From 5d9969289c50d0e010425e761005b69c5c7adb8c Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 10 Dec 2025 07:03:24 +0000 Subject: [PATCH 01/86] Update Helm release cert-manager to v1.19.2 --- dev/cert-manager/Chart.yaml | 2 +- dmz/cert-manager/Chart.yaml | 2 +- infra/cert-manager/Chart.yaml | 2 +- master/cert-manager/Chart.yaml | 2 +- prd/cert-manager/Chart.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dev/cert-manager/Chart.yaml b/dev/cert-manager/Chart.yaml index 7280af8..53f269d 100644 --- a/dev/cert-manager/Chart.yaml +++ b/dev/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: v1.17.2 + version: v1.19.2 diff --git a/dmz/cert-manager/Chart.yaml b/dmz/cert-manager/Chart.yaml index 7280af8..53f269d 100644 --- a/dmz/cert-manager/Chart.yaml +++ b/dmz/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: v1.17.2 + version: v1.19.2 diff --git a/infra/cert-manager/Chart.yaml b/infra/cert-manager/Chart.yaml index 7280af8..53f269d 100644 --- a/infra/cert-manager/Chart.yaml +++ b/infra/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: v1.17.2 + version: v1.19.2 diff --git a/master/cert-manager/Chart.yaml b/master/cert-manager/Chart.yaml index 7280af8..53f269d 100644 --- a/master/cert-manager/Chart.yaml +++ b/master/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: v1.17.2 + version: v1.19.2 diff --git a/prd/cert-manager/Chart.yaml b/prd/cert-manager/Chart.yaml index 7280af8..53f269d 100644 --- a/prd/cert-manager/Chart.yaml +++ b/prd/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: v1.17.2 + version: v1.19.2 From 935f9cd9e20e90974d65f5aee7043117eca7c8b9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 13 Dec 2025 15:11:02 -0600 Subject: [PATCH 02/86] update --- infra/argocd/templates/argocd-crossplane.yaml | 101 ------------------ infra/argocd/templates/crowdsec.yaml | 20 ---- 2 files changed, 121 deletions(-) delete mode 100644 infra/argocd/templates/argocd-crossplane.yaml delete mode 100644 infra/argocd/templates/crowdsec.yaml diff --git a/infra/argocd/templates/argocd-crossplane.yaml b/infra/argocd/templates/argocd-crossplane.yaml deleted file mode 100644 index 54ac407..0000000 --- a/infra/argocd/templates/argocd-crossplane.yaml +++ /dev/null @@ -1,101 +0,0 @@ -#apiVersion: external-secrets.io/v1 -#kind: ExternalSecret -#metadata: -# name: argocd-secret-crossplane -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: argocd-secret-crossplane -# data: -# - secretKey: authToken -# remoteRef: -# key: kv/argocd/provider-argocd -# property: token -# -#--- -#apiVersion: external-secrets.io/v1 -#kind: ExternalSecret -#metadata: -# name: prod-kubeconfig -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: prod-kubeconfig -# data: -# - secretKey: kubeconfig -# remoteRef: -# key: kv/argocd/prd -# property: kubeconfig -# -#--- -#apiVersion: argocd.crossplane.io/v1alpha1 -#kind: ProviderConfig -#metadata: -# name: argocd-provider -#spec: -# serverAddr: argocd-server.argocd.svc:443 -# insecure: true -# plainText: false -# credentials: -# source: Secret -# secretRef: -# namespace: argocd -# name: argocd-secret-crossplane -# key: authToken -# -#--- -#apiVersion: cluster.argocd.crossplane.io/v1alpha1 -#kind: Cluster -#metadata: -# name: prd -# labels: -# purpose: prd -#spec: -# forProvider: -# name: prd -# config: -# kubeconfigSecretRef: -# name: prod-kubeconfig -# namespace: argocd -# key: kubeconfig -# providerConfigRef: -# name: argocd-provider -# -#--- -#apiVersion: external-secrets.io/v1 -#kind: ExternalSecret -#metadata: -# name: dev-kubeconfig -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: dev-kubeconfig -# data: -# - secretKey: kubeconfig -# remoteRef: -# key: kv/argocd/dev -# property: kubeconfig -# -#--- -#apiVersion: cluster.argocd.crossplane.io/v1alpha1 -#kind: Cluster -#metadata: -# name: dev -# labels: -# purpose: dev -#spec: -# forProvider: -# name: dev -# config: -# kubeconfigSecretRef: -# name: dev-kubeconfig -# namespace: argocd -# key: kubeconfig -# providerConfigRef: -# name: argocd-provider diff --git a/infra/argocd/templates/crowdsec.yaml b/infra/argocd/templates/crowdsec.yaml deleted file mode 100644 index 69e07a8..0000000 --- a/infra/argocd/templates/crowdsec.yaml +++ /dev/null @@ -1,20 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: crowdsec -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: dmz/crowdsec -# destination: -# namespace: crowdsec -# name: dmz -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true From d6cf85135c79999e7352272a972a44ba6a10a768 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 14 Dec 2025 07:02:44 -0600 Subject: [PATCH 03/86] update --- infra/argocd/templates/octopusdeploy.yaml | 43 ------- infra/argocd/templates/portainer.yaml | 20 ++++ infra/octopus-agent/Chart.yaml | 12 -- infra/octopus-agent/templates/secret.yaml | 23 ---- infra/octopus-agent/values.yaml | 19 ---- infra/octopusdeploy/templates/ingress.yaml | 32 ------ infra/octopusdeploy/templates/secrets.yaml | 106 ------------------ infra/octopusdeploy/values.yaml | 10 -- infra/{octopusdeploy => portainer}/Chart.yaml | 8 +- infra/portainer/values.yaml | 78 +++++++++++++ 10 files changed, 102 insertions(+), 249 deletions(-) delete mode 100644 infra/argocd/templates/octopusdeploy.yaml create mode 100644 infra/argocd/templates/portainer.yaml delete mode 100644 infra/octopus-agent/Chart.yaml delete mode 100644 infra/octopus-agent/templates/secret.yaml delete mode 100644 infra/octopus-agent/values.yaml delete mode 100644 infra/octopusdeploy/templates/ingress.yaml delete mode 100644 infra/octopusdeploy/templates/secrets.yaml delete mode 100644 infra/octopusdeploy/values.yaml rename infra/{octopusdeploy => portainer}/Chart.yaml (52%) create mode 100644 infra/portainer/values.yaml diff --git a/infra/argocd/templates/octopusdeploy.yaml b/infra/argocd/templates/octopusdeploy.yaml deleted file mode 100644 index d58d1fd..0000000 --- a/infra/argocd/templates/octopusdeploy.yaml +++ /dev/null @@ -1,43 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: octopusdeploy -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: infra/octopusdeploy -# destination: -# namespace: octopusdeploy -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# -#--- -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: octopusdeploy-agent -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: infra/octopus-agent -# destination: -# namespace: octopus-agent -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# \ No newline at end of file diff --git a/infra/argocd/templates/portainer.yaml b/infra/argocd/templates/portainer.yaml new file mode 100644 index 0000000..d8b5d32 --- /dev/null +++ b/infra/argocd/templates/portainer.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: portainer + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/portainer + destination: + namespace: portainer + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/infra/octopus-agent/Chart.yaml b/infra/octopus-agent/Chart.yaml deleted file mode 100644 index f36dd2d..0000000 --- a/infra/octopus-agent/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: octopusdeploy -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: - - name: kubernetes-agent - repository: oci://registry-1.docker.io/octopusdeploy - version: 2.*.* diff --git a/infra/octopus-agent/templates/secret.yaml b/infra/octopus-agent/templates/secret.yaml deleted file mode 100644 index 50a87d8..0000000 --- a/infra/octopus-agent/templates/secret.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: vault - ---- - -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: agent-token -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: agent-token - data: - - secretKey: bearer-token - remoteRef: - key: kv/octopusdeploy - property: infra-bearer-token - diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml deleted file mode 100644 index 8f262a5..0000000 --- a/infra/octopus-agent/values.yaml +++ /dev/null @@ -1,19 +0,0 @@ -kubernetes-agent: - agent: - bearerTokenSecretName: agent-token - acceptEula: "Y" - serverUrl: "https://octopus.durp.info/" - serverCommsAddresses: - - "https://octopus-deploy-node0.octopusdeploy.svc.cluster.local:10943/" - - "https://octopus-deploy-node1.octopusdeploy.svc.cluster.local:10943/" - - "https://octopus-deploy-node2.octopusdeploy.svc.cluster.local:10943/" - space: "Default" - name: "infra" - deploymentTarget: - initial: - environments: - - "development" - - "production" - tags: - - "infra-cluster" - enabled: "true" diff --git a/infra/octopusdeploy/templates/ingress.yaml b/infra/octopusdeploy/templates/ingress.yaml deleted file mode 100644 index e399ae8..0000000 --- a/infra/octopusdeploy/templates/ingress.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: octopus-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`octopus.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: octopusdeploy-octopus-deploy - port: 80 - tls: - secretName: octopus-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: octopus-tls -spec: - secretName: octopus-tls - issuerRef: - name: vault-issuer - kind: ClusterIssuer - commonName: "octopus.durp.info" - dnsNames: - - "octopus.durp.info" diff --git a/infra/octopusdeploy/templates/secrets.yaml b/infra/octopusdeploy/templates/secrets.yaml deleted file mode 100644 index 7f9ec8b..0000000 --- a/infra/octopusdeploy/templates/secrets.yaml +++ /dev/null @@ -1,106 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: vault - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-adminpassword -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-adminpassword - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: adminpassword - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-adminusername -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-adminusername - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: adminusername - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-connectionstring -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-connectionstring - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: connectionstring - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-masterkey -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-masterkey - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: masterkey - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-sapassword -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-sapassword - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: sapassword - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-licensekey -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-licensekey - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: licensekey diff --git a/infra/octopusdeploy/values.yaml b/infra/octopusdeploy/values.yaml deleted file mode 100644 index 70db7fa..0000000 --- a/infra/octopusdeploy/values.yaml +++ /dev/null @@ -1,10 +0,0 @@ -octopusdeploy-helm: - octopus: - image: - repository: registry.durp.info/octopusdeploy/octopusdeploy - tag: 2025.3 - createSecrets: false - acceptEula: Y - replicaCount: 3 - mssql: - enabled: true \ No newline at end of file diff --git a/infra/octopusdeploy/Chart.yaml b/infra/portainer/Chart.yaml similarity index 52% rename from infra/octopusdeploy/Chart.yaml rename to infra/portainer/Chart.yaml index e1aba0c..1813d7a 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/portainer/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -name: octopusdeploy +name: portainer description: A Helm chart for Kubernetes type: application @@ -7,6 +7,6 @@ version: 0.1.0 appVersion: "1.16.0" dependencies: - - name: octopusdeploy-helm - repository: oci://ghcr.io/octopusdeploy - version: 1.7.0 + - name: portainer + repository: https://portainer.github.io/k8s/ + version: 2.33.5 diff --git a/infra/portainer/values.yaml b/infra/portainer/values.yaml new file mode 100644 index 0000000..a63ba2e --- /dev/null +++ b/infra/portainer/values.yaml @@ -0,0 +1,78 @@ +portainer: + replicaCount: 1 + image: + repository: registry.durp.info/portainer/portainer-ce + tag: 2.33.5 + pullPolicy: Always + + imagePullSecrets: [] + + nodeSelector: {} + tolerations: [] + + serviceAccount: + annotations: {} + name: portainer-sa-clusteradmin + + # This flag provides the ability to enable or disable RBAC-related resources during the deployment of the Portainer application + # If you are using Portainer to manage the K8s cluster it is deployed to, this flag must be set to true + localMgmt: true + + service: + # Set the httpNodePort and edgeNodePort only if the type is NodePort + # For Ingress, set the type to be ClusterIP and set ingress.enabled to true + # For Cloud Providers, set the type to be LoadBalancer + type: NodePort + httpPort: 9000 + httpsPort: 9443 + httpNodePort: 30777 + httpsNodePort: 30779 + edgePort: 8000 + edgeNodePort: 30776 + annotations: {} + + tls: + # If set, Portainer will be configured to use TLS only + force: false + # If set, will mount the existing secret into the pod + existingSecret: "" + + trusted_origins: + # If set, Portainer will be configured to trust the domains specified in domains + enabled: false + # specify (in a comma-separated list) the domain(s) used to access Portainer when it is behind a reverse proxy + # example: portainer.mydomain.com,portainer.example.com + domains: "" + + mtls: + # If set, Portainer will be configured to use mTLS only + enable: false + # If set, will mount the existing secret into the pod + existingSecret: "" + + feature: + flags: [] + + ingress: + enabled: false + ingressClassName: "" + annotations: {} + # kubernetes.io/ingress.class: nginx + # Only use below if tls.force=true + # nginx.ingress.kubernetes.io/backend-protocol: HTTPS + # Note: Hosts and paths are of type array + hosts: + - host: + paths: [] + # - path: "/" + tls: [] + + resources: {} + + persistence: + enabled: true + size: "10Gi" + annotations: {} + storageClass: longhorn + existingClaim: + From 2d1497141d65ef26383ccd9eecd0e9db9e642980 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 14 Dec 2025 07:33:12 -0600 Subject: [PATCH 04/86] update --- dmz/internalproxy/templates/octopus.yaml | 41 ---------------------- dmz/internalproxy/templates/portainer.yaml | 36 ++----------------- infra/portainer/templates/ingress.yaml | 30 ++++++++++++++++ 3 files changed, 33 insertions(+), 74 deletions(-) delete mode 100644 dmz/internalproxy/templates/octopus.yaml create mode 100644 infra/portainer/templates/ingress.yaml diff --git a/dmz/internalproxy/templates/octopus.yaml b/dmz/internalproxy/templates/octopus.yaml deleted file mode 100644 index 084200c..0000000 --- a/dmz/internalproxy/templates/octopus.yaml +++ /dev/null @@ -1,41 +0,0 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: octopus-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`octopus.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: infra-cluster -# port: 443 -# tls: -# secretName: octopus-tls -# -#--- -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: octopus-tls -#spec: -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# secretName: octopus-tls -# commonName: "octopus.durp.info" -# dnsNames: -# - "octopus.durp.info" -# -#--- -#kind: Service -#apiVersion: v1 -#metadata: -# name: octopus-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: octopus.durp.info -#spec: -# type: ExternalName -# externalName: durp.info -# \ No newline at end of file diff --git a/dmz/internalproxy/templates/portainer.yaml b/dmz/internalproxy/templates/portainer.yaml index c27e0ff..554e052 100644 --- a/dmz/internalproxy/templates/portainer.yaml +++ b/dmz/internalproxy/templates/portainer.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: portainer -spec: - ports: - - name: app - port: 9443 - protocol: TCP - targetPort: 9443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: portainer -subsets: -- addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 9443 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -41,9 +12,8 @@ spec: # namespace: traefik kind: Rule services: - - name: portainer - port: 9443 - scheme: https + - name: infra-cluster + port: 443 tls: secretName: portainer-tls @@ -60,4 +30,4 @@ spec: kind: ClusterIssuer commonName: "portainer.internal.durp.info" dnsNames: - - "portainer.internal.durp.info" + - "portainer.internal.durp.info" diff --git a/infra/portainer/templates/ingress.yaml b/infra/portainer/templates/ingress.yaml new file mode 100644 index 0000000..ed213cb --- /dev/null +++ b/infra/portainer/templates/ingress.yaml @@ -0,0 +1,30 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: portainer-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`portainer.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: portainer + port: 9443 + tls: + secretName: portainer-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: portainer-tls +spec: + secretName: portainer-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "portainer.internal.durp.info" + dnsNames: + - "portainer.internal.durp.info" From b987abbe424092a35f77d36a0540add91346bd8c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 14 Dec 2025 07:35:44 -0600 Subject: [PATCH 05/86] update --- infra/portainer/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/portainer/templates/ingress.yaml b/infra/portainer/templates/ingress.yaml index ed213cb..9d6f0fb 100644 --- a/infra/portainer/templates/ingress.yaml +++ b/infra/portainer/templates/ingress.yaml @@ -10,7 +10,7 @@ spec: kind: Rule services: - name: portainer - port: 9443 + port: 9000 tls: secretName: portainer-tls From 0e5337d76219647d67993df7f1d36c2f7afc9faf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 14 Dec 2025 07:43:12 -0600 Subject: [PATCH 06/86] update --- infra/portainer/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/portainer/templates/ingress.yaml b/infra/portainer/templates/ingress.yaml index 9d6f0fb..c1e0e38 100644 --- a/infra/portainer/templates/ingress.yaml +++ b/infra/portainer/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`portainer.durp.info`) && PathPrefix(`/`) + - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: portainer From cb37d0211e4d32b78676bcdbd98b6829456ca5fc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Dec 2025 12:33:58 -0600 Subject: [PATCH 07/86] update --- dmz/redlib/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/redlib/templates/deployment.yaml b/dmz/redlib/templates/deployment.yaml index 0e20610..3ab54c5 100644 --- a/dmz/redlib/templates/deployment.yaml +++ b/dmz/redlib/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: redlib - image: registry.durp.info/redlib/redlib:latest + image: registry.durp.info/redlib/redlib:sha-ba98178 imagePullPolicy: Always livenessProbe: httpGet: From fa6036b05a10c6eda9d4b29c6621637044ec7477 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Dec 2025 12:40:56 -0600 Subject: [PATCH 08/86] update --- dmz/redlib/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/redlib/templates/deployment.yaml b/dmz/redlib/templates/deployment.yaml index 3ab54c5..8cfe8b1 100644 --- a/dmz/redlib/templates/deployment.yaml +++ b/dmz/redlib/templates/deployment.yaml @@ -9,7 +9,7 @@ spec: selector: matchLabels: app: redlib - replicas: 3 + replicas: 1 template: metadata: labels: From 2036374917c2ba567b07f08610c2fba7376159a3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Dec 2025 12:41:47 -0600 Subject: [PATCH 09/86] update --- dmz/redlib/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/redlib/templates/deployment.yaml b/dmz/redlib/templates/deployment.yaml index 8cfe8b1..c09a144 100644 --- a/dmz/redlib/templates/deployment.yaml +++ b/dmz/redlib/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: redlib - image: registry.durp.info/redlib/redlib:sha-ba98178 + image: registry.durp.info/redlib/redlib:latest imagePullPolicy: Always livenessProbe: httpGet: From e401910bee154c9fb40aca7b686244d0db7636ab Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 10:44:59 -0600 Subject: [PATCH 10/86] update --- dmz/internalproxy/templates/gitlab.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 2dd208e..8a7fa96 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 9080 + port: 9443 protocol: TCP - targetPort: 9080 + targetPort: 9443 clusterIP: None type: ClusterIP @@ -21,7 +21,7 @@ subsets: - ip: 192.168.21.200 ports: - name: app - port: 9080 + port: 9443 protocol: TCP --- @@ -37,8 +37,8 @@ spec: kind: Rule services: - name: gitlab - port: 9080 - scheme: http + port: 9443 + scheme: https tls: secretName: gitlab-tls From 63fe8a5a33596926bc5fc12c38bb7ceba1738b39 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 10:50:13 -0600 Subject: [PATCH 11/86] update --- dmz/internalproxy/templates/gitlab.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 8a7fa96..b825dd0 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -18,7 +18,7 @@ metadata: name: gitlab subsets: - addresses: - - ip: 192.168.21.200 + - ip: 192.168.20.200 ports: - name: app port: 9443 From e2348f012baccd94e064b3122dd40bb39d4806bf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 10:53:24 -0600 Subject: [PATCH 12/86] update --- dmz/internalproxy/templates/gitlab.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index b825dd0..8a7fa96 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -18,7 +18,7 @@ metadata: name: gitlab subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 9443 From e427f19c298f73869bb355856fce8fe9ed5e7ac0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 11:21:37 -0600 Subject: [PATCH 13/86] update --- dmz/traefik/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index aa0efe0..74e76eb 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -23,6 +23,11 @@ traefik: dashboard: enabled: true + ports: + gitlab-ssh: + port: 9022 + expose: true + additionalArguments: # - "--providers.file.filename=/config/config.yml" - "--serversTransport.insecureSkipVerify=true" From f90b4121498010ed1fe5c3fad92ffa18a1a3c44c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 11:26:44 -0600 Subject: [PATCH 14/86] update --- dmz/traefik/values.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 74e76eb..c762b94 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -26,7 +26,9 @@ traefik: ports: gitlab-ssh: port: 9022 - expose: true + expose: + default: true + exposedPort: 9022 additionalArguments: # - "--providers.file.filename=/config/config.yml" From c67044655137e5cd91e13a48ffcc20ef84bd2dcd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 11:30:20 -0600 Subject: [PATCH 15/86] update --- dmz/internalproxy/templates/gitlab.yaml | 44 +++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 8a7fa96..fbebfec 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -1,5 +1,49 @@ apiVersion: v1 kind: Service +metadata: + name: gitlab-ssh +spec: + ports: + - name: app + port: 9022 + protocol: TCP + targetPort: 9022 + clusterIP: None + type: ClusterIP + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: gitlab-ssh +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 9022 + protocol: TCP + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: gitlab-ssh-ingress +spec: + entryPoints: + - gitlab-ssh + routes: + - match: HostSNI(`*`) + kind: Rule + services: + - name: gitlab-ssh + port: 9022 + tls: + secretName: gitlab-tls + +--- +apiVersion: v1 +kind: Service metadata: name: gitlab spec: From f021aae87ecb6c07a5e33f14d393912575f8be35 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 11:52:01 -0600 Subject: [PATCH 16/86] update --- dmz/internalproxy/templates/gitlab.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index fbebfec..2888cea 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -36,7 +36,7 @@ spec: - match: HostSNI(`*`) kind: Rule services: - - name: gitlab-ssh + - name: app port: 9022 tls: secretName: gitlab-tls From 443c5b30bdf941341041610c6ce3344701230340 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 12:00:30 -0600 Subject: [PATCH 17/86] update --- dmz/internalproxy/templates/gitlab.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 2888cea..cd7c92d 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -28,13 +28,12 @@ subsets: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: gitlab-ssh-ingress + name: gitlab-ssh spec: entryPoints: - gitlab-ssh routes: - match: HostSNI(`*`) - kind: Rule services: - name: app port: 9022 From 6b027f04b4937189716b09eb9f04cec0a739adaf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 12:06:37 -0600 Subject: [PATCH 18/86] update --- dmz/internalproxy/templates/gitlab.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index cd7c92d..576d9ea 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -7,7 +7,7 @@ spec: - name: app port: 9022 protocol: TCP - targetPort: 9022 + targetPort: 9443 clusterIP: None type: ClusterIP From 121bd8a421a0cd319cf82887d81cb2a264c4fa7c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 12:08:25 -0600 Subject: [PATCH 19/86] update --- dmz/internalproxy/templates/gitlab.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 576d9ea..5b178ea 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -5,7 +5,7 @@ metadata: spec: ports: - name: app - port: 9022 + port: 9443 protocol: TCP targetPort: 9443 clusterIP: None @@ -21,7 +21,7 @@ subsets: - ip: 192.168.21.200 ports: - name: app - port: 9022 + port: 9443 protocol: TCP --- @@ -36,7 +36,7 @@ spec: - match: HostSNI(`*`) services: - name: app - port: 9022 + port: 9443 tls: secretName: gitlab-tls From db506ef0324e9f7fba942bd63b813f40271f6a9e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 12:10:22 -0600 Subject: [PATCH 20/86] update --- dmz/internalproxy/templates/gitlab.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 5b178ea..1ad072b 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 9443 + port: 9022 protocol: TCP - targetPort: 9443 + targetPort: 9022 clusterIP: None type: ClusterIP @@ -21,12 +21,12 @@ subsets: - ip: 192.168.21.200 ports: - name: app - port: 9443 + port: 9022 protocol: TCP --- apiVersion: traefik.io/v1alpha1 -kind: IngressRoute +kind: IngressRouteTCP metadata: name: gitlab-ssh spec: @@ -36,7 +36,7 @@ spec: - match: HostSNI(`*`) services: - name: app - port: 9443 + port: 9022 tls: secretName: gitlab-tls From 8b892fe6b1d36e6c12297b871443acd97a1ada8d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 12:12:31 -0600 Subject: [PATCH 21/86] update --- dmz/internalproxy/templates/gitlab.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 1ad072b..0c79c8b 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -35,10 +35,8 @@ spec: routes: - match: HostSNI(`*`) services: - - name: app + - name: gitlab-ssh port: 9022 - tls: - secretName: gitlab-tls --- apiVersion: v1 From 6bd445af5b076578468b631ff72a53c17ea07c2d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 14 Jan 2026 06:09:21 -0600 Subject: [PATCH 22/86] add openvpn server --- dmz/terraform/main.tf | 10 +++++++ dmz/terraform/openVPN.tf | 57 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+) create mode 100644 dmz/terraform/openVPN.tf diff --git a/dmz/terraform/main.tf b/dmz/terraform/main.tf index 021675c..4a949bd 100644 --- a/dmz/terraform/main.tf +++ b/dmz/terraform/main.tf @@ -45,4 +45,14 @@ locals { node = ["mothership", "overlord", "vanguard"] ip = ["21", "22", "23"] } + openVPN = { + tags = "openVPN" + count = 1 + name = ["openVPN"] + cores = 2 + memory = "4096" + drive = 20 + node = ["mothership"] + ip = ["20"] + } } diff --git a/dmz/terraform/openVPN.tf b/dmz/terraform/openVPN.tf new file mode 100644 index 0000000..ea43924 --- /dev/null +++ b/dmz/terraform/openVPN.tf @@ -0,0 +1,57 @@ +resource "proxmox_vm_qemu" "openVPN" { + count = local.openVPN.count + ciuser = "administrator" + vmid = "${local.vlan}${local.openVPN.ip[count.index]}" + name = local.openVPN.name[count.index] + target_node = local.openVPN.node[count.index] + clone = local.template + tags = local.openVPN.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.openVPN.cores + sockets = 1 + cpu_type = "host" + memory = local.openVPN.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.openVPN.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.openVPN.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} From 04b638b8f925a67138a911525aaaa986233b7a61 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 14 Jan 2026 06:13:42 -0600 Subject: [PATCH 23/86] fix gitlab pipeline --- .gitlab/.gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml index 4c7a36a..b21e1bf 100644 --- a/.gitlab/.gitlab-ci.yml +++ b/.gitlab/.gitlab-ci.yml @@ -4,7 +4,7 @@ stages: build_dmz: stage: triggers trigger: - include: infra/.gitlab/.gitlab-ci.yml + include: dmz/.gitlab/.gitlab-ci.yml rules: - changes: - "dmz/terraform/*.tf" From a6437bb1097f7deb61269e1414439c393b77a7f1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 18 Jan 2026 06:46:37 -0600 Subject: [PATCH 24/86] add searxng --- dmz/searxng/Chart.yaml | 27 +++++++++ dmz/searxng/templates/NOTES.txt | 1 + dmz/searxng/templates/common.yaml | 17 ++++++ dmz/searxng/templates/configmap.yaml | 11 ++++ dmz/searxng/templates/ingress.yaml | 45 +++++++++++++++ dmz/searxng/values.yaml | 83 ++++++++++++++++++++++++++++ infra/argocd/templates/searxng.yaml | 22 ++++++++ 7 files changed, 206 insertions(+) create mode 100644 dmz/searxng/Chart.yaml create mode 100644 dmz/searxng/templates/NOTES.txt create mode 100644 dmz/searxng/templates/common.yaml create mode 100644 dmz/searxng/templates/configmap.yaml create mode 100644 dmz/searxng/templates/ingress.yaml create mode 100644 dmz/searxng/values.yaml create mode 100644 infra/argocd/templates/searxng.yaml diff --git a/dmz/searxng/Chart.yaml b/dmz/searxng/Chart.yaml new file mode 100644 index 0000000..0a3d722 --- /dev/null +++ b/dmz/searxng/Chart.yaml @@ -0,0 +1,27 @@ +apiVersion: v2 +appVersion: latest +description: SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. +name: searxng +version: 1.0.1 +kubeVersion: ">=1.16.0-0" +keywords: + - searx + - searxng + - search engine + - privacy +icon: https://github.com/searxng/searxng/blob/master/searx/static/themes/simple/img/favicon.png?raw=true +sources: + - https://github.com/searxng/searxng + - https://docs.searxng.org + - https://hub.docker.com/r/searxng/searxng +maintainers: + - name: unixfox + email: searxng@unixfoxremovemeifyouwanttocontactme.eu +dependencies: + - name: common + repository: https://library-charts.k8s-at-home.com + version: 4.4.2 + - name: redis + version: 0.0.3 + repository: https://charts.pascaliske.dev + condition: redis.enabled diff --git a/dmz/searxng/templates/NOTES.txt b/dmz/searxng/templates/NOTES.txt new file mode 100644 index 0000000..90f7b65 --- /dev/null +++ b/dmz/searxng/templates/NOTES.txt @@ -0,0 +1 @@ +{{- include "common.notes.defaultNotes" . -}} diff --git a/dmz/searxng/templates/common.yaml b/dmz/searxng/templates/common.yaml new file mode 100644 index 0000000..f8490f9 --- /dev/null +++ b/dmz/searxng/templates/common.yaml @@ -0,0 +1,17 @@ +{{/* First Make sure all variables are set and merged properly */}} +{{- include "common.values.setup" . }} + +{{/* Append the configMap volume to the volumes */}} +{{- define "searxng.settingsVolume" -}} +enabled: "true" +mountPath: "/etc/searxng/settings.yml" +subPath: "settings.yml" +type: "custom" +volumeSpec: + secret: + secretName: {{ include "common.names.fullname" . }}-config +{{- end -}} +{{- $_ := set .Values.persistence "searxng-config" (include "searxng.settingsVolume" . | fromYaml) -}} + +{{/* Render the templates */}} +{{ include "common.all" . }} \ No newline at end of file diff --git a/dmz/searxng/templates/configmap.yaml b/dmz/searxng/templates/configmap.yaml new file mode 100644 index 0000000..f27ea5d --- /dev/null +++ b/dmz/searxng/templates/configmap.yaml @@ -0,0 +1,11 @@ +{{- include "common.values.setup" . -}} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }}-config + labels: + {{- include "common.labels" . | nindent 4 }} +data: + settings.yml: |- +{{ toYaml .Values.searxng.config | b64enc | indent 4 }} \ No newline at end of file diff --git a/dmz/searxng/templates/ingress.yaml b/dmz/searxng/templates/ingress.yaml new file mode 100644 index 0000000..8093211 --- /dev/null +++ b/dmz/searxng/templates/ingress.yaml @@ -0,0 +1,45 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: searxng-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`searxng.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: searxng + port: 3000 + tls: + secretName: searxng-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: searxng-tls +spec: + secretName: searxng-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "searxng.durp.info" + dnsNames: + - "searxng.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: searxng-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: searxng.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/searxng/values.yaml b/dmz/searxng/values.yaml new file mode 100644 index 0000000..0f92a3b --- /dev/null +++ b/dmz/searxng/values.yaml @@ -0,0 +1,83 @@ +# +# IMPORTANT NOTE +# +# This chart inherits from our common library chart. You can check the default values/options here: +# https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml +# + +image: + # -- image repository + repository: registry.durp.info/searxng/searxng + # -- image tag + tag: latest + # -- image pull policy + pullPolicy: Always + +# Explanation about each environment variables here: +# https://docs.searxng.org/admin/installation-docker.html#command-line +env: + INSTANCE_NAME: "durp.info" + BASE_URL: "https://searx.durp.info" + AUTOCOMPLETE: "false" + # MORTY_URL: "http://morty:8080" + # MORTY_KEY: "mysecretkey" + # BIND_ADDRESS: "0.0.0.0:8080" + +controller: + strategy: "RollingUpdate" + +# -- Configures service settings for the chart. +# @default -- See values.yaml +service: + main: + ports: + http: + port: 8080 + +# -- Configure persistence settings for the chart under this key. +# @default -- See values.yaml +persistence: + config: + enabled: false + +ingress: + # -- Enable and configure ingress settings for the chart under this key. + # @default -- See values.yaml + main: + enabled: false + +searxng: + config: + use_default_settings: true + #server: + # secret_key: pleasechangeme + # Uncomment when using the builtin rate limiter + # See https://docs.searxng.org/src/searx.plugins.limiter.html#limiter-plugin + # server.limiter: true + # redis.url: redis://@searxng-redis:6379/0 + +probes: + readiness: + custom: true + spec: + httpGet: + path: /healthz + port: 8080 + liveness: + custom: true + spec: + httpGet: + path: /healthz + port: 8080 + startup: + custom: true + spec: + httpGet: + path: /healthz + port: 8080 + +# Enable when using searxng builtin rate limiter +# Values: https://github.com/pascaliske/helm-charts/tree/master/charts/redis +redis: + enabled: false + \ No newline at end of file diff --git a/infra/argocd/templates/searxng.yaml b/infra/argocd/templates/searxng.yaml new file mode 100644 index 0000000..174c060 --- /dev/null +++ b/infra/argocd/templates/searxng.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: searxng + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/searxng + directory: + recurse: true + destination: + name: dmz + namespace: searxng + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From 3e062cea4c9671959ac9e0570a38ddfda149c29c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 18 Jan 2026 06:51:06 -0600 Subject: [PATCH 25/86] update --- dmz/searxng/Chart.yaml | 18 ------------------ dmz/searxng/templates/configmap.yaml | 3 +-- 2 files changed, 1 insertion(+), 20 deletions(-) diff --git a/dmz/searxng/Chart.yaml b/dmz/searxng/Chart.yaml index 0a3d722..6d8990f 100644 --- a/dmz/searxng/Chart.yaml +++ b/dmz/searxng/Chart.yaml @@ -3,25 +3,7 @@ appVersion: latest description: SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. name: searxng version: 1.0.1 -kubeVersion: ">=1.16.0-0" -keywords: - - searx - - searxng - - search engine - - privacy -icon: https://github.com/searxng/searxng/blob/master/searx/static/themes/simple/img/favicon.png?raw=true -sources: - - https://github.com/searxng/searxng - - https://docs.searxng.org - - https://hub.docker.com/r/searxng/searxng -maintainers: - - name: unixfox - email: searxng@unixfoxremovemeifyouwanttocontactme.eu dependencies: - name: common repository: https://library-charts.k8s-at-home.com version: 4.4.2 - - name: redis - version: 0.0.3 - repository: https://charts.pascaliske.dev - condition: redis.enabled diff --git a/dmz/searxng/templates/configmap.yaml b/dmz/searxng/templates/configmap.yaml index f27ea5d..b05869b 100644 --- a/dmz/searxng/templates/configmap.yaml +++ b/dmz/searxng/templates/configmap.yaml @@ -7,5 +7,4 @@ metadata: labels: {{- include "common.labels" . | nindent 4 }} data: - settings.yml: |- -{{ toYaml .Values.searxng.config | b64enc | indent 4 }} \ No newline at end of file + settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} \ No newline at end of file From 5a0664e1efa7259da1fb228740d026cadee5ad3c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 18 Jan 2026 06:52:57 -0600 Subject: [PATCH 26/86] update --- dmz/searxng/templates/configmap.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/dmz/searxng/templates/configmap.yaml b/dmz/searxng/templates/configmap.yaml index b05869b..5b3239e 100644 --- a/dmz/searxng/templates/configmap.yaml +++ b/dmz/searxng/templates/configmap.yaml @@ -1,5 +1,3 @@ -{{- include "common.values.setup" . -}} ---- apiVersion: v1 kind: Secret metadata: @@ -7,4 +5,4 @@ metadata: labels: {{- include "common.labels" . | nindent 4 }} data: - settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} \ No newline at end of file + settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} From 6799a84f65c3215a4aa1a89884b59c410711056f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 18 Jan 2026 06:53:36 -0600 Subject: [PATCH 27/86] update --- dmz/searxng/templates/configmap.yaml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/dmz/searxng/templates/configmap.yaml b/dmz/searxng/templates/configmap.yaml index 5b3239e..c0b5155 100644 --- a/dmz/searxng/templates/configmap.yaml +++ b/dmz/searxng/templates/configmap.yaml @@ -1,8 +1,9 @@ -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "common.names.fullname" . }}-config - labels: - {{- include "common.labels" . | nindent 4 }} -data: - settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} +#apiVersion: v1 +#kind: Secret +#metadata: +# name: {{ include "common.names.fullname" . }}-config +# labels: +# {{- include "common.labels" . | nindent 4 }} +#data: +# settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} +# \ No newline at end of file From 5e39fb1a1dc520514e62cb4cf7e453b66ce9a297 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 18 Jan 2026 06:58:20 -0600 Subject: [PATCH 28/86] update --- dmz/searxng/Chart.yaml | 9 +++++---- dmz/searxng/templates/NOTES.txt | 1 - dmz/searxng/templates/common.yaml | 17 ----------------- dmz/searxng/templates/configmap.yaml | 9 --------- dmz/searxng/templates/deployment.yaml | 24 ++++++++++++++++++++++++ dmz/searxng/templates/ingress.yaml | 4 ++-- dmz/searxng/templates/service.yaml | 12 ++++++++++++ 7 files changed, 43 insertions(+), 33 deletions(-) delete mode 100644 dmz/searxng/templates/NOTES.txt delete mode 100644 dmz/searxng/templates/common.yaml delete mode 100644 dmz/searxng/templates/configmap.yaml create mode 100644 dmz/searxng/templates/deployment.yaml create mode 100644 dmz/searxng/templates/service.yaml diff --git a/dmz/searxng/Chart.yaml b/dmz/searxng/Chart.yaml index 6d8990f..263432f 100644 --- a/dmz/searxng/Chart.yaml +++ b/dmz/searxng/Chart.yaml @@ -3,7 +3,8 @@ appVersion: latest description: SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. name: searxng version: 1.0.1 -dependencies: - - name: common - repository: https://library-charts.k8s-at-home.com - version: 4.4.2 +#dependencies: +# - name: common +# repository: https://library-charts.k8s-at-home.com +# version: 4.4.2 +# \ No newline at end of file diff --git a/dmz/searxng/templates/NOTES.txt b/dmz/searxng/templates/NOTES.txt deleted file mode 100644 index 90f7b65..0000000 --- a/dmz/searxng/templates/NOTES.txt +++ /dev/null @@ -1 +0,0 @@ -{{- include "common.notes.defaultNotes" . -}} diff --git a/dmz/searxng/templates/common.yaml b/dmz/searxng/templates/common.yaml deleted file mode 100644 index f8490f9..0000000 --- a/dmz/searxng/templates/common.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{/* First Make sure all variables are set and merged properly */}} -{{- include "common.values.setup" . }} - -{{/* Append the configMap volume to the volumes */}} -{{- define "searxng.settingsVolume" -}} -enabled: "true" -mountPath: "/etc/searxng/settings.yml" -subPath: "settings.yml" -type: "custom" -volumeSpec: - secret: - secretName: {{ include "common.names.fullname" . }}-config -{{- end -}} -{{- $_ := set .Values.persistence "searxng-config" (include "searxng.settingsVolume" . | fromYaml) -}} - -{{/* Render the templates */}} -{{ include "common.all" . }} \ No newline at end of file diff --git a/dmz/searxng/templates/configmap.yaml b/dmz/searxng/templates/configmap.yaml deleted file mode 100644 index c0b5155..0000000 --- a/dmz/searxng/templates/configmap.yaml +++ /dev/null @@ -1,9 +0,0 @@ -#apiVersion: v1 -#kind: Secret -#metadata: -# name: {{ include "common.names.fullname" . }}-config -# labels: -# {{- include "common.labels" . | nindent 4 }} -#data: -# settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} -# \ No newline at end of file diff --git a/dmz/searxng/templates/deployment.yaml b/dmz/searxng/templates/deployment.yaml new file mode 100644 index 0000000..3ab2d47 --- /dev/null +++ b/dmz/searxng/templates/deployment.yaml @@ -0,0 +1,24 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: searxng + name: searxng + labels: + app: searxng +spec: + selector: + matchLabels: + app: searxng + replicas: 1 + template: + metadata: + labels: + app: searxng + spec: + containers: + - name: searxng + image: registry.durp.info/searxng/searxng:latest + imagePullPolicy: Always + ports: + - name: http + containerPort: 8080 \ No newline at end of file diff --git a/dmz/searxng/templates/ingress.yaml b/dmz/searxng/templates/ingress.yaml index 8093211..da757e7 100644 --- a/dmz/searxng/templates/ingress.yaml +++ b/dmz/searxng/templates/ingress.yaml @@ -12,8 +12,8 @@ spec: - name: authentik-proxy-provider namespace: traefik services: - - name: searxng - port: 3000 + - name: searxng-service + port: 8080 tls: secretName: searxng-tls diff --git a/dmz/searxng/templates/service.yaml b/dmz/searxng/templates/service.yaml new file mode 100644 index 0000000..8498428 --- /dev/null +++ b/dmz/searxng/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: searxng-service +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + protocol: TCP + selector: + app: searxng From 6912ca701a45ad101e59409ef43ab895d13c8cd9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 2 Feb 2026 05:18:06 -0600 Subject: [PATCH 29/86] remove terraform --- dev/terraform/k3s.tf | 115 -- dev/terraform/main.tf | 48 - dev/terraform/variables.tf | 14 - dmz/terraform/k3s.tf | 115 -- dmz/terraform/main.tf | 58 - dmz/terraform/openVPN.tf | 57 - dmz/terraform/variables.tf | 14 - infra/terraform/k3s.tf | 116 -- infra/terraform/main.tf | 81 - infra/terraform/pihole.tf | 57 - infra/terraform/postgres.tf | 116 -- infra/terraform/variables.tf | 14 - master/argocd/Chart.yaml | 14 - master/argocd/templates/InternalProxy.yaml | 23 - master/argocd/templates/argocd.yaml | 59 - master/argocd/templates/authentik.yaml | 21 - master/argocd/templates/bitwarden.yaml | 23 - master/argocd/templates/cert-manager.yaml | 20 - master/argocd/templates/crossplane.yml | 20 - master/argocd/templates/durpapi.yaml | 20 - master/argocd/templates/durpot.yaml | 20 - master/argocd/templates/external-dns.yaml | 20 - master/argocd/templates/external-secrets.yaml | 20 - master/argocd/templates/gatekeeper.yaml | 20 - master/argocd/templates/gitlab-runner.yaml | 21 - master/argocd/templates/heimdall.yaml | 20 - master/argocd/templates/krakend.yaml | 20 - .../templates/kube-prometheus-stack.yaml | 22 - master/argocd/templates/kubeclarity.yaml | 21 - master/argocd/templates/littlelink.yaml | 22 - master/argocd/templates/longhorn.yaml | 21 - master/argocd/templates/metallb-system.yaml | 22 - master/argocd/templates/nfs-client.yaml | 23 - master/argocd/templates/open-webui.yaml | 21 - master/argocd/templates/secrets.yaml | 17 - master/argocd/templates/traefik.yaml | 20 - master/argocd/templates/uptimekuma.yaml | 23 - master/argocd/templates/vault.yaml | 25 - master/argocd/values.yaml | 62 - master/authentik/Chart.yaml | 12 - master/authentik/templates/authentik-pv.yaml | 24 - master/authentik/templates/authentik-pvc.yaml | 18 - master/authentik/templates/ingress.yaml | 60 - master/authentik/templates/secrets.yaml | 28 - master/authentik/values.yaml | 30 - master/bitwarden/Chart.yaml | 7 - master/bitwarden/templates/bitwarden-pv.yaml | 25 - master/bitwarden/templates/bitwarden-pvc.yaml | 11 - master/bitwarden/templates/deployment.yaml | 50 - master/bitwarden/templates/ingress.yaml | 42 - master/bitwarden/templates/secrets.yaml | 16 - master/bitwarden/templates/service.yaml | 12 - master/cert-manager/Chart.yaml | 11 - .../templates/letsencrypt-prroduction.yaml | 16 - .../templates/letsencrypt-staging.yaml | 16 - .../cert-manager/templates/sealedsecret.yaml | 16 - master/cert-manager/values.yaml | 25 - master/crossplane/Chart.yaml | 12 - master/crossplane/templates/gitlab.yml | 55 - master/dashboards/nginx-dashboard.yaml | 1506 ----------------- master/durpapi/Chart.yaml | 13 - master/durpapi/templates/deployment.yaml | 38 - master/durpapi/templates/hpa.yaml | 24 - master/durpapi/templates/ingress.yaml | 44 - master/durpapi/templates/secrets.yaml | 39 - master/durpapi/templates/service.yaml | 12 - master/durpapi/values.yaml | 39 - master/durpot/Chart.yaml | 11 - master/durpot/templates/secrets.yaml | 43 - master/external-dns/Chart.yaml | 12 - master/external-dns/templates/secrets.yaml | 23 - master/external-dns/values.yaml | 16 - master/external-secrets/Chart.yaml | 12 - master/external-secrets/values.yaml | 463 ----- master/gatekeeper/Chart.yaml | 11 - master/gatekeeper/values.yaml | 278 --- master/gitlab-runner/Chart.yaml | 11 - master/gitlab-runner/templates/secrets.yaml | 19 - master/gitlab-runner/values.yaml | 71 - master/heimdall/Chart.yaml | 11 - master/heimdall/templates/ingress.yaml | 52 - master/heimdall/values.yaml | 28 - master/internalproxy/Chart.yaml | 7 - master/internalproxy/templates/argocd.yaml | 46 - master/internalproxy/templates/blueiris.yaml | 63 - .../templates/duplicati-ingress.yaml | 70 - master/internalproxy/templates/gitea.yaml | 72 - master/internalproxy/templates/infra.yaml | 60 - master/internalproxy/templates/jellyfin.yaml | 72 - master/internalproxy/templates/kasm.yaml | 72 - master/internalproxy/templates/minio.yaml | 63 - master/internalproxy/templates/nexus.yaml | 71 - master/internalproxy/templates/octopus.yaml | 63 - master/internalproxy/templates/ollama.yaml | 102 -- master/internalproxy/templates/plex.yaml | 72 - master/internalproxy/templates/portainer.yaml | 63 - master/internalproxy/templates/proxmox.yaml | 63 - master/internalproxy/templates/redlib.yaml | 68 - .../templates/registry-internal.yaml | 59 - master/internalproxy/templates/registry.yaml | 71 - master/internalproxy/templates/s3.yaml | 63 - master/internalproxy/templates/semaphore.yaml | 63 - master/internalproxy/templates/smokeping.yaml | 82 - master/internalproxy/templates/speedtest.yaml | 74 - master/internalproxy/templates/tdarr.yaml | 67 - master/internalproxy/templates/unifi.yaml | 63 - master/internalproxy/templates/unraid.yaml | 63 - master/internalproxy/templates/vault.yaml | 63 - master/internalproxy/templates/wazuh.yaml | 63 - master/krakend/Chart.yaml | 7 - master/krakend/templates/deployments.yaml | 39 - master/krakend/templates/ingress.yaml | 56 - master/krakend/templates/secrets.yaml | 15 - master/krakend/templates/service.yaml | 12 - master/kube-prometheus-stack/Chart.yaml | 12 - .../templates/grafana-secrets-sealed.yaml | 41 - .../templates/ingress.yaml | 80 - master/kube-prometheus-stack/values.yaml | 203 --- master/kubeclarity/Chart.yaml | 11 - master/kubeclarity/templates/ingress.yaml | 47 - master/kubeclarity/values.yaml | 235 --- master/littlelink/Chart.yaml | 0 master/littlelink/templates/deployment.yaml | 101 -- master/littlelink/templates/ingress.yaml | 42 - master/littlelink/templates/service.yaml | 12 - master/longhorn/Chart.yaml | 12 - master/longhorn/templates/ingress.yaml | 41 - master/longhorn/templates/secrets.yaml | 24 - master/longhorn/values.yaml | 253 --- master/metallb-system/Chart.yaml | 13 - master/metallb-system/templates/config.yaml | 17 - master/metallb-system/values.yaml | 197 --- master/nfs-client/Chart.yml | 8 - .../templates/cluster-role-binding.yml | 12 - master/nfs-client/templates/cluster-role.yml | 20 - master/nfs-client/templates/provisioner.yml | 42 - master/nfs-client/templates/role-binding.yml | 13 - master/nfs-client/templates/role.yml | 9 - .../nfs-client/templates/service-account.yml | 5 - master/nfs-client/templates/storage-class.yml | 10 - master/open-webui/Chart.yaml | 7 - master/open-webui/templates/deployment.yaml | 37 - master/open-webui/templates/ingress.yaml | 42 - master/open-webui/templates/pvc.yaml | 11 - master/open-webui/templates/secrets.yaml | 16 - master/open-webui/templates/service.yaml | 12 - master/traefik/Chart.yaml | 11 - master/traefik/templates/ingress.yaml | 39 - master/traefik/templates/middlewares.yaml | 35 - master/traefik/values.yaml | 887 ---------- master/uptimekuma/Chart.yaml | 7 - master/uptimekuma/templates/deployment.yaml | 42 - master/uptimekuma/templates/ingress.yaml | 42 - master/uptimekuma/templates/kuma-pv.yaml | 25 - master/uptimekuma/templates/kuma-pvc.yaml | 12 - master/uptimekuma/templates/service.yaml | 13 - master/vault/Chart.yaml | 12 - master/vault/templates/ingress.yaml | 37 - master/vault/templates/secret-store.yaml | 14 - master/vault/values.yaml | 65 - prd/terraform/k3s.tf | 115 -- prd/terraform/main.tf | 48 - prd/terraform/variables.tf | 14 - 163 files changed, 9597 deletions(-) delete mode 100644 dev/terraform/k3s.tf delete mode 100644 dev/terraform/main.tf delete mode 100644 dev/terraform/variables.tf delete mode 100644 dmz/terraform/k3s.tf delete mode 100644 dmz/terraform/main.tf delete mode 100644 dmz/terraform/openVPN.tf delete mode 100644 dmz/terraform/variables.tf delete mode 100644 infra/terraform/k3s.tf delete mode 100644 infra/terraform/main.tf delete mode 100644 infra/terraform/pihole.tf delete mode 100644 infra/terraform/postgres.tf delete mode 100644 infra/terraform/variables.tf delete mode 100644 master/argocd/Chart.yaml delete mode 100644 master/argocd/templates/InternalProxy.yaml delete mode 100644 master/argocd/templates/argocd.yaml delete mode 100644 master/argocd/templates/authentik.yaml delete mode 100644 master/argocd/templates/bitwarden.yaml delete mode 100644 master/argocd/templates/cert-manager.yaml delete mode 100644 master/argocd/templates/crossplane.yml delete mode 100644 master/argocd/templates/durpapi.yaml delete mode 100644 master/argocd/templates/durpot.yaml delete mode 100644 master/argocd/templates/external-dns.yaml delete mode 100644 master/argocd/templates/external-secrets.yaml delete mode 100644 master/argocd/templates/gatekeeper.yaml delete mode 100644 master/argocd/templates/gitlab-runner.yaml delete mode 100644 master/argocd/templates/heimdall.yaml delete mode 100644 master/argocd/templates/krakend.yaml delete mode 100644 master/argocd/templates/kube-prometheus-stack.yaml delete mode 100644 master/argocd/templates/kubeclarity.yaml delete mode 100644 master/argocd/templates/littlelink.yaml delete mode 100644 master/argocd/templates/longhorn.yaml delete mode 100644 master/argocd/templates/metallb-system.yaml delete mode 100644 master/argocd/templates/nfs-client.yaml delete mode 100644 master/argocd/templates/open-webui.yaml delete mode 100644 master/argocd/templates/secrets.yaml delete mode 100644 master/argocd/templates/traefik.yaml delete mode 100644 master/argocd/templates/uptimekuma.yaml delete mode 100644 master/argocd/templates/vault.yaml delete mode 100644 master/argocd/values.yaml delete mode 100644 master/authentik/Chart.yaml delete mode 100644 master/authentik/templates/authentik-pv.yaml delete mode 100644 master/authentik/templates/authentik-pvc.yaml delete mode 100644 master/authentik/templates/ingress.yaml delete mode 100644 master/authentik/templates/secrets.yaml delete mode 100644 master/authentik/values.yaml delete mode 100644 master/bitwarden/Chart.yaml delete mode 100644 master/bitwarden/templates/bitwarden-pv.yaml delete mode 100644 master/bitwarden/templates/bitwarden-pvc.yaml delete mode 100644 master/bitwarden/templates/deployment.yaml delete mode 100644 master/bitwarden/templates/ingress.yaml delete mode 100644 master/bitwarden/templates/secrets.yaml delete mode 100644 master/bitwarden/templates/service.yaml delete mode 100644 master/cert-manager/Chart.yaml delete mode 100644 master/cert-manager/templates/letsencrypt-prroduction.yaml delete mode 100644 master/cert-manager/templates/letsencrypt-staging.yaml delete mode 100644 master/cert-manager/templates/sealedsecret.yaml delete mode 100644 master/cert-manager/values.yaml delete mode 100644 master/crossplane/Chart.yaml delete mode 100644 master/crossplane/templates/gitlab.yml delete mode 100644 master/dashboards/nginx-dashboard.yaml delete mode 100644 master/durpapi/Chart.yaml delete mode 100644 master/durpapi/templates/deployment.yaml delete mode 100644 master/durpapi/templates/hpa.yaml delete mode 100644 master/durpapi/templates/ingress.yaml delete mode 100644 master/durpapi/templates/secrets.yaml delete mode 100644 master/durpapi/templates/service.yaml delete mode 100644 master/durpapi/values.yaml delete mode 100644 master/durpot/Chart.yaml delete mode 100644 master/durpot/templates/secrets.yaml delete mode 100644 master/external-dns/Chart.yaml delete mode 100644 master/external-dns/templates/secrets.yaml delete mode 100644 master/external-dns/values.yaml delete mode 100644 master/external-secrets/Chart.yaml delete mode 100644 master/external-secrets/values.yaml delete mode 100644 master/gatekeeper/Chart.yaml delete mode 100644 master/gatekeeper/values.yaml delete mode 100644 master/gitlab-runner/Chart.yaml delete mode 100644 master/gitlab-runner/templates/secrets.yaml delete mode 100644 master/gitlab-runner/values.yaml delete mode 100644 master/heimdall/Chart.yaml delete mode 100644 master/heimdall/templates/ingress.yaml delete mode 100644 master/heimdall/values.yaml delete mode 100644 master/internalproxy/Chart.yaml delete mode 100644 master/internalproxy/templates/argocd.yaml delete mode 100644 master/internalproxy/templates/blueiris.yaml delete mode 100644 master/internalproxy/templates/duplicati-ingress.yaml delete mode 100644 master/internalproxy/templates/gitea.yaml delete mode 100644 master/internalproxy/templates/infra.yaml delete mode 100644 master/internalproxy/templates/jellyfin.yaml delete mode 100644 master/internalproxy/templates/kasm.yaml delete mode 100644 master/internalproxy/templates/minio.yaml delete mode 100644 master/internalproxy/templates/nexus.yaml delete mode 100644 master/internalproxy/templates/octopus.yaml delete mode 100644 master/internalproxy/templates/ollama.yaml delete mode 100644 master/internalproxy/templates/plex.yaml delete mode 100644 master/internalproxy/templates/portainer.yaml delete mode 100644 master/internalproxy/templates/proxmox.yaml delete mode 100644 master/internalproxy/templates/redlib.yaml delete mode 100644 master/internalproxy/templates/registry-internal.yaml delete mode 100644 master/internalproxy/templates/registry.yaml delete mode 100644 master/internalproxy/templates/s3.yaml delete mode 100644 master/internalproxy/templates/semaphore.yaml delete mode 100644 master/internalproxy/templates/smokeping.yaml delete mode 100644 master/internalproxy/templates/speedtest.yaml delete mode 100644 master/internalproxy/templates/tdarr.yaml delete mode 100644 master/internalproxy/templates/unifi.yaml delete mode 100644 master/internalproxy/templates/unraid.yaml delete mode 100644 master/internalproxy/templates/vault.yaml delete mode 100644 master/internalproxy/templates/wazuh.yaml delete mode 100644 master/krakend/Chart.yaml delete mode 100644 master/krakend/templates/deployments.yaml delete mode 100644 master/krakend/templates/ingress.yaml delete mode 100644 master/krakend/templates/secrets.yaml delete mode 100644 master/krakend/templates/service.yaml delete mode 100644 master/kube-prometheus-stack/Chart.yaml delete mode 100644 master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml delete mode 100644 master/kube-prometheus-stack/templates/ingress.yaml delete mode 100644 master/kube-prometheus-stack/values.yaml delete mode 100644 master/kubeclarity/Chart.yaml delete mode 100644 master/kubeclarity/templates/ingress.yaml delete mode 100644 master/kubeclarity/values.yaml delete mode 100644 master/littlelink/Chart.yaml delete mode 100644 master/littlelink/templates/deployment.yaml delete mode 100644 master/littlelink/templates/ingress.yaml delete mode 100644 master/littlelink/templates/service.yaml delete mode 100644 master/longhorn/Chart.yaml delete mode 100644 master/longhorn/templates/ingress.yaml delete mode 100644 master/longhorn/templates/secrets.yaml delete mode 100644 master/longhorn/values.yaml delete mode 100644 master/metallb-system/Chart.yaml delete mode 100644 master/metallb-system/templates/config.yaml delete mode 100644 master/metallb-system/values.yaml delete mode 100644 master/nfs-client/Chart.yml delete mode 100644 master/nfs-client/templates/cluster-role-binding.yml delete mode 100644 master/nfs-client/templates/cluster-role.yml delete mode 100644 master/nfs-client/templates/provisioner.yml delete mode 100644 master/nfs-client/templates/role-binding.yml delete mode 100644 master/nfs-client/templates/role.yml delete mode 100644 master/nfs-client/templates/service-account.yml delete mode 100644 master/nfs-client/templates/storage-class.yml delete mode 100644 master/open-webui/Chart.yaml delete mode 100644 master/open-webui/templates/deployment.yaml delete mode 100644 master/open-webui/templates/ingress.yaml delete mode 100644 master/open-webui/templates/pvc.yaml delete mode 100644 master/open-webui/templates/secrets.yaml delete mode 100644 master/open-webui/templates/service.yaml delete mode 100644 master/traefik/Chart.yaml delete mode 100644 master/traefik/templates/ingress.yaml delete mode 100644 master/traefik/templates/middlewares.yaml delete mode 100644 master/traefik/values.yaml delete mode 100644 master/uptimekuma/Chart.yaml delete mode 100644 master/uptimekuma/templates/deployment.yaml delete mode 100644 master/uptimekuma/templates/ingress.yaml delete mode 100644 master/uptimekuma/templates/kuma-pv.yaml delete mode 100644 master/uptimekuma/templates/kuma-pvc.yaml delete mode 100644 master/uptimekuma/templates/service.yaml delete mode 100644 master/vault/Chart.yaml delete mode 100644 master/vault/templates/ingress.yaml delete mode 100644 master/vault/templates/secret-store.yaml delete mode 100644 master/vault/values.yaml delete mode 100644 prd/terraform/k3s.tf delete mode 100644 prd/terraform/main.tf delete mode 100644 prd/terraform/variables.tf diff --git a/dev/terraform/k3s.tf b/dev/terraform/k3s.tf deleted file mode 100644 index 4d02a21..0000000 --- a/dev/terraform/k3s.tf +++ /dev/null @@ -1,115 +0,0 @@ -resource "proxmox_vm_qemu" "k3smaster" { - count = local.k3smaster.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" - name = local.k3smaster.name[count.index] - target_node = local.k3smaster.node[count.index] - clone = local.template - tags = local.k3smaster.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3smaster.cores - sockets = 1 - cpu_type = "host" - memory = local.k3smaster.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3smaster.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3smaster.drive - format = local.format - storage = local.k3smaster.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} - -resource "proxmox_vm_qemu" "k3sserver" { - count = local.k3sserver.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" - name = local.k3sserver.name[count.index] - target_node = local.k3sserver.node[count.index] - clone = local.template - tags = local.k3sserver.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3sserver.cores - sockets = 1 - cpu_type = "host" - memory = local.k3sserver.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3sserver.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3sserver.drive - format = local.format - storage = local.k3sserver.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/dev/terraform/main.tf b/dev/terraform/main.tf deleted file mode 100644 index c75295e..0000000 --- a/dev/terraform/main.tf +++ /dev/null @@ -1,48 +0,0 @@ -terraform { - backend "http" {} - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } -} - -provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false -} - -locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - format = "raw" - dnsserver = "192.168.10.1" - vlan = 10 - k3smaster = { - tags = "k3s_dev" - count = 3 - name = ["master01-dev", "master02-dev", "master03-dev"] - cores = 2 - memory = "4096" - drive = 20 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] - } - k3sserver = { - tags = "k3s_dev" - count = 3 - name = ["node01-dev", "node02-dev", "node03-dev"] - cores = 4 - memory = "8192" - drive = 120 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] - } -} diff --git a/dev/terraform/variables.tf b/dev/terraform/variables.tf deleted file mode 100644 index 29a1c9d..0000000 --- a/dev/terraform/variables.tf +++ /dev/null @@ -1,14 +0,0 @@ -variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string -} - -variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string -} - -variable "pm_user" { - description = "Username to Proxmox provider" - type = string -} diff --git a/dmz/terraform/k3s.tf b/dmz/terraform/k3s.tf deleted file mode 100644 index bca2f62..0000000 --- a/dmz/terraform/k3s.tf +++ /dev/null @@ -1,115 +0,0 @@ -resource "proxmox_vm_qemu" "k3smaster" { - count = local.k3smaster.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" - name = local.k3smaster.name[count.index] - target_node = local.k3smaster.node[count.index] - clone = local.template - tags = local.k3smaster.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3smaster.cores - sockets = 1 - cpu_type = "host" - memory = local.k3smaster.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3smaster.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} - -resource "proxmox_vm_qemu" "k3sserver" { - count = local.k3sserver.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" - name = local.k3sserver.name[count.index] - target_node = local.k3sserver.node[count.index] - clone = local.template - tags = local.k3sserver.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3sserver.cores - sockets = 1 - cpu_type = "host" - memory = local.k3sserver.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3sserver.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/dmz/terraform/main.tf b/dmz/terraform/main.tf deleted file mode 100644 index 4a949bd..0000000 --- a/dmz/terraform/main.tf +++ /dev/null @@ -1,58 +0,0 @@ -terraform { - backend "http" {} - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } -} - -provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false -} - -locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - storage = "cache-domains" - emulatessd = true - format = "raw" - dnsserver = "192.168.98.1" - vlan = 98 - k3smaster = { - tags = "k3s_dmz" - count = 3 - name = ["master01-dmz", "master02-dmz", "master03-dmz"] - cores = 2 - memory = "4096" - drive = 20 - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] - } - k3sserver = { - tags = "k3s_dmz" - count = 3 - name = ["node01-dmz", "node02-dmz", "node03-dmz"] - cores = 4 - memory = "8192" - drive = 240 - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] - } - openVPN = { - tags = "openVPN" - count = 1 - name = ["openVPN"] - cores = 2 - memory = "4096" - drive = 20 - node = ["mothership"] - ip = ["20"] - } -} diff --git a/dmz/terraform/openVPN.tf b/dmz/terraform/openVPN.tf deleted file mode 100644 index ea43924..0000000 --- a/dmz/terraform/openVPN.tf +++ /dev/null @@ -1,57 +0,0 @@ -resource "proxmox_vm_qemu" "openVPN" { - count = local.openVPN.count - ciuser = "administrator" - vmid = "${local.vlan}${local.openVPN.ip[count.index]}" - name = local.openVPN.name[count.index] - target_node = local.openVPN.node[count.index] - clone = local.template - tags = local.openVPN.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.openVPN.cores - sockets = 1 - cpu_type = "host" - memory = local.openVPN.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.openVPN.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.openVPN.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/dmz/terraform/variables.tf b/dmz/terraform/variables.tf deleted file mode 100644 index 31a92e0..0000000 --- a/dmz/terraform/variables.tf +++ /dev/null @@ -1,14 +0,0 @@ -variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string -} - -variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string -} - -variable "pm_user" { - description = "UIsername to Proxmox provider" - type = string -} diff --git a/infra/terraform/k3s.tf b/infra/terraform/k3s.tf deleted file mode 100644 index 24e00e6..0000000 --- a/infra/terraform/k3s.tf +++ /dev/null @@ -1,116 +0,0 @@ -resource "proxmox_vm_qemu" "k3smaster" { - lifecycle { - prevent_destroy = true - } - count = local.k3smaster.count - ciuser = "administrator" - name = local.k3smaster.name[count.index] - target_node = local.k3smaster.node[count.index] - tags = local.k3smaster.tags - full_clone = false - qemu_os = "l26" - os_type = "cloud-init" - agent = 1 - cores = local.k3smaster.cores - sockets = 1 - cpu_type = "host" - memory = local.k3smaster.memory - scsihw = "virtio-scsi-pci" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3smaster.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3smaster.drive - format = local.format - storage = local.k3smaster.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} - -resource "proxmox_vm_qemu" "k3sserver" { - lifecycle { - prevent_destroy = true - } - count = local.k3sserver.count - ciuser = "administrator" - name = local.k3sserver.name[count.index] - target_node = local.k3sserver.node[count.index] - tags = local.k3sserver.tags - qemu_os = "l26" - full_clone = false - os_type = "cloud-init" - agent = 1 - cores = local.k3sserver.cores - sockets = 1 - cpu_type = "host" - memory = local.k3sserver.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3sserver.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3sserver.drive - format = local.format - storage = local.k3sserver.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf deleted file mode 100644 index df2d033..0000000 --- a/infra/terraform/main.tf +++ /dev/null @@ -1,81 +0,0 @@ -terraform { - backend "http" {} - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } -} - -provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false -} - -locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - format = "raw" - dnsserver = "192.168.12.1" - vlan = 12 - k3smaster = { - tags = "k3s_infra" - count = 3 - name = ["master01-infra", "master02-infra", "master03-infra"] - cores = 2 - memory = "4096" - drive = 20 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] - } - k3sserver = { - tags = "k3s_infra" - count = 3 - name = ["node01-infra", "node02-infra", "node03-infra"] - cores = 4 - memory = "16384" - drive = 240 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] - } - #haproxy = { - # tags = "haproxy" - # count = 3 - # name = ["haproxy-01", "haproxy-02", "haproxy-03"] - # cores = 2 - # memory = "1024" - # drive = 20 - # storage = "cache-domains" - # node = ["mothership", "overlord", "vanguard"] - # ip = ["31", "32", "33"] - #} - #postgres = { - # tags = "postgres" - # count = 3 - # name = ["postgres-01", "postgres-02", "postgres-03"] - # cores = 4 - # memory = "4096" - # drive = 40 - # storage = "cache-domains" - # node = ["mothership", "overlord", "vanguard"] - # ip = ["34", "35", "36"] - #} - pihole = { - tags = "pihole" - count = 3 - name = ["pihole-01", "pihole-02", "pihole-03"] - cores = 2 - memory = "2048" - drive = 20 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["41", "42", "43"] - } -} diff --git a/infra/terraform/pihole.tf b/infra/terraform/pihole.tf deleted file mode 100644 index ced2aac..0000000 --- a/infra/terraform/pihole.tf +++ /dev/null @@ -1,57 +0,0 @@ -resource "proxmox_vm_qemu" "pihole" { - count = local.pihole.count - ciuser = "administrator" - vmid = "${local.vlan}${local.pihole.ip[count.index]}" - name = local.pihole.name[count.index] - target_node = local.pihole.node[count.index] - clone = local.template - tags = local.pihole.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.pihole.cores - sockets = 1 - cpu_type = "host" - memory = local.pihole.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.pihole.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.pihole.drive - format = local.format - storage = local.pihole.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.pihole.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/infra/terraform/postgres.tf b/infra/terraform/postgres.tf deleted file mode 100644 index 47b8daa..0000000 --- a/infra/terraform/postgres.tf +++ /dev/null @@ -1,116 +0,0 @@ -#resource "proxmox_vm_qemu" "haproxy" { -# count = local.haproxy.count -# ciuser = "administrator" -# vmid = "${local.vlan}${local.haproxy.ip[count.index]}" -# name = local.haproxy.name[count.index] -# target_node = local.haproxy.node[count.index] -# clone = local.template -# tags = local.haproxy.tags -# qemu_os = "l26" -# full_clone = true -# os_type = "cloud-init" -# agent = 1 -# cores = local.haproxy.cores -# sockets = 1 -# cpu_type = "host" -# memory = local.haproxy.memory -# scsihw = "virtio-scsi-pci" -# #bootdisk = "scsi0" -# boot = "order=virtio0" -# onboot = true -# sshkeys = local.sshkeys -# vga { -# type = "serial0" -# } -# serial { -# id = 0 -# type = "socket" -# } -# disks { -# ide { -# ide2 { -# cloudinit { -# storage = local.haproxy.storage -# } -# } -# } -# virtio { -# virtio0 { -# disk { -# size = local.haproxy.drive -# format = local.format -# storage = local.haproxy.storage -# } -# } -# } -# } -# network { -# id = 0 -# model = "virtio" -# bridge = "vmbr0" -# tag = local.vlan -# } -# #Cloud Init Settings -# ipconfig0 = "ip=192.168.${local.vlan}.${local.haproxy.ip[count.index]}/24,gw=192.168.${local.vlan}.1" -# searchdomain = "durp.loc" -# nameserver = local.dnsserver -#} -# -#resource "proxmox_vm_qemu" "postgres" { -# count = local.postgres.count -# ciuser = "administrator" -# vmid = "${local.vlan}${local.postgres.ip[count.index]}" -# name = local.postgres.name[count.index] -# target_node = local.postgres.node[count.index] -# clone = local.template -# tags = local.postgres.tags -# qemu_os = "l26" -# full_clone = true -# os_type = "cloud-init" -# agent = 1 -# cores = local.postgres.cores -# sockets = 1 -# cpu_type = "host" -# memory = local.postgres.memory -# scsihw = "virtio-scsi-pci" -# #bootdisk = "scsi0" -# boot = "order=virtio0" -# onboot = true -# sshkeys = local.sshkeys -# vga { -# type = "serial0" -# } -# serial { -# id = 0 -# type = "socket" -# } -# disks { -# ide { -# ide2 { -# cloudinit { -# storage = local.postgres.storage -# } -# } -# } -# virtio { -# virtio0 { -# disk { -# size = local.postgres.drive -# format = local.format -# storage = local.postgres.storage -# } -# } -# } -# } -# network { -# id = 0 -# model = "virtio" -# bridge = "vmbr0" -# tag = local.vlan -# } -# #Cloud Init Settings -# ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" -# searchdomain = "durp.loc" -# nameserver = local.dnsserver -#} -# \ No newline at end of file diff --git a/infra/terraform/variables.tf b/infra/terraform/variables.tf deleted file mode 100644 index 31a92e0..0000000 --- a/infra/terraform/variables.tf +++ /dev/null @@ -1,14 +0,0 @@ -variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string -} - -variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string -} - -variable "pm_user" { - description = "UIsername to Proxmox provider" - type = string -} diff --git a/master/argocd/Chart.yaml b/master/argocd/Chart.yaml deleted file mode 100644 index 647c3cf..0000000 --- a/master/argocd/Chart.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v2 -name: argocd -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: argo-cd - repository: https://argoproj.github.io/argo-helm - version: 8.1.3 - - diff --git a/master/argocd/templates/InternalProxy.yaml b/master/argocd/templates/InternalProxy.yaml deleted file mode 100644 index 76c8229..0000000 --- a/master/argocd/templates/InternalProxy.yaml +++ /dev/null @@ -1,23 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: internalproxy -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/internalproxy -# directory: -# recurse: true -# destination: -# server: https://kubernetes.default.svc -# namespace: internalproxy -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# diff --git a/master/argocd/templates/argocd.yaml b/master/argocd/templates/argocd.yaml deleted file mode 100644 index e93aa4f..0000000 --- a/master/argocd/templates/argocd.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: argocd - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/argocd - destination: - namespace: argocd - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: argocd-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`argocd.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: argocd-server - port: 443 - scheme: https - tls: - secretName: argocd-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: argocd-tls -spec: - secretName: argocd-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "argocd.internal.durp.info" - dnsNames: - - "argocd.internal.durp.info" diff --git a/master/argocd/templates/authentik.yaml b/master/argocd/templates/authentik.yaml deleted file mode 100644 index 8d003fb..0000000 --- a/master/argocd/templates/authentik.yaml +++ /dev/null @@ -1,21 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: authentik -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/authentik -# destination: -# namespace: authentik -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# diff --git a/master/argocd/templates/bitwarden.yaml b/master/argocd/templates/bitwarden.yaml deleted file mode 100644 index ed56924..0000000 --- a/master/argocd/templates/bitwarden.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: bitwarden - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/bitwarden - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: bitwarden - syncPolicy: - automated: - prune: true - selfHeal: false - syncOptions: - - CreateNamespace=true - diff --git a/master/argocd/templates/cert-manager.yaml b/master/argocd/templates/cert-manager.yaml deleted file mode 100644 index fc11c13..0000000 --- a/master/argocd/templates/cert-manager.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: cert-manager - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/cert-manager - destination: - namespace: cert-manager - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/crossplane.yml b/master/argocd/templates/crossplane.yml deleted file mode 100644 index 21d8835..0000000 --- a/master/argocd/templates/crossplane.yml +++ /dev/null @@ -1,20 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: crossplane -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/crossplane -# destination: -# namespace: crossplane -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true diff --git a/master/argocd/templates/durpapi.yaml b/master/argocd/templates/durpapi.yaml deleted file mode 100644 index aeefcc1..0000000 --- a/master/argocd/templates/durpapi.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: durpapi - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/durpapi - destination: - namespace: durpapi - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/durpot.yaml b/master/argocd/templates/durpot.yaml deleted file mode 100644 index 7a97eb4..0000000 --- a/master/argocd/templates/durpot.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: durpot - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/durpot - destination: - namespace: durpot - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/external-dns.yaml b/master/argocd/templates/external-dns.yaml deleted file mode 100644 index 5cf21a5..0000000 --- a/master/argocd/templates/external-dns.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: external-dns - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/external-dns - destination: - namespace: external-dns - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/external-secrets.yaml b/master/argocd/templates/external-secrets.yaml deleted file mode 100644 index 04f8f1d..0000000 --- a/master/argocd/templates/external-secrets.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: external-secrets - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/external-secrets - destination: - namespace: external-secrets - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/gatekeeper.yaml b/master/argocd/templates/gatekeeper.yaml deleted file mode 100644 index e50e284..0000000 --- a/master/argocd/templates/gatekeeper.yaml +++ /dev/null @@ -1,20 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: gatekeeper -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/gatekeeper -# destination: -# namespace: gatekeeper -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true diff --git a/master/argocd/templates/gitlab-runner.yaml b/master/argocd/templates/gitlab-runner.yaml deleted file mode 100644 index 8a1afec..0000000 --- a/master/argocd/templates/gitlab-runner.yaml +++ /dev/null @@ -1,21 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: gitlab-runner -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/gitlab-runner -# destination: -# namespace: gitlab-runner -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# diff --git a/master/argocd/templates/heimdall.yaml b/master/argocd/templates/heimdall.yaml deleted file mode 100644 index 333a761..0000000 --- a/master/argocd/templates/heimdall.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: heimdall - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/heimdall - destination: - namespace: heimdall - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/krakend.yaml b/master/argocd/templates/krakend.yaml deleted file mode 100644 index e5ed113..0000000 --- a/master/argocd/templates/krakend.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: krakend - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/krakend - destination: - namespace: krakend - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/kube-prometheus-stack.yaml b/master/argocd/templates/kube-prometheus-stack.yaml deleted file mode 100644 index 2de63f1..0000000 --- a/master/argocd/templates/kube-prometheus-stack.yaml +++ /dev/null @@ -1,22 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: kube-prometheus-stack -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/kube-prometheus-stack -# destination: -# namespace: kube-prometheus-stack -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# -# \ No newline at end of file diff --git a/master/argocd/templates/kubeclarity.yaml b/master/argocd/templates/kubeclarity.yaml deleted file mode 100644 index b202df7..0000000 --- a/master/argocd/templates/kubeclarity.yaml +++ /dev/null @@ -1,21 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: kubeclarity -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/kubeclarity -# destination: -# namespace: kubeclarity -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# \ No newline at end of file diff --git a/master/argocd/templates/littlelink.yaml b/master/argocd/templates/littlelink.yaml deleted file mode 100644 index 856ac87..0000000 --- a/master/argocd/templates/littlelink.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: littlelink - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/littlelink - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: littlelink - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/longhorn.yaml b/master/argocd/templates/longhorn.yaml deleted file mode 100644 index 1e857c5..0000000 --- a/master/argocd/templates/longhorn.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: longhorn-system - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/longhorn - destination: - namespace: longhorn-system - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/master/argocd/templates/metallb-system.yaml b/master/argocd/templates/metallb-system.yaml deleted file mode 100644 index d343453..0000000 --- a/master/argocd/templates/metallb-system.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: metallb-system - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/metallb-system - destination: - namespace: metallb-system - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - - diff --git a/master/argocd/templates/nfs-client.yaml b/master/argocd/templates/nfs-client.yaml deleted file mode 100644 index a299095..0000000 --- a/master/argocd/templates/nfs-client.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: nfs-client - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/nfs-client - directory: - recurse: true - destination: - namespace: nfs-client - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/master/argocd/templates/open-webui.yaml b/master/argocd/templates/open-webui.yaml deleted file mode 100644 index bae227f..0000000 --- a/master/argocd/templates/open-webui.yaml +++ /dev/null @@ -1,21 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: open-webui -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/open-webui -# destination: -# namespace: open-webui -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# \ No newline at end of file diff --git a/master/argocd/templates/secrets.yaml b/master/argocd/templates/secrets.yaml deleted file mode 100644 index ee58a80..0000000 --- a/master/argocd/templates/secrets.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: vault-argocd - labels: - app.kubernetes.io/part-of: argocd -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: client-secret - data: - - secretKey: clientSecret - remoteRef: - key: secrets/argocd/authentik - property: clientsecret diff --git a/master/argocd/templates/traefik.yaml b/master/argocd/templates/traefik.yaml deleted file mode 100644 index e336d57..0000000 --- a/master/argocd/templates/traefik.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: traefik - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/traefik - destination: - namespace: traefik - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/uptimekuma.yaml b/master/argocd/templates/uptimekuma.yaml deleted file mode 100644 index 1d2c5e6..0000000 --- a/master/argocd/templates/uptimekuma.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: uptimekuma - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/uptimekuma - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: uptimekuma - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/master/argocd/templates/vault.yaml b/master/argocd/templates/vault.yaml deleted file mode 100644 index 6f21f08..0000000 --- a/master/argocd/templates/vault.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: vault - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/vault - destination: - namespace: vault - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - ignoreDifferences: - - group: admissionregistration.k8s.io - kind: MutatingWebhookConfiguration - jqPathExpressions: - - .webhooks[]?.clientConfig.caBundle diff --git a/master/argocd/values.yaml b/master/argocd/values.yaml deleted file mode 100644 index 82b19ac..0000000 --- a/master/argocd/values.yaml +++ /dev/null @@ -1,62 +0,0 @@ -argo-cd: - - global: - revisionHistoryLimit: 1 - image: - repository: registry.durp.info/argoproj/argocd - imagePullPolicy: Always - - server: - #extraArgs: - # - --dex-server-plaintext - # - --dex-server=argocd-dex-server:5556 - # oidc.config: | - # name: AzureAD - # issuer: https://login.microsoftonline.com/TENANT_ID/v2.0 - # clientID: CLIENT_ID - # clientSecret: $oidc.azuread.clientSecret - # requestedIDTokenClaims: - # groups: - # essential: true - # requestedScopes: - # - openid - # - profile - # - email - - dex: - enabled: true - image: - repository: registry.durp.info/dexidp/dex - imagePullPolicy: Always - - configs: - cm: - create: true - annotations: {} - url: https://argocd.internal.durp.info - oidc.tls.insecure.skip.verify: "true" - dex.config: | - connectors: - - config: - issuer: https://authentik.durp.info/application/o/argocd/ - clientID: dbb8ffc06104fb6e7fac3e4ae7fafb1d90437625 - clientSecret: $client-secret:clientSecret - insecureEnableGroups: true - scopes: - - openid - - profile - - email - - groups - name: authentik - type: oidc - id: authentik - - rbac: - create: true - policy.csv: | - g, ArgoCD Admins, role:admin - scopes: "[groups]" - - server: - route: - enabled: false diff --git a/master/authentik/Chart.yaml b/master/authentik/Chart.yaml deleted file mode 100644 index e357c64..0000000 --- a/master/authentik/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: authentik -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: authentik-remote-cluster - repository: https://charts.goauthentik.io - version: 2.1.0 diff --git a/master/authentik/templates/authentik-pv.yaml b/master/authentik/templates/authentik-pv.yaml deleted file mode 100644 index 8fbc2e2..0000000 --- a/master/authentik/templates/authentik-pv.yaml +++ /dev/null @@ -1,24 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolume -#metadata: -# annotations: -# pv.kubernetes.io/provisioned-by: durp.info/nfs -# finalizers: -# - kubernetes.io/pv-protection -# name: authentik-pv -#spec: -# accessModes: -# - ReadWriteMany -# capacity: -# storage: 10Gi -# claimRef: -# apiVersion: v1 -# kind: PersistentVolumeClaim -# name: authentik-pvc -# namespace: authentik -# nfs: -# path: /mnt/user/k3s/authentik -# server: 192.168.20.253 -# persistentVolumeReclaimPolicy: Retain -# storageClassName: nfs-storage -# volumeMode: Filesystem diff --git a/master/authentik/templates/authentik-pvc.yaml b/master/authentik/templates/authentik-pvc.yaml deleted file mode 100644 index f22640b..0000000 --- a/master/authentik/templates/authentik-pvc.yaml +++ /dev/null @@ -1,18 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolumeClaim -#metadata: -# labels: -# app.kubernetes.io/component: app -# app.kubernetes.io/instance: authentik -# app.kubernetes.io/managed-by: Helm -# app.kubernetes.io/name: authentik -# helm.sh/chart: authentik-2.14.4 -# name: authentik-pvc -# namespace: authentik -#spec: -# accessModes: -# - ReadWriteMany -# resources: -# requests: -# storage: 10Gi -# storageClassName: nfs-storage \ No newline at end of file diff --git a/master/authentik/templates/ingress.yaml b/master/authentik/templates/ingress.yaml deleted file mode 100644 index 83e1efa..0000000 --- a/master/authentik/templates/ingress.yaml +++ /dev/null @@ -1,60 +0,0 @@ -#apiVersion: traefik.containo.us/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: authentik-server -# port: 80 -# tls: -# secretName: authentik-tls -# ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - secretName: authentik-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "outpost.internal.durp.info" - dnsNames: - - "outpost.internal.durp.info" - -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: authentik-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -#spec: -# type: ExternalName -# externalName: durp.info - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: outpost-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`outpost.internal.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: ak-outpost-master-embedded-outpost - port: 9000 - tls: - secretName: authentik-tls diff --git a/master/authentik/templates/secrets.yaml b/master/authentik/templates/secrets.yaml deleted file mode 100644 index 52df8b1..0000000 --- a/master/authentik/templates/secrets.yaml +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: authentik-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: db-pass - data: - - secretKey: dbpass - remoteRef: - key: secrets/authentik/database - property: dbpass - - secretKey: secretkey - remoteRef: - key: secrets/authentik/database - property: secretkey - - secretKey: postgresql-postgres-password - remoteRef: - key: secrets/authentik/database - property: dbpass - - secretKey: postgresql-password - remoteRef: - key: secrets/authentik/database - property: dbpass - diff --git a/master/authentik/values.yaml b/master/authentik/values.yaml deleted file mode 100644 index 83be2f9..0000000 --- a/master/authentik/values.yaml +++ /dev/null @@ -1,30 +0,0 @@ -authentik-remote-cluster: - # -- Provide a name in place of `authentik`. Prefer using global.nameOverride if possible - nameOverride: "" - # -- String to fully override `"authentik.fullname"`. Prefer using global.fullnameOverride if possible - fullnameOverride: "" - # -- Override the Kubernetes version, which is used to evaluate certain manifests - kubeVersionOverride: "" - - ## Globally shared configuration for authentik components. - global: - # -- Provide a name in place of `authentik` - nameOverride: "" - # -- String to fully override `"authentik.fullname"` - fullnameOverride: "" - # -- A custom namespace to override the default namespace for the deployed resources. - namespaceOverride: "" - # -- Common labels for all resources. - additionalLabels: {} - # app: authentik - - # -- Annotations to apply to all resources - annotations: {} - - serviceAccountSecret: - # -- Create a secret with the service account credentials - enabled: true - - clusterRole: - # -- Create a clusterole in addition to a namespaced role. - enabled: true diff --git a/master/bitwarden/Chart.yaml b/master/bitwarden/Chart.yaml deleted file mode 100644 index cfdd821..0000000 --- a/master/bitwarden/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: bitwarden -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" diff --git a/master/bitwarden/templates/bitwarden-pv.yaml b/master/bitwarden/templates/bitwarden-pv.yaml deleted file mode 100644 index ff647d1..0000000 --- a/master/bitwarden/templates/bitwarden-pv.yaml +++ /dev/null @@ -1,25 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolume -#metadata: -# annotations: -# pv.kubernetes.io/provisioned-by: durp.info/nfs -# finalizers: -# - kubernetes.io/pv-protection -# name: bitwarden-pv -#spec: -# accessModes: -# - ReadWriteMany -# capacity: -# storage: 10Gi -# claimRef: -# apiVersion: v1 -# kind: PersistentVolumeClaim -# name: bitwarden-pvc -# namespace: bitwarden -# nfs: -# path: /mnt/user/k3s/bitwarden -# server: 192.168.20.253 -# persistentVolumeReclaimPolicy: Retain -# storageClassName: nfs-storage -# volumeMode: Filesystem -# \ No newline at end of file diff --git a/master/bitwarden/templates/bitwarden-pvc.yaml b/master/bitwarden/templates/bitwarden-pvc.yaml deleted file mode 100644 index 333af4d..0000000 --- a/master/bitwarden/templates/bitwarden-pvc.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: bitwarden-pvc -spec: - storageClassName: longhorn - accessModes: - - ReadWriteMany - resources: - requests: - storage: 10Gi diff --git a/master/bitwarden/templates/deployment.yaml b/master/bitwarden/templates/deployment.yaml deleted file mode 100644 index f787ba1..0000000 --- a/master/bitwarden/templates/deployment.yaml +++ /dev/null @@ -1,50 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: bitwarden - name: bitwarden - labels: - app: bitwarden -spec: - selector: - matchLabels: - app: bitwarden - replicas: 1 - template: - metadata: - labels: - app: bitwarden - spec: - containers: - - name: bitwarden - image: registry.durp.info/vaultwarden/server:1.32.7 - imagePullPolicy: Always - volumeMounts: - - name: bitwarden-pvc - mountPath: /data - subPath: bitwaren-data - ports: - - name: http - containerPort: 80 - env: - - name: SIGNUPS_ALLOWED - value: "FALSE" - - name: INVITATIONS_ALLOWED - value: "FALSE" - - name: WEBSOCKET_ENABLED - value: "TRUE" - - name: ROCKET_ENV - value: "staging" - - name: ROCKET_PORT - value: "80" - - name: ROCKET_WORKERS - value: "10" - - name: SECRET_USERNAME - valueFrom: - secretKeyRef: - name: bitwarden-secret - key: ADMIN_TOKEN - volumes: - - name: bitwarden-pvc - persistentVolumeClaim: - claimName: bitwarden-pvc diff --git a/master/bitwarden/templates/ingress.yaml b/master/bitwarden/templates/ingress.yaml deleted file mode 100644 index 8a9a628..0000000 --- a/master/bitwarden/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: bitwarden-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: bitwarden - port: 80 - tls: - secretName: bitwarden-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: bitwarden-tls -spec: - secretName: bitwarden-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "bitwarden.durp.info" - dnsNames: - - "bitwarden.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: bitwarden-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/master/bitwarden/templates/secrets.yaml b/master/bitwarden/templates/secrets.yaml deleted file mode 100644 index a5a9e44..0000000 --- a/master/bitwarden/templates/secrets.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: bitwarden-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: bitwarden-secret - data: - - secretKey: ADMIN_TOKEN - remoteRef: - key: secrets/bitwarden/admin - property: ADMIN_TOKEN - diff --git a/master/bitwarden/templates/service.yaml b/master/bitwarden/templates/service.yaml deleted file mode 100644 index df30857..0000000 --- a/master/bitwarden/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: bitwarden -spec: - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP - selector: - app: bitwarden \ No newline at end of file diff --git a/master/cert-manager/Chart.yaml b/master/cert-manager/Chart.yaml deleted file mode 100644 index 7280af8..0000000 --- a/master/cert-manager/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: cert-manager -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: cert-manager - repository: https://charts.jetstack.io - version: v1.17.2 diff --git a/master/cert-manager/templates/letsencrypt-prroduction.yaml b/master/cert-manager/templates/letsencrypt-prroduction.yaml deleted file mode 100644 index 034ed9b..0000000 --- a/master/cert-manager/templates/letsencrypt-prroduction.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-production -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-production - solvers: - - dns01: - cloudflare: - email: developerdurp@durp.info - apiTokenSecretRef: - name: cloudflare-api-token-secret - key: cloudflare-api-token-secret diff --git a/master/cert-manager/templates/letsencrypt-staging.yaml b/master/cert-manager/templates/letsencrypt-staging.yaml deleted file mode 100644 index b6ae4f9..0000000 --- a/master/cert-manager/templates/letsencrypt-staging.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-staging -spec: - acme: - server: https://acme-staging-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-staging - solvers: - - dns01: - cloudflare: - email: developerdurp@durp.info - apiTokenSecretRef: - name: cloudflare-api-token-secret - key: cloudflare-api-token-secret \ No newline at end of file diff --git a/master/cert-manager/templates/sealedsecret.yaml b/master/cert-manager/templates/sealedsecret.yaml deleted file mode 100644 index a85ea4e..0000000 --- a/master/cert-manager/templates/sealedsecret.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: cloudflare-api-token-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: cloudflare-api-token-secret - data: - - secretKey: cloudflare-api-token-secret - remoteRef: - key: secrets/cert-manager - property: cloudflare-api-token-secret - diff --git a/master/cert-manager/values.yaml b/master/cert-manager/values.yaml deleted file mode 100644 index 36f403b..0000000 --- a/master/cert-manager/values.yaml +++ /dev/null @@ -1,25 +0,0 @@ -cert-manager: - image: - registry: registry.internal.durp.info - repository: jetstack/cert-manager-controller - pullPolicy: Always - installCRDs: true - replicaCount: 3 - extraArgs: - - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 - - --dns01-recursive-nameservers-only - podDnsPolicy: None - podDnsConfig: - nameservers: - - "1.1.1.1" - - "1.0.0.1" - webhook: - image: - registry: registry.internal.durp.info - repository: jetstack/cert-manager-webhook - pullPolicy: Always - cainjector: - image: - registry: registry.internal.durp.info - repository: jetstack/cert-manager-cainjector - pullPolicy: Always \ No newline at end of file diff --git a/master/crossplane/Chart.yaml b/master/crossplane/Chart.yaml deleted file mode 100644 index e725e88..0000000 --- a/master/crossplane/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: crossplane -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: crossplane - repository: https://charts.crossplane.io/stable - version: 1.20.0 diff --git a/master/crossplane/templates/gitlab.yml b/master/crossplane/templates/gitlab.yml deleted file mode 100644 index 0211b82..0000000 --- a/master/crossplane/templates/gitlab.yml +++ /dev/null @@ -1,55 +0,0 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-gitlab -spec: - package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 ---- - -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: gitlab-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: gitlab-secret - data: - - secretKey: accesstoken - remoteRef: - key: secrets/gitlab/token - property: accesstoken - ---- - -#apiVersion: gitlab.crossplane.io/v1beta1 -#kind: ProviderConfig -#metadata: -# name: gitlab-provider -#spec: -# baseURL: https://gitlab.com/ -# credentials: -# source: Secret -# secretRef: -# namespace: crossplane -# name: gitlab-secret -# key: accesstoken -# -#--- -# -#apiVersion: projects.gitlab.crossplane.io/v1alpha1 -#kind: Project -#metadata: -# name: example-project -#spec: -# deletionPolicy: Orphan -# forProvider: -# name: "Example Project" -# description: "example project description" -# providerConfigRef: -# name: gitlab-provider -# policy: -# resolution: Optional -# resolve: Always diff --git a/master/dashboards/nginx-dashboard.yaml b/master/dashboards/nginx-dashboard.yaml deleted file mode 100644 index 333a6c5..0000000 --- a/master/dashboards/nginx-dashboard.yaml +++ /dev/null @@ -1,1506 +0,0 @@ -apiVersion: v1 -data: - nginx-ingress-controller_rev1.json: |- - { - "annotations": { - "list": [ - { - "builtIn": 1, - "datasource": { - "type": "datasource", - "uid": "grafana" - }, - "enable": true, - "hide": true, - "iconColor": "rgba(0, 211, 255, 1)", - "name": "Annotations & Alerts", - "target": { - "limit": 100, - "matchAny": false, - "tags": [], - "type": "dashboard" - }, - "type": "dashboard" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "enable": true, - "expr": "sum(changes(nginx_ingress_controller_config_last_reload_successful_timestamp_seconds{instance!=\"unknown\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[30s])) by (controller_class)", - "hide": false, - "iconColor": "rgba(255, 96, 96, 1)", - "limit": 100, - "name": "Config Reloads", - "showIn": 0, - "step": "30s", - "tagKeys": "controller_class", - "tags": [], - "titleFormat": "Config Reloaded", - "type": "tags" - } - ] - }, - "description": "Ingress-nginx supports a rich collection of prometheus metrics. If you have prometheus and grafana installed on your cluster then prometheus will already be scraping this data due to the scrape annotation on the deployment.", - "editable": true, - "fiscalYearStartMonth": 0, - "gnetId": 9614, - "graphTooltip": 0, - "id": 27, - "links": [], - "liveNow": false, - "panels": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "ops" - }, - "overrides": [] - }, - "id": 20, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "round(sum(irate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[2m])), 0.001)", - "format": "time_series", - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Controller Request Volume", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "none" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 6, - "x": 6, - "y": 0 - }, - "id": 82, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(avg_over_time(nginx_ingress_controller_nginx_process_connections{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "instant": false, - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Controller Connections", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "rgba(245, 54, 54, 0.9)", - "value": null - }, - { - "color": "rgba(237, 129, 40, 0.89)", - "value": 95 - }, - { - "color": "rgba(50, 172, 45, 0.97)", - "value": 99 - } - ] - }, - "unit": "percentunit" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 6, - "x": 12, - "y": 0 - }, - "id": 21, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",status!~\"[4-5].*\"}[2m])) / sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Controller Success Rate (non-4|5xx responses)", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "decimals": 0, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "none" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 3, - "x": 18, - "y": 0 - }, - "id": 81, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "avg(nginx_ingress_controller_success{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"})", - "format": "time_series", - "instant": true, - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Config Reloads", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "decimals": 0, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "none" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 3, - "x": 21, - "y": 0 - }, - "id": 83, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "count(nginx_ingress_controller_config_last_reload_successful{controller_pod=~\"$controller\",controller_namespace=~\"$namespace\"} == 0)", - "format": "time_series", - "instant": true, - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Last Config Failed", - "type": "stat" - }, - { - "aliasColors": {}, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": true, - "error": false, - "fill": 1, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 7, - "w": 12, - "x": 0, - "y": 3 - }, - "height": "200px", - "hiddenSeries": false, - "id": 86, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": false, - "hideEmpty": false, - "hideZero": true, - "max": false, - "min": false, - "rightSide": true, - "show": true, - "sideWidth": 300, - "sort": "current", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "repeatDirection": "h", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "round(sum(irate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress), 0.001)", - "format": "time_series", - "hide": false, - "instant": false, - "interval": "", - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "metric": "network", - "refId": "A", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Ingress Request Volume", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 2, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "reqps", - "logBase": 1, - "show": true - }, - { - "format": "Bps", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": { - "max - istio-proxy": "#890f02", - "max - master": "#bf1b00", - "max - prometheus": "#bf1b00" - }, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": false, - "error": false, - "fill": 0, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 7, - "w": 12, - "x": 12, - "y": 3 - }, - "hiddenSeries": false, - "id": 87, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": false, - "hideEmpty": true, - "hideZero": false, - "max": false, - "min": false, - "rightSide": true, - "show": true, - "sideWidth": 300, - "sort": "avg", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",ingress=~\"$ingress\",status!~\"[4-5].*\"}[2m])) by (ingress) / sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", - "format": "time_series", - "instant": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "metric": "container_memory_usage:sort_desc", - "refId": "A", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Ingress Success Rate (non-4|5xx responses)", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 1, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "percentunit", - "logBase": 1, - "show": true - }, - { - "format": "short", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": {}, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": true, - "error": false, - "fill": 1, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 6, - "w": 8, - "x": 0, - "y": 10 - }, - "height": "200px", - "hiddenSeries": false, - "id": 32, - "isNew": true, - "legend": { - "alignAsTable": false, - "avg": true, - "current": true, - "max": false, - "min": false, - "rightSide": false, - "show": false, - "sideWidth": 200, - "sort": "current", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum (irate (nginx_ingress_controller_request_size_sum{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "instant": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "Received", - "metric": "network", - "refId": "A", - "step": 10 - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "- sum (irate (nginx_ingress_controller_response_size_sum{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "hide": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "Sent", - "metric": "network", - "refId": "B", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Network I/O pressure", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 0, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "Bps", - "logBase": 1, - "show": true - }, - { - "format": "Bps", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": { - "max - istio-proxy": "#890f02", - "max - master": "#bf1b00", - "max - prometheus": "#bf1b00" - }, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": false, - "error": false, - "fill": 0, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 6, - "w": 8, - "x": 8, - "y": 10 - }, - "hiddenSeries": false, - "id": 77, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": true, - "max": false, - "min": false, - "rightSide": false, - "show": false, - "sideWidth": 200, - "sort": "current", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "avg(nginx_ingress_controller_nginx_process_resident_memory_bytes{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}) ", - "format": "time_series", - "instant": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "nginx", - "metric": "container_memory_usage:sort_desc", - "refId": "A", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Average Memory Usage", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 2, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "bytes", - "logBase": 1, - "show": true - }, - { - "format": "short", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": { - "max - istio-proxy": "#890f02", - "max - master": "#bf1b00" - }, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 3, - "editable": false, - "error": false, - "fill": 0, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 6, - "w": 8, - "x": 16, - "y": 10 - }, - "height": "", - "hiddenSeries": false, - "id": 79, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": true, - "max": false, - "min": false, - "rightSide": false, - "show": false, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum (rate (nginx_ingress_controller_nginx_process_cpu_seconds_total{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m])) ", - "format": "time_series", - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "nginx", - "metric": "container_cpu", - "refId": "A", - "step": 10 - } - ], - "thresholds": [ - { - "colorMode": "critical", - "fill": true, - "line": true, - "op": "gt" - } - ], - "timeRegions": [], - "title": "Average CPU Usage", - "tooltip": { - "msResolution": true, - "shared": true, - "sort": 2, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "none", - "label": "cores", - "logBase": 1, - "show": true - }, - { - "format": "short", - "logBase": 1, - "show": true - } - ], - "yaxis": { - "align": false - } - }, - { - "columns": [], - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fontSize": "100%", - "gridPos": { - "h": 8, - "w": 24, - "x": 0, - "y": 16 - }, - "hideTimeOverride": false, - "id": 75, - "links": [], - "pageSize": 7, - "repeatDirection": "h", - "scroll": true, - "showHeader": true, - "sort": { - "col": 1, - "desc": true - }, - "styles": [ - { - "alias": "Ingress", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "ingress", - "preserveFormat": false, - "sanitize": false, - "thresholds": [], - "type": "string", - "unit": "short" - }, - { - "alias": "Requests", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Value #A", - "thresholds": [ - "" - ], - "type": "number", - "unit": "ops" - }, - { - "alias": "Errors", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Value #B", - "thresholds": [], - "type": "number", - "unit": "ops" - }, - { - "alias": "P50 Latency", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "link": false, - "pattern": "Value #C", - "thresholds": [], - "type": "number", - "unit": "dtdurations" - }, - { - "alias": "P90 Latency", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "pattern": "Value #D", - "thresholds": [], - "type": "number", - "unit": "dtdurations" - }, - { - "alias": "P99 Latency", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "pattern": "Value #E", - "thresholds": [], - "type": "number", - "unit": "dtdurations" - }, - { - "alias": "IN", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Value #F", - "thresholds": [ - "" - ], - "type": "number", - "unit": "Bps" - }, - { - "alias": "", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Time", - "thresholds": [], - "type": "hidden", - "unit": "short" - }, - { - "alias": "OUT", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "Value #G", - "thresholds": [], - "type": "number", - "unit": "Bps" - } - ], - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "histogram_quantile(0.50, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", - "format": "table", - "hide": false, - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "C" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "histogram_quantile(0.90, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", - "format": "table", - "hide": false, - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "D" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "histogram_quantile(0.99, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", - "format": "table", - "hide": false, - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ destination_service }}", - "refId": "E" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(irate(nginx_ingress_controller_request_size_sum{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", - "format": "table", - "hide": false, - "instant": true, - "interval": "", - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "F" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(irate(nginx_ingress_controller_response_size_sum{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", - "format": "table", - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "G" - } - ], - "title": "Ingress Percentile Response Times and Transfer Rates", - "transform": "table", - "type": "table-old" - }, - { - "columns": [ - { - "text": "Current", - "value": "current" - } - ], - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fontSize": "100%", - "gridPos": { - "h": 8, - "w": 24, - "x": 0, - "y": 24 - }, - "height": "1024", - "id": 85, - "links": [], - "pageSize": 7, - "scroll": true, - "showHeader": true, - "sort": { - "col": 1, - "desc": false - }, - "styles": [ - { - "alias": "Time", - "align": "auto", - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "pattern": "Time", - "type": "date" - }, - { - "alias": "TTL", - "align": "auto", - "colorMode": "cell", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "pattern": "Current", - "thresholds": [ - "0", - "691200" - ], - "type": "number", - "unit": "s" - }, - { - "alias": "", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "decimals": 2, - "pattern": "/.*/", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "avg(nginx_ingress_controller_ssl_expire_time_seconds{kubernetes_pod_name=~\"$controller\",namespace=~\"$namespace\",ingress=~\"$ingress\"}) by (host) - time()", - "format": "time_series", - "intervalFactor": 1, - "legendFormat": "{{ host }}", - "metric": "gke_letsencrypt_cert_expiration", - "refId": "A", - "step": 1 - } - ], - "title": "Ingress Certificate Expiry", - "transform": "timeseries_aggregations", - "type": "table-old" - } - ], - "refresh": "5s", - "schemaVersion": 37, - "style": "dark", - "tags": [ - "nginx" - ], - "templating": { - "list": [ - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Namespace", - "multi": false, - "name": "namespace", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_config_hash, controller_namespace)", - "refId": "Prometheus-namespace-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 0, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - }, - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Controller Class", - "multi": false, - "name": "controller_class", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_config_hash{namespace=~\"$namespace\"}, controller_class) ", - "refId": "Prometheus-controller_class-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 0, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - }, - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Controller", - "multi": false, - "name": "controller", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_config_hash{namespace=~\"$namespace\",controller_class=~\"$controller_class\"}, controller_pod) ", - "refId": "Prometheus-controller-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 0, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - }, - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Ingress", - "multi": false, - "name": "ingress", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_requests{namespace=~\"$namespace\",controller_class=~\"$controller_class\",controller=~\"$controller\"}, ingress) ", - "refId": "Prometheus-ingress-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 2, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - } - ] - }, - "time": { - "from": "now-1h", - "to": "now" - }, - "timepicker": { - "refresh_intervals": [ - "5s", - "10s", - "30s", - "2m", - "5m", - "15m", - "30m", - "1h", - "2h", - "1d" - ], - "time_options": [ - "5m", - "15m", - "1h", - "6h", - "12h", - "24h", - "2d", - "7d", - "30d" - ] - }, - "timezone": "browser", - "title": "NGINX Ingress controller", - "uid": "nginx", - "version": 1, - "weekStart": "" - } -kind: ConfigMap -metadata: - labels: - grafana_dashboard: "1" - creationTimestamp: null - name: nginx-dashboard - namespace: kube-prometheus-stack \ No newline at end of file diff --git a/master/durpapi/Chart.yaml b/master/durpapi/Chart.yaml deleted file mode 100644 index da0c67e..0000000 --- a/master/durpapi/Chart.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v2 -name: durpapi -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0-dev0184 -appVersion: 0.1.0 - -dependencies: -- condition: postgresql.enabled - version: 16.7.* - repository: https://charts.bitnami.com/bitnami - name: postgresql diff --git a/master/durpapi/templates/deployment.yaml b/master/durpapi/templates/deployment.yaml deleted file mode 100644 index 0f42dfb..0000000 --- a/master/durpapi/templates/deployment.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ .Chart.Name }} - labels: - app: {{ .Chart.Name }} -spec: - revisionHistoryLimit: 1 - selector: - matchLabels: - app: {{ .Chart.Name }} - replicas: {{ .Values.deployment.hpa.minReplicas }} - template: - metadata: - labels: - app: {{ .Chart.Name }} - spec: - containers: - - name: api - image: "{{ .Values.deployment.image }}:{{ default .Chart.Version .Values.deployment.tag }}" - imagePullPolicy: {{ .Values.deployment.imagePullPolicy }} - readinessProbe: - {{- toYaml .Values.deployment.probe.readiness | nindent 12 }} - livenessProbe: - {{- toYaml .Values.deployment.probe.liveness | nindent 12 }} - startupProbe: - {{- toYaml .Values.deployment.probe.startup | nindent 12 }} - ports: - - name: http - containerPort: {{ .Values.service.targetport }} - env: - - name: host - value: {{ .Values.swagger.host }} - - name: version - value: {{ default .Chart.Version .Values.deployment.tag }} - envFrom: - - secretRef: - name: {{ .Values.deployment.secretfile }} diff --git a/master/durpapi/templates/hpa.yaml b/master/durpapi/templates/hpa.yaml deleted file mode 100644 index 68d484d..0000000 --- a/master/durpapi/templates/hpa.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: "{{ .Chart.Name }}-hpa" -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ .Chart.Name }} - minReplicas: {{ .Values.deployment.hpa.minReplicas }} - maxReplicas: {{ .Values.deployment.hpa.maxReplicas }} - metrics: - - type: Resource - resource: - name: memory - target: - type: Utilization - averageUtilization: 80 - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: 40 diff --git a/master/durpapi/templates/ingress.yaml b/master/durpapi/templates/ingress.yaml deleted file mode 100644 index bd268dd..0000000 --- a/master/durpapi/templates/ingress.yaml +++ /dev/null @@ -1,44 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: "{{ .Chart.Name }}-ingress" -spec: - entryPoints: - - websecure - routes: - - match: Host("api.durp.info") && PathPrefix(`/api`) - kind: Rule - middlewares: - - name: jwt - services: - - name: "durpapi-service" - port: 80 - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: "{{ .Chart.Name }}-swagger" -spec: - entryPoints: - - websecure - routes: - - match: Host("api.durp.info") && PathPrefix(`/swagger`) - kind: Rule - services: - - name: "durpapi-service" - port: 80 - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: jwt -spec: - plugin: - jwt: - Required: true - Keys: - - https://authentik.durp.info/application/o/api/jwks diff --git a/master/durpapi/templates/secrets.yaml b/master/durpapi/templates/secrets.yaml deleted file mode 100644 index 36946e9..0000000 --- a/master/durpapi/templates/secrets.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: durpapi-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: durpapi-secret - data: - - secretKey: db_host - remoteRef: - key: secrets/durpapi/postgres - property: db_host - - secretKey: db_port - remoteRef: - key: secrets/durpapi/postgres - property: db_port - - secretKey: db_pass - remoteRef: - key: secrets/durpapi/postgres - property: db_pass - - secretKey: db_user - remoteRef: - key: secrets/durpapi/postgres - property: db_user - - secretKey: db_sslmode - remoteRef: - key: secrets/durpapi/postgres - property: db_sslmode - - secretKey: db_name - remoteRef: - key: secrets/durpapi/postgres - property: db_name - - secretKey: llamaurl - remoteRef: - key: secrets/durpapi/llamaurl - property: llamaurl \ No newline at end of file diff --git a/master/durpapi/templates/service.yaml b/master/durpapi/templates/service.yaml deleted file mode 100644 index 2cab669..0000000 --- a/master/durpapi/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: "{{ .Chart.Name }}-service" -spec: - ports: - - name: http - port: {{ .Values.service.port }} - targetPort: {{ .Values.service.targetport }} - protocol: TCP - selector: - app: {{ .Chart.Name }} diff --git a/master/durpapi/values.yaml b/master/durpapi/values.yaml deleted file mode 100644 index 41b152b..0000000 --- a/master/durpapi/values.yaml +++ /dev/null @@ -1,39 +0,0 @@ -ingress: - enabled: false -deployment: - image: registry.durp.info/developerdurp/durpapi - secretfile: durpapi-secret - imagePullPolicy: Always - hpa: - minReplicas: 3 - maxReplicas: 10 - probe: - readiness: - httpGet: - path: /health/gethealth - port: 8080 - liveness: - httpGet: - path: /health/gethealth - port: 8080 - startup: - httpGet: - path: /health/gethealth - port: 8080 -service: - type: ClusterIP - port: 80 - targetport: 8080 - -swagger: - host: api.durp.info -postgresql: - enabled: true - auth: - existingSecret: durpapi-secret - secretKeys: - adminPasswordKey: db_pass - userPasswordKey: db_pass - replicationPasswordKey: db_pass - database: postgres - username: postgres diff --git a/master/durpot/Chart.yaml b/master/durpot/Chart.yaml deleted file mode 100644 index c21a834..0000000 --- a/master/durpot/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: durpapi -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: durpot - repository: https://gitlab.com/api/v4/projects/45025485/packages/helm/stable - version: 0.1.0-dev0038 diff --git a/master/durpot/templates/secrets.yaml b/master/durpot/templates/secrets.yaml deleted file mode 100644 index f51273c..0000000 --- a/master/durpot/templates/secrets.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: durpot-secert -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: durpot-secret - data: - - secretKey: OPENAI_API_KEY - remoteRef: - key: secrets/durpot/openai - property: OPENAI_API_KEY - - secretKey: BOTPREFIX - remoteRef: - key: secrets/durpot/discord - property: BOTPREFIX - - secretKey: ChannelID - remoteRef: - key: secrets/durpot/discord - property: ChannelID - - secretKey: TOKEN - remoteRef: - key: secrets/durpot/discord - property: TOKEN - - secretKey: ClientID - remoteRef: - key: secrets/durpot/auth - property: ClientID - - secretKey: Password - remoteRef: - key: secrets/durpot/auth - property: Password - - secretKey: TokenURL - remoteRef: - key: secrets/durpot/auth - property: TokenURL - - secretKey: Username - remoteRef: - key: secrets/durpot/auth - property: Username diff --git a/master/external-dns/Chart.yaml b/master/external-dns/Chart.yaml deleted file mode 100644 index 937bc49..0000000 --- a/master/external-dns/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ - -apiVersion: v2 -name: external-dns -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: external-dns - repository: https://charts.bitnami.com/bitnami - version: 8.9.2 diff --git a/master/external-dns/templates/secrets.yaml b/master/external-dns/templates/secrets.yaml deleted file mode 100644 index ba603aa..0000000 --- a/master/external-dns/templates/secrets.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: external-dns-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: external-dns - data: - - secretKey: cloudflare_api_email - remoteRef: - key: secrets/external-dns/cloudflare - property: cloudflare_api_email - - secretKey: cloudflare_api_key - remoteRef: - key: secrets/external-dns/cloudflare - property: cloudflare_api_key - - secretKey: cloudflare_api_token - remoteRef: - key: secrets/external-dns/cloudflare - property: cloudflare_api_token diff --git a/master/external-dns/values.yaml b/master/external-dns/values.yaml deleted file mode 100644 index 68abe91..0000000 --- a/master/external-dns/values.yaml +++ /dev/null @@ -1,16 +0,0 @@ -external-dns: - global: - imageRegistry: "registry.internal.durp.info" - - image: - pullPolicy: Always - - sources: - - service - - provider: cloudflare - cloudflare: - secretName : "external-dns" - proxied: false - - policy: sync diff --git a/master/external-secrets/Chart.yaml b/master/external-secrets/Chart.yaml deleted file mode 100644 index 94104aa..0000000 --- a/master/external-secrets/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: external-secrets -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: external-secrets - repository: https://charts.external-secrets.io - version: 0.17.0 - diff --git a/master/external-secrets/values.yaml b/master/external-secrets/values.yaml deleted file mode 100644 index a720adb..0000000 --- a/master/external-secrets/values.yaml +++ /dev/null @@ -1,463 +0,0 @@ -external-secrets: - replicaCount: 3 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 - - image: - repository: ghcr.io/external-secrets/external-secrets - pullPolicy: Always - # -- The image tag to use. The default is the chart appVersion. - # There are different image flavours available, like distroless and ubi. - # Please see GitHub release notes for image tags for these flavors. - # By default the distroless image is used. - tag: "" - - # -- If set, install and upgrade CRDs through helm chart. - installCRDs: true - - crds: - # -- If true, create CRDs for Cluster External Secret. - createClusterExternalSecret: true - # -- If true, create CRDs for Cluster Secret Store. - createClusterSecretStore: true - # -- If true, create CRDs for Push Secret. - createPushSecret: true - annotations: {} - conversion: - enabled: true - - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - - # -- If true, external-secrets will perform leader election between instances to ensure no more - # than one instance of external-secrets operates at a time. - leaderElect: true - - # -- If set external secrets will filter matching - # Secret Stores with the appropriate controller values. - controllerClass: "" - - # -- If true external secrets will use recommended kubernetes - # annotations as prometheus metric labels. - extendedMetricLabels: false - - # -- If set external secrets are only reconciled in the - # provided namespace - scopedNamespace: "" - - # -- Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace - # and implicitly disable cluster stores and cluster external secrets - scopedRBAC: false - - # -- if true, the operator will process cluster external secret. Else, it will ignore them. - processClusterExternalSecret: true - - # -- if true, the operator will process cluster store. Else, it will ignore them. - processClusterStore: true - - # -- Specifies whether an external secret operator deployment be created. - createOperator: true - - # -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at - # a time. - concurrent: 1 - - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - ## -- Extra containers to add to the pod. - extraContainers: [] - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- namespace where you want to install ServiceMonitors - namespace: "" - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - # -- Let prometheus add an exported_ prefix to conflicting labels - honorLabels: false - - # -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) - metricRelabelings: [] - # - action: replace - # regex: (.*) - # replacement: $1 - # sourceLabels: - # - exported_namespace - # targetLabel: namespace - - # -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) - relabelings: [] - # - sourceLabels: [__meta_kubernetes_pod_node_name] - # separator: ; - # regex: ^(.*)$ - # targetLabel: nodename - # replacement: $1 - # action: replace - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - - # -- Run the controller on the host network - hostNetwork: false - - webhook: - # -- Specifies whether a webhook deployment be created. - create: true - # -- Specifices the time to check if the cert is valid - certCheckInterval: "5m" - # -- Specifices the lookaheadInterval for certificate validity - lookaheadInterval: "" - replicaCount: 1 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 - - certDir: /tmp/certs - # -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore - failurePolicy: Fail - # -- Specifies if webhook pod should use hostNetwork or not. - hostNetwork: false - image: - repository: ghcr.io/external-secrets/external-secrets - pullPolicy: IfNotPresent - # -- The image tag to use. The default is the chart appVersion. - tag: "" - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - # -- The port the webhook will listen to - port: 10250 - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - - readinessProbe: - # -- Address for readiness probe - address: "" - # -- ReadinessProbe port for kubelet - port: 8081 - - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - # -- Annotations to add to Secret - secretAnnotations: {} - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - certController: - # -- Specifies whether a certificate controller deployment be created. - create: true - requeueInterval: "5m" - replicaCount: 1 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 - - image: - repository: ghcr.io/external-secrets/external-secrets - pullPolicy: Always - tag: "" - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Run the certController on the host network - hostNetwork: false - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - # -- Specifies `dnsOptions` to deployment - dnsConfig: {} diff --git a/master/gatekeeper/Chart.yaml b/master/gatekeeper/Chart.yaml deleted file mode 100644 index 4269281..0000000 --- a/master/gatekeeper/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: gatekeeper -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: gatekeeper - repository: https://open-policy-agent.github.io/gatekeeper/charts - version: 3.19.2 diff --git a/master/gatekeeper/values.yaml b/master/gatekeeper/values.yaml deleted file mode 100644 index 0b0c6e7..0000000 --- a/master/gatekeeper/values.yaml +++ /dev/null @@ -1,278 +0,0 @@ -#gatekeeper: -# replicas: 3 -# revisionHistoryLimit: 10 -# auditInterval: 60 -# metricsBackends: ["prometheus"] -# auditMatchKindOnly: false -# constraintViolationsLimit: 20 -# auditFromCache: false -# disableMutation: false -# disableValidatingWebhook: false -# validatingWebhookName: gatekeeper-validating-webhook-configuration -# validatingWebhookTimeoutSeconds: 3 -# validatingWebhookFailurePolicy: Ignore -# validatingWebhookAnnotations: {} -# validatingWebhookExemptNamespacesLabels: {} -# validatingWebhookObjectSelector: {} -# validatingWebhookCheckIgnoreFailurePolicy: Fail -# validatingWebhookCustomRules: {} -# validatingWebhookURL: null -# enableDeleteOperations: false -# enableExternalData: true -# enableGeneratorResourceExpansion: true -# enableTLSHealthcheck: false -# maxServingThreads: -1 -# mutatingWebhookName: gatekeeper-mutating-webhook-configuration -# mutatingWebhookFailurePolicy: Ignore -# mutatingWebhookReinvocationPolicy: Never -# mutatingWebhookAnnotations: {} -# mutatingWebhookExemptNamespacesLabels: {} -# mutatingWebhookObjectSelector: {} -# mutatingWebhookTimeoutSeconds: 1 -# mutatingWebhookCustomRules: {} -# mutatingWebhookURL: null -# mutationAnnotations: false -# auditChunkSize: 500 -# logLevel: INFO -# logDenies: false -# logMutations: false -# emitAdmissionEvents: false -# emitAuditEvents: false -# admissionEventsInvolvedNamespace: false -# auditEventsInvolvedNamespace: false -# resourceQuota: true -# externaldataProviderResponseCacheTTL: 3m -# image: -# repository: openpolicyagent/gatekeeper -# crdRepository: openpolicyagent/gatekeeper-crds -# release: v3.15.0-beta.0 -# pullPolicy: Always -# pullSecrets: [] -# preInstall: -# crdRepository: -# image: -# repository: null -# tag: v3.15.0-beta.0 -# postUpgrade: -# labelNamespace: -# enabled: false -# image: -# repository: openpolicyagent/gatekeeper-crds -# tag: v3.15.0-beta.0 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# extraNamespaces: [] -# podSecurity: ["pod-security.kubernetes.io/audit=restricted", -# "pod-security.kubernetes.io/audit-version=latest", -# "pod-security.kubernetes.io/warn=restricted", -# "pod-security.kubernetes.io/warn-version=latest", -# "pod-security.kubernetes.io/enforce=restricted", -# "pod-security.kubernetes.io/enforce-version=v1.24"] -# extraAnnotations: {} -# priorityClassName: "" -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: {} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# postInstall: -# labelNamespace: -# enabled: true -# extraRules: [] -# image: -# repository: openpolicyagent/gatekeeper-crds -# tag: v3.15.0-beta.0 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# extraNamespaces: [] -# podSecurity: ["pod-security.kubernetes.io/audit=restricted", -# "pod-security.kubernetes.io/audit-version=latest", -# "pod-security.kubernetes.io/warn=restricted", -# "pod-security.kubernetes.io/warn-version=latest", -# "pod-security.kubernetes.io/enforce=restricted", -# "pod-security.kubernetes.io/enforce-version=v1.24"] -# extraAnnotations: {} -# priorityClassName: "" -# probeWebhook: -# enabled: true -# image: -# repository: curlimages/curl -# tag: 7.83.1 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# waitTimeout: 60 -# httpTimeout: 2 -# insecureHTTPS: false -# priorityClassName: "" -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# preUninstall: -# deleteWebhookConfigurations: -# extraRules: [] -# enabled: false -# image: -# repository: openpolicyagent/gatekeeper-crds -# tag: v3.15.0-beta.0 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# priorityClassName: "" -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: {} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# podAnnotations: {} -# auditPodAnnotations: {} -# podLabels: {} -# podCountLimit: "100" -# secretAnnotations: {} -# enableRuntimeDefaultSeccompProfile: true -# controllerManager: -# exemptNamespaces: [] -# exemptNamespacePrefixes: [] -# hostNetwork: false -# dnsPolicy: ClusterFirst -# port: 8443 -# metricsPort: 8888 -# healthPort: 9090 -# readinessTimeout: 1 -# livenessTimeout: 1 -# priorityClassName: system-cluster-critical -# disableCertRotation: false -# tlsMinVersion: 1.3 -# clientCertName: "" -# strategyType: RollingUpdate -# affinity: -# podAntiAffinity: -# preferredDuringSchedulingIgnoredDuringExecution: -# - podAffinityTerm: -# labelSelector: -# matchExpressions: -# - key: gatekeeper.sh/operation -# operator: In -# values: -# - webhook -# topologyKey: kubernetes.io/hostname -# weight: 100 -# topologySpreadConstraints: [] -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: -# limits: -# memory: 512Mi -# requests: -# cpu: 100m -# memory: 512Mi -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# podSecurityContext: -# fsGroup: 999 -# supplementalGroups: -# - 999 -# extraRules: [] -# networkPolicy: -# enabled: false -# ingress: { } -# # - from: -# # - ipBlock: -# # cidr: 0.0.0.0/0 -# audit: -# enablePubsub: false -# connection: audit-connection -# channel: audit-channel -# hostNetwork: false -# dnsPolicy: ClusterFirst -# metricsPort: 8888 -# healthPort: 9090 -# readinessTimeout: 1 -# livenessTimeout: 1 -# priorityClassName: system-cluster-critical -# disableCertRotation: false -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: -# limits: -# memory: 512Mi -# requests: -# cpu: 100m -# memory: 512Mi -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# podSecurityContext: -# fsGroup: 999 -# supplementalGroups: -# - 999 -# writeToRAMDisk: false -# extraRules: [] -# crds: -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: {} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 65532 -# runAsNonRoot: true -# runAsUser: 65532 -# pdb: -# controllerManager: -# minAvailable: 1 -# service: {} -# disabledBuiltins: ["{http.send}"] -# psp: -# enabled: true -# upgradeCRDs: -# enabled: true -# extraRules: [] -# priorityClassName: "" -# rbac: -# create: true -# externalCertInjection: -# enabled: false -# secretName: gatekeeper-webhook-server-cert -# \ No newline at end of file diff --git a/master/gitlab-runner/Chart.yaml b/master/gitlab-runner/Chart.yaml deleted file mode 100644 index 2915b96..0000000 --- a/master/gitlab-runner/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: gitlab-runner -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: gitlab-runner - repository: https://charts.gitlab.io/ - version: 0.77.2 diff --git a/master/gitlab-runner/templates/secrets.yaml b/master/gitlab-runner/templates/secrets.yaml deleted file mode 100644 index 3477844..0000000 --- a/master/gitlab-runner/templates/secrets.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: gitlab-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: gitlab-secret - data: - - secretKey: runner-registration-token - remoteRef: - key: secrets/gitlab/runner - property: runner-registration-token - - secretKey: runner-token - remoteRef: - key: secrets/gitlab/runner - property: runner-token diff --git a/master/gitlab-runner/values.yaml b/master/gitlab-runner/values.yaml deleted file mode 100644 index 9535eb7..0000000 --- a/master/gitlab-runner/values.yaml +++ /dev/null @@ -1,71 +0,0 @@ -gitlab-runner: - - image: - registry: registry.internal.durp.info - image: gitlab-org/gitlab-runner - - imagePullPolicy: Always - gitlabUrl: https://gitlab.com/ - unregisterRunner: false - terminationGracePeriodSeconds: 3600 - concurrent: 10 - checkInterval: 30 - - rbac: - create: true - rules: [] - clusterWideAccess: false - podSecurityPolicy: - enabled: false - resourceNames: - - gitlab-runner - - metrics: - enabled: true - serviceMonitor: - enabled: true - service: - enabled: true - annotations: {} - - runners: - config: | - [[runners]] - [runners.kubernetes] - namespace = "{{.Release.Namespace}}" - image = "ubuntu:22.04" - privileged = true - - executor: kubernetes - name: "k3s" - runUntagged: true - privileged: true - secret: gitlab-secret - #builds: - #cpuLimit: 200m - #cpuLimitOverwriteMaxAllowed: 400m - #memoryLimit: 256Mi - #memoryLimitOverwriteMaxAllowed: 512Mi - #cpuRequests: 100m - #cpuRequestsOverwriteMaxAllowed: 200m - #memoryRequests: 128Mi - #memoryRequestsOverwriteMaxAllowed: 256Mi - - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - runAsNonRoot: true - privileged: false - capabilities: - drop: ["ALL"] - - podSecurityContext: - runAsUser: 100 - fsGroup: 65533 - - resources: - limits: - memory: 2Gi - requests: - memory: 128Mi - cpu: 500m diff --git a/master/heimdall/Chart.yaml b/master/heimdall/Chart.yaml deleted file mode 100644 index 39dbf54..0000000 --- a/master/heimdall/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: heimdall -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: heimdall - repository: https://djjudas21.github.io/charts/ - version: 8.5.4 diff --git a/master/heimdall/templates/ingress.yaml b/master/heimdall/templates/ingress.yaml deleted file mode 100644 index 98b6144..0000000 --- a/master/heimdall/templates/ingress.yaml +++ /dev/null @@ -1,52 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - annotations: - name: heimdall-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`heimdall.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: heimdall - port: 80 - - match: Host(`heimdall.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: heimdall-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: heimdall-tls -spec: - secretName: heimdall-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "heimdall.durp.info" - dnsNames: - - "heimdall.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: heimdall-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: heimdall.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/heimdall/values.yaml b/master/heimdall/values.yaml deleted file mode 100644 index e93ca43..0000000 --- a/master/heimdall/values.yaml +++ /dev/null @@ -1,28 +0,0 @@ -heimdall: - - image: - registry: - repository: registry.internal.durp.info/linuxserver/heimdall - pullPolicy: Always - - env: - TZ: UTC - PUID: "1000" - PGID: "1000" - - service: - main: - annotations: - external-dns.alpha.kubernetes.io/hostname: heimdall.durp.info - external-dns.alpha.kubernetes.io/target: home.durp.info - ports: - http: - port: 80 - - ingress: - main: - enabled: false - - persistence: - config: - enabled: true diff --git a/master/internalproxy/Chart.yaml b/master/internalproxy/Chart.yaml deleted file mode 100644 index 71c9b0d..0000000 --- a/master/internalproxy/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: internalproxy -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "0.1.0" diff --git a/master/internalproxy/templates/argocd.yaml b/master/internalproxy/templates/argocd.yaml deleted file mode 100644 index 9a82e9e..0000000 --- a/master/internalproxy/templates/argocd.yaml +++ /dev/null @@ -1,46 +0,0 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: argocd-ingress -# annotations: -# cert-manager.io/cluster-issuer: letsencrypt-production -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`argocd.internal.durp.info`) -# middlewares: -# - name: whitelist -# namespace: traefik -# kind: Rule -# services: -# - name: argocd-server -# port: 443 -# scheme: https -# tls: -# secretName: argocd-tls -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: argocd-server -#spec: -# type: ExternalName -# externalName: argocd-server.argocd.svc.cluster.local -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: argocd-tls -#spec: -# secretName: argocd-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "argocd.internal.durp.info" -# dnsNames: -# - "argocd.internal.durp.info" \ No newline at end of file diff --git a/master/internalproxy/templates/blueiris.yaml b/master/internalproxy/templates/blueiris.yaml deleted file mode 100644 index 5f120c9..0000000 --- a/master/internalproxy/templates/blueiris.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: blueiris -spec: - ports: - - name: app - port: 81 - protocol: TCP - targetPort: 81 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: blueiris -subsets: - - addresses: - - ip: 192.168.99.2 - ports: - - name: app - port: 81 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: blueiris-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`blueiris.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: blueiris - port: 81 - scheme: http - tls: - secretName: blueiris-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: blueiris-tls -spec: - secretName: blueiris-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "blueiris.internal.durp.info" - dnsNames: - - "blueiris.internal.durp.info" diff --git a/master/internalproxy/templates/duplicati-ingress.yaml b/master/internalproxy/templates/duplicati-ingress.yaml deleted file mode 100644 index de08a38..0000000 --- a/master/internalproxy/templates/duplicati-ingress.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: duplicati -spec: - ports: - - name: app - port: 8200 - protocol: TCP - targetPort: 8200 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: duplicati -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8200 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: duplicati-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: duplicati - port: 8200 - - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-master-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: duplicati-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: duplicati-tls -spec: - secretName: duplicati-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "duplicati.internal.durp.info" - dnsNames: - - "duplicati.internal.durp.info" diff --git a/master/internalproxy/templates/gitea.yaml b/master/internalproxy/templates/gitea.yaml deleted file mode 100644 index 0bde4e4..0000000 --- a/master/internalproxy/templates/gitea.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: gitea -spec: - ports: - - name: app - port: 3000 - protocol: TCP - targetPort: 3000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: gitea -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 3000 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: gitea-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`gitea.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: gitea - port: 3000 - scheme: http - tls: - secretName: gitea-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: gitea-tls -spec: - secretName: gitea-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "gitea.durp.info" - dnsNames: - - "gitea.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: gitea-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: gitea.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/infra.yaml b/master/internalproxy/templates/infra.yaml deleted file mode 100644 index 51f6a91..0000000 --- a/master/internalproxy/templates/infra.yaml +++ /dev/null @@ -1,60 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: infra -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: infra -subsets: - - addresses: - - ip: 192.168.12.130 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: infra-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`*.infra.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra - port: 443 - scheme: https - tls: - secretName: infra-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: infra-tls -spec: - secretName: infra-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "infra.durp.info" - dnsNames: - - "*.infra.durp.info" diff --git a/master/internalproxy/templates/jellyfin.yaml b/master/internalproxy/templates/jellyfin.yaml deleted file mode 100644 index 709b50a..0000000 --- a/master/internalproxy/templates/jellyfin.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: jellyfin -spec: - ports: - - name: app - port: 8096 - protocol: TCP - targetPort: 8096 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: jellyfin -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8096 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: jellyfin-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`jellyfin.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: jellyfin - port: 8096 - scheme: http - tls: - secretName: jellyfin-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: jellyfin-tls -spec: - secretName: jellyfin-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "jellyfin.durp.info" - dnsNames: - - "jellyfin.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: jellyfin-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: jellyfin.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/kasm.yaml b/master/internalproxy/templates/kasm.yaml deleted file mode 100644 index 7f756e0..0000000 --- a/master/internalproxy/templates/kasm.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: kasm -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: kasm -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: kasm-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kasm.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: kasm - port: 443 - scheme: https - tls: - secretName: kasm-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kasm-tls -spec: - secretName: kasm-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "kasm.durp.info" - dnsNames: - - "kasm.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: kasm-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kasm.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/minio.yaml b/master/internalproxy/templates/minio.yaml deleted file mode 100644 index 71dd261..0000000 --- a/master/internalproxy/templates/minio.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: minio -spec: - ports: - - name: app - port: 9769 - protocol: TCP - targetPort: 9769 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: minio -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 9769 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: minio-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`minio.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: minio - port: 9769 - scheme: http - tls: - secretName: minio-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: minio-tls -spec: - secretName: minio-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "minio.internal.durp.info" - dnsNames: - - "minio.internal.durp.info" diff --git a/master/internalproxy/templates/nexus.yaml b/master/internalproxy/templates/nexus.yaml deleted file mode 100644 index 5d3632e..0000000 --- a/master/internalproxy/templates/nexus.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: nexus -spec: - ports: - - name: app - port: 8081 - protocol: TCP - targetPort: 8081 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: nexus -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8081 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: nexus-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`nexus.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: nexus - port: 8081 - tls: - secretName: nexus-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: nexus-tls -spec: - secretName: nexus-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "nexus.durp.info" - dnsNames: - - "nexus.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: nexus-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: nexus.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/octopus.yaml b/master/internalproxy/templates/octopus.yaml deleted file mode 100644 index e0e5d78..0000000 --- a/master/internalproxy/templates/octopus.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: octopus -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: octopus -subsets: - - addresses: - - ip: 192.168.20.105 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: octopus-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`octopus.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: octopus - port: 443 - scheme: https - tls: - secretName: octopus-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: octopus-tls -spec: - secretName: octopus-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "octopus.internal.durp.info" - dnsNames: - - "octopus.internal.durp.info" diff --git a/master/internalproxy/templates/ollama.yaml b/master/internalproxy/templates/ollama.yaml deleted file mode 100644 index b845cac..0000000 --- a/master/internalproxy/templates/ollama.yaml +++ /dev/null @@ -1,102 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: ollama-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: ollama-secret - data: - - secretKey: users - remoteRef: - key: secrets/internalproxy/ollama - property: users - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: ollama-basic-auth -spec: - basicAuth: - headerField: x-api-key - secret: ollama-secret - ---- - -apiVersion: v1 -kind: Service -metadata: - name: ollama -spec: - ports: - - name: app - port: 11435 - protocol: TCP - targetPort: 11435 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: ollama -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 11435 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: ollama-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`ollama.durp.info`) && PathPrefix(`/`) - middlewares: - - name: ollama-basic-auth - kind: Rule - services: - - name: ollama - port: 11435 - tls: - secretName: ollama-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: ollama-tls -spec: - secretName: ollama-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "ollama.durp.info" - dnsNames: - - "ollama.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: ollama-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: ollama.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/plex.yaml b/master/internalproxy/templates/plex.yaml deleted file mode 100644 index 45bba44..0000000 --- a/master/internalproxy/templates/plex.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: plex -spec: - ports: - - name: app - port: 32400 - protocol: TCP - targetPort: 32400 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: plex -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 32400 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: plex-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`plex.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: plex - port: 32400 - scheme: https - tls: - secretName: plex-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: plex-tls -spec: - secretName: plex-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "plex.durp.info" - dnsNames: - - "plex.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: plex-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: plex.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/portainer.yaml b/master/internalproxy/templates/portainer.yaml deleted file mode 100644 index 5c22061..0000000 --- a/master/internalproxy/templates/portainer.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: portainer -spec: - ports: - - name: app - port: 9443 - protocol: TCP - targetPort: 9443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: portainer -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 9443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: portainer-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: portainer - port: 9443 - scheme: https - tls: - secretName: portainer-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: portainer-tls -spec: - secretName: portainer-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "portainer.internal.durp.info" - dnsNames: - - "portainer.internal.durp.info" diff --git a/master/internalproxy/templates/proxmox.yaml b/master/internalproxy/templates/proxmox.yaml deleted file mode 100644 index d61f416..0000000 --- a/master/internalproxy/templates/proxmox.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: proxmox -spec: - ports: - - name: app - port: 8006 - protocol: TCP - targetPort: 8006 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: proxmox -subsets: - - addresses: - - ip: 192.168.21.254 - ports: - - name: app - port: 8006 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: proxmox-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`proxmox.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: proxmox - port: 8006 - scheme: https - tls: - secretName: proxmox-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: proxmox-tls -spec: - secretName: proxmox-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "proxmox.internal.durp.info" - dnsNames: - - "proxmox.internal.durp.info" diff --git a/master/internalproxy/templates/redlib.yaml b/master/internalproxy/templates/redlib.yaml deleted file mode 100644 index b71e4c3..0000000 --- a/master/internalproxy/templates/redlib.yaml +++ /dev/null @@ -1,68 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: redlib -spec: - ports: - - name: app - port: 8082 - protocol: TCP - targetPort: 8082 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: redlib -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8082 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: redlib-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`redlib.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: redlib - port: 8082 - - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: redlib-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: redlib-tls -spec: - secretName: redlib-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "redlib.durp.info" - dnsNames: - - "redlib.durp.info" diff --git a/master/internalproxy/templates/registry-internal.yaml b/master/internalproxy/templates/registry-internal.yaml deleted file mode 100644 index c32c167..0000000 --- a/master/internalproxy/templates/registry-internal.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: registry-internal -spec: - ports: - - name: app - port: 5000 - protocol: TCP - targetPort: 5000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: registry-internal -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 5000 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: registry-internal-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`registry.internal.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: registry-internal - port: 5000 - tls: - secretName: registry-internal-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: registry-internal-tls -spec: - secretName: registry-internal-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "registry.internal.durp.info" - dnsNames: - - "registry.internal.durp.info" diff --git a/master/internalproxy/templates/registry.yaml b/master/internalproxy/templates/registry.yaml deleted file mode 100644 index 1906614..0000000 --- a/master/internalproxy/templates/registry.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: registry -spec: - ports: - - name: app - port: 5000 - protocol: TCP - targetPort: 5000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: registry -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 5000 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: registry-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`registry.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: registry - port: 5000 - tls: - secretName: registry-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: registry-tls -spec: - secretName: registry-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "registry.durp.info" - dnsNames: - - "registry.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: registry-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: registry.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/s3.yaml b/master/internalproxy/templates/s3.yaml deleted file mode 100644 index e48d6ce..0000000 --- a/master/internalproxy/templates/s3.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: s3 -spec: - ports: - - name: app - port: 9768 - protocol: TCP - targetPort: 9768 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: s3 -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 9768 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: s3-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`s3.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: s3 - port: 9768 - scheme: http - tls: - secretName: s3-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: s3-tls -spec: - secretName: s3-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "s3.internal.durp.info" - dnsNames: - - "s3.internal.durp.info" diff --git a/master/internalproxy/templates/semaphore.yaml b/master/internalproxy/templates/semaphore.yaml deleted file mode 100644 index e7256da..0000000 --- a/master/internalproxy/templates/semaphore.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: semaphore -spec: - ports: - - name: app - port: 3001 - protocol: TCP - targetPort: 3001 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: semaphore -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 3001 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: semaphore-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: semaphore - port: 3001 - scheme: http - tls: - secretName: semaphore-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: semaphore-tls -spec: - secretName: semaphore-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "semaphore.internal.durp.info" - dnsNames: - - "semaphore.internal.durp.info" diff --git a/master/internalproxy/templates/smokeping.yaml b/master/internalproxy/templates/smokeping.yaml deleted file mode 100644 index 9840993..0000000 --- a/master/internalproxy/templates/smokeping.yaml +++ /dev/null @@ -1,82 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: smokeping -spec: - ports: - - name: app - port: 81 - protocol: TCP - targetPort: 81 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: smokeping -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 81 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: smokeping-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: smokeping - port: 81 - - match: Host(`smokeping.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: smokeping-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: smokeping-tls -spec: - secretName: smokeping-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "smokeping.durp.info" - dnsNames: - - "smokeping.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: smokeping-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/speedtest.yaml b/master/internalproxy/templates/speedtest.yaml deleted file mode 100644 index 275b708..0000000 --- a/master/internalproxy/templates/speedtest.yaml +++ /dev/null @@ -1,74 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: speedtest -spec: - ports: - - name: app - port: 6580 - protocol: TCP - targetPort: 6580 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: speedtest -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 6580 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: speedtest-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: speedtest - port: 6580 - tls: - secretName: speedtest-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: speedtest-tls -spec: - secretName: speedtest-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "speedtest.durp.info" - dnsNames: - - "speedtest.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: speedtest-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/tdarr.yaml b/master/internalproxy/templates/tdarr.yaml deleted file mode 100644 index 96eca07..0000000 --- a/master/internalproxy/templates/tdarr.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: tdarr -spec: - ports: - - name: app - port: 8267 - protocol: TCP - targetPort: 8267 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: tdarr -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8267 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: tdarr-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`tdarr.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: tdarr - port: 8267 - scheme: http - tls: - secretName: tdarr-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: tdarr-tls -spec: - secretName: tdarr-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "tdarr.internal.durp.info" - dnsNames: - - "tdarr.internal.durp.info" diff --git a/master/internalproxy/templates/unifi.yaml b/master/internalproxy/templates/unifi.yaml deleted file mode 100644 index 76c3110..0000000 --- a/master/internalproxy/templates/unifi.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: unifi -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: unifi -subsets: - - addresses: - - ip: 192.168.20.1 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: unifi-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`unifi.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: unifi - port: 443 - scheme: https - tls: - secretName: unifi-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: unifi-tls -spec: - secretName: unifi-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "unifi.internal.durp.info" - dnsNames: - - "unifi.internal.durp.info" diff --git a/master/internalproxy/templates/unraid.yaml b/master/internalproxy/templates/unraid.yaml deleted file mode 100644 index c5cde07..0000000 --- a/master/internalproxy/templates/unraid.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: unraid -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: unraid -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: unraid-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`unraid.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: unraid - port: 443 - scheme: https - tls: - secretName: unraid-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: unraid-tls -spec: - secretName: unraid-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "unraid.internal.durp.info" - dnsNames: - - "unraid.internal.durp.info" diff --git a/master/internalproxy/templates/vault.yaml b/master/internalproxy/templates/vault.yaml deleted file mode 100644 index af97b25..0000000 --- a/master/internalproxy/templates/vault.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: root-vault -spec: - ports: - - name: app - port: 8201 - protocol: TCP - targetPort: 8201 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: root-vault -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8201 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: root-vault-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`root-vault.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: root-vault - port: 8201 - scheme: https - tls: - secretName: root-vault-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: root-vault-tls -spec: - secretName: root-vault-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "root-vault.internal.durp.info" - dnsNames: - - "root-vault.internal.durp.info" diff --git a/master/internalproxy/templates/wazuh.yaml b/master/internalproxy/templates/wazuh.yaml deleted file mode 100644 index 5a5d853..0000000 --- a/master/internalproxy/templates/wazuh.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: wazuh -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: wazuh -subsets: - - addresses: - - ip: 192.168.20.102 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: wazuh-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`wazuh.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: wazuh - port: 443 - scheme: https - tls: - secretName: wazuh-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: wazuh-tls -spec: - secretName: wazuh-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "wazuh.internal.durp.info" - dnsNames: - - "wazuh.internal.durp.info" diff --git a/master/krakend/Chart.yaml b/master/krakend/Chart.yaml deleted file mode 100644 index d998c9f..0000000 --- a/master/krakend/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: krakend -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" \ No newline at end of file diff --git a/master/krakend/templates/deployments.yaml b/master/krakend/templates/deployments.yaml deleted file mode 100644 index ce50302..0000000 --- a/master/krakend/templates/deployments.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: krakend - name: krakend - labels: - app: krakend -spec: - selector: - matchLabels: - app: krakend - replicas: 1 - template: - metadata: - labels: - app: krakend - spec: - volumes: - - name: krakend-secret - secret: - secretName: krakend-secret - containers: - - name: krakend - image: registry.internal.durp.info/devopsfaith/krakend:2.4.3 - imagePullPolicy: Always - livenessProbe: - httpGet: - path: /__health - port: 8080 - readinessProbe: - httpGet: - path: /__health - port: 8080 - ports: - - name: http - containerPort: 8080 - volumeMounts: - - name: krakend-secret - mountPath: /etc/krakend \ No newline at end of file diff --git a/master/krakend/templates/ingress.yaml b/master/krakend/templates/ingress.yaml deleted file mode 100644 index a8c08eb..0000000 --- a/master/krakend/templates/ingress.yaml +++ /dev/null @@ -1,56 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: api-tls -spec: - secretName: api-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "api.durp.info" - dnsNames: - - "api.durp.info" - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: krakend-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`api.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: krakend-service - port: 8080 - scheme: http - tls: - secretName: api-tls - ---- - -kind: Service -apiVersion: v1 -metadata: - name: api-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: api.durp.info -spec: - type: ExternalName - externalName: durp.info - ---- - -kind: Service -apiVersion: v1 -metadata: - name: api-developer-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: developer.durp.info - external-dns.alpha.kubernetes.io/cloudflare-proxied: "false" -spec: - type: ExternalName - externalName: developerdurp.github.io diff --git a/master/krakend/templates/secrets.yaml b/master/krakend/templates/secrets.yaml deleted file mode 100644 index 073e590..0000000 --- a/master/krakend/templates/secrets.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: krakend-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: krakend-secret - data: - - secretKey: krakend.json - remoteRef: - key: secrets/krakend/config - property: config \ No newline at end of file diff --git a/master/krakend/templates/service.yaml b/master/krakend/templates/service.yaml deleted file mode 100644 index d5393f3..0000000 --- a/master/krakend/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: krakend-service -spec: - ports: - - name: http - port: 8080 - targetPort: 8080 - protocol: TCP - selector: - app: krakend \ No newline at end of file diff --git a/master/kube-prometheus-stack/Chart.yaml b/master/kube-prometheus-stack/Chart.yaml deleted file mode 100644 index 093c443..0000000 --- a/master/kube-prometheus-stack/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: kube-prometheus-stack -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: kube-prometheus-stack - repository: https://prometheus-community.github.io/helm-charts - version: 72.9.1 diff --git a/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml b/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml deleted file mode 100644 index 7f01c1e..0000000 --- a/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: vault-grafana-oauth -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: grafana-oauth - data: - - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_ID - remoteRef: - key: secrets/kube-prometheus/grafana/oauth - property: GF_AUTH_GENERIC_OAUTH_CLIENT_ID - - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET - remoteRef: - key: secrets/kube-prometheus/grafana/oauth - property: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET - ---- - -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: vault-admin-credentials -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: grafana-admin-credentials - data: - - secretKey: admin-password - remoteRef: - key: secrets/kube-prometheus/grafana/admin - property: admin-password - - secretKey: admin-user - remoteRef: - key: secrets/kube-prometheus/grafana/admin - property: admin-user diff --git a/master/kube-prometheus-stack/templates/ingress.yaml b/master/kube-prometheus-stack/templates/ingress.yaml deleted file mode 100644 index caf0ee1..0000000 --- a/master/kube-prometheus-stack/templates/ingress.yaml +++ /dev/null @@ -1,80 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: grafana-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`grafana.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: grafana - port: 80 - tls: - secretName: grafana-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: grafana-tls -spec: - secretName: grafana-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "grafana.durp.info" - dnsNames: - - "grafana.durp.info" - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: alertmanager-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`alertmanager.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: prometheus-alertmanager - port: 9093 - tls: - secretName: alertmanager-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: alertmanager-tls -spec: - secretName: alertmanager-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "alertmanager.durp.info" - dnsNames: - - "alertmanager.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: grafana-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: grafana.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/master/kube-prometheus-stack/values.yaml b/master/kube-prometheus-stack/values.yaml deleted file mode 100644 index 19436ac..0000000 --- a/master/kube-prometheus-stack/values.yaml +++ /dev/null @@ -1,203 +0,0 @@ -kube-prometheus-stack: - fullnameOverride: prometheus - - defaultRules: - create: true - rules: - alertmanager: true - etcd: true - configReloaders: true - general: true - k8s: true - kubeApiserverAvailability: true - kubeApiserverBurnrate: true - kubeApiserverHistogram: true - kubeApiserverSlos: true - kubelet: true - kubeProxy: true - kubePrometheusGeneral: true - kubePrometheusNodeRecording: true - kubernetesApps: true - kubernetesResources: true - kubernetesStorage: true - kubernetesSystem: true - kubeScheduler: true - kubeStateMetrics: true - network: true - node: true - nodeExporterAlerting: true - nodeExporterRecording: true - prometheus: true - prometheusOperator: true - - alertmanager: - fullnameOverride: alertmanager - enabled: true - ingress: - enabled: false - grafana: - enabled: true - fullnameOverride: grafana - forceDeployDatasources: false - forceDeployDashboards: false - defaultDashboardsEnabled: true - defaultDashboardsTimezone: utc - plugins: - - grafana-polystat-panel - serviceMonitor: - enabled: true - admin: - existingSecret: grafana-admin-credentials - userKey: admin-user - passwordKey: admin-password - ingress: - enabled: false - grafana.ini: - server: - root_url: https://grafana.durp.info - auth.generic_oauth: - enabled: true - scopes: openid profile email - auth_url: https://authentik.durp.info/application/o/authorize/ - token_url: https://authentik.durp.info/application/o/token/ - api_url: https://authentik.durp.info/application/o/userinfo/ - envFromSecret: "grafana-oauth" - - kubeApiServer: - enabled: true - - kubelet: - enabled: true - serviceMonitor: - metricRelabelings: - - action: replace - sourceLabels: - - node - targetLabel: instance - - kubeControllerManager: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - - coreDns: - enabled: false - - kubeDns: - enabled: false - - kubeEtcd: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - service: - enabled: true - port: 2381 - targetPort: 2381 - - kubeScheduler: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - - kubeProxy: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - - kubeStateMetrics: - enabled: true - - kube-state-metrics: - fullnameOverride: kube-state-metrics - selfMonitor: - enabled: true - prometheus: - monitor: - enabled: true - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - - nodeExporter: - enabled: true - serviceMonitor: - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - - prometheus-node-exporter: - fullnameOverride: node-exporter - podLabels: - jobLabel: node-exporter - extraArgs: - - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+)($|/) - - --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$ - service: - portName: http-metrics - prometheus: - monitor: - enabled: true - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - resources: - requests: - memory: 512Mi - cpu: 250m - limits: - memory: 2048Mi - - prometheusOperator: - enabled: true - prometheusConfigReloader: - resources: - requests: - cpu: 200m - memory: 50Mi - limits: - memory: 100Mi - - prometheus: - enabled: true - prometheusSpec: - replicas: 1 - replicaExternalLabelName: "replica" - ruleSelectorNilUsesHelmValues: false - serviceMonitorSelectorNilUsesHelmValues: false - podMonitorSelectorNilUsesHelmValues: false - probeSelectorNilUsesHelmValues: false - retention: 6h - enableAdminAPI: true - walCompression: true - storageSpec: - volumeClaimTemplate: - spec: - storageClassName: nfs-storage - accessModes: ["ReadWriteMany"] - resources: - requests: - storage: 50Gi - - thanosRuler: - enabled: false diff --git a/master/kubeclarity/Chart.yaml b/master/kubeclarity/Chart.yaml deleted file mode 100644 index 4eef59a..0000000 --- a/master/kubeclarity/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: kubeclarity -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: kubeclarity - repository: https://openclarity.github.io/kubeclarity - version: 2.23.3 diff --git a/master/kubeclarity/templates/ingress.yaml b/master/kubeclarity/templates/ingress.yaml deleted file mode 100644 index 77b67a7..0000000 --- a/master/kubeclarity/templates/ingress.yaml +++ /dev/null @@ -1,47 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: kubeclarity-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kubeclarity.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: kubeclarity-kubeclarity - port: 8080 - tls: - secretName: kubeclarity-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kubeclarity-tls -spec: - secretName: kubeclarity-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "kubeclarity.durp.info" - dnsNames: - - "kubeclarity.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: kubeclarity-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kubeclarity.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/kubeclarity/values.yaml b/master/kubeclarity/values.yaml deleted file mode 100644 index 0bb5078..0000000 --- a/master/kubeclarity/values.yaml +++ /dev/null @@ -1,235 +0,0 @@ -kubeclarity: - global: - databasePassword: kubeclarity - docker: - registry: "registry.internal.durp.info/openclarity" - tag: "latest" - imagePullPolicy: Always - - curl: - image: - registry: "registry.internal.durp.info" - repository: curlimages/curl - tag: 7.87.0 - - kubeclarity: - docker: - imageName: "" - - logLevel: warning - - enableDBInfoLog: false - - prometheus: - enabled: false - - podAnnotations: {} - - service: - type: ClusterIP - port: 8080 - annotations: {} - - ingress: - enabled: false - - resources: - requests: - memory: "200Mi" - cpu: "100m" - limits: - memory: "1000Mi" - cpu: "1000m" - - initContainers: - resources: - requests: - memory: "100Mi" - cpu: "100m" - limits: - memory: "200Mi" - cpu: "200m" - - kubeclarity-runtime-scan: - httpsProxy: "" - httpProxy: "" - resultServicePort: 8888 - - labels: - app: kubeclarity-scanner - sidecar.istio.io/inject: "false" - - namespace: "" - - registry: - skipVerifyTlS: "false" - useHTTP: "false" - - cis-docker-benchmark-scanner: - resources: - requests: - memory: "50Mi" - cpu: "50m" - limits: - memory: "1000Mi" - cpu: "1000m" - - vulnerability-scanner: - resources: - requests: - memory: "50Mi" - cpu: "50m" - limits: - memory: "1000Mi" - cpu: "1000m" - - analyzer: - analyzerList: "syft gomod trivy" - analyzerScope: "squashed" - - trivy: - enabled: true - timeout: "300" - - scanner: - scannerList: "grype trivy" - - grype: - enabled: true - mode: "REMOTE" - - remote-grype: - timeout: "2m" - - dependency-track: - enabled: false - insecureSkipVerify: "true" - disableTls: "true" - apiserverAddress: "dependency-track-apiserver.dependency-track" - apiKey: "" - - trivy: - enabled: true - timeout: "300" - - kubeclarity-grype-server: - enabled: true - - docker: - imageRepo: "registry.internal.durp.info/openclarity" - imageTag: "v0.6.0" - imagePullPolicy: Always - - logLevel: warning - - servicePort: 9991 - - resources: - requests: - cpu: "200m" - memory: "200Mi" - limits: - cpu: "1000m" - memory: "1G" - - kubeclarity-trivy-server: - enabled: true - - ## Docker Image values. - image: - registry: registry.internal.durp.info - repository: aquasec/trivy - tag: 0.44.1 - pullPolicy: Always - - persistence: - enabled: false - - podSecurityContext: - runAsUser: 1001 - runAsNonRoot: true - fsGroup: 1001 - - securityContext: - privileged: false - readOnlyRootFilesystem: true - - trivy: - debugMode: false - - service: - port: 9992 - - resources: - requests: - cpu: "200m" - memory: "200Mi" - limits: - cpu: "1000m" - memory: "1G" - - - kubeclarity-sbom-db: - docker: - imageName: "" - logLevel: warning - - servicePort: 8080 - - resources: - requests: - memory: "20Mi" - cpu: "10m" - limits: - memory: "1Gi" - cpu: "200m" - - kubeclarity-postgresql: - enabled: true - - image: - registry: registry.internal.durp.info - repository: bitnami/postgresql - tag: 14.6.0-debian-11-r31 - - auth: - existingSecret: kubeclarity-postgresql-secret - username: postgres - database: kubeclarity - sslMode: disable - - service: - ports: - postgresql: 5432 - - serviceAccount: - enabled: true - securityContext: - enabled: true - fsGroup: 1001 - containerSecurityContext: - enabled: true - runAsUser: 1001 - runAsNonRoot: true - volumePermissions: - enabled: false - securityContext: - runAsUser: 1001 - shmVolume: - chmod: - enabled: true - - resources: - requests: - memory: "256Mi" - cpu: "250m" - limits: - memory: "1000Mi" - cpu: "1000m" - - kubeclarity-postgresql-external: - enabled: false - - kubeclarity-postgresql-secret: - create: true - secretKey: "postgres-password" diff --git a/master/littlelink/Chart.yaml b/master/littlelink/Chart.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/master/littlelink/templates/deployment.yaml b/master/littlelink/templates/deployment.yaml deleted file mode 100644 index ec9ab4d..0000000 --- a/master/littlelink/templates/deployment.yaml +++ /dev/null @@ -1,101 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: littlelink - name: littlelink - labels: - app: littlelink -spec: - selector: - matchLabels: - app: littlelink - replicas: 1 - template: - metadata: - labels: - app: littlelink - spec: - containers: - - name: littlelink - image: registry.internal.durp.info/techno-tim/littlelink-server:latest - imagePullPolicy: Always - livenessProbe: - httpGet: - path: /healthcheck - port: 3000 - readinessProbe: - httpGet: - path: /healthcheck - port: 3000 - env: - - name: META_TITLE - value: DeveloperDurp - - name: META_DESCRIPTION - value: The Durpy Developer - - name: META_AUTHOR - value: DeveloperDurp - - name: LANG - value: en - - name: META_INDEX_STATUS - value: all - - name: OG_TITLE - value: DeveloperDurp - - name: OG_DESCRIPTION - value: DeveloperDurp - - name: OG_URL - value: https://gitlab.com/developerdurp - - name: OG_IMAGE - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : OG_IMAGE_WIDTH - value: "400" - - name : OG_IMAGE_HEIGHT - value: "400" - - name : THEME - value: Dark - - name : FAVICON_URL - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : AVATAR_URL - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : AVATAR_2X_URL - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : AVATAR_ALT - value: DeveloperDurp Profile Pic - - name : NAME - value: DeveloperDurp - - name : BIO - value: Sup Nerd, - - name : BUTTON_ORDER - value: GITHUB,GITLAB,YOUTUBE,INSTAGRAM,TWITTER,BLUESKY,COFFEE,EMAIL - - name : TWITTER - value: https://twitter.com/developerdurp - - name : GITHUB - value: https://github.com/DeveloperDurp - - name: INSTAGRAM - value: https://instagram.com/developerdurp - - name : GITLAB - value: https://gitlab.com/developerdurp - - name: YOUTUBE - value: https://www.youtube.com/channel/UC1rGa6s6kER_gLpIQsxeMVQ - - name : EMAIL - value: DeveloperDurp@durp.info - - name : EMAIL_TEXT - value: DeveloperDurp@durp.info - - name : FOOTER - value: DeveloperDurp © 2022 - - name: CUSTOM_BUTTON_TEXT - value: BuyMeACoffee,BlueSky - - name: CUSTOM_BUTTON_URL - value: https://www.buymeacoffee.com/DeveloperDurp,https://bsky.app/profile/durp.info - - name: CUSTOM_BUTTON_COLOR - value: '#ffdd00,#1185fe' - - name: CUSTOM_BUTTON_TEXT_COLOR - value: '#000000,#FFFFFF' - - name: CUSTOM_BUTTON_ALT_TEXT - value: Support,BlueSky - - name: CUSTOM_BUTTON_NAME - value: COFFEE,BLUESKY - - name: CUSTOM_BUTTON_ICON - value: fa-solid fa-cup-togo - ports: - - name: http - containerPort: 3000 diff --git a/master/littlelink/templates/ingress.yaml b/master/littlelink/templates/ingress.yaml deleted file mode 100644 index 194f31e..0000000 --- a/master/littlelink/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: littlelink-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`links.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: littlelink - port: 80 - tls: - secretName: littlelink-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: littlelink-tls -spec: - secretName: littlelink-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "links.durp.info" - dnsNames: - - "links.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: links-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: links.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/master/littlelink/templates/service.yaml b/master/littlelink/templates/service.yaml deleted file mode 100644 index 445d527..0000000 --- a/master/littlelink/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: littlelink -spec: - ports: - - name: http - port: 80 - targetPort: 3000 - protocol: TCP - selector: - app: littlelink \ No newline at end of file diff --git a/master/longhorn/Chart.yaml b/master/longhorn/Chart.yaml deleted file mode 100644 index 2c9fea3..0000000 --- a/master/longhorn/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: longhorn-system -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: longhorn - repository: https://charts.longhorn.io - version: 1.9.0 \ No newline at end of file diff --git a/master/longhorn/templates/ingress.yaml b/master/longhorn/templates/ingress.yaml deleted file mode 100644 index 09c5ef2..0000000 --- a/master/longhorn/templates/ingress.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: longhorn-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - # - name: authentik-proxy-provider - # namespace: traefik - kind: Rule - services: - - name: longhorn-frontend - port: 80 - # - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - # kind: Rule - # services: - # - name: ak-outpost-authentik-embedded-outpost - # namespace: authentik - # port: 9000 - tls: - secretName: longhorn-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: longhorn-tls -spec: - secretName: longhorn-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "longhorn.internal.durp.info" - dnsNames: - - "longhorn.internal.durp.info" diff --git a/master/longhorn/templates/secrets.yaml b/master/longhorn/templates/secrets.yaml deleted file mode 100644 index 4bbdc35..0000000 --- a/master/longhorn/templates/secrets.yaml +++ /dev/null @@ -1,24 +0,0 @@ - -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: external-longhorn-backup-token-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: longhorn-backup-token-secret - data: - - secretKey: AWS_ACCESS_KEY_ID - remoteRef: - key: secrets/longhorn/backup - property: AWS_ACCESS_KEY_ID - - secretKey: AWS_ENDPOINTS - remoteRef: - key: secrets/longhorn/backup - property: AWS_ENDPOINTS - - secretKey: AWS_SECRET_ACCESS_KEY - remoteRef: - key: secrets/longhorn/backup - property: AWS_SECRET_ACCESS_KEY diff --git a/master/longhorn/values.yaml b/master/longhorn/values.yaml deleted file mode 100644 index 647385b..0000000 --- a/master/longhorn/values.yaml +++ /dev/null @@ -1,253 +0,0 @@ -longhorn: - - # Default values for longhorn. - # This is a YAML-formatted file. - # Declare variables to be passed into your templates. - global: - cattle: - systemDefaultRegistry: "" - - image: - longhorn: - engine: - repository: longhornio/longhorn-engine - manager: - repository: longhornio/longhorn-manager - ui: - repository: longhornio/longhorn-ui - instanceManager: - repository: longhornio/longhorn-instance-manager - shareManager: - repository: longhornio/longhorn-share-manager - backingImageManager: - repository: longhornio/backing-image-manager - csi: - attacher: - repository: longhornio/csi-attacher - provisioner: - repository: longhornio/csi-provisioner - nodeDriverRegistrar: - repository: longhornio/csi-node-driver-registrar - resizer: - repository: longhornio/csi-resizer - snapshotter: - repository: longhornio/csi-snapshotter - pullPolicy: Always - - service: - ui: - type: ClusterIP - nodePort: null - manager: - type: ClusterIP - nodePort: "" - loadBalancerIP: "" - loadBalancerSourceRanges: "" - - persistence: - defaultClass: true - defaultFsType: ext4 - defaultClassReplicaCount: 3 - defaultDataLocality: disabled # best-effort otherwise - reclaimPolicy: Retain - migratable: false - recurringJobSelector: - enable: true - jobList: '[ - { - "name":"backup", - "task":"backup", - "cron":"0 0 * * ?", - "retain":24 - } - ]' - backingImage: - enable: false - name: ~ - dataSourceType: ~ - dataSourceParameters: ~ - expectedChecksum: ~ - - csi: - kubeletRootDir: ~ - attacherReplicaCount: ~ - provisionerReplicaCount: ~ - resizerReplicaCount: ~ - snapshotterReplicaCount: ~ - - defaultSettings: - backupTarget: S3://longhorn-master@us-east-1/ - backupTargetCredentialSecret: longhorn-backup-token-secret - allowRecurringJobWhileVolumeDetached: ~ - createDefaultDiskLabeledNodes: ~ - defaultDataPath: ~ - defaultDataLocality: ~ - replicaSoftAntiAffinity: ~ - replicaAutoBalance: ~ - storageOverProvisioningPercentage: ~ - storageMinimalAvailablePercentage: ~ - upgradeChecker: ~ - defaultReplicaCount: ~ - defaultLonghornStaticStorageClass: longhorn - backupstorePollInterval: ~ - taintToleration: ~ - systemManagedComponentsNodeSelector: ~ - priorityClass: ~ - autoSalvage: ~ - autoDeletePodWhenVolumeDetachedUnexpectedly: ~ - disableSchedulingOnCordonedNode: ~ - replicaZoneSoftAntiAffinity: ~ - nodeDownPodDeletionPolicy: ~ - allowNodeDrainWithLastHealthyReplica: ~ - mkfsExt4Parameters: ~ - disableReplicaRebuild: ~ - replicaReplenishmentWaitInterval: ~ - concurrentReplicaRebuildPerNodeLimit: ~ - disableRevisionCounter: ~ - systemManagedPodsImagePullPolicy: ~ - allowVolumeCreationWithDegradedAvailability: ~ - autoCleanupSystemGeneratedSnapshot: ~ - concurrentAutomaticEngineUpgradePerNodeLimit: ~ - backingImageCleanupWaitInterval: ~ - backingImageRecoveryWaitInterval: ~ - guaranteedEngineManagerCPU: ~ - guaranteedReplicaManagerCPU: ~ - kubernetesClusterAutoscalerEnabled: ~ - orphanAutoDeletion: ~ - storageNetwork: ~ - privateRegistry: - createSecret: ~ - registryUrl: ~ - registryUser: ~ - registryPasswd: ~ - registrySecret: ~ - - longhornManager: - priorityClass: ~ - tolerations: [] - ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above - ## and uncomment this example block - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - nodeSelector: {} - ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above - ## and uncomment this example block - # label-key1: "label-value1" - # label-key2: "label-value2" - - longhornDriver: - priorityClass: ~ - tolerations: [] - ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above - ## and uncomment this example block - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - nodeSelector: {} - ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above - ## and uncomment this example block - # label-key1: "label-value1" - # label-key2: "label-value2" - - longhornUI: - priorityClass: ~ - tolerations: [] - ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above - ## and uncomment this example block - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - nodeSelector: {} - ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above - ## and uncomment this example block - # label-key1: "label-value1" - # label-key2: "label-value2" - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - # - - ingress: - ## Set to true to enable ingress record generation - enabled: false - - ## Add ingressClassName to the Ingress - ## Can replace the kubernetes.io/ingress.class annotation on v1.18+ - ingressClassName: nginx - - host: longhorn.internal.durp.info - - ## Set this to true in order to enable TLS on the ingress record - ## A side effect of this will be that the backend service will be connected at port 443 - tls: - - secretName: longhorn-tls - hosts: - - longhorn.internal.durp.info - - ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS - tlsSecret: longhorn-tls - - ## If ingress is enabled you can set the default ingress path - ## then you can access the UI by using the following full path {{host}}+{{path}} - path: / - - ## Ingress annotations done as key:value pairs - ## If you're using kube-lego, you will want to add: - ## kubernetes.io/tls-acme: true - ## - ## For a full list of possible ingress annotations, please see - ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md - ## - ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production - nginx.ingress.kubernetes.io/auth-url: |- - http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx - nginx.ingress.kubernetes.io/auth-signin: |- - https://longhorn.internal.durp.info/outpost.goauthentik.io/start?rd=$escaped_request_uri - nginx.ingress.kubernetes.io/auth-response-headers: |- - Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid - nginx.ingress.kubernetes.io/auth-snippet: | - proxy_set_header X-Forwarded-Host $http_host; - - secrets: - ## If you're providing your own certificates, please use this to add the certificates as secrets - ## key and certificate should start with -----BEGIN CERTIFICATE----- or - ## -----BEGIN RSA PRIVATE KEY----- - ## - ## name should line up with a tlsSecret set further up - ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set - ## - ## It is also possible to create and manage the certificates outside of this helm chart - ## Please see README.md for more information - # - name: longhorn.local-tls - # key: - # certificate: - - # Configure a pod security policy in the Longhorn namespace to allow privileged pods - enablePSP: true - - ## Specify override namespace, specifically this is useful for using longhorn as sub-chart - ## and its release namespace is not the `longhorn-system` - namespaceOverride: "" - - # Annotations to add to the Longhorn Manager DaemonSet Pods. Optional. - annotations: {} - - serviceAccount: - # Annotations to add to the service account - annotations: {} - diff --git a/master/metallb-system/Chart.yaml b/master/metallb-system/Chart.yaml deleted file mode 100644 index 7b97113..0000000 --- a/master/metallb-system/Chart.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v2 -name: metallb-system -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: metallb - repository: https://metallb.github.io/metallb - version: 0.15.2 - diff --git a/master/metallb-system/templates/config.yaml b/master/metallb-system/templates/config.yaml deleted file mode 100644 index e44285d..0000000 --- a/master/metallb-system/templates/config.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: metallb.io/v1beta1 -kind: IPAddressPool -metadata: - name: cheap -spec: - addresses: - - 192.168.20.130-192.168.20.140 ---- -apiVersion: metallb.io/v1beta1 -kind: L2Advertisement -metadata: - name: poop - namespace: metallb-system -spec: - ipAddressPools: - - cheap - diff --git a/master/metallb-system/values.yaml b/master/metallb-system/values.yaml deleted file mode 100644 index 0c6b1b9..0000000 --- a/master/metallb-system/values.yaml +++ /dev/null @@ -1,197 +0,0 @@ -metallb: - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - loadBalancerClass: "" - - rbac: - create: true - - prometheus: - scrapeAnnotations: false - metricsPort: 7472 - speakerMetricsTLSSecret: "" - controllerMetricsTLSSecret: "" - rbacPrometheus: true - serviceAccount: "" - namespace: "" - rbacProxy: - repository: gcr.io/kubebuilder/kube-rbac-proxy - tag: v0.12.0 - pullPolicy: - podMonitor: - enabled: false - additionalLabels: {} - annotations: {} - jobLabel: "app.kubernetes.io/name" - interval: - metricRelabelings: [] - relabelings: [] - serviceMonitor: - enabled: false - speaker: - additionalLabels: {} - annotations: {} - tlsConfig: - insecureSkipVerify: true - controller: - additionalLabels: {} - annotations: {} - tlsConfig: - insecureSkipVerify: true - jobLabel: "app.kubernetes.io/name" - interval: - metricRelabelings: [] - relabelings: [] - prometheusRule: - enabled: false - additionalLabels: {} - annotations: {} - staleConfig: - enabled: true - labels: - severity: warning - configNotLoaded: - enabled: true - labels: - severity: warning - addressPoolExhausted: - enabled: true - labels: - severity: alert - addressPoolUsage: - enabled: true - thresholds: - - percent: 75 - labels: - severity: warning - - percent: 85 - labels: - severity: warning - - percent: 95 - labels: - severity: alert - bgpSessionDown: - enabled: true - labels: - severity: alert - - extraAlerts: [] - - controller: - enabled: true - # -- Controller log level. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` - logLevel: info - image: - repository: quay.io/metallb/controller - tag: - pullPolicy: - strategy: - type: RollingUpdate - serviceAccount: - create: true - name: "" - annotations: {} - securityContext: - runAsNonRoot: true - runAsUser: 65534 - fsGroup: 65534 - resources: {} - nodeSelector: {} - tolerations: [] - priorityClassName: "" - runtimeClassName: "" - affinity: {} - podAnnotations: {} - labels: {} - livenessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - readinessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - tlsMinVersion: "VersionTLS12" - tlsCipherSuites: "" - - extraContainers: [] - - speaker: - enabled: true - logLevel: debug - tolerateMaster: true - memberlist: - enabled: true - mlBindPort: 7946 - mlBindAddrOverride: "" - mlSecretKeyPath: "/etc/ml_secret_key" - excludeInterfaces: - enabled: true - ignoreExcludeLB: false - - image: - repository: quay.io/metallb/speaker - tag: - pullPolicy: - updateStrategy: - type: RollingUpdate - serviceAccount: - create: true - name: "" - annotations: {} - securityContext: {} - resources: {} - nodeSelector: {} - tolerations: [] - priorityClassName: "" - affinity: {} - runtimeClassName: "" - podAnnotations: {} - labels: - pod-security.kubernetes.io/enforce: privileged - pod-security.kubernetes.io/audit: privileged - pod-security.kubernetes.io/warn: privileged - livenessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - readinessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - startupProbe: - enabled: true - failureThreshold: 30 - periodSeconds: 5 - frr: - enabled: true - image: - repository: quay.io/frrouting/frr - tag: 9.1.3 - pullPolicy: - metricsPort: 7473 - resources: {} - reloader: - resources: {} - frrMetrics: - resources: {} - extraContainers: [] - crds: - enabled: true - validationFailurePolicy: Fail - frrk8s: - enabled: false - diff --git a/master/nfs-client/Chart.yml b/master/nfs-client/Chart.yml deleted file mode 100644 index 217f2c1..0000000 --- a/master/nfs-client/Chart.yml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v2 -name: nfs-client -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - diff --git a/master/nfs-client/templates/cluster-role-binding.yml b/master/nfs-client/templates/cluster-role-binding.yml deleted file mode 100644 index 427d8c6..0000000 --- a/master/nfs-client/templates/cluster-role-binding.yml +++ /dev/null @@ -1,12 +0,0 @@ -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: run-nfs-client-provisioner -subjects: - - kind: ServiceAccount - name: nfs-client-provisioner - namespace: nfs-client -roleRef: - kind: ClusterRole - name: nfs-client-provisioner-runner - apiGroup: rbac.authorization.k8s.io diff --git a/master/nfs-client/templates/cluster-role.yml b/master/nfs-client/templates/cluster-role.yml deleted file mode 100644 index fa6ed20..0000000 --- a/master/nfs-client/templates/cluster-role.yml +++ /dev/null @@ -1,20 +0,0 @@ -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: nfs-client-provisioner-runner -rules: - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "create", "delete"] - - apiGroups: [""] - resources: ["persistentvolumeclaims"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["storage.k8s.io"] - resources: ["storageclasses"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "update", "patch"] - - apiGroups: [""] - resources: ["endpoints"] - verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/master/nfs-client/templates/provisioner.yml b/master/nfs-client/templates/provisioner.yml deleted file mode 100644 index c76fe8c..0000000 --- a/master/nfs-client/templates/provisioner.yml +++ /dev/null @@ -1,42 +0,0 @@ -kind: Deployment -apiVersion: apps/v1 -metadata: - name: nfs-client-provisioner - namespace: nfs-client -spec: - selector: - matchLabels: - app: nfs-client-provisioner - replicas: 1 - strategy: - type: Recreate - template: - metadata: - labels: - app: nfs-client-provisioner - spec: - serviceAccountName: nfs-client-provisioner - containers: - - name: nfs-client-provisioner - image: gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner:v4.0.0 - resources: - requests: - cpu: 500m - memory: 512Mi - limits: - memory: 1Gi - volumeMounts: - - name: nfs-client-ssd - mountPath: /persistentvolumes - env: - - name: PROVISIONER_NAME - value: durp.info/nfs - - name: NFS_SERVER - value: 192.168.20.253 - - name: NFS_PATH - value: /mnt/user/k3s - volumes: - - name: nfs-client-ssd - nfs: - server: 192.168.20.253 - path: /mnt/user/k3s diff --git a/master/nfs-client/templates/role-binding.yml b/master/nfs-client/templates/role-binding.yml deleted file mode 100644 index fb0f085..0000000 --- a/master/nfs-client/templates/role-binding.yml +++ /dev/null @@ -1,13 +0,0 @@ -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: leader-locking-nfs-client-provisioner - namespace: nfs-client -subjects: - - kind: ServiceAccount - name: nfs-client-provisioner - namespace: nfs-client -roleRef: - kind: Role - name: leader-locking-nfs-client-provisioner - apiGroup: rbac.authorization.k8s.io diff --git a/master/nfs-client/templates/role.yml b/master/nfs-client/templates/role.yml deleted file mode 100644 index 910346d..0000000 --- a/master/nfs-client/templates/role.yml +++ /dev/null @@ -1,9 +0,0 @@ -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: leader-locking-nfs-client-provisioner - namespace: nfs-client -rules: - - apiGroups: [""] - resources: ["endpoints"] - verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/master/nfs-client/templates/service-account.yml b/master/nfs-client/templates/service-account.yml deleted file mode 100644 index ef9b4d7..0000000 --- a/master/nfs-client/templates/service-account.yml +++ /dev/null @@ -1,5 +0,0 @@ -kind: ServiceAccount -apiVersion: v1 -metadata: - name: nfs-client-provisioner - namespace: nfs-client diff --git a/master/nfs-client/templates/storage-class.yml b/master/nfs-client/templates/storage-class.yml deleted file mode 100644 index b615fe1..0000000 --- a/master/nfs-client/templates/storage-class.yml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: nfs-storage - annotations: - storageclass.kubernetes.io/is-default-class: "false" -provisioner: durp.info/nfs -parameters: - archiveOnDelete: "false" -reclaimPolicy: Retain diff --git a/master/open-webui/Chart.yaml b/master/open-webui/Chart.yaml deleted file mode 100644 index 1561d60..0000000 --- a/master/open-webui/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: open-webui -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" diff --git a/master/open-webui/templates/deployment.yaml b/master/open-webui/templates/deployment.yaml deleted file mode 100644 index c76ec24..0000000 --- a/master/open-webui/templates/deployment.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: open-webui - name: open-webui - labels: - app: open-webui -spec: - selector: - matchLabels: - app: open-webui - replicas: 1 - template: - metadata: - labels: - app: open-webui - spec: - containers: - - name: open-webui - image: registry.internal.durp.info/open-webui/open-webui:main - imagePullPolicy: Always - volumeMounts: - - name: open-webui-pvc1 - mountPath: /app/backend/data - ports: - - name: http - containerPort: 8080 - env: - - name: OLLAMA_BASE_URL - valueFrom: - secretKeyRef: - name: open-webui-secret - key: OLLAMA_BASE_URL - volumes: - - name: open-webui-pvc1 - persistentVolumeClaim: - claimName: open-webui-pvc1 diff --git a/master/open-webui/templates/ingress.yaml b/master/open-webui/templates/ingress.yaml deleted file mode 100644 index 6331e92..0000000 --- a/master/open-webui/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: open-webui-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: open-webui - port: 8080 - tls: - secretName: open-webui-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: open-webui-tls -spec: - secretName: open-webui-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "open-webui.durp.info" - dnsNames: - - "open-webui.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: open-webui-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/open-webui/templates/pvc.yaml b/master/open-webui/templates/pvc.yaml deleted file mode 100644 index a7ba262..0000000 --- a/master/open-webui/templates/pvc.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: open-webui-pvc1 -spec: - storageClassName: longhorn - accessModes: - - ReadWriteMany - resources: - requests: - storage: 10Gi diff --git a/master/open-webui/templates/secrets.yaml b/master/open-webui/templates/secrets.yaml deleted file mode 100644 index c8a22bc..0000000 --- a/master/open-webui/templates/secrets.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: open-webui-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: open-webui-secret - data: - - secretKey: OLLAMA_BASE_URL - remoteRef: - key: secrets/open-webui - property: OLLAMA_BASE_URL - diff --git a/master/open-webui/templates/service.yaml b/master/open-webui/templates/service.yaml deleted file mode 100644 index cd93455..0000000 --- a/master/open-webui/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: open-webui -spec: - ports: - - name: http - port: 8080 - targetPort: 8080 - protocol: TCP - selector: - app: open-webui diff --git a/master/traefik/Chart.yaml b/master/traefik/Chart.yaml deleted file mode 100644 index 5378476..0000000 --- a/master/traefik/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: traefik -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: traefik - repository: https://traefik.github.io/charts - version: 24.0.0 diff --git a/master/traefik/templates/ingress.yaml b/master/traefik/templates/ingress.yaml deleted file mode 100644 index c3db450..0000000 --- a/master/traefik/templates/ingress.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: traefik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`traefik.internal.durp.info`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: api@internal - kind: TraefikService - - match: Host(`traefik.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-master-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: traefik-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: traefik-tls - namespace: traefik -spec: - secretName: traefik-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "traefik.internal.durp.info" - dnsNames: - - "traefik.internal.durp.info" diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml deleted file mode 100644 index dfa36c4..0000000 --- a/master/traefik/templates/middlewares.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: authentik-proxy-provider - namespace: traefik -spec: - forwardAuth: - address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri - trustForwardHeader: true - authResponseHeaders: - - X-authentik-username - - X-authentik-groups - - X-authentik-email - - X-authentik-name - - X-authentik-uid - - X-authentik-jwt - - X-authentik-meta-jwks - - X-authentik-meta-outpost - - X-authentik-meta-provider - - X-authentik-meta-app - - X-authentik-meta-version - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: whitelist - namespace: traefik -spec: - ipWhiteList: - sourceRange: - - 192.168.0.0/16 - - 172.16.0.0/12 - - 10.0.0.0/8 diff --git a/master/traefik/values.yaml b/master/traefik/values.yaml deleted file mode 100644 index 5bb0a04..0000000 --- a/master/traefik/values.yaml +++ /dev/null @@ -1,887 +0,0 @@ -traefik: - # Default values for Traefik - image: - registry: docker.io - repository: traefik - # defaults to appVersion - tag: "" - pullPolicy: Always - - # - # Configure integration with Traefik Hub - # - hub: - ## Enabling Hub will: - # * enable Traefik Hub integration on Traefik - # * add `traefikhub-tunl` endpoint - # * enable Prometheus metrics with addRoutersLabels - # * enable allowExternalNameServices on KubernetesIngress provider - # * enable allowCrossNamespace on KubernetesCRD provider - # * add an internal (ClusterIP) Service, dedicated for Traefik Hub - enabled: true - ## Default port can be changed - # tunnelPort: 9901 - ## TLS is optional. Insecure is mutually exclusive with any other options - # tls: - # insecure: false - # ca: "/path/to/ca.pem" - # cert: "/path/to/cert.pem" - # key: "/path/to/key.pem" - - # - # Configure the deployment - # - deployment: - enabled: true - # Can be either Deployment or DaemonSet - kind: Deployment - # Number of pods of the deployment (only applies when kind == Deployment) - replicas: 3 - # Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) - revisionHistoryLimit: 1 - # Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down - terminationGracePeriodSeconds: 60 - # The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available - minReadySeconds: 0 - # Additional deployment annotations (e.g. for jaeger-operator sidecar injection) - annotations: {} - # Additional deployment labels (e.g. for filtering deployment by custom labels) - labels: {} - # Additional pod annotations (e.g. for mesh injection or prometheus scraping) - podAnnotations: {} - # Additional Pod labels (e.g. for filtering Pod by custom labels) - podLabels: {} - # Additional containers (e.g. for metric offloading sidecars) - additionalContainers: [] - # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host - # - name: socat-proxy - # image: alpine/socat:1.0.5 - # args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"] - # volumeMounts: - # - name: dsdsocket - # mountPath: /socket - # Additional volumes available for use with initContainers and additionalContainers - additionalVolumes: [] - # - name: dsdsocket - # hostPath: - # path: /var/run/statsd-exporter - # Additional initContainers (e.g. for setting file permission as shown below) - initContainers: [] - # The "volume-permissions" init container is required if you run into permission issues. - # Related issue: https://github.com/traefik/traefik-helm-chart/issues/396 - # - name: volume-permissions - # image: busybox:latest - # command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"] - # securityContext: - # runAsNonRoot: true - # runAsGroup: 65532 - # runAsUser: 65532 - # volumeMounts: - # - name: data - # mountPath: /data - # Use process namespace sharing - shareProcessNamespace: false - # Custom pod DNS policy. Apply if `hostNetwork: true` - # dnsPolicy: ClusterFirstWithHostNet - # Additional imagePullSecrets - imagePullSecrets: [] - # - name: myRegistryKeySecretName - # Pod lifecycle actions - lifecycle: {} - # preStop: - # exec: - # command: ["/bin/sh", "-c", "sleep 40"] - # postStart: - # httpGet: - # path: /ping - # port: 9000 - # host: localhost - # scheme: HTTP - - # Pod disruption budget - podDisruptionBudget: - enabled: false - # maxUnavailable: 1 - # maxUnavailable: 33% - # minAvailable: 0 - # minAvailable: 25% - - # Create a default IngressClass for Traefik - ingressClass: - enabled: true - isDefaultClass: false - - # Enable experimental features - experimental: - v3: - enabled: false - plugins: - enabled: true - kubernetesGateway: - enabled: false - gateway: - enabled: true - # certificate: - # group: "core" - # kind: "Secret" - # name: "mysecret" - # By default, Gateway would be created to the Namespace you are deploying Traefik to. - # You may create that Gateway in another namespace, setting its name below: - # namespace: default - # Additional gateway annotations (e.g. for cert-manager.io/issuer) - # annotations: - # cert-manager.io/issuer: letsencrypt - - # Create an IngressRoute for the dashboard - ingressRoute: - dashboard: - enabled: true - # Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class) - annotations: {} - # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels) - labels: {} - # The router match rule used for the dashboard ingressRoute - matchRule: PathPrefix(`/dashboard`) || PathPrefix(`/api`) - # Specify the allowed entrypoints to use for the dashboard ingress route, (e.g. traefik, web, websecure). - # By default, it's using traefik entrypoint, which is not exposed. - # /!\ Do not expose your dashboard without any protection over the internet /!\ - entryPoints: ["traefik"] - # Additional ingressRoute middlewares (e.g. for authentication) - middlewares: [] - # TLS options (e.g. secret containing certificate) - tls: {} - - # Customize updateStrategy of traefik pods - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 1 - - # Customize liveness and readiness probe values. - readinessProbe: - failureThreshold: 1 - initialDelaySeconds: 2 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 2 - - livenessProbe: - failureThreshold: 3 - initialDelaySeconds: 2 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 2 - - # - # Configure providers - # - providers: - kubernetesCRD: - enabled: true - allowCrossNamespace: true - allowExternalNameServices: false - allowEmptyServices: false - # ingressClass: traefik-internal - # labelSelector: environment=production,method=traefik - namespaces: [] - # - "default" - - kubernetesIngress: - enabled: true - allowExternalNameServices: false - allowEmptyServices: false - # ingressClass: traefik-internal - # labelSelector: environment=production,method=traefik - namespaces: [] - # - "default" - # IP used for Kubernetes Ingress endpoints - publishedService: - enabled: false - # Published Kubernetes Service to copy status from. Format: namespace/servicename - # By default this Traefik service - # pathOverride: "" - - # - # Add volumes to the traefik pod. The volume name will be passed to tpl. - # This can be used to mount a cert pair or a configmap that holds a config.toml file. - # After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg: - # additionalArguments: - # - "--providers.file.filename=/config/dynamic.toml" - # - "--ping" - # - "--ping.entrypoint=web" - volumes: [] - # - name: public-cert - # mountPath: "/certs" - # type: secret - # - name: '{{ printf "%s-configs" .Release.Name }}' - # mountPath: "/config" - # type: configMap - - # Additional volumeMounts to add to the Traefik container - additionalVolumeMounts: [] - # For instance when using a logshipper for access logs - # - name: traefik-logs - # mountPath: /var/log/traefik - - ## Logs - ## https://docs.traefik.io/observability/logs/ - logs: - ## Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on). - general: - # By default, the logs use a text format (common), but you can - # also ask for the json format in the format option - # format: json - # By default, the level is set to ERROR. - # Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO. - level: ERROR - access: - # To enable access logs - enabled: false - ## By default, logs are written using the Common Log Format (CLF) on stdout. - ## To write logs in JSON, use json in the format option. - ## If the given format is unsupported, the default (CLF) is used instead. - # format: json - # filePath: "/var/log/traefik/access.log - ## To write the logs in an asynchronous fashion, specify a bufferingSize option. - ## This option represents the number of log lines Traefik will keep in memory before writing - ## them to the selected output. In some cases, this option can greatly help performances. - # bufferingSize: 100 - ## Filtering https://docs.traefik.io/observability/access-logs/#filtering - filters: {} - # statuscodes: "200,300-302" - # retryattempts: true - # minduration: 10ms - ## Fields - ## https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers - fields: - general: - defaultmode: keep - names: {} - ## Examples: - # ClientUsername: drop - headers: - defaultmode: drop - names: {} - ## Examples: - # User-Agent: redact - # Authorization: drop - # Content-Type: keep - - metrics: - ## Prometheus is enabled by default. - ## It can be disabled by setting "prometheus: null" - prometheus: - ## Entry point used to expose metrics. - entryPoint: metrics - ## Enable metrics on entry points. Default=true - # addEntryPointsLabels: false - ## Enable metrics on routers. Default=false - # addRoutersLabels: true - ## Enable metrics on services. Default=true - # addServicesLabels: false - ## Buckets for latency metrics. Default="0.1,0.3,1.2,5.0" - # buckets: "0.5,1.0,2.5" - ## When manualRouting is true, it disables the default internal router in - ## order to allow creating a custom router for prometheus@internal service. - # manualRouting: true - # datadog: - # ## Address instructs exporter to send metrics to datadog-agent at this address. - # address: "127.0.0.1:8125" - # ## The interval used by the exporter to push metrics to datadog-agent. Default=10s - # # pushInterval: 30s - # ## The prefix to use for metrics collection. Default="traefik" - # # prefix: traefik - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # influxdb: - # ## Address instructs exporter to send metrics to influxdb at this address. - # address: localhost:8089 - # ## InfluxDB's address protocol (udp or http). Default="udp" - # protocol: udp - # ## InfluxDB database used when protocol is http. Default="" - # # database: "" - # ## InfluxDB retention policy used when protocol is http. Default="" - # # retentionPolicy: "" - # ## InfluxDB username (only with http). Default="" - # # username: "" - # ## InfluxDB password (only with http). Default="" - # # password: "" - # ## The interval used by the exporter to push metrics to influxdb. Default=10s - # # pushInterval: 30s - # ## Additional labels (influxdb tags) on all metrics. - # # additionalLabels: - # # env: production - # # foo: bar - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # influxdb2: - # ## Address instructs exporter to send metrics to influxdb v2 at this address. - # address: localhost:8086 - # ## Token with which to connect to InfluxDB v2. - # token: xxx - # ## Organisation where metrics will be stored. - # org: "" - # ## Bucket where metrics will be stored. - # bucket: "" - # ## The interval used by the exporter to push metrics to influxdb. Default=10s - # # pushInterval: 30s - # ## Additional labels (influxdb tags) on all metrics. - # # additionalLabels: - # # env: production - # # foo: bar - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # statsd: - # ## Address instructs exporter to send metrics to statsd at this address. - # address: localhost:8125 - # ## The interval used by the exporter to push metrics to influxdb. Default=10s - # # pushInterval: 30s - # ## The prefix to use for metrics collection. Default="traefik" - # # prefix: traefik - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # openTelemetry: - # ## Address of the OpenTelemetry Collector to send metrics to. - # address: "localhost:4318" - # ## Enable metrics on entry points. - # addEntryPointsLabels: true - # ## Enable metrics on routers. - # addRoutersLabels: true - # ## Enable metrics on services. - # addServicesLabels: true - # ## Explicit boundaries for Histogram data points. - # explicitBoundaries: - # - "0.1" - # - "0.3" - # - "1.2" - # - "5.0" - # ## Additional headers sent with metrics by the reporter to the OpenTelemetry Collector. - # headers: - # foo: bar - # test: test - # ## Allows reporter to send metrics to the OpenTelemetry Collector without using a secured protocol. - # insecure: true - # ## Interval at which metrics are sent to the OpenTelemetry Collector. - # pushInterval: 10s - # ## Allows to override the default URL path used for sending metrics. This option has no effect when using gRPC transport. - # path: /foo/v1/traces - # ## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector. - # tls: - # ## The path to the certificate authority, it defaults to the system bundle. - # ca: path/to/ca.crt - # ## The path to the public certificate. When using this option, setting the key option is required. - # cert: path/to/foo.cert - # ## The path to the private key. When using this option, setting the cert option is required. - # key: path/to/key.key - # ## If set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers. - # insecureSkipVerify: true - # ## This instructs the reporter to send metrics to the OpenTelemetry Collector using gRPC. - # grpc: true - - ## - ## enable optional CRDs for Prometheus Operator - ## - ## Create a dedicated metrics service for use with ServiceMonitor - ## When hub.enabled is set to true, it's not needed: it will use hub service. - # service: - # enabled: false - # labels: {} - # annotations: {} - ## When set to true, it won't check if Prometheus Operator CRDs are deployed - # disableAPICheck: false - # serviceMonitor: - # metricRelabelings: [] - # - sourceLabels: [__name__] - # separator: ; - # regex: ^fluentd_output_status_buffer_(oldest|newest)_.+ - # replacement: $1 - # action: drop - # relabelings: [] - # - sourceLabels: [__meta_kubernetes_pod_node_name] - # separator: ; - # regex: ^(.*)$ - # targetLabel: nodename - # replacement: $1 - # action: replace - # jobLabel: traefik - # interval: 30s - # honorLabels: true - # # (Optional) - # # scrapeTimeout: 5s - # # honorTimestamps: true - # # enableHttp2: true - # # followRedirects: true - # # additionalLabels: - # # foo: bar - # # namespace: "another-namespace" - # # namespaceSelector: {} - # prometheusRule: - # additionalLabels: {} - # namespace: "another-namespace" - # rules: - # - alert: TraefikDown - # expr: up{job="traefik"} == 0 - # for: 5m - # labels: - # context: traefik - # severity: warning - # annotations: - # summary: "Traefik Down" - # description: "{{ $labels.pod }} on {{ $labels.nodename }} is down" - - tracing: {} - # instana: - # localAgentHost: 127.0.0.1 - # localAgentPort: 42699 - # logLevel: info - # enableAutoProfile: true - # datadog: - # localAgentHostPort: 127.0.0.1:8126 - # debug: false - # globalTag: "" - # prioritySampling: false - # jaeger: - # samplingServerURL: http://localhost:5778/sampling - # samplingType: const - # samplingParam: 1.0 - # localAgentHostPort: 127.0.0.1:6831 - # gen128Bit: false - # propagation: jaeger - # traceContextHeaderName: uber-trace-id - # disableAttemptReconnecting: true - # collector: - # endpoint: "" - # user: "" - # password: "" - # zipkin: - # httpEndpoint: http://localhost:9411/api/v2/spans - # sameSpan: false - # id128Bit: true - # sampleRate: 1.0 - # haystack: - # localAgentHost: 127.0.0.1 - # localAgentPort: 35000 - # globalTag: "" - # traceIDHeaderName: "" - # parentIDHeaderName: "" - # spanIDHeaderName: "" - # baggagePrefixHeaderName: "" - # elastic: - # serverURL: http://localhost:8200 - # secretToken: "" - # serviceEnvironment: "" - - globalArguments: - - "--global.checknewversion=false" - - "--global.sendanonymoususage=false" - - # - # Configure Traefik static configuration - # Additional arguments to be passed at Traefik's binary - # All available options available on https://docs.traefik.io/reference/static-configuration/cli/ - ## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"` - additionalArguments: - - "--serversTransport.insecureSkipVerify=true" - - "--log.level=DEBUG" - - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin - - --experimental.plugins.jwt.version=v0.7.0 - - - # Environment variables to be passed to Traefik's binary - env: [] - # - name: SOME_VAR - # value: some-var-value - # - name: SOME_VAR_FROM_CONFIG_MAP - # valueFrom: - # configMapRef: - # name: configmap-name - # key: config-key - # - name: SOME_SECRET - # valueFrom: - # secretKeyRef: - # name: secret-name - # key: secret-key - - envFrom: [] - # - configMapRef: - # name: config-map-name - # - secretRef: - # name: secret-name - - # Configure ports - ports: - # The name of this one can't be changed as it is used for the readiness and - # liveness probes, but you can adjust its config to your liking - traefik: - port: 9000 - # Use hostPort if set. - # hostPort: 9000 - # - # Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which - # means it's listening on all your interfaces and all your IPs. You may want - # to set this value if you need traefik to listen on specific interface - # only. - # hostIP: 192.168.100.10 - - # Override the liveness/readiness port. This is useful to integrate traefik - # with an external Load Balancer that performs healthchecks. - # Default: ports.traefik.port - # healthchecksPort: 9000 - - # Override the liveness/readiness scheme. Useful for getting ping to - # respond on websecure entryPoint. - # healthchecksScheme: HTTPS - - # Defines whether the port is exposed if service.type is LoadBalancer or - # NodePort. - # - # You SHOULD NOT expose the traefik port on production deployments. - # If you want to access it from outside of your cluster, - # use `kubectl port-forward` or create a secure ingress - expose: false - # The exposed port for this service - exposedPort: 9000 - # The port protocol (TCP/UDP) - protocol: TCP - web: - ## Enable this entrypoint as a default entrypoint. When a service doesn't explicity set an entrypoint it will only use this entrypoint. - # asDefault: true - port: 8000 - # hostPort: 8000 - expose: true - exposedPort: 80 - # The port protocol (TCP/UDP) - protocol: TCP - # Use nodeport if set. This is useful if you have configured Traefik in a - # LoadBalancer. - # nodePort: 32080 - # Port Redirections - # Added in 2.2, you can make permanent redirects via entrypoints. - # https://docs.traefik.io/routing/entrypoints/#redirection - redirectTo: websecure - # - # Trust forwarded headers information (X-Forwarded-*). - # forwardedHeaders: - # trustedIPs: [] - # insecure: false - # - # Enable the Proxy Protocol header parsing for the entry point - # proxyProtocol: - # trustedIPs: [] - # insecure: false - websecure: - ## Enable this entrypoint as a default entrypoint. When a service doesn't explicity set an entrypoint it will only use this entrypoint. - # asDefault: true - port: 8443 - # hostPort: 8443 - expose: true - exposedPort: 443 - ## The port protocol (TCP/UDP) - protocol: TCP - # nodePort: 32443 - # - ## Enable HTTP/3 on the entrypoint - ## Enabling it will also enable http3 experimental feature - ## https://doc.traefik.io/traefik/routing/entrypoints/#http3 - ## There are known limitations when trying to listen on same ports for - ## TCP & UDP (Http3). There is a workaround in this chart using dual Service. - ## https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741 - http3: - enabled: false - # advertisedPort: 4443 - # - ## Trust forwarded headers information (X-Forwarded-*). - #forwardedHeaders: - # trustedIPs: [] - # insecure: false - # - ## Enable the Proxy Protocol header parsing for the entry point - #proxyProtocol: - # trustedIPs: [] - # insecure: false - # - ## Set TLS at the entrypoint - ## https://doc.traefik.io/traefik/routing/entrypoints/#tls - tls: - enabled: true - # this is the name of a TLSOption definition - options: "" - certResolver: "" - domains: [] - # - main: example.com - # sans: - # - foo.example.com - # - bar.example.com - # - # One can apply Middlewares on an entrypoint - # https://doc.traefik.io/traefik/middlewares/overview/ - # https://doc.traefik.io/traefik/routing/entrypoints/#middlewares - # /!\ It introduces here a link between your static configuration and your dynamic configuration /!\ - # It follows the provider naming convention: https://doc.traefik.io/traefik/providers/overview/#provider-namespace - # middlewares: - # - namespace-name1@kubernetescrd - # - namespace-name2@kubernetescrd - middlewares: [] - metrics: - # When using hostNetwork, use another port to avoid conflict with node exporter: - # https://github.com/prometheus/prometheus/wiki/Default-port-allocations - port: 9100 - # hostPort: 9100 - # Defines whether the port is exposed if service.type is LoadBalancer or - # NodePort. - # - # You may not want to expose the metrics port on production deployments. - # If you want to access it from outside of your cluster, - # use `kubectl port-forward` or create a secure ingress - expose: false - # The exposed port for this service - exposedPort: 9100 - # The port protocol (TCP/UDP) - protocol: TCP - - # TLS Options are created as TLSOption CRDs - # https://doc.traefik.io/traefik/https/tls/#tls-options - # When using `labelSelector`, you'll need to set labels on tlsOption accordingly. - # Example: - # tlsOptions: - # default: - # labels: {} - # sniStrict: true - # preferServerCipherSuites: true - # customOptions: - # labels: {} - # curvePreferences: - # - CurveP521 - # - CurveP384 - tlsOptions: {} - - # TLS Store are created as TLSStore CRDs. This is useful if you want to set a default certificate - # https://doc.traefik.io/traefik/https/tls/#default-certificate - # Example: - # tlsStore: - # default: - # defaultCertificate: - # secretName: tls-cert - tlsStore: {} - - # Options for the main traefik service, where the entrypoints traffic comes - # from. - service: - enabled: true - ## Single service is using `MixedProtocolLBService` feature gate. - ## When set to false, it will create two Service, one for TCP and one for UDP. - single: true - type: LoadBalancer - # Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config) - annotations: {} - # Additional annotations for TCP service only - annotationsTCP: {} - # Additional annotations for UDP service only - annotationsUDP: {} - # Additional service labels (e.g. for filtering Service by custom labels) - labels: {} - # Additional entries here will be added to the service spec. - # Cannot contain type, selector or ports entries. - spec: - externalTrafficPolicy: Local - # loadBalancerIP: "1.2.3.4" - # clusterIP: "2.3.4.5" - loadBalancerSourceRanges: [] - # - 192.168.0.1/32 - # - 172.16.0.0/16 - externalIPs: [] - # - 1.2.3.4 - ## One of SingleStack, PreferDualStack, or RequireDualStack. - # ipFamilyPolicy: SingleStack - ## List of IP families (e.g. IPv4 and/or IPv6). - ## ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services - # ipFamilies: - # - IPv4 - # - IPv6 - ## - ## An additionnal and optional internal Service. - ## Same parameters as external Service - # internal: - # type: ClusterIP - # # labels: {} - # # annotations: {} - # # spec: {} - # # loadBalancerSourceRanges: [] - # # externalIPs: [] - # # ipFamilies: [ "IPv4","IPv6" ] - - ## Create HorizontalPodAutoscaler object. - ## - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 10 - metrics: - #- type: Resource - # resource: - # name: memory - # target: - # type: Utilization - # averageUtilization: 80 - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: 80 - behavior: - scaleDown: - stabilizationWindowSeconds: 300 - policies: - - type: Pods - value: 1 - periodSeconds: 60 - - # Enable persistence using Persistent Volume Claims - # ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ - # It can be used to store TLS certificates, see `storage` in certResolvers - persistence: - enabled: false - name: data - # existingClaim: "" - accessMode: ReadWriteOnce - size: 128Mi - # storageClass: "" - # volumeName: "" - path: /data - annotations: {} - # subPath: "" # only mount a subpath of the Volume into the pod - - certResolvers: {} - # letsencrypt: - # # for challenge options cf. https://doc.traefik.io/traefik/https/acme/ - # email: email@example.com - # dnsChallenge: - # # also add the provider's required configuration under env - # # or expand then from secrets/configmaps with envfrom - # # cf. https://doc.traefik.io/traefik/https/acme/#providers - # provider: digitalocean - # # add futher options for the dns challenge as needed - # # cf. https://doc.traefik.io/traefik/https/acme/#dnschallenge - # delayBeforeCheck: 30 - # resolvers: - # - 1.1.1.1 - # - 8.8.8.8 - # tlsChallenge: true - # httpChallenge: - # entryPoint: "web" - # # It has to match the path with a persistent volume - # storage: /data/acme.json - - # If hostNetwork is true, runs traefik in the host network namespace - # To prevent unschedulabel pods due to port collisions, if hostNetwork=true - # and replicas>1, a pod anti-affinity is recommended and will be set if the - # affinity is left as default. - hostNetwork: false - - # Whether Role Based Access Control objects like roles and rolebindings should be created - rbac: - enabled: true - # If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces. - # If set to true, installs Role and RoleBinding. Providers will only watch target namespace. - namespaced: false - # Enable user-facing roles - # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles - # aggregateTo: [ "admin" ] - - # Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding - podSecurityPolicy: - enabled: false - - # The service account the pods will use to interact with the Kubernetes API - serviceAccount: - # If set, an existing service account is used - # If not set, a service account is created automatically using the fullname template - name: "" - - # Additional serviceAccount annotations (e.g. for oidc authentication) - serviceAccountAnnotations: {} - - resources: - requests: - cpu: "100m" - memory: "512Mi" - limits: - #cpu: "300m" - memory: "512Mi" - - # This example pod anti-affinity forces the scheduler to put traefik pods - # on nodes where no other traefik pods are scheduled. - # It should be used when hostNetwork: true to prevent port conflicts - affinity: {} - # podAntiAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # - labelSelector: - # matchLabels: - # app.kubernetes.io/name: '{{ template "traefik.name" . }}' - # app.kubernetes.io/instance: '{{ .Release.Name }}-{{ .Release.Namespace }}' - # topologyKey: kubernetes.io/hostname - - nodeSelector: {} - tolerations: [] - topologySpreadConstraints: [] - # # This example topologySpreadConstraints forces the scheduler to put traefik pods - # # on nodes where no other traefik pods are scheduled. - # - labelSelector: - # matchLabels: - # app: '{{ template "traefik.name" . }}' - # maxSkew: 1 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - - # Pods can have priority. - # Priority indicates the importance of a Pod relative to other Pods. - priorityClassName: "" - - # Set the container security context - # To run the container with ports below 1024 this will need to be adjust to run as root - securityContext: - capabilities: - drop: [ALL] - readOnlyRootFilesystem: true - - podSecurityContext: - # # /!\ When setting fsGroup, Kubernetes will recursively changes ownership and - # # permissions for the contents of each volume to match the fsGroup. This can - # # be an issue when storing sensitive content like TLS Certificates /!\ - # fsGroup: 65532 - fsGroupChangePolicy: "OnRootMismatch" - runAsGroup: 65532 - runAsNonRoot: true - runAsUser: 65532 - - # - # Extra objects to deploy (value evaluated as a template) - # - # In some cases, it can avoid the need for additional, extended or adhoc deployments. - # See #595 for more details and traefik/tests/values/extra.yaml for example. - extraObjects: [] - - # This will override the default Release Namespace for Helm. - # It will not affect optional CRDs such as `ServiceMonitor` and `PrometheusRules` - # namespaceOverride: traefik - # - ## This will override the default app.kubernetes.io/instance label for all Objects. - # instanceLabelOverride: traefik diff --git a/master/uptimekuma/Chart.yaml b/master/uptimekuma/Chart.yaml deleted file mode 100644 index 0dcf730..0000000 --- a/master/uptimekuma/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: uptimekuma -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" diff --git a/master/uptimekuma/templates/deployment.yaml b/master/uptimekuma/templates/deployment.yaml deleted file mode 100644 index d823327..0000000 --- a/master/uptimekuma/templates/deployment.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - component: uptime-kuma - name: deployment -spec: - selector: - matchLabels: - component: uptime-kuma - replicas: 1 - strategy: - type: Recreate - - template: - metadata: - labels: - component: uptime-kuma - spec: - containers: - - name: app - image: registry.durp.info/louislam/uptime-kuma:1 - ports: - - containerPort: 3001 - volumeMounts: - - mountPath: /app/data - name: storage - #livenessProbe: - #exec: - #command: - #- node - #- extra/healthcheck.js - readinessProbe: - httpGet: - path: / - port: 3001 - scheme: HTTP - - volumes: - - name: storage - persistentVolumeClaim: - claimName: uptimekuma-pvc diff --git a/master/uptimekuma/templates/ingress.yaml b/master/uptimekuma/templates/ingress.yaml deleted file mode 100644 index 86b65c8..0000000 --- a/master/uptimekuma/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: kuma-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kuma.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: service - port: 3001 - tls: - secretName: kuma-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kuma-tls -spec: - secretName: kuma-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "kuma.durp.info" - dnsNames: - - "kuma.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: heimdall-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kuma.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/uptimekuma/templates/kuma-pv.yaml b/master/uptimekuma/templates/kuma-pv.yaml deleted file mode 100644 index e17e5a7..0000000 --- a/master/uptimekuma/templates/kuma-pv.yaml +++ /dev/null @@ -1,25 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolume -#metadata: -# annotations: -# pv.kubernetes.io/provisioned-by: durp.info/nfs -# finalizers: -# - kubernetes.io/pv-protection -# name: uptimekuma-pv -#spec: -# accessModes: -# - ReadWriteMany -# capacity: -# storage: 10Gi -# claimRef: -# apiVersion: v1 -# kind: PersistentVolumeClaim -# name: uptimekuma-pvc -# namespace: uptimekuma -# nfs: -# path: /mnt/user/k3s/uptimekuma -# server: 192.168.20.253 -# persistentVolumeReclaimPolicy: Retain -# storageClassName: nfs-storage -# volumeMode: Filesystem -# \ No newline at end of file diff --git a/master/uptimekuma/templates/kuma-pvc.yaml b/master/uptimekuma/templates/kuma-pvc.yaml deleted file mode 100644 index ab76bf0..0000000 --- a/master/uptimekuma/templates/kuma-pvc.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: uptimekuma-pvc - namespace: uptimekuma -spec: - accessModes: - - ReadWriteMany - resources: - requests: - storage: 10Gi - storageClassName: longhorn \ No newline at end of file diff --git a/master/uptimekuma/templates/service.yaml b/master/uptimekuma/templates/service.yaml deleted file mode 100644 index cad08e7..0000000 --- a/master/uptimekuma/templates/service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: service -spec: - selector: - component: uptime-kuma - type: ClusterIP - ports: - - name: http - port: 3001 - targetPort: 3001 - protocol: TCP \ No newline at end of file diff --git a/master/vault/Chart.yaml b/master/vault/Chart.yaml deleted file mode 100644 index 412c292..0000000 --- a/master/vault/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: vault -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: vault - repository: https://helm.releases.hashicorp.com - version: 0.30.0 - diff --git a/master/vault/templates/ingress.yaml b/master/vault/templates/ingress.yaml deleted file mode 100644 index 8998087..0000000 --- a/master/vault/templates/ingress.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: vault-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`vault.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: vault - port: 8200 - scheme: http - tls: - secretName: vault-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: vault-tls -spec: - secretName: vault-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "vault.internal.durp.info" - dnsNames: - - "vault.internal.durp.info" - diff --git a/master/vault/templates/secret-store.yaml b/master/vault/templates/secret-store.yaml deleted file mode 100644 index e1feef8..0000000 --- a/master/vault/templates/secret-store.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ClusterSecretStore -metadata: - name: vault -spec: - provider: - vault: - server: "http://vault.vault.svc.cluster.local:8200" - path: "secrets" - version: "v2" - auth: - kubernetes: - mountPath: "kubernetes" - role: "external-secrets" diff --git a/master/vault/values.yaml b/master/vault/values.yaml deleted file mode 100644 index b7c6d88..0000000 --- a/master/vault/values.yaml +++ /dev/null @@ -1,65 +0,0 @@ -vault: - - global: - - image: - repository: "registry.internal.durp.info/hashicorp/vault-k8s" - tag: "1.4.2" - pullPolicy: Always - - agentImage: - repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.17.6" - - injector: - enabled: "-" - - replicas: 3 - leaderElector: - enabled: true - - metrics: - enabled: true - - image: - repository: "registry.internal.durp.info/hashicorp/vault-k8s" - tag: "1.4.2" - pullPolicy: Always - - agentImage: - repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.17.6" - - server: - enabled: "-" - image: - repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.17.6" - pullPolicy: Always - ha: - enabled: false - replicas: 3 - resources: - requests: - memory: 256Mi - cpu: 250m - limits: - memory: 256Mi - cpu: 250m - - dataStorage: - enabled: true - size: 10Gi - storageClass: longhorn - accessMode: ReadWriteOnce - auditStorage: - enabled: false - size: 10Gi - mountPath: "/vault/audit" - storageClass: longhorn - accessMode: ReadWriteOnce - ui: - enabled: false - externalPort: 8200 - targetPort: 8200 - diff --git a/prd/terraform/k3s.tf b/prd/terraform/k3s.tf deleted file mode 100644 index 4d02a21..0000000 --- a/prd/terraform/k3s.tf +++ /dev/null @@ -1,115 +0,0 @@ -resource "proxmox_vm_qemu" "k3smaster" { - count = local.k3smaster.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" - name = local.k3smaster.name[count.index] - target_node = local.k3smaster.node[count.index] - clone = local.template - tags = local.k3smaster.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3smaster.cores - sockets = 1 - cpu_type = "host" - memory = local.k3smaster.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3smaster.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3smaster.drive - format = local.format - storage = local.k3smaster.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} - -resource "proxmox_vm_qemu" "k3sserver" { - count = local.k3sserver.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" - name = local.k3sserver.name[count.index] - target_node = local.k3sserver.node[count.index] - clone = local.template - tags = local.k3sserver.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3sserver.cores - sockets = 1 - cpu_type = "host" - memory = local.k3sserver.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3sserver.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3sserver.drive - format = local.format - storage = local.k3sserver.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/prd/terraform/main.tf b/prd/terraform/main.tf deleted file mode 100644 index 6be6739..0000000 --- a/prd/terraform/main.tf +++ /dev/null @@ -1,48 +0,0 @@ -terraform { - backend "http" {} - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } -} - -provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false -} - -locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - format = "raw" - dnsserver = "192.168.11.1" - vlan = 11 - k3smaster = { - tags = "k3s_prd" - count = 3 - name = ["master01-prd", "master02-prd", "master03-prd"] - cores = 2 - memory = "4096" - drive = 20 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] - } - k3sserver = { - tags = "k3s_prd" - count = 3 - name = ["node01-prd", "node02-prd", "node03-prd"] - cores = 4 - memory = "8192" - drive = 120 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] - } -} diff --git a/prd/terraform/variables.tf b/prd/terraform/variables.tf deleted file mode 100644 index 29a1c9d..0000000 --- a/prd/terraform/variables.tf +++ /dev/null @@ -1,14 +0,0 @@ -variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string -} - -variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string -} - -variable "pm_user" { - description = "Username to Proxmox provider" - type = string -} From 30b6c8ebc83a60e3658b24daca2426949a3be359 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 2 Feb 2026 05:24:41 -0600 Subject: [PATCH 30/86] remove ansible --- .gitignore | 4 +- .gitlab/.gitlab-ci.yml | 34 ---- ansible/base.yaml | 5 - ansible/newcluster.yaml | 2 - ansible/roles/base/files/01proxy | 1 - ansible/roles/base/files/10periodic | 4 - ansible/roles/base/files/authorized_keys_user | 2 - ansible/roles/base/files/issue | 4 - ansible/roles/base/files/motd | 4 - ansible/roles/base/files/sshd_config_secured | 95 ----------- ansible/roles/base/tasks/main.yaml | 155 ------------------ ansible/roles/base/vars/main.yaml | 17 -- 12 files changed, 1 insertion(+), 326 deletions(-) delete mode 100644 .gitlab/.gitlab-ci.yml delete mode 100644 ansible/base.yaml delete mode 100644 ansible/newcluster.yaml delete mode 100644 ansible/roles/base/files/01proxy delete mode 100644 ansible/roles/base/files/10periodic delete mode 100644 ansible/roles/base/files/authorized_keys_user delete mode 100644 ansible/roles/base/files/issue delete mode 100644 ansible/roles/base/files/motd delete mode 100644 ansible/roles/base/files/sshd_config_secured delete mode 100644 ansible/roles/base/tasks/main.yaml delete mode 100644 ansible/roles/base/vars/main.yaml diff --git a/.gitignore b/.gitignore index 1dee64d..723ef36 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1 @@ -.idea -infra/terraform/.terraform -infra/terraform/.terraform.lock.hcl +.idea \ No newline at end of file diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml deleted file mode 100644 index b21e1bf..0000000 --- a/.gitlab/.gitlab-ci.yml +++ /dev/null @@ -1,34 +0,0 @@ -stages: - - triggers - -build_dmz: - stage: triggers - trigger: - include: dmz/.gitlab/.gitlab-ci.yml - rules: - - changes: - - "dmz/terraform/*.tf" - -build_infra: - stage: triggers - trigger: - include: infra/.gitlab/.gitlab-ci.yml - rules: - - changes: - - "infra/terraform/*.tf" - -build_dev: - stage: triggers - trigger: - include: dev/.gitlab/.gitlab-ci.yml - rules: - - changes: - - "dev/terraform/*.tf" - -build_prd: - stage: triggers - trigger: - include: prd/.gitlab/.gitlab-ci.yml - rules: - - changes: - - "prd/terraform/*.tf" diff --git a/ansible/base.yaml b/ansible/base.yaml deleted file mode 100644 index 9093cdb..0000000 --- a/ansible/base.yaml +++ /dev/null @@ -1,5 +0,0 @@ -- hosts: all - gather_facts: yes - become: yes - roles: - - base diff --git a/ansible/newcluster.yaml b/ansible/newcluster.yaml deleted file mode 100644 index 4fb3572..0000000 --- a/ansible/newcluster.yaml +++ /dev/null @@ -1,2 +0,0 @@ -argocd login --insecure -argocd cluster add default --name prd --yes --kubeconfig ~/Documents/config-prd diff --git a/ansible/roles/base/files/01proxy b/ansible/roles/base/files/01proxy deleted file mode 100644 index 947368d..0000000 --- a/ansible/roles/base/files/01proxy +++ /dev/null @@ -1 +0,0 @@ -Acquire::http::Proxy "http://192.168.21.200:3142"; diff --git a/ansible/roles/base/files/10periodic b/ansible/roles/base/files/10periodic deleted file mode 100644 index 5d37e9f..0000000 --- a/ansible/roles/base/files/10periodic +++ /dev/null @@ -1,4 +0,0 @@ -APT::Periodic::Update-Package-Lists "1"; -APT::Periodic::Download-Upgradeable-Packages "1"; -APT::Periodic::AutocleanInterval "7"; -APT::Periodic::Unattended-Upgrade "1"; diff --git a/ansible/roles/base/files/authorized_keys_user b/ansible/roles/base/files/authorized_keys_user deleted file mode 100644 index 49d58bb..0000000 --- a/ansible/roles/base/files/authorized_keys_user +++ /dev/null @@ -1,2 +0,0 @@ -sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGilcndatMrXg06VxtNKuIo3scoyyXbYX8Z7cOjeA102AAAABHNzaDo= desktop-arch-09-08-2025-yubikey -sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINsbNSZ5Wr+50Ahz+IeZxt6F7gZ6wm1J8uKXQLbdbKFaAAAABHNzaDo= desktop-arch-09-08-2025-yubikeyNano \ No newline at end of file diff --git a/ansible/roles/base/files/issue b/ansible/roles/base/files/issue deleted file mode 100644 index 5acb66f..0000000 --- a/ansible/roles/base/files/issue +++ /dev/null @@ -1,4 +0,0 @@ -Use of this system is restricted to authorized users only, and all use is subjected to an acceptable use policy. - -IF YOU ARE NOT AUTHORIZED TO USE THIS SYSTEM, DISCONNECT NOW. - diff --git a/ansible/roles/base/files/motd b/ansible/roles/base/files/motd deleted file mode 100644 index fa6c8db..0000000 --- a/ansible/roles/base/files/motd +++ /dev/null @@ -1,4 +0,0 @@ -THIS SYSTEM IS FOR AUTHORIZED USE ONLY - -All activities are logged and monitored. - diff --git a/ansible/roles/base/files/sshd_config_secured b/ansible/roles/base/files/sshd_config_secured deleted file mode 100644 index 88bfedb..0000000 --- a/ansible/roles/base/files/sshd_config_secured +++ /dev/null @@ -1,95 +0,0 @@ -# Package generated configuration file -# See the sshd_config(5) manpage for details - -# What ports, IPs and protocols we listen for -Port 22 -# Use these options to restrict which interfaces/protocols sshd will bind to -#ListenAddress :: -#ListenAddress 0.0.0.0 -Protocol 2 -# HostKeys for protocol version 2 -HostKey /etc/ssh/ssh_host_rsa_key -HostKey /etc/ssh/ssh_host_dsa_key -HostKey /etc/ssh/ssh_host_ecdsa_key -HostKey /etc/ssh/ssh_host_ed25519_key -#Privilege Separation is turned on for security -UsePrivilegeSeparation yes - -# Lifetime and size of ephemeral version 1 server key -KeyRegenerationInterval 3600 -ServerKeyBits 1024 - -# Logging -SyslogFacility AUTH -LogLevel INFO - -# Authentication: -LoginGraceTime 120 -PermitRootLogin no -StrictModes yes - -RSAAuthentication yes -PubkeyAuthentication yes -#AuthorizedKeysFile %h/.ssh/authorized_keys - -# Don't read the user's ~/.rhosts and ~/.shosts files -IgnoreRhosts yes -# For this to work you will also need host keys in /etc/ssh_known_hosts -RhostsRSAAuthentication no -# similar for protocol version 2 -HostbasedAuthentication no -# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication -#IgnoreUserKnownHosts yes - -# To enable empty passwords, change to yes (NOT RECOMMENDED) -PermitEmptyPasswords no - -# Change to yes to enable challenge-response passwords (beware issues with -# some PAM modules and threads) -ChallengeResponseAuthentication no - -# Change to no to disable tunnelled clear text passwords -PasswordAuthentication no - -# Kerberos options -#KerberosAuthentication no -#KerberosGetAFSToken no -#KerberosOrLocalPasswd yes -#KerberosTicketCleanup yes - -# GSSAPI options -#GSSAPIAuthentication no -#GSSAPICleanupCredentials yes - -X11Forwarding no -X11DisplayOffset 10 -PrintMotd no -PrintLastLog yes -TCPKeepAlive yes -#UseLogin no - -#MaxStartups 10:30:60 -#Banner /etc/issue.net - -# Allow client to pass locale environment variables -AcceptEnv LANG LC_* - -Subsystem sftp /usr/lib/openssh/sftp-server - -# Set this to 'yes' to enable PAM authentication, account processing, -# and session processing. If this is enabled, PAM authentication will -# be allowed through the ChallengeResponseAuthentication and -# PasswordAuthentication. Depending on your PAM configuration, -# PAM authentication via ChallengeResponseAuthentication may bypass -# the setting of "PermitRootLogin without-password". -# If you just want the PAM account and session checks to run without -# PAM authentication, then enable this but set PasswordAuthentication -# and ChallengeResponseAuthentication to 'no'. -UsePAM yes - -ClientAliveInterval 300 - -#enable remote powershell -#Subsystem powershell /usr/bin/pwsh -sshs -NoLogo - - diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml deleted file mode 100644 index 8cb1553..0000000 --- a/ansible/roles/base/tasks/main.yaml +++ /dev/null @@ -1,155 +0,0 @@ -- name: Copy apt proxy - copy: - src: files/01proxy - dest: /etc/apt/apt.conf.d/01proxy - owner: root - group: root - mode: "0644" - force: yes - when: - - ansible_os_family == "Debian" - - inventory_hostname not in hosts_deny - -- name: Update packages - apt: - name: '*' - state: latest - update_cache: yes - only_upgrade: yes - retries: 300 - delay: 10 - -- name: Remove packages not needed anymore - apt: - autoremove: yes - retries: 300 - delay: 10 - -- name: Install required packages Debian - apt: - state: latest - pkg: "{{ item }}" - with_items: "{{ required_packages }}" - retries: 300 - delay: 10 - -- name: Create user account - user: - name: "user" - shell: /bin/bash - state: present - createhome: yes - -- name: ensure ssh folder exists for user - file: - path: /home/user/.ssh - owner: user - group: user - mode: "0700" - state: directory - -- name: Deploy SSH Key (user) - copy: - dest: /home/user/.ssh/authorized_keys - src: files/authorized_keys_user - owner: user - group: user - force: true - -- name: Remove Root SSH Configuration - file: - path: /root/.ssh - state: absent - -- name: Copy Secured SSHD Configuration - copy: - src: files/sshd_config_secured - dest: /etc/ssh/sshd_config - owner: root - group: root - mode: "0644" - when: ansible_os_family == "Debian" - -- name: Copy Secured SSHD Configuration - copy: - src: files/sshd_config_secured_redhat - dest: /etc/ssh/sshd_config - owner: root - group: root - mode: "0644" - when: ansible_os_family == "RedHat" - -- name: Restart SSHD - systemd: - name: sshd - daemon_reload: yes - state: restarted - enabled: yes - ignore_errors: yes - - -- name: Copy unattended-upgrades file - copy: - src: files/10periodic - dest: /etc/apt/apt.conf.d/10periodic - owner: root - group: root - mode: "0644" - force: yes - when: ansible_os_family == "Debian" - -- name: Remove undesirable packages - package: - name: "{{ unnecessary_software }}" - state: absent - when: ansible_os_family == "Debian" - -- name: Stop and disable unnecessary services - service: - name: "{{ item }}" - state: stopped - enabled: no - with_items: "{{ unnecessary_services }}" - ignore_errors: yes - -- name: Set a message of the day - copy: - dest: /etc/motd - src: files/motd - owner: root - group: root - mode: 0644 - -- name: Set a login banner - copy: - dest: "{{ item }}" - src: files/issue - owner: root - group: root - mode: 0644 - with_items: - - /etc/issue - - /etc/issue.net - -- name: set timezone - shell: timedatectl set-timezone America/Chicago - -- name: Enable cockpit - systemd: - name: cockpit - daemon_reload: yes - state: restarted - enabled: yes - -- name: change password - ansible.builtin.user: - name: "user" - state: present - password: "{{ lookup('ansible.builtin.env', 'USER_PASSWORD') | password_hash('sha512') }}" - -- name: add user to sudoers - community.general.sudoers: - name: user - state: present - user: user - commands: ALL diff --git a/ansible/roles/base/vars/main.yaml b/ansible/roles/base/vars/main.yaml deleted file mode 100644 index 2670ac2..0000000 --- a/ansible/roles/base/vars/main.yaml +++ /dev/null @@ -1,17 +0,0 @@ -required_packages: - - ufw - - qemu-guest-agent - - fail2ban - - unattended-upgrades - - cockpit - - nfs-common - - open-iscsi - -unnecessary_services: - - postfix - - telnet - -unnecessary_software: - - tcpdump - - nmap-ncat - - wpa_supplicant From bbd94d3f2248bb57ebba2429337d6069da3d69da Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 4 Feb 2026 05:30:09 -0600 Subject: [PATCH 31/86] update --- infra/renovate/Chart.yaml | 5 +- infra/renovate/templates/secrets.yaml | 37 +++ infra/renovate/values.yaml | 330 ++++++++++++++++++++++++++ 3 files changed, 371 insertions(+), 1 deletion(-) diff --git a/infra/renovate/Chart.yaml b/infra/renovate/Chart.yaml index e91e2d5..b33c633 100644 --- a/infra/renovate/Chart.yaml +++ b/infra/renovate/Chart.yaml @@ -10,4 +10,7 @@ dependencies: - name: renovate repository: https://docs.renovatebot.com/helm-charts version: 39.264.0 - + - name: renovate + repository: https://docs.renovatebot.com/helm-charts + version: 39.264.0 + alias: "renovatePersonal" diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index f4ac24c..e1e5fce 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -39,3 +39,40 @@ spec: remoteRef: key: kv/renovate property: RENOVATE_TOKEN + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: renovate-personal-config-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: renovate-personal-config-secret + data: + - secretKey: renovate.json + remoteRef: + key: kv/renoatePersonal + property: config + - secretKey: RENOVATE_AUTODISCOVER + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_AUTODISCOVER + - secretKey: RENOVATE_ENDPOINT + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_ENDPOINT + - secretKey: RENOVATE_GIT_AUTHOR + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_GIT_AUTHOR + - secretKey: RENOVATE_PLATFORM + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_PLATFORM + - secretKey: RENOVATE_TOKEN + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_TOKEN diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index b14286c..b9c7452 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -327,3 +327,333 @@ renovate: # "platform": "github", # "repositories": ["username/repo", "orgname/repo"] # } + +renovatePersonal: + global: + # -- Additional labels to be set on all renovate resources + commonLabels: {} + compatibility: + openshift: + # -- Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: `auto` (apply if the detected running cluster is Openshift), `force` (perform the adaptation always), `disabled` (do not perform adaptation) + adaptSecurityContext: "auto" + + # -- Override the name of the chart + nameOverride: "" + # -- Override the fully qualified app name + fullnameOverride: "" + # -- Annotations to add to secret + secretAnnotations: {} + + cronjob: + # -- Schedules the job to run using cron notation + schedule: "0 1 * * *" # At 01:00 every day + # -- You can specify a time zone for a CronJob by setting timeZone to the name of a valid time zone. (starting with k8s 1.27) + timeZone: "" # see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for valid names + # -- If it is set to true, all subsequent executions are suspended. This setting does not apply to already started executions. + suspend: false + # -- Annotations to set on the cronjob + annotations: {} + # -- Labels to set on the cronjob + labels: {} + # -- "Allow" to allow concurrent runs, "Forbid" to skip new runs if a previous run is still running or "Replace" to replace the previous run + concurrencyPolicy: "" + # -- "Number of successful completions is reached to mark the job as complete" + completions: "" + # -- "Where the jobs should be NonIndexed or Indexed" + completionMode: "" + # -- Amount of failed jobs to keep in history + failedJobsHistoryLimit: "" + # -- Amount of completed jobs to keep in history + successfulJobsHistoryLimit: "" + # -- Set to Never to restart the job when the pod fails or to OnFailure to restart when a container fails + jobRestartPolicy: Never + # -- Time to keep the job after it finished before automatically deleting it + ttlSecondsAfterFinished: "" + # -- Deadline for the job to finish + activeDeadlineSeconds: "" + # -- Number of times to retry running the pod before considering the job as being failed + jobBackoffLimit: "" + # -- Maximal number of failures per index + backoffLimitPerIndex: "" + # -- Maximal number of failed indexes before terminating the Job execution + maxFailedIndexes: "" + # -- Deadline to start the job, skips execution if job misses it's configured deadline + startingDeadlineSeconds: "" + # -- Additional initContainers that can be executed before renovate + initContainers: [] + # initContainers: + # - name: INIT_CONTAINER_NAME + # image: INIT_CONTAINER_IMAGE + # -- Number of pods to run in parallel + parallelism: "" + # -- Custom command to run in the container + commandOverride: [] + # -- Custom arguments to run in the container + argsOverride: [] + # -- Prepend shell commands before renovate runs + #preCommand: '' + #preCommand: | + # ls /config + # cat /config/renovate.json + + postCommand: "" + # postCommand: | + # echo hello + # echo world + + pod: + # -- Annotations to set on the pod + annotations: {} + # -- Labels to set on the pod + labels: {} + + image: + # -- Registry to pull image from + registry: registry.durp.info + # -- Image name to pull + repository: renovatebot/renovate + # -- Renovate image tag to pull + #tag: 39.264.0 + # -- "IfNotPresent" to pull the image if no image with the specified tag exists on the node, "Always" to always pull the image or "Never" to try and use pre-pulled images + pullPolicy: Always + # -- Set `true` to use the full image. See https://docs.renovatebot.com/getting-started/running/#the-full-image + useFull: false + + # -- Secret to use to pull the image from the repository + imagePullSecrets: {} + + renovate: + # -- Custom exiting global renovate config + #existingConfigFile: "/config/renovate.json" + # -- Inline global renovate config.json + config: | + { + "platform": "gitlab", + "endpoint": "https://gitlab.durp.info/api/v4", + "autodiscover": "true", + "dryRun": false, + "printConfig": false, + "autodiscoverFilter": ["durfy/*"], + "assignees": ["developerdurp"], + } + # See https://docs.renovatebot.com/self-hosted-configuration + # config: | + # { + # "": "gitlab", + # "endpoint": "https://gitlab.example.com/api/v4", + # "token": "your-gitlab-renovate-user-token", + # "autodiscover": "false", + # "dryRun": true, + # "printConfig": true, + # "repositories": ["username/repo", "orgname/repo"] + # } + + # -- Use the Helm tpl function on your configuration. See README for how to use this value + configEnableHelmTpl: false + + # -- Use this to create the renovate-config as a secret instead of a configmap + configIsSecret: true + + # -- Use this to create a config.js instead of a config.json + configIsJavaScript: false + + # -- Renovate Container-level security-context + securityContext: {} + + # Instead of a file system cache, it is highly recommended to use the redis subchart. + # Alternatively, SQLite is also a good choice. + # Take a look at https://github.com/renovatebot/renovate/discussions/30525 for more information. + # -- Options related to persistence + persistence: + cache: + # -- Allow the cache to persist between runs + enabled: false + # -- Storage class of the cache PVC + storageClass: "" + # -- Storage size of the cache PVC + storageSize: "512Mi" + # -- Existing volume, enables binding the pvc to an existing volume + volumeName: "" + # -- Labels to set on the cache PVC + labels: {} + + ssh_config: + # -- Whether to enable the use and creation of a secret containing .ssh files + enabled: false + + # Provide .ssh config file contents + # -- Contents of the id_rsa file + id_rsa: "" + # -- Contents of the id_rsa_pub file + id_rsa_pub: "" + # -- Contents of the config file + config: "" + + # or provide the name of an existing secret to be read instead. + # -- Name of the existing secret containing a valid .ssh configuration + existingSecret: "" + + # -- Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set + secrets: {} + # -- k8s secret to reference environment variables from. Overrides secrets if set + existingSecret: "renovate-personal-config-secret" + + # -- Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config + extraConfigmaps: [] + # extraConfigmaps: + # - name: netrc-config + # data: + # .netrc: |- + # machine gitlab.example.com + # login gitlab-ci-token + # password some-pass + # - name: yet-another-config + # data: + # ya-config.yaml: |- + # "key"="value" + # "key1"="value1" + + #extraVolumes: + # - name: renovate-config-secret + # secretName: + # name: renovate-config-secret + # items: + # - key: renovate.json + # path: renovate.json + + #extraVolumeMounts: + # - name: renovate-config-secret + # mountPath: /config + # subPath: renovate.json + + # -- Additional containers to the pod + extraContainers: [] + # extraContainers: + # - name: vault-agent + # image: vault:1.6.2 + # args: + # - agent + # - -config + # - /vault/config/config.hcl + # env: + # - name: VAULT_ADDR + # value: https://vault:8200 + # - name: VAULT_SKIP_VERIFY + # value: "false" + # - name: VAULT_CACERT + # value: /vault/tls/ca.crt + + serviceAccount: + # -- Specifies whether a service account should be created + create: false + # -- Annotations to add to the service account + annotations: {} + # -- The name of the service account to use + # If not set and create is true, a name is generated using the fullname template + name: "" + + # -- Specify resource limits and requests for the renovate container + resources: + {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + + # -- Environment variables to add from existing secrets/configmaps. Uses the keys as variable name + envFrom: [] + # envFrom: + # - secretRef: + # name: env-secrets + # - configMapRef: + # name: env-configmap + + # -- Environment variables to set on the renovate container + env: + RENOVATE_AUTODISCOVER: true + # env: + # VARIABLE_NAME: "value" + + # -- Additional env. Helpful too if you want to use anything other than a `value` source. + envList: [] + # envList: + # - name: POD_NAME + # valueFrom: + # fieldRef: + # fieldPath: metadata.name + + redis: + # Configuration for a Redis subchart. Additional documentation at + # https://github.com/bitnami/charts/tree/master/bitnami/redis + + # -- Enable the Redis subchart? + enabled: false + + # -- Override the prefix of the redisHost + nameOverride: "" + + # -- Disable replication by default + architecture: standalone + + auth: + # -- Don't require a password by default + enabled: false + + # -- Override Kubernetes version for redis chart + kubeVersion: "" + + # -- Override hostname resolution + hostAliases: [] + # See: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ + # hostAliases: + # - ip: "your-ip" + # hostnames: + # - "your-hostname" + + # -- Pod-level security-context + securityContext: {} + + # -- Select the node using labels to specify where the cronjob pod should run on + nodeSelector: {} + # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # renovate: true + + # -- Configure the pod(Anti)Affinity and/or node(Anti)Affinity + affinity: {} + # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + + # -- Configure which node taints the pod should tolerate + tolerations: [] + # See: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + + # -- Create extra manifests via values. Would be passed through `tpl` for templating + extraObjects: [] + # extraObjects: + # - apiVersion: external-secrets.io/v1 + # kind: ExternalSecret + # metadata: + # name: '{{ include "renovate.fullname" . }}-token' + # spec: + # secretStoreRef: + # name: default + # data: + # - secretKey: token + # remoteRef: + # key: github-token + # - | + # apiVersion: v1 + # kind: ConfigMap + # metadata: + # name: {{ include "renovate.fullname" . }}-config + # data: + # config.json: | + # { + # "platform": "github", + # "repositories": ["username/repo", "orgname/repo"] + # } From f35949a328e7545e5760f4b3921fa8ac02aa00b7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 4 Feb 2026 05:32:52 -0600 Subject: [PATCH 32/86] update --- infra/argocd/templates/renovate.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/templates/renovate.yaml b/infra/argocd/templates/renovate.yaml index 659d61f..debce7a 100644 --- a/infra/argocd/templates/renovate.yaml +++ b/infra/argocd/templates/renovate.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/renovate destination: From 3f40dcb38c6d884f89d9b47994304e8363b4b7b0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 4 Feb 2026 05:35:30 -0600 Subject: [PATCH 33/86] update --- infra/renovate/Chart.yaml | 2 +- infra/renovate/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/renovate/Chart.yaml b/infra/renovate/Chart.yaml index b33c633..05ed75f 100644 --- a/infra/renovate/Chart.yaml +++ b/infra/renovate/Chart.yaml @@ -13,4 +13,4 @@ dependencies: - name: renovate repository: https://docs.renovatebot.com/helm-charts version: 39.264.0 - alias: "renovatePersonal" + alias: "renovate-personal" diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index b9c7452..c4da8ba 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -328,7 +328,7 @@ renovate: # "repositories": ["username/repo", "orgname/repo"] # } -renovatePersonal: +renovate-personal: global: # -- Additional labels to be set on all renovate resources commonLabels: {} From 50138f25e642a471afe38fb37d0a82223c12d6fe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 04:53:32 -0600 Subject: [PATCH 34/86] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index c4da8ba..1f6fb60 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -434,7 +434,7 @@ renovate-personal: "dryRun": false, "printConfig": false, "autodiscoverFilter": ["durfy/*"], - "assignees": ["developerdurp"], + "assignees": ["durp"], } # See https://docs.renovatebot.com/self-hosted-configuration # config: | From e3547898ec3dc67cac5ffb98cbae52126db631d1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:11:50 -0600 Subject: [PATCH 35/86] update --- infra/renovate/templates/secrets.yaml | 20 -------------------- infra/renovate/values.yaml | 6 +++--- 2 files changed, 3 insertions(+), 23 deletions(-) diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index e1e5fce..5ee1d1f 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -52,26 +52,6 @@ spec: target: name: renovate-personal-config-secret data: - - secretKey: renovate.json - remoteRef: - key: kv/renoatePersonal - property: config - - secretKey: RENOVATE_AUTODISCOVER - remoteRef: - key: kv/renoatePersonal - property: RENOVATE_AUTODISCOVER - - secretKey: RENOVATE_ENDPOINT - remoteRef: - key: kv/renoatePersonal - property: RENOVATE_ENDPOINT - - secretKey: RENOVATE_GIT_AUTHOR - remoteRef: - key: kv/renoatePersonal - property: RENOVATE_GIT_AUTHOR - - secretKey: RENOVATE_PLATFORM - remoteRef: - key: kv/renoatePersonal - property: RENOVATE_PLATFORM - secretKey: RENOVATE_TOKEN remoteRef: key: kv/renoatePersonal diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 1f6fb60..f2e2ae7 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -430,11 +430,11 @@ renovate-personal: { "platform": "gitlab", "endpoint": "https://gitlab.durp.info/api/v4", - "autodiscover": "true", - "dryRun": false, + "autodiscover": true, + "dryRun": null, "printConfig": false, "autodiscoverFilter": ["durfy/*"], - "assignees": ["durp"], + "assignees": ["durp"] } # See https://docs.renovatebot.com/self-hosted-configuration # config: | From cc7ed8c81a83514d8a21ce9ac4b274802e02d7d5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:15:16 -0600 Subject: [PATCH 36/86] update --- infra/renovate/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index f2e2ae7..574cc88 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -577,6 +577,7 @@ renovate-personal: # -- Environment variables to set on the renovate container env: RENOVATE_AUTODISCOVER: true + LOG_LEVEL: debug # env: # VARIABLE_NAME: "value" From 8173a53e53a363fff9d55dae37d5d651481ca1db Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:19:20 -0600 Subject: [PATCH 37/86] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 574cc88..bc5d1d8 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -433,7 +433,7 @@ renovate-personal: "autodiscover": true, "dryRun": null, "printConfig": false, - "autodiscoverFilter": ["durfy/*"], + "autodiscoverFilter": ["durfy/**"], "assignees": ["durp"] } # See https://docs.renovatebot.com/self-hosted-configuration From 2319a2eecd7333806cb9d2cf16da62868c7b591a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:20:20 -0600 Subject: [PATCH 38/86] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index bc5d1d8..adec42f 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -577,7 +577,7 @@ renovate-personal: # -- Environment variables to set on the renovate container env: RENOVATE_AUTODISCOVER: true - LOG_LEVEL: debug + #LOG_LEVEL: debug # env: # VARIABLE_NAME: "value" From 3907301d135019de50586e690a2b4b2876b4b713 Mon Sep 17 00:00:00 2001 From: RenovateBot Date: Thu, 5 Feb 2026 11:21:01 +0000 Subject: [PATCH 39/86] Update Helm release portainer to v2.33.6 --- infra/portainer/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/portainer/Chart.yaml b/infra/portainer/Chart.yaml index 1813d7a..6bedd0a 100644 --- a/infra/portainer/Chart.yaml +++ b/infra/portainer/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: portainer repository: https://portainer.github.io/k8s/ - version: 2.33.5 + version: 2.33.6 From 38475db228782af052b1adce2ea6e17238b7bc1e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:26:47 -0600 Subject: [PATCH 40/86] update --- infra/renovate/templates/secrets.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index 5ee1d1f..d42ab7e 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -56,3 +56,7 @@ spec: remoteRef: key: kv/renoatePersonal property: RENOVATE_TOKEN + - secretKey: RENOVATE_GITHUB_COM_TOKEN + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_GITHUB_COM_TOKEN From 1b37247b5219ec4bec4910e20f24de56d38651e7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:35:41 -0600 Subject: [PATCH 41/86] update to personal gitlab --- infra/argocd/templates/argocd.yaml | 2 +- infra/argocd/templates/authentik.yaml | 4 ++-- infra/argocd/templates/bitwarden.yaml | 2 +- infra/argocd/templates/cert-manager.yaml | 4 ++-- infra/argocd/templates/external-dns.yaml | 2 +- infra/argocd/templates/external-secrets.yaml | 4 ++-- infra/argocd/templates/gitlab-runner.yaml | 2 +- infra/argocd/templates/internalproxy.yaml | 2 +- infra/argocd/templates/istio.yaml | 4 ++-- infra/argocd/templates/kube-prometheus-stack.yaml | 2 +- infra/argocd/templates/litellm.yaml | 2 +- infra/argocd/templates/littlelink.yaml | 2 +- infra/argocd/templates/longhorn.yaml | 4 ++-- infra/argocd/templates/metallb-system.yaml | 6 +++--- infra/argocd/templates/nebula-sync.yaml | 2 +- infra/argocd/templates/nfs.yaml | 2 +- infra/argocd/templates/openclarity.yaml | 2 +- infra/argocd/templates/openspeedtest.yaml | 2 +- infra/argocd/templates/portainer.yaml | 2 +- infra/argocd/templates/redlib.yaml | 2 +- infra/argocd/templates/searxng.yaml | 2 +- infra/argocd/templates/traefik.yaml | 6 +++--- infra/argocd/templates/vault.yaml | 4 ++-- 23 files changed, 33 insertions(+), 33 deletions(-) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index 54e36bd..14141da 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/argocd destination: diff --git a/infra/argocd/templates/authentik.yaml b/infra/argocd/templates/authentik.yaml index 42be478..ac5f8dc 100644 --- a/infra/argocd/templates/authentik.yaml +++ b/infra/argocd/templates/authentik.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/authentik destination: @@ -31,7 +31,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/authentik destination: diff --git a/infra/argocd/templates/bitwarden.yaml b/infra/argocd/templates/bitwarden.yaml index e9b4905..a42abbc 100644 --- a/infra/argocd/templates/bitwarden.yaml +++ b/infra/argocd/templates/bitwarden.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/bitwarden destination: diff --git a/infra/argocd/templates/cert-manager.yaml b/infra/argocd/templates/cert-manager.yaml index e7ac95d..31ef868 100644 --- a/infra/argocd/templates/cert-manager.yaml +++ b/infra/argocd/templates/cert-manager.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/cert-manager destination: @@ -29,7 +29,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/cert-manager destination: diff --git a/infra/argocd/templates/external-dns.yaml b/infra/argocd/templates/external-dns.yaml index 6edb645..caa32d9 100644 --- a/infra/argocd/templates/external-dns.yaml +++ b/infra/argocd/templates/external-dns.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/external-dns destination: diff --git a/infra/argocd/templates/external-secrets.yaml b/infra/argocd/templates/external-secrets.yaml index 0583fea..7787a03 100644 --- a/infra/argocd/templates/external-secrets.yaml +++ b/infra/argocd/templates/external-secrets.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/external-secrets destination: @@ -29,7 +29,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/external-secrets destination: diff --git a/infra/argocd/templates/gitlab-runner.yaml b/infra/argocd/templates/gitlab-runner.yaml index de73c0c..25b82bb 100644 --- a/infra/argocd/templates/gitlab-runner.yaml +++ b/infra/argocd/templates/gitlab-runner.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/gitlab-runner destination: diff --git a/infra/argocd/templates/internalproxy.yaml b/infra/argocd/templates/internalproxy.yaml index 57e2c60..9381c2d 100644 --- a/infra/argocd/templates/internalproxy.yaml +++ b/infra/argocd/templates/internalproxy.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/internalproxy destination: diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index 4d9d6d5..615a43f 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/istio-system destination: @@ -36,7 +36,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/istio-system destination: diff --git a/infra/argocd/templates/kube-prometheus-stack.yaml b/infra/argocd/templates/kube-prometheus-stack.yaml index d89dad1..bc52501 100644 --- a/infra/argocd/templates/kube-prometheus-stack.yaml +++ b/infra/argocd/templates/kube-prometheus-stack.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/kube-prometheus-stack destination: diff --git a/infra/argocd/templates/litellm.yaml b/infra/argocd/templates/litellm.yaml index 7c818dc..d8e225a 100644 --- a/infra/argocd/templates/litellm.yaml +++ b/infra/argocd/templates/litellm.yaml @@ -6,7 +6,7 @@ #spec: # project: default # source: -# repoURL: https://gitlab.com/developerdurp/homelab.git +# repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git # targetRevision: main # path: infra/litellm # destination: diff --git a/infra/argocd/templates/littlelink.yaml b/infra/argocd/templates/littlelink.yaml index 5821718..2d6011f 100644 --- a/infra/argocd/templates/littlelink.yaml +++ b/infra/argocd/templates/littlelink.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/littlelink directory: diff --git a/infra/argocd/templates/longhorn.yaml b/infra/argocd/templates/longhorn.yaml index 33eda6e..f28a74c 100644 --- a/infra/argocd/templates/longhorn.yaml +++ b/infra/argocd/templates/longhorn.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/longhorn destination: @@ -33,7 +33,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/longhorn destination: diff --git a/infra/argocd/templates/metallb-system.yaml b/infra/argocd/templates/metallb-system.yaml index bac4be3..a9b33d0 100644 --- a/infra/argocd/templates/metallb-system.yaml +++ b/infra/argocd/templates/metallb-system.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/metallb-system destination: @@ -29,7 +29,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/metallb-system destination: @@ -52,7 +52,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dev/metallb-system destination: diff --git a/infra/argocd/templates/nebula-sync.yaml b/infra/argocd/templates/nebula-sync.yaml index dea50a7..d19b024 100644 --- a/infra/argocd/templates/nebula-sync.yaml +++ b/infra/argocd/templates/nebula-sync.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/nebula-sync destination: diff --git a/infra/argocd/templates/nfs.yaml b/infra/argocd/templates/nfs.yaml index f7e964f..c006f32 100644 --- a/infra/argocd/templates/nfs.yaml +++ b/infra/argocd/templates/nfs.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/nfs destination: diff --git a/infra/argocd/templates/openclarity.yaml b/infra/argocd/templates/openclarity.yaml index 64307d6..57c1995 100644 --- a/infra/argocd/templates/openclarity.yaml +++ b/infra/argocd/templates/openclarity.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/openclarity destination: diff --git a/infra/argocd/templates/openspeedtest.yaml b/infra/argocd/templates/openspeedtest.yaml index 5d79f9c..ead0679 100644 --- a/infra/argocd/templates/openspeedtest.yaml +++ b/infra/argocd/templates/openspeedtest.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/openspeedtest directory: diff --git a/infra/argocd/templates/portainer.yaml b/infra/argocd/templates/portainer.yaml index d8b5d32..22b2a9b 100644 --- a/infra/argocd/templates/portainer.yaml +++ b/infra/argocd/templates/portainer.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/portainer destination: diff --git a/infra/argocd/templates/redlib.yaml b/infra/argocd/templates/redlib.yaml index 901c316..3867fb7 100644 --- a/infra/argocd/templates/redlib.yaml +++ b/infra/argocd/templates/redlib.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/redlib directory: diff --git a/infra/argocd/templates/searxng.yaml b/infra/argocd/templates/searxng.yaml index 174c060..9e05411 100644 --- a/infra/argocd/templates/searxng.yaml +++ b/infra/argocd/templates/searxng.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/searxng directory: diff --git a/infra/argocd/templates/traefik.yaml b/infra/argocd/templates/traefik.yaml index 0136c94..0ea06aa 100644 --- a/infra/argocd/templates/traefik.yaml +++ b/infra/argocd/templates/traefik.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/traefik destination: @@ -32,7 +32,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/traefik destination: @@ -58,7 +58,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dev/traefik destination: diff --git a/infra/argocd/templates/vault.yaml b/infra/argocd/templates/vault.yaml index 351d06f..b5f6a0b 100644 --- a/infra/argocd/templates/vault.yaml +++ b/infra/argocd/templates/vault.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/vault destination: @@ -34,7 +34,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/vault destination: From 268e8b7af53cb1288797e069369a6aaf3e8a664f Mon Sep 17 00:00:00 2001 From: RenovateBot Date: Fri, 6 Feb 2026 07:01:19 +0000 Subject: [PATCH 42/86] Update docker.io/aquasec/trivy Docker tag to v0.69.1 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 099b435..e77ca5a 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -542,7 +542,7 @@ openclarity: # -- Trivy Server container repository repository: aquasec/trivy # -- Trivy Server container tag - tag: 0.64.1 + tag: 0.69.1 # -- Trivy Server image digest. If set will override the tag. digest: "" # -- Trivy Server image pull policy From 0af5e1f9c17b8c212aae95e6c21dfda3de3dc0fc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 6 Feb 2026 05:37:36 -0600 Subject: [PATCH 43/86] update --- dmz/gitlab-runner/values.yaml | 46 +++++++++++++++++------------------ 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/dmz/gitlab-runner/values.yaml b/dmz/gitlab-runner/values.yaml index cbf56dc..3e7ddb6 100644 --- a/dmz/gitlab-runner/values.yaml +++ b/dmz/gitlab-runner/values.yaml @@ -18,15 +18,15 @@ gitlab-runner: podSecurityPolicy: enabled: false resourceNames: - - gitlab-runner + - gitlab-runner metrics: enabled: true serviceMonitor: - enabled: true + enabled: true service: enabled: true - annotations: {} + annotations: {} runners: config: | @@ -41,15 +41,15 @@ gitlab-runner: runUntagged: true privileged: true secret: gitlab-secret - #builds: + #builds: #cpuLimit: 200m #cpuLimitOverwriteMaxAllowed: 400m #memoryLimit: 256Mi #memoryLimitOverwriteMaxAllowed: 512Mi #cpuRequests: 100m #cpuRequestsOverwriteMaxAllowed: 200m - #memoryRequests: 128Mi - #memoryRequestsOverwriteMaxAllowed: 256Mi + #memoryRequests: 128Mi + #memoryRequestsOverwriteMaxAllowed: 256Mi securityContext: allowPrivilegeEscalation: false @@ -63,12 +63,12 @@ gitlab-runner: runAsUser: 100 fsGroup: 65533 - resources: + resources: limits: memory: 2Gi requests: memory: 128Mi - cpu: 500m + cpu: 50m personal: @@ -77,7 +77,7 @@ personal: image: gitlab-org/gitlab-runner imagePullPolicy: Always - gitlabUrl: https://gitlab.com/ + gitlabUrl: https://gitlab.durp.info/ unregisterRunner: false terminationGracePeriodSeconds: 3600 concurrent: 10 @@ -90,15 +90,15 @@ personal: podSecurityPolicy: enabled: false resourceNames: - - gitlab-runner + - gitlab-runner metrics: enabled: true serviceMonitor: - enabled: true + enabled: true service: enabled: true - annotations: {} + annotations: {} runners: config: | @@ -113,15 +113,15 @@ personal: runUntagged: true privileged: true secret: gitlab-secret-personal - #builds: - #cpuLimit: 200m - #cpuLimitOverwriteMaxAllowed: 400m - #memoryLimit: 256Mi - #memoryLimitOverwriteMaxAllowed: 512Mi - #cpuRequests: 100m - #cpuRequestsOverwriteMaxAllowed: 200m - #memoryRequests: 128Mi - #memoryRequestsOverwriteMaxAllowed: 256Mi + builds: + cpuLimit: 200m + cpuLimitOverwriteMaxAllowed: 400m + memoryLimit: 256Mi + memoryLimitOverwriteMaxAllowed: 512Mi + cpuRequests: 100m + cpuRequestsOverwriteMaxAllowed: 200m + memoryRequests: 128Mi + memoryRequestsOverwriteMaxAllowed: 256Mi securityContext: allowPrivilegeEscalation: false @@ -135,9 +135,9 @@ personal: runAsUser: 100 fsGroup: 65533 - resources: + resources: limits: memory: 2Gi requests: memory: 128Mi - cpu: 500m + cpu: 50m From 0e20657811fa124d4f69d0f0943d2b0374be5521 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 14 Feb 2026 04:57:57 -0600 Subject: [PATCH 44/86] update --- dmz/internalproxy/templates/nexus.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/nexus.yaml b/dmz/internalproxy/templates/nexus.yaml index 683fe8d..ed609d9 100644 --- a/dmz/internalproxy/templates/nexus.yaml +++ b/dmz/internalproxy/templates/nexus.yaml @@ -19,7 +19,7 @@ metadata: name: nexus subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 8081 From f7029a6329e3faf93cbd492e5f585da859280894 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 16 Feb 2026 04:46:14 -0600 Subject: [PATCH 45/86] add matrix server --- .gitignore | 4 ++- dmz/main.tf | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++ dmz/matrix.tf | 57 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 128 insertions(+), 1 deletion(-) create mode 100644 dmz/main.tf create mode 100644 dmz/matrix.tf diff --git a/.gitignore b/.gitignore index 723ef36..d32217b 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,3 @@ -.idea \ No newline at end of file +*/.terraform +*/.terraform.lock.hcl +.idea diff --git a/dmz/main.tf b/dmz/main.tf new file mode 100644 index 0000000..eb23c67 --- /dev/null +++ b/dmz/main.tf @@ -0,0 +1,68 @@ +terraform { + backend "http" {} + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc9" + } + } +} + +provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false +} + +locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + storage = "cache-domains" + emulatessd = true + format = "raw" + dnsserver = "192.168.98.1" + vlan = 98 + k3smaster = { + tags = "k3s_dmz" + count = 3 + name = ["master01-dmz", "master02-dmz", "master03-dmz"] + cores = 2 + memory = "4096" + drive = 20 + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] + } + k3sserver = { + tags = "k3s_dmz" + count = 3 + name = ["node01-dmz", "node02-dmz", "node03-dmz"] + cores = 4 + memory = "8192" + drive = 240 + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] + } + openVPN = { + tags = "openVPN" + count = 1 + name = ["openVPN"] + cores = 2 + memory = "4096" + drive = 20 + node = ["mothership"] + ip = ["20"] + } + matrix = { + tags = "matrix" + count = 1 + name = ["matrix"] + cores = 2 + memory = "4096" + drive = 60 + node = ["vanguard"] + ip = ["21"] + } +} diff --git a/dmz/matrix.tf b/dmz/matrix.tf new file mode 100644 index 0000000..66dd4c7 --- /dev/null +++ b/dmz/matrix.tf @@ -0,0 +1,57 @@ +resource "proxmox_vm_qemu" "matrix" { + count = local.matrix.count + ciuser = "administrator" + vmid = "${local.vlan}${local.matrix.ip[count.index]}" + name = local.matrix.name[count.index] + target_node = local.matrix.node[count.index] + clone = local.template + tags = local.matrix.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.matrix.cores + sockets = 1 + cpu_type = "host" + memory = local.matrix.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.matrix.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.matrix.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} From b328e106dfbfdba499b93a479bcd03b088423b23 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 16 Feb 2026 04:51:57 -0600 Subject: [PATCH 46/86] update --- dmz/main.tf | 68 --------------------------------------------------- dmz/matrix.tf | 57 ------------------------------------------ 2 files changed, 125 deletions(-) delete mode 100644 dmz/main.tf delete mode 100644 dmz/matrix.tf diff --git a/dmz/main.tf b/dmz/main.tf deleted file mode 100644 index eb23c67..0000000 --- a/dmz/main.tf +++ /dev/null @@ -1,68 +0,0 @@ -terraform { - backend "http" {} - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } -} - -provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false -} - -locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - storage = "cache-domains" - emulatessd = true - format = "raw" - dnsserver = "192.168.98.1" - vlan = 98 - k3smaster = { - tags = "k3s_dmz" - count = 3 - name = ["master01-dmz", "master02-dmz", "master03-dmz"] - cores = 2 - memory = "4096" - drive = 20 - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] - } - k3sserver = { - tags = "k3s_dmz" - count = 3 - name = ["node01-dmz", "node02-dmz", "node03-dmz"] - cores = 4 - memory = "8192" - drive = 240 - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] - } - openVPN = { - tags = "openVPN" - count = 1 - name = ["openVPN"] - cores = 2 - memory = "4096" - drive = 20 - node = ["mothership"] - ip = ["20"] - } - matrix = { - tags = "matrix" - count = 1 - name = ["matrix"] - cores = 2 - memory = "4096" - drive = 60 - node = ["vanguard"] - ip = ["21"] - } -} diff --git a/dmz/matrix.tf b/dmz/matrix.tf deleted file mode 100644 index 66dd4c7..0000000 --- a/dmz/matrix.tf +++ /dev/null @@ -1,57 +0,0 @@ -resource "proxmox_vm_qemu" "matrix" { - count = local.matrix.count - ciuser = "administrator" - vmid = "${local.vlan}${local.matrix.ip[count.index]}" - name = local.matrix.name[count.index] - target_node = local.matrix.node[count.index] - clone = local.template - tags = local.matrix.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.matrix.cores - sockets = 1 - cpu_type = "host" - memory = local.matrix.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.matrix.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.matrix.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} From 53acab0ecea66c61fe3435be741a82f049f08fc9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:09:02 -0600 Subject: [PATCH 47/86] add nextcloud --- dmz/internalproxy/templates/nextcloud.yaml | 68 ++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 dmz/internalproxy/templates/nextcloud.yaml diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml new file mode 100644 index 0000000..4a645a2 --- /dev/null +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -0,0 +1,68 @@ +apiVersion: v1 +kind: Service +metadata: + name: nextcloud +spec: + ports: + - name: app + port: 7282 + protocol: TCP + targetPort: 7282 + clusterIP: None + type: ClusterIP + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: nextcloud +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 7282 + protocol: TCP + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: nextcloud-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: nextcloud + port: 7282 + scheme: http + tls: + secretName: nextcloud-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: nextcloud-tls +spec: + secretName: nextcloud-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "nextcloud.durp.info" + dnsNames: + - "nextcloud.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: nextcloud-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: nextcloud.durp.info +spec: + type: ExternalName + externalName: durp.info From 975dbd1c6d1377ebb0194bef16f72b61419654c6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:11:48 -0600 Subject: [PATCH 48/86] update --- dmz/internalproxy/templates/nextcloud.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index 4a645a2..4bd7e96 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -38,7 +38,7 @@ spec: services: - name: nextcloud port: 7282 - scheme: http + scheme: https tls: secretName: nextcloud-tls From ed66676f2e0c03a7cc561100924a1eba32ecb3fe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:18:52 -0600 Subject: [PATCH 49/86] update --- dmz/internalproxy/templates/nextcloud.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index 4bd7e96..faf27a9 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -35,6 +35,8 @@ spec: routes: - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`) kind: Rule + middlewares: + - nextcloud-secure-headers services: - name: nextcloud port: 7282 @@ -66,3 +68,11 @@ metadata: spec: type: ExternalName externalName: durp.info + +--- +middlewares: + nextcloud-secure-headers: + headers: + hostsProxyHeaders: + - "X-Forwarded-Host" + referrerPolicy: "same-origin" \ No newline at end of file From f75d5d5be47e4f6d5934ea55733970549d577ea9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:21:02 -0600 Subject: [PATCH 50/86] update --- dmz/internalproxy/templates/nextcloud.yaml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index faf27a9..82c8e6d 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -70,9 +70,12 @@ spec: externalName: durp.info --- -middlewares: - nextcloud-secure-headers: - headers: - hostsProxyHeaders: - - "X-Forwarded-Host" - referrerPolicy: "same-origin" \ No newline at end of file +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: nextcloud-secure-headers +spec: + headers: + hostsProxyHeaders: + - "X-Forwarded-Host" + referrerPolicy: "same-origin" From 9d5ffd8a8a29197dec489737885f2c97aacd3038 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:22:18 -0600 Subject: [PATCH 51/86] update --- dmz/internalproxy/templates/nextcloud.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index 82c8e6d..2050c2d 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -36,7 +36,7 @@ spec: - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`) kind: Rule middlewares: - - nextcloud-secure-headers + - name: nextcloud-secure-headers services: - name: nextcloud port: 7282 From 749974197e65a8f6a96f3c0abb666020c954faf6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:25:44 -0600 Subject: [PATCH 52/86] update --- dmz/internalproxy/templates/nextcloud.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index 2050c2d..c4fd4a3 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 7282 + port: 11000 protocol: TCP - targetPort: 7282 + targetPort: 11000 clusterIP: None type: ClusterIP @@ -21,7 +21,7 @@ subsets: - ip: 192.168.21.200 ports: - name: app - port: 7282 + port: 11000 protocol: TCP --- @@ -39,7 +39,7 @@ spec: - name: nextcloud-secure-headers services: - name: nextcloud - port: 7282 + port: 11000 scheme: https tls: secretName: nextcloud-tls From d6d965595cba1975ccec90bfa3d03221de521da9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:30:33 -0600 Subject: [PATCH 53/86] update --- dmz/internalproxy/templates/nextcloud.yaml | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index c4fd4a3..4b80c8e 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -36,7 +36,7 @@ spec: - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`) kind: Rule middlewares: - - name: nextcloud-secure-headers + - name: nextcloud-chain services: - name: nextcloud port: 11000 @@ -79,3 +79,23 @@ spec: hostsProxyHeaders: - "X-Forwarded-Host" referrerPolicy: "same-origin" + +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: https-redirect +spec: + redirectScheme: + scheme: https + +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: nextcloud-chain +spec: + chain: + middlewares: + - name: https-redirect + - name: nextcloud-secure-headers \ No newline at end of file From 68d068300a2e83488bd91e0bbf06aa6a012e8479 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 19 Feb 2026 05:08:15 -0600 Subject: [PATCH 54/86] update --- dmz/internalproxy/templates/nextcloud.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index 4b80c8e..e3ea9dd 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -40,7 +40,7 @@ spec: services: - name: nextcloud port: 11000 - scheme: https + scheme: http tls: secretName: nextcloud-tls From 746e7f4d86f8df8986b506d9e925b42f001f8875 Mon Sep 17 00:00:00 2001 From: RenovateBot Date: Sun, 1 Mar 2026 07:02:06 +0000 Subject: [PATCH 55/86] Update Helm release argo-cd to v8.6.4 --- infra/argocd/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/Chart.yaml b/infra/argocd/Chart.yaml index 8da230c..d9a5074 100644 --- a/infra/argocd/Chart.yaml +++ b/infra/argocd/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: argo-cd repository: https://argoproj.github.io/argo-helm - version: 8.1.3 + version: 8.6.4 From 33efd5915fd19d8b8e4fbf4b1f955473bc8f444d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 6 Mar 2026 05:42:12 -0600 Subject: [PATCH 56/86] remove public gitlab runner --- dmz/gitlab-runner/Chart.yaml | 3 -- dmz/gitlab-runner/values.yaml | 72 ----------------------------------- 2 files changed, 75 deletions(-) diff --git a/dmz/gitlab-runner/Chart.yaml b/dmz/gitlab-runner/Chart.yaml index 542b033..17e8efe 100644 --- a/dmz/gitlab-runner/Chart.yaml +++ b/dmz/gitlab-runner/Chart.yaml @@ -6,9 +6,6 @@ version: 0.0.1 appVersion: 0.0.1 dependencies: -- name: gitlab-runner - repository: https://charts.gitlab.io/ - version: 0.77.2 - name: gitlab-runner repository: https://charts.gitlab.io/ version: 0.77.2 diff --git a/dmz/gitlab-runner/values.yaml b/dmz/gitlab-runner/values.yaml index 3e7ddb6..7ba1021 100644 --- a/dmz/gitlab-runner/values.yaml +++ b/dmz/gitlab-runner/values.yaml @@ -1,75 +1,3 @@ -gitlab-runner: - - image: - registry: registry.durp.info - image: gitlab-org/gitlab-runner - - imagePullPolicy: Always - gitlabUrl: https://gitlab.com/ - unregisterRunner: false - terminationGracePeriodSeconds: 3600 - concurrent: 10 - checkInterval: 30 - - rbac: - create: true - rules: [] - clusterWideAccess: false - podSecurityPolicy: - enabled: false - resourceNames: - - gitlab-runner - - metrics: - enabled: true - serviceMonitor: - enabled: true - service: - enabled: true - annotations: {} - - runners: - config: | - [[runners]] - [runners.kubernetes] - namespace = "{{.Release.Namespace}}" - image = "ubuntu:22.04" - privileged = true - - executor: kubernetes - name: "k3s" - runUntagged: true - privileged: true - secret: gitlab-secret - #builds: - #cpuLimit: 200m - #cpuLimitOverwriteMaxAllowed: 400m - #memoryLimit: 256Mi - #memoryLimitOverwriteMaxAllowed: 512Mi - #cpuRequests: 100m - #cpuRequestsOverwriteMaxAllowed: 200m - #memoryRequests: 128Mi - #memoryRequestsOverwriteMaxAllowed: 256Mi - - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - runAsNonRoot: true - privileged: false - capabilities: - drop: ["ALL"] - - podSecurityContext: - runAsUser: 100 - fsGroup: 65533 - - resources: - limits: - memory: 2Gi - requests: - memory: 128Mi - cpu: 50m - personal: image: From 4cb432f2ce4b80385f5f1f4d528dfcf46aa7b12f Mon Sep 17 00:00:00 2001 From: RenovateBot Date: Sat, 7 Mar 2026 07:02:04 +0000 Subject: [PATCH 57/86] Update docker.io/aquasec/trivy Docker tag to v0.69.3 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index e77ca5a..c8f1629 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -542,7 +542,7 @@ openclarity: # -- Trivy Server container repository repository: aquasec/trivy # -- Trivy Server container tag - tag: 0.69.1 + tag: 0.69.3 # -- Trivy Server image digest. If set will override the tag. digest: "" # -- Trivy Server image pull policy From fe23c8a706ffd93334711f76ada59c958d828fb9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 7 Mar 2026 06:34:28 -0600 Subject: [PATCH 58/86] remove public gitlab renovate bot --- infra/renovate/Chart.yaml | 3 - infra/renovate/values.yaml | 330 ------------------------------------- 2 files changed, 333 deletions(-) diff --git a/infra/renovate/Chart.yaml b/infra/renovate/Chart.yaml index 05ed75f..b20d1e8 100644 --- a/infra/renovate/Chart.yaml +++ b/infra/renovate/Chart.yaml @@ -7,9 +7,6 @@ version: 0.1.0 appVersion: "1.16.0" dependencies: - - name: renovate - repository: https://docs.renovatebot.com/helm-charts - version: 39.264.0 - name: renovate repository: https://docs.renovatebot.com/helm-charts version: 39.264.0 diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index adec42f..4754bc7 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -1,333 +1,3 @@ -renovate: - global: - # -- Additional labels to be set on all renovate resources - commonLabels: {} - compatibility: - openshift: - # -- Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: `auto` (apply if the detected running cluster is Openshift), `force` (perform the adaptation always), `disabled` (do not perform adaptation) - adaptSecurityContext: "auto" - - # -- Override the name of the chart - nameOverride: "" - # -- Override the fully qualified app name - fullnameOverride: "" - # -- Annotations to add to secret - secretAnnotations: {} - - cronjob: - # -- Schedules the job to run using cron notation - schedule: "0 1 * * *" # At 01:00 every day - # -- You can specify a time zone for a CronJob by setting timeZone to the name of a valid time zone. (starting with k8s 1.27) - timeZone: "" # see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for valid names - # -- If it is set to true, all subsequent executions are suspended. This setting does not apply to already started executions. - suspend: false - # -- Annotations to set on the cronjob - annotations: {} - # -- Labels to set on the cronjob - labels: {} - # -- "Allow" to allow concurrent runs, "Forbid" to skip new runs if a previous run is still running or "Replace" to replace the previous run - concurrencyPolicy: "" - # -- "Number of successful completions is reached to mark the job as complete" - completions: "" - # -- "Where the jobs should be NonIndexed or Indexed" - completionMode: "" - # -- Amount of failed jobs to keep in history - failedJobsHistoryLimit: "" - # -- Amount of completed jobs to keep in history - successfulJobsHistoryLimit: "" - # -- Set to Never to restart the job when the pod fails or to OnFailure to restart when a container fails - jobRestartPolicy: Never - # -- Time to keep the job after it finished before automatically deleting it - ttlSecondsAfterFinished: "" - # -- Deadline for the job to finish - activeDeadlineSeconds: "" - # -- Number of times to retry running the pod before considering the job as being failed - jobBackoffLimit: "" - # -- Maximal number of failures per index - backoffLimitPerIndex: "" - # -- Maximal number of failed indexes before terminating the Job execution - maxFailedIndexes: "" - # -- Deadline to start the job, skips execution if job misses it's configured deadline - startingDeadlineSeconds: "" - # -- Additional initContainers that can be executed before renovate - initContainers: [] - # initContainers: - # - name: INIT_CONTAINER_NAME - # image: INIT_CONTAINER_IMAGE - # -- Number of pods to run in parallel - parallelism: "" - # -- Custom command to run in the container - commandOverride: [] - # -- Custom arguments to run in the container - argsOverride: [] - # -- Prepend shell commands before renovate runs - #preCommand: '' - #preCommand: | - # ls /config - # cat /config/renovate.json - - postCommand: "" - # postCommand: | - # echo hello - # echo world - - pod: - # -- Annotations to set on the pod - annotations: {} - # -- Labels to set on the pod - labels: {} - - image: - # -- Registry to pull image from - registry: registry.durp.info - # -- Image name to pull - repository: renovatebot/renovate - # -- Renovate image tag to pull - #tag: 39.264.0 - # -- "IfNotPresent" to pull the image if no image with the specified tag exists on the node, "Always" to always pull the image or "Never" to try and use pre-pulled images - pullPolicy: Always - # -- Set `true` to use the full image. See https://docs.renovatebot.com/getting-started/running/#the-full-image - useFull: false - - # -- Secret to use to pull the image from the repository - imagePullSecrets: {} - - renovate: - # -- Custom exiting global renovate config - #existingConfigFile: "/config/renovate.json" - # -- Inline global renovate config.json - config: | - { - "platform": "gitlab", - "endpoint": "https://gitlab.com/api/v4", - "autodiscover": "true", - "dryRun": false, - "printConfig": false, - "autodiscoverFilter": ["developerdurp/*", "durfy/*"], - "assignees": ["developerdurp"], - } - # See https://docs.renovatebot.com/self-hosted-configuration - # config: | - # { - # "": "gitlab", - # "endpoint": "https://gitlab.example.com/api/v4", - # "token": "your-gitlab-renovate-user-token", - # "autodiscover": "false", - # "dryRun": true, - # "printConfig": true, - # "repositories": ["username/repo", "orgname/repo"] - # } - - # -- Use the Helm tpl function on your configuration. See README for how to use this value - configEnableHelmTpl: false - - # -- Use this to create the renovate-config as a secret instead of a configmap - configIsSecret: true - - # -- Use this to create a config.js instead of a config.json - configIsJavaScript: false - - # -- Renovate Container-level security-context - securityContext: {} - - # Instead of a file system cache, it is highly recommended to use the redis subchart. - # Alternatively, SQLite is also a good choice. - # Take a look at https://github.com/renovatebot/renovate/discussions/30525 for more information. - # -- Options related to persistence - persistence: - cache: - # -- Allow the cache to persist between runs - enabled: false - # -- Storage class of the cache PVC - storageClass: "" - # -- Storage size of the cache PVC - storageSize: "512Mi" - # -- Existing volume, enables binding the pvc to an existing volume - volumeName: "" - # -- Labels to set on the cache PVC - labels: {} - - ssh_config: - # -- Whether to enable the use and creation of a secret containing .ssh files - enabled: false - - # Provide .ssh config file contents - # -- Contents of the id_rsa file - id_rsa: "" - # -- Contents of the id_rsa_pub file - id_rsa_pub: "" - # -- Contents of the config file - config: "" - - # or provide the name of an existing secret to be read instead. - # -- Name of the existing secret containing a valid .ssh configuration - existingSecret: "" - - # -- Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set - secrets: {} - # -- k8s secret to reference environment variables from. Overrides secrets if set - existingSecret: "renovate-config-secret" - - # -- Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config - extraConfigmaps: [] - # extraConfigmaps: - # - name: netrc-config - # data: - # .netrc: |- - # machine gitlab.example.com - # login gitlab-ci-token - # password some-pass - # - name: yet-another-config - # data: - # ya-config.yaml: |- - # "key"="value" - # "key1"="value1" - - #extraVolumes: - # - name: renovate-config-secret - # secretName: - # name: renovate-config-secret - # items: - # - key: renovate.json - # path: renovate.json - - #extraVolumeMounts: - # - name: renovate-config-secret - # mountPath: /config - # subPath: renovate.json - - # -- Additional containers to the pod - extraContainers: [] - # extraContainers: - # - name: vault-agent - # image: vault:1.6.2 - # args: - # - agent - # - -config - # - /vault/config/config.hcl - # env: - # - name: VAULT_ADDR - # value: https://vault:8200 - # - name: VAULT_SKIP_VERIFY - # value: "false" - # - name: VAULT_CACERT - # value: /vault/tls/ca.crt - - serviceAccount: - # -- Specifies whether a service account should be created - create: false - # -- Annotations to add to the service account - annotations: {} - # -- The name of the service account to use - # If not set and create is true, a name is generated using the fullname template - name: "" - - # -- Specify resource limits and requests for the renovate container - resources: - {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - - # -- Environment variables to add from existing secrets/configmaps. Uses the keys as variable name - envFrom: [] - # envFrom: - # - secretRef: - # name: env-secrets - # - configMapRef: - # name: env-configmap - - # -- Environment variables to set on the renovate container - env: - RENOVATE_AUTODISCOVER: true - # env: - # VARIABLE_NAME: "value" - - # -- Additional env. Helpful too if you want to use anything other than a `value` source. - envList: [] - # envList: - # - name: POD_NAME - # valueFrom: - # fieldRef: - # fieldPath: metadata.name - - redis: - # Configuration for a Redis subchart. Additional documentation at - # https://github.com/bitnami/charts/tree/master/bitnami/redis - - # -- Enable the Redis subchart? - enabled: false - - # -- Override the prefix of the redisHost - nameOverride: "" - - # -- Disable replication by default - architecture: standalone - - auth: - # -- Don't require a password by default - enabled: false - - # -- Override Kubernetes version for redis chart - kubeVersion: "" - - # -- Override hostname resolution - hostAliases: [] - # See: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ - # hostAliases: - # - ip: "your-ip" - # hostnames: - # - "your-hostname" - - # -- Pod-level security-context - securityContext: {} - - # -- Select the node using labels to specify where the cronjob pod should run on - nodeSelector: {} - # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ - # renovate: true - - # -- Configure the pod(Anti)Affinity and/or node(Anti)Affinity - affinity: {} - # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ - - # -- Configure which node taints the pod should tolerate - tolerations: [] - # See: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ - - # -- Create extra manifests via values. Would be passed through `tpl` for templating - extraObjects: [] - # extraObjects: - # - apiVersion: external-secrets.io/v1 - # kind: ExternalSecret - # metadata: - # name: '{{ include "renovate.fullname" . }}-token' - # spec: - # secretStoreRef: - # name: default - # data: - # - secretKey: token - # remoteRef: - # key: github-token - # - | - # apiVersion: v1 - # kind: ConfigMap - # metadata: - # name: {{ include "renovate.fullname" . }}-config - # data: - # config.json: | - # { - # "platform": "github", - # "repositories": ["username/repo", "orgname/repo"] - # } - renovate-personal: global: # -- Additional labels to be set on all renovate resources From a1bf4cfff8b7fb0123c496c656e86ba7c6caea6f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 7 Mar 2026 07:19:43 -0600 Subject: [PATCH 59/86] update vaultwarden --- infra/bitwarden/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/bitwarden/templates/deployment.yaml b/infra/bitwarden/templates/deployment.yaml index 470ac9b..b915246 100644 --- a/infra/bitwarden/templates/deployment.yaml +++ b/infra/bitwarden/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: bitwarden - image: registry.durp.info/vaultwarden/server:1.34.3 + image: registry.durp.info/vaultwarden/server:1.35.4 imagePullPolicy: Always volumeMounts: - name: bitwarden-pvc From 059d35af3e8f6ac3c331cdea8112cdaf87727719 Mon Sep 17 00:00:00 2001 From: RenovateBot Date: Sun, 8 Mar 2026 07:02:03 +0000 Subject: [PATCH 60/86] Update Helm release base to v1.29.0 --- dmz/istio-system/Chart.yaml | 2 +- infra/istio-system/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index 50401b5..dfc92b1 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -8,7 +8,7 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.26.2 + version: 1.29.0 - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.26.2 diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index 0a7ea4b..7bb5fc3 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -8,7 +8,7 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.26.2 + version: 1.29.0 - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.26.2 From 5974e6450c09e03bc8399b8fe4abada1608a482c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 8 Mar 2026 08:11:47 -0500 Subject: [PATCH 61/86] update gitea to forgejo --- .../templates/{gitea.yaml => forgejo.yaml} | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) rename dmz/internalproxy/templates/{gitea.yaml => forgejo.yaml} (68%) diff --git a/dmz/internalproxy/templates/gitea.yaml b/dmz/internalproxy/templates/forgejo.yaml similarity index 68% rename from dmz/internalproxy/templates/gitea.yaml rename to dmz/internalproxy/templates/forgejo.yaml index 58c28d7..4a6998a 100644 --- a/dmz/internalproxy/templates/gitea.yaml +++ b/dmz/internalproxy/templates/forgejo.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: Service metadata: - name: gitea + name: forgejo spec: ports: - name: app @@ -16,7 +16,7 @@ spec: apiVersion: v1 kind: Endpoints metadata: - name: gitea + name: forgejo subsets: - addresses: - ip: 192.168.21.200 @@ -30,43 +30,43 @@ subsets: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: gitea-ingress + name: forgejo-ingress spec: entryPoints: - websecure routes: - - match: Host(`gitea.durp.info`) && PathPrefix(`/`) + - match: Host(`forgejo.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: gitea + - name: forgejo port: 3000 scheme: http tls: - secretName: gitea-tls + secretName: forgejo-tls --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: gitea-tls + name: forgejo-tls spec: - secretName: gitea-tls + secretName: forgejo-tls issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "gitea.durp.info" + commonName: "forgejo.durp.info" dnsNames: - - "gitea.durp.info" + - "forgejo.durp.info" --- kind: Service apiVersion: v1 metadata: - name: gitea-external-dns + name: forgejo-external-dns annotations: - external-dns.alpha.kubernetes.io/hostname: gitea.durp.info + external-dns.alpha.kubernetes.io/hostname: forgejo.durp.info spec: type: ExternalName externalName: durp.info From f1b27dc3666a60bce544f919dcb15962107c6f36 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 8 Mar 2026 10:03:59 -0500 Subject: [PATCH 62/86] update --- dmz/searxng/templates/ingress.yaml | 31 ++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/dmz/searxng/templates/ingress.yaml b/dmz/searxng/templates/ingress.yaml index da757e7..ab8b641 100644 --- a/dmz/searxng/templates/ingress.yaml +++ b/dmz/searxng/templates/ingress.yaml @@ -43,3 +43,34 @@ metadata: spec: type: ExternalName externalName: durp.info + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: searxng-internal-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`searxng.internal.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: searxng-service + port: 8080 + tls: + secretName: searxng-internal-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: searxng-internal-tls +spec: + secretName: searxng-internal-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "searxng.internal.durp.info" + dnsNames: + - "searxng.internal.durp.info" From 7f8883c2bcf71b6680967a0ee916287e459401f8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 8 Mar 2026 10:06:50 -0500 Subject: [PATCH 63/86] update --- dmz/searxng/templates/confligmap.yaml | 11 +++++++++++ dmz/searxng/templates/deployment.yaml | 18 +++++++++++++++++- dmz/searxng/templates/secret.yaml | 23 +++++++++++++++++++++++ 3 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 dmz/searxng/templates/confligmap.yaml create mode 100644 dmz/searxng/templates/secret.yaml diff --git a/dmz/searxng/templates/confligmap.yaml b/dmz/searxng/templates/confligmap.yaml new file mode 100644 index 0000000..edc1ca6 --- /dev/null +++ b/dmz/searxng/templates/confligmap.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: searxng-config +data: + settings.yml: |- + use_default_settings: true + search: + formats: + - html + - json diff --git a/dmz/searxng/templates/deployment.yaml b/dmz/searxng/templates/deployment.yaml index 3ab2d47..e1677ed 100644 --- a/dmz/searxng/templates/deployment.yaml +++ b/dmz/searxng/templates/deployment.yaml @@ -21,4 +21,20 @@ spec: imagePullPolicy: Always ports: - name: http - containerPort: 8080 \ No newline at end of file + containerPort: 8080 + env: + - name: SEARXNG_BASE_URL + value: https://searxng.durp.info + - name: SEARXNG_SECRET + valueFrom: + secretKeyRef: + name: searxng-secret + key: SEARXNG_SECRET + volumeMounts: + - name: searxng-config-volume + mountPath: /etc/searxng/settings.yml + subPath: settings.yml + volumes: + - name: searxng-config-volume + configMap: + name: searxng-config diff --git a/dmz/searxng/templates/secret.yaml b/dmz/searxng/templates/secret.yaml new file mode 100644 index 0000000..6d4781b --- /dev/null +++ b/dmz/searxng/templates/secret.yaml @@ -0,0 +1,23 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: searxng-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: searxng-secret + data: + - secretKey: SEARXNG_SECRET + remoteRef: + key: kv/searxng + property: searxng-secret + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + From 2afdded1093fe8d13934f48798a3b08b3de4e9ae Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 25 Mar 2026 05:48:28 -0500 Subject: [PATCH 64/86] add freshrss --- dmz/internalproxy/templates/freshrss.yaml | 61 +++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 dmz/internalproxy/templates/freshrss.yaml diff --git a/dmz/internalproxy/templates/freshrss.yaml b/dmz/internalproxy/templates/freshrss.yaml new file mode 100644 index 0000000..3ee965a --- /dev/null +++ b/dmz/internalproxy/templates/freshrss.yaml @@ -0,0 +1,61 @@ + +apiVersion: v1 +kind: Service +metadata: + name: freshrss +spec: + ports: + - name: app + port: 8085 + protocol: TCP + targetPort: 8085 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: freshrss +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 8085 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: freshrss-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`freshrss.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: freshrss + port: 8085 + scheme: https + tls: + secretName: freshrss-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: freshrss-tls +spec: + secretName: freshrss-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "freshrss.durp.info" + dnsNames: + - "freshrss.durp.info" From 6cdffc48f3bee8cbd84a6deb7eb9cec76d593e7e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 25 Mar 2026 06:07:43 -0500 Subject: [PATCH 65/86] update --- dmz/internalproxy/templates/freshrss.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/dmz/internalproxy/templates/freshrss.yaml b/dmz/internalproxy/templates/freshrss.yaml index 3ee965a..3fe0ff4 100644 --- a/dmz/internalproxy/templates/freshrss.yaml +++ b/dmz/internalproxy/templates/freshrss.yaml @@ -41,7 +41,6 @@ spec: services: - name: freshrss port: 8085 - scheme: https tls: secretName: freshrss-tls From e6aafbcf81b797ec296946fa436cbda6254cf63a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 27 Mar 2026 06:04:54 -0500 Subject: [PATCH 66/86] update --- infra/portainer/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/portainer/values.yaml b/infra/portainer/values.yaml index a63ba2e..a3779f7 100644 --- a/infra/portainer/values.yaml +++ b/infra/portainer/values.yaml @@ -2,7 +2,7 @@ portainer: replicaCount: 1 image: repository: registry.durp.info/portainer/portainer-ce - tag: 2.33.5 + tag: 2.39.1 pullPolicy: Always imagePullSecrets: [] From 1c0c8bab822e326b5dd622261ea1cb33a88053f8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 07:57:02 -0500 Subject: [PATCH 67/86] update --- dmz/internalproxy/templates/longhorn.yaml | 34 ++++++ dmz/internalproxy/templates/n8n.yaml | 136 +++++++++++----------- infra/longhorn/templates/ingress.yaml | 4 +- 3 files changed, 104 insertions(+), 70 deletions(-) create mode 100644 dmz/internalproxy/templates/longhorn.yaml diff --git a/dmz/internalproxy/templates/longhorn.yaml b/dmz/internalproxy/templates/longhorn.yaml new file mode 100644 index 0000000..9eeda9e --- /dev/null +++ b/dmz/internalproxy/templates/longhorn.yaml @@ -0,0 +1,34 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: longhorn-infra-ingress + annotations: + cert-manager.io/cluster-issuer: vault-issuer +spec: + entryPoints: + - websecure + routes: + - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: infra-cluster + port: 443 + tls: + secretName: longhorn-infra-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: longhorn-infra-tls +spec: + secretName: longhorn-infra-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "longhorn.infra.durp.info" + dnsNames: + - "longhorn.infra.durp.info" diff --git a/dmz/internalproxy/templates/n8n.yaml b/dmz/internalproxy/templates/n8n.yaml index d70038b..adfebc7 100644 --- a/dmz/internalproxy/templates/n8n.yaml +++ b/dmz/internalproxy/templates/n8n.yaml @@ -1,68 +1,68 @@ -apiVersion: v1 -kind: Service -metadata: - name: n8n -spec: - ports: - - name: app - port: 5678 - protocol: TCP - targetPort: 5678 - clusterIP: None - type: ClusterIP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: n8n -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 5678 - protocol: TCP - ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: n8n-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`n8n.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: n8n - port: 5678 - scheme: http - tls: - secretName: n8n-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: n8n-tls -spec: - secretName: n8n-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "n8n.durp.info" - dnsNames: - - "n8n.durp.info" - ---- -kind: Service -apiVersion: v1 -metadata: - name: n8n-dns - annotations: - dns.alpha.kubernetes.io/hostname: n8n.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: v1 +#kind: Service +#metadata: +# name: n8n +#spec: +# ports: +# - name: app +# port: 5678 +# protocol: TCP +# targetPort: 5678 +# clusterIP: None +# type: ClusterIP +# +#--- +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: n8n +#subsets: +# - addresses: +# - ip: 192.168.21.200 +# ports: +# - name: app +# port: 5678 +# protocol: TCP +# +#--- +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: n8n-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`n8n.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: n8n +# port: 5678 +# scheme: http +# tls: +# secretName: n8n-tls +# +#--- +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: n8n-tls +#spec: +# secretName: n8n-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "n8n.durp.info" +# dnsNames: +# - "n8n.durp.info" +# +#--- +#kind: Service +#apiVersion: v1 +#metadata: +# name: n8n-dns +# annotations: +# dns.alpha.kubernetes.io/hostname: n8n.durp.info +#spec: +# type: ExternalName +# externalName: durp.info diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index e9a3a2b..ad4ebd3 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -11,8 +11,8 @@ spec: - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`) kind: Rule middlewares: - - name: authentik-proxy-provider - namespace: traefik + #- name: authentik-proxy-provider + # namespace: traefik services: - name: longhorn-frontend port: 80 From 8343867aeed08cb2974b480090365050bc3990c7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 07:59:24 -0500 Subject: [PATCH 68/86] update --- dmz/internalproxy/templates/argocd.yaml | 34 +++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 dmz/internalproxy/templates/argocd.yaml diff --git a/dmz/internalproxy/templates/argocd.yaml b/dmz/internalproxy/templates/argocd.yaml new file mode 100644 index 0000000..20aba48 --- /dev/null +++ b/dmz/internalproxy/templates/argocd.yaml @@ -0,0 +1,34 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: argocd-infra-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`argocd.infra.durp.info`) + #middlewares: + # - name: whitelist + # namespace: traefik + kind: Rule + services: + - name: infra-cluster + port: 443 + scheme: https + tls: + secretName: argocd-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: argocd-infra-tls +spec: + secretName: argocd-infra-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "argocd.infra.durp.info" + dnsNames: + - "argocd.infra.durp.info" From ea54a2601d59fd33321d27ef8c0b9d68a6d7e51b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 08:10:07 -0500 Subject: [PATCH 69/86] update --- dmz/internalproxy/templates/endpoints.yaml | 26 ++++++++++++++++++ dmz/internalproxy/templates/tdarr.yaml | 31 +--------------------- dmz/internalproxy/templates/unraid.yaml | 30 --------------------- 3 files changed, 27 insertions(+), 60 deletions(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index c5d00c4..1f1aec6 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -43,3 +43,29 @@ spec: - protocol: TCP port: 443 targetPort: 443 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: unraid +spec: + ports: + - protocol: TCP + port: 443 + targetPort: 443 + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: unraid +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 443 + protocol: TCP diff --git a/dmz/internalproxy/templates/tdarr.yaml b/dmz/internalproxy/templates/tdarr.yaml index c9ace7f..35b9485 100644 --- a/dmz/internalproxy/templates/tdarr.yaml +++ b/dmz/internalproxy/templates/tdarr.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: tdarr -spec: - ports: - - name: app - port: 8267 - protocol: TCP - targetPort: 8267 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: tdarr -subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8267 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -45,7 +16,7 @@ spec: namespace: traefik kind: Rule services: - - name: tdarr + - name: unraid port: 8267 scheme: http tls: diff --git a/dmz/internalproxy/templates/unraid.yaml b/dmz/internalproxy/templates/unraid.yaml index f79f4a8..10e1015 100644 --- a/dmz/internalproxy/templates/unraid.yaml +++ b/dmz/internalproxy/templates/unraid.yaml @@ -1,33 +1,3 @@ - -apiVersion: v1 -kind: Service -metadata: - name: unraid -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: unraid -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 443 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: From ab36649642ab7751c3016a3ffbcf04ceb5c9a357 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 08:11:26 -0500 Subject: [PATCH 70/86] update --- dmz/internalproxy/templates/endpoints.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 1f1aec6..875ed0f 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -55,6 +55,10 @@ spec: - protocol: TCP port: 443 targetPort: 443 + - name: app + port: 8267 + protocol: TCP + targetPort: 8267 --- @@ -69,3 +73,6 @@ subsets: - name: app port: 443 protocol: TCP + - name: app + port: 8267 + protocol: TCP From 57ea463e1996b9844ba2a3c3ae9b0048d61e775e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 08:12:43 -0500 Subject: [PATCH 71/86] update --- dmz/internalproxy/templates/endpoints.yaml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 875ed0f..35f2d40 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -52,10 +52,11 @@ metadata: name: unraid spec: ports: - - protocol: TCP + - name: https + protocol: TCP port: 443 targetPort: 443 - - name: app + - name: tdarr port: 8267 protocol: TCP targetPort: 8267 @@ -70,9 +71,9 @@ subsets: - addresses: - ip: 192.168.21.200 ports: - - name: app + - name: https port: 443 protocol: TCP - - name: app + - name: tdarr port: 8267 protocol: TCP From c38262a51b480f4e3e9227e9ed0c216437fbfc85 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 11:37:45 -0500 Subject: [PATCH 72/86] update --- dmz/authentik/templates/ingress.yaml | 62 ----------------- dmz/internalproxy/templates/argocd.yaml | 6 +- dmz/internalproxy/templates/authentik.yaml | 80 +++++++++++----------- 3 files changed, 43 insertions(+), 105 deletions(-) diff --git a/dmz/authentik/templates/ingress.yaml b/dmz/authentik/templates/ingress.yaml index f03751e..e69de29 100644 --- a/dmz/authentik/templates/ingress.yaml +++ b/dmz/authentik/templates/ingress.yaml @@ -1,62 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: authentik-tls - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" - ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra-cluster - port: 443 - tls: - secretName: authentik-tls - ---- -kind: Service -apiVersion: v1 -metadata: - name: authentik-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -spec: - type: ExternalName - externalName: durp.info - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: infra-cluster -subsets: - - addresses: - - ip: 192.168.12.130 - ports: - - port: 443 - ---- -apiVersion: v1 -kind: Service -metadata: - name: infra-cluster -spec: - ports: - - protocol: TCP - port: 443 - targetPort: 443 diff --git a/dmz/internalproxy/templates/argocd.yaml b/dmz/internalproxy/templates/argocd.yaml index 20aba48..d817e19 100644 --- a/dmz/internalproxy/templates/argocd.yaml +++ b/dmz/internalproxy/templates/argocd.yaml @@ -7,9 +7,9 @@ spec: - websecure routes: - match: Host(`argocd.infra.durp.info`) - #middlewares: - # - name: whitelist - # namespace: traefik + middlewares: + - name: whitelist + namespace: traefik kind: Rule services: - name: infra-cluster diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 328d115..adf9884 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,40 +1,40 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: infra-cluster -# port: 443 -# tls: -# secretName: authentik-tls -# -#--- -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: authentik-tls -#spec: -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# secretName: authentik-tls -# commonName: "authentik.durp.info" -# dnsNames: -# - "authentik.durp.info" -# -#--- -#kind: Service -#apiVersion: v1 -#metadata: -# name: authentik-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -#spec: -# type: ExternalName -# externalName: durp.info +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: authentik-tls + commonName: "authentik.durp.info" + dnsNames: + - "authentik.durp.info" + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: authentik-tls + +--- +kind: Service +apiVersion: v1 +metadata: + name: authentik-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file From e47f51426a1e2e7dacc429eee8954587a9e2a7bf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 12:09:41 -0500 Subject: [PATCH 73/86] update --- dmz/internalproxy/templates/duplicati.yaml | 31 +--- dmz/internalproxy/templates/endpoints.yaml | 132 +++++++++++++++++ dmz/internalproxy/templates/forgejo.yaml | 31 +--- dmz/internalproxy/templates/freshrss.yaml | 32 +---- dmz/internalproxy/templates/gitlab.yaml | 85 ++++------- dmz/internalproxy/templates/invidious.yaml | 149 ++++++++++---------- dmz/internalproxy/templates/kasm.yaml | 31 +--- dmz/internalproxy/templates/kuma.yaml | 91 ++++++------ dmz/internalproxy/templates/litellm.yaml | 31 +--- dmz/internalproxy/templates/minio.yaml | 31 +--- dmz/internalproxy/templates/nextcloud.yaml | 29 +--- dmz/internalproxy/templates/nexus.yaml | 31 +--- dmz/internalproxy/templates/ollama.yaml | 35 +---- dmz/internalproxy/templates/open-webui.yaml | 33 +---- dmz/internalproxy/templates/plex.yaml | 33 +---- dmz/internalproxy/templates/portainer.yaml | 6 +- dmz/internalproxy/templates/registry.yaml | 29 +--- dmz/internalproxy/templates/root-vault.yaml | 32 +---- dmz/internalproxy/templates/s3.yaml | 33 +---- dmz/internalproxy/templates/semaphore.yaml | 129 ++++++++--------- 20 files changed, 365 insertions(+), 669 deletions(-) diff --git a/dmz/internalproxy/templates/duplicati.yaml b/dmz/internalproxy/templates/duplicati.yaml index d2563d0..74475df 100644 --- a/dmz/internalproxy/templates/duplicati.yaml +++ b/dmz/internalproxy/templates/duplicati.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: duplicati -spec: - ports: - - name: app - port: 8200 - protocol: TCP - targetPort: 8200 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: duplicati -subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8200 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -43,7 +14,7 @@ spec: namespace: traefik kind: Rule services: - - name: duplicati + - name: unraid port: 8200 tls: secretName: duplicati-tls diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 35f2d40..0b36e84 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -60,6 +60,58 @@ spec: port: 8267 protocol: TCP targetPort: 8267 + - name: duplicati + port: 8200 + protocol: TCP + targetPort: 8200 + - name: forgejo + port: 3000 + protocol: TCP + targetPort: 3000 + - name: freshrss + port: 8085 + protocol: TCP + targetPort: 8085 + - name: gitlab-ssh + port: 9022 + protocol: TCP + targetPort: 9022 + - name: gitlab + port: 9443 + protocol: TCP + targetPort: 9443 + - name: minio + port: 9769 + protocol: TCP + targetPort: 9769 + - name: nextcloud + port: 11000 + protocol: TCP + targetPort: 11000 + - name: nexus + port: 8081 + protocol: TCP + targetPort: 8081 + - name: openweb-ui + port: 8089 + protocol: TCP + targetPort: 8089 + - name: plex + port: 32400 + protocol: TCP + targetPort: 32400 + - name: registry + port: 5000 + protocol: TCP + targetPort: 5000 + - name: root-vault + port: 8201 + protocol: TCP + targetPort: 8201 + - name: s3 + port: 9768 + protocol: TCP + targetPort: 9768 --- @@ -77,3 +129,83 @@ subsets: - name: tdarr port: 8267 protocol: TCP + - name: duplicati + port: 8200 + protocol: TCP + - name: forgejo + port: 3000 + protocol: TCP + - name: freshrss + port: 8085 + protocol: TCP + - name: gitlab-ssh + port: 9022 + protocol: TCP + - name: gitlab + port: 9443 + protocol: TCP + - name: minio + port: 9769 + protocol: TCP + - name: nextcloud + port: 11000 + protocol: TCP + - name: nexus + port: 8081 + protocol: TCP + - name: openweb-ui + port: 8089 + protocol: TCP + - name: plex + port: 32400 + protocol: TCP + - name: registry + port: 5000 + protocol: TCP + - name: root-vault + port: 8201 + protocol: TCP + - name: s3 + port: 9768 + protocol: TCP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: ubuntu +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: https + port: 443 + protocol: TCP + - name: litellm + port: 4000 + protocol: TCP + - name: ollama + port: 11435 + protocol: TCP + +--- + +apiVersion: v1 +kind: Service +metadata: + name: ubuntu +spec: + ports: + - name: https + port: 443 + protocol: TCP + targetPort: 443 + - name: litellm + port: 4000 + protocol: TCP + targetPort: 4000 + - name: ollama + port: 11435 + protocol: TCP + targetPort: 11435 diff --git a/dmz/internalproxy/templates/forgejo.yaml b/dmz/internalproxy/templates/forgejo.yaml index 4a6998a..52eb710 100644 --- a/dmz/internalproxy/templates/forgejo.yaml +++ b/dmz/internalproxy/templates/forgejo.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: forgejo -spec: - ports: - - name: app - port: 3000 - protocol: TCP - targetPort: 3000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: forgejo -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 3000 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,7 +9,7 @@ spec: - match: Host(`forgejo.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: forgejo + - name: unraid port: 3000 scheme: http tls: diff --git a/dmz/internalproxy/templates/freshrss.yaml b/dmz/internalproxy/templates/freshrss.yaml index 3fe0ff4..092854c 100644 --- a/dmz/internalproxy/templates/freshrss.yaml +++ b/dmz/internalproxy/templates/freshrss.yaml @@ -1,33 +1,3 @@ - -apiVersion: v1 -kind: Service -metadata: - name: freshrss -spec: - ports: - - name: app - port: 8085 - protocol: TCP - targetPort: 8085 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: freshrss -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8085 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -39,7 +9,7 @@ spec: - match: Host(`freshrss.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: freshrss + - name: unraid port: 8085 tls: secretName: freshrss-tls diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 0c79c8b..2f225c2 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -1,30 +1,30 @@ -apiVersion: v1 -kind: Service -metadata: - name: gitlab-ssh -spec: - ports: - - name: app - port: 9022 - protocol: TCP - targetPort: 9022 - clusterIP: None - type: ClusterIP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: gitlab-ssh -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 9022 - protocol: TCP - ---- +#apiVersion: v1 +#kind: Service +#metadata: +# name: gitlab-ssh +#spec: +# ports: +# - name: app +# port: 9022 +# protocol: TCP +# targetPort: 9022 +# clusterIP: None +# type: ClusterIP +# +#--- +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: gitlab-ssh +#subsets: +# - addresses: +# - ip: 192.168.21.200 +# ports: +# - name: app +# port: 9022 +# protocol: TCP +# +#--- apiVersion: traefik.io/v1alpha1 kind: IngressRouteTCP metadata: @@ -35,36 +35,9 @@ spec: routes: - match: HostSNI(`*`) services: - - name: gitlab-ssh + - name: unraid port: 9022 ---- -apiVersion: v1 -kind: Service -metadata: - name: gitlab -spec: - ports: - - name: app - port: 9443 - protocol: TCP - targetPort: 9443 - clusterIP: None - type: ClusterIP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: gitlab -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 9443 - protocol: TCP - --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -77,7 +50,7 @@ spec: - match: Host(`gitlab.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: gitlab + - name: unraid port: 9443 scheme: https tls: diff --git a/dmz/internalproxy/templates/invidious.yaml b/dmz/internalproxy/templates/invidious.yaml index cd85414..752db88 100644 --- a/dmz/internalproxy/templates/invidious.yaml +++ b/dmz/internalproxy/templates/invidious.yaml @@ -1,74 +1,75 @@ -apiVersion: v1 -kind: Service -metadata: - name: invidious -spec: - ports: - - name: app - port: 3000 - protocol: TCP - targetPort: 3000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: invidious -subsets: -- addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 3000 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: invidious-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`invidious.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: invidious - port: 3000 - tls: - secretName: invidious-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: invidious-tls -spec: - secretName: invidious-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "invidious.durp.info" - dnsNames: - - "invidious.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: invidious-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: invidious.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: v1 +#kind: Service +#metadata: +# name: invidious +#spec: +# ports: +# - name: app +# port: 3000 +# protocol: TCP +# targetPort: 3000 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: invidious +#subsets: +#- addresses: +# - ip: 192.168.20.104 +# ports: +# - name: app +# port: 3000 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: invidious-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`invidious.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: authentik-proxy-provider +# namespace: traefik +# kind: Rule +# services: +# - name: invidious +# port: 3000 +# tls: +# secretName: invidious-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: invidious-tls +#spec: +# secretName: invidious-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "invidious.durp.info" +# dnsNames: +# - "invidious.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: invidious-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: invidious.durp.info +#spec: +# type: ExternalName +# externalName: durp.info +# \ No newline at end of file diff --git a/dmz/internalproxy/templates/kasm.yaml b/dmz/internalproxy/templates/kasm.yaml index 3e53772..7db9d75 100644 --- a/dmz/internalproxy/templates/kasm.yaml +++ b/dmz/internalproxy/templates/kasm.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: kasm -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: kasm -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 443 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,7 +9,7 @@ spec: - match: Host(`kasm.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: kasm + - name: ubuntu port: 443 scheme: https tls: diff --git a/dmz/internalproxy/templates/kuma.yaml b/dmz/internalproxy/templates/kuma.yaml index 0651763..2465b67 100644 --- a/dmz/internalproxy/templates/kuma.yaml +++ b/dmz/internalproxy/templates/kuma.yaml @@ -1,45 +1,46 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: kuma-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kuma.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: master-cluster - port: 443 - tls: - secretName: kuma-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kuma-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: kuma-tls - commonName: "kuma.durp.info" - dnsNames: - - "kuma.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: kuma-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kuma.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: kuma-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`kuma.durp.info`) && PathPrefix(`/`) +# kind: Rule +# middlewares: +# - name: authentik-proxy-provider +# namespace: traefik +# services: +# - name: master-cluster +# port: 443 +# tls: +# secretName: kuma-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: kuma-tls +#spec: +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# secretName: kuma-tls +# commonName: "kuma.durp.info" +# dnsNames: +# - "kuma.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: kuma-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: kuma.durp.info +#spec: +# type: ExternalName +# externalName: durp.info +# \ No newline at end of file diff --git a/dmz/internalproxy/templates/litellm.yaml b/dmz/internalproxy/templates/litellm.yaml index e70cbd8..11a87ac 100644 --- a/dmz/internalproxy/templates/litellm.yaml +++ b/dmz/internalproxy/templates/litellm.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: litellm -spec: - ports: - - name: app - port: 4000 - protocol: TCP - targetPort: 4000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: litellm -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 4000 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,7 +9,7 @@ spec: - match: Host(`litellm.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: litellm + - name: ubuntu port: 4000 tls: secretName: litellm-tls diff --git a/dmz/internalproxy/templates/minio.yaml b/dmz/internalproxy/templates/minio.yaml index c30a923..8622240 100644 --- a/dmz/internalproxy/templates/minio.yaml +++ b/dmz/internalproxy/templates/minio.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: minio -spec: - ports: - - name: app - port: 9769 - protocol: TCP - targetPort: 9769 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: minio -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 9769 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -41,7 +12,7 @@ spec: namespace: traefik kind: Rule services: - - name: minio + - name: unraid port: 9769 scheme: http tls: diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index e3ea9dd..77b04e5 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -1,30 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: nextcloud -spec: - ports: - - name: app - port: 11000 - protocol: TCP - targetPort: 11000 - clusterIP: None - type: ClusterIP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: nextcloud -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 11000 - protocol: TCP - ---- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,7 +11,7 @@ spec: middlewares: - name: nextcloud-chain services: - - name: nextcloud + - name: unraid port: 11000 scheme: http tls: diff --git a/dmz/internalproxy/templates/nexus.yaml b/dmz/internalproxy/templates/nexus.yaml index ed609d9..8e9ca70 100644 --- a/dmz/internalproxy/templates/nexus.yaml +++ b/dmz/internalproxy/templates/nexus.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: nexus -spec: - ports: - - name: app - port: 8081 - protocol: TCP - targetPort: 8081 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: nexus -subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8081 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,7 +9,7 @@ spec: - match: Host(`nexus.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: nexus + - name: unraid port: 8081 tls: secretName: nexus-tls diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index 9141647..9ad17e3 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -15,7 +15,6 @@ spec: property: users --- - apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: @@ -26,36 +25,6 @@ spec: secret: ollama-secret --- - -apiVersion: v1 -kind: Service -metadata: - name: ollama -spec: - ports: - - name: app - port: 11435 - protocol: TCP - targetPort: 11435 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: ollama -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 11435 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -69,13 +38,12 @@ spec: - name: ollama-basic-auth kind: Rule services: - - name: ollama + - name: unraid port: 11435 tls: secretName: ollama-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -90,7 +58,6 @@ spec: - "ollama.durp.info" --- - kind: Service apiVersion: v1 metadata: diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml index 24ae6fd..f3e7f89 100644 --- a/dmz/internalproxy/templates/open-webui.yaml +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: open-webui -spec: - ports: - - name: app - port: 8089 - protocol: TCP - targetPort: 8089 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: open-webui -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8089 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,14 +9,13 @@ spec: - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: open-webui + - name: unraid port: 8089 scheme: http tls: secretName: open-webui-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -60,7 +30,6 @@ spec: - "open-webui.durp.info" --- - kind: Service apiVersion: v1 metadata: diff --git a/dmz/internalproxy/templates/plex.yaml b/dmz/internalproxy/templates/plex.yaml index abbdabf..7fbc5f8 100644 --- a/dmz/internalproxy/templates/plex.yaml +++ b/dmz/internalproxy/templates/plex.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: plex -spec: - ports: - - name: app - port: 32400 - protocol: TCP - targetPort: 32400 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: plex -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 32400 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,14 +9,13 @@ spec: - match: Host(`plex.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: plex + - name: unraid port: 32400 scheme: https tls: secretName: plex-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -60,7 +30,6 @@ spec: - "plex.durp.info" --- - kind: Service apiVersion: v1 metadata: diff --git a/dmz/internalproxy/templates/portainer.yaml b/dmz/internalproxy/templates/portainer.yaml index 554e052..ae89690 100644 --- a/dmz/internalproxy/templates/portainer.yaml +++ b/dmz/internalproxy/templates/portainer.yaml @@ -7,9 +7,9 @@ spec: - websecure routes: - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) - #middlewares: - #- name: whitelist - # namespace: traefik + middlewares: + - name: whitelist + namespace: traefik kind: Rule services: - name: infra-cluster diff --git a/dmz/internalproxy/templates/registry.yaml b/dmz/internalproxy/templates/registry.yaml index ac3c25a..b9b6ed4 100644 --- a/dmz/internalproxy/templates/registry.yaml +++ b/dmz/internalproxy/templates/registry.yaml @@ -1,30 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: registry -spec: - ports: - - name: app - port: 5000 - protocol: TCP - targetPort: 5000 - clusterIP: None - type: ClusterIP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: registry -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 5000 - protocol: TCP - ---- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -39,7 +12,7 @@ spec: - name: whitelist namespace: traefik services: - - name: registry + - name: unraid port: 5000 tls: secretName: registry-tls diff --git a/dmz/internalproxy/templates/root-vault.yaml b/dmz/internalproxy/templates/root-vault.yaml index c32ca62..76d4b94 100644 --- a/dmz/internalproxy/templates/root-vault.yaml +++ b/dmz/internalproxy/templates/root-vault.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: root-vault -spec: - ports: - - name: app - port: 8201 - protocol: TCP - targetPort: 8201 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: root-vault -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8201 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -41,14 +12,13 @@ spec: namespace: traefik kind: Rule services: - - name: root-vault + - name: unraid port: 8201 scheme: https tls: secretName: root-vault-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 29d509d..5bf203e 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: s3 -spec: - ports: - - name: app - port: 9768 - protocol: TCP - targetPort: 9768 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: s3 -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 9768 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -41,7 +12,7 @@ spec: namespace: traefik kind: Rule services: - - name: s3 + - name: unraid port: 9768 scheme: http tls: @@ -75,7 +46,7 @@ spec: - match: Host(`s3.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: s3 + - name: unraid port: 9768 scheme: http tls: diff --git a/dmz/internalproxy/templates/semaphore.yaml b/dmz/internalproxy/templates/semaphore.yaml index 3005b94..145d1ca 100644 --- a/dmz/internalproxy/templates/semaphore.yaml +++ b/dmz/internalproxy/templates/semaphore.yaml @@ -1,64 +1,65 @@ - -apiVersion: v1 -kind: Service -metadata: - name: semaphore -spec: - ports: - - name: app - port: 3001 - protocol: TCP - targetPort: 3001 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: semaphore -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 3001 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: semaphore-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: semaphore - port: 3001 - scheme: http - tls: - secretName: semaphore-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: semaphore-tls -spec: - secretName: semaphore-tls - issuerRef: - name: vault-issuer - kind: ClusterIssuer - commonName: "semaphore.internal.durp.info" - dnsNames: - - "semaphore.internal.durp.info" +# +#apiVersion: v1 +#kind: Service +#metadata: +# name: semaphore +#spec: +# ports: +# - name: app +# port: 3001 +# protocol: TCP +# targetPort: 3001 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: semaphore +#subsets: +# - addresses: +# - ip: 192.168.21.200 +# ports: +# - name: app +# port: 3001 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: semaphore-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: whitelist +# namespace: traefik +# kind: Rule +# services: +# - name: semaphore +# port: 3001 +# scheme: http +# tls: +# secretName: semaphore-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: semaphore-tls +#spec: +# secretName: semaphore-tls +# issuerRef: +# name: vault-issuer +# kind: ClusterIssuer +# commonName: "semaphore.internal.durp.info" +# dnsNames: +# - "semaphore.internal.durp.info" +# \ No newline at end of file From 224450c70c9c848ac8cdff550bf10834b89b8a73 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 12:13:07 -0500 Subject: [PATCH 74/86] update --- dmz/internalproxy/templates/endpoints.yaml | 7 +++++ dmz/internalproxy/templates/smokeping.yaml | 33 +--------------------- 2 files changed, 8 insertions(+), 32 deletions(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 0b36e84..428120a 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -112,6 +112,10 @@ spec: port: 9768 protocol: TCP targetPort: 9768 + - name: smokeping + port: 81 + protocol: TCP + targetPort: 81 --- @@ -168,6 +172,9 @@ subsets: - name: s3 port: 9768 protocol: TCP + - name: smokeping + port: 81 + protocol: TCP --- diff --git a/dmz/internalproxy/templates/smokeping.yaml b/dmz/internalproxy/templates/smokeping.yaml index 2d78b2f..9808876 100644 --- a/dmz/internalproxy/templates/smokeping.yaml +++ b/dmz/internalproxy/templates/smokeping.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: smokeping -spec: - ports: - - name: app - port: 81 - protocol: TCP - targetPort: 81 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: smokeping -subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 81 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -43,13 +14,12 @@ spec: namespace: traefik kind: Rule services: - - name: smokeping + - name: unraid port: 81 tls: secretName: smokeping-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -64,7 +34,6 @@ spec: - "smokeping.durp.info" --- - kind: Service apiVersion: v1 metadata: From ecf16c071745446568bff607b54a53aa781be827 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Mar 2026 07:23:32 -0500 Subject: [PATCH 75/86] update --- dmz/internalproxy/templates/argocd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/argocd.yaml b/dmz/internalproxy/templates/argocd.yaml index d817e19..5adf88e 100644 --- a/dmz/internalproxy/templates/argocd.yaml +++ b/dmz/internalproxy/templates/argocd.yaml @@ -16,7 +16,7 @@ spec: port: 443 scheme: https tls: - secretName: argocd-tls + secretName: argocd-infra-tls --- From f457e7f1d9bea15716b76bb902277f9415ea3fb8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 30 Mar 2026 05:34:35 -0500 Subject: [PATCH 76/86] update --- dmz/internalproxy/templates/ollama.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index 9ad17e3..f03ca52 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -38,7 +38,7 @@ spec: - name: ollama-basic-auth kind: Rule services: - - name: unraid + - name: ubuntu port: 11435 tls: secretName: ollama-tls @@ -66,4 +66,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: ollama.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: durp.info From 1ddfd948a5542f68a91371d421f6cde1ea545f89 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 2 May 2026 06:08:39 -0500 Subject: [PATCH 77/86] add gotify and kuma --- dmz/internalproxy/templates/endpoints.yaml | 13 ++-- dmz/internalproxy/templates/gotify.yaml | 41 ++++++++++ dmz/internalproxy/templates/kuma.yaml | 87 ++++++++++------------ 3 files changed, 88 insertions(+), 53 deletions(-) create mode 100644 dmz/internalproxy/templates/gotify.yaml diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 428120a..fbabade 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -9,7 +9,6 @@ subsets: - port: 443 --- - apiVersion: v1 kind: Service metadata: @@ -21,7 +20,6 @@ spec: targetPort: 443 --- - apiVersion: v1 kind: Endpoints metadata: @@ -33,7 +31,6 @@ subsets: - port: 443 --- - apiVersion: v1 kind: Service metadata: @@ -45,7 +42,6 @@ spec: targetPort: 443 --- - apiVersion: v1 kind: Service metadata: @@ -118,7 +114,6 @@ spec: targetPort: 81 --- - apiVersion: v1 kind: Endpoints metadata: @@ -139,6 +134,9 @@ subsets: - name: forgejo port: 3000 protocol: TCP + - name: kuma + port: 3001 + protocol: TCP - name: freshrss port: 8085 protocol: TCP @@ -175,9 +173,11 @@ subsets: - name: smokeping port: 81 protocol: TCP + - name: gotify + port: 8070 + protocol: TCP --- - apiVersion: v1 kind: Endpoints metadata: @@ -197,7 +197,6 @@ subsets: protocol: TCP --- - apiVersion: v1 kind: Service metadata: diff --git a/dmz/internalproxy/templates/gotify.yaml b/dmz/internalproxy/templates/gotify.yaml new file mode 100644 index 0000000..6619aed --- /dev/null +++ b/dmz/internalproxy/templates/gotify.yaml @@ -0,0 +1,41 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: gotify-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`gotify.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: unraid + port: 8070 + scheme: http + tls: + secretName: gotify-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gotify-tls +spec: + secretName: gotify-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "gotify.durp.info" + dnsNames: + - "gotify.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: gotify-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: gotify.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/kuma.yaml b/dmz/internalproxy/templates/kuma.yaml index 2465b67..31b040b 100644 --- a/dmz/internalproxy/templates/kuma.yaml +++ b/dmz/internalproxy/templates/kuma.yaml @@ -1,46 +1,41 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: kuma-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`kuma.durp.info`) && PathPrefix(`/`) -# kind: Rule -# middlewares: -# - name: authentik-proxy-provider -# namespace: traefik -# services: -# - name: master-cluster -# port: 443 -# tls: -# secretName: kuma-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: kuma-tls -#spec: -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# secretName: kuma-tls -# commonName: "kuma.durp.info" -# dnsNames: -# - "kuma.durp.info" -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: kuma-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: kuma.durp.info -#spec: -# type: ExternalName -# externalName: durp.info -# \ No newline at end of file +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: kuma-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kuma.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: unraid + port: 3001 + scheme: http + tls: + secretName: kuma-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kuma-tls +spec: + secretName: kuma-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "kuma.durp.info" + dnsNames: + - "kuma.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: kuma-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: kuma.durp.info +spec: + type: ExternalName + externalName: durp.info From d50b776fef3f43a486a89da459d2ecebefde167c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 2 May 2026 06:15:04 -0500 Subject: [PATCH 78/86] update --- dmz/internalproxy/templates/endpoints.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index fbabade..c7544c9 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -63,6 +63,9 @@ spec: - name: forgejo port: 3000 protocol: TCP + - name: kuma + port: 3001 + protocol: TCP targetPort: 3000 - name: freshrss port: 8085 @@ -112,6 +115,9 @@ spec: port: 81 protocol: TCP targetPort: 81 + - name: gotify + port: 8070 + protocol: TCP --- apiVersion: v1 From d7effa4eacbb0dca4091b6eff37caec9abab8684 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 May 2026 08:23:10 -0500 Subject: [PATCH 79/86] update --- dmz/internalproxy/templates/s3.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 5bf203e..8d5bdca 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -13,7 +13,7 @@ spec: kind: Rule services: - name: unraid - port: 9768 + port: 9769 scheme: http tls: secretName: s3-tls @@ -47,7 +47,7 @@ spec: kind: Rule services: - name: unraid - port: 9768 + port: 9769 scheme: http tls: secretName: s3-external-tls From b968cd024f5ae8fd94e1601f15cfaf8d65da4187 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 May 2026 12:14:16 -0500 Subject: [PATCH 80/86] update --- dmz/internalproxy/templates/s3.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 8d5bdca..5bf203e 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -13,7 +13,7 @@ spec: kind: Rule services: - name: unraid - port: 9769 + port: 9768 scheme: http tls: secretName: s3-tls @@ -47,7 +47,7 @@ spec: kind: Rule services: - name: unraid - port: 9769 + port: 9768 scheme: http tls: secretName: s3-external-tls From 2d1916de2bf8de93e52e61f02ba0d51445f5925a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 May 2026 13:32:48 -0500 Subject: [PATCH 81/86] add images --- dmz/internalproxy/templates/gitlab.yaml | 44 +++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 2f225c2..5d07bea 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -80,3 +80,47 @@ metadata: spec: type: ExternalName externalName: durp.info + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: gitlab-registry + namespace: gitlab +spec: + entryPoints: + - websecure + routes: + - match: Host(`images.durp.info`) + kind: Rule + services: + - name: unraid + port: 5050 + scheme: http + tls: + certResolver: letsencrypt + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gitlab-images-tls +spec: + secretName: gitlab-images-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "images.durp.info" + dnsNames: + - "images.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: gitlab-images-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: images.durp.info +spec: + type: ExternalName + externalName: durp.info From e66526b1766e9b27b0d17e84ed78b47eaae6b525 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 May 2026 13:37:02 -0500 Subject: [PATCH 82/86] update --- dmz/internalproxy/templates/gitlab.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 5d07bea..6f032fa 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -86,7 +86,6 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: gitlab-registry - namespace: gitlab spec: entryPoints: - websecure From ce51ae2f8d7439403922c185615d9668b4b2558b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 May 2026 13:39:43 -0500 Subject: [PATCH 83/86] update --- dmz/internalproxy/templates/gitlab.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 6f032fa..5331347 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -97,7 +97,7 @@ spec: port: 5050 scheme: http tls: - certResolver: letsencrypt + secretName: gitlab-images-tls --- apiVersion: cert-manager.io/v1 From dc09d0109eb3a7d65423c80cd91becb01c760887 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 10 May 2026 08:03:18 -0500 Subject: [PATCH 84/86] update --- dmz/internalproxy/templates/endpoints.yaml | 7 +++++++ dmz/internalproxy/templates/gitlab.yaml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index c7544c9..8380a2c 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -103,6 +103,10 @@ spec: port: 5000 protocol: TCP targetPort: 5000 + - name: gitlab-registry + port: 5002 + protocol: TCP + targetPort: 5002 - name: root-vault port: 8201 protocol: TCP @@ -170,6 +174,9 @@ subsets: - name: registry port: 5000 protocol: TCP + - name: gitlab-registry + port: 5002 + protocol: TCP - name: root-vault port: 8201 protocol: TCP diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 5331347..d64a5aa 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -94,7 +94,7 @@ spec: kind: Rule services: - name: unraid - port: 5050 + port: 5002 scheme: http tls: secretName: gitlab-images-tls From fa564e4d8c27be062bff10a60ff366d972334feb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 12 May 2026 06:24:19 -0500 Subject: [PATCH 85/86] update --- infra/authentik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/authentik/values.yaml b/infra/authentik/values.yaml index 1cf4c0a..c98e563 100644 --- a/infra/authentik/values.yaml +++ b/infra/authentik/values.yaml @@ -34,7 +34,7 @@ authentik: enabled: true image: registry: registry.durp.info - repository: bitnami/postgresql + repository: bitnamilegacy/postgresql pullPolicy: Always postgresqlUsername: "authentik" postgresqlDatabase: "authentik" From dc2c619e19c59aa770109eea70d6a8cbf52359ae Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 12 May 2026 06:26:13 -0500 Subject: [PATCH 86/86] update --- infra/authentik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/authentik/values.yaml b/infra/authentik/values.yaml index c98e563..7b75190 100644 --- a/infra/authentik/values.yaml +++ b/infra/authentik/values.yaml @@ -52,7 +52,7 @@ authentik: enabled: false image: registry: registry.durp.info - repository: bitnami/redis + repository: bitnamilegacy/redis pullPolicy: Always architecture: standalone auth: