remoll/k3s-infra
0
0
Fork 0
Code Issues 1 Pull Requests 3 Packages Projects Releases Wiki Activity

Compare commits

base: remoll:feature/matrix
Branches Tags
remoll:main remoll:renovate/loki-6.x remoll:renovate/prometheus-node-exporter-4.x remoll:renovate/prometheus-operator-prometheus-operator-0.x remoll:feature/headscale remoll:feature/media-downloads remoll:feature/crowdsec remoll:feature/matrix remoll:feature/llm remoll:feature/gaming remoll:feature/affine remoll:feature/unified-file-sync
..
compare: remoll:feature/media-downloads
Branches Tags
remoll:renovate/loki-6.x remoll:main remoll:renovate/prometheus-node-exporter-4.x remoll:renovate/prometheus-operator-prometheus-operator-0.x remoll:feature/headscale remoll:feature/media-downloads remoll:feature/crowdsec remoll:feature/matrix remoll:feature/llm remoll:feature/gaming remoll:feature/affine remoll:feature/unified-file-sync

2 Commits
feature/ma ... feature/me

Author SHA1 Message Date
Remy Moll
ac4d2c3fa3 using an alternative stack 2024-12-02 13:46:04 +01:00
Remy Moll
c237e060fd add incomplete deployment 2024-05-13 14:28:37 +02:00
140 changed files with 1789 additions and 1476 deletions
Expand all files Collapse all files

6
.gitmodules vendored Normal file
View File

@@ -0,0 +1,6 @@
[submodule "infrastructure/external-dns/octodns"]
path = infrastructure/external-dns/octodns
url = ssh://git@git.kluster.moll.re:2222/remoll/dns.git
[submodule "apps/monitoring/dashboards"]
path = apps/monitoring/dashboards
url = ssh://git@git.kluster.moll.re:2222/remoll/grafana-dashboards.git

2
apps/adguard/kustomization.yaml
View File

@@ -10,7 +10,7 @@ resources:
images:
- name: adguard/adguardhome
newName: adguard/adguardhome
newTag: v0.107.53
newTag: v0.107.48
namespace: adguard

42
apps/audiobookshelf/deployment.yaml
View File

@@ -1,42 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: audiobookshelf
spec:
replicas: 1
selector:
matchLabels:
app: audiobookshelf
template:
metadata:
labels:
app: audiobookshelf
spec:
containers:
- name: audiobookshelf
image: audiobookshelf
ports:
- containerPort: 80
env:
- name: TZ
value: Europe/Berlin
- name: CONFIG_PATH
value: /data/config
- name: METADATA_PATH
value: /data/metadata
volumeMounts:
- name: data
mountPath: /data
resources:
requests:
cpu: "100m"
memory: "200Mi"
limits:
cpu: "2"
memory: "1Gi"
volumes:
- name: data
persistentVolumeClaim:
claimName: audiobookshelf-data

17
apps/audiobookshelf/ingress.yaml
View File

@@ -1,17 +0,0 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: audiobookshelf-ingressroute
spec:
entryPoints:
- websecure
routes:
- match: Host(`audiobookshelf.kluster.moll.re`)
kind: Rule
services:
- name: audiobookshelf-web
port: 80
tls:
certResolver: default-tls

11
apps/audiobookshelf/pvc.yaml
View File

@@ -1,11 +0,0 @@
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: audiobookshelf-data
spec:
storageClassName: "nfs-client"
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi

10
apps/audiobookshelf/service.yaml
View File

@@ -1,10 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: audiobookshelf-web
spec:
selector:
app: audiobookshelf
ports:
- port: 80
targetPort: 80

18
apps/dendrite/ingress.yaml
View File

@@ -1,18 +0,0 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: dendrite-ingressroute
spec:
entryPoints:
- websecure
routes:
- match: Host(`dendrite.kluster.moll.re`)
kind: Rule
services:
- name: dendrite
port: 8008
# scheme: https
tls:
certResolver: default-tls

16
apps/dendrite/kustomization.yaml
View File

@@ -1,16 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- postgres.yaml
- postgres-user.secret.yaml
- ingress.yaml
namespace: dendrite
helmCharts:
- name: dendrite
releaseName: dendrite
version: 0.13.5
valuesFile: values.yaml
repo: https://matrix-org.github.io/dendrite/

4
apps/dendrite/namespace.yaml
View File

@@ -1,4 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
name: placeholder

25
apps/dendrite/postgres.yaml
View File

@@ -1,25 +0,0 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: dendrite-postgres
spec:
instances: 1
imageName: ghcr.io/cloudnative-pg/postgresql:16.4
bootstrap:
initdb:
owner: dendrite
database: dendrite
secret:
name: postgres-password
# Persistent storage configuration
storage:
size: 2Gi
pvcTemplate:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi
storageClassName: nfs-client
volumeMode: Filesystem

287
apps/dendrite/values.yaml
View File

@@ -1,287 +0,0 @@
# signing key to use
signing_key:
# -- Create a new signing key, if not exists
create: true
persistence:
jetstream:
# -- PVC Storage Request for the jetstream volume
capacity: "1Gi"
# -- The storage class to use for volume claims.
storageClass: "nfs-client"
media:
# -- PVC Storage Request for the media volume
capacity: "1Gi"
# -- The storage class to use for volume claims.
storageClass: "nfs-client"
search:
# -- PVC Storage Request for the search volume
capacity: "1Gi"
# -- The storage class to use for volume claims.
storageClass: "nfs-client"
dendrite_config:
version: 2
global:
# -- **REQUIRED** Servername for this Dendrite deployment.
server_name: "dendrite.kluster.moll.re"
# -- The server name to delegate server-server communications to, with optional port
# e.g. localhost:443
well_known_server_name: ""
# -- The server name to delegate client-server communications to, with optional port
# e.g. localhost:443
well_known_client_name: ""
# -- Lists of domains that the server will trust as identity servers to verify third
# party identifiers such as phone numbers and email addresses.
trusted_third_party_id_servers:
- matrix.org
- vector.im
# -- The paths and expiry timestamps (as a UNIX timestamp in millisecond precision)
# to old signing keys that were formerly in use on this domain name. These
# keys will not be used for federation request or event signing, but will be
# provided to any other homeserver that asks when trying to verify old events.
old_private_keys:
# If the old private key file is available:
# - private_key: old_matrix_key.pem
# expired_at: 1601024554498
# If only the public key (in base64 format) and key ID are known:
# - public_key: mn59Kxfdq9VziYHSBzI7+EDPDcBS2Xl7jeUdiiQcOnM=
# key_id: ed25519:mykeyid
# expired_at: 1601024554498
# -- Disable federation. Dendrite will not be able to make any outbound HTTP requests
# to other servers and the federation API will not be exposed.
disable_federation: false
key_validity_period: 168h0m0s
database:
# -- The connection string for connections to Postgres.
# This will be set automatically if using the Postgres dependency
connection_string: "postgresql://dendrite:supersecretpassword!@dendrite-postgres-rw/dendrite"
# -- Default database maximum open connections
max_open_conns: 90
# -- Default database maximum idle connections
max_idle_conns: 5
# -- Default database maximum lifetime
conn_max_lifetime: -1
jetstream:
# -- Persistent directory to store JetStream streams in.
storage_path: "/data/jetstream"
# -- NATS JetStream server addresses if not using internal NATS.
addresses: []
# -- The prefix for JetStream streams
topic_prefix: "Dendrite"
# -- Keep all data in memory. (**NOTE**: This is overriden in Helm to `false`)
in_memory: false
# -- Disables TLS validation. This should **NOT** be used in production.
disable_tls_validation: true
cache:
# -- The estimated maximum size for the global cache in bytes, or in terabytes,
# gigabytes, megabytes or kilobytes when the appropriate 'tb', 'gb', 'mb' or
# 'kb' suffix is specified. Note that this is not a hard limit, nor is it a
# memory limit for the entire process. A cache that is too small may ultimately
# provide little or no benefit.
max_size_estimated: 1gb
# -- The maximum amount of time that a cache entry can live for in memory before
# it will be evicted and/or refreshed from the database. Lower values result in
# easier admission of new cache entries but may also increase database load in
# comparison to higher values, so adjust conservatively. Higher values may make
# it harder for new items to make it into the cache, e.g. if new rooms suddenly
# become popular.
max_age: 1h
report_stats:
# -- Configures phone-home statistics reporting. These statistics contain the server
# name, number of active users and some information on your deployment config.
# We use this information to understand how Dendrite is being used in the wild.
enabled: false
presence:
# -- Controls whether we receive presence events from other servers
enable_inbound: false
# -- Controls whether we send presence events for our local users to other servers.
# (_May increase CPU/memory usage_)
enable_outbound: false
server_notices:
# -- Server notices allows server admins to send messages to all users on the server.
enabled: false
# -- The local part for the user sending server notices.
local_part: "_server"
# -- The display name for the user sending server notices.
display_name: "Server Alerts"
# -- The avatar URL (as a mxc:// URL) name for the user sending server notices.
avatar_url: ""
# The room name to be used when sending server notices. This room name will
# appear in user clients.
room_name: "Server Alerts"
# prometheus metrics
metrics:
# -- Whether or not Prometheus metrics are enabled.
enabled: false
# HTTP basic authentication to protect access to monitoring.
basic_auth:
# -- HTTP basic authentication username
user: "metrics"
# -- HTTP basic authentication password
password: metrics
app_service_api:
# -- Disable the validation of TLS certificates of appservices. This is
# not recommended in production since it may allow appservice traffic
# to be sent to an insecure endpoint.
disable_tls_validation: false
# -- Appservice config files to load on startup. (**NOTE**: This is overriden by Helm, if a folder `./appservices/` exists)
config_files: []
client_api:
# -- Prevents new users from being able to register on this homeserver, except when
# using the registration shared secret below.
registration_disabled: true
# Prevents new guest accounts from being created. Guest registration is also
# disabled implicitly by setting 'registration_disabled' above.
guests_disabled: true
# -- If set, allows registration by anyone who knows the shared secret, regardless of
# whether registration is otherwise disabled.
registration_shared_secret: "supersecretpassword"
# TURN server information that this homeserver should send to clients.
turn:
# -- Duration for how long users should be considered valid ([see time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more)
turn_user_lifetime: "24h"
turn_uris: []
turn_shared_secret: ""
# -- The TURN username
turn_username: ""
# -- The TURN password
turn_password: ""
rate_limiting:
# -- Enable rate limiting
enabled: true
# -- After how many requests a rate limit should be activated
threshold: 20
# -- Cooloff time in milliseconds
cooloff_ms: 500
# -- Users which should be exempt from rate limiting
exempt_user_ids:
federation_api:
# -- Federation failure threshold. How many consecutive failures that we should
# tolerate when sending federation requests to a specific server. The backoff
# is 2**x seconds, so 1 = 2 seconds, 2 = 4 seconds, 3 = 8 seconds, etc.
# The default value is 16 if not specified, which is circa 18 hours.
send_max_retries: 16
# -- Disable TLS validation. This should **NOT** be used in production.
disable_tls_validation: false
prefer_direct_fetch: false
# -- Prevents Dendrite from keeping HTTP connections
# open for reuse for future requests. Connections will be closed quicker
# but we may spend more time on TLS handshakes instead.
disable_http_keepalives: false
# -- Perspective keyservers, to use as a backup when direct key fetch
# requests don't succeed.
# @default -- See value.yaml
key_perspectives:
- server_name: matrix.org
keys:
- key_id: ed25519:auto
public_key: Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw
- key_id: ed25519:a_RXGa
public_key: l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ
media_api:
# -- The path to store media files (e.g. avatars) in
base_path: "/data/media_store"
# -- The max file size for uploaded media files
max_file_size_bytes: 10485760
# Whether to dynamically generate thumbnails if needed.
dynamic_thumbnails: false
# -- The maximum number of simultaneous thumbnail generators to run.
max_thumbnail_generators: 10
# -- A list of thumbnail sizes to be generated for media content.
# @default -- See value.yaml
thumbnail_sizes:
- width: 32
height: 32
method: crop
- width: 96
height: 96
method: crop
- width: 640
height: 480
method: scale
sync_api:
# -- This option controls which HTTP header to inspect to find the real remote IP
# address of the client. This is likely required if Dendrite is running behind
# a reverse proxy server.
real_ip_header: X-Real-IP
# -- Configuration for the full-text search engine.
search:
# -- Whether fulltext search is enabled.
enabled: true
# -- The path to store the search index in.
index_path: "/data/search"
# -- The language most likely to be used on the server - used when indexing, to
# ensure the returned results match expectations. A full list of possible languages
# can be found [here](https://github.com/matrix-org/dendrite/blob/76db8e90defdfb9e61f6caea8a312c5d60bcc005/internal/fulltext/bleve.go#L25-L46)
language: "en"
user_api:
# -- bcrypt cost to use when hashing passwords.
# (ranges from 4-31; 4 being least secure, 31 being most secure; _NOTE: Using a too high value can cause clients to timeout and uses more CPU._)
bcrypt_cost: 10
# -- OpenID Token lifetime in milliseconds.
openid_token_lifetime_ms: 3600000
# - Disable TLS validation when hitting push gateways. This should **NOT** be used in production.
push_gateway_disable_tls_validation: false
# -- Rooms to join users to after registration
auto_join_rooms: []
# -- Default logging configuration
logging:
- type: std
level: info
postgresql:
# -- Enable and configure postgres as the database for dendrite.
# @default -- See value.yaml
enabled: false
ingress:
# -- Create an ingress for the deployment
enabled: false
service:
type: ClusterIP
port: 8008
prometheus:
servicemonitor:
# -- Enable ServiceMonitor for Prometheus-Operator for scrape metric-endpoint
enabled: false
# -- Extra Labels on ServiceMonitor for selector of Prometheus Instance
labels: {}
rules:
# -- Enable PrometheusRules for Prometheus-Operator for setup alerting
enabled: false
# -- Extra Labels on PrometheusRules for selector of Prometheus Instance
labels: {}
# -- additional alertrules (no default alertrules are provided)
additionalRules: []

2
apps/files/kustomization.yaml
View File

@@ -13,4 +13,4 @@ namespace: files
images:
- name: ocis
newName: owncloud/ocis
newTag: "5.0.8"
newTag: "5.0.3"

4
apps/files/ocis-config.sealedsecret.yaml
View File

File diff suppressed because one or more lines are too long

2
apps/finance/kustomization.yaml
View File

@@ -13,4 +13,4 @@ resources:
images:
- name: actualbudget
newName: actualbudget/actual-server
newTag: 24.10.1
newTag: 24.5.0

2
apps/homeassistant/kustomization.yaml
View File

@@ -15,4 +15,4 @@ resources:
images:
- name: homeassistant/home-assistant
newName: homeassistant/home-assistant
newTag: "2024.10"
newTag: "2024.5"

2
apps/homeassistant/service.yaml
View File

@@ -2,8 +2,6 @@ apiVersion: v1
kind: Service
metadata:
name: homeassistant-web
labels:
app: homeassistant
spec:
selector:
app: homeassistant

98
apps/homepage/configmap.yaml Normal file
View File

@@ -0,0 +1,98 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: config
labels:
app.kubernetes.io/name: homepage
data:
kubernetes.yaml: "" #|
# mode: cluster
settings.yaml: |
title: "Homepage"
background: https://images.unsplash.com/photo-1547327132-5d20850c62b5?q=80&w=3870&auto=format&fit=crop
cardBlur: sm
#settings.yaml: |
# providers:
# longhorn:
# url: https://longhorn.my.network
custom.css: ""
custom.js: ""
bookmarks.yaml: |
- Developer:
- Github:
- abbr: GH
href: https://github.com/moll-re
services.yaml: |
- Media:
- Jellyfin backend:
href: https://media-backend.kluster.moll.re
ping: media-backend.kluster.moll.re
- Jellyfin vue:
href: https://media.kluster.moll.re
ping: media.kluster.moll.re
- Immich:
href: https://immich.kluster.moll.re
ping: immich.kluster.moll.re
- Productivity:
- OwnCloud:
href: https://ocis.kluster.moll.re
ping: ocis.kluster.moll.re
- ToDo:
href: https://todos.kluster.moll.re
ping: todos.kluster.moll.re
- Finance:
href: https://finance.kluster.moll.re
ping: finance.kluster.moll.re
- Home:
- Home Assistant:
href: https://home.kluster.moll.re
ping: home.kluster.moll.re
- Grafana:
href: https://grafana.kluster.moll.re
ping: grafana.kluster.moll.re
- Recipes:
href: https://recipes.kluster.moll.re
ping: recipes.kluster.moll.re
- Infra:
- Gitea:
href: https://git.kluster.moll.re
ping: git.kluster.moll.re
- ArgoCD:
href: https://argocd.kluster.moll.re
ping: argocd.kluster.moll.re
widgets.yaml: |
# - kubernetes:
# cluster:
# show: true
# cpu: true
# memory: true
# showLabel: true
# label: "cluster"
# nodes:
# show: true
# cpu: true
# memory: true
# showLabel: true
- search:
provider: duckduckgo
- openmeteo:
label: Zürich # optional
latitude: 47.24236
longitude: 8.30439
units: metric # or imperial
cache: 30 # Time in minutes to cache API responses, to stay within limits
format: # optional, Intl.NumberFormat options
maximumFractionDigits: 1
- datetime:
locale: de
format:
dateStyle: long
timeStyle: short
- adguard:
url: http://adguard-home-web.adguard-home:3000
docker.yaml: ""

64
apps/homepage/deployment.yaml Normal file
View File

@@ -0,0 +1,64 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: homepage
labels:
app.kubernetes.io/name: homepage
spec:
revisionHistoryLimit: 3
replicas: 1
strategy:
type: RollingUpdate
selector:
matchLabels:
app.kubernetes.io/name: homepage
template:
metadata:
labels:
app.kubernetes.io/name: homepage
spec:
# serviceAccountName: homepage
# automountServiceAccountToken: true
dnsPolicy: ClusterFirst
# enableServiceLinks: true
containers:
- name: homepage
image: homepage
imagePullPolicy: Always
ports:
- name: http
containerPort: 3000
protocol: TCP
volumeMounts:
- mountPath: /app/config/custom.js
name: config
subPath: custom.js
- mountPath: /app/config/custom.css
name: config
subPath: custom.css
- mountPath: /app/config/bookmarks.yaml
name: config
subPath: bookmarks.yaml
- mountPath: /app/config/docker.yaml
name: config
subPath: docker.yaml
- mountPath: /app/config/kubernetes.yaml
name: config
subPath: kubernetes.yaml
- mountPath: /app/config/services.yaml
name: config
subPath: services.yaml
- mountPath: /app/config/settings.yaml
name: config
subPath: settings.yaml
- mountPath: /app/config/widgets.yaml
name: config
subPath: widgets.yaml
- mountPath: /app/config/logs
name: logs
volumes:
- name: config
configMap:
name: config
- name: logs
emptyDir: {}

9
infrastructure/authelia/ingress.yaml → apps/homepage/ingress.yaml
View File

@@ -1,17 +1,16 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: authelia-ingressroute
name: homepage-ingressroute
spec:
entryPoints:
- websecure
routes:
- match: Host(`auth.kluster.moll.re`)
- match: Host(`start.kluster.moll.re`)
kind: Rule
services:
- name: authelia
port: 80
- name: homepage-web
port: 3000
tls:
certResolver: default-tls

12
apps/audiobookshelf/kustomization.yaml → apps/homepage/kustomization.yaml
View File

@@ -1,15 +1,17 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: homepage
resources:
- namespace.yaml
- pvc.yaml
- deployment.yaml
- service.yaml
- configmap.yaml
- ingress.yaml
namespace: audiobookshelf
images:
- name: audiobookshelf
newName: ghcr.io/advplyr/audiobookshelf
newTag: "2.15.0"
- name: homepage
newName: ghcr.io/gethomepage/homepage
newTag: v0.8.13

0
apps/audiobookshelf/namespace.yaml → apps/homepage/namespace.yaml
View File

15
apps/homepage/service.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: homepage-web
labels:
app.kubernetes.io/name: homepage
spec:
type: ClusterIP
ports:
- port: 3000
targetPort: http
protocol: TCP
name: http
selector:
app.kubernetes.io/name: homepage

25
apps/immich/kustomization.yaml
View File

@@ -1,33 +1,24 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- ingress.yaml
- pvc.yaml
- postgres.yaml
- postgres.sealedsecret.yaml
- namespace.yaml
- ingress.yaml
- pvc.yaml
- postgres.yaml
- postgres.sealedsecret.yaml
namespace: immich
helmCharts:
- name: immich
releaseName: immich
version: 0.8.1
version: 0.6.0
valuesFile: values.yaml
repo: https://immich-app.github.io/immich-charts
images:
- name: ghcr.io/immich-app/immich-machine-learning
newTag: v1.117.0
newTag: v1.103.1
- name: ghcr.io/immich-app/immich-server
newTag: v1.117.0
patches:
- path: patch-redis-pvc.yaml
target:
kind: StatefulSet
name: immich-redis-master
newTag: v1.103.1

17
apps/immich/patch-redis-pvc.yaml
View File

@@ -1,17 +0,0 @@
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: immich-redis-master
spec:
volumeClaimTemplates:
- apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: redis-data
spec:
storageClassName: nfs-client
accessModes:
- ReadWriteMany
resources:
requests:
storage: 2Gi

16
apps/immich/postgres.yaml
View File

@@ -12,24 +12,18 @@ spec:
secret:
name: postgres-password
# Enable the VECTORS extension
postInitSQL:
- CREATE EXTENSION IF NOT EXISTS "vectors";
postgresql:
shared_preload_libraries:
- "vectors.so"
# Persistent storage configuration
storage:
size: 2Gi
size: 1Gi
pvcTemplate:
accessModes:
- ReadWriteOnce
storageClassName: ""
resources:
requests:
storage: 2Gi
storageClassName: nfs-client
volumeMode: Filesystem
storage: "1Gi"
volumeName: immich-postgres
monitoring:
enablePodMonitor: true

35
apps/immich/pvc.yaml
View File

@@ -1,11 +1,40 @@
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: immich-nfs
spec:
capacity:
storage: "50Gi"
accessModes:
- ReadWriteOnce
nfs:
path: /kluster/immich
server: 192.168.1.157
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data
name: immich-nfs
spec:
storageClassName: "nfs-client"
storageClassName: ""
accessModes:
- ReadWriteOnce
resources:
requests:
storage: "100Gi"
storage: "50Gi"
volumeName: immich-nfs
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: immich-postgres
spec:
capacity:
storage: "1Gi"
accessModes:
- ReadWriteOnce
nfs:
path: /kluster/immich-postgres
server: 192.168.1.157
# later used by cnpg

17
apps/immich/values.yaml
View File

@@ -22,19 +22,16 @@ env:
secretKeyRef:
name: postgres-password
key: password
IMMICH_WEB_URL: '{{ printf "http://%s-web:3000" .Release.Name }}'
IMMICH_MACHINE_LEARNING_URL: '{{ printf "http://%s-machine-learning:3003" .Release.Name }}'
IMMICH_METRICS: true
immich:
metrics:
# Enabling this will create the service monitors needed to monitor immich with the prometheus operator
enabled: true
persistence:
# Main data store for all photos shared between different components.
library:
# Automatically creating the library volume is not supported by this chart
# You have to specify an existing PVC to use
existingClaim: data
existingClaim: immich-nfs
# Dependencies
@@ -55,6 +52,16 @@ server:
main:
enabled: false
microservices:
enabled: true
persistence:
geodata-cache:
enabled: true
size: 1Gi
# Optional: Set this to pvc to avoid downloading the geodata every start.
type: emptyDir
accessMode: ReadWriteMany
machine-learning:
enabled: true
persistence:

47
apps/media-downloads/jackett.deployment.yaml Normal file
View File

@@ -0,0 +1,47 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: jackett
spec:
selector:
matchLabels:
app: jackett
template:
metadata:
labels:
app: jackett
spec:
containers:
- name: jackett
image: jackett
resources:
limits:
memory: "128Mi"
cpu: "500m"
ports:
- containerPort: 9117
volumeMounts:
- name: media
mountPath: /media
- name: config
mountPath: /config
volumes:
- name: media
persistentVolumeClaim:
claimName: media-downloads
- name: config
persistentVolumeClaim:
claimName: transmission-config
---
apiVersion: v1
kind: Service
metadata:
name: jackett
spec:
selector:
app: jackett
ports:
- protocol: TCP
port: 9117
targetPort: 9117
type: ClusterIP

50
apps/media-downloads/kustomization.yaml Normal file
View File

@@ -0,0 +1,50 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: media-downloads
resources:
- namespace.yaml
- pvc.yaml
- transmission.deployment.yaml
- radarr.deployment.yaml
- jackett.deployment.yaml
images:
- name: transmission
newName: haugene/transmission-openvpn
newTag: 5.3.1
- name: jackett
newName: lscr.io/linuxserver/jackett
newTag: latest
- name: radarr
newName: lscr.io/linuxserver/radarr
newTag: 5.4.6
---
# 2nd version
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: media-downloads
resources:
- namespace.yaml
- pvc.yaml
- qbittorrent.deployment.yaml
- qbittorrent.service.yaml
- qbittorrent.configmap.yaml
- radarr.deployment.yaml
- radarr.service.yaml
- radarr.configmap.yaml
- openvpn.secret.yaml
images:
- name: qbittorrent
newName: binhex/arch-qbittorrentvpn
newTag: 5.0.1-1-02
- name: radarr
newName: hotio/radarr
newTag: release-5.14.0.9383

6
apps/media-downloads/namespace.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: v1
kind: Namespace
metadata:
name: placeholder
labels:
pod-security.kubernetes.io/enforce: privileged

35
apps/media-downloads/pvc.yaml Normal file
View File

@@ -0,0 +1,35 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: radarr-config
spec:
storageClassName: "nfs-client"
accessModes:
- ReadWriteOnce
resources:
requests:
storage: "1Gi"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: qbittorrent-config
spec:
storageClassName: "nfs-client"
accessModes:
- ReadWriteOnce
resources:
requests:
storage: "1Gi"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data
spec:
storageClassName: "nfs-client"
accessModes:
- ReadWriteOnce
resources:
requests:
storage: "10Gi"

15
apps/media-downloads/qbittorrent.configmap.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: qbittorrent
labels:
app: qbittorrent
data:
VPN_ENABLED: yes
VPN_USER: vpnbook
VPN_PASS: e83zu76
VPN_PROV: custom
VPN_CLIENT: openvpn
LAN_NETWORK: 10.244.0.0/24,10.9.0.0/24
WEBUI_PORT: "8080"
ENABLE_STARTUP_SCRIPTS: no

40
apps/media-downloads/qbittorrent.deployment.yaml Normal file
View File

@@ -0,0 +1,40 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: qbittorrent
spec:
selector:
matchLabels:
app: qbittorrent
replicas: 1
template:
metadata:
labels:
app: qbittorrent
spec:
containers:
- name: qbittorrent
image: qbittorrent
ports:
- containerPort: 8080
envFrom:
- configMapRef:
name: qbittorrent
volumeMounts:
- name: data
mountPath: /data
- name: config
mountPath: /config
securityContext:
capabilities:
add:
- NET_ADMIN
volumes:
- name: data
persistentVolumeClaim:
claimName: data
- name: config
persistentVolumeClaim:
claimName: qbittorrent-config

12
apps/media-downloads/qbittorrent.service.yaml Normal file
View File

@@ -0,0 +1,12 @@
kind: Service
apiVersion: v1
metadata:
name: qbittorrent
spec:
selector:
app: qbittorrent
type: ClusterIP
ports:
- name: qbittorrent
port: 8080
targetPort: 8080

20
apps/media-downloads/radarr.configmap.yaml Normal file
View File

@@ -0,0 +1,20 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: radarr
labels:
app: radarr
data:
# VPN_ENABLED: "true"
# VPN_CONF: "wg0"
# VPN_PROVIDER: "generic"
# VPN_LAN_NETWORK: "192.168.1.0/24"
# VPN_LAN_LEAK_ENABLED: "false"
# VPN_EXPOSE_PORTS_ON_LAN: ""
# VPN_AUTO_PORT_FORWARD: "false"
# VPN_AUTO_PORT_FORWARD_TO_PORTS: ""
# VPN_KEEP_LOCAL_DNS: "false"
# VPN_FIREWALL_TYPE: "auto"
# VPN_HEALTHCHECK_ENABLED: "false"
# PRIVOXY_ENABLED: "false"
# UNBOUND_ENABLED: "false"

34
apps/media-downloads/radarr.deployment.yaml Normal file
View File

@@ -0,0 +1,34 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: radarr
spec:
selector:
matchLabels:
app: radarr
replicas: 1
template:
metadata:
labels:
app: radarr
spec:
containers:
- name: radarr
image: radarr
ports:
- containerPort: 7878
envFrom:
- configMapRef:
name: radarr
volumeMounts:
- name: data
mountPath: /data
- name: config
mountPath: /config
volumes:
- name: data
persistentVolumeClaim:
claimName: data
- name: config
persistentVolumeClaim:
claimName: radarr-config

12
apps/media-downloads/radarr.service.yaml Normal file
View File

@@ -0,0 +1,12 @@
kind: Service
apiVersion: v1
metadata:
name: radarr
spec:
selector:
app: radarr
type: ClusterIP
ports:
- name: radarr
port: 7878
targetPort: 7878

81
apps/media-downloads/transmission.deployment.yaml Normal file
View File

@@ -0,0 +1,81 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: transmission
spec:
selector:
matchLabels:
app: transmission
template:
metadata:
labels:
app: transmission
spec:
containers:
- name: transmission
image: transmission
resources:
limits:
memory: "128Mi"
cpu: "500m"
ports:
- containerPort: 9091
env:
- name: OPENVPN_PROVIDER
value: PROTONVPN
- name: LOCAL_NETWORK
value: 10.42.0.0/16
- name: OPENVPN_CONFIG
valueFrom:
secretKeyRef:
name: protonvpn
key: country
- name: OPENVPN_USERNAME
valueFrom:
secretKeyRef:
name: protonvpn
key: username
- name: OPENVPN_PASSWORD
valueFrom:
secretKeyRef:
name: protonvpn
key: password
volumeMounts:
- name: media
mountPath: /data
- name: config
mountPath: /config
securityContext:
capabilities:
add: ["NET_ADMIN"]
volumes:
- name: media
persistentVolumeClaim:
claimName: media-downloads
- name: config
persistentVolumeClaim:
claimName: transmission-config
---
apiVersion: v1
kind: Service
metadata:
name: transmission
spec:
selector:
app: transmission
ports:
- protocol: TCP
port: 9091
targetPort: 9091
type: ClusterIP
---
apiVersion: v1
kind: Secret
metadata:
name: protonvpn
type: Opaque
stringData:
country: at.protonvpn.udp,fr.protonvpn.udp,pl.protonvpn.udp,ch.protonvpn.udp
username: VOYkNuZs5PHjeB8w
password: WvKCOPijcXKOqcL5d7zjXzOPToS4zPid

21
apps/media/ingress.yaml
View File

@@ -1,5 +1,24 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: jellyfin-vue-ingress
namespace: media
spec:
entryPoints:
- websecure
routes:
- match: Host(`media.kluster.moll.re`)
middlewares:
- name: jellyfin-websocket
kind: Rule
services:
- name: jellyfin-web
port: 80
tls:
certResolver: default-tls
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: jellyfin-backend-ingress
namespace: media
@@ -7,7 +26,7 @@ spec:
entryPoints:
- websecure
routes:
- match: Host(`media.kluster.moll.re`) && !Path(`/metrics`)
- match: Host(`media-backend.kluster.moll.re`) && !Path(`/metrics`)
middlewares:
- name: jellyfin-websocket
- name: jellyfin-server-headers

17
apps/media/jellyfin.servicemonitor.yaml Normal file
View File

@@ -0,0 +1,17 @@
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: jellyfin
labels:
metrics: prometheus
spec:
selector:
matchLabels:
app: jellyfin-server-service
endpoints:
- path: /metrics
targetPort: jellyfin
# this exposes metrics on port 8096 as enabled in the jellyfin config
# https://jellyfin.org/docs/general/networking/monitoring/
# the metrics are available at /metrics but blocked by the ingress

11
apps/media/kustomization.yaml
View File

@@ -5,11 +5,16 @@ namespace: media
resources:
- namespace.yaml
- pvc.yaml
- deployment.yaml
- service.yaml
- server.deployment.yaml
- server.service.yaml
- web.deployment.yaml
- web.service.yaml
- ingress.yaml
images:
- name: jellyfin/jellyfin
newName: jellyfin/jellyfin
newTag: 10.9.11
newTag: 10.9.0
- name: ghcr.io/jellyfin/jellyfin-vue
newName: ghcr.io/jellyfin/jellyfin-vue
newTag: stable-rc.0.3.1

3
apps/media/deployment.yaml → apps/media/server.deployment.yaml
View File

@@ -18,9 +18,6 @@ spec:
limits:
memory: "2Gi"
cpu: "2"
requests:
memory: "128Mi"
cpu: "250m"
ports:
- containerPort: 8096
name: jellyfin

0
apps/media/service.yaml → apps/media/server.service.yaml
View File

27
apps/media/web.deployment.yaml Normal file
View File

@@ -0,0 +1,27 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: jellyfin-web
spec:
selector:
matchLabels:
app: jellyfin-web
template:
metadata:
labels:
app: jellyfin-web
spec:
containers:
- name: jellyfin-web
image: ghcr.io/jellyfin/jellyfin-vue
resources:
limits:
memory: "128Mi"
cpu: "30m"
ports:
- containerPort: 80
env:
- name: TZ
value: Europe/Berlin
- name: DEFAULT_SERVERS
value: "https://media-backend.kluster.moll.re"

12
apps/media/web.service.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: Service
metadata:
name: jellyfin-web
spec:
selector:
app: jellyfin-web
ports:
- protocol: TCP
port: 80
targetPort: 80

16
apps/minecraft/curseforge.sealedsecret.yaml
View File

@@ -1,16 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: curseforge-api
namespace: minecraft
spec:
encryptedData:
key: AgBYeAiejdmxDBorvgnxQX5YvUhR3NId2vfWybMKlc27e6D/bKglLNyZMk70xSnFAPjcDmZ20mYjFPYvDOr9T6IU/REJ8QlzoKAn0xW779R4SkIxRToT+dJv+OM2avgQ9uqp7vja29xeXMjYAnQML+QGZKcrT8mE04G/Ty8rdUiv3yUXK5HFAR3SUF35aVLdlthLjpRkv1s0R7GAP4L2pNzBJNV3i37viceUSSjU0zpOa23fsQOkPAs67AIukAJBqh/hyF/hR9H1GeYZNTI3OcHcvC2iNk/XGstvv0Zy6ApzoebsfWGdsbVn+QUI0EBw+mSTPqpl71cbkz0v4S4XAVndosxWpe6AIgm5MBTU0FXIyGyoFDe1aMPq8BXiQikYVwB48oVNh9KF0xXX5AOG0whB/FEsL3OJsiNQvQ3R/Hru43JBn64oxjVtLfM3E7u8v/xr1VQahX8dylDmb4s5EV01U6O4y19Ou4td1eEMlhpJb0fBPDRUYuWxZAEDGmp+U4tAakyPed11VkcZPPn9fKAAcv8sGs3TYAbbF18hqsBnv2Wd+i7ZEvKwmdmfR/T0r1TJGsvKI7jaW0QtH256XrSxQp7a52qMKMVQWOSKw2k27t/IkRhxT2Prw4GfJvaVr4RozUaBf3LV/hfDWlDfmM2zg3X9W8HkzjotGg021OLxsa0Wzmhffvb8h4bvZwxeq3U1xaJocqXui7z0rT2pF4z3wYHR/lPtexHcOA2M8gfBGKb1rBKh+kW+N+/ZfVLNI0mokg5vrTO2nR2rb4c=
template:
metadata:
creationTimestamp: null
name: curseforge-api
namespace: minecraft
type: Opaque

39
apps/minecraft/job.yaml → apps/minecraft/deployment.yaml
View File

@@ -1,41 +1,43 @@
apiVersion: batch/v1
kind: Job
apiVersion: apps/v1
kind: Deployment
metadata:
name: start-server
name: minecraft-server
spec:
selector:
matchLabels:
app: minecraft-server
template:
metadata:
labels:
app: minecraft-server
spec:
restartPolicy: OnFailure
containers:
- name: minecraft-server
image: minecraft
resources:
limits:
memory: "10000Mi"
cpu: "5"
memory: "4000Mi"
cpu: "2500m"
requests:
memory: "1500Mi"
memory: "1000Mi"
cpu: "500m"
ports:
- containerPort: 25565
env:
- name: EULA
value: "TRUE"
- name: TYPE
value: "AUTO_CURSEFORGE"
- name: CF_API_KEY
valueFrom:
secretKeyRef:
name: curseforge-api
key: key
- name: CF_PAGE_URL
value: "https://www.curseforge.com/minecraft/modpacks/vault-hunters-1-18-2/files/5413446"
- name: MODPACK
value: "https://www.curseforge.com/api/v1/mods/711537/files/5076228/download"
- name: VERSION
value: "1.18.2"
# - name: VERSION
# value: "1.16.5"
# - name: MODPACK
# value: "https://mediafilez.forgecdn.net/files/3602/5/VaultHunters-OfficialModpack-1.12.1-Server.zip"
- name: INIT_MEMORY
value: "1G"
- name: MAX_MEMORY
value: "8G"
value: "3G"
- name: MOTD
value: "VaultHunters baby!"
- name: ENABLE_RCON
@@ -44,9 +46,6 @@ spec:
value: "true"
- name: ONLINE_MODE
value: "true"
- name: ENABLE_AUTOSTOP
value: "true"
volumeMounts:
- name: minecraft-data
mountPath: /data

4
apps/minecraft/kustomization.yaml
View File

@@ -6,10 +6,8 @@ namespace: minecraft
resources:
- namespace.yaml
- pvc.yaml
- job.yaml
- deployment.yaml
- service.yaml
- curseforge.sealedsecret.yaml
images:
- name: minecraft

1
apps/monitoring/dashboards Submodule

Submodule apps/monitoring/dashboards added at 984a69be34

4
apps/monitoring/grafana-admin.sealedsecret.yaml
View File

@@ -7,8 +7,8 @@ metadata:
namespace: monitoring
spec:
encryptedData:
password: AgAwMLnsYN1y8JQSqgGQbNG/8jKensTDsEw6ogITdkhDRlJcg8HQ5t7a6xLzNCrLHLJiQW8YOoyLT4lvFkBRMOa2EYcrDvBiRD0PjygWLIscKa7dA+jpAUf/icD9zsiDnTym2yf+VUANcmEgE6DiNvlcsrcmYqiR4pKVUTDlKPNOjOpTJ3nXETb3/sbt69E0JSGwtkvusYQSXKLU9KLbciihv+ycdkdlC9xy9myd4+vYZYXSh/eAvyZeb/hsmdSX7yaASmupMvet6Qsdt99PNzFQxtbQH+LQvYalVZ8bjWZQvCN/p0bA4H15otKBfe8rtEwVthgvyEvo6TK0Mg0pFY/b3AOGFmImnT3rDmgG6S8KTZH0Jce17ksFqvELQmHjqHuYpQsPDl44glM8kWRJ9Mf/Z424LRwZlJNVcOkuVl4qFqPUjzd2rWIyF0RaD0BE012C0ThJxKn2l17lVJbNtdUiR3qNpW01ot2m0CgKd2kXbjDmgRgAll4WgrukfCIn9ZnE0gVCFLJuK3MOQAaipFYy/bDO0izwl9T8nldgcI8OfiC3NTk2O+Es5jJRXu0oJGaC3HrTB7wXiwOoELvAsxLTPxKBiN9mCHCMtZX0PEtrio0dFRQ6Pi5xPng0KVT0I9dvGNsPdhPETNOB913WEvbgP8Gt3cj016nCzk51eUsYbXPpNL2B4kmbIhecqW/8kwKQPwYjVlBSXj3NxjzwMY6PvOl1
user: AgBqmjCYGMqy5zBE+vhtsynOvhWdHWDJDyl1D+laBtLjXTJwzRbNTdunHYo1ekwyqQ6Cr5pi4YMiLxAl1LIHF+Lfsp2QlY+ResAGzp9WgSBtNQDX3EmLDQofeWxMUDdMtMsE9wiKLCfNGDkRDsGquXTz+YFq03m1vH9cB8Bp+1ClWOTui+/Ce0MZlWsJZX1W8WXH7XTirtwUo0s53pc4AplUUH97ZEK3KSIxWa3gLCn0sAPDDLPX+JVA2xtpMq1XuVFiFifjzEtG2h0dejiF35FtSAR+rR4YmEfimk3QpRDfOqV5QUxvjCG+dTV49upSevF2mvbHW+o+lB6vEc6l9cZXvlbnMdaep3NmOsJcJ8wQIdFpFK4iVzFOTKSEbzLPlZ/J+sjS5vDXsfthorIO2faMA1iIf+I663zNxQU5btaK4TNYOZQlrFVjAmioRLkDhGZ6tDUPX/zMv+Crt+0HCwyEyhmvFZckDvezTZrxARSXXMKBVcvjHCyUNkz7ubZRiMU0PGM7fYuHr659e+XMRvj+LFA68ZaEIzCQpCFJenWWYAXgUdRG4LQ1LP2MwvRHpkOYSoRkHIpX7jOfhX82A60h/ta/CdbWifqNyL9OecvE3FKsZu/Kr0taw9W6nm6FBhQLgFkOnFrqp9dWnxfHruXuDBgcn0iE8nR7Ht2zS7hfQPeR4a3Y0xK3Plqbzdrb9HKnWQQhf14=
password: AgBe8isrCWd5MuaQq5CpA+P3fDizCCDo23BVauaBJLuMRIYbVwpfahaJW7Ocj3LTXwdeVVPBrOk2D6vESUXu6I0EWc3y/NFN4ZezScxMcjmeaAb+z1zWwdH0FynTPJYOxv1fis1FDTkXDmGy3FXo5NDK9ET899TtulKFkh7UqSxdrRWbD3pegJgqKGPIqDCTAxZN/ssiccfWGS4lHqQBJkXn8DeampcKwjOCvgaBdilF03GoSfpgsqa2Iw2SfTDEobWBWVMMK/RB3/Oi/YJkGwMW3ECUxvTDam8gb0RFA1xjWXoYTLVVP5fK7q7x63ns51HebloxAP1GBrt138N/iDrfbGfjNP8Lx0NFl5y5bTgYN/z8DVTOFf90xxWe+YYERdwllg0Ci1JLNbA+NszXTD4L/HC7a8XuBfjRzxMTeymNjR76jzfPkH6v1EvesOduTfSrahPgS0qS+eGOier1rHxj3EBRhOScY1ut5Bq4oJMNId9nMVbVa6xyq2HyxuJHXV+j6h5FGHmEXn9gIR7wGp8RhtPhKgVGLrHcbHZ5Th2E7eomz1T2NK/ezNP8ZhcwOj/lyGywlW0vhU798zpWhMf57k2OPeuMlfs8Y8y74epBdyBjsrMR4EDctF8RZR3vraxENiMJ6kk1gqKj04ir6HwL7blqwiybIFFnJrp2j7MzgjS4SQ687qMX5Zf5XT03aEE+9W9Epy73tT7zVQKdENCQlcm5
user: AgAdiOivMn0d+nYjYycMZz9QSiS/9QqwHPJQMHkE7/IOou+CJtBknlETNtdv84KZgBQTucufYqu3LR3djOBpdnQsYbIXDxPFgRZQ11pwu/sO2EGifDk218yyzzfZMvx1FL7JL4LI1rKoiHycZowCwsAjEtlICVOOYv1/Plki+6MHXiAGG4r/yUhugGx3VLLX+Poq8oaTeHndgSsFXJege8SfgYR4TsC7pQgsM1UQEFncGIhJYTD2ashmUxFJ+7CJjHqPR0lFRrZXmFvPwTYTCMT+tnSHnCFWtTht8cEi1NxA4kD/eKEX0rOol15EUZnFUws2WqWI634TbyGwZ7km/Yw4XoDxiQR4ar6ulkqb/djcc3cWDYE7PF1m1c+r3iog85S5CSfZ5EvdCHHrbPN9uO2gmoRQWiR5qI70YMxBSnkeLZWN05O1vUuopdXFDTafY7YskxLEdIGHGqFUpUrJZOvBB0zNBdHGgYxFzb5pNmMCC5LPlOuoKjV4yskh9Tgovz06aAvsPxn2WWx6NOJambeziKB5OmSKvPsFofViyGBekVAWSWtt9yJe6lu5OKpBEiA6xhGhQ4ZryTXu9wvVALuPSIwBFITv85sIxjJb80qhJ51wb12QgzLLcPby0HSanyBI1M4jfsXWpK8gIAbDNO+eD7z3PhD9Y/5hPqYKXZ37Geyq23xiyxG8XDj6cL+Ie6k8XipayI4=
template:
metadata:
creationTimestamp: null

16
apps/monitoring/grafana-auth.sealedsecret.yaml
View File

@@ -1,16 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: grafana-auth
namespace: monitoring
spec:
encryptedData:
client_secret: AgCcKsnS3u2eI+fNVC9hAZ3QRFOHFErAzs5aQgX51CSdJwM03SZUoTyrDi5JPcHUVyS3MbevFH5piMhDTARMI3bLOjYlcwMbpf77JCPa7o95Y9asA/FW3lXicYt3biN9xBXJBz7Ws3fVRtEzyf6DmbGedT9gaX8aPwrUVbP19RdyJiuu76oB1A/jdUkX4K+X6kVvmoP/BWdypk/kdQJrzBNt00DIXF4NHfYey36AuhpBtqYZs4faA/tBXMXLE4RxPNtcHwNfVjnRj3v3qzNufD1fnweJvLq2UfLMrQjoR9XDVnM0zkpautylkI7yrvcoEH7ljnf6b1FMogOEZUfH1BIdqTd/WwrrlCqE58OPfJWthIfN+pQ8LvdHsGo3jc9gXvfXS2cStyhP06eTZ4D79kG+RtDQGOsD/Wpx7EcM6hbB3+dIjcs3wEAIGjpIVtY9JayW8YeRnFApMuhDST1+hscm+LdoGvaSTlAuGzv9BbVrPX/Fo9XKeYHlbG/x71Er+vF8WbW0wUa46MHLvbEy376XIdJDYi+vjl4eqznZ6YhvPbawhoKXT8ZcKUcUAjVcMue/O/jCSPZplbn3vdSCeqPTiqVqDw9PTMIeWFUepgPMxiGpFRAqdwIecFBnYItq0dXoGlFrZpo0S6AECgZjxzUR5EgdkdPlDDs2CN+d9yP7f2S+gmL7AIlQr74NW1GrTGw2x/rD4IJhunh7
template:
metadata:
creationTimestamp: null
name: grafana-auth
namespace: monitoring
type: Opaque

25
apps/monitoring/grafana.pvc.yaml Normal file
View File

@@ -0,0 +1,25 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: grafana-nfs
spec:
capacity:
storage: "1Gi"
accessModes:
- ReadWriteOnce
nfs:
path: /export/kluster/grafana
server: 192.168.1.157
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: grafana-nfs
spec:
storageClassName: ""
accessModes:
- ReadWriteOnce
resources:
requests:
storage: "1Gi"
volumeName: grafana-nfs

26
apps/monitoring/grafana.values.yaml
View File

@@ -16,12 +16,6 @@ serviceMonitor:
##
enabled: false
envValueFrom:
AUTH_GRAFANA_CLIENT_SECRET:
secretKeyRef:
name: grafana-auth
key: client_secret
ingress:
enabled: false
@@ -37,7 +31,7 @@ datasources:
datasources:
- name: Thanos
type: prometheus
url: http://thanos-querier.prometheus.svc:10902
url: http://thanos-querier.prometheus.svc:9090
isDefault: true
- name: Prometheus
type: prometheus
@@ -73,21 +67,3 @@ grafana.ini:
default_theme: dark
unified_alerting:
enabled: false
analytics:
check_for_updates: false
server:
domain: grafana.kluster.moll.re
root_url: https://grafana.kluster.moll.re
auth.generic_oauth:
name: Authelia
enabled: true
allow_sign_up: true
client_id: grafana
client_secret: ${AUTH_GRAFANA_CLIENT_SECRET}
scopes: openid profile email groups
auth_url: https://auth.kluster.moll.re/api/oidc/authorization
token_url: https://auth.kluster.moll.re/api/oidc/token
api_url: https://auth.kluster.moll.re/api/oidc/authorization/userinfo
tls_skip_verify_insecure: true
auto_login: true
use_pkce: true

25
apps/monitoring/influxdb.pvc.yaml Normal file
View File

@@ -0,0 +1,25 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: influxdb-nfs
spec:
capacity:
storage: "10Gi"
accessModes:
- ReadWriteOnce
nfs:
path: /export/kluster/influxdb
server: 192.168.1.157
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: influxdb-nfs
spec:
storageClassName: ""
accessModes:
- ReadWriteOnce
resources:
requests:
storage: "10Gi"
volumeName: influxdb-nfs

26
apps/monitoring/influxdb.values.yaml Normal file
View File

@@ -0,0 +1,26 @@
## Create default user through docker entrypoint
## Defaults indicated below
##
adminUser:
organization: "influxdata"
bucket: "default"
user: "admin"
retention_policy: "0s"
## Leave empty to generate a random password and token.
## Or fill any of these values to use fixed values.
password: ""
token: ""
## Persist data to a persistent volume
##
persistence:
enabled: true
## If true will use an existing PVC instead of creating one
useExisting: true
## Name of existing PVC to be used in the influx deployment
name: influxdb-nfs
ingress:
enabled: false

9
apps/monitoring/kustomization.yaml
View File

@@ -5,17 +5,16 @@ namespace: monitoring
resources:
- namespace.yaml
- grafana.pvc.yaml
# - influxdb.pvc.yaml
- grafana.ingress.yaml
- grafana-admin.sealedsecret.yaml
- grafana-auth.sealedsecret.yaml
# grafana dashboards are provisioned from a git repository
# in the initial bootstrap of the app of apps, the git repo won't be available, so this sync will initially fail
- https://git.kluster.moll.re/remoll/grafana-dashboards//?timeout=10&ref=main
- dashboards/
helmCharts:
- releaseName: grafana
name: grafana
repo: https://grafana.github.io/helm-charts
version: 8.5.4
version: 7.3.9
valuesFile: grafana.values.yaml

52
apps/monitoring/telegraf-speedtest.values.yaml Normal file
View File

@@ -0,0 +1,52 @@
env:
- name: HOSTNAME
value: "telegraf-speedtest"
service:
enabled: false
rbac:
# Specifies whether RBAC resources should be created
create: false
serviceAccount:
# Specifies whether a ServiceAccount should be created
create: false
## Exposed telegraf configuration
## For full list of possible values see `/docs/all-config-values.yaml` and `/docs/all-config-values.toml`
## ref: https://docs.influxdata.com/telegraf/v1.1/administration/configuration/
config:
agent:
interval: "2h"
round_interval: true
metric_batch_size: 1000
metric_buffer_limit: 10000
collection_jitter: "0s"
flush_interval: "10s"
flush_jitter: "0s"
precision: ""
debug: false
quiet: false
logfile: ""
hostname: "$HOSTNAME"
omit_hostname: false
processors:
- enum:
mapping:
field: "status"
dest: "status_code"
value_mappings:
healthy: 1
problem: 2
critical: 3
outputs:
- influxdb_v2:
urls:
- "http://influxdb-influxdb2.monitoring:80"
token: We64mk4L4bqYCL77x3fAUSYfOse9Kktyf2eBLyrryG9c3-y8PQFiKPIh9EvSWuq78QSQz6hUcsm7XSFR2Zj1MA==
organization: "influxdata"
bucket: "homeassistant"
inputs:
- internet_speed:
enable_file_download: false

2
apps/ntfy/kustomization.yaml
View File

@@ -13,4 +13,4 @@ resources:
images:
- name: binwiederhier/ntfy
newName: binwiederhier/ntfy
newTag: v2.11.0
newTag: v2.10.0

63
apps/paperless/deployment.yaml
View File

@@ -1,63 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: paperless
spec:
replicas: 1
selector:
matchLabels:
app: paperless
template:
metadata:
labels:
app: paperless
spec:
containers:
- name: paperless
image: paperless
ports:
- containerPort: 8000
env:
- name: PAPERLESS_REDIS
value: redis://redis-master:6379
- name: PAPERLESS_TIME_ZONE
value: Europe/Berlin
- name: PAPERLESS_OCR_LANGUAGE
value: deu+eng+fra
- name: PAPERLESS_URL
value: https://paperless.kluster.moll.re
- name: PAPERLESS_OCR_USER_ARGS
value: '{"invalidate_digital_signatures": true}'
- name: PAPERLESS_SECRET_KEY
valueFrom:
secretKeyRef:
name: paperless-secret-key
key: key
- name: PAPERLESS_DATA_DIR
value: /data
- name: PAPERLESS_MEDIA_ROOT
value: /data
- name: PAPERLESS_APPS
value: allauth.socialaccount.providers.openid_connect
- name: PAPERLESS_SOCIALACCOUNT_PROVIDERS
valueFrom:
secretKeyRef:
name: paperless-oauth
key: provider-config
# - name: PAPERLESS_DISABLE_REGULAR_LOGIN
# value: "True"
volumeMounts:
- name: data
mountPath: /data
resources:
requests:
cpu: "100m"
memory: "200Mi"
limits:
cpu: "2"
memory: "1Gi"
volumes:
- name: data
persistentVolumeClaim:
claimName: paperless-data

17
apps/paperless/ingress.yaml
View File

@@ -1,17 +0,0 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: paperless-ingressroute
spec:
entryPoints:
- websecure
routes:
- match: Host(`paperless.kluster.moll.re`)
kind: Rule
services:
- name: paperless-web
port: 8000
tls:
certResolver: default-tls

32
apps/paperless/kustomization.yaml
View File

@@ -1,32 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- pvc.yaml
- deployment.yaml
- service.yaml
- ingress.yaml
- paperless-secret-key.sealedsecret.yaml
- paperless-oauth.sealedsecret.yaml
namespace: paperless
images:
- name: paperless
newName: ghcr.io/paperless-ngx/paperless-ngx
newTag: "2.12.1"
helmCharts:
- name: redis
releaseName: redis
repo: https://charts.bitnami.com/bitnami
version: 20.1.5
valuesInline:
auth:
enabled: false
replica:
replicaCount: 0
master:
persistence:
storageClass: "nfs-client"

4
apps/paperless/namespace.yaml
View File

@@ -1,4 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
name: placeholder

15
apps/paperless/paperless-oauth.sealedsecret.yaml
View File

@@ -1,15 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: paperless-oauth
namespace: paperless
spec:
encryptedData:
provider-config: AgBI9IcNOfBevjUtIMwNTd0MTnr1WGxMKJ0cPnHzAS3cddmI+LTrkxxdRBuz2PFKTrhJ6/vh/2tiI9FBWMVm/YqTB64drbF3v13GfZMk/9c7W4SFyMoMcoE4xe6gs4SOm1ggTVxWT6O8IQ0gt7+FRUFaiLmwa08dxTkzrT0/zfQfYg+0aV8qS0eCJIrQk/IA1N31RpUoNV5Jl6vF7oE+cKIVyZ6LVMdecmFnuUgU+1qTC7ncgxxhWQekDQXJQnfYpgsQTF5GaHkGV8kvqJOa2Ohnk7MIeQEz5WuiKaXzU1ZMCYq3D8q/kaf/itLLBlL5MQh/hkuksCVG13aWxvulA/zIw3rSDujjZcSrD8LWH6oCMCn8zVcZjYQQBcTKUYEyYNvHLsmm0fOFIkUmFfBOS4WdHhjsBudz+941Wuc2EX5i6eLind7dk6gOlCL1HEyvbQRV6W50T104DQSNHslRG9CIjPh0BueGJ5fiaFoQa/UuM/JI8R/7cv3y5VkCG6j4gax9FVFgZKxPMtOTxB3gKolT25JHPDOqbDo996T4lsmiYRrYShni4JFZ8ALhcr7pKwlg+gVbDVaqMrVaSz1xzTP0MNxPMsojXVLtG3/Zv0/iXSVW4DPY67pFITEbZBWB3bHLvL9MiwKbWNwsDwPUylWkXTTFHsNbuRUnAXhRxcLn43uIv98JFTQcMVl2J9qrYkHm7w0FVImUr3oC+Ny/Z6j89ARposNx27B4FBgW7H7+yWMKRsAObC8cAjBOkBdXue0x5bEl7Al2BRRG7/WUKHXZvTOlvlj7GFTpLOQbPYjnBo8V8h42uOjGbiMLaCeN5sWlMtWD+7mpHV3XGdcGtPAZlIzgpUs2si/XIRNun2oDoUmJhb7YcGmugodcAK9+aYBThIkNU3guXdrM6Vc7CO2RP8PFpKBpcI9pUHgYA8dyYY+TaBqfYGrKFlGgoVcgh6oVkeOuctTX90XkojVFfqkCqab93faMh2pGCGcH4IZ81sdTYeWwNIvz1RGoi9GhUhQU5NfDeUBn2eHdOpfdsf4FkWe0kgE6TBPlQx7GQy56FldIc0G4QA8H8utL3E/MXYrao70ek/GHIxuev1/hzljJDk+5HJz5itBtKiW4s/5j2ZMD7MMBu/voDQW14XEK5pM9EbwmC6kRg6ljXvTlnUVmw1s04iUvIzF/dO6bCgaOEwFPjZj8oZs0dt64Ov+ZPLwTrmezFgHtfh4dyiRgHt4cO/WYFmzzYwd532p2De3JqjHUzT0iQIpkaz4jrF7+fdtDxtj7XgkJIg==
template:
metadata:
creationTimestamp: null
name: paperless-oauth
namespace: paperless

15
apps/paperless/paperless-secret-key.sealedsecret.yaml
View File

@@ -1,15 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: paperless-secret-key
namespace: paperless
spec:
encryptedData:
key: AgAjDxYW+bf+7a+65DR/u5Qrh37JSPQCstUrNWRdxq9We1eGf7qzTnmyke/O5TiE26rHVx3yzyK/Lcp/R+pJUnDauCvL6ja7k82DLzElkoRGhvRg4nr5Iehw488WIdJDXWqAbus4oLFCgnj5axs1B97hEiAN2onCPDsOuk7oSdJfG4mMI47Ass2qFPyQaff9TulLXQQEY5U7LrawCTudUPeiTCYGbOjBadPjEzn5pDwsyAd1G+NrqoPOwkrbNzrwMwbnwB4hLO0f+jrYOh2OMNcdZzMZgM671VH9cRYSVV6uz5iAN4A1NpZ1ZdenQN4pcWvaPmPOcvp14vjZtrYbGeyaNGnob5IycRrO4yaf+0V7DZ4Thwc/vqm6r5y/MR9U4Q9EFoNNHYmfo9VEw7LhivtaDOG8OaZXUnIFoXFLOZ59qfoZdIyK4eByTRQBZFZLK9rVgXOommbqlCgzNuDM7u11OGcYfROJFeiI9pH333x5u7GZsDz0hnAjWKphXzeTglXdaXMsQUeAHusdqKCn0X1cMatGUjkBAXwlOBrqmaDwSRdyc/+J2QIdkyQM9A+88+yoop7q8c5P8oizBikVaL7SojulUTJStH5cv7nRzhmpAY4j15+o3RQKrbEjGB4HVVx3VBFjjOiP9gfjhiYqxznYwkYTpXADPwjhLFf4opOPuhpoUD1M3OKXlQpPK/RvFTWWsh14jbJuL7WJpXbfyYs0+drbVdnYeUsn8OKlnFDoOaACdpNUCr6t9dSFMs7o7Mo8yN0E
template:
metadata:
creationTimestamp: null
name: paperless-secret-key
namespace: paperless

11
apps/paperless/pvc.yaml
View File

@@ -1,11 +0,0 @@
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: paperless-data
spec:
storageClassName: "nfs-client"
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi

10
apps/paperless/service.yaml
View File

@@ -1,10 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: paperless-web
spec:
selector:
app: paperless
ports:
- port: 8000
targetPort: 8000

7
apps/recipes/deployment.yaml
View File

@@ -21,15 +21,12 @@ spec:
ports:
- containerPort: 9000
env:
- name: ALLOW_SIGNUP
value: "true"
- name: TZ
value: Europe/Paris
- name: BASE_URL
value: https://recipes.kluster.moll.re
- name: ALLOW_SIGNUP
value: "true"
envFrom:
- secretRef:
name: mealie-oauth
volumeMounts:
- name: mealie-data
mountPath: /app/data

3
apps/recipes/kustomization.yaml
View File

@@ -6,12 +6,11 @@ namespace: recipes
resources:
- namespace.yaml
- deployment.yaml
- mealie-oauth.sealedsecret.yaml
- pvc.yaml
- service.yaml
- ingress.yaml
images:
- name: mealie
newTag: v1.12.0
newTag: v1.6.0
newName: ghcr.io/mealie-recipes/mealie

26
apps/recipes/mealie-oauth.sealedsecret.yaml
View File

@@ -1,26 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: mealie-oauth
namespace: recipes
spec:
encryptedData:
OIDC_ADMIN_GROUP: AgCTE4M54XEyKP1cHcsosZwIp5GYcvZPIzb7sgOpvVJb7mzKT9kYFOqUkwc1eyn4bjqaXu6SJyP3M4ss3K7CgkNWMsSjBVrYpP6yqsREoWqoETwwecSxRS7hrK8pJb6kRKBKyLDd2oaFMxeg0y1lm9+ul4HwNL+uPcNLSX7KRue1Hy5xqjDNlwL2mzU9JVVZGqEW8FyvPCRKMPliQtK7WpTUbadKbltN9RKrRa4PqFW9xyBrg8Al35Xj7HrNfwt8YAUDeq+73QMLtbP3y2orSck2I46h9DKW4foqYWGnVh/272fvQSXDr3tr8Il969o5M/IfVzpRS74f4zU0LeI4POxT9EgBL2sALoKhxil0EZGJ3dsPREvSS7eccCMY8n0AQE8rOT8AHyRDhd8RzsCoyPoDTAJJWf4oGS4aSH/N7f6CvsMF2EdOSCghBWC7klfRFxraWcbTiFRi5ICxlFL4GkiB9svNWpQlCkiduR9RZTop1DU+xJK2XgBmTampbjlEiS+yf9L7tXpCRvp+vRcxHwlvsMUncIxUzY3CPTST6FrVOL0BMtLeKI+MmgaCxgzo6BBAUKBZSCJbJKLTrcnhviLJnxYXKYPah5ozfk5XBzcz4C7dWuhN6N1Uwa08nDtHbuN9Mj0AWElT3HAqf3naowVBeXgLV6vRNTwYOIVoqGhyVG0O65DpwuxUdFZMUBpmhFz1QTpAZ6cbDZbL
OIDC_AUTH_ENABLED: AgAQ48wodtQ11peCbSpBL61n28GMeMJPq6cmb0a39x/n+AJGOZbjcE2e/xdFu06J+ahHTehi2QtwWxlRBi4Op6sbjdn5cXkTZ+8vGB3v/JQZQzJpGraFT1WTPZ9onYXTLl8iGsZSteF3iaxSOMzLswMahDvk/DCNrIY78mkTpqSC3Pggf9GnAWTQKOnuTFYyStBaL9ExyDBiJkbFahm/bC8h7QG9OXD93bDQrApS/W6LF+3CU6TOKj1VXmeVuMpxGdasC4B5ShL9kvBz66i5P7BJYjPfTEJfIACIFzZQmLJwxzfST1kV0urdQ9PZmcvQLapxGI4xUssD275hSPrUE6XXMLyo0BzVEBPq5QsMW5UZB1sOPQMcIajdzWagByFJWcBU1mFMwJXVUHQXlsMDEl1pDTGbSS660XCS1aAtmVb19ToXH/GIEkWlohiNpVqI+D8ypoAwMzF1FnHGvyxF6maHV4vZA4zDE7bT4S+E6dEmXM2cc0essUDlbwgOTLi/3fuqxIar3Dub857H0B9++SeriHrSUJD1A/9IOZQQNsAOwEOylK+9BuyhHYFVzk9l2lKnCRYqif75wusyoly+4yBS69LGzg4mc4Bk6LejZe91VnZLlZB3M6fZzS87qWoSKuEibxJ469KVrCPNc5mn33gfg5nW/05rSYcBnl1VazPmA18sZyX1nWnQUwwErg98jGn7Ft0q
OIDC_AUTO_REDIRECT: AgBuLoXhaCs86FfeiagJQg2bnz99Poebydj212AdXpt66Lx1nciFlJMzZ03ahJiF5T8lalxPLSzkHnc5VHBT8yRSrKe1lCisDmXVv9SBBoZHntu9zQdJeChkkHImxILlJVZk4steD2CyIBDj2xjbjUfRjFYJX4F1WrzSDXG4Vf5bal8tPXNuqbHEGfx7xw9CRetMD4cfDESyKl7FgbXi4vyLgGyNTnKTAvY1w72Y7WKminiScj7S39TZZIVH7wJyvvsNEv7MCgwaPeT+W5pNwpx34oqfumTHTeJUwQWccwCnZknhOl9jwNRJ4cHFAsVArT1yvjLCbMir9p1DvP2w0R/A8CzPgDQxbJno1QKeGnw02YVlsYH5KiOKkQQdT6/kT+kk444Mg0JLPbG7XZSUZXGmVl5n31DuDFvTGum5BQOwFzYfOim1MM1OJyFiM7XuaCZCzSMNUQHtLGv3kBHZFhIS5PXqMjfdV/RAv3QhZgAnJzGYLEDawOwy4KwIXTk9b55OX7AyEwQzwMlJUujg/+IJP28BH71tgVtgQsVDnWVT2GtWW+UMamXhqh+YK6VD2BZ/81D/p0BEGq8m/dweP/qv3MK/CGBjgtIFOHnEcNZkqMH4HhrxFeu6fabUpT6+C5cGNyYJSEFpbUqjJRb7vBPIu/ewb8Y43SNikzaSp3/1A2LtkGDyzcRckQYTuFIiIg5r3jcg
OIDC_CLIENT_ID: AgBQiUtbuXKJABinO8VfjQ+yIj0a4AEvKboHd544CxYdx1OfZd0DZLsKpkowZS+Wl5QiheC/+8HFqsRzzwKas2i4IyOpihhSW/xd6X7XjDtu2Tjwuol1oRel5AmBpBj6Kl6zTvgLbHE+iUaJi7u5f2Pw0w2vXAJWxg9nhOFVEfTVtKaafYqVVXPB1KTqRPzwR5zsTuIZToEx0BvA95yWM5oKRPnjlSLk1vHMBDPqdgUq+7u+7qhj7C+rvhI7nuTOWRk0NzsELBl3AyAg82w0r+I9H7buU8OHPEhVOID//UIc/wL/QuaJNxeFiU+rM6K0CD6MMGQanuUngaEr/ZpEdxe82hGSuaLik2mWfvG4J4328a1bmmTT/JgPPDQW8Xtg68Tsqj9zT4rfaVt/+TttMMgj4oAFkyVLGZkp1sfgIX5zT7gHc0fCusTR5gGNLJ5PmHyqCu9D2jP1ERLRltiyXH6wms8+aACj+wsmo1OKUjmqrtqtAWNwZz2bmOJhhUgkP1mPz4o2LeECjBPPv9uPWkMb67ZUI4+Qp8o7J0SgQt4ZlRqhg04Rh5MxCY9TvbhLxQD5QqTktmGYWo6cDVnIEIKd/XOSG9pBT6bTGsRLicgRxjDwm/0ZU1Y3stI6UhONKYA1HG8rso8ZfRLvDsgp1Zb8tH/GAw+bl2HkOw1DbyFXWeRxau3RPwTym3GYjFgWZhP5ScOu2Rjg
OIDC_CONFIGURATION_URL: AgBiXJGc7WugRqlUE58fVPkkKkka3G39lhajhuR7EQePZ1HdE1D02/XncXgRO0r7C4kPAX3oZ1Uczo0XAMxQxAZye9NNFNei7E4rlc3BTNOOxCc2Uj57DjuqFA74cHcjs0xRCJ1KVMEcGX8zdG85v/qEI9Oru7vQf8YT3giTKNHDZMgeyrbCMFNS0cyXniseMMVIkiX0ky6TfcFdn84bZiqJYwXwnNNzeM/kJe01NvEe3DuvxZTEme8LNkie7CTgaMHfEYeXZWIh+JqkIPW+48uDYe4ojf/Ts9P2jwzf6qW8XyqwlLti0MxoVH6IqbLbJ9JVJZ94WNMm2tcjigD1eSV2klNxXYZefyqqratQpfi7Ou/KXdfs9Reijj7dtfZDOnztVouS7ivBLlufqdxgyJrnQok1MxQloZs602CBPRDE+oSHGh5ean2wbJLqt/Vl9NxcsFZpWI4tazZ0DUhD5pgS4MXoG8D+RXIz4++nfn+XhYhv84vP4VJh6kCF84dKSYDFUKkAMGJSZRDCcs4jaORO/DZLUUnytnOHV8Mo2ypfC9KgETdnbXWT7OcdCQPesABE/l2lN9KDYHxL6DqE3GibmCqE7yk6TOF36pmVeEsECeBkmcl2DpHVu9PRBiwO0YVTGUr9AVmwO3vAR+2LAVHkDmU+jn/e5SFHg2dkEpWDORC7Zn4vZrjy3pmTJdxBthVwTYqmdnWk4uvppyKP2l6MBtaVPqtB35sDuYtLGSFV1FLBJGJueW+Kk2cGbNxJJEEhBUf6ZHCDWLrZEJPN
OIDC_GROUPS_CLAIM: AgBjsoq/VaSx/P7PnODa2TIiSy/noUFrVmPuIPAyjoZP/w62zmwTqy8Ln4yRKywmsy+n9CMGgauUzkEU8HSuWJ0Moxzt+NBRpuA3nL5R8b0hMsdQXCvY3L5zqyvPH7hfY1LRVcM5cVyzTR2CTVUNbO04EeGaFt8Mh8tsmyHk+Cf8VidbkeqgEpee8tNO638F4xQGx9aob7H7UVKOou8CdpOvH3zsNFzGmSbwv9qm1sgcTxkZkjt8cGH/c4k30p8szcMFQmUK7dzrZAma5bDPg5BuwspCnRXoGVWLYN02jHYDg/08qLpL/vL+pPpChf0DMB4j2M+s5EDHnbcfT7S7pf2NkHCnWINCJSKLMUIcBSFXXEkbmSrHo1Ft6aHf/i6JHld4CT0dQs5AyK68mCzkZTWoHU6MM8+/3/J3J/TWkSP8HOyBY3gWPOU4hYEQQQlJp3T+mnnua70mo/vMr4CuZFyxLjz872CDwG5WfZkzJxM69s0XRkHEmsXi7VYjn7NThrqhh2lqbiIIJNpAemjruRl49T3gtfstVdxfgp3dfz/H/4FWRy5KY5XDUjGwYBXDCpaEey42CFSiT1w9yXV67emahUwKekvq1vvuz2bWzaTYGtCW77WzCO1cC26hORPAYbZZxgSeDgWmxMIhJF6tVFNSAu11rMjcMUKErujC5cKWb8N4DuF0H4cQv36SESKBdVCOMPzPxDg=
OIDC_PROVIDER_NAME: AgBHYuK2JYedcaHwDca/c1RKzq8YgO9cJ0lXPY2+ain+lwFJwZ7oMOPevVOq3RoUHznEYbRxKw0CLE+110NFr16bav4bn4pXRD5CeqQDAWPIxxouu+w2NgWijnqfKnVYrtrprQlfGO9mYsZiEGj/sbftX2Wd73L7oXp/6Ab+28rnxtv3KF46wXo8yfqzOGf+QRQKdT+2pv58zjN3UCGrSANirLHvmY8+a73YiVW8/xuJZN4og3JbPW65FwBpgnvQCaHKFTbPyPIpILx7sKz2yxGzT6Jt2PeSjdwou/fT70tmrwOVucbHJkKUsd/jkI0gzRPLr9Fo5LcALAKQsn70hNQIRgTFgCy4ILurJMBKeYtHkNMdnBwKRh4NlTgJB2vNXq604480ta20Z3E2m3DUxW6XPFTQN9uC5/7IT0e/F4UgQai6HENwAqIPGuOM4eKeouw8pr+RoLMI76Z0B6xWhLRqxrZknzwzOngpaku8w9SeJPkifSFwxxFjacAqFrMwLGT1kg/KIJcBa3BUK8gVRLzqJd9hq1hQtavmm6T3W9PW8yCG3IP4b/Kxsm0+B1pXSaFC2a3elFu5lgw7JeJO22NwPmCUw3cX/zfYcn4u1MSsn2Wlr5tLNwjfpeGXb0w9eGStEZNKpj/OLo5W6sxdO1PIdCRd/IdxFuDd3q3G9cJTP7aMjeWSQhr7bzgzx1K78zZ9h4Qiw4YXrw==
OIDC_REMEMBER_ME: AgARqfhGDWYi0iqE//vNsJfgZBYJklJ7KUUHm3GkD27gNk0JtOobt/RlE3UV4cBGkstjGQkEGldkwshtQk/hAuuu8Qb9PpeDxQOUABAFX7NDcr2hWnDosFSShq724ycY6B63vjzahMBYEGo9tAB07VPy6RtvZDH5EGYcubfSe2GgX/P9VcKq64eO2NkOHJWc1A9cPqQGYqFi3YZkN1yaix7kRW7sL627Slv3nU/yLpFpEwUi9ayzDBCDxfiBZoRZh+Gy4VpD2S0XmTNYgr+uRTmFxEm0gL4qvualqahssswG6x+l6S+KizbLOkhNmLtZ12t166mZLWlzUPQKiJwEiWUK5DfJs2LtZCWyqVko9972df+buaQ4yPEBO212OoM1gF0P0JaTJ7TNzo0hhYxDIBZPIx9RnG7XzqI+sccj/OLQMeyB4p9gbbKHP4YJyyYQTSPK3dHG8BFdfUDyyq1tv5IkzKRHmy48xaumN6KCPsCqrpr8j1XL9oLPGPtDgf9VRjfp01FkTg9ujskxjnfAt6fNw8JThMyRUdInagos8Wh/qxPPV33yN+EvQaooXxq1FhvZtLVAXsErzqXnNbLBmQGx87IpBT4KMpXBWmQ7+XaiFCWXQ2pdXRtwL9IT7c6dtyCpUpYtlVjYuh8L64W8GJuRUjzg6pRbcw0205MFUZfWuOObAHK67K+ChNgzzsCCy4GHVtpp
OIDC_SIGNUP_ENABLED: AgBju2S3K1/i7oEsF+KyOIAyduYJMqA5c/spXNVDtFDgrf5+v8dIa25b1LyNZWctBPLZrcuviQtY3uJWgBbY4cKagheBlwN/eCijghdFLR5U9iFNJUv31zkmnVeOAZqkLKAmO1fmHfgqrZ8+UG5YlaRXcGsMjtuCuteKhF+/ss8VxWNwsWVcJc+xcfK11UG/ogrQ3+h/Ii1RCiS5WSMmQB3uNRvyNQEdDJHdtK6gifK5ZHboHN36Rx3DEzyr3eDeIJasyYgfDtepTBTyw5cb/7yFhRMSraHTpGy3uxJwzzNL1YdCi2EHyllJMea1/AvxUQXQAxD3zOSmNwQdroE8NU/Y+Y/vuCOLVrLeveHaTUWvI9PkIlIxbU1Xql7UGf7s+Y1PTnG7aXWNYNuTCgaw03TO5bhAPX1tBubVT9oVUZgjOH+XGY4nImtBOt/1bJ2xmciC6t2nt+8lUxLfNuFS/876vJokYtd22YHGqHuGSLhAdWg7LcwIilx4iCB3OY0ORBtdE0hDOu5KR282vRqGu5vi977k6kD7sL2far0fHjpb8rOaJqfy56UsF1CjClqQWB0F2vPh/ZNjecC87ei0ds3hCEhGtXxYYdJ1u9U3lZHyvA37NxKaagTHZCmhgs4M6Pdqm5YjsO0iDorv+aBnRkZysqzdG8LPuZNy7BkqxejW9icS5+b4TeJgCButl2Cb2RO77tda
OIDC_USER_CLAIM: AgCKYNaYTjJxEFBsijRDPNXRH2nodeUMG6SBa/emB6QKNh9jnQISn9poaZXZ8Tc/xwy1sLJ3m02x+Uh7/PE+A/jiQ26uc8FVvnjvzzUOaily9Hj+xgKZnjQHmNpxPBfj3pzomWZIEoEHybsWGrae1jDzIBxSeKbMYgTGfwJoWt9n4lnQ1Z++Z5/Texp7o+oV5ZJqsEqvjebTUT+nwWaDicKpDA/QbAjD+ysCim+gh8q8FXDCHZKNgD4OcXONTpDR185EpBYV0EKSMytlz5bdBSKHxVUACTATjf3WrFDG5NtckzmJA3bA85Xl39Jxi9pLP9D0SLk5cSOLkwNbLVL1EeQ4Q2FApXcPGhmEAgan11HQo2vJW3Dsn1R3G69zNC2ArMC6Dz6pH5f8nFId5lyTKsQQs25fCf/BV2we3910a9hGKAEPdkp27xGczu0mBdo3LLWeiFaQcDo326N2pqNm3119mdCdu5I7rhjGGvOLZ7z1c8XwS9NdE0Kb3iQZLqu1xr/FSeQZLd9NNF6qYtyFM3CtdqKSgdM4vpsRkqMEiZA84u7hdglXohuaVOjIaQD66bi0He1LemzyzRkRD57zxdVSvubKIQmedNpeG2yOT7pjZqVEk7FwWPaWZZiK61UhBZNvGXUKSMEWVJ1DIr9QBsK2E4/EGdqWKa/A5+75PKvv1TpINTw26z9schtduuPfaGO4Z/2ThfPlYFwD2eoVMZpAYjI=
OIDC_USER_GROUP: AgCTGx9h4At2lcx4tN5YUBN2PRHG9ex3curTTq4kid+kKQXRUOYckYC3LNzC7aIbJ8byhFHtJVF/T37olPkgJjWzPN6C16C9eGDv8bgq6JnG9faveeXr2zjcceZ9O3bSb4sRxlQ5Zke1Asc2olYP/H6br4VPDdKkDsJ5h5/B/W/dd9FDXuPAbTp32bK/l+3YStR4Zpmaldt4hostPu9TXfE+UxJqcLCFMtQuHsHEtFV3Pimt0XIkoNPsodpKKoAhje8vNwk5YYSlhzH13XgZvKcP43z8bfekicOgRNM6T27sVGRrFM4sE635406sOXWXbxJzwlBQJTqajCtX+tAtei3LHdr0l1sjjyMDzlREUq6RYt/6klMZrLW5gsdma769AFA76JX+e+wjekmv72/aqUVn9635IamFM1J6+jIWKdWo76vJwzR/EisO12vkSbocSoAEsUxc3rGMN2aLZEvo0LjsjENKlj8fNxog5i+4jO9Bc0AXEQaFhlQwPdIKlylQPhrSiW/cnDG1WemDn+e77a9NiOkDxMXGequzdC5KyIeIrSjITXpg1MQNa039yIKkjfVL0uMsH7OL7+qzKPSPm5LOABBxKducSHHK4t364YD+8e7KeQStHjaCTpcxgf43at4BKuQ31Ty2bWfpMRofGRBvJPusgjXrdutNEAIVrzFfW11o0Yx06U7CRF5198yXHCig3zKgxgQW
template:
metadata:
creationTimestamp: null
name: mealie-oauth
namespace: recipes
type: Opaque

21
infrastructure/argocd/argocd-oauth.configmap.yaml
View File

@@ -1,21 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: argocd-cm
data:
url: https://argocd.kluster.moll.re
oidc.config: |
name: Authelia
issuer: https://auth.kluster.moll.re
clientID: argocd
# If you want to store sensitive data in another Kubernetes Secret, instead of argocd-secret. ArgoCD knows to check the keys under data in your Kubernetes Secret for a corresponding key whenever a value in a configmap or secret starts with $, then your Kubernetes Secret name and : (colon).
clientSecret: $argocd-oauth:client-secret
skipAudienceCheckWhenTokenHasNoAudience: true
# Optional set of OIDC scopes to request. If omitted, defaults to: ["openid", "profile", "email", "groups"]
requestedScopes: ["openid", "profile", "email", "groups"]
# Optional set of OIDC claims to request on the ID token.
requestedIDTokenClaims: {"groups": {"essential": true}}

16
infrastructure/argocd/argocd-oauth.sealedsecret.yaml
View File

@@ -1,16 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: argocd-oauth
namespace: argocd
spec:
encryptedData:
client-secret: AgAGtwiMd6OOz2IT2QJJR6unSYgLqNVJCb63a6hHko749nK8Kx1WgLwCYT/UURQYUusqMMPkNqbkA+jLUgh92fa7MKhtj4GysSvWavB+j8oFWT3YZbNcYNoJsTxg8mIRKiMFmp5um703e5RtGCv7eiOWdVtHftVv1BycPVeVHUuLU5usc8lmgnTTEPiRUEUB8MjGd7bIEgJ9q5oAiRTiwefickS1NgC02K2K8hVAhG/VkP0lqYn0xYgsy4W4i/7Q7AxRxCwX3y23spjXNUCRJRYvgF7Cf+MHdBgk6xPtvJF3jDLJfw8H2ilUx0GaxkESCDIE/FSVlbhMXmUdVYB9SLVo9K/tzqHe536ufGWO+U7H92mhZl5oZcA7qP9iXLUy13sAY/slixbKT6y4BJ3Tnt/pK1IydASsOE/uuwuN5q6AHWvG++DSHEPfE8xOH3bRVph8aIJD9hi8UlH7KGlEDPIaY3twpaJDUweaGVRTEnjvxW/hKfp2SF8A0PtGDeKSSii/XBZjxjROdOvE2+xM/WTVdVqddvErzogEKfljMvb5Z4OQiNj7fFvFMVuRD55To8p/cYZu+KHx+D8tuUMH3zk6AdADs/0bjI0xAz3PJUAmVp4RE4k0vP8LAImF5rWkIyVUcvJmP8S90jf0d7usJaEFd1ZayFLyUnwGAkP8ua2RiupnNUrZ/49A31cGm1RCpw00DGEJ/5VK6VMP1+T4KOUP5pB90FUYVHUv6S8dAg==
template:
metadata:
creationTimestamp: null
name: argocd-oauth
namespace: argocd
type: Opaque

2
infrastructure/argocd/kustomization.yaml
View File

@@ -8,10 +8,8 @@ resources:
- ingress.yaml
- argo-apps.application.yaml
- bootstrap-repo.sealedsecret.yaml
- argocd-oauth.sealedsecret.yaml
patches:
- path: known-hosts.configmap.yaml
- path: argocd.configmap.yaml
- path: argocd-oauth.configmap.yaml

16
infrastructure/authelia/authelia-ldap.sealedsecret.yaml
View File

File diff suppressed because one or more lines are too long

16
infrastructure/authelia/authelia-oidc.sealedsecret.yaml
View File

File diff suppressed because one or more lines are too long

16
infrastructure/authelia/authelia-smtp.sealedsecret.yaml
View File

@@ -1,16 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: authelia-smtp
namespace: authelia
spec:
encryptedData:
smtp.yml: AgAHiNwse+aFYVoun500VoUTUKg22yDSn+cD9pLO4HKG26nqmOxkiTSi5BELpzWouqHXiHNwYLEKPv13ZFJX6AFfFskspBfe+svLvLSzEvtH8kNCSJar0G5jcACEk27xcCxTN0nhmjc6L9lmZF8UUth7l5Mrsl0EG+79pCNYhUtjy16g7HdbmYgmgrY6d7VWCen2R4HZK4A9zPx+8HEsoMzUD0mG+uKKKfmqYaxJ563Gzp7trDcQRXd4tmea9MM8t+bk9TYCDvBj9JbsNuIdzFk8MArlvlesDYqiJj/8wny49NoVyX8vvGVDF3Y5s+OmKA9+MoBIYNc4oT4FLcc14wpnMnk5WgbKtTYfExcGTdTWuTTVWPsF18dvbKTU3C6dnf2kh9T8CydIdu27jwrBbChWffxNbh5nlLlQT3Xvogai8o6qhMn+EqTnw/u93OIxNzPEooVP349VVW/mlhGX3od/IlVzXiIlQIxL5EP2pRCXL2T1KONvkpbClJ/BTuwfjRZTXz3ZaRhaTPdBAZ+bpkRkt+kEAecjqaf9EF+pHy+dOaR4tIrwBWBbrAy47iV4e/Q60B97bRHzgo9N1uaYonGmyzmyVc9TXIkhf7PIlu/cSyDaHKdobVx0AA0p2usi5D1QYMcS9fngXyM1U9imO6QiYopysxQ9gJL8rfuySRJ/YQ6JJ71fLdMxsiQ0r21D7v7LEdJK5SKLovpnmPgk4PBoL9E4ZPE6g5zRXZFj1IxpKkOqRMpyBzBvas9Q1OFFs0Y79kGtyWIXb7Z2HGYmMU1us9Pm95xVF/V34sAtMIEz7qi+SaXQHFvyqbaiJ48U8qHhHL5y+lt9e8PGmQo0tRWfHMejs5BCcFAEZKDiif6zUEsjV/WC9WKO9NUjvRiu0CYCq5z9QzKaZQqWo0LPeM6DMY8pT3w4OqpJ/OLyMfbdoWT/uQ1JW5npApGifL0lhWRIkQHCG7oZA/BkJfbiexV8jwtToS+UX/s9HkbkuQ/O4zDte8qg/Xzh5TOj5AxlAPN6wGCwd6t1RTSITSKVMnTpFabkEvPYnGeiyWU8TrckvaKmhRUNoj2ZWQCCffHKp/bimEHxRqFnW6B+cu35reTjFc2dqp12EhCBR727G0EARx3Gt/LSdPh8OYt+Bs0rLaHiUrCJh4HRBJPmg0PARVwDL7OWx6pwtclnrALmfELKKaopy6yFctDogOtkvxHbL8DNhJqNuQJo6ttzlHhz4bnQcWb2K92HIw==
template:
metadata:
creationTimestamp: null
name: authelia-smtp
namespace: authelia
type: Opaque

85
infrastructure/authelia/authelia.values.yaml
View File

@@ -1,85 +0,0 @@
ingress:
enabled: false
pod:
kind: 'Deployment'
replicas: 1
extraVolumes:
- name: config-ldap
secret:
secretName: authelia-ldap
- name: config-oidc
secret:
secretName: authelia-oidc
- name: config-smtp
secret:
secretName: authelia-smtp
extraVolumeMounts:
- name: config-ldap
mountPath: /extra-config/ldap.yml
readOnly: true
- name: config-oidc
mountPath: /extra-config/oidc.yml
readOnly: true
- name: config-smtp
mountPath: /extra-config/smtp.yml
readOnly: true
##
## Authelia Config Map Generator
##
configMap:
# Enable the configMap source for the Authelia config.
# If this is false you need to provide a volumeMount via PV/PVC or other means that mounts to /config.
disabled: false
key: 'configuration.yml'
# do not use a pre-existing configMap
# BUT, include sub-maps wich OVERRIDE the values generated by the helm chart
extraConfigs:
- /extra-config/ldap.yml
- /extra-config/oidc.yml
- /extra-config/smtp.yml
session:
cookies:
- name: authelia_session
domain: auth.kluster.moll.re
storage:
encryption_key:
value: 'authelia-encryption-key'
local:
enabled: true
file: /config/db.sqlite3
##
## Authelia Secret Configuration.
##
secret:
disabled: false
existingSecret: ''
certificates:
# don't use the pre-existing secret
existingSecret: ''
##
## Authelia Persistence Configuration.
##
## Useful in scenarios where you need persistent storage.
## Auth Provider Use Case: file; we recommend you use the ldap provider instead.
## Storage Provider Use Case: local; we recommend you use the mysql/mariadb or postgres provider instead.
## Configuration Use Case: when you want to manually configure the configuration entirely (set configMap.enabled = false).
##
persistence:
enabled: true
storageClass: 'nfs-client'

31
infrastructure/authelia/kustomization.yaml
View File

@@ -1,31 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: authelia
resources:
- namespace.yaml
# # As a user management tool, we use LDAP, more specifically, ligh ldap
- lldap-credentials.sealedsecret.yaml
- lldap.pvc.yaml
- lldap.deployment.yaml
- lldap.service.yaml
# Authelia itself is installed as a helm chart
- authelia-ldap.sealedsecret.yaml
- authelia-oidc.sealedsecret.yaml
- authelia-smtp.sealedsecret.yaml
- ingress.yaml
images:
- name: lldap
newName: nitnelave/lldap
newTag: latest
helmCharts:
- name: authelia
releaseName: authelia
version: 0.9.9
repo: https://charts.authelia.com
valuesFile: authelia.values.yaml

18
infrastructure/authelia/lldap-credentials.sealedsecret.yaml
View File

@@ -1,18 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: lldap-credentials
namespace: authelia
spec:
encryptedData:
base-dn: AgBC27VFLsDFHQ6qMN3kbyilhgRwa++hJ5uDsBOqtemO4mOj3nw3/79SJRrO4201zeFq54WJaG5tRHS4SaB5+hYMjdZKqtgTE5Cl9amKIXsfZOzHQ8bKj//WJZYgfmfPxDm5tVdElvF0CGJQMf4SbN52F4V5ujnl2x/j2Qu6gyoJdTaa8lRRIOewXrgOc16lGuAmgVIFB3KR9SEOiSQb2sJxi4tbBPvu0qcLnnfq8/roWouqlfNycanf+Smgc23P112U4ZcirF/oSoeYjUxSy/yxRMrfSzrcxjLPMeb0hyHgsKpFc17YghBt6Ofqx/JOeb4rCZUAGe2PJYoNg6EvGNlgiL02h5TqPF0GfZ02QLiEVK+jUkrEZGMEqEl97iw8juVW3fFJQpcZxyA4eZWAN2ocH7LjDg/UaPvjaZzXbkkva92X1g9LXFCukbMXYoR6QrRI4AyjLWdAHRlBm1M/7w0x5SH3uh05MR3Su0uhRgwreKxJGndd02SsWYs3I9+xM4RjzIs//aNYvhoUgeMzvhIjda8Jut4HzCTqcycIwxkE9aIUlSAgcS+0HrLuvMb236F5OROz2kwx187KlZn6FlK5vDO3m1pWQwmq2E2q0oRhg2mOJDSexzKwzaTkvOdtNiEOWgitYkML93L9I+9scDd3RbIfA5ejOKu5+JR+8cxpwvO5puURvyzI4BTZcTSj+Jnm6MK0pl6tJgfHtgt/
jwt-secret: AgCI0LA/Y2ZTUl1VZax9Wqd5DxC9OFDe3NfWH9Mr85N5xbF6X5oe49fjW0GTjBE2cytN4aCUy+Gu5kAuo2qgfF1p5XyFY42Tg8q8fyF+LMN0Uu3JlgyA1D3ql0ePc5kNKxD8TRsfcWZOX/KtIWiZxceQ4YJi+OY/7llso3ZiGRCwzV1pXPoFd7A9dSA0qbUklpFI/58VkAUJ1HSel5oCx0JUfxZZAHQaCo72ZPqhbAskOZ4ofH1hzq66NJG5VbOhtBWkPDi4e82OOgT1VqiOiVOUC3w0GAvt6S1SD5P3N2FRqUbRag02rETnja/uahRKDHvLJG82zHXDVGxt5aZQ7bKRYe93gizCaZ4mTfAgrEaz9ys3ywRNr8UL7Cda18YWghvyOqDJSNePn6tUsntc2wA5rRhkPV3NKEhi0Tskqalc8zKXTf4MrX1WJSKw2D8i2l1B6Z7/UhjncAZKaAz7pky33QlitaDtp4Jg4k/ERcqcODB8jG+7oW17At96tXpiqCu6LUki4gkMrtsojRyaVHhl12w4XjVUHW9DyyzELlUT3CluF42wN9zyqDuyhPsuuIr4JrrhNrjvhFU6dcWppvjOvaZMIBvHH5A77F7LDVoCcLwYlrqmpnpxmateeIQHC8IId2JcFlg5CbD3abN9CjtUpoK8ZDRiEt3ULNkyOZ7z1hSfwa9TpJ//HkpWoXsO1b16+ZcNUdM=
ldap-user-pass: AgBX8ryuZX2fr6CZDaYOR54I445RNY123jp5LpyYLtB4QQljzmD6CC9BIOP5eju46cu5q/GoMSRdz5OthSLXfUB+I0iRrq+yI4bWpckpcrecNa0eJn0PAbWoI+T4gfAbkOxLLz1+yfG8J2PKqwZGVmpBqSBaqw1PQnkj8HggP05YtU8kfmH8W+Gi6c5mOBOL6RtIOgWW0pHgz1OZRKLKgyb70D+suvK1Xw9cKehkNoWtbmS9YvB+2lXZpWPW96Bw1mYnilEWr5WgMRz5aYYShe7/yf9OaFHfHpORgH42dpt+nvMSb5fY8nYVjEm6cYyS/mRm7H5cuBYwj5XnghAAoSIhX1B2KxIhbLh+yvFo+y1tdZB+q7sbJHFTegqRXi/eVvM3qkqTxksxhw9kGvCT/v7vRlS6jXHNTk1wS/Ka40Sv2AHaKlg/cMLQGZZur2LJcCZW6UVZwc2uqpJuszm1RwNX7hiTe+Pj1nCE+Iu/nHJrsk4SVEVcsRGOCAQjXwCXqbkuCz8dqZvCHVYBa2qIZTEd4gTXPjabaabudUzAXRiBg1SHLTVwz4HszUY3yfKASNdpYSxZwHTDt/BTENC8NJyT0Y48Daw26uS3U+87Ntsoe0gruccamhoKPdZlzA9Pl1hoD/GEryhVCLbuUhHC02qGo7WhjPaDZ/Cguu906e6qR4bq78PqBMiz6XllZgrZ0QMshT8/ubo9Bh7HxUD0aw==
template:
metadata:
creationTimestamp: null
name: lldap-credentials
namespace: authelia
type: Opaque

54
infrastructure/authelia/lldap.deployment.yaml
View File

@@ -1,54 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: lldap
name: lldap
spec:
replicas: 1
selector:
matchLabels:
app: lldap
strategy:
type: Recreate
template:
metadata:
labels:
app: lldap
spec:
containers:
- env:
- name: GID
value: "1001"
- name: LLDAP_JWT_SECRET
valueFrom:
secretKeyRef:
name: lldap-credentials
key: jwt-secret
- name: LLDAP_LDAP_BASE_DN
valueFrom:
secretKeyRef:
name: lldap-credentials
key: base-dn
- name: LLDAP_LDAP_USER_PASS
valueFrom:
secretKeyRef:
name: lldap-credentials
key: ldap-user-pass
- name: TZ
value: Europe/Berlin
- name: UID
value: "1001"
image: lldap
name: lldap
ports:
- containerPort: 3890
- containerPort: 17170
volumeMounts:
- mountPath: /data
name: lldap-data
restartPolicy: Always
volumes:
- name: lldap-data
persistentVolumeClaim:
claimName: lldap-data

0
infrastructure/authelia/lldap.ingress.yaml
View File

11
infrastructure/authelia/lldap.pvc.yaml
View File

@@ -1,11 +0,0 @@
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: lldap-data
spec:
storageClassName: "nfs-client"
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi

10
infrastructure/authelia/lldap.service.yaml
View File

@@ -1,10 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: lldap
spec:
selector:
app: lldap
ports:
- port: 3890
targetPort: 3890

4
infrastructure/authelia/namespace.yaml
View File

@@ -1,4 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
name: placeholder

19
infrastructure/backup/README.md
View File

@@ -1,8 +1,15 @@
# How to initialize a new target
I used multiple targets for backup. Each target needs to be initialized with a repository.
# How to restore
After the target (bucket or other) is created, run the following command **locally** to initialize the target:
1. Port forward the rest api for gcloud
```bash
kubectl port-forward -n backup service/rclone-gcloud 8000
```
2. Load the snapshots locally
```bash
restic -r rest:http://127.0.0.1:8000/kluster mount /mnt/restic
```
(The password is in a secret)
3. Copy relevant files to the correct location on the NAS
```bash
restic -r <target> init
```

19
infrastructure/backup/backblaze-credentials.sealedsecret.yaml
View File

@@ -1,19 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: backblaze-credentials
namespace: backup
spec:
encryptedData:
bucket-id: AgBZ4U2eKOmIy5oj7KLvDy7LYi41KtyZLYhMsxRcKYeQVW0lYetrsHbnsCTsw1u3kqI6pSrjUVQslpOupAlwmEdwpT5pSfAvgmLpl8NV8JFLSf1vv4cd0yBe3raFxTtTjmt9BPrEaZY1NrvW2l9SeK1JsRBJoVo9+NOlNmMWAsABi2iK/r2O9bTr9e9sOKH1DQZrvxgZKYRH40CosaQL7eBJR9EZcxSvCCp5mjZISuVI0FSgA+Xj1pXODvnf7cXkDMRg6mDDOkdYCZsQ+3a7/YZkoDBEcrO734WojHDDMLVq8lEOqzepJZJnje0jLjz5vn2pDYKGe7j3cbmMPUsNpSnUDmjFFuXTIS70RIoHUAVaPvdRpWlhYYeZiwecc+Y8gKramApCYKuUUzu8opIcckpGd/qzHCaKPyKL7qwtm9aA1rkaKLkrYjJkIhF32gp6E1qiea2L4QQD3ww/2r3UryLHygNeiNbey22covJsABA15B7LbGBaNCHhj1sqaboYvDg+FWK+Nu09UYuIvvQYw2vhKWREILbtRbyHq5J46mWtekSA0B4JU/mZL/GKwGIyS32pSZGo8gFnNzpJUDC5aNSpOPdE0FyeuJ8o+XVA43Rs6DE6885uAYMGTZhNWLZtsgOIs45ly0o8Phg02P1KvWmZzyitHWpWyAW9TXADh4GETJbFOcH7AjrrAVC5+bqI6Dx8O3qM8wnN/5MTo3EnL/lxg1wBf2c1SQU=
key-id: AgCPco6/scrq+3BDVimLOssVYG78vAmNOLgo4ZM9k+ayfy9morHOBQRflAJDrLO+F/2fJFM0WvZ+8gd+NnR7W6i7R3wGImN5xr115sCsBWUAM7ued7QunyrumB+Sw/o1FDcW4+S5bqwONtr07bS/M5dYM7l8Uy1zO3BOxtvWOMqdEzSrmyW/j2Kg3tQq1lEze/TOPjS4LgXqqWMWHVCyzJTpfImS3u73EUisVQBPqO7y1m3fEUvZuqVeJVK9hT3PPGuX2HUAVcIMMKWIhsA2/aMYhHQ/J0UOgc/YrGzU6DWVQoaetAHPPrt+fFQXL+MbDVaLQwk18AaRe8vhMXMwWakQEzK3fGtwPeklJB78OV4HNwpGXGFQWr1wU+T1evMJ5mv8O4VvWg7pu6blwjLCEseaCuwib5tPghIFT+LXpl2jPuyRveD5Qdl4seDZwoE9joaTWlcPreQYfuCwsQnBX25Owf4uo3XzVuVrHHRfm4O7g2VqhI5W3NcVwKhfXKuqUKDfsAmbX/RlwcihmlX6UySL42EIO5Z3xcFqEtQzba3IYgLOP8yRjGzRKUklcKFjrtoa+ZQjewKjS5x685Ffjgb4PCmpearUlVeboqH34zQBiflnecZQrwdhntVRfd3F0tkbtA/Th550IqYwezBv3AqVwZZPm+q3jeM7i0HDu6JzVYsUVpxe2MTVSKncy2p6wihhdbJeTO0gnHHydlUsyd2C2P2pXUppgjoY
key-secret: AgAQ9GBMK/sXev8MKfCeYYgtf3tW93xvDn2jjTHaO/trAoU2OgWMS3kWKme/E+ONOxVOA3qonHhUgXcWxyut4OgMFJj2yBGRb+TqD+e0fE0KCqAwRKuYhXgFFl5SgAPZiWOAnYIJM16xu5Ci3UbrM8a8QAXAVV9aH3eT5HMF+GeqgSvhEVEQO1C8KOjVkawoqIHmDmr5KUbK4SFnIut+zCz/2HQLApNkZhPUY2whZOZjz4rwMtu2NDu8k08lI3Zl03OAw38rsbcNfZC8KbENsf1vthn5YpVJomcJKp/prgEp+/C64ZexgBWzZysq1WHs96F8R/ZmgD/Hu1Am/VjvHoFrfbLvXYUZzXGhyCBjhSwqcysm08uI5FvCs9F7WGVbYe5M/sYUMMJwLP5iILd2fkodm/+GWgl/p3EzQ76aCH85FqFhL3/9zA69bM8mZUpVG85i2yNJ9HvLe8z2EnZrh4BTgMRod/DsP9qN5NlofP0dJhK4SyXvy6M+ZO2V7CE4ksLvdWWXcJFmzuiG35DC/dQYHu8tcgywYyFVOw6uAetXSVrIzgGSCche1PZ7RKz2N4CqV5eTe6zUAgNPf4IxPne86f2AGKkivh+QcsIqfXkkR4OzcMslaKskkCniKD0IMf2aFHniSWzivi07gk5PYDxjwpa9AM2yUGRXYTcDSZquNXAt4SxE1YLDb5twZ8JyPP1Q884dwJ3+/M1DwTJj4CewO+zhH4MIURfRaGvipwsV
repository-string: AgBuD/n5Pnz2AwkFUR6ChGSPMTahm5fdStTay2dD12g+IJC+zNKGlY96rxy1RRLpGJi9sj5UzqIjWd2ke+BB9Xx3RfNygh+hjQEqwb15Z5w8Vo2j7iNRYdjqm/q/ug337Ycc+p2AAxEaA4GZln+Ujq7Xh0m0mOg58N640A+zuav5Xg8dQvUoO5vrqcx8lKzUwZuEayjubZPOZDtED14bTj8FWp6a8A88PjvH+xX9ZCi+omuplHFD8+iJyHewMaPq8CPxsa90J/jHR0FyEzkPcx3/zxryeodQFSiCtvMEb4TZsABMYGlFWOdJwqTcPvqSLRZH9Emx7NmaapknERxuoozDegl/KYF8GpshizBcHaV2YEPxNFiAcPMAqmLTJc0E8SbtGcWeilVdqz2z0+Ezqs0VL5DRICBVFg+HT01bYg3yL8FYd3dfeXepijXurMJodL+pORy0y6NeS9dSvOTqoGr7mf/SeaXSMG+cdHw1+V88CVozqFgV7yLe3NzoOPSIgjyoHckpprZSZHfYF9bgX4r8tT1vrlZqN/KlBcbyYsexYK9+s866b9rpZppvgYx1I50sWm+bAeMEYrVBy2sm6fAbpb1U+3+j9CICVnJ0E1VRyOCRCvh3ncpCRgDhvXAfZTMujxGWR6m9nAi6ixp6nLx3oWsgnszK0kAoxKoHTFiNGzdpr9M092ziBnjPosmLp4fV/HdmWKlldWMsbo0HkdMmPQlKQXmtzZ09WgeSHRh1T/3rSybzwXfukh1tj1IcVIM=
template:
metadata:
creationTimestamp: null
name: backblaze-credentials
namespace: backup
type: Opaque

23
infrastructure/backup/cronjobs-base/cronjob.yaml
View File

@@ -1,7 +1,7 @@
apiVersion: batch/v1
kind: CronJob
metadata:
name: restic-backblaze
name: restic-rclone-gdrive
spec:
successfulJobsHistoryLimit: 2
@@ -12,7 +12,7 @@ spec:
template:
spec:
restartPolicy: Never
hostname: restic-kluster
hostname: restic-k3s-pod
# used by restic to identify the host
containers:
# run after completion of initContainers
@@ -46,27 +46,14 @@ spec:
name: backup-nfs-access
env:
# secrets live in the same namespace as per kustomization.yaml
- name: RESTIC_REPOSITORY
value: rest:http://rclone-gcloud:8000/kluster
# lives in the same namespace
- name: RESTIC_PASSWORD
valueFrom:
secretKeyRef:
name: restic-gdrive-credentials
key: restic-password
- name: RESTIC_REPOSITORY
valueFrom:
secretKeyRef:
name: backblaze-credentials
key: repository-string
- name: AWS_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
name: backblaze-credentials
key: key-id
- name: AWS_SECRET_ACCESS_KEY
valueFrom:
secretKeyRef:
name: backblaze-credentials
key: key-secret
volumes:
- name: backup-nfs-access
persistentVolumeClaim:

8
infrastructure/backup/cronjobs-overlays/applying.md Normal file
View File

@@ -0,0 +1,8 @@
```
k kustomize backup/overlays/backup | k apply -f -
> secret/restic-credentials-backup created
> cronjob.batch/restic-backblaze-backup created
k kustomize backup/overlays/prune | k apply -f -
> secret/restic-credentials-prune created
> cronjob.batch/restic-backblaze-prune created
```

6
infrastructure/backup/cronjobs-overlays/backup/kustomization.yaml
View File

@@ -13,12 +13,12 @@ patches:
- path: restic-commands.yaml
target:
kind: CronJob
name: restic-backblaze
name: restic-rclone-gdrive
- target:
kind: CronJob
name: restic-backblaze
name: restic-rclone-gdrive
# replace the name of the cronjob
patch: |-
- op: replace
path: /metadata/name
value: restic-backblaze-backup
value: restic-gdrive-backup

4
infrastructure/backup/cronjobs-overlays/backup/restic-commands.yaml
View File

@@ -1,7 +1,7 @@
apiVersion: batch/v1
kind: CronJob
metadata:
name: restic-backblaze-backup
name: restic-gdrive-backup
spec:
schedule: "0 2 * * *"
# at 2:00, every day
@@ -27,4 +27,4 @@ spec:
- name: ntfy-command-send
env:
- name: OPERATION
value: "Restic backup to backblaze"
value: "Restic backup to gdrive"

6
infrastructure/backup/cronjobs-overlays/prune/kustomization.yaml
View File

@@ -11,12 +11,12 @@ patches:
- path: restic-commands.yaml
target:
kind: CronJob
name: restic-backblaze
name: restic-rclone-gdrive
- target:
kind: CronJob
name: restic-backblaze
name: restic-rclone-gdrive
# replace the name of the cronjob
patch: |-
- op: replace
path: /metadata/name
value: restic-backblaze-prune
value: restic-gdrive-prune

8
infrastructure/backup/cronjobs-overlays/prune/restic-commands.yaml
View File

@@ -1,7 +1,7 @@
apiVersion: batch/v1
kind: CronJob
metadata:
name: restic-backblaze-prune
name: restic-gdrive-prune
spec:
schedule: "0 0 1/15 * *"
# at midnight, the first and 15. of every month
@@ -17,15 +17,13 @@ spec:
# RESTIC_ARGS Can be for instance: --verbose --dry-run
# RESTIC_REPOSITORY is set in the secret
- >-
restic unlock
&&
restic forget
-r $(RESTIC_REPOSITORY)
--verbose=2
--keep-daily 7 --keep-weekly 10
--keep-daily 7 --keep-weekly 5
--prune
containers:
- name: ntfy-command-send
env:
- name: OPERATION
value: "Restic prune on backblaze"
value: "Restic prune on gdrive"

3
infrastructure/backup/kustomization.yaml
View File

@@ -8,6 +8,7 @@ resources:
- namespace.yaml
- pvc.yaml
- restic-password.sealedsecret.yaml
- backblaze-credentials.sealedsecret.yaml
- rclone-config.sealedsecret.yaml
- rclone-gcloud.deployment.yaml
- cronjobs-overlays/prune/
- cronjobs-overlays/backup/

32
infrastructure/backup/postgres/cronjob.yaml Normal file
View File

@@ -0,0 +1,32 @@
apiVersion: batch/v1
kind: CronJob
metadata:
name: postgres-backup
spec:
# Backup the database every day at 1AM
schedule: "0 1 * * *"
jobTemplate:
spec:
template:
spec:
containers:
- name: postgres-backup
image: postgres:15
command: ["/bin/sh"]
args:
- '-c'
- 'pg_dumpall -U postgres -h postgres-postgresql.postgres > /backup/backup-$(date +"%m-%d-%Y-%H-%M").sql'
env:
- name: PGPASSWORD
valueFrom:
secretKeyRef:
name: postgres-password
key: password
volumeMounts:
- mountPath: /backup
name: postgres-backup-claim
restartPolicy: Never
volumes:
- name: postgres-backup-claim
persistentVolumeClaim:
claimName: postgres-backup-claim

9
infrastructure/backup/postgres/kustomization.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: backup
resources:
- postgres.sealedsecret.yaml
- pvc.yaml
- cronjob.yaml

21
infrastructure/backup/postgres/postgres.sealedsecret.yaml Normal file
View File

@@ -0,0 +1,21 @@
{
"kind": "SealedSecret",
"apiVersion": "bitnami.com/v1alpha1",
"metadata": {
"name": "postgres-password",
"namespace": "backup",
"creationTimestamp": null
},
"spec": {
"template": {
"metadata": {
"name": "postgres-password",
"namespace": "backup",
"creationTimestamp": null
}
},
"encryptedData": {
"password": "AgBZViaCuD8Zm/nkDe95xVZXgeRVJ0zE64e8efigBrkM+XUT9ber034QY5USZWalJ8nC930FB5t4N96D+LyWWXiLrYQvnYHpsi+wxJd3H/EimQo1IJ7XKNHxRC226NGX8ugb9Lez71IZaldyK3tAX0yoQ5/j304+mzetP/535EKYjZ7NucYE7KMUDsb5JsAaswd2H5fIl61PK/lEVN9AJLIo9MKL0zbGDOJCh1WNG6bUn0oi825R9AT80QulXFl/qxBHQT8R/u1AIqJDnrhLf8CiMBCs60K4D/A/F3uFwzsfGF4t2tDrowbPnGL7abAfe+DeHW8WSQoiMQWe/rTb4mnaErRNWSWmSwOcFNtUt9QQG4LvH44RTLaXKxbNfZphsNtBYk+F8SPngOok8FxoyycwUwDbA5clCt/Kh9bMOfUQpXrPc/rfXR5FO23kxM8h2pfC7QYNej0k3LexcikdQrpqRj9yMAVMSI7xF35Tfc5buqasIDlgRxTSi2Pn/fAFIK3QqY7YQWZOYzuD3w6aTUx0trmHNTycmotKV/kbni/ZOMmf6NMGbZs5R3VbmA1vFtdp9YVD5dJ0t0aTXTdNuWjeC0+vQF0lnXPWonRYf65e8KOwcuDjTYU6ghDfQPngJ01FFoTgiF+X/1iZ+7uvIeIULak8dMIQz6CqfrCkahkimz5u2c+b3ZPlNnXRyPmZE/1JscLXaKuXvg=="
}
}
}

27
infrastructure/backup/postgres/pvc.yaml Normal file
View File

@@ -0,0 +1,27 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: pg-backup-data
spec:
capacity:
storage: "50Gi"
accessModes:
- ReadWriteOnce
nfs:
path: /kluster/pg-backup
server: 192.168.1.157
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: postgres-backup-claim
spec:
storageClassName: ""
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
volumeName: pg-backup-data

22
infrastructure/backup/rclone-config.sealedsecret.yaml Normal file
View File

@@ -0,0 +1,22 @@
{
"kind": "SealedSecret",
"apiVersion": "bitnami.com/v1alpha1",
"metadata": {
"name": "rclone-config-files",
"namespace": "backup",
"creationTimestamp": null
},
"spec": {
"template": {
"metadata": {
"name": "rclone-config-files",
"namespace": "backup",
"creationTimestamp": null
},
"type": "Opaque"
},
"encryptedData": {
"rclone.conf": "AgCQ13IG+R6bs+nAxe1xuDXttYlvGlLfV3oQ6c0qtoF2jXB8hN3LftydHn+Se3LjghmQKAIErfsA7ZRhJoWfFuSm2AIc3w2mMonsga5gjBx/56/tZSvnT2Bzn/5UXktTVxwEINSBP0dYiMcn4/G+5hO3bngmG+lCZXeI7yWoTW8H+8NKYxDHUzdoBBhPPPLTERTRZHB8EzOPUlefHq/2y/NpUfkxyLSjYk0/X45W6XNzH6MfdA2x6omxd4giDQSEwJGdXqIXu1rPnPjV7WVcA8qJzkQbxhzjqpUcFgM12YsLGVVW8HSSdAy+ZNdTXmhCIu2+pI+AVuol4QY9r/gU3xlGhFmc3asW5k4iOfn7/ZEr3Yk8JplAYM+GWQ07s59MqYdGOhqFUpVmkjO97Z29iaeReQZCwxzl/PmxUtfI20eTmtUlFKE3fObMr27sZcXgeJS3ktHOONGoqvHHeuqd4hfTaVAGwVOAEoBY8Xnkq3ECN5ld8V4zR8e52QHtANflN4IJgjnGO5pMQyAW+XASAJDxG48q7ruu9i0mI4vuM0rVuoWi2v9I30/M7Mv2xAYnmKC7NIao1mDya3paidHwkIu12480oBDdHZpm5NSqHtQr/HKMQWnbu6CrufrDmTqoVe/ew5uaqjbfrBBys35k5ObUUPlhU3putgfmsR3YZXDaAqOwIoXQ30wm02gCA5z/WNEY3EaKP6RhgsowwkrPPniQfz4EaxQQjmZ/toe/xpwzSZjmoVnJtJabiuqL/B/eY6WpNOTjOzsc7Z69EOyhZMs41gNoA32RRUbFO1ppOu8518cE12KpsGbH6K6NcucSrKh2Gd3xNGwjaGQVT2vLTVi9YwByiwvrsVpNU06f2v0fcZWeRgoFoUkKMj746lw0E+X7oF0+PmfPT2IeTRszHECkbStSvFZNDivcdJyDFutocAZKNjDoAnVPlTNVYwKKcmHvw3sOOXhVN7NOj/+9UxSNyRvip7GPZKtRF1u9ftlD6OaLCCVSip7MJ41a7TugBTUUaMJbQUTmidWKZn6A0nctAvdrPbBatPI2BZQ4amwdXa2bWyE7DI13WaCm6kAVJijsAmfVrVX3C+Ft5p8unbjsVQ/ErdpKTjlq9mJsie3TQdME5r74GlcURiVXdLc7KcV7vpf6yy88XS6ee+Y9WmlYDAwRX+taMilRDlunMeF5Zmh12DCXMzsradEifEOZ/Mg5BMznxvrZv3iHDArm/j4QW7Bi0To3+f2826IAaXMlI4ze7e9Ny3NUbgy85yE+RNYiio0+wvWRKraxpqI0EODy/juBed3VcoWlOfch0hKU4BZTVrU5rDEmwYcp6oWnXE92fhVH7wjy4IV3WUSubYg="
}
}
}

54
infrastructure/backup/rclone-gcloud.deployment.yaml Normal file
View File

@@ -0,0 +1,54 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: rclone-gcloud
spec:
selector:
matchLabels:
app: rclone-gcloud
template:
metadata:
labels:
app: rclone-gcloud
spec:
containers:
- name: rclone
image: rclone/rclone:latest
command: ["/bin/sh", "-c"]
args: # mounted as a secret
# >- strips newlines
# sleep infinity
- >-
rclone
--config /config/rclone.conf
serve restic
--addr :8000
-v
ETHZ-gdrive:backup
volumeMounts:
# from secret
- name: rclone-config
mountPath: /config
readOnly: true
volumes:
- name: rclone-config
secret:
secretName: rclone-config-files
---
apiVersion: v1
kind: Service
metadata:
name: rclone-gcloud
spec:
selector:
app: rclone-gcloud
ports:
- protocol: TCP
port: 8000
targetPort: 8000

4
infrastructure/external-dns/kustomization.yaml
View File

@@ -11,8 +11,8 @@ resources:
images:
- name: octodns
newName: octodns/octodns # has all plugins
newTag: "2024.09"
newTag: "2024.05"
- name: git
newName: alpine/git
newTag: "v2.45.2"
newTag: "2.43.0"

1
infrastructure/external-dns/octodns Submodule

Submodule infrastructure/external-dns/octodns added at ba74e801c1

Some files were not shown because too many files have changed in this diff Show More