update

Update Helm release base to v1.29.0

See merge request durfy/homelab/gitops!6

.gitignore

@@ -1 +1,3 @@
-.idea
+*/.terraform
+*/.terraform.lock.hcl
+.idea

dev/metallb-system/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: "1.16.0"
 dependencies:
 - name: metallb
   repository: https://metallb.github.io/metallb
-  version: 0.15.3
+  version: 0.15.2

dmz/authentik/templates/ingress.yaml

@@ -1,62 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: authentik-tls
-spec:
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  secretName: authentik-tls
-  commonName: "authentik.durp.info"
-  dnsNames:
-    - "authentik.durp.info"
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: authentik-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`authentik.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: infra-cluster
-          port: 443
-  tls:
-    secretName: authentik-tls
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: authentik-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info
-
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: infra-cluster
-subsets:
-  - addresses:
-      - ip: 192.168.12.130
-    ports:
-      - port: 443
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: infra-cluster
-spec:
-  ports:
-    - protocol: TCP
-      port: 443
-      targetPort: 443

dmz/gitlab-runner/Chart.yaml

@@ -6,9 +6,6 @@ version: 0.0.1
 appVersion: 0.0.1
 
 dependencies:
-- name: gitlab-runner
-  repository: https://charts.gitlab.io/
-  version: 0.77.2
 - name: gitlab-runner
   repository: https://charts.gitlab.io/
   version: 0.77.2

dmz/gitlab-runner/values.yaml

@@ -1,75 +1,3 @@
-gitlab-runner:
-
-  image:
-    registry: registry.durp.info
-    image: gitlab-org/gitlab-runner
-
-  imagePullPolicy: Always
-  gitlabUrl: https://gitlab.com/
-  unregisterRunner: false
-  terminationGracePeriodSeconds: 3600
-  concurrent: 10
-  checkInterval: 30
-
-  rbac:
-    create: true
-    rules: []
-    clusterWideAccess: false
-    podSecurityPolicy:
-      enabled: false
-      resourceNames:
-      - gitlab-runner
-
-  metrics:
-    enabled: true
-    serviceMonitor:
-      enabled: true      
-  service:
-    enabled: true
-    annotations: {}  
-
-  runners:
-    config: |
-      [[runners]]
-        [runners.kubernetes]
-          namespace = "{{.Release.Namespace}}"
-          image = "ubuntu:22.04"
-          privileged = true
-
-    executor: kubernetes
-    name: "k3s"
-    runUntagged: true
-    privileged: true
-    secret: gitlab-secret
-    #builds: 
-      #cpuLimit: 200m
-      #cpuLimitOverwriteMaxAllowed: 400m
-      #memoryLimit: 256Mi
-      #memoryLimitOverwriteMaxAllowed: 512Mi
-      #cpuRequests: 100m
-      #cpuRequestsOverwriteMaxAllowed: 200m
-      #memoryRequests: 128Mi
-      #memoryRequestsOverwriteMaxAllowed: 256Mi
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: false
-    runAsNonRoot: true
-    privileged: false
-    capabilities:
-      drop: ["ALL"]
-
-  podSecurityContext:
-    runAsUser: 100
-    fsGroup: 65533
-
-  resources: 
-    limits:
-      memory: 2Gi
-    requests:
-      memory: 128Mi
-      cpu: 500m
-
 personal:
 
   image:
@@ -77,7 +5,7 @@ personal:
     image: gitlab-org/gitlab-runner
 
   imagePullPolicy: Always
-  gitlabUrl: https://gitlab.com/
+  gitlabUrl: https://gitlab.durp.info/
   unregisterRunner: false
   terminationGracePeriodSeconds: 3600
   concurrent: 10
@@ -90,15 +18,15 @@ personal:
     podSecurityPolicy:
       enabled: false
       resourceNames:
-      - gitlab-runner
+        - gitlab-runner
 
   metrics:
     enabled: true
     serviceMonitor:
-      enabled: true      
+      enabled: true
   service:
     enabled: true
-    annotations: {}  
+    annotations: {}
 
   runners:
     config: |
@@ -113,15 +41,15 @@ personal:
     runUntagged: true
     privileged: true
     secret: gitlab-secret-personal
-    #builds: 
-      #cpuLimit: 200m
-      #cpuLimitOverwriteMaxAllowed: 400m
-      #memoryLimit: 256Mi
-      #memoryLimitOverwriteMaxAllowed: 512Mi
-      #cpuRequests: 100m
-      #cpuRequestsOverwriteMaxAllowed: 200m
-      #memoryRequests: 128Mi
-      #memoryRequestsOverwriteMaxAllowed: 256Mi
+    builds:
+      cpuLimit: 200m
+      cpuLimitOverwriteMaxAllowed: 400m
+      memoryLimit: 256Mi
+      memoryLimitOverwriteMaxAllowed: 512Mi
+      cpuRequests: 100m
+      cpuRequestsOverwriteMaxAllowed: 200m
+      memoryRequests: 128Mi
+      memoryRequestsOverwriteMaxAllowed: 256Mi
 
   securityContext:
     allowPrivilegeEscalation: false
@@ -135,9 +63,9 @@ personal:
     runAsUser: 100
     fsGroup: 65533
 
-  resources: 
+  resources:
     limits:
       memory: 2Gi
     requests:
       memory: 128Mi
-      cpu: 500m
+      cpu: 50m

dmz/internalproxy/templates/argocd.yaml

@@ -0,0 +1,34 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: argocd-infra-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`argocd.infra.durp.info`)
+      middlewares:
+        - name: whitelist
+          namespace: traefik
+      kind: Rule
+      services:
+        - name: infra-cluster
+          port: 443
+          scheme: https
+  tls:
+    secretName: argocd-infra-tls
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: argocd-infra-tls
+spec:
+  secretName: argocd-infra-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: "argocd.infra.durp.info"
+  dnsNames:
+    - "argocd.infra.durp.info"

dmz/internalproxy/templates/authentik.yaml

@@ -1,40 +1,40 @@
-#apiVersion: traefik.io/v1alpha1
-#kind: IngressRoute
-#metadata:
-#  name: authentik-ingress
-#spec:
-#  entryPoints:
-#    - websecure
-#  routes:
-#    - match: Host(`authentik.durp.info`) && PathPrefix(`/`)
-#      kind: Rule
-#      services:
-#        - name: infra-cluster
-#          port: 443
-#  tls:
-#    secretName: authentik-tls
-#
-#---
-#apiVersion: cert-manager.io/v1
-#kind: Certificate
-#metadata:
-#  name: authentik-tls
-#spec:
-#  issuerRef:
-#    name: letsencrypt-production
-#    kind: ClusterIssuer
-#  secretName: authentik-tls
-#  commonName: "authentik.durp.info"
-#  dnsNames:
-#    - "authentik.durp.info"
-#
-#---
-#kind: Service
-#apiVersion: v1
-#metadata:
-#  name: authentik-external-dns
-#  annotations:
-#    external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
-#spec:
-#  type: ExternalName
-#  externalName: durp.info
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: authentik-tls
+spec:
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  secretName: authentik-tls
+  commonName: "authentik.durp.info"
+  dnsNames:
+    - "authentik.durp.info"
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`authentik.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: infra-cluster
+          port: 443
+  tls:
+    secretName: authentik-tls
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: authentik-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info

dmz/internalproxy/templates/duplicati.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: duplicati
-spec:
-  ports:
-  - name: app
-    port: 8200
-    protocol: TCP
-    targetPort: 8200
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: duplicati
-subsets:
-- addresses:
-  - ip: 192.168.21.200
-  ports:
-  - name: app
-    port: 8200
-    protocol: TCP
-
----    
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -43,7 +14,7 @@ spec:
       namespace: traefik  
     kind: Rule
     services:
-    - name: duplicati
+    - name: unraid
       port: 8200
   tls:
     secretName: duplicati-tls

dmz/internalproxy/templates/endpoints.yaml

@@ -9,7 +9,6 @@ subsets:
       - port: 443
 
 ---
-
 apiVersion: v1
 kind: Service
 metadata:
@@ -21,7 +20,6 @@ spec:
       targetPort: 443
 
 ---
-
 apiVersion: v1
 kind: Endpoints
 metadata:
@@ -33,7 +31,6 @@ subsets:
       - port: 443
 
 ---
-
 apiVersion: v1
 kind: Service
 metadata:
@@ -43,3 +40,191 @@ spec:
     - protocol: TCP
       port: 443
       targetPort: 443
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: unraid
+spec:
+  ports:
+    - name: https
+      protocol: TCP
+      port: 443
+      targetPort: 443
+    - name: tdarr
+      port: 8267
+      protocol: TCP
+      targetPort: 8267
+    - name: duplicati
+      port: 8200
+      protocol: TCP
+      targetPort: 8200
+    - name: forgejo
+      port: 3000
+      protocol: TCP
+    - name: kuma
+      port: 3001
+      protocol: TCP
+      targetPort: 3000
+    - name: freshrss
+      port: 8085
+      protocol: TCP
+      targetPort: 8085
+    - name: gitlab-ssh
+      port: 9022
+      protocol: TCP
+      targetPort: 9022
+    - name: gitlab
+      port: 9443
+      protocol: TCP
+      targetPort: 9443
+    - name: minio
+      port: 9769
+      protocol: TCP
+      targetPort: 9769
+    - name: nextcloud
+      port: 11000
+      protocol: TCP
+      targetPort: 11000
+    - name: nexus
+      port: 8081
+      protocol: TCP
+      targetPort: 8081
+    - name: openweb-ui
+      port: 8089
+      protocol: TCP
+      targetPort: 8089
+    - name: plex
+      port: 32400
+      protocol: TCP
+      targetPort: 32400
+    - name: registry
+      port: 5000
+      protocol: TCP
+      targetPort: 5000
+    - name: gitlab-registry
+      port: 5002
+      protocol: TCP
+      targetPort: 5002
+    - name: root-vault
+      port: 8201
+      protocol: TCP
+      targetPort: 8201
+    - name: s3
+      port: 9768
+      protocol: TCP
+      targetPort: 9768
+    - name: smokeping
+      port: 81
+      protocol: TCP
+      targetPort: 81
+    - name: gotify
+      port: 8070
+      protocol: TCP
+
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: unraid
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: https
+        port: 443
+        protocol: TCP
+      - name: tdarr
+        port: 8267
+        protocol: TCP
+      - name: duplicati
+        port: 8200
+        protocol: TCP
+      - name: forgejo
+        port: 3000
+        protocol: TCP
+      - name: kuma
+        port: 3001
+        protocol: TCP
+      - name: freshrss
+        port: 8085
+        protocol: TCP
+      - name: gitlab-ssh
+        port: 9022
+        protocol: TCP
+      - name: gitlab
+        port: 9443
+        protocol: TCP
+      - name: minio
+        port: 9769
+        protocol: TCP
+      - name: nextcloud
+        port: 11000
+        protocol: TCP
+      - name: nexus
+        port: 8081
+        protocol: TCP
+      - name: openweb-ui
+        port: 8089
+        protocol: TCP
+      - name: plex
+        port: 32400
+        protocol: TCP
+      - name: registry
+        port: 5000
+        protocol: TCP
+      - name: gitlab-registry
+        port: 5002
+        protocol: TCP
+      - name: root-vault
+        port: 8201
+        protocol: TCP
+      - name: s3
+        port: 9768
+        protocol: TCP
+      - name: smokeping
+        port: 81
+        protocol: TCP
+      - name: gotify
+        port: 8070
+        protocol: TCP
+
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: ubuntu
+subsets:
+  - addresses:
+      - ip: 192.168.20.104
+    ports:
+      - name: https
+        port: 443
+        protocol: TCP
+      - name: litellm
+        port: 4000
+        protocol: TCP
+      - name: ollama
+        port: 11435
+        protocol: TCP
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ubuntu
+spec:
+  ports:
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443
+    - name: litellm
+      port: 4000
+      protocol: TCP
+      targetPort: 4000
+    - name: ollama
+      port: 11435
+      protocol: TCP
+      targetPort: 11435

dmz/internalproxy/templates/forgejo.yaml

@@ -0,0 +1,43 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: forgejo-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`forgejo.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: unraid
+          port: 3000
+          scheme: http
+  tls:
+    secretName: forgejo-tls
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: forgejo-tls
+spec:
+  secretName: forgejo-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "forgejo.durp.info"
+  dnsNames:
+    - "forgejo.durp.info"
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  name: forgejo-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: forgejo.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info

dmz/internalproxy/templates/freshrss.yaml

@@ -0,0 +1,30 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: freshrss-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`freshrss.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: unraid
+          port: 8085
+  tls:
+    secretName: freshrss-tls
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: freshrss-tls
+spec:
+  secretName: freshrss-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: "freshrss.durp.info"
+  dnsNames:
+    - "freshrss.durp.info"

dmz/internalproxy/templates/gitea.yaml

@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: gitea
-spec:
-  ports:
-    - name: app
-      port: 3000
-      protocol: TCP
-      targetPort: 3000
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: gitea
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 3000
-        protocol: TCP
-
----
-
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gitea-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`gitea.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: gitea
-          port: 3000
-          scheme: http
-  tls:
-    secretName: gitea-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: gitea-tls
-spec:
-  secretName: gitea-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "gitea.durp.info"
-  dnsNames:
-    - "gitea.durp.info"
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: gitea-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: gitea.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/gitlab.yaml

@@ -1,30 +1,30 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: gitlab-ssh
-spec:
-  ports:
-    - name: app
-      port: 9022
-      protocol: TCP
-      targetPort: 9022
-  clusterIP: None
-  type: ClusterIP
-
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: gitlab-ssh
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 9022
-        protocol: TCP
-
----
+#apiVersion: v1
+#kind: Service
+#metadata:
+#  name: gitlab-ssh
+#spec:
+#  ports:
+#    - name: app
+#      port: 9022
+#      protocol: TCP
+#      targetPort: 9022
+#  clusterIP: None
+#  type: ClusterIP
+#
+#---
+#apiVersion: v1
+#kind: Endpoints
+#metadata:
+#  name: gitlab-ssh
+#subsets:
+#  - addresses:
+#      - ip: 192.168.21.200
+#    ports:
+#      - name: app
+#        port: 9022
+#        protocol: TCP
+#
+#---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
 metadata:
@@ -35,36 +35,9 @@ spec:
   routes:
     - match: HostSNI(`*`)
       services:
-        - name: gitlab-ssh
+        - name: unraid
           port: 9022
 
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: gitlab
-spec:
-  ports:
-    - name: app
-      port: 9443
-      protocol: TCP
-      targetPort: 9443
-  clusterIP: None
-  type: ClusterIP
-
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: gitlab
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 9443
-        protocol: TCP
-
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -77,7 +50,7 @@ spec:
     - match: Host(`gitlab.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: gitlab
+        - name: unraid
           port: 9443
           scheme: https
   tls:
@@ -107,3 +80,46 @@ metadata:
 spec:
   type: ExternalName
   externalName: durp.info
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitlab-registry
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`images.durp.info`)
+      kind: Rule
+      services:
+        - name: unraid
+          port: 5002
+          scheme: http
+  tls:
+    secretName: gitlab-images-tls
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitlab-images-tls
+spec:
+  secretName: gitlab-images-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "images.durp.info"
+  dnsNames:
+    - "images.durp.info"
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: gitlab-images-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: images.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info

dmz/internalproxy/templates/gotify.yaml

@@ -0,0 +1,41 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gotify-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gotify.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: unraid
+          port: 8070
+          scheme: http
+  tls:
+    secretName: gotify-tls
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gotify-tls
+spec:
+  secretName: gotify-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "gotify.durp.info"
+  dnsNames:
+    - "gotify.durp.info"
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: gotify-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: gotify.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info

dmz/internalproxy/templates/invidious.yaml

@@ -1,74 +1,75 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: invidious
-spec:
-  ports:
-  - name: app
-    port: 3000
-    protocol: TCP
-    targetPort: 3000
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: invidious
-subsets:
-- addresses:
-  - ip: 192.168.20.104
-  ports:
-  - name: app
-    port: 3000
-    protocol: TCP
-
----    
-
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: invidious-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`invidious.durp.info`) && PathPrefix(`/`)
-    middlewares:
-    - name: authentik-proxy-provider
-      namespace: traefik  
-    kind: Rule
-    services:
-    - name: invidious
-      port: 3000
-  tls:
-    secretName: invidious-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: invidious-tls
-spec:
-  secretName: invidious-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "invidious.durp.info"
-  dnsNames:
-  - "invidious.durp.info"  
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: invidious-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: invidious.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info
+#apiVersion: v1
+#kind: Service
+#metadata:
+#  name: invidious
+#spec:
+#  ports:
+#  - name: app
+#    port: 3000
+#    protocol: TCP
+#    targetPort: 3000
+#  clusterIP: None
+#  type: ClusterIP
+#
+#---
+#
+#apiVersion: v1
+#kind: Endpoints
+#metadata:
+#  name: invidious
+#subsets:
+#- addresses:
+#  - ip: 192.168.20.104
+#  ports:
+#  - name: app
+#    port: 3000
+#    protocol: TCP
+#
+#---
+#
+#apiVersion: traefik.io/v1alpha1
+#kind: IngressRoute
+#metadata:
+#  name: invidious-ingress
+#spec:
+#  entryPoints:
+#    - websecure
+#  routes:
+#  - match: Host(`invidious.durp.info`) && PathPrefix(`/`)
+#    middlewares:
+#    - name: authentik-proxy-provider
+#      namespace: traefik
+#    kind: Rule
+#    services:
+#    - name: invidious
+#      port: 3000
+#  tls:
+#    secretName: invidious-tls
+#
+#---
+#
+#apiVersion: cert-manager.io/v1
+#kind: Certificate
+#metadata:
+#  name: invidious-tls
+#spec:
+#  secretName: invidious-tls
+#  issuerRef:
+#    name: letsencrypt-production
+#    kind: ClusterIssuer
+#  commonName: "invidious.durp.info"
+#  dnsNames:
+#  - "invidious.durp.info"
+#
+#---
+#
+#kind: Service
+#apiVersion: v1
+#metadata:
+#  name: invidious-external-dns
+#  annotations:
+#    external-dns.alpha.kubernetes.io/hostname: invidious.durp.info
+#spec:
+#  type: ExternalName
+#  externalName: durp.info
+#

dmz/internalproxy/templates/kasm.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: kasm
-spec:
-  ports:
-    - name: app
-      port: 443
-      protocol: TCP
-      targetPort: 443
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: kasm
-subsets:
-  - addresses:
-      - ip: 192.168.20.104
-    ports:
-      - name: app
-        port: 443
-        protocol: TCP
-
----
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -38,7 +9,7 @@ spec:
     - match: Host(`kasm.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: kasm
+        - name: ubuntu
           port: 443
           scheme: https
   tls:

dmz/internalproxy/templates/kuma.yaml

@@ -6,34 +6,30 @@ spec:
   entryPoints:
     - websecure
   routes:
-  - match: Host(`kuma.durp.info`) && PathPrefix(`/`) 
-    kind: Rule
-    middlewares:
-    - name: authentik-proxy-provider
-      namespace: traefik  
-    services:
-    - name: master-cluster
-      port: 443
+    - match: Host(`kuma.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: unraid
+          port: 3001
+          scheme: http
   tls:
     secretName: kuma-tls
 
 ---
-
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: kuma-tls
 spec:
+  secretName: kuma-tls
   issuerRef:
     name: letsencrypt-production
     kind: ClusterIssuer
-  secretName: kuma-tls
   commonName: "kuma.durp.info"
   dnsNames:
-  - "kuma.durp.info"
+    - "kuma.durp.info"
 
 ---
-
 kind: Service
 apiVersion: v1
 metadata:

dmz/internalproxy/templates/litellm.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: litellm
-spec:
-  ports:
-    - name: app
-      port: 4000
-      protocol: TCP
-      targetPort: 4000
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: litellm
-subsets:
-  - addresses:
-      - ip: 192.168.20.104
-    ports:
-      - name: app
-        port: 4000
-        protocol: TCP
-
----
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -38,7 +9,7 @@ spec:
     - match: Host(`litellm.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: litellm
+        - name: ubuntu
           port: 4000
   tls:
     secretName: litellm-tls

dmz/internalproxy/templates/longhorn.yaml

@@ -0,0 +1,34 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: longhorn-infra-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      middlewares:
+        - name: authentik-proxy-provider
+          namespace: traefik
+      services:
+        - name: infra-cluster
+          port: 443
+  tls:
+    secretName: longhorn-infra-tls
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: longhorn-infra-tls
+spec:
+  secretName: longhorn-infra-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: "longhorn.infra.durp.info"
+  dnsNames:
+    - "longhorn.infra.durp.info"

dmz/internalproxy/templates/minio.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: minio
-spec:
-  ports:
-    - name: app
-      port: 9769
-      protocol: TCP
-      targetPort: 9769
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: minio
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 9769
-        protocol: TCP
-
----
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -41,7 +12,7 @@ spec:
           namespace: traefik
       kind: Rule
       services:
-        - name: minio
+        - name: unraid
           port: 9769
           scheme: http
   tls:

dmz/internalproxy/templates/n8n.yaml

@@ -1,68 +1,68 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: n8n
-spec:
-  ports:
-    - name: app
-      port: 5678
-      protocol: TCP
-      targetPort: 5678
-  clusterIP: None
-  type: ClusterIP
-
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: n8n
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 5678
-        protocol: TCP
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: n8n-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`n8n.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: n8n
-          port: 5678
-          scheme: http
-  tls:
-    secretName: n8n-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: n8n-tls
-spec:
-  secretName: n8n-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "n8n.durp.info"
-  dnsNames:
-    - "n8n.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: n8n-dns
-  annotations:
-    dns.alpha.kubernetes.io/hostname: n8n.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info
+#apiVersion: v1
+#kind: Service
+#metadata:
+#  name: n8n
+#spec:
+#  ports:
+#    - name: app
+#      port: 5678
+#      protocol: TCP
+#      targetPort: 5678
+#  clusterIP: None
+#  type: ClusterIP
+#
+#---
+#apiVersion: v1
+#kind: Endpoints
+#metadata:
+#  name: n8n
+#subsets:
+#  - addresses:
+#      - ip: 192.168.21.200
+#    ports:
+#      - name: app
+#        port: 5678
+#        protocol: TCP
+#
+#---
+#apiVersion: traefik.io/v1alpha1
+#kind: IngressRoute
+#metadata:
+#  name: n8n-ingress
+#spec:
+#  entryPoints:
+#    - websecure
+#  routes:
+#    - match: Host(`n8n.durp.info`) && PathPrefix(`/`)
+#      kind: Rule
+#      services:
+#        - name: n8n
+#          port: 5678
+#          scheme: http
+#  tls:
+#    secretName: n8n-tls
+#
+#---
+#apiVersion: cert-manager.io/v1
+#kind: Certificate
+#metadata:
+#  name: n8n-tls
+#spec:
+#  secretName: n8n-tls
+#  issuerRef:
+#    name: letsencrypt-production
+#    kind: ClusterIssuer
+#  commonName: "n8n.durp.info"
+#  dnsNames:
+#    - "n8n.durp.info"
+#
+#---
+#kind: Service
+#apiVersion: v1
+#metadata:
+#  name: n8n-dns
+#  annotations:
+#    dns.alpha.kubernetes.io/hostname: n8n.durp.info
+#spec:
+#  type: ExternalName
+#  externalName: durp.info

dmz/internalproxy/templates/nextcloud.yaml

@@ -0,0 +1,74 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      middlewares:
+        - name: nextcloud-chain
+      services:
+        - name: unraid
+          port: 11000
+          scheme: http
+  tls:
+    secretName: nextcloud-tls
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: nextcloud-tls
+spec:
+  secretName: nextcloud-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "nextcloud.durp.info"
+  dnsNames:
+    - "nextcloud.durp.info"
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: nextcloud-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: nextcloud.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-secure-headers
+spec:
+  headers:
+    hostsProxyHeaders:
+      - "X-Forwarded-Host"
+    referrerPolicy: "same-origin"
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: https-redirect
+spec:
+  redirectScheme:
+    scheme: https
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-chain
+spec:
+  chain:
+    middlewares:
+      - name: https-redirect
+      - name: nextcloud-secure-headers

dmz/internalproxy/templates/nexus.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: nexus
-spec:
-  ports:
-  - name: app
-    port: 8081
-    protocol: TCP
-    targetPort: 8081
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: nexus
-subsets:
-- addresses:
-  - ip: 192.168.20.200
-  ports:
-  - name: app
-    port: 8081
-    protocol: TCP
-
----    
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -38,7 +9,7 @@ spec:
   - match: Host(`nexus.durp.info`) && PathPrefix(`/`)
     kind: Rule
     services:
-    - name: nexus
+    - name: unraid
       port: 8081
   tls:
     secretName: nexus-tls

dmz/internalproxy/templates/ollama.yaml

@@ -15,7 +15,6 @@ spec:
         property: users
 
 ---
-
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
@@ -26,36 +25,6 @@ spec:
     secret: ollama-secret
 
 ---
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: ollama
-spec:
-  ports:
-    - name: app
-      port: 11435
-      protocol: TCP
-      targetPort: 11435
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: ollama
-subsets:
-  - addresses:
-      - ip: 192.168.20.104
-    ports:
-      - name: app
-        port: 11435
-        protocol: TCP
-
----
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -69,13 +38,12 @@ spec:
         - name: ollama-basic-auth
       kind: Rule
       services:
-        - name: ollama
+        - name: ubuntu
           port: 11435
   tls:
     secretName: ollama-tls
 
 ---
-
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -90,7 +58,6 @@ spec:
     - "ollama.durp.info"
 
 ---
-
 kind: Service
 apiVersion: v1
 metadata:
@@ -99,4 +66,4 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: ollama.durp.info
 spec:
   type: ExternalName
-  externalName: durp.info
+  externalName: durp.info

dmz/internalproxy/templates/open-webui.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: open-webui
-spec:
-  ports:
-    - name: app
-      port: 8089
-      protocol: TCP
-      targetPort: 8089
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: open-webui
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 8089
-        protocol: TCP
-
----
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -38,14 +9,13 @@ spec:
     - match: Host(`open-webui.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: open-webui
+        - name: unraid
           port: 8089
           scheme: http
   tls:
     secretName: open-webui-tls
 
 ---
-
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -60,7 +30,6 @@ spec:
     - "open-webui.durp.info"
 
 ---
-
 kind: Service
 apiVersion: v1
 metadata:

dmz/internalproxy/templates/plex.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: plex
-spec:
-  ports:
-    - name: app
-      port: 32400
-      protocol: TCP
-      targetPort: 32400
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: plex
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 32400
-        protocol: TCP
-
----
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -38,14 +9,13 @@ spec:
     - match: Host(`plex.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: plex
+        - name: unraid
           port: 32400
           scheme: https
   tls:
     secretName: plex-tls
 
 ---
-
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -60,7 +30,6 @@ spec:
     - "plex.durp.info"
 
 ---
-
 kind: Service
 apiVersion: v1
 metadata:

dmz/internalproxy/templates/portainer.yaml

@@ -7,9 +7,9 @@ spec:
     - websecure
   routes:
   - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`)
-      #middlewares:
-      #- name: whitelist
-      #  namespace: traefik
+    middlewares:
+      - name: whitelist
+        namespace: traefik
     kind: Rule
     services:
       - name: infra-cluster

dmz/internalproxy/templates/registry.yaml

@@ -1,30 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: registry
-spec:
-  ports:
-    - name: app
-      port: 5000
-      protocol: TCP
-      targetPort: 5000
-  clusterIP: None
-  type: ClusterIP
-
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: registry
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 5000
-        protocol: TCP
-
----
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -39,7 +12,7 @@ spec:
         - name: whitelist
           namespace: traefik
       services:
-        - name: registry
+        - name: unraid
           port: 5000
   tls:
     secretName: registry-tls

dmz/internalproxy/templates/root-vault.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: root-vault
-spec:
-  ports:
-    - name: app
-      port: 8201
-      protocol: TCP
-      targetPort: 8201
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: root-vault
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 8201
-        protocol: TCP
-
----
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -41,14 +12,13 @@ spec:
           namespace: traefik
       kind: Rule
       services:
-        - name: root-vault
+        - name: unraid
           port: 8201
           scheme: https
   tls:
     secretName: root-vault-tls
 
 ---
-
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:

dmz/internalproxy/templates/s3.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: s3
-spec:
-  ports:
-    - name: app
-      port: 9768
-      protocol: TCP
-      targetPort: 9768
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: s3
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 9768
-        protocol: TCP
-
----
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -41,7 +12,7 @@ spec:
           namespace: traefik
       kind: Rule
       services:
-        - name: s3
+        - name: unraid
           port: 9768
           scheme: http
   tls:
@@ -75,7 +46,7 @@ spec:
     - match: Host(`s3.durp.info`) && PathPrefix(`/`)
       kind: Rule
       services:
-        - name: s3
+        - name: unraid
           port: 9768
           scheme: http
   tls:

dmz/internalproxy/templates/semaphore.yaml

@@ -1,64 +1,65 @@
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: semaphore
-spec:
-  ports:
-    - name: app
-      port: 3001
-      protocol: TCP
-      targetPort: 3001
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: semaphore
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 3001
-        protocol: TCP
-
----
-
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: semaphore-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`)
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      kind: Rule
-      services:
-        - name: semaphore
-          port: 3001
-          scheme: http
-  tls:
-    secretName: semaphore-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: semaphore-tls
-spec:
-  secretName: semaphore-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "semaphore.internal.durp.info"
-  dnsNames:
-    - "semaphore.internal.durp.info"
+#
+#apiVersion: v1
+#kind: Service
+#metadata:
+#  name: semaphore
+#spec:
+#  ports:
+#    - name: app
+#      port: 3001
+#      protocol: TCP
+#      targetPort: 3001
+#  clusterIP: None
+#  type: ClusterIP
+#
+#---
+#
+#apiVersion: v1
+#kind: Endpoints
+#metadata:
+#  name: semaphore
+#subsets:
+#  - addresses:
+#      - ip: 192.168.21.200
+#    ports:
+#      - name: app
+#        port: 3001
+#        protocol: TCP
+#
+#---
+#
+#apiVersion: traefik.io/v1alpha1
+#kind: IngressRoute
+#metadata:
+#  name: semaphore-ingress
+#spec:
+#  entryPoints:
+#    - websecure
+#  routes:
+#    - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`)
+#      middlewares:
+#        - name: whitelist
+#          namespace: traefik
+#      kind: Rule
+#      services:
+#        - name: semaphore
+#          port: 3001
+#          scheme: http
+#  tls:
+#    secretName: semaphore-tls
+#
+#---
+#
+#apiVersion: cert-manager.io/v1
+#kind: Certificate
+#metadata:
+#  name: semaphore-tls
+#spec:
+#  secretName: semaphore-tls
+#  issuerRef:
+#    name: vault-issuer
+#    kind: ClusterIssuer
+#  commonName: "semaphore.internal.durp.info"
+#  dnsNames:
+#    - "semaphore.internal.durp.info"
+#

dmz/internalproxy/templates/smokeping.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: smokeping
-spec:
-  ports:
-  - name: app
-    port: 81
-    protocol: TCP
-    targetPort: 81
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: smokeping
-subsets:
-- addresses:
-  - ip: 192.168.21.200
-  ports:
-  - name: app
-    port: 81
-    protocol: TCP
-
----    
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -43,13 +14,12 @@ spec:
       namespace: traefik  
     kind: Rule
     services:
-    - name: smokeping
+    - name: unraid
       port: 81
   tls:
     secretName: smokeping-tls
 
 ---
-
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -64,7 +34,6 @@ spec:
   - "smokeping.durp.info"  
 
 ---
-
 kind: Service
 apiVersion: v1
 metadata:

dmz/internalproxy/templates/tdarr.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: tdarr
-spec:
-  ports:
-  - name: app
-    port: 8267
-    protocol: TCP
-    targetPort: 8267
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: tdarr
-subsets:
-- addresses:
-  - ip: 192.168.21.200
-  ports:
-  - name: app
-    port: 8267
-    protocol: TCP
-
----
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -45,7 +16,7 @@ spec:
       namespace: traefik  
     kind: Rule
     services:
-    - name: tdarr
+    - name: unraid
       port: 8267
       scheme: http
   tls:

dmz/internalproxy/templates/unraid.yaml

@@ -1,33 +1,3 @@
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: unraid
-spec:
-  ports:
-    - name: app
-      port: 443
-      protocol: TCP
-      targetPort: 443
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: unraid
-subsets:
-  - addresses:
-      - ip: 192.168.21.200
-    ports:
-      - name: app
-        port: 443
-        protocol: TCP
-
----
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:

dmz/istio-system/Chart.yaml

@@ -8,7 +8,7 @@ appVersion: 0.0.1
 dependencies:
   - name: base
     repository: https://istio-release.storage.googleapis.com/charts
-    version: 1.26.2
+    version: 1.29.0
   - name: istiod
     repository: https://istio-release.storage.googleapis.com/charts
     version: 1.26.2

dmz/metallb-system/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: "1.16.0"
 dependencies:
 - name: metallb
   repository: https://metallb.github.io/metallb
-  version: 0.15.3
+  version: 0.15.2

dmz/searxng/templates/confligmap.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: searxng-config
+data:
+  settings.yml: |-
+    use_default_settings: true
+    search:
+      formats:
+        - html
+        - json

dmz/searxng/templates/deployment.yaml

@@ -21,4 +21,20 @@ spec:
           imagePullPolicy: Always
           ports:
             - name: http
-              containerPort: 8080
+              containerPort: 8080
+          env:
+            - name: SEARXNG_BASE_URL
+              value: https://searxng.durp.info
+            - name: SEARXNG_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: searxng-secret
+                  key: SEARXNG_SECRET
+          volumeMounts:
+            - name: searxng-config-volume
+              mountPath: /etc/searxng/settings.yml
+              subPath: settings.yml
+      volumes:
+        - name: searxng-config-volume
+          configMap:
+            name: searxng-config

dmz/searxng/templates/ingress.yaml

@@ -43,3 +43,34 @@ metadata:
 spec:
   type: ExternalName
   externalName: durp.info
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: searxng-internal-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`searxng.internal.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: searxng-service
+          port: 8080
+  tls:
+    secretName: searxng-internal-tls
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: searxng-internal-tls
+spec:
+  secretName: searxng-internal-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "searxng.internal.durp.info"
+  dnsNames:
+    - "searxng.internal.durp.info"

dmz/searxng/templates/secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: searxng-secret
+spec:
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: searxng-secret
+  data:
+    - secretKey: SEARXNG_SECRET
+      remoteRef:
+        key: kv/searxng
+        property: searxng-secret
+
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault
+

infra/argocd/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: "1.16.0"
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 8.1.3
+  version: 8.6.4

infra/argocd/templates/argocd.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/argocd
   destination:

infra/argocd/templates/authentik.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/authentik
   destination:
@@ -31,7 +31,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/authentik
   destination:

infra/argocd/templates/bitwarden.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/bitwarden
   destination:

infra/argocd/templates/cert-manager.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/cert-manager
   destination:
@@ -29,7 +29,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/cert-manager
   destination:

infra/argocd/templates/external-dns.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/external-dns
   destination:

infra/argocd/templates/external-secrets.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/external-secrets
   destination:
@@ -29,7 +29,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/external-secrets
   destination:

infra/argocd/templates/gitlab-runner.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/gitlab-runner
   destination:

infra/argocd/templates/internalproxy.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/internalproxy
   destination:

infra/argocd/templates/istio.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/istio-system
   destination:
@@ -36,7 +36,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/istio-system
   destination:

infra/argocd/templates/kube-prometheus-stack.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/kube-prometheus-stack
   destination:

infra/argocd/templates/litellm.yaml

@@ -6,7 +6,7 @@
 #spec:
 #  project: default
 #  source:
-#    repoURL: https://gitlab.com/developerdurp/homelab.git
+#    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
 #    targetRevision: main
 #    path: infra/litellm
 #  destination:

infra/argocd/templates/littlelink.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/littlelink
     directory:

infra/argocd/templates/longhorn.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/longhorn
   destination:
@@ -33,7 +33,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/longhorn
   destination:

infra/argocd/templates/metallb-system.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/metallb-system
   destination:
@@ -29,7 +29,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/metallb-system
   destination:
@@ -52,7 +52,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dev/metallb-system
   destination:

infra/argocd/templates/nebula-sync.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/nebula-sync
   destination:

infra/argocd/templates/nfs.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/nfs
   destination:

infra/argocd/templates/openclarity.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/openclarity
   destination:

infra/argocd/templates/openspeedtest.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/openspeedtest
     directory:

infra/argocd/templates/portainer.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/portainer
   destination:

infra/argocd/templates/redlib.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/redlib
     directory:

infra/argocd/templates/searxng.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/searxng
     directory:

infra/argocd/templates/traefik.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/traefik
   destination:
@@ -32,7 +32,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/traefik
   destination:
@@ -58,7 +58,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dev/traefik
   destination:

infra/argocd/templates/vault.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: infra/vault
   destination:
@@ -34,7 +34,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
+    repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git
     targetRevision: main
     path: dmz/vault
   destination:

infra/authentik/values.yaml

@@ -34,7 +34,7 @@ authentik:
     enabled: true
     image:
       registry: registry.durp.info
-      repository: bitnami/postgresql
+      repository: bitnamilegacy/postgresql
       pullPolicy: Always
     postgresqlUsername: "authentik"
     postgresqlDatabase: "authentik"
@@ -52,7 +52,7 @@ authentik:
         enabled: false
     image:
       registry: registry.durp.info
-      repository: bitnami/redis
+      repository: bitnamilegacy/redis
       pullPolicy: Always
     architecture: standalone
     auth:

infra/bitwarden/templates/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: bitwarden
-          image: registry.durp.info/vaultwarden/server:1.34.3
+          image: registry.durp.info/vaultwarden/server:1.35.4
           imagePullPolicy: Always
           volumeMounts:
             - name: bitwarden-pvc

infra/istio-system/Chart.yaml

@@ -8,7 +8,7 @@ appVersion: 0.0.1
 dependencies:
 - name: base
   repository: https://istio-release.storage.googleapis.com/charts
-  version: 1.26.2
+  version: 1.29.0
 - name: istiod
   repository: https://istio-release.storage.googleapis.com/charts
   version: 1.26.2

infra/longhorn/templates/ingress.yaml

@@ -11,8 +11,8 @@ spec:
     - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`)
       kind: Rule
       middlewares:
-        - name: authentik-proxy-provider
-          namespace: traefik
+        #- name: authentik-proxy-provider
+        #  namespace: traefik
       services:
         - name: longhorn-frontend
           port: 80

infra/metallb-system/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: "1.16.0"
 dependencies:
 - name: metallb
   repository: https://metallb.github.io/metallb
-  version: 0.15.3
+  version: 0.15.2

infra/openclarity/values.yaml

@@ -542,7 +542,7 @@ openclarity:
       # -- Trivy Server container repository
       repository: aquasec/trivy
       # -- Trivy Server container tag
-      tag: 0.64.1
+      tag: 0.69.3
       # -- Trivy Server image digest. If set will override the tag.
       digest: ""
       # -- Trivy Server image pull policy

infra/portainer/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: "1.16.0"
 dependencies:
   - name: portainer
     repository: https://portainer.github.io/k8s/
-    version: 2.33.5
+    version: 2.33.6

infra/portainer/values.yaml

@@ -2,7 +2,7 @@ portainer:
   replicaCount: 1
   image:
     repository: registry.durp.info/portainer/portainer-ce
-    tag: 2.33.5
+    tag: 2.39.1
     pullPolicy: Always
 
   imagePullSecrets: []

infra/renovate/Chart.yaml

@@ -7,9 +7,6 @@ version: 0.1.0
 appVersion: "1.16.0"
 
 dependencies:
-  - name: renovate
-    repository: https://docs.renovatebot.com/helm-charts
-    version: 39.264.0
   - name: renovate
     repository: https://docs.renovatebot.com/helm-charts
     version: 39.264.0

infra/renovate/templates/secrets.yaml

@@ -56,3 +56,7 @@ spec:
       remoteRef:
         key: kv/renoatePersonal
         property: RENOVATE_TOKEN
+    - secretKey: RENOVATE_GITHUB_COM_TOKEN
+      remoteRef:
+        key: kv/renoatePersonal
+        property: RENOVATE_GITHUB_COM_TOKEN

infra/renovate/values.yaml

@@ -1,333 +1,3 @@
-renovate:
-  global:
-    # -- Additional labels to be set on all renovate resources
-    commonLabels: {}
-    compatibility:
-      openshift:
-        # --  Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: `auto` (apply if the detected running cluster is Openshift), `force` (perform the adaptation always), `disabled` (do not perform adaptation)
-        adaptSecurityContext: "auto"
-
-  # -- Override the name of the chart
-  nameOverride: ""
-  # -- Override the fully qualified app name
-  fullnameOverride: ""
-  # -- Annotations to add to secret
-  secretAnnotations: {}
-
-  cronjob:
-    # -- Schedules the job to run using cron notation
-    schedule: "0 1 * * *" # At 01:00 every day
-    # -- You can specify a time zone for a CronJob by setting timeZone to the name of a valid time zone. (starting with k8s 1.27) <https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/#time-zones>
-    timeZone: "" # see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for valid names
-    # -- If it is set to true, all subsequent executions are suspended. This setting does not apply to already started executions.
-    suspend: false
-    # -- Annotations to set on the cronjob
-    annotations: {}
-    # -- Labels to set on the cronjob
-    labels: {}
-    # -- "Allow" to allow concurrent runs, "Forbid" to skip new runs if a previous run is still running or "Replace" to replace the previous run
-    concurrencyPolicy: ""
-    # -- "Number of successful completions is reached to mark the job as complete"
-    completions: ""
-    # -- "Where the jobs should be NonIndexed or Indexed"
-    completionMode: ""
-    # -- Amount of failed jobs to keep in history
-    failedJobsHistoryLimit: ""
-    # -- Amount of completed jobs to keep in history
-    successfulJobsHistoryLimit: ""
-    # -- Set to Never to restart the job when the pod fails or to OnFailure to restart when a container fails
-    jobRestartPolicy: Never
-    # -- Time to keep the job after it finished before automatically deleting it
-    ttlSecondsAfterFinished: ""
-    # -- Deadline for the job to finish
-    activeDeadlineSeconds: ""
-    # -- Number of times to retry running the pod before considering the job as being failed
-    jobBackoffLimit: ""
-    # -- Maximal number of failures per index
-    backoffLimitPerIndex: ""
-    # -- Maximal number of failed indexes before terminating the Job execution
-    maxFailedIndexes: ""
-    # -- Deadline to start the job, skips execution if job misses it's configured deadline
-    startingDeadlineSeconds: ""
-    # -- Additional initContainers that can be executed before renovate
-    initContainers: []
-    # initContainers:
-    # - name: INIT_CONTAINER_NAME
-    #   image: INIT_CONTAINER_IMAGE
-    # -- Number of pods to run in parallel
-    parallelism: ""
-    # -- Custom command to run in the container
-    commandOverride: []
-    # -- Custom arguments to run in the container
-    argsOverride: []
-    # -- Prepend shell commands before renovate runs
-    #preCommand: ''
-    #preCommand: |
-    #  ls /config
-    #  cat /config/renovate.json
-
-    postCommand: ""
-    # postCommand: |
-    #   echo hello
-    #   echo world
-
-  pod:
-    # -- Annotations to set on the pod
-    annotations: {}
-    # -- Labels to set on the pod
-    labels: {}
-
-  image:
-    # -- Registry to pull image from
-    registry: registry.durp.info
-    # -- Image name to pull
-    repository: renovatebot/renovate
-    # -- Renovate image tag to pull
-    #tag: 39.264.0
-    # -- "IfNotPresent" to pull the image if no image with the specified tag exists on the node, "Always" to always pull the image or "Never" to try and use pre-pulled images
-    pullPolicy: Always
-    # -- Set `true` to use the full image. See https://docs.renovatebot.com/getting-started/running/#the-full-image
-    useFull: false
-
-  # -- Secret to use to pull the image from the repository
-  imagePullSecrets: {}
-
-  renovate:
-    # -- Custom exiting global renovate config
-    #existingConfigFile: "/config/renovate.json"
-    # -- Inline global renovate config.json
-    config: |
-      {
-        "platform": "gitlab",
-        "endpoint": "https://gitlab.com/api/v4",
-        "autodiscover": "true",
-        "dryRun": false,
-        "printConfig": false,
-        "autodiscoverFilter": ["developerdurp/*", "durfy/*"],
-        "assignees": ["developerdurp"],
-      }
-    # See https://docs.renovatebot.com/self-hosted-configuration
-    # config: |
-    #   {
-    #     "": "gitlab",
-    #     "endpoint": "https://gitlab.example.com/api/v4",
-    #     "token": "your-gitlab-renovate-user-token",
-    #     "autodiscover": "false",
-    #     "dryRun": true,
-    #     "printConfig": true,
-    #     "repositories": ["username/repo", "orgname/repo"]
-    #   }
-
-    # -- Use the Helm tpl function on your configuration. See README for how to use this value
-    configEnableHelmTpl: false
-
-    # -- Use this to create the renovate-config as a secret instead of a configmap
-    configIsSecret: true
-
-    # -- Use this to create a config.js instead of a config.json
-    configIsJavaScript: false
-
-    # -- Renovate Container-level security-context
-    securityContext: {}
-
-    # Instead of a file system cache, it is highly recommended to use the redis subchart.
-    # Alternatively, SQLite is also a good choice.
-    # Take a look at https://github.com/renovatebot/renovate/discussions/30525 for more information.
-    # -- Options related to persistence
-    persistence:
-      cache:
-        # -- Allow the cache to persist between runs
-        enabled: false
-        # -- Storage class of the cache PVC
-        storageClass: ""
-        # -- Storage size of the cache PVC
-        storageSize: "512Mi"
-        # -- Existing volume, enables binding the pvc to an existing volume
-        volumeName: ""
-        # -- Labels to set on the cache PVC
-        labels: {}
-
-  ssh_config:
-    # -- Whether to enable the use and creation of a secret containing .ssh files
-    enabled: false
-
-    # Provide .ssh config file contents
-    # -- Contents of the id_rsa file
-    id_rsa: ""
-    # -- Contents of the id_rsa_pub file
-    id_rsa_pub: ""
-    # -- Contents of the config file
-    config: ""
-
-    # or provide the name of an existing secret to be read instead.
-    # -- Name of the existing secret containing a valid .ssh configuration
-    existingSecret: ""
-
-  # -- Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set
-  secrets: {}
-  # -- k8s secret to reference environment variables from. Overrides secrets if set
-  existingSecret: "renovate-config-secret"
-
-  # -- Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config
-  extraConfigmaps: []
-  # extraConfigmaps:
-  #   - name: netrc-config
-  #     data:
-  #       .netrc: |-
-  #         machine gitlab.example.com
-  #         login gitlab-ci-token
-  #         password some-pass
-  #   - name: yet-another-config
-  #     data:
-  #       ya-config.yaml: |-
-  #         "key"="value"
-  #         "key1"="value1"
-
-  #extraVolumes:
-  #  - name: renovate-config-secret
-  #    secretName:
-  #      name: renovate-config-secret
-  #      items:
-  #        - key: renovate.json
-  #          path: renovate.json
-
-  #extraVolumeMounts:
-  #  - name: renovate-config-secret
-  #    mountPath: /config
-  #    subPath: renovate.json
-
-  # -- Additional containers to the pod
-  extraContainers: []
-  # extraContainers:
-  #   - name: vault-agent
-  #     image: vault:1.6.2
-  #     args:
-  #     - agent
-  #     - -config
-  #     - /vault/config/config.hcl
-  #     env:
-  #     - name: VAULT_ADDR
-  #       value: https://vault:8200
-  #     - name: VAULT_SKIP_VERIFY
-  #       value: "false"
-  #     - name: VAULT_CACERT
-  #       value: /vault/tls/ca.crt
-
-  serviceAccount:
-    # -- Specifies whether a service account should be created
-    create: false
-    # -- Annotations to add to the service account
-    annotations: {}
-    # -- The name of the service account to use
-    # If not set and create is true, a name is generated using the fullname template
-    name: ""
-
-  # -- Specify resource limits and requests for the renovate container
-  resources:
-    {}
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    # limits:
-    #  cpu: 100m
-    #  memory: 128Mi
-    # requests:
-    #  cpu: 100m
-    #  memory: 128Mi
-
-  # -- Environment variables to add from existing secrets/configmaps. Uses the keys as variable name
-  envFrom: []
-  # envFrom:
-  #   - secretRef:
-  #       name: env-secrets
-  #   - configMapRef:
-  #       name: env-configmap
-
-  # -- Environment variables to set on the renovate container
-  env:
-    RENOVATE_AUTODISCOVER: true
-  # env:
-  #   VARIABLE_NAME: "value"
-
-  # -- Additional env. Helpful too if you want to use anything other than a `value` source.
-  envList: []
-  # envList:
-  #   - name: POD_NAME
-  #     valueFrom:
-  #       fieldRef:
-  #         fieldPath: metadata.name
-
-  redis:
-    # Configuration for a Redis subchart. Additional documentation at
-    # https://github.com/bitnami/charts/tree/master/bitnami/redis
-
-    # -- Enable the Redis subchart?
-    enabled: false
-
-    # -- Override the prefix of the redisHost
-    nameOverride: ""
-
-    # -- Disable replication by default
-    architecture: standalone
-
-    auth:
-      # -- Don't require a password by default
-      enabled: false
-
-    # -- Override Kubernetes version for redis chart
-    kubeVersion: ""
-
-  # -- Override hostname resolution
-  hostAliases: []
-  # See: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
-  # hostAliases:
-  #   - ip: "your-ip"
-  #     hostnames:
-  #       - "your-hostname"
-
-  # -- Pod-level security-context
-  securityContext: {}
-
-  # -- Select the node using labels to specify where the cronjob pod should run on
-  nodeSelector: {}
-  # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
-  # renovate: true
-
-  # -- Configure the pod(Anti)Affinity and/or node(Anti)Affinity
-  affinity: {}
-  # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
-
-  # -- Configure which node taints the pod should tolerate
-  tolerations: []
-  # See: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
-
-  # -- Create extra manifests via values. Would be passed through `tpl` for templating
-  extraObjects: []
-  # extraObjects:
-  #   - apiVersion: external-secrets.io/v1
-  #     kind: ExternalSecret
-  #     metadata:
-  #       name: '{{ include "renovate.fullname" . }}-token'
-  #     spec:
-  #       secretStoreRef:
-  #         name: default
-  #       data:
-  #         - secretKey: token
-  #           remoteRef:
-  #             key: github-token
-  #   - |
-  #     apiVersion: v1
-  #     kind: ConfigMap
-  #     metadata:
-  #       name: {{ include "renovate.fullname" . }}-config
-  #     data:
-  #       config.json: |
-  #         {
-  #           "platform": "github",
-  #           "repositories": ["username/repo", "orgname/repo"]
-  #         }
-
 renovate-personal:
   global:
     # -- Additional labels to be set on all renovate resources
@@ -577,7 +247,7 @@ renovate-personal:
   # -- Environment variables to set on the renovate container
   env:
     RENOVATE_AUTODISCOVER: true
-    LOG_LEVEL: debug
+    #LOG_LEVEL: debug
   # env:
   #   VARIABLE_NAME: "value"
 

prd/metallb-system/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: "1.16.0"
 dependencies:
 - name: metallb
   repository: https://metallb.github.io/metallb
-  version: 0.15.3
+  version: 0.15.2