Merge pull request 'Update adguard/adguardhome Docker tag to v0.107.50' (#107) from renovate/adguard-adguardhome-0.x into main

Reviewed-on: #107

apps/adguard/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 images:
   - name: adguard/adguardhome
     newName: adguard/adguardhome
-    newTag: v0.107.48
+    newTag: v0.107.50
 
 namespace: adguard
 

apps/files/kustomization.yaml

@@ -13,4 +13,4 @@ namespace: files
 images:
   - name: ocis
     newName: owncloud/ocis
-    newTag: "5.0.3"
+    newTag: "5.0.5"

apps/immich/kustomization.yaml

@@ -19,6 +19,6 @@ helmCharts:
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.103.1
+    newTag: v1.105.1
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.103.1
+    newTag: v1.105.1

apps/media-downloads/jackett.deployment.yaml

@@ -1,47 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: jackett
-spec:
-  selector:
-    matchLabels:
-      app: jackett
-  template:
-    metadata:
-      labels:
-        app: jackett
-    spec:
-      containers:
-      - name: jackett
-        image: jackett
-        resources:
-          limits:
-            memory: "128Mi"
-            cpu: "500m"
-        ports:
-        - containerPort: 9117
-        volumeMounts:
-        - name: media
-          mountPath: /media
-        - name: config
-          mountPath: /config
-      volumes:
-      - name: media
-        persistentVolumeClaim:
-          claimName: media-downloads
-      - name: config
-        persistentVolumeClaim:
-          claimName: transmission-config
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: jackett
-spec:
-  selector:
-    app: jackett
-  ports:
-    - protocol: TCP
-      port: 9117
-      targetPort: 9117
-  type: ClusterIP

apps/media-downloads/kustomization.yaml

@@ -1,50 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: media-downloads
-
-resources:
-  - namespace.yaml
-  - pvc.yaml
-  - transmission.deployment.yaml
-  - radarr.deployment.yaml
-  - jackett.deployment.yaml
-
-
-images:
-  - name: transmission
-    newName: haugene/transmission-openvpn
-    newTag: 5.3.1
-  - name: jackett
-    newName: lscr.io/linuxserver/jackett
-    newTag: latest
-  - name: radarr
-    newName: lscr.io/linuxserver/radarr
-    newTag: 5.4.6
-
-
----
-# 2nd version
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: media-downloads
-
-
-resources: 
-  - namespace.yaml
-  - pvc.yaml
-  - qbittorrent.deployment.yaml
-  - qbittorrent.service.yaml
-  - qbittorrent.configmap.yaml
-  - radarr.deployment.yaml
-  - radarr.service.yaml
-  - radarr.configmap.yaml
-  - openvpn.secret.yaml
-
-images:
-  - name: qbittorrent
-    newName: binhex/arch-qbittorrentvpn
-    newTag: 5.0.1-1-02
-  - name: radarr
-    newName: hotio/radarr
-    newTag: release-5.14.0.9383

apps/media-downloads/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder
-  labels:
-    pod-security.kubernetes.io/enforce: privileged 

apps/media-downloads/pvc.yaml

@@ -1,35 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-config
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-config
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "10Gi"

apps/media-downloads/qbittorrent.configmap.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: qbittorrent
-  labels:
-    app: qbittorrent
-data:
-  VPN_ENABLED: yes
-  VPN_USER: vpnbook
-  VPN_PASS: e83zu76
-  VPN_PROV: custom
-  VPN_CLIENT: openvpn
-  LAN_NETWORK: 10.244.0.0/24,10.9.0.0/24
-  WEBUI_PORT: "8080"
-  ENABLE_STARTUP_SCRIPTS: no

apps/media-downloads/qbittorrent.deployment.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qbittorrent
-spec:
-  selector:
-    matchLabels:
-      app: qbittorrent
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: qbittorrent
-    spec:
-      containers:
-      - name: qbittorrent
-        image: qbittorrent
-        ports:
-        - containerPort: 8080
-        envFrom:
-        - configMapRef:
-            name: qbittorrent
-        volumeMounts:
-        - name: data
-          mountPath: /data
-        - name: config
-          mountPath: /config
-
-        securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
-
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: data
-      - name: config
-        persistentVolumeClaim:
-          claimName: qbittorrent-config

apps/media-downloads/qbittorrent.service.yaml

@@ -1,12 +0,0 @@
-kind: Service
-apiVersion: v1
-metadata:
-  name: qbittorrent
-spec:
-  selector:
-    app: qbittorrent
-  type:  ClusterIP
-  ports:
-  - name: qbittorrent
-    port:  8080
-    targetPort:  8080

apps/media-downloads/radarr.configmap.yaml

@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: radarr
-  labels:
-    app: radarr
-data:
-  # VPN_ENABLED: "true"
-  # VPN_CONF: "wg0"
-  # VPN_PROVIDER: "generic"
-  # VPN_LAN_NETWORK: "192.168.1.0/24"
-  # VPN_LAN_LEAK_ENABLED: "false"
-  # VPN_EXPOSE_PORTS_ON_LAN: ""
-  # VPN_AUTO_PORT_FORWARD: "false"
-  # VPN_AUTO_PORT_FORWARD_TO_PORTS: ""
-  # VPN_KEEP_LOCAL_DNS: "false"
-  # VPN_FIREWALL_TYPE: "auto"
-  # VPN_HEALTHCHECK_ENABLED: "false"
-  # PRIVOXY_ENABLED: "false"
-  # UNBOUND_ENABLED: "false"

apps/media-downloads/radarr.deployment.yaml

@@ -1,34 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: radarr
-spec:
-  selector:
-    matchLabels:
-      app: radarr
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: radarr
-    spec:
-      containers:
-      - name: radarr
-        image: radarr
-        ports:
-        - containerPort: 7878
-        envFrom:
-        - configMapRef:
-            name: radarr
-        volumeMounts:
-        - name: data
-          mountPath: /data
-        - name: config
-          mountPath: /config
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: data
-      - name: config
-        persistentVolumeClaim:
-          claimName: radarr-config

apps/media-downloads/radarr.service.yaml

@@ -1,12 +0,0 @@
-kind: Service
-apiVersion: v1
-metadata:
-  name: radarr
-spec:
-  selector:
-    app: radarr
-  type:  ClusterIP
-  ports:
-  - name: radarr
-    port:  7878
-    targetPort:  7878

apps/media-downloads/transmission.deployment.yaml

@@ -1,81 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: transmission
-spec:
-  selector:
-    matchLabels:
-      app: transmission
-  template:
-    metadata:
-      labels:
-        app: transmission
-    spec:
-      containers:
-      - name: transmission
-        image: transmission
-        resources:
-          limits:
-            memory: "128Mi"
-            cpu: "500m"
-        ports:
-        - containerPort: 9091
-        env:
-        - name: OPENVPN_PROVIDER
-          value: PROTONVPN
-        - name: LOCAL_NETWORK
-          value: 10.42.0.0/16
-        - name: OPENVPN_CONFIG
-          valueFrom:
-            secretKeyRef:
-              name: protonvpn
-              key: country
-        - name: OPENVPN_USERNAME
-          valueFrom:
-            secretKeyRef:
-              name: protonvpn
-              key: username
-        - name: OPENVPN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: protonvpn
-              key: password
-        volumeMounts:
-        - name: media
-          mountPath: /data
-        - name: config
-          mountPath: /config
-        securityContext:
-          capabilities:
-            add: ["NET_ADMIN"]
-      volumes:
-      - name: media
-        persistentVolumeClaim:
-          claimName: media-downloads
-      - name: config
-        persistentVolumeClaim:
-          claimName: transmission-config
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: transmission
-spec:
-  selector:
-    app: transmission
-  ports:
-    - protocol: TCP
-      port: 9091
-      targetPort: 9091
-  type: ClusterIP
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: protonvpn
-type: Opaque
-stringData:
-  country: at.protonvpn.udp,fr.protonvpn.udp,pl.protonvpn.udp,ch.protonvpn.udp
-  username: VOYkNuZs5PHjeB8w
-  password: WvKCOPijcXKOqcL5d7zjXzOPToS4zPid

apps/media/kustomization.yaml

@@ -14,7 +14,7 @@ resources:
 images:
   - name: jellyfin/jellyfin
     newName: jellyfin/jellyfin
-    newTag: 10.9.0
+    newTag: 10.9.2
   - name: ghcr.io/jellyfin/jellyfin-vue
     newName: ghcr.io/jellyfin/jellyfin-vue
     newTag: stable-rc.0.3.1

apps/minecraft/curseforge.sealedsecret.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: curseforge-api
+  namespace: minecraft
+spec:
+  encryptedData:
+    key: AgBYeAiejdmxDBorvgnxQX5YvUhR3NId2vfWybMKlc27e6D/bKglLNyZMk70xSnFAPjcDmZ20mYjFPYvDOr9T6IU/REJ8QlzoKAn0xW779R4SkIxRToT+dJv+OM2avgQ9uqp7vja29xeXMjYAnQML+QGZKcrT8mE04G/Ty8rdUiv3yUXK5HFAR3SUF35aVLdlthLjpRkv1s0R7GAP4L2pNzBJNV3i37viceUSSjU0zpOa23fsQOkPAs67AIukAJBqh/hyF/hR9H1GeYZNTI3OcHcvC2iNk/XGstvv0Zy6ApzoebsfWGdsbVn+QUI0EBw+mSTPqpl71cbkz0v4S4XAVndosxWpe6AIgm5MBTU0FXIyGyoFDe1aMPq8BXiQikYVwB48oVNh9KF0xXX5AOG0whB/FEsL3OJsiNQvQ3R/Hru43JBn64oxjVtLfM3E7u8v/xr1VQahX8dylDmb4s5EV01U6O4y19Ou4td1eEMlhpJb0fBPDRUYuWxZAEDGmp+U4tAakyPed11VkcZPPn9fKAAcv8sGs3TYAbbF18hqsBnv2Wd+i7ZEvKwmdmfR/T0r1TJGsvKI7jaW0QtH256XrSxQp7a52qMKMVQWOSKw2k27t/IkRhxT2Prw4GfJvaVr4RozUaBf3LV/hfDWlDfmM2zg3X9W8HkzjotGg021OLxsa0Wzmhffvb8h4bvZwxeq3U1xaJocqXui7z0rT2pF4z3wYHR/lPtexHcOA2M8gfBGKb1rBKh+kW+N+/ZfVLNI0mokg5vrTO2nR2rb4c=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: curseforge-api
+      namespace: minecraft
+    type: Opaque

apps/minecraft/deployment.yaml

@@ -16,28 +16,31 @@ spec:
         image: minecraft
         resources:
           limits:
-            memory: "4000Mi"
+            memory: "6000Mi"
-            cpu: "2500m"
+            cpu: "3"
           requests:
-            memory: "1000Mi"
+            memory: "1500Mi"
             cpu: "500m"
         ports:
         - containerPort: 25565
         env:
         - name: EULA
           value: "TRUE"
-        - name: MODPACK
+        - name: TYPE
-          value: "https://www.curseforge.com/api/v1/mods/711537/files/5076228/download"
+          value: "AUTO_CURSEFORGE"
+        - name: CF_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: curseforge-api
+              key: key
+        - name: CF_SLUG
+          value: "vault-hunters-1-18-2"
         - name: VERSION
           value: "1.18.2"
-        # - name: VERSION
-        #   value: "1.16.5"
-        # - name: MODPACK
-        #   value: "https://mediafilez.forgecdn.net/files/3602/5/VaultHunters-OfficialModpack-1.12.1-Server.zip"
         - name: INIT_MEMORY
           value: "1G"
         - name: MAX_MEMORY
-          value: "3G"
+          value: "5G"
         - name: MOTD
           value: "VaultHunters baby!"
         - name: ENABLE_RCON
@@ -46,6 +49,10 @@ spec:
           value: "true"
         - name: ONLINE_MODE
           value: "true"
+        - name: ENABLE_AUTOPAUSE
+          value: "true"
+        - name: AUTOPAUSE_TIMEOUT_EST
+          value: "1800"
         volumeMounts:
         - name: minecraft-data
           mountPath: /data

apps/minecraft/kustomization.yaml

@@ -8,6 +8,8 @@ resources:
   - pvc.yaml
   - deployment.yaml
   - service.yaml
+  - curseforge.sealedsecret.yaml
+
 
 images:
   - name: minecraft

apps/ntfy/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: binwiederhier/ntfy
     newName: binwiederhier/ntfy
-    newTag: v2.10.0
+    newTag: v2.11.0

infrastructure/external-dns/kustomization.yaml

@@ -15,4 +15,4 @@ images:
 
   - name: git
     newName: alpine/git
-    newTag: "2.43.0"
+    newTag: "v2.43.4"

infrastructure/external/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
   - omv-s3.ingress.yaml
   - openmediavault.ingress.yaml
   - proxmox.ingress.yaml
+  - wireguard.ingress.yaml

infrastructure/external/wireguard.ingress.yaml

@@ -0,0 +1,38 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: wireguard-ingressroute
+  namespace: external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`wireguard.kluster.moll.re`)
+    kind: Rule
+    services:
+    - name: wireguard
+      port: 443
+      scheme: https
+  tls:
+    certResolver: default-tls
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: wireguard
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.1
+    ports:
+      - port: 443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wireguard
+  namespace: external
+spec:
+  ports:
+    - port: 443
+      targetPort: 443

infrastructure/gitea/actions.deployment.yaml

@@ -20,7 +20,16 @@ spec:
           requests:
             memory: "128Mi"
             cpu: "500m"
+          limits:
+            memory: "2Gi"
+            cpu: "2"
         env:
+        - name: DOCKER_HOST
+          value: tcp://localhost:2376
+        - name: DOCKER_CERT_PATH
+          value: /certs/client
+        - name: DOCKER_TLS_VERIFY
+          value: "1"
         - name: GITEA_INSTANCE_URL
           value: "https://git.kluster.moll.re"
         - name: GITEA_RUNNER_REGISTRATION_TOKEN
@@ -28,12 +37,56 @@ spec:
             secretKeyRef:
               name: actions-runner-secret
               key: runner-token
+        # - name: GITEA_RUNNER_LABELS
+        #   value: ubuntu-latest:docker://node:16-bullseye,ubuntu-22.04:docker://node:16-bullseye
+        - name: ACTIONS_RUNNER_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
+          value: "true"
+        - name: ACTIONS_RUNNER_CONTAINER_HOOKS
+          value: /home/runner/k8s/index.js
+        - name: ACTIONS_RUNNER_CLAIM_NAME
+          value: runner-workdir
         - name: GITEA_RUNNER_LABELS
           value: k8s
         volumeMounts:
+        - name: runner-workdir
+          mountPath: /home/runner/_work
         - name: runner-data
           mountPath: /data
-      volumes:
-      - name: runner-data
-        emptyDir: {}
     
+      volumes:
+      - name: runner-workdir
+        persistentVolumeClaim:
+          claimName: runner-workdir
+      - name: runner-data
+        persistentVolumeClaim:
+          claimName: runner-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: runner-data
+spec:
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: "nfs-client"
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: runner-workdir
+spec:
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: "nfs-client"
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany

infrastructure/gitea/kustomization.yaml

@@ -18,7 +18,7 @@ namespace: gitea
 images:
   - name: actions-runner
     newName: ghcr.io/christopherhx/gitea-actions-runner
-    newTag: v0.0.11
+    newTag: nightly
 
 
 helmCharts:

kluster-deployments/kustomization.yaml

@@ -32,6 +32,7 @@ resources:
   - immich/
   - journal/
   - media/
+  - minecraft/application.yaml
   - monitoring/
   - ntfy/
   - recipes/

kluster-deployments/minecraft/application.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: minecraft-application
+  namespace: argocd
+spec:
+  project: apps
+  source:
+    repoURL: ssh://git@git.kluster.moll.re:2222/remoll/k3s-infra.git
+    targetRevision: main
+    path: apps/minecraft
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: minecraft
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: false