update

.gitignore

@@ -1,3 +1 @@
-*/.terraform
-*/.terraform.lock.hcl
 .idea

Untitled

@@ -1,4 +0,0 @@
-VAULT_HELM_SECRET_NAME=$(kubectl get secrets -n vault --output=json | jq -r '.items[].metadata | select(.name|startswith("vault-token-")).name')
-TOKEN_REVIEW_JWT=$(kubectl get secret $VAULT_HELM_SECRET_NAME -n vault --output='go-template={{ .data.token }}' | base64 --decode)
-KUBE_CA_CERT=$(kubectl config view --raw --minify --flatten --output='jsonpath={.clusters[].cluster.certificate-authority-data}' | base64 --decode)
-KUBE_HOST=$(kubectl config view --raw --minify --flatten --output='jsonpath={.clusters[].cluster.server}')

argocd/Chart.yaml

@@ -9,4 +9,6 @@ appVersion: "1.16.0"
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 8.6.4
+  version: 6.7.11
+
+

argocd/templates/InternalProxy.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: internalproxy
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: dmz
+    path: internalproxy
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: internalproxy
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true  
+    syncOptions:
+      - CreateNamespace=true   
+

argocd/templates/argocd.yaml

@@ -1,16 +1,16 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: nebula-sync
+  name: argocd
   namespace: argocd
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
+    targetRevision: dmz
-    path: infra/nebula-sync
+    path: argocd
   destination:
-    namespace: nebula-sync
+    namespace: argocd
     name: in-cluster
   syncPolicy:
     automated:

argocd/templates/cert-manager.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: dmz
+    path: cert-manager
+  destination:
+    namespace: cert-manager
+    name: in-cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true  
+    syncOptions:
+      - CreateNamespace=true 

argocd/templates/external-dns.yaml

@@ -1,21 +1,20 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: external-dns-dmz
+  name: external-dns
   namespace: argocd
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
+    targetRevision: dmz
-    path: dmz/external-dns
+    path: external-dns
   destination:
     namespace: external-dns
-    name: dmz
+    name: in-cluster
   syncPolicy:
     automated:
       prune: true
       selfHeal: true  
     syncOptions:
       - CreateNamespace=true 
-

argocd/templates/external-secrets.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: dmz
+    path: external-secrets
+  destination:
+    namespace: external-secrets
+    name: in-cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true  
+    syncOptions:
+      - CreateNamespace=true 

argocd/templates/gatekeeper.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gatekeeper
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: dmz
+    path: gatekeeper
+  destination:
+    namespace: gatekeeper
+    name: in-cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true  
+    syncOptions:
+      - CreateNamespace=true 

argocd/templates/gitlab-runner.yaml

@@ -1,18 +1,21 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: nfs
+  name: gitlab-runner
   namespace: argocd
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
+    targetRevision: dmz
-    path: infra/nfs
+    path: gitlab-runner
   destination:
-    namespace: kube-system
+    namespace: gitlab-runner
     name: in-cluster
   syncPolicy:
     automated:
       prune: true
       selfHeal: true  
+    syncOptions:
+      - CreateNamespace=true    
+

argocd/templates/kube-prometheus-stack.yaml

@@ -6,9 +6,9 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
+    targetRevision: dmz
-    path: infra/kube-prometheus-stack
+    path: kube-prometheus-stack
   destination:
     namespace: kube-prometheus-stack
     name: in-cluster
@@ -18,3 +18,4 @@ spec:
       selfHeal: true  
     syncOptions:
       - CreateNamespace=true 
+

argocd/templates/kubeclarity.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kubeclarity
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: dmz
+    path: kubeclarity
+  destination:
+    namespace: kubeclarity
+    name: in-cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true  
+    syncOptions:
+      - CreateNamespace=true 

argocd/templates/longhorn.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: internal-proxy
+  name: longhorn-system
   namespace: argocd
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
+    targetRevision: dmz
-    path: dmz/internalproxy
+    path: longhorn
   destination:
-    namespace: internalproxy
+    namespace: longhorn-system
-    name: dmz
+    name: in-cluster
   syncPolicy:
     automated:
       prune: true

argocd/templates/metallb-system.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: gitlab-runner-dmz
+  name: metallb-system
   namespace: argocd
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
+    targetRevision: dmz
-    path: dmz/gitlab-runner
+    path: metallb-system
   destination:
-    namespace: gitlab-runner
+    namespace: metallb-system
-    name: dmz
+    name: in-cluster
   syncPolicy:
     automated:
       prune: true
@@ -19,3 +19,4 @@ spec:
     syncOptions:
       - CreateNamespace=true 
 
+

argocd/templates/traefik.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: traefik
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: dmz
+    path: traefik
+  destination:
+    namespace: traefik
+    name: in-cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true  
+    syncOptions:
+      - CreateNamespace=true 

argocd/templates/uptimekuma.yaml

@@ -1,22 +1,23 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: openspeedtest
+  name: uptimekuma
   namespace: argocd
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
+    targetRevision: dmz
-    path: dmz/openspeedtest
+    path: uptimekuma
     directory:
       recurse: true
   destination:
-    name: dmz
+    server: https://kubernetes.default.svc
-    namespace: openspeedtest
+    namespace: uptimekuma
   syncPolicy:
     automated:
       prune: true
       selfHeal: true
     syncOptions:
       - CreateNamespace=true   
+

argocd/templates/vault.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vault
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: dmz
+    path: vault
+  destination:
+    namespace: vault
+    name: in-cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true  
+    syncOptions:
+      - CreateNamespace=true 
+  ignoreDifferences:
+  - group: admissionregistration.k8s.io
+    kind: MutatingWebhookConfiguration
+    jqPathExpressions:
+    - .webhooks[]?.clientConfig.caBundle

argocd/values.yaml

@@ -1,40 +1,40 @@
 argo-cd:
+
   global:
     revisionHistoryLimit: 1
     image:
-      repository: registry.durp.info/argoproj/argocd
+      repository: registry.internal.durp.info/argoproj/argocd
       imagePullPolicy: Always
 
-  #server:
+  server:
-  #extraArgs:
+    #extraArgs:
-  #  - --dex-server-plaintext
+    #  - --dex-server-plaintext
-  #  - --dex-server=argocd-dex-server:5556
+    #  - --dex-server=argocd-dex-server:5556
-  # oidc.config: |
+    # oidc.config: |
-  #   name: AzureAD
+    #   name: AzureAD
-  #   issuer: https://login.microsoftonline.com/TENANT_ID/v2.0
+    #   issuer: https://login.microsoftonline.com/TENANT_ID/v2.0
-  #   clientID: CLIENT_ID
+    #   clientID: CLIENT_ID
-  #   clientSecret: $oidc.azuread.clientSecret
+    #   clientSecret: $oidc.azuread.clientSecret
-  #   requestedIDTokenClaims:
+    #   requestedIDTokenClaims:
-  #     groups:
+    #     groups:
-  #       essential: true
+    #       essential: true
-  #   requestedScopes:
+    #   requestedScopes:
-  #     - openid
+    #     - openid
-  #     - profile
+    #     - profile
-  #     - email
+    #     - email
 
   dex:
     enabled: true
     image:
-      repository: registry.durp.info/dexidp/dex
+      repository: registry.internal.durp.info/dexidp/dex
       imagePullPolicy: Always
 
   configs:
     cm:
       create: true
       annotations: {}
-      url: https://argocd.infra.durp.info
+      url: https://argocd.internal.durp.info
       oidc.tls.insecure.skip.verify: "true"
-      accounts.provider-argocd: apiKey
       dex.config: |
         connectors:
           - config:
@@ -50,13 +50,11 @@ argo-cd:
             name: authentik
             type: oidc
             id: authentik
-      resource.exclusions: ""
 
     rbac:
       create: true
       policy.csv: |
         g, ArgoCD Admins, role:admin 
-        g, provider-argocd, role:admin
       scopes: "[groups]"
 
   server:

cert-manager/Chart.yaml

@@ -8,4 +8,4 @@ appVersion: 0.0.1
 dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
-  version: v1.17.2
+  version: 1.*.*

cert-manager/templates/letsencrypt-prroduction.yaml

@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-production
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-production
+    solvers:
+    - dns01:
+        cloudflare:
+          email: developerdurp@durp.info
+          apiTokenSecretRef:
+            name: cloudflare-api-token-secret
+            key: cloudflare-api-token-secret

cert-manager/templates/letsencrypt-staging.yaml

@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+    - dns01:
+        cloudflare:
+          email: developerdurp@durp.info
+          apiTokenSecretRef:
+            name: cloudflare-api-token-secret
+            key: cloudflare-api-token-secret

cert-manager/templates/sealedsecret.yaml

@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1
+apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: cloudflare-api-token-secret
@@ -11,12 +11,6 @@ spec:
   data:
   - secretKey: cloudflare-api-token-secret
     remoteRef:
-      key: kv/cert-manager
+      key: secrets/cert-manager
       property: cloudflare-api-token-secret
 
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault

cert-manager/values.yaml

@@ -1,10 +1,9 @@
 cert-manager:
-  crds:
-    enabled: true
   image:
     registry: registry.internal.durp.info
     repository: jetstack/cert-manager-controller
     pullPolicy: Always
+  installCRDs: true
   replicaCount: 3
   extraArgs:
     - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53

dev/.gitlab/.gitlab-ci.yml

@@ -1,95 +0,0 @@
-stages:
-  - plan
-  - apply
-  - destroy
-
-variables:
-  WORKDIR: $CI_PROJECT_DIR/dev/terraform
-  GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/dev
-
-image:
-  name: registry.durp.info/opentofu/opentofu:latest
-  entrypoint: [""]
-
-.tf-init:
-  before_script:
-    - cd $WORKDIR
-    - tofu init 
-      -reconfigure 
-      -backend-config="address=${GITLAB_TF_ADDRESS}" 
-      -backend-config="lock_address=${GITLAB_TF_ADDRESS}/lock" 
-      -backend-config="unlock_address=${GITLAB_TF_ADDRESS}/lock"
-      -backend-config="username=gitlab-ci-token" 
-      -backend-config="password=${CI_JOB_TOKEN}"
-      -backend-config="lock_method=POST"
-      -backend-config="unlock_method=DELETE"
-      -backend-config="retry_wait_min=5"
-
-format:
-  stage: .pre
-  allow_failure: false
-  script:
-    - cd $WORKDIR
-    - tofu fmt -diff -check -write=false
-  rules:
-    - changes:
-        - "dev/terraform/*.tf"
-
-validate:
-  stage: .pre
-  allow_failure: false
-  extends: .tf-init
-  script:
-    - tofu validate
-  rules:
-    - changes:
-        - "dev/terraform/*.tf"
-
-plan-dev-infrastructure:
-  stage: plan
-  variables:
-    PLAN: plan.tfplan
-    JSON_PLAN_FILE: tfplan.json
-    ENVIRONMENT_NAME: dev
-  allow_failure: false
-  extends: .tf-init
-  script:
-    - apk add --update curl jq
-    - alias convert_report="jq -r '([.resource_changes[].change.actions?]|flatten)|{\"create\":(map(select(.==\"create\"))|length),\"update\":(map(select(.==\"update\"))|length),\"delete\":(map(select(.==\"delete\"))|length)}'"
-    - tofu plan -out=$PLAN $ARGUMENTS
-    - tofu show --json $PLAN | jq -r '([.resource_changes[].change.actions?]|flatten)|{"create":(map(select(.=="create"))|length),"update":(map(select(.=="update"))|length),"delete":(map(select(.=="delete"))|length)}' > $JSON_PLAN_FILE
-  artifacts:
-    reports:
-      terraform: $WORKDIR/$JSON_PLAN_FILE
-  needs: ["validate","format"]
-  rules:
-    - changes:
-        - "dev/terraform/*.tf"
-
-apply-dev-infrastructure:
-  stage: apply
-  variables:
-    ENVIRONMENT_NAME: dev
-  allow_failure: false
-  extends: .tf-init
-  script:
-    - tofu apply -auto-approve $ARGUMENTS
-  rules:
-    - changes:
-        - "dev/terraform/*.tf"
-      when: manual
-  needs: ["plan-dev-infrastructure"]
-
-destroy-dev-infrastructure:
-  stage: destroy
-  variables:
-    ENVIRONMENT_NAME: dev
-  allow_failure: false
-  extends: .tf-init
-  script:
-    - tofu destroy -auto-approve $ARGUMENTS
-  rules:
-    - changes:
-        - "dev/terraform/*.tf"
-      when: manual
-  needs: ["plan-dev-infrastructure"]

dev/cert-manager/templates/issuer.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: issuer
-secrets:
-  - name:  issuer-token-lmzpj
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: issuer-token-lmzpj
-  annotations:
-    kubernetes.io/service-account.name: issuer
-type: kubernetes.io/service-account-token

dev/external-dns/templates/secrets.yaml

@@ -1,30 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: external-dns-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: external-dns
-  data:
-  - secretKey: cloudflare_api_email
-    remoteRef:
-      key: kv/cloudflare
-      property: cloudflare_api_email
-  - secretKey: cloudflare_api_key
-    remoteRef:
-      key: kv/cloudflare
-      property: cloudflare_api_key
-  - secretKey: cloudflare_api_token
-    remoteRef:
-      key: kv/cloudflare
-      property: cloudflare_api_token
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault

dev/external-dns/values.yaml

@@ -1,18 +0,0 @@
-external-dns:
-  global:
-    imageRegistry: "registry.durp.info"
-
-  image:
-    pullPolicy: Always
-
-  txtPrefix: "dmz-"
-
-  sources:
-    - service
-    
-  provider: cloudflare
-  cloudflare:
-    secretName : "external-dns"
-    proxied: false
-
-  policy: sync

dev/external-secrets/Chart.yaml

@@ -1,11 +0,0 @@
-apiVersion: v2
-name: external-secrets
-description: A Helm chart for Kubernetes
-type: application
-version: 0.0.1
-appVersion: 0.0.1
-
-dependencies:
-- name: external-secrets
-  repository: https://charts.external-secrets.io
-  version: 0.17.0

dev/external-secrets/templates/ca.yaml

@@ -1,81 +0,0 @@
-apiVersion: v1
-data:
-  vault.pem: |
-    -----BEGIN CERTIFICATE-----
-    MIIEszCCA5ugAwIBAgIUZEzzxqEuYiKHkL1df+Cb22NRRJMwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzIyMzQ0MloXDTM1MDEy
-    MTExMTU1NVowIDEeMBwGA1UEAxMVdmF1bHQuaW5mcmEuZHVycC5pbmZvMIIBIjAN
-    BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkZM0ue4bMcmmATs+kGYSpR2hLUzq
-    scGIwCtqmaKCMbd1xhmgjnIR3zvSRptLR2GVGvc1ti6qby0jXYvcqbxkHvay00zW
-    2zYN+M2m4lXpuWzg1t6NEoO6XGAsGj2v0vcVktPPU9uj0rGUVGWWfsvjoXqQFg5I
-    jdxsxK9SvMvw2XtE3FgKxpzCyw94InIHlcPwFTO+3ZdKStZlMbUDIkmszLBrWFcr
-    XOsPDfLxqMy0Ck//LKIt8djh3254FHB1GG5+kI+JSW1o+tUcL2NymvIINwm/2acS
-    1uTm+j9W7iEXav0pJNmm+/dzSskc3Y0ftM0h2HCXgitBIaEZnUVneNHOLwIDAQAB
-    o4IB7zCCAeswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
-    BBYEFCaQ2q7j7LyBGETEZ5qaJAdlISKCMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2
-    dfBMWVYeWrQ2MIH0BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6
-    Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFo
-    dHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3Nw
-    MDEGCCsGAQUFBzAChiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtp
-    L2NhMDsGCCsGAQUFBzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVy
-    cC5pbmZvL3YxL3BraS9jYTAgBgNVHREEGTAXghV2YXVsdC5pbmZyYS5kdXJwLmlu
-    Zm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAx
-    L3YxL3BraS9jcmwwNqA0oDKGMGh0dHBzOi8vcm9vdC12YXVsdC5pbnRlcm5hbC5k
-    dXJwLmluZm8vdjEvcGtpL2NybDANBgkqhkiG9w0BAQsFAAOCAQEAuJ+lplY/+A5L
-    5LzkljbKDTy3U6PLv1LtxqVCOFGiJXBnXMjtVW07bBEUadzFRNW8GHQ3w5QzOG6k
-    /vE/TrrJho7l05J/uc+BUrPSNjefLmQV6hn4jrP86PR0vzRfbSqKKBIID9M7+zi6
-    GFvHlVkSHsQyMQp7JOoax9KVzW2Y+OIgw7Lgw2tP122WCt2SIF0QenoZHsoW0guj
-    tzTJRmJDjn6XeJ7L3FPkf37H6ub0Jg3zBGr6eorEFfYZNN5CXezjqMFBpRdq4UIo
-    1M3A7o3uyZFcFsp/vGDcMBkwaCsBV9idu/HwkvGaTUNI285ilBORPD0bMZnACq/9
-    +Q/cdsO5lg==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIEmzCCA4OgAwIBAgIUQwCAs82sgSuiaVbjANHScO2DSfAwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMjEyNVoXDTM1MDEy
-    MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF
-    AAOCAQ8AMIIBCgKCAQEAn9fjGRqqFsqguz56X6cXZwEMtD9wElwSFCb4Fc8YTzlH
-    4fV13QwXKESLE/Q+7bw4y4FJQ8BiGNbxxbQOOgWhfGGlQyFa1lfhJtYLfqRN5C2/
-    S7nr0YxDB9duc4OAExVL6Pr4/Koc+vDZY03l7RzwnF2AOM9DjFTASw01TphCQjRk
-    U+upiN2TUhUPejV/gMR+zXM6pn98UBKG1dNubS0HzAMwAEXAPm141NDyWUCPT9+3
-    6P03Ka8mUTx3X49OCtvJEGEQbtlnTFQaOSkP1yLW+XRMHw3sQaV2PWXu5fInbEpZ
-    +SuzmgLOXtmQNmHLav9q1qeTVkpBGPWvfh2Vh1JJhQIDAQABo4IB4zCCAd8wDgYD
-    VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJaP17f1Zw0V
-    55Ks9Uf0USVWl0BPMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2dfBMWVYeWrQ2MIH0
-    BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6Ly8xOTIuMTY4LjIw
-    LjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFodHRwczovL3Jvb3Qt
-    dmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3NwMDEGCCsGAQUFBzAC
-    hiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtpL2NhMDsGCCsGAQUF
-    BzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3Br
-    aS9jYTAUBgNVHREEDTALgglkdXJwLmluZm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0
-    cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9jcmwwNqA0oDKGMGh0dHBz
-    Oi8vcm9vdC12YXVsdC5pbnRlcm5hbC5kdXJwLmluZm8vdjEvcGtpL2NybDANBgkq
-    hkiG9w0BAQsFAAOCAQEAiqAZ4zNIEkCWcvpDRq0VyJuk59sVtJr5X4FscHQ179nE
-    QbbvMe+EBDFS6XQml1Elj8jiPa/D5O9Oc6Iisnm5+weZKwApz/lQ+XVkWLCoEplB
-    ZZ9fcWVCbMLt0xlt8qn5z/mYKfbCT7ZCqDO+prQZt+ADJcQbiknfroAAqEbNKxwN
-    Y9uUyOWNF3SxJEch4w2dtX+IEVmxeZnhMy8OuP0SQKl8aW40ugiG0ZD5yTBBfOD9
-    zsrGSU/iSatn0b7bevBhaL96hz1/rNR1cL+4/albX2hrr8Rv3/SB2DLtNQlQW0ls
-    AfhXAqP5zL+Ytgf1Of/pVdgnhxrYUY7RKCSGY5Hagw==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIDLzCCAhegAwIBAgIUNHdvOzam2HPVdwXpMHUy4wl8ZRYwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMTUyNVoXDTM1MDEy
-    MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF
-    AAOCAQ8AMIIBCgKCAQEA8XDTVEtRI3+k4yuvqVqfIiLRQJcXbmhfVtAeYk+5j9Ox
-    p1w9YHdnPLqLFrD1PzadjqYeAp/fwlEFfs6lqwoTS8S9vhaFqcgB57nVMb77dTBb
-    /08XHXOU6FPRjdFKm5QMpS7tn1XacPMy/o0bKqRREQeiuFDGVRyuF5PUgvWc1dvJ
-    l27JvvgYktgjfpNS4DlCxg4lGXT5abvaKf2hnr65egaIo/yRWN9wnvAzRiY7oci7
-    GA1oKz87Yc1tfL2gcynrwccOOCF/eUKesJR1I6GXNkN/a1fcr+Ld9Z9NhHBtO+vE
-    N8DsZY+kG7DE3M4BCCTFUzllcYHjaW4HaF9vZW+PYwIDAQABo3kwdzAOBgNVHQ8B
-    Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7WMLIaSkU75CJHZ1
-    8ExZVh5atDYwHwYDVR0jBBgwFoAU7WMLIaSkU75CJHZ18ExZVh5atDYwFAYDVR0R
-    BA0wC4IJZHVycC5pbmZvMA0GCSqGSIb3DQEBCwUAA4IBAQAS/qUI/1Yv07xUTK5k
-    r93kC7GSPpmpkXIsfjChAl93sebN143fu70NUP74jjCc0Wkb8hRofGg10E+/24r1
-    AI0KsLhzKzfIASxUVQAn8RTptLruaaPLboSA4MUZ8IB5y8Vy8E3/KtD0gD80j64Y
-    rm9XGHA0HTJHbPUTb/Rux2g0E7WtiyWSWH8mqzbegU8IrkM3eVT4+ylBE7YkfWDD
-    dw44sB71tfmDKpzWg6XQ6YMh0YfnyG1fYCj9LhuecNY9Uuo6cjDaAvkzMewWwqDx
-    Q2Ekas98Di6itCP8vET+gBDjeCc+XR6Hx6vzWmxlZhwDuxEKL1a2/DabUxJyMNzv
-    55Fn
-    -----END CERTIFICATE-----
-kind: ConfigMap
-metadata:
-  name: ca-pemstore

dev/external-secrets/values.yaml

@@ -1,94 +0,0 @@
-external-secrets:
-  replicaCount: 3
-  revisionHistoryLimit: 1
-  leaderElect: true
-
-  installCRDs: true
-  crds:
-    createClusterExternalSecret: true
-    createClusterSecretStore: true
-    createClusterGenerator: true
-    createPushSecret: true
-    conversion:
-      enabled: false
-
-  image:
-    repository: registry.durp.info/external-secrets/external-secrets
-    pullPolicy: Always
-
-  extraVolumes: 
-    - name: ca-pemstore
-      configMap:
-        name: ca-pemstore
-
-  extraVolumeMounts: 
-    - name: ca-pemstore
-      mountPath: /etc/ssl/certs/vault.pem
-      subPath: vault.pem
-      readOnly: true
-
-  resources: 
-    requests:
-      memory: 32Mi
-      cpu: 10m
-    limits:
-      memory: 32Mi
-      cpu: 10m
-
-  webhook:
-    create: false
-    failurePolicy: Ignore
-    log:
-      level: debug
-    image:
-      repository: registry.durp.info/external-secrets/external-secrets
-      pullPolicy: Always
-
-    extraVolumes: 
-      - name: ca-pemstore
-        configMap:
-          name: ca-pemstore
-
-    extraVolumeMounts: 
-      - name: ca-pemstore
-        mountPath: /etc/ssl/certs/vault.pem
-        subPath: vault.pem
-        readOnly: true
-
-    resources: 
-      requests:
-        memory: 32Mi
-        cpu: 10m
-      limits:
-        memory: 32Mi
-        cpu: 10m
-
-  certController:
-    create: false
-    revisionHistoryLimit: 1
-    log:
-      level: debug
-
-    image:
-      repository: registry.durp.info/external-secrets/external-secrets
-      pullPolicy: Always
-      tag: ""
-
-    resources: 
-      requests:
-        memory: 32Mi
-        cpu: 10m
-      limits:
-        memory: 32Mi
-        cpu: 10m
-
-    extraVolumes: 
-      - name: ca-pemstore
-        configMap:
-          name: ca-pemstore
-
-    extraVolumeMounts: 
-      - name: ca-pemstore
-        mountPath: /etc/ssl/certs/vault.pem
-        subPath: vault.pem
-        readOnly: true

dev/metallb-system/templates/config.yaml

@@ -1,17 +0,0 @@
-apiVersion: metallb.io/v1beta1
-kind: IPAddressPool
-metadata:
-  name: cheap
-spec:
-  addresses:
-    - 192.168.10.130-192.168.10.140
----
-apiVersion: metallb.io/v1beta1
-kind: L2Advertisement
-metadata:
-  name: pool
-  namespace: metallb-system
-spec:
-  ipAddressPools:
-  - cheap
-

dev/traefik/values.yaml

@@ -1,58 +0,0 @@
-traefik:
-  image:
-    #    registry: registry.durp.info
-    #    repository: traefik
-    pullPolicy: Always
-
-  providers:
-    kubernetesCRD:
-      allowCrossNamespace: true
-      allowExternalNameServices: true
-      allowEmptyServices: false
-
-  deployment:
-    replicas: 3
-    revisionHistoryLimit: 1
-
-  # volumes:
-  #   - name: traefik-configmap
-  #     mountPath: "/config"
-  #     type: configMap
-
-  ingressRoute:
-    dashboard:
-      enabled: true
-
-  additionalArguments:
-    #  - "--providers.file.filename=/config/config.yml"
-    - "--serversTransport.insecureSkipVerify=true"
-    - "--log.level=DEBUG"
-    - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin
-    - --experimental.plugins.jwt.version=v0.7.0
-
-  autoscaling:
-    enabled: true
-    minReplicas: 3
-    maxReplicas: 10
-    metrics:
-      - type: Resource
-        resource:
-          name: cpu
-          target:
-            type: Utilization
-            averageUtilization: 80
-    behavior:
-      scaleDown:
-        stabilizationWindowSeconds: 300
-        policies:
-          - type: Pods
-            value: 1
-            periodSeconds: 60
-
-  # -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for `traefik` container.
-  resources:
-    requests:
-      cpu: "100m"
-      memory: "512Mi"
-    limits:
-      memory: "512Mi"

dev/vault/Chart.yaml

@@ -1,12 +0,0 @@
-apiVersion: v2
-name: vault
-description: A Helm chart for Kubernetes
-type: application
-version: 0.0.1
-appVersion: 0.0.1
-
-dependencies:
-- name: vault
-  repository: https://helm.releases.hashicorp.com  
-  version: 0.30.0
-

dev/vault/templates/secret-store.yaml

@@ -1,23 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ClusterSecretStore
-metadata:
-  name: vault
-spec:
-  provider:
-    vault:
-      server: "https://vault.infra.durp.info"
-      path: "kv"
-      version: "v2"
-      auth:
-        kubernetes:
-          mountPath: "dmz-cluster"
-          role: "external-secrets"
-          serviceAccountRef:
-            name: "vault"
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault

dev/vault/values.yaml

@@ -1,13 +0,0 @@
-vault:
-  global:
-    enabled: true
-    tlsDisable: false
-    externalVaultAddr: "https://vault.infra.durp.info"
-    resources:
-      requests:
-        memory: 256Mi
-        cpu: 250m
-      limits:
-        memory: 256Mi
-        cpu: 250m
-  

dmz/.gitlab/.gitlab-ci.yml

@@ -1,95 +0,0 @@
-stages:
-  - plan
-  - apply
-  - destroy
-
-variables:
-  WORKDIR: $CI_PROJECT_DIR/dmz/terraform
-  GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/dmz
-
-image:
-  name: registry.durp.info/opentofu/opentofu:latest
-  entrypoint: [""]
-
-.tf-init:
-  before_script:
-    - cd $WORKDIR
-    - tofu init 
-      -reconfigure 
-      -backend-config="address=${GITLAB_TF_ADDRESS}" 
-      -backend-config="lock_address=${GITLAB_TF_ADDRESS}/lock" 
-      -backend-config="unlock_address=${GITLAB_TF_ADDRESS}/lock"
-      -backend-config="username=gitlab-ci-token" 
-      -backend-config="password=${CI_JOB_TOKEN}"
-      -backend-config="lock_method=POST"
-      -backend-config="unlock_method=DELETE"
-      -backend-config="retry_wait_min=5"
-
-format:
-  stage: .pre
-  allow_failure: false
-  script:
-    - cd $WORKDIR
-    - tofu fmt -diff -check -write=false
-  rules:
-    - changes:
-        - "dmz/terraform/*.tf"
-
-validate:
-  stage: .pre
-  allow_failure: false
-  extends: .tf-init
-  script:
-    - tofu validate
-  rules:
-    - changes:
-        - "dmz/terraform/*.tf"
-
-plan-dmz-infrastructure:
-  stage: plan
-  variables:
-    PLAN: plan.tfplan
-    JSON_PLAN_FILE: tfplan.json
-    ENVIRONMENT_NAME: dmz
-  allow_failure: false
-  extends: .tf-init
-  script:
-    - apk add --update curl jq
-    - alias convert_report="jq -r '([.resource_changes[].change.actions?]|flatten)|{\"create\":(map(select(.==\"create\"))|length),\"update\":(map(select(.==\"update\"))|length),\"delete\":(map(select(.==\"delete\"))|length)}'"
-    - tofu plan -out=$PLAN $ARGUMENTS
-    - tofu show --json $PLAN | jq -r '([.resource_changes[].change.actions?]|flatten)|{"create":(map(select(.=="create"))|length),"update":(map(select(.=="update"))|length),"delete":(map(select(.=="delete"))|length)}' > $JSON_PLAN_FILE
-  artifacts:
-    reports:
-      terraform: $WORKDIR/$JSON_PLAN_FILE
-  needs: ["validate","format"]
-  rules:
-    - changes:
-        - "dmz/terraform/*.tf"
-
-apply-dmz-infrastructure:
-  stage: apply
-  variables:
-    ENVIRONMENT_NAME: dmz
-  allow_failure: false
-  extends: .tf-init
-  script:
-    - tofu apply -auto-approve $ARGUMENTS
-  rules:
-    - changes:
-        - "dmz/terraform/*.tf"
-      when: manual
-  needs: ["plan-dmz-infrastructure"]
-
-destroy-dmz-infrastructure:
-  stage: destroy
-  variables:
-    ENVIRONMENT_NAME: dmz
-  allow_failure: false
-  extends: .tf-init
-  script:
-    - tofu destroy -auto-approve $ARGUMENTS
-  rules:
-    - changes:
-        - "dmz/terraform/*.tf"
-      when: manual
-  needs: ["plan-dmz-infrastructure"]

dmz/authentik/Chart.yaml

@@ -1,12 +0,0 @@
-apiVersion: v2
-name: authentik
-description: A Helm chart for Kubernetes
-type: application
-
-version: 0.1.0
-appVersion: "1.16.0"
-
-dependencies:
-  - name: authentik-remote-cluster
-    repository: https://charts.goauthentik.io
-    version: 2.1.0

dmz/authentik/values.yaml

@@ -1,30 +0,0 @@
-authentik-remote-cluster:
-  # -- Provide a name in place of `authentik`. Prefer using global.nameOverride if possible
-  nameOverride: ""
-  # -- String to fully override `"authentik.fullname"`. Prefer using global.fullnameOverride if possible
-  fullnameOverride: ""
-  # -- Override the Kubernetes version, which is used to evaluate certain manifests
-  kubeVersionOverride: ""
-
-  ## Globally shared configuration for authentik components.
-  global:
-    # -- Provide a name in place of `authentik`
-    nameOverride: ""
-    # -- String to fully override `"authentik.fullname"`
-    fullnameOverride: ""
-    # -- A custom namespace to override the default namespace for the deployed resources.
-    namespaceOverride: ""
-    # -- Common labels for all resources.
-    additionalLabels: {}
-      # app: authentik
-
-  # -- Annotations to apply to all resources
-  annotations: {}
-
-  serviceAccountSecret:
-    # -- Create a secret with the service account credentials
-    enabled: true
-
-  clusterRole:
-    # -- Create a clusterole in addition to a namespaced role.
-    enabled: true

dmz/cert-manager/Chart.yaml

@@ -1,11 +0,0 @@
-apiVersion: v2
-name: cert-manager
-description: A Helm chart for Kubernetes
-type: application
-version: 0.0.1
-appVersion: 0.0.1
-
-dependencies:
-- name: cert-manager
-  repository: https://charts.jetstack.io
-  version: v1.17.2

dmz/cert-manager/templates/issuer.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: issuer
-secrets:
-  - name:  issuer-token-lmzpj
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: issuer-token-lmzpj
-  annotations:
-    kubernetes.io/service-account.name: issuer
-type: kubernetes.io/service-account-token

dmz/cert-manager/templates/secretvault.yaml

@@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: cloudflare-api-token-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: cloudflare-api-token-secret
-  data:
-  - secretKey: cloudflare-api-token-secret
-    remoteRef:
-      key: kv/cert-manager
-      property: cloudflare-api-token-secret
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault

dmz/cert-manager/values.yaml

@@ -1,31 +0,0 @@
-cert-manager:
-  crds:
-    enabled: true
-  image:
-    registry: registry.durp.info
-    repository: jetstack/cert-manager-controller
-    pullPolicy: Always
-  replicaCount: 3
-  extraArgs:
-    - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53
-    - --dns01-recursive-nameservers-only
-  podDnsPolicy: None
-  podDnsConfig:
-    nameservers:
-      - "1.1.1.1"
-      - "1.0.0.1"
-  webhook:
-    image:
-      registry: registry.durp.info
-      repository: jetstack/cert-manager-webhook
-      pullPolicy: Always  
-  cainjector:
-    image:
-      registry: registry.durp.info
-      repository: jetstack/cert-manager-cainjector
-      pullPolicy: Always
-
-  hostAliases: 
-  - ip: 192.168.12.130
-    hostnames:
-    - vault.infra.durp.info

dmz/crowdsec/Chart.yaml

@@ -1,11 +0,0 @@
-apiVersion: v2
-name: crowdsec
-description: A Helm chart for Kubernetes
-type: application
-version: 0.0.1
-appVersion: 0.0.1
-
-dependencies:
-  - name: crowdsec
-    repository: https://crowdsecurity.github.io/helm-charts
-    version: 0.19.4

dmz/crowdsec/templates/secrets.yaml

@@ -1,29 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: enroll-key
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: enroll-key
-  data:
-    - secretKey: ENROLL_INSTANCE_NAME
-      remoteRef:
-        key: kv/crowdsec/dmz-enroll
-        property: ENROLL_INSTANCE_NAME
-    - secretKey: ENROLL_KEY
-      remoteRef:
-        key: kv/crowdsec/dmz-enroll
-        property: ENROLL_KEY
-    - secretKey: ENROLL_TAGS
-      remoteRef:
-        key: kv/crowdsec/dmz-enroll
-        property: ENROLL_TAGS
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault

dmz/crowdsec/values.yaml

@@ -1,24 +0,0 @@
-crowdsec:
-  #
-  image:
-    repository: registry.durp.info/crowdsecurity/crowdsec
-    pullPolicy: Always
-
-  # for raw logs format: json or cri (docker|containerd)
-  container_runtime: containerd
-  agent:
-    # Specify each pod whose logs you want to process
-    acquisition:
-      # The namespace where the pod is located
-      - namespace: traefik
-        # The pod name
-        podName: traefik-*
-        # as in crowdsec configuration, we need to specify the program name to find a matching parser
-        program: traefik
-    env:
-      - name: COLLECTIONS
-        value: "crowdsecurity/traefik"
-  lapi:
-    envFrom:
-      - secretRef:
-          name: enroll-key

dmz/external-dns/templates/secrets.yaml

@@ -1,30 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: external-dns-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: external-dns
-  data:
-  - secretKey: cloudflare_api_email
-    remoteRef:
-      key: kv/cloudflare
-      property: cloudflare_api_email
-  - secretKey: cloudflare_api_key
-    remoteRef:
-      key: kv/cloudflare
-      property: cloudflare_api_key
-  - secretKey: cloudflare_api_token
-    remoteRef:
-      key: kv/cloudflare
-      property: cloudflare_api_token
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault

dmz/external-dns/values.yaml

@@ -1,20 +0,0 @@
-external-dns:
-  global:
-    imageRegistry: "registry.durp.info"
-    security:
-      allowInsecureImages: true
-
-  image:
-    pullPolicy: Always
-
-  txtPrefix: "dmz-"
-
-  sources:
-    - service
-
-  provider: cloudflare
-  cloudflare:
-    secretName: "external-dns"
-    proxied: false
-
-  policy: sync

dmz/external-secrets/Chart.yaml

@@ -1,11 +0,0 @@
-apiVersion: v2
-name: external-secrets
-description: A Helm chart for Kubernetes
-type: application
-version: 0.0.1
-appVersion: 0.0.1
-
-dependencies:
-  - name: external-secrets
-    repository: https://charts.external-secrets.io
-    version: 0.17.0

dmz/external-secrets/templates/ca.yaml

@@ -1,81 +0,0 @@
-apiVersion: v1
-data:
-  vault.pem: |
-    -----BEGIN CERTIFICATE-----
-    MIIEszCCA5ugAwIBAgIUZEzzxqEuYiKHkL1df+Cb22NRRJMwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzIyMzQ0MloXDTM1MDEy
-    MTExMTU1NVowIDEeMBwGA1UEAxMVdmF1bHQuaW5mcmEuZHVycC5pbmZvMIIBIjAN
-    BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkZM0ue4bMcmmATs+kGYSpR2hLUzq
-    scGIwCtqmaKCMbd1xhmgjnIR3zvSRptLR2GVGvc1ti6qby0jXYvcqbxkHvay00zW
-    2zYN+M2m4lXpuWzg1t6NEoO6XGAsGj2v0vcVktPPU9uj0rGUVGWWfsvjoXqQFg5I
-    jdxsxK9SvMvw2XtE3FgKxpzCyw94InIHlcPwFTO+3ZdKStZlMbUDIkmszLBrWFcr
-    XOsPDfLxqMy0Ck//LKIt8djh3254FHB1GG5+kI+JSW1o+tUcL2NymvIINwm/2acS
-    1uTm+j9W7iEXav0pJNmm+/dzSskc3Y0ftM0h2HCXgitBIaEZnUVneNHOLwIDAQAB
-    o4IB7zCCAeswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
-    BBYEFCaQ2q7j7LyBGETEZ5qaJAdlISKCMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2
-    dfBMWVYeWrQ2MIH0BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6
-    Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFo
-    dHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3Nw
-    MDEGCCsGAQUFBzAChiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtp
-    L2NhMDsGCCsGAQUFBzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVy
-    cC5pbmZvL3YxL3BraS9jYTAgBgNVHREEGTAXghV2YXVsdC5pbmZyYS5kdXJwLmlu
-    Zm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAx
-    L3YxL3BraS9jcmwwNqA0oDKGMGh0dHBzOi8vcm9vdC12YXVsdC5pbnRlcm5hbC5k
-    dXJwLmluZm8vdjEvcGtpL2NybDANBgkqhkiG9w0BAQsFAAOCAQEAuJ+lplY/+A5L
-    5LzkljbKDTy3U6PLv1LtxqVCOFGiJXBnXMjtVW07bBEUadzFRNW8GHQ3w5QzOG6k
-    /vE/TrrJho7l05J/uc+BUrPSNjefLmQV6hn4jrP86PR0vzRfbSqKKBIID9M7+zi6
-    GFvHlVkSHsQyMQp7JOoax9KVzW2Y+OIgw7Lgw2tP122WCt2SIF0QenoZHsoW0guj
-    tzTJRmJDjn6XeJ7L3FPkf37H6ub0Jg3zBGr6eorEFfYZNN5CXezjqMFBpRdq4UIo
-    1M3A7o3uyZFcFsp/vGDcMBkwaCsBV9idu/HwkvGaTUNI285ilBORPD0bMZnACq/9
-    +Q/cdsO5lg==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIEmzCCA4OgAwIBAgIUQwCAs82sgSuiaVbjANHScO2DSfAwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMjEyNVoXDTM1MDEy
-    MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF
-    AAOCAQ8AMIIBCgKCAQEAn9fjGRqqFsqguz56X6cXZwEMtD9wElwSFCb4Fc8YTzlH
-    4fV13QwXKESLE/Q+7bw4y4FJQ8BiGNbxxbQOOgWhfGGlQyFa1lfhJtYLfqRN5C2/
-    S7nr0YxDB9duc4OAExVL6Pr4/Koc+vDZY03l7RzwnF2AOM9DjFTASw01TphCQjRk
-    U+upiN2TUhUPejV/gMR+zXM6pn98UBKG1dNubS0HzAMwAEXAPm141NDyWUCPT9+3
-    6P03Ka8mUTx3X49OCtvJEGEQbtlnTFQaOSkP1yLW+XRMHw3sQaV2PWXu5fInbEpZ
-    +SuzmgLOXtmQNmHLav9q1qeTVkpBGPWvfh2Vh1JJhQIDAQABo4IB4zCCAd8wDgYD
-    VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJaP17f1Zw0V
-    55Ks9Uf0USVWl0BPMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2dfBMWVYeWrQ2MIH0
-    BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6Ly8xOTIuMTY4LjIw
-    LjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFodHRwczovL3Jvb3Qt
-    dmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3NwMDEGCCsGAQUFBzAC
-    hiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtpL2NhMDsGCCsGAQUF
-    BzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3Br
-    aS9jYTAUBgNVHREEDTALgglkdXJwLmluZm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0
-    cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9jcmwwNqA0oDKGMGh0dHBz
-    Oi8vcm9vdC12YXVsdC5pbnRlcm5hbC5kdXJwLmluZm8vdjEvcGtpL2NybDANBgkq
-    hkiG9w0BAQsFAAOCAQEAiqAZ4zNIEkCWcvpDRq0VyJuk59sVtJr5X4FscHQ179nE
-    QbbvMe+EBDFS6XQml1Elj8jiPa/D5O9Oc6Iisnm5+weZKwApz/lQ+XVkWLCoEplB
-    ZZ9fcWVCbMLt0xlt8qn5z/mYKfbCT7ZCqDO+prQZt+ADJcQbiknfroAAqEbNKxwN
-    Y9uUyOWNF3SxJEch4w2dtX+IEVmxeZnhMy8OuP0SQKl8aW40ugiG0ZD5yTBBfOD9
-    zsrGSU/iSatn0b7bevBhaL96hz1/rNR1cL+4/albX2hrr8Rv3/SB2DLtNQlQW0ls
-    AfhXAqP5zL+Ytgf1Of/pVdgnhxrYUY7RKCSGY5Hagw==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIDLzCCAhegAwIBAgIUNHdvOzam2HPVdwXpMHUy4wl8ZRYwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMTUyNVoXDTM1MDEy
-    MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF
-    AAOCAQ8AMIIBCgKCAQEA8XDTVEtRI3+k4yuvqVqfIiLRQJcXbmhfVtAeYk+5j9Ox
-    p1w9YHdnPLqLFrD1PzadjqYeAp/fwlEFfs6lqwoTS8S9vhaFqcgB57nVMb77dTBb
-    /08XHXOU6FPRjdFKm5QMpS7tn1XacPMy/o0bKqRREQeiuFDGVRyuF5PUgvWc1dvJ
-    l27JvvgYktgjfpNS4DlCxg4lGXT5abvaKf2hnr65egaIo/yRWN9wnvAzRiY7oci7
-    GA1oKz87Yc1tfL2gcynrwccOOCF/eUKesJR1I6GXNkN/a1fcr+Ld9Z9NhHBtO+vE
-    N8DsZY+kG7DE3M4BCCTFUzllcYHjaW4HaF9vZW+PYwIDAQABo3kwdzAOBgNVHQ8B
-    Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7WMLIaSkU75CJHZ1
-    8ExZVh5atDYwHwYDVR0jBBgwFoAU7WMLIaSkU75CJHZ18ExZVh5atDYwFAYDVR0R
-    BA0wC4IJZHVycC5pbmZvMA0GCSqGSIb3DQEBCwUAA4IBAQAS/qUI/1Yv07xUTK5k
-    r93kC7GSPpmpkXIsfjChAl93sebN143fu70NUP74jjCc0Wkb8hRofGg10E+/24r1
-    AI0KsLhzKzfIASxUVQAn8RTptLruaaPLboSA4MUZ8IB5y8Vy8E3/KtD0gD80j64Y
-    rm9XGHA0HTJHbPUTb/Rux2g0E7WtiyWSWH8mqzbegU8IrkM3eVT4+ylBE7YkfWDD
-    dw44sB71tfmDKpzWg6XQ6YMh0YfnyG1fYCj9LhuecNY9Uuo6cjDaAvkzMewWwqDx
-    Q2Ekas98Di6itCP8vET+gBDjeCc+XR6Hx6vzWmxlZhwDuxEKL1a2/DabUxJyMNzv
-    55Fn
-    -----END CERTIFICATE-----
-kind: ConfigMap
-metadata:
-  name: ca-pemstore

dmz/external-secrets/values.yaml

@@ -1,100 +0,0 @@
-external-secrets:
-  global:
-    security:
-      allowInsecureImages: true
-
-  log:
-    level: debug
-  replicaCount: 1
-  revisionHistoryLimit: 1
-  leaderElect: false
-
-  installCRDs: true
-  crds:
-    createClusterExternalSecret: true
-    createClusterSecretStore: true
-    createClusterGenerator: true
-    createPushSecret: true
-    conversion:
-      enabled: false
-
-  image:
-    repository: registry.durp.info/external-secrets/external-secrets
-    pullPolicy: Always
-
-  extraVolumes:
-    - name: ca-pemstore
-      configMap:
-        name: ca-pemstore
-
-  extraVolumeMounts:
-    - name: ca-pemstore
-      mountPath: /etc/ssl/certs/vault.pem
-      subPath: vault.pem
-      readOnly: true
-
-  #  resources:
-  #    requests:
-  #      memory: 32Mi
-  #      cpu: 10m
-  #    limits:
-  #      memory: 32Mi
-  #      cpu: 10m
-
-  webhook:
-    create: false
-    failurePolicy: Ignore
-    log:
-      level: debug
-    image:
-      repository: registry.durp.info/external-secrets/external-secrets
-      pullPolicy: Always
-
-    extraVolumes:
-      - name: ca-pemstore
-        configMap:
-          name: ca-pemstore
-
-    extraVolumeMounts:
-      - name: ca-pemstore
-        mountPath: /etc/ssl/certs/vault.pem
-        subPath: vault.pem
-        readOnly: true
-
-  #    resources:
-  #      requests:
-  #        memory: 32Mi
-  #        cpu: 10m
-  #      limits:
-  #        memory: 32Mi
-  #        cpu: 10m
-
-  certController:
-    create: false
-    revisionHistoryLimit: 1
-    log:
-      level: debug
-
-    image:
-      repository: registry.durp.info/external-secrets/external-secrets
-      pullPolicy: Always
-      tag: ""
-
-    resources:
-      requests:
-        memory: 32Mi
-        cpu: 10m
-      limits:
-        memory: 32Mi
-        cpu: 10m
-
-    extraVolumes:
-      - name: ca-pemstore
-        configMap:
-          name: ca-pemstore
-
-    extraVolumeMounts:
-      - name: ca-pemstore
-        mountPath: /etc/ssl/certs/vault.pem
-        subPath: vault.pem
-        readOnly: true

dmz/gitlab-runner/templates/secrets.yaml

@@ -1,48 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitlab-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: gitlab-secret
-  data:
-  - secretKey: runner-registration-token
-    remoteRef:
-      key: kv/gitlab/runner
-      property: runner-registration-token
-  - secretKey: runner-token
-    remoteRef:
-      key: kv/gitlab/runner
-      property: runner-token
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault
-
----
-
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitlab-secret-personal
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: gitlab-secret-personal
-  data:
-  - secretKey: runner-token
-    remoteRef:
-      key: kv/gitlab/runner
-      property: personal-runner-token
-  - secretKey: runner-registration-token
-    remoteRef:
-      key: kv/gitlab/runner
-      property: personal-runner-token

dmz/internalproxy/templates/argocd.yaml

@@ -1,34 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: argocd-infra-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`argocd.infra.durp.info`)
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      kind: Rule
-      services:
-        - name: infra-cluster
-          port: 443
-          scheme: https
-  tls:
-    secretName: argocd-infra-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: argocd-infra-tls
-spec:
-  secretName: argocd-infra-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "argocd.infra.durp.info"
-  dnsNames:
-    - "argocd.infra.durp.info"

dmz/internalproxy/templates/authentik.yaml

@@ -1,40 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: authentik-tls
-spec:
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  secretName: authentik-tls
-  commonName: "authentik.durp.info"
-  dnsNames:
-    - "authentik.durp.info"
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: authentik-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`authentik.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: infra-cluster
-          port: 443
-  tls:
-    secretName: authentik-tls
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: authentik-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/bitwarden.yaml

@@ -1,42 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: bitwarden-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`) 
-    kind: Rule
-    services:
-    - name: infra-cluster
-      port: 443
-  tls:
-    secretName: bitwarden-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: bitwarden-tls
-spec:
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  secretName: bitwarden-tls
-  commonName: "bitwarden.durp.info"
-  dnsNames:
-  - "bitwarden.durp.info"
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: bitwarden-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/duplicati.yaml

@@ -1,35 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: duplicati-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/`)
-    middlewares:
-    - name: whitelist
-      namespace: traefik
-    - name: authentik-proxy-provider
-      namespace: traefik  
-    kind: Rule
-    services:
-    - name: unraid
-      port: 8200
-  tls:
-    secretName: duplicati-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: duplicati-tls
-spec:
-  secretName: duplicati-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "duplicati.internal.durp.info"
-  dnsNames:
-  - "duplicati.internal.durp.info"  

dmz/internalproxy/templates/endpoints.yaml

@@ -1,230 +0,0 @@
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: master-cluster
-subsets:
-  - addresses:
-      - ip: 192.168.20.130
-    ports:
-      - port: 443
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: master-cluster
-spec:
-  ports:
-    - protocol: TCP
-      port: 443
-      targetPort: 443
-
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: infra-cluster
-subsets:
-  - addresses:
-      - ip: 192.168.12.130
-    ports:
-      - port: 443
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: infra-cluster
-spec:
-  ports:
-    - protocol: TCP
-      port: 443
-      targetPort: 443
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: unraid
-spec:
-  ports:
-    - name: https
-      protocol: TCP
-      port: 443
-      targetPort: 443
-    - name: tdarr
-      port: 8267
-      protocol: TCP
-      targetPort: 8267
-    - name: duplicati
-      port: 8200
-      protocol: TCP
-      targetPort: 8200
-    - name: forgejo
-      port: 3000
-      protocol: TCP
-    - name: kuma
-      port: 3001
-      protocol: TCP
-      targetPort: 3000
-    - name: freshrss
-      port: 8085
-      protocol: TCP
-      targetPort: 8085
-    - name: gitlab-ssh
-      port: 9022
-      protocol: TCP
-      targetPort: 9022
-    - name: gitlab
-      port: 9443
-      protocol: TCP
-      targetPort: 9443
-    - name: minio
-      port: 9769
-      protocol: TCP
-      targetPort: 9769
-    - name: nextcloud
-      port: 11000
-      protocol: TCP
-      targetPort: 11000
-    - name: nexus
-      port: 8081
-      protocol: TCP
-      targetPort: 8081
-    - name: openweb-ui
-      port: 8089
-      protocol: TCP
-      targetPort: 8089
-    - name: plex
-      port: 32400
-      protocol: TCP
-      targetPort: 32400
-    - name: registry
-      port: 5000
-      protocol: TCP
-      targetPort: 5000
-    - name: gitlab-registry
-      port: 5002
-      protocol: TCP
-      targetPort: 5002
-    - name: root-vault
-      port: 8201
-      protocol: TCP
-      targetPort: 8201
-    - name: s3
-      port: 9768
-      protocol: TCP
-      targetPort: 9768
-    - name: smokeping
-      port: 81
-      protocol: TCP
-      targetPort: 81
-    - name: gotify
-      port: 8070
-      protocol: TCP
-
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: unraid
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: https
-        port: 443
-        protocol: TCP
-      - name: tdarr
-        port: 8267
-        protocol: TCP
-      - name: duplicati
-        port: 8200
-        protocol: TCP
-      - name: forgejo
-        port: 3000
-        protocol: TCP
-      - name: kuma
-        port: 3001
-        protocol: TCP
-      - name: freshrss
-        port: 8085
-        protocol: TCP
-      - name: gitlab-ssh
-        port: 9022
-        protocol: TCP
-      - name: gitlab
-        port: 9443
-        protocol: TCP
-      - name: minio
-        port: 9769
-        protocol: TCP
-      - name: nextcloud
-        port: 11000
-        protocol: TCP
-      - name: nexus
-        port: 8081
-        protocol: TCP
-      - name: openweb-ui
-        port: 8089
-        protocol: TCP
-      - name: plex
-        port: 32400
-        protocol: TCP
-      - name: registry
-        port: 5000
-        protocol: TCP
-      - name: gitlab-registry
-        port: 5002
-        protocol: TCP
-      - name: root-vault
-        port: 8201
-        protocol: TCP
-      - name: s3
-        port: 9768
-        protocol: TCP
-      - name: smokeping
-        port: 81
-        protocol: TCP
-      - name: gotify
-        port: 8070
-        protocol: TCP
-
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: ubuntu
-subsets:
-  - addresses:
-      - ip: 192.168.20.104
-    ports:
-      - name: https
-        port: 443
-        protocol: TCP
-      - name: litellm
-        port: 4000
-        protocol: TCP
-      - name: ollama
-        port: 11435
-        protocol: TCP
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: ubuntu
-spec:
-  ports:
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    - name: litellm
-      port: 4000
-      protocol: TCP
-      targetPort: 4000
-    - name: ollama
-      port: 11435
-      protocol: TCP
-      targetPort: 11435

dmz/internalproxy/templates/forgejo.yaml

@@ -1,43 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: forgejo-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`forgejo.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 3000
-          scheme: http
-  tls:
-    secretName: forgejo-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: forgejo-tls
-spec:
-  secretName: forgejo-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "forgejo.durp.info"
-  dnsNames:
-    - "forgejo.durp.info"
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: forgejo-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: forgejo.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/freshrss.yaml

@@ -1,30 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: freshrss-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`freshrss.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 8085
-  tls:
-    secretName: freshrss-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: freshrss-tls
-spec:
-  secretName: freshrss-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "freshrss.durp.info"
-  dnsNames:
-    - "freshrss.durp.info"

dmz/internalproxy/templates/gitlab.yaml

@@ -1,125 +0,0 @@
-#apiVersion: v1
-#kind: Service
-#metadata:
-#  name: gitlab-ssh
-#spec:
-#  ports:
-#    - name: app
-#      port: 9022
-#      protocol: TCP
-#      targetPort: 9022
-#  clusterIP: None
-#  type: ClusterIP
-#
-#---
-#apiVersion: v1
-#kind: Endpoints
-#metadata:
-#  name: gitlab-ssh
-#subsets:
-#  - addresses:
-#      - ip: 192.168.21.200
-#    ports:
-#      - name: app
-#        port: 9022
-#        protocol: TCP
-#
-#---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRouteTCP
-metadata:
-  name: gitlab-ssh
-spec:
-  entryPoints:
-    - gitlab-ssh
-  routes:
-    - match: HostSNI(`*`)
-      services:
-        - name: unraid
-          port: 9022
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gitlab-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`gitlab.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 9443
-          scheme: https
-  tls:
-    secretName: gitlab-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: gitlab-tls
-spec:
-  secretName: gitlab-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "gitlab.durp.info"
-  dnsNames:
-    - "gitlab.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: gitlab-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: gitlab.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gitlab-registry
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`images.durp.info`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 5002
-          scheme: http
-  tls:
-    secretName: gitlab-images-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: gitlab-images-tls
-spec:
-  secretName: gitlab-images-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "images.durp.info"
-  dnsNames:
-    - "images.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: gitlab-images-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: images.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/gotify.yaml

@@ -1,41 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gotify-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`gotify.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 8070
-          scheme: http
-  tls:
-    secretName: gotify-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: gotify-tls
-spec:
-  secretName: gotify-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "gotify.durp.info"
-  dnsNames:
-    - "gotify.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: gotify-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: gotify.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/grafana.yaml

@@ -1,40 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: grafana-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`grafana.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: infra-cluster
-          port: 443
-  tls:
-    secretName: grafana-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: grafana-tls
-spec:
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  secretName: grafana-tls
-  commonName: "grafana.durp.info"
-  dnsNames:
-    - "grafana.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: grafana-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: grafana.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/invidious.yaml

@@ -1,75 +0,0 @@
-#apiVersion: v1
-#kind: Service
-#metadata:
-#  name: invidious
-#spec:
-#  ports:
-#  - name: app
-#    port: 3000
-#    protocol: TCP
-#    targetPort: 3000
-#  clusterIP: None
-#  type: ClusterIP
-#
-#---
-#
-#apiVersion: v1
-#kind: Endpoints
-#metadata:
-#  name: invidious
-#subsets:
-#- addresses:
-#  - ip: 192.168.20.104
-#  ports:
-#  - name: app
-#    port: 3000
-#    protocol: TCP
-#
-#---
-#
-#apiVersion: traefik.io/v1alpha1
-#kind: IngressRoute
-#metadata:
-#  name: invidious-ingress
-#spec:
-#  entryPoints:
-#    - websecure
-#  routes:
-#  - match: Host(`invidious.durp.info`) && PathPrefix(`/`)
-#    middlewares:
-#    - name: authentik-proxy-provider
-#      namespace: traefik
-#    kind: Rule
-#    services:
-#    - name: invidious
-#      port: 3000
-#  tls:
-#    secretName: invidious-tls
-#
-#---
-#
-#apiVersion: cert-manager.io/v1
-#kind: Certificate
-#metadata:
-#  name: invidious-tls
-#spec:
-#  secretName: invidious-tls
-#  issuerRef:
-#    name: letsencrypt-production
-#    kind: ClusterIssuer
-#  commonName: "invidious.durp.info"
-#  dnsNames:
-#  - "invidious.durp.info"
-#
-#---
-#
-#kind: Service
-#apiVersion: v1
-#metadata:
-#  name: invidious-external-dns
-#  annotations:
-#    external-dns.alpha.kubernetes.io/hostname: invidious.durp.info
-#spec:
-#  type: ExternalName
-#  externalName: durp.info
-#

dmz/internalproxy/templates/kasm.yaml

@@ -1,43 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: kasm-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`kasm.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: ubuntu
-          port: 443
-          scheme: https
-  tls:
-    secretName: kasm-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: kasm-tls
-spec:
-  secretName: kasm-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "kasm.durp.info"
-  dnsNames:
-    - "kasm.durp.info"
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: kasm-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: kasm.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/litellm.yaml

@@ -1,42 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: litellm-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`litellm.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: ubuntu
-          port: 4000
-  tls:
-    secretName: litellm-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: litellm-tls
-spec:
-  secretName: litellm-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "litellm.durp.info"
-  dnsNames:
-    - "litellm.durp.info"
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: litellm-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: litellm.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/longhorn.yaml

@@ -1,34 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: longhorn-infra-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      middlewares:
-        - name: authentik-proxy-provider
-          namespace: traefik
-      services:
-        - name: infra-cluster
-          port: 443
-  tls:
-    secretName: longhorn-infra-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: longhorn-infra-tls
-spec:
-  secretName: longhorn-infra-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "longhorn.infra.durp.info"
-  dnsNames:
-    - "longhorn.infra.durp.info"

dmz/internalproxy/templates/minio.yaml

@@ -1,34 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: minio-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`minio.internal.durp.info`) && PathPrefix(`/`)
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      kind: Rule
-      services:
-        - name: unraid
-          port: 9769
-          scheme: http
-  tls:
-    secretName: minio-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: minio-tls
-spec:
-  secretName: minio-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "minio.internal.durp.info"
-  dnsNames:
-    - "minio.internal.durp.info"

dmz/internalproxy/templates/n8n.yaml

@@ -1,68 +0,0 @@
-#apiVersion: v1
-#kind: Service
-#metadata:
-#  name: n8n
-#spec:
-#  ports:
-#    - name: app
-#      port: 5678
-#      protocol: TCP
-#      targetPort: 5678
-#  clusterIP: None
-#  type: ClusterIP
-#
-#---
-#apiVersion: v1
-#kind: Endpoints
-#metadata:
-#  name: n8n
-#subsets:
-#  - addresses:
-#      - ip: 192.168.21.200
-#    ports:
-#      - name: app
-#        port: 5678
-#        protocol: TCP
-#
-#---
-#apiVersion: traefik.io/v1alpha1
-#kind: IngressRoute
-#metadata:
-#  name: n8n-ingress
-#spec:
-#  entryPoints:
-#    - websecure
-#  routes:
-#    - match: Host(`n8n.durp.info`) && PathPrefix(`/`)
-#      kind: Rule
-#      services:
-#        - name: n8n
-#          port: 5678
-#          scheme: http
-#  tls:
-#    secretName: n8n-tls
-#
-#---
-#apiVersion: cert-manager.io/v1
-#kind: Certificate
-#metadata:
-#  name: n8n-tls
-#spec:
-#  secretName: n8n-tls
-#  issuerRef:
-#    name: letsencrypt-production
-#    kind: ClusterIssuer
-#  commonName: "n8n.durp.info"
-#  dnsNames:
-#    - "n8n.durp.info"
-#
-#---
-#kind: Service
-#apiVersion: v1
-#metadata:
-#  name: n8n-dns
-#  annotations:
-#    dns.alpha.kubernetes.io/hostname: n8n.durp.info
-#spec:
-#  type: ExternalName
-#  externalName: durp.info

dmz/internalproxy/templates/nextcloud.yaml

@@ -1,74 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: nextcloud-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      middlewares:
-        - name: nextcloud-chain
-      services:
-        - name: unraid
-          port: 11000
-          scheme: http
-  tls:
-    secretName: nextcloud-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: nextcloud-tls
-spec:
-  secretName: nextcloud-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "nextcloud.durp.info"
-  dnsNames:
-    - "nextcloud.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: nextcloud-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: nextcloud.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info
-
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: nextcloud-secure-headers
-spec:
-  headers:
-    hostsProxyHeaders:
-      - "X-Forwarded-Host"
-    referrerPolicy: "same-origin"
-
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: https-redirect
-spec:
-  redirectScheme:
-    scheme: https
-
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: nextcloud-chain
-spec:
-  chain:
-    middlewares:
-      - name: https-redirect
-      - name: nextcloud-secure-headers

dmz/internalproxy/templates/ollama.yaml

@@ -1,69 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: ollama-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: ollama-secret
-  data:
-    - secretKey: users
-      remoteRef:
-        key: kv/ollama
-        property: users
-
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: ollama-basic-auth
-spec:
-  basicAuth:
-    headerField: x-api-key
-    secret: ollama-secret
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: ollama-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`ollama.durp.info`) && PathPrefix(`/`)
-      middlewares:
-        - name: ollama-basic-auth
-      kind: Rule
-      services:
-        - name: ubuntu
-          port: 11435
-  tls:
-    secretName: ollama-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: ollama-tls
-spec:
-  secretName: ollama-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "ollama.durp.info"
-  dnsNames:
-    - "ollama.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: ollama-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: ollama.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/open-webui.yaml

@@ -1,41 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: open-webui-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`open-webui.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 8089
-          scheme: http
-  tls:
-    secretName: open-webui-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: open-webui-tls
-spec:
-  secretName: open-webui-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "open-webui.durp.info"
-  dnsNames:
-    - "open-webui.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: open-webui-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/plex.yaml

@@ -1,41 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: plex-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`plex.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 32400
-          scheme: https
-  tls:
-    secretName: plex-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: plex-tls
-spec:
-  secretName: plex-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "plex.durp.info"
-  dnsNames:
-    - "plex.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: plex-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: plex.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info  

dmz/internalproxy/templates/portainer.yaml

@@ -1,33 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: portainer-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`)
-    middlewares:
-      - name: whitelist
-        namespace: traefik
-    kind: Rule
-    services:
-      - name: infra-cluster
-        port: 443
-  tls:
-    secretName: portainer-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: portainer-tls
-spec:
-  secretName: portainer-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "portainer.internal.durp.info"
-  dnsNames:
-  - "portainer.internal.durp.info"

dmz/internalproxy/templates/proxmox.yaml

@@ -1,63 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: proxmox
-spec:
-  ports:
-    - name: app
-      port: 8006
-      protocol: TCP
-      targetPort: 8006
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: proxmox
-subsets:
-  - addresses:
-      - ip: 192.168.21.254
-    ports:
-      - name: app
-        port: 8006
-        protocol: TCP
-
----
-
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: proxmox-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`proxmox.internal.durp.info`) && PathPrefix(`/`)
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      kind: Rule
-      services:
-        - name: proxmox
-          port: 8006
-          scheme: https
-  tls:
-    secretName: proxmox-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: proxmox-tls
-spec:
-  secretName: proxmox-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "proxmox.internal.durp.info"
-  dnsNames:
-    - "proxmox.internal.durp.info"

dmz/internalproxy/templates/redlib.yaml

@@ -1,74 +0,0 @@
-#apiVersion: v1
-#kind: Service
-#metadata:
-#  name: redlib
-#spec:
-#  ports:
-#  - name: app
-#    port: 8082
-#    protocol: TCP
-#    targetPort: 8082
-#  clusterIP: None
-#  type: ClusterIP
-#
-#---
-#
-#apiVersion: v1
-#kind: Endpoints
-#metadata:
-#  name: redlib
-#subsets:
-#- addresses:
-#  - ip: 192.168.21.200
-#  ports:
-#  - name: app
-#    port: 8082
-#    protocol: TCP
-#
-#---    
-#
-#apiVersion: traefik.io/v1alpha1
-#kind: IngressRoute
-#metadata:
-#  name: redlib-ingress
-#spec:
-#  entryPoints:
-#    - websecure
-#  routes:
-#  - match: Host(`redlib.durp.info`) && PathPrefix(`/`)
-#    middlewares:
-#    - name: authentik-proxy-provider
-#      namespace: traefik  
-#    kind: Rule
-#    services:
-#    - name: redlib
-#      port: 8082
-#  tls:
-#    secretName: redlib-tls
-#
-#---
-#
-#apiVersion: cert-manager.io/v1
-#kind: Certificate
-#metadata:
-#  name: redlib-tls
-#spec:
-#  secretName: redlib-tls
-#  issuerRef:
-#    name: letsencrypt-production
-#    kind: ClusterIssuer
-#  commonName: "redlib.durp.info"
-#  dnsNames:
-#  - "redlib.durp.info"  
-#
-#---
-#
-#kind: Service
-#apiVersion: v1
-#metadata:
-#  name: redlib-external-dns
-#  annotations:
-#    external-dns.alpha.kubernetes.io/hostname: redlib.durp.info
-#spec:
-#  type: ExternalName
-#  externalName: durp.info

dmz/internalproxy/templates/registry.yaml

@@ -1,43 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: registry-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`registry.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      services:
-        - name: unraid
-          port: 5000
-  tls:
-    secretName: registry-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: registry-tls
-spec:
-  secretName: registry-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "registry.durp.info"
-  dnsNames:
-    - "registry.durp.info"
-
----
-#kind: Service
-#apiVersion: v1
-#metadata:
-#  name: registry-external-dns
-#  annotations:
-#    external-dns.alpha.kubernetes.io/hostname: registry.durp.info
-#spec:
-#  type: ExternalName
-#  externalName: durp.info

dmz/internalproxy/templates/root-vault.yaml

@@ -1,33 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: root-vault-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`root-vault.internal.durp.info`) && PathPrefix(`/`)
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      kind: Rule
-      services:
-        - name: unraid
-          port: 8201
-          scheme: https
-  tls:
-    secretName: root-vault-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: root-vault-tls
-spec:
-  secretName: root-vault-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "root-vault.internal.durp.info"
-  dnsNames:
-    - "root-vault.internal.durp.info"

dmz/internalproxy/templates/s3.yaml

@@ -1,80 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: s3-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`s3.internal.durp.info`) && PathPrefix(`/`)
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      kind: Rule
-      services:
-        - name: unraid
-          port: 9768
-          scheme: http
-  tls:
-    secretName: s3-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: s3-tls
-spec:
-  secretName: s3-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "s3.internal.durp.info"
-  dnsNames:
-    - "s3.internal.durp.info"
-
----
-
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: s3-ingress-external
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`s3.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 9768
-          scheme: http
-  tls:
-    secretName: s3-external-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: s3-external-tls
-spec:
-  secretName: s3-external-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "s3.durp.info"
-  dnsNames:
-    - "s3.durp.info"
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: s3-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: s3.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/semaphore.yaml

@@ -1,65 +0,0 @@
-#
-#apiVersion: v1
-#kind: Service
-#metadata:
-#  name: semaphore
-#spec:
-#  ports:
-#    - name: app
-#      port: 3001
-#      protocol: TCP
-#      targetPort: 3001
-#  clusterIP: None
-#  type: ClusterIP
-#
-#---
-#
-#apiVersion: v1
-#kind: Endpoints
-#metadata:
-#  name: semaphore
-#subsets:
-#  - addresses:
-#      - ip: 192.168.21.200
-#    ports:
-#      - name: app
-#        port: 3001
-#        protocol: TCP
-#
-#---
-#
-#apiVersion: traefik.io/v1alpha1
-#kind: IngressRoute
-#metadata:
-#  name: semaphore-ingress
-#spec:
-#  entryPoints:
-#    - websecure
-#  routes:
-#    - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`)
-#      middlewares:
-#        - name: whitelist
-#          namespace: traefik
-#      kind: Rule
-#      services:
-#        - name: semaphore
-#          port: 3001
-#          scheme: http
-#  tls:
-#    secretName: semaphore-tls
-#
-#---
-#
-#apiVersion: cert-manager.io/v1
-#kind: Certificate
-#metadata:
-#  name: semaphore-tls
-#spec:
-#  secretName: semaphore-tls
-#  issuerRef:
-#    name: vault-issuer
-#    kind: ClusterIssuer
-#  commonName: "semaphore.internal.durp.info"
-#  dnsNames:
-#    - "semaphore.internal.durp.info"
-#

dmz/internalproxy/templates/serviceaccount.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault

dmz/internalproxy/templates/speedtest.yaml

@@ -1,74 +0,0 @@
-#apiVersion: v1
-#kind: Service
-#metadata:
-#  name: speedtest
-#spec:
-#  ports:
-#  - name: app
-#    port: 6580
-#    protocol: TCP
-#    targetPort: 6580
-#  clusterIP: None
-#  type: ClusterIP
-#
-#---
-#
-#apiVersion: v1
-#kind: Endpoints
-#metadata:
-#  name: speedtest
-#subsets:
-#- addresses:
-#  - ip: 192.168.21.200
-#  ports:
-#  - name: app
-#    port: 6580
-#    protocol: TCP
-#
-#---    
-#
-#apiVersion: traefik.io/v1alpha1
-#kind: IngressRoute
-#metadata:
-#  name: speedtest-ingress
-#spec:
-#  entryPoints:
-#    - websecure
-#  routes:
-#  - match: Host(`speedtest.durp.info`) && PathPrefix(`/`)
-#    kind: Rule
-#    middlewares:
-#    - name: authentik-proxy-provider
-#      namespace: traefik 
-#    services:
-#    - name: speedtest
-#      port: 6580
-#  tls:
-#    secretName: speedtest-tls
-#
-#---
-#
-#apiVersion: cert-manager.io/v1
-#kind: Certificate
-#metadata:
-#  name: speedtest-tls
-#spec:
-#  secretName: speedtest-tls
-#  issuerRef:
-#    name: letsencrypt-production
-#    kind: ClusterIssuer
-#  commonName: "speedtest.durp.info"
-#  dnsNames:
-#  - "speedtest.durp.info"  
-#
-#---
-#
-#kind: Service
-#apiVersion: v1
-#metadata:
-#  name: speedtest-external-dns
-#  annotations:
-#    external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info
-#spec:
-#  type: ExternalName
-#  externalName: durp.info

dmz/internalproxy/templates/unifi.yaml

@@ -1,63 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: unifi
-spec:
-  ports:
-    - name: app
-      port: 443
-      protocol: TCP
-      targetPort: 443
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: unifi
-subsets:
-  - addresses:
-      - ip: 192.168.98.1
-    ports:
-      - name: app
-        port: 443
-        protocol: TCP
-
----
-
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: unifi-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`unifi.internal.durp.info`) && PathPrefix(`/`)
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      kind: Rule
-      services:
-        - name: unifi
-          port: 443
-          scheme: https
-  tls:
-    secretName: unifi-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: unifi-tls
-spec:
-  secretName: unifi-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "unifi.internal.durp.info"
-  dnsNames:
-    - "unifi.internal.durp.info"

dmz/internalproxy/templates/unraid.yaml

@@ -1,34 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: unraid-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`unraid.internal.durp.info`) && PathPrefix(`/`)
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      kind: Rule
-      services:
-        - name: unraid
-          port: 443
-          scheme: https
-  tls:
-    secretName: unraid-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: unraid-tls
-spec:
-  secretName: unraid-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "unraid.internal.durp.info"
-  dnsNames:
-    - "unraid.internal.durp.info"

dmz/istio-system/Chart.yaml

@@ -1,17 +0,0 @@
-apiVersion: v2
-name: istio-system
-description: A Helm chart for Kubernetes
-type: application
-version: 0.0.1
-appVersion: 0.0.1
-
-dependencies:
-  - name: base
-    repository: https://istio-release.storage.googleapis.com/charts
-    version: 1.29.0
-  - name: istiod
-    repository: https://istio-release.storage.googleapis.com/charts
-    version: 1.26.2
-  - name: gateway
-    repository: https://istio-release.storage.googleapis.com/charts
-    version: 1.26.2

dmz/istio-system/templates/annotate.yaml

@@ -1,14 +0,0 @@
-#apiVersion: v1
-#kind: Namespace
-#metadata:
-#  annotations:
-#    topology.istio.io/controlPlaneClusters: cluster1
-#  labels:
-#    kubernetes.io/metadata.name: istio-system
-#  name: istio-system
-#spec:
-#  finalizers:
-#  - kubernetes
-#status:
-#  phase: Active
-#

dmz/istio-system/templates/expose.yaml

@@ -1,16 +0,0 @@
-apiVersion: networking.istio.io/v1
-kind: Gateway
-metadata:
-  name: cross-network-gateway
-spec:
-  selector:
-    istio: eastwestgateway
-  servers:
-    - port:
-        number: 15443
-        name: tls
-        protocol: TLS
-      tls:
-        mode: AUTO_PASSTHROUGH
-      hosts:
-        - "*.local"

dmz/istio-system/values.yaml

@@ -1,10 +0,0 @@
-istiod:
-  global:
-    network: network2
-    meshID: mesh1
-    multiCluster:
-      clusterName: dmz
-
-gateway:
-  name: istio-eastwestgateway
-  networkGateway: network2

dmz/littlelink/templates/deployment.yaml

@@ -1,101 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: littlelink
-  name: littlelink
-  labels:
-    app: littlelink
-spec:
-  selector:
-    matchLabels:
-      app: littlelink
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: littlelink
-    spec:
-      containers:
-      - name: littlelink
-        image: registry.durp.info/techno-tim/littlelink-server:latest
-        imagePullPolicy: Always
-        livenessProbe:
-          httpGet:
-            path: /healthcheck
-            port: 3000
-        readinessProbe:
-          httpGet:
-            path: /healthcheck
-            port: 3000            
-        env:
-          - name: META_TITLE
-            value: DeveloperDurp
-          - name: META_DESCRIPTION
-            value: The Durpy Developer
-          - name: META_AUTHOR
-            value: DeveloperDurp
-          - name: LANG
-            value: en
-          - name: META_INDEX_STATUS
-            value: all
-          - name: OG_TITLE
-            value: DeveloperDurp
-          - name: OG_DESCRIPTION
-            value: DeveloperDurp
-          - name: OG_URL
-            value: https://gitlab.com/developerdurp
-          - name: OG_IMAGE
-            value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png
-          - name : OG_IMAGE_WIDTH
-            value: "400"
-          - name : OG_IMAGE_HEIGHT
-            value: "400"
-          - name : THEME
-            value: Dark 
-          - name : FAVICON_URL
-            value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png
-          - name : AVATAR_URL
-            value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png
-          - name : AVATAR_2X_URL
-            value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png   
-          - name : AVATAR_ALT
-            value: DeveloperDurp Profile Pic
-          - name : NAME
-            value: DeveloperDurp
-          - name : BIO
-            value: Sup Nerd,
-          - name : BUTTON_ORDER
-            value: GITHUB,GITLAB,YOUTUBE,INSTAGRAM,TWITTER,BLUESKY,COFFEE,EMAIL
-          - name : TWITTER
-            value: https://twitter.com/developerdurp                
-          - name : GITHUB
-            value: https://github.com/DeveloperDurp
-          - name: INSTAGRAM
-            value: https://instagram.com/developerdurp
-          - name : GITLAB
-            value: https://gitlab.com/developerdurp
-          - name: YOUTUBE
-            value: https://www.youtube.com/channel/UC1rGa6s6kER_gLpIQsxeMVQ
-          - name : EMAIL
-            value: DeveloperDurp@durp.info
-          - name : EMAIL_TEXT
-            value: DeveloperDurp@durp.info            
-          - name : FOOTER
-            value: DeveloperDurp © 2022         
-          - name: CUSTOM_BUTTON_TEXT
-            value: BuyMeACoffee,BlueSky
-          - name: CUSTOM_BUTTON_URL
-            value: https://www.buymeacoffee.com/DeveloperDurp,https://bsky.app/profile/durp.info
-          - name: CUSTOM_BUTTON_COLOR
-            value: '#ffdd00,#1185fe'
-          - name: CUSTOM_BUTTON_TEXT_COLOR
-            value: '#000000,#FFFFFF'
-          - name: CUSTOM_BUTTON_ALT_TEXT
-            value: Support,BlueSky
-          - name: CUSTOM_BUTTON_NAME
-            value: COFFEE,BLUESKY
-          - name: CUSTOM_BUTTON_ICON
-            value: fa-solid fa-cup-togo
-        ports:
-        - name: http
-          containerPort: 3000          

dmz/littlelink/templates/ingress.yaml

@@ -1,42 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: littlelink-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`links.durp.info`) && PathPrefix(`/`)
-    kind: Rule
-    services:
-    - name: littlelink
-      port: 80
-  tls:
-    secretName: littlelink-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: littlelink-tls
-spec:
-  secretName: littlelink-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "links.durp.info"
-  dnsNames:
-  - "links.durp.info"  
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: links-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: links.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/littlelink/templates/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: littlelink
-spec:
-  ports:
-  - name: http
-    port: 80
-    targetPort: 3000
-    protocol: TCP 
-  selector:
-    app: littlelink

dmz/longhorn/Chart.yaml

@@ -1,12 +0,0 @@
-apiVersion: v2
-name: longhorn-system
-description: A Helm chart for Kubernetes
-type: application
-
-version: 0.1.0
-appVersion: "1.16.0"
-
-dependencies:
-- name: longhorn
-  repository: https://charts.longhorn.io
-  version: 1.9.0

dmz/longhorn/templates/ingress.yaml

@@ -1,34 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: longhorn-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`longhorn.dmz.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      middlewares:
-        - name: authentik-proxy-provider
-          namespace: traefik
-      services:
-        - name: longhorn-frontend
-          port: 80
-  tls:
-    secretName: longhorn-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: longhorn-tls
-spec:
-  secretName: longhorn-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "longhorn.dmz.durp.info"
-  dnsNames:
-    - "longhorn.dmz.durp.info"

dmz/metallb-system/Chart.yaml

@@ -1,12 +0,0 @@
-apiVersion: v2
-name: metallb-system
-description: A Helm chart for Kubernetes
-type: application
-
-version: 0.1.0
-appVersion: "1.16.0"
-
-dependencies:
-- name: metallb
-  repository: https://metallb.github.io/metallb
-  version: 0.15.2

dmz/metallb-system/templates/config.yaml

@@ -1,17 +0,0 @@
-apiVersion: metallb.io/v1beta1
-kind: IPAddressPool
-metadata:
-  name: cheap
-spec:
-  addresses:
-    - 192.168.98.130-192.168.98.140
----
-apiVersion: metallb.io/v1beta1
-kind: L2Advertisement
-metadata:
-  name: pool
-  namespace: metallb-system
-spec:
-  ipAddressPools:
-  - cheap
-

dmz/openspeedtest/Chart.yaml

@@ -1,7 +0,0 @@
-apiVersion: v2
-name: openspeedtest
-description: A Helm chart for Kubernetes
-type: application
-
-version: 0.1.0
-appVersion: "1.16.0"