Update Helm release authentik to v2025.12.1

.gitignore

@@ -1,3 +1,3 @@
-*/.terraform
-*/.terraform.lock.hcl
 .idea
+infra/terraform/.terraform
+infra/terraform/.terraform.lock.hcl

.gitlab/.gitlab-ci.yml

@@ -0,0 +1,34 @@
+stages:
+  - triggers
+
+build_dmz:
+  stage: triggers
+  trigger:
+    include: dmz/.gitlab/.gitlab-ci.yml
+  rules:
+    - changes:
+        - "dmz/terraform/*.tf"
+
+build_infra:
+  stage: triggers
+  trigger:
+    include: infra/.gitlab/.gitlab-ci.yml
+  rules:
+    - changes:
+        - "infra/terraform/*.tf"
+
+build_dev:
+  stage: triggers
+  trigger:
+    include: dev/.gitlab/.gitlab-ci.yml
+  rules:
+    - changes:
+        - "dev/terraform/*.tf"
+
+build_prd:
+  stage: triggers
+  trigger:
+    include: prd/.gitlab/.gitlab-ci.yml
+  rules:
+    - changes:
+        - "prd/terraform/*.tf"

ansible/base.yaml

@@ -0,0 +1,5 @@
+- hosts: all
+  gather_facts: yes
+  become: yes
+  roles:
+    - base

ansible/newcluster.yaml

@@ -0,0 +1,2 @@
+argocd login --insecure
+argocd cluster add default --name prd --yes --kubeconfig ~/Documents/config-prd

ansible/roles/base/files/01proxy

@@ -0,0 +1 @@
+Acquire::http::Proxy "http://192.168.21.200:3142";

ansible/roles/base/files/10periodic

@@ -0,0 +1,4 @@
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::AutocleanInterval "7";
+APT::Periodic::Unattended-Upgrade "1";

ansible/roles/base/files/authorized_keys_user

@@ -0,0 +1,2 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGilcndatMrXg06VxtNKuIo3scoyyXbYX8Z7cOjeA102AAAABHNzaDo= desktop-arch-09-08-2025-yubikey
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINsbNSZ5Wr+50Ahz+IeZxt6F7gZ6wm1J8uKXQLbdbKFaAAAABHNzaDo= desktop-arch-09-08-2025-yubikeyNano

ansible/roles/base/files/issue

@@ -0,0 +1,4 @@
+Use of this system is restricted to authorized users only, and all use is subjected to an acceptable use policy.
+
+IF YOU ARE NOT AUTHORIZED TO USE THIS SYSTEM, DISCONNECT NOW.
+

ansible/roles/base/files/motd

@@ -0,0 +1,4 @@
+THIS SYSTEM IS FOR AUTHORIZED USE ONLY
+
+All activities are logged and monitored.
+

ansible/roles/base/files/sshd_config_secured

@@ -0,0 +1,95 @@
+# Package generated configuration file
+# See the sshd_config(5) manpage for details
+
+# What ports, IPs and protocols we listen for
+Port 22
+# Use these options to restrict which interfaces/protocols sshd will bind to
+#ListenAddress ::
+#ListenAddress 0.0.0.0
+Protocol 2
+# HostKeys for protocol version 2
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_dsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+#Privilege Separation is turned on for security
+UsePrivilegeSeparation yes
+
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
+ServerKeyBits 1024
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 120
+PermitRootLogin no
+StrictModes yes
+
+RSAAuthentication yes
+PubkeyAuthentication yes
+#AuthorizedKeysFile %h/.ssh/authorized_keys
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts yes
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication no
+# similar for protocol version 2
+HostbasedAuthentication no
+# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
+#IgnoreUserKnownHosts yes
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication no
+
+# Change to no to disable tunnelled clear text passwords
+PasswordAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosGetAFSToken no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+X11Forwarding no
+X11DisplayOffset 10
+PrintMotd no
+PrintLastLog yes
+TCPKeepAlive yes
+#UseLogin no
+
+#MaxStartups 10:30:60
+#Banner /etc/issue.net
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+Subsystem sftp /usr/lib/openssh/sftp-server
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM yes
+
+ClientAliveInterval 300
+
+#enable remote powershell
+#Subsystem powershell /usr/bin/pwsh -sshs -NoLogo
+
+

ansible/roles/base/tasks/main.yaml

@@ -0,0 +1,155 @@
+- name: Copy apt proxy
+  copy: 
+    src: files/01proxy
+    dest: /etc/apt/apt.conf.d/01proxy
+    owner: root 
+    group: root 
+    mode: "0644"
+    force: yes
+  when: 
+    - ansible_os_family == "Debian"      
+    - inventory_hostname not in hosts_deny
+
+- name: Update packages
+  apt:
+    name: '*'
+    state: latest
+    update_cache: yes
+    only_upgrade: yes
+  retries: 300
+  delay: 10
+
+- name: Remove packages not needed anymore
+  apt:
+    autoremove: yes  
+  retries: 300
+  delay: 10      
+      
+- name: Install required packages Debian
+  apt: 
+    state: latest 
+    pkg: "{{ item }}"
+  with_items:  "{{ required_packages }}" 
+  retries: 300
+  delay: 10  
+
+- name: Create user account
+  user: 
+    name: "user"
+    shell: /bin/bash
+    state: present
+    createhome: yes
+
+- name: ensure ssh folder exists for user
+  file: 
+    path: /home/user/.ssh
+    owner: user 
+    group: user 
+    mode: "0700"
+    state: directory
+
+- name: Deploy SSH Key (user)
+  copy:
+    dest: /home/user/.ssh/authorized_keys
+    src: files/authorized_keys_user
+    owner: user 
+    group: user
+    force: true 
+
+- name: Remove Root SSH Configuration
+  file: 
+    path: /root/.ssh
+    state: absent
+
+- name: Copy Secured SSHD Configuration
+  copy: 
+    src: files/sshd_config_secured 
+    dest: /etc/ssh/sshd_config 
+    owner: root 
+    group: root 
+    mode: "0644"
+  when: ansible_os_family == "Debian"   
+
+- name: Copy Secured SSHD Configuration
+  copy: 
+    src: files/sshd_config_secured_redhat 
+    dest: /etc/ssh/sshd_config 
+    owner: root 
+    group: root 
+    mode: "0644"    
+  when: ansible_os_family == "RedHat"   
+
+- name: Restart SSHD
+  systemd:
+    name: sshd
+    daemon_reload: yes
+    state: restarted
+    enabled: yes
+  ignore_errors: yes
+
+
+- name: Copy unattended-upgrades file
+  copy: 
+    src: files/10periodic
+    dest: /etc/apt/apt.conf.d/10periodic 
+    owner: root 
+    group: root 
+    mode: "0644"
+    force: yes
+  when: ansible_os_family == "Debian"      
+
+- name: Remove undesirable packages
+  package:
+    name: "{{ unnecessary_software }}"
+    state: absent
+  when: ansible_os_family == "Debian"    
+
+- name: Stop and disable unnecessary services
+  service:
+    name: "{{ item }}"
+    state: stopped
+    enabled: no
+  with_items: "{{ unnecessary_services }}"
+  ignore_errors: yes
+
+- name: Set a message of the day
+  copy:
+    dest: /etc/motd
+    src: files/motd
+    owner: root
+    group: root
+    mode: 0644
+
+- name: Set a login banner
+  copy:
+    dest: "{{ item }}"
+    src: files/issue
+    owner: root
+    group: root
+    mode: 0644
+  with_items:
+    - /etc/issue
+    - /etc/issue.net
+
+- name: set timezone
+  shell: timedatectl set-timezone America/Chicago
+
+- name: Enable cockpit
+  systemd:
+    name: cockpit
+    daemon_reload: yes
+    state: restarted
+    enabled: yes
+
+- name: change password
+  ansible.builtin.user:
+    name: "user"
+    state: present
+    password: "{{ lookup('ansible.builtin.env', 'USER_PASSWORD') | password_hash('sha512') }}"
+
+- name: add user to sudoers
+  community.general.sudoers:
+    name: user
+    state: present
+    user: user
+    commands: ALL

ansible/roles/base/vars/main.yaml

@@ -0,0 +1,17 @@
+required_packages:
+    - ufw
+    - qemu-guest-agent
+    - fail2ban
+    - unattended-upgrades
+    - cockpit
+    - nfs-common
+    - open-iscsi
+
+unnecessary_services:
+    - postfix
+    - telnet
+    
+unnecessary_software:
+    - tcpdump
+    - nmap-ncat
+    - wpa_supplicant    

dev/terraform/k3s.tf

@@ -0,0 +1,115 @@
+resource "proxmox_vm_qemu" "k3smaster" {
+  count       = local.k3smaster.count
+  ciuser      = "administrator"
+  vmid        = "${local.vlan}${local.k3smaster.ip[count.index]}"
+  name        = local.k3smaster.name[count.index]
+  target_node = local.k3smaster.node[count.index]
+  clone       = local.template
+  tags        = local.k3smaster.tags
+  qemu_os     = "l26"
+  full_clone  = true
+  os_type     = "cloud-init"
+  agent       = 1
+  cores       = local.k3smaster.cores
+  sockets     = 1
+  cpu_type    = "host"
+  memory      = local.k3smaster.memory
+  scsihw      = "virtio-scsi-pci"
+  #bootdisk    = "scsi0"
+  boot    = "order=virtio0"
+  onboot  = true
+  sshkeys = local.sshkeys
+  vga {
+    type = "serial0"
+  }
+  serial {
+    id   = 0
+    type = "socket"
+  }
+  disks {
+    ide {
+      ide2 {
+        cloudinit {
+          storage = local.k3smaster.storage
+        }
+      }
+    }
+    virtio {
+      virtio0 {
+        disk {
+          size    = local.k3smaster.drive
+          format  = local.format
+          storage = local.k3smaster.storage
+        }
+      }
+    }
+  }
+  network {
+    id     = 0
+    model  = "virtio"
+    bridge = "vmbr0"
+    tag    = local.vlan
+  }
+  #Cloud Init Settings
+  ipconfig0    = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
+  searchdomain = "durp.loc"
+  nameserver   = local.dnsserver
+}
+
+resource "proxmox_vm_qemu" "k3sserver" {
+  count       = local.k3sserver.count
+  ciuser      = "administrator"
+  vmid        = "${local.vlan}${local.k3sserver.ip[count.index]}"
+  name        = local.k3sserver.name[count.index]
+  target_node = local.k3sserver.node[count.index]
+  clone       = local.template
+  tags        = local.k3sserver.tags
+  qemu_os     = "l26"
+  full_clone  = true
+  os_type     = "cloud-init"
+  agent       = 1
+  cores       = local.k3sserver.cores
+  sockets     = 1
+  cpu_type    = "host"
+  memory      = local.k3sserver.memory
+  scsihw      = "virtio-scsi-pci"
+  #bootdisk    = "scsi0"
+  boot    = "order=virtio0"
+  onboot  = true
+  sshkeys = local.sshkeys
+  vga {
+    type = "serial0"
+  }
+  serial {
+    id   = 0
+    type = "socket"
+  }
+  disks {
+    ide {
+      ide2 {
+        cloudinit {
+          storage = local.k3sserver.storage
+        }
+      }
+    }
+    virtio {
+      virtio0 {
+        disk {
+          size    = local.k3sserver.drive
+          format  = local.format
+          storage = local.k3sserver.storage
+        }
+      }
+    }
+  }
+  network {
+    id     = 0
+    model  = "virtio"
+    bridge = "vmbr0"
+    tag    = local.vlan
+  }
+  #Cloud Init Settings
+  ipconfig0    = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
+  searchdomain = "durp.loc"
+  nameserver   = local.dnsserver
+}

dev/terraform/main.tf

@@ -0,0 +1,48 @@
+terraform {
+  backend "http" {}
+  required_providers {
+    proxmox = {
+      source  = "Telmate/proxmox"
+      version = "3.0.1-rc9"
+    }
+  }
+}
+
+provider "proxmox" {
+  pm_parallel     = 1
+  pm_tls_insecure = true
+  pm_api_url      = var.pm_api_url
+  pm_user         = var.pm_user
+  pm_password     = var.pm_password
+  pm_debug        = false
+}
+
+locals {
+  sshkeys   = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible"
+  template  = "Debian12-Template"
+  format    = "raw"
+  dnsserver = "192.168.10.1"
+  vlan      = 10
+  k3smaster = {
+    tags    = "k3s_dev"
+    count   = 3
+    name    = ["master01-dev", "master02-dev", "master03-dev"]
+    cores   = 2
+    memory  = "4096"
+    drive   = 20
+    storage = "cache-domains"
+    node    = ["mothership", "overlord", "vanguard"]
+    ip      = ["11", "12", "13"]
+  }
+  k3sserver = {
+    tags    = "k3s_dev"
+    count   = 3
+    name    = ["node01-dev", "node02-dev", "node03-dev"]
+    cores   = 4
+    memory  = "8192"
+    drive   = 120
+    storage = "cache-domains"
+    node    = ["mothership", "overlord", "vanguard"]
+    ip      = ["21", "22", "23"]
+  }
+}

dev/terraform/variables.tf

@@ -0,0 +1,14 @@
+variable "pm_api_url" {
+  description = "API URL to Proxmox provider"
+  type        = string
+}
+
+variable "pm_password" {
+  description = "Passowrd to Proxmox provider"
+  type        = string
+}
+
+variable "pm_user" {
+  description = "Username to Proxmox provider"
+  type        = string
+}

dmz/authentik/templates/ingress.yaml

@@ -0,0 +1,62 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: authentik-tls
+spec:
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  secretName: authentik-tls
+  commonName: "authentik.durp.info"
+  dnsNames:
+    - "authentik.durp.info"
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`authentik.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: infra-cluster
+          port: 443
+  tls:
+    secretName: authentik-tls
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: authentik-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info
+
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: infra-cluster
+subsets:
+  - addresses:
+      - ip: 192.168.12.130
+    ports:
+      - port: 443
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: infra-cluster
+spec:
+  ports:
+    - protocol: TCP
+      port: 443
+      targetPort: 443

dmz/gitlab-runner/Chart.yaml

@@ -6,6 +6,9 @@ version: 0.0.1
 appVersion: 0.0.1
 
 dependencies:
+- name: gitlab-runner
+  repository: https://charts.gitlab.io/
+  version: 0.77.2
 - name: gitlab-runner
   repository: https://charts.gitlab.io/
   version: 0.77.2

dmz/gitlab-runner/values.yaml

@@ -1,11 +1,11 @@
-personal:
+gitlab-runner:
 
   image:
     registry: registry.durp.info
     image: gitlab-org/gitlab-runner
 
   imagePullPolicy: Always
-  gitlabUrl: https://gitlab.durp.info/
+  gitlabUrl: https://gitlab.com/
   unregisterRunner: false
   terminationGracePeriodSeconds: 3600
   concurrent: 10
@@ -18,15 +18,87 @@ personal:
     podSecurityPolicy:
       enabled: false
       resourceNames:
-        - gitlab-runner
+      - gitlab-runner
 
   metrics:
     enabled: true
     serviceMonitor:
-      enabled: true
+      enabled: true      
   service:
     enabled: true
-    annotations: {}
+    annotations: {}  
+
+  runners:
+    config: |
+      [[runners]]
+        [runners.kubernetes]
+          namespace = "{{.Release.Namespace}}"
+          image = "ubuntu:22.04"
+          privileged = true
+
+    executor: kubernetes
+    name: "k3s"
+    runUntagged: true
+    privileged: true
+    secret: gitlab-secret
+    #builds: 
+      #cpuLimit: 200m
+      #cpuLimitOverwriteMaxAllowed: 400m
+      #memoryLimit: 256Mi
+      #memoryLimitOverwriteMaxAllowed: 512Mi
+      #cpuRequests: 100m
+      #cpuRequestsOverwriteMaxAllowed: 200m
+      #memoryRequests: 128Mi
+      #memoryRequestsOverwriteMaxAllowed: 256Mi
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: false
+    runAsNonRoot: true
+    privileged: false
+    capabilities:
+      drop: ["ALL"]
+
+  podSecurityContext:
+    runAsUser: 100
+    fsGroup: 65533
+
+  resources: 
+    limits:
+      memory: 2Gi
+    requests:
+      memory: 128Mi
+      cpu: 500m
+
+personal:
+
+  image:
+    registry: registry.durp.info
+    image: gitlab-org/gitlab-runner
+
+  imagePullPolicy: Always
+  gitlabUrl: https://gitlab.com/
+  unregisterRunner: false
+  terminationGracePeriodSeconds: 3600
+  concurrent: 10
+  checkInterval: 30
+
+  rbac:
+    create: true
+    rules: []
+    clusterWideAccess: false
+    podSecurityPolicy:
+      enabled: false
+      resourceNames:
+      - gitlab-runner
+
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true      
+  service:
+    enabled: true
+    annotations: {}  
 
   runners:
     config: |
@@ -41,15 +113,15 @@ personal:
     runUntagged: true
     privileged: true
     secret: gitlab-secret-personal
-    builds:
+    #builds: 
-      cpuLimit: 200m
+      #cpuLimit: 200m
-      cpuLimitOverwriteMaxAllowed: 400m
+      #cpuLimitOverwriteMaxAllowed: 400m
-      memoryLimit: 256Mi
+      #memoryLimit: 256Mi
-      memoryLimitOverwriteMaxAllowed: 512Mi
+      #memoryLimitOverwriteMaxAllowed: 512Mi
-      cpuRequests: 100m
+      #cpuRequests: 100m
-      cpuRequestsOverwriteMaxAllowed: 200m
+      #cpuRequestsOverwriteMaxAllowed: 200m
-      memoryRequests: 128Mi
+      #memoryRequests: 128Mi
-      memoryRequestsOverwriteMaxAllowed: 256Mi
+      #memoryRequestsOverwriteMaxAllowed: 256Mi
 
   securityContext:
     allowPrivilegeEscalation: false
@@ -63,9 +135,9 @@ personal:
     runAsUser: 100
     fsGroup: 65533
 
-  resources:
+  resources: 
     limits:
       memory: 2Gi
     requests:
       memory: 128Mi
-      cpu: 50m
+      cpu: 500m

dmz/internalproxy/templates/argocd.yaml

@@ -1,34 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: argocd-infra-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`argocd.infra.durp.info`)
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      kind: Rule
-      services:
-        - name: infra-cluster
-          port: 443
-          scheme: https
-  tls:
-    secretName: argocd-infra-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: argocd-infra-tls
-spec:
-  secretName: argocd-infra-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "argocd.infra.durp.info"
-  dnsNames:
-    - "argocd.infra.durp.info"

dmz/internalproxy/templates/authentik.yaml

@@ -1,40 +1,40 @@
-apiVersion: cert-manager.io/v1
+#apiVersion: traefik.io/v1alpha1
-kind: Certificate
+#kind: IngressRoute
-metadata:
+#metadata:
-  name: authentik-tls
+#  name: authentik-ingress
-spec:
+#spec:
-  issuerRef:
+#  entryPoints:
-    name: letsencrypt-production
+#    - websecure
-    kind: ClusterIssuer
+#  routes:
-  secretName: authentik-tls
+#    - match: Host(`authentik.durp.info`) && PathPrefix(`/`)
-  commonName: "authentik.durp.info"
+#      kind: Rule
-  dnsNames:
+#      services:
-    - "authentik.durp.info"
+#        - name: infra-cluster
-
+#          port: 443
----
+#  tls:
-apiVersion: traefik.io/v1alpha1
+#    secretName: authentik-tls
-kind: IngressRoute
+#
-metadata:
+#---
-  name: authentik-ingress
+#apiVersion: cert-manager.io/v1
-spec:
+#kind: Certificate
-  entryPoints:
+#metadata:
-    - websecure
+#  name: authentik-tls
-  routes:
+#spec:
-    - match: Host(`authentik.durp.info`) && PathPrefix(`/`)
+#  issuerRef:
-      kind: Rule
+#    name: letsencrypt-production
-      services:
+#    kind: ClusterIssuer
-        - name: infra-cluster
+#  secretName: authentik-tls
-          port: 443
+#  commonName: "authentik.durp.info"
-  tls:
+#  dnsNames:
-    secretName: authentik-tls
+#    - "authentik.durp.info"
-
+#
----
+#---
-kind: Service
+#kind: Service
-apiVersion: v1
+#apiVersion: v1
-metadata:
+#metadata:
-  name: authentik-external-dns
+#  name: authentik-external-dns
-  annotations:
+#  annotations:
-    external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
+#    external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
-spec:
+#spec:
-  type: ExternalName
+#  type: ExternalName
-  externalName: durp.info
+#  externalName: durp.info

dmz/internalproxy/templates/duplicati.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: duplicati
+spec:
+  ports:
+  - name: app
+    port: 8200
+    protocol: TCP
+    targetPort: 8200
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: duplicati
+subsets:
+- addresses:
+  - ip: 192.168.21.200
+  ports:
+  - name: app
+    port: 8200
+    protocol: TCP
+
+---    
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -14,7 +43,7 @@ spec:
       namespace: traefik  
     kind: Rule
     services:
-    - name: unraid
+    - name: duplicati
       port: 8200
   tls:
     secretName: duplicati-tls

dmz/internalproxy/templates/endpoints.yaml

@@ -9,6 +9,7 @@ subsets:
       - port: 443
 
 ---
+
 apiVersion: v1
 kind: Service
 metadata:
@@ -20,6 +21,7 @@ spec:
       targetPort: 443
 
 ---
+
 apiVersion: v1
 kind: Endpoints
 metadata:
@@ -31,6 +33,7 @@ subsets:
       - port: 443
 
 ---
+
 apiVersion: v1
 kind: Service
 metadata:
@@ -40,191 +43,3 @@ spec:
     - protocol: TCP
       port: 443
       targetPort: 443
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: unraid
-spec:
-  ports:
-    - name: https
-      protocol: TCP
-      port: 443
-      targetPort: 443
-    - name: tdarr
-      port: 8267
-      protocol: TCP
-      targetPort: 8267
-    - name: duplicati
-      port: 8200
-      protocol: TCP
-      targetPort: 8200
-    - name: forgejo
-      port: 3000
-      protocol: TCP
-    - name: kuma
-      port: 3001
-      protocol: TCP
-      targetPort: 3000
-    - name: freshrss
-      port: 8085
-      protocol: TCP
-      targetPort: 8085
-    - name: gitlab-ssh
-      port: 9022
-      protocol: TCP
-      targetPort: 9022
-    - name: gitlab
-      port: 9443
-      protocol: TCP
-      targetPort: 9443
-    - name: minio
-      port: 9769
-      protocol: TCP
-      targetPort: 9769
-    - name: nextcloud
-      port: 11000
-      protocol: TCP
-      targetPort: 11000
-    - name: nexus
-      port: 8081
-      protocol: TCP
-      targetPort: 8081
-    - name: openweb-ui
-      port: 8089
-      protocol: TCP
-      targetPort: 8089
-    - name: plex
-      port: 32400
-      protocol: TCP
-      targetPort: 32400
-    - name: registry
-      port: 5000
-      protocol: TCP
-      targetPort: 5000
-    - name: gitlab-registry
-      port: 5002
-      protocol: TCP
-      targetPort: 5002
-    - name: root-vault
-      port: 8201
-      protocol: TCP
-      targetPort: 8201
-    - name: s3
-      port: 9768
-      protocol: TCP
-      targetPort: 9768
-    - name: smokeping
-      port: 81
-      protocol: TCP
-      targetPort: 81
-    - name: gotify
-      port: 8070
-      protocol: TCP
-
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: unraid
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: https
-        port: 443
-        protocol: TCP
-      - name: tdarr
-        port: 8267
-        protocol: TCP
-      - name: duplicati
-        port: 8200
-        protocol: TCP
-      - name: forgejo
-        port: 3000
-        protocol: TCP
-      - name: kuma
-        port: 3001
-        protocol: TCP
-      - name: freshrss
-        port: 8085
-        protocol: TCP
-      - name: gitlab-ssh
-        port: 9022
-        protocol: TCP
-      - name: gitlab
-        port: 9443
-        protocol: TCP
-      - name: minio
-        port: 9769
-        protocol: TCP
-      - name: nextcloud
-        port: 11000
-        protocol: TCP
-      - name: nexus
-        port: 8081
-        protocol: TCP
-      - name: openweb-ui
-        port: 8089
-        protocol: TCP
-      - name: plex
-        port: 32400
-        protocol: TCP
-      - name: registry
-        port: 5000
-        protocol: TCP
-      - name: gitlab-registry
-        port: 5002
-        protocol: TCP
-      - name: root-vault
-        port: 8201
-        protocol: TCP
-      - name: s3
-        port: 9768
-        protocol: TCP
-      - name: smokeping
-        port: 81
-        protocol: TCP
-      - name: gotify
-        port: 8070
-        protocol: TCP
-
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: ubuntu
-subsets:
-  - addresses:
-      - ip: 192.168.20.104
-    ports:
-      - name: https
-        port: 443
-        protocol: TCP
-      - name: litellm
-        port: 4000
-        protocol: TCP
-      - name: ollama
-        port: 11435
-        protocol: TCP
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: ubuntu
-spec:
-  ports:
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    - name: litellm
-      port: 4000
-      protocol: TCP
-      targetPort: 4000
-    - name: ollama
-      port: 11435
-      protocol: TCP
-      targetPort: 11435

dmz/internalproxy/templates/forgejo.yaml

@@ -1,43 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: forgejo-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`forgejo.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 3000
-          scheme: http
-  tls:
-    secretName: forgejo-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: forgejo-tls
-spec:
-  secretName: forgejo-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "forgejo.durp.info"
-  dnsNames:
-    - "forgejo.durp.info"
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: forgejo-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: forgejo.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/freshrss.yaml

@@ -1,30 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: freshrss-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`freshrss.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 8085
-  tls:
-    secretName: freshrss-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: freshrss-tls
-spec:
-  secretName: freshrss-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "freshrss.durp.info"
-  dnsNames:
-    - "freshrss.durp.info"

dmz/internalproxy/templates/gitea.yaml

@@ -0,0 +1,72 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea
+spec:
+  ports:
+    - name: app
+      port: 3000
+      protocol: TCP
+      targetPort: 3000
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: gitea
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: app
+        port: 3000
+        protocol: TCP
+
+---
+
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitea.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: gitea
+          port: 3000
+          scheme: http
+  tls:
+    secretName: gitea-tls
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitea-tls
+spec:
+  secretName: gitea-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "gitea.durp.info"
+  dnsNames:
+    - "gitea.durp.info"
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  name: gitea-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: gitea.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info

dmz/internalproxy/templates/gitlab.yaml

@@ -1,30 +1,30 @@
-#apiVersion: v1
+apiVersion: v1
-#kind: Service
+kind: Service
-#metadata:
+metadata:
-#  name: gitlab-ssh
+  name: gitlab-ssh
-#spec:
+spec:
-#  ports:
+  ports:
-#    - name: app
+    - name: app
-#      port: 9022
+      port: 9022
-#      protocol: TCP
+      protocol: TCP
-#      targetPort: 9022
+      targetPort: 9022
-#  clusterIP: None
+  clusterIP: None
-#  type: ClusterIP
+  type: ClusterIP
-#
+
-#---
+---
-#apiVersion: v1
+apiVersion: v1
-#kind: Endpoints
+kind: Endpoints
-#metadata:
+metadata:
-#  name: gitlab-ssh
+  name: gitlab-ssh
-#subsets:
+subsets:
-#  - addresses:
+  - addresses:
-#      - ip: 192.168.21.200
+      - ip: 192.168.21.200
-#    ports:
+    ports:
-#      - name: app
+      - name: app
-#        port: 9022
+        port: 9022
-#        protocol: TCP
+        protocol: TCP
-#
+
-#---
+---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
 metadata:
@@ -35,9 +35,36 @@ spec:
   routes:
     - match: HostSNI(`*`)
       services:
-        - name: unraid
+        - name: gitlab-ssh
           port: 9022
 
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitlab
+spec:
+  ports:
+    - name: app
+      port: 9443
+      protocol: TCP
+      targetPort: 9443
+  clusterIP: None
+  type: ClusterIP
+
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: gitlab
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: app
+        port: 9443
+        protocol: TCP
+
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -50,7 +77,7 @@ spec:
     - match: Host(`gitlab.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: unraid
+        - name: gitlab
           port: 9443
           scheme: https
   tls:
@@ -80,46 +107,3 @@ metadata:
 spec:
   type: ExternalName
   externalName: durp.info
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gitlab-registry
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`images.durp.info`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 5002
-          scheme: http
-  tls:
-    secretName: gitlab-images-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: gitlab-images-tls
-spec:
-  secretName: gitlab-images-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "images.durp.info"
-  dnsNames:
-    - "images.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: gitlab-images-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: images.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/gotify.yaml

@@ -1,41 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gotify-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`gotify.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: unraid
-          port: 8070
-          scheme: http
-  tls:
-    secretName: gotify-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: gotify-tls
-spec:
-  secretName: gotify-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "gotify.durp.info"
-  dnsNames:
-    - "gotify.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: gotify-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: gotify.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/invidious.yaml

@@ -1,75 +1,74 @@
-#apiVersion: v1
+apiVersion: v1
-#kind: Service
+kind: Service
-#metadata:
+metadata:
-#  name: invidious
+  name: invidious
-#spec:
+spec:
-#  ports:
+  ports:
-#  - name: app
+  - name: app
-#    port: 3000
+    port: 3000
-#    protocol: TCP
+    protocol: TCP
-#    targetPort: 3000
+    targetPort: 3000
-#  clusterIP: None
+  clusterIP: None
-#  type: ClusterIP
+  type: ClusterIP
-#
+
-#---
+---
-#
+
-#apiVersion: v1
+apiVersion: v1
-#kind: Endpoints
+kind: Endpoints
-#metadata:
+metadata:
-#  name: invidious
+  name: invidious
-#subsets:
+subsets:
-#- addresses:
+- addresses:
-#  - ip: 192.168.20.104
+  - ip: 192.168.20.104
-#  ports:
+  ports:
-#  - name: app
+  - name: app
-#    port: 3000
+    port: 3000
-#    protocol: TCP
+    protocol: TCP
-#
+
-#---
+---    
-#
+
-#apiVersion: traefik.io/v1alpha1
+apiVersion: traefik.io/v1alpha1
-#kind: IngressRoute
+kind: IngressRoute
-#metadata:
+metadata:
-#  name: invidious-ingress
+  name: invidious-ingress
-#spec:
+spec:
-#  entryPoints:
+  entryPoints:
-#    - websecure
+    - websecure
-#  routes:
+  routes:
-#  - match: Host(`invidious.durp.info`) && PathPrefix(`/`)
+  - match: Host(`invidious.durp.info`) && PathPrefix(`/`)
-#    middlewares:
+    middlewares:
-#    - name: authentik-proxy-provider
+    - name: authentik-proxy-provider
-#      namespace: traefik
+      namespace: traefik  
-#    kind: Rule
+    kind: Rule
-#    services:
+    services:
-#    - name: invidious
+    - name: invidious
-#      port: 3000
+      port: 3000
-#  tls:
+  tls:
-#    secretName: invidious-tls
+    secretName: invidious-tls
-#
+
-#---
+---
-#
+
-#apiVersion: cert-manager.io/v1
+apiVersion: cert-manager.io/v1
-#kind: Certificate
+kind: Certificate
-#metadata:
+metadata:
-#  name: invidious-tls
+  name: invidious-tls
-#spec:
+spec:
-#  secretName: invidious-tls
+  secretName: invidious-tls
-#  issuerRef:
+  issuerRef:
-#    name: letsencrypt-production
+    name: letsencrypt-production
-#    kind: ClusterIssuer
+    kind: ClusterIssuer
-#  commonName: "invidious.durp.info"
+  commonName: "invidious.durp.info"
-#  dnsNames:
+  dnsNames:
-#  - "invidious.durp.info"
+  - "invidious.durp.info"  
-#
+
-#---
+---
-#
+
-#kind: Service
+kind: Service
-#apiVersion: v1
+apiVersion: v1
-#metadata:
+metadata:
-#  name: invidious-external-dns
+  name: invidious-external-dns
-#  annotations:
+  annotations:
-#    external-dns.alpha.kubernetes.io/hostname: invidious.durp.info
+    external-dns.alpha.kubernetes.io/hostname: invidious.durp.info
-#spec:
+spec:
-#  type: ExternalName
+  type: ExternalName
-#  externalName: durp.info
+  externalName: durp.info
-#

dmz/internalproxy/templates/kasm.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kasm
+spec:
+  ports:
+    - name: app
+      port: 443
+      protocol: TCP
+      targetPort: 443
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: kasm
+subsets:
+  - addresses:
+      - ip: 192.168.20.104
+    ports:
+      - name: app
+        port: 443
+        protocol: TCP
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -9,7 +38,7 @@ spec:
     - match: Host(`kasm.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: ubuntu
+        - name: kasm
           port: 443
           scheme: https
   tls:

dmz/internalproxy/templates/kuma.yaml

@@ -6,30 +6,34 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`kuma.durp.info`) && PathPrefix(`/`)
+  - match: Host(`kuma.durp.info`) && PathPrefix(`/`) 
-      kind: Rule
+    kind: Rule
-      services:
+    middlewares:
-        - name: unraid
+    - name: authentik-proxy-provider
-          port: 3001
+      namespace: traefik  
-          scheme: http
+    services:
+    - name: master-cluster
+      port: 443
   tls:
     secretName: kuma-tls
 
 ---
+
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: kuma-tls
 spec:
-  secretName: kuma-tls
   issuerRef:
     name: letsencrypt-production
     kind: ClusterIssuer
+  secretName: kuma-tls
   commonName: "kuma.durp.info"
   dnsNames:
-    - "kuma.durp.info"
+  - "kuma.durp.info"
 
 ---
+
 kind: Service
 apiVersion: v1
 metadata:

dmz/internalproxy/templates/litellm.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: litellm
+spec:
+  ports:
+    - name: app
+      port: 4000
+      protocol: TCP
+      targetPort: 4000
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: litellm
+subsets:
+  - addresses:
+      - ip: 192.168.20.104
+    ports:
+      - name: app
+        port: 4000
+        protocol: TCP
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -9,7 +38,7 @@ spec:
     - match: Host(`litellm.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: ubuntu
+        - name: litellm
           port: 4000
   tls:
     secretName: litellm-tls

dmz/internalproxy/templates/longhorn.yaml

@@ -1,34 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: longhorn-infra-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      middlewares:
-        - name: authentik-proxy-provider
-          namespace: traefik
-      services:
-        - name: infra-cluster
-          port: 443
-  tls:
-    secretName: longhorn-infra-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: longhorn-infra-tls
-spec:
-  secretName: longhorn-infra-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "longhorn.infra.durp.info"
-  dnsNames:
-    - "longhorn.infra.durp.info"

dmz/internalproxy/templates/minio.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: minio
+spec:
+  ports:
+    - name: app
+      port: 9769
+      protocol: TCP
+      targetPort: 9769
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: minio
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: app
+        port: 9769
+        protocol: TCP
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -12,7 +41,7 @@ spec:
           namespace: traefik
       kind: Rule
       services:
-        - name: unraid
+        - name: minio
           port: 9769
           scheme: http
   tls:

dmz/internalproxy/templates/n8n.yaml

@@ -1,68 +1,68 @@
-#apiVersion: v1
+apiVersion: v1
-#kind: Service
+kind: Service
-#metadata:
+metadata:
-#  name: n8n
+  name: n8n
-#spec:
+spec:
-#  ports:
+  ports:
-#    - name: app
+    - name: app
-#      port: 5678
+      port: 5678
-#      protocol: TCP
+      protocol: TCP
-#      targetPort: 5678
+      targetPort: 5678
-#  clusterIP: None
+  clusterIP: None
-#  type: ClusterIP
+  type: ClusterIP
-#
+
-#---
+---
-#apiVersion: v1
+apiVersion: v1
-#kind: Endpoints
+kind: Endpoints
-#metadata:
+metadata:
-#  name: n8n
+  name: n8n
-#subsets:
+subsets:
-#  - addresses:
+  - addresses:
-#      - ip: 192.168.21.200
+      - ip: 192.168.21.200
-#    ports:
+    ports:
-#      - name: app
+      - name: app
-#        port: 5678
+        port: 5678
-#        protocol: TCP
+        protocol: TCP
-#
+
-#---
+---
-#apiVersion: traefik.io/v1alpha1
+apiVersion: traefik.io/v1alpha1
-#kind: IngressRoute
+kind: IngressRoute
-#metadata:
+metadata:
-#  name: n8n-ingress
+  name: n8n-ingress
-#spec:
+spec:
-#  entryPoints:
+  entryPoints:
-#    - websecure
+    - websecure
-#  routes:
+  routes:
-#    - match: Host(`n8n.durp.info`) && PathPrefix(`/`)
+    - match: Host(`n8n.durp.info`) && PathPrefix(`/`)
-#      kind: Rule
+      kind: Rule
-#      services:
+      services:
-#        - name: n8n
+        - name: n8n
-#          port: 5678
+          port: 5678
-#          scheme: http
+          scheme: http
-#  tls:
+  tls:
-#    secretName: n8n-tls
+    secretName: n8n-tls
-#
+
-#---
+---
-#apiVersion: cert-manager.io/v1
+apiVersion: cert-manager.io/v1
-#kind: Certificate
+kind: Certificate
-#metadata:
+metadata:
-#  name: n8n-tls
+  name: n8n-tls
-#spec:
+spec:
-#  secretName: n8n-tls
+  secretName: n8n-tls
-#  issuerRef:
+  issuerRef:
-#    name: letsencrypt-production
+    name: letsencrypt-production
-#    kind: ClusterIssuer
+    kind: ClusterIssuer
-#  commonName: "n8n.durp.info"
+  commonName: "n8n.durp.info"
-#  dnsNames:
+  dnsNames:
-#    - "n8n.durp.info"
+    - "n8n.durp.info"
-#
+
-#---
+---
-#kind: Service
+kind: Service
-#apiVersion: v1
+apiVersion: v1
-#metadata:
+metadata:
-#  name: n8n-dns
+  name: n8n-dns
-#  annotations:
+  annotations:
-#    dns.alpha.kubernetes.io/hostname: n8n.durp.info
+    dns.alpha.kubernetes.io/hostname: n8n.durp.info
-#spec:
+spec:
-#  type: ExternalName
+  type: ExternalName
-#  externalName: durp.info
+  externalName: durp.info

dmz/internalproxy/templates/nextcloud.yaml

@@ -1,74 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: nextcloud-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      middlewares:
-        - name: nextcloud-chain
-      services:
-        - name: unraid
-          port: 11000
-          scheme: http
-  tls:
-    secretName: nextcloud-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: nextcloud-tls
-spec:
-  secretName: nextcloud-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "nextcloud.durp.info"
-  dnsNames:
-    - "nextcloud.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: nextcloud-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: nextcloud.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info
-
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: nextcloud-secure-headers
-spec:
-  headers:
-    hostsProxyHeaders:
-      - "X-Forwarded-Host"
-    referrerPolicy: "same-origin"
-
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: https-redirect
-spec:
-  redirectScheme:
-    scheme: https
-
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: nextcloud-chain
-spec:
-  chain:
-    middlewares:
-      - name: https-redirect
-      - name: nextcloud-secure-headers

dmz/internalproxy/templates/nexus.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nexus
+spec:
+  ports:
+  - name: app
+    port: 8081
+    protocol: TCP
+    targetPort: 8081
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: nexus
+subsets:
+- addresses:
+  - ip: 192.168.20.200
+  ports:
+  - name: app
+    port: 8081
+    protocol: TCP
+
+---    
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -9,7 +38,7 @@ spec:
   - match: Host(`nexus.durp.info`) && PathPrefix(`/`)
     kind: Rule
     services:
-    - name: unraid
+    - name: nexus
       port: 8081
   tls:
     secretName: nexus-tls

dmz/internalproxy/templates/ollama.yaml

@@ -15,6 +15,7 @@ spec:
         property: users
 
 ---
+
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
@@ -25,6 +26,36 @@ spec:
     secret: ollama-secret
 
 ---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: ollama
+spec:
+  ports:
+    - name: app
+      port: 11435
+      protocol: TCP
+      targetPort: 11435
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: ollama
+subsets:
+  - addresses:
+      - ip: 192.168.20.104
+    ports:
+      - name: app
+        port: 11435
+        protocol: TCP
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -38,12 +69,13 @@ spec:
         - name: ollama-basic-auth
       kind: Rule
       services:
-        - name: ubuntu
+        - name: ollama
           port: 11435
   tls:
     secretName: ollama-tls
 
 ---
+
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -58,6 +90,7 @@ spec:
     - "ollama.durp.info"
 
 ---
+
 kind: Service
 apiVersion: v1
 metadata:
@@ -66,4 +99,4 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: ollama.durp.info
 spec:
   type: ExternalName
-  externalName: durp.info
+  externalName: durp.info

dmz/internalproxy/templates/open-webui.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: open-webui
+spec:
+  ports:
+    - name: app
+      port: 8089
+      protocol: TCP
+      targetPort: 8089
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: open-webui
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: app
+        port: 8089
+        protocol: TCP
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -9,13 +38,14 @@ spec:
     - match: Host(`open-webui.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: unraid
+        - name: open-webui
           port: 8089
           scheme: http
   tls:
     secretName: open-webui-tls
 
 ---
+
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -30,6 +60,7 @@ spec:
     - "open-webui.durp.info"
 
 ---
+
 kind: Service
 apiVersion: v1
 metadata:

dmz/internalproxy/templates/plex.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: plex
+spec:
+  ports:
+    - name: app
+      port: 32400
+      protocol: TCP
+      targetPort: 32400
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: plex
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: app
+        port: 32400
+        protocol: TCP
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -9,13 +38,14 @@ spec:
     - match: Host(`plex.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: unraid
+        - name: plex
           port: 32400
           scheme: https
   tls:
     secretName: plex-tls
 
 ---
+
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -30,6 +60,7 @@ spec:
     - "plex.durp.info"
 
 ---
+
 kind: Service
 apiVersion: v1
 metadata:

dmz/internalproxy/templates/portainer.yaml

@@ -7,9 +7,9 @@ spec:
     - websecure
   routes:
   - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`)
-    middlewares:
+      #middlewares:
-      - name: whitelist
+      #- name: whitelist
-        namespace: traefik
+      #  namespace: traefik
     kind: Rule
     services:
       - name: infra-cluster

dmz/internalproxy/templates/registry.yaml

@@ -1,3 +1,30 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: registry
+spec:
+  ports:
+    - name: app
+      port: 5000
+      protocol: TCP
+      targetPort: 5000
+  clusterIP: None
+  type: ClusterIP
+
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: registry
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: app
+        port: 5000
+        protocol: TCP
+
+---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -12,7 +39,7 @@ spec:
         - name: whitelist
           namespace: traefik
       services:
-        - name: unraid
+        - name: registry
           port: 5000
   tls:
     secretName: registry-tls

dmz/internalproxy/templates/root-vault.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: root-vault
+spec:
+  ports:
+    - name: app
+      port: 8201
+      protocol: TCP
+      targetPort: 8201
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: root-vault
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: app
+        port: 8201
+        protocol: TCP
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -12,13 +41,14 @@ spec:
           namespace: traefik
       kind: Rule
       services:
-        - name: unraid
+        - name: root-vault
           port: 8201
           scheme: https
   tls:
     secretName: root-vault-tls
 
 ---
+
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:

dmz/internalproxy/templates/s3.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: s3
+spec:
+  ports:
+    - name: app
+      port: 9768
+      protocol: TCP
+      targetPort: 9768
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: s3
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: app
+        port: 9768
+        protocol: TCP
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -12,7 +41,7 @@ spec:
           namespace: traefik
       kind: Rule
       services:
-        - name: unraid
+        - name: s3
           port: 9768
           scheme: http
   tls:
@@ -46,7 +75,7 @@ spec:
     - match: Host(`s3.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: unraid
+        - name: s3
           port: 9768
           scheme: http
   tls:

dmz/internalproxy/templates/semaphore.yaml

@@ -1,65 +1,64 @@
-#
+
-#apiVersion: v1
+apiVersion: v1
-#kind: Service
+kind: Service
-#metadata:
+metadata:
-#  name: semaphore
+  name: semaphore
-#spec:
+spec:
-#  ports:
+  ports:
-#    - name: app
+    - name: app
-#      port: 3001
+      port: 3001
-#      protocol: TCP
+      protocol: TCP
-#      targetPort: 3001
+      targetPort: 3001
-#  clusterIP: None
+  clusterIP: None
-#  type: ClusterIP
+  type: ClusterIP
-#
+
-#---
+---
-#
+
-#apiVersion: v1
+apiVersion: v1
-#kind: Endpoints
+kind: Endpoints
-#metadata:
+metadata:
-#  name: semaphore
+  name: semaphore
-#subsets:
+subsets:
-#  - addresses:
+  - addresses:
-#      - ip: 192.168.21.200
+      - ip: 192.168.21.200
-#    ports:
+    ports:
-#      - name: app
+      - name: app
-#        port: 3001
+        port: 3001
-#        protocol: TCP
+        protocol: TCP
-#
+
-#---
+---
-#
+
-#apiVersion: traefik.io/v1alpha1
+apiVersion: traefik.io/v1alpha1
-#kind: IngressRoute
+kind: IngressRoute
-#metadata:
+metadata:
-#  name: semaphore-ingress
+  name: semaphore-ingress
-#spec:
+spec:
-#  entryPoints:
+  entryPoints:
-#    - websecure
+    - websecure
-#  routes:
+  routes:
-#    - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`)
+    - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`)
-#      middlewares:
+      middlewares:
-#        - name: whitelist
+        - name: whitelist
-#          namespace: traefik
+          namespace: traefik
-#      kind: Rule
+      kind: Rule
-#      services:
+      services:
-#        - name: semaphore
+        - name: semaphore
-#          port: 3001
+          port: 3001
-#          scheme: http
+          scheme: http
-#  tls:
+  tls:
-#    secretName: semaphore-tls
+    secretName: semaphore-tls
-#
+
-#---
+---
-#
+
-#apiVersion: cert-manager.io/v1
+apiVersion: cert-manager.io/v1
-#kind: Certificate
+kind: Certificate
-#metadata:
+metadata:
-#  name: semaphore-tls
+  name: semaphore-tls
-#spec:
+spec:
-#  secretName: semaphore-tls
+  secretName: semaphore-tls
-#  issuerRef:
+  issuerRef:
-#    name: vault-issuer
+    name: vault-issuer
-#    kind: ClusterIssuer
+    kind: ClusterIssuer
-#  commonName: "semaphore.internal.durp.info"
+  commonName: "semaphore.internal.durp.info"
-#  dnsNames:
+  dnsNames:
-#    - "semaphore.internal.durp.info"
+    - "semaphore.internal.durp.info"
-#

dmz/internalproxy/templates/smokeping.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: smokeping
+spec:
+  ports:
+  - name: app
+    port: 81
+    protocol: TCP
+    targetPort: 81
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: smokeping
+subsets:
+- addresses:
+  - ip: 192.168.21.200
+  ports:
+  - name: app
+    port: 81
+    protocol: TCP
+
+---    
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -14,12 +43,13 @@ spec:
       namespace: traefik  
     kind: Rule
     services:
-    - name: unraid
+    - name: smokeping
       port: 81
   tls:
     secretName: smokeping-tls
 
 ---
+
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -34,6 +64,7 @@ spec:
   - "smokeping.durp.info"  
 
 ---
+
 kind: Service
 apiVersion: v1
 metadata:

dmz/internalproxy/templates/tdarr.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tdarr
+spec:
+  ports:
+  - name: app
+    port: 8267
+    protocol: TCP
+    targetPort: 8267
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: tdarr
+subsets:
+- addresses:
+  - ip: 192.168.21.200
+  ports:
+  - name: app
+    port: 8267
+    protocol: TCP
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -16,7 +45,7 @@ spec:
       namespace: traefik  
     kind: Rule
     services:
-    - name: unraid
+    - name: tdarr
       port: 8267
       scheme: http
   tls:

dmz/internalproxy/templates/unraid.yaml

@@ -1,3 +1,33 @@
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: unraid
+spec:
+  ports:
+    - name: app
+      port: 443
+      protocol: TCP
+      targetPort: 443
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: unraid
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: app
+        port: 443
+        protocol: TCP
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:

dmz/istio-system/Chart.yaml

@@ -8,7 +8,7 @@ appVersion: 0.0.1
 dependencies:
   - name: base
     repository: https://istio-release.storage.googleapis.com/charts
-    version: 1.29.0
+    version: 1.26.2
   - name: istiod
     repository: https://istio-release.storage.googleapis.com/charts
     version: 1.26.2

dmz/searxng/Chart.yaml

@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: latest
-description: SearXNG is a free internet metasearch engine which aggregates results from various search services and databases.
-name: searxng
-version: 1.0.1
-#dependencies:
-#  - name: common
-#    repository: https://library-charts.k8s-at-home.com
-#    version: 4.4.2
-#

dmz/searxng/templates/confligmap.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: searxng-config
-data:
-  settings.yml: |-
-    use_default_settings: true
-    search:
-      formats:
-        - html
-        - json

dmz/searxng/templates/deployment.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: searxng
-  name: searxng
-  labels:
-    app: searxng
-spec:
-  selector:
-    matchLabels:
-      app: searxng
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: searxng
-    spec:
-      containers:
-        - name: searxng
-          image: registry.durp.info/searxng/searxng:latest
-          imagePullPolicy: Always
-          ports:
-            - name: http
-              containerPort: 8080
-          env:
-            - name: SEARXNG_BASE_URL
-              value: https://searxng.durp.info
-            - name: SEARXNG_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: searxng-secret
-                  key: SEARXNG_SECRET
-          volumeMounts:
-            - name: searxng-config-volume
-              mountPath: /etc/searxng/settings.yml
-              subPath: settings.yml
-      volumes:
-        - name: searxng-config-volume
-          configMap:
-            name: searxng-config

dmz/searxng/templates/ingress.yaml

@@ -1,76 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: searxng-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`searxng.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      middlewares:
-        - name: authentik-proxy-provider
-          namespace: traefik
-      services:
-        - name: searxng-service
-          port: 8080
-  tls:
-    secretName: searxng-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: searxng-tls
-spec:
-  secretName: searxng-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "searxng.durp.info"
-  dnsNames:
-    - "searxng.durp.info"
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: searxng-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: searxng.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: searxng-internal-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`searxng.internal.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: searxng-service
-          port: 8080
-  tls:
-    secretName: searxng-internal-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: searxng-internal-tls
-spec:
-  secretName: searxng-internal-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "searxng.internal.durp.info"
-  dnsNames:
-    - "searxng.internal.durp.info"

dmz/searxng/templates/secret.yaml

@@ -1,23 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: searxng-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: searxng-secret
-  data:
-    - secretKey: SEARXNG_SECRET
-      remoteRef:
-        key: kv/searxng
-        property: searxng-secret
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault
-

dmz/searxng/templates/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: searxng-service
-spec:
-  ports:
-    - name: http
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: searxng

dmz/searxng/values.yaml

@@ -1,83 +0,0 @@
-#
-# IMPORTANT NOTE
-#
-# This chart inherits from our common library chart. You can check the default values/options here:
-# https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml
-#
-
-image:
-  # -- image repository
-  repository: registry.durp.info/searxng/searxng
-  # -- image tag
-  tag: latest
-  # -- image pull policy
-  pullPolicy: Always
-
-# Explanation about each environment variables here:
-# https://docs.searxng.org/admin/installation-docker.html#command-line
-env:
-  INSTANCE_NAME: "durp.info"
-  BASE_URL: "https://searx.durp.info"
-  AUTOCOMPLETE: "false"
-  # MORTY_URL: "http://morty:8080"
-  # MORTY_KEY: "mysecretkey"
-  # BIND_ADDRESS: "0.0.0.0:8080"
-
-controller:
-  strategy: "RollingUpdate"
-
-# -- Configures service settings for the chart.
-# @default -- See values.yaml
-service:
-  main:
-    ports:
-      http:
-        port: 8080
-
-# -- Configure persistence settings for the chart under this key.
-# @default -- See values.yaml
-persistence:
-  config:
-    enabled: false
-
-ingress:
-  # -- Enable and configure ingress settings for the chart under this key.
-  # @default -- See values.yaml
-  main:
-    enabled: false
-
-searxng:
-  config:
-    use_default_settings: true
-    #server:
-    #  secret_key: pleasechangeme
-    # Uncomment when using the builtin rate limiter
-    # See https://docs.searxng.org/src/searx.plugins.limiter.html#limiter-plugin
-    # server.limiter: true
-    # redis.url: redis://@searxng-redis:6379/0
-
-probes:
-  readiness:
-    custom: true
-    spec:
-      httpGet:
-        path: /healthz
-        port: 8080
-  liveness:
-    custom: true
-    spec:
-      httpGet:
-        path: /healthz
-        port: 8080
-  startup:
-    custom: true
-    spec:
-      httpGet:
-        path: /healthz
-        port: 8080
-
-# Enable when using searxng builtin rate limiter
-# Values: https://github.com/pascaliske/helm-charts/tree/master/charts/redis
-redis:
-  enabled: false
-  

dmz/terraform/k3s.tf

@@ -0,0 +1,115 @@
+resource "proxmox_vm_qemu" "k3smaster" {
+  count       = local.k3smaster.count
+  ciuser      = "administrator"
+  vmid        = "${local.vlan}${local.k3smaster.ip[count.index]}"
+  name        = local.k3smaster.name[count.index]
+  target_node = local.k3smaster.node[count.index]
+  clone       = local.template
+  tags        = local.k3smaster.tags
+  qemu_os     = "l26"
+  full_clone  = true
+  os_type     = "cloud-init"
+  agent       = 1
+  cores       = local.k3smaster.cores
+  sockets     = 1
+  cpu_type    = "host"
+  memory      = local.k3smaster.memory
+  scsihw      = "virtio-scsi-pci"
+  #bootdisk    = "scsi0"
+  boot    = "order=virtio0"
+  onboot  = true
+  sshkeys = local.sshkeys
+  vga {
+    type = "serial0"
+  }
+  serial {
+    id   = 0
+    type = "socket"
+  }
+  disks {
+    ide {
+      ide2 {
+        cloudinit {
+          storage = local.storage
+        }
+      }
+    }
+    virtio {
+      virtio0 {
+        disk {
+          size    = local.k3smaster.drive
+          format  = local.format
+          storage = local.storage
+        }
+      }
+    }
+  }
+  network {
+    id     = 0
+    model  = "virtio"
+    bridge = "vmbr0"
+    tag    = local.vlan
+  }
+  #Cloud Init Settings
+  ipconfig0    = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
+  searchdomain = "durp.loc"
+  nameserver   = local.dnsserver
+}
+
+resource "proxmox_vm_qemu" "k3sserver" {
+  count       = local.k3sserver.count
+  ciuser      = "administrator"
+  vmid        = "${local.vlan}${local.k3sserver.ip[count.index]}"
+  name        = local.k3sserver.name[count.index]
+  target_node = local.k3sserver.node[count.index]
+  clone       = local.template
+  tags        = local.k3sserver.tags
+  qemu_os     = "l26"
+  full_clone  = true
+  os_type     = "cloud-init"
+  agent       = 1
+  cores       = local.k3sserver.cores
+  sockets     = 1
+  cpu_type    = "host"
+  memory      = local.k3sserver.memory
+  scsihw      = "virtio-scsi-pci"
+  #bootdisk    = "scsi0"
+  boot    = "order=virtio0"
+  onboot  = true
+  sshkeys = local.sshkeys
+  vga {
+    type = "serial0"
+  }
+  serial {
+    id   = 0
+    type = "socket"
+  }
+  disks {
+    ide {
+      ide2 {
+        cloudinit {
+          storage = local.storage
+        }
+      }
+    }
+    virtio {
+      virtio0 {
+        disk {
+          size    = local.k3sserver.drive
+          format  = local.format
+          storage = local.storage
+        }
+      }
+    }
+  }
+  network {
+    id     = 0
+    model  = "virtio"
+    bridge = "vmbr0"
+    tag    = local.vlan
+  }
+  #Cloud Init Settings
+  ipconfig0    = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
+  searchdomain = "durp.loc"
+  nameserver   = local.dnsserver
+}

dmz/terraform/main.tf

@@ -0,0 +1,58 @@
+terraform {
+  backend "http" {}
+  required_providers {
+    proxmox = {
+      source  = "Telmate/proxmox"
+      version = "3.0.1-rc9"
+    }
+  }
+}
+
+provider "proxmox" {
+  pm_parallel     = 1
+  pm_tls_insecure = true
+  pm_api_url      = var.pm_api_url
+  pm_user         = var.pm_user
+  pm_password     = var.pm_password
+  pm_debug        = false
+}
+
+locals {
+  sshkeys    = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible"
+  template   = "Debian12-Template"
+  storage    = "cache-domains"
+  emulatessd = true
+  format     = "raw"
+  dnsserver  = "192.168.98.1"
+  vlan       = 98
+  k3smaster = {
+    tags   = "k3s_dmz"
+    count  = 3
+    name   = ["master01-dmz", "master02-dmz", "master03-dmz"]
+    cores  = 2
+    memory = "4096"
+    drive  = 20
+    node   = ["mothership", "overlord", "vanguard"]
+    ip     = ["11", "12", "13"]
+  }
+  k3sserver = {
+    tags   = "k3s_dmz"
+    count  = 3
+    name   = ["node01-dmz", "node02-dmz", "node03-dmz"]
+    cores  = 4
+    memory = "8192"
+    drive  = 240
+    node   = ["mothership", "overlord", "vanguard"]
+    ip     = ["21", "22", "23"]
+  }
+  openVPN = {
+    tags   = "openVPN"
+    count  = 1
+    name   = ["openVPN"]
+    cores  = 2
+    memory = "4096"
+    drive  = 20
+    node   = ["mothership"]
+    ip     = ["20"]
+  }
+}

dmz/terraform/openVPN.tf

@@ -0,0 +1,57 @@
+resource "proxmox_vm_qemu" "openVPN" {
+  count       = local.openVPN.count
+  ciuser      = "administrator"
+  vmid        = "${local.vlan}${local.openVPN.ip[count.index]}"
+  name        = local.openVPN.name[count.index]
+  target_node = local.openVPN.node[count.index]
+  clone       = local.template
+  tags        = local.openVPN.tags
+  qemu_os     = "l26"
+  full_clone  = true
+  os_type     = "cloud-init"
+  agent       = 1
+  cores       = local.openVPN.cores
+  sockets     = 1
+  cpu_type    = "host"
+  memory      = local.openVPN.memory
+  scsihw      = "virtio-scsi-pci"
+  #bootdisk    = "scsi0"
+  boot    = "order=virtio0"
+  onboot  = true
+  sshkeys = local.sshkeys
+  vga {
+    type = "serial0"
+  }
+  serial {
+    id   = 0
+    type = "socket"
+  }
+  disks {
+    ide {
+      ide2 {
+        cloudinit {
+          storage = local.storage
+        }
+      }
+    }
+    virtio {
+      virtio0 {
+        disk {
+          size    = local.openVPN.drive
+          format  = local.format
+          storage = local.storage
+        }
+      }
+    }
+  }
+  network {
+    id     = 0
+    model  = "virtio"
+    bridge = "vmbr0"
+    tag    = local.vlan
+  }
+  #Cloud Init Settings
+  ipconfig0    = "ip=192.168.${local.vlan}.${local.openVPN.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
+  searchdomain = "durp.loc"
+  nameserver   = local.dnsserver
+}

dmz/terraform/variables.tf

@@ -0,0 +1,14 @@
+variable "pm_api_url" {
+  description = "API URL to Proxmox provider"
+  type        = string
+}
+
+variable "pm_password" {
+  description = "Passowrd to Proxmox provider"
+  type        = string
+}
+
+variable "pm_user" {
+  description = "UIsername to Proxmox provider"
+  type        = string
+}

infra/argocd/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: "1.16.0"
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 8.6.4
+  version: 8.1.3

infra/argocd/templates/argocd.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/argocd
   destination:

infra/argocd/templates/authentik.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/authentik
   destination:
@@ -31,7 +31,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/authentik
   destination:

infra/argocd/templates/bitwarden.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/bitwarden
   destination:

infra/argocd/templates/cert-manager.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/cert-manager
   destination:
@@ -29,7 +29,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/cert-manager
   destination:

infra/argocd/templates/external-dns.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/external-dns
   destination:

infra/argocd/templates/external-secrets.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/external-secrets
   destination:
@@ -29,7 +29,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/external-secrets
   destination:

infra/argocd/templates/gitlab-runner.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/gitlab-runner
   destination:

infra/argocd/templates/internalproxy.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/internalproxy
   destination:

infra/argocd/templates/istio.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/istio-system
   destination:
@@ -36,7 +36,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/istio-system
   destination:

infra/argocd/templates/kube-prometheus-stack.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/kube-prometheus-stack
   destination:

infra/argocd/templates/litellm.yaml

@@ -6,7 +6,7 @@
 #spec:
 #  project: default
 #  source:
-#    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+#    repoURL: https://gitlab.com/developerdurp/homelab.git
 #    targetRevision: main
 #    path: infra/litellm
 #  destination:

infra/argocd/templates/littlelink.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/littlelink
     directory:

infra/argocd/templates/longhorn.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/longhorn
   destination:
@@ -33,7 +33,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/longhorn
   destination:

infra/argocd/templates/metallb-system.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/metallb-system
   destination:
@@ -29,7 +29,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/metallb-system
   destination:
@@ -52,7 +52,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dev/metallb-system
   destination:

infra/argocd/templates/nebula-sync.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/nebula-sync
   destination:

infra/argocd/templates/nfs.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/nfs
   destination:

infra/argocd/templates/openclarity.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/openclarity
   destination:

infra/argocd/templates/openspeedtest.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/openspeedtest
     directory:

infra/argocd/templates/portainer.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/portainer
   destination:

infra/argocd/templates/redlib.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/redlib
     directory:

infra/argocd/templates/renovate.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/renovate
   destination:

infra/argocd/templates/traefik.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/traefik
   destination:
@@ -32,7 +32,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/traefik
   destination:
@@ -58,7 +58,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dev/traefik
   destination:

infra/argocd/templates/vault.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: infra/vault
   destination:
@@ -34,7 +34,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
+    repoURL: https://gitlab.com/developerdurp/homelab.git
     targetRevision: main
     path: dmz/vault
   destination:

infra/authentik/Chart.yaml

@@ -9,5 +9,5 @@ appVersion: "1.16.0"
 dependencies:
   - name: authentik
     repository: https://charts.goauthentik.io
-    version: 2025.4.1
+    version: 2025.12.1
 

infra/authentik/values.yaml

@@ -34,7 +34,7 @@ authentik:
     enabled: true
     image:
       registry: registry.durp.info
-      repository: bitnamilegacy/postgresql
+      repository: bitnami/postgresql
       pullPolicy: Always
     postgresqlUsername: "authentik"
     postgresqlDatabase: "authentik"
@@ -52,7 +52,7 @@ authentik:
         enabled: false
     image:
       registry: registry.durp.info
-      repository: bitnamilegacy/redis
+      repository: bitnami/redis
       pullPolicy: Always
     architecture: standalone
     auth:

infra/bitwarden/templates/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: bitwarden
-          image: registry.durp.info/vaultwarden/server:1.35.4
+          image: registry.durp.info/vaultwarden/server:1.34.3
           imagePullPolicy: Always
           volumeMounts:
             - name: bitwarden-pvc

infra/istio-system/Chart.yaml

@@ -8,7 +8,7 @@ appVersion: 0.0.1
 dependencies:
 - name: base
   repository: https://istio-release.storage.googleapis.com/charts
-  version: 1.29.0
+  version: 1.26.2
 - name: istiod
   repository: https://istio-release.storage.googleapis.com/charts
   version: 1.26.2

infra/longhorn/templates/ingress.yaml

@@ -11,8 +11,8 @@ spec:
     - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`)
       kind: Rule
       middlewares:
-        #- name: authentik-proxy-provider
+        - name: authentik-proxy-provider
-        #  namespace: traefik
+          namespace: traefik
       services:
         - name: longhorn-frontend
           port: 80

infra/openclarity/values.yaml

@@ -542,7 +542,7 @@ openclarity:
       # -- Trivy Server container repository
       repository: aquasec/trivy
       # -- Trivy Server container tag
-      tag: 0.69.3
+      tag: 0.64.1
       # -- Trivy Server image digest. If set will override the tag.
       digest: ""
       # -- Trivy Server image pull policy

infra/portainer/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: "1.16.0"
 dependencies:
   - name: portainer
     repository: https://portainer.github.io/k8s/
-    version: 2.33.6
+    version: 2.33.5

infra/portainer/values.yaml

@@ -2,7 +2,7 @@ portainer:
   replicaCount: 1
   image:
     repository: registry.durp.info/portainer/portainer-ce
-    tag: 2.39.1
+    tag: 2.33.5
     pullPolicy: Always
 
   imagePullSecrets: []

infra/renovate/Chart.yaml

@@ -10,4 +10,4 @@ dependencies:
   - name: renovate
     repository: https://docs.renovatebot.com/helm-charts
     version: 39.264.0
-    alias: "renovate-personal"
+

infra/renovate/templates/secrets.yaml

@@ -39,24 +39,3 @@ spec:
       remoteRef:
         key: kv/renovate
         property: RENOVATE_TOKEN
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: renovate-personal-config-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: renovate-personal-config-secret
-  data:
-    - secretKey: RENOVATE_TOKEN
-      remoteRef:
-        key: kv/renoatePersonal
-        property: RENOVATE_TOKEN
-    - secretKey: RENOVATE_GITHUB_COM_TOKEN
-      remoteRef:
-        key: kv/renoatePersonal
-        property: RENOVATE_GITHUB_COM_TOKEN

infra/renovate/values.yaml

@@ -1,4 +1,4 @@
-renovate-personal:
+renovate:
   global:
     # -- Additional labels to be set on all renovate resources
     commonLabels: {}
@@ -99,12 +99,12 @@ renovate-personal:
     config: |
       {
         "platform": "gitlab",
-        "endpoint": "https://gitlab.durp.info/api/v4",
+        "endpoint": "https://gitlab.com/api/v4",
-        "autodiscover": true,
+        "autodiscover": "true",
-        "dryRun": null,
+        "dryRun": false,
         "printConfig": false,
-        "autodiscoverFilter": ["durfy/**"],
+        "autodiscoverFilter": ["developerdurp/*", "durfy/*"],
-        "assignees": ["durp"]
+        "assignees": ["developerdurp"],
       }
     # See https://docs.renovatebot.com/self-hosted-configuration
     # config: |
@@ -166,7 +166,7 @@ renovate-personal:
   # -- Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set
   secrets: {}
   # -- k8s secret to reference environment variables from. Overrides secrets if set
-  existingSecret: "renovate-personal-config-secret"
+  existingSecret: "renovate-config-secret"
 
   # -- Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config
   extraConfigmaps: []
@@ -233,8 +233,8 @@ renovate-personal:
     #  cpu: 100m
     #  memory: 128Mi
     # requests:
-  #  cpu: 100m
+    #  cpu: 100m
-  #  memory: 128Mi
+    #  memory: 128Mi
 
   # -- Environment variables to add from existing secrets/configmaps. Uses the keys as variable name
   envFrom: []
@@ -247,7 +247,6 @@ renovate-personal:
   # -- Environment variables to set on the renovate container
   env:
     RENOVATE_AUTODISCOVER: true
-    #LOG_LEVEL: debug
   # env:
   #   VARIABLE_NAME: "value"
 

infra/terraform/k3s.tf

@@ -0,0 +1,116 @@
+resource "proxmox_vm_qemu" "k3smaster" {
+  lifecycle {
+    prevent_destroy = true
+  }
+  count       = local.k3smaster.count
+  ciuser      = "administrator"
+  name        = local.k3smaster.name[count.index]
+  target_node = local.k3smaster.node[count.index]
+  tags        = local.k3smaster.tags
+  full_clone  = false
+  qemu_os     = "l26"
+  os_type     = "cloud-init"
+  agent       = 1
+  cores       = local.k3smaster.cores
+  sockets     = 1
+  cpu_type    = "host"
+  memory      = local.k3smaster.memory
+  scsihw      = "virtio-scsi-pci"
+  boot        = "order=virtio0"
+  onboot      = true
+  sshkeys     = local.sshkeys
+  vga {
+    type = "serial0"
+  }
+  serial {
+    id   = 0
+    type = "socket"
+  }
+  disks {
+    ide {
+      ide2 {
+        cloudinit {
+          storage = local.k3smaster.storage
+        }
+      }
+    }
+    virtio {
+      virtio0 {
+        disk {
+          size    = local.k3smaster.drive
+          format  = local.format
+          storage = local.k3smaster.storage
+        }
+      }
+    }
+  }
+  network {
+    id     = 0
+    model  = "virtio"
+    bridge = "vmbr0"
+    tag    = local.vlan
+  }
+  #Cloud Init Settings
+  ipconfig0    = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
+  searchdomain = "durp.loc"
+  nameserver   = local.dnsserver
+}
+
+resource "proxmox_vm_qemu" "k3sserver" {
+  lifecycle {
+    prevent_destroy = true
+  }
+  count       = local.k3sserver.count
+  ciuser      = "administrator"
+  name        = local.k3sserver.name[count.index]
+  target_node = local.k3sserver.node[count.index]
+  tags        = local.k3sserver.tags
+  qemu_os     = "l26"
+  full_clone  = false
+  os_type     = "cloud-init"
+  agent       = 1
+  cores       = local.k3sserver.cores
+  sockets     = 1
+  cpu_type    = "host"
+  memory      = local.k3sserver.memory
+  scsihw      = "virtio-scsi-pci"
+  #bootdisk    = "scsi0"
+  boot    = "order=virtio0"
+  onboot  = true
+  sshkeys = local.sshkeys
+  vga {
+    type = "serial0"
+  }
+  serial {
+    id   = 0
+    type = "socket"
+  }
+  disks {
+    ide {
+      ide2 {
+        cloudinit {
+          storage = local.k3sserver.storage
+        }
+      }
+    }
+    virtio {
+      virtio0 {
+        disk {
+          size    = local.k3sserver.drive
+          format  = local.format
+          storage = local.k3sserver.storage
+        }
+      }
+    }
+  }
+  network {
+    id     = 0
+    model  = "virtio"
+    bridge = "vmbr0"
+    tag    = local.vlan
+  }
+  #Cloud Init Settings
+  ipconfig0    = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
+  searchdomain = "durp.loc"
+  nameserver   = local.dnsserver
+}

infra/terraform/main.tf

@@ -0,0 +1,81 @@
+terraform {
+  backend "http" {}
+  required_providers {
+    proxmox = {
+      source  = "Telmate/proxmox"
+      version = "3.0.1-rc9"
+    }
+  }
+}
+
+provider "proxmox" {
+  pm_parallel     = 1
+  pm_tls_insecure = true
+  pm_api_url      = var.pm_api_url
+  pm_user         = var.pm_user
+  pm_password     = var.pm_password
+  pm_debug        = false
+}
+
+locals {
+  sshkeys   = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible"
+  template  = "Debian12-Template"
+  format    = "raw"
+  dnsserver = "192.168.12.1"
+  vlan      = 12
+  k3smaster = {
+    tags    = "k3s_infra"
+    count   = 3
+    name    = ["master01-infra", "master02-infra", "master03-infra"]
+    cores   = 2
+    memory  = "4096"
+    drive   = 20
+    storage = "cache-domains"
+    node    = ["mothership", "overlord", "vanguard"]
+    ip      = ["11", "12", "13"]
+  }
+  k3sserver = {
+    tags    = "k3s_infra"
+    count   = 3
+    name    = ["node01-infra", "node02-infra", "node03-infra"]
+    cores   = 4
+    memory  = "16384"
+    drive   = 240
+    storage = "cache-domains"
+    node    = ["mothership", "overlord", "vanguard"]
+    ip      = ["21", "22", "23"]
+  }
+  #haproxy = {
+  #  tags    = "haproxy"
+  #  count   = 3
+  #  name    = ["haproxy-01", "haproxy-02", "haproxy-03"]
+  #  cores   = 2
+  #  memory  = "1024"
+  #  drive   = 20
+  #  storage = "cache-domains"
+  #  node    = ["mothership", "overlord", "vanguard"]
+  #  ip      = ["31", "32", "33"]
+  #}
+  #postgres = {
+  #  tags    = "postgres"
+  #  count   = 3
+  #  name    = ["postgres-01", "postgres-02", "postgres-03"]
+  #  cores   = 4
+  #  memory  = "4096"
+  #  drive   = 40
+  #  storage = "cache-domains"
+  #  node    = ["mothership", "overlord", "vanguard"]
+  #  ip      = ["34", "35", "36"]
+  #}
+  pihole = {
+    tags    = "pihole"
+    count   = 3
+    name    = ["pihole-01", "pihole-02", "pihole-03"]
+    cores   = 2
+    memory  = "2048"
+    drive   = 20
+    storage = "cache-domains"
+    node    = ["mothership", "overlord", "vanguard"]
+    ip      = ["41", "42", "43"]
+  }
+}

infra/terraform/pihole.tf

@@ -0,0 +1,57 @@
+resource "proxmox_vm_qemu" "pihole" {
+  count       = local.pihole.count
+  ciuser      = "administrator"
+  vmid        = "${local.vlan}${local.pihole.ip[count.index]}"
+  name        = local.pihole.name[count.index]
+  target_node = local.pihole.node[count.index]
+  clone       = local.template
+  tags        = local.pihole.tags
+  qemu_os     = "l26"
+  full_clone  = true
+  os_type     = "cloud-init"
+  agent       = 1
+  cores       = local.pihole.cores
+  sockets     = 1
+  cpu_type    = "host"
+  memory      = local.pihole.memory
+  scsihw      = "virtio-scsi-pci"
+  #bootdisk    = "scsi0"
+  boot    = "order=virtio0"
+  onboot  = true
+  sshkeys = local.sshkeys
+  vga {
+    type = "serial0"
+  }
+  serial {
+    id   = 0
+    type = "socket"
+  }
+  disks {
+    ide {
+      ide2 {
+        cloudinit {
+          storage = local.pihole.storage
+        }
+      }
+    }
+    virtio {
+      virtio0 {
+        disk {
+          size    = local.pihole.drive
+          format  = local.format
+          storage = local.pihole.storage
+        }
+      }
+    }
+  }
+  network {
+    id     = 0
+    model  = "virtio"
+    bridge = "vmbr0"
+    tag    = local.vlan
+  }
+  #Cloud Init Settings
+  ipconfig0    = "ip=192.168.${local.vlan}.${local.pihole.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
+  searchdomain = "durp.loc"
+  nameserver   = local.dnsserver
+}

infra/terraform/postgres.tf

@@ -0,0 +1,116 @@
+#resource "proxmox_vm_qemu" "haproxy" {
+#  count       = local.haproxy.count
+#  ciuser      = "administrator"
+#  vmid        = "${local.vlan}${local.haproxy.ip[count.index]}"
+#  name        = local.haproxy.name[count.index]
+#  target_node = local.haproxy.node[count.index]
+#  clone       = local.template
+#  tags        = local.haproxy.tags
+#  qemu_os     = "l26"
+#  full_clone  = true
+#  os_type     = "cloud-init"
+#  agent       = 1
+#  cores       = local.haproxy.cores
+#  sockets     = 1
+#  cpu_type    = "host"
+#  memory      = local.haproxy.memory
+#  scsihw      = "virtio-scsi-pci"
+#  #bootdisk    = "scsi0"
+#  boot    = "order=virtio0"
+#  onboot  = true
+#  sshkeys = local.sshkeys
+#  vga {
+#    type = "serial0"
+#  }
+#  serial {
+#    id   = 0
+#    type = "socket"
+#  }
+#  disks {
+#    ide {
+#      ide2 {
+#        cloudinit {
+#          storage = local.haproxy.storage
+#        }
+#      }
+#    }
+#    virtio {
+#      virtio0 {
+#        disk {
+#          size    = local.haproxy.drive
+#          format  = local.format
+#          storage = local.haproxy.storage
+#        }
+#      }
+#    }
+#  }
+#  network {
+#    id     = 0
+#    model  = "virtio"
+#    bridge = "vmbr0"
+#    tag    = local.vlan
+#  }
+#  #Cloud Init Settings
+#  ipconfig0    = "ip=192.168.${local.vlan}.${local.haproxy.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
+#  searchdomain = "durp.loc"
+#  nameserver   = local.dnsserver
+#}
+#
+#resource "proxmox_vm_qemu" "postgres" {
+#  count       = local.postgres.count
+#  ciuser      = "administrator"
+#  vmid        = "${local.vlan}${local.postgres.ip[count.index]}"
+#  name        = local.postgres.name[count.index]
+#  target_node = local.postgres.node[count.index]
+#  clone       = local.template
+#  tags        = local.postgres.tags
+#  qemu_os     = "l26"
+#  full_clone  = true
+#  os_type     = "cloud-init"
+#  agent       = 1
+#  cores       = local.postgres.cores
+#  sockets     = 1
+#  cpu_type    = "host"
+#  memory      = local.postgres.memory
+#  scsihw      = "virtio-scsi-pci"
+#  #bootdisk    = "scsi0"
+#  boot    = "order=virtio0"
+#  onboot  = true
+#  sshkeys = local.sshkeys
+#  vga {
+#    type = "serial0"
+#  }
+#  serial {
+#    id   = 0
+#    type = "socket"
+#  }
+#  disks {
+#    ide {
+#      ide2 {
+#        cloudinit {
+#          storage = local.postgres.storage
+#        }
+#      }
+#    }
+#    virtio {
+#      virtio0 {
+#        disk {
+#          size    = local.postgres.drive
+#          format  = local.format
+#          storage = local.postgres.storage
+#        }
+#      }
+#    }
+#  }
+#  network {
+#    id     = 0
+#    model  = "virtio"
+#    bridge = "vmbr0"
+#    tag    = local.vlan
+#  }
+#  #Cloud Init Settings
+#  ipconfig0    = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
+#  searchdomain = "durp.loc"
+#  nameserver   = local.dnsserver
+#}
+#

infra/terraform/variables.tf

@@ -0,0 +1,14 @@
+variable "pm_api_url" {
+  description = "API URL to Proxmox provider"
+  type        = string
+}
+
+variable "pm_password" {
+  description = "Passowrd to Proxmox provider"
+  type        = string
+}
+
+variable "pm_user" {
+  description = "UIsername to Proxmox provider"
+  type        = string
+}

master/argocd/Chart.yaml

@@ -0,0 +1,14 @@
+apiVersion: v2
+name: argocd
+description: A Helm chart for Kubernetes
+type: application
+
+version: 0.1.0
+appVersion: "1.16.0"
+
+dependencies:
+- name: argo-cd
+  repository: https://argoproj.github.io/argo-helm
+  version: 8.1.3
+
+