whyredfire/gitops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: whyredfire/gitops:7467e34b4ca8060814df241d1483da579f33e639
Branches Tags
whyredfire/gitops:main whyredfire/gitops:feat/sync-waves
...
compare: whyredfire/gitops:main
Branches Tags
whyredfire/gitops:main whyredfire/gitops:feat/sync-waves
10 Commits
7467e34b4c ... main
Author SHA1 Message Date
whyredfire 98081ed54c feat: Add holyarrs and use LDAP for jellyfin 2026-11-10 22:27:54 +05:30
whyredfire e22907125d chore(add-ons): Track redoost images with latest tags 2026-11-08 17:04:28 +05:30
whyredfire 658296205f chore(add-ons): Let Image Updater read GHCR 2026-11-05 22:44:24 +05:30
whyredfire a2536f4a3a chore(apps): Add the deploy key for the applications repo 2026-11-05 22:44:24 +05:30
whyredfire ba022ddccc chore(traefik): Serve *.pixelos.net with a wildcard certificate 2026-11-05 22:44:24 +05:30
whyredfire ed9f485b88 chore(apps): Add PixelOS applications, rolled out by Image Updater 2026-11-05 22:44:24 +05:30
whyredfire 6dbe8beefd chore(add-ons): Add Argo CD Image Updater 2026-11-05 22:27:39 +05:30
whyredfire 02b375d7e6 fix(wireguard): Allow egress to Traefik pod ports 2026-10-28 21:43:51 +05:30
whyredfire e4346af5ba chore(add-ons): Add network policies to operators and monitoring 2026-10-28 15:27:26 +05:30
whyredfire 49ee2a29f5 chore(apps): Add network policies to apps 2026-10-28 15:19:35 +05:30
52 changed files with 1169 additions and 16 deletions
Expand all files Collapse all files
add-ons/argocd-image-updater/ghcr-sealedsecret.yaml
+14
View File
@@ -0,0 +1,14 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: ghcr-pull
namespace: argocd
spec:
encryptedData:
.dockerconfigjson: AgCRsZSHP+T0U4pLck8AJ++dCb47OklXOgediZXPUSENy2/W/o4ooDgr+vP9GmSMoSm/5FBahmiSF8WYth0TYL4bdTKMQfnFO4kAOxk5QXuyyaKL+ZxL3XFfKRUeVD4m+HFJrvUsHC36TeJy0SYwkaS5isWdNTPFPdNRhXQ9OiTKQlL2tPZgOzk48CH5wDCugI3uC6/1tuzoeNzbIWRFpbkDtwhdGBqnZIiZZhOliXBV5wGnEcPKpxBnE21PNBsr2A8/lisuTsmcsyZDj3uenLjcdITdTs57sss8HPEI9u+cIuNFCZVO/URtJEV1k24oEr3CAPJojic6vT6jS0Ow9H3VEJpEObAN4E02+yC/gZjkLOBSO9aq77SzVRJpTxmcuW4s2U91hegYzS33H0jBCB1EJ5y/rYZUFrdBQnr16gENbMo8HuYf0jnogDvyGjd4Kf4HWDl97yiOv2xdm7Jb3MBrgyCQSw2uU4QpvgwGpTCo8j3LrfqQjBZRyTn/HplLO+zGkQKcqsNosZ0a+fm990gDWEgBuNjf/2iVLsYMJrz8da3Fu4k2TTtzxtAZ0eFJbxa97CRC3d/4nx/vS/S3zTzoXhp2XHdlG3RfurrKKtxeretRlTtbTM8CjahMB0/oLgBKSaNs5gEtvaATKe8jBfAw+WHxCFJC+0Jxj8IfDq0KWv2I1OO2r+7TK+o2Ed/7SucJQd4e4NQJfWQW/xiq4RL3StJdO3WXcICloslTMtE9EaZn/w/dx98bLRus9mrkom+tPSHw63tHPn6C4B75Ya8qA5LSBylMEZXg8CG5xfqmR3C0F/c4XCYerfbzNg88AIw2VBsAgW6aySCkZCa9rkaCx5AyzblCVQxGZ+PpR0RdaBkuT2hXoWHBZZu9Dmhk6Qr1HyqCBaV2DmsYFcYB+pfHUKzT0BAWO7BdbiLFil0V779JZw==
template:
metadata:
name: ghcr-pull
namespace: argocd
type: kubernetes.io/dockerconfigjson
add-ons/argocd-image-updater/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ghcr-sealedsecret.yaml
- pixelos-applications.yaml
- redoost.yaml
add-ons/argocd-image-updater/pixelos-applications.yaml
+16
View File
@@ -0,0 +1,16 @@
apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
name: pixelos-applications
namespace: argocd
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
spec:
applicationRefs:
- namePattern: pixelos-applications
images:
- alias: app
imageName: ghcr.io/pixelos-ci/applications:latest
commonUpdateSettings:
updateStrategy: digest
pullSecret: pullsecret:argocd/ghcr-pull
add-ons/argocd-image-updater/redoost.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
name: redoost
namespace: argocd
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
spec:
applicationRefs:
- namePattern: redoost
images:
- alias: api
imageName: ghcr.io/whyredfire/redoost-api:latest
commonUpdateSettings:
updateStrategy: digest
manifestTargets:
helm:
name: api.image.repository
tag: api.image.tag
- alias: frontend
imageName: ghcr.io/whyredfire/redoost-frontend:latest
commonUpdateSettings:
updateStrategy: digest
manifestTargets:
helm:
name: frontend.image.repository
tag: frontend.image.tag
add-ons/authentik/blueprint-jellyfin-ldap.yaml
+116
View File
@@ -0,0 +1,116 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: blueprint-jellyfin-ldap
namespace: authentik
data:
jellyfin-ldap.yaml: |
version: 1
metadata:
name: Jellyfin LDAP
entries:
- model: authentik_stages_password.passwordstage
id: ldap-password
identifiers:
name: ldap-authentication-password
attrs:
backends:
- authentik.core.auth.InbuiltBackend
- authentik.core.auth.TokenBackend
- model: authentik_stages_identification.identificationstage
id: ldap-identification
identifiers:
name: ldap-authentication-identification
attrs:
user_fields:
- username
password_stage: !KeyOf ldap-password
- model: authentik_stages_user_login.userloginstage
id: ldap-login
identifiers:
name: ldap-authentication-login
- model: authentik_flows.flow
id: ldap-flow
identifiers:
slug: ldap-authentication
attrs:
designation: authentication
name: LDAP bind
title: LDAP bind
- model: authentik_flows.flowstagebinding
identifiers:
order: 10
stage: !KeyOf ldap-identification
target: !KeyOf ldap-flow
- model: authentik_flows.flowstagebinding
identifiers:
order: 30
stage: !KeyOf ldap-login
target: !KeyOf ldap-flow
- model: authentik_core.user
id: ldap-jellyfin
identifiers:
username: ldap-jellyfin
attrs:
name: Jellyfin LDAP bind
password: !Env JELLYFIN_LDAP_PASSWORD
- model: authentik_providers_ldap.ldapprovider
id: jellyfin-ldap-provider
identifiers:
name: jellyfin-ldap
attrs:
authorization_flow: !KeyOf ldap-flow
invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
base_dn: dc=ldap,dc=goauthentik,dc=io
certificate: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
bind_mode: direct
search_mode: direct
mfa_support: false # else ";" in a password is read as a TOTP separator
permissions:
- permission: authentik_providers_ldap.search_full_directory
user: !KeyOf ldap-jellyfin
- model: authentik_core.application
id: jellyfin-ldap
identifiers:
slug: jellyfin-ldap
attrs:
name: Jellyfin LDAP
provider: !KeyOf jellyfin-ldap-provider
policy_engine_mode: any
- model: authentik_policies.policybinding
identifiers:
order: 0
target: !KeyOf jellyfin-ldap
attrs:
group: !Find [authentik_core.group, [name, admins]]
- model: authentik_policies.policybinding
identifiers:
order: 10
target: !KeyOf jellyfin-ldap
attrs:
user: !KeyOf ldap-jellyfin
- model: authentik_outposts.outpost
identifiers:
name: ldap
attrs:
type: ldap
service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [name, Local Kubernetes Cluster]]
providers:
- !KeyOf jellyfin-ldap-provider
config:
authentik_host: http://authentik-server.authentik.svc.cluster.local
- model: authentik_core.user
identifiers:
username: whyredfire
attrs:
attributes:
jellyfinUsername: karan
- model: authentik_core.token
identifiers:
identifier: jellyfin-whyredfire
attrs:
user: !Find [authentik_core.user, [username, whyredfire]]
intent: app_password
key: !Env JELLYFIN_APP_PASSWORD
expiring: false
description: Jellyfin
add-ons/authentik/kustomization.yaml
+2
View File
@@ -6,9 +6,11 @@ resources:
- blueprint-garage-ui.yaml - blueprint-garage-ui.yaml
- blueprint-google-login.yaml - blueprint-google-login.yaml
- blueprint-grafana.yaml - blueprint-grafana.yaml
- blueprint-jellyfin-ldap.yaml
- blueprint-outpost.yaml - blueprint-outpost.yaml
- blueprint-pgweb.yaml - blueprint-pgweb.yaml
- blueprint-qbittorrent.yaml - blueprint-qbittorrent.yaml
- blueprint-wireguard-admin.yaml - blueprint-wireguard-admin.yaml
- httproute.yaml - httproute.yaml
- referencegrant.yaml - referencegrant.yaml
- networkpolicy.yaml
add-ons/authentik/networkpolicy.yaml
+57
View File
@@ -0,0 +1,57 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: authentik
namespace: authentik
spec:
egress:
- to:
- podSelector: {}
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 5432
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: postgres
podSelector:
matchLabels:
cnpg.io/cluster: postgres
- ports:
- port: 6443
protocol: TCP
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- podSelector: {}
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 9000
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: authentik
policyTypes:
- Ingress
- Egress
add-ons/authentik/sealed-secret.yaml
+2
View File
@@ -12,6 +12,8 @@ spec:
GOOGLE_CLIENT_ID: AgDOTuDt2E53pPy4ZL+VC6Gvb1I+kuL6ziDjOwWM+CkDpxuBSNxdsCOZap+TWMjOUhxgxev9mhijBTN1DuTtcnLNZopX0Rm2ZtVIq+k3Mm0a6cI6AZCi4nBbiAsNXCx1fUHz00b7meG/hVi6UB4skPR1VFdIu5LZ3QZo3GS5cZ7PMRmCq0UIrP74Hhvlz9CpC2nTPYRx/SsBbbcjYh/DIS6FWiwm8GuIE60Mt9tiiG3Yntb5YF0ZibmEcPzcFfNdxD2uEqTMNOPR0PwbEjdd83LOLLI37/OyW5C0uZIMofjeIx6JuipSaG758kLRfBWXewWSN0BPJIUrKBD7xbZaJ9l25UbpJSB1dZX5nKNh4cRi3xpbdzS4JqhNcytmUgO43NglV0AkiEY2PGzuqj0RiZPlDu0lAEh14cI5SYXAVzlapxE/Zq/DCYBdUYN4Qg6G4hTLNv1wsA/UK8O7KExQ4JqgEfQYyhykMlFdXHERdY1AvhapcTO+KbX1wvU+gVg1GgBz1V+iCWeuxzFwvNDoepCc8rsPUVRr86MCDIKT/I4RTwLNsFyG2Igcj+C1GcoPwMJEY7pJorVBFLYd7Czp2PVm1t1s4Tk+ad+hkURYLnOenOAmSAgUUIYKDxAyxAzzKLOQYxtYKrXw1QmSlaIgz70TAWsBUIimu5/5mC9C6rBcm6soi9hBm207kAkS4h1TlsHdigstJOLggO3ajZMrEqTN0IQFQKP0/SlO7qaHD2R0VW+J8D1C3XhKTeH+XJNIH+JyCD18iDfLXINJ2frfWcvtDPCVzKQMJtM= GOOGLE_CLIENT_ID: AgDOTuDt2E53pPy4ZL+VC6Gvb1I+kuL6ziDjOwWM+CkDpxuBSNxdsCOZap+TWMjOUhxgxev9mhijBTN1DuTtcnLNZopX0Rm2ZtVIq+k3Mm0a6cI6AZCi4nBbiAsNXCx1fUHz00b7meG/hVi6UB4skPR1VFdIu5LZ3QZo3GS5cZ7PMRmCq0UIrP74Hhvlz9CpC2nTPYRx/SsBbbcjYh/DIS6FWiwm8GuIE60Mt9tiiG3Yntb5YF0ZibmEcPzcFfNdxD2uEqTMNOPR0PwbEjdd83LOLLI37/OyW5C0uZIMofjeIx6JuipSaG758kLRfBWXewWSN0BPJIUrKBD7xbZaJ9l25UbpJSB1dZX5nKNh4cRi3xpbdzS4JqhNcytmUgO43NglV0AkiEY2PGzuqj0RiZPlDu0lAEh14cI5SYXAVzlapxE/Zq/DCYBdUYN4Qg6G4hTLNv1wsA/UK8O7KExQ4JqgEfQYyhykMlFdXHERdY1AvhapcTO+KbX1wvU+gVg1GgBz1V+iCWeuxzFwvNDoepCc8rsPUVRr86MCDIKT/I4RTwLNsFyG2Igcj+C1GcoPwMJEY7pJorVBFLYd7Czp2PVm1t1s4Tk+ad+hkURYLnOenOAmSAgUUIYKDxAyxAzzKLOQYxtYKrXw1QmSlaIgz70TAWsBUIimu5/5mC9C6rBcm6soi9hBm207kAkS4h1TlsHdigstJOLggO3ajZMrEqTN0IQFQKP0/SlO7qaHD2R0VW+J8D1C3XhKTeH+XJNIH+JyCD18iDfLXINJ2frfWcvtDPCVzKQMJtM=
GOOGLE_CLIENT_SECRET: AgDYAawB7EWhFwOTmRWP8MBjhslEZr9iq+wkOFbYmsDAnW3ADa9g7JILJn33eWG6jTjTE3SH/K0vmhqE+cppCyUtR9qk1vV+lSxuhrqb68l6J5tYPPY45bwq9Ol5Osar6PjuwX5eFLFZwi2hKy61aGH6SzoqJ606hBhMTQijI4X0IYHoEagEg52Fug5y+qEn09CV9Nq9QmaBPJTI8IQfbxqzAVe3E7XMEmjwBBd5pLprOkZAe0cZKFFUx9yRphf8zT8YcxBS+GoiN/Q1lLdQr8fMBWJ3kw5uwmaJwwsGDGyvac9IKGujhlduIba51AfXQ6qels7bqpvN67MmoL5f+j5vT7pB4c3fNNyqkx9Bu8d1dhoZqpaWEa75c2hIlwSMZYOSB1p8lwulzFIyehkuRgGeJqosjmKw0cIspLM/wLXV3MSeGG32opltOW2CtyaK4B7JPDvOhS7M8vjhsP/FxpAfkeQO4GIVS7WbM7sN5i9oAVit/RRhoN1IkZ8+8KEl1B1AkOu6vOCfgMyd0wM3E1EfIN21HyaGZGR5gBLyLl1vKv0TtmH5RJgOkwKmEi5yUL7pyhHLeGuDprtQmt2+l+hFn1xAEN7SHhrynUBFu4ZXfa18q1wcr83trbbl940OB3Xpcu6E2/QgWLAnSDioYyqQXaXXJ9HMddydbSHrYe4/yo2N3katZ3YuZQLZOyl/4eLduWN7jcKMexKU/eLl3Aa9+16mg/g4iMk1WbZTpKGL1GSwAQ== GOOGLE_CLIENT_SECRET: AgDYAawB7EWhFwOTmRWP8MBjhslEZr9iq+wkOFbYmsDAnW3ADa9g7JILJn33eWG6jTjTE3SH/K0vmhqE+cppCyUtR9qk1vV+lSxuhrqb68l6J5tYPPY45bwq9Ol5Osar6PjuwX5eFLFZwi2hKy61aGH6SzoqJ606hBhMTQijI4X0IYHoEagEg52Fug5y+qEn09CV9Nq9QmaBPJTI8IQfbxqzAVe3E7XMEmjwBBd5pLprOkZAe0cZKFFUx9yRphf8zT8YcxBS+GoiN/Q1lLdQr8fMBWJ3kw5uwmaJwwsGDGyvac9IKGujhlduIba51AfXQ6qels7bqpvN67MmoL5f+j5vT7pB4c3fNNyqkx9Bu8d1dhoZqpaWEa75c2hIlwSMZYOSB1p8lwulzFIyehkuRgGeJqosjmKw0cIspLM/wLXV3MSeGG32opltOW2CtyaK4B7JPDvOhS7M8vjhsP/FxpAfkeQO4GIVS7WbM7sN5i9oAVit/RRhoN1IkZ8+8KEl1B1AkOu6vOCfgMyd0wM3E1EfIN21HyaGZGR5gBLyLl1vKv0TtmH5RJgOkwKmEi5yUL7pyhHLeGuDprtQmt2+l+hFn1xAEN7SHhrynUBFu4ZXfa18q1wcr83trbbl940OB3Xpcu6E2/QgWLAnSDioYyqQXaXXJ9HMddydbSHrYe4/yo2N3katZ3YuZQLZOyl/4eLduWN7jcKMexKU/eLl3Aa9+16mg/g4iMk1WbZTpKGL1GSwAQ==
GRAFANA_CLIENT_SECRET: AgCuqXVJoaIdMAoQTjSTLM1kVCvi5k+M8sVtg7cBGjMR2/Bry2FdU2fji/ND4A5w2FfSLLHOmC7J704krMzdKkH9+wsmhGoKbZG4Ur4ImBPiDdApE4JPOOrMWtpxnyGmNkPBv16ztmWj+3Q0pyo0fb1+0l2Gg9XnSG8O0vJXTt28IhfuROzh9r5rRaMilUKnIgEnWybgsPbxYUfqPJE7g5wvZIVxOcpiYlJxFC6MkjEkwkUO7TKCqSNbeSeRvhjRbxAd0ZHkrKGZ0LSLpKDBp7ZfRXBasuUy1sfhLTZNtGWS8YhC5YfoizUs13iafFE3acbkJz/DVJ8at0nsJKrxrfjYOv6kce9RSc4j41mBm8NTv8lhNc/qygxKu+BmNWi5go93PPpA1kno6OonwNNy36rSU0PyElXKUmMegsVXnu7sfDjQfld+VzJPQiDK6gdj090mJ7p2LyBmN1QbSJNvGQ0vNGvqxNjiXHlGantMaA/U6Od2B7AYHu447kJNHnya9KWel3eBWaLC12sfSEfwn5EmWe+7w0wyQd6Frgv9BP/EXQ35SQp7p2dA5WJxSI/2vtue98F3bfnvaJLLrPRiZg/Mqz4DSS875ojPtJc2iEyWprziHehk84zIDC/MuxhmJxj8Xh7zh/zHK6qdFEE8NKLtKlfpFbEzs/p2qtkzQUtCXm618rHOQ+7Rh7JI7u/P7tG11NWmKX15dbmT/Z20MLKsUXq+ymfT0nty8h0FbNAfXaiBENEDpMRCLNu+mCMND5nSqATghSvwFGMgaTbbu3OW99fpn/cK5iMNxXIunai7VA== GRAFANA_CLIENT_SECRET: AgCuqXVJoaIdMAoQTjSTLM1kVCvi5k+M8sVtg7cBGjMR2/Bry2FdU2fji/ND4A5w2FfSLLHOmC7J704krMzdKkH9+wsmhGoKbZG4Ur4ImBPiDdApE4JPOOrMWtpxnyGmNkPBv16ztmWj+3Q0pyo0fb1+0l2Gg9XnSG8O0vJXTt28IhfuROzh9r5rRaMilUKnIgEnWybgsPbxYUfqPJE7g5wvZIVxOcpiYlJxFC6MkjEkwkUO7TKCqSNbeSeRvhjRbxAd0ZHkrKGZ0LSLpKDBp7ZfRXBasuUy1sfhLTZNtGWS8YhC5YfoizUs13iafFE3acbkJz/DVJ8at0nsJKrxrfjYOv6kce9RSc4j41mBm8NTv8lhNc/qygxKu+BmNWi5go93PPpA1kno6OonwNNy36rSU0PyElXKUmMegsVXnu7sfDjQfld+VzJPQiDK6gdj090mJ7p2LyBmN1QbSJNvGQ0vNGvqxNjiXHlGantMaA/U6Od2B7AYHu447kJNHnya9KWel3eBWaLC12sfSEfwn5EmWe+7w0wyQd6Frgv9BP/EXQ35SQp7p2dA5WJxSI/2vtue98F3bfnvaJLLrPRiZg/Mqz4DSS875ojPtJc2iEyWprziHehk84zIDC/MuxhmJxj8Xh7zh/zHK6qdFEE8NKLtKlfpFbEzs/p2qtkzQUtCXm618rHOQ+7Rh7JI7u/P7tG11NWmKX15dbmT/Z20MLKsUXq+ymfT0nty8h0FbNAfXaiBENEDpMRCLNu+mCMND5nSqATghSvwFGMgaTbbu3OW99fpn/cK5iMNxXIunai7VA==
JELLYFIN_APP_PASSWORD: AgCzqHmMF80Bh4OcOl0OStJb/zQk0BKzCjIblpELwMLsAuBtIOO0OK/IYrjlCO0T8Vn9jd00LQI1m7R5d+vCxcwbQVNhyw1zHDFg1MI28irvdJmp7439Si7R/T+gObB1I2Vww8d9OZJj5Zm9ngQoM+Oh5ne7c/+W7Qc9xgpWBDtcseCX5QDA1Uu4TJH1cShDQMPb3+KLq7MlKgoWw5uJZA/dJspdR1eqFyaXGHh+rceMZmzwG8sNz43KtVWKN0u7KrN+OE9RYdreQGCw09Yet8FwYA4+z4pAFbOIhyCfqdEW0uWA95f9PA27Z7GgO/CG2vonv73V7nvItIArPchdzdMwD+/UimLllH70tPB6GfZqMsU4FnwdhAyl/UhVO4/PILNZFyyku3SfWtIc2GAf8w0i7KB/zSZoo+HdrGsG8i5020XOG9lIqH/vNTeU4zPBWROEtCKzPjmewBdR2CmGtDu4RrN3XHK5sljwXU3o5QucrD9k8RZ+TjQh6dk/cp373xB1ywMAF9+NmFalnIy4RXJSvjh2H5NLrFFty2vxLqsrVNYdlc8UjNOB06pCnugMBBCx9UIc92ntfoMCmdK7EsUguYB7KWbygbBMfVZ/PusWNMFpmqca5LzcQnoYVKtExRzfofftws9yd0zyQ1MnrEHAC28GlJjYKoIfP/8Tkvah68w9dIoiJ2cIgwkU41JiJ9tjRDIYdvIDBZUPKl3gDF6hbb1K+XbjrEHP5FAZ3Dul0uts2BxRbxBi
JELLYFIN_LDAP_PASSWORD: AgAmgR2Br9bWrqKtnUmcbicWUqVPcgVGLOgTkEhiC5rQPr2W/VXQDecb5ErIfl7XmvhyjMh/4lVymaUntpvD7tYGh0F5IeFTe9NVGL1ssanH7YqY4vQAfDdgQYOWUzl4cC5Lo79bUQcNk31YuJkqDlEiHXWv8W7u0L7X3ijbMvFcgkMwPgZuHPAwJGB9Uok2odtAeSCIQDZ/ri+TfSAqD4rBqKbvueP1o+bkNXN8qai1obvTtPH7NrTy4Qi0JAGQUu43RtTzjxoSaqr3Xq7Z9l+HvYJTxqRUhrNkME378OvNqcH6ob0J6siFyiMJnzfGw2BzhzJ11Y9PEVnzL8c3fC/VtF7bErhid/x9OzFf4qBs9ba1S/710P5BB1cqI8MmqGvc1vIHeH/J8AyWkbWGPqLdsqLZ4k5lcwDJ67R6RwMQIivc2oaUQJnBU2IEzT+EydAyzSMO/Obfc32UFuk64B0IigsXKii274r1tAxa3Ua8lvpi1rQkqhx6Fe8Nwkvxe116gLjWKqBiJ6dTPMuwvt3OkRjMpKBs9AH9V8t90lWqO4cBGd1kZYKTcAHyQkIM8XqIiOuwyzjuW8Kxjl7skT9DuV+X6GLWoUnZNpo16Vu4OUigWb7uuNuMcp1bI7fX0U0CR1H58h1dAUfLRGP06tOK8xakrmmsC/QCu8ErC2broAPOWKLsFQVRafiSjRcvQ7z2OcN/JHLAPeJUJcFVhdTJSpVQa41KW3MX9uFO8oXLLyQSrFFrKF7Y
WIREGUARD_CLIENT_SECRET: AgChVcZeF7KFvb0r9dkUg+53Rx7owhpI+ttOsTZ2Bd6h8Luike/g2Fj0wbBJqOeIqQIHGCHXB+lZ1wZHG8kL4BeDseMt5v22w8WOffZpfwcFtx9AYKjvKeNldFuFnaQjQbSigYJY1fFZXObn7tMB0zppSHb93G1q7r3/JsseXIrsBGFY2cHakE1gu+NC9glIdQLByxQzTrdHF/92bHsOcLa1Bqqtihxrfy2wBAykZloiyNIj+bhD1EIpCjHB2Dx5Cu5Sqz+lguHOIAs1jOaxA1NGjQJADo0+w5prtUhuB57nNHQrOLFzZyJqHr59ENYjsrz6jmroCuffbjyI0aKsCn/82oWfJzoSKvMGI9PnS9CzoGC+mKu2FWvDvdTvultGy0lk4m6pvNQIxUz+PPNUeagS43e6xiGgHKKaBZf0r5cWqFtbSrYl8hn0Fw7u3A0c+7N5/lx2//icrwFfajvF1Rguay1vvhKn1Wl9OSvo9F+Prtm85r4Gu4qsds42TpmTMr7d+fsL4hftGZg4KUdpqAca02uTURkS+3RiSYmTL/D9RrNy34oGuq8KkW4feLfHOub92J7GK/6febePsdyuTE6NCaikWekTPUEtmJAKMgRfZWkc2fL81pLT2QrMq/9DwTelrTLrAA8rtxT5TkN0aIfF+Gn3n1fOhTjYAqzMeKKRyrhODF8D+MKsi3knau2SFPDAJaXTvgInHImqtIL2RBtzv6DvIP8bUkaFLlMiOz0y5tcegzFcsp9HCQ8YjwQcJJb3tavZLe/VWJqOPrRP1+ti WIREGUARD_CLIENT_SECRET: AgChVcZeF7KFvb0r9dkUg+53Rx7owhpI+ttOsTZ2Bd6h8Luike/g2Fj0wbBJqOeIqQIHGCHXB+lZ1wZHG8kL4BeDseMt5v22w8WOffZpfwcFtx9AYKjvKeNldFuFnaQjQbSigYJY1fFZXObn7tMB0zppSHb93G1q7r3/JsseXIrsBGFY2cHakE1gu+NC9glIdQLByxQzTrdHF/92bHsOcLa1Bqqtihxrfy2wBAykZloiyNIj+bhD1EIpCjHB2Dx5Cu5Sqz+lguHOIAs1jOaxA1NGjQJADo0+w5prtUhuB57nNHQrOLFzZyJqHr59ENYjsrz6jmroCuffbjyI0aKsCn/82oWfJzoSKvMGI9PnS9CzoGC+mKu2FWvDvdTvultGy0lk4m6pvNQIxUz+PPNUeagS43e6xiGgHKKaBZf0r5cWqFtbSrYl8hn0Fw7u3A0c+7N5/lx2//icrwFfajvF1Rguay1vvhKn1Wl9OSvo9F+Prtm85r4Gu4qsds42TpmTMr7d+fsL4hftGZg4KUdpqAca02uTURkS+3RiSYmTL/D9RrNy34oGuq8KkW4feLfHOub92J7GK/6febePsdyuTE6NCaikWekTPUEtmJAKMgRfZWkc2fL81pLT2QrMq/9DwTelrTLrAA8rtxT5TkN0aIfF+Gn3n1fOhTjYAqzMeKKRyrhODF8D+MKsi3knau2SFPDAJaXTvgInHImqtIL2RBtzv6DvIP8bUkaFLlMiOz0y5tcegzFcsp9HCQ8YjwQcJJb3tavZLe/VWJqOPrRP1+ti
template: template:
metadata: metadata:
add-ons/cnpg/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- networkpolicy.yaml
add-ons/cnpg/networkpolicy.yaml
+41
View File
@@ -0,0 +1,41 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: cnpg
namespace: cnpg-system
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- ports:
- port: 8000
protocol: TCP
to:
- namespaceSelector: {}
podSelector:
matchExpressions:
- key: cnpg.io/cluster
operator: Exists
ingress:
- ports:
- port: 9443
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: cloudnative-pg
policyTypes:
- Ingress
- Egress
add-ons/postgres/kustomization.yaml
+1
View File
@@ -9,3 +9,4 @@ resources:
- pgweb-db-sealedsecret.yaml - pgweb-db-sealedsecret.yaml
- redoost-db-sealedsecret.yaml - redoost-db-sealedsecret.yaml
- redoost-database.yaml - redoost-database.yaml
- networkpolicy.yaml
add-ons/postgres/networkpolicy.yaml
+72
View File
@@ -0,0 +1,72 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: postgres
namespace: postgres
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- to:
- podSelector:
matchLabels:
cnpg.io/cluster: postgres
ingress:
- from:
- podSelector:
matchLabels:
cnpg.io/cluster: postgres
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: cnpg-system
podSelector:
matchLabels:
app.kubernetes.io/name: cloudnative-pg
ports:
- port: 8000
protocol: TCP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: authentik
podSelector:
matchLabels:
app.kubernetes.io/name: authentik
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: monitoring
podSelector:
matchLabels:
app.kubernetes.io/name: grafana
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: pgweb
podSelector:
matchLabels:
app.kubernetes.io/name: pgweb
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: redoost
ports:
- port: 5432
protocol: TCP
podSelector:
matchLabels:
cnpg.io/cluster: postgres
policyTypes:
- Ingress
- Egress
add-ons/traefik/kustomization.yaml
+2
View File
@@ -3,3 +3,5 @@ kind: Kustomization
resources: resources:
- wildcard-whyredfire-dev.yaml - wildcard-whyredfire-dev.yaml
- wildcard-whyredfire-dpdns-org.yaml - wildcard-whyredfire-dpdns-org.yaml
- wildcard-pixelos-net.yaml
- networkpolicy.yaml
add-ons/traefik/networkpolicy.yaml
+39
View File
@@ -0,0 +1,39 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: traefik
namespace: traefik
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- to:
- namespaceSelector: {}
ingress:
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 8000
protocol: TCP
- port: 8443
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: traefik
policyTypes:
- Ingress
- Egress
add-ons/traefik/wildcard-pixelos-net.yaml
+14
View File
@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: wildcard-pixelos-net
namespace: traefik
spec:
dnsNames:
- '*.pixelos.net'
issuerRef:
kind: ClusterIssuer
name: letsencrypt-prod
privateKey:
rotationPolicy: Always
secretName: wildcard-pixelos-net
apps/bentopdf/kustomization.yaml
+1
View File
@@ -4,3 +4,4 @@ resources:
- deployment.yaml - deployment.yaml
- service.yaml - service.yaml
- httproute.yaml - httproute.yaml
- networkpolicy.yaml
apps/bentopdf/networkpolicy.yaml
+21
View File
@@ -0,0 +1,21 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: bentopdf
namespace: bentopdf
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: bentopdf
policyTypes:
- Ingress
- Egress
apps/garage-ui/kustomization.yaml
+1
View File
@@ -4,3 +4,4 @@ resources:
- sealed-secret.yaml - sealed-secret.yaml
- middleware.yaml - middleware.yaml
- httproute.yaml - httproute.yaml
- networkpolicy.yaml
apps/garage-ui/networkpolicy.yaml
+40
View File
@@ -0,0 +1,40 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: garage-ui
namespace: garage
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 3903
protocol: TCP
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: garage
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: garage-ui
policyTypes:
- Ingress
- Egress
apps/garage/kustomization.yaml
+1
View File
@@ -4,3 +4,4 @@ resources:
- httproute-s3.yaml - httproute-s3.yaml
- sealed-secret.yaml - sealed-secret.yaml
- service-admin.yaml - service-admin.yaml
- networkpolicy.yaml
apps/garage/networkpolicy.yaml
+44
View File
@@ -0,0 +1,44 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: garage
namespace: garage
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: redoost
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: monitoring
podSelector:
matchLabels:
app.kubernetes.io/name: loki
ports:
- port: 3900
protocol: TCP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: redoost
ports:
- port: 3902
protocol: TCP
- from:
- podSelector:
matchLabels:
app.kubernetes.io/name: garage-ui
ports:
- port: 3903
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: garage
policyTypes:
- Ingress
- Egress
apps/holyarrs/deployment.yaml
+74
View File
@@ -0,0 +1,74 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: holyarrs
namespace: holyarrs
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: holyarrs
strategy:
type: Recreate
template:
metadata:
labels:
app.kubernetes.io/name: holyarrs
spec:
containers:
- env:
- name: TZ
value: Etc/UTC
- name: HOLYARRS_ALLOWED_HOSTS
value: holyarrs.whyredfire.dev
# Traefik's pods
- name: HOLYARRS_TRUSTED_PROXIES
value: 10.42.0.0/16
image: holyarrs/holyarrs:1.0.9@sha256:3d941aa8a78d4474cc016a0d994b2531aa8692015aaad487cbdee136e8dd4226
livenessProbe:
httpGet:
path: /healthz
port: http
initialDelaySeconds: 10
periodSeconds: 30
name: holyarrs
ports:
- containerPort: 6262
name: http
readinessProbe:
httpGet:
path: /healthz
port: http
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 50m
memory: 192Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /config
name: config
# Same path as Jellyfin; one mount so imports hardlink instead of copy
- mountPath: /media
name: media
# Owner of /srv/media, same as qBittorrent
securityContext:
fsGroup: 1000
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
volumes:
- name: config
persistentVolumeClaim:
claimName: holyarrs-config
- hostPath:
path: /srv/media
name: media
apps/holyarrs/httproute.yaml
+23
View File
@@ -0,0 +1,23 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
annotations:
argocd.argoproj.io/sync-wave: "2"
name: holyarrs
namespace: holyarrs
spec:
hostnames:
- holyarrs.whyredfire.dev
parentRefs:
- kind: Gateway
name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
- backendRefs:
- name: holyarrs
port: 6262
matches:
- path:
type: PathPrefix
value: /
apps/holyarrs/kustomization.yaml
+8
View File
@@ -0,0 +1,8 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- deployment.yaml
- service.yaml
- httproute.yaml
- networkpolicy.yaml
apps/holyarrs/networkpolicy.yaml
+62
View File
@@ -0,0 +1,62 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: holyarrs
namespace: holyarrs
spec:
# Metadata and indexers are on the internet; in the cluster it only talks
# to Jellyfin and qBittorrent
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 8096
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: jellyfin
podSelector:
matchLabels:
app.kubernetes.io/name: jellyfin
- ports:
- port: 8080
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: qbit
podSelector:
matchLabels:
app.kubernetes.io/name: qbittorrent
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 6262
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: holyarrs
policyTypes:
- Ingress
- Egress
apps/holyarrs/pvc.yaml
+11
View File
@@ -0,0 +1,11 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: holyarrs-config
namespace: holyarrs
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
apps/holyarrs/service.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: v1
kind: Service
metadata:
name: holyarrs
namespace: holyarrs
spec:
ports:
- name: http
port: 6262
targetPort: http
selector:
app.kubernetes.io/name: holyarrs
apps/jellyfin/kustomization.yaml
+2
View File
@@ -3,3 +3,5 @@ kind: Kustomization
resources: resources:
- httproute-local.yaml - httproute-local.yaml
- httproute.yaml - httproute.yaml
- networkpolicy-holyarrs.yaml
- networkpolicy-ldap.yaml
apps/jellyfin/networkpolicy-holyarrs.yaml
+25
View File
@@ -0,0 +1,25 @@
# Lets HolyArrs ask Jellyfin to rescan after imports and sign people in.
# Adds to the chart's policy, which only admits traefik.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: jellyfin-from-holyarrs
namespace: jellyfin
spec:
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: holyarrs
podSelector:
matchLabels:
app.kubernetes.io/name: holyarrs
ports:
- port: 8096
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: jellyfin
app.kubernetes.io/instance: jellyfin
policyTypes:
- Ingress
apps/jellyfin/networkpolicy-ldap.yaml
+25
View File
@@ -0,0 +1,25 @@
# Lets Jellyfin's LDAP plugin reach authentik's LDAP outpost (LDAPS).
# Adds to the chart's policy, which keeps Jellyfin off the cluster network.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: jellyfin-to-ldap
namespace: jellyfin
spec:
egress:
- ports:
- port: 6636
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: authentik
podSelector:
matchLabels:
goauthentik.io/outpost-name: ldap
podSelector:
matchLabels:
app.kubernetes.io/name: jellyfin
app.kubernetes.io/instance: jellyfin
policyTypes:
- Egress
apps/qbit/kustomization.yaml
+1
View File
@@ -7,3 +7,4 @@ resources:
- service.yaml - service.yaml
- middleware.yaml - middleware.yaml
- httproute.yaml - httproute.yaml
- networkpolicy.yaml
apps/qbit/networkpolicy.yaml
+39
View File
@@ -0,0 +1,39 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: qbittorrent
namespace: qbit
spec:
egress:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
# HolyArrs sends releases and follows downloads through the Web API
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: holyarrs
podSelector:
matchLabels:
app.kubernetes.io/name: holyarrs
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: qbittorrent
policyTypes:
- Ingress
- Egress
apps/rustbin/kustomization.yaml
+1
View File
@@ -5,3 +5,4 @@ resources:
- deployment.yaml - deployment.yaml
- service.yaml - service.yaml
- httproute.yaml - httproute.yaml
- networkpolicy.yaml
apps/rustbin/networkpolicy.yaml
+21
View File
@@ -0,0 +1,21 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: rustbin
namespace: rustbin
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 3000
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: rustbin
policyTypes:
- Ingress
- Egress
apps/wireguard/kustomization.yaml
+1
View File
@@ -7,3 +7,4 @@ resources:
- service.yaml - service.yaml
- service-admin.yaml - service-admin.yaml
- httproute.yaml - httproute.yaml
- networkpolicy.yaml
apps/wireguard/networkpolicy.yaml
+60
View File
@@ -0,0 +1,60 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: wireguard
namespace: wireguard
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 8000
protocol: TCP
- port: 8443
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
podSelector:
matchLabels:
app.kubernetes.io/name: traefik
- to:
- ipBlock:
cidr: 192.168.2.0/24
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 27299
protocol: UDP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 51821
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: wireguard
policyTypes:
- Ingress
- Egress
argocd-apps/add-ons/alloy.yaml
+27
View File
@@ -15,6 +15,33 @@ spec:
chart: alloy chart: alloy
helm: helm:
values: | values: |
# Discovers pods through the API and pushes their logs to Loki
networkPolicy:
enabled: true
ingress: []
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- ports:
- port: 3100
protocol: TCP
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: loki
alloy: alloy:
configMap: configMap:
content: | content: |
argocd-apps/add-ons/argocd-image-updater.yaml
+35
View File
@@ -0,0 +1,35 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "1"
name: argocd-image-updater
namespace: argocd
spec:
destination:
namespace: argocd
server: https://kubernetes.default.svc
project: default
sources:
- chart: argocd-image-updater
repoURL: https://argoproj.github.io/argo-helm
targetRevision: 1.4.0
helm:
values: |
resources:
limits:
cpu: 200m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
- path: add-ons/argocd-image-updater
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- ServerSideApply=true
argocd-apps/add-ons/authentik.yaml
+1
View File
@@ -32,6 +32,7 @@ spec:
- blueprint-garage-ui - blueprint-garage-ui
- blueprint-google-login - blueprint-google-login
- blueprint-grafana - blueprint-grafana
- blueprint-jellyfin-ldap
- blueprint-outpost - blueprint-outpost
- blueprint-pgweb - blueprint-pgweb
- blueprint-qbittorrent - blueprint-qbittorrent
argocd-apps/add-ons/cert-manager.yaml
+18
View File
@@ -29,7 +29,18 @@ spec:
requests: requests:
cpu: 10m cpu: 10m
memory: 64Mi memory: 64Mi
# The chart's egress fits the controller: ACME and Cloudflare on 443,
# DNS-01 propagation checks on 53, and the API on 6443
networkPolicy:
enabled: true
cainjector: cainjector:
# Only talks to the API
networkPolicy:
enabled: true
egress:
- ports:
- port: 6443
protocol: TCP
resources: resources:
limits: limits:
cpu: 200m cpu: 200m
@@ -38,6 +49,13 @@ spec:
cpu: 10m cpu: 10m
memory: 64Mi memory: 64Mi
webhook: webhook:
# Only talks to the API
networkPolicy:
enabled: true
egress:
- ports:
- port: 6443
protocol: TCP
resources: resources:
limits: limits:
cpu: 200m cpu: 200m
argocd-apps/add-ons/cnpg.yaml
+19 -16
View File
@@ -11,22 +11,25 @@ spec:
namespace: cnpg-system namespace: cnpg-system
server: https://kubernetes.default.svc server: https://kubernetes.default.svc
project: default project: default
source: sources:
chart: cloudnative-pg - chart: cloudnative-pg
helm: helm:
values: | values: |
replicaCount: 1 replicaCount: 1
config: config:
clusterWide: true clusterWide: true
resources: resources:
limits: limits:
cpu: 500m cpu: 500m
memory: 256Mi memory: 256Mi
requests: requests:
cpu: 10m cpu: 10m
memory: 64Mi memory: 64Mi
repoURL: https://cloudnative-pg.github.io/charts repoURL: https://cloudnative-pg.github.io/charts
targetRevision: 0.29.1 targetRevision: 0.29.1
- path: add-ons/cnpg
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
syncPolicy: syncPolicy:
automated: automated:
prune: true prune: true
argocd-apps/add-ons/kube-prometheus-stack.yaml
+56
View File
@@ -47,6 +47,9 @@ spec:
kubeStateMetrics: kubeStateMetrics:
enabled: false enabled: false
prometheusOperator: prometheusOperator:
# The chart's policy only limits ingress to the webhook; egress stays open
networkPolicy:
enabled: true
admissionWebhooks: admissionWebhooks:
certManager: certManager:
enabled: true enabled: true
@@ -96,6 +99,38 @@ spec:
cpu: 20m cpu: 20m
memory: 32Mi memory: 32Mi
prometheus: prometheus:
# Only Grafana queries it; it scrapes the kubelet and node-exporter on the
# node, matched by port so no node IP is needed
networkPolicy:
enabled: true
ingress:
- from:
- podSelector:
matchLabels:
app.kubernetes.io/name: grafana
ports:
- port: 9090
protocol: TCP
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- port: 9100
protocol: TCP
- port: 10250
protocol: TCP
serviceMonitor: serviceMonitor:
selfMonitor: false selfMonitor: false
prometheusSpec: prometheusSpec:
@@ -124,6 +159,27 @@ spec:
requests: requests:
storage: 50Gi storage: 50Gi
grafana: grafana:
# The chart takes one list of egress ports for every destination: OIDC
# on 443, Loki, Postgres, the API for the sidecars, and Prometheus
networkPolicy:
enabled: true
allowExternal: false
explicitNamespacesSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
egress:
enabled: true
ports:
- port: 443
protocol: TCP
- port: 3100
protocol: TCP
- port: 5432
protocol: TCP
- port: 6443
protocol: TCP
- port: 9090
protocol: TCP
admin: admin:
existingSecret: grafana-admin existingSecret: grafana-admin
additionalDataSources: additionalDataSources:
argocd-apps/add-ons/kustomization.yaml
+1
View File
@@ -3,6 +3,7 @@ kind: Kustomization
resources: resources:
- alloy.yaml - alloy.yaml
- argocd-dashboard.yaml - argocd-dashboard.yaml
- argocd-image-updater.yaml
- authentik.yaml - authentik.yaml
- cert-manager.yaml - cert-manager.yaml
- cnpg.yaml - cnpg.yaml
argocd-apps/add-ons/loki.yaml
+9
View File
@@ -15,6 +15,15 @@ spec:
- chart: loki - chart: loki
helm: helm:
values: | values: |
# Garage on 3900; the rules sidecar watches the API, which only the
# discovery port can allow
networkPolicy:
enabled: true
externalStorage:
ports:
- 3900
discovery:
port: 6443
loki: loki:
auth_enabled: false auth_enabled: false
commonConfig: commonConfig:
argocd-apps/add-ons/sealed-secrets.yaml
+7
View File
@@ -16,6 +16,13 @@ spec:
helm: helm:
values: | values: |
keyrenewperiod: "0" keyrenewperiod: "0"
# The API is reached by port alone, so the policy doesn't depend on the node's IP
networkPolicy:
enabled: true
egress:
enabled: true
kubeapiCidr: 0.0.0.0/0
kubeapiPort: 6443
resources: resources:
limits: limits:
cpu: 200m cpu: 200m
argocd-apps/add-ons/traefik.yaml
+14
View File
@@ -15,6 +15,9 @@ spec:
- chart: traefik - chart: traefik
helm: helm:
values: | values: |
# The network policy allows no internet egress
global:
checkNewVersion: false
# Query strings are dropped, as OAuth callbacks carry codes. # Query strings are dropped, as OAuth callbacks carry codes.
accessLog: accessLog:
enabled: true enabled: true
@@ -61,6 +64,17 @@ spec:
- kind: Secret - kind: Secret
name: wildcard-whyredfire-dpdns-org name: wildcard-whyredfire-dpdns-org
group: "" group: ""
websecure-pixelos:
port: 8443
protocol: HTTPS
mode: Terminate
hostname: "*.pixelos.net"
namespacePolicy:
from: All
certificateRefs:
- kind: Secret
name: wildcard-pixelos-net
group: ""
resources: resources:
limits: limits:
cpu: 1000m cpu: 1000m
argocd-apps/apps/applications-repo-sealedsecret.yaml
+17
View File
@@ -0,0 +1,17 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: applications-repo
namespace: argocd
spec:
encryptedData:
sshPrivateKey: AgDIXYZfl1u4KR4YgGx8XHpiM1MXnvv39MJV07StKwk2LCsCamL31HDzaA34L5VV5wsnLEgx1CR7i9WMEd6lUyuQWG4YGI4JUgcYV8clMpu/Ih64io2rWs7TTLs1FUqrkLvGwx6aCVFYNQMOnDpY5+RJ63WC8JTM/z0rr16F/47d1BKrW0WVaEZcyy+AT1wG8Y+R7qNDxqND9W7X3+sQfBP+nI2WiTplDe3vbk6WTolKpofME+x6u70j2JpP2rfIhnttNv88qiM9CNssHqxQ4TlH1BNrI2SdnLwX6bWLvCqVKrj8TAh18yZzrkYy1wwI+4ZKCcTSUNsKgtwrrj/BmPEmQsxJ241e/uZzRyuT+VdOls2gtdpc1gz/sxlgRNALZd/BQcYq/XV3pe07STujqXoZgNjC92vRrVY6wPdycCmKHrGSyhN34KdqTi9lfrYc0MtI0c0T0BgXt+ButNKfSHt/2m4SZ8HGne22b3pIltsJP58R8XtomTbHa9VFfTWfiEhuKpwWzM/UsDo7PYhd+TdZFkTj9zfUrR1JluJLuFknUp3hpsU1F1HSyXLGtVmdKb+nD/7n4RTP3zGWNZfCRG3PqsAgR2TBwPKo+7RTq5B1BPqNXjoEWaI3P+divrkZT1PooqHuLEWJOr+68azSy04AnlhBzI06w/FZIgMSjV4adqizFlVBR5BTQgQULDSISYlMRoQz2Z1HUXr9JbqEZBHTwmcSgNilagKYM7dE5mLNXswys4IvlG+SxzDHgTCQH+7ZRS3n2prIZRWqHHhh1EcE7FChvN13HnzwY5PtHi8AQje6dRxCxliQ/nRrjhRQRM+4XQj4bI6wT+kSCjM71hTe/Zg7WguNoyc8Jt105X2YApFTCu6AIBNi5vGIqWXfAofoDvrBM2Flu0kVnbwOCrShh3SXuO/wr8mAdZC1DfbRNFnPNog0Iav4t2iju25YEk1a0SczpyjqVyJRU0IaZx21Ean0B/EweNCC3qt5++mVveuxSfOLJOnX/0mOkwNeJS/6jxiCU4IijDwUEW4FLMiz5yOXM3ktnNdPkauD9IP7py/kmdjgXSjwBr0mSRmzyQe8QaYUIsX15pZoiIdDcrCX8pf5ftzzxxB145SBajQW9YmAIh4DrtrGCpGYTWjd9AVEUYEIh3P0lxN/KtXQdsZvYK5/Gjb2MAeoFXlaussHTWNlULHEo7PDgIyE0oeeXN9qcbU/EJ4H47z9JOTFhVqLWdYECv1ueamHVAZ5CVQDQdQWBqVlOwX2ltM2g84GCiLMIng7WopZtDujMp1bwT3zzTblYXfx0gk6Gp1nNlGOHw==
type: AgA4zCPMAfGwpRf7SNkANByWaxs64jB7YKBTbb5Q1y+UF1u+/tEuYYAFySGRRffLPxjXWutwkcCJvzCaJn4v0KaUCT05HAyRPILgE9aNxa3NIAz80hkTBPDInakvrUq6AysKKHl5TvMsd6YCI40EM2aVrUYcEAwaNycFMaYQNXrfJeJdrSBjgLPqWLudos2e9U1yC8vqrfaCDnTCQitgxfVkD7YNhtfpKWUnMOdO2GDx+yOfom4KxUWSwnfvbXOgA+xmCYqpJ96TCEg6Jar5xcGsZuEluS8cMrbw+tSUqfsGYpmA4Q9KllloFTmNZrUi49R5MgE9dU5i7+WmOX6RbbSfI2scVACvnzYA7yKQMXI58ngwtTB/yYM24/ylV+6ltl2n8XDXSMJ7qZ8h4QJ0IOPAuehQTYy+SQLaVKYdfKzUoSi2mA+CHH948Ul6KbNiCbhv4AptlV4amg1PDITz4YmtOWh0rO9PxQFN92FY6dScoDSyACon1nniE9p2k/fF9AsagDoBLl+h66mreHH8KlzjlmsVTuq2Wdn9sCZKw0EfyH8u78Th8Kj7/tpAEKmjvt81YM6miZGgOT71Vg/ttluLqetud98rz/G7wLPKsonFGvrBCVvmJ+cSYs6jp/HNAY5pN30A0515vRutXDeo7Q0UUoOwxGdFRd//lptKZus/WrvyzBqKmGzArn9CLjWqpLA0Jtg=
url: AgBjKOHHrbW6YouHDudb2TOBBqQnvsK1FAZG+matWvjJcdCDzEHaX5libU103q9dAMzrEizYrRcy0TxPVn8frwblRcdOvRXL4RDzSaLxS5vnWW/pfCjk9O3imwG987jy1qiRgsiqXNDhaiNor0KCak/9oYiNjhwVzqmQJW3A6lyjwjYZO+1piNeQGn5oO1mIBJnz/dNw6lrtevSG5B785h9Jpo3n2UUbvFgOcPT4lOOxpWBETAvIo5o5fy4AdfKwHCBfm/GpAsXWyNV3bop6h117NVsXc+ysigjC0NIjCobf03J5EA9H1f/byuSyiUDsI1LVAtw+0YlUSvAXGYwVnnCLqxJDkIkrXlVtF18+kR9ktavm1Xkq2eIeL32yJ/v+WTcT9ilOhwEdfHin89l5Qhv4/VJL2CWlpllpZnHvgyD8RjeI0liW4v3HKZkiHbXmthNNrdCinJQJWpsvZBGC41NHYtFXd18i/iu29MwZ6Z7+dR/i5QHF/PxH3OH4ZB58Khuy7Y2BbKNK/KBVjV3Hm4hzHXtbEawPI4SOSyhgqTeD3eh2O5Xs7PQFkgbZzO2vOIRtRxO3F5oJOdGUhjWCLpi+gqcQhHsVodM+hYkVFsYMGBbGHKdGBX78e2q3QHBNSpyDLyoR5TOw6BzQG+C+oqlbcMwF+fkMzPT6nRbKmKtEdFqFZAW2Y6RA3jYf5Fn870wayZ/Hj5j8vhpcR6LW5DKamFkcGSZ7+ugAHEo9Tsx8xMfMaFqU1KeTUOI=
template:
metadata:
labels:
argocd.argoproj.io/secret-type: repository
name: applications-repo
namespace: argocd
argocd-apps/apps/holyarrs.yaml
+24
View File
@@ -0,0 +1,24 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "3"
name: holyarrs
namespace: argocd
spec:
destination:
namespace: holyarrs
server: https://kubernetes.default.svc
project: default
source:
path: apps/holyarrs
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- ServerSideApply=true
argocd-apps/apps/jellyfin.yaml
+22
View File
@@ -30,6 +30,28 @@ spec:
enabled: true enabled: true
type: hostPath type: hostPath
hostPath: /srv/media hostPath: /srv/media
# Metadata, artwork, and subtitles come from the internet; the
# cluster and the LAN stay off limits
networkPolicy:
enabled: true
ingress:
allowExternal: false
namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
egress:
allowAllEgress: false
restrictedEgress:
allowMetadata: false
allowInCluster: false
customRules:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
resources: resources:
limits: limits:
cpu: 3000m cpu: 3000m
argocd-apps/apps/kustomization.yaml
+3
View File
@@ -1,12 +1,15 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- applications-repo-sealedsecret.yaml
- bentopdf.yaml - bentopdf.yaml
- betterslcm.yaml - betterslcm.yaml
- garage.yaml - garage.yaml
- garage-ui.yaml - garage-ui.yaml
- holyarrs.yaml
- jellyfin.yaml - jellyfin.yaml
- pgweb.yaml - pgweb.yaml
- pixelos-applications.yaml
- qbit.yaml - qbit.yaml
- redoost.yaml - redoost.yaml
- rustbin.yaml - rustbin.yaml
argocd-apps/apps/pixelos-applications.yaml
+24
View File
@@ -0,0 +1,24 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "3"
name: pixelos-applications
namespace: argocd
spec:
destination:
namespace: pixelos
server: https://kubernetes.default.svc
project: default
source:
path: k8s
repoURL: [email protected]:PixelOS-CI/applications.git
targetRevision: main
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- ServerSideApply=true
argocd-apps/apps/redoost.yaml
+6
View File
@@ -18,6 +18,12 @@ spec:
helm: helm:
values: | values: |
appOrigin: https://redoost.whyredfire.dev appOrigin: https://redoost.whyredfire.dev
api:
image:
tag: latest
frontend:
image:
tag: latest
sitesOrigin: https://whyredfire.dpdns.org sitesOrigin: https://whyredfire.dpdns.org
httpRoute: httpRoute:
annotations: annotations: