diff --git a/.gitignore b/.gitignore index d32217b..1dee64d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ -*/.terraform -*/.terraform.lock.hcl .idea +infra/terraform/.terraform +infra/terraform/.terraform.lock.hcl diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml new file mode 100644 index 0000000..4c7a36a --- /dev/null +++ b/.gitlab/.gitlab-ci.yml @@ -0,0 +1,34 @@ +stages: + - triggers + +build_dmz: + stage: triggers + trigger: + include: infra/.gitlab/.gitlab-ci.yml + rules: + - changes: + - "dmz/terraform/*.tf" + +build_infra: + stage: triggers + trigger: + include: infra/.gitlab/.gitlab-ci.yml + rules: + - changes: + - "infra/terraform/*.tf" + +build_dev: + stage: triggers + trigger: + include: dev/.gitlab/.gitlab-ci.yml + rules: + - changes: + - "dev/terraform/*.tf" + +build_prd: + stage: triggers + trigger: + include: prd/.gitlab/.gitlab-ci.yml + rules: + - changes: + - "prd/terraform/*.tf" diff --git a/ansible/base.yaml b/ansible/base.yaml new file mode 100644 index 0000000..9093cdb --- /dev/null +++ b/ansible/base.yaml @@ -0,0 +1,5 @@ +- hosts: all + gather_facts: yes + become: yes + roles: + - base diff --git a/ansible/newcluster.yaml b/ansible/newcluster.yaml new file mode 100644 index 0000000..4fb3572 --- /dev/null +++ b/ansible/newcluster.yaml @@ -0,0 +1,2 @@ +argocd login --insecure +argocd cluster add default --name prd --yes --kubeconfig ~/Documents/config-prd diff --git a/ansible/roles/base/files/01proxy b/ansible/roles/base/files/01proxy new file mode 100644 index 0000000..947368d --- /dev/null +++ b/ansible/roles/base/files/01proxy @@ -0,0 +1 @@ +Acquire::http::Proxy "http://192.168.21.200:3142"; diff --git a/ansible/roles/base/files/10periodic b/ansible/roles/base/files/10periodic new file mode 100644 index 0000000..5d37e9f --- /dev/null +++ b/ansible/roles/base/files/10periodic @@ -0,0 +1,4 @@ +APT::Periodic::Update-Package-Lists "1"; +APT::Periodic::Download-Upgradeable-Packages "1"; +APT::Periodic::AutocleanInterval "7"; +APT::Periodic::Unattended-Upgrade "1"; diff --git a/ansible/roles/base/files/authorized_keys_user b/ansible/roles/base/files/authorized_keys_user new file mode 100644 index 0000000..49d58bb --- /dev/null +++ b/ansible/roles/base/files/authorized_keys_user @@ -0,0 +1,2 @@ +sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGilcndatMrXg06VxtNKuIo3scoyyXbYX8Z7cOjeA102AAAABHNzaDo= desktop-arch-09-08-2025-yubikey +sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINsbNSZ5Wr+50Ahz+IeZxt6F7gZ6wm1J8uKXQLbdbKFaAAAABHNzaDo= desktop-arch-09-08-2025-yubikeyNano \ No newline at end of file diff --git a/ansible/roles/base/files/issue b/ansible/roles/base/files/issue new file mode 100644 index 0000000..5acb66f --- /dev/null +++ b/ansible/roles/base/files/issue @@ -0,0 +1,4 @@ +Use of this system is restricted to authorized users only, and all use is subjected to an acceptable use policy. + +IF YOU ARE NOT AUTHORIZED TO USE THIS SYSTEM, DISCONNECT NOW. + diff --git a/ansible/roles/base/files/motd b/ansible/roles/base/files/motd new file mode 100644 index 0000000..fa6c8db --- /dev/null +++ b/ansible/roles/base/files/motd @@ -0,0 +1,4 @@ +THIS SYSTEM IS FOR AUTHORIZED USE ONLY + +All activities are logged and monitored. + diff --git a/ansible/roles/base/files/sshd_config_secured b/ansible/roles/base/files/sshd_config_secured new file mode 100644 index 0000000..88bfedb --- /dev/null +++ b/ansible/roles/base/files/sshd_config_secured @@ -0,0 +1,95 @@ +# Package generated configuration file +# See the sshd_config(5) manpage for details + +# What ports, IPs and protocols we listen for +Port 22 +# Use these options to restrict which interfaces/protocols sshd will bind to +#ListenAddress :: +#ListenAddress 0.0.0.0 +Protocol 2 +# HostKeys for protocol version 2 +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_dsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +HostKey /etc/ssh/ssh_host_ed25519_key +#Privilege Separation is turned on for security +UsePrivilegeSeparation yes + +# Lifetime and size of ephemeral version 1 server key +KeyRegenerationInterval 3600 +ServerKeyBits 1024 + +# Logging +SyslogFacility AUTH +LogLevel INFO + +# Authentication: +LoginGraceTime 120 +PermitRootLogin no +StrictModes yes + +RSAAuthentication yes +PubkeyAuthentication yes +#AuthorizedKeysFile %h/.ssh/authorized_keys + +# Don't read the user's ~/.rhosts and ~/.shosts files +IgnoreRhosts yes +# For this to work you will also need host keys in /etc/ssh_known_hosts +RhostsRSAAuthentication no +# similar for protocol version 2 +HostbasedAuthentication no +# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication +#IgnoreUserKnownHosts yes + +# To enable empty passwords, change to yes (NOT RECOMMENDED) +PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +ChallengeResponseAuthentication no + +# Change to no to disable tunnelled clear text passwords +PasswordAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosGetAFSToken no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +X11Forwarding no +X11DisplayOffset 10 +PrintMotd no +PrintLastLog yes +TCPKeepAlive yes +#UseLogin no + +#MaxStartups 10:30:60 +#Banner /etc/issue.net + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +Subsystem sftp /usr/lib/openssh/sftp-server + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +UsePAM yes + +ClientAliveInterval 300 + +#enable remote powershell +#Subsystem powershell /usr/bin/pwsh -sshs -NoLogo + + diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml new file mode 100644 index 0000000..8cb1553 --- /dev/null +++ b/ansible/roles/base/tasks/main.yaml @@ -0,0 +1,155 @@ +- name: Copy apt proxy + copy: + src: files/01proxy + dest: /etc/apt/apt.conf.d/01proxy + owner: root + group: root + mode: "0644" + force: yes + when: + - ansible_os_family == "Debian" + - inventory_hostname not in hosts_deny + +- name: Update packages + apt: + name: '*' + state: latest + update_cache: yes + only_upgrade: yes + retries: 300 + delay: 10 + +- name: Remove packages not needed anymore + apt: + autoremove: yes + retries: 300 + delay: 10 + +- name: Install required packages Debian + apt: + state: latest + pkg: "{{ item }}" + with_items: "{{ required_packages }}" + retries: 300 + delay: 10 + +- name: Create user account + user: + name: "user" + shell: /bin/bash + state: present + createhome: yes + +- name: ensure ssh folder exists for user + file: + path: /home/user/.ssh + owner: user + group: user + mode: "0700" + state: directory + +- name: Deploy SSH Key (user) + copy: + dest: /home/user/.ssh/authorized_keys + src: files/authorized_keys_user + owner: user + group: user + force: true + +- name: Remove Root SSH Configuration + file: + path: /root/.ssh + state: absent + +- name: Copy Secured SSHD Configuration + copy: + src: files/sshd_config_secured + dest: /etc/ssh/sshd_config + owner: root + group: root + mode: "0644" + when: ansible_os_family == "Debian" + +- name: Copy Secured SSHD Configuration + copy: + src: files/sshd_config_secured_redhat + dest: /etc/ssh/sshd_config + owner: root + group: root + mode: "0644" + when: ansible_os_family == "RedHat" + +- name: Restart SSHD + systemd: + name: sshd + daemon_reload: yes + state: restarted + enabled: yes + ignore_errors: yes + + +- name: Copy unattended-upgrades file + copy: + src: files/10periodic + dest: /etc/apt/apt.conf.d/10periodic + owner: root + group: root + mode: "0644" + force: yes + when: ansible_os_family == "Debian" + +- name: Remove undesirable packages + package: + name: "{{ unnecessary_software }}" + state: absent + when: ansible_os_family == "Debian" + +- name: Stop and disable unnecessary services + service: + name: "{{ item }}" + state: stopped + enabled: no + with_items: "{{ unnecessary_services }}" + ignore_errors: yes + +- name: Set a message of the day + copy: + dest: /etc/motd + src: files/motd + owner: root + group: root + mode: 0644 + +- name: Set a login banner + copy: + dest: "{{ item }}" + src: files/issue + owner: root + group: root + mode: 0644 + with_items: + - /etc/issue + - /etc/issue.net + +- name: set timezone + shell: timedatectl set-timezone America/Chicago + +- name: Enable cockpit + systemd: + name: cockpit + daemon_reload: yes + state: restarted + enabled: yes + +- name: change password + ansible.builtin.user: + name: "user" + state: present + password: "{{ lookup('ansible.builtin.env', 'USER_PASSWORD') | password_hash('sha512') }}" + +- name: add user to sudoers + community.general.sudoers: + name: user + state: present + user: user + commands: ALL diff --git a/ansible/roles/base/vars/main.yaml b/ansible/roles/base/vars/main.yaml new file mode 100644 index 0000000..2670ac2 --- /dev/null +++ b/ansible/roles/base/vars/main.yaml @@ -0,0 +1,17 @@ +required_packages: + - ufw + - qemu-guest-agent + - fail2ban + - unattended-upgrades + - cockpit + - nfs-common + - open-iscsi + +unnecessary_services: + - postfix + - telnet + +unnecessary_software: + - tcpdump + - nmap-ncat + - wpa_supplicant diff --git a/dev/terraform/k3s.tf b/dev/terraform/k3s.tf new file mode 100644 index 0000000..4d02a21 --- /dev/null +++ b/dev/terraform/k3s.tf @@ -0,0 +1,115 @@ +resource "proxmox_vm_qemu" "k3smaster" { + count = local.k3smaster.count + ciuser = "administrator" + vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" + name = local.k3smaster.name[count.index] + target_node = local.k3smaster.node[count.index] + clone = local.template + tags = local.k3smaster.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.k3smaster.cores + sockets = 1 + cpu_type = "host" + memory = local.k3smaster.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.k3smaster.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3smaster.drive + format = local.format + storage = local.k3smaster.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} + +resource "proxmox_vm_qemu" "k3sserver" { + count = local.k3sserver.count + ciuser = "administrator" + vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" + name = local.k3sserver.name[count.index] + target_node = local.k3sserver.node[count.index] + clone = local.template + tags = local.k3sserver.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.k3sserver.cores + sockets = 1 + cpu_type = "host" + memory = local.k3sserver.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.k3sserver.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3sserver.drive + format = local.format + storage = local.k3sserver.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} diff --git a/dev/terraform/main.tf b/dev/terraform/main.tf new file mode 100644 index 0000000..c75295e --- /dev/null +++ b/dev/terraform/main.tf @@ -0,0 +1,48 @@ +terraform { + backend "http" {} + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc9" + } + } +} + +provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false +} + +locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + format = "raw" + dnsserver = "192.168.10.1" + vlan = 10 + k3smaster = { + tags = "k3s_dev" + count = 3 + name = ["master01-dev", "master02-dev", "master03-dev"] + cores = 2 + memory = "4096" + drive = 20 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] + } + k3sserver = { + tags = "k3s_dev" + count = 3 + name = ["node01-dev", "node02-dev", "node03-dev"] + cores = 4 + memory = "8192" + drive = 120 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] + } +} diff --git a/dev/terraform/variables.tf b/dev/terraform/variables.tf new file mode 100644 index 0000000..29a1c9d --- /dev/null +++ b/dev/terraform/variables.tf @@ -0,0 +1,14 @@ +variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string +} + +variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string +} + +variable "pm_user" { + description = "Username to Proxmox provider" + type = string +} diff --git a/dmz/authentik/templates/ingress.yaml b/dmz/authentik/templates/ingress.yaml index e69de29..f03751e 100644 --- a/dmz/authentik/templates/ingress.yaml +++ b/dmz/authentik/templates/ingress.yaml @@ -0,0 +1,62 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: authentik-tls + commonName: "authentik.durp.info" + dnsNames: + - "authentik.durp.info" + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: authentik-tls + +--- +kind: Service +apiVersion: v1 +metadata: + name: authentik-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +spec: + type: ExternalName + externalName: durp.info + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: infra-cluster +subsets: + - addresses: + - ip: 192.168.12.130 + ports: + - port: 443 + +--- +apiVersion: v1 +kind: Service +metadata: + name: infra-cluster +spec: + ports: + - protocol: TCP + port: 443 + targetPort: 443 diff --git a/dmz/gitlab-runner/Chart.yaml b/dmz/gitlab-runner/Chart.yaml index 17e8efe..542b033 100644 --- a/dmz/gitlab-runner/Chart.yaml +++ b/dmz/gitlab-runner/Chart.yaml @@ -6,6 +6,9 @@ version: 0.0.1 appVersion: 0.0.1 dependencies: +- name: gitlab-runner + repository: https://charts.gitlab.io/ + version: 0.77.2 - name: gitlab-runner repository: https://charts.gitlab.io/ version: 0.77.2 diff --git a/dmz/gitlab-runner/values.yaml b/dmz/gitlab-runner/values.yaml index 7ba1021..cbf56dc 100644 --- a/dmz/gitlab-runner/values.yaml +++ b/dmz/gitlab-runner/values.yaml @@ -1,11 +1,11 @@ -personal: +gitlab-runner: image: registry: registry.durp.info image: gitlab-org/gitlab-runner imagePullPolicy: Always - gitlabUrl: https://gitlab.durp.info/ + gitlabUrl: https://gitlab.com/ unregisterRunner: false terminationGracePeriodSeconds: 3600 concurrent: 10 @@ -18,15 +18,87 @@ personal: podSecurityPolicy: enabled: false resourceNames: - - gitlab-runner + - gitlab-runner metrics: enabled: true serviceMonitor: - enabled: true + enabled: true service: enabled: true - annotations: {} + annotations: {} + + runners: + config: | + [[runners]] + [runners.kubernetes] + namespace = "{{.Release.Namespace}}" + image = "ubuntu:22.04" + privileged = true + + executor: kubernetes + name: "k3s" + runUntagged: true + privileged: true + secret: gitlab-secret + #builds: + #cpuLimit: 200m + #cpuLimitOverwriteMaxAllowed: 400m + #memoryLimit: 256Mi + #memoryLimitOverwriteMaxAllowed: 512Mi + #cpuRequests: 100m + #cpuRequestsOverwriteMaxAllowed: 200m + #memoryRequests: 128Mi + #memoryRequestsOverwriteMaxAllowed: 256Mi + + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + runAsNonRoot: true + privileged: false + capabilities: + drop: ["ALL"] + + podSecurityContext: + runAsUser: 100 + fsGroup: 65533 + + resources: + limits: + memory: 2Gi + requests: + memory: 128Mi + cpu: 500m + +personal: + + image: + registry: registry.durp.info + image: gitlab-org/gitlab-runner + + imagePullPolicy: Always + gitlabUrl: https://gitlab.com/ + unregisterRunner: false + terminationGracePeriodSeconds: 3600 + concurrent: 10 + checkInterval: 30 + + rbac: + create: true + rules: [] + clusterWideAccess: false + podSecurityPolicy: + enabled: false + resourceNames: + - gitlab-runner + + metrics: + enabled: true + serviceMonitor: + enabled: true + service: + enabled: true + annotations: {} runners: config: | @@ -41,15 +113,15 @@ personal: runUntagged: true privileged: true secret: gitlab-secret-personal - builds: - cpuLimit: 200m - cpuLimitOverwriteMaxAllowed: 400m - memoryLimit: 256Mi - memoryLimitOverwriteMaxAllowed: 512Mi - cpuRequests: 100m - cpuRequestsOverwriteMaxAllowed: 200m - memoryRequests: 128Mi - memoryRequestsOverwriteMaxAllowed: 256Mi + #builds: + #cpuLimit: 200m + #cpuLimitOverwriteMaxAllowed: 400m + #memoryLimit: 256Mi + #memoryLimitOverwriteMaxAllowed: 512Mi + #cpuRequests: 100m + #cpuRequestsOverwriteMaxAllowed: 200m + #memoryRequests: 128Mi + #memoryRequestsOverwriteMaxAllowed: 256Mi securityContext: allowPrivilegeEscalation: false @@ -63,9 +135,9 @@ personal: runAsUser: 100 fsGroup: 65533 - resources: + resources: limits: memory: 2Gi requests: memory: 128Mi - cpu: 50m + cpu: 500m diff --git a/dmz/internalproxy/templates/argocd.yaml b/dmz/internalproxy/templates/argocd.yaml deleted file mode 100644 index 5adf88e..0000000 --- a/dmz/internalproxy/templates/argocd.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: argocd-infra-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`argocd.infra.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: infra-cluster - port: 443 - scheme: https - tls: - secretName: argocd-infra-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: argocd-infra-tls -spec: - secretName: argocd-infra-tls - issuerRef: - name: vault-issuer - kind: ClusterIssuer - commonName: "argocd.infra.durp.info" - dnsNames: - - "argocd.infra.durp.info" diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index adf9884..328d115 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,40 +1,40 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: authentik-tls - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" - ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra-cluster - port: 443 - tls: - secretName: authentik-tls - ---- -kind: Service -apiVersion: v1 -metadata: - name: authentik-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: infra-cluster +# port: 443 +# tls: +# secretName: authentik-tls +# +#--- +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: authentik-tls +#spec: +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# secretName: authentik-tls +# commonName: "authentik.durp.info" +# dnsNames: +# - "authentik.durp.info" +# +#--- +#kind: Service +#apiVersion: v1 +#metadata: +# name: authentik-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +#spec: +# type: ExternalName +# externalName: durp.info diff --git a/dmz/internalproxy/templates/duplicati.yaml b/dmz/internalproxy/templates/duplicati.yaml index 74475df..d2563d0 100644 --- a/dmz/internalproxy/templates/duplicati.yaml +++ b/dmz/internalproxy/templates/duplicati.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: duplicati +spec: + ports: + - name: app + port: 8200 + protocol: TCP + targetPort: 8200 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: duplicati +subsets: +- addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 8200 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -14,7 +43,7 @@ spec: namespace: traefik kind: Rule services: - - name: unraid + - name: duplicati port: 8200 tls: secretName: duplicati-tls diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 8380a2c..c5d00c4 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -9,6 +9,7 @@ subsets: - port: 443 --- + apiVersion: v1 kind: Service metadata: @@ -20,6 +21,7 @@ spec: targetPort: 443 --- + apiVersion: v1 kind: Endpoints metadata: @@ -31,6 +33,7 @@ subsets: - port: 443 --- + apiVersion: v1 kind: Service metadata: @@ -40,191 +43,3 @@ spec: - protocol: TCP port: 443 targetPort: 443 - ---- -apiVersion: v1 -kind: Service -metadata: - name: unraid -spec: - ports: - - name: https - protocol: TCP - port: 443 - targetPort: 443 - - name: tdarr - port: 8267 - protocol: TCP - targetPort: 8267 - - name: duplicati - port: 8200 - protocol: TCP - targetPort: 8200 - - name: forgejo - port: 3000 - protocol: TCP - - name: kuma - port: 3001 - protocol: TCP - targetPort: 3000 - - name: freshrss - port: 8085 - protocol: TCP - targetPort: 8085 - - name: gitlab-ssh - port: 9022 - protocol: TCP - targetPort: 9022 - - name: gitlab - port: 9443 - protocol: TCP - targetPort: 9443 - - name: minio - port: 9769 - protocol: TCP - targetPort: 9769 - - name: nextcloud - port: 11000 - protocol: TCP - targetPort: 11000 - - name: nexus - port: 8081 - protocol: TCP - targetPort: 8081 - - name: openweb-ui - port: 8089 - protocol: TCP - targetPort: 8089 - - name: plex - port: 32400 - protocol: TCP - targetPort: 32400 - - name: registry - port: 5000 - protocol: TCP - targetPort: 5000 - - name: gitlab-registry - port: 5002 - protocol: TCP - targetPort: 5002 - - name: root-vault - port: 8201 - protocol: TCP - targetPort: 8201 - - name: s3 - port: 9768 - protocol: TCP - targetPort: 9768 - - name: smokeping - port: 81 - protocol: TCP - targetPort: 81 - - name: gotify - port: 8070 - protocol: TCP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: unraid -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: https - port: 443 - protocol: TCP - - name: tdarr - port: 8267 - protocol: TCP - - name: duplicati - port: 8200 - protocol: TCP - - name: forgejo - port: 3000 - protocol: TCP - - name: kuma - port: 3001 - protocol: TCP - - name: freshrss - port: 8085 - protocol: TCP - - name: gitlab-ssh - port: 9022 - protocol: TCP - - name: gitlab - port: 9443 - protocol: TCP - - name: minio - port: 9769 - protocol: TCP - - name: nextcloud - port: 11000 - protocol: TCP - - name: nexus - port: 8081 - protocol: TCP - - name: openweb-ui - port: 8089 - protocol: TCP - - name: plex - port: 32400 - protocol: TCP - - name: registry - port: 5000 - protocol: TCP - - name: gitlab-registry - port: 5002 - protocol: TCP - - name: root-vault - port: 8201 - protocol: TCP - - name: s3 - port: 9768 - protocol: TCP - - name: smokeping - port: 81 - protocol: TCP - - name: gotify - port: 8070 - protocol: TCP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: ubuntu -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: https - port: 443 - protocol: TCP - - name: litellm - port: 4000 - protocol: TCP - - name: ollama - port: 11435 - protocol: TCP - ---- -apiVersion: v1 -kind: Service -metadata: - name: ubuntu -spec: - ports: - - name: https - port: 443 - protocol: TCP - targetPort: 443 - - name: litellm - port: 4000 - protocol: TCP - targetPort: 4000 - - name: ollama - port: 11435 - protocol: TCP - targetPort: 11435 diff --git a/dmz/internalproxy/templates/forgejo.yaml b/dmz/internalproxy/templates/forgejo.yaml deleted file mode 100644 index 52eb710..0000000 --- a/dmz/internalproxy/templates/forgejo.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: forgejo-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`forgejo.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: unraid - port: 3000 - scheme: http - tls: - secretName: forgejo-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: forgejo-tls -spec: - secretName: forgejo-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "forgejo.durp.info" - dnsNames: - - "forgejo.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: forgejo-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: forgejo.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/dmz/internalproxy/templates/freshrss.yaml b/dmz/internalproxy/templates/freshrss.yaml deleted file mode 100644 index 092854c..0000000 --- a/dmz/internalproxy/templates/freshrss.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: freshrss-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`freshrss.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: unraid - port: 8085 - tls: - secretName: freshrss-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: freshrss-tls -spec: - secretName: freshrss-tls - issuerRef: - name: vault-issuer - kind: ClusterIssuer - commonName: "freshrss.durp.info" - dnsNames: - - "freshrss.durp.info" diff --git a/dmz/internalproxy/templates/gitea.yaml b/dmz/internalproxy/templates/gitea.yaml new file mode 100644 index 0000000..58c28d7 --- /dev/null +++ b/dmz/internalproxy/templates/gitea.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: gitea +spec: + ports: + - name: app + port: 3000 + protocol: TCP + targetPort: 3000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: gitea +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 3000 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: gitea-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`gitea.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: gitea + port: 3000 + scheme: http + tls: + secretName: gitea-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gitea-tls +spec: + secretName: gitea-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "gitea.durp.info" + dnsNames: + - "gitea.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: gitea-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: gitea.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index d64a5aa..2dd208e 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -1,42 +1,28 @@ -#apiVersion: v1 -#kind: Service -#metadata: -# name: gitlab-ssh -#spec: -# ports: -# - name: app -# port: 9022 -# protocol: TCP -# targetPort: 9022 -# clusterIP: None -# type: ClusterIP -# -#--- -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: gitlab-ssh -#subsets: -# - addresses: -# - ip: 192.168.21.200 -# ports: -# - name: app -# port: 9022 -# protocol: TCP -# -#--- -apiVersion: traefik.io/v1alpha1 -kind: IngressRouteTCP +apiVersion: v1 +kind: Service metadata: - name: gitlab-ssh + name: gitlab spec: - entryPoints: - - gitlab-ssh - routes: - - match: HostSNI(`*`) - services: - - name: unraid - port: 9022 + ports: + - name: app + port: 9080 + protocol: TCP + targetPort: 9080 + clusterIP: None + type: ClusterIP + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: gitlab +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 9080 + protocol: TCP --- apiVersion: traefik.io/v1alpha1 @@ -50,9 +36,9 @@ spec: - match: Host(`gitlab.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: unraid - port: 9443 - scheme: https + - name: gitlab + port: 9080 + scheme: http tls: secretName: gitlab-tls @@ -80,46 +66,3 @@ metadata: spec: type: ExternalName externalName: durp.info - ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: gitlab-registry -spec: - entryPoints: - - websecure - routes: - - match: Host(`images.durp.info`) - kind: Rule - services: - - name: unraid - port: 5002 - scheme: http - tls: - secretName: gitlab-images-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: gitlab-images-tls -spec: - secretName: gitlab-images-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "images.durp.info" - dnsNames: - - "images.durp.info" - ---- -kind: Service -apiVersion: v1 -metadata: - name: gitlab-images-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: images.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/dmz/internalproxy/templates/invidious.yaml b/dmz/internalproxy/templates/invidious.yaml index 752db88..cd85414 100644 --- a/dmz/internalproxy/templates/invidious.yaml +++ b/dmz/internalproxy/templates/invidious.yaml @@ -1,75 +1,74 @@ -#apiVersion: v1 -#kind: Service -#metadata: -# name: invidious -#spec: -# ports: -# - name: app -# port: 3000 -# protocol: TCP -# targetPort: 3000 -# clusterIP: None -# type: ClusterIP -# -#--- -# -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: invidious -#subsets: -#- addresses: -# - ip: 192.168.20.104 -# ports: -# - name: app -# port: 3000 -# protocol: TCP -# -#--- -# -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: invidious-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`invidious.durp.info`) && PathPrefix(`/`) -# middlewares: -# - name: authentik-proxy-provider -# namespace: traefik -# kind: Rule -# services: -# - name: invidious -# port: 3000 -# tls: -# secretName: invidious-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: invidious-tls -#spec: -# secretName: invidious-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "invidious.durp.info" -# dnsNames: -# - "invidious.durp.info" -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: invidious-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: invidious.durp.info -#spec: -# type: ExternalName -# externalName: durp.info -# \ No newline at end of file +apiVersion: v1 +kind: Service +metadata: + name: invidious +spec: + ports: + - name: app + port: 3000 + protocol: TCP + targetPort: 3000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: invidious +subsets: +- addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 3000 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: invidious-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`invidious.durp.info`) && PathPrefix(`/`) + middlewares: + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: invidious + port: 3000 + tls: + secretName: invidious-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: invidious-tls +spec: + secretName: invidious-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "invidious.durp.info" + dnsNames: + - "invidious.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: invidious-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: invidious.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/kasm.yaml b/dmz/internalproxy/templates/kasm.yaml index 7db9d75..3e53772 100644 --- a/dmz/internalproxy/templates/kasm.yaml +++ b/dmz/internalproxy/templates/kasm.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: kasm +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: kasm +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 443 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -9,7 +38,7 @@ spec: - match: Host(`kasm.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: ubuntu + - name: kasm port: 443 scheme: https tls: diff --git a/dmz/internalproxy/templates/kuma.yaml b/dmz/internalproxy/templates/kuma.yaml index 31b040b..0651763 100644 --- a/dmz/internalproxy/templates/kuma.yaml +++ b/dmz/internalproxy/templates/kuma.yaml @@ -6,30 +6,34 @@ spec: entryPoints: - websecure routes: - - match: Host(`kuma.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: unraid - port: 3001 - scheme: http + - match: Host(`kuma.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: master-cluster + port: 443 tls: secretName: kuma-tls --- + apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: kuma-tls spec: - secretName: kuma-tls issuerRef: name: letsencrypt-production kind: ClusterIssuer + secretName: kuma-tls commonName: "kuma.durp.info" dnsNames: - - "kuma.durp.info" + - "kuma.durp.info" --- + kind: Service apiVersion: v1 metadata: diff --git a/dmz/internalproxy/templates/litellm.yaml b/dmz/internalproxy/templates/litellm.yaml index 11a87ac..e70cbd8 100644 --- a/dmz/internalproxy/templates/litellm.yaml +++ b/dmz/internalproxy/templates/litellm.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: litellm +spec: + ports: + - name: app + port: 4000 + protocol: TCP + targetPort: 4000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: litellm +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 4000 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -9,7 +38,7 @@ spec: - match: Host(`litellm.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: ubuntu + - name: litellm port: 4000 tls: secretName: litellm-tls diff --git a/dmz/internalproxy/templates/longhorn.yaml b/dmz/internalproxy/templates/longhorn.yaml deleted file mode 100644 index 9eeda9e..0000000 --- a/dmz/internalproxy/templates/longhorn.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: longhorn-infra-ingress - annotations: - cert-manager.io/cluster-issuer: vault-issuer -spec: - entryPoints: - - websecure - routes: - - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: infra-cluster - port: 443 - tls: - secretName: longhorn-infra-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: longhorn-infra-tls -spec: - secretName: longhorn-infra-tls - issuerRef: - name: vault-issuer - kind: ClusterIssuer - commonName: "longhorn.infra.durp.info" - dnsNames: - - "longhorn.infra.durp.info" diff --git a/dmz/internalproxy/templates/minio.yaml b/dmz/internalproxy/templates/minio.yaml index 8622240..c30a923 100644 --- a/dmz/internalproxy/templates/minio.yaml +++ b/dmz/internalproxy/templates/minio.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: minio +spec: + ports: + - name: app + port: 9769 + protocol: TCP + targetPort: 9769 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: minio +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 9769 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -12,7 +41,7 @@ spec: namespace: traefik kind: Rule services: - - name: unraid + - name: minio port: 9769 scheme: http tls: diff --git a/dmz/internalproxy/templates/n8n.yaml b/dmz/internalproxy/templates/n8n.yaml index adfebc7..d70038b 100644 --- a/dmz/internalproxy/templates/n8n.yaml +++ b/dmz/internalproxy/templates/n8n.yaml @@ -1,68 +1,68 @@ -#apiVersion: v1 -#kind: Service -#metadata: -# name: n8n -#spec: -# ports: -# - name: app -# port: 5678 -# protocol: TCP -# targetPort: 5678 -# clusterIP: None -# type: ClusterIP -# -#--- -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: n8n -#subsets: -# - addresses: -# - ip: 192.168.21.200 -# ports: -# - name: app -# port: 5678 -# protocol: TCP -# -#--- -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: n8n-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`n8n.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: n8n -# port: 5678 -# scheme: http -# tls: -# secretName: n8n-tls -# -#--- -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: n8n-tls -#spec: -# secretName: n8n-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "n8n.durp.info" -# dnsNames: -# - "n8n.durp.info" -# -#--- -#kind: Service -#apiVersion: v1 -#metadata: -# name: n8n-dns -# annotations: -# dns.alpha.kubernetes.io/hostname: n8n.durp.info -#spec: -# type: ExternalName -# externalName: durp.info +apiVersion: v1 +kind: Service +metadata: + name: n8n +spec: + ports: + - name: app + port: 5678 + protocol: TCP + targetPort: 5678 + clusterIP: None + type: ClusterIP + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: n8n +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 5678 + protocol: TCP + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: n8n-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`n8n.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: n8n + port: 5678 + scheme: http + tls: + secretName: n8n-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: n8n-tls +spec: + secretName: n8n-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "n8n.durp.info" + dnsNames: + - "n8n.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: n8n-dns + annotations: + dns.alpha.kubernetes.io/hostname: n8n.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml deleted file mode 100644 index 77b04e5..0000000 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ /dev/null @@ -1,74 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: nextcloud-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: nextcloud-chain - services: - - name: unraid - port: 11000 - scheme: http - tls: - secretName: nextcloud-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: nextcloud-tls -spec: - secretName: nextcloud-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "nextcloud.durp.info" - dnsNames: - - "nextcloud.durp.info" - ---- -kind: Service -apiVersion: v1 -metadata: - name: nextcloud-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: nextcloud.durp.info -spec: - type: ExternalName - externalName: durp.info - ---- -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: nextcloud-secure-headers -spec: - headers: - hostsProxyHeaders: - - "X-Forwarded-Host" - referrerPolicy: "same-origin" - ---- -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: https-redirect -spec: - redirectScheme: - scheme: https - ---- -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: nextcloud-chain -spec: - chain: - middlewares: - - name: https-redirect - - name: nextcloud-secure-headers \ No newline at end of file diff --git a/dmz/internalproxy/templates/nexus.yaml b/dmz/internalproxy/templates/nexus.yaml index 8e9ca70..683fe8d 100644 --- a/dmz/internalproxy/templates/nexus.yaml +++ b/dmz/internalproxy/templates/nexus.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: nexus +spec: + ports: + - name: app + port: 8081 + protocol: TCP + targetPort: 8081 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: nexus +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8081 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -9,7 +38,7 @@ spec: - match: Host(`nexus.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: unraid + - name: nexus port: 8081 tls: secretName: nexus-tls diff --git a/dmz/internalproxy/templates/gotify.yaml b/dmz/internalproxy/templates/octopus.yaml similarity index 52% rename from dmz/internalproxy/templates/gotify.yaml rename to dmz/internalproxy/templates/octopus.yaml index 6619aed..f68d9e3 100644 --- a/dmz/internalproxy/templates/gotify.yaml +++ b/dmz/internalproxy/templates/octopus.yaml @@ -1,41 +1,40 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: gotify-ingress + name: octopus-ingress spec: entryPoints: - websecure routes: - - match: Host(`gotify.durp.info`) && PathPrefix(`/`) + - match: Host(`octopus.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: unraid - port: 8070 - scheme: http + - name: infra-cluster + port: 443 tls: - secretName: gotify-tls + secretName: octopus-tls --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: gotify-tls + name: octopus-tls spec: - secretName: gotify-tls issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "gotify.durp.info" + secretName: octopus-tls + commonName: "octopus.durp.info" dnsNames: - - "gotify.durp.info" + - "octopus.durp.info" --- kind: Service apiVersion: v1 metadata: - name: gotify-external-dns + name: octopus-external-dns annotations: - external-dns.alpha.kubernetes.io/hostname: gotify.durp.info + external-dns.alpha.kubernetes.io/hostname: octopus.durp.info spec: type: ExternalName externalName: durp.info diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index f03ca52..9141647 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -15,6 +15,7 @@ spec: property: users --- + apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: @@ -25,6 +26,36 @@ spec: secret: ollama-secret --- + +apiVersion: v1 +kind: Service +metadata: + name: ollama +spec: + ports: + - name: app + port: 11435 + protocol: TCP + targetPort: 11435 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: ollama +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 11435 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,12 +69,13 @@ spec: - name: ollama-basic-auth kind: Rule services: - - name: ubuntu + - name: ollama port: 11435 tls: secretName: ollama-tls --- + apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -58,6 +90,7 @@ spec: - "ollama.durp.info" --- + kind: Service apiVersion: v1 metadata: @@ -66,4 +99,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: ollama.durp.info spec: type: ExternalName - externalName: durp.info + externalName: durp.info \ No newline at end of file diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml index f3e7f89..24ae6fd 100644 --- a/dmz/internalproxy/templates/open-webui.yaml +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: open-webui +spec: + ports: + - name: app + port: 8089 + protocol: TCP + targetPort: 8089 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: open-webui +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 8089 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -9,13 +38,14 @@ spec: - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: unraid + - name: open-webui port: 8089 scheme: http tls: secretName: open-webui-tls --- + apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -30,6 +60,7 @@ spec: - "open-webui.durp.info" --- + kind: Service apiVersion: v1 metadata: diff --git a/dmz/internalproxy/templates/plex.yaml b/dmz/internalproxy/templates/plex.yaml index 7fbc5f8..abbdabf 100644 --- a/dmz/internalproxy/templates/plex.yaml +++ b/dmz/internalproxy/templates/plex.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: plex +spec: + ports: + - name: app + port: 32400 + protocol: TCP + targetPort: 32400 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: plex +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 32400 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -9,13 +38,14 @@ spec: - match: Host(`plex.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: unraid + - name: plex port: 32400 scheme: https tls: secretName: plex-tls --- + apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -30,6 +60,7 @@ spec: - "plex.durp.info" --- + kind: Service apiVersion: v1 metadata: diff --git a/dmz/internalproxy/templates/portainer.yaml b/dmz/internalproxy/templates/portainer.yaml index ae89690..c27e0ff 100644 --- a/dmz/internalproxy/templates/portainer.yaml +++ b/dmz/internalproxy/templates/portainer.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: portainer +spec: + ports: + - name: app + port: 9443 + protocol: TCP + targetPort: 9443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: portainer +subsets: +- addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 9443 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -7,13 +36,14 @@ spec: - websecure routes: - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik + #middlewares: + #- name: whitelist + # namespace: traefik kind: Rule services: - - name: infra-cluster - port: 443 + - name: portainer + port: 9443 + scheme: https tls: secretName: portainer-tls @@ -30,4 +60,4 @@ spec: kind: ClusterIssuer commonName: "portainer.internal.durp.info" dnsNames: - - "portainer.internal.durp.info" + - "portainer.internal.durp.info" diff --git a/dmz/internalproxy/templates/registry.yaml b/dmz/internalproxy/templates/registry.yaml index b9b6ed4..ac3c25a 100644 --- a/dmz/internalproxy/templates/registry.yaml +++ b/dmz/internalproxy/templates/registry.yaml @@ -1,3 +1,30 @@ +apiVersion: v1 +kind: Service +metadata: + name: registry +spec: + ports: + - name: app + port: 5000 + protocol: TCP + targetPort: 5000 + clusterIP: None + type: ClusterIP + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: registry +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 5000 + protocol: TCP + +--- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -12,7 +39,7 @@ spec: - name: whitelist namespace: traefik services: - - name: unraid + - name: registry port: 5000 tls: secretName: registry-tls diff --git a/dmz/internalproxy/templates/root-vault.yaml b/dmz/internalproxy/templates/root-vault.yaml index 76d4b94..c32ca62 100644 --- a/dmz/internalproxy/templates/root-vault.yaml +++ b/dmz/internalproxy/templates/root-vault.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: root-vault +spec: + ports: + - name: app + port: 8201 + protocol: TCP + targetPort: 8201 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: root-vault +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 8201 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -12,13 +41,14 @@ spec: namespace: traefik kind: Rule services: - - name: unraid + - name: root-vault port: 8201 scheme: https tls: secretName: root-vault-tls --- + apiVersion: cert-manager.io/v1 kind: Certificate metadata: diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 5bf203e..29d509d 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: s3 +spec: + ports: + - name: app + port: 9768 + protocol: TCP + targetPort: 9768 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: s3 +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 9768 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -12,7 +41,7 @@ spec: namespace: traefik kind: Rule services: - - name: unraid + - name: s3 port: 9768 scheme: http tls: @@ -46,7 +75,7 @@ spec: - match: Host(`s3.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: unraid + - name: s3 port: 9768 scheme: http tls: diff --git a/dmz/internalproxy/templates/semaphore.yaml b/dmz/internalproxy/templates/semaphore.yaml index 145d1ca..3005b94 100644 --- a/dmz/internalproxy/templates/semaphore.yaml +++ b/dmz/internalproxy/templates/semaphore.yaml @@ -1,65 +1,64 @@ -# -#apiVersion: v1 -#kind: Service -#metadata: -# name: semaphore -#spec: -# ports: -# - name: app -# port: 3001 -# protocol: TCP -# targetPort: 3001 -# clusterIP: None -# type: ClusterIP -# -#--- -# -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: semaphore -#subsets: -# - addresses: -# - ip: 192.168.21.200 -# ports: -# - name: app -# port: 3001 -# protocol: TCP -# -#--- -# -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: semaphore-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) -# middlewares: -# - name: whitelist -# namespace: traefik -# kind: Rule -# services: -# - name: semaphore -# port: 3001 -# scheme: http -# tls: -# secretName: semaphore-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: semaphore-tls -#spec: -# secretName: semaphore-tls -# issuerRef: -# name: vault-issuer -# kind: ClusterIssuer -# commonName: "semaphore.internal.durp.info" -# dnsNames: -# - "semaphore.internal.durp.info" -# \ No newline at end of file + +apiVersion: v1 +kind: Service +metadata: + name: semaphore +spec: + ports: + - name: app + port: 3001 + protocol: TCP + targetPort: 3001 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: semaphore +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 3001 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: semaphore-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: semaphore + port: 3001 + scheme: http + tls: + secretName: semaphore-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: semaphore-tls +spec: + secretName: semaphore-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "semaphore.internal.durp.info" + dnsNames: + - "semaphore.internal.durp.info" diff --git a/dmz/internalproxy/templates/smokeping.yaml b/dmz/internalproxy/templates/smokeping.yaml index 9808876..2d78b2f 100644 --- a/dmz/internalproxy/templates/smokeping.yaml +++ b/dmz/internalproxy/templates/smokeping.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: smokeping +spec: + ports: + - name: app + port: 81 + protocol: TCP + targetPort: 81 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: smokeping +subsets: +- addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 81 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -14,12 +43,13 @@ spec: namespace: traefik kind: Rule services: - - name: unraid + - name: smokeping port: 81 tls: secretName: smokeping-tls --- + apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -34,6 +64,7 @@ spec: - "smokeping.durp.info" --- + kind: Service apiVersion: v1 metadata: diff --git a/dmz/internalproxy/templates/tdarr.yaml b/dmz/internalproxy/templates/tdarr.yaml index 35b9485..c9ace7f 100644 --- a/dmz/internalproxy/templates/tdarr.yaml +++ b/dmz/internalproxy/templates/tdarr.yaml @@ -1,3 +1,32 @@ +apiVersion: v1 +kind: Service +metadata: + name: tdarr +spec: + ports: + - name: app + port: 8267 + protocol: TCP + targetPort: 8267 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: tdarr +subsets: +- addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 8267 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -16,7 +45,7 @@ spec: namespace: traefik kind: Rule services: - - name: unraid + - name: tdarr port: 8267 scheme: http tls: diff --git a/dmz/internalproxy/templates/unraid.yaml b/dmz/internalproxy/templates/unraid.yaml index 10e1015..f79f4a8 100644 --- a/dmz/internalproxy/templates/unraid.yaml +++ b/dmz/internalproxy/templates/unraid.yaml @@ -1,3 +1,33 @@ + +apiVersion: v1 +kind: Service +metadata: + name: unraid +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: unraid +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 443 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index dfc92b1..50401b5 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -8,7 +8,7 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.29.0 + version: 1.26.2 - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.26.2 diff --git a/dmz/redlib/templates/deployment.yaml b/dmz/redlib/templates/deployment.yaml index c09a144..0e20610 100644 --- a/dmz/redlib/templates/deployment.yaml +++ b/dmz/redlib/templates/deployment.yaml @@ -9,7 +9,7 @@ spec: selector: matchLabels: app: redlib - replicas: 1 + replicas: 3 template: metadata: labels: diff --git a/dmz/searxng/Chart.yaml b/dmz/searxng/Chart.yaml deleted file mode 100644 index 263432f..0000000 --- a/dmz/searxng/Chart.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v2 -appVersion: latest -description: SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. -name: searxng -version: 1.0.1 -#dependencies: -# - name: common -# repository: https://library-charts.k8s-at-home.com -# version: 4.4.2 -# \ No newline at end of file diff --git a/dmz/searxng/templates/confligmap.yaml b/dmz/searxng/templates/confligmap.yaml deleted file mode 100644 index edc1ca6..0000000 --- a/dmz/searxng/templates/confligmap.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: searxng-config -data: - settings.yml: |- - use_default_settings: true - search: - formats: - - html - - json diff --git a/dmz/searxng/templates/deployment.yaml b/dmz/searxng/templates/deployment.yaml deleted file mode 100644 index e1677ed..0000000 --- a/dmz/searxng/templates/deployment.yaml +++ /dev/null @@ -1,40 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: searxng - name: searxng - labels: - app: searxng -spec: - selector: - matchLabels: - app: searxng - replicas: 1 - template: - metadata: - labels: - app: searxng - spec: - containers: - - name: searxng - image: registry.durp.info/searxng/searxng:latest - imagePullPolicy: Always - ports: - - name: http - containerPort: 8080 - env: - - name: SEARXNG_BASE_URL - value: https://searxng.durp.info - - name: SEARXNG_SECRET - valueFrom: - secretKeyRef: - name: searxng-secret - key: SEARXNG_SECRET - volumeMounts: - - name: searxng-config-volume - mountPath: /etc/searxng/settings.yml - subPath: settings.yml - volumes: - - name: searxng-config-volume - configMap: - name: searxng-config diff --git a/dmz/searxng/templates/ingress.yaml b/dmz/searxng/templates/ingress.yaml deleted file mode 100644 index ab8b641..0000000 --- a/dmz/searxng/templates/ingress.yaml +++ /dev/null @@ -1,76 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: searxng-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`searxng.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: searxng-service - port: 8080 - tls: - secretName: searxng-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: searxng-tls -spec: - secretName: searxng-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "searxng.durp.info" - dnsNames: - - "searxng.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: searxng-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: searxng.durp.info -spec: - type: ExternalName - externalName: durp.info - ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: searxng-internal-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`searxng.internal.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: searxng-service - port: 8080 - tls: - secretName: searxng-internal-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: searxng-internal-tls -spec: - secretName: searxng-internal-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "searxng.internal.durp.info" - dnsNames: - - "searxng.internal.durp.info" diff --git a/dmz/searxng/templates/service.yaml b/dmz/searxng/templates/service.yaml deleted file mode 100644 index 8498428..0000000 --- a/dmz/searxng/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: searxng-service -spec: - ports: - - name: http - port: 8080 - targetPort: 8080 - protocol: TCP - selector: - app: searxng diff --git a/dmz/searxng/values.yaml b/dmz/searxng/values.yaml deleted file mode 100644 index 0f92a3b..0000000 --- a/dmz/searxng/values.yaml +++ /dev/null @@ -1,83 +0,0 @@ -# -# IMPORTANT NOTE -# -# This chart inherits from our common library chart. You can check the default values/options here: -# https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml -# - -image: - # -- image repository - repository: registry.durp.info/searxng/searxng - # -- image tag - tag: latest - # -- image pull policy - pullPolicy: Always - -# Explanation about each environment variables here: -# https://docs.searxng.org/admin/installation-docker.html#command-line -env: - INSTANCE_NAME: "durp.info" - BASE_URL: "https://searx.durp.info" - AUTOCOMPLETE: "false" - # MORTY_URL: "http://morty:8080" - # MORTY_KEY: "mysecretkey" - # BIND_ADDRESS: "0.0.0.0:8080" - -controller: - strategy: "RollingUpdate" - -# -- Configures service settings for the chart. -# @default -- See values.yaml -service: - main: - ports: - http: - port: 8080 - -# -- Configure persistence settings for the chart under this key. -# @default -- See values.yaml -persistence: - config: - enabled: false - -ingress: - # -- Enable and configure ingress settings for the chart under this key. - # @default -- See values.yaml - main: - enabled: false - -searxng: - config: - use_default_settings: true - #server: - # secret_key: pleasechangeme - # Uncomment when using the builtin rate limiter - # See https://docs.searxng.org/src/searx.plugins.limiter.html#limiter-plugin - # server.limiter: true - # redis.url: redis://@searxng-redis:6379/0 - -probes: - readiness: - custom: true - spec: - httpGet: - path: /healthz - port: 8080 - liveness: - custom: true - spec: - httpGet: - path: /healthz - port: 8080 - startup: - custom: true - spec: - httpGet: - path: /healthz - port: 8080 - -# Enable when using searxng builtin rate limiter -# Values: https://github.com/pascaliske/helm-charts/tree/master/charts/redis -redis: - enabled: false - \ No newline at end of file diff --git a/dmz/terraform/k3s.tf b/dmz/terraform/k3s.tf new file mode 100644 index 0000000..bca2f62 --- /dev/null +++ b/dmz/terraform/k3s.tf @@ -0,0 +1,115 @@ +resource "proxmox_vm_qemu" "k3smaster" { + count = local.k3smaster.count + ciuser = "administrator" + vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" + name = local.k3smaster.name[count.index] + target_node = local.k3smaster.node[count.index] + clone = local.template + tags = local.k3smaster.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.k3smaster.cores + sockets = 1 + cpu_type = "host" + memory = local.k3smaster.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3smaster.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} + +resource "proxmox_vm_qemu" "k3sserver" { + count = local.k3sserver.count + ciuser = "administrator" + vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" + name = local.k3sserver.name[count.index] + target_node = local.k3sserver.node[count.index] + clone = local.template + tags = local.k3sserver.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.k3sserver.cores + sockets = 1 + cpu_type = "host" + memory = local.k3sserver.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3sserver.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} diff --git a/dmz/terraform/main.tf b/dmz/terraform/main.tf new file mode 100644 index 0000000..021675c --- /dev/null +++ b/dmz/terraform/main.tf @@ -0,0 +1,48 @@ +terraform { + backend "http" {} + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc9" + } + } +} + +provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false +} + +locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + storage = "cache-domains" + emulatessd = true + format = "raw" + dnsserver = "192.168.98.1" + vlan = 98 + k3smaster = { + tags = "k3s_dmz" + count = 3 + name = ["master01-dmz", "master02-dmz", "master03-dmz"] + cores = 2 + memory = "4096" + drive = 20 + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] + } + k3sserver = { + tags = "k3s_dmz" + count = 3 + name = ["node01-dmz", "node02-dmz", "node03-dmz"] + cores = 4 + memory = "8192" + drive = 240 + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] + } +} diff --git a/dmz/terraform/variables.tf b/dmz/terraform/variables.tf new file mode 100644 index 0000000..31a92e0 --- /dev/null +++ b/dmz/terraform/variables.tf @@ -0,0 +1,14 @@ +variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string +} + +variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string +} + +variable "pm_user" { + description = "UIsername to Proxmox provider" + type = string +} diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index c762b94..aa0efe0 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -23,13 +23,6 @@ traefik: dashboard: enabled: true - ports: - gitlab-ssh: - port: 9022 - expose: - default: true - exposedPort: 9022 - additionalArguments: # - "--providers.file.filename=/config/config.yml" - "--serversTransport.insecureSkipVerify=true" diff --git a/infra/argocd/Chart.yaml b/infra/argocd/Chart.yaml index d9a5074..8da230c 100644 --- a/infra/argocd/Chart.yaml +++ b/infra/argocd/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: argo-cd repository: https://argoproj.github.io/argo-helm - version: 8.6.4 + version: 8.1.3 diff --git a/infra/argocd/templates/argocd-crossplane.yaml b/infra/argocd/templates/argocd-crossplane.yaml new file mode 100644 index 0000000..54ac407 --- /dev/null +++ b/infra/argocd/templates/argocd-crossplane.yaml @@ -0,0 +1,101 @@ +#apiVersion: external-secrets.io/v1 +#kind: ExternalSecret +#metadata: +# name: argocd-secret-crossplane +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: argocd-secret-crossplane +# data: +# - secretKey: authToken +# remoteRef: +# key: kv/argocd/provider-argocd +# property: token +# +#--- +#apiVersion: external-secrets.io/v1 +#kind: ExternalSecret +#metadata: +# name: prod-kubeconfig +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: prod-kubeconfig +# data: +# - secretKey: kubeconfig +# remoteRef: +# key: kv/argocd/prd +# property: kubeconfig +# +#--- +#apiVersion: argocd.crossplane.io/v1alpha1 +#kind: ProviderConfig +#metadata: +# name: argocd-provider +#spec: +# serverAddr: argocd-server.argocd.svc:443 +# insecure: true +# plainText: false +# credentials: +# source: Secret +# secretRef: +# namespace: argocd +# name: argocd-secret-crossplane +# key: authToken +# +#--- +#apiVersion: cluster.argocd.crossplane.io/v1alpha1 +#kind: Cluster +#metadata: +# name: prd +# labels: +# purpose: prd +#spec: +# forProvider: +# name: prd +# config: +# kubeconfigSecretRef: +# name: prod-kubeconfig +# namespace: argocd +# key: kubeconfig +# providerConfigRef: +# name: argocd-provider +# +#--- +#apiVersion: external-secrets.io/v1 +#kind: ExternalSecret +#metadata: +# name: dev-kubeconfig +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: dev-kubeconfig +# data: +# - secretKey: kubeconfig +# remoteRef: +# key: kv/argocd/dev +# property: kubeconfig +# +#--- +#apiVersion: cluster.argocd.crossplane.io/v1alpha1 +#kind: Cluster +#metadata: +# name: dev +# labels: +# purpose: dev +#spec: +# forProvider: +# name: dev +# config: +# kubeconfigSecretRef: +# name: dev-kubeconfig +# namespace: argocd +# key: kubeconfig +# providerConfigRef: +# name: argocd-provider diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index 14141da..54e36bd 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/argocd destination: diff --git a/infra/argocd/templates/authentik.yaml b/infra/argocd/templates/authentik.yaml index ac5f8dc..42be478 100644 --- a/infra/argocd/templates/authentik.yaml +++ b/infra/argocd/templates/authentik.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/authentik destination: @@ -31,7 +31,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/authentik destination: diff --git a/infra/argocd/templates/bitwarden.yaml b/infra/argocd/templates/bitwarden.yaml index a42abbc..e9b4905 100644 --- a/infra/argocd/templates/bitwarden.yaml +++ b/infra/argocd/templates/bitwarden.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/bitwarden destination: diff --git a/infra/argocd/templates/cert-manager.yaml b/infra/argocd/templates/cert-manager.yaml index 31ef868..e7ac95d 100644 --- a/infra/argocd/templates/cert-manager.yaml +++ b/infra/argocd/templates/cert-manager.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/cert-manager destination: @@ -29,7 +29,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/cert-manager destination: diff --git a/infra/argocd/templates/crowdsec.yaml b/infra/argocd/templates/crowdsec.yaml new file mode 100644 index 0000000..69e07a8 --- /dev/null +++ b/infra/argocd/templates/crowdsec.yaml @@ -0,0 +1,20 @@ +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: crowdsec +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: dmz/crowdsec +# destination: +# namespace: crowdsec +# name: dmz +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true diff --git a/infra/argocd/templates/external-dns.yaml b/infra/argocd/templates/external-dns.yaml index caa32d9..6edb645 100644 --- a/infra/argocd/templates/external-dns.yaml +++ b/infra/argocd/templates/external-dns.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/external-dns destination: diff --git a/infra/argocd/templates/external-secrets.yaml b/infra/argocd/templates/external-secrets.yaml index 7787a03..0583fea 100644 --- a/infra/argocd/templates/external-secrets.yaml +++ b/infra/argocd/templates/external-secrets.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/external-secrets destination: @@ -29,7 +29,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/external-secrets destination: diff --git a/infra/argocd/templates/gitlab-runner.yaml b/infra/argocd/templates/gitlab-runner.yaml index 25b82bb..de73c0c 100644 --- a/infra/argocd/templates/gitlab-runner.yaml +++ b/infra/argocd/templates/gitlab-runner.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/gitlab-runner destination: diff --git a/infra/argocd/templates/internalproxy.yaml b/infra/argocd/templates/internalproxy.yaml index 9381c2d..57e2c60 100644 --- a/infra/argocd/templates/internalproxy.yaml +++ b/infra/argocd/templates/internalproxy.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/internalproxy destination: diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index 615a43f..4d9d6d5 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/istio-system destination: @@ -36,7 +36,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/istio-system destination: diff --git a/infra/argocd/templates/kube-prometheus-stack.yaml b/infra/argocd/templates/kube-prometheus-stack.yaml index bc52501..d89dad1 100644 --- a/infra/argocd/templates/kube-prometheus-stack.yaml +++ b/infra/argocd/templates/kube-prometheus-stack.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/kube-prometheus-stack destination: diff --git a/infra/argocd/templates/litellm.yaml b/infra/argocd/templates/litellm.yaml index d8e225a..7c818dc 100644 --- a/infra/argocd/templates/litellm.yaml +++ b/infra/argocd/templates/litellm.yaml @@ -6,7 +6,7 @@ #spec: # project: default # source: -# repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git +# repoURL: https://gitlab.com/developerdurp/homelab.git # targetRevision: main # path: infra/litellm # destination: diff --git a/infra/argocd/templates/littlelink.yaml b/infra/argocd/templates/littlelink.yaml index 2d6011f..5821718 100644 --- a/infra/argocd/templates/littlelink.yaml +++ b/infra/argocd/templates/littlelink.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/littlelink directory: diff --git a/infra/argocd/templates/longhorn.yaml b/infra/argocd/templates/longhorn.yaml index f28a74c..33eda6e 100644 --- a/infra/argocd/templates/longhorn.yaml +++ b/infra/argocd/templates/longhorn.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/longhorn destination: @@ -33,7 +33,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/longhorn destination: diff --git a/infra/argocd/templates/metallb-system.yaml b/infra/argocd/templates/metallb-system.yaml index a9b33d0..bac4be3 100644 --- a/infra/argocd/templates/metallb-system.yaml +++ b/infra/argocd/templates/metallb-system.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/metallb-system destination: @@ -29,7 +29,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/metallb-system destination: @@ -52,7 +52,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dev/metallb-system destination: diff --git a/infra/argocd/templates/nebula-sync.yaml b/infra/argocd/templates/nebula-sync.yaml index d19b024..dea50a7 100644 --- a/infra/argocd/templates/nebula-sync.yaml +++ b/infra/argocd/templates/nebula-sync.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/nebula-sync destination: diff --git a/infra/argocd/templates/nfs.yaml b/infra/argocd/templates/nfs.yaml index c006f32..f7e964f 100644 --- a/infra/argocd/templates/nfs.yaml +++ b/infra/argocd/templates/nfs.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/nfs destination: diff --git a/infra/argocd/templates/octopusdeploy.yaml b/infra/argocd/templates/octopusdeploy.yaml new file mode 100644 index 0000000..3412681 --- /dev/null +++ b/infra/argocd/templates/octopusdeploy.yaml @@ -0,0 +1,42 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: octopusdeploy + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/octopusdeploy + destination: + namespace: octopusdeploy + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: octopusdeploy-agent + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/octopus-agent + destination: + namespace: octopus-agent + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/infra/argocd/templates/openclarity.yaml b/infra/argocd/templates/openclarity.yaml index 57c1995..64307d6 100644 --- a/infra/argocd/templates/openclarity.yaml +++ b/infra/argocd/templates/openclarity.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/openclarity destination: diff --git a/infra/argocd/templates/openspeedtest.yaml b/infra/argocd/templates/openspeedtest.yaml index ead0679..5d79f9c 100644 --- a/infra/argocd/templates/openspeedtest.yaml +++ b/infra/argocd/templates/openspeedtest.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/openspeedtest directory: diff --git a/infra/argocd/templates/redlib.yaml b/infra/argocd/templates/redlib.yaml index 3867fb7..901c316 100644 --- a/infra/argocd/templates/redlib.yaml +++ b/infra/argocd/templates/redlib.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/redlib directory: diff --git a/infra/argocd/templates/renovate.yaml b/infra/argocd/templates/renovate.yaml index debce7a..659d61f 100644 --- a/infra/argocd/templates/renovate.yaml +++ b/infra/argocd/templates/renovate.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/renovate destination: diff --git a/infra/argocd/templates/traefik.yaml b/infra/argocd/templates/traefik.yaml index 0ea06aa..0136c94 100644 --- a/infra/argocd/templates/traefik.yaml +++ b/infra/argocd/templates/traefik.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/traefik destination: @@ -32,7 +32,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/traefik destination: @@ -58,7 +58,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dev/traefik destination: diff --git a/infra/argocd/templates/vault.yaml b/infra/argocd/templates/vault.yaml index b5f6a0b..351d06f 100644 --- a/infra/argocd/templates/vault.yaml +++ b/infra/argocd/templates/vault.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: infra/vault destination: @@ -34,7 +34,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main path: dmz/vault destination: diff --git a/infra/authentik/values.yaml b/infra/authentik/values.yaml index 7b75190..1cf4c0a 100644 --- a/infra/authentik/values.yaml +++ b/infra/authentik/values.yaml @@ -34,7 +34,7 @@ authentik: enabled: true image: registry: registry.durp.info - repository: bitnamilegacy/postgresql + repository: bitnami/postgresql pullPolicy: Always postgresqlUsername: "authentik" postgresqlDatabase: "authentik" @@ -52,7 +52,7 @@ authentik: enabled: false image: registry: registry.durp.info - repository: bitnamilegacy/redis + repository: bitnami/redis pullPolicy: Always architecture: standalone auth: diff --git a/infra/bitwarden/templates/deployment.yaml b/infra/bitwarden/templates/deployment.yaml index b915246..470ac9b 100644 --- a/infra/bitwarden/templates/deployment.yaml +++ b/infra/bitwarden/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: bitwarden - image: registry.durp.info/vaultwarden/server:1.35.4 + image: registry.durp.info/vaultwarden/server:1.34.3 imagePullPolicy: Always volumeMounts: - name: bitwarden-pvc diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index 7bb5fc3..0a7ea4b 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -8,7 +8,7 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.29.0 + version: 1.26.2 - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.26.2 diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index ad4ebd3..e9a3a2b 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -11,8 +11,8 @@ spec: - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`) kind: Rule middlewares: - #- name: authentik-proxy-provider - # namespace: traefik + - name: authentik-proxy-provider + namespace: traefik services: - name: longhorn-frontend port: 80 diff --git a/infra/octopus-agent/Chart.yaml b/infra/octopus-agent/Chart.yaml new file mode 100644 index 0000000..f36dd2d --- /dev/null +++ b/infra/octopus-agent/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: octopusdeploy +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: + - name: kubernetes-agent + repository: oci://registry-1.docker.io/octopusdeploy + version: 2.*.* diff --git a/dmz/searxng/templates/secret.yaml b/infra/octopus-agent/templates/secret.yaml similarity index 63% rename from dmz/searxng/templates/secret.yaml rename to infra/octopus-agent/templates/secret.yaml index 6d4781b..50a87d8 100644 --- a/dmz/searxng/templates/secret.yaml +++ b/infra/octopus-agent/templates/secret.yaml @@ -1,23 +1,23 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: searxng-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: searxng-secret - data: - - secretKey: SEARXNG_SECRET - remoteRef: - key: kv/searxng - property: searxng-secret - ---- - apiVersion: v1 kind: ServiceAccount metadata: name: vault +--- + +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: agent-token +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: agent-token + data: + - secretKey: bearer-token + remoteRef: + key: kv/octopusdeploy + property: infra-bearer-token + diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml new file mode 100644 index 0000000..8f262a5 --- /dev/null +++ b/infra/octopus-agent/values.yaml @@ -0,0 +1,19 @@ +kubernetes-agent: + agent: + bearerTokenSecretName: agent-token + acceptEula: "Y" + serverUrl: "https://octopus.durp.info/" + serverCommsAddresses: + - "https://octopus-deploy-node0.octopusdeploy.svc.cluster.local:10943/" + - "https://octopus-deploy-node1.octopusdeploy.svc.cluster.local:10943/" + - "https://octopus-deploy-node2.octopusdeploy.svc.cluster.local:10943/" + space: "Default" + name: "infra" + deploymentTarget: + initial: + environments: + - "development" + - "production" + tags: + - "infra-cluster" + enabled: "true" diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml new file mode 100644 index 0000000..e1aba0c --- /dev/null +++ b/infra/octopusdeploy/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: octopusdeploy +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: + - name: octopusdeploy-helm + repository: oci://ghcr.io/octopusdeploy + version: 1.7.0 diff --git a/infra/octopusdeploy/templates/ingress.yaml b/infra/octopusdeploy/templates/ingress.yaml new file mode 100644 index 0000000..e399ae8 --- /dev/null +++ b/infra/octopusdeploy/templates/ingress.yaml @@ -0,0 +1,32 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: octopus-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`octopus.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: octopusdeploy-octopus-deploy + port: 80 + tls: + secretName: octopus-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: octopus-tls +spec: + secretName: octopus-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "octopus.durp.info" + dnsNames: + - "octopus.durp.info" diff --git a/infra/octopusdeploy/templates/secrets.yaml b/infra/octopusdeploy/templates/secrets.yaml new file mode 100644 index 0000000..7f9ec8b --- /dev/null +++ b/infra/octopusdeploy/templates/secrets.yaml @@ -0,0 +1,106 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: octopusdeploy-adminpassword +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-adminpassword + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: adminpassword + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: octopusdeploy-adminusername +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-adminusername + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: adminusername + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: octopusdeploy-connectionstring +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-connectionstring + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: connectionstring + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: octopusdeploy-masterkey +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-masterkey + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: masterkey + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: octopusdeploy-sapassword +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-sapassword + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: sapassword + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: octopusdeploy-licensekey +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-licensekey + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: licensekey diff --git a/infra/octopusdeploy/values.yaml b/infra/octopusdeploy/values.yaml new file mode 100644 index 0000000..70db7fa --- /dev/null +++ b/infra/octopusdeploy/values.yaml @@ -0,0 +1,10 @@ +octopusdeploy-helm: + octopus: + image: + repository: registry.durp.info/octopusdeploy/octopusdeploy + tag: 2025.3 + createSecrets: false + acceptEula: Y + replicaCount: 3 + mssql: + enabled: true \ No newline at end of file diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index c8f1629..099b435 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -542,7 +542,7 @@ openclarity: # -- Trivy Server container repository repository: aquasec/trivy # -- Trivy Server container tag - tag: 0.69.3 + tag: 0.64.1 # -- Trivy Server image digest. If set will override the tag. digest: "" # -- Trivy Server image pull policy diff --git a/infra/portainer/templates/ingress.yaml b/infra/portainer/templates/ingress.yaml deleted file mode 100644 index c1e0e38..0000000 --- a/infra/portainer/templates/ingress.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: portainer-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: portainer - port: 9000 - tls: - secretName: portainer-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: portainer-tls -spec: - secretName: portainer-tls - issuerRef: - name: vault-issuer - kind: ClusterIssuer - commonName: "portainer.internal.durp.info" - dnsNames: - - "portainer.internal.durp.info" diff --git a/infra/portainer/values.yaml b/infra/portainer/values.yaml deleted file mode 100644 index a3779f7..0000000 --- a/infra/portainer/values.yaml +++ /dev/null @@ -1,78 +0,0 @@ -portainer: - replicaCount: 1 - image: - repository: registry.durp.info/portainer/portainer-ce - tag: 2.39.1 - pullPolicy: Always - - imagePullSecrets: [] - - nodeSelector: {} - tolerations: [] - - serviceAccount: - annotations: {} - name: portainer-sa-clusteradmin - - # This flag provides the ability to enable or disable RBAC-related resources during the deployment of the Portainer application - # If you are using Portainer to manage the K8s cluster it is deployed to, this flag must be set to true - localMgmt: true - - service: - # Set the httpNodePort and edgeNodePort only if the type is NodePort - # For Ingress, set the type to be ClusterIP and set ingress.enabled to true - # For Cloud Providers, set the type to be LoadBalancer - type: NodePort - httpPort: 9000 - httpsPort: 9443 - httpNodePort: 30777 - httpsNodePort: 30779 - edgePort: 8000 - edgeNodePort: 30776 - annotations: {} - - tls: - # If set, Portainer will be configured to use TLS only - force: false - # If set, will mount the existing secret into the pod - existingSecret: "" - - trusted_origins: - # If set, Portainer will be configured to trust the domains specified in domains - enabled: false - # specify (in a comma-separated list) the domain(s) used to access Portainer when it is behind a reverse proxy - # example: portainer.mydomain.com,portainer.example.com - domains: "" - - mtls: - # If set, Portainer will be configured to use mTLS only - enable: false - # If set, will mount the existing secret into the pod - existingSecret: "" - - feature: - flags: [] - - ingress: - enabled: false - ingressClassName: "" - annotations: {} - # kubernetes.io/ingress.class: nginx - # Only use below if tls.force=true - # nginx.ingress.kubernetes.io/backend-protocol: HTTPS - # Note: Hosts and paths are of type array - hosts: - - host: - paths: [] - # - path: "/" - tls: [] - - resources: {} - - persistence: - enabled: true - size: "10Gi" - annotations: {} - storageClass: longhorn - existingClaim: - diff --git a/infra/renovate/Chart.yaml b/infra/renovate/Chart.yaml index b20d1e8..e91e2d5 100644 --- a/infra/renovate/Chart.yaml +++ b/infra/renovate/Chart.yaml @@ -10,4 +10,4 @@ dependencies: - name: renovate repository: https://docs.renovatebot.com/helm-charts version: 39.264.0 - alias: "renovate-personal" + diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index d42ab7e..f4ac24c 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -39,24 +39,3 @@ spec: remoteRef: key: kv/renovate property: RENOVATE_TOKEN - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: renovate-personal-config-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: renovate-personal-config-secret - data: - - secretKey: RENOVATE_TOKEN - remoteRef: - key: kv/renoatePersonal - property: RENOVATE_TOKEN - - secretKey: RENOVATE_GITHUB_COM_TOKEN - remoteRef: - key: kv/renoatePersonal - property: RENOVATE_GITHUB_COM_TOKEN diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 4754bc7..b14286c 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -1,4 +1,4 @@ -renovate-personal: +renovate: global: # -- Additional labels to be set on all renovate resources commonLabels: {} @@ -99,12 +99,12 @@ renovate-personal: config: | { "platform": "gitlab", - "endpoint": "https://gitlab.durp.info/api/v4", - "autodiscover": true, - "dryRun": null, + "endpoint": "https://gitlab.com/api/v4", + "autodiscover": "true", + "dryRun": false, "printConfig": false, - "autodiscoverFilter": ["durfy/**"], - "assignees": ["durp"] + "autodiscoverFilter": ["developerdurp/*", "durfy/*"], + "assignees": ["developerdurp"], } # See https://docs.renovatebot.com/self-hosted-configuration # config: | @@ -166,7 +166,7 @@ renovate-personal: # -- Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set secrets: {} # -- k8s secret to reference environment variables from. Overrides secrets if set - existingSecret: "renovate-personal-config-secret" + existingSecret: "renovate-config-secret" # -- Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config extraConfigmaps: [] @@ -233,8 +233,8 @@ renovate-personal: # cpu: 100m # memory: 128Mi # requests: - # cpu: 100m - # memory: 128Mi + # cpu: 100m + # memory: 128Mi # -- Environment variables to add from existing secrets/configmaps. Uses the keys as variable name envFrom: [] @@ -247,7 +247,6 @@ renovate-personal: # -- Environment variables to set on the renovate container env: RENOVATE_AUTODISCOVER: true - #LOG_LEVEL: debug # env: # VARIABLE_NAME: "value" diff --git a/infra/terraform/k3s.tf b/infra/terraform/k3s.tf new file mode 100644 index 0000000..24e00e6 --- /dev/null +++ b/infra/terraform/k3s.tf @@ -0,0 +1,116 @@ +resource "proxmox_vm_qemu" "k3smaster" { + lifecycle { + prevent_destroy = true + } + count = local.k3smaster.count + ciuser = "administrator" + name = local.k3smaster.name[count.index] + target_node = local.k3smaster.node[count.index] + tags = local.k3smaster.tags + full_clone = false + qemu_os = "l26" + os_type = "cloud-init" + agent = 1 + cores = local.k3smaster.cores + sockets = 1 + cpu_type = "host" + memory = local.k3smaster.memory + scsihw = "virtio-scsi-pci" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.k3smaster.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3smaster.drive + format = local.format + storage = local.k3smaster.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} + +resource "proxmox_vm_qemu" "k3sserver" { + lifecycle { + prevent_destroy = true + } + count = local.k3sserver.count + ciuser = "administrator" + name = local.k3sserver.name[count.index] + target_node = local.k3sserver.node[count.index] + tags = local.k3sserver.tags + qemu_os = "l26" + full_clone = false + os_type = "cloud-init" + agent = 1 + cores = local.k3sserver.cores + sockets = 1 + cpu_type = "host" + memory = local.k3sserver.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.k3sserver.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3sserver.drive + format = local.format + storage = local.k3sserver.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf new file mode 100644 index 0000000..df2d033 --- /dev/null +++ b/infra/terraform/main.tf @@ -0,0 +1,81 @@ +terraform { + backend "http" {} + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc9" + } + } +} + +provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false +} + +locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + format = "raw" + dnsserver = "192.168.12.1" + vlan = 12 + k3smaster = { + tags = "k3s_infra" + count = 3 + name = ["master01-infra", "master02-infra", "master03-infra"] + cores = 2 + memory = "4096" + drive = 20 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] + } + k3sserver = { + tags = "k3s_infra" + count = 3 + name = ["node01-infra", "node02-infra", "node03-infra"] + cores = 4 + memory = "16384" + drive = 240 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] + } + #haproxy = { + # tags = "haproxy" + # count = 3 + # name = ["haproxy-01", "haproxy-02", "haproxy-03"] + # cores = 2 + # memory = "1024" + # drive = 20 + # storage = "cache-domains" + # node = ["mothership", "overlord", "vanguard"] + # ip = ["31", "32", "33"] + #} + #postgres = { + # tags = "postgres" + # count = 3 + # name = ["postgres-01", "postgres-02", "postgres-03"] + # cores = 4 + # memory = "4096" + # drive = 40 + # storage = "cache-domains" + # node = ["mothership", "overlord", "vanguard"] + # ip = ["34", "35", "36"] + #} + pihole = { + tags = "pihole" + count = 3 + name = ["pihole-01", "pihole-02", "pihole-03"] + cores = 2 + memory = "2048" + drive = 20 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["41", "42", "43"] + } +} diff --git a/infra/terraform/pihole.tf b/infra/terraform/pihole.tf new file mode 100644 index 0000000..ced2aac --- /dev/null +++ b/infra/terraform/pihole.tf @@ -0,0 +1,57 @@ +resource "proxmox_vm_qemu" "pihole" { + count = local.pihole.count + ciuser = "administrator" + vmid = "${local.vlan}${local.pihole.ip[count.index]}" + name = local.pihole.name[count.index] + target_node = local.pihole.node[count.index] + clone = local.template + tags = local.pihole.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.pihole.cores + sockets = 1 + cpu_type = "host" + memory = local.pihole.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.pihole.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.pihole.drive + format = local.format + storage = local.pihole.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.pihole.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} diff --git a/infra/terraform/postgres.tf b/infra/terraform/postgres.tf new file mode 100644 index 0000000..47b8daa --- /dev/null +++ b/infra/terraform/postgres.tf @@ -0,0 +1,116 @@ +#resource "proxmox_vm_qemu" "haproxy" { +# count = local.haproxy.count +# ciuser = "administrator" +# vmid = "${local.vlan}${local.haproxy.ip[count.index]}" +# name = local.haproxy.name[count.index] +# target_node = local.haproxy.node[count.index] +# clone = local.template +# tags = local.haproxy.tags +# qemu_os = "l26" +# full_clone = true +# os_type = "cloud-init" +# agent = 1 +# cores = local.haproxy.cores +# sockets = 1 +# cpu_type = "host" +# memory = local.haproxy.memory +# scsihw = "virtio-scsi-pci" +# #bootdisk = "scsi0" +# boot = "order=virtio0" +# onboot = true +# sshkeys = local.sshkeys +# vga { +# type = "serial0" +# } +# serial { +# id = 0 +# type = "socket" +# } +# disks { +# ide { +# ide2 { +# cloudinit { +# storage = local.haproxy.storage +# } +# } +# } +# virtio { +# virtio0 { +# disk { +# size = local.haproxy.drive +# format = local.format +# storage = local.haproxy.storage +# } +# } +# } +# } +# network { +# id = 0 +# model = "virtio" +# bridge = "vmbr0" +# tag = local.vlan +# } +# #Cloud Init Settings +# ipconfig0 = "ip=192.168.${local.vlan}.${local.haproxy.ip[count.index]}/24,gw=192.168.${local.vlan}.1" +# searchdomain = "durp.loc" +# nameserver = local.dnsserver +#} +# +#resource "proxmox_vm_qemu" "postgres" { +# count = local.postgres.count +# ciuser = "administrator" +# vmid = "${local.vlan}${local.postgres.ip[count.index]}" +# name = local.postgres.name[count.index] +# target_node = local.postgres.node[count.index] +# clone = local.template +# tags = local.postgres.tags +# qemu_os = "l26" +# full_clone = true +# os_type = "cloud-init" +# agent = 1 +# cores = local.postgres.cores +# sockets = 1 +# cpu_type = "host" +# memory = local.postgres.memory +# scsihw = "virtio-scsi-pci" +# #bootdisk = "scsi0" +# boot = "order=virtio0" +# onboot = true +# sshkeys = local.sshkeys +# vga { +# type = "serial0" +# } +# serial { +# id = 0 +# type = "socket" +# } +# disks { +# ide { +# ide2 { +# cloudinit { +# storage = local.postgres.storage +# } +# } +# } +# virtio { +# virtio0 { +# disk { +# size = local.postgres.drive +# format = local.format +# storage = local.postgres.storage +# } +# } +# } +# } +# network { +# id = 0 +# model = "virtio" +# bridge = "vmbr0" +# tag = local.vlan +# } +# #Cloud Init Settings +# ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" +# searchdomain = "durp.loc" +# nameserver = local.dnsserver +#} +# \ No newline at end of file diff --git a/infra/terraform/variables.tf b/infra/terraform/variables.tf new file mode 100644 index 0000000..31a92e0 --- /dev/null +++ b/infra/terraform/variables.tf @@ -0,0 +1,14 @@ +variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string +} + +variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string +} + +variable "pm_user" { + description = "UIsername to Proxmox provider" + type = string +} diff --git a/infra/portainer/Chart.yaml b/master/argocd/Chart.yaml similarity index 54% rename from infra/portainer/Chart.yaml rename to master/argocd/Chart.yaml index 6bedd0a..647c3cf 100644 --- a/infra/portainer/Chart.yaml +++ b/master/argocd/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -name: portainer +name: argocd description: A Helm chart for Kubernetes type: application @@ -7,6 +7,8 @@ version: 0.1.0 appVersion: "1.16.0" dependencies: - - name: portainer - repository: https://portainer.github.io/k8s/ - version: 2.33.6 +- name: argo-cd + repository: https://argoproj.github.io/argo-helm + version: 8.1.3 + + diff --git a/master/argocd/templates/InternalProxy.yaml b/master/argocd/templates/InternalProxy.yaml new file mode 100644 index 0000000..76c8229 --- /dev/null +++ b/master/argocd/templates/InternalProxy.yaml @@ -0,0 +1,23 @@ +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: internalproxy +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/internalproxy +# directory: +# recurse: true +# destination: +# server: https://kubernetes.default.svc +# namespace: internalproxy +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# diff --git a/master/argocd/templates/argocd.yaml b/master/argocd/templates/argocd.yaml new file mode 100644 index 0000000..e93aa4f --- /dev/null +++ b/master/argocd/templates/argocd.yaml @@ -0,0 +1,59 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/argocd + destination: + namespace: argocd + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: argocd-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`argocd.internal.durp.info`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: argocd-server + port: 443 + scheme: https + tls: + secretName: argocd-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: argocd-tls +spec: + secretName: argocd-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "argocd.internal.durp.info" + dnsNames: + - "argocd.internal.durp.info" diff --git a/master/argocd/templates/authentik.yaml b/master/argocd/templates/authentik.yaml new file mode 100644 index 0000000..8d003fb --- /dev/null +++ b/master/argocd/templates/authentik.yaml @@ -0,0 +1,21 @@ +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: authentik +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/authentik +# destination: +# namespace: authentik +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# diff --git a/master/argocd/templates/bitwarden.yaml b/master/argocd/templates/bitwarden.yaml new file mode 100644 index 0000000..ed56924 --- /dev/null +++ b/master/argocd/templates/bitwarden.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: bitwarden + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/bitwarden + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: bitwarden + syncPolicy: + automated: + prune: true + selfHeal: false + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/cert-manager.yaml b/master/argocd/templates/cert-manager.yaml new file mode 100644 index 0000000..fc11c13 --- /dev/null +++ b/master/argocd/templates/cert-manager.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/cert-manager + destination: + namespace: cert-manager + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/crossplane.yml b/master/argocd/templates/crossplane.yml new file mode 100644 index 0000000..21d8835 --- /dev/null +++ b/master/argocd/templates/crossplane.yml @@ -0,0 +1,20 @@ +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: crossplane +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/crossplane +# destination: +# namespace: crossplane +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true diff --git a/infra/argocd/templates/portainer.yaml b/master/argocd/templates/durpapi.yaml similarity index 56% rename from infra/argocd/templates/portainer.yaml rename to master/argocd/templates/durpapi.yaml index 22b2a9b..aeefcc1 100644 --- a/infra/argocd/templates/portainer.yaml +++ b/master/argocd/templates/durpapi.yaml @@ -1,20 +1,20 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: portainer + name: durpapi namespace: argocd spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: infra/portainer + path: master/durpapi destination: - namespace: portainer + namespace: durpapi name: in-cluster syncPolicy: automated: prune: true - selfHeal: true + selfHeal: true syncOptions: - - CreateNamespace=true + - CreateNamespace=true diff --git a/master/argocd/templates/durpot.yaml b/master/argocd/templates/durpot.yaml new file mode 100644 index 0000000..7a97eb4 --- /dev/null +++ b/master/argocd/templates/durpot.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: durpot + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/durpot + destination: + namespace: durpot + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/external-dns.yaml b/master/argocd/templates/external-dns.yaml new file mode 100644 index 0000000..5cf21a5 --- /dev/null +++ b/master/argocd/templates/external-dns.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/external-dns + destination: + namespace: external-dns + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/external-secrets.yaml b/master/argocd/templates/external-secrets.yaml new file mode 100644 index 0000000..04f8f1d --- /dev/null +++ b/master/argocd/templates/external-secrets.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-secrets + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/external-secrets + destination: + namespace: external-secrets + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/gatekeeper.yaml b/master/argocd/templates/gatekeeper.yaml new file mode 100644 index 0000000..e50e284 --- /dev/null +++ b/master/argocd/templates/gatekeeper.yaml @@ -0,0 +1,20 @@ +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: gatekeeper +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/gatekeeper +# destination: +# namespace: gatekeeper +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true diff --git a/master/argocd/templates/gitlab-runner.yaml b/master/argocd/templates/gitlab-runner.yaml new file mode 100644 index 0000000..8a1afec --- /dev/null +++ b/master/argocd/templates/gitlab-runner.yaml @@ -0,0 +1,21 @@ +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: gitlab-runner +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/gitlab-runner +# destination: +# namespace: gitlab-runner +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# diff --git a/master/argocd/templates/heimdall.yaml b/master/argocd/templates/heimdall.yaml new file mode 100644 index 0000000..333a761 --- /dev/null +++ b/master/argocd/templates/heimdall.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: heimdall + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/heimdall + destination: + namespace: heimdall + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/krakend.yaml b/master/argocd/templates/krakend.yaml new file mode 100644 index 0000000..e5ed113 --- /dev/null +++ b/master/argocd/templates/krakend.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: krakend + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/krakend + destination: + namespace: krakend + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/kube-prometheus-stack.yaml b/master/argocd/templates/kube-prometheus-stack.yaml new file mode 100644 index 0000000..2de63f1 --- /dev/null +++ b/master/argocd/templates/kube-prometheus-stack.yaml @@ -0,0 +1,22 @@ +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: kube-prometheus-stack +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/kube-prometheus-stack +# destination: +# namespace: kube-prometheus-stack +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# +# \ No newline at end of file diff --git a/master/argocd/templates/kubeclarity.yaml b/master/argocd/templates/kubeclarity.yaml new file mode 100644 index 0000000..b202df7 --- /dev/null +++ b/master/argocd/templates/kubeclarity.yaml @@ -0,0 +1,21 @@ +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: kubeclarity +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/kubeclarity +# destination: +# namespace: kubeclarity +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# \ No newline at end of file diff --git a/master/argocd/templates/littlelink.yaml b/master/argocd/templates/littlelink.yaml new file mode 100644 index 0000000..856ac87 --- /dev/null +++ b/master/argocd/templates/littlelink.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: littlelink + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/littlelink + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: littlelink + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/longhorn.yaml b/master/argocd/templates/longhorn.yaml new file mode 100644 index 0000000..1e857c5 --- /dev/null +++ b/master/argocd/templates/longhorn.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: longhorn-system + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/longhorn + destination: + namespace: longhorn-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/metallb-system.yaml b/master/argocd/templates/metallb-system.yaml new file mode 100644 index 0000000..d343453 --- /dev/null +++ b/master/argocd/templates/metallb-system.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: metallb-system + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/metallb-system + destination: + namespace: metallb-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + + diff --git a/master/argocd/templates/nfs-client.yaml b/master/argocd/templates/nfs-client.yaml new file mode 100644 index 0000000..a299095 --- /dev/null +++ b/master/argocd/templates/nfs-client.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: nfs-client + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/nfs-client + directory: + recurse: true + destination: + namespace: nfs-client + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/open-webui.yaml b/master/argocd/templates/open-webui.yaml new file mode 100644 index 0000000..bae227f --- /dev/null +++ b/master/argocd/templates/open-webui.yaml @@ -0,0 +1,21 @@ +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: open-webui +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/open-webui +# destination: +# namespace: open-webui +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# \ No newline at end of file diff --git a/master/argocd/templates/secrets.yaml b/master/argocd/templates/secrets.yaml new file mode 100644 index 0000000..ee58a80 --- /dev/null +++ b/master/argocd/templates/secrets.yaml @@ -0,0 +1,17 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: vault-argocd + labels: + app.kubernetes.io/part-of: argocd +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: client-secret + data: + - secretKey: clientSecret + remoteRef: + key: secrets/argocd/authentik + property: clientsecret diff --git a/master/argocd/templates/traefik.yaml b/master/argocd/templates/traefik.yaml new file mode 100644 index 0000000..e336d57 --- /dev/null +++ b/master/argocd/templates/traefik.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: traefik + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/traefik + destination: + namespace: traefik + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/infra/argocd/templates/searxng.yaml b/master/argocd/templates/uptimekuma.yaml similarity index 57% rename from infra/argocd/templates/searxng.yaml rename to master/argocd/templates/uptimekuma.yaml index 9e05411..1d2c5e6 100644 --- a/infra/argocd/templates/searxng.yaml +++ b/master/argocd/templates/uptimekuma.yaml @@ -1,22 +1,23 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: searxng + name: uptimekuma namespace: argocd spec: project: default source: - repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git + repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: dmz/searxng + path: master/uptimekuma directory: recurse: true destination: - name: dmz - namespace: searxng + server: https://kubernetes.default.svc + namespace: uptimekuma syncPolicy: automated: prune: true selfHeal: true syncOptions: - - CreateNamespace=true + - CreateNamespace=true + diff --git a/master/argocd/templates/vault.yaml b/master/argocd/templates/vault.yaml new file mode 100644 index 0000000..6f21f08 --- /dev/null +++ b/master/argocd/templates/vault.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: vault + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: master/vault + destination: + namespace: vault + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle diff --git a/master/argocd/values.yaml b/master/argocd/values.yaml new file mode 100644 index 0000000..82b19ac --- /dev/null +++ b/master/argocd/values.yaml @@ -0,0 +1,62 @@ +argo-cd: + + global: + revisionHistoryLimit: 1 + image: + repository: registry.durp.info/argoproj/argocd + imagePullPolicy: Always + + server: + #extraArgs: + # - --dex-server-plaintext + # - --dex-server=argocd-dex-server:5556 + # oidc.config: | + # name: AzureAD + # issuer: https://login.microsoftonline.com/TENANT_ID/v2.0 + # clientID: CLIENT_ID + # clientSecret: $oidc.azuread.clientSecret + # requestedIDTokenClaims: + # groups: + # essential: true + # requestedScopes: + # - openid + # - profile + # - email + + dex: + enabled: true + image: + repository: registry.durp.info/dexidp/dex + imagePullPolicy: Always + + configs: + cm: + create: true + annotations: {} + url: https://argocd.internal.durp.info + oidc.tls.insecure.skip.verify: "true" + dex.config: | + connectors: + - config: + issuer: https://authentik.durp.info/application/o/argocd/ + clientID: dbb8ffc06104fb6e7fac3e4ae7fafb1d90437625 + clientSecret: $client-secret:clientSecret + insecureEnableGroups: true + scopes: + - openid + - profile + - email + - groups + name: authentik + type: oidc + id: authentik + + rbac: + create: true + policy.csv: | + g, ArgoCD Admins, role:admin + scopes: "[groups]" + + server: + route: + enabled: false diff --git a/master/authentik/Chart.yaml b/master/authentik/Chart.yaml new file mode 100644 index 0000000..e357c64 --- /dev/null +++ b/master/authentik/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: authentik +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: authentik-remote-cluster + repository: https://charts.goauthentik.io + version: 2.1.0 diff --git a/master/authentik/templates/authentik-pv.yaml b/master/authentik/templates/authentik-pv.yaml new file mode 100644 index 0000000..8fbc2e2 --- /dev/null +++ b/master/authentik/templates/authentik-pv.yaml @@ -0,0 +1,24 @@ +#apiVersion: v1 +#kind: PersistentVolume +#metadata: +# annotations: +# pv.kubernetes.io/provisioned-by: durp.info/nfs +# finalizers: +# - kubernetes.io/pv-protection +# name: authentik-pv +#spec: +# accessModes: +# - ReadWriteMany +# capacity: +# storage: 10Gi +# claimRef: +# apiVersion: v1 +# kind: PersistentVolumeClaim +# name: authentik-pvc +# namespace: authentik +# nfs: +# path: /mnt/user/k3s/authentik +# server: 192.168.20.253 +# persistentVolumeReclaimPolicy: Retain +# storageClassName: nfs-storage +# volumeMode: Filesystem diff --git a/master/authentik/templates/authentik-pvc.yaml b/master/authentik/templates/authentik-pvc.yaml new file mode 100644 index 0000000..f22640b --- /dev/null +++ b/master/authentik/templates/authentik-pvc.yaml @@ -0,0 +1,18 @@ +#apiVersion: v1 +#kind: PersistentVolumeClaim +#metadata: +# labels: +# app.kubernetes.io/component: app +# app.kubernetes.io/instance: authentik +# app.kubernetes.io/managed-by: Helm +# app.kubernetes.io/name: authentik +# helm.sh/chart: authentik-2.14.4 +# name: authentik-pvc +# namespace: authentik +#spec: +# accessModes: +# - ReadWriteMany +# resources: +# requests: +# storage: 10Gi +# storageClassName: nfs-storage \ No newline at end of file diff --git a/master/authentik/templates/ingress.yaml b/master/authentik/templates/ingress.yaml new file mode 100644 index 0000000..83e1efa --- /dev/null +++ b/master/authentik/templates/ingress.yaml @@ -0,0 +1,60 @@ +#apiVersion: traefik.containo.us/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: authentik-server +# port: 80 +# tls: +# secretName: authentik-tls +# +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + secretName: authentik-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "outpost.internal.durp.info" + dnsNames: + - "outpost.internal.durp.info" + +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: authentik-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +#spec: +# type: ExternalName +# externalName: durp.info + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: outpost-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`outpost.internal.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: ak-outpost-master-embedded-outpost + port: 9000 + tls: + secretName: authentik-tls diff --git a/master/authentik/templates/secrets.yaml b/master/authentik/templates/secrets.yaml new file mode 100644 index 0000000..52df8b1 --- /dev/null +++ b/master/authentik/templates/secrets.yaml @@ -0,0 +1,28 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: authentik-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: db-pass + data: + - secretKey: dbpass + remoteRef: + key: secrets/authentik/database + property: dbpass + - secretKey: secretkey + remoteRef: + key: secrets/authentik/database + property: secretkey + - secretKey: postgresql-postgres-password + remoteRef: + key: secrets/authentik/database + property: dbpass + - secretKey: postgresql-password + remoteRef: + key: secrets/authentik/database + property: dbpass + diff --git a/master/authentik/values.yaml b/master/authentik/values.yaml new file mode 100644 index 0000000..83be2f9 --- /dev/null +++ b/master/authentik/values.yaml @@ -0,0 +1,30 @@ +authentik-remote-cluster: + # -- Provide a name in place of `authentik`. Prefer using global.nameOverride if possible + nameOverride: "" + # -- String to fully override `"authentik.fullname"`. Prefer using global.fullnameOverride if possible + fullnameOverride: "" + # -- Override the Kubernetes version, which is used to evaluate certain manifests + kubeVersionOverride: "" + + ## Globally shared configuration for authentik components. + global: + # -- Provide a name in place of `authentik` + nameOverride: "" + # -- String to fully override `"authentik.fullname"` + fullnameOverride: "" + # -- A custom namespace to override the default namespace for the deployed resources. + namespaceOverride: "" + # -- Common labels for all resources. + additionalLabels: {} + # app: authentik + + # -- Annotations to apply to all resources + annotations: {} + + serviceAccountSecret: + # -- Create a secret with the service account credentials + enabled: true + + clusterRole: + # -- Create a clusterole in addition to a namespaced role. + enabled: true diff --git a/master/bitwarden/Chart.yaml b/master/bitwarden/Chart.yaml new file mode 100644 index 0000000..cfdd821 --- /dev/null +++ b/master/bitwarden/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: bitwarden +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" diff --git a/master/bitwarden/templates/bitwarden-pv.yaml b/master/bitwarden/templates/bitwarden-pv.yaml new file mode 100644 index 0000000..ff647d1 --- /dev/null +++ b/master/bitwarden/templates/bitwarden-pv.yaml @@ -0,0 +1,25 @@ +#apiVersion: v1 +#kind: PersistentVolume +#metadata: +# annotations: +# pv.kubernetes.io/provisioned-by: durp.info/nfs +# finalizers: +# - kubernetes.io/pv-protection +# name: bitwarden-pv +#spec: +# accessModes: +# - ReadWriteMany +# capacity: +# storage: 10Gi +# claimRef: +# apiVersion: v1 +# kind: PersistentVolumeClaim +# name: bitwarden-pvc +# namespace: bitwarden +# nfs: +# path: /mnt/user/k3s/bitwarden +# server: 192.168.20.253 +# persistentVolumeReclaimPolicy: Retain +# storageClassName: nfs-storage +# volumeMode: Filesystem +# \ No newline at end of file diff --git a/master/bitwarden/templates/bitwarden-pvc.yaml b/master/bitwarden/templates/bitwarden-pvc.yaml new file mode 100644 index 0000000..333af4d --- /dev/null +++ b/master/bitwarden/templates/bitwarden-pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: bitwarden-pvc +spec: + storageClassName: longhorn + accessModes: + - ReadWriteMany + resources: + requests: + storage: 10Gi diff --git a/master/bitwarden/templates/deployment.yaml b/master/bitwarden/templates/deployment.yaml new file mode 100644 index 0000000..f787ba1 --- /dev/null +++ b/master/bitwarden/templates/deployment.yaml @@ -0,0 +1,50 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: bitwarden + name: bitwarden + labels: + app: bitwarden +spec: + selector: + matchLabels: + app: bitwarden + replicas: 1 + template: + metadata: + labels: + app: bitwarden + spec: + containers: + - name: bitwarden + image: registry.durp.info/vaultwarden/server:1.32.7 + imagePullPolicy: Always + volumeMounts: + - name: bitwarden-pvc + mountPath: /data + subPath: bitwaren-data + ports: + - name: http + containerPort: 80 + env: + - name: SIGNUPS_ALLOWED + value: "FALSE" + - name: INVITATIONS_ALLOWED + value: "FALSE" + - name: WEBSOCKET_ENABLED + value: "TRUE" + - name: ROCKET_ENV + value: "staging" + - name: ROCKET_PORT + value: "80" + - name: ROCKET_WORKERS + value: "10" + - name: SECRET_USERNAME + valueFrom: + secretKeyRef: + name: bitwarden-secret + key: ADMIN_TOKEN + volumes: + - name: bitwarden-pvc + persistentVolumeClaim: + claimName: bitwarden-pvc diff --git a/master/bitwarden/templates/ingress.yaml b/master/bitwarden/templates/ingress.yaml new file mode 100644 index 0000000..8a9a628 --- /dev/null +++ b/master/bitwarden/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: bitwarden-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: bitwarden + port: 80 + tls: + secretName: bitwarden-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: bitwarden-tls +spec: + secretName: bitwarden-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "bitwarden.durp.info" + dnsNames: + - "bitwarden.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: bitwarden-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/bitwarden/templates/secrets.yaml b/master/bitwarden/templates/secrets.yaml new file mode 100644 index 0000000..a5a9e44 --- /dev/null +++ b/master/bitwarden/templates/secrets.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: bitwarden-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: bitwarden-secret + data: + - secretKey: ADMIN_TOKEN + remoteRef: + key: secrets/bitwarden/admin + property: ADMIN_TOKEN + diff --git a/master/bitwarden/templates/service.yaml b/master/bitwarden/templates/service.yaml new file mode 100644 index 0000000..df30857 --- /dev/null +++ b/master/bitwarden/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: bitwarden +spec: + ports: + - name: http + port: 80 + targetPort: 80 + protocol: TCP + selector: + app: bitwarden \ No newline at end of file diff --git a/master/cert-manager/Chart.yaml b/master/cert-manager/Chart.yaml new file mode 100644 index 0000000..7280af8 --- /dev/null +++ b/master/cert-manager/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: cert-manager +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: cert-manager + repository: https://charts.jetstack.io + version: v1.17.2 diff --git a/master/cert-manager/templates/letsencrypt-prroduction.yaml b/master/cert-manager/templates/letsencrypt-prroduction.yaml new file mode 100644 index 0000000..034ed9b --- /dev/null +++ b/master/cert-manager/templates/letsencrypt-prroduction.yaml @@ -0,0 +1,16 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: developerdurp@durp.info + apiTokenSecretRef: + name: cloudflare-api-token-secret + key: cloudflare-api-token-secret diff --git a/master/cert-manager/templates/letsencrypt-staging.yaml b/master/cert-manager/templates/letsencrypt-staging.yaml new file mode 100644 index 0000000..b6ae4f9 --- /dev/null +++ b/master/cert-manager/templates/letsencrypt-staging.yaml @@ -0,0 +1,16 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - dns01: + cloudflare: + email: developerdurp@durp.info + apiTokenSecretRef: + name: cloudflare-api-token-secret + key: cloudflare-api-token-secret \ No newline at end of file diff --git a/master/cert-manager/templates/sealedsecret.yaml b/master/cert-manager/templates/sealedsecret.yaml new file mode 100644 index 0000000..a85ea4e --- /dev/null +++ b/master/cert-manager/templates/sealedsecret.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: cloudflare-api-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: cloudflare-api-token-secret + data: + - secretKey: cloudflare-api-token-secret + remoteRef: + key: secrets/cert-manager + property: cloudflare-api-token-secret + diff --git a/master/cert-manager/values.yaml b/master/cert-manager/values.yaml new file mode 100644 index 0000000..36f403b --- /dev/null +++ b/master/cert-manager/values.yaml @@ -0,0 +1,25 @@ +cert-manager: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-controller + pullPolicy: Always + installCRDs: true + replicaCount: 3 + extraArgs: + - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 + - --dns01-recursive-nameservers-only + podDnsPolicy: None + podDnsConfig: + nameservers: + - "1.1.1.1" + - "1.0.0.1" + webhook: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-webhook + pullPolicy: Always + cainjector: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-cainjector + pullPolicy: Always \ No newline at end of file diff --git a/master/crossplane/Chart.yaml b/master/crossplane/Chart.yaml new file mode 100644 index 0000000..e725e88 --- /dev/null +++ b/master/crossplane/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: crossplane +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: crossplane + repository: https://charts.crossplane.io/stable + version: 1.20.0 diff --git a/master/crossplane/templates/gitlab.yml b/master/crossplane/templates/gitlab.yml new file mode 100644 index 0000000..0211b82 --- /dev/null +++ b/master/crossplane/templates/gitlab.yml @@ -0,0 +1,55 @@ +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + name: provider-gitlab +spec: + package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 +--- + +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: gitlab-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: gitlab-secret + data: + - secretKey: accesstoken + remoteRef: + key: secrets/gitlab/token + property: accesstoken + +--- + +#apiVersion: gitlab.crossplane.io/v1beta1 +#kind: ProviderConfig +#metadata: +# name: gitlab-provider +#spec: +# baseURL: https://gitlab.com/ +# credentials: +# source: Secret +# secretRef: +# namespace: crossplane +# name: gitlab-secret +# key: accesstoken +# +#--- +# +#apiVersion: projects.gitlab.crossplane.io/v1alpha1 +#kind: Project +#metadata: +# name: example-project +#spec: +# deletionPolicy: Orphan +# forProvider: +# name: "Example Project" +# description: "example project description" +# providerConfigRef: +# name: gitlab-provider +# policy: +# resolution: Optional +# resolve: Always diff --git a/master/dashboards/nginx-dashboard.yaml b/master/dashboards/nginx-dashboard.yaml new file mode 100644 index 0000000..333a6c5 --- /dev/null +++ b/master/dashboards/nginx-dashboard.yaml @@ -0,0 +1,1506 @@ +apiVersion: v1 +data: + nginx-ingress-controller_rev1.json: |- + { + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": { + "type": "datasource", + "uid": "grafana" + }, + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "target": { + "limit": 100, + "matchAny": false, + "tags": [], + "type": "dashboard" + }, + "type": "dashboard" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "enable": true, + "expr": "sum(changes(nginx_ingress_controller_config_last_reload_successful_timestamp_seconds{instance!=\"unknown\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[30s])) by (controller_class)", + "hide": false, + "iconColor": "rgba(255, 96, 96, 1)", + "limit": 100, + "name": "Config Reloads", + "showIn": 0, + "step": "30s", + "tagKeys": "controller_class", + "tags": [], + "titleFormat": "Config Reloaded", + "type": "tags" + } + ] + }, + "description": "Ingress-nginx supports a rich collection of prometheus metrics. If you have prometheus and grafana installed on your cluster then prometheus will already be scraping this data due to the scrape annotation on the deployment.", + "editable": true, + "fiscalYearStartMonth": 0, + "gnetId": 9614, + "graphTooltip": 0, + "id": 27, + "links": [], + "liveNow": false, + "panels": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fieldConfig": { + "defaults": { + "color": { + "fixedColor": "rgb(31, 120, 193)", + "mode": "fixed" + }, + "mappings": [ + { + "options": { + "match": "null", + "result": { + "text": "N/A" + } + }, + "type": "special" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "ops" + }, + "overrides": [] + }, + "id": 20, + "links": [], + "maxDataPoints": 100, + "options": { + "colorMode": "none", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "horizontal", + "reduceOptions": { + "calcs": [ + "mean" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "pluginVersion": "9.1.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "round(sum(irate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[2m])), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "title": "Controller Request Volume", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fieldConfig": { + "defaults": { + "color": { + "fixedColor": "rgb(31, 120, 193)", + "mode": "fixed" + }, + "mappings": [ + { + "options": { + "match": "null", + "result": { + "text": "N/A" + } + }, + "type": "special" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "none" + }, + "overrides": [] + }, + "gridPos": { + "h": 3, + "w": 6, + "x": 6, + "y": 0 + }, + "id": 82, + "links": [], + "maxDataPoints": 100, + "options": { + "colorMode": "none", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "horizontal", + "reduceOptions": { + "calcs": [ + "mean" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "pluginVersion": "9.1.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum(avg_over_time(nginx_ingress_controller_nginx_process_connections{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", + "format": "time_series", + "instant": false, + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "title": "Controller Connections", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fieldConfig": { + "defaults": { + "color": { + "fixedColor": "rgb(31, 120, 193)", + "mode": "fixed" + }, + "mappings": [ + { + "options": { + "match": "null", + "result": { + "text": "N/A" + } + }, + "type": "special" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "rgba(245, 54, 54, 0.9)", + "value": null + }, + { + "color": "rgba(237, 129, 40, 0.89)", + "value": 95 + }, + { + "color": "rgba(50, 172, 45, 0.97)", + "value": 99 + } + ] + }, + "unit": "percentunit" + }, + "overrides": [] + }, + "gridPos": { + "h": 3, + "w": 6, + "x": 12, + "y": 0 + }, + "id": 21, + "links": [], + "maxDataPoints": 100, + "options": { + "colorMode": "none", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "horizontal", + "reduceOptions": { + "calcs": [ + "mean" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "pluginVersion": "9.1.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",status!~\"[4-5].*\"}[2m])) / sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[2m]))", + "format": "time_series", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "title": "Controller Success Rate (non-4|5xx responses)", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fieldConfig": { + "defaults": { + "color": { + "fixedColor": "rgb(31, 120, 193)", + "mode": "fixed" + }, + "decimals": 0, + "mappings": [ + { + "options": { + "match": "null", + "result": { + "text": "N/A" + } + }, + "type": "special" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "none" + }, + "overrides": [] + }, + "gridPos": { + "h": 3, + "w": 3, + "x": 18, + "y": 0 + }, + "id": 81, + "links": [], + "maxDataPoints": 100, + "options": { + "colorMode": "none", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "horizontal", + "reduceOptions": { + "calcs": [ + "mean" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "pluginVersion": "9.1.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "avg(nginx_ingress_controller_success{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"})", + "format": "time_series", + "instant": true, + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "title": "Config Reloads", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fieldConfig": { + "defaults": { + "color": { + "fixedColor": "rgb(31, 120, 193)", + "mode": "fixed" + }, + "decimals": 0, + "mappings": [ + { + "options": { + "match": "null", + "result": { + "text": "N/A" + } + }, + "type": "special" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "none" + }, + "overrides": [] + }, + "gridPos": { + "h": 3, + "w": 3, + "x": 21, + "y": 0 + }, + "id": 83, + "links": [], + "maxDataPoints": 100, + "options": { + "colorMode": "none", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "horizontal", + "reduceOptions": { + "calcs": [ + "mean" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "pluginVersion": "9.1.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "count(nginx_ingress_controller_config_last_reload_successful{controller_pod=~\"$controller\",controller_namespace=~\"$namespace\"} == 0)", + "format": "time_series", + "instant": true, + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "title": "Last Config Failed", + "type": "stat" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "decimals": 2, + "editable": true, + "error": false, + "fill": 1, + "fillGradient": 0, + "grid": {}, + "gridPos": { + "h": 7, + "w": 12, + "x": 0, + "y": 3 + }, + "height": "200px", + "hiddenSeries": false, + "id": 86, + "isNew": true, + "legend": { + "alignAsTable": true, + "avg": true, + "current": false, + "hideEmpty": false, + "hideZero": true, + "max": false, + "min": false, + "rightSide": true, + "show": true, + "sideWidth": 300, + "sort": "current", + "sortDesc": true, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 2, + "links": [], + "nullPointMode": "connected", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "9.1.6", + "pointradius": 5, + "points": false, + "renderer": "flot", + "repeatDirection": "h", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "round(sum(irate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress), 0.001)", + "format": "time_series", + "hide": false, + "instant": false, + "interval": "", + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "metric": "network", + "refId": "A", + "step": 10 + } + ], + "thresholds": [], + "timeRegions": [], + "title": "Ingress Request Volume", + "tooltip": { + "msResolution": false, + "shared": true, + "sort": 2, + "value_type": "cumulative" + }, + "type": "graph", + "xaxis": { + "mode": "time", + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "reqps", + "logBase": 1, + "show": true + }, + { + "format": "Bps", + "logBase": 1, + "show": false + } + ], + "yaxis": { + "align": false + } + }, + { + "aliasColors": { + "max - istio-proxy": "#890f02", + "max - master": "#bf1b00", + "max - prometheus": "#bf1b00" + }, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "decimals": 2, + "editable": false, + "error": false, + "fill": 0, + "fillGradient": 0, + "grid": {}, + "gridPos": { + "h": 7, + "w": 12, + "x": 12, + "y": 3 + }, + "hiddenSeries": false, + "id": 87, + "isNew": true, + "legend": { + "alignAsTable": true, + "avg": true, + "current": false, + "hideEmpty": true, + "hideZero": false, + "max": false, + "min": false, + "rightSide": true, + "show": true, + "sideWidth": 300, + "sort": "avg", + "sortDesc": true, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 2, + "links": [], + "nullPointMode": "connected", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "9.1.6", + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",ingress=~\"$ingress\",status!~\"[4-5].*\"}[2m])) by (ingress) / sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", + "format": "time_series", + "instant": false, + "interval": "10s", + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "metric": "container_memory_usage:sort_desc", + "refId": "A", + "step": 10 + } + ], + "thresholds": [], + "timeRegions": [], + "title": "Ingress Success Rate (non-4|5xx responses)", + "tooltip": { + "msResolution": false, + "shared": true, + "sort": 1, + "value_type": "cumulative" + }, + "type": "graph", + "xaxis": { + "mode": "time", + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "percentunit", + "logBase": 1, + "show": true + }, + { + "format": "short", + "logBase": 1, + "show": false + } + ], + "yaxis": { + "align": false + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "decimals": 2, + "editable": true, + "error": false, + "fill": 1, + "fillGradient": 0, + "grid": {}, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 10 + }, + "height": "200px", + "hiddenSeries": false, + "id": 32, + "isNew": true, + "legend": { + "alignAsTable": false, + "avg": true, + "current": true, + "max": false, + "min": false, + "rightSide": false, + "show": false, + "sideWidth": 200, + "sort": "current", + "sortDesc": true, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 2, + "links": [], + "nullPointMode": "connected", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "9.1.6", + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum (irate (nginx_ingress_controller_request_size_sum{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", + "format": "time_series", + "instant": false, + "interval": "10s", + "intervalFactor": 1, + "legendFormat": "Received", + "metric": "network", + "refId": "A", + "step": 10 + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "- sum (irate (nginx_ingress_controller_response_size_sum{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", + "format": "time_series", + "hide": false, + "interval": "10s", + "intervalFactor": 1, + "legendFormat": "Sent", + "metric": "network", + "refId": "B", + "step": 10 + } + ], + "thresholds": [], + "timeRegions": [], + "title": "Network I/O pressure", + "tooltip": { + "msResolution": false, + "shared": true, + "sort": 0, + "value_type": "cumulative" + }, + "type": "graph", + "xaxis": { + "mode": "time", + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "Bps", + "logBase": 1, + "show": true + }, + { + "format": "Bps", + "logBase": 1, + "show": false + } + ], + "yaxis": { + "align": false + } + }, + { + "aliasColors": { + "max - istio-proxy": "#890f02", + "max - master": "#bf1b00", + "max - prometheus": "#bf1b00" + }, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "decimals": 2, + "editable": false, + "error": false, + "fill": 0, + "fillGradient": 0, + "grid": {}, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 10 + }, + "hiddenSeries": false, + "id": 77, + "isNew": true, + "legend": { + "alignAsTable": true, + "avg": true, + "current": true, + "max": false, + "min": false, + "rightSide": false, + "show": false, + "sideWidth": 200, + "sort": "current", + "sortDesc": true, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 2, + "links": [], + "nullPointMode": "connected", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "9.1.6", + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "avg(nginx_ingress_controller_nginx_process_resident_memory_bytes{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}) ", + "format": "time_series", + "instant": false, + "interval": "10s", + "intervalFactor": 1, + "legendFormat": "nginx", + "metric": "container_memory_usage:sort_desc", + "refId": "A", + "step": 10 + } + ], + "thresholds": [], + "timeRegions": [], + "title": "Average Memory Usage", + "tooltip": { + "msResolution": false, + "shared": true, + "sort": 2, + "value_type": "cumulative" + }, + "type": "graph", + "xaxis": { + "mode": "time", + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "bytes", + "logBase": 1, + "show": true + }, + { + "format": "short", + "logBase": 1, + "show": false + } + ], + "yaxis": { + "align": false + } + }, + { + "aliasColors": { + "max - istio-proxy": "#890f02", + "max - master": "#bf1b00" + }, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "decimals": 3, + "editable": false, + "error": false, + "fill": 0, + "fillGradient": 0, + "grid": {}, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 10 + }, + "height": "", + "hiddenSeries": false, + "id": 79, + "isNew": true, + "legend": { + "alignAsTable": true, + "avg": true, + "current": true, + "max": false, + "min": false, + "rightSide": false, + "show": false, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 2, + "links": [], + "nullPointMode": "connected", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "9.1.6", + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum (rate (nginx_ingress_controller_nginx_process_cpu_seconds_total{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m])) ", + "format": "time_series", + "interval": "10s", + "intervalFactor": 1, + "legendFormat": "nginx", + "metric": "container_cpu", + "refId": "A", + "step": 10 + } + ], + "thresholds": [ + { + "colorMode": "critical", + "fill": true, + "line": true, + "op": "gt" + } + ], + "timeRegions": [], + "title": "Average CPU Usage", + "tooltip": { + "msResolution": true, + "shared": true, + "sort": 2, + "value_type": "cumulative" + }, + "type": "graph", + "xaxis": { + "mode": "time", + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "none", + "label": "cores", + "logBase": 1, + "show": true + }, + { + "format": "short", + "logBase": 1, + "show": true + } + ], + "yaxis": { + "align": false + } + }, + { + "columns": [], + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fontSize": "100%", + "gridPos": { + "h": 8, + "w": 24, + "x": 0, + "y": 16 + }, + "hideTimeOverride": false, + "id": 75, + "links": [], + "pageSize": 7, + "repeatDirection": "h", + "scroll": true, + "showHeader": true, + "sort": { + "col": 1, + "desc": true + }, + "styles": [ + { + "alias": "Ingress", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "ingress", + "preserveFormat": false, + "sanitize": false, + "thresholds": [], + "type": "string", + "unit": "short" + }, + { + "alias": "Requests", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #A", + "thresholds": [ + "" + ], + "type": "number", + "unit": "ops" + }, + { + "alias": "Errors", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #B", + "thresholds": [], + "type": "number", + "unit": "ops" + }, + { + "alias": "P50 Latency", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 0, + "link": false, + "pattern": "Value #C", + "thresholds": [], + "type": "number", + "unit": "dtdurations" + }, + { + "alias": "P90 Latency", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 0, + "pattern": "Value #D", + "thresholds": [], + "type": "number", + "unit": "dtdurations" + }, + { + "alias": "P99 Latency", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 0, + "pattern": "Value #E", + "thresholds": [], + "type": "number", + "unit": "dtdurations" + }, + { + "alias": "IN", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #F", + "thresholds": [ + "" + ], + "type": "number", + "unit": "Bps" + }, + { + "alias": "", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Time", + "thresholds": [], + "type": "hidden", + "unit": "short" + }, + { + "alias": "OUT", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "mappingType": 1, + "pattern": "Value #G", + "thresholds": [], + "type": "number", + "unit": "Bps" + } + ], + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "histogram_quantile(0.50, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "refId": "C" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "histogram_quantile(0.90, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "refId": "D" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "histogram_quantile(0.99, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }}", + "refId": "E" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum(irate(nginx_ingress_controller_request_size_sum{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", + "format": "table", + "hide": false, + "instant": true, + "interval": "", + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "refId": "F" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum(irate(nginx_ingress_controller_response_size_sum{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", + "format": "table", + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "refId": "G" + } + ], + "title": "Ingress Percentile Response Times and Transfer Rates", + "transform": "table", + "type": "table-old" + }, + { + "columns": [ + { + "text": "Current", + "value": "current" + } + ], + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fontSize": "100%", + "gridPos": { + "h": 8, + "w": 24, + "x": 0, + "y": 24 + }, + "height": "1024", + "id": 85, + "links": [], + "pageSize": 7, + "scroll": true, + "showHeader": true, + "sort": { + "col": 1, + "desc": false + }, + "styles": [ + { + "alias": "Time", + "align": "auto", + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "pattern": "Time", + "type": "date" + }, + { + "alias": "TTL", + "align": "auto", + "colorMode": "cell", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 0, + "pattern": "Current", + "thresholds": [ + "0", + "691200" + ], + "type": "number", + "unit": "s" + }, + { + "alias": "", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "decimals": 2, + "pattern": "/.*/", + "thresholds": [], + "type": "number", + "unit": "short" + } + ], + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "avg(nginx_ingress_controller_ssl_expire_time_seconds{kubernetes_pod_name=~\"$controller\",namespace=~\"$namespace\",ingress=~\"$ingress\"}) by (host) - time()", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ host }}", + "metric": "gke_letsencrypt_cert_expiration", + "refId": "A", + "step": 1 + } + ], + "title": "Ingress Certificate Expiry", + "transform": "timeseries_aggregations", + "type": "table-old" + } + ], + "refresh": "5s", + "schemaVersion": 37, + "style": "dark", + "tags": [ + "nginx" + ], + "templating": { + "list": [ + { + "allValue": ".*", + "current": { + "selected": false, + "text": "All", + "value": "$__all" + }, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "definition": "", + "hide": 0, + "includeAll": true, + "label": "Namespace", + "multi": false, + "name": "namespace", + "options": [], + "query": { + "query": "label_values(nginx_ingress_controller_config_hash, controller_namespace)", + "refId": "Prometheus-namespace-Variable-Query" + }, + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "sort": 0, + "tagValuesQuery": "", + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": ".*", + "current": { + "selected": false, + "text": "All", + "value": "$__all" + }, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "definition": "", + "hide": 0, + "includeAll": true, + "label": "Controller Class", + "multi": false, + "name": "controller_class", + "options": [], + "query": { + "query": "label_values(nginx_ingress_controller_config_hash{namespace=~\"$namespace\"}, controller_class) ", + "refId": "Prometheus-controller_class-Variable-Query" + }, + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "sort": 0, + "tagValuesQuery": "", + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": ".*", + "current": { + "selected": false, + "text": "All", + "value": "$__all" + }, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "definition": "", + "hide": 0, + "includeAll": true, + "label": "Controller", + "multi": false, + "name": "controller", + "options": [], + "query": { + "query": "label_values(nginx_ingress_controller_config_hash{namespace=~\"$namespace\",controller_class=~\"$controller_class\"}, controller_pod) ", + "refId": "Prometheus-controller-Variable-Query" + }, + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "sort": 0, + "tagValuesQuery": "", + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": ".*", + "current": { + "selected": false, + "text": "All", + "value": "$__all" + }, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "definition": "", + "hide": 0, + "includeAll": true, + "label": "Ingress", + "multi": false, + "name": "ingress", + "options": [], + "query": { + "query": "label_values(nginx_ingress_controller_requests{namespace=~\"$namespace\",controller_class=~\"$controller_class\",controller=~\"$controller\"}, ingress) ", + "refId": "Prometheus-ingress-Variable-Query" + }, + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "sort": 2, + "tagValuesQuery": "", + "tagsQuery": "", + "type": "query", + "useTags": false + } + ] + }, + "time": { + "from": "now-1h", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "2m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ], + "time_options": [ + "5m", + "15m", + "1h", + "6h", + "12h", + "24h", + "2d", + "7d", + "30d" + ] + }, + "timezone": "browser", + "title": "NGINX Ingress controller", + "uid": "nginx", + "version": 1, + "weekStart": "" + } +kind: ConfigMap +metadata: + labels: + grafana_dashboard: "1" + creationTimestamp: null + name: nginx-dashboard + namespace: kube-prometheus-stack \ No newline at end of file diff --git a/master/durpapi/Chart.yaml b/master/durpapi/Chart.yaml new file mode 100644 index 0000000..da0c67e --- /dev/null +++ b/master/durpapi/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +name: durpapi +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0-dev0184 +appVersion: 0.1.0 + +dependencies: +- condition: postgresql.enabled + version: 16.7.* + repository: https://charts.bitnami.com/bitnami + name: postgresql diff --git a/master/durpapi/templates/deployment.yaml b/master/durpapi/templates/deployment.yaml new file mode 100644 index 0000000..0f42dfb --- /dev/null +++ b/master/durpapi/templates/deployment.yaml @@ -0,0 +1,38 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Chart.Name }} + labels: + app: {{ .Chart.Name }} +spec: + revisionHistoryLimit: 1 + selector: + matchLabels: + app: {{ .Chart.Name }} + replicas: {{ .Values.deployment.hpa.minReplicas }} + template: + metadata: + labels: + app: {{ .Chart.Name }} + spec: + containers: + - name: api + image: "{{ .Values.deployment.image }}:{{ default .Chart.Version .Values.deployment.tag }}" + imagePullPolicy: {{ .Values.deployment.imagePullPolicy }} + readinessProbe: + {{- toYaml .Values.deployment.probe.readiness | nindent 12 }} + livenessProbe: + {{- toYaml .Values.deployment.probe.liveness | nindent 12 }} + startupProbe: + {{- toYaml .Values.deployment.probe.startup | nindent 12 }} + ports: + - name: http + containerPort: {{ .Values.service.targetport }} + env: + - name: host + value: {{ .Values.swagger.host }} + - name: version + value: {{ default .Chart.Version .Values.deployment.tag }} + envFrom: + - secretRef: + name: {{ .Values.deployment.secretfile }} diff --git a/master/durpapi/templates/hpa.yaml b/master/durpapi/templates/hpa.yaml new file mode 100644 index 0000000..68d484d --- /dev/null +++ b/master/durpapi/templates/hpa.yaml @@ -0,0 +1,24 @@ +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: "{{ .Chart.Name }}-hpa" +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ .Chart.Name }} + minReplicas: {{ .Values.deployment.hpa.minReplicas }} + maxReplicas: {{ .Values.deployment.hpa.maxReplicas }} + metrics: + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: 80 + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 40 diff --git a/master/durpapi/templates/ingress.yaml b/master/durpapi/templates/ingress.yaml new file mode 100644 index 0000000..bd268dd --- /dev/null +++ b/master/durpapi/templates/ingress.yaml @@ -0,0 +1,44 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: "{{ .Chart.Name }}-ingress" +spec: + entryPoints: + - websecure + routes: + - match: Host("api.durp.info") && PathPrefix(`/api`) + kind: Rule + middlewares: + - name: jwt + services: + - name: "durpapi-service" + port: 80 + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: "{{ .Chart.Name }}-swagger" +spec: + entryPoints: + - websecure + routes: + - match: Host("api.durp.info") && PathPrefix(`/swagger`) + kind: Rule + services: + - name: "durpapi-service" + port: 80 + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: jwt +spec: + plugin: + jwt: + Required: true + Keys: + - https://authentik.durp.info/application/o/api/jwks diff --git a/master/durpapi/templates/secrets.yaml b/master/durpapi/templates/secrets.yaml new file mode 100644 index 0000000..36946e9 --- /dev/null +++ b/master/durpapi/templates/secrets.yaml @@ -0,0 +1,39 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: durpapi-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: durpapi-secret + data: + - secretKey: db_host + remoteRef: + key: secrets/durpapi/postgres + property: db_host + - secretKey: db_port + remoteRef: + key: secrets/durpapi/postgres + property: db_port + - secretKey: db_pass + remoteRef: + key: secrets/durpapi/postgres + property: db_pass + - secretKey: db_user + remoteRef: + key: secrets/durpapi/postgres + property: db_user + - secretKey: db_sslmode + remoteRef: + key: secrets/durpapi/postgres + property: db_sslmode + - secretKey: db_name + remoteRef: + key: secrets/durpapi/postgres + property: db_name + - secretKey: llamaurl + remoteRef: + key: secrets/durpapi/llamaurl + property: llamaurl \ No newline at end of file diff --git a/master/durpapi/templates/service.yaml b/master/durpapi/templates/service.yaml new file mode 100644 index 0000000..2cab669 --- /dev/null +++ b/master/durpapi/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: "{{ .Chart.Name }}-service" +spec: + ports: + - name: http + port: {{ .Values.service.port }} + targetPort: {{ .Values.service.targetport }} + protocol: TCP + selector: + app: {{ .Chart.Name }} diff --git a/master/durpapi/values.yaml b/master/durpapi/values.yaml new file mode 100644 index 0000000..41b152b --- /dev/null +++ b/master/durpapi/values.yaml @@ -0,0 +1,39 @@ +ingress: + enabled: false +deployment: + image: registry.durp.info/developerdurp/durpapi + secretfile: durpapi-secret + imagePullPolicy: Always + hpa: + minReplicas: 3 + maxReplicas: 10 + probe: + readiness: + httpGet: + path: /health/gethealth + port: 8080 + liveness: + httpGet: + path: /health/gethealth + port: 8080 + startup: + httpGet: + path: /health/gethealth + port: 8080 +service: + type: ClusterIP + port: 80 + targetport: 8080 + +swagger: + host: api.durp.info +postgresql: + enabled: true + auth: + existingSecret: durpapi-secret + secretKeys: + adminPasswordKey: db_pass + userPasswordKey: db_pass + replicationPasswordKey: db_pass + database: postgres + username: postgres diff --git a/master/durpot/Chart.yaml b/master/durpot/Chart.yaml new file mode 100644 index 0000000..c21a834 --- /dev/null +++ b/master/durpot/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: durpapi +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: durpot + repository: https://gitlab.com/api/v4/projects/45025485/packages/helm/stable + version: 0.1.0-dev0038 diff --git a/master/durpot/templates/secrets.yaml b/master/durpot/templates/secrets.yaml new file mode 100644 index 0000000..f51273c --- /dev/null +++ b/master/durpot/templates/secrets.yaml @@ -0,0 +1,43 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: durpot-secert +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: durpot-secret + data: + - secretKey: OPENAI_API_KEY + remoteRef: + key: secrets/durpot/openai + property: OPENAI_API_KEY + - secretKey: BOTPREFIX + remoteRef: + key: secrets/durpot/discord + property: BOTPREFIX + - secretKey: ChannelID + remoteRef: + key: secrets/durpot/discord + property: ChannelID + - secretKey: TOKEN + remoteRef: + key: secrets/durpot/discord + property: TOKEN + - secretKey: ClientID + remoteRef: + key: secrets/durpot/auth + property: ClientID + - secretKey: Password + remoteRef: + key: secrets/durpot/auth + property: Password + - secretKey: TokenURL + remoteRef: + key: secrets/durpot/auth + property: TokenURL + - secretKey: Username + remoteRef: + key: secrets/durpot/auth + property: Username diff --git a/master/external-dns/Chart.yaml b/master/external-dns/Chart.yaml new file mode 100644 index 0000000..937bc49 --- /dev/null +++ b/master/external-dns/Chart.yaml @@ -0,0 +1,12 @@ + +apiVersion: v2 +name: external-dns +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-dns + repository: https://charts.bitnami.com/bitnami + version: 8.9.2 diff --git a/master/external-dns/templates/secrets.yaml b/master/external-dns/templates/secrets.yaml new file mode 100644 index 0000000..ba603aa --- /dev/null +++ b/master/external-dns/templates/secrets.yaml @@ -0,0 +1,23 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: external-dns-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: external-dns + data: + - secretKey: cloudflare_api_email + remoteRef: + key: secrets/external-dns/cloudflare + property: cloudflare_api_email + - secretKey: cloudflare_api_key + remoteRef: + key: secrets/external-dns/cloudflare + property: cloudflare_api_key + - secretKey: cloudflare_api_token + remoteRef: + key: secrets/external-dns/cloudflare + property: cloudflare_api_token diff --git a/master/external-dns/values.yaml b/master/external-dns/values.yaml new file mode 100644 index 0000000..68abe91 --- /dev/null +++ b/master/external-dns/values.yaml @@ -0,0 +1,16 @@ +external-dns: + global: + imageRegistry: "registry.internal.durp.info" + + image: + pullPolicy: Always + + sources: + - service + + provider: cloudflare + cloudflare: + secretName : "external-dns" + proxied: false + + policy: sync diff --git a/master/external-secrets/Chart.yaml b/master/external-secrets/Chart.yaml new file mode 100644 index 0000000..94104aa --- /dev/null +++ b/master/external-secrets/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: external-secrets +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-secrets + repository: https://charts.external-secrets.io + version: 0.17.0 + diff --git a/master/external-secrets/values.yaml b/master/external-secrets/values.yaml new file mode 100644 index 0000000..a720adb --- /dev/null +++ b/master/external-secrets/values.yaml @@ -0,0 +1,463 @@ +external-secrets: + replicaCount: 3 + + # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) + revisionHistoryLimit: 10 + + image: + repository: ghcr.io/external-secrets/external-secrets + pullPolicy: Always + # -- The image tag to use. The default is the chart appVersion. + # There are different image flavours available, like distroless and ubi. + # Please see GitHub release notes for image tags for these flavors. + # By default the distroless image is used. + tag: "" + + # -- If set, install and upgrade CRDs through helm chart. + installCRDs: true + + crds: + # -- If true, create CRDs for Cluster External Secret. + createClusterExternalSecret: true + # -- If true, create CRDs for Cluster Secret Store. + createClusterSecretStore: true + # -- If true, create CRDs for Push Secret. + createPushSecret: true + annotations: {} + conversion: + enabled: true + + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + + # -- If true, external-secrets will perform leader election between instances to ensure no more + # than one instance of external-secrets operates at a time. + leaderElect: true + + # -- If set external secrets will filter matching + # Secret Stores with the appropriate controller values. + controllerClass: "" + + # -- If true external secrets will use recommended kubernetes + # annotations as prometheus metric labels. + extendedMetricLabels: false + + # -- If set external secrets are only reconciled in the + # provided namespace + scopedNamespace: "" + + # -- Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace + # and implicitly disable cluster stores and cluster external secrets + scopedRBAC: false + + # -- if true, the operator will process cluster external secret. Else, it will ignore them. + processClusterExternalSecret: true + + # -- if true, the operator will process cluster store. Else, it will ignore them. + processClusterStore: true + + # -- Specifies whether an external secret operator deployment be created. + createOperator: true + + # -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at + # a time. + concurrent: 1 + + serviceAccount: + # -- Specifies whether a service account should be created. + create: true + # -- Automounts the service account token in all containers of the pod + automount: true + # -- Annotations to add to the service account. + annotations: {} + # -- Extra Labels to add to the service account. + extraLabels: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + + rbac: + # -- Specifies whether role and rolebinding resources should be created. + create: true + + ## -- Extra environment variables to add to container. + extraEnv: [] + + ## -- Map of extra arguments to pass to container. + extraArgs: {} + + ## -- Extra volumes to pass to pod. + extraVolumes: [] + + ## -- Extra volumes to mount to the container. + extraVolumeMounts: [] + + ## -- Extra containers to add to the pod. + extraContainers: [] + + # -- Annotations to add to Deployment + deploymentAnnotations: {} + + # -- Annotations to add to Pod + podAnnotations: {} + + podLabels: {} + + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + + resources: {} + # requests: + # cpu: 10m + # memory: 32Mi + + prometheus: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. + enabled: false + service: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. + port: 8080 + + serviceMonitor: + # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics + enabled: false + + # -- namespace where you want to install ServiceMonitors + namespace: "" + + # -- Additional labels + additionalLabels: {} + + # -- Interval to scrape metrics + interval: 30s + + # -- Timeout if metrics can't be retrieved in given time interval + scrapeTimeout: 25s + + # -- Let prometheus add an exported_ prefix to conflicting labels + honorLabels: false + + # -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) + metricRelabelings: [] + # - action: replace + # regex: (.*) + # replacement: $1 + # sourceLabels: + # - exported_namespace + # targetLabel: namespace + + # -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) + relabelings: [] + # - sourceLabels: [__meta_kubernetes_pod_node_name] + # separator: ; + # regex: ^(.*)$ + # targetLabel: nodename + # replacement: $1 + # action: replace + + metrics: + service: + # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics + enabled: false + + # -- Metrics service port to scrape + port: 8080 + + # -- Additional service annotations + annotations: {} + + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # -- Pod priority class name. + priorityClassName: "" + + # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ + podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 1 + + # -- Run the controller on the host network + hostNetwork: false + + webhook: + # -- Specifies whether a webhook deployment be created. + create: true + # -- Specifices the time to check if the cert is valid + certCheckInterval: "5m" + # -- Specifices the lookaheadInterval for certificate validity + lookaheadInterval: "" + replicaCount: 1 + + # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) + revisionHistoryLimit: 10 + + certDir: /tmp/certs + # -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore + failurePolicy: Fail + # -- Specifies if webhook pod should use hostNetwork or not. + hostNetwork: false + image: + repository: ghcr.io/external-secrets/external-secrets + pullPolicy: IfNotPresent + # -- The image tag to use. The default is the chart appVersion. + tag: "" + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + # -- The port the webhook will listen to + port: 10250 + rbac: + # -- Specifies whether role and rolebinding resources should be created. + create: true + serviceAccount: + # -- Specifies whether a service account should be created. + create: true + # -- Automounts the service account token in all containers of the pod + automount: true + # -- Annotations to add to the service account. + annotations: {} + # -- Extra Labels to add to the service account. + extraLabels: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # -- Pod priority class name. + priorityClassName: "" + + # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ + podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 1 + prometheus: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + enabled: false + service: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + port: 8080 + + serviceMonitor: + # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics + enabled: false + + # -- Additional labels + additionalLabels: {} + + # -- Interval to scrape metrics + interval: 30s + + # -- Timeout if metrics can't be retrieved in given time interval + scrapeTimeout: 25s + + metrics: + service: + # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics + enabled: false + + # -- Metrics service port to scrape + port: 8080 + + # -- Additional service annotations + annotations: {} + + + readinessProbe: + # -- Address for readiness probe + address: "" + # -- ReadinessProbe port for kubelet + port: 8081 + + + ## -- Extra environment variables to add to container. + extraEnv: [] + + ## -- Map of extra arguments to pass to container. + extraArgs: {} + + ## -- Extra volumes to pass to pod. + extraVolumes: [] + + ## -- Extra volumes to mount to the container. + extraVolumeMounts: [] + + # -- Annotations to add to Secret + secretAnnotations: {} + + # -- Annotations to add to Deployment + deploymentAnnotations: {} + + # -- Annotations to add to Pod + podAnnotations: {} + + podLabels: {} + + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + + resources: {} + # requests: + # cpu: 10m + # memory: 32Mi + + certController: + # -- Specifies whether a certificate controller deployment be created. + create: true + requeueInterval: "5m" + replicaCount: 1 + + # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) + revisionHistoryLimit: 10 + + image: + repository: ghcr.io/external-secrets/external-secrets + pullPolicy: Always + tag: "" + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + rbac: + # -- Specifies whether role and rolebinding resources should be created. + create: true + serviceAccount: + # -- Specifies whether a service account should be created. + create: true + # -- Automounts the service account token in all containers of the pod + automount: true + # -- Annotations to add to the service account. + annotations: {} + # -- Extra Labels to add to the service account. + extraLabels: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # -- Run the certController on the host network + hostNetwork: false + + # -- Pod priority class name. + priorityClassName: "" + + # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ + podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 1 + + prometheus: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + enabled: false + service: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + port: 8080 + + serviceMonitor: + # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics + enabled: false + + # -- Additional labels + additionalLabels: {} + + # -- Interval to scrape metrics + interval: 30s + + # -- Timeout if metrics can't be retrieved in given time interval + scrapeTimeout: 25s + + metrics: + service: + # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics + enabled: false + + # -- Metrics service port to scrape + port: 8080 + + # -- Additional service annotations + annotations: {} + + ## -- Extra environment variables to add to container. + extraEnv: [] + + ## -- Map of extra arguments to pass to container. + extraArgs: {} + + + ## -- Extra volumes to pass to pod. + extraVolumes: [] + + ## -- Extra volumes to mount to the container. + extraVolumeMounts: [] + + # -- Annotations to add to Deployment + deploymentAnnotations: {} + + # -- Annotations to add to Pod + podAnnotations: {} + + podLabels: {} + + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + + resources: {} + # requests: + # cpu: 10m + # memory: 32Mi + + # -- Specifies `dnsOptions` to deployment + dnsConfig: {} diff --git a/master/gatekeeper/Chart.yaml b/master/gatekeeper/Chart.yaml new file mode 100644 index 0000000..351da14 --- /dev/null +++ b/master/gatekeeper/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: gatekeeper +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: gatekeeper + repository: https://open-policy-agent.github.io/gatekeeper/charts + version: 3.21.0 diff --git a/master/gatekeeper/values.yaml b/master/gatekeeper/values.yaml new file mode 100644 index 0000000..0b0c6e7 --- /dev/null +++ b/master/gatekeeper/values.yaml @@ -0,0 +1,278 @@ +#gatekeeper: +# replicas: 3 +# revisionHistoryLimit: 10 +# auditInterval: 60 +# metricsBackends: ["prometheus"] +# auditMatchKindOnly: false +# constraintViolationsLimit: 20 +# auditFromCache: false +# disableMutation: false +# disableValidatingWebhook: false +# validatingWebhookName: gatekeeper-validating-webhook-configuration +# validatingWebhookTimeoutSeconds: 3 +# validatingWebhookFailurePolicy: Ignore +# validatingWebhookAnnotations: {} +# validatingWebhookExemptNamespacesLabels: {} +# validatingWebhookObjectSelector: {} +# validatingWebhookCheckIgnoreFailurePolicy: Fail +# validatingWebhookCustomRules: {} +# validatingWebhookURL: null +# enableDeleteOperations: false +# enableExternalData: true +# enableGeneratorResourceExpansion: true +# enableTLSHealthcheck: false +# maxServingThreads: -1 +# mutatingWebhookName: gatekeeper-mutating-webhook-configuration +# mutatingWebhookFailurePolicy: Ignore +# mutatingWebhookReinvocationPolicy: Never +# mutatingWebhookAnnotations: {} +# mutatingWebhookExemptNamespacesLabels: {} +# mutatingWebhookObjectSelector: {} +# mutatingWebhookTimeoutSeconds: 1 +# mutatingWebhookCustomRules: {} +# mutatingWebhookURL: null +# mutationAnnotations: false +# auditChunkSize: 500 +# logLevel: INFO +# logDenies: false +# logMutations: false +# emitAdmissionEvents: false +# emitAuditEvents: false +# admissionEventsInvolvedNamespace: false +# auditEventsInvolvedNamespace: false +# resourceQuota: true +# externaldataProviderResponseCacheTTL: 3m +# image: +# repository: openpolicyagent/gatekeeper +# crdRepository: openpolicyagent/gatekeeper-crds +# release: v3.15.0-beta.0 +# pullPolicy: Always +# pullSecrets: [] +# preInstall: +# crdRepository: +# image: +# repository: null +# tag: v3.15.0-beta.0 +# postUpgrade: +# labelNamespace: +# enabled: false +# image: +# repository: openpolicyagent/gatekeeper-crds +# tag: v3.15.0-beta.0 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# extraNamespaces: [] +# podSecurity: ["pod-security.kubernetes.io/audit=restricted", +# "pod-security.kubernetes.io/audit-version=latest", +# "pod-security.kubernetes.io/warn=restricted", +# "pod-security.kubernetes.io/warn-version=latest", +# "pod-security.kubernetes.io/enforce=restricted", +# "pod-security.kubernetes.io/enforce-version=v1.24"] +# extraAnnotations: {} +# priorityClassName: "" +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: {} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# postInstall: +# labelNamespace: +# enabled: true +# extraRules: [] +# image: +# repository: openpolicyagent/gatekeeper-crds +# tag: v3.15.0-beta.0 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# extraNamespaces: [] +# podSecurity: ["pod-security.kubernetes.io/audit=restricted", +# "pod-security.kubernetes.io/audit-version=latest", +# "pod-security.kubernetes.io/warn=restricted", +# "pod-security.kubernetes.io/warn-version=latest", +# "pod-security.kubernetes.io/enforce=restricted", +# "pod-security.kubernetes.io/enforce-version=v1.24"] +# extraAnnotations: {} +# priorityClassName: "" +# probeWebhook: +# enabled: true +# image: +# repository: curlimages/curl +# tag: 7.83.1 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# waitTimeout: 60 +# httpTimeout: 2 +# insecureHTTPS: false +# priorityClassName: "" +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# preUninstall: +# deleteWebhookConfigurations: +# extraRules: [] +# enabled: false +# image: +# repository: openpolicyagent/gatekeeper-crds +# tag: v3.15.0-beta.0 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# priorityClassName: "" +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: {} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# podAnnotations: {} +# auditPodAnnotations: {} +# podLabels: {} +# podCountLimit: "100" +# secretAnnotations: {} +# enableRuntimeDefaultSeccompProfile: true +# controllerManager: +# exemptNamespaces: [] +# exemptNamespacePrefixes: [] +# hostNetwork: false +# dnsPolicy: ClusterFirst +# port: 8443 +# metricsPort: 8888 +# healthPort: 9090 +# readinessTimeout: 1 +# livenessTimeout: 1 +# priorityClassName: system-cluster-critical +# disableCertRotation: false +# tlsMinVersion: 1.3 +# clientCertName: "" +# strategyType: RollingUpdate +# affinity: +# podAntiAffinity: +# preferredDuringSchedulingIgnoredDuringExecution: +# - podAffinityTerm: +# labelSelector: +# matchExpressions: +# - key: gatekeeper.sh/operation +# operator: In +# values: +# - webhook +# topologyKey: kubernetes.io/hostname +# weight: 100 +# topologySpreadConstraints: [] +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: +# limits: +# memory: 512Mi +# requests: +# cpu: 100m +# memory: 512Mi +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# podSecurityContext: +# fsGroup: 999 +# supplementalGroups: +# - 999 +# extraRules: [] +# networkPolicy: +# enabled: false +# ingress: { } +# # - from: +# # - ipBlock: +# # cidr: 0.0.0.0/0 +# audit: +# enablePubsub: false +# connection: audit-connection +# channel: audit-channel +# hostNetwork: false +# dnsPolicy: ClusterFirst +# metricsPort: 8888 +# healthPort: 9090 +# readinessTimeout: 1 +# livenessTimeout: 1 +# priorityClassName: system-cluster-critical +# disableCertRotation: false +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: +# limits: +# memory: 512Mi +# requests: +# cpu: 100m +# memory: 512Mi +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# podSecurityContext: +# fsGroup: 999 +# supplementalGroups: +# - 999 +# writeToRAMDisk: false +# extraRules: [] +# crds: +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: {} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 65532 +# runAsNonRoot: true +# runAsUser: 65532 +# pdb: +# controllerManager: +# minAvailable: 1 +# service: {} +# disabledBuiltins: ["{http.send}"] +# psp: +# enabled: true +# upgradeCRDs: +# enabled: true +# extraRules: [] +# priorityClassName: "" +# rbac: +# create: true +# externalCertInjection: +# enabled: false +# secretName: gatekeeper-webhook-server-cert +# \ No newline at end of file diff --git a/master/gitlab-runner/Chart.yaml b/master/gitlab-runner/Chart.yaml new file mode 100644 index 0000000..2915b96 --- /dev/null +++ b/master/gitlab-runner/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: gitlab-runner +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: gitlab-runner + repository: https://charts.gitlab.io/ + version: 0.77.2 diff --git a/master/gitlab-runner/templates/secrets.yaml b/master/gitlab-runner/templates/secrets.yaml new file mode 100644 index 0000000..3477844 --- /dev/null +++ b/master/gitlab-runner/templates/secrets.yaml @@ -0,0 +1,19 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: gitlab-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: gitlab-secret + data: + - secretKey: runner-registration-token + remoteRef: + key: secrets/gitlab/runner + property: runner-registration-token + - secretKey: runner-token + remoteRef: + key: secrets/gitlab/runner + property: runner-token diff --git a/master/gitlab-runner/values.yaml b/master/gitlab-runner/values.yaml new file mode 100644 index 0000000..9535eb7 --- /dev/null +++ b/master/gitlab-runner/values.yaml @@ -0,0 +1,71 @@ +gitlab-runner: + + image: + registry: registry.internal.durp.info + image: gitlab-org/gitlab-runner + + imagePullPolicy: Always + gitlabUrl: https://gitlab.com/ + unregisterRunner: false + terminationGracePeriodSeconds: 3600 + concurrent: 10 + checkInterval: 30 + + rbac: + create: true + rules: [] + clusterWideAccess: false + podSecurityPolicy: + enabled: false + resourceNames: + - gitlab-runner + + metrics: + enabled: true + serviceMonitor: + enabled: true + service: + enabled: true + annotations: {} + + runners: + config: | + [[runners]] + [runners.kubernetes] + namespace = "{{.Release.Namespace}}" + image = "ubuntu:22.04" + privileged = true + + executor: kubernetes + name: "k3s" + runUntagged: true + privileged: true + secret: gitlab-secret + #builds: + #cpuLimit: 200m + #cpuLimitOverwriteMaxAllowed: 400m + #memoryLimit: 256Mi + #memoryLimitOverwriteMaxAllowed: 512Mi + #cpuRequests: 100m + #cpuRequestsOverwriteMaxAllowed: 200m + #memoryRequests: 128Mi + #memoryRequestsOverwriteMaxAllowed: 256Mi + + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + runAsNonRoot: true + privileged: false + capabilities: + drop: ["ALL"] + + podSecurityContext: + runAsUser: 100 + fsGroup: 65533 + + resources: + limits: + memory: 2Gi + requests: + memory: 128Mi + cpu: 500m diff --git a/master/heimdall/Chart.yaml b/master/heimdall/Chart.yaml new file mode 100644 index 0000000..39dbf54 --- /dev/null +++ b/master/heimdall/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: heimdall +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: heimdall + repository: https://djjudas21.github.io/charts/ + version: 8.5.4 diff --git a/master/heimdall/templates/ingress.yaml b/master/heimdall/templates/ingress.yaml new file mode 100644 index 0000000..98b6144 --- /dev/null +++ b/master/heimdall/templates/ingress.yaml @@ -0,0 +1,52 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + annotations: + name: heimdall-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`heimdall.durp.info`) && PathPrefix(`/`) + middlewares: + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: heimdall + port: 80 + - match: Host(`heimdall.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: heimdall-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: heimdall-tls +spec: + secretName: heimdall-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "heimdall.durp.info" + dnsNames: + - "heimdall.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: heimdall-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: heimdall.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/heimdall/values.yaml b/master/heimdall/values.yaml new file mode 100644 index 0000000..e93ca43 --- /dev/null +++ b/master/heimdall/values.yaml @@ -0,0 +1,28 @@ +heimdall: + + image: + registry: + repository: registry.internal.durp.info/linuxserver/heimdall + pullPolicy: Always + + env: + TZ: UTC + PUID: "1000" + PGID: "1000" + + service: + main: + annotations: + external-dns.alpha.kubernetes.io/hostname: heimdall.durp.info + external-dns.alpha.kubernetes.io/target: home.durp.info + ports: + http: + port: 80 + + ingress: + main: + enabled: false + + persistence: + config: + enabled: true diff --git a/master/internalproxy/Chart.yaml b/master/internalproxy/Chart.yaml new file mode 100644 index 0000000..71c9b0d --- /dev/null +++ b/master/internalproxy/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: internalproxy +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "0.1.0" diff --git a/master/internalproxy/templates/argocd.yaml b/master/internalproxy/templates/argocd.yaml new file mode 100644 index 0000000..9a82e9e --- /dev/null +++ b/master/internalproxy/templates/argocd.yaml @@ -0,0 +1,46 @@ +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: argocd-ingress +# annotations: +# cert-manager.io/cluster-issuer: letsencrypt-production +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`argocd.internal.durp.info`) +# middlewares: +# - name: whitelist +# namespace: traefik +# kind: Rule +# services: +# - name: argocd-server +# port: 443 +# scheme: https +# tls: +# secretName: argocd-tls +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: argocd-server +#spec: +# type: ExternalName +# externalName: argocd-server.argocd.svc.cluster.local +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: argocd-tls +#spec: +# secretName: argocd-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "argocd.internal.durp.info" +# dnsNames: +# - "argocd.internal.durp.info" \ No newline at end of file diff --git a/master/internalproxy/templates/blueiris.yaml b/master/internalproxy/templates/blueiris.yaml new file mode 100644 index 0000000..5f120c9 --- /dev/null +++ b/master/internalproxy/templates/blueiris.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: blueiris +spec: + ports: + - name: app + port: 81 + protocol: TCP + targetPort: 81 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: blueiris +subsets: + - addresses: + - ip: 192.168.99.2 + ports: + - name: app + port: 81 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: blueiris-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`blueiris.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: blueiris + port: 81 + scheme: http + tls: + secretName: blueiris-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: blueiris-tls +spec: + secretName: blueiris-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "blueiris.internal.durp.info" + dnsNames: + - "blueiris.internal.durp.info" diff --git a/master/internalproxy/templates/duplicati-ingress.yaml b/master/internalproxy/templates/duplicati-ingress.yaml new file mode 100644 index 0000000..de08a38 --- /dev/null +++ b/master/internalproxy/templates/duplicati-ingress.yaml @@ -0,0 +1,70 @@ +apiVersion: v1 +kind: Service +metadata: + name: duplicati +spec: + ports: + - name: app + port: 8200 + protocol: TCP + targetPort: 8200 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: duplicati +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8200 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: duplicati-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: duplicati + port: 8200 + - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-master-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: duplicati-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: duplicati-tls +spec: + secretName: duplicati-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "duplicati.internal.durp.info" + dnsNames: + - "duplicati.internal.durp.info" diff --git a/master/internalproxy/templates/gitea.yaml b/master/internalproxy/templates/gitea.yaml new file mode 100644 index 0000000..0bde4e4 --- /dev/null +++ b/master/internalproxy/templates/gitea.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: gitea +spec: + ports: + - name: app + port: 3000 + protocol: TCP + targetPort: 3000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: gitea +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 3000 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: gitea-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`gitea.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: gitea + port: 3000 + scheme: http + tls: + secretName: gitea-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gitea-tls +spec: + secretName: gitea-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "gitea.durp.info" + dnsNames: + - "gitea.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: gitea-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: gitea.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/infra.yaml b/master/internalproxy/templates/infra.yaml new file mode 100644 index 0000000..51f6a91 --- /dev/null +++ b/master/internalproxy/templates/infra.yaml @@ -0,0 +1,60 @@ +apiVersion: v1 +kind: Service +metadata: + name: infra +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: infra +subsets: + - addresses: + - ip: 192.168.12.130 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: infra-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`*.infra.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra + port: 443 + scheme: https + tls: + secretName: infra-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: infra-tls +spec: + secretName: infra-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "infra.durp.info" + dnsNames: + - "*.infra.durp.info" diff --git a/master/internalproxy/templates/jellyfin.yaml b/master/internalproxy/templates/jellyfin.yaml new file mode 100644 index 0000000..709b50a --- /dev/null +++ b/master/internalproxy/templates/jellyfin.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: jellyfin +spec: + ports: + - name: app + port: 8096 + protocol: TCP + targetPort: 8096 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: jellyfin +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8096 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: jellyfin-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`jellyfin.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: jellyfin + port: 8096 + scheme: http + tls: + secretName: jellyfin-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: jellyfin-tls +spec: + secretName: jellyfin-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "jellyfin.durp.info" + dnsNames: + - "jellyfin.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: jellyfin-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: jellyfin.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/kasm.yaml b/master/internalproxy/templates/kasm.yaml new file mode 100644 index 0000000..7f756e0 --- /dev/null +++ b/master/internalproxy/templates/kasm.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: kasm +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: kasm +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: kasm-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kasm.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: kasm + port: 443 + scheme: https + tls: + secretName: kasm-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kasm-tls +spec: + secretName: kasm-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "kasm.durp.info" + dnsNames: + - "kasm.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: kasm-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: kasm.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/minio.yaml b/master/internalproxy/templates/minio.yaml new file mode 100644 index 0000000..71dd261 --- /dev/null +++ b/master/internalproxy/templates/minio.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: minio +spec: + ports: + - name: app + port: 9769 + protocol: TCP + targetPort: 9769 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: minio +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 9769 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: minio-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`minio.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: minio + port: 9769 + scheme: http + tls: + secretName: minio-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: minio-tls +spec: + secretName: minio-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "minio.internal.durp.info" + dnsNames: + - "minio.internal.durp.info" diff --git a/master/internalproxy/templates/nexus.yaml b/master/internalproxy/templates/nexus.yaml new file mode 100644 index 0000000..5d3632e --- /dev/null +++ b/master/internalproxy/templates/nexus.yaml @@ -0,0 +1,71 @@ +apiVersion: v1 +kind: Service +metadata: + name: nexus +spec: + ports: + - name: app + port: 8081 + protocol: TCP + targetPort: 8081 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: nexus +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8081 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: nexus-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`nexus.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: nexus + port: 8081 + tls: + secretName: nexus-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: nexus-tls +spec: + secretName: nexus-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "nexus.durp.info" + dnsNames: + - "nexus.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: nexus-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: nexus.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/octopus.yaml b/master/internalproxy/templates/octopus.yaml new file mode 100644 index 0000000..e0e5d78 --- /dev/null +++ b/master/internalproxy/templates/octopus.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: octopus +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: octopus +subsets: + - addresses: + - ip: 192.168.20.105 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: octopus-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`octopus.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: octopus + port: 443 + scheme: https + tls: + secretName: octopus-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: octopus-tls +spec: + secretName: octopus-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "octopus.internal.durp.info" + dnsNames: + - "octopus.internal.durp.info" diff --git a/master/internalproxy/templates/ollama.yaml b/master/internalproxy/templates/ollama.yaml new file mode 100644 index 0000000..b845cac --- /dev/null +++ b/master/internalproxy/templates/ollama.yaml @@ -0,0 +1,102 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: ollama-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: ollama-secret + data: + - secretKey: users + remoteRef: + key: secrets/internalproxy/ollama + property: users + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: ollama-basic-auth +spec: + basicAuth: + headerField: x-api-key + secret: ollama-secret + +--- + +apiVersion: v1 +kind: Service +metadata: + name: ollama +spec: + ports: + - name: app + port: 11435 + protocol: TCP + targetPort: 11435 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: ollama +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 11435 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: ollama-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`ollama.durp.info`) && PathPrefix(`/`) + middlewares: + - name: ollama-basic-auth + kind: Rule + services: + - name: ollama + port: 11435 + tls: + secretName: ollama-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: ollama-tls +spec: + secretName: ollama-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "ollama.durp.info" + dnsNames: + - "ollama.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: ollama-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: ollama.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/plex.yaml b/master/internalproxy/templates/plex.yaml new file mode 100644 index 0000000..45bba44 --- /dev/null +++ b/master/internalproxy/templates/plex.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: plex +spec: + ports: + - name: app + port: 32400 + protocol: TCP + targetPort: 32400 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: plex +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 32400 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: plex-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`plex.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: plex + port: 32400 + scheme: https + tls: + secretName: plex-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: plex-tls +spec: + secretName: plex-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "plex.durp.info" + dnsNames: + - "plex.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: plex-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: plex.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/portainer.yaml b/master/internalproxy/templates/portainer.yaml new file mode 100644 index 0000000..5c22061 --- /dev/null +++ b/master/internalproxy/templates/portainer.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: portainer +spec: + ports: + - name: app + port: 9443 + protocol: TCP + targetPort: 9443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: portainer +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 9443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: portainer-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: portainer + port: 9443 + scheme: https + tls: + secretName: portainer-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: portainer-tls +spec: + secretName: portainer-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "portainer.internal.durp.info" + dnsNames: + - "portainer.internal.durp.info" diff --git a/master/internalproxy/templates/proxmox.yaml b/master/internalproxy/templates/proxmox.yaml new file mode 100644 index 0000000..d61f416 --- /dev/null +++ b/master/internalproxy/templates/proxmox.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: proxmox +spec: + ports: + - name: app + port: 8006 + protocol: TCP + targetPort: 8006 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: proxmox +subsets: + - addresses: + - ip: 192.168.21.254 + ports: + - name: app + port: 8006 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: proxmox-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`proxmox.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: proxmox + port: 8006 + scheme: https + tls: + secretName: proxmox-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: proxmox-tls +spec: + secretName: proxmox-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "proxmox.internal.durp.info" + dnsNames: + - "proxmox.internal.durp.info" diff --git a/master/internalproxy/templates/redlib.yaml b/master/internalproxy/templates/redlib.yaml new file mode 100644 index 0000000..b71e4c3 --- /dev/null +++ b/master/internalproxy/templates/redlib.yaml @@ -0,0 +1,68 @@ +apiVersion: v1 +kind: Service +metadata: + name: redlib +spec: + ports: + - name: app + port: 8082 + protocol: TCP + targetPort: 8082 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: redlib +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8082 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: redlib-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`redlib.durp.info`) && PathPrefix(`/`) + middlewares: + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: redlib + port: 8082 + - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: redlib-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: redlib-tls +spec: + secretName: redlib-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "redlib.durp.info" + dnsNames: + - "redlib.durp.info" diff --git a/master/internalproxy/templates/registry-internal.yaml b/master/internalproxy/templates/registry-internal.yaml new file mode 100644 index 0000000..c32c167 --- /dev/null +++ b/master/internalproxy/templates/registry-internal.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: Service +metadata: + name: registry-internal +spec: + ports: + - name: app + port: 5000 + protocol: TCP + targetPort: 5000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: registry-internal +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 5000 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: registry-internal-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`registry.internal.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: registry-internal + port: 5000 + tls: + secretName: registry-internal-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: registry-internal-tls +spec: + secretName: registry-internal-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "registry.internal.durp.info" + dnsNames: + - "registry.internal.durp.info" diff --git a/master/internalproxy/templates/registry.yaml b/master/internalproxy/templates/registry.yaml new file mode 100644 index 0000000..1906614 --- /dev/null +++ b/master/internalproxy/templates/registry.yaml @@ -0,0 +1,71 @@ +apiVersion: v1 +kind: Service +metadata: + name: registry +spec: + ports: + - name: app + port: 5000 + protocol: TCP + targetPort: 5000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: registry +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 5000 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: registry-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`registry.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: registry + port: 5000 + tls: + secretName: registry-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: registry-tls +spec: + secretName: registry-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "registry.durp.info" + dnsNames: + - "registry.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: registry-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: registry.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/s3.yaml b/master/internalproxy/templates/s3.yaml new file mode 100644 index 0000000..e48d6ce --- /dev/null +++ b/master/internalproxy/templates/s3.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: s3 +spec: + ports: + - name: app + port: 9768 + protocol: TCP + targetPort: 9768 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: s3 +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 9768 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: s3-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`s3.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: s3 + port: 9768 + scheme: http + tls: + secretName: s3-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: s3-tls +spec: + secretName: s3-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "s3.internal.durp.info" + dnsNames: + - "s3.internal.durp.info" diff --git a/master/internalproxy/templates/semaphore.yaml b/master/internalproxy/templates/semaphore.yaml new file mode 100644 index 0000000..e7256da --- /dev/null +++ b/master/internalproxy/templates/semaphore.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: semaphore +spec: + ports: + - name: app + port: 3001 + protocol: TCP + targetPort: 3001 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: semaphore +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 3001 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: semaphore-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: semaphore + port: 3001 + scheme: http + tls: + secretName: semaphore-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: semaphore-tls +spec: + secretName: semaphore-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "semaphore.internal.durp.info" + dnsNames: + - "semaphore.internal.durp.info" diff --git a/master/internalproxy/templates/smokeping.yaml b/master/internalproxy/templates/smokeping.yaml new file mode 100644 index 0000000..9840993 --- /dev/null +++ b/master/internalproxy/templates/smokeping.yaml @@ -0,0 +1,82 @@ +apiVersion: v1 +kind: Service +metadata: + name: smokeping +spec: + ports: + - name: app + port: 81 + protocol: TCP + targetPort: 81 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: smokeping +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 81 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: smokeping-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: smokeping + port: 81 + - match: Host(`smokeping.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: smokeping-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: smokeping-tls +spec: + secretName: smokeping-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "smokeping.durp.info" + dnsNames: + - "smokeping.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: smokeping-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/speedtest.yaml b/master/internalproxy/templates/speedtest.yaml new file mode 100644 index 0000000..275b708 --- /dev/null +++ b/master/internalproxy/templates/speedtest.yaml @@ -0,0 +1,74 @@ +apiVersion: v1 +kind: Service +metadata: + name: speedtest +spec: + ports: + - name: app + port: 6580 + protocol: TCP + targetPort: 6580 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: speedtest +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 6580 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: speedtest-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: speedtest + port: 6580 + tls: + secretName: speedtest-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: speedtest-tls +spec: + secretName: speedtest-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "speedtest.durp.info" + dnsNames: + - "speedtest.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: speedtest-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/tdarr.yaml b/master/internalproxy/templates/tdarr.yaml new file mode 100644 index 0000000..96eca07 --- /dev/null +++ b/master/internalproxy/templates/tdarr.yaml @@ -0,0 +1,67 @@ +apiVersion: v1 +kind: Service +metadata: + name: tdarr +spec: + ports: + - name: app + port: 8267 + protocol: TCP + targetPort: 8267 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: tdarr +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8267 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: tdarr-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`tdarr.internal.durp.info`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: tdarr + port: 8267 + scheme: http + tls: + secretName: tdarr-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: tdarr-tls +spec: + secretName: tdarr-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "tdarr.internal.durp.info" + dnsNames: + - "tdarr.internal.durp.info" diff --git a/master/internalproxy/templates/unifi.yaml b/master/internalproxy/templates/unifi.yaml new file mode 100644 index 0000000..76c3110 --- /dev/null +++ b/master/internalproxy/templates/unifi.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: unifi +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: unifi +subsets: + - addresses: + - ip: 192.168.20.1 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: unifi-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`unifi.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: unifi + port: 443 + scheme: https + tls: + secretName: unifi-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: unifi-tls +spec: + secretName: unifi-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "unifi.internal.durp.info" + dnsNames: + - "unifi.internal.durp.info" diff --git a/master/internalproxy/templates/unraid.yaml b/master/internalproxy/templates/unraid.yaml new file mode 100644 index 0000000..c5cde07 --- /dev/null +++ b/master/internalproxy/templates/unraid.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: unraid +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: unraid +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: unraid-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`unraid.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: unraid + port: 443 + scheme: https + tls: + secretName: unraid-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: unraid-tls +spec: + secretName: unraid-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "unraid.internal.durp.info" + dnsNames: + - "unraid.internal.durp.info" diff --git a/master/internalproxy/templates/vault.yaml b/master/internalproxy/templates/vault.yaml new file mode 100644 index 0000000..af97b25 --- /dev/null +++ b/master/internalproxy/templates/vault.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: root-vault +spec: + ports: + - name: app + port: 8201 + protocol: TCP + targetPort: 8201 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: root-vault +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8201 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: root-vault-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`root-vault.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: root-vault + port: 8201 + scheme: https + tls: + secretName: root-vault-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: root-vault-tls +spec: + secretName: root-vault-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "root-vault.internal.durp.info" + dnsNames: + - "root-vault.internal.durp.info" diff --git a/master/internalproxy/templates/wazuh.yaml b/master/internalproxy/templates/wazuh.yaml new file mode 100644 index 0000000..5a5d853 --- /dev/null +++ b/master/internalproxy/templates/wazuh.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: wazuh +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: wazuh +subsets: + - addresses: + - ip: 192.168.20.102 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: wazuh-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`wazuh.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: wazuh + port: 443 + scheme: https + tls: + secretName: wazuh-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wazuh-tls +spec: + secretName: wazuh-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "wazuh.internal.durp.info" + dnsNames: + - "wazuh.internal.durp.info" diff --git a/master/krakend/Chart.yaml b/master/krakend/Chart.yaml new file mode 100644 index 0000000..d998c9f --- /dev/null +++ b/master/krakend/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: krakend +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" \ No newline at end of file diff --git a/master/krakend/templates/deployments.yaml b/master/krakend/templates/deployments.yaml new file mode 100644 index 0000000..ce50302 --- /dev/null +++ b/master/krakend/templates/deployments.yaml @@ -0,0 +1,39 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: krakend + name: krakend + labels: + app: krakend +spec: + selector: + matchLabels: + app: krakend + replicas: 1 + template: + metadata: + labels: + app: krakend + spec: + volumes: + - name: krakend-secret + secret: + secretName: krakend-secret + containers: + - name: krakend + image: registry.internal.durp.info/devopsfaith/krakend:2.4.3 + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /__health + port: 8080 + readinessProbe: + httpGet: + path: /__health + port: 8080 + ports: + - name: http + containerPort: 8080 + volumeMounts: + - name: krakend-secret + mountPath: /etc/krakend \ No newline at end of file diff --git a/master/krakend/templates/ingress.yaml b/master/krakend/templates/ingress.yaml new file mode 100644 index 0000000..a8c08eb --- /dev/null +++ b/master/krakend/templates/ingress.yaml @@ -0,0 +1,56 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: api-tls +spec: + secretName: api-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "api.durp.info" + dnsNames: + - "api.durp.info" + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: krakend-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`api.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: krakend-service + port: 8080 + scheme: http + tls: + secretName: api-tls + +--- + +kind: Service +apiVersion: v1 +metadata: + name: api-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: api.durp.info +spec: + type: ExternalName + externalName: durp.info + +--- + +kind: Service +apiVersion: v1 +metadata: + name: api-developer-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: developer.durp.info + external-dns.alpha.kubernetes.io/cloudflare-proxied: "false" +spec: + type: ExternalName + externalName: developerdurp.github.io diff --git a/master/krakend/templates/secrets.yaml b/master/krakend/templates/secrets.yaml new file mode 100644 index 0000000..073e590 --- /dev/null +++ b/master/krakend/templates/secrets.yaml @@ -0,0 +1,15 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: krakend-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: krakend-secret + data: + - secretKey: krakend.json + remoteRef: + key: secrets/krakend/config + property: config \ No newline at end of file diff --git a/master/krakend/templates/service.yaml b/master/krakend/templates/service.yaml new file mode 100644 index 0000000..d5393f3 --- /dev/null +++ b/master/krakend/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: krakend-service +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + protocol: TCP + selector: + app: krakend \ No newline at end of file diff --git a/master/kube-prometheus-stack/Chart.yaml b/master/kube-prometheus-stack/Chart.yaml new file mode 100644 index 0000000..093c443 --- /dev/null +++ b/master/kube-prometheus-stack/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: kube-prometheus-stack +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: kube-prometheus-stack + repository: https://prometheus-community.github.io/helm-charts + version: 72.9.1 diff --git a/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml b/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml new file mode 100644 index 0000000..7f01c1e --- /dev/null +++ b/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml @@ -0,0 +1,41 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: vault-grafana-oauth +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: grafana-oauth + data: + - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_ID + remoteRef: + key: secrets/kube-prometheus/grafana/oauth + property: GF_AUTH_GENERIC_OAUTH_CLIENT_ID + - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET + remoteRef: + key: secrets/kube-prometheus/grafana/oauth + property: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET + +--- + +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: vault-admin-credentials +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: grafana-admin-credentials + data: + - secretKey: admin-password + remoteRef: + key: secrets/kube-prometheus/grafana/admin + property: admin-password + - secretKey: admin-user + remoteRef: + key: secrets/kube-prometheus/grafana/admin + property: admin-user diff --git a/master/kube-prometheus-stack/templates/ingress.yaml b/master/kube-prometheus-stack/templates/ingress.yaml new file mode 100644 index 0000000..caf0ee1 --- /dev/null +++ b/master/kube-prometheus-stack/templates/ingress.yaml @@ -0,0 +1,80 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: grafana-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`grafana.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: grafana + port: 80 + tls: + secretName: grafana-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: grafana-tls +spec: + secretName: grafana-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "grafana.durp.info" + dnsNames: + - "grafana.durp.info" + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: alertmanager-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`alertmanager.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: prometheus-alertmanager + port: 9093 + tls: + secretName: alertmanager-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: alertmanager-tls +spec: + secretName: alertmanager-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "alertmanager.durp.info" + dnsNames: + - "alertmanager.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: grafana-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: grafana.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/kube-prometheus-stack/values.yaml b/master/kube-prometheus-stack/values.yaml new file mode 100644 index 0000000..19436ac --- /dev/null +++ b/master/kube-prometheus-stack/values.yaml @@ -0,0 +1,203 @@ +kube-prometheus-stack: + fullnameOverride: prometheus + + defaultRules: + create: true + rules: + alertmanager: true + etcd: true + configReloaders: true + general: true + k8s: true + kubeApiserverAvailability: true + kubeApiserverBurnrate: true + kubeApiserverHistogram: true + kubeApiserverSlos: true + kubelet: true + kubeProxy: true + kubePrometheusGeneral: true + kubePrometheusNodeRecording: true + kubernetesApps: true + kubernetesResources: true + kubernetesStorage: true + kubernetesSystem: true + kubeScheduler: true + kubeStateMetrics: true + network: true + node: true + nodeExporterAlerting: true + nodeExporterRecording: true + prometheus: true + prometheusOperator: true + + alertmanager: + fullnameOverride: alertmanager + enabled: true + ingress: + enabled: false + grafana: + enabled: true + fullnameOverride: grafana + forceDeployDatasources: false + forceDeployDashboards: false + defaultDashboardsEnabled: true + defaultDashboardsTimezone: utc + plugins: + - grafana-polystat-panel + serviceMonitor: + enabled: true + admin: + existingSecret: grafana-admin-credentials + userKey: admin-user + passwordKey: admin-password + ingress: + enabled: false + grafana.ini: + server: + root_url: https://grafana.durp.info + auth.generic_oauth: + enabled: true + scopes: openid profile email + auth_url: https://authentik.durp.info/application/o/authorize/ + token_url: https://authentik.durp.info/application/o/token/ + api_url: https://authentik.durp.info/application/o/userinfo/ + envFromSecret: "grafana-oauth" + + kubeApiServer: + enabled: true + + kubelet: + enabled: true + serviceMonitor: + metricRelabelings: + - action: replace + sourceLabels: + - node + targetLabel: instance + + kubeControllerManager: + enabled: true + endpoints: # ips of servers + - 192.168.20.121 + - 192.168.20.122 + - 192.168.20.123 + + coreDns: + enabled: false + + kubeDns: + enabled: false + + kubeEtcd: + enabled: true + endpoints: # ips of servers + - 192.168.20.121 + - 192.168.20.122 + - 192.168.20.123 + service: + enabled: true + port: 2381 + targetPort: 2381 + + kubeScheduler: + enabled: true + endpoints: # ips of servers + - 192.168.20.121 + - 192.168.20.122 + - 192.168.20.123 + + kubeProxy: + enabled: true + endpoints: # ips of servers + - 192.168.20.121 + - 192.168.20.122 + - 192.168.20.123 + + kubeStateMetrics: + enabled: true + + kube-state-metrics: + fullnameOverride: kube-state-metrics + selfMonitor: + enabled: true + prometheus: + monitor: + enabled: true + relabelings: + - action: replace + regex: (.*) + replacement: $1 + sourceLabels: + - __meta_kubernetes_pod_node_name + targetLabel: kubernetes_node + + nodeExporter: + enabled: true + serviceMonitor: + relabelings: + - action: replace + regex: (.*) + replacement: $1 + sourceLabels: + - __meta_kubernetes_pod_node_name + targetLabel: kubernetes_node + + prometheus-node-exporter: + fullnameOverride: node-exporter + podLabels: + jobLabel: node-exporter + extraArgs: + - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+)($|/) + - --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$ + service: + portName: http-metrics + prometheus: + monitor: + enabled: true + relabelings: + - action: replace + regex: (.*) + replacement: $1 + sourceLabels: + - __meta_kubernetes_pod_node_name + targetLabel: kubernetes_node + resources: + requests: + memory: 512Mi + cpu: 250m + limits: + memory: 2048Mi + + prometheusOperator: + enabled: true + prometheusConfigReloader: + resources: + requests: + cpu: 200m + memory: 50Mi + limits: + memory: 100Mi + + prometheus: + enabled: true + prometheusSpec: + replicas: 1 + replicaExternalLabelName: "replica" + ruleSelectorNilUsesHelmValues: false + serviceMonitorSelectorNilUsesHelmValues: false + podMonitorSelectorNilUsesHelmValues: false + probeSelectorNilUsesHelmValues: false + retention: 6h + enableAdminAPI: true + walCompression: true + storageSpec: + volumeClaimTemplate: + spec: + storageClassName: nfs-storage + accessModes: ["ReadWriteMany"] + resources: + requests: + storage: 50Gi + + thanosRuler: + enabled: false diff --git a/master/kubeclarity/Chart.yaml b/master/kubeclarity/Chart.yaml new file mode 100644 index 0000000..4eef59a --- /dev/null +++ b/master/kubeclarity/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: kubeclarity +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: kubeclarity + repository: https://openclarity.github.io/kubeclarity + version: 2.23.3 diff --git a/master/kubeclarity/templates/ingress.yaml b/master/kubeclarity/templates/ingress.yaml new file mode 100644 index 0000000..77b67a7 --- /dev/null +++ b/master/kubeclarity/templates/ingress.yaml @@ -0,0 +1,47 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: kubeclarity-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kubeclarity.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: kubeclarity-kubeclarity + port: 8080 + tls: + secretName: kubeclarity-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kubeclarity-tls +spec: + secretName: kubeclarity-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "kubeclarity.durp.info" + dnsNames: + - "kubeclarity.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: kubeclarity-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: kubeclarity.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/kubeclarity/values.yaml b/master/kubeclarity/values.yaml new file mode 100644 index 0000000..0bb5078 --- /dev/null +++ b/master/kubeclarity/values.yaml @@ -0,0 +1,235 @@ +kubeclarity: + global: + databasePassword: kubeclarity + docker: + registry: "registry.internal.durp.info/openclarity" + tag: "latest" + imagePullPolicy: Always + + curl: + image: + registry: "registry.internal.durp.info" + repository: curlimages/curl + tag: 7.87.0 + + kubeclarity: + docker: + imageName: "" + + logLevel: warning + + enableDBInfoLog: false + + prometheus: + enabled: false + + podAnnotations: {} + + service: + type: ClusterIP + port: 8080 + annotations: {} + + ingress: + enabled: false + + resources: + requests: + memory: "200Mi" + cpu: "100m" + limits: + memory: "1000Mi" + cpu: "1000m" + + initContainers: + resources: + requests: + memory: "100Mi" + cpu: "100m" + limits: + memory: "200Mi" + cpu: "200m" + + kubeclarity-runtime-scan: + httpsProxy: "" + httpProxy: "" + resultServicePort: 8888 + + labels: + app: kubeclarity-scanner + sidecar.istio.io/inject: "false" + + namespace: "" + + registry: + skipVerifyTlS: "false" + useHTTP: "false" + + cis-docker-benchmark-scanner: + resources: + requests: + memory: "50Mi" + cpu: "50m" + limits: + memory: "1000Mi" + cpu: "1000m" + + vulnerability-scanner: + resources: + requests: + memory: "50Mi" + cpu: "50m" + limits: + memory: "1000Mi" + cpu: "1000m" + + analyzer: + analyzerList: "syft gomod trivy" + analyzerScope: "squashed" + + trivy: + enabled: true + timeout: "300" + + scanner: + scannerList: "grype trivy" + + grype: + enabled: true + mode: "REMOTE" + + remote-grype: + timeout: "2m" + + dependency-track: + enabled: false + insecureSkipVerify: "true" + disableTls: "true" + apiserverAddress: "dependency-track-apiserver.dependency-track" + apiKey: "" + + trivy: + enabled: true + timeout: "300" + + kubeclarity-grype-server: + enabled: true + + docker: + imageRepo: "registry.internal.durp.info/openclarity" + imageTag: "v0.6.0" + imagePullPolicy: Always + + logLevel: warning + + servicePort: 9991 + + resources: + requests: + cpu: "200m" + memory: "200Mi" + limits: + cpu: "1000m" + memory: "1G" + + kubeclarity-trivy-server: + enabled: true + + ## Docker Image values. + image: + registry: registry.internal.durp.info + repository: aquasec/trivy + tag: 0.44.1 + pullPolicy: Always + + persistence: + enabled: false + + podSecurityContext: + runAsUser: 1001 + runAsNonRoot: true + fsGroup: 1001 + + securityContext: + privileged: false + readOnlyRootFilesystem: true + + trivy: + debugMode: false + + service: + port: 9992 + + resources: + requests: + cpu: "200m" + memory: "200Mi" + limits: + cpu: "1000m" + memory: "1G" + + + kubeclarity-sbom-db: + docker: + imageName: "" + logLevel: warning + + servicePort: 8080 + + resources: + requests: + memory: "20Mi" + cpu: "10m" + limits: + memory: "1Gi" + cpu: "200m" + + kubeclarity-postgresql: + enabled: true + + image: + registry: registry.internal.durp.info + repository: bitnami/postgresql + tag: 14.6.0-debian-11-r31 + + auth: + existingSecret: kubeclarity-postgresql-secret + username: postgres + database: kubeclarity + sslMode: disable + + service: + ports: + postgresql: 5432 + + serviceAccount: + enabled: true + securityContext: + enabled: true + fsGroup: 1001 + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + volumePermissions: + enabled: false + securityContext: + runAsUser: 1001 + shmVolume: + chmod: + enabled: true + + resources: + requests: + memory: "256Mi" + cpu: "250m" + limits: + memory: "1000Mi" + cpu: "1000m" + + kubeclarity-postgresql-external: + enabled: false + + kubeclarity-postgresql-secret: + create: true + secretKey: "postgres-password" diff --git a/master/littlelink/Chart.yaml b/master/littlelink/Chart.yaml new file mode 100644 index 0000000..e69de29 diff --git a/master/littlelink/templates/deployment.yaml b/master/littlelink/templates/deployment.yaml new file mode 100644 index 0000000..ec9ab4d --- /dev/null +++ b/master/littlelink/templates/deployment.yaml @@ -0,0 +1,101 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: littlelink + name: littlelink + labels: + app: littlelink +spec: + selector: + matchLabels: + app: littlelink + replicas: 1 + template: + metadata: + labels: + app: littlelink + spec: + containers: + - name: littlelink + image: registry.internal.durp.info/techno-tim/littlelink-server:latest + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthcheck + port: 3000 + readinessProbe: + httpGet: + path: /healthcheck + port: 3000 + env: + - name: META_TITLE + value: DeveloperDurp + - name: META_DESCRIPTION + value: The Durpy Developer + - name: META_AUTHOR + value: DeveloperDurp + - name: LANG + value: en + - name: META_INDEX_STATUS + value: all + - name: OG_TITLE + value: DeveloperDurp + - name: OG_DESCRIPTION + value: DeveloperDurp + - name: OG_URL + value: https://gitlab.com/developerdurp + - name: OG_IMAGE + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : OG_IMAGE_WIDTH + value: "400" + - name : OG_IMAGE_HEIGHT + value: "400" + - name : THEME + value: Dark + - name : FAVICON_URL + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : AVATAR_URL + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : AVATAR_2X_URL + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : AVATAR_ALT + value: DeveloperDurp Profile Pic + - name : NAME + value: DeveloperDurp + - name : BIO + value: Sup Nerd, + - name : BUTTON_ORDER + value: GITHUB,GITLAB,YOUTUBE,INSTAGRAM,TWITTER,BLUESKY,COFFEE,EMAIL + - name : TWITTER + value: https://twitter.com/developerdurp + - name : GITHUB + value: https://github.com/DeveloperDurp + - name: INSTAGRAM + value: https://instagram.com/developerdurp + - name : GITLAB + value: https://gitlab.com/developerdurp + - name: YOUTUBE + value: https://www.youtube.com/channel/UC1rGa6s6kER_gLpIQsxeMVQ + - name : EMAIL + value: DeveloperDurp@durp.info + - name : EMAIL_TEXT + value: DeveloperDurp@durp.info + - name : FOOTER + value: DeveloperDurp © 2022 + - name: CUSTOM_BUTTON_TEXT + value: BuyMeACoffee,BlueSky + - name: CUSTOM_BUTTON_URL + value: https://www.buymeacoffee.com/DeveloperDurp,https://bsky.app/profile/durp.info + - name: CUSTOM_BUTTON_COLOR + value: '#ffdd00,#1185fe' + - name: CUSTOM_BUTTON_TEXT_COLOR + value: '#000000,#FFFFFF' + - name: CUSTOM_BUTTON_ALT_TEXT + value: Support,BlueSky + - name: CUSTOM_BUTTON_NAME + value: COFFEE,BLUESKY + - name: CUSTOM_BUTTON_ICON + value: fa-solid fa-cup-togo + ports: + - name: http + containerPort: 3000 diff --git a/master/littlelink/templates/ingress.yaml b/master/littlelink/templates/ingress.yaml new file mode 100644 index 0000000..194f31e --- /dev/null +++ b/master/littlelink/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: littlelink-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`links.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: littlelink + port: 80 + tls: + secretName: littlelink-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: littlelink-tls +spec: + secretName: littlelink-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "links.durp.info" + dnsNames: + - "links.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: links-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: links.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/littlelink/templates/service.yaml b/master/littlelink/templates/service.yaml new file mode 100644 index 0000000..445d527 --- /dev/null +++ b/master/littlelink/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: littlelink +spec: + ports: + - name: http + port: 80 + targetPort: 3000 + protocol: TCP + selector: + app: littlelink \ No newline at end of file diff --git a/master/longhorn/Chart.yaml b/master/longhorn/Chart.yaml new file mode 100644 index 0000000..2c9fea3 --- /dev/null +++ b/master/longhorn/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: longhorn-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: longhorn + repository: https://charts.longhorn.io + version: 1.9.0 \ No newline at end of file diff --git a/master/longhorn/templates/ingress.yaml b/master/longhorn/templates/ingress.yaml new file mode 100644 index 0000000..09c5ef2 --- /dev/null +++ b/master/longhorn/templates/ingress.yaml @@ -0,0 +1,41 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: longhorn-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + # - name: authentik-proxy-provider + # namespace: traefik + kind: Rule + services: + - name: longhorn-frontend + port: 80 + # - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + # kind: Rule + # services: + # - name: ak-outpost-authentik-embedded-outpost + # namespace: authentik + # port: 9000 + tls: + secretName: longhorn-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: longhorn-tls +spec: + secretName: longhorn-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "longhorn.internal.durp.info" + dnsNames: + - "longhorn.internal.durp.info" diff --git a/master/longhorn/templates/secrets.yaml b/master/longhorn/templates/secrets.yaml new file mode 100644 index 0000000..4bbdc35 --- /dev/null +++ b/master/longhorn/templates/secrets.yaml @@ -0,0 +1,24 @@ + +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: external-longhorn-backup-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: longhorn-backup-token-secret + data: + - secretKey: AWS_ACCESS_KEY_ID + remoteRef: + key: secrets/longhorn/backup + property: AWS_ACCESS_KEY_ID + - secretKey: AWS_ENDPOINTS + remoteRef: + key: secrets/longhorn/backup + property: AWS_ENDPOINTS + - secretKey: AWS_SECRET_ACCESS_KEY + remoteRef: + key: secrets/longhorn/backup + property: AWS_SECRET_ACCESS_KEY diff --git a/master/longhorn/values.yaml b/master/longhorn/values.yaml new file mode 100644 index 0000000..647385b --- /dev/null +++ b/master/longhorn/values.yaml @@ -0,0 +1,253 @@ +longhorn: + + # Default values for longhorn. + # This is a YAML-formatted file. + # Declare variables to be passed into your templates. + global: + cattle: + systemDefaultRegistry: "" + + image: + longhorn: + engine: + repository: longhornio/longhorn-engine + manager: + repository: longhornio/longhorn-manager + ui: + repository: longhornio/longhorn-ui + instanceManager: + repository: longhornio/longhorn-instance-manager + shareManager: + repository: longhornio/longhorn-share-manager + backingImageManager: + repository: longhornio/backing-image-manager + csi: + attacher: + repository: longhornio/csi-attacher + provisioner: + repository: longhornio/csi-provisioner + nodeDriverRegistrar: + repository: longhornio/csi-node-driver-registrar + resizer: + repository: longhornio/csi-resizer + snapshotter: + repository: longhornio/csi-snapshotter + pullPolicy: Always + + service: + ui: + type: ClusterIP + nodePort: null + manager: + type: ClusterIP + nodePort: "" + loadBalancerIP: "" + loadBalancerSourceRanges: "" + + persistence: + defaultClass: true + defaultFsType: ext4 + defaultClassReplicaCount: 3 + defaultDataLocality: disabled # best-effort otherwise + reclaimPolicy: Retain + migratable: false + recurringJobSelector: + enable: true + jobList: '[ + { + "name":"backup", + "task":"backup", + "cron":"0 0 * * ?", + "retain":24 + } + ]' + backingImage: + enable: false + name: ~ + dataSourceType: ~ + dataSourceParameters: ~ + expectedChecksum: ~ + + csi: + kubeletRootDir: ~ + attacherReplicaCount: ~ + provisionerReplicaCount: ~ + resizerReplicaCount: ~ + snapshotterReplicaCount: ~ + + defaultSettings: + backupTarget: S3://longhorn-master@us-east-1/ + backupTargetCredentialSecret: longhorn-backup-token-secret + allowRecurringJobWhileVolumeDetached: ~ + createDefaultDiskLabeledNodes: ~ + defaultDataPath: ~ + defaultDataLocality: ~ + replicaSoftAntiAffinity: ~ + replicaAutoBalance: ~ + storageOverProvisioningPercentage: ~ + storageMinimalAvailablePercentage: ~ + upgradeChecker: ~ + defaultReplicaCount: ~ + defaultLonghornStaticStorageClass: longhorn + backupstorePollInterval: ~ + taintToleration: ~ + systemManagedComponentsNodeSelector: ~ + priorityClass: ~ + autoSalvage: ~ + autoDeletePodWhenVolumeDetachedUnexpectedly: ~ + disableSchedulingOnCordonedNode: ~ + replicaZoneSoftAntiAffinity: ~ + nodeDownPodDeletionPolicy: ~ + allowNodeDrainWithLastHealthyReplica: ~ + mkfsExt4Parameters: ~ + disableReplicaRebuild: ~ + replicaReplenishmentWaitInterval: ~ + concurrentReplicaRebuildPerNodeLimit: ~ + disableRevisionCounter: ~ + systemManagedPodsImagePullPolicy: ~ + allowVolumeCreationWithDegradedAvailability: ~ + autoCleanupSystemGeneratedSnapshot: ~ + concurrentAutomaticEngineUpgradePerNodeLimit: ~ + backingImageCleanupWaitInterval: ~ + backingImageRecoveryWaitInterval: ~ + guaranteedEngineManagerCPU: ~ + guaranteedReplicaManagerCPU: ~ + kubernetesClusterAutoscalerEnabled: ~ + orphanAutoDeletion: ~ + storageNetwork: ~ + privateRegistry: + createSecret: ~ + registryUrl: ~ + registryUser: ~ + registryPasswd: ~ + registrySecret: ~ + + longhornManager: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + longhornDriver: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + longhornUI: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + # + + ingress: + ## Set to true to enable ingress record generation + enabled: false + + ## Add ingressClassName to the Ingress + ## Can replace the kubernetes.io/ingress.class annotation on v1.18+ + ingressClassName: nginx + + host: longhorn.internal.durp.info + + ## Set this to true in order to enable TLS on the ingress record + ## A side effect of this will be that the backend service will be connected at port 443 + tls: + - secretName: longhorn-tls + hosts: + - longhorn.internal.durp.info + + ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS + tlsSecret: longhorn-tls + + ## If ingress is enabled you can set the default ingress path + ## then you can access the UI by using the following full path {{host}}+{{path}} + path: / + + ## Ingress annotations done as key:value pairs + ## If you're using kube-lego, you will want to add: + ## kubernetes.io/tls-acme: true + ## + ## For a full list of possible ingress annotations, please see + ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md + ## + ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production + nginx.ingress.kubernetes.io/auth-url: |- + http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx + nginx.ingress.kubernetes.io/auth-signin: |- + https://longhorn.internal.durp.info/outpost.goauthentik.io/start?rd=$escaped_request_uri + nginx.ingress.kubernetes.io/auth-response-headers: |- + Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid + nginx.ingress.kubernetes.io/auth-snippet: | + proxy_set_header X-Forwarded-Host $http_host; + + secrets: + ## If you're providing your own certificates, please use this to add the certificates as secrets + ## key and certificate should start with -----BEGIN CERTIFICATE----- or + ## -----BEGIN RSA PRIVATE KEY----- + ## + ## name should line up with a tlsSecret set further up + ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set + ## + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + # - name: longhorn.local-tls + # key: + # certificate: + + # Configure a pod security policy in the Longhorn namespace to allow privileged pods + enablePSP: true + + ## Specify override namespace, specifically this is useful for using longhorn as sub-chart + ## and its release namespace is not the `longhorn-system` + namespaceOverride: "" + + # Annotations to add to the Longhorn Manager DaemonSet Pods. Optional. + annotations: {} + + serviceAccount: + # Annotations to add to the service account + annotations: {} + diff --git a/master/metallb-system/Chart.yaml b/master/metallb-system/Chart.yaml new file mode 100644 index 0000000..7b97113 --- /dev/null +++ b/master/metallb-system/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +name: metallb-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: metallb + repository: https://metallb.github.io/metallb + version: 0.15.2 + diff --git a/master/metallb-system/templates/config.yaml b/master/metallb-system/templates/config.yaml new file mode 100644 index 0000000..e44285d --- /dev/null +++ b/master/metallb-system/templates/config.yaml @@ -0,0 +1,17 @@ +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: cheap +spec: + addresses: + - 192.168.20.130-192.168.20.140 +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: poop + namespace: metallb-system +spec: + ipAddressPools: + - cheap + diff --git a/master/metallb-system/values.yaml b/master/metallb-system/values.yaml new file mode 100644 index 0000000..0c6b1b9 --- /dev/null +++ b/master/metallb-system/values.yaml @@ -0,0 +1,197 @@ +metallb: + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + loadBalancerClass: "" + + rbac: + create: true + + prometheus: + scrapeAnnotations: false + metricsPort: 7472 + speakerMetricsTLSSecret: "" + controllerMetricsTLSSecret: "" + rbacPrometheus: true + serviceAccount: "" + namespace: "" + rbacProxy: + repository: gcr.io/kubebuilder/kube-rbac-proxy + tag: v0.12.0 + pullPolicy: + podMonitor: + enabled: false + additionalLabels: {} + annotations: {} + jobLabel: "app.kubernetes.io/name" + interval: + metricRelabelings: [] + relabelings: [] + serviceMonitor: + enabled: false + speaker: + additionalLabels: {} + annotations: {} + tlsConfig: + insecureSkipVerify: true + controller: + additionalLabels: {} + annotations: {} + tlsConfig: + insecureSkipVerify: true + jobLabel: "app.kubernetes.io/name" + interval: + metricRelabelings: [] + relabelings: [] + prometheusRule: + enabled: false + additionalLabels: {} + annotations: {} + staleConfig: + enabled: true + labels: + severity: warning + configNotLoaded: + enabled: true + labels: + severity: warning + addressPoolExhausted: + enabled: true + labels: + severity: alert + addressPoolUsage: + enabled: true + thresholds: + - percent: 75 + labels: + severity: warning + - percent: 85 + labels: + severity: warning + - percent: 95 + labels: + severity: alert + bgpSessionDown: + enabled: true + labels: + severity: alert + + extraAlerts: [] + + controller: + enabled: true + # -- Controller log level. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` + logLevel: info + image: + repository: quay.io/metallb/controller + tag: + pullPolicy: + strategy: + type: RollingUpdate + serviceAccount: + create: true + name: "" + annotations: {} + securityContext: + runAsNonRoot: true + runAsUser: 65534 + fsGroup: 65534 + resources: {} + nodeSelector: {} + tolerations: [] + priorityClassName: "" + runtimeClassName: "" + affinity: {} + podAnnotations: {} + labels: {} + livenessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + tlsMinVersion: "VersionTLS12" + tlsCipherSuites: "" + + extraContainers: [] + + speaker: + enabled: true + logLevel: debug + tolerateMaster: true + memberlist: + enabled: true + mlBindPort: 7946 + mlBindAddrOverride: "" + mlSecretKeyPath: "/etc/ml_secret_key" + excludeInterfaces: + enabled: true + ignoreExcludeLB: false + + image: + repository: quay.io/metallb/speaker + tag: + pullPolicy: + updateStrategy: + type: RollingUpdate + serviceAccount: + create: true + name: "" + annotations: {} + securityContext: {} + resources: {} + nodeSelector: {} + tolerations: [] + priorityClassName: "" + affinity: {} + runtimeClassName: "" + podAnnotations: {} + labels: + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/audit: privileged + pod-security.kubernetes.io/warn: privileged + livenessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + startupProbe: + enabled: true + failureThreshold: 30 + periodSeconds: 5 + frr: + enabled: true + image: + repository: quay.io/frrouting/frr + tag: 9.1.3 + pullPolicy: + metricsPort: 7473 + resources: {} + reloader: + resources: {} + frrMetrics: + resources: {} + extraContainers: [] + crds: + enabled: true + validationFailurePolicy: Fail + frrk8s: + enabled: false + diff --git a/master/nfs-client/Chart.yml b/master/nfs-client/Chart.yml new file mode 100644 index 0000000..217f2c1 --- /dev/null +++ b/master/nfs-client/Chart.yml @@ -0,0 +1,8 @@ +apiVersion: v2 +name: nfs-client +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + diff --git a/master/nfs-client/templates/cluster-role-binding.yml b/master/nfs-client/templates/cluster-role-binding.yml new file mode 100644 index 0000000..427d8c6 --- /dev/null +++ b/master/nfs-client/templates/cluster-role-binding.yml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: run-nfs-client-provisioner +subjects: + - kind: ServiceAccount + name: nfs-client-provisioner + namespace: nfs-client +roleRef: + kind: ClusterRole + name: nfs-client-provisioner-runner + apiGroup: rbac.authorization.k8s.io diff --git a/master/nfs-client/templates/cluster-role.yml b/master/nfs-client/templates/cluster-role.yml new file mode 100644 index 0000000..fa6ed20 --- /dev/null +++ b/master/nfs-client/templates/cluster-role.yml @@ -0,0 +1,20 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: nfs-client-provisioner-runner +rules: + - apiGroups: [""] + resources: ["persistentvolumes"] + verbs: ["get", "list", "watch", "create", "delete"] + - apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch"] + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/master/nfs-client/templates/provisioner.yml b/master/nfs-client/templates/provisioner.yml new file mode 100644 index 0000000..c76fe8c --- /dev/null +++ b/master/nfs-client/templates/provisioner.yml @@ -0,0 +1,42 @@ +kind: Deployment +apiVersion: apps/v1 +metadata: + name: nfs-client-provisioner + namespace: nfs-client +spec: + selector: + matchLabels: + app: nfs-client-provisioner + replicas: 1 + strategy: + type: Recreate + template: + metadata: + labels: + app: nfs-client-provisioner + spec: + serviceAccountName: nfs-client-provisioner + containers: + - name: nfs-client-provisioner + image: gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner:v4.0.0 + resources: + requests: + cpu: 500m + memory: 512Mi + limits: + memory: 1Gi + volumeMounts: + - name: nfs-client-ssd + mountPath: /persistentvolumes + env: + - name: PROVISIONER_NAME + value: durp.info/nfs + - name: NFS_SERVER + value: 192.168.20.253 + - name: NFS_PATH + value: /mnt/user/k3s + volumes: + - name: nfs-client-ssd + nfs: + server: 192.168.20.253 + path: /mnt/user/k3s diff --git a/master/nfs-client/templates/role-binding.yml b/master/nfs-client/templates/role-binding.yml new file mode 100644 index 0000000..fb0f085 --- /dev/null +++ b/master/nfs-client/templates/role-binding.yml @@ -0,0 +1,13 @@ +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: leader-locking-nfs-client-provisioner + namespace: nfs-client +subjects: + - kind: ServiceAccount + name: nfs-client-provisioner + namespace: nfs-client +roleRef: + kind: Role + name: leader-locking-nfs-client-provisioner + apiGroup: rbac.authorization.k8s.io diff --git a/master/nfs-client/templates/role.yml b/master/nfs-client/templates/role.yml new file mode 100644 index 0000000..910346d --- /dev/null +++ b/master/nfs-client/templates/role.yml @@ -0,0 +1,9 @@ +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: leader-locking-nfs-client-provisioner + namespace: nfs-client +rules: + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/master/nfs-client/templates/service-account.yml b/master/nfs-client/templates/service-account.yml new file mode 100644 index 0000000..ef9b4d7 --- /dev/null +++ b/master/nfs-client/templates/service-account.yml @@ -0,0 +1,5 @@ +kind: ServiceAccount +apiVersion: v1 +metadata: + name: nfs-client-provisioner + namespace: nfs-client diff --git a/master/nfs-client/templates/storage-class.yml b/master/nfs-client/templates/storage-class.yml new file mode 100644 index 0000000..b615fe1 --- /dev/null +++ b/master/nfs-client/templates/storage-class.yml @@ -0,0 +1,10 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: nfs-storage + annotations: + storageclass.kubernetes.io/is-default-class: "false" +provisioner: durp.info/nfs +parameters: + archiveOnDelete: "false" +reclaimPolicy: Retain diff --git a/master/open-webui/Chart.yaml b/master/open-webui/Chart.yaml new file mode 100644 index 0000000..1561d60 --- /dev/null +++ b/master/open-webui/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: open-webui +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" diff --git a/master/open-webui/templates/deployment.yaml b/master/open-webui/templates/deployment.yaml new file mode 100644 index 0000000..c76ec24 --- /dev/null +++ b/master/open-webui/templates/deployment.yaml @@ -0,0 +1,37 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: open-webui + name: open-webui + labels: + app: open-webui +spec: + selector: + matchLabels: + app: open-webui + replicas: 1 + template: + metadata: + labels: + app: open-webui + spec: + containers: + - name: open-webui + image: registry.internal.durp.info/open-webui/open-webui:main + imagePullPolicy: Always + volumeMounts: + - name: open-webui-pvc1 + mountPath: /app/backend/data + ports: + - name: http + containerPort: 8080 + env: + - name: OLLAMA_BASE_URL + valueFrom: + secretKeyRef: + name: open-webui-secret + key: OLLAMA_BASE_URL + volumes: + - name: open-webui-pvc1 + persistentVolumeClaim: + claimName: open-webui-pvc1 diff --git a/master/open-webui/templates/ingress.yaml b/master/open-webui/templates/ingress.yaml new file mode 100644 index 0000000..6331e92 --- /dev/null +++ b/master/open-webui/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: open-webui-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: open-webui + port: 8080 + tls: + secretName: open-webui-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: open-webui-tls +spec: + secretName: open-webui-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "open-webui.durp.info" + dnsNames: + - "open-webui.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: open-webui-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/open-webui/templates/pvc.yaml b/master/open-webui/templates/pvc.yaml new file mode 100644 index 0000000..a7ba262 --- /dev/null +++ b/master/open-webui/templates/pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: open-webui-pvc1 +spec: + storageClassName: longhorn + accessModes: + - ReadWriteMany + resources: + requests: + storage: 10Gi diff --git a/master/open-webui/templates/secrets.yaml b/master/open-webui/templates/secrets.yaml new file mode 100644 index 0000000..c8a22bc --- /dev/null +++ b/master/open-webui/templates/secrets.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: open-webui-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: open-webui-secret + data: + - secretKey: OLLAMA_BASE_URL + remoteRef: + key: secrets/open-webui + property: OLLAMA_BASE_URL + diff --git a/master/open-webui/templates/service.yaml b/master/open-webui/templates/service.yaml new file mode 100644 index 0000000..cd93455 --- /dev/null +++ b/master/open-webui/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: open-webui +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + protocol: TCP + selector: + app: open-webui diff --git a/master/traefik/Chart.yaml b/master/traefik/Chart.yaml new file mode 100644 index 0000000..5378476 --- /dev/null +++ b/master/traefik/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: traefik +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: traefik + repository: https://traefik.github.io/charts + version: 24.0.0 diff --git a/master/traefik/templates/ingress.yaml b/master/traefik/templates/ingress.yaml new file mode 100644 index 0000000..c3db450 --- /dev/null +++ b/master/traefik/templates/ingress.yaml @@ -0,0 +1,39 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: traefik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`traefik.internal.durp.info`) + middlewares: + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: api@internal + kind: TraefikService + - match: Host(`traefik.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-master-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: traefik-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: traefik-tls + namespace: traefik +spec: + secretName: traefik-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "traefik.internal.durp.info" + dnsNames: + - "traefik.internal.durp.info" diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml new file mode 100644 index 0000000..dfa36c4 --- /dev/null +++ b/master/traefik/templates/middlewares.yaml @@ -0,0 +1,35 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: authentik-proxy-provider + namespace: traefik +spec: + forwardAuth: + address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + trustForwardHeader: true + authResponseHeaders: + - X-authentik-username + - X-authentik-groups + - X-authentik-email + - X-authentik-name + - X-authentik-uid + - X-authentik-jwt + - X-authentik-meta-jwks + - X-authentik-meta-outpost + - X-authentik-meta-provider + - X-authentik-meta-app + - X-authentik-meta-version + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: whitelist + namespace: traefik +spec: + ipWhiteList: + sourceRange: + - 192.168.0.0/16 + - 172.16.0.0/12 + - 10.0.0.0/8 diff --git a/master/traefik/values.yaml b/master/traefik/values.yaml new file mode 100644 index 0000000..5bb0a04 --- /dev/null +++ b/master/traefik/values.yaml @@ -0,0 +1,887 @@ +traefik: + # Default values for Traefik + image: + registry: docker.io + repository: traefik + # defaults to appVersion + tag: "" + pullPolicy: Always + + # + # Configure integration with Traefik Hub + # + hub: + ## Enabling Hub will: + # * enable Traefik Hub integration on Traefik + # * add `traefikhub-tunl` endpoint + # * enable Prometheus metrics with addRoutersLabels + # * enable allowExternalNameServices on KubernetesIngress provider + # * enable allowCrossNamespace on KubernetesCRD provider + # * add an internal (ClusterIP) Service, dedicated for Traefik Hub + enabled: true + ## Default port can be changed + # tunnelPort: 9901 + ## TLS is optional. Insecure is mutually exclusive with any other options + # tls: + # insecure: false + # ca: "/path/to/ca.pem" + # cert: "/path/to/cert.pem" + # key: "/path/to/key.pem" + + # + # Configure the deployment + # + deployment: + enabled: true + # Can be either Deployment or DaemonSet + kind: Deployment + # Number of pods of the deployment (only applies when kind == Deployment) + replicas: 3 + # Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) + revisionHistoryLimit: 1 + # Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down + terminationGracePeriodSeconds: 60 + # The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available + minReadySeconds: 0 + # Additional deployment annotations (e.g. for jaeger-operator sidecar injection) + annotations: {} + # Additional deployment labels (e.g. for filtering deployment by custom labels) + labels: {} + # Additional pod annotations (e.g. for mesh injection or prometheus scraping) + podAnnotations: {} + # Additional Pod labels (e.g. for filtering Pod by custom labels) + podLabels: {} + # Additional containers (e.g. for metric offloading sidecars) + additionalContainers: [] + # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host + # - name: socat-proxy + # image: alpine/socat:1.0.5 + # args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"] + # volumeMounts: + # - name: dsdsocket + # mountPath: /socket + # Additional volumes available for use with initContainers and additionalContainers + additionalVolumes: [] + # - name: dsdsocket + # hostPath: + # path: /var/run/statsd-exporter + # Additional initContainers (e.g. for setting file permission as shown below) + initContainers: [] + # The "volume-permissions" init container is required if you run into permission issues. + # Related issue: https://github.com/traefik/traefik-helm-chart/issues/396 + # - name: volume-permissions + # image: busybox:latest + # command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"] + # securityContext: + # runAsNonRoot: true + # runAsGroup: 65532 + # runAsUser: 65532 + # volumeMounts: + # - name: data + # mountPath: /data + # Use process namespace sharing + shareProcessNamespace: false + # Custom pod DNS policy. Apply if `hostNetwork: true` + # dnsPolicy: ClusterFirstWithHostNet + # Additional imagePullSecrets + imagePullSecrets: [] + # - name: myRegistryKeySecretName + # Pod lifecycle actions + lifecycle: {} + # preStop: + # exec: + # command: ["/bin/sh", "-c", "sleep 40"] + # postStart: + # httpGet: + # path: /ping + # port: 9000 + # host: localhost + # scheme: HTTP + + # Pod disruption budget + podDisruptionBudget: + enabled: false + # maxUnavailable: 1 + # maxUnavailable: 33% + # minAvailable: 0 + # minAvailable: 25% + + # Create a default IngressClass for Traefik + ingressClass: + enabled: true + isDefaultClass: false + + # Enable experimental features + experimental: + v3: + enabled: false + plugins: + enabled: true + kubernetesGateway: + enabled: false + gateway: + enabled: true + # certificate: + # group: "core" + # kind: "Secret" + # name: "mysecret" + # By default, Gateway would be created to the Namespace you are deploying Traefik to. + # You may create that Gateway in another namespace, setting its name below: + # namespace: default + # Additional gateway annotations (e.g. for cert-manager.io/issuer) + # annotations: + # cert-manager.io/issuer: letsencrypt + + # Create an IngressRoute for the dashboard + ingressRoute: + dashboard: + enabled: true + # Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class) + annotations: {} + # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels) + labels: {} + # The router match rule used for the dashboard ingressRoute + matchRule: PathPrefix(`/dashboard`) || PathPrefix(`/api`) + # Specify the allowed entrypoints to use for the dashboard ingress route, (e.g. traefik, web, websecure). + # By default, it's using traefik entrypoint, which is not exposed. + # /!\ Do not expose your dashboard without any protection over the internet /!\ + entryPoints: ["traefik"] + # Additional ingressRoute middlewares (e.g. for authentication) + middlewares: [] + # TLS options (e.g. secret containing certificate) + tls: {} + + # Customize updateStrategy of traefik pods + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 1 + + # Customize liveness and readiness probe values. + readinessProbe: + failureThreshold: 1 + initialDelaySeconds: 2 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 2 + + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 2 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 2 + + # + # Configure providers + # + providers: + kubernetesCRD: + enabled: true + allowCrossNamespace: true + allowExternalNameServices: false + allowEmptyServices: false + # ingressClass: traefik-internal + # labelSelector: environment=production,method=traefik + namespaces: [] + # - "default" + + kubernetesIngress: + enabled: true + allowExternalNameServices: false + allowEmptyServices: false + # ingressClass: traefik-internal + # labelSelector: environment=production,method=traefik + namespaces: [] + # - "default" + # IP used for Kubernetes Ingress endpoints + publishedService: + enabled: false + # Published Kubernetes Service to copy status from. Format: namespace/servicename + # By default this Traefik service + # pathOverride: "" + + # + # Add volumes to the traefik pod. The volume name will be passed to tpl. + # This can be used to mount a cert pair or a configmap that holds a config.toml file. + # After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg: + # additionalArguments: + # - "--providers.file.filename=/config/dynamic.toml" + # - "--ping" + # - "--ping.entrypoint=web" + volumes: [] + # - name: public-cert + # mountPath: "/certs" + # type: secret + # - name: '{{ printf "%s-configs" .Release.Name }}' + # mountPath: "/config" + # type: configMap + + # Additional volumeMounts to add to the Traefik container + additionalVolumeMounts: [] + # For instance when using a logshipper for access logs + # - name: traefik-logs + # mountPath: /var/log/traefik + + ## Logs + ## https://docs.traefik.io/observability/logs/ + logs: + ## Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on). + general: + # By default, the logs use a text format (common), but you can + # also ask for the json format in the format option + # format: json + # By default, the level is set to ERROR. + # Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO. + level: ERROR + access: + # To enable access logs + enabled: false + ## By default, logs are written using the Common Log Format (CLF) on stdout. + ## To write logs in JSON, use json in the format option. + ## If the given format is unsupported, the default (CLF) is used instead. + # format: json + # filePath: "/var/log/traefik/access.log + ## To write the logs in an asynchronous fashion, specify a bufferingSize option. + ## This option represents the number of log lines Traefik will keep in memory before writing + ## them to the selected output. In some cases, this option can greatly help performances. + # bufferingSize: 100 + ## Filtering https://docs.traefik.io/observability/access-logs/#filtering + filters: {} + # statuscodes: "200,300-302" + # retryattempts: true + # minduration: 10ms + ## Fields + ## https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers + fields: + general: + defaultmode: keep + names: {} + ## Examples: + # ClientUsername: drop + headers: + defaultmode: drop + names: {} + ## Examples: + # User-Agent: redact + # Authorization: drop + # Content-Type: keep + + metrics: + ## Prometheus is enabled by default. + ## It can be disabled by setting "prometheus: null" + prometheus: + ## Entry point used to expose metrics. + entryPoint: metrics + ## Enable metrics on entry points. Default=true + # addEntryPointsLabels: false + ## Enable metrics on routers. Default=false + # addRoutersLabels: true + ## Enable metrics on services. Default=true + # addServicesLabels: false + ## Buckets for latency metrics. Default="0.1,0.3,1.2,5.0" + # buckets: "0.5,1.0,2.5" + ## When manualRouting is true, it disables the default internal router in + ## order to allow creating a custom router for prometheus@internal service. + # manualRouting: true + # datadog: + # ## Address instructs exporter to send metrics to datadog-agent at this address. + # address: "127.0.0.1:8125" + # ## The interval used by the exporter to push metrics to datadog-agent. Default=10s + # # pushInterval: 30s + # ## The prefix to use for metrics collection. Default="traefik" + # # prefix: traefik + # ## Enable metrics on entry points. Default=true + # # addEntryPointsLabels: false + # ## Enable metrics on routers. Default=false + # # addRoutersLabels: true + # ## Enable metrics on services. Default=true + # # addServicesLabels: false + # influxdb: + # ## Address instructs exporter to send metrics to influxdb at this address. + # address: localhost:8089 + # ## InfluxDB's address protocol (udp or http). Default="udp" + # protocol: udp + # ## InfluxDB database used when protocol is http. Default="" + # # database: "" + # ## InfluxDB retention policy used when protocol is http. Default="" + # # retentionPolicy: "" + # ## InfluxDB username (only with http). Default="" + # # username: "" + # ## InfluxDB password (only with http). Default="" + # # password: "" + # ## The interval used by the exporter to push metrics to influxdb. Default=10s + # # pushInterval: 30s + # ## Additional labels (influxdb tags) on all metrics. + # # additionalLabels: + # # env: production + # # foo: bar + # ## Enable metrics on entry points. Default=true + # # addEntryPointsLabels: false + # ## Enable metrics on routers. Default=false + # # addRoutersLabels: true + # ## Enable metrics on services. Default=true + # # addServicesLabels: false + # influxdb2: + # ## Address instructs exporter to send metrics to influxdb v2 at this address. + # address: localhost:8086 + # ## Token with which to connect to InfluxDB v2. + # token: xxx + # ## Organisation where metrics will be stored. + # org: "" + # ## Bucket where metrics will be stored. + # bucket: "" + # ## The interval used by the exporter to push metrics to influxdb. Default=10s + # # pushInterval: 30s + # ## Additional labels (influxdb tags) on all metrics. + # # additionalLabels: + # # env: production + # # foo: bar + # ## Enable metrics on entry points. Default=true + # # addEntryPointsLabels: false + # ## Enable metrics on routers. Default=false + # # addRoutersLabels: true + # ## Enable metrics on services. Default=true + # # addServicesLabels: false + # statsd: + # ## Address instructs exporter to send metrics to statsd at this address. + # address: localhost:8125 + # ## The interval used by the exporter to push metrics to influxdb. Default=10s + # # pushInterval: 30s + # ## The prefix to use for metrics collection. Default="traefik" + # # prefix: traefik + # ## Enable metrics on entry points. Default=true + # # addEntryPointsLabels: false + # ## Enable metrics on routers. Default=false + # # addRoutersLabels: true + # ## Enable metrics on services. Default=true + # # addServicesLabels: false + # openTelemetry: + # ## Address of the OpenTelemetry Collector to send metrics to. + # address: "localhost:4318" + # ## Enable metrics on entry points. + # addEntryPointsLabels: true + # ## Enable metrics on routers. + # addRoutersLabels: true + # ## Enable metrics on services. + # addServicesLabels: true + # ## Explicit boundaries for Histogram data points. + # explicitBoundaries: + # - "0.1" + # - "0.3" + # - "1.2" + # - "5.0" + # ## Additional headers sent with metrics by the reporter to the OpenTelemetry Collector. + # headers: + # foo: bar + # test: test + # ## Allows reporter to send metrics to the OpenTelemetry Collector without using a secured protocol. + # insecure: true + # ## Interval at which metrics are sent to the OpenTelemetry Collector. + # pushInterval: 10s + # ## Allows to override the default URL path used for sending metrics. This option has no effect when using gRPC transport. + # path: /foo/v1/traces + # ## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector. + # tls: + # ## The path to the certificate authority, it defaults to the system bundle. + # ca: path/to/ca.crt + # ## The path to the public certificate. When using this option, setting the key option is required. + # cert: path/to/foo.cert + # ## The path to the private key. When using this option, setting the cert option is required. + # key: path/to/key.key + # ## If set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers. + # insecureSkipVerify: true + # ## This instructs the reporter to send metrics to the OpenTelemetry Collector using gRPC. + # grpc: true + + ## + ## enable optional CRDs for Prometheus Operator + ## + ## Create a dedicated metrics service for use with ServiceMonitor + ## When hub.enabled is set to true, it's not needed: it will use hub service. + # service: + # enabled: false + # labels: {} + # annotations: {} + ## When set to true, it won't check if Prometheus Operator CRDs are deployed + # disableAPICheck: false + # serviceMonitor: + # metricRelabelings: [] + # - sourceLabels: [__name__] + # separator: ; + # regex: ^fluentd_output_status_buffer_(oldest|newest)_.+ + # replacement: $1 + # action: drop + # relabelings: [] + # - sourceLabels: [__meta_kubernetes_pod_node_name] + # separator: ; + # regex: ^(.*)$ + # targetLabel: nodename + # replacement: $1 + # action: replace + # jobLabel: traefik + # interval: 30s + # honorLabels: true + # # (Optional) + # # scrapeTimeout: 5s + # # honorTimestamps: true + # # enableHttp2: true + # # followRedirects: true + # # additionalLabels: + # # foo: bar + # # namespace: "another-namespace" + # # namespaceSelector: {} + # prometheusRule: + # additionalLabels: {} + # namespace: "another-namespace" + # rules: + # - alert: TraefikDown + # expr: up{job="traefik"} == 0 + # for: 5m + # labels: + # context: traefik + # severity: warning + # annotations: + # summary: "Traefik Down" + # description: "{{ $labels.pod }} on {{ $labels.nodename }} is down" + + tracing: {} + # instana: + # localAgentHost: 127.0.0.1 + # localAgentPort: 42699 + # logLevel: info + # enableAutoProfile: true + # datadog: + # localAgentHostPort: 127.0.0.1:8126 + # debug: false + # globalTag: "" + # prioritySampling: false + # jaeger: + # samplingServerURL: http://localhost:5778/sampling + # samplingType: const + # samplingParam: 1.0 + # localAgentHostPort: 127.0.0.1:6831 + # gen128Bit: false + # propagation: jaeger + # traceContextHeaderName: uber-trace-id + # disableAttemptReconnecting: true + # collector: + # endpoint: "" + # user: "" + # password: "" + # zipkin: + # httpEndpoint: http://localhost:9411/api/v2/spans + # sameSpan: false + # id128Bit: true + # sampleRate: 1.0 + # haystack: + # localAgentHost: 127.0.0.1 + # localAgentPort: 35000 + # globalTag: "" + # traceIDHeaderName: "" + # parentIDHeaderName: "" + # spanIDHeaderName: "" + # baggagePrefixHeaderName: "" + # elastic: + # serverURL: http://localhost:8200 + # secretToken: "" + # serviceEnvironment: "" + + globalArguments: + - "--global.checknewversion=false" + - "--global.sendanonymoususage=false" + + # + # Configure Traefik static configuration + # Additional arguments to be passed at Traefik's binary + # All available options available on https://docs.traefik.io/reference/static-configuration/cli/ + ## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"` + additionalArguments: + - "--serversTransport.insecureSkipVerify=true" + - "--log.level=DEBUG" + - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin + - --experimental.plugins.jwt.version=v0.7.0 + + + # Environment variables to be passed to Traefik's binary + env: [] + # - name: SOME_VAR + # value: some-var-value + # - name: SOME_VAR_FROM_CONFIG_MAP + # valueFrom: + # configMapRef: + # name: configmap-name + # key: config-key + # - name: SOME_SECRET + # valueFrom: + # secretKeyRef: + # name: secret-name + # key: secret-key + + envFrom: [] + # - configMapRef: + # name: config-map-name + # - secretRef: + # name: secret-name + + # Configure ports + ports: + # The name of this one can't be changed as it is used for the readiness and + # liveness probes, but you can adjust its config to your liking + traefik: + port: 9000 + # Use hostPort if set. + # hostPort: 9000 + # + # Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which + # means it's listening on all your interfaces and all your IPs. You may want + # to set this value if you need traefik to listen on specific interface + # only. + # hostIP: 192.168.100.10 + + # Override the liveness/readiness port. This is useful to integrate traefik + # with an external Load Balancer that performs healthchecks. + # Default: ports.traefik.port + # healthchecksPort: 9000 + + # Override the liveness/readiness scheme. Useful for getting ping to + # respond on websecure entryPoint. + # healthchecksScheme: HTTPS + + # Defines whether the port is exposed if service.type is LoadBalancer or + # NodePort. + # + # You SHOULD NOT expose the traefik port on production deployments. + # If you want to access it from outside of your cluster, + # use `kubectl port-forward` or create a secure ingress + expose: false + # The exposed port for this service + exposedPort: 9000 + # The port protocol (TCP/UDP) + protocol: TCP + web: + ## Enable this entrypoint as a default entrypoint. When a service doesn't explicity set an entrypoint it will only use this entrypoint. + # asDefault: true + port: 8000 + # hostPort: 8000 + expose: true + exposedPort: 80 + # The port protocol (TCP/UDP) + protocol: TCP + # Use nodeport if set. This is useful if you have configured Traefik in a + # LoadBalancer. + # nodePort: 32080 + # Port Redirections + # Added in 2.2, you can make permanent redirects via entrypoints. + # https://docs.traefik.io/routing/entrypoints/#redirection + redirectTo: websecure + # + # Trust forwarded headers information (X-Forwarded-*). + # forwardedHeaders: + # trustedIPs: [] + # insecure: false + # + # Enable the Proxy Protocol header parsing for the entry point + # proxyProtocol: + # trustedIPs: [] + # insecure: false + websecure: + ## Enable this entrypoint as a default entrypoint. When a service doesn't explicity set an entrypoint it will only use this entrypoint. + # asDefault: true + port: 8443 + # hostPort: 8443 + expose: true + exposedPort: 443 + ## The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # + ## Enable HTTP/3 on the entrypoint + ## Enabling it will also enable http3 experimental feature + ## https://doc.traefik.io/traefik/routing/entrypoints/#http3 + ## There are known limitations when trying to listen on same ports for + ## TCP & UDP (Http3). There is a workaround in this chart using dual Service. + ## https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741 + http3: + enabled: false + # advertisedPort: 4443 + # + ## Trust forwarded headers information (X-Forwarded-*). + #forwardedHeaders: + # trustedIPs: [] + # insecure: false + # + ## Enable the Proxy Protocol header parsing for the entry point + #proxyProtocol: + # trustedIPs: [] + # insecure: false + # + ## Set TLS at the entrypoint + ## https://doc.traefik.io/traefik/routing/entrypoints/#tls + tls: + enabled: true + # this is the name of a TLSOption definition + options: "" + certResolver: "" + domains: [] + # - main: example.com + # sans: + # - foo.example.com + # - bar.example.com + # + # One can apply Middlewares on an entrypoint + # https://doc.traefik.io/traefik/middlewares/overview/ + # https://doc.traefik.io/traefik/routing/entrypoints/#middlewares + # /!\ It introduces here a link between your static configuration and your dynamic configuration /!\ + # It follows the provider naming convention: https://doc.traefik.io/traefik/providers/overview/#provider-namespace + # middlewares: + # - namespace-name1@kubernetescrd + # - namespace-name2@kubernetescrd + middlewares: [] + metrics: + # When using hostNetwork, use another port to avoid conflict with node exporter: + # https://github.com/prometheus/prometheus/wiki/Default-port-allocations + port: 9100 + # hostPort: 9100 + # Defines whether the port is exposed if service.type is LoadBalancer or + # NodePort. + # + # You may not want to expose the metrics port on production deployments. + # If you want to access it from outside of your cluster, + # use `kubectl port-forward` or create a secure ingress + expose: false + # The exposed port for this service + exposedPort: 9100 + # The port protocol (TCP/UDP) + protocol: TCP + + # TLS Options are created as TLSOption CRDs + # https://doc.traefik.io/traefik/https/tls/#tls-options + # When using `labelSelector`, you'll need to set labels on tlsOption accordingly. + # Example: + # tlsOptions: + # default: + # labels: {} + # sniStrict: true + # preferServerCipherSuites: true + # customOptions: + # labels: {} + # curvePreferences: + # - CurveP521 + # - CurveP384 + tlsOptions: {} + + # TLS Store are created as TLSStore CRDs. This is useful if you want to set a default certificate + # https://doc.traefik.io/traefik/https/tls/#default-certificate + # Example: + # tlsStore: + # default: + # defaultCertificate: + # secretName: tls-cert + tlsStore: {} + + # Options for the main traefik service, where the entrypoints traffic comes + # from. + service: + enabled: true + ## Single service is using `MixedProtocolLBService` feature gate. + ## When set to false, it will create two Service, one for TCP and one for UDP. + single: true + type: LoadBalancer + # Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config) + annotations: {} + # Additional annotations for TCP service only + annotationsTCP: {} + # Additional annotations for UDP service only + annotationsUDP: {} + # Additional service labels (e.g. for filtering Service by custom labels) + labels: {} + # Additional entries here will be added to the service spec. + # Cannot contain type, selector or ports entries. + spec: + externalTrafficPolicy: Local + # loadBalancerIP: "1.2.3.4" + # clusterIP: "2.3.4.5" + loadBalancerSourceRanges: [] + # - 192.168.0.1/32 + # - 172.16.0.0/16 + externalIPs: [] + # - 1.2.3.4 + ## One of SingleStack, PreferDualStack, or RequireDualStack. + # ipFamilyPolicy: SingleStack + ## List of IP families (e.g. IPv4 and/or IPv6). + ## ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services + # ipFamilies: + # - IPv4 + # - IPv6 + ## + ## An additionnal and optional internal Service. + ## Same parameters as external Service + # internal: + # type: ClusterIP + # # labels: {} + # # annotations: {} + # # spec: {} + # # loadBalancerSourceRanges: [] + # # externalIPs: [] + # # ipFamilies: [ "IPv4","IPv6" ] + + ## Create HorizontalPodAutoscaler object. + ## + autoscaling: + enabled: true + minReplicas: 3 + maxReplicas: 10 + metrics: + #- type: Resource + # resource: + # name: memory + # target: + # type: Utilization + # averageUtilization: 80 + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 80 + behavior: + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Pods + value: 1 + periodSeconds: 60 + + # Enable persistence using Persistent Volume Claims + # ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + # It can be used to store TLS certificates, see `storage` in certResolvers + persistence: + enabled: false + name: data + # existingClaim: "" + accessMode: ReadWriteOnce + size: 128Mi + # storageClass: "" + # volumeName: "" + path: /data + annotations: {} + # subPath: "" # only mount a subpath of the Volume into the pod + + certResolvers: {} + # letsencrypt: + # # for challenge options cf. https://doc.traefik.io/traefik/https/acme/ + # email: email@example.com + # dnsChallenge: + # # also add the provider's required configuration under env + # # or expand then from secrets/configmaps with envfrom + # # cf. https://doc.traefik.io/traefik/https/acme/#providers + # provider: digitalocean + # # add futher options for the dns challenge as needed + # # cf. https://doc.traefik.io/traefik/https/acme/#dnschallenge + # delayBeforeCheck: 30 + # resolvers: + # - 1.1.1.1 + # - 8.8.8.8 + # tlsChallenge: true + # httpChallenge: + # entryPoint: "web" + # # It has to match the path with a persistent volume + # storage: /data/acme.json + + # If hostNetwork is true, runs traefik in the host network namespace + # To prevent unschedulabel pods due to port collisions, if hostNetwork=true + # and replicas>1, a pod anti-affinity is recommended and will be set if the + # affinity is left as default. + hostNetwork: false + + # Whether Role Based Access Control objects like roles and rolebindings should be created + rbac: + enabled: true + # If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces. + # If set to true, installs Role and RoleBinding. Providers will only watch target namespace. + namespaced: false + # Enable user-facing roles + # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles + # aggregateTo: [ "admin" ] + + # Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding + podSecurityPolicy: + enabled: false + + # The service account the pods will use to interact with the Kubernetes API + serviceAccount: + # If set, an existing service account is used + # If not set, a service account is created automatically using the fullname template + name: "" + + # Additional serviceAccount annotations (e.g. for oidc authentication) + serviceAccountAnnotations: {} + + resources: + requests: + cpu: "100m" + memory: "512Mi" + limits: + #cpu: "300m" + memory: "512Mi" + + # This example pod anti-affinity forces the scheduler to put traefik pods + # on nodes where no other traefik pods are scheduled. + # It should be used when hostNetwork: true to prevent port conflicts + affinity: {} + # podAntiAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # - labelSelector: + # matchLabels: + # app.kubernetes.io/name: '{{ template "traefik.name" . }}' + # app.kubernetes.io/instance: '{{ .Release.Name }}-{{ .Release.Namespace }}' + # topologyKey: kubernetes.io/hostname + + nodeSelector: {} + tolerations: [] + topologySpreadConstraints: [] + # # This example topologySpreadConstraints forces the scheduler to put traefik pods + # # on nodes where no other traefik pods are scheduled. + # - labelSelector: + # matchLabels: + # app: '{{ template "traefik.name" . }}' + # maxSkew: 1 + # topologyKey: kubernetes.io/hostname + # whenUnsatisfiable: DoNotSchedule + + # Pods can have priority. + # Priority indicates the importance of a Pod relative to other Pods. + priorityClassName: "" + + # Set the container security context + # To run the container with ports below 1024 this will need to be adjust to run as root + securityContext: + capabilities: + drop: [ALL] + readOnlyRootFilesystem: true + + podSecurityContext: + # # /!\ When setting fsGroup, Kubernetes will recursively changes ownership and + # # permissions for the contents of each volume to match the fsGroup. This can + # # be an issue when storing sensitive content like TLS Certificates /!\ + # fsGroup: 65532 + fsGroupChangePolicy: "OnRootMismatch" + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + + # + # Extra objects to deploy (value evaluated as a template) + # + # In some cases, it can avoid the need for additional, extended or adhoc deployments. + # See #595 for more details and traefik/tests/values/extra.yaml for example. + extraObjects: [] + + # This will override the default Release Namespace for Helm. + # It will not affect optional CRDs such as `ServiceMonitor` and `PrometheusRules` + # namespaceOverride: traefik + # + ## This will override the default app.kubernetes.io/instance label for all Objects. + # instanceLabelOverride: traefik diff --git a/master/uptimekuma/Chart.yaml b/master/uptimekuma/Chart.yaml new file mode 100644 index 0000000..0dcf730 --- /dev/null +++ b/master/uptimekuma/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: uptimekuma +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" diff --git a/master/uptimekuma/templates/deployment.yaml b/master/uptimekuma/templates/deployment.yaml new file mode 100644 index 0000000..d823327 --- /dev/null +++ b/master/uptimekuma/templates/deployment.yaml @@ -0,0 +1,42 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + component: uptime-kuma + name: deployment +spec: + selector: + matchLabels: + component: uptime-kuma + replicas: 1 + strategy: + type: Recreate + + template: + metadata: + labels: + component: uptime-kuma + spec: + containers: + - name: app + image: registry.durp.info/louislam/uptime-kuma:1 + ports: + - containerPort: 3001 + volumeMounts: + - mountPath: /app/data + name: storage + #livenessProbe: + #exec: + #command: + #- node + #- extra/healthcheck.js + readinessProbe: + httpGet: + path: / + port: 3001 + scheme: HTTP + + volumes: + - name: storage + persistentVolumeClaim: + claimName: uptimekuma-pvc diff --git a/master/uptimekuma/templates/ingress.yaml b/master/uptimekuma/templates/ingress.yaml new file mode 100644 index 0000000..86b65c8 --- /dev/null +++ b/master/uptimekuma/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: kuma-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kuma.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: service + port: 3001 + tls: + secretName: kuma-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kuma-tls +spec: + secretName: kuma-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "kuma.durp.info" + dnsNames: + - "kuma.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: heimdall-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: kuma.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/uptimekuma/templates/kuma-pv.yaml b/master/uptimekuma/templates/kuma-pv.yaml new file mode 100644 index 0000000..e17e5a7 --- /dev/null +++ b/master/uptimekuma/templates/kuma-pv.yaml @@ -0,0 +1,25 @@ +#apiVersion: v1 +#kind: PersistentVolume +#metadata: +# annotations: +# pv.kubernetes.io/provisioned-by: durp.info/nfs +# finalizers: +# - kubernetes.io/pv-protection +# name: uptimekuma-pv +#spec: +# accessModes: +# - ReadWriteMany +# capacity: +# storage: 10Gi +# claimRef: +# apiVersion: v1 +# kind: PersistentVolumeClaim +# name: uptimekuma-pvc +# namespace: uptimekuma +# nfs: +# path: /mnt/user/k3s/uptimekuma +# server: 192.168.20.253 +# persistentVolumeReclaimPolicy: Retain +# storageClassName: nfs-storage +# volumeMode: Filesystem +# \ No newline at end of file diff --git a/master/uptimekuma/templates/kuma-pvc.yaml b/master/uptimekuma/templates/kuma-pvc.yaml new file mode 100644 index 0000000..ab76bf0 --- /dev/null +++ b/master/uptimekuma/templates/kuma-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: uptimekuma-pvc + namespace: uptimekuma +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 10Gi + storageClassName: longhorn \ No newline at end of file diff --git a/master/uptimekuma/templates/service.yaml b/master/uptimekuma/templates/service.yaml new file mode 100644 index 0000000..cad08e7 --- /dev/null +++ b/master/uptimekuma/templates/service.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: service +spec: + selector: + component: uptime-kuma + type: ClusterIP + ports: + - name: http + port: 3001 + targetPort: 3001 + protocol: TCP \ No newline at end of file diff --git a/master/vault/Chart.yaml b/master/vault/Chart.yaml new file mode 100644 index 0000000..412c292 --- /dev/null +++ b/master/vault/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: vault +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: vault + repository: https://helm.releases.hashicorp.com + version: 0.30.0 + diff --git a/master/vault/templates/ingress.yaml b/master/vault/templates/ingress.yaml new file mode 100644 index 0000000..8998087 --- /dev/null +++ b/master/vault/templates/ingress.yaml @@ -0,0 +1,37 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: vault-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`vault.internal.durp.info`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: vault + port: 8200 + scheme: http + tls: + secretName: vault-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: vault-tls +spec: + secretName: vault-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "vault.internal.durp.info" + dnsNames: + - "vault.internal.durp.info" + diff --git a/master/vault/templates/secret-store.yaml b/master/vault/templates/secret-store.yaml new file mode 100644 index 0000000..e1feef8 --- /dev/null +++ b/master/vault/templates/secret-store.yaml @@ -0,0 +1,14 @@ +apiVersion: external-secrets.io/v1 +kind: ClusterSecretStore +metadata: + name: vault +spec: + provider: + vault: + server: "http://vault.vault.svc.cluster.local:8200" + path: "secrets" + version: "v2" + auth: + kubernetes: + mountPath: "kubernetes" + role: "external-secrets" diff --git a/master/vault/values.yaml b/master/vault/values.yaml new file mode 100644 index 0000000..b7c6d88 --- /dev/null +++ b/master/vault/values.yaml @@ -0,0 +1,65 @@ +vault: + + global: + + image: + repository: "registry.internal.durp.info/hashicorp/vault-k8s" + tag: "1.4.2" + pullPolicy: Always + + agentImage: + repository: "registry.internal.durp.info/hashicorp/vault" + tag: "1.17.6" + + injector: + enabled: "-" + + replicas: 3 + leaderElector: + enabled: true + + metrics: + enabled: true + + image: + repository: "registry.internal.durp.info/hashicorp/vault-k8s" + tag: "1.4.2" + pullPolicy: Always + + agentImage: + repository: "registry.internal.durp.info/hashicorp/vault" + tag: "1.17.6" + + server: + enabled: "-" + image: + repository: "registry.internal.durp.info/hashicorp/vault" + tag: "1.17.6" + pullPolicy: Always + ha: + enabled: false + replicas: 3 + resources: + requests: + memory: 256Mi + cpu: 250m + limits: + memory: 256Mi + cpu: 250m + + dataStorage: + enabled: true + size: 10Gi + storageClass: longhorn + accessMode: ReadWriteOnce + auditStorage: + enabled: false + size: 10Gi + mountPath: "/vault/audit" + storageClass: longhorn + accessMode: ReadWriteOnce + ui: + enabled: false + externalPort: 8200 + targetPort: 8200 + diff --git a/prd/terraform/k3s.tf b/prd/terraform/k3s.tf new file mode 100644 index 0000000..4d02a21 --- /dev/null +++ b/prd/terraform/k3s.tf @@ -0,0 +1,115 @@ +resource "proxmox_vm_qemu" "k3smaster" { + count = local.k3smaster.count + ciuser = "administrator" + vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" + name = local.k3smaster.name[count.index] + target_node = local.k3smaster.node[count.index] + clone = local.template + tags = local.k3smaster.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.k3smaster.cores + sockets = 1 + cpu_type = "host" + memory = local.k3smaster.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.k3smaster.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3smaster.drive + format = local.format + storage = local.k3smaster.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} + +resource "proxmox_vm_qemu" "k3sserver" { + count = local.k3sserver.count + ciuser = "administrator" + vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" + name = local.k3sserver.name[count.index] + target_node = local.k3sserver.node[count.index] + clone = local.template + tags = local.k3sserver.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.k3sserver.cores + sockets = 1 + cpu_type = "host" + memory = local.k3sserver.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.k3sserver.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3sserver.drive + format = local.format + storage = local.k3sserver.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} diff --git a/prd/terraform/main.tf b/prd/terraform/main.tf new file mode 100644 index 0000000..6be6739 --- /dev/null +++ b/prd/terraform/main.tf @@ -0,0 +1,48 @@ +terraform { + backend "http" {} + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc9" + } + } +} + +provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false +} + +locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + format = "raw" + dnsserver = "192.168.11.1" + vlan = 11 + k3smaster = { + tags = "k3s_prd" + count = 3 + name = ["master01-prd", "master02-prd", "master03-prd"] + cores = 2 + memory = "4096" + drive = 20 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] + } + k3sserver = { + tags = "k3s_prd" + count = 3 + name = ["node01-prd", "node02-prd", "node03-prd"] + cores = 4 + memory = "8192" + drive = 120 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] + } +} diff --git a/prd/terraform/variables.tf b/prd/terraform/variables.tf new file mode 100644 index 0000000..29a1c9d --- /dev/null +++ b/prd/terraform/variables.tf @@ -0,0 +1,14 @@ +variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string +} + +variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string +} + +variable "pm_user" { + description = "Username to Proxmox provider" + type = string +}