Merge pull request 'Update owncloud/ocis Docker tag to v5.0.5' (#103) from renovate/owncloud-ocis-5.x into main

Reviewed-on: #103

apps/files/kustomization.yaml

@@ -13,4 +13,4 @@ namespace: files
 images:
   - name: ocis
     newName: owncloud/ocis
-    newTag: "5.0.3"
+    newTag: "5.0.5"

apps/immich/kustomization.yaml

@@ -19,6 +19,6 @@ helmCharts:
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.103.1
+    newTag: v1.105.1
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.103.1
+    newTag: v1.105.1

apps/media/kustomization.yaml

@@ -14,7 +14,7 @@ resources:
 images:
   - name: jellyfin/jellyfin
     newName: jellyfin/jellyfin
-    newTag: 10.9.0
+    newTag: 10.9.2
   - name: ghcr.io/jellyfin/jellyfin-vue
     newName: ghcr.io/jellyfin/jellyfin-vue
     newTag: stable-rc.0.3.1

apps/minecraft/curseforge.sealedsecret.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: curseforge-api
+  namespace: minecraft
+spec:
+  encryptedData:
+    key: AgBYeAiejdmxDBorvgnxQX5YvUhR3NId2vfWybMKlc27e6D/bKglLNyZMk70xSnFAPjcDmZ20mYjFPYvDOr9T6IU/REJ8QlzoKAn0xW779R4SkIxRToT+dJv+OM2avgQ9uqp7vja29xeXMjYAnQML+QGZKcrT8mE04G/Ty8rdUiv3yUXK5HFAR3SUF35aVLdlthLjpRkv1s0R7GAP4L2pNzBJNV3i37viceUSSjU0zpOa23fsQOkPAs67AIukAJBqh/hyF/hR9H1GeYZNTI3OcHcvC2iNk/XGstvv0Zy6ApzoebsfWGdsbVn+QUI0EBw+mSTPqpl71cbkz0v4S4XAVndosxWpe6AIgm5MBTU0FXIyGyoFDe1aMPq8BXiQikYVwB48oVNh9KF0xXX5AOG0whB/FEsL3OJsiNQvQ3R/Hru43JBn64oxjVtLfM3E7u8v/xr1VQahX8dylDmb4s5EV01U6O4y19Ou4td1eEMlhpJb0fBPDRUYuWxZAEDGmp+U4tAakyPed11VkcZPPn9fKAAcv8sGs3TYAbbF18hqsBnv2Wd+i7ZEvKwmdmfR/T0r1TJGsvKI7jaW0QtH256XrSxQp7a52qMKMVQWOSKw2k27t/IkRhxT2Prw4GfJvaVr4RozUaBf3LV/hfDWlDfmM2zg3X9W8HkzjotGg021OLxsa0Wzmhffvb8h4bvZwxeq3U1xaJocqXui7z0rT2pF4z3wYHR/lPtexHcOA2M8gfBGKb1rBKh+kW+N+/ZfVLNI0mokg5vrTO2nR2rb4c=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: curseforge-api
+      namespace: minecraft
+    type: Opaque

apps/minecraft/deployment.yaml

@@ -16,28 +16,31 @@ spec:
         image: minecraft
         resources:
           limits:
-            memory: "4000Mi"
-            cpu: "2500m"
+            memory: "6000Mi"
+            cpu: "3"
           requests:
-            memory: "1000Mi"
+            memory: "1500Mi"
             cpu: "500m"
         ports:
         - containerPort: 25565
         env:
         - name: EULA
           value: "TRUE"
-        - name: MODPACK
-          value: "https://www.curseforge.com/api/v1/mods/711537/files/5076228/download"
+        - name: TYPE
+          value: "AUTO_CURSEFORGE"
+        - name: CF_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: curseforge-api
+              key: key
+        - name: CF_SLUG
+          value: "vault-hunters-1-18-2"
         - name: VERSION
           value: "1.18.2"
-        # - name: VERSION
-        #   value: "1.16.5"
-        # - name: MODPACK
-        #   value: "https://mediafilez.forgecdn.net/files/3602/5/VaultHunters-OfficialModpack-1.12.1-Server.zip"
         - name: INIT_MEMORY
           value: "1G"
         - name: MAX_MEMORY
-          value: "3G"
+          value: "5G"
         - name: MOTD
           value: "VaultHunters baby!"
         - name: ENABLE_RCON

apps/minecraft/kustomization.yaml

@@ -8,6 +8,8 @@ resources:
   - pvc.yaml
   - deployment.yaml
   - service.yaml
+  - curseforge.sealedsecret.yaml
+
 
 images:
   - name: minecraft

apps/ntfy/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: binwiederhier/ntfy
     newName: binwiederhier/ntfy
-    newTag: v2.10.0
+    newTag: v2.11.0

infrastructure/external/kustomization.yaml

@@ -8,4 +8,5 @@ resources:
   - namespace.yaml
   - omv-s3.ingress.yaml
   - openmediavault.ingress.yaml
-  - proxmox.ingress.yaml
+  - proxmox.ingress.yaml
+  - wireguard.ingress.yaml

infrastructure/external/wireguard.ingress.yaml

@@ -0,0 +1,38 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: wireguard-ingressroute
+  namespace: external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`wireguard.kluster.moll.re`)
+    kind: Rule
+    services:
+    - name: wireguard
+      port: 443
+      scheme: https
+  tls:
+    certResolver: default-tls
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: wireguard
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.1
+    ports:
+      - port: 443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wireguard
+  namespace: external
+spec:
+  ports:
+    - port: 443
+      targetPort: 443

infrastructure/gitea/actions.deployment.yaml

@@ -20,7 +20,16 @@ spec:
           requests:
             memory: "128Mi"
             cpu: "500m"
+          limits:
+            memory: "2Gi"
+            cpu: "2"
         env:
+        - name: DOCKER_HOST
+          value: tcp://localhost:2376
+        - name: DOCKER_CERT_PATH
+          value: /certs/client
+        - name: DOCKER_TLS_VERIFY
+          value: "1"
         - name: GITEA_INSTANCE_URL
           value: "https://git.kluster.moll.re"
         - name: GITEA_RUNNER_REGISTRATION_TOKEN
@@ -28,12 +37,56 @@ spec:
             secretKeyRef:
               name: actions-runner-secret
               key: runner-token
+        # - name: GITEA_RUNNER_LABELS
+        #   value: ubuntu-latest:docker://node:16-bullseye,ubuntu-22.04:docker://node:16-bullseye
+        - name: ACTIONS_RUNNER_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
+          value: "true"
+        - name: ACTIONS_RUNNER_CONTAINER_HOOKS
+          value: /home/runner/k8s/index.js
+        - name: ACTIONS_RUNNER_CLAIM_NAME
+          value: runner-workdir
         - name: GITEA_RUNNER_LABELS
           value: k8s
         volumeMounts:
+        - name: runner-workdir
+          mountPath: /home/runner/_work
         - name: runner-data
           mountPath: /data
+    
       volumes:
+      - name: runner-workdir
+        persistentVolumeClaim:
+          claimName: runner-workdir
       - name: runner-data
-        emptyDir: {}
-
+        persistentVolumeClaim:
+          claimName: runner-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: runner-data
+spec:
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: "nfs-client"
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: runner-workdir
+spec:
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: "nfs-client"
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany

infrastructure/gitea/kustomization.yaml

@@ -18,7 +18,7 @@ namespace: gitea
 images:
   - name: actions-runner
     newName: ghcr.io/christopherhx/gitea-actions-runner
-    newTag: v0.0.11
+    newTag: nightly
 
 
 helmCharts:

kluster-deployments/kustomization.yaml

@@ -32,6 +32,7 @@ resources:
   - immich/
   - journal/
   - media/
+  - minecraft/application.yaml
   - monitoring/
   - ntfy/
   - recipes/

kluster-deployments/minecraft/application.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: minecraft-application
+  namespace: argocd
+spec:
+  project: apps
+  source:
+    repoURL: ssh://git@git.kluster.moll.re:2222/remoll/k3s-infra.git
+    targetRevision: main
+    path: apps/minecraft
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: minecraft
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: false