using an alternative stack

Reviewed-on: #94

.gitignore

@@ -1,2 +1,6 @@
+# Kubernetes secrets
 *.secret.yaml
-charts/
+main.key
+
+# Helm Chart files
+charts/

.gitmodules

@@ -1,3 +1,6 @@
 [submodule "infrastructure/external-dns/octodns"]
 	path = infrastructure/external-dns/octodns
 	url = ssh://git@git.kluster.moll.re:2222/remoll/dns.git
+[submodule "apps/monitoring/dashboards"]
+	path = apps/monitoring/dashboards
+	url = ssh://git@git.kluster.moll.re:2222/remoll/grafana-dashboards.git

README.md

@@ -1,7 +1,6 @@
 # Kluster setup and IaaC using argoCD
 
 
-
 ### Initial setup
 #### Requirements:
 - A running k3s instance
@@ -28,5 +27,21 @@ The app-of-apps will bootstrap a fully featured cluster with the following compo
     - immich
     - ...
 
+#### Recap
+- install sealedsecrets see [README](./infrastructure/sealedsecrets/README.md)
+    ```bash
+    kubectl apply -k infrastructure/sealedsecrets
+    kubectl apply -f infrastructure/sealedsecrets/main.key
+    kubectl delete pod -n kube-system -l name=sealed-secrets-controller
+    ```
+- install argocd
+    ```bash
+    kubectl apply -k infrastructure/argocd
+    ```
+- wait...
+
 
 ### Adding an application
+todo
+
+

apps/adguard/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
 metadata:
   name: adguard-tls-ingress

apps/adguard/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 images:
   - name: adguard/adguardhome
     newName: adguard/adguardhome
-    newTag: v0.107.44
+    newTag: v0.107.48
 
 namespace: adguard
 

apps/files/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: ocis-statefulset
+spec:
+  selector:
+    matchLabels:
+      app: ocis
+  serviceName: ocis-web
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: ocis
+    spec:
+      containers:
+      - name: ocis
+        image: ocis
+        resources:
+          limits:
+            memory: "1Gi"
+            cpu: "1000m"
+        env:
+        - name: OCIS_INSECURE
+          value: "true"
+        - name: OCIS_URL
+          value: "https://ocis.kluster.moll.re"
+        - name: OCIS_LOG_LEVEL
+          value: "debug"
+        ports:
+        - containerPort: 9200
+        volumeMounts:
+        - name: config
+          mountPath: /etc/ocis
+        # - name: ocis-config-file
+        #   mountPath: /etc/ocis/config.yaml
+        - name: data
+          mountPath: /var/lib/ocis
+      volumes:
+      # - name: ocis-config
+      #   persistentVolumeClaim:
+      #     claimName: ocis-config
+      - name: config
+        secret:
+          secretName: ocis-config
+      - name: data
+        persistentVolumeClaim:
+          claimName: ocis

apps/files/ingress.yaml

@@ -0,0 +1,18 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ocis-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`ocis.kluster.moll.re`)
+    kind: Rule
+    services:
+    - name: ocis-web
+      port: 9200
+      scheme: https
+
+  tls:
+    certResolver: default-tls 

apps/files/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: 
+  - namespace.yaml
+  - ingress.yaml
+  - service.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - ocis-config.sealedsecret.yaml
+
+namespace: files
+
+images:
+  - name: ocis
+    newName: owncloud/ocis
+    newTag: "5.0.3"

apps/files/pvc.yaml

@@ -1,11 +1,11 @@
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: syncthing-claim
+  name: ocis
 spec:
-  storageClassName: nfs-client
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: 150Gi

apps/files/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ocis-web
+spec:
+  selector:
+    app: ocis
+  ports:
+  - port: 9200
+    targetPort: 9200

apps/finance/actualbudget.deployment.yaml

@@ -22,13 +22,13 @@ spec:
             - name: TZ
               value: Europe/Berlin
           volumeMounts:
-            - name: actualbudget-data-nfs
+            - name: data
               mountPath: /data
           ports:
             - containerPort: 5006
               name: http
               protocol: TCP
       volumes:
-        - name: actualbudget-data-nfs
+        - name: data
           persistentVolumeClaim:
-            claimName: actualbudget-data-nfs
+            claimName: data

apps/finance/actualbudget.ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: actualbudget

apps/finance/actualbudget.pvc.yaml

@@ -1,27 +1,11 @@
 apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: "actualbudget-data-nfs"
-spec:
-  capacity:
-    storage: "5Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/actualbudget
-    server: 192.168.1.157
-
----
-apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: "actualbudget-data-nfs"
+  name: "data"
 spec:
-  storageClassName: ""
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
       storage: "5Gi"
-
-  volumeName: actualbudget-data-nfs

apps/finance/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: actualbudget
     newName: actualbudget/actual-server
-    newTag: 24.2.0
+    newTag: 24.5.0

apps/homeassistant/deployment.yaml

@@ -1,4 +1,3 @@
-
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -22,7 +21,7 @@ spec:
           - name: TZ
             value: Europe/Berlin
           volumeMounts:
-            - name: config
+            - name: config-dir
               mountPath: /config
           resources:
             requests:
@@ -32,6 +31,7 @@ spec:
               cpu: "2"
               memory: "1Gi"
       volumes:
-        - name: config
+        - name: config-dir
           persistentVolumeClaim:
-            claimName: homeassistant-nfs
+            claimName: config
+

apps/homeassistant/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: homeassistant-ingress
@@ -6,7 +6,7 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`home.kluster.moll.re`)
+    - match: Host(`home.kluster.moll.re`) && !Path(`/api/prometheus`)
       middlewares:
         - name: homeassistant-websocket
       kind: Rule
@@ -15,9 +15,8 @@ spec:
           port: 8123
   tls:
     certResolver: default-tls
-
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: homeassistant-websocket
@@ -27,6 +26,3 @@ spec:
       X-Forwarded-Proto: "https"
       # enable websockets
       Upgrade: "websocket"
-
-
-

apps/homeassistant/kustomization.yaml

@@ -9,8 +9,10 @@ resources:
   - pvc.yaml
   - service.yaml
   - deployment.yaml
+  - servicemonitor.yaml
+
 
 images:
   - name: homeassistant/home-assistant
     newName: homeassistant/home-assistant
-    newTag: "2024.2"
+    newTag: "2024.5"

apps/homeassistant/pvc.yaml

@@ -1,28 +1,11 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: homeassistant-nfs
-spec:
-  # storageClassName: slow
-  capacity:
-    storage: "1Gi"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /kluster/homeassistant
-    server: 192.168.1.157
----
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: homeassistant-nfs
+  name: config
 spec:
-  storageClassName: ""
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
       storage: "1Gi"
-  volumeName: homeassistant-nfs

apps/homeassistant/service.yaml

@@ -7,4 +7,5 @@ spec:
     app: homeassistant
   ports:
   - port: 8123
-    targetPort: 8123
+    targetPort: 8123
+    name: http

apps/homeassistant/servicemonitor.yaml

@@ -0,0 +1,13 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: homeassistant-servicemonitor
+  labels:
+    app: homeassistant
+spec:
+  selector:
+    matchLabels:
+      app: homeassistant
+  endpoints:
+    - port: http
+      path: /api/prometheus

apps/homepage/configmap.yaml

@@ -0,0 +1,98 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config
+  labels:
+    app.kubernetes.io/name: homepage
+data:
+  kubernetes.yaml: "" #|
+  #  mode: cluster
+  settings.yaml: |
+    title: "Homepage"
+    background: https://images.unsplash.com/photo-1547327132-5d20850c62b5?q=80&w=3870&auto=format&fit=crop
+    cardBlur: sm
+  #settings.yaml: |
+  #  providers:
+  #    longhorn:
+  #      url: https://longhorn.my.network
+  custom.css: ""
+  custom.js: ""
+  bookmarks.yaml: |
+    - Developer:
+        - Github:
+            - abbr: GH
+              href: https://github.com/moll-re
+  services.yaml: |
+    - Media:
+        - Jellyfin backend:
+            href: https://media-backend.kluster.moll.re
+            ping: media-backend.kluster.moll.re
+        - Jellyfin vue:
+            href: https://media.kluster.moll.re
+            ping: media.kluster.moll.re
+        - Immich:
+            href: https://immich.kluster.moll.re
+            ping: immich.kluster.moll.re
+
+    - Productivity:
+        - OwnCloud:
+            href: https://ocis.kluster.moll.re
+            ping: ocis.kluster.moll.re
+        - ToDo:
+            href: https://todos.kluster.moll.re
+            ping: todos.kluster.moll.re
+        - Finance:
+            href: https://finance.kluster.moll.re
+            ping: finance.kluster.moll.re
+
+    - Home:
+        - Home Assistant:
+            href: https://home.kluster.moll.re
+            ping: home.kluster.moll.re
+        - Grafana:
+            href: https://grafana.kluster.moll.re
+            ping: grafana.kluster.moll.re
+        - Recipes:
+            href: https://recipes.kluster.moll.re
+            ping: recipes.kluster.moll.re
+    
+    - Infra:
+        - Gitea:
+            href: https://git.kluster.moll.re
+            ping: git.kluster.moll.re
+        - ArgoCD:
+            href: https://argocd.kluster.moll.re
+            ping: argocd.kluster.moll.re
+
+  widgets.yaml: |
+    # - kubernetes:
+    #     cluster:
+    #       show: true
+    #       cpu: true
+    #       memory: true
+    #       showLabel: true
+    #       label: "cluster"
+    #     nodes:
+    #       show: true
+    #       cpu: true
+    #       memory: true
+    #       showLabel: true
+    - search:
+        provider: duckduckgo
+    - openmeteo:
+        label: Zürich # optional
+        latitude: 47.24236
+        longitude: 8.30439
+        units: metric # or imperial
+        cache: 30 # Time in minutes to cache API responses, to stay within limits
+        format: # optional, Intl.NumberFormat options
+            maximumFractionDigits: 1
+    - datetime:
+        locale: de
+        format:
+          dateStyle: long
+          timeStyle: short
+    - adguard:
+        url: http://adguard-home-web.adguard-home:3000
+
+  docker.yaml: ""

apps/homepage/deployment.yaml

@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homepage
+  labels:
+    app.kubernetes.io/name: homepage
+spec:
+  revisionHistoryLimit: 3
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: homepage
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: homepage
+    spec:
+      # serviceAccountName: homepage
+      # automountServiceAccountToken: true
+      dnsPolicy: ClusterFirst
+      # enableServiceLinks: true
+      containers:
+        - name: homepage
+          image: homepage
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /app/config/custom.js
+              name: config
+              subPath: custom.js
+            - mountPath: /app/config/custom.css
+              name: config
+              subPath: custom.css
+            - mountPath: /app/config/bookmarks.yaml
+              name: config
+              subPath: bookmarks.yaml
+            - mountPath: /app/config/docker.yaml
+              name: config
+              subPath: docker.yaml
+            - mountPath: /app/config/kubernetes.yaml
+              name: config
+              subPath: kubernetes.yaml
+            - mountPath: /app/config/services.yaml
+              name: config
+              subPath: services.yaml
+            - mountPath: /app/config/settings.yaml
+              name: config
+              subPath: settings.yaml
+            - mountPath: /app/config/widgets.yaml
+              name: config
+              subPath: widgets.yaml
+            - mountPath: /app/config/logs
+              name: logs
+      volumes:
+        - name: config
+          configMap:
+            name: config
+        - name: logs
+          emptyDir: {}

apps/homepage/ingress.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: homepage-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`start.kluster.moll.re`)
+      kind: Rule
+      services:
+        - name: homepage-web
+          port: 3000
+  tls:
+    certResolver: default-tls

apps/homepage/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: homepage
+
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - configmap.yaml
+  - ingress.yaml
+
+
+images:
+  - name: homepage
+    newName: ghcr.io/gethomepage/homepage
+    newTag: v0.8.13

apps/homepage/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: homepage-web
+  labels:
+    app.kubernetes.io/name: homepage
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: homepage

apps/immich/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: stripprefix
@@ -7,7 +7,7 @@ spec:
     prefixes:
       - /api
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: websocket
@@ -18,7 +18,7 @@ spec:
       # enable websockets
       Upgrade: "websocket"
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
     name: immich-ingressroute

apps/immich/kustomization.yaml

@@ -12,14 +12,13 @@ namespace: immich
 helmCharts:
   - name: immich
     releaseName: immich
-    version: 0.3.1
+    version: 0.6.0
     valuesFile: values.yaml
     repo: https://immich-app.github.io/immich-charts
 
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.95.1
+    newTag: v1.103.1
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.95.1
+    newTag: v1.103.1
-

apps/immich/postgres.yaml

@@ -1,4 +1,3 @@
-
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
@@ -10,7 +9,7 @@ spec:
     initdb:
       owner: immich
       database: immich
-      secret: 
+      secret:
         name: postgres-password
 
   postgresql:
@@ -19,7 +18,12 @@ spec:
 
   storage:
     size: 1Gi
-    storageClass: nfs-client
+    pvcTemplate:
+      storageClassName: ""
+      resources:
+        requests:
+          storage: "1Gi"
+      volumeName: immich-postgres
 
   monitoring:
     enablePodMonitor: true

apps/immich/pvc.yaml

@@ -24,3 +24,17 @@ spec:
     requests:
       storage: "50Gi"
   volumeName: immich-nfs
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: immich-postgres
+spec:
+  capacity:
+    storage: "1Gi"
+  accessModes:
+    - ReadWriteOnce
+  nfs:
+    path: /kluster/immich-postgres
+    server: 192.168.1.157
+# later used by cnpg

apps/media-downloads/jackett.deployment.yaml

@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jackett
+spec:
+  selector:
+    matchLabels:
+      app: jackett
+  template:
+    metadata:
+      labels:
+        app: jackett
+    spec:
+      containers:
+      - name: jackett
+        image: jackett
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 9117
+        volumeMounts:
+        - name: media
+          mountPath: /media
+        - name: config
+          mountPath: /config
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: media-downloads
+      - name: config
+        persistentVolumeClaim:
+          claimName: transmission-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jackett
+spec:
+  selector:
+    app: jackett
+  ports:
+    - protocol: TCP
+      port: 9117
+      targetPort: 9117
+  type: ClusterIP

apps/media-downloads/kustomization.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: media-downloads
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - transmission.deployment.yaml
+  - radarr.deployment.yaml
+  - jackett.deployment.yaml
+
+
+images:
+  - name: transmission
+    newName: haugene/transmission-openvpn
+    newTag: 5.3.1
+  - name: jackett
+    newName: lscr.io/linuxserver/jackett
+    newTag: latest
+  - name: radarr
+    newName: lscr.io/linuxserver/radarr
+    newTag: 5.4.6
+
+
+---
+# 2nd version
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: media-downloads
+
+
+resources: 
+  - namespace.yaml
+  - pvc.yaml
+  - qbittorrent.deployment.yaml
+  - qbittorrent.service.yaml
+  - qbittorrent.configmap.yaml
+  - radarr.deployment.yaml
+  - radarr.service.yaml
+  - radarr.configmap.yaml
+  - openvpn.secret.yaml
+
+images:
+  - name: qbittorrent
+    newName: binhex/arch-qbittorrentvpn
+    newTag: 5.0.1-1-02
+  - name: radarr
+    newName: hotio/radarr
+    newTag: release-5.14.0.9383

apps/media-downloads/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder
+  labels:
+    pod-security.kubernetes.io/enforce: privileged 

apps/media-downloads/pvc.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-config
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: qbittorrent-config
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "10Gi"

apps/media-downloads/qbittorrent.configmap.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: qbittorrent
+  labels:
+    app: qbittorrent
+data:
+  VPN_ENABLED: yes
+  VPN_USER: vpnbook
+  VPN_PASS: e83zu76
+  VPN_PROV: custom
+  VPN_CLIENT: openvpn
+  LAN_NETWORK: 10.244.0.0/24,10.9.0.0/24
+  WEBUI_PORT: "8080"
+  ENABLE_STARTUP_SCRIPTS: no

apps/media-downloads/qbittorrent.deployment.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrent
+spec:
+  selector:
+    matchLabels:
+      app: qbittorrent
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: qbittorrent
+    spec:
+      containers:
+      - name: qbittorrent
+        image: qbittorrent
+        ports:
+        - containerPort: 8080
+        envFrom:
+        - configMapRef:
+            name: qbittorrent
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: config
+          mountPath: /config
+
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: data
+      - name: config
+        persistentVolumeClaim:
+          claimName: qbittorrent-config

apps/media-downloads/qbittorrent.service.yaml

@@ -0,0 +1,12 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: qbittorrent
+spec:
+  selector:
+    app: qbittorrent
+  type:  ClusterIP
+  ports:
+  - name: qbittorrent
+    port:  8080
+    targetPort:  8080

apps/media-downloads/radarr.configmap.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: radarr
+  labels:
+    app: radarr
+data:
+  # VPN_ENABLED: "true"
+  # VPN_CONF: "wg0"
+  # VPN_PROVIDER: "generic"
+  # VPN_LAN_NETWORK: "192.168.1.0/24"
+  # VPN_LAN_LEAK_ENABLED: "false"
+  # VPN_EXPOSE_PORTS_ON_LAN: ""
+  # VPN_AUTO_PORT_FORWARD: "false"
+  # VPN_AUTO_PORT_FORWARD_TO_PORTS: ""
+  # VPN_KEEP_LOCAL_DNS: "false"
+  # VPN_FIREWALL_TYPE: "auto"
+  # VPN_HEALTHCHECK_ENABLED: "false"
+  # PRIVOXY_ENABLED: "false"
+  # UNBOUND_ENABLED: "false"

apps/media-downloads/radarr.deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: radarr
+spec:
+  selector:
+    matchLabels:
+      app: radarr
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: radarr
+    spec:
+      containers:
+      - name: radarr
+        image: radarr
+        ports:
+        - containerPort: 7878
+        envFrom:
+        - configMapRef:
+            name: radarr
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: config
+          mountPath: /config
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: data
+      - name: config
+        persistentVolumeClaim:
+          claimName: radarr-config

apps/media-downloads/radarr.service.yaml

@@ -0,0 +1,12 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: radarr
+spec:
+  selector:
+    app: radarr
+  type:  ClusterIP
+  ports:
+  - name: radarr
+    port:  7878
+    targetPort:  7878

apps/media-downloads/transmission.deployment.yaml

@@ -0,0 +1,81 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: transmission
+spec:
+  selector:
+    matchLabels:
+      app: transmission
+  template:
+    metadata:
+      labels:
+        app: transmission
+    spec:
+      containers:
+      - name: transmission
+        image: transmission
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 9091
+        env:
+        - name: OPENVPN_PROVIDER
+          value: PROTONVPN
+        - name: LOCAL_NETWORK
+          value: 10.42.0.0/16
+        - name: OPENVPN_CONFIG
+          valueFrom:
+            secretKeyRef:
+              name: protonvpn
+              key: country
+        - name: OPENVPN_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: protonvpn
+              key: username
+        - name: OPENVPN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: protonvpn
+              key: password
+        volumeMounts:
+        - name: media
+          mountPath: /data
+        - name: config
+          mountPath: /config
+        securityContext:
+          capabilities:
+            add: ["NET_ADMIN"]
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: media-downloads
+      - name: config
+        persistentVolumeClaim:
+          claimName: transmission-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: transmission
+spec:
+  selector:
+    app: transmission
+  ports:
+    - protocol: TCP
+      port: 9091
+      targetPort: 9091
+  type: ClusterIP
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: protonvpn
+type: Opaque
+stringData:
+  country: at.protonvpn.udp,fr.protonvpn.udp,pl.protonvpn.udp,ch.protonvpn.udp
+  username: VOYkNuZs5PHjeB8w
+  password: WvKCOPijcXKOqcL5d7zjXzOPToS4zPid

apps/media/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: jellyfin-vue-ingress
@@ -17,7 +17,7 @@ spec:
   tls:
     certResolver: default-tls
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: jellyfin-backend-ingress
@@ -37,7 +37,7 @@ spec:
   tls:
     certResolver: default-tls
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: jellyfin-websocket
@@ -48,7 +48,7 @@ spec:
       Connection: keep-alive, Upgrade
       Upgrade: WebSocket
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: jellyfin-server-headers
@@ -60,4 +60,4 @@ spec:
     accessControlAllowMethods: [ "GET","HEAD","OPTIONS" ] # "POST","PUT"
     accessControlAllowOriginList:
       - "*"
-    accessControlMaxAge: 100
+    accessControlMaxAge: 100

apps/media/kustomization.yaml

@@ -10,12 +10,11 @@ resources:
   - web.deployment.yaml
   - web.service.yaml
   - ingress.yaml
-  - jellyfin.servicemonitor.yaml
 
 images:
   - name: jellyfin/jellyfin
     newName: jellyfin/jellyfin
-    newTag: 10.8.13
+    newTag: 10.9.0
   - name: ghcr.io/jellyfin/jellyfin-vue
     newName: ghcr.io/jellyfin/jellyfin-vue
     newTag: stable-rc.0.3.1

apps/media/pvc.yaml

@@ -1,39 +1,21 @@
-
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  namespace: media
-  name: jellyfin-config-nfs
-spec:
-  capacity:
-    storage: "1Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/jellyfin-config
-    server: 192.168.1.157
----
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  namespace: media
+  name: config
-  name: jellyfin-config-nfs
 spec:
-  storageClassName: ""
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
       storage: "1Gi"
-  volumeName: jellyfin-config-nfs
 
 ---
 
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  namespace: media
+  name: media
-  name: jellyfin-data-nfs
 spec:
   capacity:
     storage: "1Ti"
@@ -46,8 +28,7 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  namespace: media
+  name: media
-  name: jellyfin-data-nfs
 spec:
   storageClassName: ""
   accessModes:
@@ -55,4 +36,4 @@ spec:
   resources:
     requests:
       storage: "1Ti"
-  volumeName: jellyfin-data-nfs
+  volumeName: media

apps/media/server.deployment.yaml

@@ -25,9 +25,9 @@ spec:
         - name: TZ
           value: Europe/Berlin
         volumeMounts:
-        - name: jellyfin-config
+        - name: config
           mountPath: /config
-        - name: jellyfin-data
+        - name: media
           mountPath: /media
         livenessProbe:
           httpGet:
@@ -36,10 +36,10 @@ spec:
           initialDelaySeconds: 100
           periodSeconds: 15
       volumes:
-      - name: jellyfin-config
+      - name: config
         persistentVolumeClaim:
-          claimName: jellyfin-config-nfs
+          claimName: config
-      - name: jellyfin-data
+      - name: media
         persistentVolumeClaim:
-          claimName: jellyfin-data-nfs
+          claimName: media
 

apps/minecraft/README.md

@@ -0,0 +1,7 @@
+## Sending a command
+```
+kubectl exec -it -n minecraft deploy/minecraft-server -- /bin/bash
+mc-send-to-console /help
+# or directly
+kubectl exec -it -n minecraft deploy/minecraft-server -- mc-send-to-console /help
+```

apps/minecraft/deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: minecraft-server
+spec:
+  selector:
+    matchLabels:
+      app: minecraft-server
+  template:
+    metadata:
+      labels:
+        app: minecraft-server
+    spec:
+      containers:
+      - name: minecraft-server
+        image: minecraft
+        resources:
+          limits:
+            memory: "4000Mi"
+            cpu: "2500m"
+          requests:
+            memory: "1000Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 25565
+        env:
+        - name: EULA
+          value: "TRUE"
+        - name: MODPACK
+          value: "https://www.curseforge.com/api/v1/mods/711537/files/5076228/download"
+        - name: VERSION
+          value: "1.18.2"
+        # - name: VERSION
+        #   value: "1.16.5"
+        # - name: MODPACK
+        #   value: "https://mediafilez.forgecdn.net/files/3602/5/VaultHunters-OfficialModpack-1.12.1-Server.zip"
+        - name: INIT_MEMORY
+          value: "1G"
+        - name: MAX_MEMORY
+          value: "3G"
+        - name: MOTD
+          value: "VaultHunters baby!"
+        - name: ENABLE_RCON
+          value: "false"
+        - name: CREATE_CONSOLE_IN_PIPE
+          value: "true"
+        - name: ONLINE_MODE
+          value: "true"
+        volumeMounts:
+        - name: minecraft-data
+          mountPath: /data
+
+      volumes:
+      - name: minecraft-data
+        persistentVolumeClaim:
+          claimName: minecraft-data

apps/minecraft/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: minecraft
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+
+images:
+  - name: minecraft
+    newName: itzg/minecraft-server
+    newTag: java21

apps/minecraft/pvc.yaml

@@ -1,13 +1,11 @@
-```
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: test-claim
+  name: minecraft-data
 spec:
-  storageClassName: nfs-client
+  storageClassName: "nfs-client"
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
   resources:
     requests:
-      storage: 1Mi
+      storage: 1Gi
-```

apps/minecraft/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: minecraft-server
+spec:
+  selector:
+    app: minecraft-server
+  ports:
+  - port: 25565
+    targetPort: 25565
+  type: LoadBalancer
+  loadBalancerIP: 192.168.3.4

apps/monitoring/grafana-admin.sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: grafana-admin-secret
+  namespace: monitoring
+spec:
+  encryptedData:
+    password: AgBe8isrCWd5MuaQq5CpA+P3fDizCCDo23BVauaBJLuMRIYbVwpfahaJW7Ocj3LTXwdeVVPBrOk2D6vESUXu6I0EWc3y/NFN4ZezScxMcjmeaAb+z1zWwdH0FynTPJYOxv1fis1FDTkXDmGy3FXo5NDK9ET899TtulKFkh7UqSxdrRWbD3pegJgqKGPIqDCTAxZN/ssiccfWGS4lHqQBJkXn8DeampcKwjOCvgaBdilF03GoSfpgsqa2Iw2SfTDEobWBWVMMK/RB3/Oi/YJkGwMW3ECUxvTDam8gb0RFA1xjWXoYTLVVP5fK7q7x63ns51HebloxAP1GBrt138N/iDrfbGfjNP8Lx0NFl5y5bTgYN/z8DVTOFf90xxWe+YYERdwllg0Ci1JLNbA+NszXTD4L/HC7a8XuBfjRzxMTeymNjR76jzfPkH6v1EvesOduTfSrahPgS0qS+eGOier1rHxj3EBRhOScY1ut5Bq4oJMNId9nMVbVa6xyq2HyxuJHXV+j6h5FGHmEXn9gIR7wGp8RhtPhKgVGLrHcbHZ5Th2E7eomz1T2NK/ezNP8ZhcwOj/lyGywlW0vhU798zpWhMf57k2OPeuMlfs8Y8y74epBdyBjsrMR4EDctF8RZR3vraxENiMJ6kk1gqKj04ir6HwL7blqwiybIFFnJrp2j7MzgjS4SQ687qMX5Zf5XT03aEE+9W9Epy73tT7zVQKdENCQlcm5
+    user: AgAdiOivMn0d+nYjYycMZz9QSiS/9QqwHPJQMHkE7/IOou+CJtBknlETNtdv84KZgBQTucufYqu3LR3djOBpdnQsYbIXDxPFgRZQ11pwu/sO2EGifDk218yyzzfZMvx1FL7JL4LI1rKoiHycZowCwsAjEtlICVOOYv1/Plki+6MHXiAGG4r/yUhugGx3VLLX+Poq8oaTeHndgSsFXJege8SfgYR4TsC7pQgsM1UQEFncGIhJYTD2ashmUxFJ+7CJjHqPR0lFRrZXmFvPwTYTCMT+tnSHnCFWtTht8cEi1NxA4kD/eKEX0rOol15EUZnFUws2WqWI634TbyGwZ7km/Yw4XoDxiQR4ar6ulkqb/djcc3cWDYE7PF1m1c+r3iog85S5CSfZ5EvdCHHrbPN9uO2gmoRQWiR5qI70YMxBSnkeLZWN05O1vUuopdXFDTafY7YskxLEdIGHGqFUpUrJZOvBB0zNBdHGgYxFzb5pNmMCC5LPlOuoKjV4yskh9Tgovz06aAvsPxn2WWx6NOJambeziKB5OmSKvPsFofViyGBekVAWSWtt9yJe6lu5OKpBEiA6xhGhQ4ZryTXu9wvVALuPSIwBFITv85sIxjJb80qhJ51wb12QgzLLcPby0HSanyBI1M4jfsXWpK8gIAbDNO+eD7z3PhD9Y/5hPqYKXZ37Geyq23xiyxG8XDj6cL+Ie6k8XipayI4=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: grafana-admin-secret
+      namespace: monitoring
+    type: Opaque

apps/monitoring/grafana.ingress.yaml

@@ -1,5 +1,5 @@
 kind: IngressRoute
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 metadata:
   name: grafana-ingress
 spec:

apps/monitoring/grafana.values.yaml

@@ -1,4 +1,3 @@
-
 replicas: 1
 
 ## Create a headless service for the deployment
@@ -10,13 +9,6 @@ headlessService: false
 ##
 service:
   enabled: true
-  type: ClusterIP
-  port: 80
-  targetPort: 3000
-    # targetPort: 4181 To be used with a proxy extraContainer
-  annotations: {}
-  labels: {}
-  portName: service
 
 serviceMonitor:
   ## If true, a ServiceMonitor CRD is created for a prometheus operator
@@ -24,42 +16,54 @@ serviceMonitor:
   ##
   enabled: false
 
-
 ingress:
   enabled: false
-persistence:
-  type: pvc
-  enabled: true
-  # storageClassName: default
-  accessModes:
-    - ReadWriteOnce
-  size: 10Gi
-  # annotations: {}
-  finalizers:
-    - kubernetes.io/pvc-protection
-  # selectorLabels: {}
-  ## Sub-directory of the PV to mount. Can be templated.
-  # subPath: ""
-  ## Name of an existing PVC. Can be templated.
-  existingClaim: grafana-nfs
 
-  ## If persistence is not enabled, this allows to mount the
+# credentials
-  ## local storage in-memory to improve performance
+admin:
-  ##
+  existingSecret: grafana-admin-secret
-  inMemory:
+  userKey: user
+  passwordKey: password
+
+datasources:
+  datasources.yaml:
+    apiVersion: 1
+    datasources:
+      - name: Thanos
+        type: prometheus
+        url: http://thanos-querier.prometheus.svc:9090
+        isDefault: true
+      - name: Prometheus
+        type: prometheus
+        url: http://prometheus.prometheus.svc:9090
+        isDefault: false
+
+dashboardProviders:
+ dashboardproviders.yaml:
+   apiVersion: 1
+   providers:
+   - name: 'default'
+     orgId: 1
+     folder: ''
+     type: file
+     disableDeletion: false
+     editable: true
+     options:
+       path: /var/lib/grafana/dashboards/default
+## Reference to external ConfigMap per provider. Use provider name as key and ConfigMap name as value.
+## A provider dashboards must be defined either by external ConfigMaps or in values.yaml, not in both.
+## ConfigMap data example:
+##
+## data:
+##   example-dashboard.json: |
+##     RAW_JSON
+##
+dashboardsConfigMaps:
+  default: grafana-dashboards
+
+
+grafana.ini:
+  wal: true
+  default_theme: dark
+  unified_alerting:
     enabled: false
-    ## The maximum usage on memory medium EmptyDir would be
-    ## the minimum value between the SizeLimit specified
-    ## here and the sum of memory limits of all containers in a pod
-    ##
-    # sizeLimit: 300Mi
-
-initChownData:
-  ## If false, data ownership will not be reset at startup
-  ## This allows the prometheus-server to be run with an arbitrary user
-  ##
-  enabled: true
-
-# Administrator credentials when not using an existing secret (see below)
-adminUser: admin
-# adminPassword: strongpassword

apps/monitoring/kustomization.yaml

@@ -6,29 +6,15 @@ namespace: monitoring
 resources: 
   - namespace.yaml
   - grafana.pvc.yaml
-  - influxdb.pvc.yaml
+  # - influxdb.pvc.yaml
   - grafana.ingress.yaml
-  # prometheus-operator crds
+  - grafana-admin.sealedsecret.yaml
-  - https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.70.0/bundle.yaml
+  - dashboards/
-  - prometheus.yaml
-  - thanos-objstore-config.sealedsecret.yaml
 
 
 helmCharts:
   - releaseName: grafana
     name: grafana
     repo: https://grafana.github.io/helm-charts
-    version: 7.3.0
+    version: 7.3.9
     valuesFile: grafana.values.yaml
-
-  - releaseName: influxdb
-    name: influxdb2
-    repo: https://helm.influxdata.com/
-    version: 2.1.2
-    valuesFile: influxdb.values.yaml
-
-  - releaseName: telegraf-speedtest
-    name: telegraf
-    repo: https://helm.influxdata.com/
-    version: 1.8.39
-    valuesFile: telegraf-speedtest.values.yaml

apps/monitoring/thanos-objstore-config.sealedsecret.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: thanos-objstore-config
-  namespace: monitoring
-spec:
-  encryptedData:
-    thanos.yaml: AgCXlr7NO2DoH1R0ngtDFi8rgJaDnW5WSmOMjvXF4GMcEjnn1kwQMLkF0Xz1BUB5GlQkTAg+ZjCWGMlfycBmUnZb+koZK3X1YLsk1BxBxtuSqhj35iQYxKQ7rAlsz7FxUQjK2oiJkFeQmo/rwcw6l6vZJ73+THYSebR9mLQ/H0pnmJM3ldLX4iWL2H8BZ7ftOYdXO7Xv0lk2k2L4O4LgnB1Uedpyk0HLVxAv3VdVU/RFpHm5Q7kudrCMm9ENcJG7qIWuii8GkysvEefbo2phgKn1Zr5XR6SyekuW2e6FyHe9us5Pv5HnJ6Z2+ZyewygaGgHiRqtxRMaLbahICewfSHwyGzeAD2kdgwVyJYXxVPV9qKQvZmj0ZDCDZ5K548mSUq7nNXSI9M9AJBTKUoqb2FXK3pqn4yh9M1l+7Pmno5Fs22blAyGsRqO32GxrYvEXPpdSeqHRjOMYTnbPuteGRKcvmSEUSuHzkeoTzU1Jh4Sg0ygtQUNIKtbwhJm1XpbJ0oaR5ukWMxPfpDv+B5FmrDsU/I+o62+NtCLQLkK6MoRBFiJ1kymtKkM3vQ1CVg4Vtc5Gc2D6mMu5K8kEuUODweBb8qPnYH7ULfTYORldj3d+Fb2mGF5mAU6xHMzbocsdgZpbAzUP/FfJmMMDWf4aW3LJ1mBjUD06KAwPsQvbTm6VInrdXh2QVb4UIp41kbyK8sanHrvh3bprHloxt8OnTZ2HQl+XN+kxYirkVkL34lIlk7KdYCWqO7QqH0ncd9WF0f9mpPGbxo3J
-  template:
-    metadata:
-      creationTimestamp: null
-      name: thanos-objstore-config
-      namespace: monitoring
-    type: Opaque

apps/nextcloud/README.md

@@ -1,5 +0,0 @@
-### Runninf `occ` commands:
-
-```
-su -s /bin/bash www-data -c "php occ user:list"
-```

apps/nextcloud/ingress.yaml

@@ -1,16 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: nextcloud-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`nextcloud.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: nextcloud
-      port: 8080
-  tls:
-    certResolver: default-tls 

apps/nextcloud/kustomization.yaml

@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources: 
-- namespace.yaml
-- ingress.yaml
-- pvc.yaml
-- postgres.sealedsecret.yaml
-
-namespace: nextcloud
-
-helmCharts:
-  - name: nextcloud
-    releaseName: nextcloud
-    version: 4.5.5
-    valuesFile: values.yaml
-    repo: https://nextcloud.github.io/helm/

apps/nextcloud/postgres.sealedsecret.yaml

@@ -1,22 +0,0 @@
-{
-  "kind": "SealedSecret",
-  "apiVersion": "bitnami.com/v1alpha1",
-  "metadata": {
-    "name": "postgres-password",
-    "namespace": "nextcloud",
-    "creationTimestamp": null
-  },
-  "spec": {
-    "template": {
-      "metadata": {
-        "name": "postgres-password",
-        "namespace": "nextcloud",
-        "creationTimestamp": null
-      }
-    },
-    "encryptedData": {
-      "password": "AgCTmvBe9YFnyWOdz02rxr0hTXnWuVLeUt5dpieWMzl4cVMBj7WcyyODWtNd+eQOLARRssGNZAP4C9gH90iVRFAW1aU+NeA76oceXE5Kiiqoc8T30wE5FC6/UbTjQYRH520NF4wcCQKm//iH8o5uI2+NxZW4goeuShibXK9sijFVNXxUuTeXTmaSJjEPyB+pnmPwjzw+qjhkJJADefh9oryy5+t9ecCwXDiI/2ce2n1Vawm/Nq6/0rZMUSsF8XSiTFczKMunuGMhxGEyyx/I8NZd4XMXGSnBo0YZF7jR9+eRHIjuenPHq1kfEid2Ps4fhFSE8mEecnK7w5xE3r0XeTNHQcTId1yYneK/LQfcRkzInuRddytTwTAmsoSjROcjKjAvtyZSM81pFWJsMQ7bSVXOC0K2wvEz9khDT0RIoR/8tMh2G737F15raTe9Ggbgy3DHst4mYIpoWV/slHrOF0vR9j7X+MRN9R1cVtI1coof/tVSWQsLvv0AJfB4/6dUl+i/yNO/j+4c3WolGwqyXd+oxsZK1VrSwSCBZwBO17BmePJL2QsPVRdutq06TrlvGqP4wXySH9LRuHr3sWgr2VuDV00w+UvuU7ExI+16dWh7jrn/rvIBQSJlHDhl5+VpyM0WTMy5kSfO6nits73ZzT7BAoSU7AeQOMj3t+cUiEq9f9dk7em7QxWMuWg6QIJ+ZZ2+CCBms4rSE4x2glOxanNX/HktQg==",
-      "username": "AgCxJKzhsF7yNJesK5oLJP62kjFnX4UUNQ2NrHl02Hv6MAzi/AUEV3uJSXXIi3H/uMJSMxRpJQjIDsrznYVI0YHOoz1M8/y1dx8xotFv/i0XByI9sMuGtesop7ncmQbEPMaJ3pqTJyaGkEwcsEMGmwwYiRfJHmEhhCYtzEc5IAnx+nmk//HYsrSWKpJGSWl0LvdMJsnsTxrWoJjaYTW3J0Of3VOOmgkuwIFKyXW9S2cUbAco8xVYchbyiHc8LXbS3izyAidRzg1OWyqvTGMIKJDQZ3ibIiXheon5ZeYjj0fkEkv3TrB7WoKdo0090OY1eHabqAPHT8aP+WG1g6TAzbJEtg+zFfYDKIw5Tp1WkRlsD2me4HycGuZbsaXgP5vWlxF5+rULUzUgxfmTRmYTl0H8kIlmUrusZwxR5ZXnSuBJ3n3AMEjmpmTTALakxEFEPDJJoVbgcViLtANwk72yu15FlOxczT22uyW8FMkj9kYzcq/+2a/EjaTo62SnUYJ3UTQXvgMKML1yJD+zym2+xscPNmwZFBPN5BQ/64ru/Z51nWB20fWFgW3Rw67jEQMajmVclmUcASWOjHzO87feEprHeilTH+224IHzpmC4aLz/JtIP9EEvqfDUr3fRrxcgtT1DgxV37vPj6Pqn47MHr39AA850CxjFmb1VcwfH6ygXABFlxnVByZDn7xCyBNswtKJqtw=="
-    }
-  }
-}

apps/nextcloud/pvc.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: nextcloud-nfs
-spec:
-  capacity:
-    storage: "150Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /kluster/nextcloud
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nextcloud-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "150Gi"
-  volumeName: nextcloud-nfs

apps/nextcloud/readme.md

@@ -1,17 +0,0 @@
-## Running occ commands
-
-Sometimes you need to run a command on the Nextcloud container directly. You can do that by running commands as the user www-data via the kubectl exec command.
-```
-# $NEXTCLOUD_POD should be the name of *your* nextcloud pod :)
-kubectl exec $NEXTCLOUD_POD -- su -s /bin/sh www-data -c "php occ myocccomand"
-```
-Here are some examples below.
-Putting Nextcloud into maintanence mode
-
-Some admin actions require you to put your Nextcloud instance into
-
-(e.g. backups):
-```
-# $NEXTCLOUD_POD should be the name of *your* nextcloud pod :)
-kubectl exec $NEXTCLOUD_POD -- su -s /bin/sh www-data -c "php occ maintenance:mode --on"
-```

apps/nextcloud/values.yaml

@@ -1,171 +0,0 @@
-## Official nextcloud image version
-## ref: https://hub.docker.com/r/library/nextcloud/tags/
-
-image:
-  tag: "28"
-
-ingress:
-  enabled: false
-
-
-
-nextcloud:
-  host: nextcloud.kluster.moll.re
-  username: admin
-  password: changeme
-  ## Use an existing secret
-  existingSecret:
-    enabled: false
-  update: 0
-  # If web server is not binding default port, you can define it
-  # containerPort: 8080
-  datadir: /var/www/html/data
-  persistence:
-    subPath:
-  mail:
-    enabled: false
-  # PHP Configuration files
-  # Will be injected in /usr/local/etc/php/conf.d for apache image and in /usr/local/etc/php-fpm.d when nginx.enabled: true
-  phpConfigs: {}
-  # Default config files
-  # IMPORTANT: Will be used only if you put extra configs, otherwise default will come from nextcloud itself
-  # Default confgurations can be found here: https://github.com/nextcloud/docker/tree/master/16.0/apache/config
-  defaultConfigs:
-    # To protect /var/www/html/config
-    .htaccess: true
-    # Redis default configuration
-    redis.config.php: true
-    # Apache configuration for rewrite urls
-    apache-pretty-urls.config.php: true
-    # Define APCu as local cache
-    apcu.config.php: true
-    # Apps directory configs
-    apps.config.php: true
-    # Used for auto configure database
-    autoconfig.php: true
-    # SMTP default configuration
-    smtp.config.php: true
-  # Extra config files created in /var/www/html/config/
-  # ref: https://docs.nextcloud.com/server/15/admin_manual/configuration_server/config_sample_php_parameters.html#multiple-config-php-file
-  configs: {}
-
-  # For example, to use S3 as primary storage
-  # ref: https://docs.nextcloud.com/server/13/admin_manual/configuration_files/primary_storage.html#simple-storage-service-s3
-  #
-  #  configs:
-  #    s3.config.php: |-
-  #      <?php
-  #      $CONFIG = array (
-  #        'objectstore' => array(
-  #          'class' => '\\OC\\Files\\ObjectStore\\S3',
-  #          'arguments' => array(
-  #            'bucket'     => 'my-bucket',
-  #            'autocreate' => true,
-  #            'key'        => 'xxx',
-  #            'secret'     => 'xxx',
-  #            'region'     => 'us-east-1',
-  #            'use_ssl'    => true
-  #          )
-  #        )
-  #      );
-
-nginx:
-  ## You need to set an fpm version of the image for nextcloud if you want to use nginx!
-  enabled: false
-
-internalDatabase:
-  enabled: true
-  name: nextcloud
-
-##
-## External database configuration
-##
-externalDatabase:
-  enabled: true
-
-  ## Supported database engines: mysql or postgresql
-  type: postgresql
-
-  ## Database host
-  host: postgres-postgresql.postgres
-
-  ## Database user
-  # user: nextcloud
-
-  # ## Database password
-  # password: test
-
-  ## Database name
-  database: nextcloud
-
-  ## Use a existing secret
-  existingSecret:
-    enabled: true
-    secretName: postgres-password
-    usernameKey: username
-    passwordKey: password
-
-##
-## MariaDB chart configuration
-##
-mariadb:
-  enabled: false
-
-postgresql:
-  enabled: false
-
-redis:
-  enabled: false
-
-## Cronjob to execute Nextcloud background tasks
-## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
-##
-cronjob:
-  enabled: false
-
-## Enable persistence using Persistent Volume Claims
-## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
-##
-persistence:
-  # Nextcloud Data (/var/www/html)
-  enabled: true
-  annotations: {}
-
-  ## If defined, PVC must be created manually before volume will be bound
-  existingClaim: nextcloud-nfs
-
-  ## Use an additional pvc for the data directory rather than a subpath of the default PVC
-  ## Useful to store data on a different storageClass (e.g. on slower disks)
-  nextcloudData:
-    enabled: false
-
-resources:
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  limits:
-   cpu: 2000m
-   memory: 2Gi
-  requests:
-   cpu: 100m
-   memory: 128Mi
-
-livenessProbe:
-  enabled: true
-  # disable when upgrading from a previous chart version
-
-## Enable pod autoscaling using HorizontalPodAutoscaler
-## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
-##
-hpa:
-  enabled: false
-
-## Prometheus Exporter / Metrics
-##
-metrics:
-  enabled: false
-
-
-rbac:
-  enabled: false

apps/ntfy/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: websocket
@@ -9,7 +9,7 @@ spec:
       # enable websockets
       Upgrade: "websocket"
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
     name: ntfy-ingressroute

apps/ntfy/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: binwiederhier/ntfy
     newName: binwiederhier/ntfy
-    newTag: v2.8.0
+    newTag: v2.10.0

apps/recipes/deployment.yaml

@@ -34,4 +34,4 @@ spec:
       volumes:
       - name: mealie-data
         persistentVolumeClaim:
-          claimName: mealie-data
+          claimName: mealie

apps/recipes/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: mealie-ingressroute

apps/recipes/kustomization.yaml

@@ -12,5 +12,5 @@ resources:
 
 images:
   - name: mealie
-    newTag: v1.2.0
+    newTag: v1.6.0
     newName: ghcr.io/mealie-recipes/mealie

apps/recipes/pvc.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: mealie-data
+  name: mealie
 spec:
   resources:
     requests:
-      storage: 1Gi
+      storage: 5Gi
   volumeMode: Filesystem
-  storageClassName: nfs-client
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce

apps/rss/deployment.yaml

@@ -18,9 +18,9 @@ spec:
           ports:
             - containerPort: 7070
           volumeMounts:
-            - name: rss-data
+            - name: data
               mountPath: /data
       volumes:
-        - name: rss-data
+        - name: data
           persistentVolumeClaim:
-            claimName: rss-claim
+            claimName: data

apps/rss/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: rss-ingressroute

apps/rss/namespace.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: placeholder
+  name: placeholder

apps/rss/pvc.yaml

@@ -1,9 +1,9 @@
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: rss-claim
+  name: data
 spec:
-  storageClassName: nfs-client
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:

apps/syncthing/deployment.yaml

@@ -1,35 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: syncthing
-spec:
-  selector:
-    matchLabels:
-      app: syncthing
-  template:
-    metadata:
-      labels:
-        app: syncthing
-    spec:
-      containers:
-      - name: syncthing
-        image: syncthing
-        resources:
-          limits:
-            memory: "256Mi"
-            cpu: "500m"
-        ports:
-        - containerPort: 8384
-          protocol: TCP
-          name: syncthing-web
-        - containerPort: 22000
-          protocol: TCP
-        - containerPort: 22000
-          protocol: UDP
-        volumeMounts:
-        - name: persistence
-          mountPath: /var/syncthing
-      volumes:
-      - name: persistence
-        persistentVolumeClaim:
-          claimName: syncthing-claim

apps/syncthing/ingress.yaml

@@ -1,16 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: rss-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`syncthing.kluster.moll.re`)
-      kind: Rule
-      services:
-        - name: syncthing-web
-          port: 8384
-  tls:
-    certResolver: default-tls

apps/syncthing/kustomization.yaml

@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: syncthing
-
-resources:
-  - namespace.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - servicemonitor.yaml
-  - syncthing-api.sealedsecret.yaml
-
-images:
-  - name: syncthing
-    newName: syncthing/syncthing
-    newTag: "1.27"

apps/syncthing/service.yaml

@@ -1,46 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: syncthing-web
-  labels:
-    app: syncthing
-spec:
-  selector:
-    app: syncthing
-  type: ClusterIP
-  ports:
-  - port: 8384
-    targetPort: 8384
-    name: syncthing-web
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: syncthing-listen
-  annotations:
-    metallb.universe.tf/allow-shared-ip: syncthing-service
-spec:
-  selector:
-    app: syncthing
-  type: LoadBalancer
-  LoadBalancerIP: 192.168.3.4
-  ports:
-  - port: 22000
-    targetPort: 22000
-    protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: syncthing-discover
-  annotations:
-    metallb.universe.tf/allow-shared-ip: syncthing-service
-spec:
-  selector:
-    app: syncthing
-  type: LoadBalancer
-  LoadBalancerIP: 192.168.3.4
-  ports:
-  - port: 22000
-    targetPort: 22000
-    protocol: UDP

apps/syncthing/servicemonitor.yaml

@@ -1,17 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: syncthing-servicemonitor
-  labels:
-    app: syncthing
-spec:
-  selector:
-    matchLabels:
-      app: syncthing
-  endpoints:
-    - port: syncthing-web
-      path: /metrics
-      bearerTokenSecret:
-        name: syncthing-api
-        key: token
-        namespace: syncthing

apps/syncthing/syncthing-api.sealedsecret.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: syncthing-api
-  namespace: syncthing
-spec:
-  encryptedData:
-    token: AgC1hG1aguLIWBgA1R19MGrXDq7BONAldMEXtCeGXLO9Xar08f7qFqprtRJAMOID4trUEBMAkF96m7rH7QHTpO0WzRLrJctLi7U6NgESUJBDxusqjij3RAANS69Xt27mu2oa+rhm605CfFJT6Gpx/2CxrFtUD3yCijilDnEVvw4WvTLHvVQMCd8cM8ZDlpBsSYbxvtCUN1+B02DCucLpMphspxV2SGPAdc04xQD7d0vUhNLekFi0xSgu0jiRGVDHOG5Egd9d/BGeNOBgiUVxJxqqdXc6EmkslcSUtMQJ5luSxjogf+p3jdOqt4aPpUeR8sSPb6OSEIZD/Cfs9X4akHdpUAqkycu+V24lDxeHWAtIviCMBPttrwNAEytgwqaiT0U4UmL5GqR97jpmy3Tx+jYKuXkt4Igb6VByreuL9aZacRrqRhCCgbg95Y/UrYlLAbZYOI/+KsFzB5akGpZXUDcW9h2IkTUmcT+QxWXqEoNpoTI5qAnKiu/9T5elDKghjMHYX+CnPj+rXlQIJzX7NkZ0Q6HpKQ4B2Vd1Ewkvadf963jBodUe7WiMt8UeYgzCa33F4U23JjExIrL8t3r8MQ/IIdtfUvyz6Da1vp5hjpBUnUCk8rca/6VC3GO1GP3DLdIXiZQY1OOTHJlyLG7+bIL35zVfkmLMzmlIdaFsfeYiL4P+hYRbLABPAJk8lY7MEdiczpvI9HlmFVatJaPrFJwx9jyhzqIOq5eGt0OIkFt+fw==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: syncthing-api
-      namespace: syncthing
-    type: Opaque

apps/todos/README.md

@@ -0,0 +1,6 @@
+### Adding a user
+```bash
+kubectl exec -it -n todos deployments/todos-vikunja -- /app/vikunja/vikunja user create -u <username> -e "<user-email>"
+```
+
+Password will be prompted.

apps/todos/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: todos-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`todos.kluster.moll.re`) && PathPrefix(`/api/v1`)
+      kind: Rule
+      services:
+        - name: todos-api
+          port: 3456
+    - match: Host(`todos.kluster.moll.re`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: todos-frontend
+          port: 80
+  tls:
+    certResolver: default-tls

apps/todos/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: todos
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - ingress.yaml
+
+
+# helmCharts:
+#   - name: vikunja
+#     version: 0.1.5
+#     repo: https://charts.oecis.io
+#     valuesFile: values.yaml
+#     releaseName: todos
+# managed by argocd directly

apps/todos/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/todos/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: data
+spec:
+  resources:
+    requests:
+      storage: 5Gi
+  volumeMode: Filesystem
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce

apps/todos/values.yaml

@@ -0,0 +1,51 @@
+######################
+# VIKUNJA COMPONENTS #
+######################
+# You can find the default values that this `values.yaml` overrides, in the comment at the top of this file.
+api:
+  enabled: true
+  image:
+    tag: 0.22.1
+  persistence:
+    # This is your Vikunja data will live, you can either let
+    # the chart create a new PVC for you or provide an existing one.
+    data:
+      enabled: true
+      existingClaim: data
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      mountPath: /app/vikunja/files
+
+  ingress:
+    main:
+      enabled: false
+
+  configMaps:
+    # The configuration for Vikunja's api.
+    # https://vikunja.io/docs/config-options/
+    config:
+      enabled: true
+      data:
+        config.yml: |
+          service:
+              frontendUrl: https://todos.kluster.moll.re
+          database:
+            type: sqlite
+            path: /app/vikunja/files/vikunja.db
+          registration: false
+  env:
+
+frontend:
+  enabled: true
+  image:
+    tag: 0.22.1
+  ingress:
+    main:
+      enabled: false
+
+postgresql:
+  enabled: false
+redis:
+  enabled: false
+typesense:
+  enabled: false

apps/whoami/base/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   namespace: whoami

infrastructure/argocd/argo-apps.application.yaml

@@ -12,7 +12,9 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd
-  syncPolicy:
+  # syncPolicy:
-    automated:
+  #   automated:
-      prune: true
+  #     prune: true
-      # selfHeal: true
+  #     selfHeal: false
+  # DO NOT AUTO SYNC THE APP OF APPS.
+  # all other apps are auto-synced, but adding new apps should be done manually.

infrastructure/argocd/ingress.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
     name: argocd-ingressroute

infrastructure/backup/README.md

@@ -0,0 +1,15 @@
+# How to restore
+
+1.  Port forward the rest api for gcloud
+    ```bash
+    kubectl port-forward -n backup service/rclone-gcloud 8000
+    ```
+
+2. Load the snapshots locally
+    ```bash
+    restic -r rest:http://127.0.0.1:8000/kluster mount /mnt/restic
+    ```
+    (The password is in a secret)
+
+3. Copy relevant files to the correct location on the NAS
+    

infrastructure/backup/cronjobs-overlays/backup/kustomization.yaml

@@ -4,7 +4,7 @@ kind: Kustomization
 namespace: backup
 # nameSuffix: -backup
 resources:
-  - ../../base
+  - ../../cronjobs-base
   # - ./restic-commands.yaml
 
 

infrastructure/backup/cronjobs-overlays/prune/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 
 namespace: backup
 resources:
-  - ../../base
+  - ../../cronjobs-base
 
 
 # patch the cronjob args field:

infrastructure/backup/kustomization.yaml

@@ -1,6 +1,14 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
+
 kind: Kustomization
+
+namespace: backup
+
 resources:
-  - rclone-config.sealedsecret.yaml
+  - namespace.yaml
+  - pvc.yaml
   - restic-password.sealedsecret.yaml
-  - pvc.yaml
+  - rclone-config.sealedsecret.yaml
+  - rclone-gcloud.deployment.yaml
+  - cronjobs-overlays/prune/
+  - cronjobs-overlays/backup/