Compare commits
1 commit
main
...
renovate/c
| Author | SHA1 | Date | |
|---|---|---|---|
|
5d9969289c |
263 changed files with 11266 additions and 1281 deletions
4
.gitignore
vendored
4
.gitignore
vendored
|
|
@ -1,3 +1,3 @@
|
|||
*/.terraform
|
||||
*/.terraform.lock.hcl
|
||||
.idea
|
||||
infra/terraform/.terraform
|
||||
infra/terraform/.terraform.lock.hcl
|
||||
|
|
|
|||
34
.gitlab/.gitlab-ci.yml
Normal file
34
.gitlab/.gitlab-ci.yml
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
stages:
|
||||
- triggers
|
||||
|
||||
build_dmz:
|
||||
stage: triggers
|
||||
trigger:
|
||||
include: infra/.gitlab/.gitlab-ci.yml
|
||||
rules:
|
||||
- changes:
|
||||
- "dmz/terraform/*.tf"
|
||||
|
||||
build_infra:
|
||||
stage: triggers
|
||||
trigger:
|
||||
include: infra/.gitlab/.gitlab-ci.yml
|
||||
rules:
|
||||
- changes:
|
||||
- "infra/terraform/*.tf"
|
||||
|
||||
build_dev:
|
||||
stage: triggers
|
||||
trigger:
|
||||
include: dev/.gitlab/.gitlab-ci.yml
|
||||
rules:
|
||||
- changes:
|
||||
- "dev/terraform/*.tf"
|
||||
|
||||
build_prd:
|
||||
stage: triggers
|
||||
trigger:
|
||||
include: prd/.gitlab/.gitlab-ci.yml
|
||||
rules:
|
||||
- changes:
|
||||
- "prd/terraform/*.tf"
|
||||
5
ansible/base.yaml
Normal file
5
ansible/base.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
- hosts: all
|
||||
gather_facts: yes
|
||||
become: yes
|
||||
roles:
|
||||
- base
|
||||
2
ansible/newcluster.yaml
Normal file
2
ansible/newcluster.yaml
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
argocd login --insecure
|
||||
argocd cluster add default --name prd --yes --kubeconfig ~/Documents/config-prd
|
||||
1
ansible/roles/base/files/01proxy
Normal file
1
ansible/roles/base/files/01proxy
Normal file
|
|
@ -0,0 +1 @@
|
|||
Acquire::http::Proxy "http://192.168.21.200:3142";
|
||||
4
ansible/roles/base/files/10periodic
Normal file
4
ansible/roles/base/files/10periodic
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
2
ansible/roles/base/files/authorized_keys_user
Normal file
2
ansible/roles/base/files/authorized_keys_user
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGilcndatMrXg06VxtNKuIo3scoyyXbYX8Z7cOjeA102AAAABHNzaDo= desktop-arch-09-08-2025-yubikey
|
||||
sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINsbNSZ5Wr+50Ahz+IeZxt6F7gZ6wm1J8uKXQLbdbKFaAAAABHNzaDo= desktop-arch-09-08-2025-yubikeyNano
|
||||
4
ansible/roles/base/files/issue
Normal file
4
ansible/roles/base/files/issue
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
Use of this system is restricted to authorized users only, and all use is subjected to an acceptable use policy.
|
||||
|
||||
IF YOU ARE NOT AUTHORIZED TO USE THIS SYSTEM, DISCONNECT NOW.
|
||||
|
||||
4
ansible/roles/base/files/motd
Normal file
4
ansible/roles/base/files/motd
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
THIS SYSTEM IS FOR AUTHORIZED USE ONLY
|
||||
|
||||
All activities are logged and monitored.
|
||||
|
||||
95
ansible/roles/base/files/sshd_config_secured
Normal file
95
ansible/roles/base/files/sshd_config_secured
Normal file
|
|
@ -0,0 +1,95 @@
|
|||
# Package generated configuration file
|
||||
# See the sshd_config(5) manpage for details
|
||||
|
||||
# What ports, IPs and protocols we listen for
|
||||
Port 22
|
||||
# Use these options to restrict which interfaces/protocols sshd will bind to
|
||||
#ListenAddress ::
|
||||
#ListenAddress 0.0.0.0
|
||||
Protocol 2
|
||||
# HostKeys for protocol version 2
|
||||
HostKey /etc/ssh/ssh_host_rsa_key
|
||||
HostKey /etc/ssh/ssh_host_dsa_key
|
||||
HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
#Privilege Separation is turned on for security
|
||||
UsePrivilegeSeparation yes
|
||||
|
||||
# Lifetime and size of ephemeral version 1 server key
|
||||
KeyRegenerationInterval 3600
|
||||
ServerKeyBits 1024
|
||||
|
||||
# Logging
|
||||
SyslogFacility AUTH
|
||||
LogLevel INFO
|
||||
|
||||
# Authentication:
|
||||
LoginGraceTime 120
|
||||
PermitRootLogin no
|
||||
StrictModes yes
|
||||
|
||||
RSAAuthentication yes
|
||||
PubkeyAuthentication yes
|
||||
#AuthorizedKeysFile %h/.ssh/authorized_keys
|
||||
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
IgnoreRhosts yes
|
||||
# For this to work you will also need host keys in /etc/ssh_known_hosts
|
||||
RhostsRSAAuthentication no
|
||||
# similar for protocol version 2
|
||||
HostbasedAuthentication no
|
||||
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
|
||||
#IgnoreUserKnownHosts yes
|
||||
|
||||
# To enable empty passwords, change to yes (NOT RECOMMENDED)
|
||||
PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication no
|
||||
|
||||
# Change to no to disable tunnelled clear text passwords
|
||||
PasswordAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosGetAFSToken no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
|
||||
X11Forwarding no
|
||||
X11DisplayOffset 10
|
||||
PrintMotd no
|
||||
PrintLastLog yes
|
||||
TCPKeepAlive yes
|
||||
#UseLogin no
|
||||
|
||||
#MaxStartups 10:30:60
|
||||
#Banner /etc/issue.net
|
||||
|
||||
# Allow client to pass locale environment variables
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
UsePAM yes
|
||||
|
||||
ClientAliveInterval 300
|
||||
|
||||
#enable remote powershell
|
||||
#Subsystem powershell /usr/bin/pwsh -sshs -NoLogo
|
||||
|
||||
|
||||
155
ansible/roles/base/tasks/main.yaml
Normal file
155
ansible/roles/base/tasks/main.yaml
Normal file
|
|
@ -0,0 +1,155 @@
|
|||
- name: Copy apt proxy
|
||||
copy:
|
||||
src: files/01proxy
|
||||
dest: /etc/apt/apt.conf.d/01proxy
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
force: yes
|
||||
when:
|
||||
- ansible_os_family == "Debian"
|
||||
- inventory_hostname not in hosts_deny
|
||||
|
||||
- name: Update packages
|
||||
apt:
|
||||
name: '*'
|
||||
state: latest
|
||||
update_cache: yes
|
||||
only_upgrade: yes
|
||||
retries: 300
|
||||
delay: 10
|
||||
|
||||
- name: Remove packages not needed anymore
|
||||
apt:
|
||||
autoremove: yes
|
||||
retries: 300
|
||||
delay: 10
|
||||
|
||||
- name: Install required packages Debian
|
||||
apt:
|
||||
state: latest
|
||||
pkg: "{{ item }}"
|
||||
with_items: "{{ required_packages }}"
|
||||
retries: 300
|
||||
delay: 10
|
||||
|
||||
- name: Create user account
|
||||
user:
|
||||
name: "user"
|
||||
shell: /bin/bash
|
||||
state: present
|
||||
createhome: yes
|
||||
|
||||
- name: ensure ssh folder exists for user
|
||||
file:
|
||||
path: /home/user/.ssh
|
||||
owner: user
|
||||
group: user
|
||||
mode: "0700"
|
||||
state: directory
|
||||
|
||||
- name: Deploy SSH Key (user)
|
||||
copy:
|
||||
dest: /home/user/.ssh/authorized_keys
|
||||
src: files/authorized_keys_user
|
||||
owner: user
|
||||
group: user
|
||||
force: true
|
||||
|
||||
- name: Remove Root SSH Configuration
|
||||
file:
|
||||
path: /root/.ssh
|
||||
state: absent
|
||||
|
||||
- name: Copy Secured SSHD Configuration
|
||||
copy:
|
||||
src: files/sshd_config_secured
|
||||
dest: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Copy Secured SSHD Configuration
|
||||
copy:
|
||||
src: files/sshd_config_secured_redhat
|
||||
dest: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when: ansible_os_family == "RedHat"
|
||||
|
||||
- name: Restart SSHD
|
||||
systemd:
|
||||
name: sshd
|
||||
daemon_reload: yes
|
||||
state: restarted
|
||||
enabled: yes
|
||||
ignore_errors: yes
|
||||
|
||||
|
||||
- name: Copy unattended-upgrades file
|
||||
copy:
|
||||
src: files/10periodic
|
||||
dest: /etc/apt/apt.conf.d/10periodic
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
force: yes
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Remove undesirable packages
|
||||
package:
|
||||
name: "{{ unnecessary_software }}"
|
||||
state: absent
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Stop and disable unnecessary services
|
||||
service:
|
||||
name: "{{ item }}"
|
||||
state: stopped
|
||||
enabled: no
|
||||
with_items: "{{ unnecessary_services }}"
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Set a message of the day
|
||||
copy:
|
||||
dest: /etc/motd
|
||||
src: files/motd
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
|
||||
- name: Set a login banner
|
||||
copy:
|
||||
dest: "{{ item }}"
|
||||
src: files/issue
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
with_items:
|
||||
- /etc/issue
|
||||
- /etc/issue.net
|
||||
|
||||
- name: set timezone
|
||||
shell: timedatectl set-timezone America/Chicago
|
||||
|
||||
- name: Enable cockpit
|
||||
systemd:
|
||||
name: cockpit
|
||||
daemon_reload: yes
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- name: change password
|
||||
ansible.builtin.user:
|
||||
name: "user"
|
||||
state: present
|
||||
password: "{{ lookup('ansible.builtin.env', 'USER_PASSWORD') | password_hash('sha512') }}"
|
||||
|
||||
- name: add user to sudoers
|
||||
community.general.sudoers:
|
||||
name: user
|
||||
state: present
|
||||
user: user
|
||||
commands: ALL
|
||||
17
ansible/roles/base/vars/main.yaml
Normal file
17
ansible/roles/base/vars/main.yaml
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
required_packages:
|
||||
- ufw
|
||||
- qemu-guest-agent
|
||||
- fail2ban
|
||||
- unattended-upgrades
|
||||
- cockpit
|
||||
- nfs-common
|
||||
- open-iscsi
|
||||
|
||||
unnecessary_services:
|
||||
- postfix
|
||||
- telnet
|
||||
|
||||
unnecessary_software:
|
||||
- tcpdump
|
||||
- nmap-ncat
|
||||
- wpa_supplicant
|
||||
|
|
@ -8,4 +8,4 @@ appVersion: 0.0.1
|
|||
dependencies:
|
||||
- name: cert-manager
|
||||
repository: https://charts.jetstack.io
|
||||
version: v1.17.2
|
||||
version: v1.19.2
|
||||
|
|
|
|||
115
dev/terraform/k3s.tf
Normal file
115
dev/terraform/k3s.tf
Normal file
|
|
@ -0,0 +1,115 @@
|
|||
resource "proxmox_vm_qemu" "k3smaster" {
|
||||
count = local.k3smaster.count
|
||||
ciuser = "administrator"
|
||||
vmid = "${local.vlan}${local.k3smaster.ip[count.index]}"
|
||||
name = local.k3smaster.name[count.index]
|
||||
target_node = local.k3smaster.node[count.index]
|
||||
clone = local.template
|
||||
tags = local.k3smaster.tags
|
||||
qemu_os = "l26"
|
||||
full_clone = true
|
||||
os_type = "cloud-init"
|
||||
agent = 1
|
||||
cores = local.k3smaster.cores
|
||||
sockets = 1
|
||||
cpu_type = "host"
|
||||
memory = local.k3smaster.memory
|
||||
scsihw = "virtio-scsi-pci"
|
||||
#bootdisk = "scsi0"
|
||||
boot = "order=virtio0"
|
||||
onboot = true
|
||||
sshkeys = local.sshkeys
|
||||
vga {
|
||||
type = "serial0"
|
||||
}
|
||||
serial {
|
||||
id = 0
|
||||
type = "socket"
|
||||
}
|
||||
disks {
|
||||
ide {
|
||||
ide2 {
|
||||
cloudinit {
|
||||
storage = local.k3smaster.storage
|
||||
}
|
||||
}
|
||||
}
|
||||
virtio {
|
||||
virtio0 {
|
||||
disk {
|
||||
size = local.k3smaster.drive
|
||||
format = local.format
|
||||
storage = local.k3smaster.storage
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
network {
|
||||
id = 0
|
||||
model = "virtio"
|
||||
bridge = "vmbr0"
|
||||
tag = local.vlan
|
||||
}
|
||||
#Cloud Init Settings
|
||||
ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
|
||||
searchdomain = "durp.loc"
|
||||
nameserver = local.dnsserver
|
||||
}
|
||||
|
||||
resource "proxmox_vm_qemu" "k3sserver" {
|
||||
count = local.k3sserver.count
|
||||
ciuser = "administrator"
|
||||
vmid = "${local.vlan}${local.k3sserver.ip[count.index]}"
|
||||
name = local.k3sserver.name[count.index]
|
||||
target_node = local.k3sserver.node[count.index]
|
||||
clone = local.template
|
||||
tags = local.k3sserver.tags
|
||||
qemu_os = "l26"
|
||||
full_clone = true
|
||||
os_type = "cloud-init"
|
||||
agent = 1
|
||||
cores = local.k3sserver.cores
|
||||
sockets = 1
|
||||
cpu_type = "host"
|
||||
memory = local.k3sserver.memory
|
||||
scsihw = "virtio-scsi-pci"
|
||||
#bootdisk = "scsi0"
|
||||
boot = "order=virtio0"
|
||||
onboot = true
|
||||
sshkeys = local.sshkeys
|
||||
vga {
|
||||
type = "serial0"
|
||||
}
|
||||
serial {
|
||||
id = 0
|
||||
type = "socket"
|
||||
}
|
||||
disks {
|
||||
ide {
|
||||
ide2 {
|
||||
cloudinit {
|
||||
storage = local.k3sserver.storage
|
||||
}
|
||||
}
|
||||
}
|
||||
virtio {
|
||||
virtio0 {
|
||||
disk {
|
||||
size = local.k3sserver.drive
|
||||
format = local.format
|
||||
storage = local.k3sserver.storage
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
network {
|
||||
id = 0
|
||||
model = "virtio"
|
||||
bridge = "vmbr0"
|
||||
tag = local.vlan
|
||||
}
|
||||
#Cloud Init Settings
|
||||
ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
|
||||
searchdomain = "durp.loc"
|
||||
nameserver = local.dnsserver
|
||||
}
|
||||
48
dev/terraform/main.tf
Normal file
48
dev/terraform/main.tf
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
terraform {
|
||||
backend "http" {}
|
||||
required_providers {
|
||||
proxmox = {
|
||||
source = "Telmate/proxmox"
|
||||
version = "3.0.1-rc9"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "proxmox" {
|
||||
pm_parallel = 1
|
||||
pm_tls_insecure = true
|
||||
pm_api_url = var.pm_api_url
|
||||
pm_user = var.pm_user
|
||||
pm_password = var.pm_password
|
||||
pm_debug = false
|
||||
}
|
||||
|
||||
locals {
|
||||
sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible"
|
||||
template = "Debian12-Template"
|
||||
format = "raw"
|
||||
dnsserver = "192.168.10.1"
|
||||
vlan = 10
|
||||
k3smaster = {
|
||||
tags = "k3s_dev"
|
||||
count = 3
|
||||
name = ["master01-dev", "master02-dev", "master03-dev"]
|
||||
cores = 2
|
||||
memory = "4096"
|
||||
drive = 20
|
||||
storage = "cache-domains"
|
||||
node = ["mothership", "overlord", "vanguard"]
|
||||
ip = ["11", "12", "13"]
|
||||
}
|
||||
k3sserver = {
|
||||
tags = "k3s_dev"
|
||||
count = 3
|
||||
name = ["node01-dev", "node02-dev", "node03-dev"]
|
||||
cores = 4
|
||||
memory = "8192"
|
||||
drive = 120
|
||||
storage = "cache-domains"
|
||||
node = ["mothership", "overlord", "vanguard"]
|
||||
ip = ["21", "22", "23"]
|
||||
}
|
||||
}
|
||||
14
dev/terraform/variables.tf
Normal file
14
dev/terraform/variables.tf
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
variable "pm_api_url" {
|
||||
description = "API URL to Proxmox provider"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "pm_password" {
|
||||
description = "Passowrd to Proxmox provider"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "pm_user" {
|
||||
description = "Username to Proxmox provider"
|
||||
type = string
|
||||
}
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: authentik-tls
|
||||
spec:
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
secretName: authentik-tls
|
||||
commonName: "authentik.durp.info"
|
||||
dnsNames:
|
||||
- "authentik.durp.info"
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: authentik-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`authentik.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: infra-cluster
|
||||
port: 443
|
||||
tls:
|
||||
secretName: authentik-tls
|
||||
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: authentik-external-dns
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: infra-cluster
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.12.130
|
||||
ports:
|
||||
- port: 443
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: infra-cluster
|
||||
spec:
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 443
|
||||
targetPort: 443
|
||||
|
|
@ -8,4 +8,4 @@ appVersion: 0.0.1
|
|||
dependencies:
|
||||
- name: cert-manager
|
||||
repository: https://charts.jetstack.io
|
||||
version: v1.17.2
|
||||
version: v1.19.2
|
||||
|
|
|
|||
|
|
@ -6,6 +6,9 @@ version: 0.0.1
|
|||
appVersion: 0.0.1
|
||||
|
||||
dependencies:
|
||||
- name: gitlab-runner
|
||||
repository: https://charts.gitlab.io/
|
||||
version: 0.77.2
|
||||
- name: gitlab-runner
|
||||
repository: https://charts.gitlab.io/
|
||||
version: 0.77.2
|
||||
|
|
|
|||
|
|
@ -1,3 +1,75 @@
|
|||
gitlab-runner:
|
||||
|
||||
image:
|
||||
registry: registry.durp.info
|
||||
image: gitlab-org/gitlab-runner
|
||||
|
||||
imagePullPolicy: Always
|
||||
gitlabUrl: https://gitlab.com/
|
||||
unregisterRunner: false
|
||||
terminationGracePeriodSeconds: 3600
|
||||
concurrent: 10
|
||||
checkInterval: 30
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
rules: []
|
||||
clusterWideAccess: false
|
||||
podSecurityPolicy:
|
||||
enabled: false
|
||||
resourceNames:
|
||||
- gitlab-runner
|
||||
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
service:
|
||||
enabled: true
|
||||
annotations: {}
|
||||
|
||||
runners:
|
||||
config: |
|
||||
[[runners]]
|
||||
[runners.kubernetes]
|
||||
namespace = "{{.Release.Namespace}}"
|
||||
image = "ubuntu:22.04"
|
||||
privileged = true
|
||||
|
||||
executor: kubernetes
|
||||
name: "k3s"
|
||||
runUntagged: true
|
||||
privileged: true
|
||||
secret: gitlab-secret
|
||||
#builds:
|
||||
#cpuLimit: 200m
|
||||
#cpuLimitOverwriteMaxAllowed: 400m
|
||||
#memoryLimit: 256Mi
|
||||
#memoryLimitOverwriteMaxAllowed: 512Mi
|
||||
#cpuRequests: 100m
|
||||
#cpuRequestsOverwriteMaxAllowed: 200m
|
||||
#memoryRequests: 128Mi
|
||||
#memoryRequestsOverwriteMaxAllowed: 256Mi
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
|
||||
podSecurityContext:
|
||||
runAsUser: 100
|
||||
fsGroup: 65533
|
||||
|
||||
resources:
|
||||
limits:
|
||||
memory: 2Gi
|
||||
requests:
|
||||
memory: 128Mi
|
||||
cpu: 500m
|
||||
|
||||
personal:
|
||||
|
||||
image:
|
||||
|
|
@ -5,7 +77,7 @@ personal:
|
|||
image: gitlab-org/gitlab-runner
|
||||
|
||||
imagePullPolicy: Always
|
||||
gitlabUrl: https://gitlab.durp.info/
|
||||
gitlabUrl: https://gitlab.com/
|
||||
unregisterRunner: false
|
||||
terminationGracePeriodSeconds: 3600
|
||||
concurrent: 10
|
||||
|
|
@ -41,15 +113,15 @@ personal:
|
|||
runUntagged: true
|
||||
privileged: true
|
||||
secret: gitlab-secret-personal
|
||||
builds:
|
||||
cpuLimit: 200m
|
||||
cpuLimitOverwriteMaxAllowed: 400m
|
||||
memoryLimit: 256Mi
|
||||
memoryLimitOverwriteMaxAllowed: 512Mi
|
||||
cpuRequests: 100m
|
||||
cpuRequestsOverwriteMaxAllowed: 200m
|
||||
memoryRequests: 128Mi
|
||||
memoryRequestsOverwriteMaxAllowed: 256Mi
|
||||
#builds:
|
||||
#cpuLimit: 200m
|
||||
#cpuLimitOverwriteMaxAllowed: 400m
|
||||
#memoryLimit: 256Mi
|
||||
#memoryLimitOverwriteMaxAllowed: 512Mi
|
||||
#cpuRequests: 100m
|
||||
#cpuRequestsOverwriteMaxAllowed: 200m
|
||||
#memoryRequests: 128Mi
|
||||
#memoryRequestsOverwriteMaxAllowed: 256Mi
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
|
@ -68,4 +140,4 @@ personal:
|
|||
memory: 2Gi
|
||||
requests:
|
||||
memory: 128Mi
|
||||
cpu: 50m
|
||||
cpu: 500m
|
||||
|
|
|
|||
|
|
@ -1,34 +0,0 @@
|
|||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: argocd-infra-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`argocd.infra.durp.info`)
|
||||
middlewares:
|
||||
- name: whitelist
|
||||
namespace: traefik
|
||||
kind: Rule
|
||||
services:
|
||||
- name: infra-cluster
|
||||
port: 443
|
||||
scheme: https
|
||||
tls:
|
||||
secretName: argocd-infra-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: argocd-infra-tls
|
||||
spec:
|
||||
secretName: argocd-infra-tls
|
||||
issuerRef:
|
||||
name: vault-issuer
|
||||
kind: ClusterIssuer
|
||||
commonName: "argocd.infra.durp.info"
|
||||
dnsNames:
|
||||
- "argocd.infra.durp.info"
|
||||
|
|
@ -1,40 +1,40 @@
|
|||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: authentik-tls
|
||||
spec:
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
secretName: authentik-tls
|
||||
commonName: "authentik.durp.info"
|
||||
dnsNames:
|
||||
- "authentik.durp.info"
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: authentik-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`authentik.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: infra-cluster
|
||||
port: 443
|
||||
tls:
|
||||
secretName: authentik-tls
|
||||
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: authentik-external-dns
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
#apiVersion: traefik.io/v1alpha1
|
||||
#kind: IngressRoute
|
||||
#metadata:
|
||||
# name: authentik-ingress
|
||||
#spec:
|
||||
# entryPoints:
|
||||
# - websecure
|
||||
# routes:
|
||||
# - match: Host(`authentik.durp.info`) && PathPrefix(`/`)
|
||||
# kind: Rule
|
||||
# services:
|
||||
# - name: infra-cluster
|
||||
# port: 443
|
||||
# tls:
|
||||
# secretName: authentik-tls
|
||||
#
|
||||
#---
|
||||
#apiVersion: cert-manager.io/v1
|
||||
#kind: Certificate
|
||||
#metadata:
|
||||
# name: authentik-tls
|
||||
#spec:
|
||||
# issuerRef:
|
||||
# name: letsencrypt-production
|
||||
# kind: ClusterIssuer
|
||||
# secretName: authentik-tls
|
||||
# commonName: "authentik.durp.info"
|
||||
# dnsNames:
|
||||
# - "authentik.durp.info"
|
||||
#
|
||||
#---
|
||||
#kind: Service
|
||||
#apiVersion: v1
|
||||
#metadata:
|
||||
# name: authentik-external-dns
|
||||
# annotations:
|
||||
# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
|
||||
#spec:
|
||||
# type: ExternalName
|
||||
# externalName: durp.info
|
||||
|
|
|
|||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: duplicati
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 8200
|
||||
protocol: TCP
|
||||
targetPort: 8200
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: duplicati
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 8200
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -14,7 +43,7 @@ spec:
|
|||
namespace: traefik
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
- name: duplicati
|
||||
port: 8200
|
||||
tls:
|
||||
secretName: duplicati-tls
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ subsets:
|
|||
- port: 443
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
|
|
@ -20,6 +21,7 @@ spec:
|
|||
targetPort: 443
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
|
|
@ -31,6 +33,7 @@ subsets:
|
|||
- port: 443
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
|
|
@ -40,191 +43,3 @@ spec:
|
|||
- protocol: TCP
|
||||
port: 443
|
||||
targetPort: 443
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: unraid
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
protocol: TCP
|
||||
port: 443
|
||||
targetPort: 443
|
||||
- name: tdarr
|
||||
port: 8267
|
||||
protocol: TCP
|
||||
targetPort: 8267
|
||||
- name: duplicati
|
||||
port: 8200
|
||||
protocol: TCP
|
||||
targetPort: 8200
|
||||
- name: forgejo
|
||||
port: 3000
|
||||
protocol: TCP
|
||||
- name: kuma
|
||||
port: 3001
|
||||
protocol: TCP
|
||||
targetPort: 3000
|
||||
- name: freshrss
|
||||
port: 8085
|
||||
protocol: TCP
|
||||
targetPort: 8085
|
||||
- name: gitlab-ssh
|
||||
port: 9022
|
||||
protocol: TCP
|
||||
targetPort: 9022
|
||||
- name: gitlab
|
||||
port: 9443
|
||||
protocol: TCP
|
||||
targetPort: 9443
|
||||
- name: minio
|
||||
port: 9769
|
||||
protocol: TCP
|
||||
targetPort: 9769
|
||||
- name: nextcloud
|
||||
port: 11000
|
||||
protocol: TCP
|
||||
targetPort: 11000
|
||||
- name: nexus
|
||||
port: 8081
|
||||
protocol: TCP
|
||||
targetPort: 8081
|
||||
- name: openweb-ui
|
||||
port: 8089
|
||||
protocol: TCP
|
||||
targetPort: 8089
|
||||
- name: plex
|
||||
port: 32400
|
||||
protocol: TCP
|
||||
targetPort: 32400
|
||||
- name: registry
|
||||
port: 5000
|
||||
protocol: TCP
|
||||
targetPort: 5000
|
||||
- name: gitlab-registry
|
||||
port: 5002
|
||||
protocol: TCP
|
||||
targetPort: 5002
|
||||
- name: root-vault
|
||||
port: 8201
|
||||
protocol: TCP
|
||||
targetPort: 8201
|
||||
- name: s3
|
||||
port: 9768
|
||||
protocol: TCP
|
||||
targetPort: 9768
|
||||
- name: smokeping
|
||||
port: 81
|
||||
protocol: TCP
|
||||
targetPort: 81
|
||||
- name: gotify
|
||||
port: 8070
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: unraid
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
- name: tdarr
|
||||
port: 8267
|
||||
protocol: TCP
|
||||
- name: duplicati
|
||||
port: 8200
|
||||
protocol: TCP
|
||||
- name: forgejo
|
||||
port: 3000
|
||||
protocol: TCP
|
||||
- name: kuma
|
||||
port: 3001
|
||||
protocol: TCP
|
||||
- name: freshrss
|
||||
port: 8085
|
||||
protocol: TCP
|
||||
- name: gitlab-ssh
|
||||
port: 9022
|
||||
protocol: TCP
|
||||
- name: gitlab
|
||||
port: 9443
|
||||
protocol: TCP
|
||||
- name: minio
|
||||
port: 9769
|
||||
protocol: TCP
|
||||
- name: nextcloud
|
||||
port: 11000
|
||||
protocol: TCP
|
||||
- name: nexus
|
||||
port: 8081
|
||||
protocol: TCP
|
||||
- name: openweb-ui
|
||||
port: 8089
|
||||
protocol: TCP
|
||||
- name: plex
|
||||
port: 32400
|
||||
protocol: TCP
|
||||
- name: registry
|
||||
port: 5000
|
||||
protocol: TCP
|
||||
- name: gitlab-registry
|
||||
port: 5002
|
||||
protocol: TCP
|
||||
- name: root-vault
|
||||
port: 8201
|
||||
protocol: TCP
|
||||
- name: s3
|
||||
port: 9768
|
||||
protocol: TCP
|
||||
- name: smokeping
|
||||
port: 81
|
||||
protocol: TCP
|
||||
- name: gotify
|
||||
port: 8070
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: ubuntu
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.20.104
|
||||
ports:
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
- name: litellm
|
||||
port: 4000
|
||||
protocol: TCP
|
||||
- name: ollama
|
||||
port: 11435
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ubuntu
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 443
|
||||
- name: litellm
|
||||
port: 4000
|
||||
protocol: TCP
|
||||
targetPort: 4000
|
||||
- name: ollama
|
||||
port: 11435
|
||||
protocol: TCP
|
||||
targetPort: 11435
|
||||
|
|
|
|||
|
|
@ -1,43 +0,0 @@
|
|||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: forgejo-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`forgejo.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
port: 3000
|
||||
scheme: http
|
||||
tls:
|
||||
secretName: forgejo-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: forgejo-tls
|
||||
spec:
|
||||
secretName: forgejo-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "forgejo.durp.info"
|
||||
dnsNames:
|
||||
- "forgejo.durp.info"
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: forgejo-external-dns
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: forgejo.durp.info
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: freshrss-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`freshrss.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
port: 8085
|
||||
tls:
|
||||
secretName: freshrss-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: freshrss-tls
|
||||
spec:
|
||||
secretName: freshrss-tls
|
||||
issuerRef:
|
||||
name: vault-issuer
|
||||
kind: ClusterIssuer
|
||||
commonName: "freshrss.durp.info"
|
||||
dnsNames:
|
||||
- "freshrss.durp.info"
|
||||
72
dmz/internalproxy/templates/gitea.yaml
Normal file
72
dmz/internalproxy/templates/gitea.yaml
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: gitea
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 3000
|
||||
protocol: TCP
|
||||
targetPort: 3000
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: gitea
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 3000
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: gitea-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`gitea.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: gitea
|
||||
port: 3000
|
||||
scheme: http
|
||||
tls:
|
||||
secretName: gitea-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: gitea-tls
|
||||
spec:
|
||||
secretName: gitea-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "gitea.durp.info"
|
||||
dnsNames:
|
||||
- "gitea.durp.info"
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: gitea-external-dns
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: gitea.durp.info
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
|
|
@ -1,42 +1,28 @@
|
|||
#apiVersion: v1
|
||||
#kind: Service
|
||||
#metadata:
|
||||
# name: gitlab-ssh
|
||||
#spec:
|
||||
# ports:
|
||||
# - name: app
|
||||
# port: 9022
|
||||
# protocol: TCP
|
||||
# targetPort: 9022
|
||||
# clusterIP: None
|
||||
# type: ClusterIP
|
||||
#
|
||||
#---
|
||||
#apiVersion: v1
|
||||
#kind: Endpoints
|
||||
#metadata:
|
||||
# name: gitlab-ssh
|
||||
#subsets:
|
||||
# - addresses:
|
||||
# - ip: 192.168.21.200
|
||||
# ports:
|
||||
# - name: app
|
||||
# port: 9022
|
||||
# protocol: TCP
|
||||
#
|
||||
#---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRouteTCP
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: gitlab-ssh
|
||||
name: gitlab
|
||||
spec:
|
||||
entryPoints:
|
||||
- gitlab-ssh
|
||||
routes:
|
||||
- match: HostSNI(`*`)
|
||||
services:
|
||||
- name: unraid
|
||||
port: 9022
|
||||
ports:
|
||||
- name: app
|
||||
port: 9080
|
||||
protocol: TCP
|
||||
targetPort: 9080
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: gitlab
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 9080
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
|
|
@ -50,9 +36,9 @@ spec:
|
|||
- match: Host(`gitlab.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
port: 9443
|
||||
scheme: https
|
||||
- name: gitlab
|
||||
port: 9080
|
||||
scheme: http
|
||||
tls:
|
||||
secretName: gitlab-tls
|
||||
|
||||
|
|
@ -80,46 +66,3 @@ metadata:
|
|||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: gitlab-registry
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`images.durp.info`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
port: 5002
|
||||
scheme: http
|
||||
tls:
|
||||
secretName: gitlab-images-tls
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: gitlab-images-tls
|
||||
spec:
|
||||
secretName: gitlab-images-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "images.durp.info"
|
||||
dnsNames:
|
||||
- "images.durp.info"
|
||||
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: gitlab-images-external-dns
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: images.durp.info
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
|
|
|
|||
|
|
@ -1,41 +0,0 @@
|
|||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: gotify-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`gotify.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
port: 8070
|
||||
scheme: http
|
||||
tls:
|
||||
secretName: gotify-tls
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: gotify-tls
|
||||
spec:
|
||||
secretName: gotify-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "gotify.durp.info"
|
||||
dnsNames:
|
||||
- "gotify.durp.info"
|
||||
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: gotify-external-dns
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: gotify.durp.info
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
|
|
@ -1,75 +1,74 @@
|
|||
#apiVersion: v1
|
||||
#kind: Service
|
||||
#metadata:
|
||||
# name: invidious
|
||||
#spec:
|
||||
# ports:
|
||||
# - name: app
|
||||
# port: 3000
|
||||
# protocol: TCP
|
||||
# targetPort: 3000
|
||||
# clusterIP: None
|
||||
# type: ClusterIP
|
||||
#
|
||||
#---
|
||||
#
|
||||
#apiVersion: v1
|
||||
#kind: Endpoints
|
||||
#metadata:
|
||||
# name: invidious
|
||||
#subsets:
|
||||
#- addresses:
|
||||
# - ip: 192.168.20.104
|
||||
# ports:
|
||||
# - name: app
|
||||
# port: 3000
|
||||
# protocol: TCP
|
||||
#
|
||||
#---
|
||||
#
|
||||
#apiVersion: traefik.io/v1alpha1
|
||||
#kind: IngressRoute
|
||||
#metadata:
|
||||
# name: invidious-ingress
|
||||
#spec:
|
||||
# entryPoints:
|
||||
# - websecure
|
||||
# routes:
|
||||
# - match: Host(`invidious.durp.info`) && PathPrefix(`/`)
|
||||
# middlewares:
|
||||
# - name: authentik-proxy-provider
|
||||
# namespace: traefik
|
||||
# kind: Rule
|
||||
# services:
|
||||
# - name: invidious
|
||||
# port: 3000
|
||||
# tls:
|
||||
# secretName: invidious-tls
|
||||
#
|
||||
#---
|
||||
#
|
||||
#apiVersion: cert-manager.io/v1
|
||||
#kind: Certificate
|
||||
#metadata:
|
||||
# name: invidious-tls
|
||||
#spec:
|
||||
# secretName: invidious-tls
|
||||
# issuerRef:
|
||||
# name: letsencrypt-production
|
||||
# kind: ClusterIssuer
|
||||
# commonName: "invidious.durp.info"
|
||||
# dnsNames:
|
||||
# - "invidious.durp.info"
|
||||
#
|
||||
#---
|
||||
#
|
||||
#kind: Service
|
||||
#apiVersion: v1
|
||||
#metadata:
|
||||
# name: invidious-external-dns
|
||||
# annotations:
|
||||
# external-dns.alpha.kubernetes.io/hostname: invidious.durp.info
|
||||
#spec:
|
||||
# type: ExternalName
|
||||
# externalName: durp.info
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: invidious
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 3000
|
||||
protocol: TCP
|
||||
targetPort: 3000
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: invidious
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.20.104
|
||||
ports:
|
||||
- name: app
|
||||
port: 3000
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: invidious-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`invidious.durp.info`) && PathPrefix(`/`)
|
||||
middlewares:
|
||||
- name: authentik-proxy-provider
|
||||
namespace: traefik
|
||||
kind: Rule
|
||||
services:
|
||||
- name: invidious
|
||||
port: 3000
|
||||
tls:
|
||||
secretName: invidious-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: invidious-tls
|
||||
spec:
|
||||
secretName: invidious-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "invidious.durp.info"
|
||||
dnsNames:
|
||||
- "invidious.durp.info"
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: invidious-external-dns
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: invidious.durp.info
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
|
|
|
|||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kasm
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 443
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: kasm
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.20.104
|
||||
ports:
|
||||
- name: app
|
||||
port: 443
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -9,7 +38,7 @@ spec:
|
|||
- match: Host(`kasm.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: ubuntu
|
||||
- name: kasm
|
||||
port: 443
|
||||
scheme: https
|
||||
tls:
|
||||
|
|
|
|||
|
|
@ -8,28 +8,32 @@ spec:
|
|||
routes:
|
||||
- match: Host(`kuma.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: authentik-proxy-provider
|
||||
namespace: traefik
|
||||
services:
|
||||
- name: unraid
|
||||
port: 3001
|
||||
scheme: http
|
||||
- name: master-cluster
|
||||
port: 443
|
||||
tls:
|
||||
secretName: kuma-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: kuma-tls
|
||||
spec:
|
||||
secretName: kuma-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
secretName: kuma-tls
|
||||
commonName: "kuma.durp.info"
|
||||
dnsNames:
|
||||
- "kuma.durp.info"
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: litellm
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 4000
|
||||
protocol: TCP
|
||||
targetPort: 4000
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: litellm
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.20.104
|
||||
ports:
|
||||
- name: app
|
||||
port: 4000
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -9,7 +38,7 @@ spec:
|
|||
- match: Host(`litellm.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: ubuntu
|
||||
- name: litellm
|
||||
port: 4000
|
||||
tls:
|
||||
secretName: litellm-tls
|
||||
|
|
|
|||
|
|
@ -1,34 +0,0 @@
|
|||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: longhorn-infra-ingress
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: authentik-proxy-provider
|
||||
namespace: traefik
|
||||
services:
|
||||
- name: infra-cluster
|
||||
port: 443
|
||||
tls:
|
||||
secretName: longhorn-infra-tls
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: longhorn-infra-tls
|
||||
spec:
|
||||
secretName: longhorn-infra-tls
|
||||
issuerRef:
|
||||
name: vault-issuer
|
||||
kind: ClusterIssuer
|
||||
commonName: "longhorn.infra.durp.info"
|
||||
dnsNames:
|
||||
- "longhorn.infra.durp.info"
|
||||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: minio
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 9769
|
||||
protocol: TCP
|
||||
targetPort: 9769
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: minio
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 9769
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -12,7 +41,7 @@ spec:
|
|||
namespace: traefik
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
- name: minio
|
||||
port: 9769
|
||||
scheme: http
|
||||
tls:
|
||||
|
|
|
|||
|
|
@ -1,68 +1,68 @@
|
|||
#apiVersion: v1
|
||||
#kind: Service
|
||||
#metadata:
|
||||
# name: n8n
|
||||
#spec:
|
||||
# ports:
|
||||
# - name: app
|
||||
# port: 5678
|
||||
# protocol: TCP
|
||||
# targetPort: 5678
|
||||
# clusterIP: None
|
||||
# type: ClusterIP
|
||||
#
|
||||
#---
|
||||
#apiVersion: v1
|
||||
#kind: Endpoints
|
||||
#metadata:
|
||||
# name: n8n
|
||||
#subsets:
|
||||
# - addresses:
|
||||
# - ip: 192.168.21.200
|
||||
# ports:
|
||||
# - name: app
|
||||
# port: 5678
|
||||
# protocol: TCP
|
||||
#
|
||||
#---
|
||||
#apiVersion: traefik.io/v1alpha1
|
||||
#kind: IngressRoute
|
||||
#metadata:
|
||||
# name: n8n-ingress
|
||||
#spec:
|
||||
# entryPoints:
|
||||
# - websecure
|
||||
# routes:
|
||||
# - match: Host(`n8n.durp.info`) && PathPrefix(`/`)
|
||||
# kind: Rule
|
||||
# services:
|
||||
# - name: n8n
|
||||
# port: 5678
|
||||
# scheme: http
|
||||
# tls:
|
||||
# secretName: n8n-tls
|
||||
#
|
||||
#---
|
||||
#apiVersion: cert-manager.io/v1
|
||||
#kind: Certificate
|
||||
#metadata:
|
||||
# name: n8n-tls
|
||||
#spec:
|
||||
# secretName: n8n-tls
|
||||
# issuerRef:
|
||||
# name: letsencrypt-production
|
||||
# kind: ClusterIssuer
|
||||
# commonName: "n8n.durp.info"
|
||||
# dnsNames:
|
||||
# - "n8n.durp.info"
|
||||
#
|
||||
#---
|
||||
#kind: Service
|
||||
#apiVersion: v1
|
||||
#metadata:
|
||||
# name: n8n-dns
|
||||
# annotations:
|
||||
# dns.alpha.kubernetes.io/hostname: n8n.durp.info
|
||||
#spec:
|
||||
# type: ExternalName
|
||||
# externalName: durp.info
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: n8n
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 5678
|
||||
protocol: TCP
|
||||
targetPort: 5678
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: n8n
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 5678
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: n8n-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`n8n.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: n8n
|
||||
port: 5678
|
||||
scheme: http
|
||||
tls:
|
||||
secretName: n8n-tls
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: n8n-tls
|
||||
spec:
|
||||
secretName: n8n-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "n8n.durp.info"
|
||||
dnsNames:
|
||||
- "n8n.durp.info"
|
||||
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: n8n-dns
|
||||
annotations:
|
||||
dns.alpha.kubernetes.io/hostname: n8n.durp.info
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
|
|
|
|||
|
|
@ -1,74 +0,0 @@
|
|||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: nextcloud-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`nextcloud.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: nextcloud-chain
|
||||
services:
|
||||
- name: unraid
|
||||
port: 11000
|
||||
scheme: http
|
||||
tls:
|
||||
secretName: nextcloud-tls
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: nextcloud-tls
|
||||
spec:
|
||||
secretName: nextcloud-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "nextcloud.durp.info"
|
||||
dnsNames:
|
||||
- "nextcloud.durp.info"
|
||||
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: nextcloud-external-dns
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: nextcloud.durp.info
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: nextcloud-secure-headers
|
||||
spec:
|
||||
headers:
|
||||
hostsProxyHeaders:
|
||||
- "X-Forwarded-Host"
|
||||
referrerPolicy: "same-origin"
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: https-redirect
|
||||
spec:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: nextcloud-chain
|
||||
spec:
|
||||
chain:
|
||||
middlewares:
|
||||
- name: https-redirect
|
||||
- name: nextcloud-secure-headers
|
||||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nexus
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 8081
|
||||
protocol: TCP
|
||||
targetPort: 8081
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: nexus
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.20.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 8081
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -9,7 +38,7 @@ spec:
|
|||
- match: Host(`nexus.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
- name: nexus
|
||||
port: 8081
|
||||
tls:
|
||||
secretName: nexus-tls
|
||||
|
|
|
|||
41
dmz/internalproxy/templates/octopus.yaml
Normal file
41
dmz/internalproxy/templates/octopus.yaml
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
#apiVersion: traefik.io/v1alpha1
|
||||
#kind: IngressRoute
|
||||
#metadata:
|
||||
# name: octopus-ingress
|
||||
#spec:
|
||||
# entryPoints:
|
||||
# - websecure
|
||||
# routes:
|
||||
# - match: Host(`octopus.durp.info`) && PathPrefix(`/`)
|
||||
# kind: Rule
|
||||
# services:
|
||||
# - name: infra-cluster
|
||||
# port: 443
|
||||
# tls:
|
||||
# secretName: octopus-tls
|
||||
#
|
||||
#---
|
||||
#apiVersion: cert-manager.io/v1
|
||||
#kind: Certificate
|
||||
#metadata:
|
||||
# name: octopus-tls
|
||||
#spec:
|
||||
# issuerRef:
|
||||
# name: letsencrypt-production
|
||||
# kind: ClusterIssuer
|
||||
# secretName: octopus-tls
|
||||
# commonName: "octopus.durp.info"
|
||||
# dnsNames:
|
||||
# - "octopus.durp.info"
|
||||
#
|
||||
#---
|
||||
#kind: Service
|
||||
#apiVersion: v1
|
||||
#metadata:
|
||||
# name: octopus-external-dns
|
||||
# annotations:
|
||||
# external-dns.alpha.kubernetes.io/hostname: octopus.durp.info
|
||||
#spec:
|
||||
# type: ExternalName
|
||||
# externalName: durp.info
|
||||
#
|
||||
|
|
@ -15,6 +15,7 @@ spec:
|
|||
property: users
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
|
|
@ -25,6 +26,36 @@ spec:
|
|||
secret: ollama-secret
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ollama
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 11435
|
||||
protocol: TCP
|
||||
targetPort: 11435
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: ollama
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.20.104
|
||||
ports:
|
||||
- name: app
|
||||
port: 11435
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -38,12 +69,13 @@ spec:
|
|||
- name: ollama-basic-auth
|
||||
kind: Rule
|
||||
services:
|
||||
- name: ubuntu
|
||||
- name: ollama
|
||||
port: 11435
|
||||
tls:
|
||||
secretName: ollama-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
|
|
@ -58,6 +90,7 @@ spec:
|
|||
- "ollama.durp.info"
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: open-webui
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 8089
|
||||
protocol: TCP
|
||||
targetPort: 8089
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: open-webui
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 8089
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -9,13 +38,14 @@ spec:
|
|||
- match: Host(`open-webui.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
- name: open-webui
|
||||
port: 8089
|
||||
scheme: http
|
||||
tls:
|
||||
secretName: open-webui-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
|
|
@ -30,6 +60,7 @@ spec:
|
|||
- "open-webui.durp.info"
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: plex
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 32400
|
||||
protocol: TCP
|
||||
targetPort: 32400
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: plex
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 32400
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -9,13 +38,14 @@ spec:
|
|||
- match: Host(`plex.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
- name: plex
|
||||
port: 32400
|
||||
scheme: https
|
||||
tls:
|
||||
secretName: plex-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
|
|
@ -30,6 +60,7 @@ spec:
|
|||
- "plex.durp.info"
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: portainer
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 9443
|
||||
protocol: TCP
|
||||
targetPort: 9443
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: portainer
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.20.104
|
||||
ports:
|
||||
- name: app
|
||||
port: 9443
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -7,13 +36,14 @@ spec:
|
|||
- websecure
|
||||
routes:
|
||||
- match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`)
|
||||
middlewares:
|
||||
- name: whitelist
|
||||
namespace: traefik
|
||||
#middlewares:
|
||||
#- name: whitelist
|
||||
# namespace: traefik
|
||||
kind: Rule
|
||||
services:
|
||||
- name: infra-cluster
|
||||
port: 443
|
||||
- name: portainer
|
||||
port: 9443
|
||||
scheme: https
|
||||
tls:
|
||||
secretName: portainer-tls
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,30 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: registry
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 5000
|
||||
protocol: TCP
|
||||
targetPort: 5000
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: registry
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 5000
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -12,7 +39,7 @@ spec:
|
|||
- name: whitelist
|
||||
namespace: traefik
|
||||
services:
|
||||
- name: unraid
|
||||
- name: registry
|
||||
port: 5000
|
||||
tls:
|
||||
secretName: registry-tls
|
||||
|
|
|
|||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: root-vault
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 8201
|
||||
protocol: TCP
|
||||
targetPort: 8201
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: root-vault
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 8201
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -12,13 +41,14 @@ spec:
|
|||
namespace: traefik
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
- name: root-vault
|
||||
port: 8201
|
||||
scheme: https
|
||||
tls:
|
||||
secretName: root-vault-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: s3
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 9768
|
||||
protocol: TCP
|
||||
targetPort: 9768
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: s3
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 9768
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -12,7 +41,7 @@ spec:
|
|||
namespace: traefik
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
- name: s3
|
||||
port: 9768
|
||||
scheme: http
|
||||
tls:
|
||||
|
|
@ -46,7 +75,7 @@ spec:
|
|||
- match: Host(`s3.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
- name: s3
|
||||
port: 9768
|
||||
scheme: http
|
||||
tls:
|
||||
|
|
|
|||
|
|
@ -1,65 +1,64 @@
|
|||
#
|
||||
#apiVersion: v1
|
||||
#kind: Service
|
||||
#metadata:
|
||||
# name: semaphore
|
||||
#spec:
|
||||
# ports:
|
||||
# - name: app
|
||||
# port: 3001
|
||||
# protocol: TCP
|
||||
# targetPort: 3001
|
||||
# clusterIP: None
|
||||
# type: ClusterIP
|
||||
#
|
||||
#---
|
||||
#
|
||||
#apiVersion: v1
|
||||
#kind: Endpoints
|
||||
#metadata:
|
||||
# name: semaphore
|
||||
#subsets:
|
||||
# - addresses:
|
||||
# - ip: 192.168.21.200
|
||||
# ports:
|
||||
# - name: app
|
||||
# port: 3001
|
||||
# protocol: TCP
|
||||
#
|
||||
#---
|
||||
#
|
||||
#apiVersion: traefik.io/v1alpha1
|
||||
#kind: IngressRoute
|
||||
#metadata:
|
||||
# name: semaphore-ingress
|
||||
#spec:
|
||||
# entryPoints:
|
||||
# - websecure
|
||||
# routes:
|
||||
# - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`)
|
||||
# middlewares:
|
||||
# - name: whitelist
|
||||
# namespace: traefik
|
||||
# kind: Rule
|
||||
# services:
|
||||
# - name: semaphore
|
||||
# port: 3001
|
||||
# scheme: http
|
||||
# tls:
|
||||
# secretName: semaphore-tls
|
||||
#
|
||||
#---
|
||||
#
|
||||
#apiVersion: cert-manager.io/v1
|
||||
#kind: Certificate
|
||||
#metadata:
|
||||
# name: semaphore-tls
|
||||
#spec:
|
||||
# secretName: semaphore-tls
|
||||
# issuerRef:
|
||||
# name: vault-issuer
|
||||
# kind: ClusterIssuer
|
||||
# commonName: "semaphore.internal.durp.info"
|
||||
# dnsNames:
|
||||
# - "semaphore.internal.durp.info"
|
||||
#
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: semaphore
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 3001
|
||||
protocol: TCP
|
||||
targetPort: 3001
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: semaphore
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 3001
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: semaphore-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`)
|
||||
middlewares:
|
||||
- name: whitelist
|
||||
namespace: traefik
|
||||
kind: Rule
|
||||
services:
|
||||
- name: semaphore
|
||||
port: 3001
|
||||
scheme: http
|
||||
tls:
|
||||
secretName: semaphore-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: semaphore-tls
|
||||
spec:
|
||||
secretName: semaphore-tls
|
||||
issuerRef:
|
||||
name: vault-issuer
|
||||
kind: ClusterIssuer
|
||||
commonName: "semaphore.internal.durp.info"
|
||||
dnsNames:
|
||||
- "semaphore.internal.durp.info"
|
||||
|
|
|
|||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: smokeping
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 81
|
||||
protocol: TCP
|
||||
targetPort: 81
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: smokeping
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 81
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -14,12 +43,13 @@ spec:
|
|||
namespace: traefik
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
- name: smokeping
|
||||
port: 81
|
||||
tls:
|
||||
secretName: smokeping-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
|
|
@ -34,6 +64,7 @@ spec:
|
|||
- "smokeping.durp.info"
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,3 +1,32 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: tdarr
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 8267
|
||||
protocol: TCP
|
||||
targetPort: 8267
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: tdarr
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 8267
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
@ -16,7 +45,7 @@ spec:
|
|||
namespace: traefik
|
||||
kind: Rule
|
||||
services:
|
||||
- name: unraid
|
||||
- name: tdarr
|
||||
port: 8267
|
||||
scheme: http
|
||||
tls:
|
||||
|
|
|
|||
|
|
@ -1,3 +1,33 @@
|
|||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: unraid
|
||||
spec:
|
||||
ports:
|
||||
- name: app
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 443
|
||||
clusterIP: None
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Endpoints
|
||||
metadata:
|
||||
name: unraid
|
||||
subsets:
|
||||
- addresses:
|
||||
- ip: 192.168.21.200
|
||||
ports:
|
||||
- name: app
|
||||
port: 443
|
||||
protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ appVersion: 0.0.1
|
|||
dependencies:
|
||||
- name: base
|
||||
repository: https://istio-release.storage.googleapis.com/charts
|
||||
version: 1.29.0
|
||||
version: 1.26.2
|
||||
- name: istiod
|
||||
repository: https://istio-release.storage.googleapis.com/charts
|
||||
version: 1.26.2
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ spec:
|
|||
selector:
|
||||
matchLabels:
|
||||
app: redlib
|
||||
replicas: 1
|
||||
replicas: 3
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
|
|
|
|||
|
|
@ -1,10 +0,0 @@
|
|||
apiVersion: v2
|
||||
appVersion: latest
|
||||
description: SearXNG is a free internet metasearch engine which aggregates results from various search services and databases.
|
||||
name: searxng
|
||||
version: 1.0.1
|
||||
#dependencies:
|
||||
# - name: common
|
||||
# repository: https://library-charts.k8s-at-home.com
|
||||
# version: 4.4.2
|
||||
#
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: searxng-config
|
||||
data:
|
||||
settings.yml: |-
|
||||
use_default_settings: true
|
||||
search:
|
||||
formats:
|
||||
- html
|
||||
- json
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
namespace: searxng
|
||||
name: searxng
|
||||
labels:
|
||||
app: searxng
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: searxng
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: searxng
|
||||
spec:
|
||||
containers:
|
||||
- name: searxng
|
||||
image: registry.durp.info/searxng/searxng:latest
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
env:
|
||||
- name: SEARXNG_BASE_URL
|
||||
value: https://searxng.durp.info
|
||||
- name: SEARXNG_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: searxng-secret
|
||||
key: SEARXNG_SECRET
|
||||
volumeMounts:
|
||||
- name: searxng-config-volume
|
||||
mountPath: /etc/searxng/settings.yml
|
||||
subPath: settings.yml
|
||||
volumes:
|
||||
- name: searxng-config-volume
|
||||
configMap:
|
||||
name: searxng-config
|
||||
|
|
@ -1,76 +0,0 @@
|
|||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: searxng-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`searxng.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: authentik-proxy-provider
|
||||
namespace: traefik
|
||||
services:
|
||||
- name: searxng-service
|
||||
port: 8080
|
||||
tls:
|
||||
secretName: searxng-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: searxng-tls
|
||||
spec:
|
||||
secretName: searxng-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "searxng.durp.info"
|
||||
dnsNames:
|
||||
- "searxng.durp.info"
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: searxng-external-dns
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: searxng.durp.info
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: durp.info
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: searxng-internal-ingress
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`searxng.internal.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: searxng-service
|
||||
port: 8080
|
||||
tls:
|
||||
secretName: searxng-internal-tls
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: searxng-internal-tls
|
||||
spec:
|
||||
secretName: searxng-internal-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "searxng.internal.durp.info"
|
||||
dnsNames:
|
||||
- "searxng.internal.durp.info"
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: searxng-service
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: searxng
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
#
|
||||
# IMPORTANT NOTE
|
||||
#
|
||||
# This chart inherits from our common library chart. You can check the default values/options here:
|
||||
# https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml
|
||||
#
|
||||
|
||||
image:
|
||||
# -- image repository
|
||||
repository: registry.durp.info/searxng/searxng
|
||||
# -- image tag
|
||||
tag: latest
|
||||
# -- image pull policy
|
||||
pullPolicy: Always
|
||||
|
||||
# Explanation about each environment variables here:
|
||||
# https://docs.searxng.org/admin/installation-docker.html#command-line
|
||||
env:
|
||||
INSTANCE_NAME: "durp.info"
|
||||
BASE_URL: "https://searx.durp.info"
|
||||
AUTOCOMPLETE: "false"
|
||||
# MORTY_URL: "http://morty:8080"
|
||||
# MORTY_KEY: "mysecretkey"
|
||||
# BIND_ADDRESS: "0.0.0.0:8080"
|
||||
|
||||
controller:
|
||||
strategy: "RollingUpdate"
|
||||
|
||||
# -- Configures service settings for the chart.
|
||||
# @default -- See values.yaml
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
http:
|
||||
port: 8080
|
||||
|
||||
# -- Configure persistence settings for the chart under this key.
|
||||
# @default -- See values.yaml
|
||||
persistence:
|
||||
config:
|
||||
enabled: false
|
||||
|
||||
ingress:
|
||||
# -- Enable and configure ingress settings for the chart under this key.
|
||||
# @default -- See values.yaml
|
||||
main:
|
||||
enabled: false
|
||||
|
||||
searxng:
|
||||
config:
|
||||
use_default_settings: true
|
||||
#server:
|
||||
# secret_key: pleasechangeme
|
||||
# Uncomment when using the builtin rate limiter
|
||||
# See https://docs.searxng.org/src/searx.plugins.limiter.html#limiter-plugin
|
||||
# server.limiter: true
|
||||
# redis.url: redis://@searxng-redis:6379/0
|
||||
|
||||
probes:
|
||||
readiness:
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
liveness:
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
startup:
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
|
||||
# Enable when using searxng builtin rate limiter
|
||||
# Values: https://github.com/pascaliske/helm-charts/tree/master/charts/redis
|
||||
redis:
|
||||
enabled: false
|
||||
|
||||
115
dmz/terraform/k3s.tf
Normal file
115
dmz/terraform/k3s.tf
Normal file
|
|
@ -0,0 +1,115 @@
|
|||
resource "proxmox_vm_qemu" "k3smaster" {
|
||||
count = local.k3smaster.count
|
||||
ciuser = "administrator"
|
||||
vmid = "${local.vlan}${local.k3smaster.ip[count.index]}"
|
||||
name = local.k3smaster.name[count.index]
|
||||
target_node = local.k3smaster.node[count.index]
|
||||
clone = local.template
|
||||
tags = local.k3smaster.tags
|
||||
qemu_os = "l26"
|
||||
full_clone = true
|
||||
os_type = "cloud-init"
|
||||
agent = 1
|
||||
cores = local.k3smaster.cores
|
||||
sockets = 1
|
||||
cpu_type = "host"
|
||||
memory = local.k3smaster.memory
|
||||
scsihw = "virtio-scsi-pci"
|
||||
#bootdisk = "scsi0"
|
||||
boot = "order=virtio0"
|
||||
onboot = true
|
||||
sshkeys = local.sshkeys
|
||||
vga {
|
||||
type = "serial0"
|
||||
}
|
||||
serial {
|
||||
id = 0
|
||||
type = "socket"
|
||||
}
|
||||
disks {
|
||||
ide {
|
||||
ide2 {
|
||||
cloudinit {
|
||||
storage = local.storage
|
||||
}
|
||||
}
|
||||
}
|
||||
virtio {
|
||||
virtio0 {
|
||||
disk {
|
||||
size = local.k3smaster.drive
|
||||
format = local.format
|
||||
storage = local.storage
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
network {
|
||||
id = 0
|
||||
model = "virtio"
|
||||
bridge = "vmbr0"
|
||||
tag = local.vlan
|
||||
}
|
||||
#Cloud Init Settings
|
||||
ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
|
||||
searchdomain = "durp.loc"
|
||||
nameserver = local.dnsserver
|
||||
}
|
||||
|
||||
resource "proxmox_vm_qemu" "k3sserver" {
|
||||
count = local.k3sserver.count
|
||||
ciuser = "administrator"
|
||||
vmid = "${local.vlan}${local.k3sserver.ip[count.index]}"
|
||||
name = local.k3sserver.name[count.index]
|
||||
target_node = local.k3sserver.node[count.index]
|
||||
clone = local.template
|
||||
tags = local.k3sserver.tags
|
||||
qemu_os = "l26"
|
||||
full_clone = true
|
||||
os_type = "cloud-init"
|
||||
agent = 1
|
||||
cores = local.k3sserver.cores
|
||||
sockets = 1
|
||||
cpu_type = "host"
|
||||
memory = local.k3sserver.memory
|
||||
scsihw = "virtio-scsi-pci"
|
||||
#bootdisk = "scsi0"
|
||||
boot = "order=virtio0"
|
||||
onboot = true
|
||||
sshkeys = local.sshkeys
|
||||
vga {
|
||||
type = "serial0"
|
||||
}
|
||||
serial {
|
||||
id = 0
|
||||
type = "socket"
|
||||
}
|
||||
disks {
|
||||
ide {
|
||||
ide2 {
|
||||
cloudinit {
|
||||
storage = local.storage
|
||||
}
|
||||
}
|
||||
}
|
||||
virtio {
|
||||
virtio0 {
|
||||
disk {
|
||||
size = local.k3sserver.drive
|
||||
format = local.format
|
||||
storage = local.storage
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
network {
|
||||
id = 0
|
||||
model = "virtio"
|
||||
bridge = "vmbr0"
|
||||
tag = local.vlan
|
||||
}
|
||||
#Cloud Init Settings
|
||||
ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1"
|
||||
searchdomain = "durp.loc"
|
||||
nameserver = local.dnsserver
|
||||
}
|
||||
48
dmz/terraform/main.tf
Normal file
48
dmz/terraform/main.tf
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
terraform {
|
||||
backend "http" {}
|
||||
required_providers {
|
||||
proxmox = {
|
||||
source = "Telmate/proxmox"
|
||||
version = "3.0.1-rc9"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "proxmox" {
|
||||
pm_parallel = 1
|
||||
pm_tls_insecure = true
|
||||
pm_api_url = var.pm_api_url
|
||||
pm_user = var.pm_user
|
||||
pm_password = var.pm_password
|
||||
pm_debug = false
|
||||
}
|
||||
|
||||
locals {
|
||||
sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible"
|
||||
template = "Debian12-Template"
|
||||
storage = "cache-domains"
|
||||
emulatessd = true
|
||||
format = "raw"
|
||||
dnsserver = "192.168.98.1"
|
||||
vlan = 98
|
||||
k3smaster = {
|
||||
tags = "k3s_dmz"
|
||||
count = 3
|
||||
name = ["master01-dmz", "master02-dmz", "master03-dmz"]
|
||||
cores = 2
|
||||
memory = "4096"
|
||||
drive = 20
|
||||
node = ["mothership", "overlord", "vanguard"]
|
||||
ip = ["11", "12", "13"]
|
||||
}
|
||||
k3sserver = {
|
||||
tags = "k3s_dmz"
|
||||
count = 3
|
||||
name = ["node01-dmz", "node02-dmz", "node03-dmz"]
|
||||
cores = 4
|
||||
memory = "8192"
|
||||
drive = 240
|
||||
node = ["mothership", "overlord", "vanguard"]
|
||||
ip = ["21", "22", "23"]
|
||||
}
|
||||
}
|
||||
14
dmz/terraform/variables.tf
Normal file
14
dmz/terraform/variables.tf
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
variable "pm_api_url" {
|
||||
description = "API URL to Proxmox provider"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "pm_password" {
|
||||
description = "Passowrd to Proxmox provider"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "pm_user" {
|
||||
description = "UIsername to Proxmox provider"
|
||||
type = string
|
||||
}
|
||||
|
|
@ -23,13 +23,6 @@ traefik:
|
|||
dashboard:
|
||||
enabled: true
|
||||
|
||||
ports:
|
||||
gitlab-ssh:
|
||||
port: 9022
|
||||
expose:
|
||||
default: true
|
||||
exposedPort: 9022
|
||||
|
||||
additionalArguments:
|
||||
# - "--providers.file.filename=/config/config.yml"
|
||||
- "--serversTransport.insecureSkipVerify=true"
|
||||
|
|
|
|||
|
|
@ -9,4 +9,4 @@ appVersion: "1.16.0"
|
|||
dependencies:
|
||||
- name: argo-cd
|
||||
repository: https://argoproj.github.io/argo-helm
|
||||
version: 8.6.4
|
||||
version: 8.1.3
|
||||
|
|
|
|||
101
infra/argocd/templates/argocd-crossplane.yaml
Normal file
101
infra/argocd/templates/argocd-crossplane.yaml
Normal file
|
|
@ -0,0 +1,101 @@
|
|||
#apiVersion: external-secrets.io/v1
|
||||
#kind: ExternalSecret
|
||||
#metadata:
|
||||
# name: argocd-secret-crossplane
|
||||
#spec:
|
||||
# secretStoreRef:
|
||||
# name: vault
|
||||
# kind: ClusterSecretStore
|
||||
# target:
|
||||
# name: argocd-secret-crossplane
|
||||
# data:
|
||||
# - secretKey: authToken
|
||||
# remoteRef:
|
||||
# key: kv/argocd/provider-argocd
|
||||
# property: token
|
||||
#
|
||||
#---
|
||||
#apiVersion: external-secrets.io/v1
|
||||
#kind: ExternalSecret
|
||||
#metadata:
|
||||
# name: prod-kubeconfig
|
||||
#spec:
|
||||
# secretStoreRef:
|
||||
# name: vault
|
||||
# kind: ClusterSecretStore
|
||||
# target:
|
||||
# name: prod-kubeconfig
|
||||
# data:
|
||||
# - secretKey: kubeconfig
|
||||
# remoteRef:
|
||||
# key: kv/argocd/prd
|
||||
# property: kubeconfig
|
||||
#
|
||||
#---
|
||||
#apiVersion: argocd.crossplane.io/v1alpha1
|
||||
#kind: ProviderConfig
|
||||
#metadata:
|
||||
# name: argocd-provider
|
||||
#spec:
|
||||
# serverAddr: argocd-server.argocd.svc:443
|
||||
# insecure: true
|
||||
# plainText: false
|
||||
# credentials:
|
||||
# source: Secret
|
||||
# secretRef:
|
||||
# namespace: argocd
|
||||
# name: argocd-secret-crossplane
|
||||
# key: authToken
|
||||
#
|
||||
#---
|
||||
#apiVersion: cluster.argocd.crossplane.io/v1alpha1
|
||||
#kind: Cluster
|
||||
#metadata:
|
||||
# name: prd
|
||||
# labels:
|
||||
# purpose: prd
|
||||
#spec:
|
||||
# forProvider:
|
||||
# name: prd
|
||||
# config:
|
||||
# kubeconfigSecretRef:
|
||||
# name: prod-kubeconfig
|
||||
# namespace: argocd
|
||||
# key: kubeconfig
|
||||
# providerConfigRef:
|
||||
# name: argocd-provider
|
||||
#
|
||||
#---
|
||||
#apiVersion: external-secrets.io/v1
|
||||
#kind: ExternalSecret
|
||||
#metadata:
|
||||
# name: dev-kubeconfig
|
||||
#spec:
|
||||
# secretStoreRef:
|
||||
# name: vault
|
||||
# kind: ClusterSecretStore
|
||||
# target:
|
||||
# name: dev-kubeconfig
|
||||
# data:
|
||||
# - secretKey: kubeconfig
|
||||
# remoteRef:
|
||||
# key: kv/argocd/dev
|
||||
# property: kubeconfig
|
||||
#
|
||||
#---
|
||||
#apiVersion: cluster.argocd.crossplane.io/v1alpha1
|
||||
#kind: Cluster
|
||||
#metadata:
|
||||
# name: dev
|
||||
# labels:
|
||||
# purpose: dev
|
||||
#spec:
|
||||
# forProvider:
|
||||
# name: dev
|
||||
# config:
|
||||
# kubeconfigSecretRef:
|
||||
# name: dev-kubeconfig
|
||||
# namespace: argocd
|
||||
# key: kubeconfig
|
||||
# providerConfigRef:
|
||||
# name: argocd-provider
|
||||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/argocd
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/authentik
|
||||
destination:
|
||||
|
|
@ -31,7 +31,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/authentik
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/bitwarden
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/cert-manager
|
||||
destination:
|
||||
|
|
@ -29,7 +29,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/cert-manager
|
||||
destination:
|
||||
|
|
|
|||
20
infra/argocd/templates/crowdsec.yaml
Normal file
20
infra/argocd/templates/crowdsec.yaml
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
#apiVersion: argoproj.io/v1alpha1
|
||||
#kind: Application
|
||||
#metadata:
|
||||
# name: crowdsec
|
||||
# namespace: argocd
|
||||
#spec:
|
||||
# project: default
|
||||
# source:
|
||||
# repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
# targetRevision: main
|
||||
# path: dmz/crowdsec
|
||||
# destination:
|
||||
# namespace: crowdsec
|
||||
# name: dmz
|
||||
# syncPolicy:
|
||||
# automated:
|
||||
# prune: true
|
||||
# selfHeal: true
|
||||
# syncOptions:
|
||||
# - CreateNamespace=true
|
||||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/external-dns
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/external-secrets
|
||||
destination:
|
||||
|
|
@ -29,7 +29,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/external-secrets
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/gitlab-runner
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/internalproxy
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/istio-system
|
||||
destination:
|
||||
|
|
@ -36,7 +36,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/istio-system
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/kube-prometheus-stack
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
#spec:
|
||||
# project: default
|
||||
# source:
|
||||
# repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
# repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
# targetRevision: main
|
||||
# path: infra/litellm
|
||||
# destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/littlelink
|
||||
directory:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/longhorn
|
||||
destination:
|
||||
|
|
@ -33,7 +33,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/longhorn
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/metallb-system
|
||||
destination:
|
||||
|
|
@ -29,7 +29,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/metallb-system
|
||||
destination:
|
||||
|
|
@ -52,7 +52,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dev/metallb-system
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/nebula-sync
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/nfs
|
||||
destination:
|
||||
|
|
|
|||
43
infra/argocd/templates/octopusdeploy.yaml
Normal file
43
infra/argocd/templates/octopusdeploy.yaml
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
#apiVersion: argoproj.io/v1alpha1
|
||||
#kind: Application
|
||||
#metadata:
|
||||
# name: octopusdeploy
|
||||
# namespace: argocd
|
||||
#spec:
|
||||
# project: default
|
||||
# source:
|
||||
# repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
# targetRevision: main
|
||||
# path: infra/octopusdeploy
|
||||
# destination:
|
||||
# namespace: octopusdeploy
|
||||
# name: in-cluster
|
||||
# syncPolicy:
|
||||
# automated:
|
||||
# prune: true
|
||||
# selfHeal: true
|
||||
# syncOptions:
|
||||
# - CreateNamespace=true
|
||||
#
|
||||
#---
|
||||
#apiVersion: argoproj.io/v1alpha1
|
||||
#kind: Application
|
||||
#metadata:
|
||||
# name: octopusdeploy-agent
|
||||
# namespace: argocd
|
||||
#spec:
|
||||
# project: default
|
||||
# source:
|
||||
# repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
# targetRevision: main
|
||||
# path: infra/octopus-agent
|
||||
# destination:
|
||||
# namespace: octopus-agent
|
||||
# name: in-cluster
|
||||
# syncPolicy:
|
||||
# automated:
|
||||
# prune: true
|
||||
# selfHeal: true
|
||||
# syncOptions:
|
||||
# - CreateNamespace=true
|
||||
#
|
||||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/openclarity
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/openspeedtest
|
||||
directory:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/redlib
|
||||
directory:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/renovate
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/traefik
|
||||
destination:
|
||||
|
|
@ -32,7 +32,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/traefik
|
||||
destination:
|
||||
|
|
@ -58,7 +58,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dev/traefik
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: infra/vault
|
||||
destination:
|
||||
|
|
@ -34,7 +34,7 @@ metadata:
|
|||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
|
||||
repoURL: https://gitlab.com/developerdurp/homelab.git
|
||||
targetRevision: main
|
||||
path: dmz/vault
|
||||
destination:
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ authentik:
|
|||
enabled: true
|
||||
image:
|
||||
registry: registry.durp.info
|
||||
repository: bitnamilegacy/postgresql
|
||||
repository: bitnami/postgresql
|
||||
pullPolicy: Always
|
||||
postgresqlUsername: "authentik"
|
||||
postgresqlDatabase: "authentik"
|
||||
|
|
@ -52,7 +52,7 @@ authentik:
|
|||
enabled: false
|
||||
image:
|
||||
registry: registry.durp.info
|
||||
repository: bitnamilegacy/redis
|
||||
repository: bitnami/redis
|
||||
pullPolicy: Always
|
||||
architecture: standalone
|
||||
auth:
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ spec:
|
|||
spec:
|
||||
containers:
|
||||
- name: bitwarden
|
||||
image: registry.durp.info/vaultwarden/server:1.35.4
|
||||
image: registry.durp.info/vaultwarden/server:1.34.3
|
||||
imagePullPolicy: Always
|
||||
volumeMounts:
|
||||
- name: bitwarden-pvc
|
||||
|
|
|
|||
|
|
@ -8,4 +8,4 @@ appVersion: 0.0.1
|
|||
dependencies:
|
||||
- name: cert-manager
|
||||
repository: https://charts.jetstack.io
|
||||
version: v1.17.2
|
||||
version: v1.19.2
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ appVersion: 0.0.1
|
|||
dependencies:
|
||||
- name: base
|
||||
repository: https://istio-release.storage.googleapis.com/charts
|
||||
version: 1.29.0
|
||||
version: 1.26.2
|
||||
- name: istiod
|
||||
repository: https://istio-release.storage.googleapis.com/charts
|
||||
version: 1.26.2
|
||||
|
|
|
|||
|
|
@ -11,8 +11,8 @@ spec:
|
|||
- match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
#- name: authentik-proxy-provider
|
||||
# namespace: traefik
|
||||
- name: authentik-proxy-provider
|
||||
namespace: traefik
|
||||
services:
|
||||
- name: longhorn-frontend
|
||||
port: 80
|
||||
|
|
|
|||
12
infra/octopus-agent/Chart.yaml
Normal file
12
infra/octopus-agent/Chart.yaml
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: v2
|
||||
name: octopusdeploy
|
||||
description: A Helm chart for Kubernetes
|
||||
type: application
|
||||
|
||||
version: 0.1.0
|
||||
appVersion: "1.16.0"
|
||||
|
||||
dependencies:
|
||||
- name: kubernetes-agent
|
||||
repository: oci://registry-1.docker.io/octopusdeploy
|
||||
version: 2.*.*
|
||||
|
|
@ -1,23 +1,23 @@
|
|||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: searxng-secret
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: searxng-secret
|
||||
data:
|
||||
- secretKey: SEARXNG_SECRET
|
||||
remoteRef:
|
||||
key: kv/searxng
|
||||
property: searxng-secret
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: vault
|
||||
|
||||
---
|
||||
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: agent-token
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: agent-token
|
||||
data:
|
||||
- secretKey: bearer-token
|
||||
remoteRef:
|
||||
key: kv/octopusdeploy
|
||||
property: infra-bearer-token
|
||||
|
||||
19
infra/octopus-agent/values.yaml
Normal file
19
infra/octopus-agent/values.yaml
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
kubernetes-agent:
|
||||
agent:
|
||||
bearerTokenSecretName: agent-token
|
||||
acceptEula: "Y"
|
||||
serverUrl: "https://octopus.durp.info/"
|
||||
serverCommsAddresses:
|
||||
- "https://octopus-deploy-node0.octopusdeploy.svc.cluster.local:10943/"
|
||||
- "https://octopus-deploy-node1.octopusdeploy.svc.cluster.local:10943/"
|
||||
- "https://octopus-deploy-node2.octopusdeploy.svc.cluster.local:10943/"
|
||||
space: "Default"
|
||||
name: "infra"
|
||||
deploymentTarget:
|
||||
initial:
|
||||
environments:
|
||||
- "development"
|
||||
- "production"
|
||||
tags:
|
||||
- "infra-cluster"
|
||||
enabled: "true"
|
||||
12
infra/octopusdeploy/Chart.yaml
Normal file
12
infra/octopusdeploy/Chart.yaml
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: v2
|
||||
name: octopusdeploy
|
||||
description: A Helm chart for Kubernetes
|
||||
type: application
|
||||
|
||||
version: 0.1.0
|
||||
appVersion: "1.16.0"
|
||||
|
||||
dependencies:
|
||||
- name: octopusdeploy-helm
|
||||
repository: oci://ghcr.io/octopusdeploy
|
||||
version: 1.7.0
|
||||
32
infra/octopusdeploy/templates/ingress.yaml
Normal file
32
infra/octopusdeploy/templates/ingress.yaml
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: octopus-ingress
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`octopus.durp.info`) && PathPrefix(`/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: octopusdeploy-octopus-deploy
|
||||
port: 80
|
||||
tls:
|
||||
secretName: octopus-tls
|
||||
|
||||
---
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: octopus-tls
|
||||
spec:
|
||||
secretName: octopus-tls
|
||||
issuerRef:
|
||||
name: vault-issuer
|
||||
kind: ClusterIssuer
|
||||
commonName: "octopus.durp.info"
|
||||
dnsNames:
|
||||
- "octopus.durp.info"
|
||||
106
infra/octopusdeploy/templates/secrets.yaml
Normal file
106
infra/octopusdeploy/templates/secrets.yaml
Normal file
|
|
@ -0,0 +1,106 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: vault
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: octopusdeploy-adminpassword
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: octopusdeploy-adminpassword
|
||||
data:
|
||||
- secretKey: secret
|
||||
remoteRef:
|
||||
key: kv/octopusdeploy
|
||||
property: adminpassword
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: octopusdeploy-adminusername
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: octopusdeploy-adminusername
|
||||
data:
|
||||
- secretKey: secret
|
||||
remoteRef:
|
||||
key: kv/octopusdeploy
|
||||
property: adminusername
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: octopusdeploy-connectionstring
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: octopusdeploy-connectionstring
|
||||
data:
|
||||
- secretKey: secret
|
||||
remoteRef:
|
||||
key: kv/octopusdeploy
|
||||
property: connectionstring
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: octopusdeploy-masterkey
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: octopusdeploy-masterkey
|
||||
data:
|
||||
- secretKey: secret
|
||||
remoteRef:
|
||||
key: kv/octopusdeploy
|
||||
property: masterkey
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: octopusdeploy-sapassword
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: octopusdeploy-sapassword
|
||||
data:
|
||||
- secretKey: secret
|
||||
remoteRef:
|
||||
key: kv/octopusdeploy
|
||||
property: sapassword
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: octopusdeploy-licensekey
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: octopusdeploy-licensekey
|
||||
data:
|
||||
- secretKey: secret
|
||||
remoteRef:
|
||||
key: kv/octopusdeploy
|
||||
property: licensekey
|
||||
10
infra/octopusdeploy/values.yaml
Normal file
10
infra/octopusdeploy/values.yaml
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
octopusdeploy-helm:
|
||||
octopus:
|
||||
image:
|
||||
repository: registry.durp.info/octopusdeploy/octopusdeploy
|
||||
tag: 2025.3
|
||||
createSecrets: false
|
||||
acceptEula: Y
|
||||
replicaCount: 3
|
||||
mssql:
|
||||
enabled: true
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue