IyOpihhSW/xd6X7XjDtu2Tjwuol1oRel5AmBpBj6Kl6zTvgLbHE+iUaJi7u5f2Pw0w2vXAJWxg9nhOFVEfTVtKaafYqVVXPB1KTqRPzwR5zsTuIZToEx0BvA95yWM5oKRPnjlSLk1vHMBDPqdgUq+7u+7qhj7C+rvhI7nuTOWRk0NzsELBl3AyAg82w0r+I9H7buU8OHPEhVOID//UIc/wL/QuaJNxeFiU+rM6K0CD6MMGQanuUngaEr/ZpEdxe82hGSuaLik2mWfvG4J4328a1bmmTT/JgPPDQW8Xtg68Tsqj9zT4rfaVt/+TttMMgj4oAFkyVLGZkp1sfgIX5zT7gHc0fCusTR5gGNLJ5PmHyqCu9D2jP1ERLRltiyXH6wms8+aACj+wsmo1OKUjmqrtqtAWNwZz2bmOJhhUgkP1mPz4o2LeECjBPPv9uPWkMb67ZUI4+Qp8o7J0SgQt4ZlRqhg04Rh5MxCY9TvbhLxQD5QqTktmGYWo6cDVnIEIKd/XOSG9pBT6bTGsRLicgRxjDwm/0ZU1Y3stI6UhONKYA1HG8rso8ZfRLvDsgp1Zb8tH/GAw+bl2HkOw1DbyFXWeRxau3RPwTym3GYjFgWZhP5ScOu2Rjg
+    OIDC_CONFIGURATION_URL: AgBiXJGc7WugRqlUE58fVPkkKkka3G39lhajhuR7EQePZ1HdE1D02/XncXgRO0r7C4kPAX3oZ1Uczo0XAMxQxAZye9NNFNei7E4rlc3BTNOOxCc2Uj57DjuqFA74cHcjs0xRCJ1KVMEcGX8zdG85v/qEI9Oru7vQf8YT3giTKNHDZMgeyrbCMFNS0cyXniseMMVIkiX0ky6TfcFdn84bZiqJYwXwnNNzeM/kJe01NvEe3DuvxZTEme8LNkie7CTgaMHfEYeXZWIh+JqkIPW+48uDYe4ojf/Ts9P2jwzf6qW8XyqwlLti0MxoVH6IqbLbJ9JVJZ94WNMm2tcjigD1eSV2klNxXYZefyqqratQpfi7Ou/KXdfs9Reijj7dtfZDOnztVouS7ivBLlufqdxgyJrnQok1MxQloZs602CBPRDE+oSHGh5ean2wbJLqt/Vl9NxcsFZpWI4tazZ0DUhD5pgS4MXoG8D+RXIz4++nfn+XhYhv84vP4VJh6kCF84dKSYDFUKkAMGJSZRDCcs4jaORO/DZLUUnytnOHV8Mo2ypfC9KgETdnbXWT7OcdCQPesABE/l2lN9KDYHxL6DqE3GibmCqE7yk6TOF36pmVeEsECeBkmcl2DpHVu9PRBiwO0YVTGUr9AVmwO3vAR+2LAVHkDmU+jn/e5SFHg2dkEpWDORC7Zn4vZrjy3pmTJdxBthVwTYqmdnWk4uvppyKP2l6MBtaVPqtB35sDuYtLGSFV1FLBJGJueW+Kk2cGbNxJJEEhBUf6ZHCDWLrZEJPN
+    OIDC_GROUPS_CLAIM: AgBjsoq/VaSx/P7PnODa2TIiSy/noUFrVmPuIPAyjoZP/w62zmwTqy8Ln4yRKywmsy+n9CMGgauUzkEU8HSuWJ0Moxzt+NBRpuA3nL5R8b0hMsdQXCvY3L5zqyvPH7hfY1LRVcM5cVyzTR2CTVUNbO04EeGaFt8Mh8tsmyHk+Cf8VidbkeqgEpee8tNO638F4xQGx9aob7H7UVKOou8CdpOvH3zsNFzGmSbwv9qm1sgcTxkZkjt8cGH/c4k30p8szcMFQmUK7dzrZAma5bDPg5BuwspCnRXoGVWLYN02jHYDg/08qLpL/vL+pPpChf0DMB4j2M+s5EDHnbcfT7S7pf2NkHCnWINCJSKLMUIcBSFXXEkbmSrHo1Ft6aHf/i6JHld4CT0dQs5AyK68mCzkZTWoHU6MM8+/3/J3J/TWkSP8HOyBY3gWPOU4hYEQQQlJp3T+mnnua70mo/vMr4CuZFyxLjz872CDwG5WfZkzJxM69s0XRkHEmsXi7VYjn7NThrqhh2lqbiIIJNpAemjruRl49T3gtfstVdxfgp3dfz/H/4FWRy5KY5XDUjGwYBXDCpaEey42CFSiT1w9yXV67emahUwKekvq1vvuz2bWzaTYGtCW77WzCO1cC26hORPAYbZZxgSeDgWmxMIhJF6tVFNSAu11rMjcMUKErujC5cKWb8N4DuF0H4cQv36SESKBdVCOMPzPxDg=
+    OIDC_PROVIDER_NAME: AgBHYuK2JYedcaHwDca/c1RKzq8YgO9cJ0lXPY2+ain+lwFJwZ7oMOPevVOq3RoUHznEYbRxKw0CLE+110NFr16bav4bn4pXRD5CeqQDAWPIxxouu+w2NgWijnqfKnVYrtrprQlfGO9mYsZiEGj/sbftX2Wd73L7oXp/6Ab+28rnxtv3KF46wXo8yfqzOGf+QRQKdT+2pv58zjN3UCGrSANirLHvmY8+a73YiVW8/xuJZN4og3JbPW65FwBpgnvQCaHKFTbPyPIpILx7sKz2yxGzT6Jt2PeSjdwou/fT70tmrwOVucbHJkKUsd/jkI0gzRPLr9Fo5LcALAKQsn70hNQIRgTFgCy4ILurJMBKeYtHkNMdnBwKRh4NlTgJB2vNXq604480ta20Z3E2m3DUxW6XPFTQN9uC5/7IT0e/F4UgQai6HENwAqIPGuOM4eKeouw8pr+RoLMI76Z0B6xWhLRqxrZknzwzOngpaku8w9SeJPkifSFwxxFjacAqFrMwLGT1kg/KIJcBa3BUK8gVRLzqJd9hq1hQtavmm6T3W9PW8yCG3IP4b/Kxsm0+B1pXSaFC2a3elFu5lgw7JeJO22NwPmCUw3cX/zfYcn4u1MSsn2Wlr5tLNwjfpeGXb0w9eGStEZNKpj/OLo5W6sxdO1PIdCRd/IdxFuDd3q3G9cJTP7aMjeWSQhr7bzgzx1K78zZ9h4Qiw4YXrw==
+    OIDC_REMEMBER_ME: AgARqfhGDWYi0iqE//vNsJfgZBYJklJ7KUUHm3GkD27gNk0JtOobt/RlE3UV4cBGkstjGQkEGldkwshtQk/hAuuu8Qb9PpeDxQOUABAFX7NDcr2hWnDosFSShq724ycY6B63vjzahMBYEGo9tAB07VPy6RtvZDH5EGYcubfSe2GgX/P9VcKq64eO2NkOHJWc1A9cPqQGYqFi3YZkN1yaix7kRW7sL627Slv3nU/yLpFpEwUi9ayzDBCDxfiBZoRZh+Gy4VpD2S0XmTNYgr+uRTmFxEm0gL4qvualqahssswG6x+l6S+KizbLOkhNmLtZ12t166mZLWlzUPQKiJwEiWUK5DfJs2LtZCWyqVko9972df+buaQ4yPEBO212OoM1gF0P0JaTJ7TNzo0hhYxDIBZPIx9RnG7XzqI+sccj/OLQMeyB4p9gbbKHP4YJyyYQTSPK3dHG8BFdfUDyyq1tv5IkzKRHmy48xaumN6KCPsCqrpr8j1XL9oLPGPtDgf9VRjfp01FkTg9ujskxjnfAt6fNw8JThMyRUdInagos8Wh/qxPPV33yN+EvQaooXxq1FhvZtLVAXsErzqXnNbLBmQGx87IpBT4KMpXBWmQ7+XaiFCWXQ2pdXRtwL9IT7c6dtyCpUpYtlVjYuh8L64W8GJuRUjzg6pRbcw0205MFUZfWuOObAHK67K+ChNgzzsCCy4GHVtpp
+    OIDC_SIGNUP_ENABLED: AgBju2S3K1/i7oEsF+KyOIAyduYJMqA5c/spXNVDtFDgrf5+v8dIa25b1LyNZWctBPLZrcuviQtY3uJWgBbY4cKagheBlwN/eCijghdFLR5U9iFNJUv31zkmnVeOAZqkLKAmO1fmHfgqrZ8+UG5YlaRXcGsMjtuCuteKhF+/ss8VxWNwsWVcJc+xcfK11UG/ogrQ3+h/Ii1RCiS5WSMmQB3uNRvyNQEdDJHdtK6gifK5ZHboHN36Rx3DEzyr3eDeIJasyYgfDtepTBTyw5cb/7yFhRMSraHTpGy3uxJwzzNL1YdCi2EHyllJMea1/AvxUQXQAxD3zOSmNwQdroE8NU/Y+Y/vuCOLVrLeveHaTUWvI9PkIlIxbU1Xql7UGf7s+Y1PTnG7aXWNYNuTCgaw03TO5bhAPX1tBubVT9oVUZgjOH+XGY4nImtBOt/1bJ2xmciC6t2nt+8lUxLfNuFS/876vJokYtd22YHGqHuGSLhAdWg7LcwIilx4iCB3OY0ORBtdE0hDOu5KR282vRqGu5vi977k6kD7sL2far0fHjpb8rOaJqfy56UsF1CjClqQWB0F2vPh/ZNjecC87ei0ds3hCEhGtXxYYdJ1u9U3lZHyvA37NxKaagTHZCmhgs4M6Pdqm5YjsO0iDorv+aBnRkZysqzdG8LPuZNy7BkqxejW9icS5+b4TeJgCButl2Cb2RO77tda
+    OIDC_USER_CLAIM: AgCKYNaYTjJxEFBsijRDPNXRH2nodeUMG6SBa/emB6QKNh9jnQISn9poaZXZ8Tc/xwy1sLJ3m02x+Uh7/PE+A/jiQ26uc8FVvnjvzzUOaily9Hj+xgKZnjQHmNpxPBfj3pzomWZIEoEHybsWGrae1jDzIBxSeKbMYgTGfwJoWt9n4lnQ1Z++Z5/Texp7o+oV5ZJqsEqvjebTUT+nwWaDicKpDA/QbAjD+ysCim+gh8q8FXDCHZKNgD4OcXONTpDR185EpBYV0EKSMytlz5bdBSKHxVUACTATjf3WrFDG5NtckzmJA3bA85Xl39Jxi9pLP9D0SLk5cSOLkwNbLVL1EeQ4Q2FApXcPGhmEAgan11HQo2vJW3Dsn1R3G69zNC2ArMC6Dz6pH5f8nFId5lyTKsQQs25fCf/BV2we3910a9hGKAEPdkp27xGczu0mBdo3LLWeiFaQcDo326N2pqNm3119mdCdu5I7rhjGGvOLZ7z1c8XwS9NdE0Kb3iQZLqu1xr/FSeQZLd9NNF6qYtyFM3CtdqKSgdM4vpsRkqMEiZA84u7hdglXohuaVOjIaQD66bi0He1LemzyzRkRD57zxdVSvubKIQmedNpeG2yOT7pjZqVEk7FwWPaWZZiK61UhBZNvGXUKSMEWVJ1DIr9QBsK2E4/EGdqWKa/A5+75PKvv1TpINTw26z9schtduuPfaGO4Z/2ThfPlYFwD2eoVMZpAYjI=
+    OIDC_USER_GROUP: AgCTGx9h4At2lcx4tN5YUBN2PRHG9ex3curTTq4kid+kKQXRUOYckYC3LNzC7aIbJ8byhFHtJVF/T37olPkgJjWzPN6C16C9eGDv8bgq6JnG9faveeXr2zjcceZ9O3bSb4sRxlQ5Zke1Asc2olYP/H6br4VPDdKkDsJ5h5/B/W/dd9FDXuPAbTp32bK/l+3YStR4Zpmaldt4hostPu9TXfE+UxJqcLCFMtQuHsHEtFV3Pimt0XIkoNPsodpKKoAhje8vNwk5YYSlhzH13XgZvKcP43z8bfekicOgRNM6T27sVGRrFM4sE635406sOXWXbxJzwlBQJTqajCtX+tAtei3LHdr0l1sjjyMDzlREUq6RYt/6klMZrLW5gsdma769AFA76JX+e+wjekmv72/aqUVn9635IamFM1J6+jIWKdWo76vJwzR/EisO12vkSbocSoAEsUxc3rGMN2aLZEvo0LjsjENKlj8fNxog5i+4jO9Bc0AXEQaFhlQwPdIKlylQPhrSiW/cnDG1WemDn+e77a9NiOkDxMXGequzdC5KyIeIrSjITXpg1MQNa039yIKkjfVL0uMsH7OL7+qzKPSPm5LOABBxKducSHHK4t364YD+8e7KeQStHjaCTpcxgf43at4BKuQ31Ty2bWfpMRofGRBvJPusgjXrdutNEAIVrzFfW11o0Yx06U7CRF5198yXHCig3zKgxgQW
+  template:
+    metadata:
+      creationTimestamp: null
+      name: mealie-oauth
+      namespace: recipes
+    type: Opaque

infrastructure/argocd/argocd-oauth.configmap.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  url: https://argocd.kluster.moll.re
+
+  oidc.config: |
+    name: Authelia
+    issuer: https://auth.kluster.moll.re
+    clientID: argocd
+    # If you want to store sensitive data in another Kubernetes Secret, instead of argocd-secret. ArgoCD knows to check the keys under data in your Kubernetes Secret for a corresponding key whenever a value in a configmap or secret starts with $, then your Kubernetes Secret name and : (colon).
+    clientSecret: $argocd-oauth:client-secret
+
+    skipAudienceCheckWhenTokenHasNoAudience: true
+
+    # Optional set of OIDC scopes to request. If omitted, defaults to: ["openid", "profile", "email", "groups"]
+    requestedScopes: ["openid", "profile", "email", "groups"]
+
+    # Optional set of OIDC claims to request on the ID token.
+    requestedIDTokenClaims: {"groups": {"essential": true}}

infrastructure/argocd/argocd-oauth.sealedsecret.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: argocd-oauth
+  namespace: argocd
+spec:
+  encryptedData:
+    client-secret: AgAGtwiMd6OOz2IT2QJJR6unSYgLqNVJCb63a6hHko749nK8Kx1WgLwCYT/UURQYUusqMMPkNqbkA+jLUgh92fa7MKhtj4GysSvWavB+j8oFWT3YZbNcYNoJsTxg8mIRKiMFmp5um703e5RtGCv7eiOWdVtHftVv1BycPVeVHUuLU5usc8lmgnTTEPiRUEUB8MjGd7bIEgJ9q5oAiRTiwefickS1NgC02K2K8hVAhG/VkP0lqYn0xYgsy4W4i/7Q7AxRxCwX3y23spjXNUCRJRYvgF7Cf+MHdBgk6xPtvJF3jDLJfw8H2ilUx0GaxkESCDIE/FSVlbhMXmUdVYB9SLVo9K/tzqHe536ufGWO+U7H92mhZl5oZcA7qP9iXLUy13sAY/slixbKT6y4BJ3Tnt/pK1IydASsOE/uuwuN5q6AHWvG++DSHEPfE8xOH3bRVph8aIJD9hi8UlH7KGlEDPIaY3twpaJDUweaGVRTEnjvxW/hKfp2SF8A0PtGDeKSSii/XBZjxjROdOvE2+xM/WTVdVqddvErzogEKfljMvb5Z4OQiNj7fFvFMVuRD55To8p/cYZu+KHx+D8tuUMH3zk6AdADs/0bjI0xAz3PJUAmVp4RE4k0vP8LAImF5rWkIyVUcvJmP8S90jf0d7usJaEFd1ZayFLyUnwGAkP8ua2RiupnNUrZ/49A31cGm1RCpw00DGEJ/5VK6VMP1+T4KOUP5pB90FUYVHUv6S8dAg==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: argocd-oauth
+      namespace: argocd
+    type: Opaque

infrastructure/argocd/kustomization.yaml

@@ -8,8 +8,10 @@ resources:
   - ingress.yaml
   - argo-apps.application.yaml
   - bootstrap-repo.sealedsecret.yaml
+  - argocd-oauth.sealedsecret.yaml
 
 
 patches:
   - path: known-hosts.configmap.yaml
   - path: argocd.configmap.yaml
+  - path: argocd-oauth.configmap.yaml

infrastructure/authelia/authelia-smtp.sealedsecret.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: authelia-smtp
+  namespace: authelia
+spec:
+  encryptedData:
+    smtp.yml: AgAHiNwse+aFYVoun500VoUTUKg22yDSn+cD9pLO4HKG26nqmOxkiTSi5BELpzWouqHXiHNwYLEKPv13ZFJX6AFfFskspBfe+svLvLSzEvtH8kNCSJar0G5jcACEk27xcCxTN0nhmjc6L9lmZF8UUth7l5Mrsl0EG+79pCNYhUtjy16g7HdbmYgmgrY6d7VWCen2R4HZK4A9zPx+8HEsoMzUD0mG+uKKKfmqYaxJ563Gzp7trDcQRXd4tmea9MM8t+bk9TYCDvBj9JbsNuIdzFk8MArlvlesDYqiJj/8wny49NoVyX8vvGVDF3Y5s+OmKA9+MoBIYNc4oT4FLcc14wpnMnk5WgbKtTYfExcGTdTWuTTVWPsF18dvbKTU3C6dnf2kh9T8CydIdu27jwrBbChWffxNbh5nlLlQT3Xvogai8o6qhMn+EqTnw/u93OIxNzPEooVP349VVW/mlhGX3od/IlVzXiIlQIxL5EP2pRCXL2T1KONvkpbClJ/BTuwfjRZTXz3ZaRhaTPdBAZ+bpkRkt+kEAecjqaf9EF+pHy+dOaR4tIrwBWBbrAy47iV4e/Q60B97bRHzgo9N1uaYonGmyzmyVc9TXIkhf7PIlu/cSyDaHKdobVx0AA0p2usi5D1QYMcS9fngXyM1U9imO6QiYopysxQ9gJL8rfuySRJ/YQ6JJ71fLdMxsiQ0r21D7v7LEdJK5SKLovpnmPgk4PBoL9E4ZPE6g5zRXZFj1IxpKkOqRMpyBzBvas9Q1OFFs0Y79kGtyWIXb7Z2HGYmMU1us9Pm95xVF/V34sAtMIEz7qi+SaXQHFvyqbaiJ48U8qHhHL5y+lt9e8PGmQo0tRWfHMejs5BCcFAEZKDiif6zUEsjV/WC9WKO9NUjvRiu0CYCq5z9QzKaZQqWo0LPeM6DMY8pT3w4OqpJ/OLyMfbdoWT/uQ1JW5npApGifL0lhWRIkQHCG7oZA/BkJfbiexV8jwtToS+UX/s9HkbkuQ/O4zDte8qg/Xzh5TOj5AxlAPN6wGCwd6t1RTSITSKVMnTpFabkEvPYnGeiyWU8TrckvaKmhRUNoj2ZWQCCffHKp/bimEHxRqFnW6B+cu35reTjFc2dqp12EhCBR727G0EARx3Gt/LSdPh8OYt+Bs0rLaHiUrCJh4HRBJPmg0PARVwDL7OWx6pwtclnrALmfELKKaopy6yFctDogOtkvxHbL8DNhJqNuQJo6ttzlHhz4bnQcWb2K92HIw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: authelia-smtp
+      namespace: authelia
+    type: Opaque

infrastructure/authelia/authelia.values.yaml

@@ -0,0 +1,85 @@
+
+ingress:
+  enabled: false
+
+
+pod:
+  kind: 'Deployment'
+  replicas: 1
+  extraVolumes:
+    - name: config-ldap
+      secret:
+        secretName: authelia-ldap
+    - name: config-oidc
+      secret:
+        secretName: authelia-oidc
+    - name: config-smtp
+      secret:
+        secretName: authelia-smtp
+
+  extraVolumeMounts:
+    - name: config-ldap
+      mountPath: /extra-config/ldap.yml
+      readOnly: true
+    - name: config-oidc
+      mountPath: /extra-config/oidc.yml
+      readOnly: true
+    - name: config-smtp
+      mountPath: /extra-config/smtp.yml
+      readOnly: true
+      
+
+##
+## Authelia Config Map Generator
+##
+configMap:
+
+  # Enable the configMap source for the Authelia config.
+  # If this is false you need to provide a volumeMount via PV/PVC or other means that mounts to /config.
+  disabled: false
+  key: 'configuration.yml'
+  # do not use a pre-existing configMap
+  # BUT, include sub-maps wich OVERRIDE the values generated by the helm chart
+  extraConfigs:
+    - /extra-config/ldap.yml
+    - /extra-config/oidc.yml
+    - /extra-config/smtp.yml
+  
+  session:
+    cookies:
+      - name: authelia_session
+        domain: auth.kluster.moll.re
+  storage:
+    encryption_key:
+      value: 'authelia-encryption-key'
+    local:
+      enabled: true
+      file: /config/db.sqlite3
+
+
+##
+## Authelia Secret Configuration.
+##
+secret:
+
+  disabled: false
+
+  existingSecret: ''
+
+
+certificates:
+  # don't use the pre-existing secret
+  existingSecret: ''
+
+##
+## Authelia Persistence Configuration.
+##
+## Useful in scenarios where you need persistent storage.
+## Auth Provider Use Case: file; we recommend you use the ldap provider instead.
+## Storage Provider Use Case: local; we recommend you use the mysql/mariadb or postgres provider instead.
+## Configuration Use Case: when you want to manually configure the configuration entirely (set configMap.enabled = false).
+##
+persistence:
+  enabled: true
+  storageClass: 'nfs-client'
+

infrastructure/authelia/ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authelia-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth.kluster.moll.re`)
+      kind: Rule
+      services:
+        - name: authelia
+          port: 80
+
+  tls:
+    certResolver: default-tls

infrastructure/authelia/kustomization.yaml

@@ -0,0 +1,31 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: authelia
+
+resources:
+  - namespace.yaml
+  # # As a user management tool, we use LDAP, more specifically, ligh ldap
+  - lldap-credentials.sealedsecret.yaml
+  - lldap.pvc.yaml
+  - lldap.deployment.yaml
+  - lldap.service.yaml
+  # Authelia itself is installed as a helm chart
+  - authelia-ldap.sealedsecret.yaml
+  - authelia-oidc.sealedsecret.yaml
+  - authelia-smtp.sealedsecret.yaml
+  - ingress.yaml
+
+
+images:
+  - name: lldap
+    newName: nitnelave/lldap
+    newTag: latest
+
+
+helmCharts:
+  - name: authelia
+    releaseName: authelia
+    version: 0.9.9
+    repo: https://charts.authelia.com
+    valuesFile: authelia.values.yaml

infrastructure/authelia/lldap-credentials.sealedsecret.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: lldap-credentials
+  namespace: authelia
+spec:
+  encryptedData:
+    base-dn: AgBC27VFLsDFHQ6qMN3kbyilhgRwa++hJ5uDsBOqtemO4mOj3nw3/79SJRrO4201zeFq54WJaG5tRHS4SaB5+hYMjdZKqtgTE5Cl9amKIXsfZOzHQ8bKj//WJZYgfmfPxDm5tVdElvF0CGJQMf4SbN52F4V5ujnl2x/j2Qu6gyoJdTaa8lRRIOewXrgOc16lGuAmgVIFB3KR9SEOiSQb2sJxi4tbBPvu0qcLnnfq8/roWouqlfNycanf+Smgc23P112U4ZcirF/oSoeYjUxSy/yxRMrfSzrcxjLPMeb0hyHgsKpFc17YghBt6Ofqx/JOeb4rCZUAGe2PJYoNg6EvGNlgiL02h5TqPF0GfZ02QLiEVK+jUkrEZGMEqEl97iw8juVW3fFJQpcZxyA4eZWAN2ocH7LjDg/UaPvjaZzXbkkva92X1g9LXFCukbMXYoR6QrRI4AyjLWdAHRlBm1M/7w0x5SH3uh05MR3Su0uhRgwreKxJGndd02SsWYs3I9+xM4RjzIs//aNYvhoUgeMzvhIjda8Jut4HzCTqcycIwxkE9aIUlSAgcS+0HrLuvMb236F5OROz2kwx187KlZn6FlK5vDO3m1pWQwmq2E2q0oRhg2mOJDSexzKwzaTkvOdtNiEOWgitYkML93L9I+9scDd3RbIfA5ejOKu5+JR+8cxpwvO5puURvyzI4BTZcTSj+Jnm6MK0pl6tJgfHtgt/
+    jwt-secret: AgCI0LA/Y2ZTUl1VZax9Wqd5DxC9OFDe3NfWH9Mr85N5xbF6X5oe49fjW0GTjBE2cytN4aCUy+Gu5kAuo2qgfF1p5XyFY42Tg8q8fyF+LMN0Uu3JlgyA1D3ql0ePc5kNKxD8TRsfcWZOX/KtIWiZxceQ4YJi+OY/7llso3ZiGRCwzV1pXPoFd7A9dSA0qbUklpFI/58VkAUJ1HSel5oCx0JUfxZZAHQaCo72ZPqhbAskOZ4ofH1hzq66NJG5VbOhtBWkPDi4e82OOgT1VqiOiVOUC3w0GAvt6S1SD5P3N2FRqUbRag02rETnja/uahRKDHvLJG82zHXDVGxt5aZQ7bKRYe93gizCaZ4mTfAgrEaz9ys3ywRNr8UL7Cda18YWghvyOqDJSNePn6tUsntc2wA5rRhkPV3NKEhi0Tskqalc8zKXTf4MrX1WJSKw2D8i2l1B6Z7/UhjncAZKaAz7pky33QlitaDtp4Jg4k/ERcqcODB8jG+7oW17At96tXpiqCu6LUki4gkMrtsojRyaVHhl12w4XjVUHW9DyyzELlUT3CluF42wN9zyqDuyhPsuuIr4JrrhNrjvhFU6dcWppvjOvaZMIBvHH5A77F7LDVoCcLwYlrqmpnpxmateeIQHC8IId2JcFlg5CbD3abN9CjtUpoK8ZDRiEt3ULNkyOZ7z1hSfwa9TpJ//HkpWoXsO1b16+ZcNUdM=
+    ldap-user-pass: AgBX8ryuZX2fr6CZDaYOR54I445RNY123jp5LpyYLtB4QQljzmD6CC9BIOP5eju46cu5q/GoMSRdz5OthSLXfUB+I0iRrq+yI4bWpckpcrecNa0eJn0PAbWoI+T4gfAbkOxLLz1+yfG8J2PKqwZGVmpBqSBaqw1PQnkj8HggP05YtU8kfmH8W+Gi6c5mOBOL6RtIOgWW0pHgz1OZRKLKgyb70D+suvK1Xw9cKehkNoWtbmS9YvB+2lXZpWPW96Bw1mYnilEWr5WgMRz5aYYShe7/yf9OaFHfHpORgH42dpt+nvMSb5fY8nYVjEm6cYyS/mRm7H5cuBYwj5XnghAAoSIhX1B2KxIhbLh+yvFo+y1tdZB+q7sbJHFTegqRXi/eVvM3qkqTxksxhw9kGvCT/v7vRlS6jXHNTk1wS/Ka40Sv2AHaKlg/cMLQGZZur2LJcCZW6UVZwc2uqpJuszm1RwNX7hiTe+Pj1nCE+Iu/nHJrsk4SVEVcsRGOCAQjXwCXqbkuCz8dqZvCHVYBa2qIZTEd4gTXPjabaabudUzAXRiBg1SHLTVwz4HszUY3yfKASNdpYSxZwHTDt/BTENC8NJyT0Y48Daw26uS3U+87Ntsoe0gruccamhoKPdZlzA9Pl1hoD/GEryhVCLbuUhHC02qGo7WhjPaDZ/Cguu906e6qR4bq78PqBMiz6XllZgrZ0QMshT8/ubo9Bh7HxUD0aw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: lldap-credentials
+      namespace: authelia
+    type: Opaque

infrastructure/authelia/lldap.deployment.yaml

@@ -0,0 +1,54 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: lldap
+  name: lldap
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: lldap
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: lldap
+    spec:
+      containers:
+        - env:
+            - name: GID
+              value: "1001"
+            - name: LLDAP_JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: lldap-credentials
+                  key: jwt-secret
+            - name: LLDAP_LDAP_BASE_DN
+              valueFrom:
+                secretKeyRef:
+                  name: lldap-credentials
+                  key: base-dn
+            - name: LLDAP_LDAP_USER_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: lldap-credentials
+                  key: ldap-user-pass
+            - name: TZ
+              value: Europe/Berlin
+            - name: UID
+              value: "1001"
+          image: lldap
+          name: lldap
+          ports:
+            - containerPort: 3890
+            - containerPort: 17170
+          volumeMounts:
+            - mountPath: /data
+              name: lldap-data
+      restartPolicy: Always
+      volumes:
+        - name: lldap-data
+          persistentVolumeClaim:
+            claimName: lldap-data

infrastructure/authelia/lldap.pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: lldap-data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

infrastructure/authelia/lldap.service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: lldap
+spec:
+  selector:
+    app: lldap
+  ports:
+  - port: 3890
+    targetPort: 3890

infrastructure/authelia/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

infrastructure/backup/README.md

@@ -1,15 +1,8 @@
-# How to restore
+# How to initialize a new target
+I used multiple targets for backup. Each target needs to be initialized with a repository.
 
-1.  Port forward the rest api for gcloud
+After the target (bucket or other) is created, run the following command **locally** to initialize the target:
-    ```bash
-    kubectl port-forward -n backup service/rclone-gcloud 8000
-    ```
-
-2. Load the snapshots locally
-    ```bash
-    restic -r rest:http://127.0.0.1:8000/kluster mount /mnt/restic
-    ```
-    (The password is in a secret)
-
-3. Copy relevant files to the correct location on the NAS
 
+```bash
+restic -r <target> init
+```

infrastructure/backup/backblaze-credentials.sealedsecret.yaml

@@ -7,10 +7,10 @@ metadata:
   namespace: backup
 spec:
   encryptedData:
-    bucket-id: AgBwwjlkGjskxMXXpXrnfcT9fJGgDXtbOO/6WcpqsX0exoADw31dADjLTHztiddsGYipiGFf2DBWge69UEnL04NXIzh/xTwWtWaqlz6yOJm/89FMQE1mfbrrLc7tk98TO3oS8i+IDAnkUiYyvDXJexgJg56QLY595PXkpplYit2bAk43mAB02yUZAK0gMs3KRDIvhHFsMq8Uiqx78En5KGGXwEg6KbVDyNvI2k8suEyy+C0yNO/M6dlczoUQiIJbllQzbqIzuxbOp609PfvGFAYHuPlz1kwsg+feZJ3kNsHYi4hWvpd64BWb30iO9J3dAYfW6d7C61t3S5uabmnd9E7bMYZA/OppD8SCknBFalXF91BUiJao9qBVd/BB7TCZOzhdzhxTW+FhgARcA+GIfg+nIzgBqHfAfQQmAOO2RZnsWrvMysyZaUpODvU8kSsLWZJ3CESVRVU3BHmJZpyxjX/s6QEXShQXZaLq54zoFJULZU/kbom5yFNNDWW5sKbURPvbKJcf/J9QabY5toO4yOwDk96Sr/FI+CHHvMh8/amigva0Upq6naiTHXMf4BR6+w3VKP5ALn5cbD5jG7EpUA/j1roMoLn68GMAtTJDLvSq2BGeJENWrUpOmjWZHDKZy8DEKorJk/Wbp46ksteSALE8eXpi4DRKXYDPvDb57EhzoJGQ9NMXgAvU9+1vw2nyTZE4gAWKpg0JkiHglu4Om79HfuGuewzJXlY=
+    bucket-id: AgBZ4U2eKOmIy5oj7KLvDy7LYi41KtyZLYhMsxRcKYeQVW0lYetrsHbnsCTsw1u3kqI6pSrjUVQslpOupAlwmEdwpT5pSfAvgmLpl8NV8JFLSf1vv4cd0yBe3raFxTtTjmt9BPrEaZY1NrvW2l9SeK1JsRBJoVo9+NOlNmMWAsABi2iK/r2O9bTr9e9sOKH1DQZrvxgZKYRH40CosaQL7eBJR9EZcxSvCCp5mjZISuVI0FSgA+Xj1pXODvnf7cXkDMRg6mDDOkdYCZsQ+3a7/YZkoDBEcrO734WojHDDMLVq8lEOqzepJZJnje0jLjz5vn2pDYKGe7j3cbmMPUsNpSnUDmjFFuXTIS70RIoHUAVaPvdRpWlhYYeZiwecc+Y8gKramApCYKuUUzu8opIcckpGd/qzHCaKPyKL7qwtm9aA1rkaKLkrYjJkIhF32gp6E1qiea2L4QQD3ww/2r3UryLHygNeiNbey22covJsABA15B7LbGBaNCHhj1sqaboYvDg+FWK+Nu09UYuIvvQYw2vhKWREILbtRbyHq5J46mWtekSA0B4JU/mZL/GKwGIyS32pSZGo8gFnNzpJUDC5aNSpOPdE0FyeuJ8o+XVA43Rs6DE6885uAYMGTZhNWLZtsgOIs45ly0o8Phg02P1KvWmZzyitHWpWyAW9TXADh4GETJbFOcH7AjrrAVC5+bqI6Dx8O3qM8wnN/5MTo3EnL/lxg1wBf2c1SQU=
-    key-id: AgBe4Iytjw9CkT7CqqNLHWyG4F8F+R6m8W1fnQZdGJvLy7D81+nB2ZDMCUZgUQV/mppGnXCkSxHyelcyTYCswQ9bD8hZsAIiQACq39v2UFxdORFEgNMj4bTWPo65fwhSK2giozPqN/4lzPopP91uyq1Z0gQaiqn/HDtbfNjq+Nu9kPmV06O1NUj1f7QqvfsMK+Xadv0G+DAA+ClGaq1q3fZPDkl2MSDdbEPGq+fLPK2DSdYu9fr1bc9TPyaU5JDFvGrCg8Nyigugi4wVGjQFtVwR1QsHAADmnoDAdXoj1Sz65QO5F+zNaDZWvnLnVFxAFrXJHihilc4ilAc8hSpE6YHQm7dGO5gGejLRNaaCspb/fPJD1g2XlnkckhFCSwd9sHNrXb07BZk8gFTHfndEC0t2UyUNloYpXsfap6fvehPK91ey35jbxDk9zYdgKZ7bz/tY0450CkofSbhisf2DwS3prt5YCEDaXasrpUqlk4dSbmLaGm6aee8lM5VpO8qYE56nvXY7qr0yB6z/NGWuLX3oH3fV+C8hH1P4mxDjvVEFdtewlF50Bf9WFoE7KpboSvmChZhBfjOkbtsGmQE41ZuNoYVupetXn6IfvYo6MzGoG6dTRVpJ5S2KLQDtsUljQfXJDFCSYwo87DD2dGBEn/z9GFCIPAYNO2ewzU4RUgcXPuDD4I2tdNIC+xdEBZq7BaWn/46Yfc1+FAWUA9VWEL/9kz5tK6hFD3Ww
+    key-id: AgCPco6/scrq+3BDVimLOssVYG78vAmNOLgo4ZM9k+ayfy9morHOBQRflAJDrLO+F/2fJFM0WvZ+8gd+NnR7W6i7R3wGImN5xr115sCsBWUAM7ued7QunyrumB+Sw/o1FDcW4+S5bqwONtr07bS/M5dYM7l8Uy1zO3BOxtvWOMqdEzSrmyW/j2Kg3tQq1lEze/TOPjS4LgXqqWMWHVCyzJTpfImS3u73EUisVQBPqO7y1m3fEUvZuqVeJVK9hT3PPGuX2HUAVcIMMKWIhsA2/aMYhHQ/J0UOgc/YrGzU6DWVQoaetAHPPrt+fFQXL+MbDVaLQwk18AaRe8vhMXMwWakQEzK3fGtwPeklJB78OV4HNwpGXGFQWr1wU+T1evMJ5mv8O4VvWg7pu6blwjLCEseaCuwib5tPghIFT+LXpl2jPuyRveD5Qdl4seDZwoE9joaTWlcPreQYfuCwsQnBX25Owf4uo3XzVuVrHHRfm4O7g2VqhI5W3NcVwKhfXKuqUKDfsAmbX/RlwcihmlX6UySL42EIO5Z3xcFqEtQzba3IYgLOP8yRjGzRKUklcKFjrtoa+ZQjewKjS5x685Ffjgb4PCmpearUlVeboqH34zQBiflnecZQrwdhntVRfd3F0tkbtA/Th550IqYwezBv3AqVwZZPm+q3jeM7i0HDu6JzVYsUVpxe2MTVSKncy2p6wihhdbJeTO0gnHHydlUsyd2C2P2pXUppgjoY
-    key-secret: AgBcKSHdXHeNBzkZRtbaOEZra7AAWVlzmubaQoklECr14gKNL7rTReqX87qQObjQjmGKXtnJlKXIVHGDuiuHGkqfxQ9PCxccvpA3/7LdbFZnZtlFDWpAv+VB6Tp7H7Quho/GeAo8u6de0BXz85lz7+RyDCssBpuuzpchMgOlcEmhhfgQM5E6ye7bD6LpAZWcay3PV6FW2xTrJvLobpCcJordye6iTdSySPKdk6zflkon9h1KuQT+njmW4cfTQg/u7iS/NDQYcHdCpDHRLCor4GkVmi7NW8q+WuYhUSGWBy55SGvcUobhUL7GEHFJZpKmyrBOwSbwiWUDoN+NjI2TR5xvG0Ldjd/Hj32Vk29I+xSnj/O7pZj5ho35qExlZ/WCe42i0VHjzHFbOoU1MkqB+Skm24L1cLufhyNBtA8NNN3GWZhkcozpe164gpx4H/Vfe0UyzxUn4VJIws/IXYiLb4DgDkGrV+wzigN2QfSgTgs6syQkSs4UJ4gUZeN0jsyq0YHIhq1VZ8qPtLH310d8LZLxpTjZdO0obBwJfnHkg3blwSABEt5756C5DvjKmvO1pjG+JX/PJ0yAINL9Sc+FsY7TnGlItVzD830NcZ3Gg9C4Tg4xBEHybUWCSl1rJjwMvmUvVKNcIzLBHPAOyle1VLTZ37zb13MnhwNwdUtBu7+RZTy9wVO26iqemXTtFVj13kgZkJsyLjM6bo2y2wvFmjBCV9EKQtm87ROStM7iKB46
+    key-secret: AgAQ9GBMK/sXev8MKfCeYYgtf3tW93xvDn2jjTHaO/trAoU2OgWMS3kWKme/E+ONOxVOA3qonHhUgXcWxyut4OgMFJj2yBGRb+TqD+e0fE0KCqAwRKuYhXgFFl5SgAPZiWOAnYIJM16xu5Ci3UbrM8a8QAXAVV9aH3eT5HMF+GeqgSvhEVEQO1C8KOjVkawoqIHmDmr5KUbK4SFnIut+zCz/2HQLApNkZhPUY2whZOZjz4rwMtu2NDu8k08lI3Zl03OAw38rsbcNfZC8KbENsf1vthn5YpVJomcJKp/prgEp+/C64ZexgBWzZysq1WHs96F8R/ZmgD/Hu1Am/VjvHoFrfbLvXYUZzXGhyCBjhSwqcysm08uI5FvCs9F7WGVbYe5M/sYUMMJwLP5iILd2fkodm/+GWgl/p3EzQ76aCH85FqFhL3/9zA69bM8mZUpVG85i2yNJ9HvLe8z2EnZrh4BTgMRod/DsP9qN5NlofP0dJhK4SyXvy6M+ZO2V7CE4ksLvdWWXcJFmzuiG35DC/dQYHu8tcgywYyFVOw6uAetXSVrIzgGSCche1PZ7RKz2N4CqV5eTe6zUAgNPf4IxPne86f2AGKkivh+QcsIqfXkkR4OzcMslaKskkCniKD0IMf2aFHniSWzivi07gk5PYDxjwpa9AM2yUGRXYTcDSZquNXAt4SxE1YLDb5twZ8JyPP1Q884dwJ3+/M1DwTJj4CewO+zhH4MIURfRaGvipwsV
-    repository-string: AgAEYSqT6VR4OKW9/ZDgjYV+rm4tK3uucZsQG2u7W+8rRO0Rowkuba1AbybjgTE+G3q8si/GtlgsB1J8suvztHcVLNxg0y0Olb40pn2sZjKd85Q8AzsM0pFMkzme1lvnwu1Bcgd6Ck+FCr4CuUnh+UvJM5iWhAoSHJtdBb/EKw2F1BhewAqMXSX4oWM7V/T8RTtW2wBUk4wgX4ia+gCBPMpTo6i00ZtSpRB3Ub9VfGJfRmiXZA7oh5j3yN9nJlXonbJYBp4DNWod76CF7s35HBnSzS7YfIV80R4lH4xAPgRbZ0tvPWkTLMhSBX8rJCEnxT7DjL2lS7WfyboLdL4Uy8WmP7n2difZSr7p2iic6SCP44YgQ8JY5UgXh2QZENQ6oLvjK/PpFTjQ4bfw3E1/dakg1EdCYc/6DPyK3YekccUe/pXvVBrazpgObxXWeKKT6RMDeYWLUXTBHWhJ5OaJHHePD5t9IM65FlFTtkuUFbxExTi/u+RczBlWWcy10Yow3I3LGrDPJ/PfBy4RPfHCeQDQ+WoLJkNT20nu5mBXEYYKgNvgdn4yogifSiNG8vsNpo4dO89aHppbnHdmdp7F9asfbn27btEoFoHzIFku/mEnY5srs+Smrhhzy0+iPKge9LOuW33Gi4oJban1UYFvLAjq8YsZGkbIO82r2p+v15UjwU3girWPl1KBUc8WzLJtnqBvRPWS1ul6/X9JIdmmrHJjC0KlcGiVMU/Ls9ljnQj7dgLXuDW7JzuK3MhTWV3Y2kS39ze3TskCKcbL
+    repository-string: AgBuD/n5Pnz2AwkFUR6ChGSPMTahm5fdStTay2dD12g+IJC+zNKGlY96rxy1RRLpGJi9sj5UzqIjWd2ke+BB9Xx3RfNygh+hjQEqwb15Z5w8Vo2j7iNRYdjqm/q/ug337Ycc+p2AAxEaA4GZln+Ujq7Xh0m0mOg58N640A+zuav5Xg8dQvUoO5vrqcx8lKzUwZuEayjubZPOZDtED14bTj8FWp6a8A88PjvH+xX9ZCi+omuplHFD8+iJyHewMaPq8CPxsa90J/jHR0FyEzkPcx3/zxryeodQFSiCtvMEb4TZsABMYGlFWOdJwqTcPvqSLRZH9Emx7NmaapknERxuoozDegl/KYF8GpshizBcHaV2YEPxNFiAcPMAqmLTJc0E8SbtGcWeilVdqz2z0+Ezqs0VL5DRICBVFg+HT01bYg3yL8FYd3dfeXepijXurMJodL+pORy0y6NeS9dSvOTqoGr7mf/SeaXSMG+cdHw1+V88CVozqFgV7yLe3NzoOPSIgjyoHckpprZSZHfYF9bgX4r8tT1vrlZqN/KlBcbyYsexYK9+s866b9rpZppvgYx1I50sWm+bAeMEYrVBy2sm6fAbpb1U+3+j9CICVnJ0E1VRyOCRCvh3ncpCRgDhvXAfZTMujxGWR6m9nAi6ixp6nLx3oWsgnszK0kAoxKoHTFiNGzdpr9M092ziBnjPosmLp4fV/HdmWKlldWMsbo0HkdMmPQlKQXmtzZ09WgeSHRh1T/3rSybzwXfukh1tj1IcVIM=
   template:
     metadata:
       creationTimestamp: null

infrastructure/backup/cronjobs-base/cronjob.yaml

@@ -1,7 +1,7 @@
 apiVersion: batch/v1
 kind: CronJob
 metadata:
-  name: restic-rclone-gdrive
+  name: restic-backblaze
   
 spec:
   successfulJobsHistoryLimit: 2
@@ -12,7 +12,7 @@ spec:
       template:
         spec:
           restartPolicy: Never
-          hostname: restic-k3s-pod
+          hostname: restic-kluster
           # used by restic to identify the host
           containers:
           # run after completion of initContainers
@@ -62,7 +62,7 @@ spec:
                   secretKeyRef:
                     name: backblaze-credentials
                     key: key-id
-              - name: AWS_ACCESS_KEY
+              - name: AWS_SECRET_ACCESS_KEY
                 valueFrom:
                   secretKeyRef:
                     name: backblaze-credentials

infrastructure/backup/cronjobs-overlays/applying.md

@@ -1,8 +0,0 @@
-```
-k kustomize backup/overlays/backup | k apply -f -
-> secret/restic-credentials-backup created
-> cronjob.batch/restic-backblaze-backup created
-k kustomize backup/overlays/prune | k apply -f -
-> secret/restic-credentials-prune created
-> cronjob.batch/restic-backblaze-prune created
-```

infrastructure/backup/cronjobs-overlays/backup/kustomization.yaml

@@ -13,12 +13,12 @@ patches:
   - path: restic-commands.yaml
     target:
       kind: CronJob
-      name: restic-rclone-gdrive
+      name: restic-backblaze
   - target:
       kind: CronJob
-      name: restic-rclone-gdrive
+      name: restic-backblaze
       # replace the name of the cronjob
     patch: |-
       - op: replace
         path: /metadata/name
-        value: restic-gdrive-backup
+        value: restic-backblaze-backup

infrastructure/backup/cronjobs-overlays/backup/restic-commands.yaml

@@ -1,7 +1,7 @@
 apiVersion: batch/v1
 kind: CronJob
 metadata:
-  name: restic-gdrive-backup
+  name: restic-backblaze-backup
 spec:
   schedule: "0 2 * * *"
   # at 2:00, every day
@@ -27,4 +27,4 @@ spec:
           - name: ntfy-command-send
             env:
               - name: OPERATION
-                value: "Restic backup to gdrive"
+                value: "Restic backup to backblaze"

infrastructure/backup/cronjobs-overlays/prune/kustomization.yaml

@@ -11,12 +11,12 @@ patches:
   - path: restic-commands.yaml
     target:
       kind: CronJob
-      name: restic-rclone-gdrive
+      name: restic-backblaze
   - target:
       kind: CronJob
-      name: restic-rclone-gdrive
+      name: restic-backblaze
       # replace the name of the cronjob
     patch: |-
       - op: replace
         path: /metadata/name
-        value: restic-gdrive-prune
+        value: restic-backblaze-prune

infrastructure/backup/cronjobs-overlays/prune/restic-commands.yaml

@@ -1,7 +1,7 @@
 apiVersion: batch/v1
 kind: CronJob
 metadata:
-  name: restic-gdrive-prune
+  name: restic-backblaze-prune
 spec:
   schedule: "0 0 1/15 * *"
   # at midnight, the first and 15. of every month
@@ -28,4 +28,4 @@ spec:
           - name: ntfy-command-send
             env:
               - name: OPERATION
-                value: "Restic prune on gdrive"
+                value: "Restic prune on backblaze"

infrastructure/backup/postgres/cronjob.yaml

@@ -1,32 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: postgres-backup
-spec:
-  # Backup the database every day at 1AM
-  schedule: "0 1 * * *"
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          containers:
-          - name: postgres-backup
-            image: postgres:15
-            command: ["/bin/sh"]
-            args:
-              - '-c'
-              - 'pg_dumpall -U postgres -h postgres-postgresql.postgres > /backup/backup-$(date +"%m-%d-%Y-%H-%M").sql'
-            env:
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-password
-                  key: password
-            volumeMounts:
-            - mountPath: /backup
-              name: postgres-backup-claim
-          restartPolicy: Never
-          volumes:
-          - name: postgres-backup-claim
-            persistentVolumeClaim:
-              claimName: postgres-backup-claim

infrastructure/backup/postgres/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: backup
-
-resources:
-  - postgres.sealedsecret.yaml
-  - pvc.yaml
-  - cronjob.yaml

infrastructure/backup/postgres/postgres.sealedsecret.yaml

@@ -1,21 +0,0 @@
-{
-  "kind": "SealedSecret",
-  "apiVersion": "bitnami.com/v1alpha1",
-  "metadata": {
-    "name": "postgres-password",
-    "namespace": "backup",
-    "creationTimestamp": null
-  },
-  "spec": {
-    "template": {
-      "metadata": {
-        "name": "postgres-password",
-        "namespace": "backup",
-        "creationTimestamp": null
-      }
-    },
-    "encryptedData": {
-      "password": "AgBZViaCuD8Zm/nkDe95xVZXgeRVJ0zE64e8efigBrkM+XUT9ber034QY5USZWalJ8nC930FB5t4N96D+LyWWXiLrYQvnYHpsi+wxJd3H/EimQo1IJ7XKNHxRC226NGX8ugb9Lez71IZaldyK3tAX0yoQ5/j304+mzetP/535EKYjZ7NucYE7KMUDsb5JsAaswd2H5fIl61PK/lEVN9AJLIo9MKL0zbGDOJCh1WNG6bUn0oi825R9AT80QulXFl/qxBHQT8R/u1AIqJDnrhLf8CiMBCs60K4D/A/F3uFwzsfGF4t2tDrowbPnGL7abAfe+DeHW8WSQoiMQWe/rTb4mnaErRNWSWmSwOcFNtUt9QQG4LvH44RTLaXKxbNfZphsNtBYk+F8SPngOok8FxoyycwUwDbA5clCt/Kh9bMOfUQpXrPc/rfXR5FO23kxM8h2pfC7QYNej0k3LexcikdQrpqRj9yMAVMSI7xF35Tfc5buqasIDlgRxTSi2Pn/fAFIK3QqY7YQWZOYzuD3w6aTUx0trmHNTycmotKV/kbni/ZOMmf6NMGbZs5R3VbmA1vFtdp9YVD5dJ0t0aTXTdNuWjeC0+vQF0lnXPWonRYf65e8KOwcuDjTYU6ghDfQPngJ01FFoTgiF+X/1iZ+7uvIeIULak8dMIQz6CqfrCkahkimz5u2c+b3ZPlNnXRyPmZE/1JscLXaKuXvg=="
-    }
-  }
-}

infrastructure/backup/postgres/pvc.yaml

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pg-backup-data
-spec:
-  capacity:
-    storage: "50Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /kluster/pg-backup
-    server: 192.168.1.157
----
-kind: PersistentVolumeClaim
-apiVersion: v1
-
-metadata:
-  name: postgres-backup-claim
-
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  volumeName: pg-backup-data

infrastructure/backup/rclone-config.sealedsecret.yaml

@@ -1,22 +0,0 @@
-{
-  "kind": "SealedSecret",
-  "apiVersion": "bitnami.com/v1alpha1",
-  "metadata": {
-    "name": "rclone-config-files",
-    "namespace": "backup",
-    "creationTimestamp": null
-  },
-  "spec": {
-    "template": {
-      "metadata": {
-        "name": "rclone-config-files",
-        "namespace": "backup",
-        "creationTimestamp": null
-      },
-      "type": "Opaque"
-    },
-    "encryptedData": {
-      "rclone.conf": "AgCQ13IG+R6bs+nAxe1xuDXttYlvGlLfV3oQ6c0qtoF2jXB8hN3LftydHn+Se3LjghmQKAIErfsA7ZRhJoWfFuSm2AIc3w2mMonsga5gjBx/56/tZSvnT2Bzn/5UXktTVxwEINSBP0dYiMcn4/G+5hO3bngmG+lCZXeI7yWoTW8H+8NKYxDHUzdoBBhPPPLTERTRZHB8EzOPUlefHq/2y/NpUfkxyLSjYk0/X45W6XNzH6MfdA2x6omxd4giDQSEwJGdXqIXu1rPnPjV7WVcA8qJzkQbxhzjqpUcFgM12YsLGVVW8HSSdAy+ZNdTXmhCIu2+pI+AVuol4QY9r/gU3xlGhFmc3asW5k4iOfn7/ZEr3Yk8JplAYM+GWQ07s59MqYdGOhqFUpVmkjO97Z29iaeReQZCwxzl/PmxUtfI20eTmtUlFKE3fObMr27sZcXgeJS3ktHOONGoqvHHeuqd4hfTaVAGwVOAEoBY8Xnkq3ECN5ld8V4zR8e52QHtANflN4IJgjnGO5pMQyAW+XASAJDxG48q7ruu9i0mI4vuM0rVuoWi2v9I30/M7Mv2xAYnmKC7NIao1mDya3paidHwkIu12480oBDdHZpm5NSqHtQr/HKMQWnbu6CrufrDmTqoVe/ew5uaqjbfrBBys35k5ObUUPlhU3putgfmsR3YZXDaAqOwIoXQ30wm02gCA5z/WNEY3EaKP6RhgsowwkrPPniQfz4EaxQQjmZ/toe/xpwzSZjmoVnJtJabiuqL/B/eY6WpNOTjOzsc7Z69EOyhZMs41gNoA32RRUbFO1ppOu8518cE12KpsGbH6K6NcucSrKh2Gd3xNGwjaGQVT2vLTVi9YwByiwvrsVpNU06f2v0fcZWeRgoFoUkKMj746lw0E+X7oF0+PmfPT2IeTRszHECkbStSvFZNDivcdJyDFutocAZKNjDoAnVPlTNVYwKKcmHvw3sOOXhVN7NOj/+9UxSNyRvip7GPZKtRF1u9ftlD6OaLCCVSip7MJ41a7TugBTUUaMJbQUTmidWKZn6A0nctAvdrPbBatPI2BZQ4amwdXa2bWyE7DI13WaCm6kAVJijsAmfVrVX3C+Ft5p8unbjsVQ/ErdpKTjlq9mJsie3TQdME5r74GlcURiVXdLc7KcV7vpf6yy88XS6ee+Y9WmlYDAwRX+taMilRDlunMeF5Zmh12DCXMzsradEifEOZ/Mg5BMznxvrZv3iHDArm/j4QW7Bi0To3+f2826IAaXMlI4ze7e9Ny3NUbgy85yE+RNYiio0+wvWRKraxpqI0EODy/juBed3VcoWlOfch0hKU4BZTVrU5rDEmwYcp6oWnXE92fhVH7wjy4IV3WUSubYg="
-    }
-  }
-}

infrastructure/backup/rclone-gcloud.deployment.yaml

@@ -1,54 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: rclone-gcloud
-
-spec:
-  selector:
-    matchLabels:
-      app: rclone-gcloud
-  template:
-    metadata:
-      labels:
-        app: rclone-gcloud
-    spec:
-      containers:
-      - name: rclone
-        image: rclone/rclone:latest
-        command: ["/bin/sh", "-c"]
-        args: # mounted as a secret
-          # >- strips newlines
-            # sleep infinity
-          - >-
-            rclone
-            --config /config/rclone.conf
-            serve restic
-            --addr :8000
-            -v
-            ETHZ-gdrive:backup
-
-        volumeMounts:
-          # from secret
-          - name: rclone-config
-            mountPath: /config
-            readOnly: true
-      volumes:
-      - name: rclone-config
-        secret:
-          secretName: rclone-config-files
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: rclone-gcloud
-
-spec:
-  selector:
-    app: rclone-gcloud
-  ports:
-    - protocol: TCP
-      port: 8000
-      targetPort: 8000
-
-

infrastructure/external-dns/kustomization.yaml

@@ -11,7 +11,7 @@ resources:
 images:
   - name: octodns
     newName: octodns/octodns # has all plugins
-    newTag: "2024.08"
+    newTag: "2024.09"
 
   - name: git
     newName: alpine/git

infrastructure/gitea/gitea-oauth.sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: gitea-oauth
+  namespace: gitea
+spec:
+  encryptedData:
+    key: AgAXDv5WIcA8AFGT4Eb1spaXbtifwOIFaiqjMbEuDYNG43Me7evzgrWmHvUQsf3jzkElsAhC/ykhsMKTNIGdeLC15oVifqOKL+19fcuBPwt7ubaL/z35svluq3P87vTP4Yp+rag3SvN05E4xteOiqyYJWSIUmrOHwkLRco4QzgTk2FO594//ZsA2TJb9YdjhBLXl/Ywhjpnf36t5blgUZAwX1NY61QkBbzr3UV2McWBB5dU2t561bvyo9KcAXkMNG/okzlhE2OzQoHoQYRz8o+xpySlI1Z06TE4G6mtojxnexuwR4EDds0c21aA2i5CIesnybGD8Vzwd4123A00PlQd67PSQm8hj3UJMzB3eWGAQuIhWn3zp7r01GElA9JW+9yVbPEkxaXMWaT6yaH3Zo04emRKPqBwxFpEPgWqZ00H9PjZn+KDBVnMs5+BG1jaYAuF3acLfLmgnO81F1B/jNX8JDShty2oW1heB9YBxSK2lTCYN1f4ItYV6N6eoC/q/mRlJOe2nAiUW8V3oT4x2x2S7Jw5Fwnd4avSesahtHzr4YwSNtq8jB/BSicYp1BezmALvXU8RUMmI6kvXkABuEHB6+G0ugQ8RDdg2OggZ92e4yKqv6vazWopH4GJ0sgpjViRHU8ZdxEJSgWH34+KKoUcW9eE8ugOynXAtthkasazfahxTmMd5XK6IbYsnNN/Bf3MyOonq0A==
+    secret: AgBh0QjLGKbQLRsI8imDwlktlUP/kRD/nUQAYWIEkVy6hZU1OWAAexfcwJi6uVIu/s4Wfzlzl7i5ok5WeeVCWDSTFh5Xz8+SNQoio0/xubbNiYCC81y/ZDhwS9CBn74UX1St4eEFeIcRjey+cyeB7vYCRrYO1WvpZFHx8G9KZa8F4Ca9fy07A3HTGEFdm0Of8MfOM/TVGn8pgJLh2KL+VnYbmyAwQp9hd1NlMM2DC5nPW5kkdfMnz9YG7uAMyaL2MkxTynpKvEJeSCWtIXQSuj60+3IGXNAUWOgYVF46vqzsBbQErXCC67tf8TXOo/lCcDZSVluuo50uWqQceuZ2QujrjwSsQiM9ax29mnI9idu7zqT4q2MQ08+HZT0qNKqN/1jYTUwf7j3jLcANQX5VVuY6zDSZ/hDE4sBuuEoisYTFQH2RicElX73BCfXeOHTOmD4R4EiL/Cn546JG+7qjmBLnljqdNwp0Tug0iLAp25IWhsz9FsNhVwEozil6Es5RGjVHrmIp7z61OwQPqyBOxvBXjIKfQjPY9rykl00UF/X34YWltob2qilUVfYnDGQcA/OZ6UNqN2IC6Pj+vlzAqdbElGapGvqhg2w+ErnL1vAl40HLfRiDCmK5s6dOE2eHdvi6lbbwVWtlpeB7BNuFRuf8npZiMfQmtA3x3FF7dcMXiFsPJ8RbTJRQDO9VeaVTAFDnql3eBhUssVKIehywj9m39dfLvDtdRA0=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: gitea-oauth
+      namespace: gitea
+    type: Opaque

infrastructure/gitea/gitea.pvc.yaml

@@ -1,53 +1,11 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: gitea-data-nfs
-spec:
-  capacity:
-    storage: "10Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/gitea/data
-    server: 192.168.1.157
----
-apiVersion: v1
 kind: PersistentVolumeClaim
+apiVersion: v1
 metadata:
-  name: gitea-data-nfs
+  name: gitea-data
 spec:
-  storageClassName: ""
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: "10Gi"
+      storage: 50Gi
-  volumeName: gitea-data-nfs
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: gitea-postgresql-data-nfs
-spec:
-  capacity:
-    storage: "5Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/gitea/postgres
-    server: 192.168.1.157
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: gitea-postgresql-data-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "5Gi"
-  volumeName: gitea-postgresql-data-nfs

infrastructure/gitea/gitea.values.yaml

@@ -54,17 +54,12 @@ ingress:
 
 ## @param resources Kubernetes resources
 resources:
-  {}
+  limits:
-  # We usually recommend not to specify default resources and to leave this as a conscious
+    cpu: 1
-  # choice for the user. This also increases chances charts run on environments with little
+    memory: 1Gi
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  requests:
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    cpu: 100m
-  # limits:
+    memory: 128Mi
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
-  #   memory: 128Mi
 
 
 ## @section Persistence
@@ -72,7 +67,7 @@ persistence:
   enabled: true
   create: false
   mount: true
-  claimName: gitea-data-nfs
+  claimName: gitea-data
 
 
 
@@ -86,6 +81,7 @@ persistence:
 signing:
   enabled: false
 
+    
 ## @section Gitea
 #
 gitea:
@@ -121,58 +117,47 @@ gitea:
       ISSUE_INDEXER_TYPE: bleve
       REPO_INDEXER_ENABLED: false
 
+  oauth:
+    - name: authelia
+      provider: openidConnect
+      autoDiscoverUrl: https://auth.kluster.moll.re/.well-known/openid-configuration
+      scopes: openid email profile groups
+      existingSecret: gitea-oauth
+      required-claim-name: groups
+      required-claim-value: gitea
+      admin-group: apps_admin
 
   
-  ## @param gitea.ssh.logLevel Configure OpenSSH's log level. Only available for root-based Gitea image.
+  # since we want to reuse the postgres secret, we cannot directly use it in
-  ssh:
+  # additionalConfigSources:
-    logLevel: "INFO"
+  #   - secret:
+  #       secretName: postgres-password
+  # but instead set the ENV variables
+  additionalConfigFromEnvs:
+    - name: GITEA__DATABASE__DB_TYPE
+      value: postgres
+    - name: GITEA__DATABASE__HOST
+      value: gitea-postgres-rw:5432
+    - name: GITEA__DATABASE__NAME
+      valueFrom:
+        secretKeyRef:
+          name: postgres-password
+          key: database
+    - name: GITEA__DATABASE__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: postgres-password
+          key: password
+    - name: GITEA__DATABASE__USER
+      valueFrom:
+        secretKeyRef:
+          name: postgres-password
+          key: username
 
 
-
-## @section PostgreSQL
-#
-## @param postgresql.enabled Enable PostgreSQL
-## @param postgresql.global.postgresql.auth.password Password for the `gitea` user (overrides `auth.password`)
-## @param postgresql.global.postgresql.auth.database Name for a custom database to create (overrides `auth.database`)
-## @param postgresql.global.postgresql.auth.username Name for a custom user to create (overrides `auth.username`)
-## @param postgresql.global.postgresql.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`)
-## @param postgresql.primary.persistence.size PVC Storage Request for PostgreSQL volume
 postgresql:
-  enabled: true
-  image:
-    tag: 11
-  # diagnosticMode:
-  #   enabled: true
-  containerSecurityContext:
-    runAsUser: 0
-  global:
-    postgresql:
-      auth:
-        password: gitea
-        database: gitea
-        username: gitea
-      service:
-        ports:
-          postgresql: 5432
-  primary:
-    persistence:
-      size: 10Gi
-      existingClaim: gitea-postgresql-data-nfs
-      # mountPath: /bitnami/postgresql/data
-
-
-
-redis-cluster:
   enabled: false
-
 postgresql-ha:
   enabled: false
-
+redis-cluster:
-# By default, removed or moved settings that still remain in a user defined values.yaml will cause Helm to fail running the install/update.
+  enabled: false
-# Set it to false to skip this basic validation check.
-## @section Advanced
-## @param checkDeprecation Set it to false to skip this basic validation check.
-## @param test.enabled Set it to false to disable test-connection Pod.
-## @param test.image.name Image name for the wget container used in the test-connection Pod.
-## @param test.image.tag Image tag for the wget container used in the test-connection Pod.
-checkDeprecation: true

infrastructure/gitea/kustomization.yaml

@@ -2,12 +2,18 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
+  # postgres values
+  - postgres-password.sealedsecret.yaml
+  - postgres.yaml
+  # gitea values
   - gitea.pvc.yaml
   - gitea.ingress.yaml
+  - gitea-oauth.sealedsecret.yaml
   - gitea.servicemonitor.yaml
+  # actions runner values
   - actions.deployment.yaml
   - actions.sealedsecret.yaml
-  # - actions.rbac.yaml
+
 
 
 namespace: gitea

infrastructure/gitea/postgres-password.sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: postgres-password
+  namespace: gitea
+spec:
+  encryptedData:
+    database: AgB8FeAX7Dx/SO/deoqeIRNPMe7DwgKtwFznjntm9TNnEJQDLVVu+D80eolcrTTOhlZJZgtKvpM9xgw7DLtKG+ARACaPYgaMW2m4V/B87Z3xAU0DCF16sv9LVIfNA8KyQZWYthEcWLpqoB0zVFBrb2PxI8QIV22QkNG4oITMCv/Xjf7P+pTa6iWWSLdPcR2tQVfkHsdWWJvtLcrLkI7i+sWjQOW8tgV8QAcQr5JcxEjSgb3X1J3R1EEVHsPAqQcdpUB7eQ7T9SbIaIpTXw05Tant42GMgALVx2J5TAzqLPdaVaUlKVRoN26eVthYhY9qKbskXkXZp/0Sa/RxXoVHt1jMyZFicMzp5w5yC3DZd9gTtsZOrn21NS1QAVh6twB2bxtf7EHjpS5AyvhaF9qbbGkZtUh4IhFSOpd6bMGZLZqQMcH+Ih9b+jv0j3cLBLY0Bzsj4u5yLvoqhOBcxLoVnW3N3x248y3ZUWkO7hPwP+Lo5FOX/cmK9VHvn5ZhNWNNO9xv0LYSzhqnAvVyTgvAGLDTrZbnp36Q+JkqlhrhFQoQkXRQ2HHNU5CC+o59OL0RnshJg4UUed1ETmOPCJmcPZdKNvfUiW1PUB2AwDeWhRyN6wjwzreioSN6qHrxctXpEQohTwzGeG+rgG0tj9V3yHn1Er1j0pR6S9VJBkaQ0qnaInSthxSC5MkXTKXFmW8YfHQqXKmQcQ==
+    password: AgB+i/mSHnQJnBpRu1cGwKzqrqoSzKfbGkxWTv57ozmiVkEendzudwKu+3MJQh9fHrBwUa0Cu2OqIzGqMQIwDKC5+LDiYAnDOfacu/VBX6mWVABIeg8fqU/PRqym/sGxJtcmwPdo8H8zJm+/vyPpLv4dkYYjHFkAhF3QShq1qMhfeaB/vd6ZNjQEfvCWX14V2F/RTq8skuwQkVQJoz9OsaF+KiTmKC7R1aeZaTUUCFIWGGIq9V2k3O7VAITGJanAT5IYo+epQf2HLsC2xyIUs9prk1rF0yUishgc2bsb4joPULl/G2VUgafH9SKQ37TFqZi2z20gVutrkLyuCMk25tW7m+z4+YCC/dJ9aW/31sFUwSnVhdYh6gwsnNP5GzSguAoOq+6izVD8hV2QzfdIYPrIZyADI7HY9o4LK8YuRS5KgJdaCU3kWYY+tVTSvkGFCWu5q/pBihBG2bN83asTHZcnkocMEvCaTsbPq2CN8/WCRZJs84M6CEzCioNmuGAmUU+fEF/MVEZtTI+6yCrJkOEHdVywtdLufNPGFut97XF+YvJZ1UZ6AW546JGmlmEMFukNHi1XDBm/mWL8e1H6xwLe6I9rwL6YTDrji3IixdERS+a6tq2vcksU5EjW9x9WYt6ctZD/cfhEFAvpssJLCs2vmjNgMhmilPoTppvXyUYnE4bCZuVFRrO/a+ogjXUU2nkqnyKQsA==
+    username: AgCS0tZPssPP8LFwMdTWrXd64oYKb/vmEH8ir+fnc7MgnPkW9kop+hF2X7/KIWTVNe1MAkreW40DxZ6/T4UO7gGTGv52BItcQp87Rr+RMZ5Y720bhivBC33zmDXlWR7TQDMqo733cdcWRnMDvCSvzKV1Mn18iF0VqhOlDZITcyConmKIWcuzzElt90iYtC9o3UIYw6crBD6l9ikrFwU1wH9mL+FdvM8fWG83qkbJGoaqjxj5FEgMXwXFUWVzUqC8dEe8wiHcyq7eeFpyXrF7/WtAiZOwPBy6EG4zFQoRSihR+qme+pZdXP+fHVzGrcBsMxjW4l16R1MmyS9PLpA3r+LdX81K7XHPEctNihrV4U1Dmb2fkANcP2SV95Moftb160WRkfR1cElHxOJs0kaKbZ0P4k74U2UFaZSVIEw85fYm1TE0C5qnpFKktOhOhSKcia+XGG58TQLuosQCYH+P1OZ1LbFfj9O/NBmqWnH2dBIRCC5Ba6b+nNpOQaSztMeEOCSCdYmglS9MmP34zzFjusZ8hAj7ebe25gCo1UCSxYR/xEjrGQsyXY9VB9IPjVO8F7Ms9ex3KITYoib5HcMFCvDUOKl3SOmsJmzf/ahufHXRr/NdPFAoqLU6sehcNAx8LKp/795h3N3PBqol/y9Kv4xbAquz8/qY0giHJfaWcKP/LuVZ81s6MvQlnqn/UWXWzQgNo/RbZw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: postgres-password
+      namespace: gitea

infrastructure/gitea/postgres.yaml

@@ -4,15 +4,15 @@ metadata:
   name: gitea-postgres
 spec:
   instances: 1
-  imageName: ghcr.io/tensorchord/cloudnative-pgvecto.rs:16.2
+  imageName: ghcr.io/cloudnative-pg/postgresql:11
   bootstrap:
     initdb:
-      import:
+      owner: gitea
-        type: monolith
+      database: gitea
-        databases:
+      secret:
+        name: postgres-password
 
 
-    # Persistent storage configuration
   storage:
     size: 10Gi
     pvcTemplate:

infrastructure/pg-ha/README.md

@@ -0,0 +1,3 @@
+# Rebuilding the kluster
+
+When rebuilding the kluster from scratch, the CNPG containers 

infrastructure/traefik-system/kustomization.yaml

@@ -13,6 +13,6 @@ namespace: traefik-system
 helmCharts:
   - name: traefik
     releaseName: traefik
-    version: 31.1.1
+    version: 32.1.1
     valuesFile: values.yaml
     repo: https://traefik.github.io/charts

kluster-deployments/authelia/application.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authelia-application
+  namespace: argocd
+spec:
+  project: infrastructure
+  source:
+    repoURL: git@github.com:moll-re/bootstrap-k3s-infra.git
+    targetRevision: main
+    path: infrastructure/authelia
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: authelia
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

kluster-deployments/authelia/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - application.yaml

kluster-deployments/kustomization.yaml

@@ -21,6 +21,7 @@ resources:
   - external-dns/
   - external-services/
   - prometheus/application.yaml
+  - authelia/
 
   # simple apps
   - adguard/