Compare commits
1
Commits
main
..
d12db3c9b7
| Author | SHA1 | Date | |
|---|---|---|---|
 whyredfire
|
d12db3c9b7 |
@@ -1,41 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
# Normalise staged manifests to their kubectl kustomize output, so what is
|
|
||||||
# committed is exactly what Argo CD renders. Requires kubectl and yq.
|
|
||||||
|
|
||||||
identity='[.apiVersion, .kind, .metadata.name // ""] | join("|")'
|
|
||||||
|
|
||||||
git diff --cached --name-only --diff-filter=ACM -- '*.yaml' |
|
|
||||||
while IFS= read -r file; do
|
|
||||||
dir=$(dirname "$file")
|
|
||||||
name=$(basename "$file")
|
|
||||||
[ "$name" = kustomization.yaml ] && continue
|
|
||||||
|
|
||||||
# only normalise files the sibling kustomization lists as a resource, so
|
|
||||||
# patches and components are never replaced with build output
|
|
||||||
yq -r '.resources[]? // ""' "$dir/kustomization.yaml" 2>/dev/null |
|
|
||||||
grep -Fxq "$name" || continue
|
|
||||||
|
|
||||||
rendered=$(mktemp)
|
|
||||||
kubectl kustomize "$dir" |
|
|
||||||
yq eval-all "select(($identity) == \"$(yq eval-all "$identity" "$file" | head -1)\")" - >"$rendered"
|
|
||||||
|
|
||||||
if [ -s "$rendered" ] && ! diff -q "$file" "$rendered" >/dev/null; then
|
|
||||||
cat "$rendered" >"$file"
|
|
||||||
git add "$file"
|
|
||||||
echo "normalised $file"
|
|
||||||
fi
|
|
||||||
rm -f "$rendered"
|
|
||||||
|
|
||||||
# normalising may have reverted the change entirely
|
|
||||||
if git diff --cached --quiet -- "$file"; then
|
|
||||||
git reset -q HEAD -- "$file"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
# nothing left staged — prevent an empty commit
|
|
||||||
if git diff --cached --quiet; then
|
|
||||||
echo "pre-commit: no meaningful changes, aborting commit"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: traefik
|
||||||
|
namespace: argocd
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
repoURL: https://traefik.github.io/charts
|
||||||
|
chart: traefik
|
||||||
|
targetRevision: v39.0.2
|
||||||
|
helm:
|
||||||
|
values: |
|
||||||
|
providers:
|
||||||
|
kubernetesGateway:
|
||||||
|
enabled: true
|
||||||
|
kubernetesIngress:
|
||||||
|
enabled: false
|
||||||
|
service:
|
||||||
|
type: ClusterIP
|
||||||
|
externalIPs:
|
||||||
|
- 192.168.2.220
|
||||||
|
gateway:
|
||||||
|
listeners:
|
||||||
|
web:
|
||||||
|
namespacePolicy:
|
||||||
|
from: All
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: traefik
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
prune: true
|
||||||
|
selfHeal: true
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
- ServerSideApply=true
|
||||||
+4
-6
@@ -1,19 +1,17 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
apiVersion: argoproj.io/v1alpha1
|
||||||
kind: Application
|
kind: Application
|
||||||
metadata:
|
metadata:
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: telegram-autoregexbot
|
name: telegram-autoregexbot
|
||||||
namespace: argocd
|
namespace: argocd
|
||||||
spec:
|
spec:
|
||||||
destination:
|
|
||||||
namespace: telegram-bot
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
project: default
|
||||||
source:
|
source:
|
||||||
path: k8s
|
|
||||||
repoURL: https://github.com/santarl/telegram-autoregexbot
|
repoURL: https://github.com/santarl/telegram-autoregexbot
|
||||||
targetRevision: main
|
targetRevision: main
|
||||||
|
path: k8s
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: telegram-bot
|
||||||
syncPolicy:
|
syncPolicy:
|
||||||
automated:
|
automated:
|
||||||
prune: true
|
prune: true
|
||||||
@@ -1,19 +1,17 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
apiVersion: argoproj.io/v1alpha1
|
||||||
kind: Application
|
kind: Application
|
||||||
metadata:
|
metadata:
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: betterslcm
|
name: betterslcm
|
||||||
namespace: argocd
|
namespace: argocd
|
||||||
spec:
|
spec:
|
||||||
destination:
|
|
||||||
namespace: betterslcm
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
project: default
|
||||||
source:
|
source:
|
||||||
path: k8s
|
|
||||||
repoURL: https://github.com/DK10WS/SLCM_APP.git
|
repoURL: https://github.com/DK10WS/SLCM_APP.git
|
||||||
targetRevision: web
|
targetRevision: web
|
||||||
|
path: k8s
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: slcm
|
||||||
syncPolicy:
|
syncPolicy:
|
||||||
automated:
|
automated:
|
||||||
prune: true
|
prune: true
|
||||||
+4
-6
@@ -1,19 +1,17 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
apiVersion: argoproj.io/v1alpha1
|
||||||
kind: Application
|
kind: Application
|
||||||
metadata:
|
metadata:
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: scriptscribe
|
name: scriptscribe
|
||||||
namespace: argocd
|
namespace: argocd
|
||||||
spec:
|
spec:
|
||||||
destination:
|
|
||||||
namespace: scriptscribe
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
project: default
|
||||||
source:
|
source:
|
||||||
path: k8s
|
|
||||||
repoURL: https://github.com/whyredfire/scriptscribe
|
repoURL: https://github.com/whyredfire/scriptscribe
|
||||||
targetRevision: main
|
targetRevision: main
|
||||||
|
path: k8s
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: scriptscribe
|
||||||
syncPolicy:
|
syncPolicy:
|
||||||
automated:
|
automated:
|
||||||
prune: true
|
prune: true
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: bentopdf
|
|
||||||
namespace: bentopdf
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: bentopdf
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: bentopdf
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- image: ghcr.io/alam00000/bentopdf-simple:latest@sha256:3d62b8f8eece5fe947026ac3925ff08fda245b3d6ba2c3916b94da91e0010c74
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: http
|
|
||||||
name: bentopdf
|
|
||||||
ports:
|
|
||||||
- containerPort: 8080
|
|
||||||
name: http
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: http
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 128Mi
|
|
||||||
requests:
|
|
||||||
cpu: 10m
|
|
||||||
memory: 32Mi
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
securityContext:
|
|
||||||
runAsGroup: 101
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 101
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
name: bentopdf
|
|
||||||
namespace: bentopdf
|
|
||||||
spec:
|
|
||||||
hostnames:
|
|
||||||
- pdf.whyredfire.dev
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: bentopdf
|
|
||||||
port: 8080
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- deployment.yaml
|
|
||||||
- service.yaml
|
|
||||||
- httproute.yaml
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: bentopdf
|
|
||||||
namespace: bentopdf
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
port: 8080
|
|
||||||
targetPort: http
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/name: bentopdf
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
name: garage-ui
|
|
||||||
namespace: garage
|
|
||||||
spec:
|
|
||||||
hostnames:
|
|
||||||
- garage.whyredfire.dev
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: authentik-server
|
|
||||||
namespace: authentik
|
|
||||||
port: 80
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /outpost.goauthentik.io
|
|
||||||
- backendRefs:
|
|
||||||
- name: garage-ui
|
|
||||||
port: 80
|
|
||||||
filters:
|
|
||||||
- extensionRef:
|
|
||||||
group: traefik.io
|
|
||||||
kind: Middleware
|
|
||||||
name: authentik
|
|
||||||
type: ExtensionRef
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- sealed-secret.yaml
|
|
||||||
- middleware.yaml
|
|
||||||
- httproute.yaml
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: Middleware
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "1"
|
|
||||||
name: authentik
|
|
||||||
namespace: garage
|
|
||||||
spec:
|
|
||||||
forwardAuth:
|
|
||||||
address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
|
|
||||||
authResponseHeaders:
|
|
||||||
- X-authentik-username
|
|
||||||
- X-authentik-groups
|
|
||||||
- X-authentik-email
|
|
||||||
- X-authentik-name
|
|
||||||
- X-authentik-uid
|
|
||||||
trustForwardHeader: true
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
apiVersion: bitnami.com/v1alpha1
|
|
||||||
kind: SealedSecret
|
|
||||||
metadata:
|
|
||||||
name: garage-ui-secrets
|
|
||||||
namespace: garage
|
|
||||||
spec:
|
|
||||||
encryptedData:
|
|
||||||
admin-password: AgCQeGAvd1QdDC8IUwNYqHJxRES1jfPbonYTyutCklms6tjebQw1pRKnbDWGRaFmgWg5jFRPYf6TAMRnZnA/1dKJMOrV9vGjqx++r+khWbe5oqvcoQInqVdbkfulHoP/Bf6jc2mj9znGqpW6E7e6Z94pwwYkpaY2CIYhfcs7PiaTh7HiFMmoNWlGmHBh+lIZ//WJblgpFdQRWR9j7CiIJOLC3OmAvGV+Uh5i15fdA9aTBLZaB1pWh/kqug/mmj6q5E3Bp7BlC7Pm20Dbyn85kfA9RjAM/AkWSycGcBgk+FaJKFVJnPzrHcx6CdkbUnczxGVrbs+C89pzCk8ysaOVSNDErW0rCWNaHrflRx6P1+OUamCWWafZdkWTGQ4m0I5pX5IQ40zIK1uE8Zzil8EJPynfs37fNzn54wVBmsaKpsFC/3y+d8UTVgf1shJF0cqPimWjCZPqvUZrimL/20tPhTSERaxtWSq14l39bQUc4sNZdaKc69IkI04geI9OPvE+XXQNYe86XPYlNJ/R5curg1RvQxAR59sb04RmZAfdSvcwYxpK1Ekchq/e9IK4ft6Ul70nE/oN43NE2Ck1+5/EOjucFmIQzZ49Jq2OIjHuBjA/p/BmwAhiZVwPObRJ0VoL9XDv7BVB+S/+RWnFjDW7J5YhWquZ2Y6XwspHhpjvHmH+LLSio/34VpWQgG/lSAhvSPuRkIp/XxhQwemti+3yQNeqfXtvpfKa1IgAg9ic/rbocQIUtQDaT4yYFi7cruTpx7U=
|
|
||||||
admin-token: AgDBYTHO2ZgJig+h3wIv1ru7VxEDKIq+SUjOygg39lVaF1bH0ADaWOdr1m6nP37LiBCyQSGtqilUGqXPV91VRiJJqFBXLTnYs0JbmXGekkfeImztAd7LL3yqKHThji/Bo+vD00PC3SAbpder2d6BJhOMez2XqFY2vPSY81earoiR+ajzuvHBC4PuwDjNYwnNq5BkGCF/D6EOenVfVJZdWHG4/oCciJzX+fwYQYw0sY8ur5cRxyY6wyWC2QH9YflDKbwFteiqnh8E1+B4mqSFiTcaM79FAU6rYxknXmw/BArNdbXvAxvYDyGKxQA1k6GwW9TWSg/CpKAmuJW2Xv1nMCqt3ZIJCTO/H1PIi24XouNBGc9n0VOWKNWZTI8CIZLRB+/LzLuT/vjhu4qA/LE6SkDXw1dTkgkkUChUKN4PrWfwTVIEgZwjPdewOZ9D9JT8TmPSZtGvVuDVOJl7+wBYGT4SkI9W2qU91h1VT+vmXO/7QyQ/kj2ny092GjT2aJTFAbtusAjV3dKZnfodXaCX/dQ3JnSuP2mWQGZ/2Gj5AB92FNvqeTkiqovS2hGgXjyOYp4JeXVPvBa1tWEo0Cy4FrqBLaycNIHuhGiWAhLrivXTX2YqyM3NfEmEuyzXu5M3E6eQhaF8uveDjqhxF1z07IUXU8zBCvHtC7vX2aYPfSKGWcpvGKa8NnkjamRY1qJbj1Jr15a9UBSM1TyWNGp3pxFHyy707FlayRDIdJOe0iYqQw/5qZQJBl1u4/1zbOldP3dPFtbGuhR257+wNWwKKfACorTsBg==
|
|
||||||
jwt-key.pem: AgBYRkRh01LSyyozE46odjgrHsZ6gI3ykVOdV7qMPEFt5lILq44BKFt3vVL+yAUz0brVPQeEjz7dg+xsurAKKMjvuxzkOqBsSFhWwBzy+f+GfTSZPBrBNPAX7jI05dUNbcu2UuxYMlgVq6VWa9lf0Gc8yvuEuD0nS2qmpj1ACL6awLBKnkVXL9c5mvoC97DRyk920rPTnERJGU5q7i+zue4sxufYJwJZAJLOmdpzavHfQ3lCcJr6FfboFmGnvD6SM85rXTtImyDY4tsXf4J1rRriYR1OQe91j4SSbvxDFskXYSQ4bTgjimat21SXLCImj/Pqh6LJz7wMd9aW95ju4jDE1q1og0ToIL0Nybl9ANhqlJgFtOfvQRnaJVQQw/2GitlDVejJHCYWsVsSxQtAhvrGdWDOrZ1eTzvsmBnGcWzDwtC1YN3u+Wd0qJBfoRIJLiinwLaJ7ponm5MSb9Qjkym99gXm6XUO0MlHS52pfVaai+OmyWE6B6nF9tf3YVXfjZcNVB1pFHCZZR6XcnIm+wi1EwxXR8NIeFgqiaIm+BwX9u6IMiQOHCVznHD5nc2wfSXpeeT75IX/HAzRWC2cc6a8vPsr+h4A4hqW+cOoMYb9gQQIa+F5X4LcWb6f/0HJHh1IO4vf+P2hVU/5CkpgGJk+x48KgkrX0CE+bafQQjNp8JTdis1gxSGEX0QUaVGl+x7exGhrKlW81ZZTovequibx1JhdNSXNbWZxQ2fXz7SdN+/AjYyEh1gNPI2Zx6RRJc5BlDSSt7TYwqy1NUcPfbJV7hbqV7oDUH8JrsoSk+xxB0WDE+Uh5P4MsQna6NWkWyFV4tvfK4QyMupQaxOAKOYV27DxBaTr
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
name: garage-ui-secrets
|
|
||||||
namespace: garage
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
name: garage-s3
|
|
||||||
namespace: garage
|
|
||||||
spec:
|
|
||||||
hostnames:
|
|
||||||
- s3.whyredfire.dev
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: garage
|
|
||||||
port: 3900
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- httproute-s3.yaml
|
|
||||||
- sealed-secret.yaml
|
|
||||||
- service-admin.yaml
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
apiVersion: bitnami.com/v1alpha1
|
|
||||||
kind: SealedSecret
|
|
||||||
metadata:
|
|
||||||
name: garage-secrets
|
|
||||||
namespace: garage
|
|
||||||
spec:
|
|
||||||
encryptedData:
|
|
||||||
rpcSecret: AgDWvOoSUADQx+cExTUDmk6/BWR8a7U5HRGf+T38P24FrP4DJiKl3GJ3Ce9a3eF7SqO/1TXiaN80+c4NX0dMEmnaS8III2Zbaa7x/rOHP608Vh1z2Nnxly11X10okVy+Qym9O5/oA3cue2bu6K3eG8W38mn3hCA9kWC6g9OiAwjBTxJXYmsUFYbj69Iloo9moBBLEtztu8T9vYu8rGqcchKzzjnvcS91kiduq9rY9/ZvYC4zx469DgnV/di8cjGdU6JAtsoHwggDtCVf2hvkyOIHTyPM9Y/EVGCsOsIzhJnTdsyRGn4su3ruLmS8VqbKC22Q86pSHjwdlD5RoZJjYtMWr5Q5YAvFbnTH9/+d0r363BfxlNsVkINd5d2OwlPpagEQ9pg4oFnnk48tsVEoYz1RCy9x/bK3U4B0Jin6l0T2NJ3umXPriLxBQbODWVA9vcv6G1tQiiuOsbYCWigoxe3ACpuYQDV+XujfmEZr3pcIw0hwKXtUWHI079aUkICcMEbtE3gLc1dNVQpja1SimZOUlqf6pz3YLv6L1e2X+yR93p2rN6hc8IJh3KA8ZR1Ymbbq2LaOwdyla50uuhsOkE2TGDTGmf9NyXjGcUys5LgNpRruzXEm/KgUX4tP7iMjHu5HbnDe9oiv66qfuIORiR2P3lbOdx3s+XmPd/87afw6YHA896ccCRkGpGnFanbrR+Z7MRqCOZsSLnQd1JpjnWJJU/bzrSl4q+PUV1Bt+hvAf8wXUrDtES6MdpOKUe4XW8s3QbVHvCx1iOSzP+r59T4N
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
name: garage-secrets
|
|
||||||
namespace: garage
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: garage-admin
|
|
||||||
namespace: garage
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: admin
|
|
||||||
port: 3903
|
|
||||||
targetPort: admin
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/instance: garage
|
|
||||||
app.kubernetes.io/name: garage
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "1"
|
|
||||||
name: jellyfin-local
|
|
||||||
namespace: jellyfin
|
|
||||||
spec:
|
|
||||||
hostnames:
|
|
||||||
- jellyfin-local.whyredfire.dev
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: jellyfin
|
|
||||||
port: 8096
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "1"
|
|
||||||
name: jellyfin
|
|
||||||
namespace: jellyfin
|
|
||||||
spec:
|
|
||||||
hostnames:
|
|
||||||
- jellyfin.whyredfire.dev
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: jellyfin
|
|
||||||
port: 8096
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- httproute-local.yaml
|
|
||||||
- httproute.yaml
|
|
||||||
@@ -1,126 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: qbittorrent
|
|
||||||
namespace: qbit
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: qbittorrent
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: qbittorrent
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- env:
|
|
||||||
- name: PUID
|
|
||||||
value: "1000"
|
|
||||||
- name: PGID
|
|
||||||
value: "1000"
|
|
||||||
- name: TZ
|
|
||||||
value: Etc/UTC
|
|
||||||
- name: WEBUI_PORT
|
|
||||||
value: "8080"
|
|
||||||
- name: TORRENTING_PORT
|
|
||||||
value: "6881"
|
|
||||||
image: lscr.io/linuxserver/qbittorrent:5.2.3_v2.0.15-ls478
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: http
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 30
|
|
||||||
name: qbittorrent
|
|
||||||
ports:
|
|
||||||
- containerPort: 8080
|
|
||||||
name: http
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /config
|
|
||||||
name: config
|
|
||||||
- mountPath: /downloads
|
|
||||||
name: downloads
|
|
||||||
dnsConfig:
|
|
||||||
nameservers:
|
|
||||||
- 127.0.0.1
|
|
||||||
dnsPolicy: None
|
|
||||||
initContainers:
|
|
||||||
- args:
|
|
||||||
- ip rule del table 51820; ip -6 rule del table 51820; exec /gluetun-entrypoint
|
|
||||||
command:
|
|
||||||
- /bin/sh
|
|
||||||
- -c
|
|
||||||
env:
|
|
||||||
- name: VPN_SERVICE_PROVIDER
|
|
||||||
value: custom
|
|
||||||
- name: VPN_TYPE
|
|
||||||
value: wireguard
|
|
||||||
- name: WIREGUARD_IMPLEMENTATION
|
|
||||||
value: kernelspace
|
|
||||||
- name: WIREGUARD_PRIVATE_KEY
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: WIREGUARD_PRIVATE_KEY
|
|
||||||
name: wireguard
|
|
||||||
- name: WIREGUARD_PUBLIC_KEY
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: WIREGUARD_PUBLIC_KEY
|
|
||||||
name: wireguard
|
|
||||||
- name: WIREGUARD_ADDRESSES
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: WIREGUARD_ADDRESSES
|
|
||||||
name: wireguard
|
|
||||||
- name: WIREGUARD_ENDPOINT_IP
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: WIREGUARD_ENDPOINT_IP
|
|
||||||
name: wireguard
|
|
||||||
- name: WIREGUARD_ENDPOINT_PORT
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: WIREGUARD_ENDPOINT_PORT
|
|
||||||
name: wireguard
|
|
||||||
- name: WIREGUARD_MTU
|
|
||||||
value: "1280"
|
|
||||||
- name: WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL
|
|
||||||
value: 25s
|
|
||||||
- name: FIREWALL_INPUT_PORTS
|
|
||||||
value: "8080"
|
|
||||||
- name: HEALTH_VPN_DURATION_INITIAL
|
|
||||||
value: 30s
|
|
||||||
- name: TZ
|
|
||||||
value: Etc/UTC
|
|
||||||
image: qmcgaw/gluetun:v3.41.3
|
|
||||||
livenessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /gluetun-entrypoint
|
|
||||||
- healthcheck
|
|
||||||
periodSeconds: 30
|
|
||||||
timeoutSeconds: 10
|
|
||||||
name: gluetun
|
|
||||||
restartPolicy: Always
|
|
||||||
securityContext:
|
|
||||||
capabilities:
|
|
||||||
add:
|
|
||||||
- NET_ADMIN
|
|
||||||
startupProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /gluetun-entrypoint
|
|
||||||
- healthcheck
|
|
||||||
failureThreshold: 30
|
|
||||||
periodSeconds: 5
|
|
||||||
timeoutSeconds: 5
|
|
||||||
volumes:
|
|
||||||
- name: config
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: qbit-config-pvc
|
|
||||||
- hostPath:
|
|
||||||
path: /srv/media
|
|
||||||
name: downloads
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
name: qbittorrent
|
|
||||||
namespace: qbit
|
|
||||||
spec:
|
|
||||||
hostnames:
|
|
||||||
- qbit.whyredfire.dev
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: authentik-server
|
|
||||||
namespace: authentik
|
|
||||||
port: 80
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /outpost.goauthentik.io
|
|
||||||
- backendRefs:
|
|
||||||
- name: qbittorrent
|
|
||||||
port: 8080
|
|
||||||
filters:
|
|
||||||
- extensionRef:
|
|
||||||
group: traefik.io
|
|
||||||
kind: Middleware
|
|
||||||
name: authentik
|
|
||||||
type: ExtensionRef
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- sealed-secret.yaml
|
|
||||||
- pvc.yaml
|
|
||||||
- deployment.yaml
|
|
||||||
- service.yaml
|
|
||||||
- middleware.yaml
|
|
||||||
- httproute.yaml
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: Middleware
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "1"
|
|
||||||
name: authentik
|
|
||||||
namespace: qbit
|
|
||||||
spec:
|
|
||||||
forwardAuth:
|
|
||||||
address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
|
|
||||||
authResponseHeaders:
|
|
||||||
- X-authentik-username
|
|
||||||
- X-authentik-groups
|
|
||||||
- X-authentik-email
|
|
||||||
- X-authentik-name
|
|
||||||
- X-authentik-uid
|
|
||||||
trustForwardHeader: true
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: qbit-config-pvc
|
|
||||||
namespace: qbit
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 500Mi
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
apiVersion: bitnami.com/v1alpha1
|
|
||||||
kind: SealedSecret
|
|
||||||
metadata:
|
|
||||||
name: wireguard
|
|
||||||
namespace: qbit
|
|
||||||
spec:
|
|
||||||
encryptedData:
|
|
||||||
WIREGUARD_ADDRESSES: AgCUjKDTHlj+cDz5QmTdFrQ2uzgf2h7nHIB22Hiy8dNQoHPmpl42IS8pWMM3cC7/RQ620XX3Gvnjt7w3N+cRHsxZONCtBaocM/B4lBxgkrqoBuMISQ90oeqeL16ZWd6yDPmzgJLG0JfWPEuGkXsCkMHKg2cTQwZeIhoI0jiiUIKtY0q3YA19cSaf9gX0buQyu84hy6oi7Y2l0EXqwcbHJP2NEAWmxXuHF1nKtcSnAUlsHGCfomHLtSPoyoR0Ug3CER60oE18JIYmbt+iFL4Oalx4nKFoJbkD+dPLx/Do7kylySVqX5DAj1ivIQjyqZmcsyaigP01OU+poSM0D94mhMt8Dfi+ZOzDemoVDKtJlOYNfskk0hLdbLdGk6DzlONl7KBjduzbSk7BnFlr5bRNeKYFiDpg5I1y2FKROpmFCvV2pzqlLFl0C2BTwZU1dAj2Qk+ouUdhzzxEKqS2Q/CUUIftepqKIYzMJncFDbEjt5gAB0DJOt6FWiNG9TV3v+oSdzqn9UFPTIP1SO3IhyVoICDGmo829ki104ZnvjVciuPLH85l5rSdQI6qJuabLXylqTU8tmebTXDJZw/kBD+hw4ycCgD1kQssZM3djjy/RbMhY4zrpN345jelr9Z5kQsINcDBPfyCjCm/Eo6PM/fiuCkNP/KrKHI6C+NkyFHWk14ZeYODJI8GYakRO6SCRZ1G/SWJxA5DfZcuojweGD0G
|
|
||||||
WIREGUARD_ENDPOINT_IP: AgBKPD8cgNPVl7YTUsKkDRioPFCLNg+q+PGYiN5Qvw5nAvhh8tmUiV3JlkdtUHp/ggC8Fn+bLsNPRjjQoa02F8wZv1oxO1XeThNtxX49xlcLiFsw83wtL/pKQcNShml+HClsiCXN569g9NkcCY4R13tcSZPRbVs+oV95sGeUtfx/Ukh4g/URX1Z0aKzI2RE1ENMLQMXkVrrk7GJdqKBBsW76wHcTHw3DgcshMhlgcDwLiX4b+e5nAOzjlcwEKm6EBxXz2NuHP9PTkzfvK9QSSZJ7GLlac7eqFWj+xir8k1s1bIzB/suNMIzpo0bvOUjpxmoI54Xd4/hZ6fXkEF7lD1DwK7G/RV9+XNePPX+lGSJ9gQMIadmK3P6jHNnl/+RtqUk3mQ35r3Tl1Tmz3mhhK3/YalL6/8zWesNVYt6D4yQkFi3GFnc02Htl7/CyU+r5a3TwE3xUl/VNtkhHklrL8obF/cCORbFlYcwT2tbYl1av/3slJ8UsG+DXEX62+o6Tpt70Mzhcj61mQ2H/Emb5d7FPYlohogM1e37YY6lJhbjZeNHxxKvki8kusPa/eY8ZAdJcpd41/0rrL3uSOOZqqELNuTzqQKRhb6CDUGaoYFqSw9umDqwjdvfFQcYLQepn84HFILAlUfNF/InO6WrNh8jWGKx9SNsDfrJpY/RRyEJK8EoNIuelLdNP3phZhxUcQn/UBZ/M/UOzJZZ2xJPl
|
|
||||||
WIREGUARD_ENDPOINT_PORT: AgCOTc0MMWugdnF6Ou8mGgBGu5VD7zP6O3hGr+4YzW/UvCEARqwuoRXTKggUpFcZC0mNf1CdGCB1iRGCVWjnFJsw6zSudcJiWEVOtqLMfxxwZHhApiMtaHq4ERP4Hhu3jn/QwdwbYgk7rUoqsCRU2JelgPoYIhJh/2BtOz0z8PO+ktMIi5Qaj7m6O0zkxbzvqZaEbgkYsFCtQlaWqvghNk7GZB12KOOr0kU+Uu4vyi2ak7quoMjaQkMrRHOhhw0hk++FCXN9SNpDGyGBcqPtl/8ZRUyomLi76O3nsHX8QtXXj3yzDEwrdfwNzCwJXqI6HI4X2+/xSvnxI09wf5ei6D8gyJX8gkPQiqsXA4dsYvTUstf26Qlh/L6iQjB8RkXixBR1YwrIu/lLNO0FpFPqtLJu5jf1jMjZIn+oPl3GxAXcM+kRsX9YS5oJdD3rFFTz8HGthfOTSpaEgSnN2rF440vfIH8DKvTDH4cyR78C2Z8TWQ2hbDxXOX/NwxvPfidttyC3euLBc4Nkb/VX/DEU9W3QCB9yKuXw2KKSqnWHvIAReYLn5ex9czU+B+8IP2fJzTMDH7gOYqwtxuRMPu5bto0dn/120ZaLDBzGUHL38pBnMsYhssOGQlerpG32nT66IYdaZXTMD2UHsTwnNqu4/J98IY47n60wg3SVOVyZQ/dmS7Dfp8lPr/kE3+xNM8HWayCEKYxW
|
|
||||||
WIREGUARD_PRIVATE_KEY: AgAwJo1zxNRWXAinDWXvLajPWwHeWwAD8zOopE8Z8M5xAUDKWkTwZecR/ODI37bYQ22bb1+qjErBsqUHyT79adOmypY9DLW6YdY2YPkQwef33iXdgC1T7nV4pjI2TahiVab0z+5ot18A/FM9S7VHmRX4L+3ccO/oqcInNz5PFbsXp6U0dZZtiKWg7N5IzdT9dwDCknNFTv10URlHKE0Awff8jA34XGC8Ra/SvF3gSiaYjwd74HEBpnBMM5CsiveOyU1vCNxg93S12yrauC5jmD/ex5oEnJ4J1SziTUlB6e6ALpluA3AD91wuZ+wXeaJ0huNSz4g4sL6jm3OQykyiRx7jx/8FL3no0u3ydGPgYZ5MaEYXBtTk6ODFEhUZ7EGs9w8vip1SY/FijZYC3QT78R5WMim8gi1wf+TwmA8YRIDZW0CMhbtI32Ef2oDmb1Jzl58Igba8zQGTIqT7Htj6f4mpJk8gKSRIzkvLK6o+cynOpQzZBOZb+G7lZst4g+lILLjmfpFGJTVgogfEkuYV6ntuE3dGB2OmRGUW0vpDM4ZCkxYsjh/1kzSyOGVYtL0EHS689ehzUDUJLuJuvuwZIFUjOFCFofGP37rKCcSGouLNj+xWmcbCgx7si05rw8JMeAWE5YETaBbi55DDaUB98G97KM28OlPBDm8PtqdcBD4W2up34nowXdG0tZ38VsTV7xNyp+2A5saPQZ72wM1fQiUwGwoHRKdHB1ptF6u+0zr6tlQoiVE07BMQ8/ykAQ==
|
|
||||||
WIREGUARD_PUBLIC_KEY: AgBAElHBgsQNQ3l8CGLlKMmi9dMTLmgp4gseMgbEMW4sjOvhsAIeLGsuv+HuStvH+bfAp7U9Fh6pAlEZKPOdN5pbpoFjkTDC5VU8aKJcdO/+iZWURbULYBDyGK32Ss/0eCwIsdO7lFcSFy2T7XJFPn656lBx8gocBp9PMHRSoL2dELP9q8JyNr3nb84vZ8hwiBP3Gy8BITeeE4J7+DnF2SUg+4pc92gMOgmWL4LO25pI39Q1yKBw4tCOf4f4ETgmjRHv17WsFw2JZTgb1rmXFvvKWGzTPZbA1gajcRgTKY7DrzWFjFi/o84qjGC4feQ9vb5ZwnLN1MzU1yByQmxQiAOSCK+1SMrvUJ9dF2kE3zJw0fSGjU83iXcorpbe4YYFr4Y8k6mKSSthchYyQZp5FuB9N9J7vm4vv4kUbTGOtwHQFrKRNiB5PVVFqzUVYWs9CfFcodAu7JaCBHKzLj1X7xBLiQoWYpx7/LVTjoR/R9j/+bfblKlid+H322Oh4ReSuxVKfMmNiOGeueMOrGX+DhHtYFbGHmdc3aprjBkYanq71MV9kFRVAZd834IX4wWykQWWgmYtx+eZJs6DZRWhAaVbBQ9IY0vS4IjAInTpMN9yqNxJkZ+w1MJIeTG5S9NnB3xUjnOgSCow9r/IEVNFbT4CbsEXbMECQ3S0OIby8r3Zwt8J7NEphFYkLtsR+brtMLsWRHIw23mtSTZajLMaSHOG6fooZyNKYgYJGr0Spura2M6TjhW+f1csYKrkxA==
|
|
||||||
wgcf-account.toml: AgAaSo7eZz/CvAN1reUDhHzFWIcmQMopYloYitAYq5Zu6gXE+65ogq0Jr/S7WLTqdgL3KWWhSmlG+jpepC8cpomVrnPfydlw6or227dm0ND5XNEO1MwNOtzeGNS3q7ayB8NoC7qZVR33KqutGOZLbFawyTZUi4ItjW74SdvL/Ftd4VvqrG7hQtAd/2PP37mL0unw2DesL8hFUXTkvlzAdKHZGQMaYNcH73JWJwvlf95L6ncKdZXWEM0uJnjhAVE+sCpUEQK67mQcX4RrYairr1wwux2YYjwweAriXw7wzBDvOXnHqg3Ldmat0V7FMK0MeIzHhezy15AGLtYRonFcYzEznIl7P2FjjG4Yz0EAk0t1rJpQgV35NAybseQ8t/92+vPa7LaPcjUUKZ5Kx1a2SdihljtLEjzuIdvYN/tKPcselzehWWrbDl/qeQuwZABxj8z24moJmBqJcXpAigvX4XlDcWp0jHWQxbLDozKtYHKUEPmhAklVaDuVr+bY2jOxU4Nki3ybLYpi834CsifcSc7RAaruJIlnITZUR2VG7PMIoTObqfeYnSyZKabHadWHHdkoyYsJmSiWjadvlvBXtW+RTHVU8UsD8GdVS9wBpA6ZcRsegFiEAoMzdyZQNRabYjUeAxpA/lOtt/PH1FnIV588Of/lhypBdUF4rRYcCvVT0gFQjoe7ITsvEf/P+fLb3TO47fQtBqOmKqoD21yhtb8Y4GQ21XVmB1gJT+/oYjny9/YL5CuhJif0XoarJZHtvTb5Ubs716PRSmSvAoXI6jBMKVSssWtfMIedL03X+RAxyT3jvL/W/SEuN5D5a2RpjIswAIN5LQ3b9f7F/JgDIQKdIHUEm+Z430lS83RDsMpJ13SmRVoXzbAededT7r08DHu++sOvDfHeMy+lTD0aTaskbPWY5PLve7g7PWat9q+NMepgRC3z26JCw/08O4SGX/fUhxg709F5A8hf/LUSTNGRlQ==
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
name: wireguard
|
|
||||||
namespace: qbit
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: qbittorrent
|
|
||||||
namespace: qbit
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
port: 8080
|
|
||||||
targetPort: http
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/name: qbittorrent
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- sealed-secret.yaml
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
apiVersion: bitnami.com/v1alpha1
|
|
||||||
kind: SealedSecret
|
|
||||||
metadata:
|
|
||||||
name: redoost-s3
|
|
||||||
namespace: redoost
|
|
||||||
spec:
|
|
||||||
encryptedData:
|
|
||||||
REDOOST_S3_ACCESS_KEY_ID: AgC0A+pQKuYKMLfMPRAtL6a3PBEkwgghd7IbH8ZGhgU086s23NvbOBM5sHHkApqOiQ9z2LarAfvvKpBdxlQTjInxhqdJ1lW/zkWHokHhSn/L4ule/efU18a5gXsxNXN0Mon9PZrS9wKAFR9ZNiEDFa2/L4iUtCesUR/MneUFqqqibxiUgt2R8sMmRIzP9O0b8T7vnw1EkgyO4HWpWlLrGPnBryWA4OEj9CGLrTT7Z8u3Z2J5m43dELfmzdAH4gM3RQPXAzAMY+QyxnhtGA6x52OTcD8XxqB1lW/dWzTq+zCjnmRR5HbpWjeuM6ojlFJZoBLxYRRMZowMEKFX4egKUvGEDmSKOX5Z+Hn5n11dyRFhpKrMU9vy+utLvVtDM/rr5NqK1Bna0u40VdUUwpdoqAWUevw9yLld2QzOg06hjqQwpqVER7E1VTDKjVXveacaN7si+63abaw649eAaFhTitMEE9ORHZ7Fz3YZB5zdqnEQWZwzczJhhvqzNxP0pg1/JCEVrKYVfHCtuDoJ0BCeiuFPWU8lKYhYoxRzm6biWhdevM4o5CobnCedH/O+TDq6iPDDgC9iBNHIQjwfUAjjq44OXfl7X9+J3Q7xm7BYMD+/8LvycbBauFtOnkj32fyuUKF/EvoQF/AIQ3TX6rC/CkbIMT+m+mcAx75CB6hfpBFOMRKgpTT7WNR1zs6YrSEzNNQq95KvTIMVYEEKm+gjrnpv9mkCkCmSJPCWsw==
|
|
||||||
REDOOST_S3_SECRET_ACCESS_KEY: AgCp8zFoy+Clr5qY/57jfSwYT44a2jwTFzHgOPoYfE6LXXtis40QjrteEjyc9oE4dE2IlR3wY85twCcqMEbJW24mkTbQf5E4B4V5XaUTi2XhMkrms1tfwaKJzYJiPfoS5u/WyrMN7LK/pqryEVGODKh/57PNoEDK/N/ab7w1iKfxGQQVuwDSCdsT3RtrinzKXKHUFsR4f3wpOAO9nh/53atgZ9MMs+6DFLmkdXvIfjgJ/PqCrtxKx3hTXFNhrwbDIUJFF/wF9SUy6C2CyHCycdeU5HJFSahCIRMZvFAhDrl0Ubsi/MFgWsQouj2q6VEK8VAWDttCJaiSf9g/KhELneKCYC7qo7e4PzhHhAHUGO5fILWxd7HySj4CxSiCDiF3kIqVUXo/sqlbgBNMvPb+NNqo19g27jcFZPh/AZZkuBSxsdmEYfgg1RAcYmwPGUxksRcj36yknYjX4pMxJNqVGDH1nLsplOa5b8h+evxMnjK6oNduRP96zHd+Qo4sC2ThBF3Ar8STJpbbJ+KgdW1HnHo38JYd0J8q/pcVq5xY3+VX8Gy8JSrb9wdFMZnb+iWmyL/GNwLIqqbZw1zcKF7Rru78fl8Y5VWDnrpbjn1buqDxwyFkDhcxX9WISoAPKXP9K2Cs5UOIKwu50cOAyA+cMOMsYbTnkvAuDMZ5aBPp80j0TQLu4luPPvKG1RumhYxGthmEpwQaPyXuJfhOBbuVrsiNlaCKe+d3Jv9l3Y4PVlTBJg7ZD7YpfLoyvt1Y9ELAI5qiUjZ4Ru5TxX2lIqZOoZ/G
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
name: redoost-s3
|
|
||||||
namespace: redoost
|
|
||||||
type: Opaque
|
|
||||||
@@ -1,60 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: rustbin
|
|
||||||
namespace: rustbin
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: rustbin
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: rustbin
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- env:
|
|
||||||
- name: DATABASE_URL
|
|
||||||
value: sqlite:///data/rustbin.db?mode=rwc
|
|
||||||
image: ghcr.io/whyredfire/rustbin:sha-75418bf
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: http
|
|
||||||
name: rustbin
|
|
||||||
ports:
|
|
||||||
- containerPort: 3000
|
|
||||||
name: http
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: http
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 500m
|
|
||||||
memory: 256Mi
|
|
||||||
requests:
|
|
||||||
cpu: 10m
|
|
||||||
memory: 64Mi
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /data
|
|
||||||
name: data
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 65532
|
|
||||||
runAsGroup: 65532
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 65532
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
volumes:
|
|
||||||
- name: data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: rustbin-data
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
name: rustbin
|
|
||||||
namespace: rustbin
|
|
||||||
spec:
|
|
||||||
hostnames:
|
|
||||||
- bin.whyredfire.dev
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: rustbin
|
|
||||||
port: 3000
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- pvc.yaml
|
|
||||||
- deployment.yaml
|
|
||||||
- service.yaml
|
|
||||||
- httproute.yaml
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: rustbin-data
|
|
||||||
namespace: rustbin
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 1Gi
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: rustbin
|
|
||||||
namespace: rustbin
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
port: 3000
|
|
||||||
targetPort: http
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/name: rustbin
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
apiVersion: postgresql.cnpg.io/v1
|
|
||||||
kind: Cluster
|
|
||||||
metadata:
|
|
||||||
name: splitpro-db
|
|
||||||
namespace: splitpro
|
|
||||||
spec:
|
|
||||||
bootstrap:
|
|
||||||
initdb:
|
|
||||||
database: splitpro
|
|
||||||
owner: splitpro
|
|
||||||
postInitApplicationSQL:
|
|
||||||
- CREATE EXTENSION IF NOT EXISTS pg_cron;
|
|
||||||
- GRANT USAGE ON SCHEMA cron TO splitpro;
|
|
||||||
- GRANT REFERENCES ON cron.job TO splitpro;
|
|
||||||
- GRANT EXECUTE ON FUNCTION cron.alter_job(bigint, text, text, text, text, boolean) TO splitpro;
|
|
||||||
enablePDB: false
|
|
||||||
imageName: ghcr.io/whyredfire/postgres-cnpg:18-sha-62e724e
|
|
||||||
instances: 1
|
|
||||||
postgresql:
|
|
||||||
parameters:
|
|
||||||
cron.database_name: splitpro
|
|
||||||
cron.timezone: UTC
|
|
||||||
cron.use_background_workers: "on"
|
|
||||||
shared_preload_libraries:
|
|
||||||
- pg_cron
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
memory: 512Mi
|
|
||||||
requests:
|
|
||||||
cpu: 50m
|
|
||||||
memory: 128Mi
|
|
||||||
storage:
|
|
||||||
size: 1Gi
|
|
||||||
@@ -1,108 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: splitpro
|
|
||||||
namespace: splitpro
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
revisionHistoryLimit: 3
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: splitpro
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: splitpro
|
|
||||||
spec:
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
containers:
|
|
||||||
- env:
|
|
||||||
- name: DATABASE_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: uri
|
|
||||||
name: splitpro-db-app
|
|
||||||
- name: DEFAULT_HOMEPAGE
|
|
||||||
value: /balances
|
|
||||||
- name: HOSTNAME
|
|
||||||
value: 0.0.0.0
|
|
||||||
- name: INVITE_ONLY
|
|
||||||
value: "false"
|
|
||||||
- name: NEXTAUTH_URL
|
|
||||||
value: https://split.whyredfire.dev
|
|
||||||
- name: NEXTAUTH_URL_INTERNAL
|
|
||||||
value: http://localhost:3000
|
|
||||||
envFrom:
|
|
||||||
- secretRef:
|
|
||||||
name: splitpro
|
|
||||||
image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /api/auth/providers
|
|
||||||
port: http
|
|
||||||
name: splitpro
|
|
||||||
ports:
|
|
||||||
- containerPort: 3000
|
|
||||||
name: http
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /api/auth/providers
|
|
||||||
port: http
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: "1"
|
|
||||||
memory: 1Gi
|
|
||||||
requests:
|
|
||||||
cpu: 50m
|
|
||||||
memory: 256Mi
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
startupProbe:
|
|
||||||
failureThreshold: 60
|
|
||||||
httpGet:
|
|
||||||
path: /api/auth/providers
|
|
||||||
port: http
|
|
||||||
periodSeconds: 5
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /app/uploads
|
|
||||||
name: uploads
|
|
||||||
- mountPath: /app/.next/cache
|
|
||||||
name: cache
|
|
||||||
- mountPath: /tmp
|
|
||||||
name: tmp
|
|
||||||
initContainers:
|
|
||||||
- command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- until nc -z -w 2 splitpro-db-rw 5432; do echo waiting for database; sleep 2; done
|
|
||||||
image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
|
|
||||||
name: wait-for-db
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1000
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
volumes:
|
|
||||||
- emptyDir:
|
|
||||||
sizeLimit: 256Mi
|
|
||||||
name: cache
|
|
||||||
- emptyDir:
|
|
||||||
sizeLimit: 256Mi
|
|
||||||
name: tmp
|
|
||||||
- name: uploads
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: splitpro-uploads
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
name: splitpro
|
|
||||||
namespace: splitpro
|
|
||||||
spec:
|
|
||||||
hostnames:
|
|
||||||
- split.whyredfire.dev
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: splitpro
|
|
||||||
port: 3000
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- sealed-secret.yaml
|
|
||||||
- cluster.yaml
|
|
||||||
- pvc.yaml
|
|
||||||
- deployment.yaml
|
|
||||||
- service.yaml
|
|
||||||
- httproute.yaml
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: splitpro-uploads
|
|
||||||
namespace: splitpro
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 2Gi
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
apiVersion: bitnami.com/v1alpha1
|
|
||||||
kind: SealedSecret
|
|
||||||
metadata:
|
|
||||||
name: splitpro
|
|
||||||
namespace: splitpro
|
|
||||||
spec:
|
|
||||||
encryptedData:
|
|
||||||
GOOGLE_CLIENT_ID: AgDRctXaM2WUp9CYS1HQaxq1F6qJ6wyuV5PRK1hhSYCGCpZwId6mT/M+YCGiPnvAqR2W0L0cJ199ytZ5aV7UBrgbLG6XK7jN1txxpdWTSq0pONPj2jOrUvqdToA/6hUCsQBW6oqshbhjV/H53PxmKzR/t2zTQ0xoI64FK81INBsyaCY1gzdZQWYZCkmDhBUrvzfprcI6ayTvOtMhJkXMFU/TNielxjQtmRKnjz1wqyKZkvie7ZS2oEzU7R+VuuoMQVyL/N1pcu8rd5/WaJxJNgtG0oTFtJMQMCKvV80nXRWTXaTCGtpd4Ior+COgUW1ruzxU7HvrOMeQk/pwRPtVuANA5XUgwABWJH+RMmSDTsmqFlqaIYluE4swYGeR2dvEVWv4PN7YjBuJzYrWOCntp571JLw9jJ8ffCCEETQiEYc65ZMochp1rayZaHFJXAoorS/AbOK5fBYpdwM7R9KYl9tGxYzNcqzihezqb2hZuIIyEQnCtKPJl68TywiDXcUiftwlIhf56v2Us9nYaHRsIVstot1FhkrO2DqYrRxJ9/k8wPeJjPFCqrpx56y9bqRiyq4R4tfAKv/iHTZ2d8hVUZ1Pr/bc2pqwjxtjzBlGBXrAC4xSQWf463wk5IvY2dthRq0LZsXd7c8zV8QN9ZGwtWgWulNB/VXIsv0LoI7lmujWbCAGcis8helOo1wRgYE/NVeD/SEpJGEPkzx9XRuplj+00WsjOYmsbfvtQIcOOJbEtM3d6vqLd+SeFswSg1z01YFX6gagPhHCbDqfy0+DFkkM3QVsAPxKrBwT
|
|
||||||
GOOGLE_CLIENT_SECRET: AgAkBnqzqC9srhWzQA/q7ZfMpgfTy+J0on856vHPrIS8oe5P30vciaGlgkQdf1oMLA5ovHaSq6x9AEqv7HRzoeSrdUSjswZce1akAcXU+wA0mQGzVsmaTpCERAJ7GXWmSgsvIQNQXF5N6BLiZliueDiMIy3sZYAcoffrZ5l22mWOSBlHCXXZqZoP+F4Y4tQrlO28NjlWGo1UBf83JZ6TZMtK7IOuYoMDsZo/NlE1x0zj3beMm1VLvHJXRn1plU06IwlIKH0xEed2izff4FQ7f4Q3Dqmtbz6PhTdVqy4HQvhIrkAl/6IwQCZdTWHRdgv6fXQWs+ZftoeRMHFXI0xB3YfbLoqO8Q2kDqgxSOM8Xixdbabq1v8u0EVZCNRryb+XuWwG46xWNPVF2Nl1SIaeLxWQhFGEXTUf9IqYH9fQ1kpqIlj5IgEa1MUWsx1eE+vik1shT20woU7Lj21Zcu3RZob92qMVNZHheB2Lzkcw+dP1BwRIwXTiLXfdyDDHXlajnkvkkrrcwO62K4zEIIS/LyoLt2vdk63mfXKSz343pnpOsN2hEqJSTkCx3CFhB4JBSybSFrBtljcCDjK95dvsTQq8qZKEqLFZEQjRWXxsiR9aoNo2MCmPA+dDfvsJ7/GZ8mnjyNdLw+UCxrTiyXMI0pAgezZZZf96KPGUL+LnRbJiTHxxsfk+q2/nMZeU+ftZdV0F7zrCUQhkyJZwhYk2XsblyHiKsPCvLHtKbhIXVpwnLdXPgw==
|
|
||||||
NEXTAUTH_SECRET: AgCdNnXbHEuOlg1UnJii5eGJVfBZh5nWaybBODJJK3FbyhYPuj2KhGfNB/ld529FpddAEDv1IGWwKAOaSCkhSv1Nh1P2NZj37jpgbsHx8vw1omLLSkWqtRf1m4AhHhEwQoY49dlAk4AxSkjk5IckH8PbbRWFXx8Ns8kAGrJLrp6i7EbxrkI3U+hbEz93sQwRJo8XOeYCEodr7JPKoYHwy5roAwB0PmFL56bZFfuCa9yEje4BFxdQMrm0grSDMotTDH3nTF6irq5HSOEgqnL7Tt3kHW+Uaz5mvUZcCxAMUoB9q2mjTjm8fiprybVfMmCsib3epcZGrn0DiPZhihePkrfL6vTaz0pm1Nr7qkbtXFVY3RWgZjFpmDyAl/of7ddh9VYQVmqVAhfI610Czqqyou0zFuvlOXGlp1ljp7FNiwo+r02WxYoJ1leikB+CCnVxd/ErELA0AVneGUcWzoKG6r+OlDzsfV/gp2LXanAq2jKyeZ09ARhkLs3PHzkoGDaOF1Dr+3ZCidrfV+GRcnr73P7QEQNO6R+tEmL+idKiLr4uI56zrFg/Vb5Yxk/jMr2Hrfw7ai/nV2A+eqgXFQammCEZlDyCS8GPX8ULervbG/n4JmXXMUtGB9esM40cfTlsNhhv7sBC2P8QkOI00wvgdiwcPkOE+1i33Sxd1Vt20d8EP6TMfwhofQz2zYdYQEWYmBgiG+zX7mwwh3awuA5uH+ooA5vFe/aHPvMYM2rbTYDihEISJt1b6cbCiE8+Iw==
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
name: splitpro
|
|
||||||
namespace: splitpro
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: splitpro
|
|
||||||
namespace: splitpro
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
port: 3000
|
|
||||||
targetPort: http
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/name: splitpro
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "1"
|
|
||||||
finalizers:
|
|
||||||
- resources-finalizer.argocd.argoproj.io
|
|
||||||
name: anubis-operator
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: anubis-operator-system
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
kustomize:
|
|
||||||
images:
|
|
||||||
- public-registry.brunobernard.dev/techarohq/anubis-operator=ghcr.io/eznix86/anubis-kubernetes-operator:0.4.4
|
|
||||||
path: config/default
|
|
||||||
repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
|
|
||||||
targetRevision: v0.4.4
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
- ServerSideApply=true
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: argocd-dashboard
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: argocd
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
path: infra/argocd-dashboard
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
name: authentik
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: authentik
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
sources:
|
|
||||||
- chart: authentik
|
|
||||||
helm:
|
|
||||||
values: |
|
|
||||||
authentik:
|
|
||||||
error_reporting:
|
|
||||||
enabled: false
|
|
||||||
postgresql:
|
|
||||||
host: postgres-rw.postgres.svc.cluster.local
|
|
||||||
name: authentik
|
|
||||||
user: authentik
|
|
||||||
global:
|
|
||||||
envFrom:
|
|
||||||
- secretRef:
|
|
||||||
name: authentik-secrets
|
|
||||||
blueprints:
|
|
||||||
configMaps:
|
|
||||||
- authentik-blueprints
|
|
||||||
server:
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
memory: 1Gi
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 512Mi
|
|
||||||
worker:
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
memory: 1Gi
|
|
||||||
requests:
|
|
||||||
cpu: 50m
|
|
||||||
memory: 384Mi
|
|
||||||
repoURL: https://charts.goauthentik.io
|
|
||||||
targetRevision: 2026.8.3
|
|
||||||
- path: infra/authentik
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "1"
|
|
||||||
name: cert-manager
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: cert-manager
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
sources:
|
|
||||||
- chart: cert-manager
|
|
||||||
helm:
|
|
||||||
values: |
|
|
||||||
crds:
|
|
||||||
enabled: true
|
|
||||||
config:
|
|
||||||
apiVersion: controller.config.cert-manager.io/v1alpha1
|
|
||||||
kind: ControllerConfiguration
|
|
||||||
featureGates:
|
|
||||||
ExperimentalGatewayAPISupport: true
|
|
||||||
repoURL: https://charts.jetstack.io
|
|
||||||
targetRevision: v1.21.1
|
|
||||||
- path: infra/cert-manager
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
- ServerSideApply=true
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "0"
|
|
||||||
name: cnpg
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: cnpg-system
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
chart: cloudnative-pg
|
|
||||||
helm:
|
|
||||||
values: |
|
|
||||||
replicaCount: 1
|
|
||||||
config:
|
|
||||||
clusterWide: true
|
|
||||||
repoURL: https://cloudnative-pg.github.io/charts
|
|
||||||
targetRevision: 0.29.0
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
- ServerSideApply=true
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- argocd-dashboard.yaml
|
|
||||||
- authentik.yaml
|
|
||||||
- cert-manager.yaml
|
|
||||||
- cnpg.yaml
|
|
||||||
- postgres.yaml
|
|
||||||
- sealed-secrets.yaml
|
|
||||||
- traefik.yaml
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "1"
|
|
||||||
name: postgres
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: postgres
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
path: infra/postgres
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "0"
|
|
||||||
name: sealed-secrets
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: sealed-secrets
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
chart: sealed-secrets
|
|
||||||
repoURL: https://bitnami.github.io/sealed-secrets
|
|
||||||
targetRevision: 2.19.1
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
- ServerSideApply=true
|
|
||||||
@@ -1,67 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
name: traefik
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: traefik
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
sources:
|
|
||||||
- chart: traefik
|
|
||||||
helm:
|
|
||||||
values: |
|
|
||||||
ingressClass:
|
|
||||||
enabled: false
|
|
||||||
providers:
|
|
||||||
kubernetesGateway:
|
|
||||||
enabled: true
|
|
||||||
kubernetesIngress:
|
|
||||||
enabled: false
|
|
||||||
service:
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
externalIPs:
|
|
||||||
- 192.168.2.5
|
|
||||||
gateway:
|
|
||||||
listeners:
|
|
||||||
web:
|
|
||||||
namespacePolicy:
|
|
||||||
from: All
|
|
||||||
websecure:
|
|
||||||
port: 8443
|
|
||||||
protocol: HTTPS
|
|
||||||
mode: Terminate
|
|
||||||
hostname: "*.whyredfire.dev"
|
|
||||||
namespacePolicy:
|
|
||||||
from: All
|
|
||||||
certificateRefs:
|
|
||||||
- kind: Secret
|
|
||||||
name: wildcard-whyredfire-dev
|
|
||||||
group: ""
|
|
||||||
websecure-dpdns:
|
|
||||||
port: 8443
|
|
||||||
protocol: HTTPS
|
|
||||||
mode: Terminate
|
|
||||||
hostname: "*.whyredfire.dpdns.org"
|
|
||||||
namespacePolicy:
|
|
||||||
from: All
|
|
||||||
certificateRefs:
|
|
||||||
- kind: Secret
|
|
||||||
name: wildcard-whyredfire-dpdns-org
|
|
||||||
group: ""
|
|
||||||
repoURL: https://traefik.github.io/charts
|
|
||||||
targetRevision: 41.6.0
|
|
||||||
- path: infra/traefik
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
- ServerSideApply=true
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- add-ons
|
|
||||||
- services
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: bentopdf
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: bentopdf
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
path: apps/bentopdf
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,44 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "4"
|
|
||||||
name: garage-ui
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: garage
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
sources:
|
|
||||||
- chart: garage-ui
|
|
||||||
repoURL: https://helm.noste.dev/
|
|
||||||
targetRevision: 0.12.1
|
|
||||||
helm:
|
|
||||||
values: |
|
|
||||||
config:
|
|
||||||
server:
|
|
||||||
domain: garage.whyredfire.dev
|
|
||||||
protocol: https
|
|
||||||
root_url: https://garage.whyredfire.dev
|
|
||||||
garage:
|
|
||||||
admin_endpoint: http://garage-admin:3903
|
|
||||||
existingSecret:
|
|
||||||
name: garage-ui-secrets
|
|
||||||
auth:
|
|
||||||
admin:
|
|
||||||
enabled: false
|
|
||||||
jwt_private_key_secret:
|
|
||||||
name: garage-ui-secrets
|
|
||||||
cors:
|
|
||||||
enabled: false
|
|
||||||
- path: apps/garage-ui
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
- ServerSideApply=true
|
|
||||||
@@ -1,90 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: garage
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: garage
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
sources:
|
|
||||||
- repoURL: https://git.deuxfleurs.fr/Deuxfleurs/garage.git
|
|
||||||
targetRevision: v2.4.1
|
|
||||||
path: script/helm/garage
|
|
||||||
helm:
|
|
||||||
values: |
|
|
||||||
garage:
|
|
||||||
singleNode: true
|
|
||||||
existingRpcSecret: garage-secrets
|
|
||||||
noClusterRole: true
|
|
||||||
# No discovery is needed for a single node.
|
|
||||||
garageTomlString: |
|
|
||||||
metadata_dir = "/mnt/meta"
|
|
||||||
data_dir = "/mnt/data"
|
|
||||||
db_engine = "sqlite"
|
|
||||||
metadata_fsync = true
|
|
||||||
data_fsync = true
|
|
||||||
replication_factor = 1
|
|
||||||
rpc_bind_addr = "127.0.0.1:3901"
|
|
||||||
rpc_public_addr = "127.0.0.1:3901"
|
|
||||||
rpc_secret = "__RPC_SECRET_REPLACE__"
|
|
||||||
|
|
||||||
[s3_api]
|
|
||||||
s3_region = "garage"
|
|
||||||
api_bind_addr = "0.0.0.0:3900"
|
|
||||||
|
|
||||||
[s3_web]
|
|
||||||
bind_addr = "0.0.0.0:3902"
|
|
||||||
# Required; a bucket's full name also works as the Host
|
|
||||||
root_domain = ".web.garage.internal"
|
|
||||||
index = "index.html"
|
|
||||||
|
|
||||||
[admin]
|
|
||||||
api_bind_addr = "0.0.0.0:3903"
|
|
||||||
metrics_require_token = true
|
|
||||||
image:
|
|
||||||
repository: dxflrs/garage
|
|
||||||
initImage:
|
|
||||||
tag: "1.37.0"
|
|
||||||
persistence:
|
|
||||||
meta:
|
|
||||||
storageClass: local-path
|
|
||||||
size: 1Gi
|
|
||||||
data:
|
|
||||||
storageClass: local-path
|
|
||||||
size: 9Gi
|
|
||||||
podSecurityContext:
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /health
|
|
||||||
port: admin
|
|
||||||
timeoutSeconds: 3
|
|
||||||
livenessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: s3-api
|
|
||||||
initialDelaySeconds: 60
|
|
||||||
periodSeconds: 20
|
|
||||||
timeoutSeconds: 3
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 256Mi
|
|
||||||
limits:
|
|
||||||
memory: 1Gi
|
|
||||||
- path: apps/garage
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
- ServerSideApply=true
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: jellyfin
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: jellyfin
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
sources:
|
|
||||||
- chart: jellyfin
|
|
||||||
helm:
|
|
||||||
values: |
|
|
||||||
image:
|
|
||||||
tag: "12.0"
|
|
||||||
service:
|
|
||||||
type: ClusterIP
|
|
||||||
port: 8096
|
|
||||||
ingress:
|
|
||||||
enabled: false
|
|
||||||
persistence:
|
|
||||||
config:
|
|
||||||
enabled: true
|
|
||||||
size: 2Gi
|
|
||||||
media:
|
|
||||||
enabled: true
|
|
||||||
type: hostPath
|
|
||||||
hostPath: /srv/media
|
|
||||||
repoURL: https://jellyfin.github.io/jellyfin-helm
|
|
||||||
targetRevision: 3.2.0
|
|
||||||
- path: apps/jellyfin
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- bentopdf.yaml
|
|
||||||
- betterslcm.yaml
|
|
||||||
- garage.yaml
|
|
||||||
- garage-ui.yaml
|
|
||||||
- jellyfin.yaml
|
|
||||||
- legislative-summarization.yaml
|
|
||||||
- qbit.yaml
|
|
||||||
- redoost.yaml
|
|
||||||
- rustbin.yaml
|
|
||||||
- scriptscribe.yaml
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: legislative-summarization
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: legislative-summarization
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
path: k8s
|
|
||||||
repoURL: https://github.com/whyredfire/legislative-summarization
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: qbit
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: qbit
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
path: apps/qbit
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,63 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: redoost
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: redoost
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
sources:
|
|
||||||
- repoURL: https://github.com/whyredfire/redoost.git
|
|
||||||
targetRevision: main
|
|
||||||
path: chart
|
|
||||||
helm:
|
|
||||||
values: |
|
|
||||||
appOrigin: https://redoost.whyredfire.dev
|
|
||||||
sitesOrigin: https://whyredfire.dpdns.org
|
|
||||||
httpRoute:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
app:
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
sites:
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure-dpdns
|
|
||||||
s3:
|
|
||||||
endpoint: http://garage.garage.svc.cluster.local:3900
|
|
||||||
publicEndpoint: https://s3.whyredfire.dev
|
|
||||||
websiteUpstream: garage.garage.svc.cluster.local:3902
|
|
||||||
bucket: redoost-sites
|
|
||||||
existingSecret: redoost-s3
|
|
||||||
networkPolicy:
|
|
||||||
enabled: true
|
|
||||||
gateway:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: traefik
|
|
||||||
s3:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: garage
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: garage
|
|
||||||
- path: apps/redoost
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: rustbin
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: rustbin
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
path: apps/rustbin
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "3"
|
|
||||||
name: splitpro
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
destination:
|
|
||||||
namespace: splitpro
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
path: apps/splitpro
|
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- CreateNamespace=true
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: argocd-cm
|
|
||||||
data:
|
|
||||||
admin.enabled: "false"
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: argocd-cm
|
|
||||||
data:
|
|
||||||
resource.customizations.health.argoproj.io_Application: |
|
|
||||||
hs = {}
|
|
||||||
hs.status = "Progressing"
|
|
||||||
hs.message = ""
|
|
||||||
if obj.status ~= nil then
|
|
||||||
if obj.status.health ~= nil then
|
|
||||||
hs.status = obj.status.health.status
|
|
||||||
if obj.status.health.message ~= nil then
|
|
||||||
hs.message = obj.status.health.message
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
return hs
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: argocd-cm
|
|
||||||
data:
|
|
||||||
oidc.config: |
|
|
||||||
name: Authentik
|
|
||||||
issuer: https://auth.whyredfire.dev/application/o/argocd/
|
|
||||||
clientID: argocd
|
|
||||||
clientSecret: $argocd-oidc:clientSecret
|
|
||||||
enablePKCEAuthentication: true
|
|
||||||
requestedScopes:
|
|
||||||
- openid
|
|
||||||
- profile
|
|
||||||
- email
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: argocd-cm
|
|
||||||
data:
|
|
||||||
url: https://argo.whyredfire.dev
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: argocd-cmd-params-cm
|
|
||||||
data:
|
|
||||||
server.insecure: "true"
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: argocd-cmd-params-cm
|
|
||||||
data:
|
|
||||||
controller.diff.server.side: "true"
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: argocd-rbac-cm
|
|
||||||
data:
|
|
||||||
policy.csv: |
|
|
||||||
g, admins, role:admin
|
|
||||||
policy.default: ""
|
|
||||||
scopes: "[groups]"
|
|
||||||
@@ -1,5 +1,6 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
kind: Kustomization
|
kind: Kustomization
|
||||||
|
|
||||||
resources:
|
resources:
|
||||||
- namespace.yaml
|
- namespace.yaml
|
||||||
- root-app.yaml
|
- root-app.yaml
|
||||||
|
|||||||
@@ -4,14 +4,16 @@ metadata:
|
|||||||
name: root-app
|
name: root-app
|
||||||
namespace: argocd
|
namespace: argocd
|
||||||
spec:
|
spec:
|
||||||
destination:
|
|
||||||
namespace: argocd
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
project: default
|
project: default
|
||||||
source:
|
source:
|
||||||
path: argocd-apps
|
repoURL: https://gitea.whyredfire.tech/whyredfire/gitops.git
|
||||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
||||||
targetRevision: main
|
targetRevision: main
|
||||||
|
path: applications
|
||||||
|
directory:
|
||||||
|
recurse: true
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: argocd
|
||||||
syncPolicy:
|
syncPolicy:
|
||||||
automated:
|
automated:
|
||||||
prune: true
|
prune: true
|
||||||
|
|||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: argocd-server
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: argocd-server
|
||||||
|
spec:
|
||||||
|
type: NodePort
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: 443
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: 8080
|
||||||
|
nodePort: 30443
|
||||||
@@ -1,39 +1,14 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
kind: Kustomization
|
kind: Kustomization
|
||||||
|
|
||||||
namespace: argocd
|
namespace: argocd
|
||||||
|
|
||||||
resources:
|
resources:
|
||||||
- https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/install.yaml
|
- https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/install.yaml
|
||||||
- argocd-root-app
|
- argocd-root-app
|
||||||
|
|
||||||
patches:
|
patches:
|
||||||
- target:
|
- target:
|
||||||
kind: Service
|
kind: Service
|
||||||
name: argocd-server
|
name: argocd-server
|
||||||
path: argocd-server-clusterip-patch.yaml
|
path: argocd-server-nodeport-patch.yaml
|
||||||
- target:
|
|
||||||
kind: ConfigMap
|
|
||||||
name: argocd-cm
|
|
||||||
path: argocd-cm-application-health-patch.yaml
|
|
||||||
- target:
|
|
||||||
kind: ConfigMap
|
|
||||||
name: argocd-cm
|
|
||||||
path: argocd-cm-url-patch.yaml
|
|
||||||
- target:
|
|
||||||
kind: ConfigMap
|
|
||||||
name: argocd-cm
|
|
||||||
path: argocd-cm-oidc-patch.yaml
|
|
||||||
- target:
|
|
||||||
kind: ConfigMap
|
|
||||||
name: argocd-cm
|
|
||||||
path: argocd-cm-admin-disabled-patch.yaml
|
|
||||||
- target:
|
|
||||||
kind: ConfigMap
|
|
||||||
name: argocd-rbac-cm
|
|
||||||
path: argocd-rbac-cm-patch.yaml
|
|
||||||
- target:
|
|
||||||
kind: ConfigMap
|
|
||||||
name: argocd-cmd-params-cm
|
|
||||||
path: argocd-cmd-params-cm-server-side-diff-patch.yaml
|
|
||||||
- target:
|
|
||||||
kind: ConfigMap
|
|
||||||
name: argocd-cmd-params-cm
|
|
||||||
path: argocd-cmd-params-cm-server-insecure-patch.yaml
|
|
||||||
|
|||||||
@@ -1,23 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
name: argocd-dashboard
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
hostnames:
|
|
||||||
- argo.whyredfire.dev
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: argocd-server
|
|
||||||
port: 80
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- httproute.yaml
|
|
||||||
- oidc-sealedsecret.yaml
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: bitnami.com/v1alpha1
|
|
||||||
kind: SealedSecret
|
|
||||||
metadata:
|
|
||||||
name: argocd-oidc
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
encryptedData:
|
|
||||||
clientSecret: AgAuadGZNylY8/lomfIg8PybwBtfZ20BXDfNacgIMMdRanRgRnLhMghaZfcQbcGuKRaAIya/aIqbUKkQwat2elypOp374wvDHilnaQ0DQ4qCBGZlPLMSzyEoz+sSuB3c0YHLcj48DIF9b5b24jsysS9mllTQCeEBNsuXiEjEuSBUpu6EbR5ztRPnEi8OnuJYTMJtnMVX0iPEqEK4DsR/c7ActayVBG+sGDK/ZyACxyLg8cuhJ2p7SyxqCwqtaS4NaKC6d4WK+3LEQcAd65PWeSKbR7zv77EcUQ8yzaM3yDXIZMmgLMzynfPgyll9aLr31n2UOaNU2uZPT6JtlnPARU1WuzQHcRCdJBjuKneDahE2D3m7sClxUCNXTgXfZqsWl6/gSvZrREukQyJgIz6mmmN3rUjYRn0lG+0CU6o1uDFGHyn9GEmzTPT4zt/U0YD7LjwdR+tWHBUmzQCPbe2DcPQLb+OwyY0M9RC52btfJVyErjMXN7TP8ut1Gmf6p0phr9ebVH9hNAPWcfbWkNG4r8c4gzHDca9ULPrwjz1oJsNeHf6ZXu3Zu26xnFsLswSQqWSSpBrHA9F5bl3U3/ScNErD+wrP6lH6dqcGGJVpMMUhDDNBKkSsu8zL8M97x5MYZPwAI+EfNF5ijdzqZbgEU0iTjJv5fHX1i+rGhbzkfqvuI3ti/8CkcSB/dEAYQXwfmSrtPJISX1zEWhqzgIfIDuPk2BmD+rKmWL906+aff7M/Ns32wZlvN3eCPVjO9w80mkn6OJY11re0Si0eg4ksUZDH
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/part-of: argocd
|
|
||||||
name: argocd-oidc
|
|
||||||
namespace: argocd
|
|
||||||
@@ -1,69 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: authentik-blueprints
|
|
||||||
namespace: authentik
|
|
||||||
data:
|
|
||||||
google-login.yaml: |
|
|
||||||
version: 1
|
|
||||||
metadata:
|
|
||||||
name: Google login
|
|
||||||
entries:
|
|
||||||
- model: authentik_blueprints.metaapplyblueprint
|
|
||||||
attrs:
|
|
||||||
identifiers:
|
|
||||||
path: default/flow-default-source-authentication.yaml
|
|
||||||
required: true
|
|
||||||
- model: authentik_core.group
|
|
||||||
id: admins
|
|
||||||
identifiers:
|
|
||||||
name: admins
|
|
||||||
attrs:
|
|
||||||
is_superuser: true
|
|
||||||
- model: authentik_core.user
|
|
||||||
identifiers:
|
|
||||||
username: whyredfire
|
|
||||||
attrs:
|
|
||||||
email: [email protected]
|
|
||||||
groups:
|
|
||||||
- !KeyOf admins
|
|
||||||
name: Karan Parashar
|
|
||||||
- model: authentik_sources_oauth.oauthsource
|
|
||||||
id: google
|
|
||||||
identifiers:
|
|
||||||
slug: google
|
|
||||||
attrs:
|
|
||||||
authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
|
|
||||||
consumer_key: !Env GOOGLE_CLIENT_ID
|
|
||||||
consumer_secret: !Env GOOGLE_CLIENT_SECRET
|
|
||||||
name: Google
|
|
||||||
promoted: true
|
|
||||||
provider_type: google
|
|
||||||
user_matching_mode: email_link
|
|
||||||
- model: authentik_stages_identification.identificationstage
|
|
||||||
id: google-identification
|
|
||||||
identifiers:
|
|
||||||
name: google-identification
|
|
||||||
attrs:
|
|
||||||
sources:
|
|
||||||
- !KeyOf google
|
|
||||||
user_fields: []
|
|
||||||
- model: authentik_flows.flow
|
|
||||||
id: google-flow
|
|
||||||
identifiers:
|
|
||||||
slug: google-login
|
|
||||||
attrs:
|
|
||||||
authentication: require_unauthenticated
|
|
||||||
designation: authentication
|
|
||||||
name: Google login
|
|
||||||
title: Welcome!
|
|
||||||
- model: authentik_flows.flowstagebinding
|
|
||||||
identifiers:
|
|
||||||
order: 10
|
|
||||||
stage: !KeyOf google-identification
|
|
||||||
target: !KeyOf google-flow
|
|
||||||
- model: authentik_brands.brand
|
|
||||||
identifiers:
|
|
||||||
domain: authentik-default
|
|
||||||
attrs:
|
|
||||||
flow_authentication: !KeyOf google-flow
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "2"
|
|
||||||
name: authentik
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
hostnames:
|
|
||||||
- auth.whyredfire.dev
|
|
||||||
parentRefs:
|
|
||||||
- kind: Gateway
|
|
||||||
name: traefik-gateway
|
|
||||||
namespace: traefik
|
|
||||||
sectionName: websecure
|
|
||||||
rules:
|
|
||||||
# The ArgoCD Android app posts to the token endpoint without its trailing slash
|
|
||||||
- backendRefs:
|
|
||||||
- name: authentik-server
|
|
||||||
port: 80
|
|
||||||
filters:
|
|
||||||
- type: URLRewrite
|
|
||||||
urlRewrite:
|
|
||||||
path:
|
|
||||||
replaceFullPath: /application/o/token/
|
|
||||||
type: ReplaceFullPath
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: Exact
|
|
||||||
value: /application/o/token
|
|
||||||
- backendRefs:
|
|
||||||
- name: authentik-server
|
|
||||||
port: 80
|
|
||||||
matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- sealed-secret.yaml
|
|
||||||
- blueprints.yaml
|
|
||||||
- httproute.yaml
|
|
||||||
- referencegrant.yaml
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: ReferenceGrant
|
|
||||||
metadata:
|
|
||||||
name: outpost
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
from:
|
|
||||||
- group: gateway.networking.k8s.io
|
|
||||||
kind: HTTPRoute
|
|
||||||
namespace: garage
|
|
||||||
- group: gateway.networking.k8s.io
|
|
||||||
kind: HTTPRoute
|
|
||||||
namespace: qbit
|
|
||||||
to:
|
|
||||||
- group: ""
|
|
||||||
kind: Service
|
|
||||||
name: authentik-server
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: bitnami.com/v1alpha1
|
|
||||||
kind: SealedSecret
|
|
||||||
metadata:
|
|
||||||
name: authentik-secrets
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
encryptedData:
|
|
||||||
AUTHENTIK_BOOTSTRAP_PASSWORD: AgAPgYcs6IXUWk3VUgoPNQXwP43kEKP26OAJmu7dA4vTRhmWwmJXN8ybRhX7jS2YPwGWxAWflxiM3x7F3jUohOpqN37et4zFCoUq43mQ3blbTMV4zhsuyMx0JIqhsafzlVWiKqmqIykVq8yJQ6886FkIS0u14i//YTcs0QMS7gum6pDEhehAg+FhwiNgm92iVCyhoh+3rL549akXe53UJNKwVzuWavEHZFTKJNmFa2g9YzYcJgNf46f7maPbfSg09E27XC9L7KNxxiodU2h0D50La8LMEX+X0fAbLtrXPf9MsJjcfNvy0kXqy/AB+A5zL/Yh4uVztWikE27evDvfeoWc9svCTIbBzwx1EtR/nC71IvN61ADpFGbTXA44jSOtPg6nNtOAq8AEqIp0p3uNbQK17cEfbmDtq8husTYF1i6e+VFVGIltPiGdRSZb92xtLGkf63YfdYXSy+xaiIJ/8ki4vgw91KY0l5/9sS1BqWR312UUEAtOGt7M4cydVEWToc1AdYj3RDBgPjmqoddiR66EMzhCFz5sxlU/rji7j4DAOFA4gqAV5JAZO1HehNFp2GajTi36d0XLe06/Z+IbEmSeTlPTGZOvxTweYcWexplzp/ob/MwAaMouPRcmae4/VTlu9Lex1bMYugc6bD8B7V+gmM/MhY7heQl+mSyBV0CO6JsZwC1tipzcJfaiBzUF8sZ7Ast3v+7omsjFo/CXqxbPNZrolipiEjE9IT3n3r2m7gpIkv+A/ie77iJF8k6zFRM=
|
|
||||||
AUTHENTIK_POSTGRESQL__PASSWORD: AgAoQ04gX1QOUI5kfNMNy07pnaqDTp4X6LDlQBBwSs13SVGZCJAL61hQymOaL/U2cCyc0N5nr7FCswHcqBE8t1esKlK/NB+BL9aWfO7uPonhdzsc2iKBONZYickCyyD+8Hgu/McQDPVo6vMQ51/82WL2ZKfwJEfTKmo1OfJ/I2Tls2KmczzlkNrCC9M5moObXl+PJlKJuxAkeXJc61MSn/vvsvksG5O0AKtXHmTk8E1t7krAbOqKy9CbVwHJAwH/NIhiOgJr/KziceWhHHQiEwC631ZpM+fZWiUSKETwpnLWSl7s8SvsEUNA9s/W2w24tpqSKrHOZtS6J0sT84FsV9U9T5MaZtZT9NG3FmNehxQpIlet6BSyJh+JMq5LjzA8ANvVvlXs4jhJyTcotLf/m1ZJbetVjFGJjvxUbVuxObpMentVrAeLO8cZqk1iTzqPdkrEeV38DN2E9oJSyQeRP6sZTnDd9xweou8nwMZWidyIDorTKSwvggje2YDXefc8+aOVVCN7pBOwKisEuPH35Ov/A2RDzmE3mQRC3EDuHJ+3dZbVawIawV0ZUIL52X+ongbllOtHABUfODY7tTC/VQMk07d3/zG5q7bCE2D+R0XE4oQJy2h2wYHiYUoGYM5JKC2me4TIx6Y+haksl2mqfC/yal3FLWMBdK4eC9VyXugO25l4yLVOcKa/QMhImHB6lbyNLGDuafnIanMkraWo73EqqXpF3IIqfzfgkj4aOO3Cbuu6BeQ4bNmmam+cWLqq1QQ=
|
|
||||||
AUTHENTIK_SECRET_KEY: AgAHHDs8mbJRc45DFgap2VUZn/F+m59hm9u2lebuJv70HSBxLLsHEn8nXLGUO3b2ScyPt1Qi2wbmRDENTjOHOYHtAQAjwV25r6RUiZ5TosRH2KhGx5N6gceorYQyk18l2CkKv4ObXjeGLJA0EqMarmFWiT24SFZdtIrOvWygLxg4XGful2h1Fw5uXK9PiUHgptrp/G5M5Htv0bvtD6m/FrgOlK6C6tK1D4vLL3VLX3/SceqNWVDIJmJao5JKO4IZTQxN8TN5k9K2CGrtOUhjCn4vLbYQKTPhiiidoQaipQ9FR+4KJMO0y8FbIy+3q7C/UZPyOTOu/2zI4t5h4TJY1+477A80GTLpE0aCBDpmFwgZY728wbTW4NyfIm15u0Um7OXhnJkXC1EqDbvlK4HYHiSDUjGChvlfMEY+D1datDlF1fEuIaeXtTqowpz3uy9qIEa0f1emS2J8TjIrKH3oW3mfmrJKSiySnCX1704ZPlwOJfnF5Z2vM6Oqo/mWHa6PSwPPRxSxEKVtSqD4KynzrUmx3GkrUs+7tntepA3yQoiDjyUyE71FwhJXO4sE3XcRGDUf4rB8CFO4+NgTbBAqFzNKYG32GIDhGjbMxBAJQMNXZhVcKceiaXf7G8LuaOEw39BkdtiFCdK3uXl9xaQPuStRsOYYQR2Dt0vt3AvDGjAW+McauCbYUD3rcAtVMo+rxEbejrotojWnb1OpGX0JqD5gHC68qlqY6BYkDbWpYojoKWJHuHlYxHIm8k7ghSq6npw94R526bxripNtcNq4Lh1NeM55LKruOEGr7n0dFcyAmQ==
|
|
||||||
GOOGLE_CLIENT_ID: AgCV2Rwe/bHbkQ3nkkIs4EFTbsEqQWRaWlXa/fHzkDyNKpd0CTOgqVb6Rd2KYyvoT9iDR0xt/8reLPd9e7B3G3V1oVFV7G1XiErBmzvxr6591+tXzo8JLVpIy0363R87idi2xIKGVii+G5aJvxxhua8IRsNfi4SRtoqpDzjgNbFtm5UDhhlCzcRKkm0zHgLw83d4Uwszu9X9II2A4FuMPD6KvsTFrgHevR1v3OerKl5kvTlUx0O3XEg5mnNUVk46J+D9wfg58bIlgUhMV8NtfKa8I5zmRKhCJySks1zlCgIudCLX7wPYupFgt0nrZjJGx7a546ntPdMVE4IJ+VhlQ94gjdWsVFm07espaQLph9T4CZDKxb6TwyNswhfFxH1Z9auyFf3Cfk2wx5GChNOL0mZ8Zrzcw008c8IUShF8je8JZ60teBffbBNao7XN6JM6a4ac5aKnNwFch9IJUU1qkvcJaZk5hAkeGO9uHrICb6lkr5Rj7t4h9l4mvgfIKXP5YCCKZ+yqrSI8Jpkch/cB0Sphgp7m7QXgGwmWRgdKEk1rP7ioIfoF66mLsfgvOkc+1ySvPgW/rCLbHwzMqJn1Fkk/afbRoWp/guFj1cOY9MrEQIn8ftugeV/0xWiL+y5RyJm7QZc1z5fSj/NTrVCZV0LhBHttPZzoGGWEqjLYQnyJ8p38lK7EU6Pmk4WrEMj7mmdYHEijyPhab+b7guOc+ULbPT7k7sBHXbKrTTUJa09jIqSS4jl2PNrzPCPDIvRpG/cMgNklhNPfvpDQcLdVRA7bsf7navZvDsQ=
|
|
||||||
GOOGLE_CLIENT_SECRET: AgDNFpqV5LGekTMvOBtPE9c6ZVPtT6wN+nCFRhZnvBKIz4I7U9jzisEN7yhc4ud22XJXpS5oR8hN4H+V6Js/bCZMDJefYcdstmHku14kUvoLRUtwPV9tdjiihmb57VLTnT1s1OzbnOqZPwXoCAmGAPLDgZrghBi0id21GgjU41jCHDJCcH1j9RHhE20JwsVG2uz9Tcp6MVYh94aq53V4//bvFXz4xQgVlN8c1jJ/W4rrNM9vmYdMwKyB5509oVWJigowsRlji0FXurR8ovz1AXpMuGj6hUGxLp0uHsqz7FV/0lsd4B2BR9cVRChAR8zDCiiKb4TH2Kmn676/Z+gtJ8vcOQg/WDT1ENzOr6dyndCLVxJvJuvl1EqinzhSqJjUy11HxqULApKKbX1iRJIAIGb6dpeKVoHDKg5xtcWGwaD6epG/tz20agkWBMCFNq5aS80npz28W5GeOQ8aF4X/rpjuEHVLrN+n0pgyS4wjwniB6UJMYRIYk45r0ICUtqyFjOiNzpU70NsPmEjDyItW1EVo+6tb0lRmOI5apm/9yayZXjFISwTAFPdBMrQL+ij4AGw4HMWMmN0aqDO+Kd1c9Jg6wUKluN2Lb6CaxehWeSJiz2wTEhEz8KBkInfezgSekNkw4wjJiBEZ4/M3G6Y/C61ekuVFarRc87cY+S3SomVZDGQcPysfQlieMVpHlfXq/CSDgHhZV3Q+S/wqpy5ZcfsyaU+v4PmvyEc12MZxQ1RGngVJow==
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
name: authentik-secrets
|
|
||||||
namespace: authentik
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
apiVersion: bitnami.com/v1alpha1
|
|
||||||
kind: SealedSecret
|
|
||||||
metadata:
|
|
||||||
name: cloudflare-api-token
|
|
||||||
namespace: cert-manager
|
|
||||||
spec:
|
|
||||||
encryptedData:
|
|
||||||
api-token: AgCqVfWKc3TVZOWN2kWfWcEe+5pf5lRMOzcQUjgI7Wd4/0cDogagn0fF3MR1+tcm4kaxXyn0GzZLoOT4mWetg/BoGYY6X4DYy6fsyFzpvpY8mtdwiTrYtzdORSz1qw2U3yerB1st//Cy90D+sw8V13MGDh0vD0OEtYG4Xf1foRTR5KClzHmy16gjp64d4dbFWLO1oa99drQkCGRPhHcDzcrT0bFOutjN52p8AVcjBlzDMpP2k/Wo9wT4MiDv+clrXwOVyvARk5DrN9KY+iRiB0NkBvHaVNkQ9M62sIUJ9asBwIWZCY/aV4xGEvx9LYxAWvzIqmXBy+DOlOo3gOavQCOBI7Gdz015V1oIsViLQXG3j+5m0PSbguCNCXQhF9zmgqoJgiEpC2aFcU9oCZ/JS/DTiD8Xq60JSyY8bQE/yMX3vHAnXm5HOe14WJ60GkjGXPsBWWjmtAeBltAUW1WJfkTnHm/aPBflpZBkuJgkCpL2iMERETi0e4UfOuvf06cN3testuFfR9sIn6aD9mMY4B9e+6TLbjFF5uSf/W9/aMhLLTG8Mh5pZneGDndfRm6IG3Lj506xLOo3CAOA9BYF7MiShrgtuLmDH/pd8YCRTxsboYigQ2LrobpaQnkKYjHqLWNJi/I1rXefmEXK1mR8zZKJzBIsz4NG9TTary9v34yL22n9L+RtWJhrsFDXQqz7C860J7ifa28VJObo1QZN9bzsWoTPzUjK/Yw1GvrVUVUAsNyzbCgUjFUbrydoPmpx4ntmj6fSxQ==
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
name: cloudflare-api-token
|
|
||||||
namespace: cert-manager
|
|
||||||
type: Opaque
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
argocd.argoproj.io/sync-wave: "1"
|
|
||||||
name: letsencrypt-prod
|
|
||||||
spec:
|
|
||||||
acme:
|
|
||||||
email: [email protected]
|
|
||||||
privateKeySecretRef:
|
|
||||||
name: letsencrypt-prod
|
|
||||||
server: https://acme-v02.api.letsencrypt.org/directory
|
|
||||||
solvers:
|
|
||||||
- dns01:
|
|
||||||
cloudflare:
|
|
||||||
apiTokenSecretRef:
|
|
||||||
key: api-token
|
|
||||||
name: cloudflare-api-token
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- cloudflare-api-token-sealed-secret.yaml
|
|
||||||
- cluster-issuer.yaml
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
apiVersion: postgresql.cnpg.io/v1
|
|
||||||
kind: Database
|
|
||||||
metadata:
|
|
||||||
name: authentik
|
|
||||||
namespace: postgres
|
|
||||||
spec:
|
|
||||||
cluster:
|
|
||||||
name: postgres
|
|
||||||
databaseReclaimPolicy: retain
|
|
||||||
name: authentik
|
|
||||||
owner: authentik
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: bitnami.com/v1alpha1
|
|
||||||
kind: SealedSecret
|
|
||||||
metadata:
|
|
||||||
name: authentik-db
|
|
||||||
namespace: postgres
|
|
||||||
spec:
|
|
||||||
encryptedData:
|
|
||||||
password: AgALpscM7BiDoZuUSlAI39CZYz3DvSaHQwzOpZEKp4tqfEYQ1r2DALOAbi4l3+6LzsMo63RNv3SYlhxFcbjjrDMiiaaB47iKDEmbSW/LQTJibiaoy67rgTs8T3I4awQbHeylwJQr5nS0BN6MeYh87PCmqFc3Orc5kCokSL9j7gVwOqNkq27RMJkghulUxAEONQrixFOiCHTFWCD/IybR1olUUacz7nKxCTLmcqDfzimGlF92VBbFaUzZH5W+0yd59zNqjhnmslIRiqli/ZVB2Z5ECuqr4YmrSmaCQvR5mzRmNjpmAeqCF/byFjfanPM6ZZ4NM2x7flqu8sULzZfBdXWmhIy03jPFFDBIvznHHW6y0K2r8kqewkoUsKgJEgZcsEvwe/F/gode3ukI02LuD2dKMNjeDaf8A4xaRx6h9U9cDiggmpHPW2HjO3kLp6ViEGPlGm3JuisnqncsBgfIh1T8ZMpmuM0WgAe6E3hFHnR6vbWYfSIi6nrEcpfLL+F2bBGYdUFBfjflaxXzhPnGDJ29GEBuyJcHPVRTqBhybS9rl+77dhCbPEsC5GN9MdCdS3uVWyKN+xIV1f/cJNsUFhDyU2rbkbFAebJurjPbKi92HPDaEq6OK3kunN9nNEZ9rE7d6ouw/gQ5Uq3CmaNDiVDorFfaW5DHVbRnm3MLdbLoUuN1AlU96/cDuSqDZjfLB69iB/+nt8TQLHopwQxj9AajfMyF+y9c2XvYZWvZGaCE1fTEfpIJ2fV1McnwbFi0uHk=
|
|
||||||
username: AgA9pxBlPvKPAX/NaHHFSN1ypRxKmd8CNcs92+l3JpDar81IYWaQPG0p99wYxrBp0414GIhojpkWks7+lVDSgmVzw9T+JQzow54lRxe7dHFOzfAQx1oQyGp8AkiGtjAIdUx9kgYhM01xQUDYtFDe3XnhVUkvjQNARctWyX+o/vyYTnK5BMHZB6viQOWrifNUmPQQRFnB9oEPGVqysYlJ2+o1sMyJYXOiTEMVkuk0rFp8AE2WGeyfR0pFwhSyn2g7bbFvUoQbECiG4y83AKmpmX4p25bAlzsIxb1kgUpYlqZXGMqLuQaVBJsBs3u7sDUjQZFRfz3rH2OLfNGZcCGT3c9Ueg05eRpAyWHP1kHWmkK2Yl4kPcyx54bBk2yv2h4lW7DmlsG6jE6bzKPtMTJOiJdkqkNSkerd062ktWYrpAg6iuGWB1A7Et+J07JaWd6xfANRknvH/D+CEQHuRM5qEtM8HVLuTlKSxX464d0nNKUw0rrSokWJWT5olroc+VjaHyXdF6LEYmgNXxtUwa95q6k8J78ZLidx7SawbFC5d5ErFbkq+6xOPWeKzcDExtcMd9UF1Ti90Ybp5ncyxoQLXCWhSV9SxjeS+f6H8Cs7JM39kxeOfLvvxw9qz2rSW6qbimh5KaXmO8KK3BFtrui+k5tlnv6qJaRbtMUV+p7WyK36wBk1fUMR0lfK8FRuWfnUuslP2wk17vlkvto=
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
cnpg.io/reload: "true"
|
|
||||||
name: authentik-db
|
|
||||||
namespace: postgres
|
|
||||||
type: kubernetes.io/basic-auth
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
apiVersion: postgresql.cnpg.io/v1
|
|
||||||
kind: Cluster
|
|
||||||
metadata:
|
|
||||||
name: postgres
|
|
||||||
namespace: postgres
|
|
||||||
spec:
|
|
||||||
enablePDB: false
|
|
||||||
imageName: ghcr.io/cloudnative-pg/postgresql:18
|
|
||||||
instances: 1
|
|
||||||
managed:
|
|
||||||
roles:
|
|
||||||
- ensure: present
|
|
||||||
login: true
|
|
||||||
name: authentik
|
|
||||||
passwordSecret:
|
|
||||||
name: authentik-db
|
|
||||||
postgresql:
|
|
||||||
# Each app role may only connect to the database of the same name.
|
|
||||||
pg_hba:
|
|
||||||
- host sameuser all all scram-sha-256
|
|
||||||
- host all all all reject
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
memory: 1Gi
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 256Mi
|
|
||||||
storage:
|
|
||||||
size: 5Gi
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- cluster.yaml
|
|
||||||
- authentik-db-sealedsecret.yaml
|
|
||||||
- authentik-database.yaml
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- wildcard-whyredfire-dev.yaml
|
|
||||||
- wildcard-whyredfire-dpdns-org.yaml
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: wildcard-whyredfire-dev
|
|
||||||
namespace: traefik
|
|
||||||
spec:
|
|
||||||
dnsNames:
|
|
||||||
- '*.whyredfire.dev'
|
|
||||||
issuerRef:
|
|
||||||
kind: ClusterIssuer
|
|
||||||
name: letsencrypt-prod
|
|
||||||
privateKey:
|
|
||||||
rotationPolicy: Always
|
|
||||||
secretName: wildcard-whyredfire-dev
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: wildcard-whyredfire-dpdns-org
|
|
||||||
namespace: traefik
|
|
||||||
spec:
|
|
||||||
dnsNames:
|
|
||||||
- '*.whyredfire.dpdns.org'
|
|
||||||
issuerRef:
|
|
||||||
kind: ClusterIssuer
|
|
||||||
name: letsencrypt-prod
|
|
||||||
privateKey:
|
|
||||||
rotationPolicy: Always
|
|
||||||
secretName: wildcard-whyredfire-dpdns-org
|
|
||||||
Reference in New Issue
Block a user