Compare commits
1 Commits
renovate/q
...
7813762143
| Author | SHA1 | Date | |
|---|---|---|---|
| 7813762143 |
5
.gitignore
vendored
5
.gitignore
vendored
@@ -3,7 +3,4 @@
|
||||
main.key
|
||||
|
||||
# Helm Chart files
|
||||
charts/
|
||||
|
||||
# Nix and local environment files
|
||||
.direnv/
|
||||
charts/
|
||||
52
README.md
52
README.md
@@ -1,7 +1,7 @@
|
||||
# Kluster setup and IaaC using argoCD
|
||||
|
||||
|
||||
### Description
|
||||
### Initial setup
|
||||
#### Requirements:
|
||||
- A running k3s instance
|
||||
- `sealedsecrets` deployed
|
||||
@@ -27,61 +27,21 @@ The app-of-apps will bootstrap a fully featured cluster with the following compo
|
||||
- immich
|
||||
- ...
|
||||
|
||||
## Setup instructions
|
||||
1. install sealedsecrets see [README](./infrastructure/sealedsecrets/README.md)
|
||||
#### Recap
|
||||
- install sealedsecrets see [README](./infrastructure/sealedsecrets/README.md)
|
||||
```bash
|
||||
kubectl apply -k infrastructure/sealedsecrets
|
||||
kubectl apply -f infrastructure/sealedsecrets/main.key
|
||||
kubectl delete pod -n kube-system -l name=sealed-secrets-controller
|
||||
```
|
||||
1. install argocd and the app-of-apps bundled with it
|
||||
- install argocd
|
||||
```bash
|
||||
kubectl apply -k infrastructure/argocd
|
||||
```
|
||||
|
||||
|
||||
> NOTE: The argocd kustomization already mentions some CRDs available only after the full bootstrapping (traefik). Some might fail to apply right away. Since the argo application is managed through argo as well, they will become available as all kluster applications are rolled out.
|
||||
- wait...
|
||||
|
||||
|
||||
### Adding an application
|
||||
1. todo
|
||||
1. Don't forget to add the status badge.
|
||||
todo
|
||||
|
||||
|
||||
|
||||
### Status
|
||||
[](https://argocd.kluster.moll.re/applications/authelia-application)
|
||||
[](https://argocd.kluster.moll.re/applications/backup-application)
|
||||
[](https://argocd.kluster.moll.re/applications/external-application)
|
||||
[](https://argocd.kluster.moll.re/applications/external-dns-application)
|
||||
[](https://argocd.kluster.moll.re/applications/gitea-application)
|
||||
[](https://argocd.kluster.moll.re/applications/metallb-application)
|
||||
[](https://argocd.kluster.moll.re/applications/monitoring-application)
|
||||
[](https://argocd.kluster.moll.re/applications/nfs-provisioner-application)
|
||||
[](https://argocd.kluster.moll.re/applications/pg-ha-application)
|
||||
[](https://argocd.kluster.moll.re/applications/renovate-application)
|
||||
[](https://argocd.kluster.moll.re/applications/sealedsecrets-application)
|
||||
[](https://argocd.kluster.moll.re/applications/traefik-application)
|
||||
|
||||
|
||||
---
|
||||
[](https://argocd.kluster.moll.re/applications/adguard-application)
|
||||
[](https://argocd.kluster.moll.re/applications/audiobookshelf-application)
|
||||
[](https://argocd.kluster.moll.re/applications/code-server-application)
|
||||
[](https://argocd.kluster.moll.re/applications/files-application)
|
||||
[](https://argocd.kluster.moll.re/applications/finance-application)
|
||||
[](https://argocd.kluster.moll.re/applications/grafana-application)
|
||||
[](https://argocd.kluster.moll.re/applications/homeassistant-application)
|
||||
[](https://argocd.kluster.moll.re/applications/immich-application)
|
||||
[](https://argocd.kluster.moll.re/applications/kitchenowl-application)
|
||||
[](https://argocd.kluster.moll.re/applications/linkding-application)
|
||||
[](https://argocd.kluster.moll.re/applications/media-application)
|
||||
[](https://argocd.kluster.moll.re/applications/minecraft-application)
|
||||
[](https://argocd.kluster.moll.re/applications/ntfy-application)
|
||||
[](https://argocd.kluster.moll.re/applications/paperless-application)
|
||||
[](https://argocd.kluster.moll.re/applications/recipes-application)
|
||||
[](https://argocd.kluster.moll.re/applications/rss-application)
|
||||
---
|
||||
[](https://argocd.kluster.moll.re/applications/journal-application)
|
||||
[](https://argocd.kluster.moll.re/applications/physics-application)
|
||||
|
||||
|
||||
@@ -27,10 +27,7 @@ data:
|
||||
ratelimit_whitelist: []
|
||||
refuse_any: true
|
||||
upstream_dns:
|
||||
- tls://1.1.1.1
|
||||
- tls://dns.google
|
||||
- tls://p0.freedns.controld.com
|
||||
- tls://dns.quad9.net
|
||||
- https://dns10.quad9.net/dns-query
|
||||
upstream_dns_file: ""
|
||||
bootstrap_dns:
|
||||
- 9.9.9.10
|
||||
@@ -38,7 +35,8 @@ data:
|
||||
- 2620:fe::10
|
||||
- 2620:fe::fe:10
|
||||
fallback_dns: []
|
||||
upstream_mode: load_balance
|
||||
all_servers: false
|
||||
fastest_addr: false
|
||||
fastest_timeout: 1s
|
||||
allowed_clients: []
|
||||
disallowed_clients: []
|
||||
@@ -74,8 +72,6 @@ data:
|
||||
dns64_prefixes: []
|
||||
serve_http3: false
|
||||
use_http3_upstreams: false
|
||||
serve_plain_dns: true
|
||||
hostsfile_enabled: true
|
||||
tls:
|
||||
enabled: false
|
||||
server_name: ""
|
||||
@@ -92,14 +88,12 @@ data:
|
||||
private_key_path: ""
|
||||
strict_sni_check: false
|
||||
querylog:
|
||||
dir_path: ""
|
||||
ignored: []
|
||||
interval: 2160h
|
||||
size_memory: 1000
|
||||
enabled: true
|
||||
file_enabled: true
|
||||
statistics:
|
||||
dir_path: ""
|
||||
ignored: []
|
||||
interval: 24h
|
||||
enabled: true
|
||||
@@ -116,10 +110,6 @@ data:
|
||||
url: https://someonewhocares.org/hosts/zero/hosts
|
||||
name: Dan Pollock's List
|
||||
id: 1684963532
|
||||
- enabled: true
|
||||
url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_3.txt
|
||||
name: Peter Lowe's Blocklist
|
||||
id: 1735824753
|
||||
whitelist_filters: []
|
||||
user_rules: []
|
||||
dhcp:
|
||||
@@ -144,36 +134,13 @@ data:
|
||||
blocking_ipv6: ""
|
||||
blocked_services:
|
||||
schedule:
|
||||
time_zone: Europe/Berlin
|
||||
sun:
|
||||
start: 18h
|
||||
end: 23h59m
|
||||
mon:
|
||||
start: 18h
|
||||
end: 23h59m
|
||||
tue:
|
||||
start: 18h
|
||||
end: 23h59m
|
||||
wed:
|
||||
start: 18h
|
||||
end: 23h59m
|
||||
thu:
|
||||
start: 18h
|
||||
end: 23h59m
|
||||
fri:
|
||||
start: 18h
|
||||
end: 23h59m
|
||||
sat:
|
||||
start: 18h
|
||||
end: 23h59m
|
||||
ids:
|
||||
- reddit
|
||||
time_zone: UTC
|
||||
ids: []
|
||||
protection_disabled_until: null
|
||||
safe_search:
|
||||
enabled: false
|
||||
bing: true
|
||||
duckduckgo: true
|
||||
ecosia: true
|
||||
google: true
|
||||
pixabay: true
|
||||
yandex: true
|
||||
@@ -182,13 +149,11 @@ data:
|
||||
parental_block_host: family-block.dns.adguard.com
|
||||
safebrowsing_block_host: standard-block.dns.adguard.com
|
||||
rewrites: []
|
||||
safe_fs_patterns:
|
||||
- /opt/adguardhome/data/userfilters/*
|
||||
safebrowsing_cache_size: 1048576
|
||||
safesearch_cache_size: 1048576
|
||||
parental_cache_size: 1048576
|
||||
cache_time: 30
|
||||
filters_update_interval: 168
|
||||
filters_update_interval: 24
|
||||
blocked_response_ttl: 10
|
||||
filtering_enabled: true
|
||||
parental_enabled: true
|
||||
@@ -203,7 +168,6 @@ data:
|
||||
hosts: true
|
||||
persistent: []
|
||||
log:
|
||||
enabled: true
|
||||
file: ""
|
||||
max_backups: 0
|
||||
max_size: 100
|
||||
@@ -215,4 +179,4 @@ data:
|
||||
group: ""
|
||||
user: ""
|
||||
rlimit_nofile: 0
|
||||
schema_version: 29
|
||||
schema_version: 27
|
||||
|
||||
@@ -10,7 +10,7 @@ resources:
|
||||
images:
|
||||
- name: adguard/adguardhome
|
||||
newName: adguard/adguardhome
|
||||
newTag: v0.107.69
|
||||
newTag: v0.107.54
|
||||
|
||||
namespace: adguard
|
||||
|
||||
|
||||
@@ -12,4 +12,4 @@ namespace: audiobookshelf
|
||||
images:
|
||||
- name: audiobookshelf
|
||||
newName: ghcr.io/advplyr/audiobookshelf
|
||||
newTag: "2.29.0"
|
||||
newTag: "2.17.2"
|
||||
|
||||
@@ -1,41 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: code-server
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: code-server
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: code-server
|
||||
spec:
|
||||
containers:
|
||||
- name: code-server
|
||||
image: code-server
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
env:
|
||||
- name: TZ
|
||||
value: Europe/Berlin
|
||||
- name: CONFIG_PATH
|
||||
value: /data/config
|
||||
- name: METADATA_PATH
|
||||
value: /data/metadata
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /home/coder
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "100Mi"
|
||||
limits:
|
||||
cpu: "6"
|
||||
memory: "16Gi"
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: code-server-data
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: audiobookshelf-ingressroute
|
||||
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`code.kluster.moll.re`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: code-server-web
|
||||
port: 8080
|
||||
|
||||
tls:
|
||||
certResolver: default-tls
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- pvc.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
|
||||
namespace: code-server
|
||||
|
||||
images:
|
||||
- name: code-server
|
||||
newName: ghcr.io/coder/code-server
|
||||
newTag: 4.104.3-fedora
|
||||
@@ -1,11 +0,0 @@
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: code-server-data
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: code-server-web
|
||||
spec:
|
||||
selector:
|
||||
app: code-server
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
type: LoadBalancer
|
||||
@@ -13,4 +13,4 @@ namespace: files
|
||||
images:
|
||||
- name: ocis
|
||||
newName: owncloud/ocis
|
||||
newTag: "7.3.0"
|
||||
newTag: "5.0.9"
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -21,9 +21,6 @@ spec:
|
||||
env:
|
||||
- name: TZ
|
||||
value: Europe/Berlin
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: actualbudget-oidc
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
|
||||
@@ -9,9 +9,8 @@ resources:
|
||||
- actualbudget.deployment.yaml
|
||||
- actualbudget.service.yaml
|
||||
- actualbudget.ingress.yaml
|
||||
- oidc.sealedsecret.yaml
|
||||
|
||||
images:
|
||||
- name: actualbudget
|
||||
newName: actualbudget/actual-server
|
||||
newTag: 25.10.0
|
||||
newTag: 24.11.0
|
||||
|
||||
@@ -1,19 +0,0 @@
|
||||
---
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: actualbudget-oidc
|
||||
namespace: finance
|
||||
spec:
|
||||
encryptedData:
|
||||
ACTUAL_OPENID_AUTH_METHOD: AgAhPqooAS/7R9S/X3KGfSfs3ClN38J9CEfkUTYAUvKGEehQ2Tz3thPNvhvnbz/gKRc7C172jgxoxaGMiVXi40Qa+I7Y8JVHefjoSd8NuubzQZU8ZK5KlYRgc5OnoPM3RLarHyZ2DFw5Q/ngv3sp1c5dSI4/604KSQPxVAFCnb/lnSkOsBggDRymWvYclx1NrLIClpLAFwHgCOm6g1kHCvtGIdBLxKOHsiRJm62+UyHt0GLkR0QFTDXBQxoBm9QR9kLjQqw/QqcOIVx1by0RHoHBI6HDEEIQVH3UgWqlMmIwm+a4KQeBEdEfWLn9YC8MGSdlQRlaZoi5ltFT2c/DWuMuRStnaOWbsMQVR+y6yJ2UNBe29uVQh6877iqfmAJvT6gXic73zI7Vkq6IFQ7veQPBaTi22HP/sxiElGI8rY0LtRHD4TctKSePaOPvsgrv8k8SpB5qYAft7UonbTPWzzRSSc4Y3Z4fQiD0x/uhtTqTTtukx39nzM2TjVGcJThWaxUGa07w1fjTafieFVwwreURBUpRK92X2NY3ovOdA9c1WrHfqIzVtpcnfQyCeA5D4XT2sBFk0+crwEm1GmtscjPkGnyctNMUSmkHd+QKw8EAmWxKge4+7rfOrZp5ZK7cBFJcB4gVQcxnm3bXr0qZyiA1udaxmSxVflQR2AjduvhKuE73AGPi0bJki5TvKJp6bavTotYfdMY=
|
||||
ACTUAL_OPENID_CLIENT_ID: AgA6X0uYaU1n4XSXVntmT4+NgahYkkMVx61OZP8ExnSMkRPlwQfErhNHrwKsTsnD8OzP3svhxBe5bwaI8O1OKF0k5pQWG0DbRfmBrwiep9nBsKPt+fQm0AJUsZ2sQNShusmsSEumBKbMD0CMPklVMq18tLpOIh/YaXM34lsOutW0SIx7HWWQsyLmoolEoRVdkKvDhoh3FXjKqzGYlr1uKuqYG7pJPsxEpsTs2pZTUIlB2gVcEqb/ZXxgkj01GDYzB519swIOfYdISj7oCR8VG90M9iDrgmxsPkWozMDxFjNo5JR2dB9wvP7ptFex8JonbZZXYZD7tE+36U8iys6Cjh6JGwr9luN1AxYYSkRrNWJd2CuID+8ujWptoTvRSO0RwiVVp5LhXe1l2GxLsS2UVtO+nbWH6DGMJei4DQ+LAxDXFR8FAvi7615cneN0umQfF4ZMUJirvxHA3tFN42tbnRmSCbLAZLNLhQq8VbRmkYOAN6LCzSKYlyhSyA3NM2HjRTFkXGUhOPL+3tPZJB4v0QlEhlhy1Ffxh2mbUXgmQ+ZHGUsBXEHfc/Gba6gJhsj6S2DkiAeZUW6euY5/v4vpveWsS+YS+BxH441//8mOJnrpsWrcQbM5yCk4WMnmpETy/VFEkc3dqYfVWHDfvwAeqjVfXAovXBmwOoCASG6qDf0P7FdeLFTHUNuahyNhBzhBAQ/yNpOkbzKTJFBWwnM=
|
||||
ACTUAL_OPENID_CLIENT_SECRET: AgAbJinP4E8rbGAw7BTfh/GB3XxQOfHiLFrgaikQbUIsmZu+Y6ktK7aJdcX2/g6yhHXX6z8p4xoYTaGgkpo8H0XWvUDT4ohqJVdJSWZgNx8MyzisVKi+51BEpslL4JvGo/ISjXT0hNeYGzFXlHnnr3LX+fuTVh3dKtk4t8nmR8SqaCCIyvKiBPmX/1QWo4Vrfw7OLpVlfGP0i3J7FrhjNgKMRWcQKQC4Ohk+NLHHghdtqzuFB8eKwcuBZmynKCVyblOhwZSL5WnyJPskWLMjNEizWuCubDdyHVY3ZqYLDe5dgoi7Gop5/xY7FEuEkmTL0g7LpKo4RkEKRLjsZwWtW+xN6HRRt7zGoUdIpo20ZnTtEH8C/qcxjHKUycFvzKLnk6ntq5rEdK2/MhBtMfd3a8pb4vpT9JNra1AWsB7zCUv4yc/FT0RpkL+1r1CVva4o+tzM8ojnm4o0ch6qsGb0IOYZvJx6sF7c6aj7c41YQK3ZrQF3bhhhEHYyWOBjy1V4T/GJPZ9CbhGG0PIsSvpW7d5pG5jNAwU/Xo6FL/vVUPwmSq/hCqYMSSSKNiMH/q/vzKyu5B5aQbNDAumzsLRqD/auJz8nAaUoLNBVHq+7zTs3wV7pEayY22teq/MN5PRtYOQLE5Ck60gv9Q70cfhgvTeK+eX4h9BbhfijCV/EiSYhLP7meeIpE80icdLUSkNROfW+0sf3RNbW5q3JX8PsW0h29VJgREJdlziLj2cCshe+ww==
|
||||
ACTUAL_OPENID_DISCOVERY_URL: AgAQVZX6r8SPkwwBR1dmUF/ahuZKkGSsU/GULe5PF7Nm75UadtjPb5aHAZjWE59MdV61DQZDa4KJz1/fW4xDUrJBuUElIRQH4oyMTQG12MSMauQpLd25SVU8ex2NYyerbd85j521FSxujP0l3941KGsENLt5wCx/idXu47txhAHgS81mj3CLfWzT5yyG+V1i48a24xK905v+ft5ZKuNLOxvVb6yZSBt1j/3egx49eB49CRk/dxYQtPpSw8Zb6KgaN+skjq5HTH/Neb4J92nlJ1aFPVKbFLbtxyIHDSoO35U8ODHEJVGKBbZjjfrrjCpmQYnZPEWN9s+xj2NAXZ7qANcJfbFEF/3bOiKZhc0jLM5MyhiMZoytn4FvGM8zxINC3z8zqaWJm1wiMXEUH3/FLUa2UWeHKQB14h0f5XGwytb3s/nPCoBnHhtOK1y4utJ2APsQhRsxySZjgYNRaRCarp8PntY7yB7VHYlv5Mitx+qBWcAUmcKp1I4NTnm1LORRGzIFcrJJKtQfqcW7GNuZDA3AiLGyOMVigcA93GnPbppor5BItE9FK/BKqrR4Bz31jXSO8S7pjhi3JxBIKEMmMZRVbyelJ9o7gTpqrBvO7KZ5v/L+mlE0J8D2LZoEWPqxfa/BE+QZfwIS3wDWQl1GTruaAM4u0bp4i9GkyK3hPVXnml3dNMElSG3GvNqHhhy1Boo1cHXHbQ5YzbkGgzL9fLkigVQCi0FKItyBxdGsui9U0OU5LNi0EGKBibs22mdDkp6f051GWeMidtSwz9j5
|
||||
ACTUAL_OPENID_SERVER_HOSTNAME: AgB+C31GqtPKbMifuTFYhwOgUwXph+RQYdnVQaVIaDiveE6Lydl/2HnTyFQIi2mhrbiCpDgegXuvGBoM7WHxlPepny5E66lY/cAdFaFDGMARqMXCRLVmvkt3U1IyNn9zPCPil0x+eAv2S/ETLm8Nj2OL9utxkdNBHub9xiGrE0d7qBeBfK1FNmainthYQUpnCsR7jowmmvYGuEyDwfG+suUooDdb5zaWmCJZRYk1jKD3zlu21N0sfciBJ/GpTdz/2V+NXqJJqs3r2zoB2GJPQ64pMuZHZ+yw8bYUkg7/QOHD2ofWmtzNOGGtiNRHAG8MtvF6ovc4Hgv5uu+4x413UP6pSIJsrHrXSHYP+mvu+ya3gNUn6YK2qymezrqbvUF/n7LoaDzTRqa0PmemtdskuABiwfqrdiOarxaWjomkXqnrBK6VkJ8PhOMDMv/j/c6zlXdhpnqlUyxMcjBjqicfNBWN8UByDIEw4D0rhibzOS4fIKjNHrmXHv39GNJsY90avhZqq42oTMJL0vcaj3v4pBZJdJ05TOvY7PQ/iUwnnczGqOtpAQtBKfCV2+PXp9o/64wOGc0Br322kSpzjIleWP9VWVgbqvwMjUGtlL+xTkCaOFpiYETxUim09c745WDc+YgU55rd5i/5t20wiKy7RSYnHvYOwvdjAlEgAnD0YZBXOQkL51nL9P+nOMAYBE0HiM1vYsd8R6h6Fk+G2gcs/2CLgwglqOtMwAm9A9+5qSqyMak6Z68=
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: actualbudget-oidc
|
||||
namespace: finance
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: grafana-admin-secret
|
||||
namespace: grafana
|
||||
spec:
|
||||
encryptedData:
|
||||
password: AgAU6g/CwKj+1gPpt4DLvLsS0YCvJdVHWw4W4bRhibE9brVvcJtGB3D9MTJrSLVVwusaE6OR59og7oW5ge3yTd/9bbclXYLrxEi7OwvkQjCvo8MfD8yhJO9nV4Xs9Mjk2Z4SHGYuq6wvcssuJrpz5f0XEC7ocTRA+u0UaE+/b4FrYF71uyKGvj8GSXgLZUjGPFsGfPzwJn7cLBmlclVHx1xGbFpUc042m5Mulpn0QolFQnOwZiW4PL8pQyz1MXVRwCsz0RJd5apZL3XJ4X7BLMoAp+diHQ2xi3zoU9VScp+J2QgvFdRKgDa6v7Jz1f+HCwq5W/DoegwFXBrcMIfF2YrnvTnc1PCVwD9IHOeylO7J2hfi8teQiqTvvRlVgdBTLqoqlVovemf5k6ke6JfjTwnsJjTNnL7MKN5Qt0o7N2XRZ3ba9jp8cKbI7fyFQKaU2QEf2PIkp82kEnixmpA1aATgeA3W4E5Km7sKHUEB81+pwnOe54tzD2ShgQX/+UiswhWYTT+gdZKL1udBBemUDC0z9PSJNTPTy+hq+G4CIzVQUYxlioM3c+3geF7YLU8yXisj84pk44GN9KX3z5x+M2+LZL7agAWPUjxtrP2V+id7dNJQfCm0aSMeo57dVfb4zlBUAAgKIKjX+j1KqCVqE9zEO2F/QX7mY6MJTP2me3wmY7JAVRJ7d6bbkyyoDhs8JErLYLp0A+Eh+qx8nWgM9ErPVSA0
|
||||
user: AgB8ZLG2EuERjg1nKdH/xadbUuIR2c8a9gF5fE8ctrp4DNDLLuuqmjyoHRiWpkrtfnE1yKg1rPP+asV9Lj5iVmE9J+OB3QUOeFS4MHciBNj7pa68zfFgnHP4kxMX6aXyKRQrYruYjHwfzCpOM1zyTEphuGlnokjQXxjF/mZsoM2NWn7WGReqfxqH95tJXfs9AUC5vVv/PHqd+KKRZH7+G1AnWVJ7RFQHedR7wyftO4/rkm8deMuZWtOLl25fAOyOr7+hSqT69s9/uTKSLJXjobSqtulqsR+v5lkwx2ThNKzmcEcuoenKG6lk8XLRSIscccZH3JTPh6IknQWUOC4nmYj+XUxE8Go0RX/4eL+D/6FrYrtp0gr3HOCLAGU4vAHMeKfJoyqykJVnvY6QY6bFgaziyOlWaoEHpg6g0vHHDwyX7HIDcQfJZGOLH9dhrWJ2sOkzyuuxfqWEgz/M2eBW4EUAudHwfTLPocSMUI+D6fjeciMojet5uxWMP7ZHh/E061f5+Vfk6CKYd9Kpi69Xah8KEyyHYP5NImkdIwjgllaEAd/FBE2+QJyTVZlUQC7y9ObagDMCUFaFbTS5QOLh5BOJDL5buEYFWG0IhoH47SC/pKeEOQH//uvoo27K9zvxTOQN1YOTrxCozmexMOsTIdhvU0dOnJDBrThSHKYLCeIokDOgUUT52FqDH51RoLoK3UkyGbMoq+M=
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: grafana-admin-secret
|
||||
namespace: grafana
|
||||
type: Opaque
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: grafana-auth
|
||||
namespace: grafana
|
||||
spec:
|
||||
encryptedData:
|
||||
client_secret: AgCEdC1/ERlPQyQP+bd9gcW33Yrvl4uRbx+RF5AY4vYAquOzxmLTygMl/WZlB5wlCE5idIHgto6/fUWVZrQbmfClRqsW2pFoddKQAtS9cQNXwMjLCm7e0lXk9GM9O3ZwktmklFbCu8XewHmefGHhoJ28vPxPMaINv1fM4zYKvNz5RHf0dJfTHgxb68wRYjAbE/eJpRcVE3a29Yw6Gfa8Mb+cFI7RTHvjuv9LBgWqM6b3qvvJ4wYR2WKuiQrnJ5xAtHpMAI/2R80qq151wlaZueDZ1PwjRBHURkmPTmwZnrMrmIugNge7Tpww+ArZlG9kDfSu1aTJidbXbcpN6fyt1qARTCYrBlbn60PTYLnPL/NObvMCpjS6DsYsYz7MJ7WoOupu46Ib5paZHmak+CilC6lb9LjJj4EKfRsagZmWT07JavhHBW/tqjB3GToccIz4fOAOdA9aU51J4wCL2ctp2SgzCEKe2EaBK/f9nDd9ASmmon9PDwRDVtG8yTukrNcZHNzodi09Af81DB0RNa36Z3Sjt5xu94paN+mjiOWGf2JduVEq+60NbPvDbPE9e1aVH3DdQcij2WGZaTE8dAGLSsLoOkIq3m2E+Mbk1Re1gI9H18xJM72ivb5uDe7pzReyvO5DY4Pfq8JgQhPxWcDq9ScmWS6Bb+jdCKytFq5NafSAl+akPbbwN+1GFu33if/P5D9I2TwOA8V1wyVU
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: grafana-auth
|
||||
namespace: grafana
|
||||
type: Opaque
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
# - namespace.yaml # not managed by kustomize but created as needed by the argo app. creates conflicts otherwise since both overlays share the same namespace
|
||||
- ingress.yaml
|
||||
- pvc.yaml
|
||||
- service.yaml
|
||||
- deployment.yaml
|
||||
- servicemonitor.yaml
|
||||
|
||||
|
||||
images:
|
||||
- name: homeassistant
|
||||
newName: homeassistant/home-assistant
|
||||
newTag: "2025.10"
|
||||
|
||||
configurations:
|
||||
# allow nameReference to work with different mentions of the same resource as well
|
||||
- name_reference.yaml
|
||||
@@ -1,32 +0,0 @@
|
||||
nameReference:
|
||||
# Tie target Service metadata.name to other ingressroute fields
|
||||
- kind: Service
|
||||
fieldSpecs:
|
||||
# rewrite the backend service name
|
||||
- kind: IngressRoute
|
||||
group: traefik.io
|
||||
version: v1alpha1
|
||||
path: spec/routes/services/name
|
||||
|
||||
# adapt the ingress url
|
||||
# DOES NOT WORK
|
||||
- kind: IngressRoute
|
||||
group: traefik.io
|
||||
version: v1alpha1
|
||||
path: /spec/routes/match
|
||||
create: false
|
||||
|
||||
# adapt any middleware names
|
||||
- kind: IngressRoute
|
||||
group: traefik.io
|
||||
version: v1alpha1
|
||||
path: spec/routes/middlewares/name
|
||||
|
||||
# Update deployment volume mounts according to name changes in the sealedsecret
|
||||
- kind: SealedSecret
|
||||
fieldSpecs:
|
||||
# volume mounts:
|
||||
- kind: Deployment
|
||||
group: apps
|
||||
version: v1
|
||||
path: spec/template/spec/volumes/secret/secretName
|
||||
@@ -14,7 +14,7 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: homeassistant
|
||||
image: homeassistant
|
||||
image: homeassistant/home-assistant
|
||||
ports:
|
||||
- containerPort: 8123
|
||||
env:
|
||||
@@ -34,3 +34,4 @@ spec:
|
||||
- name: config-dir
|
||||
persistentVolumeClaim:
|
||||
claimName: config
|
||||
|
||||
@@ -1,17 +1,17 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: homeassistant
|
||||
name: homeassistant-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`homeassistant.kluster.moll.re`)
|
||||
- match: Host(`home.kluster.moll.re`) && !Path(`/api/prometheus`)
|
||||
middlewares:
|
||||
- name: homeassistant
|
||||
- name: homeassistant-websocket
|
||||
kind: Rule
|
||||
services:
|
||||
- name: homeassistant
|
||||
- name: homeassistant-web
|
||||
port: 8123
|
||||
tls:
|
||||
certResolver: default-tls
|
||||
@@ -19,7 +19,7 @@ spec:
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: homeassistant
|
||||
name: homeassistant-websocket
|
||||
spec:
|
||||
headers:
|
||||
customRequestHeaders:
|
||||
@@ -1,17 +1,18 @@
|
||||
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: homeassistant
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- pvc.yaml
|
||||
- stump-config.configmap.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- pvc.yaml
|
||||
- service.yaml
|
||||
- deployment.yaml
|
||||
- servicemonitor.yaml
|
||||
|
||||
namespace: stump
|
||||
|
||||
images:
|
||||
- name: stump
|
||||
newName: aaronleopold/stump
|
||||
newTag: "0.0.12"
|
||||
- name: homeassistant/home-assistant
|
||||
newName: homeassistant/home-assistant
|
||||
newTag: "2024.11"
|
||||
@@ -1,3 +0,0 @@
|
||||
- op: replace
|
||||
path: /spec/routes/0/match
|
||||
value: Host(`home.kluster.moll.re`)
|
||||
@@ -1,17 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
|
||||
namespace: homeassistant
|
||||
nameSuffix: -flat
|
||||
labels:
|
||||
- includeSelectors: true
|
||||
pairs:
|
||||
env: flat
|
||||
|
||||
patches:
|
||||
- path: ingress.patch.yaml
|
||||
target:
|
||||
kind: IngressRoute
|
||||
@@ -1,3 +0,0 @@
|
||||
- op: replace
|
||||
path: /spec/routes/0/match
|
||||
value: Host(`home-house.kluster.moll.re`)
|
||||
@@ -1,28 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
- wireguard-config.sealedsecret.yaml
|
||||
|
||||
|
||||
namespace: homeassistant
|
||||
nameSuffix: -house
|
||||
labels:
|
||||
- includeSelectors: true
|
||||
pairs:
|
||||
env: house
|
||||
|
||||
images:
|
||||
- name: wireguard
|
||||
newName: ghcr.io/linuxserver/wireguard
|
||||
newTag: "1.0.20250521"
|
||||
|
||||
patches:
|
||||
- path: wireguard.deployment.yaml
|
||||
target:
|
||||
kind: Deployment
|
||||
name: homeassistant
|
||||
- path: ingress.patch.yaml
|
||||
target:
|
||||
kind: IngressRoute
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
# WARNING - the originial secret was named wireguard-config-house, but we remove the suffix here, anticipating that it will be created by the kustomization overlay
|
||||
name: wireguard-config
|
||||
namespace: homeassistant
|
||||
spec:
|
||||
encryptedData:
|
||||
wireguard.conf: AgAz726k7X6IsabWUPX8kQ8r19mBq/N+YytlFS1gW2LUiYqc6H/O5/tqma5lLcazuxtsQhebeoitp2SkH7jTU8vRxn2tDWpyzcJr+BW4vKnghw5NhMbkNOzl7mvc7QIJk6rmRyD1umu33v6x8u3St9TVsUOI1zXJyXHxlbLdHVCORhgV79CGLjghpi23KyyFu6LzNrE5rhpB0Q7NzPUmbm5MHPNbtLsmImd/CZ9XjbyXSq0be8BgpUtGDE/NMx65G2+lLIw3EgbNwlirw/XKrM+pUIvEI6CxuNhbEM7KxCYlq2Du6bm7XsKHRzNu9oSfH+P4DaDoDt+M5k5miv4B8TIKXg7piy5mThXSTcVf5YpLJCiTfMDZOriG1ygr9gbJPYY1jumZA+vsZCvBx1o21BlNycWZWKBeYZZh47Hz9FGI/Smn8dOs5exZ34MrQtM4OuEqC/cJY8fdQ+nmGMezL0IKdbtpWgq5UqNH/wWv3F9kItB4KlSD4YtEGaY2z68BJG6t+9igSJCWmVca0EbOzhV0s5rI39ASVXOO50x774EEWUueoyfI+l5vwtQhc96I5Qn3kbFhwov0tHMg/IGBtS/7XdBBtOBx9KbcUHq1GlwWzQdw8WnRB6yyUVCqXyuExRhMPz5orqkTQwiUM2Fjse7xxnaEA0mbi0TVPKV/sFgWixvHqy3VAc1Jj6MEAWFAu+kPVlOFFCckEC5kPhNPFhBMeYX/3IblRjly/EHvrbrW/eFjNYE7bqpSCVhkB8bOXbJqt29V3+ffM1z/RkdSusgqdwid9CXhQw6SKAI/vcAqqxXdzcsbG1wsgP9bJ1Gk/i9ch8zUn7MwcFe6Tla86+xeiDIAmQmA7rhtmWhyyuxXdw+HXAFNhrbxHaUw3LZOExM+RzhWNepjSLnCBqnrtPkzFrHE02JKebWzX+IRZIOsEXJVhKTiSSjoB2v8h956kO+C7bdHz8GbxoJKJ7anrqFG13A//XLy5PvKr50qs/gQptrl9UtR7oj981bSDTVVa8h3OXbGLkZXly/qxsh5DlEjwnw2/2UqS+5yTT4FO/dNVtHryJ2tbc8ZuIHb6C/pQygqpseagthkm5T+Dv0T2xWpXFrvuktGNm58Cwg9bwNMcC6iofcjQP5JeNcat3RwzbJ9xwU4Nm8xLRMMc0ul6xUHRrL3ZjDfWHLuSuTp28HqXZ6xSKLlrRVjwZ6Mp/hhxj58SfVfLVIQxatGkwnIaHEFWE2n3S7m/iQO9tZIWCx5Yfs15atb1Ze8HjKjQ4o3sfaMD8Eokj9aFnXQQxpnOuSI3NLETe79QQ==
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: wireguard-config-house
|
||||
namespace: homeassistant
|
||||
type: Opaque
|
||||
@@ -1,24 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: homeassistant
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: wireguard-sidecar
|
||||
image: wireguard
|
||||
securityContext:
|
||||
privileged: true
|
||||
|
||||
|
||||
volumeMounts:
|
||||
- name: wireguard-config
|
||||
mountPath: /config/wg_confs/
|
||||
|
||||
volumes:
|
||||
- name: wireguard-config
|
||||
secret:
|
||||
secretName: wireguard-config
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: homeassistant
|
||||
name: homeassistant-web
|
||||
labels:
|
||||
app: homeassistant
|
||||
spec:
|
||||
@@ -10,4 +10,4 @@ spec:
|
||||
ports:
|
||||
- port: 8123
|
||||
targetPort: 8123
|
||||
name: http
|
||||
name: http
|
||||
@@ -1,39 +0,0 @@
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: immich-postgresql
|
||||
spec:
|
||||
instances: 1
|
||||
imageName: ghcr.io/tensorchord/cloudnative-vectorchord:16-0.3.0
|
||||
|
||||
bootstrap:
|
||||
initdb:
|
||||
owner: immich
|
||||
database: immich
|
||||
secret:
|
||||
name: postgres-password
|
||||
dataChecksums: true
|
||||
postInitApplicationSQL:
|
||||
- ALTER USER immich WITH SUPERUSER;
|
||||
- CREATE EXTENSION IF NOT EXISTS vchord CASCADE;
|
||||
- CREATE EXTENSION IF NOT EXISTS "cube";
|
||||
- CREATE EXTENSION IF NOT EXISTS "earthdistance";
|
||||
|
||||
postgresql:
|
||||
shared_preload_libraries:
|
||||
- "vchord.so"
|
||||
|
||||
storage:
|
||||
size: 5Gi
|
||||
storageClass: nfs-client
|
||||
|
||||
monitoring:
|
||||
enablePodMonitor: true
|
||||
|
||||
resources:
|
||||
limits:
|
||||
cpu: '2'
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 512Mi
|
||||
@@ -1,12 +1,11 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- ingress.yaml
|
||||
- pvc.yaml
|
||||
- immich.postgres.yaml
|
||||
- postgres.yaml
|
||||
- postgres.sealedsecret.yaml
|
||||
# - servicemonitor.yaml
|
||||
|
||||
|
||||
namespace: immich
|
||||
@@ -15,13 +14,20 @@ namespace: immich
|
||||
helmCharts:
|
||||
- name: immich
|
||||
releaseName: immich
|
||||
version: 0.10.1
|
||||
version: 0.8.4
|
||||
valuesFile: values.yaml
|
||||
repo: https://immich-app.github.io/immich-charts
|
||||
|
||||
|
||||
images:
|
||||
- name: ghcr.io/immich-app/immich-machine-learning
|
||||
newTag: v2.1.0
|
||||
newTag: v1.119.1
|
||||
- name: ghcr.io/immich-app/immich-server
|
||||
newTag: v2.1.0
|
||||
newTag: v1.119.1
|
||||
|
||||
|
||||
patches:
|
||||
- path: patch-redis-pvc.yaml
|
||||
target:
|
||||
kind: StatefulSet
|
||||
name: immich-redis-master
|
||||
17
apps/immich/patch-redis-pvc.yaml
Normal file
17
apps/immich/patch-redis-pvc.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: immich-redis-master
|
||||
spec:
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: redis-data
|
||||
spec:
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
@@ -1,10 +0,0 @@
|
||||
{
|
||||
"packageRules": [
|
||||
{
|
||||
"matchDatasources": ["docker"],
|
||||
"matchPackagePrefixes": ["ghcr.io/immich-app/"],
|
||||
"groupName": "Immich containers",
|
||||
"groupSlug": "immich-app-images"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: immich-service-monitor
|
||||
spec:
|
||||
endpoints:
|
||||
- port: metrics-api
|
||||
scheme: http
|
||||
- port: metrics-ms
|
||||
scheme: http
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: server
|
||||
app.kubernetes.io/service: immich-server
|
||||
@@ -4,30 +4,26 @@
|
||||
|
||||
# These entries are shared between all the Immich components
|
||||
|
||||
|
||||
controllers:
|
||||
main:
|
||||
containers:
|
||||
main:
|
||||
env:
|
||||
# some non-default vars
|
||||
DB_HOSTNAME: "immich-postgresql-rw"
|
||||
DB_USERNAME:
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgres-password
|
||||
key: username
|
||||
DB_DATABASE_NAME:
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgres-password
|
||||
key: database
|
||||
DB_PASSWORD:
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgres-password
|
||||
key: password
|
||||
IMMICH_METRICS: true
|
||||
env:
|
||||
REDIS_HOSTNAME: '{{ printf "%s-redis-master" .Release.Name }}'
|
||||
DB_HOSTNAME: "immich-postgres-rw"
|
||||
DB_USERNAME:
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgres-password
|
||||
key: username
|
||||
DB_DATABASE_NAME:
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgres-password
|
||||
key: database
|
||||
DB_PASSWORD:
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgres-password
|
||||
key: password
|
||||
IMMICH_MACHINE_LEARNING_URL: '{{ printf "http://%s-machine-learning:3003" .Release.Name }}'
|
||||
IMMICH_METRICS: true
|
||||
|
||||
immich:
|
||||
metrics:
|
||||
@@ -41,15 +37,17 @@ immich:
|
||||
existingClaim: data
|
||||
|
||||
# Dependencies
|
||||
valkey:
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
|
||||
redis:
|
||||
enabled: true
|
||||
persistence:
|
||||
data:
|
||||
enabled: true
|
||||
size: 1Gi
|
||||
# Optional: Set this to persistentVolumeClaim to keep job queues persistent
|
||||
type: emptyDir
|
||||
accessMode: ReadWriteOnce
|
||||
architecture: standalone
|
||||
auth:
|
||||
enabled: false
|
||||
|
||||
# Immich components
|
||||
|
||||
server:
|
||||
enabled: true
|
||||
|
||||
@@ -1,42 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: kitchenowl
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: kitchenowl
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: kitchenowl
|
||||
spec:
|
||||
containers:
|
||||
- name: kitchenowl
|
||||
image: kitchenowl
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
env:
|
||||
- name: TZ
|
||||
value: Europe/Berlin
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: kitchenowl-config
|
||||
- secretRef:
|
||||
name: kitchenowl-oauth
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "100Mi"
|
||||
limits:
|
||||
cpu: "100m"
|
||||
memory: "1Gi"
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: kitchenowl-data
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: kitchenowl-ingressroute
|
||||
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`kitchen.kluster.moll.re`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: kitchenowl-web
|
||||
port: 8080
|
||||
|
||||
tls:
|
||||
certResolver: default-tls
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kitchenowl-config
|
||||
data:
|
||||
FRONT_URL: https://kitchen.kluster.moll.re
|
||||
DISABLE_USERNAME_PASSWORD_LOGIN: "true"
|
||||
@@ -1,19 +0,0 @@
|
||||
---
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: kitchenowl-oauth
|
||||
namespace: kitchenowl
|
||||
spec:
|
||||
encryptedData:
|
||||
JWT_SECRET_KEY: AgAclRIJS25ACVe4NqLQbAree6c6WpTBHnLpe3ZQJ0ScHG/EbW/ooABZj7y1ABAn/mCc+hBYXYHm81FNUfUtSuLKi2UlORbTCsfmisYH49WX0Lpku9LTM/8az9tjE0tjUUrJZcRUuJfdNJMDPQx7IPjUQ7sKk/exFnkPEbK98+AElXyHpPKXd9dxiCgll0n+ksbF9BDUR8KY8IB2Zvh4cXPww578qe/9XYnxLV8uY9K8KPvhl7NI40SIaL4PX8KmsDlBh1bpOR/OxhIwAGEZDQp/KROy6msrIOYW4SHM9nlSUSD4WvV8UjcbV1oNnYpE1usFOuxSfQlJ1zlFepKUv40JykyunvQv9nqVbEogsrS4o5N3gNEaB9yyFSHIlevp32LVpAuZu3cNplmT+Zg7+ODpCWIcVgmOAeapvB+X7H4ScbKVcYLAzrRFDtnS4Vo1M+RERhr0AuMU/tz0lGs99oRkCw2ZIg015R125u0VcRNqzgCtbBM5BFiKiP2kYrHn02Q6o5tRWxDQfrfb0mnfD5c/gM4+btlfM6DZMpr/l1kLlm8PDEpPGbkhK1XiAyJ4erHPDMLcmZXrSyxX9R1g8n7vnLnkqx5LkGmnltQI2FM7StxC6IrMlxY0nPnkq1lHhTz7yCpQJNXgfXZLVvov+f6jlD6WJhYHZCL/hIFfx3ybjGYZwJ0m84lH0OQJQw5dtsbPVqqoYZIPieqdRmHw7M7TTmFuQJXD94lZj5gsln1sMqs=
|
||||
OIDC_CLIENT_ID: AgDOxWtGCiFrIP5aWHimrR6bu0uMS1/i1v1Kzo1lIR3j3zlw/Da2oCPNx1ZuhNAp9UMIs2euc8mtrWkyv4R6pcci+IxXiGzlQNBSkMfWu4DwhwlEdnVyCVehfE00t0ytBxX6NeLfS1b8JOtH9yo3e22fdaeTwn/iwGLNwi1BJxMmzk9pVp7jzXH09Zia8UvUmXw5GyGpIOIiGcIfaXkr1ZnY2l30jTw8eS7HaouzfWHWTpNXkMLN3qim4vs/B1Sgz/y9tUyVo/qMhWLdEcVklYHT7xHx03SPD7RtK+zdYZCqvDtj+tsdpYHt05zeGV+wflNQuiocjwP8TW7vhtbjKrf9lQIxB5CErju178ELOVrpsPBAYMgdEl7qZeKdSpydIwe3VbOg3XJ7O/Ps1KSnRYwrCvgE4ZCMm3geHyJxSiKRhBcuVYz5JkNd5ylD0Eq9NL5RCqJ4szL9NaGNPbzkvcdZzAnbTYFTzyqZ+XHX/BUFisXl5bKNHtaqAsOK8woGYnxJiawKRrwDUmHXU4RB3QiPCPhHSLU7OkvU+XDhyQqLa8bKEQzj9dUf4bX3Savk4noiRsXMYJznAlgMPo0Q4taxVIoyQHELYwIIdP5YRuw27B9wKUR7e2hhu4FTOEcyhwuFql3OuAjq8HJCDX6+COkL2WYFFxWBnbSCYEdzfbMBCHjrUUonijcQluU2VbaHODNMAvB16MRKapAW
|
||||
OIDC_CLIENT_SECRET: AgAylnSUXwInlh/WvyCiFz+8asbCSZA6kk84Rt6l7bHVYw34c58lJHsZK2OvOIlHuaMe/ewnTqxVd0hI1Azl+wd/5NygMYlntKquq0vuzlhLrGc3u+0SOn9N2P6quA3slF9KR94CYsDx9ogy+EsEoA1yrsydB8S0g9W8syraR1MtpM0ZkcJ/D78OZ6qzyXUuBNAZc+iX/r96NvoMiGNYavgG7npOJh/pkKNYPuNkt4zpbAFjVyoCfgZd4V2nmZ6dhEVy8odW+jcsMn6OJ1OZVlPb1beq49lBEcaJqk83ZtKbq2evtBYHw9YAnENVq92ecenw/YL5LXUhOxeN0M9Amo99/O6pQwwrT1mtZqhTTeTIZTAxqmJKgyxGhE4DJUR/s71bc7K9hd2WvdAYnCyVC2uGa0MwXp4V7UuaN9GerldT8lcFxOpRnD7yroqVTqebjAJIkIinp5NNZ2ZP/LCiCwKKHHT19Pchn615WOPTofC6es/spIdQ8a1Nf2J5YzvRjsduFS55U6tMaC7cuV8kqKH9xTTf/sDHt+68wVEAO9koAe1zpO+zR2Pq3VuCnvcDGIwXopXjvyjfujEEhEWZl51PVJLZqtkP5Wg2wHvlgjJBbbIGTrqh4xa9pK7wLDM2hUFx1q/YKqwfP0EGVTc96G8Wermj0DtIqclqFLr54DtxVe+Rr8J4edG6YQ26/seYsrZ1Oq2PejHQt8u9EzQYAtYYlBsw2ujCWys6KrbhaVr3
|
||||
OIDC_ISSUER: AgA2JPd5axkL5YIRA95qm/iH8wgM2J0AjKjgGClWabYJ3UKIk0hi/L/zR+1Pw9Z+6amYXj7Q0FxLqCcNYG+H5ABxnqUi7Gl8gvfVbegaO3q5QiO27g18RMDssNHDSun8PPaxHBvBD68hxgsaXntu8sZavCGdwEK0TzLJi7eH/4jtHlofzfYgaCsGqeOBgvs/q87PVJ/qxazXlY9e7abbRAKl9ZMY7Wga58/IU2HhWwYMvI53yQyGMcKf3XiI9iNHgIcj1+TmlgQo+PRKyopNfzgFbey7on8woQXphY+ioqQ0hyworpxAVoWlvzKKopt1xBDr4zxzkzbWyxtjwPVOOH3iyenZz8tZa/JkNYWxkWHbh0KCs9yUIji3D3shQOFM/NtE17THsQm3NgpZ2lg9ET1v6uXqwfOLiQ+J1JQLwNFnYeruH2lK4EGt2nDCq2VycOIjW4kMpiJ4LiT8gap9HwYjTpAn+opicYn5e9fmpgiHdMPvrsG1m9edg0cbwdSpEelliHnAUfKsxMV2e1fLsga6yrhBLSXIQs8rbURRa6wqVvGoLB86a9Q5Rm94Jfm0Sa9v5LMGRYvqO5LbLrjrR8e/2r17pHQE8ynMQCAW1yVTe09FcgRwYhDUohfThtjIh16sdoC97eUel7fo/POt3atP69JsCIBZstprhVtBIBssmavpIotVqi8F2/yUkhrZR26mH3gsOxkNTEk6XzHHtJRu0cU+BmObTvYgMi3DHg==
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: kitchenowl-oauth
|
||||
namespace: kitchenowl
|
||||
type: Opaque
|
||||
@@ -1,17 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- pvc.yaml
|
||||
- kitchenowl-oauth.sealedsecret.yaml
|
||||
- kitchenowl-config.configmap.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
|
||||
namespace: kitchenowl
|
||||
|
||||
images:
|
||||
- name: kitchenowl
|
||||
newName: tombursch/kitchenowl
|
||||
newTag: v0.7.4
|
||||
@@ -1,4 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: placeholder
|
||||
@@ -1,11 +0,0 @@
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: kitchenowl-data
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kitchenowl-web
|
||||
spec:
|
||||
selector:
|
||||
app: kitchenowl
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
@@ -13,4 +13,4 @@ namespace: linkding
|
||||
images:
|
||||
- name: linkding
|
||||
newName: sissbruecker/linkding
|
||||
newTag: "1.44.1"
|
||||
newTag: "1.36.0"
|
||||
|
||||
@@ -12,4 +12,4 @@ resources:
|
||||
images:
|
||||
- name: jellyfin/jellyfin
|
||||
newName: jellyfin/jellyfin
|
||||
newTag: 10.10.7
|
||||
newTag: 10.10.3
|
||||
|
||||
@@ -1,11 +1,3 @@
|
||||
## Setup
|
||||
Because minecraft is quite sensitive to io performance, we want the data to be stored on a local disk. But hostpath is not well supported in talos (and is not persistent), so we use an ephemeral volume instead. In order to do this, we create an emptyDir volume and mount it to the pod.
|
||||
|
||||
We use an initContaier that copies the data to the local storage. Afterwards, copying from the local storage back to the persistent storage is handled by a preStop lifecycle event.
|
||||
|
||||
This way, we can have the best of both worlds: fast local storage and persistent storage.
|
||||
|
||||
|
||||
## Sending a command
|
||||
```
|
||||
kubectl exec -it -n minecraft deploy/minecraft-server -- /bin/bash
|
||||
|
||||
@@ -7,7 +7,7 @@ metadata:
|
||||
namespace: minecraft
|
||||
spec:
|
||||
encryptedData:
|
||||
key: AgDG6apUvB38rB9tH+/ya5Af/32IUJjHiEGZFdYYqesuqyPB/qf99EtC/7CwqD6bDQQPVycJVcxwZuF8QtYfPXzv//yMkqEUJ2G1/Q5J8I6bjNGLR636UhliUpCkH1QDOspWJUjwKDVxlFN9l0g9UajvxnqLyGzbWPeay0sJEBvAY8ltEZpLP21V+GD+HgPk3HIfSFFBMsULS6GPCjMaFxkxQb6cG3K4Ej4NHCHRGOmax+4Rk7lwMyAHlXLlrwj/ytxrnHDWrugLIJE9KKmJn6UVNTuk6olgkhleg2PixV7oOiDVyu9ZQP8wbdppzRix6dnIcFEYJ1ZDK1rNF5QErYO0gBytiJnSsdFO0jUMsdBrho2FgUc5GgIdmgXWJJz3lrGFqXaRVvbPsBZTUAsQRh2+4IfqfWmAkEjBcjs1K8WWJfS+rO9e02KoHBT4decdsd8Qfr5EFdPIzMrkUoRMI9CJnIa5u2nR08Hhd9iojbL64FZ26kXMODtEdKmlo+HwjufLX5rYJVSfOyZYzivd/kgKA87YTFaMLKej07w3ofGrPYSoCnmLfJyoQdNyJhdonBDsgM1GgRWQZDpgJ1df0SB02A5lZ4V7lHWr8KlANv9YLuMoZnVehsH1NZjNQHDInIRiTLahEBbjcJzQz4vU1UWG100ATszEYKOUVkzPnTgkqKYU99ZQ23bHP8z7iAWQeumb6V84NTi6jNITBvU4yTFLuAiI3nW34Vb1mFVLwfWqMjEYX8gBB4yMSaVshB/japfkyXU0pYg4mK9gsB4=
|
||||
key: AgBYeAiejdmxDBorvgnxQX5YvUhR3NId2vfWybMKlc27e6D/bKglLNyZMk70xSnFAPjcDmZ20mYjFPYvDOr9T6IU/REJ8QlzoKAn0xW779R4SkIxRToT+dJv+OM2avgQ9uqp7vja29xeXMjYAnQML+QGZKcrT8mE04G/Ty8rdUiv3yUXK5HFAR3SUF35aVLdlthLjpRkv1s0R7GAP4L2pNzBJNV3i37viceUSSjU0zpOa23fsQOkPAs67AIukAJBqh/hyF/hR9H1GeYZNTI3OcHcvC2iNk/XGstvv0Zy6ApzoebsfWGdsbVn+QUI0EBw+mSTPqpl71cbkz0v4S4XAVndosxWpe6AIgm5MBTU0FXIyGyoFDe1aMPq8BXiQikYVwB48oVNh9KF0xXX5AOG0whB/FEsL3OJsiNQvQ3R/Hru43JBn64oxjVtLfM3E7u8v/xr1VQahX8dylDmb4s5EV01U6O4y19Ou4td1eEMlhpJb0fBPDRUYuWxZAEDGmp+U4tAakyPed11VkcZPPn9fKAAcv8sGs3TYAbbF18hqsBnv2Wd+i7ZEvKwmdmfR/T0r1TJGsvKI7jaW0QtH256XrSxQp7a52qMKMVQWOSKw2k27t/IkRhxT2Prw4GfJvaVr4RozUaBf3LV/hfDWlDfmM2zg3X9W8HkzjotGg021OLxsa0Wzmhffvb8h4bvZwxeq3U1xaJocqXui7z0rT2pF4z3wYHR/lPtexHcOA2M8gfBGKb1rBKh+kW+N+/ZfVLNI0mokg5vrTO2nR2rb4c=
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
|
||||
@@ -4,27 +4,14 @@ metadata:
|
||||
name: start-server
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: minecraft-server
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
initContainers:
|
||||
- name: copy-data-to-local
|
||||
image: alpine
|
||||
command: ["/bin/sh"]
|
||||
args: ["-c", "cp -r /data/* /local-data/"]
|
||||
volumeMounts:
|
||||
- name: local-data
|
||||
mountPath: /local-data
|
||||
- name: minecraft-data
|
||||
mountPath: /data
|
||||
containers:
|
||||
- name: minecraft-server
|
||||
image: minecraft
|
||||
resources:
|
||||
limits:
|
||||
memory: "11000Mi"
|
||||
memory: "10000Mi"
|
||||
cpu: "5"
|
||||
requests:
|
||||
memory: "1500Mi"
|
||||
@@ -42,13 +29,13 @@ spec:
|
||||
name: curseforge-api
|
||||
key: key
|
||||
- name: CF_PAGE_URL
|
||||
value: "https://www.curseforge.com/minecraft/modpacks/vault-hunters-1-18-2/files/6807187"
|
||||
value: "https://www.curseforge.com/minecraft/modpacks/vault-hunters-1-18-2/files/5413446"
|
||||
- name: VERSION
|
||||
value: "1.18.2"
|
||||
- name: INIT_MEMORY
|
||||
value: "1G"
|
||||
- name: MAX_MEMORY
|
||||
value: "10G"
|
||||
value: "8G"
|
||||
- name: MOTD
|
||||
value: "VaultHunters baby!"
|
||||
- name: ENABLE_RCON
|
||||
@@ -56,37 +43,15 @@ spec:
|
||||
- name: CREATE_CONSOLE_IN_PIPE
|
||||
value: "true"
|
||||
- name: ONLINE_MODE
|
||||
value: "false"
|
||||
value: "true"
|
||||
- name: ENABLE_AUTOSTOP
|
||||
value: "true"
|
||||
- name: AUTOSTOP_TIMEOUT_EST
|
||||
value: "1800" # stop 30 min after last disconnect
|
||||
|
||||
volumeMounts:
|
||||
- name: local-data
|
||||
mountPath: /data
|
||||
|
||||
- name: copy-data-to-persistent
|
||||
image: rsync
|
||||
command: ["/bin/sh"]
|
||||
# args: ["-c", "sleep infinity"]
|
||||
args: ["/run-rsync.sh"]
|
||||
volumeMounts:
|
||||
- name: local-data
|
||||
mountPath: /local-data
|
||||
- name: minecraft-data
|
||||
mountPath: /persistent-data
|
||||
- name: rsync-config
|
||||
mountPath: /run-rsync.sh
|
||||
subPath: run-rsync.sh
|
||||
|
||||
mountPath: /data
|
||||
|
||||
volumes:
|
||||
- name: minecraft-data
|
||||
persistentVolumeClaim:
|
||||
claimName: minecraft-data
|
||||
- name: local-data
|
||||
emptyDir: {}
|
||||
- name: rsync-config
|
||||
configMap:
|
||||
name: rsync-config
|
||||
defaultMode: 0777
|
||||
|
||||
@@ -8,7 +8,6 @@ resources:
|
||||
- pvc.yaml
|
||||
- job.yaml
|
||||
- service.yaml
|
||||
- rsync.configmap.yaml
|
||||
- curseforge.sealedsecret.yaml
|
||||
|
||||
|
||||
@@ -16,9 +15,3 @@ images:
|
||||
- name: minecraft
|
||||
newName: itzg/minecraft-server
|
||||
newTag: java21
|
||||
- name: alpine
|
||||
newName: alpine
|
||||
newTag: "3.22"
|
||||
- name: rsync
|
||||
newName: eeacms/rsync
|
||||
newTag: "3.0"
|
||||
|
||||
@@ -1,42 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: rsync-config
|
||||
data:
|
||||
run-rsync.sh: |-
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
echo "Starting rsync..."
|
||||
|
||||
no_change_count=0
|
||||
|
||||
while [ "$no_change_count" -lt 3 ]; do
|
||||
# use the i flag to get per line output of each change
|
||||
rsync_output=$(rsync -avzi --delete /local-data/ /persistent-data/)
|
||||
# echo "$rsync_output"
|
||||
|
||||
# in this format rsync outputs at least 4 lines:
|
||||
# ---
|
||||
# sending incremental file list
|
||||
#
|
||||
# sent 145,483 bytes received 717 bytes 26,581.82 bytes/sec
|
||||
# total size is 708,682,765 speedup is 4,847.35
|
||||
# ---
|
||||
# even though a non-zero number of bytes is sent, no changes were made
|
||||
|
||||
line_count=$(echo "$rsync_output" | wc -l)
|
||||
|
||||
if [ "$line_count" -eq 4 ]; then
|
||||
echo "Rsync output was: $rsync_output"
|
||||
no_change_count=$((no_change_count + 1))
|
||||
echo "No changes detected. Incrementing no_change_count to $no_change_count."
|
||||
else
|
||||
no_change_count=0
|
||||
echo "Changes detected. Resetting no_change_count to 0."
|
||||
fi
|
||||
|
||||
echo "Rsync completed. Sleeping for 10 minutes..."
|
||||
sleep 600
|
||||
done
|
||||
|
||||
echo "No changes detected for 3 consecutive runs. Exiting."
|
||||
17
apps/monitoring/grafana-admin.sealedsecret.yaml
Normal file
17
apps/monitoring/grafana-admin.sealedsecret.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
---
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: grafana-admin-secret
|
||||
namespace: monitoring
|
||||
spec:
|
||||
encryptedData:
|
||||
password: AgAwMLnsYN1y8JQSqgGQbNG/8jKensTDsEw6ogITdkhDRlJcg8HQ5t7a6xLzNCrLHLJiQW8YOoyLT4lvFkBRMOa2EYcrDvBiRD0PjygWLIscKa7dA+jpAUf/icD9zsiDnTym2yf+VUANcmEgE6DiNvlcsrcmYqiR4pKVUTDlKPNOjOpTJ3nXETb3/sbt69E0JSGwtkvusYQSXKLU9KLbciihv+ycdkdlC9xy9myd4+vYZYXSh/eAvyZeb/hsmdSX7yaASmupMvet6Qsdt99PNzFQxtbQH+LQvYalVZ8bjWZQvCN/p0bA4H15otKBfe8rtEwVthgvyEvo6TK0Mg0pFY/b3AOGFmImnT3rDmgG6S8KTZH0Jce17ksFqvELQmHjqHuYpQsPDl44glM8kWRJ9Mf/Z424LRwZlJNVcOkuVl4qFqPUjzd2rWIyF0RaD0BE012C0ThJxKn2l17lVJbNtdUiR3qNpW01ot2m0CgKd2kXbjDmgRgAll4WgrukfCIn9ZnE0gVCFLJuK3MOQAaipFYy/bDO0izwl9T8nldgcI8OfiC3NTk2O+Es5jJRXu0oJGaC3HrTB7wXiwOoELvAsxLTPxKBiN9mCHCMtZX0PEtrio0dFRQ6Pi5xPng0KVT0I9dvGNsPdhPETNOB913WEvbgP8Gt3cj016nCzk51eUsYbXPpNL2B4kmbIhecqW/8kwKQPwYjVlBSXj3NxjzwMY6PvOl1
|
||||
user: AgBqmjCYGMqy5zBE+vhtsynOvhWdHWDJDyl1D+laBtLjXTJwzRbNTdunHYo1ekwyqQ6Cr5pi4YMiLxAl1LIHF+Lfsp2QlY+ResAGzp9WgSBtNQDX3EmLDQofeWxMUDdMtMsE9wiKLCfNGDkRDsGquXTz+YFq03m1vH9cB8Bp+1ClWOTui+/Ce0MZlWsJZX1W8WXH7XTirtwUo0s53pc4AplUUH97ZEK3KSIxWa3gLCn0sAPDDLPX+JVA2xtpMq1XuVFiFifjzEtG2h0dejiF35FtSAR+rR4YmEfimk3QpRDfOqV5QUxvjCG+dTV49upSevF2mvbHW+o+lB6vEc6l9cZXvlbnMdaep3NmOsJcJ8wQIdFpFK4iVzFOTKSEbzLPlZ/J+sjS5vDXsfthorIO2faMA1iIf+I663zNxQU5btaK4TNYOZQlrFVjAmioRLkDhGZ6tDUPX/zMv+Crt+0HCwyEyhmvFZckDvezTZrxARSXXMKBVcvjHCyUNkz7ubZRiMU0PGM7fYuHr659e+XMRvj+LFA68ZaEIzCQpCFJenWWYAXgUdRG4LQ1LP2MwvRHpkOYSoRkHIpX7jOfhX82A60h/ta/CdbWifqNyL9OecvE3FKsZu/Kr0taw9W6nm6FBhQLgFkOnFrqp9dWnxfHruXuDBgcn0iE8nR7Ht2zS7hfQPeR4a3Y0xK3Plqbzdrb9HKnWQQhf14=
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: grafana-admin-secret
|
||||
namespace: monitoring
|
||||
type: Opaque
|
||||
16
apps/monitoring/grafana-auth.sealedsecret.yaml
Normal file
16
apps/monitoring/grafana-auth.sealedsecret.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: grafana-auth
|
||||
namespace: monitoring
|
||||
spec:
|
||||
encryptedData:
|
||||
client_secret: AgCcKsnS3u2eI+fNVC9hAZ3QRFOHFErAzs5aQgX51CSdJwM03SZUoTyrDi5JPcHUVyS3MbevFH5piMhDTARMI3bLOjYlcwMbpf77JCPa7o95Y9asA/FW3lXicYt3biN9xBXJBz7Ws3fVRtEzyf6DmbGedT9gaX8aPwrUVbP19RdyJiuu76oB1A/jdUkX4K+X6kVvmoP/BWdypk/kdQJrzBNt00DIXF4NHfYey36AuhpBtqYZs4faA/tBXMXLE4RxPNtcHwNfVjnRj3v3qzNufD1fnweJvLq2UfLMrQjoR9XDVnM0zkpautylkI7yrvcoEH7ljnf6b1FMogOEZUfH1BIdqTd/WwrrlCqE58OPfJWthIfN+pQ8LvdHsGo3jc9gXvfXS2cStyhP06eTZ4D79kG+RtDQGOsD/Wpx7EcM6hbB3+dIjcs3wEAIGjpIVtY9JayW8YeRnFApMuhDST1+hscm+LdoGvaSTlAuGzv9BbVrPX/Fo9XKeYHlbG/x71Er+vF8WbW0wUa46MHLvbEy376XIdJDYi+vjl4eqznZ6YhvPbawhoKXT8ZcKUcUAjVcMue/O/jCSPZplbn3vdSCeqPTiqVqDw9PTMIeWFUepgPMxiGpFRAqdwIecFBnYItq0dXoGlFrZpo0S6AECgZjxzUR5EgdkdPlDDs2CN+d9yP7f2S+gmL7AIlQr74NW1GrTGw2x/rD4IJhunh7
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: grafana-auth
|
||||
namespace: monitoring
|
||||
type: Opaque
|
||||
@@ -35,17 +35,13 @@ datasources:
|
||||
datasources.yaml:
|
||||
apiVersion: 1
|
||||
datasources:
|
||||
- name: Prometheus
|
||||
type: prometheus
|
||||
url: http://prometheus.monitoring.svc:9090
|
||||
isDefault: true
|
||||
- name: Thanos
|
||||
type: prometheus
|
||||
url: http://thanos-querier.monitoring.svc:10902
|
||||
isDefault: false
|
||||
- name: Loki
|
||||
type: loki
|
||||
url: http://loki.monitoring.svc:3100
|
||||
url: http://thanos-querier.prometheus.svc:10902
|
||||
isDefault: true
|
||||
- name: Prometheus
|
||||
type: prometheus
|
||||
url: http://prometheus.prometheus.svc:9090
|
||||
isDefault: false
|
||||
|
||||
dashboardProviders:
|
||||
@@ -85,15 +81,13 @@ grafana.ini:
|
||||
auth.generic_oauth:
|
||||
name: Authelia
|
||||
enabled: true
|
||||
icon: signin
|
||||
allow_sign_up: true
|
||||
client_id: grafana
|
||||
client_secret: ${AUTH_GRAFANA_CLIENT_SECRET}
|
||||
scopes: openid profile email groups
|
||||
empty_scopes: false
|
||||
auth_url: https://auth.kluster.moll.re/api/oidc/authorization
|
||||
token_url: https://auth.kluster.moll.re/api/oidc/token
|
||||
api_url: https://auth.kluster.moll.re/api/oidc/userinfo
|
||||
api_url: https://auth.kluster.moll.re/api/oidc/authorization/userinfo
|
||||
tls_skip_verify_insecure: true
|
||||
auto_login: true
|
||||
use_pkce: true
|
||||
role_attribute_path: contains(groups[*], 'apps_admin') && 'Admin' || 'Editor'
|
||||
use_pkce: true
|
||||
@@ -1,7 +1,7 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: grafana
|
||||
namespace: monitoring
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
@@ -17,5 +17,5 @@ helmCharts:
|
||||
- releaseName: grafana
|
||||
name: grafana
|
||||
repo: https://grafana.github.io/helm-charts
|
||||
version: 10.1.4
|
||||
version: 8.6.2
|
||||
valuesFile: grafana.values.yaml
|
||||
@@ -13,4 +13,4 @@ resources:
|
||||
images:
|
||||
- name: binwiederhier/ntfy
|
||||
newName: binwiederhier/ntfy
|
||||
newTag: v2.14.0
|
||||
newTag: v2.11.0
|
||||
|
||||
@@ -55,7 +55,7 @@ spec:
|
||||
memory: "200Mi"
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: "4Gi"
|
||||
memory: "1Gi"
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
|
||||
@@ -14,14 +14,14 @@ namespace: paperless
|
||||
images:
|
||||
- name: paperless
|
||||
newName: ghcr.io/paperless-ngx/paperless-ngx
|
||||
newTag: "2.18.4"
|
||||
newTag: "2.13.5"
|
||||
|
||||
|
||||
helmCharts:
|
||||
- name: redis
|
||||
releaseName: redis
|
||||
repo: https://charts.bitnami.com/bitnami
|
||||
version: 23.2.3
|
||||
version: 20.3.0
|
||||
valuesInline:
|
||||
auth:
|
||||
enabled: false
|
||||
|
||||
@@ -13,5 +13,5 @@ resources:
|
||||
|
||||
images:
|
||||
- name: mealie
|
||||
newTag: v3.4.0
|
||||
newTag: nightly
|
||||
newName: ghcr.io/mealie-recipes/mealie
|
||||
|
||||
@@ -1,48 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: stump
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: stump
|
||||
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: stump
|
||||
|
||||
spec:
|
||||
containers:
|
||||
- name: stump
|
||||
image: stump
|
||||
|
||||
resources:
|
||||
requests:
|
||||
memory: "64Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "128Mi"
|
||||
cpu: "500m"
|
||||
|
||||
ports:
|
||||
- containerPort: 10801
|
||||
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: stump-config
|
||||
|
||||
volumeMounts:
|
||||
- name: stump-data
|
||||
mountPath: /data
|
||||
- name: stump-config
|
||||
mountPath: /config
|
||||
|
||||
volumes:
|
||||
- name: stump-config
|
||||
persistentVolumeClaim:
|
||||
claimName: stump-config
|
||||
- name: stump-data
|
||||
persistentVolumeClaim:
|
||||
claimName: stump-data
|
||||
@@ -1,17 +0,0 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: stump-ingressroute
|
||||
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`stump.kluster.moll.re`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: stump-web
|
||||
port: 10801
|
||||
|
||||
tls:
|
||||
certResolver: default-tls
|
||||
@@ -1,4 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: placeholder
|
||||
@@ -1,23 +0,0 @@
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: stump-data
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: stump-config
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: stump-web
|
||||
spec:
|
||||
selector:
|
||||
app: stump
|
||||
ports:
|
||||
- port: 10801
|
||||
targetPort: 10801
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: stump-config
|
||||
data:
|
||||
STUMP_ENABLE_UPLOAD: "true"
|
||||
STUMP_CONFIG_DIR: /config
|
||||
ENABLE_KOREADER_SYNC: "true"
|
||||
@@ -1,43 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: todos
|
||||
labels:
|
||||
app: todos
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: todos
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: todos
|
||||
spec:
|
||||
containers:
|
||||
- name: todos
|
||||
image: todos
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 200Mi
|
||||
|
||||
ports:
|
||||
- containerPort: 3456
|
||||
name: web
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /db
|
||||
- name: config
|
||||
mountPath: /app/vikunja/config.yml
|
||||
subPath: config.yml
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: data
|
||||
- name: config
|
||||
secret:
|
||||
secretName: todos-config
|
||||
@@ -7,11 +7,15 @@ spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
|
||||
- match: Host(`todos.kluster.moll.re`)
|
||||
- match: Host(`todos.kluster.moll.re`) && PathPrefix(`/api/v1`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: todos-web
|
||||
- name: todos-api
|
||||
port: 3456
|
||||
- match: Host(`todos.kluster.moll.re`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: todos-frontend
|
||||
port: 80
|
||||
tls:
|
||||
certResolver: default-tls
|
||||
|
||||
@@ -6,13 +6,13 @@ namespace: todos
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- pvc.yaml
|
||||
- todos-config.sealedsecret.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
|
||||
|
||||
images:
|
||||
- name: todos
|
||||
newName: vikunja/vikunja
|
||||
newTag: 0.24.6
|
||||
# helmCharts:
|
||||
# - name: vikunja
|
||||
# version: 0.1.5
|
||||
# repo: https://charts.oecis.io
|
||||
# valuesFile: values.yaml
|
||||
# releaseName: todos
|
||||
# managed by argocd directly
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: todos-web
|
||||
spec:
|
||||
selector:
|
||||
app: todos
|
||||
ports:
|
||||
- name: todos
|
||||
port: 3456
|
||||
targetPort: 3456
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: todos-config
|
||||
namespace: todos
|
||||
spec:
|
||||
encryptedData:
|
||||
config.yml: AgBRKmf5GSn6EcCH4r+I/lJkNiwZp0Pa/TFloYlPzqJ1aQWrTRDCLiljHYs1n/PTBWWv5SdWj+3Uvx4M+tzTXpRTp1dWomJ1C8pUDpf4N7SSZeAMoJxz5/mSUpA1YsYwiy/jhOzSsaeC80JX9WTXhCE5cnox/OUjcDf62vVg/7kgy8tHYpCSRmTGMah82642gP0/rlLpp+ctb29oYttmL0fWafHMRHgZYwkO1Ol7tmfbVOfr/bQljTQD3h/f0+ef2s3kDNtAkXSBAwHo6TfukB5bZi+pj3q3TLHAWU/belC38RZtIYW7trJf20WzbxxWKcS7rnQ8GHJqpbNgoWdnBQgP5OGHzySnQrdIAWLvOxw3JdJ8S1ZMbZfWASGpeIdfTI1p99Bhu1MGE3nnAzUCM93sLySE/mjjGDPdA9+Q7orgLGX3ct+w4deu1ABLR/HWxFYvPah11xs+MyzBFVh2rRj+MMzSWwQmbo+widmHWnzx6fjTiLd8eyGmvz1M9hBwFjqUTjbAR70S4xx2ALlYqAtbmJUk07PmTdTMhvokvaY5NX7Ylahx2oFE2q/FxMBwvPZVyI9tSbrZHEK9a67QaXnnwyfSqj3nErNkpdAa/zSJ9M6SG5cJrJvZCBn5cFg6pxtY65wZoj0GWMZ5kF2oqxDuekdjitWGMTp5q6ROJYSs/o3Lc/Abga9pSZYEtNrHr68tJuSeO61s9TjUftbkxkJ97/dwTfVQOd7aJui2EDp8NVcZg0CkEOgI7tt0nOEsll30RWS46QJwUbJM34FD646bpEk50K/GsIvFovKjZjtoCjeKczGdMpYS2XFwEMb8UjgSATxcVYjSWwvx+7prEChvoyVcg8Bi8ZEGcBVxSAD9fJu8PtyPBeijs7ZVwVyGGxiSafd3gAPU8spSuvbEDl/VZAKy9k2vrI2c/gtTqwaIasnBHudIbbNqDHlTlH8dk0z+kuNg/AzqheZWireMvBvgQ3TlHan0RN6+vVpZCY5XbzWkj/DEmoor8UfeuYt3GD7/JHniAorMPj61n2od7TLXmLunPG/B/zNpJCgJ8LgtUriDDZno99IDCXaZ/MO2+jppMaKizl83axxrv9HUTYDDgtX4RqLLdutd4i/AsOe0GgayFrOjUtDVOL6MKhX7dRJfbNsL5IcGEVZ1cdzcjjazoDpSlDdMC6E1XNS1NWprqUpmfjFPtFk1FWW3oRF3iEYUimngYvy6oTx3d70EZ+eOdEvp6A+aHbmG6fyEQb3AKYhMIOsn4AbKpDLjTsHiqWNGwT9ummS5kOLhnWBBB4ohDpCl4UMCtP61+1lhtx//Jne8QFAoq31MMFcCO2X3b2JfD6egLDc8Vwju6NHNy7jrmkponKqKxQPSs0w9Aj2biUBuFkMCiAik0Cf1fPk59bjJqs2ypwURDPAs1ShPoSU=
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: todos-config
|
||||
namespace: todos
|
||||
type: Opaque
|
||||
51
apps/todos/values.yaml
Normal file
51
apps/todos/values.yaml
Normal file
@@ -0,0 +1,51 @@
|
||||
######################
|
||||
# VIKUNJA COMPONENTS #
|
||||
######################
|
||||
# You can find the default values that this `values.yaml` overrides, in the comment at the top of this file.
|
||||
api:
|
||||
enabled: true
|
||||
image:
|
||||
tag: 0.22.1
|
||||
persistence:
|
||||
# This is your Vikunja data will live, you can either let
|
||||
# the chart create a new PVC for you or provide an existing one.
|
||||
data:
|
||||
enabled: true
|
||||
existingClaim: data
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
mountPath: /app/vikunja/files
|
||||
|
||||
ingress:
|
||||
main:
|
||||
enabled: false
|
||||
|
||||
configMaps:
|
||||
# The configuration for Vikunja's api.
|
||||
# https://vikunja.io/docs/config-options/
|
||||
config:
|
||||
enabled: true
|
||||
data:
|
||||
config.yml: |
|
||||
service:
|
||||
frontendUrl: https://todos.kluster.moll.re
|
||||
database:
|
||||
type: sqlite
|
||||
path: /app/vikunja/files/vikunja.db
|
||||
registration: false
|
||||
env:
|
||||
|
||||
frontend:
|
||||
enabled: true
|
||||
image:
|
||||
tag: 0.22.1
|
||||
ingress:
|
||||
main:
|
||||
enabled: false
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
redis:
|
||||
enabled: false
|
||||
typesense:
|
||||
enabled: false
|
||||
16
default.nix
16
default.nix
@@ -1,16 +0,0 @@
|
||||
{ pkgs ? import <nixpkgs> {} }:
|
||||
pkgs.mkShell {
|
||||
name = "infra-shell";
|
||||
|
||||
|
||||
buildInputs = with pkgs; [
|
||||
kubeseal
|
||||
yq
|
||||
jq
|
||||
kubernetes-helm-wrapped
|
||||
];
|
||||
|
||||
env = {
|
||||
};
|
||||
|
||||
}
|
||||
@@ -3,6 +3,4 @@ kind: ConfigMap
|
||||
metadata:
|
||||
name: argocd-cmd-params-cm
|
||||
data:
|
||||
# server.insecure: "true"
|
||||
# DID NOT FIX RELOAD LOOPS
|
||||
# application.namespaces: "*"
|
||||
server.insecure: "true"
|
||||
@@ -12,11 +12,13 @@ data:
|
||||
# If you want to store sensitive data in another Kubernetes Secret, instead of argocd-secret. ArgoCD knows to check the keys under data in your Kubernetes Secret for a corresponding key whenever a value in a configmap or secret starts with $, then your Kubernetes Secret name and : (colon).
|
||||
clientSecret: $argocd-oauth:client-secret
|
||||
|
||||
skipAudienceCheckWhenTokenHasNoAudience: true
|
||||
|
||||
# Optional set of OIDC scopes to request. If omitted, defaults to: ["openid", "profile", "email", "groups"]
|
||||
requestedScopes: ["openid", "profile", "email", "groups"]
|
||||
|
||||
# Optional set of OIDC claims to request on the ID token.
|
||||
requestedIDTokenClaims: {"groups": {"essential": true}}
|
||||
|
||||
allowedAudiences:
|
||||
- argocd
|
||||
|
||||
@@ -6,6 +6,4 @@ data:
|
||||
policy.csv: |
|
||||
# use oidc group apps_admin as admin group in argocd
|
||||
g, apps_admin, role:admin
|
||||
g, argocd, role:readonly
|
||||
# all other user that might have entered via oidc, are blocked: deny everything
|
||||
policy.default: deny
|
||||
policy.default: role:readonly
|
||||
|
||||
@@ -3,9 +3,7 @@ kind: ConfigMap
|
||||
metadata:
|
||||
name: argocd-cm
|
||||
data:
|
||||
# enable helm when using kustomize
|
||||
kustomize.buildOptions: --enable-helm
|
||||
# disable admin user - use oidc
|
||||
admin.enabled: "false"
|
||||
# show neat status badges in the UI or as embeds
|
||||
statusbadge.enabled: "true"
|
||||
# switch to annotation based resource tracking as per
|
||||
# https://argo-cd.readthedocs.io/en/stable/user-guide/resource_tracking/
|
||||
application.resourceTrackingMethod: annotation+label
|
||||
|
||||
@@ -10,8 +10,8 @@ spec:
|
||||
- kind: Rule
|
||||
match: Host(`argocd.kluster.moll.re`)
|
||||
services:
|
||||
- name: argocd-server
|
||||
port: 443
|
||||
scheme: https
|
||||
- name: argocd-server
|
||||
port: 80
|
||||
|
||||
tls:
|
||||
certResolver: default-tls
|
||||
certResolver: default-tls
|
||||
|
||||
@@ -4,13 +4,14 @@ kind: Kustomization
|
||||
namespace: argocd
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- https://github.com/argoproj/argo-cd//manifests/cluster-install?timeout=120&ref=v3.1.9
|
||||
- https://raw.githubusercontent.com/argoproj/argo-cd/v2.12.6/manifests/install.yaml
|
||||
- ingress.yaml
|
||||
- argo-apps.application.yaml
|
||||
- bootstrap-repo.sealedsecret.yaml
|
||||
- argocd-oauth.sealedsecret.yaml
|
||||
- servicemonitor.yaml
|
||||
|
||||
components:
|
||||
- https://github.com/argoproj-labs/argocd-extensions/manifests
|
||||
|
||||
patches:
|
||||
- path: argocd.configmap.yaml
|
||||
|
||||
@@ -1,77 +0,0 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: argocd-metrics
|
||||
labels:
|
||||
release: prometheus-operator
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-metrics
|
||||
endpoints:
|
||||
- port: metrics
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: argocd-server-metrics
|
||||
labels:
|
||||
release: prometheus-operator
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-server-metrics
|
||||
endpoints:
|
||||
- port: metrics
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: argocd-repo-server-metrics
|
||||
labels:
|
||||
release: prometheus-operator
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-repo-server
|
||||
endpoints:
|
||||
- port: metrics
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: argocd-applicationset-controller-metrics
|
||||
labels:
|
||||
release: prometheus-operator
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
endpoints:
|
||||
- port: metrics
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: argocd-dex-server
|
||||
labels:
|
||||
release: prometheus-operator
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-dex-server
|
||||
endpoints:
|
||||
- port: metrics
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: argocd-redis-haproxy-metrics
|
||||
labels:
|
||||
release: prometheus-operator
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-redis-ha-haproxy
|
||||
endpoints:
|
||||
- port: http-exporter-port
|
||||
@@ -1,8 +0,0 @@
|
||||
### Adding clients
|
||||
|
||||
Generate a new secret + hash:
|
||||
```
|
||||
k exec -it -n authelia deployments/authelia -- authelia crypto hash generate pbkdf2
|
||||
```
|
||||
|
||||
give the client the hash, store the secret in `authelia-oidc.secret.yaml` and seal it.
|
||||
@@ -1,20 +0,0 @@
|
||||
---
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: authelia-internal
|
||||
namespace: authelia
|
||||
spec:
|
||||
encryptedData:
|
||||
identity_providers.oidc.hmac.key: AgBiAFMdVNGubsvfYu9oi6SE1AF8ZmiSbiSPjZhrSjpw8J8vN0Zjm/4TQX+I+qD7GQu0zO72D2hF/26fBZrLx2N1IJAj0va1NYEkmGgAaYa3lVC948n5OzyNPpOwfFCMBKo/BJwh0VeZ0wa7gm6L7+Gfk+YutGmkNa7Cuf+F/e8LxlT0MHlyoj+YGzeNEWkm2uUv73f74ND+a15AnBkvGMfm5A8vt/EdN3IOqD8EUCwRpf+lqhrJe9Mwp28kHp4NdO2W97I40BWA7LFXQco7CuhjNafHkpaNMZ1bkbYLjlpqyC6Xs7bCZU9wMIPOHL9cGt2QvfQG5gMWrJmJsyes9qadBk/TKmqPi3iPH2DzUYO2vMETI765RVrL6IVOwxXc663JxfpZVQTiCSXz8oCVYZ7Ka7gcjXSPTMSxwD2cBVG9KDwjntYaXTairO/Kyx0HiPbbXzhENYkqY7oZvJde/l83l5TvPi+M4/a0Pa8COq8voRw+Fkrfw/qhPDn4AZnuanceOLog3xfrXw0Z45rZ34unovKP+3NjTdBUX5YB8OgGd5tXc4Ur6oK8nxt5IhQ1EzJkh1VEUU8pbDaw9EX1xCKZxVk86MEzW7zqFZWRve5Sp34CJdwHcUk8hLs2PweEzyvibLJIACn1mQoM6nC+Wep5iYXjUzQ9qobItzKFpw/mGsceCu8VqNoBtQBws+I47EF2NkzT45szvxF9tvSzmgmRBHtzES11bqePopHvye4310pywFYJ/WeiWOLEn1IEd4rrTJ6zIoqU1QH9qHShT4SoT0uC5wqz+Tgl64OdMIHKwQLcWih7A5lcDMv+jPV1Xvd52g3EYx13epNTPHtHwi4sBlFi1VuDrwXgTAlnpvM6N5Ij0qNNK5NMcWHerbLyOaMzng1pOtRfYA5UKGG4KYQd49vh5Fw9mHsk9/lelT+iyTs4GhA=
|
||||
identity_validation.reset_password.jwt.hmac.key: AgCOsW1JBwnAB7BEIkEwqTLNHX5N/HrqHoxz7axdr3ppES7BnPKGRak846aKHrUVEykAV470SCgdwomTh/KBVAvHtml9L8h+FBu24rDbqZjHnL/BVy+2SkukNoVq6A2vDQRI521HBZntQQljhG0XTFTMMyI7tUhhM/PwmzeyZpKsDPcw6EJAMk9ERxdYtM7iaYEIAAcn0N2NPI7+I/A7nMKYpx4oGr79tobQyM1aDQF2VFwlRq1vqCrkEzBtPUPa9SrfnFE2GrIJlIR3xh/h5SmXCaAjF0uZFjPBPMrHSU4XtZVqtmwIEXpXFqjf+M6N5LTA5rKEviHV5oSJ4sDbMC1GMzwYw8u1Z2gvi/sP87ncbtSbW6ereAXC/5i7/bkOiyBlwVbNV+YcY6RlHG6DzEO/4Fqx9ET6XJhms1TcNb8Cp/VA7NS79IYbtnnZozefHnZAKQa7k/SR8tUVcVET2LhW6/j4QhxhFsASbws/yaZkEKdQnDqCpDlMkXKWxAt/7wlu/URTKlYTtCV5tvhrDj14Hdvs2CtpbXsYuf9FEn6OkRjFFXtr2c8tlOgh63qLoDfgmc+NlfLmkOGEtfEi9KCt9UY4qBAh2bc0PkkKod5JhMoiBUCwc2H8WlXAeUj2v7UmB5fvaP+IbeNKGf6+v8adVW3m7tckFeARG71QHkv049EKVfNyIP+CvBhEFZwTMNtzYGhr280zpEuvKowVXYlLp9pSBA/3vEIFcsnNzQfg2eFzsETOVtHXd7KnPoRKk29fTXmgIKdMThaSgvs72LoGdiYpYPaVrRKgCeqCah697bsOo6q2gv/jAeofRkcoaUx3sMb8nZJ3fnijr5Z5DFq6PM2VyJy8PlgfoIKO/w1nkQ==
|
||||
oidc.jwks.key: AgCuYKmdCv3LcmH8zpNAuS5oeHjf/cEmcAlGjRfv2CtfXmlYhcysDLeo2Cyn9kMUEPyRwxhQ/b9G6ZfkfuIh83v4j8PFBitoyaAmDNLmhn/tEjxUG4ddRZ+X1m+Skqs/QyGSt8w4iCBv2tzVV8v9mbbh0GSEk4Nz/tOi8oyUBF/RF0Pgan7JubQ9E7uT2c2rD+hVeWJx9dL6Vv6z/OdbNEjpDvlMNjpQBqMj7H0dMXSnMIxoQHXn2TduI/2qoc84qfNf8diGaG9DN/lrm4rebPwQZvwkidSKEGCCca8ICwXEN2b2q2TijiaVGJPtpd+R9n3BDa8SHi94ptwxuWwHEQBA5QlkK5TMUT8SGLzUIJK5Z/sX7QQcTxxSX2pySA+3eKveBIiHJeLjiuABkioo9uZMoWsp/piwZBQy5xB7yF2WIGz6cAg1Y098Khw8ZYrnYrJSHG35/Ai9270eiJOvdXDvOdiXEbxUhI6EGwypl1E18AevE3Pe6OcthEfwErbYdEevSNSfUNthC6gFh/PM8qCEi9ZpX1IrbDq/4lyPltKNbhev7OJuci2CF4kc/kMu9Swdih2p4UV/FOHk6z0hfpjxuqXBwdQYcNOZvyZgnGNjb0fqtrKN953A8Skb8+g1XeWzOVxRYGLi/M/oUaWiy2ksLgxlEhKgSzlQ2al0qMBTdr+I+W3bm1HjITocnEFHR54x7+i6V9LydtWXqy08xH1p4LXi56+PtoUQ6901nE8vyofVcuoV1tqqrnVv+L7XHqsM2qGgdvsYlYBttt3zBy/JbOTcUhVe0KIjRGtuAF2MPJWSxcyFc0crfC7dYmKllV3sKO+MowyDjDQ7OQ3MxgPufLKMRJUAB1XsX5BUE5HyQketKHE5hYWzLR+PmQPShq6wc/Er36jPBLkGUsNVJhUdPewbEzZEcqeBdDsncXUwZjcjAlclWpM1VYxT71BLBT0SUL6YyoeesW0RZ+LG/reD9klfYQM5vfhXTDax5crOcp5BIo8T7mJEYIFBvUU0ruAi3Ur7GqgSCCE8AAcILTeqex22KP6JcFUB7nzFsn3PlUv1lJ+TJutmUe3aGXjVMQGD2B3s5cMHCcqMD302gj39gLVsCV4gQo2hb+UeZcfz7X2ltJ0H6ch/CHeLZbBQoCreVVDWBcoMl4tncdbrkdFK0Bo1tCjY+MScsYATswn4/fbEIKALBVO4gS/WI4NcbGl6HXyNnJvbYv+6l48EHcTHtMqER1hur7Wkso3YpC5zHx7RVfnuCTXP9kWPcCCr1VMj4Uth86LB5xi4FIs3X8DvoyOTVgUyu4T9tedldhMurOh8qt/kqxdxjKkREFk80sH2kb61xPypY/779hLXG9PeDHLFyETYgdHiJWSv8UhizVVOBErjKUljWZ2y5zZam8DNKI6QRislPE++pYsqQw2Pe0iyjjcSWMAriCVJW1klkgmOkEoweFjD98CIUWJUcJx/as1YOIc+QqtVRKH/1AA/CuPrPJWfPXzGBfNFXveQB/G9lvJ4MNfVLNdAz5kUv6bGnGaAyR2LFTl/ficNZv8IFBQvHi91CLe0PjMoq32SO/wCJMX9f7yESWgFnCWS/HfuzWJR+f30hbsM/JbE8hXQQ8/VPgzgRkaKPz3XW9j4w6Wb2mBX3GAYtRtGUKfWsOJWIOjKDlqd73HiIM31MUsiDMgo4DdSV9ocEuH+Y8EiAgtK8P1nSUp2Y6wRVZ5dMz471GC/qAtZS2eYEYzbe57sX2i+pjmA790O28fZauEipPs4d8tbUyef+wPD+aJLyYLRX+R19IU5y+Hk7VdFoi/o+5roDyqAESYfOKhY2dRV6MjLvgbb0g4spJBPefFppKxEW46pi/zMniqUmel+czm704i9/Hr8LrZHUwHQqPN+iLqLTvQQo9Uj0xNzeM+fF4BG+QpYPPl8hNlRFcz/H486i7z1qIRjDvCHko5nQx6nMjJgY3DVyCV6w92NvWKsuWtJ5S+LyCe3Mt2z3R+l7JVntf0xPcAaUjruEnPC9jkpiD7GtZJaeqqm9X6NwanPrTD9KRw3czDyN00H51tmqut/St0O9ThpCNDDO06TrtvWIGmbO3zuBLawOnYniISNhpwpCO1jfV5J8zg8iv57LclG1O7LcwqAbLg6fdYNRnViIn3FRmwrIunSjcL+KbQP6sPQRHqiRxUbO0jp8v48wfzrxc1V4hzvrzlMQzIFRwqGKRjRaHzsBVjln1Ec8Bbg3bvVVCr60rVNVQEy40ldTz22nNjecAUp88v5DXqslHgwD1jEA7rDAmjAIpdN0fVOZBHKxalXVzq/cYssuAMg8NgJXCoLvi+mZj+iR8LsV4OtrSd8nJSCADrVrLJwccHjRo0GnPBD3jJFchy77gPN+8OnzRXPVVuuMSOjrxfAfrjwCUkj3KybOH3MMLu5NUFz27DcpLRxBqACQOtSOshkuuJuk1FXIexssFMZvO2StYecv5R880WX0LqZwKNTJRqQOXTGaV1VWNEexSu4iegOtaX0UZQNyDyHygNU9JXsve4u/2Sd6VyTy/i69XouFCY21DE/fonqBGuIen+TqxshpPJGy3HZJ7Y044rFCcWyTjzz8XH5s836CUWmwri+DsGeT/L/E3C+zR17ImU1Na4IA8f11ThR5aaomfTEwbNseFr8L51dJrgQl/QgRJrViHwowLDVClCbhszVKFg7i0ERRjSNNxZ9tUluOyCHSeg4wP1DOERumYwj5oV9I0isAOpG5cCDUDMrrZP831YmeUgJsH5aciRZmho9/p+Q0R+s7v0PA2HKtRNOfIm1VWSL7y185LKvYO6DPfZNDnOFobwg9ANP7H7kdE1GOlsnEQYWTFlc8wtRLfENNCHlBUwrIGJUoNPlSHVG3PXGz4vah6wwJD/QBH+9TKtLvdV1+2T4+cdCIn08MbdlHDKvWLraMtmSOTJKNJxtXOuXfdAuGYIoqyc1Em7nbV/Oo4de/n1zWkrwZPeTx7d9D1Io/ana8+2LlJEjrIltr4IzdnuCtImbANCDA45VFmlq87s+2lYdbKDvDMNUviw//s80G3qTT3VpGFnnyEF6TsJzpTJ7PrpE1A0PMufNbg8kJTMBifBU+XzoBDTqBwPzim4VqwazuScOqzwZDTgLdQhGzeo1bKIJKHrLOEgZm1KCp+tjPPhnhK0zIGUjqB+UL2+3IvHDmVr9ly7buGub+kuyBiXnoIr4B6bwa7cpFgNU9zmTng+hFlTDgfSLBlz+69knYDlEpgE6BsVfTcXFpfVgS/eRHH04OrYB0t7kwUD0Ku+Ljpn6nd/x7/gcDOGaiQH7TpW1qKTF8E5+sfbn7f8j6fGYRT7dDQ0n4ljZ8qAYsPw3k+hY1MBIiNqAfQKpwTc88yB6EmB7Ul1N28tsLTuEGCCHtXvhTaQLTFzTVoKdtn5B8eNJDqOdBc5+g0qPgp1W8cVESH9nc80pcGo382GND/QllOEmmaKEasYEzPeMJAcPM4UxMuXF7SnadQweoCTIPXuQyZW+eKlMW4RlC5DHQ1m4NymrN6GFptQtTiG5v182BR2ibp4NogkEyZhHeMCtGXZV6QgGbnoJ24ii0vY4iO/08YgXOxDLcH83vvdiya/WxO/75rRVH052z0doEC4jLUleLEs398o59LBEolHSyPYOemzHLOkSB7w6acxiuujb9nujMuE2im5httFXKhq0cu6ytxlVKtKbVwB1y5lZigpTAh9FZXki8OBNIEa1FwtrYsoLz4hJP2CyRqUrHCY9WmCDTOUFTq7NrltBL2+wFvbPAtJbrzM0ALJYNaOb7J5N8R8sP3voXaL5DEEFoS57+xSvtx+lIOCNweJqzzZMoxZ2p9JL6qaJxG+EJIGTeHhWMxX9UJTJJACgB2W/cZyCaD43E5XIxSC6czgdOgwii27fFAJKJabmj+FsSwYBMiyHiFE=
|
||||
session.encryption.key: AgB6LuT3btnwlDtP19iS6TAA6hz5t2gtXn93/sKI+ANzRvDtAUEJf934pWS0xhWu8Zfqwe5YuPy6Hb7CYG1Xk76Z3IFAEKcENcAA4Ngl6f80yBPgaL+6pzkeHyouYhpuRFenPoCcoa60OuusnDBUvBO0v6Mtqd39nACDJwdrJH0VzoLiWlMPzNsqJSkX+qNumrFlahqEtpswgoQBFtgljfMh8jCfAiqtwwe4Gx77B3GHNDuRQ7tSKhq5pSPUfDE9i/a1fb5yd1z8mlDkbivb0/yhvBsUi7stV9TE7HpBcsxtd6vSzt+MgXsflFfHZ9HU7oVVS0PuDzeDEXac9r2XDA96eUdhz/9NF3d9BvBMZqsi4YlF9tvsODNR7BofF5axxuRb2sptVwM5HuexXhG6S2PPpjLWi0BnY2P4Y12rXUhtYTisKgk7J1H5kZ1XYdjySFIQpMnWvdQD4TDmvqCi2YbnDts5labuFPQmgdrguRbqb1W94Pwg3SOuhJdsNJkfvXFBOOPf2eJBdGsrv4hOFiWt87pNh5Idzi9DAsV9CHZyLwxchwSpNre3yb1TnrTUE9xuQexY/xviAKAc1XjLsKyapryyAtv1AF6UnZMECDyElyenWblPBlWyOYTAWk8yiYl11C/2cipP6+pv8/XpbHKaQKGVQLIQdixXVGKRZwChTo5b3wliSJD2FXiC7ZkWfjOHlgXa+1DNYEoAlUfIU+IMdTP+x82QIjeYRH5wmhujd0JrYu4AygU1Zg==
|
||||
storage.encryption.key: AgBOR7VfqNstwSBQ3pZIuHUo6m6bcbqTRluZ+G52d2djiyYm2E6FEfzeNrVgPSyw/9CuWXnzzQRyyGVvwP9FwtF6wWqNByhtY4sHd4xoHLEv3L4ZNRvNCf/iCGw0yI46k7nGifvIGw7BNWMkzGVOY+926aa9CAahxh27nQf0dztuFM3DPX4ASKpJ7c3IRGbMi0x0gPTU+Z1/3JLlhn+WvM95UpbPq75LHSzo4A2YfdluZEOpvvo8M5NnPgvHIvRC3tjZuXsDJwRQhqLVa8oFdrjJ7DvMonScKyv4IF/fttd4K0h+g/WZqCRix1dw/7LburKVicYBLl4IQJDIDORKXIUqU1M7i28UVF6DBe/r6jBTGDJcqv9Zor5hoQHuswyC0p+2+sm0EGUvGJLGJ4aqq5UBSsZyD98vMwGT3H3sofIqESHJo4O6rOSo+NFag2P/E1Ij2PFN2+wJTMRJ467CPnzEC85/mm3Tii+NRRb4CKEuxh+zfmVB/Bpny+7zjL7atS3BFR95PbI1jM5yI4uu1uHaVJaXjI3nQKYKjYetS3POOdxae5YRs8CywtZWkv+wUnlbPlzB7XRObQ2yzwNj8tZL8/846TykafDsvPB51B4wAnY8w1LaxNYBTZHQGco/rO7fUNEbuwPyDcbDtUaNxbUD7Yfu1pUY2fay0YtTLDlm1FEZePm9LLKQVj2K703Hu4YA2F/wKhcWKfjtijaC6z8KTaPQiVpjhA==
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: authelia-internal
|
||||
namespace: authelia
|
||||
type: Opaque
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -7,7 +7,7 @@ metadata:
|
||||
namespace: authelia
|
||||
spec:
|
||||
encryptedData:
|
||||
smtp.yml: AgCfZqHvV3N/S7C3BCeBZv5erYNnbc3yuhYswXBxJUmvfWt/oyEi0VM9830cV740zF532ZteMaEC47Yer1dm1zwBb8degsSPOnivTU3HVN1MQKMxB0T9roN7ytXnS48dIVLlZAy5/7AqU/+F081zJeGW/8lsQKJ7QVa3zG7BDGJmaExxttrB5ZsSiVmFldSQap1FNIcPFU1O4N1w59r29IsUNbOVpnb4NqONBBh7Lt/RoUwYVmdMT8OxOAtgovft1z+KuZN2ZnvBlm3EgY70wAWTs/tSmZLWuDGa8yo0M6LPIjO9zlc+l1YuI25AqGHDuhGU+H+gQWZhtIglwKHtU8oUuDchWxQpb4tJSokpyegkWrpty8vBEEGK9CtLk13EmPUHTPicv9XYgwxvROeXB7+6/gQC8Yc/PzjjZwSrNo8SC/rF4VJY9jXMJ2nS7UkubcfdOY/bKhu1jZENrav7Zd/z5hiy2stg2LFJ2rnzIrSKeYWN3ygR24KRGh/7Bpwz6LhCkPdrfJJyymA+Azwq06CoyyPTLkYRMpTdkzx8zLNCvfQfmEKYRxRcXVBDfSr/Wn/9QNmCAG/rp1Ep23xRYegQRTUyGD2JVVSjE0WcMRRnqb70IYfEPk4w5TS14RcO2/59Lvs+1mF8g9JfLhrxOjLDAvnSKjN5KZ3PgLdpqbkcVjUb0Hs18SAilmZhs5cQtNR++LqYePIe1r7R3V9IPIvPudCs7/2BrLLpuREhTdQIiA3catZ6kLZgHuh/KswFEDAcZ1NisSNvZZLAKTHupIe7XjBp+0zGHLZ7hgbA/Ojf4e6M4RLjqR41Uix+stkKuwWwdoXs/YAf2GUl6+4fb/8iPVUwPA7XHf92ALxv5neNEDlo4awXvuBQG8XdmaCqkYXBe1GE+vgmzfQhr1gjcO1VxvpsAJXT9/Ak1whQbs8kLfwxDfGp3CYQxx+eaxxm4Q2xumeQYXHFyhNZ5d5XOpmlx9EovRwM/uGoZdslykZ27ZbKRMYcqwhJ16CS/y5ptMcEbB1RkqodM55UCslR/fo+9aJejX0x8V91U2bm8eFrDFhFJsM6Z6oClxOXeAbSoE8m4KclRWTtF4+CIXq+qszdWzwqrHBWvKAtVwGo3L08Sxw24ajT9Rw1Ay2kvb4xO2SVzIRhHdzIFpF6iSiDqBJsSH7SL0kP1C07j3vl95qZBp01BW8BUnVxFyqOVMvVnXMaNQZdFrsq4MVEsxDftgciF9oE8rVv4Q==
|
||||
smtp.yml: AgAHiNwse+aFYVoun500VoUTUKg22yDSn+cD9pLO4HKG26nqmOxkiTSi5BELpzWouqHXiHNwYLEKPv13ZFJX6AFfFskspBfe+svLvLSzEvtH8kNCSJar0G5jcACEk27xcCxTN0nhmjc6L9lmZF8UUth7l5Mrsl0EG+79pCNYhUtjy16g7HdbmYgmgrY6d7VWCen2R4HZK4A9zPx+8HEsoMzUD0mG+uKKKfmqYaxJ563Gzp7trDcQRXd4tmea9MM8t+bk9TYCDvBj9JbsNuIdzFk8MArlvlesDYqiJj/8wny49NoVyX8vvGVDF3Y5s+OmKA9+MoBIYNc4oT4FLcc14wpnMnk5WgbKtTYfExcGTdTWuTTVWPsF18dvbKTU3C6dnf2kh9T8CydIdu27jwrBbChWffxNbh5nlLlQT3Xvogai8o6qhMn+EqTnw/u93OIxNzPEooVP349VVW/mlhGX3od/IlVzXiIlQIxL5EP2pRCXL2T1KONvkpbClJ/BTuwfjRZTXz3ZaRhaTPdBAZ+bpkRkt+kEAecjqaf9EF+pHy+dOaR4tIrwBWBbrAy47iV4e/Q60B97bRHzgo9N1uaYonGmyzmyVc9TXIkhf7PIlu/cSyDaHKdobVx0AA0p2usi5D1QYMcS9fngXyM1U9imO6QiYopysxQ9gJL8rfuySRJ/YQ6JJ71fLdMxsiQ0r21D7v7LEdJK5SKLovpnmPgk4PBoL9E4ZPE6g5zRXZFj1IxpKkOqRMpyBzBvas9Q1OFFs0Y79kGtyWIXb7Z2HGYmMU1us9Pm95xVF/V34sAtMIEz7qi+SaXQHFvyqbaiJ48U8qHhHL5y+lt9e8PGmQo0tRWfHMejs5BCcFAEZKDiif6zUEsjV/WC9WKO9NUjvRiu0CYCq5z9QzKaZQqWo0LPeM6DMY8pT3w4OqpJ/OLyMfbdoWT/uQ1JW5npApGifL0lhWRIkQHCG7oZA/BkJfbiexV8jwtToS+UX/s9HkbkuQ/O4zDte8qg/Xzh5TOj5AxlAPN6wGCwd6t1RTSITSKVMnTpFabkEvPYnGeiyWU8TrckvaKmhRUNoj2ZWQCCffHKp/bimEHxRqFnW6B+cu35reTjFc2dqp12EhCBR727G0EARx3Gt/LSdPh8OYt+Bs0rLaHiUrCJh4HRBJPmg0PARVwDL7OWx6pwtclnrALmfELKKaopy6yFctDogOtkvxHbL8DNhJqNuQJo6ttzlHhz4bnQcWb2K92HIw==
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
@@ -5,59 +6,45 @@ ingress:
|
||||
pod:
|
||||
kind: 'Deployment'
|
||||
replicas: 1
|
||||
extraVolumes:
|
||||
- name: config-ldap
|
||||
secret:
|
||||
secretName: authelia-ldap
|
||||
- name: config-oidc
|
||||
secret:
|
||||
secretName: authelia-oidc
|
||||
- name: config-smtp
|
||||
secret:
|
||||
secretName: authelia-smtp
|
||||
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: config-ldap
|
||||
mountPath: /extra-config/ldap.yml
|
||||
readOnly: true
|
||||
- name: config-oidc
|
||||
mountPath: /extra-config/oidc.yml
|
||||
readOnly: true
|
||||
- name: config-smtp
|
||||
mountPath: /extra-config/smtp.yml
|
||||
readOnly: true
|
||||
|
||||
|
||||
##
|
||||
## Authelia Config Map Generator
|
||||
##
|
||||
configMap:
|
||||
key: 'configuration.yaml'
|
||||
# include sub-maps wich OVERRIDE the values generated by the helm chart
|
||||
|
||||
# Enable the configMap source for the Authelia config.
|
||||
# If this is false you need to provide a volumeMount via PV/PVC or other means that mounts to /config.
|
||||
disabled: false
|
||||
key: 'configuration.yml'
|
||||
# do not use a pre-existing configMap
|
||||
# BUT, include sub-maps wich OVERRIDE the values generated by the helm chart
|
||||
extraConfigs:
|
||||
- /secrets/authelia-smtp/smtp.yml
|
||||
|
||||
|
||||
# many of the values remain default from the helm chart
|
||||
authentication_backend:
|
||||
ldap:
|
||||
enabled: true
|
||||
implementation: 'custom'
|
||||
address: 'ldap://lldap:3890'
|
||||
base_dn: 'DC=moll,DC=re'
|
||||
additional_users_dn: 'OU=people'
|
||||
users_filter: "(&({username_attribute}={input})(objectClass=person))"
|
||||
additional_groups_dn: 'OU=groups'
|
||||
groups_filter: "(member={dn})"
|
||||
|
||||
## The username of the admin user.
|
||||
user: 'uid=authelia,ou=people,dc=moll,dc=re'
|
||||
password:
|
||||
# ## Disables this secret and leaves configuring it entirely up to you.
|
||||
# disabled: false
|
||||
|
||||
# ## The secret name. The ~ name is special as it is the secret we generate either automatically or via the
|
||||
# ## secret_value option below.
|
||||
# secret_name: ~
|
||||
|
||||
# ## The value of a generated secret when using the ~ secret_name.
|
||||
# value: ''
|
||||
|
||||
# ## The path to the secret. If it has a '/' prefix it's assumed to be an absolute path within the pod. Otherwise
|
||||
# ## it uses the format '{mountPath}/{secret_name}/{path}' where '{mountPath}' refers to the 'secret.mountPath'
|
||||
# ## value, '{secret_name}' is the secret_name above, and '{path}' is this value.
|
||||
path: 'authentication.ldap.password.txt'
|
||||
secret_name: authelia-ldap
|
||||
|
||||
attributes:
|
||||
display_name: displayName
|
||||
username: uid
|
||||
group_name: cn
|
||||
mail: mail
|
||||
file:
|
||||
enabled: false
|
||||
|
||||
|
||||
- /extra-config/ldap.yml
|
||||
- /extra-config/oidc.yml
|
||||
- /extra-config/smtp.yml
|
||||
|
||||
session:
|
||||
inactivity: '2d'
|
||||
expiration: '7d'
|
||||
@@ -65,242 +52,37 @@ configMap:
|
||||
cookies:
|
||||
- name: authelia_session
|
||||
domain: auth.kluster.moll.re
|
||||
encryption_key:
|
||||
secret_name: authelia-internal
|
||||
|
||||
|
||||
storage:
|
||||
encryption_key:
|
||||
secret_name: authelia-internal
|
||||
|
||||
value: 'authelia-encryption-key'
|
||||
local:
|
||||
enabled: true
|
||||
path: /config/db.sqlite3
|
||||
file: /config/db.sqlite3
|
||||
|
||||
|
||||
identity_validation:
|
||||
reset_password:
|
||||
secret:
|
||||
secret_name: authelia-internal
|
||||
path: 'identity_validation.reset_password.jwt.hmac.key'
|
||||
##
|
||||
## Authelia Secret Configuration.
|
||||
##
|
||||
secret:
|
||||
|
||||
disabled: false
|
||||
|
||||
existingSecret: ''
|
||||
|
||||
|
||||
identity_providers:
|
||||
oidc:
|
||||
enabled: true
|
||||
hmac_secret:
|
||||
secret_name: authelia-internal
|
||||
path: 'identity_providers.oidc.hmac.key'
|
||||
|
||||
# lifespans:
|
||||
# access_token: '1 hour'
|
||||
# authorize_code: '1 minute'
|
||||
# id_token: '1 hour'
|
||||
# refresh_token: '1 hour and 30 minutes'
|
||||
|
||||
jwks:
|
||||
- algorithm: 'RS256'
|
||||
key:
|
||||
path: '/secrets/authelia-internal/oidc.jwks.key'
|
||||
|
||||
cors:
|
||||
allowed_origins_from_client_redirect_uris: true
|
||||
|
||||
clients:
|
||||
- client_id: 'grafana'
|
||||
client_name: 'Grafana'
|
||||
client_secret:
|
||||
path: '/secrets/authelia-oidc/client.grafana'
|
||||
public: false
|
||||
authorization_policy: 'one_factor'
|
||||
require_pkce: true
|
||||
pkce_challenge_method: 'S256'
|
||||
redirect_uris:
|
||||
- 'https://grafana.kluster.moll.re/login/generic_oauth'
|
||||
scopes:
|
||||
- 'openid'
|
||||
- 'profile'
|
||||
- 'groups'
|
||||
- 'email'
|
||||
response_types:
|
||||
- 'code'
|
||||
grant_types:
|
||||
- 'authorization_code'
|
||||
access_token_signed_response_alg: 'none'
|
||||
token_endpoint_auth_method: 'client_secret_basic'
|
||||
consent_mode: 'implicit'
|
||||
- client_id: 'recipes'
|
||||
client_name: 'Recipes'
|
||||
client_secret:
|
||||
path: '/secrets/authelia-oidc/client.recipes'
|
||||
public: false
|
||||
authorization_policy: 'one_factor'
|
||||
require_pkce: true
|
||||
pkce_challenge_method: 'S256'
|
||||
redirect_uris:
|
||||
- 'https://recipes.kluster.moll.re/login'
|
||||
scopes:
|
||||
- 'openid'
|
||||
- 'email'
|
||||
- 'profile'
|
||||
- 'groups'
|
||||
userinfo_signed_response_alg: 'none'
|
||||
token_endpoint_auth_method: 'client_secret_basic'
|
||||
consent_mode: 'implicit'
|
||||
- client_id: 'gitea'
|
||||
client_name: 'Gitea'
|
||||
client_secret:
|
||||
path: '/secrets/authelia-oidc/client.gitea'
|
||||
public: false
|
||||
authorization_policy: 'one_factor'
|
||||
redirect_uris:
|
||||
- 'https://git.kluster.moll.re/user/oauth2/authelia/callback'
|
||||
scopes:
|
||||
- 'openid'
|
||||
- 'email'
|
||||
- 'profile'
|
||||
- 'groups'
|
||||
userinfo_signed_response_alg: 'none'
|
||||
token_endpoint_auth_method: 'client_secret_basic'
|
||||
consent_mode: 'implicit'
|
||||
- client_id: 'argocd'
|
||||
client_name: 'Argo CD'
|
||||
client_secret:
|
||||
path: '/secrets/authelia-oidc/client.argocd'
|
||||
public: false
|
||||
authorization_policy: 'one_factor'
|
||||
redirect_uris:
|
||||
- 'https://argocd.kluster.moll.re/auth/callback'
|
||||
scopes:
|
||||
- 'openid'
|
||||
- 'groups'
|
||||
- 'email'
|
||||
- 'profile'
|
||||
userinfo_signed_response_alg: 'none'
|
||||
token_endpoint_auth_method: 'client_secret_post'
|
||||
consent_mode: 'implicit'
|
||||
- client_id: 'paperless'
|
||||
client_name: 'Paperless'
|
||||
client_secret:
|
||||
path: '/secrets/authelia-oidc/client.paperless'
|
||||
public: false
|
||||
authorization_policy: 'one_factor'
|
||||
redirect_uris:
|
||||
- 'https://paperless.kluster.moll.re/accounts/oidc/authelia/login/callback/'
|
||||
scopes:
|
||||
- 'openid'
|
||||
- 'profile'
|
||||
- 'email'
|
||||
- 'groups'
|
||||
userinfo_signed_response_alg: 'none'
|
||||
token_endpoint_auth_method: 'client_secret_basic'
|
||||
consent_mode: 'implicit'
|
||||
- client_id: 'linkding'
|
||||
client_name: 'LinkDing'
|
||||
client_secret:
|
||||
path: '/secrets/authelia-oidc/client.linkding'
|
||||
public: false
|
||||
authorization_policy: 'one_factor'
|
||||
redirect_uris:
|
||||
- 'https://linkding.kluster.moll.re/oidc/callback/'
|
||||
scopes:
|
||||
- 'openid'
|
||||
- 'groups'
|
||||
- 'email'
|
||||
- 'profile'
|
||||
userinfo_signed_response_alg: 'none'
|
||||
token_endpoint_auth_method: 'client_secret_post'
|
||||
consent_mode: 'implicit'
|
||||
- client_id: 'todos'
|
||||
client_name: 'Todos'
|
||||
client_secret:
|
||||
path: '/secrets/authelia-oidc/client.todos'
|
||||
public: false
|
||||
authorization_policy: 'one_factor'
|
||||
redirect_uris:
|
||||
- 'https://todos.kluster.moll.re/auth/openid/authelia'
|
||||
scopes:
|
||||
- 'openid'
|
||||
- 'groups'
|
||||
- 'email'
|
||||
- 'profile'
|
||||
userinfo_signed_response_alg: 'none'
|
||||
token_endpoint_auth_method: 'client_secret_basic'
|
||||
consent_mode: 'implicit'
|
||||
- client_id: 'kitchenowl'
|
||||
client_name: 'KitchenOwl'
|
||||
client_secret:
|
||||
path: '/secrets/authelia-oidc/client.kitchenowl'
|
||||
public: false
|
||||
token_endpoint_auth_method: 'client_secret_post'
|
||||
authorization_policy: 'one_factor'
|
||||
redirect_uris:
|
||||
- 'https://kitchen.kluster.moll.re/signin/redirect'
|
||||
- kitchenowl:/signin/redirect
|
||||
# mobile app as well
|
||||
scopes:
|
||||
- openid
|
||||
- email
|
||||
- profile
|
||||
- client_id: 'actualbudget'
|
||||
client_name: 'Actual Budget'
|
||||
client_secret:
|
||||
path: '/secrets/authelia-oidc/client.actualbudget'
|
||||
public: false
|
||||
authorization_policy: 'one_factor'
|
||||
require_pkce: false
|
||||
pkce_challenge_method: ''
|
||||
redirect_uris:
|
||||
- 'https://actualbudget.kluster.moll.re/openid/callback'
|
||||
scopes:
|
||||
- 'openid'
|
||||
- 'profile'
|
||||
- 'groups'
|
||||
- 'email'
|
||||
response_types:
|
||||
- 'code'
|
||||
grant_types:
|
||||
- 'authorization_code'
|
||||
access_token_signed_response_alg: 'none'
|
||||
userinfo_signed_response_alg: 'none'
|
||||
token_endpoint_auth_method: 'client_secret_basic'
|
||||
- client_id: 'vaultwarden'
|
||||
client_name: 'VaultWarden'
|
||||
client_secret:
|
||||
path: '/secrets/authelia-oidc/client.vaultwarden'
|
||||
public: false
|
||||
authorization_policy: 'one_factor'
|
||||
require_pkce: false
|
||||
pkce_challenge_method: ''
|
||||
redirect_uris:
|
||||
- 'https://passwords.kluster.moll.re/identity/connect/oidc-signin'
|
||||
scopes:
|
||||
- 'openid'
|
||||
- 'profile'
|
||||
- 'groups'
|
||||
- 'email'
|
||||
response_types:
|
||||
- 'code'
|
||||
grant_types:
|
||||
- 'authorization_code'
|
||||
access_token_signed_response_alg: 'none'
|
||||
userinfo_signed_response_alg: 'none'
|
||||
token_endpoint_auth_method: 'client_secret_basic'
|
||||
|
||||
# notifier
|
||||
# is set through a secret
|
||||
|
||||
certificates:
|
||||
# don't use the pre-existing secret
|
||||
existingSecret: ''
|
||||
|
||||
##
|
||||
## Authelia Persistence Configuration.
|
||||
##
|
||||
## Useful in scenarios where you need persistent storage.
|
||||
## Auth Provider Use Case: file; we recommend you use the ldap provider instead.
|
||||
## Storage Provider Use Case: local; we recommend you use the mysql/mariadb or postgres provider instead.
|
||||
## Configuration Use Case: when you want to manually configure the configuration entirely (set configMap.enabled = false).
|
||||
##
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: 'nfs-client'
|
||||
|
||||
|
||||
secret:
|
||||
mountPath: '/secrets'
|
||||
additionalSecrets:
|
||||
# the oidc client secrets referenced in the oidc config
|
||||
authelia-oidc: {}
|
||||
authelia-internal: {}
|
||||
authelia-ldap: {}
|
||||
authelia-smtp: {}
|
||||
|
||||
@@ -14,7 +14,6 @@ resources:
|
||||
- authelia-ldap.sealedsecret.yaml
|
||||
- authelia-oidc.sealedsecret.yaml
|
||||
- authelia-smtp.sealedsecret.yaml
|
||||
- authelia-internal.sealedsecret.yaml
|
||||
- ingress.yaml
|
||||
|
||||
|
||||
@@ -27,6 +26,6 @@ images:
|
||||
helmCharts:
|
||||
- name: authelia
|
||||
releaseName: authelia
|
||||
version: 0.10.47
|
||||
version: 0.9.9
|
||||
repo: https://charts.authelia.com
|
||||
valuesFile: authelia.values.yaml
|
||||
|
||||
0
infrastructure/authelia/lldap.ingress.yaml
Normal file
0
infrastructure/authelia/lldap.ingress.yaml
Normal file
@@ -9,15 +9,55 @@ spec:
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 0
|
||||
|
||||
template:
|
||||
spec:
|
||||
initContainers:
|
||||
- name: git
|
||||
image: git
|
||||
command: ["git"]
|
||||
args:
|
||||
- clone
|
||||
- https://git.kluster.moll.re/remoll/dns.git
|
||||
- /etc/octodns
|
||||
volumeMounts:
|
||||
- name: octodns-config
|
||||
mountPath: /etc/octodns
|
||||
containers:
|
||||
- name: dns
|
||||
image: dns
|
||||
- name: octodns
|
||||
image: octodns
|
||||
env:
|
||||
# - name: CLOUDFLARE_ACCOUNT_ID
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: cloudflare-api
|
||||
# key: CLOUDFLARE_ACCOUNT_ID
|
||||
- name: CLOUDFLARE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: cloudflare-api
|
||||
key: CLOUDFLARE_TOKEN
|
||||
# - name: CLOUDFLARE_EMAIL
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: cloudflare-api
|
||||
# key: CLOUDFLARE_EMAIL
|
||||
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- >-
|
||||
cd /etc/octodns
|
||||
&&
|
||||
pip install -r ./requirements.txt
|
||||
&&
|
||||
octodns-sync --config-file ./config.yaml --doit
|
||||
&&
|
||||
echo "done..."
|
||||
volumeMounts:
|
||||
- name: octodns-config
|
||||
mountPath: /etc/octodns
|
||||
|
||||
volumes:
|
||||
- name: octodns-config
|
||||
emptyDir: {}
|
||||
restartPolicy: Never
|
||||
|
||||
@@ -9,6 +9,10 @@ resources:
|
||||
- cronjob.yaml
|
||||
|
||||
images:
|
||||
- name: dns
|
||||
newName: git.kluster.moll.re/remoll/dns
|
||||
newTag: 0.0.2-build.100
|
||||
- name: octodns
|
||||
newName: octodns/octodns # has all plugins
|
||||
newTag: "2024.09"
|
||||
|
||||
- name: git
|
||||
newName: alpine/git
|
||||
newTag: "v2.45.2"
|
||||
@@ -1,15 +0,0 @@
|
||||
{
|
||||
"hostRules": [
|
||||
{
|
||||
"hostType": "docker",
|
||||
"matchHost": "git.kluster.moll.re"
|
||||
}
|
||||
],
|
||||
"packageRules": [
|
||||
{
|
||||
"matchDatasources": ["docker"],
|
||||
"matchPackageNames": ["git.kluster.moll.re/remoll/dns"],
|
||||
"versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-build.(?<build>\\d+)$"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,6 +1,3 @@
|
||||
strategy:
|
||||
type: Recreate
|
||||
|
||||
|
||||
## @section Service
|
||||
service:
|
||||
@@ -59,8 +56,7 @@ ingress:
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 5Gi
|
||||
# high memory should be allowed to handle package uploads
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
@@ -100,7 +96,6 @@ gitea:
|
||||
email: "gitea@delete.me"
|
||||
|
||||
metrics:
|
||||
# service monitor is configured manually
|
||||
enabled: true
|
||||
|
||||
## @param gitea.config Configuration for the Gitea server,ref: [config-cheat-sheet](https://docs.gitea.io/en-us/config-cheat-sheet/)
|
||||
@@ -121,10 +116,6 @@ gitea:
|
||||
indexer:
|
||||
ISSUE_INDEXER_TYPE: bleve
|
||||
REPO_INDEXER_ENABLED: false
|
||||
service:
|
||||
DISABLE_REGISTRATION: true
|
||||
oauth2_client:
|
||||
ENABLE_AUTO_REGISTRATION: true
|
||||
|
||||
oauth:
|
||||
- name: authelia
|
||||
@@ -136,7 +127,6 @@ gitea:
|
||||
required-claim-value: gitea
|
||||
group-claim-name: groups
|
||||
admin-group: apps_admin
|
||||
|
||||
|
||||
|
||||
# since we want to reuse the postgres secret, we cannot directly use it in
|
||||
@@ -170,7 +160,5 @@ postgresql:
|
||||
enabled: false
|
||||
postgresql-ha:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: false
|
||||
valkey-cluster:
|
||||
redis-cluster:
|
||||
enabled: false
|
||||
|
||||
@@ -23,6 +23,6 @@ helmCharts:
|
||||
- name: gitea
|
||||
namespace: gitea # needs to be set explicitly for svc to be referenced correctly
|
||||
releaseName: gitea
|
||||
version: 12.4.0
|
||||
version: 10.6.0
|
||||
valuesFile: gitea.values.yaml
|
||||
repo: https://dl.gitea.io/charts/
|
||||
|
||||
@@ -2,6 +2,7 @@ apiVersion: metallb.io/v1beta1
|
||||
kind: IPAddressPool
|
||||
metadata:
|
||||
name: default
|
||||
namespace: metallb-system
|
||||
spec:
|
||||
addresses:
|
||||
- 192.168.3.0/24
|
||||
@@ -9,8 +10,5 @@ spec:
|
||||
apiVersion: metallb.io/v1beta1
|
||||
kind: L2Advertisement
|
||||
metadata:
|
||||
name: default
|
||||
# selector is left empty on purpose to match all IPAddressPools
|
||||
# spec:
|
||||
# ipAddressPools:
|
||||
# - default
|
||||
name: empty
|
||||
namespace: metallb-system
|
||||
@@ -1,12 +1,15 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- ipaddresspool.yaml
|
||||
|
||||
namespace: metallb-system
|
||||
|
||||
resources:
|
||||
# - namespace.yaml
|
||||
# namespace is already included in the remote kustomization
|
||||
# - github.com/metallb/metallb/config/native?ref=v0.15.2
|
||||
- github.com/metallb/metallb/config/frr?ref=v0.15.2
|
||||
- ipaddresspool.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: metallb
|
||||
repo: https://metallb.github.io/metallb
|
||||
version: 0.14.8
|
||||
releaseName: metallb
|
||||
valuesFile: values.yaml
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: metallb-system
|
||||
# labels:
|
||||
# pod-security.kubernetes.io/enforce: privileged
|
||||
name: placeholder
|
||||
labels:
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user