whyredfire/gitops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: whyredfire/gitops:main
Branches Tags
whyredfire/gitops:main whyredfire/gitops:feat/sync-waves
..
compare: whyredfire/gitops:2c9999600c989b21c6e4b603a4fa958430154c0c
Branches Tags
whyredfire/gitops:main whyredfire/gitops:feat/sync-waves
2 Commits
main .. 2c9999600c
Author SHA1 Message Date
whyredfire 2c9999600c feat(argocd): Disable local admin account 2026-09-25 02:16:04 +05:30
whyredfire 953bfca47d chore(apps): Remove anubis from argocd, garage-ui and redoost 2026-09-25 01:52:29 +05:30
142 changed files with 462 additions and 3163 deletions
Expand all files Collapse all files
README.md
-40
View File
@@ -1,40 +0,0 @@
# gitops
Argo CD manifests for a single-node k3s cluster.
## Node configuration
These live on the node, not in this repo, so reapply them when rebuilding it.
### k3s
The bundled Traefik is replaced by the Argo CD-managed one, which is exposed
via `externalIPs` rather than ServiceLB. Control-plane metrics endpoints are
exposed for Prometheus:
```yaml
# /etc/rancher/k3s/config.yaml
disable:
- traefik
- servicelb
kube-controller-manager-arg:
- bind-address=0.0.0.0
kube-scheduler-arg:
- bind-address=0.0.0.0
kube-proxy-arg:
- metrics-bind-address=0.0.0.0
```
### Image garbage collection
Kubelet only prunes images once the disk crosses 85%, so unused images pile up
on a large disk. Also expire images that haven't been used in 7 days:
```yaml
# /var/lib/rancher/k3s/agent/etc/kubelet.conf.d/50-image-gc.conf
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
imageMaximumGCAge: 168h
```
Apply with `sudo systemctl restart k3s`.
add-ons/argocd-dashboard/oidc-sealedsecret.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: argocd-oidc
namespace: argocd
spec:
encryptedData:
clientSecret: AgBqp25ilSAdFoj5LmPESSi/5Gq/Cai4vmZs1czKXmohOAMq7HIRO+fLWn+wU5B7R44s0kQ2Xw1ohF2hzTVljsK31PIdYNLbblfxYduKIJLCW1Um3/fCyYC6WSAFlZnaEn1iGghvR468Bsh8KT3OFIx3R6L5fu1dJ3t7JYE557GtkLbD7EWD70q57itUa+2OdL+1XdvSXOrqSVYjBcFdbxTRTUtvh8LR9J0Mg+uRYsk17UInfCqT3FRQtwRGQMQs+UX/4AuKzyTjw60w2lcfIsm/SBGvG/72FENUt46XGALoXmj3h4DaZBCH0j2LHWi3c+1psKTEXner5jw00Xa3eNOBKoDwIoEOIyGjIrhLf60d9Gm9Fp1weqcf8JTJdO3sXd4RXleUT+2zsu4vIeIXShXgCC/dz03kSXpPcM4/4XG/hWfu7Xgffc72Erdqbwj2SFpksVTQp1mWrhVu01qB45AwcaySpUovdYEm4DWhq7eB91sk8zhmHCNaDosnOlSjd1UD63L9Rg4y+objdVNEKODhFueSWh/Lb2wDQIxq3dR8Apy0cqSmrJ8QrJV8eAtsupHfn7Hg2zTvIM4jnKV8zQ+Jiut+Kpb+pC8jlcJPRfp6k3lpUjP9t95q+T8CVfvCMyEw8u0w9OUpGhozUMbW/BlP6tsWaJWKLnocIROxYPh3Rf4UtJ8Ol3qEW3Wkc+i6FyrIUlEGkQAad7USrADTx14Ge/XfZ6KO+Yt3FgyS8884u9dH8egkcEYZbHiZweAAd552JwIZn8gj7oUPxq8UQtNK
template:
metadata:
labels:
app.kubernetes.io/part-of: argocd
name: argocd-oidc
namespace: argocd
add-ons/argocd-image-updater/ghcr-sealedsecret.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: ghcr-pull
namespace: argocd
spec:
encryptedData:
.dockerconfigjson: AgCRsZSHP+T0U4pLck8AJ++dCb47OklXOgediZXPUSENy2/W/o4ooDgr+vP9GmSMoSm/5FBahmiSF8WYth0TYL4bdTKMQfnFO4kAOxk5QXuyyaKL+ZxL3XFfKRUeVD4m+HFJrvUsHC36TeJy0SYwkaS5isWdNTPFPdNRhXQ9OiTKQlL2tPZgOzk48CH5wDCugI3uC6/1tuzoeNzbIWRFpbkDtwhdGBqnZIiZZhOliXBV5wGnEcPKpxBnE21PNBsr2A8/lisuTsmcsyZDj3uenLjcdITdTs57sss8HPEI9u+cIuNFCZVO/URtJEV1k24oEr3CAPJojic6vT6jS0Ow9H3VEJpEObAN4E02+yC/gZjkLOBSO9aq77SzVRJpTxmcuW4s2U91hegYzS33H0jBCB1EJ5y/rYZUFrdBQnr16gENbMo8HuYf0jnogDvyGjd4Kf4HWDl97yiOv2xdm7Jb3MBrgyCQSw2uU4QpvgwGpTCo8j3LrfqQjBZRyTn/HplLO+zGkQKcqsNosZ0a+fm990gDWEgBuNjf/2iVLsYMJrz8da3Fu4k2TTtzxtAZ0eFJbxa97CRC3d/4nx/vS/S3zTzoXhp2XHdlG3RfurrKKtxeretRlTtbTM8CjahMB0/oLgBKSaNs5gEtvaATKe8jBfAw+WHxCFJC+0Jxj8IfDq0KWv2I1OO2r+7TK+o2Ed/7SucJQd4e4NQJfWQW/xiq4RL3StJdO3WXcICloslTMtE9EaZn/w/dx98bLRus9mrkom+tPSHw63tHPn6C4B75Ya8qA5LSBylMEZXg8CG5xfqmR3C0F/c4XCYerfbzNg88AIw2VBsAgW6aySCkZCa9rkaCx5AyzblCVQxGZ+PpR0RdaBkuT2hXoWHBZZu9Dmhk6Qr1HyqCBaV2DmsYFcYB+pfHUKzT0BAWO7BdbiLFil0V779JZw==
template:
metadata:
name: ghcr-pull
namespace: argocd
type: kubernetes.io/dockerconfigjson
add-ons/argocd-image-updater/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ghcr-sealedsecret.yaml
- pixelos-applications.yaml
- redoost.yaml
add-ons/argocd-image-updater/pixelos-applications.yaml
-16
View File
@@ -1,16 +0,0 @@
apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
name: pixelos-applications
namespace: argocd
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
spec:
applicationRefs:
- namePattern: pixelos-applications
images:
- alias: app
imageName: ghcr.io/pixelos-ci/applications:latest
commonUpdateSettings:
updateStrategy: digest
pullSecret: pullsecret:argocd/ghcr-pull
add-ons/argocd-image-updater/redoost.yaml
-27
View File
@@ -1,27 +0,0 @@
apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
name: redoost
namespace: argocd
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
spec:
applicationRefs:
- namePattern: redoost
images:
- alias: api
imageName: ghcr.io/whyredfire/redoost-api:latest
commonUpdateSettings:
updateStrategy: digest
manifestTargets:
helm:
name: api.image.repository
tag: api.image.tag
- alias: frontend
imageName: ghcr.io/whyredfire/redoost-frontend:latest
commonUpdateSettings:
updateStrategy: digest
manifestTargets:
helm:
name: frontend.image.repository
tag: frontend.image.tag
add-ons/authentik/blueprint-argocd.yaml
-51
View File
@@ -1,51 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: blueprint-argocd
namespace: authentik
data:
argocd.yaml: |
version: 1
metadata:
name: ArgoCD
entries:
- model: authentik_providers_oauth2.oauth2provider
id: argocd-provider
identifiers:
name: argocd
attrs:
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
client_type: public
client_id: argocd
grant_types:
- authorization_code
- refresh_token
redirect_uris:
- matching_mode: strict
url: https://argo.whyredfire.dev/auth/callback
- matching_mode: strict
url: https://argo.whyredfire.dev/pkce/verify
- matching_mode: strict
url: http://localhost:8085/auth/callback
- matching_mode: strict
url: argocd://auth/callback
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
property_mappings:
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
- model: authentik_core.application
id: argocd
identifiers:
slug: argocd
attrs:
name: ArgoCD
provider: !KeyOf argocd-provider
meta_launch_url: https://argo.whyredfire.dev
- model: authentik_policies.policybinding
identifiers:
order: 0
target: !KeyOf argocd
attrs:
group: !Find [authentik_core.group, [name, admins]]
add-ons/authentik/blueprint-garage-ui.yaml
-33
View File
@@ -1,33 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: blueprint-garage-ui
namespace: authentik
data:
garage-ui.yaml: |
version: 1
metadata:
name: Garage UI
entries:
- model: authentik_providers_proxy.proxyprovider
id: garage-ui-provider
identifiers:
name: garage-ui
attrs:
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
mode: forward_single
external_host: https://garage.whyredfire.dev
- model: authentik_core.application
id: garage-ui
identifiers:
slug: garage-ui
attrs:
name: Garage UI
provider: !KeyOf garage-ui-provider
- model: authentik_policies.policybinding
identifiers:
order: 0
target: !KeyOf garage-ui
attrs:
group: !Find [authentik_core.group, [name, admins]]
add-ons/authentik/blueprint-grafana.yaml
-38
View File
@@ -1,38 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: blueprint-grafana
namespace: authentik
data:
grafana.yaml: |
version: 1
metadata:
name: Grafana
entries:
- model: authentik_providers_oauth2.oauth2provider
id: grafana-provider
identifiers:
name: grafana
attrs:
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
client_id: grafana
client_secret: !Env GRAFANA_CLIENT_SECRET
grant_types:
- authorization_code
- refresh_token
redirect_uris:
- matching_mode: strict
url: https://grafana.whyredfire.dev/login/generic_oauth
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
property_mappings:
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
- model: authentik_core.application
identifiers:
slug: grafana
attrs:
name: Grafana
provider: !KeyOf grafana-provider
meta_launch_url: https://grafana.whyredfire.dev
add-ons/authentik/blueprint-outpost.yaml
-34
View File
@@ -1,34 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: blueprint-outpost
namespace: authentik
data:
outpost.yaml: |
version: 1
metadata:
name: Embedded outpost
entries:
- model: authentik_blueprints.metaapplyblueprint
attrs:
identifiers:
path: mounted/cm-blueprint-garage-ui/garage-ui.yaml
required: true
- model: authentik_blueprints.metaapplyblueprint
attrs:
identifiers:
path: mounted/cm-blueprint-pgweb/pgweb.yaml
required: true
- model: authentik_blueprints.metaapplyblueprint
attrs:
identifiers:
path: mounted/cm-blueprint-qbittorrent/qbittorrent.yaml
required: true
- model: authentik_outposts.outpost
identifiers:
managed: goauthentik.io/outposts/embedded
attrs:
providers:
- !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]]
- !Find [authentik_providers_proxy.proxyprovider, [name, pgweb]]
- !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]]
add-ons/authentik/blueprint-pgweb.yaml
-33
View File
@@ -1,33 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: blueprint-pgweb
namespace: authentik
data:
pgweb.yaml: |
version: 1
metadata:
name: pgweb
entries:
- model: authentik_providers_proxy.proxyprovider
id: pgweb-provider
identifiers:
name: pgweb
attrs:
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
mode: forward_single
external_host: https://pgweb.whyredfire.dev
- model: authentik_core.application
id: pgweb
identifiers:
slug: pgweb
attrs:
name: pgweb
provider: !KeyOf pgweb-provider
- model: authentik_policies.policybinding
identifiers:
order: 0
target: !KeyOf pgweb
attrs:
group: !Find [authentik_core.group, [name, admins]]
add-ons/authentik/blueprint-qbittorrent.yaml
-33
View File
@@ -1,33 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: blueprint-qbittorrent
namespace: authentik
data:
qbittorrent.yaml: |
version: 1
metadata:
name: qBittorrent
entries:
- model: authentik_providers_proxy.proxyprovider
id: qbittorrent-provider
identifiers:
name: qbittorrent
attrs:
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
mode: forward_single
external_host: https://qbit.whyredfire.dev
- model: authentik_core.application
id: qbittorrent
identifiers:
slug: qbittorrent
attrs:
name: qBittorrent
provider: !KeyOf qbittorrent-provider
- model: authentik_policies.policybinding
identifiers:
order: 0
target: !KeyOf qbittorrent
attrs:
group: !Find [authentik_core.group, [name, admins]]
add-ons/authentik/blueprint-wireguard-admin.yaml
-60
View File
@@ -1,60 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: blueprint-wireguard-admin
namespace: authentik
data:
wireguard-admin.yaml: |
version: 1
metadata:
name: WireGuard admin
entries:
# wg-easy requires email_verified, which the default mapping sends as false.
- model: authentik_providers_oauth2.scopemapping
id: verified-email
identifiers:
name: wireguard-admin email
attrs:
scope_name: email
expression: |
return {
"email": request.user.email,
"email_verified": True,
}
- model: authentik_providers_oauth2.oauth2provider
id: wireguard-admin-provider
identifiers:
name: wireguard-admin
attrs:
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
client_id: wireguard-admin
client_secret: !Env WIREGUARD_CLIENT_SECRET
grant_types:
- authorization_code
- refresh_token
redirect_uris:
- matching_mode: strict
url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
- matching_mode: strict
url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
property_mappings:
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
- !KeyOf verified-email
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
- model: authentik_core.application
id: wireguard-admin
identifiers:
slug: wireguard-admin
attrs:
name: WireGuard Admin
provider: !KeyOf wireguard-admin-provider
meta_launch_url: https://wg-admin.whyredfire.dev
# wg-easy makes every user an admin.
- model: authentik_policies.policybinding
identifiers:
order: 0
target: !KeyOf wireguard-admin
attrs:
group: !Find [authentik_core.group, [name, admins]]
add-ons/authentik/httproute.yaml
-37
View File
@@ -1,37 +0,0 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
annotations:
argocd.argoproj.io/sync-wave: "2"
name: authentik
namespace: authentik
spec:
hostnames:
- auth.whyredfire.dev
parentRefs:
- kind: Gateway
name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
# The ArgoCD Android app posts to the token endpoint without its trailing slash
- backendRefs:
- name: authentik-server
port: 80
filters:
- type: URLRewrite
urlRewrite:
path:
replaceFullPath: /application/o/token/
type: ReplaceFullPath
matches:
- path:
type: Exact
value: /application/o/token
- backendRefs:
- name: authentik-server
port: 80
matches:
- path:
type: PathPrefix
value: /
add-ons/authentik/kustomization.yaml
-15
View File
@@ -1,15 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- sealed-secret.yaml
- blueprint-argocd.yaml
- blueprint-garage-ui.yaml
- blueprint-google-login.yaml
- blueprint-grafana.yaml
- blueprint-outpost.yaml
- blueprint-pgweb.yaml
- blueprint-qbittorrent.yaml
- blueprint-wireguard-admin.yaml
- httproute.yaml
- referencegrant.yaml
- networkpolicy.yaml
add-ons/authentik/networkpolicy.yaml
-57
View File
@@ -1,57 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: authentik
namespace: authentik
spec:
egress:
- to:
- podSelector: {}
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 5432
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: postgres
podSelector:
matchLabels:
cnpg.io/cluster: postgres
- ports:
- port: 6443
protocol: TCP
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- podSelector: {}
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 9000
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: authentik
policyTypes:
- Ingress
- Egress
add-ons/authentik/referencegrant.yaml
-20
View File
@@ -1,20 +0,0 @@
apiVersion: gateway.networking.k8s.io/v1
kind: ReferenceGrant
metadata:
name: outpost
namespace: authentik
spec:
from:
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: garage
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: pgweb
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: qbit
to:
- group: ""
kind: Service
name: authentik-server
add-ons/authentik/sealed-secret.yaml
-19
View File
@@ -1,19 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: authentik-secrets
namespace: authentik
spec:
encryptedData:
AUTHENTIK_BOOTSTRAP_PASSWORD: AgCdmFtQtxaSvL+ggv8kdkufOxVEhBOPMWEKmv0k6LpakDZdXDKBEdcb4bj8eYSbAePTpoPbSraV0GxMxw/D+Xm9o0JbbXqW+G9MfxDTJDE8n1eFkw/bRjq2gIZq/MNRH0ORBMpviQeAFnzt2gfcvu3Fua2RIQji1JHR67d6xTtzGTIunyte7UFh1OIDr9JWE+6mfjKVuebbWq1qUXq5ScrWf0UYjJ/qHJiMjM7NZeEq8v9D9uYZoXoZj5Ew6BRP+UWGZOgoulxgJys5mdAo4k6NMYapT8vEyyyOmzDlBYPG0KucQgiVHBwW8UaBvRQ3WES/xYgD44fwSIiLwtFsU0rCfDQXUMlbA05wvcy8u0Fq8v8xKCWZhpWpxKzaLHRIFL9QKfRmil60nvwYferjVRtfObdY28hU+/vh/LDJ6NMj5d5APgQ/1/otX/XQ48Ezrmo2nZqhqdbFKlJq9eSukcfB5KARvKrY7tvFmGr8tyqqqn2eAeDlcy8ivNomF9sIqYKVadtv4UlO/SjwTM0UEUyN2tIGTWBGWI6kDWKFjUtjsJTmMSTKFvTHyd24sUa8QskZgGLqMmF1z+Z8upVK3qgo5EKjFvvT9MekVZp+gj0eD9dZreEs8QeScw0+Oxl+ksrp6bJWXwh/A05/QSkPQm7A1Fx7KoVRdo2PVEJun7Jk4HuOrYXG+EAvDE0A66psM1XntLPdUlHbdt15a9JxMrTc4LI3ARw9TFDi9tL89G1JMQdBJGi63AOuOtLPVXm96zI=
AUTHENTIK_POSTGRESQL__PASSWORD: AgAlxWe8VpLJ9qzrJJqIBbWgctSdBBjx8HUXVqLQtZx1zWURks7YsB8RGdBYO/o/aQ42Q3EI/YLGiNdvm+7M+Bmbmg4GoXTxNujgfg8W4BZ46Z2g1sq/4mJhj3Bx/fiRAL8QaqJNbSiSmGoCRXuwseuiqDSrEn69ly/Y+wRlV22ZyPqa4vU/cesOFVYu6EAWKhS/6Af5TrsxEVwFPQUmOpsMGTxHV4GSkbYiXAjq9Rr2JkgtmISDiSGTFB6QcITF5QzdaAKaDym1ol/j2VLAXACgesVvUs3cFtRCprusXctUtNZdURriytUn7UusbeB+7YeG4hJohgGRZne83OkPd2RyYj2XyS2t7G5vV83WDFFBsOkvXQDGlnfSgAovyTX8hpUbwvWq2nkpRm+NhJYyryXR9QRZcnUdf4LZgSwDWasy1nUwTuOs2W6YIsdN3yV+BLq+yC77vDRrdlNbibc54EycuwDPzMnqazlGoPrxO53li/qGJN4v+et1cfevk3dXguYrOH7E2Kmqh0nAjp3mojoPfG+1RTzwRoiMjaLxEbtkLWzq/gBJTsVdWtTq1CpfEVT47Todc44lDmtk64OQffxQbq+ryaR6q7V8bRynsTYPJVFi0+VD5mjdmWz5IDDP5+fCMb6xZD6oTqgVoFV3zWSAj05J87Ok/lR99xCU0WqxYrF6o+3Bvg5i9D7flAw8nrFmuNc7G7SXgcQu2QIHfOikVXL6WScJl1Ycu9v38KvtZep5XjzGgHQ2SvfkulhaSlU=
AUTHENTIK_SECRET_KEY: AgDZtbDVvUGwkMw+uBUv7CyPd1lNrh23svotEiD9v+8gDaJlE6P4r1qLijYn1dqH063RdmmW3wndlohM/MjAXzSJbdRX3hv5Dk6Rd2fJKZdOiGuHFNRTLXsVwe1k0JwyweOzdBYcjHnfvSwEpI1ahFEtsmA9QhJ1HOpMxoMyA6oBWGkcjdO888wrL7EkMTYeAtwtIdnqA45X4Zqi7hhRdtZjhWBZ0d3pel1105DAxd1vyiK1mALvXhfFI3ixKYyU3Mb9q8O6KXHrv4JqOW/Zz9OQVpf0/yVRxv2xkYFvgaj66xW0KcA5rVp68NSDEGE1O4a/W2B09n1vtb5ZRml2597j0/36/wYkl9Q87jFEBkXi2xfDUTBHlm2ik8DwcOK6f54j2sHmWJMywPHsBYBvxVdRFQMxXXETQJWaas5ToL78HzFLsL3uuoez7umFMXtta3Dg3t6AqC3NwbWqicKgU8zJVPWNJAoLr9wrmJBOBLXgMHGnowLAkfNJNwQIAu2SaQwLpOZEfTkyKc+HBm6/rM++IpvCg1KJXGoUPbAq7qt97t8d0ev2JdHs3kMU8G5PnNfE+nf/6limWxp29Z/vXdMZ0JHWk+ivCia9yrdP0IXEqvSAuewEniKY+nYWlPZpJwX6kNpVcSK7DTIVzv+l9vcSPrLnkjwuzmnd+Sv4lA0cYkwh0uZ+00FF/0RVCEj8OP/c840bINdsSX13BXkaeeA2InZFWvC5PrjNKY9RIb1k2Hyo2EGS1ZTuIUNMFN/XORlBC2IdT0Tld1LpmKL8GuW+2SLJUJRwv23SmmAFWhPljg==
GOOGLE_CLIENT_ID: AgDOTuDt2E53pPy4ZL+VC6Gvb1I+kuL6ziDjOwWM+CkDpxuBSNxdsCOZap+TWMjOUhxgxev9mhijBTN1DuTtcnLNZopX0Rm2ZtVIq+k3Mm0a6cI6AZCi4nBbiAsNXCx1fUHz00b7meG/hVi6UB4skPR1VFdIu5LZ3QZo3GS5cZ7PMRmCq0UIrP74Hhvlz9CpC2nTPYRx/SsBbbcjYh/DIS6FWiwm8GuIE60Mt9tiiG3Yntb5YF0ZibmEcPzcFfNdxD2uEqTMNOPR0PwbEjdd83LOLLI37/OyW5C0uZIMofjeIx6JuipSaG758kLRfBWXewWSN0BPJIUrKBD7xbZaJ9l25UbpJSB1dZX5nKNh4cRi3xpbdzS4JqhNcytmUgO43NglV0AkiEY2PGzuqj0RiZPlDu0lAEh14cI5SYXAVzlapxE/Zq/DCYBdUYN4Qg6G4hTLNv1wsA/UK8O7KExQ4JqgEfQYyhykMlFdXHERdY1AvhapcTO+KbX1wvU+gVg1GgBz1V+iCWeuxzFwvNDoepCc8rsPUVRr86MCDIKT/I4RTwLNsFyG2Igcj+C1GcoPwMJEY7pJorVBFLYd7Czp2PVm1t1s4Tk+ad+hkURYLnOenOAmSAgUUIYKDxAyxAzzKLOQYxtYKrXw1QmSlaIgz70TAWsBUIimu5/5mC9C6rBcm6soi9hBm207kAkS4h1TlsHdigstJOLggO3ajZMrEqTN0IQFQKP0/SlO7qaHD2R0VW+J8D1C3XhKTeH+XJNIH+JyCD18iDfLXINJ2frfWcvtDPCVzKQMJtM=
GOOGLE_CLIENT_SECRET: AgDYAawB7EWhFwOTmRWP8MBjhslEZr9iq+wkOFbYmsDAnW3ADa9g7JILJn33eWG6jTjTE3SH/K0vmhqE+cppCyUtR9qk1vV+lSxuhrqb68l6J5tYPPY45bwq9Ol5Osar6PjuwX5eFLFZwi2hKy61aGH6SzoqJ606hBhMTQijI4X0IYHoEagEg52Fug5y+qEn09CV9Nq9QmaBPJTI8IQfbxqzAVe3E7XMEmjwBBd5pLprOkZAe0cZKFFUx9yRphf8zT8YcxBS+GoiN/Q1lLdQr8fMBWJ3kw5uwmaJwwsGDGyvac9IKGujhlduIba51AfXQ6qels7bqpvN67MmoL5f+j5vT7pB4c3fNNyqkx9Bu8d1dhoZqpaWEa75c2hIlwSMZYOSB1p8lwulzFIyehkuRgGeJqosjmKw0cIspLM/wLXV3MSeGG32opltOW2CtyaK4B7JPDvOhS7M8vjhsP/FxpAfkeQO4GIVS7WbM7sN5i9oAVit/RRhoN1IkZ8+8KEl1B1AkOu6vOCfgMyd0wM3E1EfIN21HyaGZGR5gBLyLl1vKv0TtmH5RJgOkwKmEi5yUL7pyhHLeGuDprtQmt2+l+hFn1xAEN7SHhrynUBFu4ZXfa18q1wcr83trbbl940OB3Xpcu6E2/QgWLAnSDioYyqQXaXXJ9HMddydbSHrYe4/yo2N3katZ3YuZQLZOyl/4eLduWN7jcKMexKU/eLl3Aa9+16mg/g4iMk1WbZTpKGL1GSwAQ==
GRAFANA_CLIENT_SECRET: AgCuqXVJoaIdMAoQTjSTLM1kVCvi5k+M8sVtg7cBGjMR2/Bry2FdU2fji/ND4A5w2FfSLLHOmC7J704krMzdKkH9+wsmhGoKbZG4Ur4ImBPiDdApE4JPOOrMWtpxnyGmNkPBv16ztmWj+3Q0pyo0fb1+0l2Gg9XnSG8O0vJXTt28IhfuROzh9r5rRaMilUKnIgEnWybgsPbxYUfqPJE7g5wvZIVxOcpiYlJxFC6MkjEkwkUO7TKCqSNbeSeRvhjRbxAd0ZHkrKGZ0LSLpKDBp7ZfRXBasuUy1sfhLTZNtGWS8YhC5YfoizUs13iafFE3acbkJz/DVJ8at0nsJKrxrfjYOv6kce9RSc4j41mBm8NTv8lhNc/qygxKu+BmNWi5go93PPpA1kno6OonwNNy36rSU0PyElXKUmMegsVXnu7sfDjQfld+VzJPQiDK6gdj090mJ7p2LyBmN1QbSJNvGQ0vNGvqxNjiXHlGantMaA/U6Od2B7AYHu447kJNHnya9KWel3eBWaLC12sfSEfwn5EmWe+7w0wyQd6Frgv9BP/EXQ35SQp7p2dA5WJxSI/2vtue98F3bfnvaJLLrPRiZg/Mqz4DSS875ojPtJc2iEyWprziHehk84zIDC/MuxhmJxj8Xh7zh/zHK6qdFEE8NKLtKlfpFbEzs/p2qtkzQUtCXm618rHOQ+7Rh7JI7u/P7tG11NWmKX15dbmT/Z20MLKsUXq+ymfT0nty8h0FbNAfXaiBENEDpMRCLNu+mCMND5nSqATghSvwFGMgaTbbu3OW99fpn/cK5iMNxXIunai7VA==
WIREGUARD_CLIENT_SECRET: AgChVcZeF7KFvb0r9dkUg+53Rx7owhpI+ttOsTZ2Bd6h8Luike/g2Fj0wbBJqOeIqQIHGCHXB+lZ1wZHG8kL4BeDseMt5v22w8WOffZpfwcFtx9AYKjvKeNldFuFnaQjQbSigYJY1fFZXObn7tMB0zppSHb93G1q7r3/JsseXIrsBGFY2cHakE1gu+NC9glIdQLByxQzTrdHF/92bHsOcLa1Bqqtihxrfy2wBAykZloiyNIj+bhD1EIpCjHB2Dx5Cu5Sqz+lguHOIAs1jOaxA1NGjQJADo0+w5prtUhuB57nNHQrOLFzZyJqHr59ENYjsrz6jmroCuffbjyI0aKsCn/82oWfJzoSKvMGI9PnS9CzoGC+mKu2FWvDvdTvultGy0lk4m6pvNQIxUz+PPNUeagS43e6xiGgHKKaBZf0r5cWqFtbSrYl8hn0Fw7u3A0c+7N5/lx2//icrwFfajvF1Rguay1vvhKn1Wl9OSvo9F+Prtm85r4Gu4qsds42TpmTMr7d+fsL4hftGZg4KUdpqAca02uTURkS+3RiSYmTL/D9RrNy34oGuq8KkW4feLfHOub92J7GK/6febePsdyuTE6NCaikWekTPUEtmJAKMgRfZWkc2fL81pLT2QrMq/9DwTelrTLrAA8rtxT5TkN0aIfF+Gn3n1fOhTjYAqzMeKKRyrhODF8D+MKsi3knau2SFPDAJaXTvgInHImqtIL2RBtzv6DvIP8bUkaFLlMiOz0y5tcegzFcsp9HCQ8YjwQcJJb3tavZLe/VWJqOPrRP1+ti
template:
metadata:
name: authentik-secrets
namespace: authentik
add-ons/cert-manager/cloudflare-api-token-sealed-secret.yaml
-13
View File
@@ -1,13 +0,0 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: cloudflare-api-token
namespace: cert-manager
spec:
encryptedData:
api-token: AgAdOsht6DLr8etz8DyU3JJVzoinxnldvBWzS/GBJWzDvAUKw5O0Lu8JpPEZTVMj97uKs16YZsiDCwODBZSD2PJZUAmKwcaWFgCSqBjnWsaCgsEW4Fo9i/SnovgzIPRsc8Q0BOaGZ/85j2hsHHX9lGQZdzLvPFqtR8oU3gCQyFPOJnOFwegUUavf/OzbCsaSd5+g8RZdB5tGdoScw0rlpV2rMff3IqBvAG/drLj4zcjq1vviC0XF5E79rKu2wLPmVVXfLxt/hpO431OCxLyoBJ/2drb16hqUv0yrFVykllfnVu2YxMg7Tzu0m0F6QHEaIu3FTyTQyhX5iG6a0hjYjlmUY3wkenm6V+bc9/Z2w45cYkXwyjumjTzjGvofIjf4pV8F0jYlYcobnY0w8cfij5yLo6WcMuYWImxF7j+94cmANVgFhZkhevSpwFE7uP9x8KakTGHd12NTNvJE8n1hYy7vS7giJGy8TSKPoFr6B2793m532aVR4EeIF2BfU4zENrcr6w5zWQRvmh/UPYj0fd61kefIRorjt6Xt0ydwzgEE7ggxFYN/6Pbn8ZNOwQvGIppHVZCzH2IGh147Pmg/U7RQsPzWRVshhlr4sY1cBA1PGsdOODuGuvtVTR2EJ/AoL79X8stMXOxhv0/bzRiAhHS0sg4H0xp5z5x8g/xSva6KY0o6IKgBEbGDuIa1L39VNu/5TeP/+68ln76zJiWlO6W3Ksl4jwk+ALLCo2U7OXqTk/4HJygn10mLnlvF+YlfIfvq1a/61g==
template:
metadata:
name: cloudflare-api-token
namespace: cert-manager
type: Opaque
add-ons/cnpg/kustomization.yaml
-4
View File
@@ -1,4 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- networkpolicy.yaml
add-ons/cnpg/networkpolicy.yaml
-41
View File
@@ -1,41 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: cnpg
namespace: cnpg-system
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- ports:
- port: 8000
protocol: TCP
to:
- namespaceSelector: {}
podSelector:
matchExpressions:
- key: cnpg.io/cluster
operator: Exists
ingress:
- ports:
- port: 9443
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: cloudnative-pg
policyTypes:
- Ingress
- Egress
add-ons/kube-prometheus-stack/grafana-admin-sealedsecret.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: grafana-admin
namespace: monitoring
spec:
encryptedData:
admin-password: AgDHA/P0QjtI0wgwOJTWOtRf49kKuqmX6sMCB4Vsk8LpGhFMYWgP8pnXxTAbV50qTnqVdY7GQfsabcWWaYDV7FTH3oRtAHbV+gplabbhlxIF3o+lwunkGcObbex9PrCI/9/qX4DL/wOVLTftlOKHzyX2+ajGnufDMuF3n4axiKAJNGiKiuawQIhksV4EgaGPtAhiInQUte5BylwlKIciTl6eiTDus3B+DVW0ubsX5VPVKRnJj2jKKM1woc+F3/+aSVKDzavjX2zKrptltWUgaY+KPIwuEsYB+kzy9JwtgD189NdGR+3f4zQNJ3pX+p9WzfhocyXdEiFAGPdqaPP0E4mMSd8WPpmdsCiFGN6aeu8vJJQOONyC/Bm63em+BJk1AaGWm1XgwC+GauUdkqAHNiva+XQpqIEBI20ddHJBN8HyS1xZajg2JI3Mxukfph0WjPoQ9kqhAkFjIfoIv1uvusL7fDAXhmAyp0s23f67WTzXB1ZWEyRGbgPZIoC0eHztILRIngUuC3L14/aTOhiTxcnX4VVUAJyXy1tM+NM3KCL6T7pQX81VnFerfzW+VeIzSpIU7AIaXuBf60d47j88Ff7Zm2qp257L0ov+sMY8jp33v8Vx4oB20h2bqdGbCdt4NWeD0hCBAU26vaFVuiUmZZuNuLNQqsCABa7cE86+BlRCVG0KXgylrFMNjE1IvgHj+LbazAWFQ0kSKpXKyD/AT0bX3ZNUQlL/U9jDMSuNTzYCjMe/znsQ
admin-user: AgB0Uxo17KMXzvE/IbxYE9M6xDN30OXhQ66hD+MD1fUmNriResa+iGpCknByxOWDtccojz6abbVTJBw/ACjWGWDcmuafrRmkXcy6/l7gcirb/TVubUlyurecr9n1Iqna2Ip4/5IhEnBuVzx2e5xe5r0npRmWI0qeFN795OO6++2I3rZUR8lUMpywTs6oyGSKKQ/9qOCaN+bARIvja4fxGw6mzPNkIHS7MAOsiUElNft8fmT+JufSfQ0npvxgimvsQCFyfxQjWwZwX+LLKSesPAcDD6iXQvaR51NCfwpfRptfom/99QeIXjv0OyBysQUWfZyYNx3I8VKOEWXLSvCafCQVJV/tuHkWob1hVZcaSRZxJolnSZQ3mQ4hgYxfr9QZp3D4rQMgpzvqsJ/EwShwWEFqrOy353X5PNvJhQTB005FGky9yumYpiJjtAyX1QWeM9wBedZfKYUi7YLV9YXiXk91n13nQxfJ/HRRZFvqnCYtTXFRfX8PGbYF6aaW2nop3xcaDZ932y9fZQ9Q6AlasKUm+qCfkfl6dUOfVHftJRLpvm/60GLw5ylz9XTHS1EEPJAPpty8YExuxYWdHn5RoCbRHjKyQWxckKjFG6qZ7LcQpQuitSqwzcCqE04n/naWLoKJpMJhI0Ecs1hYai7LCFKNqZJm9HqncaeZ9SZAd4jquKOoVIJAJMyGDdzLQFkuq/7Z75y9fQ==
template:
metadata:
name: grafana-admin
namespace: monitoring
add-ons/kube-prometheus-stack/grafana-db-sealedsecret.yaml
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: grafana-db
namespace: monitoring
spec:
encryptedData:
password: AgAGsDkcxjB3fakl0/pOZF/ej8gxCo7BUac0LJxfRR106PA4V9n2otOAiyVhmN45sNE2pscm2vDJdHtv5fWaR7AyZLaBk3dSn8at5vFh6Zgx20KLXWXGUrPaJLD07fuvNI4fgmFqEHnWsYUiO35mBfr01s6gTJPPr+y9b9LUzAA+WCuJERNwt+hFwmRDkI8rUvwr2Jy3TGKAJFJCXK1vkPtsGvIi8zHONlo+DI1uEH5qFECzScjXy4zEwKd54VoZtmS9F+QCJhXeGxy28v00jYCjPuIN0vhbzlJbLxDfYRskOuIxU88LWbGd9CDse0ZQvNW0i4cZbhL4Xsr/rCYeQfVMjc9eC//h5hsF7FPtKp589/lnC2jnpSYUfAz6sORY5elmg9QgB7yin6ItOCkVTBLZ3KPicOzu9oVLks5oTb1h2ndyNn3ltThPUo3RQpqOlq70HVpeB5cnn1Vdlty7/DJ8EtQSpVl1Zh26xTSsK1BLabs/sEVKRT7D1qyFtUT7aZDD1e63giFJIZzOiO6i3gaeTlLUyUmj5XlwfI0sTlTVIn0v4af1d/rgIUWqHYw/LMxYAF/x1M8LIRwtFjpWDYH4QuB2Keu0vMcTiErL+OGfM06izLntIzdoNM96TEj1dpLOHBxAh6cGNj6K22AzXfaToDcSpdO/yVzQPuzIWwr/joiEakUHCAKF+wQbI5vtO2suZTadSlo4T5M5clrIDkRTht5d2p4DNBaSG18N0T0yoic5RqQyUbOdSkepyWbWJuiluOXi5/X0gRG1DUBtNkWR
template:
metadata:
name: grafana-db
namespace: monitoring
add-ons/kube-prometheus-stack/grafana-oidc-sealedsecret.yaml
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: grafana-oidc
namespace: monitoring
spec:
encryptedData:
client-secret: AgDYt08vksKi/llySruExrqYKajxYNy6qlSze2pUy88XZOftNv/HEQrsoe5pcDK1fTBDgrPQhQgbX3mjD7I9psSVFrA6/tw19MQZK9QjyClz/92rGOf/iW7sqKJJ/rUYydPyPva48DwTvg/peGmUDleodE1bfogKrHfz36fJdop37KeTi8k0UZoyNQK0o/FayliyJzp9oX6rlJoa26szmQ0JP9/akBd2JTAruNw1JbOdmFx8GpIGU3Bl8uvbcDQwZ4LuGxn1hOiPutXuA5NTS8xrC7GnLBPMtAvg8etZr5JL6ZLh/cGPGyN7tWpjqrJ4Y9hyR+ryapZh4I6/uRrRG8BpqXILUri0T2CB7/VSFrRka2b3CWtrlUiaCYDK4d5UF1I3K9x7WnK9rWNDMx9hxOQ+4hL6wFhX9k3nfDH9yJ7C8+4u4jTJVOfE01HbR5d2ZBfvP8sEO8sAePgD84ViRVcAAZ2LmW9aPrMdNhlQXf1ODDOnj4FaXP+yZIEq+fqsiyQtLDNBsIwDDJgCv4l7ac6NQKbpN2rfEfs4UFk5g8Jj3TfvpXieFe4+VuUyAwy/7npvxuAn50xrcjAo/m6cyEgJ76oyK2tdHM44m5CX+MwMhNIVU1Mmuq4oZ98pRXx0f1xptcwcXiFV2Eor5lKmNx4mDaYDDgbFrPGJ8w9k6gnDsYUnxP5LfAhpcwFxQcSyhj2XdbSnP+mZio59W0+adGQoksNuZjF72COME7ijNREsAmUJ6d9EKffQsH8zf3rHb03vzNWVzofgOKDTHyfNy6bdiZgezxGjNdcgFixdU1Fqjw==
template:
metadata:
name: grafana-oidc
namespace: monitoring
add-ons/kube-prometheus-stack/httproute.yaml
-21
View File
@@ -1,21 +0,0 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: grafana
namespace: monitoring
spec:
hostnames:
- grafana.whyredfire.dev
parentRefs:
- kind: Gateway
name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
- backendRefs:
- name: kube-prometheus-stack-grafana
port: 80
matches:
- path:
type: PathPrefix
value: /
add-ons/kube-prometheus-stack/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- grafana-admin-sealedsecret.yaml
- grafana-db-sealedsecret.yaml
- grafana-oidc-sealedsecret.yaml
- httproute.yaml
add-ons/loki/s3-sealedsecret.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: loki-s3
namespace: monitoring
spec:
encryptedData:
LOKI_S3_ACCESS_KEY_ID: AgCy95N0v+X9sAZ6eLZ1dT4x/TZbZdJdKDBdoB1EB0XD69KtjRnTIp6fnK7fWhJK8LBQMinvses1ZT8zxjXoYtP+eP/UMF3A5BPKp3GtwWqgGLWWcDEdRIPryf4isovw/5JRV7EoaS2GOqmXrGmzqW3S5B0CkGBBfp4vE22ClkONw0lh8RQorAHnHAQ5oBjdnUwcudKkqzCUpymZsLEU19TFx1xuHrI1b9pPBDUZKJc5sRQeJpMh0TOmP6G21SHvoVpfGb91nX7rFqt5uCxwXp00rWTJQDLmrBHITTzw/regKbtDz/hnow/Rmw9VvrKeh0olIxUjDwPfRFLalu2OKmV1oa60ta99Q5OExqQKKIWjOyOHovBAtpTP6q6z0/mMg/O0qoj+PyW6OJ8Ojkf7zYJAEyDil66ijALwXQd6bARjnePcrrmNCFcHVDIKRgraO4ZJDkPdfekKdCY9nepxGGdYDbFcl+CgieiKp5C+DQ2MAurAiWVIy07gfc0EwTneTIZa6gJsL1extnD1QMxF+Q51q6v4raTyvydMg7q2fcJNWs9E8c3buVJ+xbyuTGdotqaEgKgL9h7AGPznuXLBEv3jsZ0DZzooaXQr9e2eSOaj1Wdj9fBTkTDwtcCQOkWVTzQv0jdRzHkyadKaCkSLEy+wFvyoCmm90I1v41kUNAKb+OfErQF2oneR/kFvCRR63fHkrqeLlpfYX0yu6yWOKhDHN7WsQ6wd2s76PA==
LOKI_S3_SECRET_ACCESS_KEY: AgCR6N449J9uv9ZIb1CCZzlEMIgmnnWWGiYqDj5awSzun/j7nnU5CiqY0Q7YNUztKI2y/0TQAHdrS9Q46d3c27ZIiCwDJGK69w6Bcc8XPotzFZl7htRvc792CZtx9OShqLYrltoGvmNCLB1AY5wnxTJPQJ7p8Xat9GJA7CgRHerwhfhtuT3vKGRVOkjpQ5tRDaIYGQO8o7Tj2eaIn/dBwMgCVlfd2x2XLS7RzV8F+DTQ+94jpS7h+zJGsnEqH4nEO40OaD87ZTn8CnHlw9H9TL9shu8dNVULYK3j5Z9vHHPjBQ5oiTBdwtayJ0lBDOjimlMMYXiJhczsoR8PwYG7TNL/OZZIF8uMvuZX7lFLa/15W99XhLZSKoTbtYNT2HAzWNLM29unor3eDBebwZGyVu8VzQVECtU1/6EGnY0enMpldxUhJnVq3YmifZ74lktIcLy9g96lIYvJs10OrMZqMf7ANr74T6tLj+kDvlTS7AZF+27m5bK7Da3Uj15qvLsxox5XYsTfZa82Kz9XM67/Dif5PdGz3LCkVJHKBpSbAwoy54NqaIIlRrl08J947o7AR7M6T+L+kbU8JTREH0bbnAIgFvkBZow0LvL0rNB6I0A5aSO9jrMnb04I876Tf2JyRX0pLhtovo+253I3kQf8X9S49suYcJeTdATKtIMC2sE5wb23AdFeHLZz603HobieozAm7X5sDCaXQSROHUMPF2+f2sRifTxcryPP9YhpBZvm7zuqFDSjfQI3dtLrl8I7/Ohbn3J6whP6rgSqKBQaLS+s
template:
metadata:
name: loki-s3
namespace: monitoring
add-ons/postgres/authentik-db-sealedsecret.yaml
-17
View File
@@ -1,17 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: authentik-db
namespace: postgres
spec:
encryptedData:
password: AgDLpRHzrgu7ZjiHPa6Ryk1SJ7/hWlN50lKj6vwUP8IXWhsqKD75eniNRVEkogcsL4bxoL+xD5PK+A9p3MQe7gLlBlH0EJd0f5J3tSN+scxFpYxwjR8Dma1+sIlC2l87rD276Vr9rqXNe9x83ooJ6nHSDPGMidEryUzNUNzcObjG53BgQRW39ZzjHIlju3wt6iRcAxalfRC3v2mTPJyYaiz+He9ipO6LCJ/sv/po4QloASghBUK4zUGHyn8UCQzDuhQ3nnYZCyFG4T4ey8XWL53pFopTzWpRn+4g0yQXI+qvb28kfy4L8QvNgRhIzoWYMLQVswVVvzRE2y3nrkWRhG3Z4FgJSfGuOOR6obXboWNA008d4Q0In58O7lTxh+cwDNzGRY9WrWmFhx9ib1b2O729I+Vu1aTUa7IkaYg5BpMLuUjEiY6DfVZW+OvvQYPd6+a3mhitjk+NwVGZBdR20lW3bz35SY63yLfDrA1bBex2iq4jLGXEBlJz+loAU+yko1zua2RYC/tgfJpyU9NrSy+9ti59I8e0+I4o9YkJ2VmVtcoFd6L0ZOmdayw4r6hDtB+EHW6Wz0vnIrwx3fxMjSaXEvtNjZOVeKVvm9Cv2qJqTJGcRfiUeSbqEXtti1tlwupTe3bBXfotV1MqjmsAUJehhdfwYscvdmo60XMKJheyoAfB3LQw+uAg6CLtmfe78W9IUK23ofFfgtiQwp2/3gXmmp4XPAEctwXe//SaZWbVTdl5bKEiNvrrqGEI0zdcWfU=
username: AgDRt25giEz0pQQNgaKjvHh7pM5PKgp+LasT7uBRtkjdzvPVgjnmYjo5EIGMv16VGk1AzxoHk/gI+ERlVGACzrOoi7n5LoTwqmnbcw/AcsBB2TM18KdFKzMjJFZ7S65+lC2y1jt2fOaiTdlQ/OzU251x9NSiHPnLBw3K14M8kD6Yyq93kN2q78o9gD06KjXWGmbnADH1H9gJSCwSJmLMS9WWri0Mr86l/JgMwVCdEoDKOFwlqQWWr8SAm1P/5q61TyIOPjjUe1AMFMSZTFezFuchf6NBieztHN/JW5nmPWSc43aH5u1zjjaTJu2qk3ipSN5BBCkoKZ9boW/wqy4AriRJfitq8LxIObAFgkJMHG5RTjtxU8j2z8oKHll9UxO0yRSIkdhBI3h6iJAqDmi75bH+RIfdx1kiT3g+nkXsmR5/ptBORyNejppeSYsh/jptdJNtzjmBlGlORtLX9Ah8I3Hj/gr6x++GjwphYZLlwjVa1S7vSnWwpdGKP/0RwBNMFeqf8PerN/tp519b96toja9QyA0y0lJzh9XmMcfOUKYamg2i31tn+4ab1GOGlMGeck/MQ+3G4skJmEiCMvxQjGSOuNjL9W1DnSvjPsK8pNnJ5ndUCQatu1a04psQ0dJK/jVluwuIm34u3lOmisWEoTzb9Y2PYUavIpkPt5be0qmCh9+r5xdL+gBLccGdVdrB4zQ7caW26Lp76WE=
template:
metadata:
labels:
cnpg.io/reload: "true"
name: authentik-db
namespace: postgres
type: kubernetes.io/basic-auth
add-ons/postgres/cluster.yaml
-49
View File
@@ -1,49 +0,0 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: postgres
namespace: postgres
spec:
enablePDB: false
imageName: ghcr.io/cloudnative-pg/postgresql:18
instances: 1
managed:
roles:
- ensure: present
login: true
name: authentik
passwordSecret:
name: authentik-db
- ensure: present
login: true
name: grafana
passwordSecret:
name: grafana-db
- ensure: present
inRoles:
- pg_read_all_data
login: true
name: pgweb
passwordSecret:
name: pgweb-db
- ensure: present
login: true
name: redoost
passwordSecret:
name: redoost-db
postgresql:
# Each app role may only connect to its own database; pgweb to all but authentik.
pg_hba:
- host sameuser all all scram-sha-256
- host authentik pgweb all reject
- host all pgweb all scram-sha-256
- host all all all reject
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 100m
memory: 256Mi
storage:
size: 5Gi
add-ons/postgres/grafana-database.yaml
-11
View File
@@ -1,11 +0,0 @@
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
name: grafana
namespace: postgres
spec:
cluster:
name: postgres
databaseReclaimPolicy: retain
name: grafana
owner: grafana
add-ons/postgres/grafana-db-sealedsecret.yaml
-17
View File
@@ -1,17 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: grafana-db
namespace: postgres
spec:
encryptedData:
password: AgCS2VPTseFFkdtaDAjYv6+9M+s6ndiezfWjV+OyPTPurfHJxLFkUlPC8gnZkut9gRhz1jsakP91an0aFEZTWHlM/amvSkomUWbwxKw6l9Co1U0IjK6PUPWKkQtLA++vFaL40u8yHFMbMLkND3oLPqNadcCGl+cmLgmSq5VgEayaClx4MPlhSBFYBvpJJ3B/CkK2odnXYO1aSeBIKPQFIlbiooSWjBA0CzJ9gQQFSnEVkDqHfkd3nEVHaziCdhpOCDyH6twQlafMqUjIbVKPJ2yd2dZSJZRLh6t6FY5EHhTh6PIbniRJ3ZtX2uTaZJ/tJF2af3QfRMUJ6go4r+16IKM/Q1ZrOcJfa7Zz+9RoC4d9dkl30hysr88WX2+GHx1E+beEd0v0Kv5IR8CZlbRyQV+DYDgwjFD9ALE37EMhpkCyb1qi1ulhl+8LIXLB08nedbIqqvPrmjUd3+y1EpuATeCgIsaVeACxBN2iUJ+JjVOFE/umnSgEGVctSIQSl4kZz/SFpS1Ygy0yrVOSmt9rtvPaWSWlg8yN4TTli1OKCJreyLDVSXV+/Pf+3UoN8p/SR7r1cC3jb4KBy61O/7jovMgO3XuhYHtUyJdrgp0h3DS116yBtFVomGKhCRMriLXb7VG9zD/spgYpmikPMrMABm9OPaLOBiKMEz+VN8Nd7cXZ1/us6kV77lSUInZV4osall09avYn8NaTN93hIS6J/Xb81b7yuH6Au6p13Zf6dkefEF6vu/g3m0eP3ZlgIkroF1rNe6IrkzxA0U9dDvrr3ayB
username: AgB1nXmxGuR6ObktViN4tvpH9W5B2HdzDVAwd4dtv0nBSGkS4NXA5B65BzF8NpWRVcnbS5hr6H0KfnAWHguDGL3/pEU6fdam3At8F+2i0oXSH9Pt+C2SxEcH2ecRHK+7VqNgJhd8j9i89G8DQGAgFjWj9UpfOCwr65G7UrHkomdBgitSFQD0dXMPJ973ZSlRZOxECT8NKjmgMX/iHztBszIms/ACB6u4Yfg64nAZUta1/Ky95ZSb5ZgrqABE+GLgRIKngAhr4OlpiVZelsTz0ccjCU4bT6a4ZqiqkbDLS19nO2rOSMDsnxgqoVBRF1Bz4Ry4R3e3jpQx4xBQrV4x+FFCymEi1rpZ8KQCrRf88YD+A+jRsBGnsB79wcaq996zw2tQ3kZd743C7AM9ZzXiNuGVGlhXqld6IbvHzyh1F9X02+diPVFftAO9owPEiTBcZVscj6RREmkOGcYHLtjhCghzHR0iQZ1DvazqyPSyUuvKyyXcX5m1b0DzgONqEgdmHD+saZZbAacQakUdoOS1hGLGgExaXS1pLV20eSIpoAJls9WbRXCeAIfWbN2MV2y1BUUDvmIAkdkocQbthovl2NeOy1FYVZZSmS6jY4zv59PDXFx2HMcNsj8qzZu4gDlEfngY5L+L6Lqr0XQKN250gYEkuduYaPoftCiaThMKCc9eJkAlQ9GdvrQrW49wBcXnErvFVmfuNcWr
template:
metadata:
labels:
cnpg.io/reload: "true"
name: grafana-db
namespace: postgres
type: kubernetes.io/basic-auth
add-ons/postgres/kustomization.yaml
-12
View File
@@ -1,12 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- cluster.yaml
- authentik-db-sealedsecret.yaml
- authentik-database.yaml
- grafana-db-sealedsecret.yaml
- grafana-database.yaml
- pgweb-db-sealedsecret.yaml
- redoost-db-sealedsecret.yaml
- redoost-database.yaml
- networkpolicy.yaml
add-ons/postgres/networkpolicy.yaml
-72
View File
@@ -1,72 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: postgres
namespace: postgres
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- to:
- podSelector:
matchLabels:
cnpg.io/cluster: postgres
ingress:
- from:
- podSelector:
matchLabels:
cnpg.io/cluster: postgres
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: cnpg-system
podSelector:
matchLabels:
app.kubernetes.io/name: cloudnative-pg
ports:
- port: 8000
protocol: TCP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: authentik
podSelector:
matchLabels:
app.kubernetes.io/name: authentik
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: monitoring
podSelector:
matchLabels:
app.kubernetes.io/name: grafana
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: pgweb
podSelector:
matchLabels:
app.kubernetes.io/name: pgweb
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: redoost
ports:
- port: 5432
protocol: TCP
podSelector:
matchLabels:
cnpg.io/cluster: postgres
policyTypes:
- Ingress
- Egress
add-ons/postgres/pgweb-db-sealedsecret.yaml
-17
View File
@@ -1,17 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: pgweb-db
namespace: postgres
spec:
encryptedData:
password: AgCCnUlPp1buEwCQDC/q1Fy8JHfi5QzuUCMoIXJoi5xgJewkI7ti0JctSrJJvdvS0QUm7se5s85tewKjsA1tIGrC8/nsSSeGbNmqRXS5BbGVdr6SIQhExTmVNdQqQwoyYtV8/ebW4ntt+HrIdgO16o6nsDb5lXblYguZps535SqwSN6vRLHhD3+Wg8SBjHZV11i/9w1nufy4KhgW5jlBhosKOaGVpgH33OQdsDMvkSF5FcljgeUm7R+R5sBYXh5VfPpEjsBB0zi8nDzSNS8aDVrQuv3aFeNnJ4vgBRV8a8/VclaMO9RqXgnl+HjHczbEau+x8AHZ19lLVXJ3rxi4itgOGXevVGEdHi+i+WJX3yfakGrleBneqkbY4VUuuu8T0l1wveLxRGBNwR39xl+wSZU8skDWoDh0Qdgcxpiez9Ewit3s9WE7SALtdUhVdwBdzZVctqZMVUeUDDBGYk5cyTZmRAMR0oBYAHSFD+C7+oyVjJsnZOp4sn/1q8vOOZzLeMu640tyopCChL1eIqbUxz+c0WsVXOQkIZFO2XErkLi0mpf9/rksRc8jWPZL3xTqcgQmGPujpm116K6nclf6urgghj+UW2KWilZRD2M1qXFEi4UdyDFPMs9bOMqymuk0zr8bM2+xJUvaC5AAByjFOEvwoqrXMp/55+4OhcEXkce482Ohl22EF9UznwegpxgcSvDVsdvA63nqkA6/ScYVf6vOJMV1IV3V/xrCmCfvrgzw7oOdfLMFF3DFlK7b2bcwdm7tJGnjIVxRKEk/Oac0hcmb
username: AgCrlxpjKHYriSWpb27Yy244lRX8YJFTWFxfT6Zpf/FG3nJ0BmcFRCzADbE9+E82Uugbsomv7Bx+GG3PbdzZGZJkxnGptLLIMIXbFlRr0W7cKFCWasmti8CW3KmVSp6YSZ/QR17GPmEkehFnmooK5DGhxZJcrK2+yFhN16JtCh/XGuXHVwVGMZMcVm8mKWcPKgH1yCfxQfFCk/xD8+3FySTKz1B/eyaUhaWncL8iCaMQgTd4G9YUomL0ykqwu6RzO/UkC7taq0dnvSg/XC6NDfZJ3juqdAw86RagJH3H41T41WM42ItXHCVy8XEAkJALZO8+caJC1Aa8kqvtPQh+5ParKpQK2CGGoIpcy8gicfWsGC2Ohtmoma0J37Ha/ur4BUuEbesnrvkYGDyf+j6rwJ1tA1Ff5w1POeySqRbpK8M7pEwLNTA3dNzhqBfY8sLdIwDx6W5ElBDz/481IzC1vKgNCaINjvCIvT4ZMHMVEwaAHxTyjv/On0Gi/U2m38Qnu+IxZXC/Zi1LPvFCCE3ieVHOKA4gyxooKIriORzxzxZbD7hvg+o4Dhkd6hxWRYfpIMZBQi6Ov7jHzY2VJroJ80wzsLXFLNwP4pEpSjcQsmus/ErLJGwHUeWYASo5cVmBdrbtQEDWGSFm2pi1FSCLnC/7/eWsPJqqS0tHCT35+Iabgk0EbXEPHgE3ShR7b3j/+qwhACLktg==
template:
metadata:
labels:
cnpg.io/reload: "true"
name: pgweb-db
namespace: postgres
type: kubernetes.io/basic-auth
add-ons/postgres/redoost-database.yaml
-11
View File
@@ -1,11 +0,0 @@
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
name: redoost
namespace: postgres
spec:
cluster:
name: postgres
databaseReclaimPolicy: retain
name: redoost
owner: redoost
add-ons/postgres/redoost-db-sealedsecret.yaml
-17
View File
@@ -1,17 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: redoost-db
namespace: postgres
spec:
encryptedData:
password: AgABXpIKEczwyJR1ZLvcmtcQluGi0ACDO3SCC+D2OfaSxpUF0ZtmE0b5ngq2HmYj7GPMZ3vAEaJ42oXDgEiS8Teq9ACxmCIo7XMeA5X2w6w7RCmhgQdx7N3G+nL0fO5l49URckk8xDZVFCSo4wjbtmjQrdes5CbMlImtG11byFAyjs5lBAN9niJZ2tnJqJhpEvI9/6St0AlVjhsRhwvaV0zlVBtKFcBvSKemcBHkTA2gPBeJ3xmizuc4NsJHhCriiOAhJ+IA19eBzvN/bmfSxdJb2F1LdSQxlLDstnuO/dJDKkvIul6TrWwtqRbCI5tM3K0lHbGeeDmIRVPmsK99Kw3FAoSSKIZ0u3FTXqMF5mi9+abJAxHgD/JYn0Ecx/09Hp4lUwEWK3RIqmbfq6ose3YcSRULJeksSIQtGsOmkE0LxZkQV1F15lOAWL9QhYTDXZbD2JTnkc06SLSk2THpl9o0+F4ZNI+TpLHGASIH8nu95qVh3u7odwjaqe5Czh/njIGw7zuh718hLQtXi7P4soAj46Db2Gw9ZjSw412LGfU3ETDjeIeA4wQXhp78HtEn/vsDRMgx9EQH/726Y3BehdEzpx3g95zBvyT2T04UPc+J+K0zwp3c4rLmkyqxlXOq8NW2p1huQsdk8QTMojCep73k8VSzKpq9i2I9ktWTPJbiXP1KpLA8q0J6awgFD3c1IjYoeeOptfz0kR5oTQa8syTdlj4QVYrxopWqGhK7Cn2G4zwc1Gv1F2sO+KL7/KUe+Z/vp4kICKdL6JfQbUJf4WAU
username: AgB7DGwIppwLvtb61d9cn/FnzC9bwAdhvk0XR2BTiO4EaA9py79Y55Y0pmSmdi167MCfsQNBZEYHV/pD1RncdzHbMV+rKs1Y9Q8ghFUcuTaXC03tkYfZX/JnwdKAaqhyMqGkycyFWsVip7i2uoodJ2M0QhuD3L6dgXeq6rFQhrc5GjL/7bWiKcYY6X82qbYToJCHAHzmZ6lXcRwGqtV9TcC72CtHgP6vsBTaTZLadptxh9xI89SiLej/9m2D1lhSshJ6K90BTeaLVqeR19hP/VCOltnQfeV2GfJgBAfstTEnTHpqtGuPct+zo/IvbFnnjLmcNgVwzCerk6O25mgIuOQxkQp/gnoswnzMojPzwWnKsl5mrlrjkYRuGrFZjykB6th/xat/VarHyMJUpKlmNcealkWvy9TfHzCyQtCHW/fwHiWJ6W2/Cvf6ABBDl5kn0oj41l1Ekm8zxR7GCoucd/iAvizWJ8V9d4g/P28gBl7UI+WDFRkKcYATKZ2s6P60ORXj+aeYnoV0s64if+Er/fdbYXdSo7YiZVOtKy3nGIRsq9pl17QM1GXNmKNcpSE3SwKudEwIKcLSKZ8oCAn0gm2KwGGbJ6sRWu2+zysxgcoDnmpZje4SoO+xXLKDJ9NMCI1RBmDByk8IoNxn6efQXZesn1TQd0QqdjRF4+yXxPgpfzjK5TBEFx8ya8LMZWlhU2dxIQpJusV1
template:
metadata:
labels:
cnpg.io/reload: "true"
name: redoost-db
namespace: postgres
type: kubernetes.io/basic-auth
add-ons/traefik/networkpolicy.yaml
-39
View File
@@ -1,39 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: traefik
namespace: traefik
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- to:
- namespaceSelector: {}
ingress:
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 8000
protocol: TCP
- port: 8443
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: traefik
policyTypes:
- Ingress
- Egress
add-ons/traefik/wildcard-pixelos-net.yaml
-14
View File
@@ -1,14 +0,0 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: wildcard-pixelos-net
namespace: traefik
spec:
dnsNames:
- '*.pixelos.net'
issuerRef:
kind: ClusterIssuer
name: letsencrypt-prod
privateKey:
rotationPolicy: Always
secretName: wildcard-pixelos-net
apps/bentopdf/kustomization.yaml
-1
View File
@@ -4,4 +4,3 @@ resources:
- deployment.yaml
- service.yaml
- httproute.yaml
- networkpolicy.yaml
apps/bentopdf/networkpolicy.yaml
-21
View File
@@ -1,21 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: bentopdf
namespace: bentopdf
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: bentopdf
policyTypes:
- Ingress
- Egress
apps/garage-ui/httproute.yaml
-14
View File
@@ -14,23 +14,9 @@ spec:
namespace: traefik
sectionName: websecure
rules:
- backendRefs:
- name: authentik-server
namespace: authentik
port: 80
matches:
- path:
type: PathPrefix
value: /outpost.goauthentik.io
- backendRefs:
- name: garage-ui
port: 80
filters:
- extensionRef:
group: traefik.io
kind: Middleware
name: authentik
type: ExtensionRef
matches:
- path:
type: PathPrefix
apps/garage-ui/kustomization.yaml
-2
View File
@@ -2,6 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- sealed-secret.yaml
- middleware.yaml
- httproute.yaml
- networkpolicy.yaml
apps/garage-ui/middleware.yaml
-17
View File
@@ -1,17 +0,0 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
annotations:
argocd.argoproj.io/sync-wave: "1"
name: authentik
namespace: garage
spec:
forwardAuth:
address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-email
- X-authentik-name
- X-authentik-uid
trustForwardHeader: true
apps/garage-ui/networkpolicy.yaml
-40
View File
@@ -1,40 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: garage-ui
namespace: garage
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 3903
protocol: TCP
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: garage
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: garage-ui
policyTypes:
- Ingress
- Egress
apps/garage-ui/sealed-secret.yaml
+3 -3
View File
@@ -5,9 +5,9 @@ metadata:
namespace: garage
spec:
encryptedData:
admin-password: AgDIy9i34wa9hD57pft2B8SmSmCF5UyksaOD5NyUovQhLwJqv6QuZoXOQ8dS2aCMK9B2jFw2oaycJPgW02HEsUiuaorifAz/wmjrU8yXtGTcxpqxQfS0+EUhefHtcWBYVcTc23qMpllJZLEr7+aR+sCF6jAq1CHeuSCdAOTkhjBTbFmcodIZWCspxrqoxF4NLBGKSdKIuWLekH8w8oJ1ymf/VUj/LizJIKZn7QoRpS5KYVBM2hzlXipUr1FWSjmCmolTPv/ICW6CYHtlOnEvYUTOnEAdmAx5DD2HocKs+OjBUuFgnYwj2XIyLOoVI+nrACrQSvmzXOUrKNI5y54DU2PNgAa1zetWfHk/Xv468bLQc9bSBFhSSNTrl3mi8Aa381mKJ5aRXLGa89fCqGWAyrzKle0yc1msg90jriJMh5kN026KHXw/yeqcrTCD9MdTMr51UusfhzkE6LSnKmXX0XQNjP4OLOKu7kFXj8xRox0W0CNbXyg4keQcWnWKF1LUgG3X2+1CIZNFex7S7OE8KYtxP4O7aqy1kRZvgVsUONafaIPB+k+Gosnw7ImEQ4Zu8L1ATqpeEioHoxeac+RhavXjte7UqSjIV6moxWrwrK2EMZPHhm2Kh+h8S3ROA/78Y58hFkEYQFnJQwwwByGctS0zLIOCybVm/lz8puohlZAcfzf+J++0R6sxkWZtIa4YWG2g6RuTjUoqcgHPwrRYmbvB3WmYu9/w+717HZob13QP9C4mpT7Zhposw44JuJMN7MA=
admin-token: AgAJHn+bv6P/JJVplonJWgc/vnqXRQSsaKlTnrEUmH+P72YqMPEbt/Ma9ptkWOewQNr6mceYHUpXQuhczuAmeebe0GS7jr1md+Clnap+8NMKHbhYSCX0/MwvV7JUcWfZ6xJcttPHbP6a8s6SToidDOohBtY6gkeuA+12AtGI0t6xugAcCwBKqZnAY2lacD1nEqyatUP2cGHXTMmaNzsyz3g9QvuhCPrOx6FeC7JjmC/JdwqyLHN/b/NvVdCZUmvNjsPaq0U7UK7UCbcWYbjxof2u/3QF+EFlNBrpb4DYipOVqtrY57IrfYbUNucd+e5X71Kjpg+iwR+IPyGXS8OGJQQsh1ytYeZLbHpaCpmm2HVU0JMZx7p25QSqwNzP81wjU1VKkw1WEZG4RW4eHS6/aISSBouG4g/IRo8E93nskfj6Ue0+feFv1k50l2L4ROYtEUwMaeaA7zpwr6tTei1fenJ86sa3HAIwgIdiV1qqp2TTWwpr4xFHlVYdYvb+igt7Q4h73FwvYt3kAMTmH5O2iatGZfo36pqTGOqrfBPu5p+agkuA97MSumqHKzqADSPyNz0BmqzV7DPvuKsKxaFYAiEbNjD5bCIyDUwNnQIucMUbHtEfLngN+yD79kZiwBY1xS7sf8QG5yOYi0U5Ra1f/AEKasPUEOsiphrypcTZ3GzVv6aIaF/AJPWZZGDT0S0kXIB6u19Lyl6V5NUEXImnpBI8gyoMflIiFB18qt0nX7CBbNdRcwHGzcCjy2nshkvhSRmW0OiWw3v4UkDu8YAaSZDRFGjKJQ==
jwt-key.pem: AgBLwseufpRTqJdLEFeRr4ZN4VihNmua9GMPEEm/iARbWgNqCl64QzvJGy6XWM+RdXkS4z5jrjMg2Z2AJDHvd8qnFpDPBd4peAYw03vaxxpkz/TNz2+9HO4Nultn2wA2bd3CfA43doSs1T49lksCKn33puYEh8q5BB9hMUgU8JFc1sEMKS7auWoPQlwAOnJ4Qi4ISQZZ/C2IPLVW1VUJfPTsAenJ7ZgqE42DFFmghDfaFEQb8BcMNDuQCU8BJSqC3BoSMiuxmtkurzk7aXegVOEBcbdmPEkKa0h63kuTJCHZth5mVz4NatpgO6EDovGahO2EJkuAY1fyDhL0EpUSf+XHyaTpsDa/M+qvPZvd6wjGLjIH2CV1bHkvqx2GjKqv4zPkki3ESlxan/qfh0uFcGG2a2bSezmFbibvXr6uvmKo7KcbZWevc2GYgmODRJRW4bl5MTp0YDKcxF4I2kFboJhnCG5aw8hfw7LLUdk9iCT89u7UV/cHafG9TpoxkpIHyZmKrZLLczAvkLdABFX+6UYbFG3N+kVlFUXe6K7Gt1LrMVievNDIlds0y4b1paXIsj855znXZO7+zLcmpJKEnmjOJ9wa6TLCsI3wdTzEoLQOO9HPgywGRo3lxNu9mbiYnRbjwpO1pXs8RNfQj0ERNwE/EZoE+51SkGAADvqeWG/fT4bHadKaTYWitiVwXOjKJeXjEm3BpQI6hNyLMO4J/JMTAGHdqNttv3yeu5FJWJ4MrYS/tyXUSVBTojU2599/soFPqDUn/1IClkOKrdG15ZJCedMB55qOPf1k51dvIbhUVBEQlDyRDGksqPItVf1tM/+RhuGrasRk58zVuY5qm9JQFReNiNZv
admin-password: AgCQeGAvd1QdDC8IUwNYqHJxRES1jfPbonYTyutCklms6tjebQw1pRKnbDWGRaFmgWg5jFRPYf6TAMRnZnA/1dKJMOrV9vGjqx++r+khWbe5oqvcoQInqVdbkfulHoP/Bf6jc2mj9znGqpW6E7e6Z94pwwYkpaY2CIYhfcs7PiaTh7HiFMmoNWlGmHBh+lIZ//WJblgpFdQRWR9j7CiIJOLC3OmAvGV+Uh5i15fdA9aTBLZaB1pWh/kqug/mmj6q5E3Bp7BlC7Pm20Dbyn85kfA9RjAM/AkWSycGcBgk+FaJKFVJnPzrHcx6CdkbUnczxGVrbs+C89pzCk8ysaOVSNDErW0rCWNaHrflRx6P1+OUamCWWafZdkWTGQ4m0I5pX5IQ40zIK1uE8Zzil8EJPynfs37fNzn54wVBmsaKpsFC/3y+d8UTVgf1shJF0cqPimWjCZPqvUZrimL/20tPhTSERaxtWSq14l39bQUc4sNZdaKc69IkI04geI9OPvE+XXQNYe86XPYlNJ/R5curg1RvQxAR59sb04RmZAfdSvcwYxpK1Ekchq/e9IK4ft6Ul70nE/oN43NE2Ck1+5/EOjucFmIQzZ49Jq2OIjHuBjA/p/BmwAhiZVwPObRJ0VoL9XDv7BVB+S/+RWnFjDW7J5YhWquZ2Y6XwspHhpjvHmH+LLSio/34VpWQgG/lSAhvSPuRkIp/XxhQwemti+3yQNeqfXtvpfKa1IgAg9ic/rbocQIUtQDaT4yYFi7cruTpx7U=
admin-token: AgDBYTHO2ZgJig+h3wIv1ru7VxEDKIq+SUjOygg39lVaF1bH0ADaWOdr1m6nP37LiBCyQSGtqilUGqXPV91VRiJJqFBXLTnYs0JbmXGekkfeImztAd7LL3yqKHThji/Bo+vD00PC3SAbpder2d6BJhOMez2XqFY2vPSY81earoiR+ajzuvHBC4PuwDjNYwnNq5BkGCF/D6EOenVfVJZdWHG4/oCciJzX+fwYQYw0sY8ur5cRxyY6wyWC2QH9YflDKbwFteiqnh8E1+B4mqSFiTcaM79FAU6rYxknXmw/BArNdbXvAxvYDyGKxQA1k6GwW9TWSg/CpKAmuJW2Xv1nMCqt3ZIJCTO/H1PIi24XouNBGc9n0VOWKNWZTI8CIZLRB+/LzLuT/vjhu4qA/LE6SkDXw1dTkgkkUChUKN4PrWfwTVIEgZwjPdewOZ9D9JT8TmPSZtGvVuDVOJl7+wBYGT4SkI9W2qU91h1VT+vmXO/7QyQ/kj2ny092GjT2aJTFAbtusAjV3dKZnfodXaCX/dQ3JnSuP2mWQGZ/2Gj5AB92FNvqeTkiqovS2hGgXjyOYp4JeXVPvBa1tWEo0Cy4FrqBLaycNIHuhGiWAhLrivXTX2YqyM3NfEmEuyzXu5M3E6eQhaF8uveDjqhxF1z07IUXU8zBCvHtC7vX2aYPfSKGWcpvGKa8NnkjamRY1qJbj1Jr15a9UBSM1TyWNGp3pxFHyy707FlayRDIdJOe0iYqQw/5qZQJBl1u4/1zbOldP3dPFtbGuhR257+wNWwKKfACorTsBg==
jwt-key.pem: AgBYRkRh01LSyyozE46odjgrHsZ6gI3ykVOdV7qMPEFt5lILq44BKFt3vVL+yAUz0brVPQeEjz7dg+xsurAKKMjvuxzkOqBsSFhWwBzy+f+GfTSZPBrBNPAX7jI05dUNbcu2UuxYMlgVq6VWa9lf0Gc8yvuEuD0nS2qmpj1ACL6awLBKnkVXL9c5mvoC97DRyk920rPTnERJGU5q7i+zue4sxufYJwJZAJLOmdpzavHfQ3lCcJr6FfboFmGnvD6SM85rXTtImyDY4tsXf4J1rRriYR1OQe91j4SSbvxDFskXYSQ4bTgjimat21SXLCImj/Pqh6LJz7wMd9aW95ju4jDE1q1og0ToIL0Nybl9ANhqlJgFtOfvQRnaJVQQw/2GitlDVejJHCYWsVsSxQtAhvrGdWDOrZ1eTzvsmBnGcWzDwtC1YN3u+Wd0qJBfoRIJLiinwLaJ7ponm5MSb9Qjkym99gXm6XUO0MlHS52pfVaai+OmyWE6B6nF9tf3YVXfjZcNVB1pFHCZZR6XcnIm+wi1EwxXR8NIeFgqiaIm+BwX9u6IMiQOHCVznHD5nc2wfSXpeeT75IX/HAzRWC2cc6a8vPsr+h4A4hqW+cOoMYb9gQQIa+F5X4LcWb6f/0HJHh1IO4vf+P2hVU/5CkpgGJk+x48KgkrX0CE+bafQQjNp8JTdis1gxSGEX0QUaVGl+x7exGhrKlW81ZZTovequibx1JhdNSXNbWZxQ2fXz7SdN+/AjYyEh1gNPI2Zx6RRJc5BlDSSt7TYwqy1NUcPfbJV7hbqV7oDUH8JrsoSk+xxB0WDE+Uh5P4MsQna6NWkWyFV4tvfK4QyMupQaxOAKOYV27DxBaTr
template:
metadata:
name: garage-ui-secrets
apps/garage/kustomization.yaml
-1
View File
@@ -4,4 +4,3 @@ resources:
- httproute-s3.yaml
- sealed-secret.yaml
- service-admin.yaml
- networkpolicy.yaml
apps/garage/networkpolicy.yaml
-44
View File
@@ -1,44 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: garage
namespace: garage
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: redoost
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: monitoring
podSelector:
matchLabels:
app.kubernetes.io/name: loki
ports:
- port: 3900
protocol: TCP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: redoost
ports:
- port: 3902
protocol: TCP
- from:
- podSelector:
matchLabels:
app.kubernetes.io/name: garage-ui
ports:
- port: 3903
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: garage
policyTypes:
- Ingress
- Egress
apps/garage/sealed-secret.yaml
+1 -1
View File
@@ -5,7 +5,7 @@ metadata:
namespace: garage
spec:
encryptedData:
rpcSecret: AgB5qZc+lP+J11wyLaNSG++stokqfiu0KuX+FPIzO9WZIHsdNGoBlcCifn9jsbVxB5z9tbSlteSTS/hVLHvYWEGPK5MNdRZORG5lSGqf428+jmdCp4kXAQp80nBHsqsOpJeHJtuM3IlEEpHMfV18cXnz9Q3fOj7hcSBRb28XzdAdyEIr3ZG7ThPScXR0lQFwYe5/W4GikGQvLUHSn8DwZgsJesP4bJdHlHaifPYZMLFa4JSv0bcwrz5+WjsKWU3xa5wkHrMT05ihaK63n9vUOb4/AwPQHBL2BJfl95DlmoRAIvAqwlfA3d7N7Nekb9G8ZupUTnPRZBQ2+32JsHZ64B+nIR1/WC6+8U+2McTMJtORCidHbf0i0E6Q6ClpMeoGobtVy6z+rOkUF3Z9xW/WwS1hznb5LXRW1My/KPvo0pztyEipdTZFqRkq2teGf1pXvELORlA3yoE3K1JU3RgCmDWOD4sUbuacWhjG1127Zo+W3gnxudVbODJ+s/F7HLC+6IHlWBarTd9QbTHemD/8/iZpkqWmyg1oexowvzWlG6jWFsxBe+hMQ9vzFmPkYDsfzBNMeJohwhOxPG3h/aWkBw1FHqd5/VOY7R1t+BpCI9xanWKL9F/rOa5wH5wfOyLptLv057ZxCBCRZQNDeVsAaU+Z+odBYhGQxnsZIPly9L8vAnS5h68A1bnTHhyob4RuIaLoSTKGDHnNOvzIhclu5DSfr5cSkRxbRRFPD67KSpNhoU7NUnjJJE171yJZADI/f5XZPVfe/1mu7Y3epDExT/oD
rpcSecret: AgDWvOoSUADQx+cExTUDmk6/BWR8a7U5HRGf+T38P24FrP4DJiKl3GJ3Ce9a3eF7SqO/1TXiaN80+c4NX0dMEmnaS8III2Zbaa7x/rOHP608Vh1z2Nnxly11X10okVy+Qym9O5/oA3cue2bu6K3eG8W38mn3hCA9kWC6g9OiAwjBTxJXYmsUFYbj69Iloo9moBBLEtztu8T9vYu8rGqcchKzzjnvcS91kiduq9rY9/ZvYC4zx469DgnV/di8cjGdU6JAtsoHwggDtCVf2hvkyOIHTyPM9Y/EVGCsOsIzhJnTdsyRGn4su3ruLmS8VqbKC22Q86pSHjwdlD5RoZJjYtMWr5Q5YAvFbnTH9/+d0r363BfxlNsVkINd5d2OwlPpagEQ9pg4oFnnk48tsVEoYz1RCy9x/bK3U4B0Jin6l0T2NJ3umXPriLxBQbODWVA9vcv6G1tQiiuOsbYCWigoxe3ACpuYQDV+XujfmEZr3pcIw0hwKXtUWHI079aUkICcMEbtE3gLc1dNVQpja1SimZOUlqf6pz3YLv6L1e2X+yR93p2rN6hc8IJh3KA8ZR1Ymbbq2LaOwdyla50uuhsOkE2TGDTGmf9NyXjGcUys5LgNpRruzXEm/KgUX4tP7iMjHu5HbnDe9oiv66qfuIORiR2P3lbOdx3s+XmPd/87afw6YHA896ccCRkGpGnFanbrR+Z7MRqCOZsSLnQd1JpjnWJJU/bzrSl4q+PUV1Bt+hvAf8wXUrDtES6MdpOKUe4XW8s3QbVHvCx1iOSzP+r59T4N
template:
metadata:
name: garage-secrets
apps/holyarrs/deployment.yaml
-74
View File
@@ -1,74 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: holyarrs
namespace: holyarrs
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: holyarrs
strategy:
type: Recreate
template:
metadata:
labels:
app.kubernetes.io/name: holyarrs
spec:
containers:
- env:
- name: TZ
value: Etc/UTC
- name: HOLYARRS_ALLOWED_HOSTS
value: holyarrs.whyredfire.dev
# Traefik's pods
- name: HOLYARRS_TRUSTED_PROXIES
value: 10.42.0.0/16
image: holyarrs/holyarrs:1.0.9@sha256:3d941aa8a78d4474cc016a0d994b2531aa8692015aaad487cbdee136e8dd4226
livenessProbe:
httpGet:
path: /healthz
port: http
initialDelaySeconds: 10
periodSeconds: 30
name: holyarrs
ports:
- containerPort: 6262
name: http
readinessProbe:
httpGet:
path: /healthz
port: http
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 50m
memory: 192Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /config
name: config
# Same path as Jellyfin; one mount so imports hardlink instead of copy
- mountPath: /media
name: media
# Owner of /srv/media, same as qBittorrent
securityContext:
fsGroup: 1000
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
volumes:
- name: config
persistentVolumeClaim:
claimName: holyarrs-config
- hostPath:
path: /srv/media
name: media
apps/holyarrs/networkpolicy.yaml
-62
View File
@@ -1,62 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: holyarrs
namespace: holyarrs
spec:
# Metadata and indexers are on the internet; in the cluster it only talks
# to Jellyfin and qBittorrent
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 8096
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: jellyfin
podSelector:
matchLabels:
app.kubernetes.io/name: jellyfin
- ports:
- port: 8080
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: qbit
podSelector:
matchLabels:
app.kubernetes.io/name: qbittorrent
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 6262
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: holyarrs
policyTypes:
- Ingress
- Egress
apps/holyarrs/pvc.yaml
-11
View File
@@ -1,11 +0,0 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: holyarrs-config
namespace: holyarrs
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
apps/holyarrs/service.yaml
-12
View File
@@ -1,12 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: holyarrs
namespace: holyarrs
spec:
ports:
- name: http
port: 6262
targetPort: http
selector:
app.kubernetes.io/name: holyarrs
apps/jellyfin/kustomization.yaml
-1
View File
@@ -3,4 +3,3 @@ kind: Kustomization
resources:
- httproute-local.yaml
- httproute.yaml
- networkpolicy-holyarrs.yaml
apps/jellyfin/networkpolicy-holyarrs.yaml
-25
View File
@@ -1,25 +0,0 @@
# Lets HolyArrs ask Jellyfin to rescan after imports and sign people in.
# Adds to the chart's policy, which only admits traefik.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: jellyfin-from-holyarrs
namespace: jellyfin
spec:
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: holyarrs
podSelector:
matchLabels:
app.kubernetes.io/name: holyarrs
ports:
- port: 8096
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: jellyfin
app.kubernetes.io/instance: jellyfin
policyTypes:
- Ingress
apps/pgweb/bookmark-grafana.yaml
-13
View File
@@ -1,13 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: pgweb-bookmark-grafana
namespace: pgweb
data:
grafana.toml: |
host = "postgres-rw.postgres.svc.cluster.local"
user = "pgweb"
passwordvar = "DATABASE_PASSWORD"
database = "grafana"
sslmode = "require"
readonly = true
apps/pgweb/bookmark-redoost.yaml
-13
View File
@@ -1,13 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: pgweb-bookmark-redoost
namespace: pgweb
data:
redoost.toml: |
host = "postgres-rw.postgres.svc.cluster.local"
user = "pgweb"
passwordvar = "DATABASE_PASSWORD"
database = "redoost"
sslmode = "require"
readonly = true
apps/pgweb/deployment.yaml
-73
View File
@@ -1,73 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: pgweb
namespace: pgweb
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: pgweb
strategy:
type: Recreate
template:
metadata:
labels:
app.kubernetes.io/name: pgweb
spec:
containers:
- args:
- --bookmarks-dir=/bookmarks
- --bookmarks-only
- --no-ssh
- --readonly
- --skip-open
env:
- name: DATABASE_PASSWORD
valueFrom:
secretKeyRef:
key: password
name: pgweb
image: ghcr.io/whyredfire/pgweb:sha-2c734cc
livenessProbe:
httpGet:
path: /
port: http
name: pgweb
ports:
- containerPort: 8081
name: http
readinessProbe:
httpGet:
path: /
port: http
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 10m
memory: 32Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /bookmarks
name: bookmarks
readOnly: true
securityContext:
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
volumes:
- name: bookmarks
projected:
sources:
- configMap:
name: pgweb-bookmark-grafana
- configMap:
name: pgweb-bookmark-redoost
apps/pgweb/httproute.yaml
-37
View File
@@ -1,37 +0,0 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
annotations:
argocd.argoproj.io/sync-wave: "2"
name: pgweb
namespace: pgweb
spec:
hostnames:
- pgweb.whyredfire.dev
parentRefs:
- kind: Gateway
name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
- backendRefs:
- name: authentik-server
namespace: authentik
port: 80
matches:
- path:
type: PathPrefix
value: /outpost.goauthentik.io
- backendRefs:
- name: pgweb
port: 8081
filters:
- extensionRef:
group: traefik.io
kind: Middleware
name: authentik
type: ExtensionRef
matches:
- path:
type: PathPrefix
value: /
apps/pgweb/kustomization.yaml
-11
View File
@@ -1,11 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- sealed-secret.yaml
- bookmark-grafana.yaml
- bookmark-redoost.yaml
- deployment.yaml
- service.yaml
- networkpolicy.yaml
- middleware.yaml
- httproute.yaml
apps/pgweb/middleware.yaml
-17
View File
@@ -1,17 +0,0 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
annotations:
argocd.argoproj.io/sync-wave: "1"
name: authentik
namespace: pgweb
spec:
forwardAuth:
address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-email
- X-authentik-name
- X-authentik-uid
trustForwardHeader: true
apps/pgweb/networkpolicy.yaml
-44
View File
@@ -1,44 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: pgweb
namespace: pgweb
spec:
# Only traefik may reach pgweb, so authentik can't be bypassed.
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 5432
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: postgres
podSelector:
matchLabels:
cnpg.io/cluster: postgres
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8081
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: pgweb
policyTypes:
- Ingress
- Egress
apps/pgweb/sealed-secret.yaml
-12
View File
@@ -1,12 +0,0 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: pgweb
namespace: pgweb
spec:
encryptedData:
password: AgCCLx1xyP6tj0NnqQpB20SXNfb1k+Y2jL2U5JEz1UMR+bx7LXCGkFoWBGdvLBEO0gOtoYwcG2zQf89ukurqVx4V6Z7/22/0ERvOw1HiFrqnHh9B+1KhO/76iC2V+0a+2elCYrPuTUeV8MaBbleY8qPHqTVbx7P5umvtrvmI9YcLaROw/6FKmgwN75JYMWjeeAhrhW4knOgJKgZqXFcGUIqPeC08TBVvRfIfkxyahx1mS3Bi4Wu1GdYaaUOfyrhCUuyhhE9Fo/dAFVkshnJGRPpBvIjM/iFsR8LZYO+WuVE4HbX2Jf/re7jZMELs+PbliX4I4RUNUTo8P6J0GEMlpHXTzkpVvtRsSy6SZynEmr3u3rLFW6y7xvqx+fMNEIO366Vn6wkDMCakHroo7ZCCgMIhwTqtbIkJ1wLm89SzMXaAapR0ZPpF2W2t//XZ6XAPnAXuwW1aynLddHd/4q4H4GFJgH1igMtAU4Rdt69P7F6V2w/SgDR5kAXVzh9VOFdiWQ0cB00E9d19PpAIbEhx6SJ8zgout/RjYGZJyr+jLML97KqiSwaH7k6dH4JfezLeBnlknulbge7NRoL1QiN0h+rs/O66+lD37mlQV63mWDgbkqhzDIV7Q2ORRyj1PZ1mJ9arzNnWOGD3DpjO3IRVW95XEHqj4Q7FGZ5AOMHYG/Jh92LWqLmVjKG74omWf3gsFAdN6SojEf40TICFCaiPUpo7rwPCBialScmMBVDq9RJmlCjdXrIlEbBx5AxI/HR/oT2wrS9Z7slwN42jYq3T9f7A
template:
metadata:
name: pgweb
namespace: pgweb
apps/qbit/deployment.yaml
-140
View File
@@ -1,140 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: qbittorrent
namespace: qbit
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: qbittorrent
strategy:
type: Recreate
template:
metadata:
labels:
app.kubernetes.io/name: qbittorrent
spec:
containers:
- env:
- name: PUID
value: "1000"
- name: PGID
value: "1000"
- name: TZ
value: Etc/UTC
- name: WEBUI_PORT
value: "8080"
- name: TORRENTING_PORT
value: "6881"
image: lscr.io/linuxserver/qbittorrent:5.2.4_v2.0.15-ls480
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 30
periodSeconds: 30
name: qbittorrent
ports:
- containerPort: 8080
name: http
resources:
limits:
cpu: 1000m
memory: 2Gi
requests:
cpu: 50m
memory: 128Mi
volumeMounts:
- mountPath: /config
name: config
- mountPath: /downloads
name: downloads
dnsConfig:
nameservers:
- 127.0.0.1
dnsPolicy: None
initContainers:
- args:
- ip rule del table 51820; ip -6 rule del table 51820; exec /gluetun-entrypoint
command:
- /bin/sh
- -c
env:
- name: VPN_SERVICE_PROVIDER
value: custom
- name: VPN_TYPE
value: wireguard
- name: WIREGUARD_IMPLEMENTATION
value: kernelspace
- name: WIREGUARD_PRIVATE_KEY
valueFrom:
secretKeyRef:
key: WIREGUARD_PRIVATE_KEY
name: wireguard
- name: WIREGUARD_PUBLIC_KEY
valueFrom:
secretKeyRef:
key: WIREGUARD_PUBLIC_KEY
name: wireguard
- name: WIREGUARD_ADDRESSES
valueFrom:
secretKeyRef:
key: WIREGUARD_ADDRESSES
name: wireguard
- name: WIREGUARD_ENDPOINT_IP
valueFrom:
secretKeyRef:
key: WIREGUARD_ENDPOINT_IP
name: wireguard
- name: WIREGUARD_ENDPOINT_PORT
valueFrom:
secretKeyRef:
key: WIREGUARD_ENDPOINT_PORT
name: wireguard
- name: WIREGUARD_MTU
value: "1280"
- name: WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL
value: 25s
- name: FIREWALL_INPUT_PORTS
value: "8080"
- name: HEALTH_VPN_DURATION_INITIAL
value: 30s
- name: TZ
value: Etc/UTC
image: qmcgaw/gluetun:v3.41.3
livenessProbe:
exec:
command:
- /gluetun-entrypoint
- healthcheck
periodSeconds: 30
timeoutSeconds: 10
name: gluetun
resources:
limits:
cpu: 500m
memory: 256Mi
requests:
cpu: 10m
memory: 96Mi
restartPolicy: Always
securityContext:
capabilities:
add:
- NET_ADMIN
startupProbe:
exec:
command:
- /gluetun-entrypoint
- healthcheck
failureThreshold: 30
periodSeconds: 5
timeoutSeconds: 5
volumes:
- name: config
persistentVolumeClaim:
claimName: qbit-config-pvc
- hostPath:
path: /srv/media
name: downloads
apps/qbit/httproute.yaml
-37
View File
@@ -1,37 +0,0 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
annotations:
argocd.argoproj.io/sync-wave: "2"
name: qbittorrent
namespace: qbit
spec:
hostnames:
- qbit.whyredfire.dev
parentRefs:
- kind: Gateway
name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
- backendRefs:
- name: authentik-server
namespace: authentik
port: 80
matches:
- path:
type: PathPrefix
value: /outpost.goauthentik.io
- backendRefs:
- name: qbittorrent
port: 8080
filters:
- extensionRef:
group: traefik.io
kind: Middleware
name: authentik
type: ExtensionRef
matches:
- path:
type: PathPrefix
value: /
apps/qbit/middleware.yaml
-17
View File
@@ -1,17 +0,0 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
annotations:
argocd.argoproj.io/sync-wave: "1"
name: authentik
namespace: qbit
spec:
forwardAuth:
address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-email
- X-authentik-name
- X-authentik-uid
trustForwardHeader: true
apps/qbit/networkpolicy.yaml
-39
View File
@@ -1,39 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: qbittorrent
namespace: qbit
spec:
egress:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
# HolyArrs sends releases and follows downloads through the Web API
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: holyarrs
podSelector:
matchLabels:
app.kubernetes.io/name: holyarrs
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: qbittorrent
policyTypes:
- Ingress
- Egress
apps/qbit/sealed-secret.yaml
-17
View File
@@ -1,17 +0,0 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: wireguard
namespace: qbit
spec:
encryptedData:
WIREGUARD_ADDRESSES: AgAgYz7lVospXNvfy7IZOK/fxQe2OWJ6cc7ZzQf7kfXtZgARrffOg2trievpkcimVhi2dL8CTbYwuiJ72M0FirxOq9zTyUGh48AagZk9JygQntCrkJp7O9E3nSpyTJanq2L5QWug3WePvrjK8ShzmSJLQT43l/hAxFPy9u2JbblU5vjpvPpZCHpVU7HuZ/lqfNEI5zRj6mzxZnphmctEGzXW+wilw+WHENvDBL+jqSMgylAycu/5+Uc5X1JGLqEN2DWRyCQBRMDxkiMBnVvE+ImfkxHU+ZcTMUANllnqNwjot/jpFDZb1b916n8eBLMoSUkwKpTP5DfT0slez7hC+bJ9tkUXAAUHDRm18XTtGY1Ouh1uqtIQl8HiuY0hoShfPF3BfC/4wNXMRZjsj1R++z6kP/vQyiSu+z2PuEI8yzDRnNQGEnSnog7bTJBdui/MXHUc7Q+wgVNZ0/c4HfViZbw4zP6GVf+jshdUbOR8HC+KxRlKzU8cNDeUdnydUxplF+By8gyWg1hPY/GlD+8hRWqi1QDLdgl5JXEwDpU++WmKhiBHrm72f1BgZ5jlIiMON3Z2Vo18DzY8j9zUA59uAQsxDhSu7+wiuWQYbZrSVdFY006eBWaI3gVPeu3e3++i2ogKFfc6q5gmmaxhs1CLhhUypddKUzkfXDz7alMuauKq/h4uLesoqIFEXD9eWPs4mP9qirYx8MAZP9txx/YP
WIREGUARD_ENDPOINT_IP: AgDEkEaKaG9zfbuT9Hx3HMWZJzVT8QnMWN7eebCx654Gwn6XNtxD/22d8wxIRfhllrv47HCsCUR855ptHD9HQjeJ08WhMFm7nQl1rYI/5vKfZDyWdSR3grBzGConz0Eue3y5uljXcr0yN+9kqzURPr5MPs6fKRJVfSWaMFbsjb2S1Y3HRPXU3+xdoDxeOeVmMV/pP1enGRnZX890UF5QR2wfZcEXB6WPWWC1XnPxc7CFmLNRi4RRhLjh+A9WDIqEny5gviBTFXQsOEnFqAEFSmey/zMF+Rk2lGEWl6ROFzdH7ypr9KNA0dtMmfCLJ9AQF9P6MMD/uh2CyB5K9Jk5xNGoy3EgpQyjHp7q6FGiUG/jT2RXBdfoiJoq/NPsgQB3leIzEBBQk/DRau+xcob6H75nVtS+fVWOJFt6tsWKVAQhDc7YO7WvwRyTups+3s0iHxS8SXbshiC+ndZPZClPO4UXVY9OhMAUZ3sKwS2c0Ffj3xzJZWTnO7JBcONYmjo9qASd6FJQKPvIy6T4t9EEe6iL05t0/mIsnOIEdoN2le5Lv4DK5mmlboCW3FzSK/e/QD1iZLJVwrTF7gvBKvsGk+hCng6GZMsr/3++t2bZYMUjMZPTpDaTk2z3N2An8Qg0X2HM57D/pTZiaiKTy83cjQsnFhkLBHzsqGhtJbScJHtasAMt07+kW9t/8T5LTGSv8h6w0e2Iyj/TsShc1ZuA
WIREGUARD_ENDPOINT_PORT: AgCANmOaOgGnXywiDn755qCxBADq995QPGwBQYiApioSaYC32UP64SVP6RRDBGvC+jjFqhmXZlSDTN0LdrKG0x9d7klVIlF2awTIdRKAzN9wki0lLZQZ9Xx0wQl/YVXTKgcVtiuWeOmSJOEPm8Zxw8/1Rj21bg1PV05VZc4jxqsq+s0AdDy8DDIphD0Pobp0/U8MpowFRFEGnjmfE+Ap0wV/L7CR1opFr0PJHuEbgjp2+WfgnnG2Hwqj8nEUXiZzZzd0YIQ53sE7rlpBfTgWIBpeisOD1NAmAr5UxdTSlYhKn11pdMgIdybYGS22RTYMdKh9S6I+S0AjA0Gnci2O62c7y1aFIMxLrq2G8LhTlCEiRrYirGzNQZiVooGAnJE2evcTVnjZTGS2eHH5d+86Fq2anD+YzYhW9QLyp8goEyqHjuf7EoGF5H78Ij0lJ+rPreA0dSU0uOEC4dKZQpvdjkMZFu++uusNWLh1x8tvQBdRBDqExc2qbulBnn8VxRk1jwMKjwRarGrt0K4f2Dn3pWGc8d7JuLxnJ5QDljp/BaNlrOhnp95h1Uh4vQoj6fvn78aMkAQDbIIVaCx2IFVPEJBXCfbYIbV7mY1M7roRTZPUQ4+mGDe3IEPeXLvI96QK5en+0VsksB37+eFp7BIsNibzViJI5KgBYp+Hd9PECPYKivPjhP15vqLEcqGuskahvxp7xblS
WIREGUARD_PRIVATE_KEY: AgB1iJHqHhWudTU26hAXvWpp8OsCccV7ASH1BG+hmo5nXTEyBpjCQ58yuYMIYHIJq+iLlrHTr3cn4s2Q9CO+BEnca1O6sfOYzewoIqvVVjF4ol2TurPz+Q+FhqO1W+IAE4qrg/2/qTwyg7HcvBHEsKvIH0M9huAk6hgzGrh0Hx1NK2AyvtEkW11Bxubux4LVNxjqS9RuNNzIvVURU4aN6sDX1Jhkvv6cr/DU8QwopojHJnrxVOA++rWgF4IFvkz0K487WKkE7Pn+aTW0t+vN0JgxIobznoyMVRkUqeEDbE1nBaf+/JSQ1FREcv4CSIzT+Zcb1XslkGB4vOjEC0ZBkiQaAxHQdl0Fdthmt/5NnXonl+5mFDVepDmoGPmsk272uMGxl0vvTXWZXQfasspf0MBGBjR/NF6MPVkEf2n6Gkk3INvtQUbtwjKpmbQj1INBKVhOgEH5RDwyYsHz6FkrtPQmv8odwcTpQzL4gC7bZ5aRY/MGJDnWRNHZsU2j4Juqpc7q8t15xT26gvhedGwcD07uYM97gGvMtVhiCFAYj8XOKJAfhqeROgbGjWSpUC/9D5ERNg9BYhYyYjcOmrmdL3x2LZEiWCwKI6jR0YssmuGsAgX0z01h4OvLTN+kjc9hurdPdat2zqNr7w48CdE117ahLd3li//iYWlEC5mVCnHQ6iRrh65LstfCDwWBdFHTLfdpAhe0Ugd6rcVJt1sHPGL/5E6tLECU8zwOThU6WygHmvWpjLzWIX1bO2eF6g==
WIREGUARD_PUBLIC_KEY: AgASGQ2/lkGyl0HYWYlwuJZ1EtxoHrCIf/Zgzk7hCe3he1kHZHrcDpdoMPVEd5ys72wHW1crygowq1h1ySHPRb/gU6OgxBQHvZkGXBxmXon8u3KIuahuAnXwHsftO7qIepAGTka9S8/7GTeXEutXGMOWgfdRO3RzBUzkmoFH6lyFwco1U6SBfyfN0MVfPTTlMk4fV6DBZk4ygOf6Slow3/CR5+2otNRFx3fnzPTU2bEg0QvuMXg2RPmse9YnjIiSKl5gVmt5FwIyo7IDpgJy67rwfGu17Hv3cIhOdLLskPkakd97MVxpBp8xeGLSOL+5ogeoi2rvKvF3AbRyuMhi1eUlTuYuFp672tPQqkrTr512LsL44+WZdivhEAAl/bkMSJDHejAyta0n/3BJTIBaF9T7/ZPagfMSE6rBwpI9qpiNHNaCD+qeo9f4+f9VvVj0TTvhGku3ERh3cWiaJ3RElcpzhlWNlBb1Rnnmz5d++ES85W78vq58HjfYv9Y0JzOWmjdk0PhOxd7us4qNGOUaEs9CnkdDKU2AAnbbPkIw7CIGR8fTeNsyQw4L0VtP9X5X9NvjAsBsCgzPKQg8dcGFL07G/JLWVOCFQidn9L0SxQXH5O6bH4lic2jFQjCdwmOD9CkT/49Gb6ZzxwUnlYTO6mlNtIiFKhH/b+WAjDc9LMfwvSxNft1fkjgFjrSvk8No9NyU8QVvIPxQLJnKdVxSWWAaI8pePPeKaTD3a/qeANkb8HWIh6Z17zNx1ggC9A==
wgcf-account.toml: AgCmivAwuSXzJouUpC2FRB5vzLQ6Zj4LYzTbpwo6S6FuB0npes/61jtvdBuT+zdw+GuXhANRW0g4IBo8B/m/rtOzauZ0Sao6hqvlwTBbTPd6B/lnwQMMF/u4SrdsmRjFrlPxRWWs4rVZfDVcoeQqy7GCpRRHx36z/uwTGoFbz1yvTWO9RLJWCTMI8es8zoHzudpe9fS6PcAo4Cxv4ezA7kPMqQ88JkT5C0HdTNj5xEm/lhkrA/5mdF2ScDC8JOVJnJkURirr0glPRRoYlKB9wlSXcLtXMjlVWu72cND29QcOmJHaSyVZLzWtu83rA8axZBjX9c2Dgtw7zwtf06Lapcj91Qo2ul4vKXMfH9CoCzEpMwllSWKZZndV+OgkG53qKWzvrDj/bagK4qX4TLibCAdGd0hQ+/IX9ATJdmdRgHMu2AW3dudsLMXJJF8/5NdKS9ULeWXA/Fi1P+Ahebi1mS3NyRIQpAB0Fa9+FoaHUIp4itNOaOVQEQP/xKUCBeB4yFTqcCqnOwogPbzpsvPJWnoUTKCKDB9PCActjAiRPkGsxj+rh8FGfm/xjSbuzdLg42fHiFSO17zMr1xWbuhhUv4/LM0JXJki61e7/ZOPTjzJACykH2L9KYoC+jHv1+Tfr+tXnhO5yX9G7BUKF4r0CCciVufnH1N0j8ZsSDoqxT9avimH0hJJiJ596pW/UbM9KXbf8omqShd88rGHF++eX51Kp3eU2+JVFhpYsrWjtYOSUHobU6NqJZDYMc1TE3hAa8GeiGtuKweovD/mcbhEXvNksIOQqB2JZ8dODgFtN8WAcRQqRALoag5OyokcpZcnpd9NUgvPVUpCyddnKnF3oF9hR1uhhG71U7rf7OTtNO9KZwy0tg20cPQ+fz88vXLRejezCqf7yfVgd6pqxXtw7XgPHMR0j0RhKMrahee3Q/TWBou/XB1kVYkJHLfg6QLmRiaWVT4I/xd7zEZF7Li0VNc49g==
template:
metadata:
name: wireguard
namespace: qbit
apps/qbit/service.yaml
-12
View File
@@ -1,12 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: qbittorrent
namespace: qbit
spec:
ports:
- name: http
port: 8080
targetPort: http
selector:
app.kubernetes.io/name: qbittorrent
apps/redoost/auth-sealedsecret.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: redoost-auth
namespace: redoost
spec:
encryptedData:
REDOOST_JWT_SECRET: AgBlwaY7ZaZZSSpLoS4XOF5+dghrmIXZu4YN7kQxlm2WunpxMjw4VjCz5Iz6OxvsJrh0R4rf4YfIotHTlbs1Ylc9JtjrjcO0joi3+VwenIGLbGKi3tq0JJCJohrAkFF08Ro9d2UEFx39vhEXJ6EFDoNqhZp8v51OXdLRe5gAU7kwEHyWIxZMzxC9LeVLCPN3Ss+LJCALa+ePoYOENYADy9PK0BgsvXddnUmRIaxRVv81qc74c1tHnzCL79nazVtFw4gdqV9m9QuPzRem2pHXRvIC8O8J08LeCSrp1XXJnRB7SDWEdKYS6iSL+/ohOhxYGRUSDq+bG68b7pWTQu8Gp/jHyPiZWcjtL5V6fzs4otE8Ur7prAbflXZHLuxzUjPHsUJ6JMoP/Eousb5ui/rcA2jtjVOlPmxaIncj2Q5JK4jABMt8s19oyFedlEHD2Er7WXF7ZoYY2LFu5c645ltju3HlUflxac66NDhVDqy5BGpFyjwkC/XJ6mrl3gqp756UaFrFW8ViuJllhYty08KBU5eA9AOvi9JRl0AVHGQPAE0kV+4SC97Q0zXcqNb0FR9PloOUNvoqyFyjU/n8LUO8ObWw8zrCPljigexHRKEawwgxEVCrqMNHaAtzEhD5uXrDvsTZ4ONFOAooR+dSKM13HSMyvwFyPY+vzZr6D1Mef4dxYfHwJeV6WtZuAFFsfQFS7QhFpCIDsDXV3FDxY4PJnREG9jFr/lkgShlLFD7IcdDBYC1BxwjNUNdMUW5oA1AiKyByd5aCQgetHy1UbJKGy7yO
REDOOST_OIDC_CLIENT_SECRET: AgDS2dN+lFtGk/DHb7TNj3+trQLgxNIQZBth1nHLH90gXh1Etz04wKwWmI+/OJWGqxaa4xbxrcJWJDaAQeAK34qOQ6nu3uVV10lK0PBHqaGVA9s7uu9LsMy08dGC3IcHGI7dSyNaBoWAgO/CbRJYRBIEl9ePibm5bvhMo0VQZk8LtiBxrsySLyYqBSEDLOxbrGGtEO6jAlAe21jKTFOdaSdwZ+oGPWAuKICciA8bl4A5iqkJR8P0AD0azZ/HjYtygOL9Lextlf2IcRyzFC6lmyYEyn/O02rTGgFuCZHHDcF1fS9VOXDXlJVpvFSd7fsbvLa1BOqZ4y0UlJ7BVP03IzmieJIbl3Ey57Pr/mWlpQ9j6a7Fo90zF1Z8eribSZvJIuRdLPWIBfHJTqBVB6S0YiUNcn2KArwx5hKbRqEfb1NDFyDV0cfT7dXTN69xcc4YByBdaUmFjZZKfz0gYIOYKZo8bkA/vHiIjYYOdamSJpdThNFMLuqD6mJdsNx3EZLoXjkezmbWig764AudHfkzU9OOqi095rW1tP2mSK9T1qAxjs/lr/PGNjTQU5CNQ/XOi0qZgnjUmRZEyuDz79lvL8LeE9XWLVQ3eQ+z2Mm//YNcx1soaHdDnhUKtFXEqcl3tj9InWmCloHtB8xtxyBoB2yEUR5eEls3qHCfdiebt7mINDMdO0QqmNdleFKz3TTs7/2NgJ3xfzK/cSkkfXxvUHmRgYpGWG8887KifIEONZvn6ZLDfg==
template:
metadata:
name: redoost-auth
namespace: redoost
type: Opaque
apps/redoost/database-sealedsecret.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: redoost-db
namespace: redoost
spec:
encryptedData:
REDOOST_DATABASE_URL: AgBqe7ze4oAAyWrbSdLWaaQ3laVs7WxBobr0/H/YFpXIyALuVZP2O5rtB/0BGauc1xPEQl9aeYkmSzAvaK0ECtEvU/Wj9QLfSJ0WCcGXrK+Cou7ykW6lSwFfbTOzDylCDpZtSEKanFFj8KCmeu/7PS/gwi9zsJXKR4xgfaWEPztCr6ND8iHY6RkBAxljl3NLeR0y6auC/eq/Tj08IkTGlXHeF9nQN7SaCl4t+kxtjY+k1CLbXUmbmNY16c0H2DFwbLQ9RgsyvL6aXnJ2LeqRvNsg3QdZDPDJwvs1wqR/4U+hTRh8tAGrmIoqQKuxcasEL5bmBX6Bo1JVlS9xgULf9bPbHP4mncClHFJrXTHmNv10cLLuyd/o0YdBStWoaeIv2YSchnaoRH0Qu26GbF1CF2KrgE9Dwu6iCJn9Ux5LPhWBvjsNfJ6r7unw97IwEHSsrWT93osddiPi4rGLXS4rP89CouvUbN3LYsyJuI832Jj163lk/+EERxXR+ctVQJsgH1gZuHlswLXEkn0BvCT44w5+Sc0NgPkGeKyld4Fnn5FmHlba8qkyks9+J+mZBJC26fh9wZJN0JFbTkLov6sk6nGEMEvrIJyVBrAJi1FmEG0Uec8Fr/NyLv+1TZm0eeRZ1mk8J5h6QydsBu5Cq2wabfysnMsIJmS4YpL6kYSIcF0j8zr/ISfjEFchfnI9AcGQ8rhqYcytjkud+I+kpaq6R9wDMpUB7FV0S2J48A7seXmvJw7wA1ojdXFuQ7Ix0HCUIcFrvTPs6KqXe75DfXEtQ8Lm2xc+OWz7xm9DfbPkeo2s1CSmHpUg7WeRjNp7aoiJgFvy6+xZi8xe7nt8B7P87SHf5IbtLLpY9v2bcPjXJ8R/lzyXE/kOK+H/Dr9YDrGDZvZm
template:
metadata:
name: redoost-db
namespace: redoost
type: Opaque
apps/redoost/kustomization.yaml
-3
View File
@@ -2,6 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- sealed-secret.yaml
- database-sealedsecret.yaml
- auth-sealedsecret.yaml
- middleware.yaml
apps/redoost/middleware.yaml
-9
View File
@@ -1,9 +0,0 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
annotations:
argocd.argoproj.io/sync-wave: "1"
name: compress
namespace: redoost
spec:
compress: {}
apps/redoost/sealed-secret.yaml
+2 -2
View File
@@ -5,8 +5,8 @@ metadata:
namespace: redoost
spec:
encryptedData:
REDOOST_S3_ACCESS_KEY_ID: AgAsARN/0zM6asSlm+13UwKz2YvviQDwuvzPiP+Xy+kCi8VUdaQohzG0f7FfDhmG/0zvgc2EawNenf8QfUuEVYUMw/xa3orbvardL0RkOZN7dnm9bLm0LiuzRs6i5VgWSOBhCVZd3oMhlVyI2Pzbu09VtcTIqbIPrrrcrQzA5a9rIes8MKGEQbU3pdZILSKLFXgFWCqDGiex9ugkweI6jp9gk71hRzqpYOP9AA2df5kB0n+7HcIB4rDq7WlA/iXkCMH1NGhjDBMpRE/HyxhP0Td2WXqNsYKDM8Licq1qBnuSGT2FaTsCKXZ0X3ClFpbaXipzAwimqK4eg65tneT5NKbLnWjNZKx08scw98PcQzS4g+9l8nH8IIKOVq2+MuC+85e6yEgfkEjwknltEGSJl4VwdFUm5Ec2GVi1X9zWW4BzHuGWJYE/tj3atoCHfUnht3O8WVo1s4pSOMyInsetSlhV2YVMncOKVDHciY67+ih71jqiHqABGclbDzaQKFeXFY/e2J6o1tTRQ2ej5jxdjU+hdqig5/jsGqRc67t4oiOPEgEq4FmDTp27FGUIM20w3l74PC8vhX7GWOJfpl8DqvYgAJyYLO0hzSeE/Gl07/UZalq2Cinl0BwvROJ7kPVB4H+NqfbGl77AxMXWu49AUV3BBKG3xFI5eEVY9CRTL5lAY+WKW31543pgvB9lvYbq7LuTnvlOcKSwlXD0EeAWo4eyLuwtPOk0n8c26w==
REDOOST_S3_SECRET_ACCESS_KEY: AgDEE69d7G2xfvL/SyMz4HbsYO6bilvv0lh7gtSgfGLSBK1K3Bzn4tf3h6xRFLlO/mhlQCiozWSB9TQdltZyDvYswYH23kEaPR5m27yudHK7nxN1G8I/uyKFzm6o48keU+SGCakutYJ3Mqrbicj/Ogi+5VPG8M6Yxh/hKYcMO9i3cJDoqn93Ldyv9jRty8q9nNhaZDs52di1p+1S4FOZ0+ryrIPVtdPGfM2KViFnLG3DEBqMkxHNegWGRjie+AVKY/MOqVE64I7t+XBYnjLfy4aRpGFHhEXhihkfGklQMMKFwlIc8OChs0RfPHTWHlbTg73Xmr9uDyUDWgAG7VPfjuQU6RfgkWCGe3WjLF/7hPZmfzR/S2nhPZzNugFRBeWG6Q2FJ+ACPoJQFCmht2JackU9X7HivJee3UgfG0q63Ja2OK35oiwmHcPj2Wfv7YGarmnMw6QRiKY6ZpQN3/mlUyWNPMnwoRrb+JWQJTkVrRL1lZloydgtFX1y25v3XYjR6jU0s0aN1jacxIVto1C5UgNhLBIjhebXBnqVlWn4nJzYTLZvKnY0mHv8sF2cEXZNi4wqa8VdifZjSriqJKDCnQSPX0Gvr9XTRiqRWFNzoTRr0U6AnV3/zlxJaBb21zXAY7QbpbzExEbazJjhaaSCGoCGhVsVFOdn2KydbZd0mFR/o5KUDR7GXMJj/6wvNsjduyvlNFxJgCwElhApHTWxtsXWYR0yFeuIuTfyn6hbTo8TMQqPqAGKowSst+q0DvOKz7E7P5HZrvFBGkucSr5JdIxY
REDOOST_S3_ACCESS_KEY_ID: AgC0A+pQKuYKMLfMPRAtL6a3PBEkwgghd7IbH8ZGhgU086s23NvbOBM5sHHkApqOiQ9z2LarAfvvKpBdxlQTjInxhqdJ1lW/zkWHokHhSn/L4ule/efU18a5gXsxNXN0Mon9PZrS9wKAFR9ZNiEDFa2/L4iUtCesUR/MneUFqqqibxiUgt2R8sMmRIzP9O0b8T7vnw1EkgyO4HWpWlLrGPnBryWA4OEj9CGLrTT7Z8u3Z2J5m43dELfmzdAH4gM3RQPXAzAMY+QyxnhtGA6x52OTcD8XxqB1lW/dWzTq+zCjnmRR5HbpWjeuM6ojlFJZoBLxYRRMZowMEKFX4egKUvGEDmSKOX5Z+Hn5n11dyRFhpKrMU9vy+utLvVtDM/rr5NqK1Bna0u40VdUUwpdoqAWUevw9yLld2QzOg06hjqQwpqVER7E1VTDKjVXveacaN7si+63abaw649eAaFhTitMEE9ORHZ7Fz3YZB5zdqnEQWZwzczJhhvqzNxP0pg1/JCEVrKYVfHCtuDoJ0BCeiuFPWU8lKYhYoxRzm6biWhdevM4o5CobnCedH/O+TDq6iPDDgC9iBNHIQjwfUAjjq44OXfl7X9+J3Q7xm7BYMD+/8LvycbBauFtOnkj32fyuUKF/EvoQF/AIQ3TX6rC/CkbIMT+m+mcAx75CB6hfpBFOMRKgpTT7WNR1zs6YrSEzNNQq95KvTIMVYEEKm+gjrnpv9mkCkCmSJPCWsw==
REDOOST_S3_SECRET_ACCESS_KEY: AgCp8zFoy+Clr5qY/57jfSwYT44a2jwTFzHgOPoYfE6LXXtis40QjrteEjyc9oE4dE2IlR3wY85twCcqMEbJW24mkTbQf5E4B4V5XaUTi2XhMkrms1tfwaKJzYJiPfoS5u/WyrMN7LK/pqryEVGODKh/57PNoEDK/N/ab7w1iKfxGQQVuwDSCdsT3RtrinzKXKHUFsR4f3wpOAO9nh/53atgZ9MMs+6DFLmkdXvIfjgJ/PqCrtxKx3hTXFNhrwbDIUJFF/wF9SUy6C2CyHCycdeU5HJFSahCIRMZvFAhDrl0Ubsi/MFgWsQouj2q6VEK8VAWDttCJaiSf9g/KhELneKCYC7qo7e4PzhHhAHUGO5fILWxd7HySj4CxSiCDiF3kIqVUXo/sqlbgBNMvPb+NNqo19g27jcFZPh/AZZkuBSxsdmEYfgg1RAcYmwPGUxksRcj36yknYjX4pMxJNqVGDH1nLsplOa5b8h+evxMnjK6oNduRP96zHd+Qo4sC2ThBF3Ar8STJpbbJ+KgdW1HnHo38JYd0J8q/pcVq5xY3+VX8Gy8JSrb9wdFMZnb+iWmyL/GNwLIqqbZw1zcKF7Rru78fl8Y5VWDnrpbjn1buqDxwyFkDhcxX9WISoAPKXP9K2Cs5UOIKwu50cOAyA+cMOMsYbTnkvAuDMZ5aBPp80j0TQLu4luPPvKG1RumhYxGthmEpwQaPyXuJfhOBbuVrsiNlaCKe+d3Jv9l3Y4PVlTBJg7ZD7YpfLoyvt1Y9ELAI5qiUjZ4Ru5TxX2lIqZOoZ/G
template:
metadata:
name: redoost-s3
apps/rustbin/kustomization.yaml
-1
View File
@@ -5,4 +5,3 @@ resources:
- deployment.yaml
- service.yaml
- httproute.yaml
- networkpolicy.yaml
apps/rustbin/networkpolicy.yaml
-21
View File
@@ -1,21 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: rustbin
namespace: rustbin
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 3000
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: rustbin
policyTypes:
- Ingress
- Egress
apps/splitpro/cluster.yaml
+33
View File
@@ -0,0 +1,33 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: splitpro-db
namespace: splitpro
spec:
bootstrap:
initdb:
database: splitpro
owner: splitpro
postInitApplicationSQL:
- CREATE EXTENSION IF NOT EXISTS pg_cron;
- GRANT USAGE ON SCHEMA cron TO splitpro;
- GRANT REFERENCES ON cron.job TO splitpro;
- GRANT EXECUTE ON FUNCTION cron.alter_job(bigint, text, text, text, text, boolean) TO splitpro;
enablePDB: false
imageName: ghcr.io/whyredfire/postgres-cnpg:18-sha-62e724e
instances: 1
postgresql:
parameters:
cron.database_name: splitpro
cron.timezone: UTC
cron.use_background_workers: "on"
shared_preload_libraries:
- pg_cron
resources:
limits:
memory: 512Mi
requests:
cpu: 50m
memory: 128Mi
storage:
size: 1Gi
apps/splitpro/deployment.yaml
+108
View File
@@ -0,0 +1,108 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: splitpro
namespace: splitpro
spec:
replicas: 1
revisionHistoryLimit: 3
selector:
matchLabels:
app.kubernetes.io/name: splitpro
strategy:
type: Recreate
template:
metadata:
labels:
app.kubernetes.io/name: splitpro
spec:
automountServiceAccountToken: false
containers:
- env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
key: uri
name: splitpro-db-app
- name: DEFAULT_HOMEPAGE
value: /balances
- name: HOSTNAME
value: 0.0.0.0
- name: INVITE_ONLY
value: "false"
- name: NEXTAUTH_URL
value: https://split.whyredfire.dev
- name: NEXTAUTH_URL_INTERNAL
value: http://localhost:3000
envFrom:
- secretRef:
name: splitpro
image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
livenessProbe:
httpGet:
path: /api/auth/providers
port: http
name: splitpro
ports:
- containerPort: 3000
name: http
readinessProbe:
httpGet:
path: /api/auth/providers
port: http
resources:
limits:
cpu: "1"
memory: 1Gi
requests:
cpu: 50m
memory: 256Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
startupProbe:
failureThreshold: 60
httpGet:
path: /api/auth/providers
port: http
periodSeconds: 5
volumeMounts:
- mountPath: /app/uploads
name: uploads
- mountPath: /app/.next/cache
name: cache
- mountPath: /tmp
name: tmp
initContainers:
- command:
- sh
- -c
- until nc -z -w 2 splitpro-db-rw 5432; do echo waiting for database; sleep 2; done
image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
name: wait-for-db
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
securityContext:
fsGroup: 1000
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
volumes:
- emptyDir:
sizeLimit: 256Mi
name: cache
- emptyDir:
sizeLimit: 256Mi
name: tmp
- name: uploads
persistentVolumeClaim:
claimName: splitpro-uploads
apps/holyarrs/httproute.yaml → apps/splitpro/httproute.yaml
+5 -5
View File
@@ -3,11 +3,11 @@ kind: HTTPRoute
metadata:
annotations:
argocd.argoproj.io/sync-wave: "2"
name: holyarrs
namespace: holyarrs
name: splitpro
namespace: splitpro
spec:
hostnames:
- holyarrs.whyredfire.dev
- split.whyredfire.dev
parentRefs:
- kind: Gateway
name: traefik-gateway
@@ -15,8 +15,8 @@ spec:
sectionName: websecure
rules:
- backendRefs:
- name: holyarrs
port: 6262
- name: splitpro
port: 3000
matches:
- path:
type: PathPrefix
apps/qbit/kustomization.yaml → apps/splitpro/kustomization.yaml
+1 -2
View File
@@ -2,9 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- sealed-secret.yaml
- cluster.yaml
- pvc.yaml
- deployment.yaml
- service.yaml
- middleware.yaml
- httproute.yaml
- networkpolicy.yaml
apps/qbit/pvc.yaml → apps/splitpro/pvc.yaml
+3 -3
View File
@@ -1,11 +1,11 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: qbit-config-pvc
namespace: qbit
name: splitpro-uploads
namespace: splitpro
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 500Mi
storage: 2Gi
apps/splitpro/sealed-secret.yaml
+14
View File
@@ -0,0 +1,14 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: splitpro
namespace: splitpro
spec:
encryptedData:
GOOGLE_CLIENT_ID: AgDRctXaM2WUp9CYS1HQaxq1F6qJ6wyuV5PRK1hhSYCGCpZwId6mT/M+YCGiPnvAqR2W0L0cJ199ytZ5aV7UBrgbLG6XK7jN1txxpdWTSq0pONPj2jOrUvqdToA/6hUCsQBW6oqshbhjV/H53PxmKzR/t2zTQ0xoI64FK81INBsyaCY1gzdZQWYZCkmDhBUrvzfprcI6ayTvOtMhJkXMFU/TNielxjQtmRKnjz1wqyKZkvie7ZS2oEzU7R+VuuoMQVyL/N1pcu8rd5/WaJxJNgtG0oTFtJMQMCKvV80nXRWTXaTCGtpd4Ior+COgUW1ruzxU7HvrOMeQk/pwRPtVuANA5XUgwABWJH+RMmSDTsmqFlqaIYluE4swYGeR2dvEVWv4PN7YjBuJzYrWOCntp571JLw9jJ8ffCCEETQiEYc65ZMochp1rayZaHFJXAoorS/AbOK5fBYpdwM7R9KYl9tGxYzNcqzihezqb2hZuIIyEQnCtKPJl68TywiDXcUiftwlIhf56v2Us9nYaHRsIVstot1FhkrO2DqYrRxJ9/k8wPeJjPFCqrpx56y9bqRiyq4R4tfAKv/iHTZ2d8hVUZ1Pr/bc2pqwjxtjzBlGBXrAC4xSQWf463wk5IvY2dthRq0LZsXd7c8zV8QN9ZGwtWgWulNB/VXIsv0LoI7lmujWbCAGcis8helOo1wRgYE/NVeD/SEpJGEPkzx9XRuplj+00WsjOYmsbfvtQIcOOJbEtM3d6vqLd+SeFswSg1z01YFX6gagPhHCbDqfy0+DFkkM3QVsAPxKrBwT
GOOGLE_CLIENT_SECRET: AgAkBnqzqC9srhWzQA/q7ZfMpgfTy+J0on856vHPrIS8oe5P30vciaGlgkQdf1oMLA5ovHaSq6x9AEqv7HRzoeSrdUSjswZce1akAcXU+wA0mQGzVsmaTpCERAJ7GXWmSgsvIQNQXF5N6BLiZliueDiMIy3sZYAcoffrZ5l22mWOSBlHCXXZqZoP+F4Y4tQrlO28NjlWGo1UBf83JZ6TZMtK7IOuYoMDsZo/NlE1x0zj3beMm1VLvHJXRn1plU06IwlIKH0xEed2izff4FQ7f4Q3Dqmtbz6PhTdVqy4HQvhIrkAl/6IwQCZdTWHRdgv6fXQWs+ZftoeRMHFXI0xB3YfbLoqO8Q2kDqgxSOM8Xixdbabq1v8u0EVZCNRryb+XuWwG46xWNPVF2Nl1SIaeLxWQhFGEXTUf9IqYH9fQ1kpqIlj5IgEa1MUWsx1eE+vik1shT20woU7Lj21Zcu3RZob92qMVNZHheB2Lzkcw+dP1BwRIwXTiLXfdyDDHXlajnkvkkrrcwO62K4zEIIS/LyoLt2vdk63mfXKSz343pnpOsN2hEqJSTkCx3CFhB4JBSybSFrBtljcCDjK95dvsTQq8qZKEqLFZEQjRWXxsiR9aoNo2MCmPA+dDfvsJ7/GZ8mnjyNdLw+UCxrTiyXMI0pAgezZZZf96KPGUL+LnRbJiTHxxsfk+q2/nMZeU+ftZdV0F7zrCUQhkyJZwhYk2XsblyHiKsPCvLHtKbhIXVpwnLdXPgw==
NEXTAUTH_SECRET: AgCdNnXbHEuOlg1UnJii5eGJVfBZh5nWaybBODJJK3FbyhYPuj2KhGfNB/ld529FpddAEDv1IGWwKAOaSCkhSv1Nh1P2NZj37jpgbsHx8vw1omLLSkWqtRf1m4AhHhEwQoY49dlAk4AxSkjk5IckH8PbbRWFXx8Ns8kAGrJLrp6i7EbxrkI3U+hbEz93sQwRJo8XOeYCEodr7JPKoYHwy5roAwB0PmFL56bZFfuCa9yEje4BFxdQMrm0grSDMotTDH3nTF6irq5HSOEgqnL7Tt3kHW+Uaz5mvUZcCxAMUoB9q2mjTjm8fiprybVfMmCsib3epcZGrn0DiPZhihePkrfL6vTaz0pm1Nr7qkbtXFVY3RWgZjFpmDyAl/of7ddh9VYQVmqVAhfI610Czqqyou0zFuvlOXGlp1ljp7FNiwo+r02WxYoJ1leikB+CCnVxd/ErELA0AVneGUcWzoKG6r+OlDzsfV/gp2LXanAq2jKyeZ09ARhkLs3PHzkoGDaOF1Dr+3ZCidrfV+GRcnr73P7QEQNO6R+tEmL+idKiLr4uI56zrFg/Vb5Yxk/jMr2Hrfw7ai/nV2A+eqgXFQammCEZlDyCS8GPX8ULervbG/n4JmXXMUtGB9esM40cfTlsNhhv7sBC2P8QkOI00wvgdiwcPkOE+1i33Sxd1Vt20d8EP6TMfwhofQz2zYdYQEWYmBgiG+zX7mwwh3awuA5uH+ooA5vFe/aHPvMYM2rbTYDihEISJt1b6cbCiE8+Iw==
template:
metadata:
name: splitpro
namespace: splitpro
apps/pgweb/service.yaml → apps/splitpro/service.yaml
+4 -4
View File
@@ -1,12 +1,12 @@
apiVersion: v1
kind: Service
metadata:
name: pgweb
namespace: pgweb
name: splitpro
namespace: splitpro
spec:
ports:
- name: http
port: 8081
port: 3000
targetPort: http
selector:
app.kubernetes.io/name: pgweb
app.kubernetes.io/name: splitpro
apps/wireguard/deployment.yaml
-108
View File
@@ -1,108 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: wireguard
namespace: wireguard
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: wireguard
strategy:
type: Recreate
template:
metadata:
labels:
app.kubernetes.io/name: wireguard
spec:
containers:
- args:
- |
# The node's kernel only has nftables, the image defaults to legacy iptables.
for b in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do
ln -sf xtables-nft-multi "/usr/sbin/$b"
done
# Only skips the setup wizard; password login is disabled.
INIT_PASSWORD="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
export INIT_PASSWORD
exec /usr/bin/dumb-init node server/index.mjs
command:
- /bin/sh
- -c
env:
- name: DISABLE_IPV6
value: "true"
- name: DISABLE_PASSWORD_AUTH
value: "true"
- name: INIT_ALLOWED_IPS
value: 192.168.2.0/24
- name: INIT_DNS
value: 192.168.2.1
- name: INIT_ENABLED
value: "true"
- name: INIT_HOST
value: wg.whyredfire.dev
- name: INIT_PORT
value: "27299"
- name: INIT_USERNAME
value: admin
- name: OAUTH_AUTO_LAUNCH
value: oidc
- name: OAUTH_AUTO_REGISTER
value: "true"
- name: OAUTH_OIDC_CLIENT_ID
value: wireguard-admin
- name: OAUTH_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
key: oidc-client-secret
name: wireguard
- name: OAUTH_OIDC_NAME
value: authentik
- name: OAUTH_OIDC_SERVER
value: https://auth.whyredfire.dev/application/o/wireguard-admin/
- name: OAUTH_PROVIDERS
value: oidc
image: ghcr.io/wg-easy/wg-easy:15.5.0
name: wg-easy
ports:
- containerPort: 27299
name: wireguard
protocol: UDP
- containerPort: 51821
name: http
resources:
limits:
cpu: 500m
memory: 512Mi
requests:
cpu: 10m
memory: 192Mi
securityContext:
capabilities:
add:
- NET_ADMIN
volumeMounts:
- mountPath: /etc/wireguard
name: data
initContainers:
- args:
- |
# VPN clients may reach the LAN, not this pod or the cluster networks.
set -eu
iptables-nft -t mangle -A PREROUTING -i wg0 -m addrtype --dst-type LOCAL -j DROP
iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.42.0.0/16 -j DROP
iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.43.0.0/16 -j DROP
command:
- /bin/sh
- -c
image: ghcr.io/wg-easy/wg-easy:15.5.0
name: firewall
securityContext:
capabilities:
add:
- NET_ADMIN
volumes:
- name: data
persistentVolumeClaim:
claimName: wireguard-data
apps/wireguard/kustomization.yaml
-10
View File
@@ -1,10 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- sealed-secret.yaml
- pvc.yaml
- deployment.yaml
- service.yaml
- service-admin.yaml
- httproute.yaml
- networkpolicy.yaml
apps/wireguard/networkpolicy.yaml
-60
View File
@@ -1,60 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: wireguard
namespace: wireguard
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 8000
protocol: TCP
- port: 8443
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
podSelector:
matchLabels:
app.kubernetes.io/name: traefik
- to:
- ipBlock:
cidr: 192.168.2.0/24
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 27299
protocol: UDP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 51821
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: wireguard
policyTypes:
- Ingress
- Egress
apps/wireguard/pvc.yaml
-11
View File
@@ -1,11 +0,0 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: wireguard-data
namespace: wireguard
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 100Mi
apps/wireguard/sealed-secret.yaml
-12
View File
@@ -1,12 +0,0 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: wireguard
namespace: wireguard
spec:
encryptedData:
oidc-client-secret: AgDML2QiPv8lLkyYYOXVI7IY+F3F6x4AoJP7OwNWcFzN699HTvud78sYW1zs9P3BX8FfUArkXHZhjG07OyP5HYxtbUvv4t1IyJaMqg1NsBSB9F3QPEVoanrEIwfUbrzbIcCjD9J0RRrf7aBeAL+zTI1odEOFQhdXwrwEliombjLTcjMMBZGW8IVAQ8/2Ip+Vl8fIGpoS0kP6PGW7NZMTehxBMImyLipzJeYrg2gHN8dlHgE+TWKIuAxV0TSmWV+QvjW6ivSWEwDOabGvQ9GxH3DCwSvPM4kEm5SfFXodzyEvFVsK0MFyY/TvsIU8kursZrSWNlhu437ncjPp4H9X/AYikYHqUnx0hbLRqspIP8OmdNu4A3VdQjGVJcqwsSWmKBIpXrKaoO2GmQQWKKhmbFfgJaCXDmnPBG1A4ngLnNzFdG4JuT5zZwfQRLe0BHxkVbTaN2MtsU47G2dS55TXoJk8q54Gi/buarf0eNj515DsgiI/CqaUchp3I9U+SWC4cHtAF8EncC1qbfqtMTpI/mEsK+L3RxKZFq0EPXmrOLYbrqjA4H44l7cdg8/3aVxmILCh0wleytUuYnQG0u1+vNk/5H73F+RZQT2UbOzQZ5VVIvzT1vNgu8EAfX8+HWvbRANuGB+4hAdOLv73myL2qnxyz3N5btXFOGbjDjAkxeLKf/qEsAXUBPiBGPh5NEdCEgMSzrgvdtfzQ/BzT8i0xUPBzjVvXAQQckOprZAuz9IOq5N4Ug7VRFgktyDpzQ2acpcWuxeq4opfrj5PGM5rUPkv
template:
metadata:
name: wireguard
namespace: wireguard
apps/wireguard/service-admin.yaml
-12
View File
@@ -1,12 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: wireguard-admin
namespace: wireguard
spec:
ports:
- name: http
port: 51821
targetPort: http
selector:
app.kubernetes.io/name: wireguard
apps/wireguard/service.yaml
-15
View File
@@ -1,15 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: wireguard
namespace: wireguard
spec:
externalIPs:
- 192.168.2.5
ports:
- name: wireguard
port: 51820
protocol: UDP
targetPort: wireguard
selector:
app.kubernetes.io/name: wireguard
argocd-apps/add-ons/alloy.yaml
-164
View File
@@ -1,164 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "4"
name: alloy
namespace: argocd
spec:
destination:
namespace: monitoring
server: https://kubernetes.default.svc
project: default
source:
chart: alloy
helm:
values: |
# Discovers pods through the API and pushes their logs to Loki
networkPolicy:
enabled: true
ingress: []
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- ports:
- port: 3100
protocol: TCP
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: loki
alloy:
configMap:
content: |
discovery.kubernetes "pods" {
role = "pod"
namespaces {
names = ["garage", "postgres", "redoost", "traefik"]
}
selectors {
role = "pod"
field = "spec.nodeName=" + sys.env("HOSTNAME")
}
}
discovery.relabel "pods" {
targets = discovery.kubernetes.pods.targets
rule {
source_labels = ["__meta_kubernetes_namespace"]
target_label = "namespace"
}
rule {
source_labels = ["__meta_kubernetes_pod_name"]
target_label = "pod"
}
rule {
source_labels = ["__meta_kubernetes_pod_controller_name"]
target_label = "workload"
}
// A deployment owns its pods through a ReplicaSet named <deployment>-<hash>.
rule {
source_labels = ["__meta_kubernetes_pod_controller_kind", "__meta_kubernetes_pod_controller_name"]
regex = "ReplicaSet;(.+)-[a-z0-9]+"
target_label = "workload"
}
// A cronjob's runs are Jobs named <cronjob>-<timestamp>.
rule {
source_labels = ["__meta_kubernetes_pod_controller_kind", "__meta_kubernetes_pod_controller_name"]
regex = "Job;(.+)-[0-9]+"
target_label = "workload"
}
rule {
source_labels = ["__meta_kubernetes_pod_container_name"]
target_label = "container"
}
rule {
source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name", "__meta_kubernetes_pod_label_app"]
regex = "^;*([^;]+)(;.*)?$"
target_label = "app"
}
rule {
source_labels = ["__meta_kubernetes_pod_node_name"]
target_label = "node"
}
rule {
source_labels = ["__meta_kubernetes_pod_uid", "__meta_kubernetes_pod_container_name"]
separator = "/"
replacement = "/var/log/pods/*$1/*.log"
target_label = "__path__"
}
}
local.file_match "pods" {
path_targets = discovery.relabel.pods.output
}
loki.source.file "pods" {
targets = local.file_match.pods.targets
forward_to = [loki.process.pods.receiver]
}
loki.process "pods" {
stage.cri {}
// Changes on every rotation and would start a new stream.
stage.label_drop {
values = ["filename"]
}
forward_to = [loki.write.default.receiver]
}
loki.write "default" {
endpoint {
url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
}
}
mounts:
varlog: true
extra:
- name: storage
mountPath: /var/lib/alloy
# Tail positions survive pod restarts, so logs are not shipped twice.
storagePath: /var/lib/alloy
resources:
limits:
cpu: 500m
memory: 512Mi
requests:
cpu: 50m
memory: 128Mi
configReloader:
resources:
limits:
cpu: 50m
memory: 100Mi
controller:
volumes:
extra:
- name: storage
hostPath:
path: /var/lib/alloy
type: DirectoryOrCreate
repoURL: https://grafana.github.io/helm-charts
targetRevision: 1.13.1
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- ServerSideApply=true
argocd-apps/add-ons/anubis-operator.yaml
+28
View File
@@ -0,0 +1,28 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/sync-wave: "1"
finalizers:
- resources-finalizer.argocd.argoproj.io
name: anubis-operator
namespace: argocd
spec:
destination:
namespace: anubis-operator-system
server: https://kubernetes.default.svc
project: default
source:
kustomize:
images:
- public-registry.brunobernard.dev/techarohq/anubis-operator=ghcr.io/eznix86/anubis-kubernetes-operator:0.4.4
path: config/default
repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
targetRevision: v0.4.4
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- ServerSideApply=true
argocd-apps/add-ons/argocd-dashboard.yaml
+1 -3
View File
@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "3"
name: argocd-dashboard
namespace: argocd
@@ -12,7 +11,7 @@ spec:
server: https://kubernetes.default.svc
project: default
source:
path: add-ons/argocd-dashboard
path: infra/argocd-dashboard
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
syncPolicy:
@@ -21,4 +20,3 @@ spec:
selfHeal: true
syncOptions:
- CreateNamespace=true
- ServerSideApply=true
argocd-apps/add-ons/argocd-image-updater.yaml
-35
View File
@@ -1,35 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "1"
name: argocd-image-updater
namespace: argocd
spec:
destination:
namespace: argocd
server: https://kubernetes.default.svc
project: default
sources:
- chart: argocd-image-updater
repoURL: https://argoproj.github.io/argo-helm
targetRevision: 1.4.0
helm:
values: |
resources:
limits:
cpu: 200m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
- path: add-ons/argocd-image-updater
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- ServerSideApply=true
argocd-apps/apps/pgweb.yaml → argocd-apps/add-ons/argocd-repos.yaml
+4 -6
View File
@@ -2,17 +2,16 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "3"
name: pgweb
argocd.argoproj.io/sync-wave: "1"
name: argocd-repos
namespace: argocd
spec:
destination:
namespace: pgweb
namespace: argocd
server: https://kubernetes.default.svc
project: default
source:
path: apps/pgweb
path: infra/argocd-repos
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
syncPolicy:
@@ -21,4 +20,3 @@ spec:
selfHeal: true
syncOptions:
- CreateNamespace=true
- ServerSideApply=true
argocd-apps/add-ons/authentik.yaml
+2 -13
View File
@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "2"
name: authentik
namespace: argocd
@@ -28,18 +27,10 @@ spec:
name: authentik-secrets
blueprints:
configMaps:
- blueprint-argocd
- blueprint-garage-ui
- blueprint-google-login
- blueprint-grafana
- blueprint-outpost
- blueprint-pgweb
- blueprint-qbittorrent
- blueprint-wireguard-admin
- authentik-blueprints
server:
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 100m
@@ -47,14 +38,13 @@ spec:
worker:
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 50m
memory: 384Mi
repoURL: https://charts.goauthentik.io
targetRevision: 2026.8.3
- path: add-ons/authentik
- path: infra/authentik
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
syncPolicy:
@@ -63,4 +53,3 @@ spec:
selfHeal: true
syncOptions:
- CreateNamespace=true
- ServerSideApply=true
argocd-apps/add-ons/cert-manager.yaml
+2 -44
View File
@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "1"
name: cert-manager
namespace: argocd
@@ -22,50 +21,9 @@ spec:
kind: ControllerConfiguration
featureGates:
ExperimentalGatewayAPISupport: true
resources:
limits:
cpu: 200m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
# The chart's egress fits the controller: ACME and Cloudflare on 443,
# DNS-01 propagation checks on 53, and the API on 6443
networkPolicy:
enabled: true
cainjector:
# Only talks to the API
networkPolicy:
enabled: true
egress:
- ports:
- port: 6443
protocol: TCP
resources:
limits:
cpu: 200m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
webhook:
# Only talks to the API
networkPolicy:
enabled: true
egress:
- ports:
- port: 6443
protocol: TCP
resources:
limits:
cpu: 200m
memory: 128Mi
requests:
cpu: 10m
memory: 32Mi
repoURL: https://charts.jetstack.io
targetRevision: v1.21.2
- path: add-ons/cert-manager
targetRevision: v1.21.1
- path: infra/cert-manager
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
syncPolicy:
argocd-apps/add-ons/cnpg.yaml
+3 -14
View File
@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "0"
name: cnpg
namespace: argocd
@@ -11,25 +10,15 @@ spec:
namespace: cnpg-system
server: https://kubernetes.default.svc
project: default
sources:
- chart: cloudnative-pg
source:
chart: cloudnative-pg
helm:
values: |
replicaCount: 1
config:
clusterWide: true
resources:
limits:
cpu: 500m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
repoURL: https://cloudnative-pg.github.io/charts
targetRevision: 0.29.1
- path: add-ons/cnpg
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
targetRevision: 0.29.0
syncPolicy:
automated:
prune: true
argocd-apps/add-ons/kube-prometheus-stack.yaml
-262
View File
@@ -1,262 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "3"
name: kube-prometheus-stack
namespace: argocd
spec:
destination:
namespace: monitoring
server: https://kubernetes.default.svc
project: default
sources:
- chart: kube-prometheus-stack
helm:
values: |
alertmanager:
enabled: false
# Only node-exporter and cAdvisor are scraped.
defaultRules:
create: false
kubelet:
serviceMonitor:
interval: 60s
kubelet: false
probes: false
cAdvisorMetricRelabelings:
- action: keep
sourceLabels: [__name__]
regex: container_(cpu_usage_seconds_total|memory_working_set_bytes)
- action: drop
sourceLabels: [id, pod]
regex: .+;
kubeApiServer:
enabled: false
kubeControllerManager:
enabled: false
kubeScheduler:
enabled: false
kubeProxy:
enabled: false
kubeEtcd:
enabled: false
coreDns:
enabled: false
kubeStateMetrics:
enabled: false
prometheusOperator:
# The chart's policy only limits ingress to the webhook; egress stays open
networkPolicy:
enabled: true
admissionWebhooks:
certManager:
enabled: true
resources:
limits:
cpu: 200m
memory: 256Mi
requests:
cpu: 20m
memory: 64Mi
prometheusConfigReloader:
resources:
limits:
cpu: 50m
memory: 64Mi
requests:
cpu: 10m
memory: 32Mi
serviceMonitor:
selfMonitor: false
prometheus-node-exporter:
# CPU, memory, disks, network and temperature.
extraArgs:
- --collector.disable-defaults
- --collector.cpu
- --collector.meminfo
- --collector.filesystem
- --collector.netdev
- --collector.hwmon
- --web.disable-exporter-metrics
# The chart's defaults, as lists are replaced.
- --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)
- --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$
- --collector.netdev.device-exclude=^(veth.*|br-.*|docker0|cni0|lo)$
prometheus:
monitor:
# Collectors report more than these, like per-chip sensor labels.
metricRelabelings:
- action: keep
sourceLabels: [__name__]
regex: node_(cpu_seconds_total|memory_(MemAvailable|MemTotal)_bytes|filesystem_(avail|size)_bytes|network_(receive|transmit)_bytes_total|hwmon_temp_celsius)
resources:
limits:
cpu: 200m
memory: 128Mi
requests:
cpu: 20m
memory: 32Mi
prometheus:
# Only Grafana queries it; it scrapes the kubelet and node-exporter on the
# node, matched by port so no node IP is needed
networkPolicy:
enabled: true
ingress:
- from:
- podSelector:
matchLabels:
app.kubernetes.io/name: grafana
ports:
- port: 9090
protocol: TCP
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- port: 9100
protocol: TCP
- port: 10250
protocol: TCP
serviceMonitor:
selfMonitor: false
prometheusSpec:
scrapeInterval: 60s
retention: 90d
retentionSize: 45GB
# Pick up monitors and rules from every namespace, not just this release.
podMonitorSelectorNilUsesHelmValues: false
probeSelectorNilUsesHelmValues: false
ruleSelectorNilUsesHelmValues: false
scrapeConfigSelectorNilUsesHelmValues: false
serviceMonitorSelectorNilUsesHelmValues: false
resources:
limits:
cpu: "1"
memory: 3Gi
requests:
cpu: 200m
memory: 1Gi
storageSpec:
volumeClaimTemplate:
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 50Gi
grafana:
# The chart takes one list of egress ports for every destination: OIDC
# on 443, Loki, Postgres, the API for the sidecars, and Prometheus
networkPolicy:
enabled: true
allowExternal: false
explicitNamespacesSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
egress:
enabled: true
ports:
- port: 443
protocol: TCP
- port: 3100
protocol: TCP
- port: 5432
protocol: TCP
- port: 6443
protocol: TCP
- port: 9090
protocol: TCP
admin:
existingSecret: grafana-admin
additionalDataSources:
- name: Loki
type: loki
uid: loki
url: http://loki.monitoring.svc.cluster.local:3100
isDefault: true
defaultDashboardsEnabled: false
envValueFrom:
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
secretKeyRef:
name: grafana-oidc
key: client-secret
GF_DATABASE_PASSWORD:
secretKeyRef:
name: grafana-db
key: password
grafana.ini:
database:
type: postgres
host: postgres-rw.postgres.svc.cluster.local:5432
name: grafana
user: grafana
ssl_mode: require
server:
root_url: https://grafana.whyredfire.dev
auth:
# Break-glass admin login stays reachable at /login?disableAutoLogin=true
oauth_auto_login: true
signout_redirect_url: https://auth.whyredfire.dev/application/o/grafana/end-session/
auth.generic_oauth:
enabled: true
name: Authentik
client_id: grafana
scopes: openid profile email
auth_url: https://auth.whyredfire.dev/application/o/authorize/
token_url: https://auth.whyredfire.dev/application/o/token/
api_url: https://auth.whyredfire.dev/application/o/userinfo/
use_pkce: true
login_attribute_path: preferred_username
role_attribute_path: contains(groups, 'admins') && 'Admin'
role_attribute_strict: true
resources:
limits:
cpu: 500m
memory: 768Mi
requests:
cpu: 50m
memory: 256Mi
serviceMonitor:
enabled: false
sidecar:
datasources:
alertmanager:
enabled: false
isDefaultDatasource: false
dashboards:
searchNamespace: ALL
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
testFramework:
enabled: false
repoURL: https://prometheus-community.github.io/helm-charts
targetRevision: 92.3.0
- path: add-ons/kube-prometheus-stack
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- ServerSideApply=true
argocd-apps/add-ons/kustomization.yaml
+2 -4
View File
@@ -1,14 +1,12 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- alloy.yaml
- anubis-operator.yaml
- argocd-dashboard.yaml
- argocd-image-updater.yaml
- argocd-repos.yaml
- authentik.yaml
- cert-manager.yaml
- cnpg.yaml
- kube-prometheus-stack.yaml
- loki.yaml
- postgres.yaml
- sealed-secrets.yaml
- traefik.yaml
argocd-apps/add-ons/loki.yaml
-129
View File
@@ -1,129 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
annotations:
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
argocd.argoproj.io/sync-wave: "4"
name: loki
namespace: argocd
spec:
destination:
namespace: monitoring
server: https://kubernetes.default.svc
project: default
sources:
- chart: loki
helm:
values: |
# Garage on 3900; the rules sidecar watches the API, which only the
# discovery port can allow
networkPolicy:
enabled: true
externalStorage:
ports:
- 3900
discovery:
port: 6443
loki:
auth_enabled: false
commonConfig:
replication_factor: 1
schemaConfig:
configs:
- from: "2026-09-01"
store: tsdb
object_store: s3
schema: v13
index:
prefix: loki_index_
period: 24h
storage:
bucketNames:
chunks: loki
ruler: loki
s3:
endpoint: http://garage.garage.svc.cluster.local:3900
region: garage
accessKeyId: ${LOKI_S3_ACCESS_KEY_ID}
secretAccessKey: ${LOKI_S3_SECRET_ACCESS_KEY}
s3ForcePathStyle: true
insecure: true
ingester:
chunk_encoding: zstd
compactor:
retention_enabled: true
delete_request_store: s3
limits_config:
retention_period: 2160h
singleBinary:
replicas: 1
extraEnvFrom:
- secretRef:
name: loki-s3
resources:
limits:
cpu: "1"
memory: 2Gi
requests:
cpu: 100m
memory: 512Mi
# Memory limits sit ~20% above memcached's allocation.
chunksCache:
allocatedMemory: 512
resources:
limits:
cpu: 500m
memory: 614Mi
requests:
cpu: 50m
memory: 614Mi
resultsCache:
allocatedMemory: 128
resources:
limits:
cpu: 500m
memory: 154Mi
requests:
cpu: 50m
memory: 154Mi
memcachedExporter:
resources:
limits:
cpu: 100m
memory: 64Mi
requests:
cpu: 10m
memory: 16Mi
sidecar:
resources:
limits:
cpu: 100m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
# Grafana and Alloy talk to Loki directly, there is a single tenant.
gateway:
enabled: false
lokiCanary:
enabled: false
test:
enabled: false
backend:
replicas: 0
read:
replicas: 0
write:
replicas: 0
repoURL: https://grafana-community.github.io/helm-charts
targetRevision: 18.15.1
- path: add-ons/loki
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- ServerSideApply=true

Some files were not shown because too many files have changed in this diff Show More