Merge pull request 'Update homeassistant/home-assistant Docker tag to v2024.6' (#119) from renovate/homeassistant-home-assistant-2024.x into main

Reviewed-on: #119

apps/adguard/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 images:
   - name: adguard/adguardhome
     newName: adguard/adguardhome
-    newTag: v0.107.48
+    newTag: v0.107.50
 
 namespace: adguard
 

apps/files/kustomization.yaml

@@ -13,4 +13,4 @@ namespace: files
 images:
   - name: ocis
     newName: owncloud/ocis
-    newTag: "5.0.3"
+    newTag: "5.0.5"

apps/finance/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: actualbudget
     newName: actualbudget/actual-server
-    newTag: 24.5.0
+    newTag: 24.6.0

apps/homeassistant/kustomization.yaml

@@ -15,4 +15,4 @@ resources:
 images:
   - name: homeassistant/home-assistant
     newName: homeassistant/home-assistant
-    newTag: "2024.5"
+    newTag: "2024.6"

apps/homepage/kustomization.yaml

@@ -14,4 +14,4 @@ resources:
 images:
   - name: homepage
     newName: ghcr.io/gethomepage/homepage
-    newTag: v0.8.13
+    newTag: v0.9.1

apps/immich/kustomization.yaml

@@ -19,6 +19,6 @@ helmCharts:
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.103.1
+    newTag: v1.105.1
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.103.1
+    newTag: v1.105.1

apps/media-downloads/jackett.deployment.yaml

@@ -1,47 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: jackett
-spec:
-  selector:
-    matchLabels:
-      app: jackett
-  template:
-    metadata:
-      labels:
-        app: jackett
-    spec:
-      containers:
-      - name: jackett
-        image: jackett
-        resources:
-          limits:
-            memory: "128Mi"
-            cpu: "500m"
-        ports:
-        - containerPort: 9117
-        volumeMounts:
-        - name: media
-          mountPath: /media
-        - name: config
-          mountPath: /config
-      volumes:
-      - name: media
-        persistentVolumeClaim:
-          claimName: media-downloads
-      - name: config
-        persistentVolumeClaim:
-          claimName: transmission-config
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: jackett
-spec:
-  selector:
-    app: jackett
-  ports:
-    - protocol: TCP
-      port: 9117
-      targetPort: 9117
-  type: ClusterIP

apps/media-downloads/kustomization.yaml

@@ -1,50 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: media-downloads
-
-resources:
-  - namespace.yaml
-  - pvc.yaml
-  - transmission.deployment.yaml
-  - radarr.deployment.yaml
-  - jackett.deployment.yaml
-
-
-images:
-  - name: transmission
-    newName: haugene/transmission-openvpn
-    newTag: 5.3.1
-  - name: jackett
-    newName: lscr.io/linuxserver/jackett
-    newTag: latest
-  - name: radarr
-    newName: lscr.io/linuxserver/radarr
-    newTag: 5.4.6
-
-
----
-# 2nd version
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: media-downloads
-
-
-resources: 
-  - namespace.yaml
-  - pvc.yaml
-  - qbittorrent.deployment.yaml
-  - qbittorrent.service.yaml
-  - qbittorrent.configmap.yaml
-  - radarr.deployment.yaml
-  - radarr.service.yaml
-  - radarr.configmap.yaml
-  - openvpn.secret.yaml
-
-images:
-  - name: qbittorrent
-    newName: binhex/arch-qbittorrentvpn
-    newTag: 5.0.1-1-02
-  - name: radarr
-    newName: hotio/radarr
-    newTag: release-5.14.0.9383

apps/media-downloads/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder
-  labels:
-    pod-security.kubernetes.io/enforce: privileged 

apps/media-downloads/pvc.yaml

@@ -1,35 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-config
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-config
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "10Gi"

apps/media-downloads/qbittorrent.configmap.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: qbittorrent
-  labels:
-    app: qbittorrent
-data:
-  VPN_ENABLED: yes
-  VPN_USER: vpnbook
-  VPN_PASS: e83zu76
-  VPN_PROV: custom
-  VPN_CLIENT: openvpn
-  LAN_NETWORK: 10.244.0.0/24,10.9.0.0/24
-  WEBUI_PORT: "8080"
-  ENABLE_STARTUP_SCRIPTS: no

apps/media-downloads/qbittorrent.deployment.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qbittorrent
-spec:
-  selector:
-    matchLabels:
-      app: qbittorrent
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: qbittorrent
-    spec:
-      containers:
-      - name: qbittorrent
-        image: qbittorrent
-        ports:
-        - containerPort: 8080
-        envFrom:
-        - configMapRef:
-            name: qbittorrent
-        volumeMounts:
-        - name: data
-          mountPath: /data
-        - name: config
-          mountPath: /config
-
-        securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
-
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: data
-      - name: config
-        persistentVolumeClaim:
-          claimName: qbittorrent-config

apps/media-downloads/qbittorrent.service.yaml

@@ -1,12 +0,0 @@
-kind: Service
-apiVersion: v1
-metadata:
-  name: qbittorrent
-spec:
-  selector:
-    app: qbittorrent
-  type:  ClusterIP
-  ports:
-  - name: qbittorrent
-    port:  8080
-    targetPort:  8080

apps/media-downloads/radarr.configmap.yaml

@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: radarr
-  labels:
-    app: radarr
-data:
-  # VPN_ENABLED: "true"
-  # VPN_CONF: "wg0"
-  # VPN_PROVIDER: "generic"
-  # VPN_LAN_NETWORK: "192.168.1.0/24"
-  # VPN_LAN_LEAK_ENABLED: "false"
-  # VPN_EXPOSE_PORTS_ON_LAN: ""
-  # VPN_AUTO_PORT_FORWARD: "false"
-  # VPN_AUTO_PORT_FORWARD_TO_PORTS: ""
-  # VPN_KEEP_LOCAL_DNS: "false"
-  # VPN_FIREWALL_TYPE: "auto"
-  # VPN_HEALTHCHECK_ENABLED: "false"
-  # PRIVOXY_ENABLED: "false"
-  # UNBOUND_ENABLED: "false"

apps/media-downloads/radarr.deployment.yaml

@@ -1,34 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: radarr
-spec:
-  selector:
-    matchLabels:
-      app: radarr
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: radarr
-    spec:
-      containers:
-      - name: radarr
-        image: radarr
-        ports:
-        - containerPort: 7878
-        envFrom:
-        - configMapRef:
-            name: radarr
-        volumeMounts:
-        - name: data
-          mountPath: /data
-        - name: config
-          mountPath: /config
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: data
-      - name: config
-        persistentVolumeClaim:
-          claimName: radarr-config

apps/media-downloads/radarr.service.yaml

@@ -1,12 +0,0 @@
-kind: Service
-apiVersion: v1
-metadata:
-  name: radarr
-spec:
-  selector:
-    app: radarr
-  type:  ClusterIP
-  ports:
-  - name: radarr
-    port:  7878
-    targetPort:  7878

apps/media-downloads/transmission.deployment.yaml

@@ -1,81 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: transmission
-spec:
-  selector:
-    matchLabels:
-      app: transmission
-  template:
-    metadata:
-      labels:
-        app: transmission
-    spec:
-      containers:
-      - name: transmission
-        image: transmission
-        resources:
-          limits:
-            memory: "128Mi"
-            cpu: "500m"
-        ports:
-        - containerPort: 9091
-        env:
-        - name: OPENVPN_PROVIDER
-          value: PROTONVPN
-        - name: LOCAL_NETWORK
-          value: 10.42.0.0/16
-        - name: OPENVPN_CONFIG
-          valueFrom:
-            secretKeyRef:
-              name: protonvpn
-              key: country
-        - name: OPENVPN_USERNAME
-          valueFrom:
-            secretKeyRef:
-              name: protonvpn
-              key: username
-        - name: OPENVPN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: protonvpn
-              key: password
-        volumeMounts:
-        - name: media
-          mountPath: /data
-        - name: config
-          mountPath: /config
-        securityContext:
-          capabilities:
-            add: ["NET_ADMIN"]
-      volumes:
-      - name: media
-        persistentVolumeClaim:
-          claimName: media-downloads
-      - name: config
-        persistentVolumeClaim:
-          claimName: transmission-config
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: transmission
-spec:
-  selector:
-    app: transmission
-  ports:
-    - protocol: TCP
-      port: 9091
-      targetPort: 9091
-  type: ClusterIP
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: protonvpn
-type: Opaque
-stringData:
-  country: at.protonvpn.udp,fr.protonvpn.udp,pl.protonvpn.udp,ch.protonvpn.udp
-  username: VOYkNuZs5PHjeB8w
-  password: WvKCOPijcXKOqcL5d7zjXzOPToS4zPid

apps/media/kustomization.yaml

@@ -14,7 +14,7 @@ resources:
 images:
   - name: jellyfin/jellyfin
     newName: jellyfin/jellyfin
-    newTag: 10.9.0
+    newTag: 10.9.4
   - name: ghcr.io/jellyfin/jellyfin-vue
     newName: ghcr.io/jellyfin/jellyfin-vue
     newTag: stable-rc.0.3.1

apps/minecraft/curseforge.sealedsecret.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: curseforge-api
+  namespace: minecraft
+spec:
+  encryptedData:
+    key: AgBYeAiejdmxDBorvgnxQX5YvUhR3NId2vfWybMKlc27e6D/bKglLNyZMk70xSnFAPjcDmZ20mYjFPYvDOr9T6IU/REJ8QlzoKAn0xW779R4SkIxRToT+dJv+OM2avgQ9uqp7vja29xeXMjYAnQML+QGZKcrT8mE04G/Ty8rdUiv3yUXK5HFAR3SUF35aVLdlthLjpRkv1s0R7GAP4L2pNzBJNV3i37viceUSSjU0zpOa23fsQOkPAs67AIukAJBqh/hyF/hR9H1GeYZNTI3OcHcvC2iNk/XGstvv0Zy6ApzoebsfWGdsbVn+QUI0EBw+mSTPqpl71cbkz0v4S4XAVndosxWpe6AIgm5MBTU0FXIyGyoFDe1aMPq8BXiQikYVwB48oVNh9KF0xXX5AOG0whB/FEsL3OJsiNQvQ3R/Hru43JBn64oxjVtLfM3E7u8v/xr1VQahX8dylDmb4s5EV01U6O4y19Ou4td1eEMlhpJb0fBPDRUYuWxZAEDGmp+U4tAakyPed11VkcZPPn9fKAAcv8sGs3TYAbbF18hqsBnv2Wd+i7ZEvKwmdmfR/T0r1TJGsvKI7jaW0QtH256XrSxQp7a52qMKMVQWOSKw2k27t/IkRhxT2Prw4GfJvaVr4RozUaBf3LV/hfDWlDfmM2zg3X9W8HkzjotGg021OLxsa0Wzmhffvb8h4bvZwxeq3U1xaJocqXui7z0rT2pF4z3wYHR/lPtexHcOA2M8gfBGKb1rBKh+kW+N+/ZfVLNI0mokg5vrTO2nR2rb4c=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: curseforge-api
+      namespace: minecraft
+    type: Opaque

apps/minecraft/deployment.yaml

@@ -16,28 +16,31 @@ spec:
         image: minecraft
         resources:
           limits:
-            memory: "4000Mi"
+            memory: "6000Mi"
-            cpu: "2500m"
+            cpu: "3"
           requests:
-            memory: "1000Mi"
+            memory: "1500Mi"
             cpu: "500m"
         ports:
         - containerPort: 25565
         env:
         - name: EULA
           value: "TRUE"
-        - name: MODPACK
+        - name: TYPE
-          value: "https://www.curseforge.com/api/v1/mods/711537/files/5076228/download"
+          value: "AUTO_CURSEFORGE"
+        - name: CF_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: curseforge-api
+              key: key
+        - name: CF_SLUG
+          value: "vault-hunters-1-18-2"
         - name: VERSION
           value: "1.18.2"
-        # - name: VERSION
-        #   value: "1.16.5"
-        # - name: MODPACK
-        #   value: "https://mediafilez.forgecdn.net/files/3602/5/VaultHunters-OfficialModpack-1.12.1-Server.zip"
         - name: INIT_MEMORY
           value: "1G"
         - name: MAX_MEMORY
-          value: "3G"
+          value: "5G"
         - name: MOTD
           value: "VaultHunters baby!"
         - name: ENABLE_RCON
@@ -46,6 +49,10 @@ spec:
           value: "true"
         - name: ONLINE_MODE
           value: "true"
+        - name: ENABLE_AUTOPAUSE
+          value: "true"
+        - name: AUTOPAUSE_TIMEOUT_EST
+          value: "1800"
         volumeMounts:
         - name: minecraft-data
           mountPath: /data

apps/minecraft/kustomization.yaml

@@ -8,6 +8,8 @@ resources:
   - pvc.yaml
   - deployment.yaml
   - service.yaml
+  - curseforge.sealedsecret.yaml
+
 
 images:
   - name: minecraft

apps/monitoring/kustomization.yaml

@@ -16,5 +16,5 @@ helmCharts:
   - releaseName: grafana
     name: grafana
     repo: https://grafana.github.io/helm-charts
-    version: 7.3.9
+    version: 8.0.0
     valuesFile: grafana.values.yaml

apps/ntfy/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: binwiederhier/ntfy
     newName: binwiederhier/ntfy
-    newTag: v2.10.0
+    newTag: v2.11.0

apps/recipes/kustomization.yaml

@@ -12,5 +12,5 @@ resources:
 
 images:
   - name: mealie
-    newTag: v1.6.0
+    newTag: v1.8.0
     newName: ghcr.io/mealie-recipes/mealie

infrastructure/external-dns/kustomization.yaml

@@ -15,4 +15,4 @@ images:
 
   - name: git
     newName: alpine/git
-    newTag: "2.43.0"
+    newTag: "v2.45.1"

infrastructure/gitea/README.md

@@ -0,0 +1,31 @@
+# Using gitea actions
+The actions deployment allows to use gitea actions from repositories within this instance.
+
+### Building docker images
+Docker builds use the kubernetes runner to build the images. For this to work, the pipeline needs to be able to access the kube-api. A service-account is created for this purpose.
+
+To use the correct docker builder use the following action
+```yaml
+    ...
+
+    - name: Create Kubeconfig
+      run: |
+        mkdir $HOME/.kube
+        echo "${{ secrets.BUILDX_KUBECONFIG }}" > $HOME/.kube/config
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+        driver: kubernetes
+        driver-opts: |
+          namespace=act-runner
+          qemu.install=true
+
+    ...
+
+    - name: Build and push
+      uses: docker/build-push-action@v5
+      with:
+        context: .
+        <other config>
+```

infrastructure/gitea/actions.deployment.yaml

@@ -1,25 +1,23 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: actions-runner
+  labels:
+    app: act-runner
+  name: act-runner
 spec:
+  replicas: 1
   selector:
     matchLabels:
-      app: actions-runner
+      app: act-runner
   template:
     metadata:
       labels:
-        app: actions-runner
+        app: act-runner
     spec:
-      hostname: kube-runner
+      restartPolicy: Always
-      serviceAccountName: actions-runner
       containers:
-      - name: actions-runner
+      - name: runner
-        image: actions-runner
+        image: vegardit/gitea-act-runner:dind-latest
-        resources:
-          requests:
-            memory: "128Mi"
-            cpu: "500m"
         env:
         - name: GITEA_INSTANCE_URL
           value: "https://git.kluster.moll.re"
@@ -28,12 +26,35 @@ spec:
             secretKeyRef:
               name: actions-runner-secret
               key: runner-token
-        - name: GITEA_RUNNER_LABELS
+        - name: ACTIONS_RUNNER_POD_NAME
-          value: k8s
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: GITEA_RUNNER_UID
+          value: '1000'
+        - name: GITEA_RUNNER_GID
+          value: '1000'
+        - name: GITEA_RUNNER_JOB_CONTAINER_PRIVILEGED
+          value: 'true'
+        securityContext:
+          privileged: true
         volumeMounts:
         - name: runner-data
           mountPath: /data
       volumes:
       - name: runner-data
-        emptyDir: {}
+        persistentVolumeClaim:
-
+          claimName: runner-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: runner-data
+spec:
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: "nfs-client"
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany

infrastructure/gitea/actions.rbac.yaml

@@ -1,38 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: actions-runner
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: actions-role
-rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "list", "create", "delete"]
-- apiGroups: [""]
-  resources: ["pods/exec"]
-  verbs: ["get", "create"]
-- apiGroups: [""]
-  resources: ["pods/log"]
-  verbs: ["get", "list", "watch",]
-- apiGroups: ["batch"]
-  resources: ["jobs"]
-  verbs: ["get", "list", "create", "delete"]
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "list", "create", "delete"]
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: actions-role-binding
-subjects:
-- kind: ServiceAccount
-  name: actions-runner
-  apiGroup: ""
-roleRef:
-  kind: Role
-  name: actions-role
-  apiGroup: rbac.authorization.k8s.io

infrastructure/gitea/actions.sealedsecret.yaml

@@ -7,7 +7,7 @@ metadata:
   namespace: gitea
 spec:
   encryptedData:
-    runner-token: AgBHwek/Aj/0oOnI/bnZ4FgtRoeJw4tIKvcDzBhaPdQ7bMVHyHUKYUNP7lkPgZrIN+7rhMY7C/j13iGWx4iTdhTgipLiJvyZ70pXKLSix4IpcypJTElggWkW0JW79x1HyJfBtn9iJiHnEZXPi7sEnyKhA0asAOR0ae8NS6mxxei0TIImaPaC2RHL6MOi40xsXpHz2ZaVhDQaTSRWjv0U6+WkCGcueqM2HLYfF1gqqkzGCjjhdOTK1CKvIvApZ5n8x6x94IiywCXJraDCwLz+acF2c2vA/Jb/3p7TwyyRZ5uIF5LZufhTJ6+5sFJSReHYxO4CpPA8KvM880vtiEjN7LxVo/Jruj2459OvjviKZS03ZwLHHrjanom1+HA9Sx2ffRLiR5ayGkfj/6kvpIRt5x1F7BbPp+a0LXuxJX+1nGDyEa1D1WzVKvZASav6/v7cXcom/nKGO91Zb8qHlOv7ZTs5guGQ9G9VCOHOG8szwpW3ZmQwWfFoWsShzqbDqszBYOGeIjIiDllLzTZ8A9dv9J2ELngZ1IPGIkfpQNEW8hsbNXTYhdVIrkh7BIFkRWfYDNWxqZd4iE6XllQcT1rqndusgiNEJX2r+P4nT8dPewATXQ79wzvZU3kB+VHzM8cLymlVGADi7v/qTY9RcrhuE0oMLzHRShr6JU05VfLGbMsttrYKmW7smvBp3lRJitO5A8+r8cRniS1+Xr8mIx87vCvnoWSH6BKkl9pCdDeCGylAWfkJN9UpkaKg
+    runner-token: AgCexZDTtbYOdG3XgvmOh9CwxzTT+dhPVCPYv/arp8cM9R45PFIfwDvFCThnTHQYZJIYpsaUvoxdXSYYdhLyBVhmuAdD0NeH47q7qRh4U6WYUF6RMqUV3Dpri00nrROx2MN8Q+uGN+wq2xloSbkDzLiS+0sD8m+ItIKhEjIMcn9PyA2OheUmbCVfyOVzCEEaOt98nweTlOXgQLJBLPhxUJFCMePfGHudAlu2lZO3dH+T8G9cC86akZnAODuI69iScuIVOtGJvj1EhPNg9d7QjmjWZOKlk0ryPdwEoR/+kD069Jp4STX7IsVqKxZcvnY8yUICbmvj2TzJWzUDMit3leBopO+8+ECSng4uANGwp3QyankmyWD8SXN3fTuASoeoWa5mYN/qCih9m5ih7FxsDNqAFumUzX1QtAN3LDmzgcomdC7D6FHc1PIaOjoEF96TaDgBc8ODMRBWDtjCzD5sTLQ3zGLRieFsOxkdb0d9E+E4pestmnbdtwNTpfgtyT0pr2847FyAmS0DhA6bb4i+JohNswo+83koJQWf1UNyKhQ14kPhPiBRp1cnYieswFjSuvBbWAjB+SYrFIns97qJon2UjwcnlJ6/KewKj5KTOWnTel1Sgxgn4y7qXFnLvReIEKc6SCz+aFFEa4qAqJVmS1STMEwcqkiM7gA+he/8mdEB0BmfwdnGK0pA1I+RD4hOhDqIQlGyTtWGQINqFulbNUS2PcLmf5nX/ERRRPLlwmZNwR27pP3iQg29
   template:
     metadata:
       creationTimestamp: null

infrastructure/gitea/drone-kube-runner.deployment.yaml

@@ -1,84 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: drone-runner
----
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: drone-runner
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - create
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/log
-  verbs:
-  - get
-  - create
-  - delete
-  - list
-  - watch
-  - update
-
----
-
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: drone-runner
-subjects:
-- kind: ServiceAccount
-  name: drone-runner
-roleRef:
-  kind: Role
-  name: drone-runner
-  apiGroup: rbac.authorization.k8s.io
-
----
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: drone-runner
-  labels:
-    app.kubernetes.io/name: drone-runner
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: drone-runner
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: drone-runner
-    spec:
-      serviceAccountName: drone-runner
-      containers:
-      - name: runner
-        image: drone/drone-runner-kube:latest
-        ports:
-        - containerPort: 3000
-        env:
-        - name: DRONE_RPC_HOST
-          value: drone-server:80
-        - name: DRONE_RPC_PROTO
-          value: http
-        - name: DRONE_RPC_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: drone-server-secret
-              key: rpc_secret
-        - name: DRONE_NAMESPACE_DEFAULT
-          value: gitea
-        # - name: DRONE_NAMESPACE_RULES
-        #   value: "drone-runner:*"
-        - name: DRONE_SERVICE_ACCOUNT_DEFAULT
-          value: drone-runner

infrastructure/gitea/drone-server.deployment.yaml

@@ -1,117 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: drone-server
-  labels:
-    app: drone-server
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: drone-server
-  template:
-    metadata:
-      labels:
-        app: drone-server
-    spec:
-      containers:
-      - name: drone
-        image: drone/drone:latest
-        env:
-          - name: DRONE_SERVER_PORT # because the deployment is called drone-server, override this var again!
-            value: ":80"
-          - name: DRONE_GITEA_SERVER
-            value: https://git.kluster.moll.re
-          - name: DRONE_USER_CREATE
-            value: username:remoll,admin:true
-          - name: DRONE_GITEA_CLIENT_ID
-            valueFrom:
-              secretKeyRef:
-                name: drone-server-secret
-                key: client_id
-          - name: DRONE_GITEA_CLIENT_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: drone-server-secret
-                key: client_secret
-          - name: DRONE_RPC_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: drone-server-secret
-                key: rpc_secret
-          - name: DRONE_SERVER_HOST
-            value: drone.kluster.moll.re
-          - name: DRONE_SERVER_PROTO
-            value: https
-        resources:
-          requests:
-            memory: "1Gi"
-            cpu: 1.5
-        volumeMounts:
-        - mountPath: /data
-          name: drone-data-nfs
-      volumes:
-      - name: drone-data-nfs
-        persistentVolumeClaim:
-          claimName: drone-data-nfs
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: drone-server
-  labels:
-    app: drone-server
-
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    name: http
-  selector:
-    app: drone-server
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: drone-server-ingress
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`drone.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: drone-server
-      port: 80
-  tls:
-    certResolver: default-tls
-
-
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: drone-data-nfs
-spec:
-  capacity:
-    storage: "1Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/drone
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: drone-data-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
-  volumeName: drone-data-nfs

infrastructure/gitea/drone-server.sealedsecret.yaml

@@ -1,23 +0,0 @@
-{
-  "kind": "SealedSecret",
-  "apiVersion": "bitnami.com/v1alpha1",
-  "metadata": {
-    "name": "drone-server-secret",
-    "namespace": "gitea",
-    "creationTimestamp": null
-  },
-  "spec": {
-    "template": {
-      "metadata": {
-        "name": "drone-server-secret",
-        "namespace": "gitea",
-        "creationTimestamp": null
-      }
-    },
-    "encryptedData": {
-      "client_id": "AgA53a7kGJ6zZcx2ooTvTNwxaW2FvfzHJnxg6co54+HXinTJKsc4+GJ1PtdIbsZ7Dgu/sLi/4X90fT+PT2sgEx9jIilmHPdJeRtwV1UID3Y46A7cJlfcAKwNOFzp2PWvBvizbNp7tbJwxeAYnVX8GfN6fi700QxBGqAI3u8qQvLpU6UGW2RM96gCXI7s1QhE1Le6TgoESy5HX95pB7csDRNSwVE02OWfDHKEjH8QD8UvBB9xct6uwDfu7KrsJiNJvWMP6arvpfhy/X+UtCTFmj5wmFYL7oc6vSiCkq+QyHgQTEHTmGpEjEGKcQxPQaus3KhbhcxQBYLMEMYRlLPH0AEAA4dzbSpoVXM3LuIe9FppgrTCknK1uRB8wyrHUeInWO8mG7UraV6m5PUS+UYODMvfjwY3PyiGhTSf6LgMlhMl8e+2rb+OsWphT8Pbeom33PucrYaRFr9RpQkJSwE6HU3JEh25YLfIJ7caqRND8C/p8kD679C8UMcNpBN8WS4Cswn5jzmwbeJNM5DGp9yQVZNx7Bv3dHzx9i3ShjJ6QQnR/zWJZ/dWLy6weGYmdZMMXRAO8CCdruvcX5YyeieXZfchSIlZ/GqqBHptdcLpwLiZsfmyTWeBvk5pMAsZaKJ1tfWpQ84s4epzMoieTfhTueGXmeRKX+DJBBcriU+5YoqNxpU1lPL+LoInorJSKN7c3ouFx78N3GDOCq7mlWI94lY0bIs5zhrfUN137ITCcED62AJ7vks=",
-      "client_secret": "AgDQXU7x6RLhE9Hc+goeR2+3rW316SLLLA8tfqx3tsykL+vxhRkY5UCEaak3Rgei0k14jB/Rmme+/O/D1/5tc/i885+sGn0yjU7Jo4L5nkIssUOHlmRSGkRJDb9ABPauFXAjap9KLix9bd8ewI7R0lS3tOK9ZhThYhcfDUqV9qkkbSHzwNptkH7gYWt9qzG/rqqqpFP+PCtjzKVve4LCBgaxetcnh1t+d5oh7VAFnSI9Bt1G/DRzi+K3YZ+YG5+XKevBp06GMiLUMiv/eUvmOfAB/KO79LnNVbOcRsAHfnqLbXgNjFzspr5xDiGMC/ma1245LavywqXDp0S9jjNEe48i51PPQMwHWV8XEovsM6LHcteluNogt+VkL4mOnmP+sba/V3NO51rt1WXl+ca+U4kBq4dLMsdpWUKemz9BlIRC4etEXjwKJ5DznT7u6GUTrXx2RCm1j0OYWM++P10SdyD6tGjKnZf88a33Wrwm8Y7c47JrPTlP4PqLq9gzvD310uVfs1vGYGULaToGy+D/th8qiWWlu7BIfwqlIj8lruVnOhQ4GeEZmUAsqYf8JfsBwuDc0Y+8qbwjFrr2z+5x+2XBL8KGZVopyme45SHijlBZs7YsJqTBsg5oW09grM8/oO731GtzSYmpat2VZlaILuTjALqo/cu//kxwmqh7UX+jnTJ/2N3bKKSAfHWbHDeHeS2XJ+eKaI4onNYW9J70EfAP3vOpU+zmQ8rOzJuJjRt0HarLwzc5CXb1Xhlgsaoj7zKXPQMnqIDngg==",
-      "rpc_secret": "AgAcJNCFtOhK28vnLredkTgsVpnMPwaXss5NT5ysc0IbVid2vWRk2CTjBZc5DzjxxLwI1Ok88MFXHP08ZGCYy4rIbwoi7Ei1OEevGWfaI4n5CvAxr4ZamQHSfIX9dVAm9BSSx2M/mDtCKqVEGJEzyHCedrxf6LXM/YTNgjD43BuCZZMu35mRsHItpYFZQSttlHiUvR8y2YKrhV2P7fiWRD3cCVao8ldzKfGuvRfal8ByGoxpsYLj2D9CdtPvRF/TQsWUJJWwzbI9DmbW1MMI4/b26Jfa5TBvHxS1MQxFJpSXuMIengO+b0bi7WaR36y/FrKSNxIrQDHI7XCb00yYaSfj3RkSBVoAD0a2p8vNupHCqsKBoaWd8tMv/wGP8wbBk4DgGeQiTIvfhbQZU/Q2/LVDDficjXVn3IuKP/cqgGVf6lUh5YsUSs8qwpMil7XySiHvaZn+iFAnsXoejd4S2e/pbRvyaxP1aa7TCxnINjpU7IrnUEUiI4glQmAte3MqZWLXcc0Uk3Qz9PP0cD+V8qCOryrPMP2kTAI8LT/K4DgcEMAEGes4Vx1l0oBMF0xJvhM2kZXcEcf0NzuQJvYTgZpQF5xp0TchezLshmEUSIkII9NvAvn+iEYJeHsJUDijjmBloSYe4+QTgdYh6FakVUwYI5U4ztDNrvgqhWjExfbn8HxaFzsNTsuzGoYs+jwXH8Wk2z1Q1oQjDdO5YTjmdqvkSTdin/5CiuCDHaQX6a4gNQ=="
-    }
-  }
-}

infrastructure/gitea/kustomization.yaml

@@ -5,21 +5,13 @@ resources:
   - gitea.pvc.yaml
   - gitea.ingress.yaml
   - gitea.servicemonitor.yaml
-  - drone-kube-runner.deployment.yaml
-  - drone-server.deployment.yaml
-  - drone-server.sealedsecret.yaml
   - actions.deployment.yaml
   - actions.sealedsecret.yaml
-  - actions.rbac.yaml
+  # - actions.rbac.yaml
 
 
 namespace: gitea
 
-images:
-  - name: actions-runner
-    newName: ghcr.io/christopherhx/gitea-actions-runner
-    newTag: v0.0.11
-
 
 helmCharts:
   - name: gitea

kluster-deployments/kustomization.yaml

@@ -32,6 +32,7 @@ resources:
   - immich/
   - journal/
   - media/
+  - minecraft/application.yaml
   - monitoring/
   - ntfy/
   - recipes/

kluster-deployments/minecraft/application.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: minecraft-application
+  namespace: argocd
+spec:
+  project: apps
+  source:
+    repoURL: ssh://git@git.kluster.moll.re:2222/remoll/k3s-infra.git
+    targetRevision: main
+    path: apps/minecraft
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: minecraft
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: false