init
This commit is contained in:
2
.github/renovate-update-notification/Dockerfile
vendored
Normal file
2
.github/renovate-update-notification/Dockerfile
vendored
Normal file
@@ -0,0 +1,2 @@
|
|||||||
|
# This file is processed by Renovate bot so that it creates a PR on new major Renovate versions
|
||||||
|
FROM renovate/renovate:37
|
||||||
175
.github/renovate.json
vendored
Normal file
175
.github/renovate.json
vendored
Normal file
@@ -0,0 +1,175 @@
|
|||||||
|
{
|
||||||
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||||
|
"extends": [
|
||||||
|
"config:recommended",
|
||||||
|
"mergeConfidence:all-badges",
|
||||||
|
":rebaseStalePrs"
|
||||||
|
],
|
||||||
|
"timezone": "US/Central",
|
||||||
|
"schedule": [
|
||||||
|
"every weekday"
|
||||||
|
],
|
||||||
|
"labels": [],
|
||||||
|
"packageRules": [
|
||||||
|
{
|
||||||
|
"description": "Disables for non major Renovate version",
|
||||||
|
"matchPaths": [
|
||||||
|
".github/renovate-update-notification/Dockerfile"
|
||||||
|
],
|
||||||
|
"matchUpdateTypes": [
|
||||||
|
"minor",
|
||||||
|
"patch",
|
||||||
|
"pin",
|
||||||
|
"digest",
|
||||||
|
"rollback"
|
||||||
|
],
|
||||||
|
"enabled": false
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"description": "Generate for major Renovate version",
|
||||||
|
"matchPaths": [
|
||||||
|
".github/renovate-update-notification/Dockerfile"
|
||||||
|
],
|
||||||
|
"matchUpdateTypes": [
|
||||||
|
"major"
|
||||||
|
],
|
||||||
|
"addLabels": [
|
||||||
|
"upgrade"
|
||||||
|
],
|
||||||
|
"automerge": false
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"description": "Label service images",
|
||||||
|
"matchDepNames": [
|
||||||
|
"dpage/pgadmin4",
|
||||||
|
"ghcr.io/cloudnative-pg/postgresql",
|
||||||
|
"hashicorp/vault",
|
||||||
|
"portainer/portainer-ce",
|
||||||
|
"redis/redis-stack-server",
|
||||||
|
"unpoller/unpoller"
|
||||||
|
],
|
||||||
|
"matchDatasources": [
|
||||||
|
"docker"
|
||||||
|
],
|
||||||
|
"addLabels": [
|
||||||
|
"service",
|
||||||
|
"image"
|
||||||
|
],
|
||||||
|
"automerge": false,
|
||||||
|
"minimumReleaseAge": "3 days"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"description": "Label service charts",
|
||||||
|
"matchDepNames": [
|
||||||
|
"argo-cd",
|
||||||
|
"authentik",
|
||||||
|
"cert-manager",
|
||||||
|
"cilium",
|
||||||
|
"cloudnative-pg",
|
||||||
|
"democratic-csi",
|
||||||
|
"external-secrets",
|
||||||
|
"gitea",
|
||||||
|
"grafana",
|
||||||
|
"intel-device-plugins-gpu",
|
||||||
|
"intel-device-plugins-operator",
|
||||||
|
"kube-prometheus-stack",
|
||||||
|
"kubelet-serving-cert-approver",
|
||||||
|
"kubernetes-cloudflare-ddns",
|
||||||
|
"loki",
|
||||||
|
"metallb",
|
||||||
|
"metrics-server",
|
||||||
|
"nfs-subdir-external-provisioner",
|
||||||
|
"node-feature-discovery",
|
||||||
|
"pgadmin4",
|
||||||
|
"portainer",
|
||||||
|
"postgres-cluster",
|
||||||
|
"prometheus-operator-crds",
|
||||||
|
"promtail",
|
||||||
|
"redis",
|
||||||
|
"rook-ceph-cluster",
|
||||||
|
"rook-ceph",
|
||||||
|
"speedtest-exporter",
|
||||||
|
"traefik",
|
||||||
|
"unpoller",
|
||||||
|
"vault"
|
||||||
|
],
|
||||||
|
"matchDatasources": [
|
||||||
|
"helm"
|
||||||
|
],
|
||||||
|
"addLabels": [
|
||||||
|
"service",
|
||||||
|
"chart"
|
||||||
|
],
|
||||||
|
"automerge": false,
|
||||||
|
"minimumReleaseAge": "3 days"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"description": "Label application images",
|
||||||
|
"matchDepNames": [
|
||||||
|
"deluan/navidrome",
|
||||||
|
"ghcr.io/advplyr/audiobookshelf",
|
||||||
|
"ghcr.io/linuxserver/calibre-web",
|
||||||
|
"jellyfin/jellyfin",
|
||||||
|
"linuxserver/code-server",
|
||||||
|
"vikunja/api",
|
||||||
|
"vikunja/frontend"
|
||||||
|
],
|
||||||
|
"matchDatasources": [
|
||||||
|
"docker"
|
||||||
|
],
|
||||||
|
"addLabels": [
|
||||||
|
"application",
|
||||||
|
"image"
|
||||||
|
],
|
||||||
|
"automerge": false,
|
||||||
|
"minimumReleaseAge": "3 days"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"description": "Label application charts",
|
||||||
|
"matchDepNames": [
|
||||||
|
"audiobookshelf",
|
||||||
|
"calibre-server",
|
||||||
|
"calibre-web",
|
||||||
|
"code-server",
|
||||||
|
"cops",
|
||||||
|
"freshrss",
|
||||||
|
"home-assistant",
|
||||||
|
"homepage",
|
||||||
|
"jellyfin",
|
||||||
|
"libation",
|
||||||
|
"navidrome",
|
||||||
|
"outline",
|
||||||
|
"plex",
|
||||||
|
"tubearchivist",
|
||||||
|
"tubearchivist-to-jellyfin",
|
||||||
|
"vikunja"
|
||||||
|
],
|
||||||
|
"matchDatasources": [
|
||||||
|
"helm"
|
||||||
|
],
|
||||||
|
"addLabels": [
|
||||||
|
"application",
|
||||||
|
"chart"
|
||||||
|
],
|
||||||
|
"automerge": false,
|
||||||
|
"minimumReleaseAge": "3 days"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"description": "Automerge the plex image",
|
||||||
|
"matchDepNames": [
|
||||||
|
"ghcr.io/onedr0p/plex"
|
||||||
|
],
|
||||||
|
"matchDatasources": [
|
||||||
|
"docker"
|
||||||
|
],
|
||||||
|
"addLabels": [
|
||||||
|
"application",
|
||||||
|
"image"
|
||||||
|
],
|
||||||
|
"versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)-(?<revision>.+)?$",
|
||||||
|
"automerge": true,
|
||||||
|
"automergeType": "branch",
|
||||||
|
"minimumReleaseAge": "3 days"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
37
.github/workflows/lint-test.yaml
vendored
Normal file
37
.github/workflows/lint-test.yaml
vendored
Normal file
@@ -0,0 +1,37 @@
|
|||||||
|
name: lint-and-test-charts
|
||||||
|
|
||||||
|
on: pull_request
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
lint-test:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
|
- name: Set up Helm
|
||||||
|
uses: azure/setup-helm@v4
|
||||||
|
with:
|
||||||
|
version: v3.13.3
|
||||||
|
|
||||||
|
- uses: actions/setup-python@v5
|
||||||
|
with:
|
||||||
|
python-version: "3.10"
|
||||||
|
check-latest: true
|
||||||
|
|
||||||
|
- name: Set up chart-testing
|
||||||
|
uses: helm/chart-testing-action@v2.6.1
|
||||||
|
|
||||||
|
- name: Run chart-testing (list-changed)
|
||||||
|
id: list-changed
|
||||||
|
run: |
|
||||||
|
changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
|
||||||
|
if [[ -n "$changed" ]]; then
|
||||||
|
echo "changed=true" >> "$GITHUB_OUTPUT"
|
||||||
|
fi
|
||||||
|
|
||||||
|
- name: Run chart-testing (lint)
|
||||||
|
if: steps.list-changed.outputs.changed == 'true'
|
||||||
|
run: ct lint --target-branch ${{ github.event.repository.default_branch }}
|
||||||
201
LICENSE
Normal file
201
LICENSE
Normal file
@@ -0,0 +1,201 @@
|
|||||||
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
|
|
||||||
|
1. Definitions.
|
||||||
|
|
||||||
|
"License" shall mean the terms and conditions for use, reproduction,
|
||||||
|
and distribution as defined by Sections 1 through 9 of this document.
|
||||||
|
|
||||||
|
"Licensor" shall mean the copyright owner or entity authorized by
|
||||||
|
the copyright owner that is granting the License.
|
||||||
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all
|
||||||
|
other entities that control, are controlled by, or are under common
|
||||||
|
control with that entity. For the purposes of this definition,
|
||||||
|
"control" means (i) the power, direct or indirect, to cause the
|
||||||
|
direction or management of such entity, whether by contract or
|
||||||
|
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||||
|
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
|
|
||||||
|
"You" (or "Your") shall mean an individual or Legal Entity
|
||||||
|
exercising permissions granted by this License.
|
||||||
|
|
||||||
|
"Source" form shall mean the preferred form for making modifications,
|
||||||
|
including but not limited to software source code, documentation
|
||||||
|
source, and configuration files.
|
||||||
|
|
||||||
|
"Object" form shall mean any form resulting from mechanical
|
||||||
|
transformation or translation of a Source form, including but
|
||||||
|
not limited to compiled object code, generated documentation,
|
||||||
|
and conversions to other media types.
|
||||||
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or
|
||||||
|
Object form, made available under the License, as indicated by a
|
||||||
|
copyright notice that is included in or attached to the work
|
||||||
|
(an example is provided in the Appendix below).
|
||||||
|
|
||||||
|
"Derivative Works" shall mean any work, whether in Source or Object
|
||||||
|
form, that is based on (or derived from) the Work and for which the
|
||||||
|
editorial revisions, annotations, elaborations, or other modifications
|
||||||
|
represent, as a whole, an original work of authorship. For the purposes
|
||||||
|
of this License, Derivative Works shall not include works that remain
|
||||||
|
separable from, or merely link (or bind by name) to the interfaces of,
|
||||||
|
the Work and Derivative Works thereof.
|
||||||
|
|
||||||
|
"Contribution" shall mean any work of authorship, including
|
||||||
|
the original version of the Work and any modifications or additions
|
||||||
|
to that Work or Derivative Works thereof, that is intentionally
|
||||||
|
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||||
|
or by an individual or Legal Entity authorized to submit on behalf of
|
||||||
|
the copyright owner. For the purposes of this definition, "submitted"
|
||||||
|
means any form of electronic, verbal, or written communication sent
|
||||||
|
to the Licensor or its representatives, including but not limited to
|
||||||
|
communication on electronic mailing lists, source code control systems,
|
||||||
|
and issue tracking systems that are managed by, or on behalf of, the
|
||||||
|
Licensor for the purpose of discussing and improving the Work, but
|
||||||
|
excluding communication that is conspicuously marked or otherwise
|
||||||
|
designated in writing by the copyright owner as "Not a Contribution."
|
||||||
|
|
||||||
|
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||||
|
on behalf of whom a Contribution has been received by Licensor and
|
||||||
|
subsequently incorporated within the Work.
|
||||||
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
copyright license to reproduce, prepare Derivative Works of,
|
||||||
|
publicly display, publicly perform, sublicense, and distribute the
|
||||||
|
Work and such Derivative Works in Source or Object form.
|
||||||
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
(except as stated in this section) patent license to make, have made,
|
||||||
|
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||||
|
where such license applies only to those patent claims licensable
|
||||||
|
by such Contributor that are necessarily infringed by their
|
||||||
|
Contribution(s) alone or by combination of their Contribution(s)
|
||||||
|
with the Work to which such Contribution(s) was submitted. If You
|
||||||
|
institute patent litigation against any entity (including a
|
||||||
|
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||||
|
or a Contribution incorporated within the Work constitutes direct
|
||||||
|
or contributory patent infringement, then any patent licenses
|
||||||
|
granted to You under this License for that Work shall terminate
|
||||||
|
as of the date such litigation is filed.
|
||||||
|
|
||||||
|
4. Redistribution. You may reproduce and distribute copies of the
|
||||||
|
Work or Derivative Works thereof in any medium, with or without
|
||||||
|
modifications, and in Source or Object form, provided that You
|
||||||
|
meet the following conditions:
|
||||||
|
|
||||||
|
(a) You must give any other recipients of the Work or
|
||||||
|
Derivative Works a copy of this License; and
|
||||||
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices
|
||||||
|
stating that You changed the files; and
|
||||||
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works
|
||||||
|
that You distribute, all copyright, patent, trademark, and
|
||||||
|
attribution notices from the Source form of the Work,
|
||||||
|
excluding those notices that do not pertain to any part of
|
||||||
|
the Derivative Works; and
|
||||||
|
|
||||||
|
(d) If the Work includes a "NOTICE" text file as part of its
|
||||||
|
distribution, then any Derivative Works that You distribute must
|
||||||
|
include a readable copy of the attribution notices contained
|
||||||
|
within such NOTICE file, excluding those notices that do not
|
||||||
|
pertain to any part of the Derivative Works, in at least one
|
||||||
|
of the following places: within a NOTICE text file distributed
|
||||||
|
as part of the Derivative Works; within the Source form or
|
||||||
|
documentation, if provided along with the Derivative Works; or,
|
||||||
|
within a display generated by the Derivative Works, if and
|
||||||
|
wherever such third-party notices normally appear. The contents
|
||||||
|
of the NOTICE file are for informational purposes only and
|
||||||
|
do not modify the License. You may add Your own attribution
|
||||||
|
notices within Derivative Works that You distribute, alongside
|
||||||
|
or as an addendum to the NOTICE text from the Work, provided
|
||||||
|
that such additional attribution notices cannot be construed
|
||||||
|
as modifying the License.
|
||||||
|
|
||||||
|
You may add Your own copyright statement to Your modifications and
|
||||||
|
may provide additional or different license terms and conditions
|
||||||
|
for use, reproduction, or distribution of Your modifications, or
|
||||||
|
for any such Derivative Works as a whole, provided Your use,
|
||||||
|
reproduction, and distribution of the Work otherwise complies with
|
||||||
|
the conditions stated in this License.
|
||||||
|
|
||||||
|
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||||
|
any Contribution intentionally submitted for inclusion in the Work
|
||||||
|
by You to the Licensor shall be under the terms and conditions of
|
||||||
|
this License, without any additional terms or conditions.
|
||||||
|
Notwithstanding the above, nothing herein shall supersede or modify
|
||||||
|
the terms of any separate license agreement you may have executed
|
||||||
|
with Licensor regarding such Contributions.
|
||||||
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade
|
||||||
|
names, trademarks, service marks, or product names of the Licensor,
|
||||||
|
except as required for reasonable and customary use in describing the
|
||||||
|
origin of the Work and reproducing the content of the NOTICE file.
|
||||||
|
|
||||||
|
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||||
|
agreed to in writing, Licensor provides the Work (and each
|
||||||
|
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
|
implied, including, without limitation, any warranties or conditions
|
||||||
|
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||||
|
appropriateness of using or redistributing the Work and assume any
|
||||||
|
risks associated with Your exercise of permissions under this License.
|
||||||
|
|
||||||
|
8. Limitation of Liability. In no event and under no legal theory,
|
||||||
|
whether in tort (including negligence), contract, or otherwise,
|
||||||
|
unless required by applicable law (such as deliberate and grossly
|
||||||
|
negligent acts) or agreed to in writing, shall any Contributor be
|
||||||
|
liable to You for damages, including any direct, indirect, special,
|
||||||
|
incidental, or consequential damages of any character arising as a
|
||||||
|
result of this License or out of the use or inability to use the
|
||||||
|
Work (including but not limited to damages for loss of goodwill,
|
||||||
|
work stoppage, computer failure or malfunction, or any and all
|
||||||
|
other commercial damages or losses), even if such Contributor
|
||||||
|
has been advised of the possibility of such damages.
|
||||||
|
|
||||||
|
9. Accepting Warranty or Additional Liability. While redistributing
|
||||||
|
the Work or Derivative Works thereof, You may choose to offer,
|
||||||
|
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||||
|
or other liability obligations and/or rights consistent with this
|
||||||
|
License. However, in accepting such obligations, You may act only
|
||||||
|
on Your own behalf and on Your sole responsibility, not on behalf
|
||||||
|
of any other Contributor, and only if You agree to indemnify,
|
||||||
|
defend, and hold each Contributor harmless for any liability
|
||||||
|
incurred by, or claims asserted against, such Contributor by reason
|
||||||
|
of your accepting any such warranty or additional liability.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
|
|
||||||
|
To apply the Apache License to your work, attach the following
|
||||||
|
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||||
|
replaced with your own identifying information. (Don't include
|
||||||
|
the brackets!) The text should be enclosed in the appropriate
|
||||||
|
comment syntax for the file format. We also recommend that a
|
||||||
|
file or class name and description of purpose be included on the
|
||||||
|
same "printed page" as the copyright notice for easier
|
||||||
|
identification within third-party archives.
|
||||||
|
|
||||||
|
Copyright [yyyy] [name of copyright owner]
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
7
README.md
Normal file
7
README.md
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
# alexlebens.net
|
||||||
|
|
||||||
|
GitOps definied infrastrucutre for the alexlebens.net domain.
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
This project is licensed under the terms of the Apache 2.0 License license.
|
||||||
11
clusters/cl01tl/applications/audiobookshelf/Chart.yaml
Normal file
11
clusters/cl01tl/applications/audiobookshelf/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: audiobookshelf
|
||||||
|
version: 0.0.1
|
||||||
|
sources:
|
||||||
|
- https://github.com/advplyr/audiobookshelf
|
||||||
|
- https://github.com/k8s-home-lab/helm-charts/tree/master/charts/stable/audiobookshelf
|
||||||
|
dependencies:
|
||||||
|
- name: audiobookshelf
|
||||||
|
version: 2.0.0
|
||||||
|
repository: https://k8s-home-lab.github.io/helm-charts/
|
||||||
|
appVersion: "2.8.0"
|
||||||
@@ -0,0 +1,40 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: audiobookshelf-nfs-storage-backup
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeMode: Filesystem
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: audiobookshelf-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: audiobookshelf-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: audiobookshelf-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: {{ .Values.storage.nfs.path }}
|
||||||
|
server: {{ .Values.storage.nfs.server }}
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
48
clusters/cl01tl/applications/audiobookshelf/values.yaml
Normal file
48
clusters/cl01tl/applications/audiobookshelf/values.yaml
Normal file
@@ -0,0 +1,48 @@
|
|||||||
|
audiobookshelf:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/advplyr/audiobookshelf
|
||||||
|
tag: 2.9.0
|
||||||
|
env:
|
||||||
|
TZ: US/Central
|
||||||
|
ingress:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
ingressClassName: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
hosts:
|
||||||
|
- host: audiobookshelf.alexlebens.net
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- secretName: audiobookshelf-secret-tls
|
||||||
|
hosts:
|
||||||
|
- audiobookshelf.alexlebens.net
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /config
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 2Gi
|
||||||
|
metadata:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /metadata
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 10Gi
|
||||||
|
backup:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /metadata/backups
|
||||||
|
type: pvc
|
||||||
|
existingClaim: audiobookshelf-nfs-storage-backup
|
||||||
|
audiobooks:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /mnt/store/
|
||||||
|
type: pvc
|
||||||
|
existingClaim: audiobookshelf-nfs-storage
|
||||||
|
storage:
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
11
clusters/cl01tl/applications/calibre-server/Chart.yaml
Normal file
11
clusters/cl01tl/applications/calibre-server/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: calibre-server
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/kovidgoyal/calibre
|
||||||
|
- https://github.com/alexlebens/helm-charts/tree/main/charts/calibre-server
|
||||||
|
dependencies:
|
||||||
|
- name: calibre-server
|
||||||
|
version: 0.0.8
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: 7.5.1
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: calibre-server-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: calibre-server-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: calibre-server-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: {{ index .Values "calibre-server" "persistence" "books" "nfs" "path" }}
|
||||||
|
server: {{ index .Values "calibre-server" "persistence" "books" "nfs" "server" }}
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
20
clusters/cl01tl/applications/calibre-server/values.yaml
Normal file
20
clusters/cl01tl/applications/calibre-server/values.yaml
Normal file
@@ -0,0 +1,20 @@
|
|||||||
|
calibre-server:
|
||||||
|
deployment:
|
||||||
|
env:
|
||||||
|
TZ: US/Central
|
||||||
|
ingressRoute:
|
||||||
|
enabled: true
|
||||||
|
http:
|
||||||
|
host: calibre-server.alexlebens.net
|
||||||
|
authentik:
|
||||||
|
outpost: authentik-outpost-proxy
|
||||||
|
namespace: authentik
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
storageClassName: ceph-block
|
||||||
|
storageSize: 5Gi
|
||||||
|
books:
|
||||||
|
claimName: calibre-server-nfs-storage
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage/Calibre
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
11
clusters/cl01tl/applications/calibre-web/Chart.yaml
Normal file
11
clusters/cl01tl/applications/calibre-web/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: calibre-web
|
||||||
|
version: 0.0.1
|
||||||
|
sources:
|
||||||
|
- https://github.com/janeczku/calibre-web
|
||||||
|
- https://github.com/k8s-home-lab/helm-charts/tree/master/charts/stable/calibre-web
|
||||||
|
dependencies:
|
||||||
|
- name: calibre-web
|
||||||
|
version: 9.0.2
|
||||||
|
repository: https://k8s-home-lab.github.io/helm-charts/
|
||||||
|
appVersion: v0.6.21
|
||||||
@@ -0,0 +1,33 @@
|
|||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: IngressRoute
|
||||||
|
metadata:
|
||||||
|
name: {{ .Release.Name }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- websecure
|
||||||
|
routes:
|
||||||
|
- kind: Rule
|
||||||
|
match: "Host(`{{ .Values.ingressRoute.host }}`)"
|
||||||
|
middlewares:
|
||||||
|
- name: "authentik-{{ .Release.Name }}"
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
priority: 10
|
||||||
|
services:
|
||||||
|
- kind: Service
|
||||||
|
name: {{ .Release.Name }}
|
||||||
|
port: {{ .Values.ingressRoute.port }}
|
||||||
|
- kind: Rule
|
||||||
|
match: "Host(`{{ .Values.ingressRoute.host }}`) && PathPrefix(`/outpost.goauthentik.io/`)"
|
||||||
|
priority: 15
|
||||||
|
services:
|
||||||
|
- kind: Service
|
||||||
|
name: {{ .Values.ingressRoute.authentik.outpost }}
|
||||||
|
port: {{ .Values.ingressRoute.authentik.port }}
|
||||||
|
namespace: {{ .Values.ingressRoute.authentik.namespace }}
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: "authentik-{{ .Release.Name }}"
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: auth
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
forwardAuth:
|
||||||
|
address: "http://{{ .Values.ingressRoute.authentik.outpost }}.authentik:{{ .Values.ingressRoute.authentik.port }}/outpost.goauthentik.io/auth/traefik"
|
||||||
|
trustForwardHeader: true
|
||||||
|
authResponseHeaders:
|
||||||
|
- X-authentik-username
|
||||||
|
- X-authentik-groups
|
||||||
|
- X-authentik-email
|
||||||
|
- X-authentik-name
|
||||||
|
- X-authentik-uid
|
||||||
|
- X-authentik-jwt
|
||||||
|
- X-authentik-meta-jwks
|
||||||
|
- X-authentik-meta-outpost
|
||||||
|
- X-authentik-meta-provider
|
||||||
|
- X-authentik-meta-app
|
||||||
|
- X-authentik-meta-version
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: calibre-web-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: calibre-web-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: calibre-web-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: {{ .Values.storage.storage.nfs.path }}
|
||||||
|
server: {{ .Values.storage.storage.nfs.server }}
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
33
clusters/cl01tl/applications/calibre-web/values.yaml
Normal file
33
clusters/cl01tl/applications/calibre-web/values.yaml
Normal file
@@ -0,0 +1,33 @@
|
|||||||
|
calibre-web:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/linuxserver/calibre-web
|
||||||
|
tag: 0.6.21-ls253
|
||||||
|
env:
|
||||||
|
TZ: US/Central
|
||||||
|
DOCKER_MODS: linuxserver/mods:universal-calibre
|
||||||
|
ingress:
|
||||||
|
main:
|
||||||
|
enabled: false
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /config
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 5Gi
|
||||||
|
media:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /books
|
||||||
|
type: pvc
|
||||||
|
existingClaim: calibre-web-nfs-storage
|
||||||
|
ingressRoute:
|
||||||
|
host: calibre.alexlebens.net
|
||||||
|
port: 8083
|
||||||
|
authentik:
|
||||||
|
outpost: authentik-outpost-proxy
|
||||||
|
port: 9000
|
||||||
|
namespace: authentik
|
||||||
|
storage:
|
||||||
|
storage:
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage/Calibre
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
12
clusters/cl01tl/applications/code-server/Chart.yaml
Normal file
12
clusters/cl01tl/applications/code-server/Chart.yaml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: code-server
|
||||||
|
version: 0.0.1
|
||||||
|
sources:
|
||||||
|
- https://github.com/coder/code-server
|
||||||
|
- https://github.com/linuxserver/docker-code-server
|
||||||
|
- https://gitlab.com/alexander-chernov/helm/code-server
|
||||||
|
dependencies:
|
||||||
|
- name: code-server
|
||||||
|
version: 0.1.1
|
||||||
|
repository: https://charts.alekc.dev
|
||||||
|
appVersion: "4.22.0"
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: codeserver-password-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: password
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /code-server/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: password
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: code-server-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeMode: Filesystem
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
34
clusters/cl01tl/applications/code-server/values.yaml
Normal file
34
clusters/cl01tl/applications/code-server/values.yaml
Normal file
@@ -0,0 +1,34 @@
|
|||||||
|
code-server:
|
||||||
|
image:
|
||||||
|
repository: linuxserver/code-server
|
||||||
|
tag: 4.89.1
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
className: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
hosts:
|
||||||
|
- host: codeserver.alexlebens.net
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- secretName: codeserver-secret-tls
|
||||||
|
hosts:
|
||||||
|
- codeserver.alexlebens.net
|
||||||
|
env:
|
||||||
|
simple:
|
||||||
|
TZ: US/Central
|
||||||
|
DEFAULT_WORKSPACE: /config
|
||||||
|
full:
|
||||||
|
- name: SUDO_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
key: password
|
||||||
|
name: codeserver-password-secret
|
||||||
|
optional: false
|
||||||
|
persistence:
|
||||||
|
existingClaim: code-server-nfs-storage
|
||||||
|
enabled: true
|
||||||
11
clusters/cl01tl/applications/cops/Chart.yaml
Normal file
11
clusters/cl01tl/applications/cops/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: cops
|
||||||
|
version: 0.0.1
|
||||||
|
sources:
|
||||||
|
- https://github.com/mikespub-org/seblucas-cops
|
||||||
|
- http://alexlebens.github.io/helm-charts
|
||||||
|
dependencies:
|
||||||
|
- name: cops
|
||||||
|
version: 0.0.3
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: 1.1.3
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: cops-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: cops-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: cops-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: {{ .Values.storage.books.nfsPath }}
|
||||||
|
server: {{ .Values.storage.books.nfsServer }}
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
22
clusters/cl01tl/applications/cops/values.yaml
Normal file
22
clusters/cl01tl/applications/cops/values.yaml
Normal file
@@ -0,0 +1,22 @@
|
|||||||
|
cops:
|
||||||
|
deployment:
|
||||||
|
env:
|
||||||
|
TZ: US/Central
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
className: traefik
|
||||||
|
host: calibre-content.alexlebens.net
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
storageClassName: ceph-block
|
||||||
|
storageSize: 1Gi
|
||||||
|
books:
|
||||||
|
claimName: cops-nfs-storage
|
||||||
|
storage:
|
||||||
|
books:
|
||||||
|
nfsPath: /volume2/Storage/Calibre
|
||||||
|
nfsServer: synologybond.alexlebens.net
|
||||||
15
clusters/cl01tl/applications/freshrss/Chart.yaml
Normal file
15
clusters/cl01tl/applications/freshrss/Chart.yaml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: freshrss
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/FreshRSS/FreshRSS
|
||||||
|
- https://github.com/alexlebens/helm-charts/tree/main/charts/hfreshrss
|
||||||
|
dependencies:
|
||||||
|
- name: freshrss
|
||||||
|
version: 0.0.3
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
- name: postgres-cluster
|
||||||
|
alias: postgres-16-cluster
|
||||||
|
version: 3.0.0
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: "1.23.1"
|
||||||
@@ -0,0 +1,94 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: freshrss-oidc-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: OIDC_CLIENT_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/freshrss
|
||||||
|
metadataPolicy: None
|
||||||
|
property: client
|
||||||
|
- secretKey: OIDC_CLIENT_SECRET
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/freshrss
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: freshrss-install-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: FRESHRSS_INSTALL
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /freshrss/config
|
||||||
|
metadataPolicy: None
|
||||||
|
property: FRESHRSS_INSTALL
|
||||||
|
- secretKey: FRESHRSS_USER
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /freshrss/config
|
||||||
|
metadataPolicy: None
|
||||||
|
property: FRESHRSS_USER
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: freshrss-postgresql-16-cluster-backup-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: freshrss-postgresql-16-cluster-backup-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: ACCESS_KEY_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-freshrss-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: access_key
|
||||||
|
- secretKey: ACCESS_SECRET_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-freshrss-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret_key
|
||||||
42
clusters/cl01tl/applications/freshrss/values.yaml
Normal file
42
clusters/cl01tl/applications/freshrss/values.yaml
Normal file
@@ -0,0 +1,42 @@
|
|||||||
|
freshrss:
|
||||||
|
deployment:
|
||||||
|
env:
|
||||||
|
TZ: US/Central
|
||||||
|
CRON_MIN: 13,43
|
||||||
|
OIDC_ENABLED: 1
|
||||||
|
OIDC_PROVIDER_METADATA_URL: https://authentik.alexlebens.net/application/o/freshrss/.well-known/openid-configuration
|
||||||
|
OIDC_X_FORWARDED_HEADERS: X-Forwarded-Port X-Forwarded-Proto X-Forwarded-Host
|
||||||
|
OIDC_SCOPES: openid email profile
|
||||||
|
OIDC_REMOTE_USER_CLAIM: preferred_username
|
||||||
|
envFrom:
|
||||||
|
- secretRef:
|
||||||
|
name: freshrss-oidc-secret
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
className: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
host: rss.alexlebens.net
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
storageClassName: ceph-block
|
||||||
|
storageSize: 5Gi
|
||||||
|
postgres-16-cluster:
|
||||||
|
mode: standalone
|
||||||
|
kubernetesClusterName: cl01tl
|
||||||
|
cluster:
|
||||||
|
walStorage:
|
||||||
|
storageClass: local-path
|
||||||
|
storage:
|
||||||
|
storageClass: local-path
|
||||||
|
monitoring:
|
||||||
|
enabled: true
|
||||||
|
backup:
|
||||||
|
enabled: true
|
||||||
|
endpointURL: https://s3.us-east-2.amazonaws.com
|
||||||
|
destinationPath: s3://cl01tl-postgresql-backups/freshrss
|
||||||
|
endpointCredentials: freshrss-postgresql-16-cluster-backup-secret
|
||||||
|
backupIndex: 1
|
||||||
|
retentionPolicy: 14d
|
||||||
11
clusters/cl01tl/applications/home-assistant/Chart.yaml
Normal file
11
clusters/cl01tl/applications/home-assistant/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: home-assistant
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/home-assistant
|
||||||
|
- https://github.com/alexlebens/helm-charts/tree/main/charts/home-assistant
|
||||||
|
dependencies:
|
||||||
|
- name: home-assistant
|
||||||
|
version: 0.1.15
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: v2024.5.3
|
||||||
@@ -0,0 +1,48 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: home-assistant-codeserver-password-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: SUDO_PASSWORD
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /home-assistant/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: SUDO_PASSWORD
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: home-assistant-token-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: bearerToken
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /home-assistant/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: bearerToken
|
||||||
46
clusters/cl01tl/applications/home-assistant/values.yaml
Normal file
46
clusters/cl01tl/applications/home-assistant/values.yaml
Normal file
@@ -0,0 +1,46 @@
|
|||||||
|
home-assistant:
|
||||||
|
deployment:
|
||||||
|
env:
|
||||||
|
TZ: US/Central
|
||||||
|
ingressRoute:
|
||||||
|
enabled: true
|
||||||
|
host: homeassistant.alexlebens.net
|
||||||
|
authentik:
|
||||||
|
outpost: authentik-outpost-proxy
|
||||||
|
namespace: authentik
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
bearerTokenSecret:
|
||||||
|
name: home-assistant-token-secret
|
||||||
|
key: bearerToken
|
||||||
|
prometheusRule:
|
||||||
|
enabled: true
|
||||||
|
rules:
|
||||||
|
- alert: HomeAssistantAbsent
|
||||||
|
annotations:
|
||||||
|
description: Home Assistant has disappeared from Prometheus service discovery.
|
||||||
|
summary: Home Assistant is down.
|
||||||
|
expr: |
|
||||||
|
absent(up{job=~".*home-assistant.*"} == 1)
|
||||||
|
for: 5m
|
||||||
|
labels:
|
||||||
|
severity: critical
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
storageClassName: ceph-block
|
||||||
|
storageSize: 1Gi
|
||||||
|
codeserver:
|
||||||
|
enabled: true
|
||||||
|
env:
|
||||||
|
TZ: US/Central
|
||||||
|
DEFAULT_WORKSPACE: /config
|
||||||
|
envFrom:
|
||||||
|
- secretRef:
|
||||||
|
name: home-assistant-codeserver-password-secret
|
||||||
|
ingressRoute:
|
||||||
|
enabled: true
|
||||||
|
host: homeassistant-codeserver.alexlebens.net
|
||||||
|
authentik:
|
||||||
|
outpost: authentik-outpost-proxy
|
||||||
|
namespace: authentik
|
||||||
18
clusters/cl01tl/applications/homepage-dev/Chart.yaml
Normal file
18
clusters/cl01tl/applications/homepage-dev/Chart.yaml
Normal file
@@ -0,0 +1,18 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: homepage-dev
|
||||||
|
version: 1.0.0
|
||||||
|
home: https://outline.alexlebens.net/doc/homepage-dev-s2clWoI5EC
|
||||||
|
sources:
|
||||||
|
- https://github.com/gethomepage/homepage
|
||||||
|
- https://github.com/cloudflare/cloudflared
|
||||||
|
- https://github.com/bjw-s/helm-charts/blob/main/charts/other/app-template/values.yaml
|
||||||
|
dependencies:
|
||||||
|
- name: app-template
|
||||||
|
alias: homepage
|
||||||
|
repository: https://bjw-s.github.io/helm-charts/
|
||||||
|
version: 3.1.0
|
||||||
|
- name: app-template
|
||||||
|
alias: cloudflared
|
||||||
|
repository: https://bjw-s.github.io/helm-charts/
|
||||||
|
version: 3.1.0
|
||||||
|
appVersion: v0.8.12
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: homepage-dev-cloudflared-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: homepage-dev-cloudflared-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: cf-tunnel-token
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /cloudflare/tunnels/homepage-dev
|
||||||
|
metadataPolicy: None
|
||||||
|
property: token
|
||||||
225
clusters/cl01tl/applications/homepage-dev/values.yaml
Normal file
225
clusters/cl01tl/applications/homepage-dev/values.yaml
Normal file
@@ -0,0 +1,225 @@
|
|||||||
|
homepage:
|
||||||
|
global:
|
||||||
|
nameOverride: homepage
|
||||||
|
controllers:
|
||||||
|
main:
|
||||||
|
type: deployment
|
||||||
|
annotations:
|
||||||
|
reloader.stakater.com/auto: "true"
|
||||||
|
strategy: Recreate
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/gethomepage/homepage
|
||||||
|
tag: v0.8.13
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 1000m
|
||||||
|
memory: 512Mi
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 128Mi
|
||||||
|
serviceAccount:
|
||||||
|
create: true
|
||||||
|
configMaps:
|
||||||
|
config:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
docker.yaml: ""
|
||||||
|
kubernetes.yaml: ""
|
||||||
|
settings.yaml: |
|
||||||
|
favicon: https://alexlebens-dev.nyc3.digitaloceanspaces.com/cl02do/assets/icon_white.png
|
||||||
|
headerStyle: clean
|
||||||
|
hideVersion: true
|
||||||
|
color: slate
|
||||||
|
background:
|
||||||
|
image: https://alexlebens-dev.nyc3.digitaloceanspaces.com/cl02do/assets/background.jpg
|
||||||
|
theme: dark
|
||||||
|
disableCollapse: true
|
||||||
|
layout:
|
||||||
|
- Media:
|
||||||
|
icon: mdi-multimedia-#ffffff
|
||||||
|
- Applications:
|
||||||
|
icon: mdi-application-#ffffff
|
||||||
|
widgets.yaml: |
|
||||||
|
- logo:
|
||||||
|
icon: https://alexlebens-dev.nyc3.digitaloceanspaces.com/cl02do/assets/icon_white.png
|
||||||
|
- datetime:
|
||||||
|
text_size: xl
|
||||||
|
format:
|
||||||
|
dateStyle: long
|
||||||
|
timeStyle: short
|
||||||
|
hour12: false
|
||||||
|
- openmeteo:
|
||||||
|
label: Denver
|
||||||
|
latitude: 39.73
|
||||||
|
longitude: 104.99
|
||||||
|
units: metric
|
||||||
|
cache: 5
|
||||||
|
services.yaml: |
|
||||||
|
- Media:
|
||||||
|
- Plex:
|
||||||
|
icon: plex.png
|
||||||
|
href: https://plex.alexlebens.net
|
||||||
|
description: Media server
|
||||||
|
siteMonitor: http://plex.plex:32400
|
||||||
|
statusStyle: dot
|
||||||
|
- Overseerr:
|
||||||
|
icon: overseerr.png
|
||||||
|
description: Requests
|
||||||
|
href: https://overseerr.alexlebens.net
|
||||||
|
siteMonitor: http://overseerr.overseerr:5055
|
||||||
|
statusStyle: dot
|
||||||
|
- Jellyfin:
|
||||||
|
icon: jellyfin.png
|
||||||
|
description: Media server
|
||||||
|
href: https://jellyfin.alexlebens.net/
|
||||||
|
siteMonitor: http://jellyfin.jellyfin:8096
|
||||||
|
statusStyle: dot
|
||||||
|
- TubeAchivist:
|
||||||
|
icon: tube-archivist.png
|
||||||
|
description: Youtube downloader
|
||||||
|
href: https://tubearchivist.alexlebens.net/login/
|
||||||
|
siteMonitor: http://tubearchivist.tubearchivist:8000
|
||||||
|
statusStyle: dot
|
||||||
|
- Navidrome:
|
||||||
|
icon: navidrome.png
|
||||||
|
description: Music
|
||||||
|
href: https://navidrome.alexlebens.net
|
||||||
|
siteMonitor: http://navidrome.navidrome:4533
|
||||||
|
statusStyle: dot
|
||||||
|
- Audiobookshelf:
|
||||||
|
icon: audiobookshelf.png
|
||||||
|
description: Audiobooks, Books, and Podcasts
|
||||||
|
href: https://audiobookshelf.alexlebens.net
|
||||||
|
siteMonitor: http://audiobookshelf.audiobookshelf:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Calibre:
|
||||||
|
icon: calibre-web.png
|
||||||
|
description: Books
|
||||||
|
href: https://calibre.alexlebens.net
|
||||||
|
siteMonitor: http://calibre-web.calibre-web:8083
|
||||||
|
statusStyle: dot
|
||||||
|
- Applications:
|
||||||
|
- Ghost:
|
||||||
|
icon: ghost.png
|
||||||
|
description: Website and blog
|
||||||
|
href: https://blog.alexlebens.dev
|
||||||
|
siteMonitor: https://blog.alexlebens.dev
|
||||||
|
statusStyle: dot
|
||||||
|
- Chat:
|
||||||
|
icon: element.svg
|
||||||
|
description: Web client for Matrix chat
|
||||||
|
href: https://chat.alexlebens.dev
|
||||||
|
siteMonitor: https://chat.alexlebens.dev
|
||||||
|
statusStyle: dot
|
||||||
|
- Home Assistant:
|
||||||
|
icon: home-assistant.png
|
||||||
|
description: Home automation
|
||||||
|
href: https://homeassistant.alexlebens.net
|
||||||
|
siteMonitor: http://home-assistant.home-assistant:8123
|
||||||
|
statusStyle: dot
|
||||||
|
- Vikunja:
|
||||||
|
icon: vikunja.png
|
||||||
|
description: Notes and tasks
|
||||||
|
href: https://vikunja.alexlebens.net
|
||||||
|
siteMonitor: http://vikunja-frontend.vikunja:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Taiga:
|
||||||
|
icon: taiga.png
|
||||||
|
description: Project planning
|
||||||
|
href: https://taiga.alexlebens.net
|
||||||
|
siteMonitor: http://taiga-front.taiga:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Penpot:
|
||||||
|
icon: https://raw.githubusercontent.com/penpot/penpot/362d4ea47f06d169dd6e0a34cb9d141200e646e6/frontend/resources/images/icons/penpot-logo-icon.svg
|
||||||
|
description: Web design
|
||||||
|
href: https://penpot.alexlebens.net
|
||||||
|
siteMonitor: http://penpot.penpot:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Outline:
|
||||||
|
icon: outline.png
|
||||||
|
description: Wiki
|
||||||
|
href: https://outline.alexlebens.net
|
||||||
|
siteMonitor: http://outline.outline:3000
|
||||||
|
statusStyle: dot
|
||||||
|
- FreshRss:
|
||||||
|
icon: freshrss.svg
|
||||||
|
description: Rss reader
|
||||||
|
href: https://rss.alexlebens.net
|
||||||
|
siteMonitor: http://freshrss.freshrss:80
|
||||||
|
statusStyle: dot
|
||||||
|
bookmarks.yaml: ""
|
||||||
|
service:
|
||||||
|
http:
|
||||||
|
controller: main
|
||||||
|
ports:
|
||||||
|
http:
|
||||||
|
port: 80
|
||||||
|
targetPort: 3000
|
||||||
|
protocol: HTTP
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
enabled: true
|
||||||
|
type: configMap
|
||||||
|
name: homepage-dev-config
|
||||||
|
advancedMounts:
|
||||||
|
main:
|
||||||
|
main:
|
||||||
|
- path: /app/config/bookmarks.yaml
|
||||||
|
readOnly: true
|
||||||
|
mountPropagation: None
|
||||||
|
subPath: bookmarks.yaml
|
||||||
|
- path: /app/config/docker.yaml
|
||||||
|
readOnly: true
|
||||||
|
mountPropagation: None
|
||||||
|
subPath: docker.yaml
|
||||||
|
- path: /app/config/kubernetes.yaml
|
||||||
|
readOnly: true
|
||||||
|
mountPropagation: None
|
||||||
|
subPath: kubernetes.yaml
|
||||||
|
- path: /app/config/services.yaml
|
||||||
|
readOnly: true
|
||||||
|
mountPropagation: None
|
||||||
|
subPath: services.yaml
|
||||||
|
- path: /app/config/settings.yaml
|
||||||
|
readOnly: true
|
||||||
|
mountPropagation: None
|
||||||
|
subPath: settings.yaml
|
||||||
|
- path: /app/config/widgets.yaml
|
||||||
|
readOnly: true
|
||||||
|
mountPropagation: None
|
||||||
|
subPath: widgets.yaml
|
||||||
|
cloudflared:
|
||||||
|
global:
|
||||||
|
nameOverride: cloudflared
|
||||||
|
controllers:
|
||||||
|
main:
|
||||||
|
type: deployment
|
||||||
|
strategy: Recreate
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
image:
|
||||||
|
repository: cloudflare/cloudflared
|
||||||
|
tag: "2024.5.0"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
args:
|
||||||
|
- tunnel
|
||||||
|
- --no-autoupdate
|
||||||
|
- run
|
||||||
|
- --token
|
||||||
|
- $(CF_MANAGED_TUNNEL_TOKEN)
|
||||||
|
env:
|
||||||
|
- name: CF_MANAGED_TUNNEL_TOKEN
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: homepage-dev-cloudflared-secret
|
||||||
|
key: cf-tunnel-token
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 64Mi
|
||||||
12
clusters/cl01tl/applications/homepage/Chart.yaml
Normal file
12
clusters/cl01tl/applications/homepage/Chart.yaml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: homepage-front
|
||||||
|
version: 1.0.0
|
||||||
|
home: https://outline.alexlebens.net/doc/homepage-s2clWoI5EC
|
||||||
|
sources:
|
||||||
|
- https://github.com/gethomepage/homepage
|
||||||
|
- https://github.com/alexlebens/helm-charts/tree/main/charts/homepage
|
||||||
|
dependencies:
|
||||||
|
- name: homepage
|
||||||
|
version: 0.0.15
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: v0.8.12
|
||||||
@@ -0,0 +1,44 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: homepage-back-key-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: HOMEPAGE_VAR_SYNOLOGY_USER
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /synology/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: user
|
||||||
|
- secretKey: HOMEPAGE_VAR_SYNOLOGY_PASSWORD
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /synology/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: password
|
||||||
|
- secretKey: HOMEPAGE_VAR_UNIFI_USER
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /unifi/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: user
|
||||||
|
- secretKey: HOMEPAGE_VAR_UNIFI_PASSWORD
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /unifi/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: password
|
||||||
420
clusters/cl01tl/applications/homepage/values.yaml
Normal file
420
clusters/cl01tl/applications/homepage/values.yaml
Normal file
@@ -0,0 +1,420 @@
|
|||||||
|
homepage:
|
||||||
|
deployment:
|
||||||
|
annotations:
|
||||||
|
reloader.stakater.com/auto: "true"
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 1000m
|
||||||
|
envFrom:
|
||||||
|
- secretRef:
|
||||||
|
name: homepage-back-key-secret
|
||||||
|
ingressRoute:
|
||||||
|
host: home.alexlebens.net
|
||||||
|
authentik:
|
||||||
|
outpost: authentik-outpost-proxy
|
||||||
|
namespace: authentik
|
||||||
|
config:
|
||||||
|
widgets:
|
||||||
|
- logo:
|
||||||
|
icon: https://alexlebens-dev.nyc3.digitaloceanspaces.com/cl02do/assets/icon_white.png
|
||||||
|
- kubernetes:
|
||||||
|
cluster:
|
||||||
|
show: true
|
||||||
|
cpu: true
|
||||||
|
memory: true
|
||||||
|
showLabel: true
|
||||||
|
label: "Cluster"
|
||||||
|
nodes:
|
||||||
|
show: false
|
||||||
|
- datetime:
|
||||||
|
text_size: xl
|
||||||
|
format:
|
||||||
|
dateStyle: long
|
||||||
|
timeStyle: short
|
||||||
|
hour12: false
|
||||||
|
- openmeteo:
|
||||||
|
label: Denver
|
||||||
|
latitude: 39.73
|
||||||
|
longitude: 104.99
|
||||||
|
units: metric
|
||||||
|
cache: 5
|
||||||
|
services:
|
||||||
|
- Media:
|
||||||
|
- Plex:
|
||||||
|
icon: plex.png
|
||||||
|
href: https://plex.alexlebens.net
|
||||||
|
description: Media server
|
||||||
|
siteMonitor: http://plex.plex:32400
|
||||||
|
statusStyle: dot
|
||||||
|
- Overseerr:
|
||||||
|
icon: overseerr.png
|
||||||
|
description: Requests
|
||||||
|
href: https://overseerr.alexlebens.net
|
||||||
|
siteMonitor: http://overseerr.overseerr:5055
|
||||||
|
statusStyle: dot
|
||||||
|
- Jellyfin:
|
||||||
|
icon: jellyfin.png
|
||||||
|
description: Media server
|
||||||
|
href: https://jellyfin.alexlebens.net/
|
||||||
|
siteMonitor: http://jellyfin.jellyfin:8096
|
||||||
|
statusStyle: dot
|
||||||
|
- Kyoo:
|
||||||
|
icon: https://raw.githubusercontent.com/zoriya/Kyoo/master/icons/icon-256x256.png
|
||||||
|
description: Media server
|
||||||
|
href: https://kyoo.alexlebens.net/
|
||||||
|
siteMonitor: http://kyoo-front.kyoo:8901
|
||||||
|
statusStyle: dot
|
||||||
|
- TubeAchivist:
|
||||||
|
icon: tube-archivist.png
|
||||||
|
description: Youtube downloader
|
||||||
|
href: https://tubearchivist.alexlebens.net/login/
|
||||||
|
siteMonitor: http://tubearchivist.tubearchivist:8000
|
||||||
|
statusStyle: dot
|
||||||
|
- Navidrome:
|
||||||
|
icon: navidrome.png
|
||||||
|
description: Music
|
||||||
|
href: https://navidrome.alexlebens.net
|
||||||
|
siteMonitor: http://navidrome.navidrome:4533
|
||||||
|
statusStyle: dot
|
||||||
|
- Audiobookshelf:
|
||||||
|
icon: audiobookshelf.png
|
||||||
|
description: Audiobooks, Books, and Podcasts
|
||||||
|
href: https://audiobookshelf.alexlebens.net
|
||||||
|
siteMonitor: http://audiobookshelf.audiobookshelf:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Calibre:
|
||||||
|
icon: calibre-web.png
|
||||||
|
description: Books
|
||||||
|
href: https://calibre.alexlebens.net
|
||||||
|
siteMonitor: http://calibre-web.calibre-web:8083
|
||||||
|
statusStyle: dot
|
||||||
|
- Applications:
|
||||||
|
- Ghost (.dev):
|
||||||
|
icon: ghost.png
|
||||||
|
description: Website and blog
|
||||||
|
href: https://blog.alexlebens.dev
|
||||||
|
siteMonitor: https://blog.alexlebens.dev
|
||||||
|
statusStyle: dot
|
||||||
|
- Chat (.dev):
|
||||||
|
icon: element.svg
|
||||||
|
description: Web client for Matrix chat
|
||||||
|
href: https://chat.alexlebens.dev
|
||||||
|
siteMonitor: https://chat.alexlebens.dev
|
||||||
|
statusStyle: dot
|
||||||
|
- Home Assistant:
|
||||||
|
icon: home-assistant.png
|
||||||
|
description: Home automation
|
||||||
|
href: https://homeassistant.alexlebens.net
|
||||||
|
siteMonitor: http://home-assistant.home-assistant:8123
|
||||||
|
statusStyle: dot
|
||||||
|
- Vikunja:
|
||||||
|
icon: vikunja.png
|
||||||
|
description: Notes and tasks
|
||||||
|
href: https://vikunja.alexlebens.net
|
||||||
|
siteMonitor: http://vikunja-frontend.vikunja:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Taiga:
|
||||||
|
icon: taiga.png
|
||||||
|
description: Project planning
|
||||||
|
href: https://taiga.alexlebens.net
|
||||||
|
siteMonitor: http://taiga-front.taiga:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Penpot:
|
||||||
|
icon: https://raw.githubusercontent.com/penpot/penpot/362d4ea47f06d169dd6e0a34cb9d141200e646e6/frontend/resources/images/icons/penpot-logo-icon.svg
|
||||||
|
description: Web design
|
||||||
|
href: https://penpot.alexlebens.net
|
||||||
|
siteMonitor: http://penpot.penpot:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Outline:
|
||||||
|
icon: outline.png
|
||||||
|
description: Wiki
|
||||||
|
href: https://outline.alexlebens.net
|
||||||
|
siteMonitor: http://outline.outline:3000
|
||||||
|
statusStyle: dot
|
||||||
|
- FreshRss:
|
||||||
|
icon: freshrss.svg
|
||||||
|
description: Rss reader
|
||||||
|
href: https://rss.alexlebens.net
|
||||||
|
siteMonitor: http://freshrss.freshrss:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Code:
|
||||||
|
- Code Server:
|
||||||
|
icon: code-server.png
|
||||||
|
description: VS Code in a browser
|
||||||
|
href: https://codeserver.alexlebens.net
|
||||||
|
siteMonitor: http://code-server.code-server:8443
|
||||||
|
statusStyle: dot
|
||||||
|
- Code Server - Home Assistant:
|
||||||
|
icon: code-server.png
|
||||||
|
description: Edit config for Home Assistant
|
||||||
|
href: https://homeassistant-codeserver.alexlebens.net
|
||||||
|
siteMonitor: http://home-assistant-codeserver.home-assistant:8443
|
||||||
|
statusStyle: dot
|
||||||
|
- Gitea:
|
||||||
|
icon: gitea.png
|
||||||
|
description: Code repository
|
||||||
|
href: https://gitea.alexlebens.net
|
||||||
|
siteMonitor: http://gitea-http.gitea:3000
|
||||||
|
statusStyle: dot
|
||||||
|
- ArgoCD:
|
||||||
|
icon: argocd.png
|
||||||
|
description: Continous Deployment
|
||||||
|
href: https://argocd.alexlebens.net
|
||||||
|
siteMonitor: http://argocd-server.argocd:80
|
||||||
|
statusStyle: dot
|
||||||
|
namespace: argocd
|
||||||
|
- Argo Rollouts:
|
||||||
|
icon: argocd.png
|
||||||
|
description: Deployment mangement and evaluation
|
||||||
|
href: https://argo-rollouts.alexlebens.net
|
||||||
|
siteMonitor: http://argo-rollouts-dashboard.argocd:3100
|
||||||
|
statusStyle: dot
|
||||||
|
namespace: argocd
|
||||||
|
- Argo Workflows:
|
||||||
|
icon: argocd.png
|
||||||
|
description: Workflows and events for ArgoCD
|
||||||
|
href: https://argo-workflows.alexlebens.net
|
||||||
|
siteMonitor: http://argo-workflows-server.argocd:2746
|
||||||
|
statusStyle: dot
|
||||||
|
namespace: argocd
|
||||||
|
- Kargo:
|
||||||
|
icon: https://raw.githubusercontent.com/akuity/kargo/main/ui/public/kargo-icon.png
|
||||||
|
description: Continous Integration
|
||||||
|
href: https://kargo.alexlebens.net
|
||||||
|
siteMonitor: http://kargo-api.argocd:80
|
||||||
|
statusStyle: dot
|
||||||
|
namespace: argocd
|
||||||
|
- Management:
|
||||||
|
- Calibre Server:
|
||||||
|
icon: calibre.png
|
||||||
|
description: Calibre content server
|
||||||
|
href: https://calibre-server.alexlebens.net
|
||||||
|
siteMonitor: http://calibre-server.calibre-server:8080
|
||||||
|
statusStyle: dot
|
||||||
|
- COPS:
|
||||||
|
icon: calibre-web.png
|
||||||
|
description: Calibre OPDS (and HTML) PHP Server
|
||||||
|
href: https://calibre-content.alexlebens.net
|
||||||
|
siteMonitor: http://cops.cops:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Monitoring:
|
||||||
|
- Portainer:
|
||||||
|
icon: portainer.png
|
||||||
|
description: Service monitoring
|
||||||
|
href: https://portainer.alexlebens.net
|
||||||
|
siteMonitor: http://portainer.portainer:9000
|
||||||
|
statusStyle: dot
|
||||||
|
- Headlamp:
|
||||||
|
icon: kubernetes.png
|
||||||
|
description: Kubernetes dashboard
|
||||||
|
href: https://headlamp.alexlebens.net
|
||||||
|
siteMonitor: http://headlamp.headlamp:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Hubble:
|
||||||
|
icon: cilium.png
|
||||||
|
description: Network monitoring for Cilium
|
||||||
|
href: https://hubble.alexlebens.net
|
||||||
|
siteMonitor: http://hubble-ui.kube-system:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Grafana:
|
||||||
|
icon: grafana.png
|
||||||
|
description: Dashboard
|
||||||
|
href: https://grafana.alexlebens.net
|
||||||
|
siteMonitor: https://grafana.alexlebens.net
|
||||||
|
statusStyle: dot
|
||||||
|
- Prometheus:
|
||||||
|
icon: prometheus.png
|
||||||
|
description: Metrics database
|
||||||
|
href: https://prometheus.alexlebens.net
|
||||||
|
siteMonitor: http://kube-prometheus-stack-prometheus.kube-prometheus-stack:9090
|
||||||
|
statusStyle: dot
|
||||||
|
widget:
|
||||||
|
type: prometheus
|
||||||
|
url: http://kube-prometheus-stack-prometheus.kube-prometheus-stack:9090
|
||||||
|
- Alertmanager:
|
||||||
|
icon: alertmanager.png
|
||||||
|
description: Alerting and notification
|
||||||
|
href: https://alertmanager.alexlebens.net
|
||||||
|
siteMonitor: http://kube-prometheus-stack-alertmanager.kube-prometheus-stack:9093
|
||||||
|
statusStyle: dot
|
||||||
|
- Services:
|
||||||
|
- Authentik:
|
||||||
|
icon: authentik.png
|
||||||
|
description: Identity management and provider
|
||||||
|
href: https://authentik.alexlebens.net
|
||||||
|
siteMonitor: http://authentik-server.authentik:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Authentik (.dev):
|
||||||
|
icon: authentik.png
|
||||||
|
description: Identity management and provider
|
||||||
|
href: https://auth.alexlebens.dev
|
||||||
|
siteMonitor: https://auth.alexlebens.dev
|
||||||
|
statusStyle: dot
|
||||||
|
- Traefik - cl01tl:
|
||||||
|
icon: traefik.png
|
||||||
|
description: Reverse proxy
|
||||||
|
href: https://traefik-cl01tl.alexlebens.net/dashboard/#/
|
||||||
|
siteMonitor: https://traefik-cl01tl.alexlebens.net/dashboard/#/
|
||||||
|
statusStyle: dot
|
||||||
|
widget:
|
||||||
|
type: traefik
|
||||||
|
url: https://traefik-cl01tl.alexlebens.net
|
||||||
|
- Traefik - ps08rp:
|
||||||
|
icon: traefik.png
|
||||||
|
description: Reverse proxy
|
||||||
|
href: https://traefik-ps08rp.alexlebens.net/dashboard/#/
|
||||||
|
siteMonitor: https://traefik-ps08rp.alexlebens.net/dashboard/#/
|
||||||
|
statusStyle: dot
|
||||||
|
- Traefik - ps09rp:
|
||||||
|
icon: traefik.png
|
||||||
|
description: Reverse proxy
|
||||||
|
href: https://traefik-ps09rp.alexlebens.net/dashboard/#/
|
||||||
|
siteMonitor: https://traefik-ps09rp.alexlebens.net/dashboard/#/
|
||||||
|
statusStyle: dot
|
||||||
|
- Technitium - ps08rp:
|
||||||
|
icon: technitium.png
|
||||||
|
description: DNS
|
||||||
|
href: https://technitium-ps08rp.alexlebens.net
|
||||||
|
siteMonitor: https://technitium-ps08rp.alexlebens.net
|
||||||
|
statusStyle: dot
|
||||||
|
- Technitium - ps09rp:
|
||||||
|
icon: technitium.png
|
||||||
|
description: DNS
|
||||||
|
href: https://technitium-ps09rp.alexlebens.net
|
||||||
|
siteMonitor: https://technitium-ps09rp.alexlebens.net
|
||||||
|
statusStyle: dot
|
||||||
|
- Hardware:
|
||||||
|
- Unifi:
|
||||||
|
icon: unifi.png
|
||||||
|
description: Manager network hardware
|
||||||
|
href: https://unifi.alexlebens.net
|
||||||
|
siteMonitor: https://unifi.alexlebens.net
|
||||||
|
statusStyle: dot
|
||||||
|
- Synology:
|
||||||
|
icon: synology.png
|
||||||
|
description: Network Attached Storage
|
||||||
|
href: https://synology.alexlebens.net
|
||||||
|
siteMonitor: https://synology.alexlebens.net
|
||||||
|
statusStyle: dot
|
||||||
|
widget:
|
||||||
|
type: diskstation
|
||||||
|
url: https://synology.alexlebens.net
|
||||||
|
username: '{{HOMEPAGE_VAR_SYNOLOGY_USER}}'
|
||||||
|
password: '{{HOMEPAGE_VAR_SYNOLOGY_PASSWORD}}'
|
||||||
|
volume: volume_2
|
||||||
|
- HD Homerun Flex:
|
||||||
|
icon: hdhomerun.png
|
||||||
|
description: TV Tuner
|
||||||
|
href: http://hdhr.alexlebens.net
|
||||||
|
siteMonitor: http://hdhr.alexlebens.net
|
||||||
|
statusStyle: dot
|
||||||
|
- Pi KVM:
|
||||||
|
icon: pikvm.png
|
||||||
|
description: IP KVM
|
||||||
|
href: https://pikvm.alexlebens.net
|
||||||
|
siteMonitor: https://pikvm.alexlebens.net
|
||||||
|
statusStyle: dot
|
||||||
|
- Storage:
|
||||||
|
- Ceph:
|
||||||
|
icon: ceph.png
|
||||||
|
description: Clustered storage
|
||||||
|
href: https://ceph.alexlebens.net
|
||||||
|
siteMonitor: http://rook-ceph-mgr-dashboard.rook-ceph:7000
|
||||||
|
statusStyle: dot
|
||||||
|
- PGAdmin:
|
||||||
|
icon: pgadmin.png
|
||||||
|
description: Postgresql console
|
||||||
|
href: https://pgadmin.alexlebens.net
|
||||||
|
siteMonitor: http://pgadmin-pgadmin4.pgadmin:80
|
||||||
|
statusStyle: dot
|
||||||
|
- Vault:
|
||||||
|
icon: vault.png
|
||||||
|
description: Secret management
|
||||||
|
href: https://vault.alexlebens.net
|
||||||
|
siteMonitor: http://vault.vault:8200
|
||||||
|
statusStyle: dot
|
||||||
|
- Minio:
|
||||||
|
icon: minio.png
|
||||||
|
description: Operator for Minio S3 storage
|
||||||
|
href: https://minio.alexlebens.net
|
||||||
|
siteMonitor: http://console.minio-operator:9090
|
||||||
|
statusStyle: dot
|
||||||
|
- Minio - Outline:
|
||||||
|
icon: minio.png
|
||||||
|
description: Tenant for Outline S3 storage
|
||||||
|
href: https://minio-outline.alexlebens.net
|
||||||
|
siteMonitor: http://minio-outline-console.outline:9090
|
||||||
|
statusStyle: dot
|
||||||
|
- Minio - Penpot:
|
||||||
|
icon: minio.png
|
||||||
|
description: Tenant for Penpot S3 storage
|
||||||
|
href: https://minio-penpot.alexlebens.net
|
||||||
|
siteMonitor: http://minio-penpot-console.penpot:9090
|
||||||
|
statusStyle: dot
|
||||||
|
bookmarks:
|
||||||
|
- External Services:
|
||||||
|
- Github:
|
||||||
|
- abbr: GH
|
||||||
|
href: https://github.com/alexlebens/alexlebens-net
|
||||||
|
- Renovate:
|
||||||
|
- abbr: RN
|
||||||
|
href: https://developer.mend.io/[platform]/alexlebens/alexlebens-net
|
||||||
|
- AWS:
|
||||||
|
- abbr: AW
|
||||||
|
href: https://aws.amazon.com/console/
|
||||||
|
- Cloudflare:
|
||||||
|
- abbr: CF
|
||||||
|
href: https://dash.cloudflare.com/b76e303258b84076ee01fd0f515c0768
|
||||||
|
- Tailscale:
|
||||||
|
- abbr: TS
|
||||||
|
href: https://login.tailscale.com/admin/machines
|
||||||
|
- ProtonVPN:
|
||||||
|
- abbr: PV
|
||||||
|
href: https://account.protonvpn.com/
|
||||||
|
- Pushover:
|
||||||
|
- abbr: PO
|
||||||
|
href: https://pushover.net
|
||||||
|
- ReCaptcha:
|
||||||
|
- abbr: RC
|
||||||
|
href: https://www.google.com/recaptcha/admin/site/698983587
|
||||||
|
- Dashboard Icons:
|
||||||
|
- abbr: DI
|
||||||
|
href: https://github.com/walkxcode/dashboard-icons/tree/main/png
|
||||||
|
settings:
|
||||||
|
favicon: https://alexlebens-dev.nyc3.digitaloceanspaces.com/cl02do/assets/icon_white.png
|
||||||
|
headerStyle: clean
|
||||||
|
hideVersion: true
|
||||||
|
color: slate
|
||||||
|
background:
|
||||||
|
image: https://alexlebens-dev.nyc3.digitaloceanspaces.com/cl02do/assets/background.jpg
|
||||||
|
theme: dark
|
||||||
|
disableCollapse: true
|
||||||
|
layout:
|
||||||
|
- Media:
|
||||||
|
tab: Apps
|
||||||
|
icon: mdi-multimedia-#ffffff
|
||||||
|
- Applications:
|
||||||
|
tab: Apps
|
||||||
|
icon: mdi-application-#ffffff
|
||||||
|
- Code:
|
||||||
|
tab: Tools
|
||||||
|
icon: mdi-code-braces-box-#ffffff
|
||||||
|
- Monitoring:
|
||||||
|
tab: Tools
|
||||||
|
icon: mdi-chart-bar-#ffffff
|
||||||
|
- Management:
|
||||||
|
tab: Tools
|
||||||
|
icon: mdi-content-save-cog-#ffffff
|
||||||
|
- Services:
|
||||||
|
tab: Services
|
||||||
|
icon: mdi-server-network-#ffffff
|
||||||
|
- Hardware:
|
||||||
|
tab: Services
|
||||||
|
icon: mdi-lan-connect-#ffffff
|
||||||
|
- Storage:
|
||||||
|
tab: Services
|
||||||
|
icon: mdi-harddisk-#ffffff
|
||||||
|
- External Services:
|
||||||
|
tab: Bookmarks
|
||||||
|
icon: mdi-cloud-#ffffff
|
||||||
11
clusters/cl01tl/applications/jellyfin/Chart.yaml
Normal file
11
clusters/cl01tl/applications/jellyfin/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: jellyfin
|
||||||
|
version: 0.0.1
|
||||||
|
sources:
|
||||||
|
- https://github.com/jellyfin/jellyfin
|
||||||
|
- https://github.com/loeken/helm-charts/tree/main/charts/jellyfin
|
||||||
|
dependencies:
|
||||||
|
- name: jellyfin
|
||||||
|
version: 10.9.1
|
||||||
|
repository: https://loeken.github.io/helm-charts
|
||||||
|
appVersion: 10.8.13
|
||||||
@@ -0,0 +1,40 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: jellyfin-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: jellyfin-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: jellyfin-youtube-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: jellyfin-youtube-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadOnlyMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
@@ -0,0 +1,52 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: jellyfin-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: {{ .Values.storage.storage.nfs.path }}
|
||||||
|
server: {{ .Values.storage.storage.nfs.server }}
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: jellyfin-youtube-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadOnlyMany
|
||||||
|
nfs:
|
||||||
|
path: {{ .Values.storage.youtube.nfs.path }}
|
||||||
|
server: {{ .Values.storage.youtube.nfs.server }}
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
55
clusters/cl01tl/applications/jellyfin/values.yaml
Normal file
55
clusters/cl01tl/applications/jellyfin/values.yaml
Normal file
@@ -0,0 +1,55 @@
|
|||||||
|
jellyfin:
|
||||||
|
env:
|
||||||
|
TZ: US/Central
|
||||||
|
ingress:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
ingressClassName: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
hosts:
|
||||||
|
- host: jellyfin.alexlebens.net
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- secretName: jellyfin-secret-tls
|
||||||
|
hosts:
|
||||||
|
- jellyfin.alexlebens.net
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /config
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 40Gi
|
||||||
|
cache:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /cache
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 40Gi
|
||||||
|
media:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /mnt/store
|
||||||
|
type: pvc
|
||||||
|
existingClaim: jellyfin-nfs-storage
|
||||||
|
youtube:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /youtube
|
||||||
|
type: pvc
|
||||||
|
existingClaim: jellyfin-youtube-nfs-storage
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
gpu.intel.com/i915: 1
|
||||||
|
limits:
|
||||||
|
gpu.intel.com/i915: 1
|
||||||
|
storage:
|
||||||
|
storage:
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
youtube:
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage/YouTube
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
32
clusters/cl01tl/applications/kyoo/Chart.yaml
Normal file
32
clusters/cl01tl/applications/kyoo/Chart.yaml
Normal file
@@ -0,0 +1,32 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: kyoo
|
||||||
|
version: 1.0.0
|
||||||
|
description: A Helm chart for deploying Kyoo
|
||||||
|
keywords:
|
||||||
|
- kyoo
|
||||||
|
- media
|
||||||
|
sources:
|
||||||
|
- https://github.com/zoriya/Kyoo
|
||||||
|
- https://github.com/rabbitmq/rabbitmq-server
|
||||||
|
- https://github.com/bitnami/charts/tree/main/bitnami/rabbitmq
|
||||||
|
- https://github.com/meilisearch/meilisearch
|
||||||
|
- https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/postgres-cluster
|
||||||
|
maintainers:
|
||||||
|
- name: alexlebens
|
||||||
|
dependencies:
|
||||||
|
- name: app-template
|
||||||
|
repository: https://bjw-s.github.io/helm-charts/
|
||||||
|
version: 3.1.0
|
||||||
|
- name: rabbitmq
|
||||||
|
version: 14.1.4
|
||||||
|
repository: https://charts.bitnami.com/bitnami
|
||||||
|
- name: meilisearch
|
||||||
|
version: 0.7.0
|
||||||
|
repository: https://meilisearch.github.io/meilisearch-kubernetes
|
||||||
|
- name: postgres-cluster
|
||||||
|
alias: postgres-16-cluster
|
||||||
|
version: 3.0.0
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
icon: https://raw.githubusercontent.com/zoriya/Kyoo/master/icons/icon-256x256.png
|
||||||
|
appVersion: v4.5.0
|
||||||
183
clusters/cl01tl/applications/kyoo/templates/external-secret.yaml
Normal file
183
clusters/cl01tl/applications/kyoo/templates/external-secret.yaml
Normal file
@@ -0,0 +1,183 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: kyoo-key-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-key-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: key
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /kyoo/authentication
|
||||||
|
metadataPolicy: None
|
||||||
|
property: key
|
||||||
|
- secretKey: kyoo
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /kyoo/authentication
|
||||||
|
metadataPolicy: None
|
||||||
|
property: kyoo
|
||||||
|
- secretKey: tmdb
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /kyoo/authentication
|
||||||
|
metadataPolicy: None
|
||||||
|
property: tmdb
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: kyoo-api-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-api-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: kyoo
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /kyoo/api
|
||||||
|
metadataPolicy: None
|
||||||
|
property: kyoo
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: kyoo-oidc-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-oidc-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: auth
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: client
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/kyoo
|
||||||
|
metadataPolicy: None
|
||||||
|
property: client
|
||||||
|
- secretKey: secret
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/kyoo
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: kyoo-rabbitmq-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-rabbitmq-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: rabbitmq
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: password
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /kyoo/rabbitmq
|
||||||
|
metadataPolicy: None
|
||||||
|
property: password
|
||||||
|
- secretKey: erlang
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /kyoo/rabbitmq
|
||||||
|
metadataPolicy: None
|
||||||
|
property: erlang
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: kyoo-meilisearch-master-key-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-meilisearch-master-key-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: meilisearch
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: MEILI_MASTER_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /kyoo/meilisearch
|
||||||
|
metadataPolicy: None
|
||||||
|
property: MEILI_MASTER_KEY
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: kyoo-postgresql-16-cluster-backup-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-postgresql-16-cluster-backup-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: ACCESS_KEY_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-kyoo-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: access_key
|
||||||
|
- secretKey: ACCESS_SECRET_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-kyoo-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret_key
|
||||||
@@ -0,0 +1,32 @@
|
|||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: IngressRoute
|
||||||
|
metadata:
|
||||||
|
name: kyoo
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- websecure
|
||||||
|
routes:
|
||||||
|
- kind: Rule
|
||||||
|
match: Host(`kyoo.alexlebens.net`)
|
||||||
|
priority: 10
|
||||||
|
services:
|
||||||
|
- kind: Service
|
||||||
|
name: kyoo-front
|
||||||
|
port: 8901
|
||||||
|
- kind: Rule
|
||||||
|
match: Host(`kyoo.alexlebens.net`) && PathPrefix(`/api/`)
|
||||||
|
middlewares:
|
||||||
|
- name: kyoo-strip-prefix
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
priority: 15
|
||||||
|
services:
|
||||||
|
- kind: Service
|
||||||
|
name: kyoo-back
|
||||||
|
port: 5000
|
||||||
15
clusters/cl01tl/applications/kyoo/templates/middleware.yaml
Normal file
15
clusters/cl01tl/applications/kyoo/templates/middleware.yaml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: kyoo-strip-prefix
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-strip-prefix
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: auth
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
stripPrefix:
|
||||||
|
prefixes:
|
||||||
|
- /api/
|
||||||
@@ -0,0 +1,229 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-anime-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-anime-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-anime-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-anime-movies-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-anime-movies-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-anime-movies-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-documentaries-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-documentaries-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-documentaries-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-documentary-shows-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-documentary-shows-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-documentary-shows-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-movies-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-movies-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-movies-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-movies-4k-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-movies-4k-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-movies-4k-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-movies-classics-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-movies-classics-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-movies-classics-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-movies-foreign-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-movies-foreign-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-movies-foreign-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-stand-up-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-stand-up-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-stand-up-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-tv-shows-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-tv-shows-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-tv-shows-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: kyoo-tv-shows-4k-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-tv-shows-4k-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: kyoo-tv-shows-4k-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
@@ -0,0 +1,295 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-anime-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-anime-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage/Anime
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-anime-movies-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-anime-movies-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: "/volume2/Storage/Anime Movies"
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-documentaries-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-documentaries-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage/Documentaries
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-documentary-shows-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-documentary-shows-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: "/volume2/Storage/Documentary Shows"
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-movies-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-movies-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage/Movies
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-movies-4k-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-movies-4k-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: "/volume2/Storage/Movies 4K"
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-movies-classics-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-movies-classics-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: "/volume2/Storage/Movies Classics"
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-movies-foreign-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-movies-foreign-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: "/volume2/Storage/Movies Foreign"
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-stand-up-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-stand-up-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: "/volume2/Storage/Stand Up"
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-tv-shows-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-tv-shows-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: "/volume2/Storage/TV Shows"
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: kyoo-tv-shows-4k-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kyoo-tv-shows-4k-nfs-storage
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: "/volume2/Storage/TV Shows 4K"
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
590
clusters/cl01tl/applications/kyoo/values.yaml
Normal file
590
clusters/cl01tl/applications/kyoo/values.yaml
Normal file
@@ -0,0 +1,590 @@
|
|||||||
|
app-template:
|
||||||
|
controllers:
|
||||||
|
autosync:
|
||||||
|
type: deployment
|
||||||
|
replicas: 1
|
||||||
|
strategy: Recreate
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/zoriya/kyoo_autosync
|
||||||
|
tag: "4.5.0"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: RABBITMQ_HOST
|
||||||
|
value: kyoo-rabbitmq
|
||||||
|
- name: RABBITMQ_DEFAULT_USER
|
||||||
|
value: kyoo
|
||||||
|
- name: RABBITMQ_DEFAULT_PASS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-rabbitmq-secret
|
||||||
|
key: password
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 512Mi
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 128Mi
|
||||||
|
back:
|
||||||
|
type: deployment
|
||||||
|
replicas: 1
|
||||||
|
strategy: Recreate
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
initContainers:
|
||||||
|
migrations:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/zoriya/kyoo_migrations
|
||||||
|
tag: "4.5.0"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: POSTGRES_USER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-postgresql-16-cluster-app
|
||||||
|
key: username
|
||||||
|
- name: POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-postgresql-16-cluster-app
|
||||||
|
key: password
|
||||||
|
- name: POSTGRES_DB
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-postgresql-16-cluster-app
|
||||||
|
key: dbname
|
||||||
|
- name: POSTGRES_SERVER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-postgresql-16-cluster-app
|
||||||
|
key: host
|
||||||
|
- name: POSTGRES_PORT
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-postgresql-16-cluster-app
|
||||||
|
key: port
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 512Mi
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 256Mi
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/zoriya/kyoo_back
|
||||||
|
tag: "4.5.0"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: REQUIRE_ACCOUNT_VERIFICATION
|
||||||
|
value: "false"
|
||||||
|
- name: UNLOGGED_PERMISSIONS
|
||||||
|
value: overall.read
|
||||||
|
- name: DEFAULT_PERMISSIONS
|
||||||
|
value: overall.read,overall.play
|
||||||
|
- name: AUTHENTICATION_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-key-secret
|
||||||
|
key: key
|
||||||
|
- name: KYOO_APIKEYS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-key-secret
|
||||||
|
key: kyoo
|
||||||
|
- name: THEMOVIEDB_APIKEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-key-secret
|
||||||
|
key: tmdb
|
||||||
|
- name: PUBLIC_URL
|
||||||
|
value: https://kyoo.alexlebens.net
|
||||||
|
- name: POSTGRES_USER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-postgresql-16-cluster-app
|
||||||
|
key: username
|
||||||
|
- name: POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-postgresql-16-cluster-app
|
||||||
|
key: password
|
||||||
|
- name: POSTGRES_DB
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-postgresql-16-cluster-app
|
||||||
|
key: dbname
|
||||||
|
- name: POSTGRES_SERVER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-postgresql-16-cluster-app
|
||||||
|
key: host
|
||||||
|
- name: POSTGRES_PORT
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-postgresql-16-cluster-app
|
||||||
|
key: port
|
||||||
|
- name: OIDC_SERVICE_NAME
|
||||||
|
value: Authentik
|
||||||
|
- name: OIDC_SERVICE_LOGO
|
||||||
|
value: https://avatars.githubusercontent.com/u/82976448?s=200&v=4
|
||||||
|
- name: OIDC_SERVICE_AUTHORIZATION
|
||||||
|
value: https://authentik.alexlebens.net/application/o/authorize/
|
||||||
|
- name: OIDC_SERVICE_TOKEN
|
||||||
|
value: https://authentik.alexlebens.net/application/o/token/
|
||||||
|
- name: OIDC_SERVICE_PROFILE
|
||||||
|
value: https://authentik.alexlebens.net/application/o/userinfo/
|
||||||
|
- name: OIDC_SERVICE_SCOPE
|
||||||
|
value: "openid profile email"
|
||||||
|
- name: OIDC_SERVICE_CLIENTID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-oidc-secret
|
||||||
|
key: client
|
||||||
|
- name: OIDC_SERVICE_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-oidc-secret
|
||||||
|
key: secret
|
||||||
|
- name: TRANSCODER_URL
|
||||||
|
value: http://kyoo-transcoder.kyoo:7666
|
||||||
|
- name: MEILI_HOST
|
||||||
|
value: http://kyoo-meilisearch.kyoo:7700
|
||||||
|
- name: MEILI_MASTER_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-meilisearch-master-key-secret
|
||||||
|
key: MEILI_MASTER_KEY
|
||||||
|
- name: RABBITMQ_HOST
|
||||||
|
value: kyoo-rabbitmq
|
||||||
|
- name: RABBITMQ_DEFAULT_USER
|
||||||
|
value: kyoo
|
||||||
|
- name: RABBITMQ_DEFAULT_PASS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-rabbitmq-secret
|
||||||
|
key: password
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 5000m
|
||||||
|
memory: 5Gi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
front:
|
||||||
|
type: deployment
|
||||||
|
replicas: 1
|
||||||
|
strategy: Recreate
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/zoriya/kyoo_front
|
||||||
|
tag: "4.5.0"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: KYOO_URL
|
||||||
|
value: http://kyoo-back.kyoo:5000
|
||||||
|
- name: KYOO_APIKEYS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-key-secret
|
||||||
|
key: kyoo
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 512Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
matcher:
|
||||||
|
type: deployment
|
||||||
|
replicas: 1
|
||||||
|
strategy: Recreate
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/zoriya/kyoo_scanner
|
||||||
|
tag: "4.5.0"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
args:
|
||||||
|
- matcher
|
||||||
|
env:
|
||||||
|
- name: KYOO_URL
|
||||||
|
value: http://kyoo-back.kyoo:5000
|
||||||
|
- name: KYOO_APIKEYS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-key-secret
|
||||||
|
key: kyoo
|
||||||
|
- name: THEMOVIEDB_APIKEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-key-secret
|
||||||
|
key: tmdb
|
||||||
|
- name: LIBRARY_LANGUAGES
|
||||||
|
value: en
|
||||||
|
- name: LIBRARY_IGNORE_PATTERN
|
||||||
|
value: .*/[dD]ownloads?/.*
|
||||||
|
- name: RABBITMQ_HOST
|
||||||
|
value: kyoo-rabbitmq
|
||||||
|
- name: RABBITMQ_DEFAULT_USER
|
||||||
|
value: kyoo
|
||||||
|
- name: RABBITMQ_DEFAULT_PASS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-rabbitmq-secret
|
||||||
|
key: password
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 5000m
|
||||||
|
memory: 2Gi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
scanner:
|
||||||
|
type: deployment
|
||||||
|
replicas: 1
|
||||||
|
strategy: Recreate
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/zoriya/kyoo_scanner
|
||||||
|
tag: "4.5.0"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: KYOO_URL
|
||||||
|
value: http://kyoo-back.kyoo:5000
|
||||||
|
- name: KYOO_APIKEYS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-key-secret
|
||||||
|
key: kyoo
|
||||||
|
- name: THEMOVIEDB_APIKEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-key-secret
|
||||||
|
key: tmdb
|
||||||
|
- name: LIBRARY_LANGUAGES
|
||||||
|
value: en
|
||||||
|
- name: LIBRARY_IGNORE_PATTERN
|
||||||
|
value: .*/[dD]ownloads?/.*
|
||||||
|
- name: RABBITMQ_HOST
|
||||||
|
value: kyoo-rabbitmq
|
||||||
|
- name: RABBITMQ_DEFAULT_USER
|
||||||
|
value: kyoo
|
||||||
|
- name: RABBITMQ_DEFAULT_PASS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kyoo-rabbitmq-secret
|
||||||
|
key: password
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 5000m
|
||||||
|
memory: 2Gi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
transcoder:
|
||||||
|
type: deployment
|
||||||
|
replicas: 1
|
||||||
|
strategy: Recreate
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/zoriya/kyoo_transcoder
|
||||||
|
tag: "4.5.0"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: GOCODER_HWACCEL
|
||||||
|
value: qsv
|
||||||
|
- name: GOCODER_QSV_RENDERER
|
||||||
|
value: /dev/dri/renderD128
|
||||||
|
- name: GOCODER_PRESET
|
||||||
|
value: fast
|
||||||
|
- name: GOCODER_METADATA_ROOT
|
||||||
|
value: /metadata
|
||||||
|
- name: GOCODER_CACHE_ROOT
|
||||||
|
value: /cache
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 5000m
|
||||||
|
memory: 4Gi
|
||||||
|
gpu.intel.com/i915: 1
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 512Mi
|
||||||
|
gpu.intel.com/i915: 1
|
||||||
|
serviceAccount:
|
||||||
|
create: true
|
||||||
|
service:
|
||||||
|
back:
|
||||||
|
controller: back
|
||||||
|
ports:
|
||||||
|
http:
|
||||||
|
port: 5000
|
||||||
|
targetPort: 5000
|
||||||
|
protocol: HTTP
|
||||||
|
front:
|
||||||
|
controller: front
|
||||||
|
ports:
|
||||||
|
http:
|
||||||
|
port: 8901
|
||||||
|
targetPort: 8901
|
||||||
|
protocol: HTTP
|
||||||
|
transcoder:
|
||||||
|
controller: transcoder
|
||||||
|
ports:
|
||||||
|
http:
|
||||||
|
port: 7666
|
||||||
|
targetPort: 7666
|
||||||
|
protocol: HTTP
|
||||||
|
persistence:
|
||||||
|
back:
|
||||||
|
storageClass: ceph-block
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 50Gi
|
||||||
|
retain: true
|
||||||
|
advancedMounts:
|
||||||
|
back:
|
||||||
|
main:
|
||||||
|
- path: /metadata
|
||||||
|
readOnly: false
|
||||||
|
metadata:
|
||||||
|
storageClass: ceph-block
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 10Gi
|
||||||
|
retain: true
|
||||||
|
advancedMounts:
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: /metadata
|
||||||
|
readOnly: false
|
||||||
|
cache:
|
||||||
|
type: emptyDir
|
||||||
|
advancedMounts:
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: /cache
|
||||||
|
readOnly: false
|
||||||
|
anime:
|
||||||
|
existingClaim: kyoo-anime-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: "/video/Anime"
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: "/video/Anime"
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: "/video/Anime"
|
||||||
|
readOnly: true
|
||||||
|
anime-movies:
|
||||||
|
existingClaim: kyoo-anime-movies-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: "/video/Anime Movies"
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: "/video/Anime Movies"
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: "/video/Anime Movies"
|
||||||
|
readOnly: true
|
||||||
|
documentaries:
|
||||||
|
existingClaim: kyoo-documentaries-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: /video/Documentaries
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: /video/Documentaries
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: /video/Documentaries
|
||||||
|
readOnly: true
|
||||||
|
documentary-shows:
|
||||||
|
existingClaim: kyoo-documentary-shows-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: "/video/Documentary Shows"
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: "/video/Documentary Shows"
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: "/video/Documentary Shows"
|
||||||
|
readOnly: true
|
||||||
|
movies:
|
||||||
|
existingClaim: kyoo-movies-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies"
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies"
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies"
|
||||||
|
readOnly: true
|
||||||
|
movies-4k:
|
||||||
|
existingClaim: kyoo-movies-4k-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies 4K"
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies 4K"
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies 4K"
|
||||||
|
readOnly: true
|
||||||
|
movies-classics:
|
||||||
|
existingClaim: kyoo-movies-classics-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies Classics"
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies Classics"
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies Classics"
|
||||||
|
readOnly: true
|
||||||
|
movies-foreign:
|
||||||
|
existingClaim: kyoo-movies-foreign-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies Foreign"
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies Foreign"
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: "/video/Movies Foreign"
|
||||||
|
readOnly: true
|
||||||
|
stand-up:
|
||||||
|
existingClaim: kyoo-stand-up-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: "/video/Stand Up"
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: "/video/Stand Up"
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: "/video/Stand Up"
|
||||||
|
readOnly: true
|
||||||
|
tv-shows:
|
||||||
|
existingClaim: kyoo-tv-shows-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: "/video/TV Shows"
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: "/video/TV Shows"
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: "/video/TV Shows"
|
||||||
|
readOnly: true
|
||||||
|
tv-shows-4k:
|
||||||
|
existingClaim: kyoo-tv-shows-4k-nfs-storage
|
||||||
|
advancedMounts:
|
||||||
|
scanner:
|
||||||
|
main:
|
||||||
|
- path: "/video/TV Shows 4K"
|
||||||
|
readOnly: true
|
||||||
|
matcher:
|
||||||
|
main:
|
||||||
|
- path: "/video/TV Shows 4K"
|
||||||
|
readOnly: true
|
||||||
|
transcoder:
|
||||||
|
main:
|
||||||
|
- path: "/video/TV Shows 4K"
|
||||||
|
readOnly: true
|
||||||
|
rabbitmq:
|
||||||
|
auth:
|
||||||
|
username: kyoo
|
||||||
|
existingPasswordSecret: kyoo-rabbitmq-secret
|
||||||
|
existingSecretPasswordKey: password
|
||||||
|
existingErlangSecret: kyoo-rabbitmq-secret
|
||||||
|
existingSecretErlangKey: erlang
|
||||||
|
extraConfiguration: |-
|
||||||
|
default_vhost = /
|
||||||
|
default_permissions.configure = .*
|
||||||
|
default_permissions.read = .*
|
||||||
|
default_permissions.write = .*
|
||||||
|
meilisearch:
|
||||||
|
environment:
|
||||||
|
MEILI_NO_ANALYTICS: true
|
||||||
|
MEILI_ENV: production
|
||||||
|
auth:
|
||||||
|
existingMasterKeySecret: kyoo-meilisearch-master-key-secret
|
||||||
|
service:
|
||||||
|
type: ClusterIP
|
||||||
|
port: 7700
|
||||||
|
persistence:
|
||||||
|
enabled: true
|
||||||
|
storageClass: ceph-block
|
||||||
|
size: 10Gi
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 200m
|
||||||
|
memory: 2Gi
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 128Mi
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
postgres-16-cluster:
|
||||||
|
mode: standalone
|
||||||
|
cluster:
|
||||||
|
walStorage:
|
||||||
|
storageClass: local-path
|
||||||
|
storage:
|
||||||
|
storageClass: local-path
|
||||||
|
monitoring:
|
||||||
|
enabled: true
|
||||||
|
backup:
|
||||||
|
enabled: true
|
||||||
|
endpointURL: https://s3.us-east-2.amazonaws.com
|
||||||
|
destinationPath: s3://cl01tl-postgresql-backups/kyoo
|
||||||
|
endpointCredentials: kyoo-postgresql-16-cluster-backup-secret
|
||||||
|
backupIndex: 1
|
||||||
|
retentionPolicy: 14d
|
||||||
11
clusters/cl01tl/applications/libation/Chart.yaml
Normal file
11
clusters/cl01tl/applications/libation/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: libation
|
||||||
|
version: 0.0.5
|
||||||
|
sources:
|
||||||
|
- https://github.com/rmcrackan/Libation
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/libation
|
||||||
|
dependencies:
|
||||||
|
- name: libation
|
||||||
|
version: 0.0.6
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: "11.1.0"
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: libation-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: libation-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: libation-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: {{ .Values.storage.storage.nfs.path }}
|
||||||
|
server: {{ .Values.storage.storage.nfs.server }}
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
14
clusters/cl01tl/applications/libation/values.yaml
Normal file
14
clusters/cl01tl/applications/libation/values.yaml
Normal file
@@ -0,0 +1,14 @@
|
|||||||
|
libation:
|
||||||
|
libation:
|
||||||
|
job:
|
||||||
|
schedule: "0 * * * *"
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
storageClassName: nfs-client
|
||||||
|
books:
|
||||||
|
claimName: libation-nfs-storage
|
||||||
|
storage:
|
||||||
|
storage:
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage/Audiobooks/
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
11
clusters/cl01tl/applications/navidrome/Chart.yaml
Normal file
11
clusters/cl01tl/applications/navidrome/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: navidrome
|
||||||
|
version: 0.0.2
|
||||||
|
sources:
|
||||||
|
- https://github.com/navidrome/navidrome
|
||||||
|
- https://github.com/0xEmma/helm-charts/tree/main/charts/navidrome
|
||||||
|
dependencies:
|
||||||
|
- name: navidrome
|
||||||
|
version: 0.0.6
|
||||||
|
repository: https://0xemma.github.io/helm-charts
|
||||||
|
appVersion: "0.51.1"
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: navidrome-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: navidrome-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: navidrome-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: {{ .Values.storage.storage.nfs.path }}
|
||||||
|
server: {{ .Values.storage.storage.nfs.server }}
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
43
clusters/cl01tl/applications/navidrome/values.yaml
Normal file
43
clusters/cl01tl/applications/navidrome/values.yaml
Normal file
@@ -0,0 +1,43 @@
|
|||||||
|
navidrome:
|
||||||
|
image:
|
||||||
|
repository: deluan/navidrome
|
||||||
|
tag: "0.52.5"
|
||||||
|
ingress:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
ingressClassName: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
hosts:
|
||||||
|
- host: navidrome.alexlebens.net
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- secretName: navidrome-secret-tls
|
||||||
|
hosts:
|
||||||
|
- navidrome.alexlebens.net
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /data
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 2Gi
|
||||||
|
music:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /mnt/store
|
||||||
|
type: pvc
|
||||||
|
existingClaim: navidrome-nfs-storage
|
||||||
|
env:
|
||||||
|
ND_MUSICFOLDER: /mnt/store/Music
|
||||||
|
ND_SCANSCHEDULE: 1h
|
||||||
|
ND_LOGLEVEL: info
|
||||||
|
ND_SESSIONTIMEOUT: 24h
|
||||||
|
ND_BASEURL: "/"
|
||||||
|
storage:
|
||||||
|
storage:
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
21
clusters/cl01tl/applications/outline/Chart.yaml
Normal file
21
clusters/cl01tl/applications/outline/Chart.yaml
Normal file
@@ -0,0 +1,21 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: outline
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/outline/outline
|
||||||
|
- https://github.com/minio/operator
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/outline
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/postgres-cluster
|
||||||
|
dependencies:
|
||||||
|
- name: outline
|
||||||
|
version: 0.6.1
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
- name: tenant
|
||||||
|
version: 5.0.15
|
||||||
|
alias: minio
|
||||||
|
repository: https://operator.min.io/
|
||||||
|
- name: postgres-cluster
|
||||||
|
alias: postgres-16-cluster
|
||||||
|
version: 3.0.0
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: v0.75.2
|
||||||
@@ -0,0 +1,176 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: outline-key-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: secret-key
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /outline/key
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret-key
|
||||||
|
- secretKey: utils-key
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /outline/key
|
||||||
|
metadataPolicy: None
|
||||||
|
property: utils-key
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: outline-oidc-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: client
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/outline
|
||||||
|
metadataPolicy: None
|
||||||
|
property: client
|
||||||
|
- secretKey: secret
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/outline
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: outline-bucket-user-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: outline-bucket-user-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: AWS_ACCESS_KEY_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /outline/minio/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: AWS_ACCESS_KEY_ID
|
||||||
|
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /outline/minio/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: AWS_SECRET_ACCESS_KEY
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: outline-minio-root-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: outline-bucket-auth-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: config.env
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /outline/minio/root
|
||||||
|
metadataPolicy: None
|
||||||
|
property: config.env
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: outline-minio-config-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: outline-bucket-auth-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: config.env
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /outline/minio/config
|
||||||
|
metadataPolicy: None
|
||||||
|
property: config.env
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: outline-postgresql-16-cluster-backup-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: ACCESS_KEY_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-outline-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: access_key
|
||||||
|
- secretKey: ACCESS_SECRET_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-outline-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret_key
|
||||||
123
clusters/cl01tl/applications/outline/values.yaml
Normal file
123
clusters/cl01tl/applications/outline/values.yaml
Normal file
@@ -0,0 +1,123 @@
|
|||||||
|
outline:
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
className: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
host: outline.alexlebens.net
|
||||||
|
persistence:
|
||||||
|
type: s3
|
||||||
|
s3:
|
||||||
|
credentialsSecret: outline-bucket-user-secret
|
||||||
|
region: us-east-1
|
||||||
|
bucketName: outline
|
||||||
|
bucketUrl: https://minio-outline-api.alexlebens.net/outline
|
||||||
|
forcePathStyle: false
|
||||||
|
outline:
|
||||||
|
url: https://outline.alexlebens.net
|
||||||
|
secretKey:
|
||||||
|
existingSecretName: outline-key-secret
|
||||||
|
existingSecretKey: secret-key
|
||||||
|
utilsSecret:
|
||||||
|
existingSecretName: outline-key-secret
|
||||||
|
existingSecretKey: utils-key
|
||||||
|
database:
|
||||||
|
usernameSecret:
|
||||||
|
existingSecretName: outline-postgresql-16-cluster-app
|
||||||
|
existingSecretKey: username
|
||||||
|
passwordSecret:
|
||||||
|
existingSecretName: outline-postgresql-16-cluster-app
|
||||||
|
existingSecretKey: password
|
||||||
|
databaseName:
|
||||||
|
existingSecretName: outline-postgresql-16-cluster-app
|
||||||
|
existingSecretKey: dbname
|
||||||
|
databaseHost:
|
||||||
|
existingSecretName: outline-postgresql-16-cluster-app
|
||||||
|
existingSecretKey: host
|
||||||
|
databasePort:
|
||||||
|
existingSecretName: outline-postgresql-16-cluster-app
|
||||||
|
existingSecretKey: port
|
||||||
|
auth:
|
||||||
|
oidc:
|
||||||
|
enabled: true
|
||||||
|
clientId:
|
||||||
|
existingSecretName: outline-oidc-secret
|
||||||
|
existingSecretKey: client
|
||||||
|
clientSecret:
|
||||||
|
existingSecretName: outline-oidc-secret
|
||||||
|
existingSecretKey: secret
|
||||||
|
authUri: https://authentik.alexlebens.net/application/o/authorize/
|
||||||
|
tokenUri: https://authentik.alexlebens.net/application/o/token/
|
||||||
|
userinfoUri: https://authentik.alexlebens.net/application/o/userinfo/
|
||||||
|
usernameClaim: email
|
||||||
|
displayName: Authentik
|
||||||
|
scopes: openid profile email
|
||||||
|
minio:
|
||||||
|
existingSecret:
|
||||||
|
name: outline-minio-root-secret
|
||||||
|
tenant:
|
||||||
|
name: minio-outline
|
||||||
|
configuration:
|
||||||
|
name: outline-minio-config-secret
|
||||||
|
pools:
|
||||||
|
- servers: 3
|
||||||
|
name: pool
|
||||||
|
volumesPerServer: 2
|
||||||
|
size: 10Gi
|
||||||
|
storageClassName: ceph-block
|
||||||
|
mountPath: /export
|
||||||
|
subPath: /data
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
port: 9000
|
||||||
|
protocol: http
|
||||||
|
certificate:
|
||||||
|
requestAutoCert: false
|
||||||
|
ingress:
|
||||||
|
api:
|
||||||
|
enabled: true
|
||||||
|
ingressClassName: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
tls:
|
||||||
|
- secretName: minio-outline-api-secret-tls
|
||||||
|
hosts:
|
||||||
|
- minio-outline-api.alexlebens.net
|
||||||
|
host: minio-outline-api.alexlebens.net
|
||||||
|
path: /
|
||||||
|
pathType: Prefix
|
||||||
|
console:
|
||||||
|
enabled: true
|
||||||
|
ingressClassName: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
tls:
|
||||||
|
- secretName: minio-outline-console-secret-tls
|
||||||
|
hosts:
|
||||||
|
- minio-outline.alexlebens.net
|
||||||
|
host: minio-outline.alexlebens.net
|
||||||
|
path: /
|
||||||
|
pathType: Prefix
|
||||||
|
postgres-16-cluster:
|
||||||
|
mode: standalone
|
||||||
|
kubernetesClusterName: cl01tl
|
||||||
|
cluster:
|
||||||
|
walStorage:
|
||||||
|
storageClass: local-path
|
||||||
|
storage:
|
||||||
|
storageClass: local-path
|
||||||
|
monitoring:
|
||||||
|
enabled: true
|
||||||
|
backup:
|
||||||
|
enabled: true
|
||||||
|
endpointURL: https://s3.us-east-2.amazonaws.com
|
||||||
|
destinationPath: s3://cl01tl-postgresql-backups/outline
|
||||||
|
endpointCredentials: outline-postgresql-16-cluster-backup-secret
|
||||||
|
backupIndex: 1
|
||||||
|
retentionPolicy: 14d
|
||||||
25
clusters/cl01tl/applications/penpot/Chart.yaml
Normal file
25
clusters/cl01tl/applications/penpot/Chart.yaml
Normal file
@@ -0,0 +1,25 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: penpot
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/penpot/penpot
|
||||||
|
- https://github.com/minio/operator
|
||||||
|
- https://github.com/bitnami/charts/tree/main/bitnami/redis
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/penpot
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/postgres-cluster
|
||||||
|
dependencies:
|
||||||
|
- name: penpot
|
||||||
|
version: 0.1.0
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
- name: redis
|
||||||
|
version: 19.3.2
|
||||||
|
repository: https://charts.bitnami.com/bitnami
|
||||||
|
- name: tenant
|
||||||
|
version: 5.0.15
|
||||||
|
alias: minio
|
||||||
|
repository: https://operator.min.io/
|
||||||
|
- name: postgres-cluster
|
||||||
|
alias: postgres-16-cluster
|
||||||
|
version: 3.0.0
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: 2.0.0
|
||||||
@@ -0,0 +1,169 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: penpot-key-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: penpot-key-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: key
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /penpot/key
|
||||||
|
metadataPolicy: None
|
||||||
|
property: key
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: penpot-oidc-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: penpot-oidc-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: auth
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: client
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/penpot
|
||||||
|
metadataPolicy: None
|
||||||
|
property: client
|
||||||
|
- secretKey: secret
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/penpot
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: penpot-bucket-user-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: penpot-bucket-user-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: AWS_ACCESS_KEY_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /penpot/minio/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: AWS_ACCESS_KEY_ID
|
||||||
|
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /penpot/minio/auth
|
||||||
|
metadataPolicy: None
|
||||||
|
property: AWS_SECRET_ACCESS_KEY
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: penpot-minio-root-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: penpot-bucket-auth-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: config.env
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /penpot/minio/root
|
||||||
|
metadataPolicy: None
|
||||||
|
property: config.env
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: penpot-minio-config-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: penpot-minio-config-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: config.env
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /penpot/minio/config
|
||||||
|
metadataPolicy: None
|
||||||
|
property: config.env
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: penpot-postgresql-16-cluster-backup-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: penpot-postgresql-16-cluster-backup-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: ACCESS_KEY_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-penpot-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: access_key
|
||||||
|
- secretKey: ACCESS_SECRET_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-penpot-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret_key
|
||||||
135
clusters/cl01tl/applications/penpot/values.yaml
Normal file
135
clusters/cl01tl/applications/penpot/values.yaml
Normal file
@@ -0,0 +1,135 @@
|
|||||||
|
penpot:
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
hosts:
|
||||||
|
- host: penpot.alexlebens.net
|
||||||
|
tls:
|
||||||
|
- secretName: penpot-secret-tls
|
||||||
|
hosts:
|
||||||
|
- penpot.alexlebens.net
|
||||||
|
persistence:
|
||||||
|
enabled: true
|
||||||
|
storageClass: ceph-block
|
||||||
|
size: 8Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
config:
|
||||||
|
publicURI: https://penpot.alexlebens.net
|
||||||
|
flags: enable-registration enable-insecure-register enable-login enable-login-with-oidc disable-demo-users disable-demo-warning
|
||||||
|
apiSecretKey:
|
||||||
|
existingSecretName: penpot-key-secret
|
||||||
|
existingSecretKey: key
|
||||||
|
postgresql:
|
||||||
|
host: penpot-postgresql-16-cluster-rw.penpot.svc.cluster.local
|
||||||
|
port: 5432
|
||||||
|
database: app
|
||||||
|
existingSecret: penpot-postgresql-16-cluster-app
|
||||||
|
secretKeys:
|
||||||
|
usernameKey: username
|
||||||
|
passwordKey: password
|
||||||
|
redis:
|
||||||
|
host: penpot-redis-headless.penpot.svc.cluster.local
|
||||||
|
port: 6379
|
||||||
|
database: 0
|
||||||
|
assets:
|
||||||
|
storageBackend: assets-s3
|
||||||
|
s3:
|
||||||
|
region: us-east-1
|
||||||
|
bucket: penpot
|
||||||
|
endpointURI: https://minio-penpot-api.alexlebens.net/penpot
|
||||||
|
existingSecret: penpot-bucket-user-secret
|
||||||
|
secretKeys:
|
||||||
|
accessKeyIDKey: AWS_ACCESS_KEY_ID
|
||||||
|
secretAccessKey: AWS_SECRET_ACCESS_KEY
|
||||||
|
telemetryEnabled: false
|
||||||
|
providers:
|
||||||
|
oidc:
|
||||||
|
enabled: true
|
||||||
|
baseURI: https://authentik.alexlebens.net/application/o/
|
||||||
|
authURI: https://authentik.alexlebens.net/application/o/authorize/
|
||||||
|
tokenURI: https://authentik.alexlebens.net/application/o/token/
|
||||||
|
userURI: https://authentik.alexlebens.net/application/o/userinfo/
|
||||||
|
roles: ""
|
||||||
|
rolesAttribute: ""
|
||||||
|
scopes: "openid profile email"
|
||||||
|
nameAttribute: preferred_username
|
||||||
|
emailAttribute: email
|
||||||
|
existingSecret: penpot-oidc-secret
|
||||||
|
secretKeys:
|
||||||
|
oidcClientIDKey: client
|
||||||
|
oidcClientSecretKey: secret
|
||||||
|
redis:
|
||||||
|
architecture: standalone
|
||||||
|
auth:
|
||||||
|
enabled: false
|
||||||
|
minio:
|
||||||
|
existingSecret:
|
||||||
|
name: penpot-minio-root-secret
|
||||||
|
tenant:
|
||||||
|
name: minio-penpot
|
||||||
|
configuration:
|
||||||
|
name: penpot-minio-config-secret
|
||||||
|
pools:
|
||||||
|
- servers: 3
|
||||||
|
name: pool
|
||||||
|
volumesPerServer: 2
|
||||||
|
size: 10Gi
|
||||||
|
storageClassName: ceph-block
|
||||||
|
mountPath: /export
|
||||||
|
subPath: /data
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
port: 9000
|
||||||
|
protocol: http
|
||||||
|
certificate:
|
||||||
|
requestAutoCert: false
|
||||||
|
ingress:
|
||||||
|
api:
|
||||||
|
enabled: true
|
||||||
|
ingressClassName: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
tls:
|
||||||
|
- secretName: minio-penpot-api-secret-tls
|
||||||
|
hosts:
|
||||||
|
- minio-penpot-api.alexlebens.net
|
||||||
|
host: minio-penpot-api.alexlebens.net
|
||||||
|
path: /
|
||||||
|
pathType: Prefix
|
||||||
|
console:
|
||||||
|
enabled: true
|
||||||
|
ingressClassName: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
tls:
|
||||||
|
- secretName: minio-penpot-console-secret-tls
|
||||||
|
hosts:
|
||||||
|
- minio-penpot.alexlebens.net
|
||||||
|
host: minio-penpot.alexlebens.net
|
||||||
|
path: /
|
||||||
|
pathType: Prefix
|
||||||
|
postgres-16-cluster:
|
||||||
|
mode: standalone
|
||||||
|
kubernetesClusterName: cl01tl
|
||||||
|
cluster:
|
||||||
|
walStorage:
|
||||||
|
storageClass: local-path
|
||||||
|
storage:
|
||||||
|
storageClass: local-path
|
||||||
|
monitoring:
|
||||||
|
enabled: true
|
||||||
|
backup:
|
||||||
|
enabled: true
|
||||||
|
endpointURL: https://s3.us-east-2.amazonaws.com
|
||||||
|
destinationPath: s3://cl01tl-postgresql-backups/penpot
|
||||||
|
endpointCredentials: penpot-postgresql-16-cluster-backup-secret
|
||||||
|
backupIndex: 1
|
||||||
|
retentionPolicy: 14d
|
||||||
11
clusters/cl01tl/applications/plex/Chart.yaml
Normal file
11
clusters/cl01tl/applications/plex/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: plex
|
||||||
|
version: 0.0.1
|
||||||
|
sources:
|
||||||
|
- https://www.plex.tv/
|
||||||
|
- https://github.com/k8s-home-lab/helm-charts/tree/master/charts/stable/plex
|
||||||
|
dependencies:
|
||||||
|
- name: plex
|
||||||
|
version: 7.1.4
|
||||||
|
repository: https://k8s-home-lab.github.io/helm-charts/
|
||||||
|
appVersion: 1.40.0.7998-c29d4c0c8
|
||||||
@@ -0,0 +1,40 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: plex-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: plex-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: plex-config
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.storage.config.storageSize }}
|
||||||
|
storageClassName: {{ .Values.storage.config.storageClassName }}
|
||||||
|
volumeMode: {{ .Values.storage.config.volumeMode }}
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: plex-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: {{ .Values.storage.media.nfs.path }}
|
||||||
|
server: {{ .Values.storage.media.nfs.server }}
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
78
clusters/cl01tl/applications/plex/values.yaml
Normal file
78
clusters/cl01tl/applications/plex/values.yaml
Normal file
@@ -0,0 +1,78 @@
|
|||||||
|
plex:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/onedr0p/plex
|
||||||
|
tag: 1.40.2.8395-c67dce28e
|
||||||
|
env:
|
||||||
|
ADVERTISE_IP: "https://plex.alexlebens.net:443/"
|
||||||
|
ALLOWED_NETWORKS: "10.0.0.0/8,192.168.1.0/24"
|
||||||
|
service:
|
||||||
|
main:
|
||||||
|
primary: true
|
||||||
|
type: LoadBalancer
|
||||||
|
annotations:
|
||||||
|
metallb.universe.tf/allow-shared-ip: "external"
|
||||||
|
externalIPs:
|
||||||
|
- 192.168.1.17
|
||||||
|
- 192.168.1.16
|
||||||
|
- 192.168.1.15
|
||||||
|
ports:
|
||||||
|
http:
|
||||||
|
port: 32400
|
||||||
|
ingress:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
ingressClassName: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
hosts:
|
||||||
|
- host: plex.alexlebens.net
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- secretName: plex-secret-tls
|
||||||
|
hosts:
|
||||||
|
- plex.alexlebens.net
|
||||||
|
hostNetwork: false
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
enabled: true
|
||||||
|
existingClaim: plex-config
|
||||||
|
transcode:
|
||||||
|
enabled: true
|
||||||
|
type: emptyDir
|
||||||
|
media:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /mnt/store
|
||||||
|
type: pvc
|
||||||
|
existingClaim: plex-nfs-storage
|
||||||
|
podSecurityContext:
|
||||||
|
runAsUser: 568
|
||||||
|
runAsGroup: 568
|
||||||
|
fsGroup: 568
|
||||||
|
fsGroupChangePolicy: "OnRootMismatch"
|
||||||
|
supplementalGroups:
|
||||||
|
- 44
|
||||||
|
- 100
|
||||||
|
- 109
|
||||||
|
- 65539
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
gpu.intel.com/i915: 1
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
limits:
|
||||||
|
gpu.intel.com/i915: 1
|
||||||
|
cpu: 4000m
|
||||||
|
memory: 4096Mi
|
||||||
|
storage:
|
||||||
|
config:
|
||||||
|
storageClassName: ceph-block
|
||||||
|
storageSize: 80Gi
|
||||||
|
volumeMode: Filesystem
|
||||||
|
media:
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
17
clusters/cl01tl/applications/taiga/Chart.yaml
Normal file
17
clusters/cl01tl/applications/taiga/Chart.yaml
Normal file
@@ -0,0 +1,17 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: taiga
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/taigaio
|
||||||
|
- https://github.com/rabbitmq/rabbitmq-server
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/taiga
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/postgres-cluster
|
||||||
|
dependencies:
|
||||||
|
- name: taiga
|
||||||
|
version: 0.2.2
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
- name: postgres-cluster
|
||||||
|
alias: postgres-16-cluster
|
||||||
|
version: 3.0.0
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: 6.7.7
|
||||||
@@ -0,0 +1,200 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: taiga-key-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: taiga-key-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: key
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /taiga/key
|
||||||
|
metadataPolicy: None
|
||||||
|
property: key
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: taiga-oidc-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: taiga-oidc-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: client
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/taiga
|
||||||
|
metadataPolicy: None
|
||||||
|
property: client
|
||||||
|
- secretKey: secret
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/taiga
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret
|
||||||
|
- secretKey: scopes
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/taiga
|
||||||
|
metadataPolicy: None
|
||||||
|
property: scopes
|
||||||
|
- secretKey: signatureAlgorithm
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/taiga
|
||||||
|
metadataPolicy: None
|
||||||
|
property: signatureAlgorithm
|
||||||
|
- secretKey: baseUrl
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/taiga
|
||||||
|
metadataPolicy: None
|
||||||
|
property: baseUrl
|
||||||
|
- secretKey: jwksEndpoint
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/taiga
|
||||||
|
metadataPolicy: None
|
||||||
|
property: jwksEndpoint
|
||||||
|
- secretKey: authorizationEndpoint
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/taiga
|
||||||
|
metadataPolicy: None
|
||||||
|
property: authorizationEndpoint
|
||||||
|
- secretKey: tokenEndpoint
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/taiga
|
||||||
|
metadataPolicy: None
|
||||||
|
property: tokenEndpoint
|
||||||
|
- secretKey: userEndpoint
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/taiga
|
||||||
|
metadataPolicy: None
|
||||||
|
property: userEndpoint
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: taiga-async-rabbitmq-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: taiga-async-rabbitmq-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: password
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /taiga/rabbitmq/async
|
||||||
|
metadataPolicy: None
|
||||||
|
property: password
|
||||||
|
- secretKey: erlang
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /taiga/rabbitmq/async
|
||||||
|
metadataPolicy: None
|
||||||
|
property: erlang
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: taiga-events-rabbitmq-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: taiga-events-rabbitmq-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: password
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /taiga/rabbitmq/events
|
||||||
|
metadataPolicy: None
|
||||||
|
property: password
|
||||||
|
- secretKey: erlang
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /taiga/rabbitmq/events
|
||||||
|
metadataPolicy: None
|
||||||
|
property: erlang
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: taiga-postgresql-16-cluster-backup-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: taiga-postgresql-16-cluster-backup-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: ACCESS_KEY_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-taiga-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: access_key
|
||||||
|
- secretKey: ACCESS_SECRET_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-taiga-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret_key
|
||||||
152
clusters/cl01tl/applications/taiga/values.yaml
Normal file
152
clusters/cl01tl/applications/taiga/values.yaml
Normal file
@@ -0,0 +1,152 @@
|
|||||||
|
taiga:
|
||||||
|
serviceAccount:
|
||||||
|
create: true
|
||||||
|
secretKey:
|
||||||
|
existingSecretName: taiga-key-secret
|
||||||
|
existingSecretKey: key
|
||||||
|
createInitialUser: false
|
||||||
|
enableTelemetry: false
|
||||||
|
publicRegisterEnabled: false
|
||||||
|
postgresql:
|
||||||
|
existingSecretName: taiga-postgresql-16-cluster-app
|
||||||
|
usernameKey: username
|
||||||
|
passwordKey: password
|
||||||
|
databaseNameKey: dbname
|
||||||
|
hostKey: host
|
||||||
|
portKey: port
|
||||||
|
oidc:
|
||||||
|
enabled: true
|
||||||
|
existingSecretName: taiga-oidc-secret
|
||||||
|
scopesKey: scopes
|
||||||
|
signatureAlgorithmKey: signatureAlgorithm
|
||||||
|
clientIdKey: client
|
||||||
|
clientSecretKey: secret
|
||||||
|
baseUrlKey: baseUrl
|
||||||
|
jwksEndpointKey: jwksEndpoint
|
||||||
|
authorizationEndpointKey: authorizationEndpoint
|
||||||
|
tokenEndpointKey: tokenEndpoint
|
||||||
|
userEndpointKey: userEndpoint
|
||||||
|
back:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/alexlebens/taiga-back-docker-oidc
|
||||||
|
tag: latest
|
||||||
|
pullPolicy: Always
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 1Gi
|
||||||
|
livenessProbe:
|
||||||
|
enabled: true
|
||||||
|
readinessProbe:
|
||||||
|
enabled: true
|
||||||
|
async:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/alexlebens/taiga-back-docker-oidc
|
||||||
|
tag: latest
|
||||||
|
pullPolicy: Always
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 1Gi
|
||||||
|
livenessProbe:
|
||||||
|
enabled: true
|
||||||
|
readinessProbe:
|
||||||
|
enabled: true
|
||||||
|
async-rabbitmq:
|
||||||
|
auth:
|
||||||
|
username: taiga
|
||||||
|
existingPasswordSecret: taiga-async-rabbitmq-secret
|
||||||
|
existingSecretPasswordKey: password
|
||||||
|
existingErlangSecret: taiga-async-rabbitmq-secret
|
||||||
|
existingSecretErlangKey: erlang
|
||||||
|
events:
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 1Gi
|
||||||
|
livenessProbe:
|
||||||
|
enabled: false
|
||||||
|
readinessProbe:
|
||||||
|
enabled: false
|
||||||
|
events-rabbitmq:
|
||||||
|
auth:
|
||||||
|
username: taiga
|
||||||
|
existingPasswordSecret: taiga-events-rabbitmq-secret
|
||||||
|
existingSecretPasswordKey: password
|
||||||
|
existingErlangSecret: taiga-events-rabbitmq-secret
|
||||||
|
existingSecretErlangKey: erlang
|
||||||
|
protected:
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 1Gi
|
||||||
|
livenessProbe:
|
||||||
|
enabled: false
|
||||||
|
readinessProbe:
|
||||||
|
enabled: false
|
||||||
|
front:
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/alexlebens/taiga-front-docker-oidc
|
||||||
|
tag: latest
|
||||||
|
pullPolicy: Always
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 1Gi
|
||||||
|
livenessProbe:
|
||||||
|
enabled: true
|
||||||
|
readinessProbe:
|
||||||
|
enabled: true
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
className: traefik
|
||||||
|
host: taiga.alexlebens.net
|
||||||
|
persistence:
|
||||||
|
static:
|
||||||
|
enabled: true
|
||||||
|
storageClass: nfs-client
|
||||||
|
accessMode: ReadWriteMany
|
||||||
|
size: 1Gi
|
||||||
|
media:
|
||||||
|
enabled: true
|
||||||
|
storageClass: nfs-client
|
||||||
|
accessMode: ReadWriteMany
|
||||||
|
size: 1Gi
|
||||||
|
postgres-16-cluster:
|
||||||
|
mode: standalone
|
||||||
|
kubernetesClusterName: cl01tl
|
||||||
|
cluster:
|
||||||
|
walStorage:
|
||||||
|
storageClass: local-path
|
||||||
|
storage:
|
||||||
|
storageClass: local-path
|
||||||
|
monitoring:
|
||||||
|
enabled: true
|
||||||
|
prometheusRule:
|
||||||
|
enabled: false
|
||||||
|
backup:
|
||||||
|
enabled: true
|
||||||
|
endpointURL: https://s3.us-east-2.amazonaws.com
|
||||||
|
destinationPath: s3://cl01tl-postgresql-backups/taiga
|
||||||
|
endpointCredentials: taiga-postgresql-16-cluster-backup-secret
|
||||||
|
backupIndex: 1
|
||||||
|
retentionPolicy: 14d
|
||||||
13
clusters/cl01tl/applications/tubearchivist/Chart.yaml
Normal file
13
clusters/cl01tl/applications/tubearchivist/Chart.yaml
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: tubearchivist
|
||||||
|
version: 0.0.7
|
||||||
|
sources:
|
||||||
|
- https://github.com/tubearchivist/tubearchivist
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/tubearchivist
|
||||||
|
- https://github.com/tubearchivist/tubearchivist-jf
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/tubearchivist-to-jellyfin
|
||||||
|
dependencies:
|
||||||
|
- name: tubearchivist
|
||||||
|
version: 0.2.7
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: v0.4.6
|
||||||
@@ -0,0 +1,83 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: tubearchivist-config-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: ELASTIC_PASSWORD
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /tubearchivist/env
|
||||||
|
metadataPolicy: None
|
||||||
|
property: ELASTIC_PASSWORD
|
||||||
|
- secretKey: ES_URL
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /tubearchivist/env
|
||||||
|
metadataPolicy: None
|
||||||
|
property: ES_URL
|
||||||
|
- secretKey: REDIS_HOST
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /tubearchivist/env
|
||||||
|
metadataPolicy: None
|
||||||
|
property: REDIS_HOST
|
||||||
|
- secretKey: TA_HOST
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /tubearchivist/env
|
||||||
|
metadataPolicy: None
|
||||||
|
property: TA_HOST
|
||||||
|
- secretKey: TA_PASSWORD
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /tubearchivist/env
|
||||||
|
metadataPolicy: None
|
||||||
|
property: TA_PASSWORD
|
||||||
|
- secretKey: TA_USERNAME
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /tubearchivist/env
|
||||||
|
metadataPolicy: None
|
||||||
|
property: TA_USERNAME
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: tubearchivist-elasticsearch-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: ELASTIC_PASSWORD
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /tubearchivist/env
|
||||||
|
metadataPolicy: None
|
||||||
|
property: ELASTIC_PASSWORD
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: tubearchivist-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
volumeName: tubearchivist-nfs-storage
|
||||||
|
storageClassName: nfs-client
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: tubearchivist-nfs-storage
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: storage
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
storageClassName: nfs-client
|
||||||
|
capacity:
|
||||||
|
storage: 1Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
path: {{ .Values.storage.youtube.nfsPath }}
|
||||||
|
server: {{ .Values.storage.youtube.nfsServer }}
|
||||||
|
mountOptions:
|
||||||
|
- vers=4
|
||||||
|
- minorversion=1
|
||||||
|
- noac
|
||||||
46
clusters/cl01tl/applications/tubearchivist/values.yaml
Normal file
46
clusters/cl01tl/applications/tubearchivist/values.yaml
Normal file
@@ -0,0 +1,46 @@
|
|||||||
|
tubearchivist:
|
||||||
|
deployment:
|
||||||
|
env:
|
||||||
|
TZ: US/Central
|
||||||
|
envFrom:
|
||||||
|
- secretRef:
|
||||||
|
name: tubearchivist-config-secret
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 1000m
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
className: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
host: tubearchivist.alexlebens.net
|
||||||
|
persistence:
|
||||||
|
cache:
|
||||||
|
enabled: true
|
||||||
|
storageClassName: ceph-block
|
||||||
|
storageSize: 80Gi
|
||||||
|
youtube:
|
||||||
|
claimName: tubearchivist-nfs-storage
|
||||||
|
elasticsearch:
|
||||||
|
global:
|
||||||
|
storageClass: ceph-block
|
||||||
|
extraEnvVarsSecret: tubearchivist-elasticsearch-secret
|
||||||
|
extraConfig:
|
||||||
|
path:
|
||||||
|
repo: /usr/share/elasticsearch/data/snapshot
|
||||||
|
extraVolumes:
|
||||||
|
- name: snapshot
|
||||||
|
nfs:
|
||||||
|
path: /volume2/Storage/TubeArchivist
|
||||||
|
server: synologybond.alexlebens.net
|
||||||
|
extraVolumeMounts:
|
||||||
|
- name: snapshot
|
||||||
|
mountPath: /usr/share/elasticsearch/data/snapshot
|
||||||
|
snapshotRepoPath: /usr/share/elasticsearch/data/snapshot
|
||||||
|
storage:
|
||||||
|
youtube:
|
||||||
|
nfsPath: /volume2/Storage/YouTube
|
||||||
|
nfsServer: synologybond.alexlebens.net
|
||||||
20
clusters/cl01tl/applications/vikunja/Chart.yaml
Normal file
20
clusters/cl01tl/applications/vikunja/Chart.yaml
Normal file
@@ -0,0 +1,20 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: vikunja
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://kolaente.dev/vikunja/vikunja
|
||||||
|
- https://kolaente.dev/vikunja/helm-chart
|
||||||
|
- https://github.com/bitnami/charts/tree/main/bitnami/redis
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/postgres-cluster
|
||||||
|
dependencies:
|
||||||
|
- name: vikunja
|
||||||
|
version: 0.4.3
|
||||||
|
repository: oci://kolaente.dev/vikunja
|
||||||
|
- name: redis
|
||||||
|
version: 19.3.2
|
||||||
|
repository: https://charts.bitnami.com/bitnami
|
||||||
|
- name: postgres-cluster
|
||||||
|
alias: postgres-16-cluster
|
||||||
|
version: 3.0.0
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: v0.22.1
|
||||||
@@ -0,0 +1,62 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: vikunja-config-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: config.yml
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /vikunja/config
|
||||||
|
metadataPolicy: None
|
||||||
|
property: config.yml
|
||||||
|
- secretKey: redis-password
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /vikunja/config
|
||||||
|
metadataPolicy: None
|
||||||
|
property: redis-password
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: vikunja-postgresql-16-cluster-backup-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: vikunja-postgresql-16-cluster-backup-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: ACCESS_KEY_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-vikunja-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: access_key
|
||||||
|
- secretKey: ACCESS_SECRET_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-vikunja-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret_key
|
||||||
117
clusters/cl01tl/applications/vikunja/values.yaml
Normal file
117
clusters/cl01tl/applications/vikunja/values.yaml
Normal file
@@ -0,0 +1,117 @@
|
|||||||
|
vikunja:
|
||||||
|
api:
|
||||||
|
enabled: true
|
||||||
|
image:
|
||||||
|
repository: vikunja/api
|
||||||
|
tag: 0.22.1
|
||||||
|
persistence:
|
||||||
|
data:
|
||||||
|
enabled: true
|
||||||
|
size: 10Gi
|
||||||
|
mountPath: /app/vikunja/files
|
||||||
|
storageClass: ceph-block
|
||||||
|
config:
|
||||||
|
type: secret
|
||||||
|
name: vikunja-config-secret
|
||||||
|
configMaps:
|
||||||
|
config:
|
||||||
|
enabled: false
|
||||||
|
ingress:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
className: traefik
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
hosts:
|
||||||
|
- host: vikunja.alexlebens.net
|
||||||
|
paths:
|
||||||
|
- path: /api/v1/
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- vikunja.alexlebens.net
|
||||||
|
secretName: vikunja-secret-tls
|
||||||
|
env:
|
||||||
|
VIKUNJA_SERVICE_FRONTENDURL: https://vikunja.alexlebens.net
|
||||||
|
VIKUNJA_SERVICE_ENABLEREGISTRATION: "true"
|
||||||
|
VIKUNJA_SERVICE_TIMEZONE: US/Central
|
||||||
|
VIKUNJA_REDIS_ENABLED: "true"
|
||||||
|
VIKUNJA_REDIS_HOST: vikunja-redis-headless:6379
|
||||||
|
VIKUNJA_REDIS_PASSWORD:
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: vikunja-config-secret
|
||||||
|
key: redis-password
|
||||||
|
VIKUNJA_DATABASE_USER:
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: vikunja-postgresql-16-cluster-app
|
||||||
|
key: user
|
||||||
|
VIKUNJA_DATABASE_DATABASE:
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: vikunja-postgresql-16-cluster-app
|
||||||
|
key: dbname
|
||||||
|
VIKUNJA_DATABASE_HOST:
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: vikunja-postgresql-16-cluster-app
|
||||||
|
key: host
|
||||||
|
VIKUNJA_DATABASE_PASSWORD:
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: vikunja-postgresql-16-cluster-app
|
||||||
|
key: password
|
||||||
|
frontend:
|
||||||
|
enabled: true
|
||||||
|
image:
|
||||||
|
repository: vikunja/frontend
|
||||||
|
tag: 0.22.1
|
||||||
|
env:
|
||||||
|
VIKUNJA_API_URL: https://vikunja.alexlebens.net/api/v1/
|
||||||
|
ingress:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
className: traefik
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
hosts:
|
||||||
|
- host: vikunja.alexlebens.net
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- vikunja.alexlebens.net
|
||||||
|
secretName: vikunja-secret-tls
|
||||||
|
postgresql:
|
||||||
|
enabled: false
|
||||||
|
redis:
|
||||||
|
enabled: false
|
||||||
|
typesense:
|
||||||
|
enabled: false
|
||||||
|
redis:
|
||||||
|
architecture: standalone
|
||||||
|
auth:
|
||||||
|
enabled: true
|
||||||
|
existingSecret: vikunja-config-secret
|
||||||
|
existingSecretPasswordKey: redis-password
|
||||||
|
postgres-16-cluster:
|
||||||
|
mode: standalone
|
||||||
|
kubernetesClusterName: cl01tl
|
||||||
|
cluster:
|
||||||
|
walStorage:
|
||||||
|
storageClass: local-path
|
||||||
|
storage:
|
||||||
|
storageClass: local-path
|
||||||
|
monitoring:
|
||||||
|
enabled: true
|
||||||
|
backup:
|
||||||
|
enabled: true
|
||||||
|
endpointURL: https://s3.us-east-2.amazonaws.com
|
||||||
|
destinationPath: s3://cl01tl-postgresql-backups/vikunja
|
||||||
|
endpointCredentials: vikunja-postgresql-16-cluster-backup-secret
|
||||||
|
backupIndex: 1
|
||||||
|
retentionPolicy: 14d
|
||||||
11
clusters/cl01tl/deployment/argo-rollouts/Chart.yaml
Normal file
11
clusters/cl01tl/deployment/argo-rollouts/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: argo-rollouts
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/argoproj/argo-rollouts
|
||||||
|
- https://github.com/argoproj/argo-helm/tree/main/charts
|
||||||
|
dependencies:
|
||||||
|
- name: argo-rollouts
|
||||||
|
version: 2.35.2
|
||||||
|
repository: https://argoproj.github.io/argo-helm
|
||||||
|
appVersion: v1.6.6
|
||||||
45
clusters/cl01tl/deployment/argo-rollouts/values.yaml
Normal file
45
clusters/cl01tl/deployment/argo-rollouts/values.yaml
Normal file
@@ -0,0 +1,45 @@
|
|||||||
|
argo-rollouts:
|
||||||
|
controller:
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
namespace: argocd
|
||||||
|
dashboard:
|
||||||
|
enabled: true
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
ingressClassName: traefik
|
||||||
|
hosts:
|
||||||
|
- argo-rollouts.alexlebens.net
|
||||||
|
tls:
|
||||||
|
- secretName: argo-rollouts-secret-tls
|
||||||
|
hosts:
|
||||||
|
- argo-rollouts.alexlebens.net
|
||||||
|
|
||||||
|
notifications:
|
||||||
|
notifiers: {}
|
||||||
|
# service.slack: |
|
||||||
|
# token: $slack-token
|
||||||
|
|
||||||
|
# -- Notification templates
|
||||||
|
templates: {}
|
||||||
|
# template.my-purple-template: |
|
||||||
|
# message: |
|
||||||
|
# Rollout {{.rollout.metadata.name}} has purple image
|
||||||
|
# slack:
|
||||||
|
# attachments: |
|
||||||
|
# [{
|
||||||
|
# "title": "{{ .rollout.metadata.name}}",
|
||||||
|
# "color": "#800080"
|
||||||
|
# }]
|
||||||
|
|
||||||
|
# -- The trigger defines the condition when the notification should be sent
|
||||||
|
triggers: {}
|
||||||
|
# trigger.on-purple: |
|
||||||
|
# - send: [my-purple-template]
|
||||||
|
# when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'
|
||||||
20
clusters/cl01tl/deployment/argo-workflows/Chart.yaml
Normal file
20
clusters/cl01tl/deployment/argo-workflows/Chart.yaml
Normal file
@@ -0,0 +1,20 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: argo-workflows
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/argoproj/argo-workflows
|
||||||
|
- https://github.com/argoproj/argo-events
|
||||||
|
- https://github.com/argoproj/argo-helm/tree/main/charts
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/postgres-cluster
|
||||||
|
dependencies:
|
||||||
|
- name: argo-workflows
|
||||||
|
version: 0.41.4
|
||||||
|
repository: https://argoproj.github.io/argo-helm
|
||||||
|
- name: argo-events
|
||||||
|
version: 2.4.4
|
||||||
|
repository: https://argoproj.github.io/argo-helm
|
||||||
|
- name: postgres-cluster
|
||||||
|
alias: postgres-16-cluster
|
||||||
|
version: 3.0.0
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: v3.5.6
|
||||||
@@ -0,0 +1,62 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: argo-workflows-oidc-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argo-workflows-oidc-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: secret
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/argo-workflows
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret
|
||||||
|
- secretKey: client
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/argo-workflows
|
||||||
|
metadataPolicy: None
|
||||||
|
property: client
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: argo-workflows-postgresql-16-cluster-backup-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argo-workflows-postgresql-16-cluster-backup-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: ACCESS_KEY_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-argo-workflows-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: access_key
|
||||||
|
- secretKey: ACCESS_SECRET_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-argo-workflows-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret_key
|
||||||
121
clusters/cl01tl/deployment/argo-workflows/values.yaml
Normal file
121
clusters/cl01tl/deployment/argo-workflows/values.yaml
Normal file
@@ -0,0 +1,121 @@
|
|||||||
|
argo-workflows:
|
||||||
|
controller:
|
||||||
|
metricsConfig:
|
||||||
|
enabled: true
|
||||||
|
persistence:
|
||||||
|
connectionPool:
|
||||||
|
maxIdleConns: 100
|
||||||
|
maxOpenConns: 0
|
||||||
|
nodeStatusOffLoad: true
|
||||||
|
archive: true
|
||||||
|
postgresql:
|
||||||
|
host: argo-workflows-postgresql-16-cluster-rw
|
||||||
|
port: 5432
|
||||||
|
database: app
|
||||||
|
tableName: app
|
||||||
|
userNameSecret:
|
||||||
|
name: argo-workflows-postgresql-16-cluster-app
|
||||||
|
key: username
|
||||||
|
passwordSecret:
|
||||||
|
name: argo-workflows-postgresql-16-cluster-app
|
||||||
|
key: password
|
||||||
|
ssl: false
|
||||||
|
sslMode: disable
|
||||||
|
workflowWorkers: 2
|
||||||
|
workflowTTLWorkers: 1
|
||||||
|
podCleanupWorkers: 1
|
||||||
|
cronWorkflowWorkers: 1
|
||||||
|
telemetryConfig:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
name: workflow-controller
|
||||||
|
workflowNamespaces:
|
||||||
|
- argocd
|
||||||
|
server:
|
||||||
|
authModes:
|
||||||
|
- sso
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
ingressClassName: traefik
|
||||||
|
hosts:
|
||||||
|
- argo-workflows.alexlebens.net
|
||||||
|
tls:
|
||||||
|
- secretName: argoworkflows-example-tls
|
||||||
|
hosts:
|
||||||
|
- argo-workflows.alexlebens.net
|
||||||
|
sso:
|
||||||
|
enabled: true
|
||||||
|
issuer: https://authentik.alexlebens.net/application/o/argo-workflows/
|
||||||
|
clientId:
|
||||||
|
name: argo-workflows-oidc-secret
|
||||||
|
key: client
|
||||||
|
clientSecret:
|
||||||
|
name: argo-workflows-oidc-secret
|
||||||
|
key: secret
|
||||||
|
redirectUrl: https://argo-workflows.alexlebens.net/oauth2/callback
|
||||||
|
rbac:
|
||||||
|
enabled: false
|
||||||
|
scopes:
|
||||||
|
- openid
|
||||||
|
- email
|
||||||
|
- profile
|
||||||
|
useStaticCredentials: true
|
||||||
|
artifactRepository:
|
||||||
|
archiveLogs: false
|
||||||
|
s3: {}
|
||||||
|
# accessKeySecret:
|
||||||
|
# name: "{{ .Release.Name }}-minio"
|
||||||
|
# key: accesskey
|
||||||
|
# secretKeySecret:
|
||||||
|
# name: "{{ .Release.Name }}-minio"
|
||||||
|
# key: secretkey
|
||||||
|
# insecure: true
|
||||||
|
# bucket:
|
||||||
|
# endpoint:
|
||||||
|
# region:
|
||||||
|
# encryptionOptions:
|
||||||
|
# enableEncryption: true
|
||||||
|
|
||||||
|
argo-events:
|
||||||
|
global:
|
||||||
|
image:
|
||||||
|
repository: quay.io/argoproj/argo-events
|
||||||
|
tag: v1.9.1
|
||||||
|
controller:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 512Mi
|
||||||
|
requests:
|
||||||
|
cpu: 250m
|
||||||
|
memory: 256Mi
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
namespace: argocd
|
||||||
|
webhook:
|
||||||
|
enabled: true
|
||||||
|
postgres-16-cluster:
|
||||||
|
mode: standalone
|
||||||
|
cluster:
|
||||||
|
walStorage:
|
||||||
|
storageClass: local-path
|
||||||
|
storage:
|
||||||
|
storageClass: local-path
|
||||||
|
monitoring:
|
||||||
|
enabled: true
|
||||||
|
prometheusRule:
|
||||||
|
enabled: true
|
||||||
|
backup:
|
||||||
|
enabled: true
|
||||||
|
endpointURL: https://s3.us-east-2.amazonaws.com
|
||||||
|
destinationPath: s3://cl01tl-postgresql-backups/argo-workflows
|
||||||
|
endpointCredentials: argo-workflows-postgresql-16-cluster-backup-secret
|
||||||
|
backupIndex: 1
|
||||||
|
retentionPolicy: 14d
|
||||||
12
clusters/cl01tl/deployment/argocd/Chart.yaml
Normal file
12
clusters/cl01tl/deployment/argocd/Chart.yaml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: argocd
|
||||||
|
version: 0.1.0
|
||||||
|
home: https://outline.alexlebens.net/doc/argo-cd-qLEdrgdwOD
|
||||||
|
sources:
|
||||||
|
- https://github.com/argoproj/argo-cd
|
||||||
|
- https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd
|
||||||
|
dependencies:
|
||||||
|
- name: argo-cd
|
||||||
|
version: 6.9.3
|
||||||
|
repository: https://argoproj.github.io/argo-helm
|
||||||
|
appVersion: v2.10.8
|
||||||
110
clusters/cl01tl/deployment/argocd/templates/external-secret.yaml
Normal file
110
clusters/cl01tl/deployment/argocd/templates/external-secret.yaml
Normal file
@@ -0,0 +1,110 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: argocd-oidc-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: "{{ .Release.Name }}-server"
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: secret
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/argocd
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret
|
||||||
|
- secretKey: client
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/argocd
|
||||||
|
metadataPolicy: None
|
||||||
|
property: client
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: argocd-cluster-cl02do-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: "{{ .Release.Name }}-server"
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
argocd.argoproj.io/secret-type: cluster
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: name
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /argocd/credentials/cluster/cl02do
|
||||||
|
metadataPolicy: None
|
||||||
|
property: name
|
||||||
|
- secretKey: server
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /argocd/credentials/cluster/cl02do
|
||||||
|
metadataPolicy: None
|
||||||
|
property: server
|
||||||
|
- secretKey: config
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /argocd/credentials/cluster/cl02do
|
||||||
|
metadataPolicy: None
|
||||||
|
property: config
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: argocd-repo-alexlebens-dev-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: "{{ .Release.Name }}-server"
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
argocd.argoproj.io/secret-type: repository
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: type
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /argocd/credentials/repo/alexlebens-dev
|
||||||
|
metadataPolicy: None
|
||||||
|
property: type
|
||||||
|
- secretKey: url
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /argocd/credentials/repo/alexlebens-dev
|
||||||
|
metadataPolicy: None
|
||||||
|
property: url
|
||||||
|
- secretKey: sshPrivateKey
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /argocd/credentials/repo/alexlebens-dev
|
||||||
|
metadataPolicy: None
|
||||||
|
property: sshPrivateKey
|
||||||
66
clusters/cl01tl/deployment/argocd/values.yaml
Normal file
66
clusters/cl01tl/deployment/argocd/values.yaml
Normal file
@@ -0,0 +1,66 @@
|
|||||||
|
argo-cd:
|
||||||
|
crds:
|
||||||
|
install: true
|
||||||
|
configs:
|
||||||
|
cm:
|
||||||
|
admin.enabled: true
|
||||||
|
url: https://argocd.alexlebens.net
|
||||||
|
statusbadge.enabled: true
|
||||||
|
dex.config: |
|
||||||
|
connectors:
|
||||||
|
- config:
|
||||||
|
issuer: https://authentik.alexlebens.net/application/o/argocd/
|
||||||
|
clientID: $argocd-oidc-secret:client
|
||||||
|
clientSecret: $argocd-oidc-secret:secret
|
||||||
|
insecureEnableGroups: true
|
||||||
|
scopes:
|
||||||
|
- openid
|
||||||
|
- profile
|
||||||
|
- email
|
||||||
|
- groups
|
||||||
|
name: authentik
|
||||||
|
type: oidc
|
||||||
|
id: authentik
|
||||||
|
rbac:
|
||||||
|
policy.csv: |
|
||||||
|
g, ArgoCD Admins, role:admin
|
||||||
|
params:
|
||||||
|
server.insecure: true
|
||||||
|
server:
|
||||||
|
replicas: 2
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
controller: generic
|
||||||
|
ingressClassName: traefik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
hostname: argocd.alexlebens.net
|
||||||
|
tls: true
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
dex:
|
||||||
|
enabled: true
|
||||||
|
redis-ha:
|
||||||
|
enabled: true
|
||||||
|
controller:
|
||||||
|
replicas: 1
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
repoServer:
|
||||||
|
replicas: 2
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
applicationSet:
|
||||||
|
replicas: 2
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
11
clusters/cl01tl/deployment/kargo/Chart.yaml
Normal file
11
clusters/cl01tl/deployment/kargo/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: kargo
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/akuity/kargo
|
||||||
|
- https://github.com/akuity/kargo/blob/main/charts/kargo/Chart.yaml
|
||||||
|
dependencies:
|
||||||
|
- name: kargo
|
||||||
|
version: 0.6.0
|
||||||
|
repository: oci://ghcr.io/akuity/kargo-charts
|
||||||
|
appVersion: v0.5.1
|
||||||
@@ -0,0 +1,56 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: kargo-oidc-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kargo-oidc-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: CLIENT_SECRET
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/kargo
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret
|
||||||
|
- secretKey: CLIENT_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/oidc/kargo
|
||||||
|
metadataPolicy: None
|
||||||
|
property: client
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: kargo-cluster-cl02do-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: kargo-cluster-cl02do-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
argocd.argoproj.io/secret-type: cluster
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: kubeconfig
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /argocd/credentials/cluster/cl02do
|
||||||
|
metadataPolicy: None
|
||||||
|
property: kubeconfig
|
||||||
120
clusters/cl01tl/deployment/kargo/values.yaml
Normal file
120
clusters/cl01tl/deployment/kargo/values.yaml
Normal file
@@ -0,0 +1,120 @@
|
|||||||
|
kargo:
|
||||||
|
api:
|
||||||
|
host: kargo.alexlebens.net
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
tls:
|
||||||
|
enabled: false
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
ingressClassName: traefik
|
||||||
|
tls:
|
||||||
|
enabled: true
|
||||||
|
selfSignedCert: false
|
||||||
|
adminAccount:
|
||||||
|
enabled: false
|
||||||
|
oidc:
|
||||||
|
enabled: true
|
||||||
|
admins:
|
||||||
|
groups: ["ArgoCD Admins"]
|
||||||
|
dex:
|
||||||
|
enabled: true
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/dexidp/dex
|
||||||
|
tag: v2.39.1
|
||||||
|
env:
|
||||||
|
- name: CLIENT_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kargo-oidc-secret
|
||||||
|
key: CLIENT_ID
|
||||||
|
- name: CLIENT_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: kargo-oidc-secret
|
||||||
|
key: CLIENT_SECRET
|
||||||
|
tls:
|
||||||
|
selfSignedCert: false
|
||||||
|
skipApprovalScreen: true
|
||||||
|
connectors:
|
||||||
|
- type: oidc
|
||||||
|
id: authentik
|
||||||
|
name: Authentik
|
||||||
|
config:
|
||||||
|
issuer: https://authentik.alexlebens.net/application/o/kargo/
|
||||||
|
clientID: "$CLIENT_ID"
|
||||||
|
clientSecret: "$CLIENT_SECRET"
|
||||||
|
redirectURI: https://kargo.alexlebens.net/dex/callback
|
||||||
|
insecureEnableGroups: true
|
||||||
|
scopes:
|
||||||
|
- openid
|
||||||
|
- profile
|
||||||
|
- email
|
||||||
|
- groups
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
argocd:
|
||||||
|
urls:
|
||||||
|
"": https://argocd.alexlebens.net
|
||||||
|
rollouts:
|
||||||
|
integrationEnabled: true
|
||||||
|
controller:
|
||||||
|
enabled: true
|
||||||
|
gitClient:
|
||||||
|
name: "Kargo cl01tl"
|
||||||
|
email: "alexanderlebens@gmail.com"
|
||||||
|
argocd:
|
||||||
|
integrationEnabled: true
|
||||||
|
rollouts:
|
||||||
|
integrationEnabled: true
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
managementController:
|
||||||
|
enabled: true
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
webhooks:
|
||||||
|
register: true
|
||||||
|
webhooksServer:
|
||||||
|
tls:
|
||||||
|
selfSignedCert: true
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
garbageCollector:
|
||||||
|
schedule: "0 * * * *"
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
6
clusters/cl01tl/deployment/stack/Chart.yaml
Normal file
6
clusters/cl01tl/deployment/stack/Chart.yaml
Normal file
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: stack
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/alexlebens/alexlebens-net.git
|
||||||
|
appVersion: 1.0.0
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
{{- range $index, $stack := .Values.applicationSet }}
|
||||||
|
---
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: ApplicationSet
|
||||||
|
metadata:
|
||||||
|
name: {{ $stack.name }}
|
||||||
|
namespace: {{ $.Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ $stack.name }}
|
||||||
|
app.kubernetes.io/instance: {{ $stack.name }}
|
||||||
|
app.kubernetes.io/version: {{ $.Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: {{ $stack.name }}
|
||||||
|
app.kubernetes.io/part-of: {{ $.Release.Name }}
|
||||||
|
spec:
|
||||||
|
syncPolicy:
|
||||||
|
applicationsSync: create-only
|
||||||
|
preserveResourcesOnDeletion: true
|
||||||
|
generators:
|
||||||
|
- git:
|
||||||
|
repoURL: {{ $.Values.git.repo }}
|
||||||
|
revision: {{ $.Values.git.revision }}
|
||||||
|
directories:
|
||||||
|
- path: "{{ $.Values.git.path }}/{{ $stack.name }}/*"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
name: '{{ `{{path.basename}}` }}'
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
spec:
|
||||||
|
destination:
|
||||||
|
name: in-cluster
|
||||||
|
namespace: '{{ $stack.namespace | default `{{path.basename}}` }}'
|
||||||
|
project: default
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
source:
|
||||||
|
repoURL: {{ $.Values.git.repo }}
|
||||||
|
targetRevision: {{ $.Values.git.revision }}
|
||||||
|
path: '{{ `{{path}}` }}'
|
||||||
|
ignoreDifferences:
|
||||||
|
{{- toYaml $stack.ignoreDifferences | nindent 8 }}
|
||||||
|
syncPolicy:
|
||||||
|
{{- if $stack.syncPolicy.automated.enabled }}
|
||||||
|
automated:
|
||||||
|
prune: {{ $stack.syncPolicy.automated.prune | default false }}
|
||||||
|
selfHeal: {{ $stack.syncPolicy.automated.selfHeal | default false }}
|
||||||
|
{{- end }}
|
||||||
|
retry:
|
||||||
|
limit: 3
|
||||||
|
backoff:
|
||||||
|
duration: 1m
|
||||||
|
factor: 2
|
||||||
|
maxDuration: 15m
|
||||||
|
syncOptions:
|
||||||
|
{{- toYaml $stack.syncPolicy.syncOptions | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
82
clusters/cl01tl/deployment/stack/templates/application.yaml
Normal file
82
clusters/cl01tl/deployment/stack/templates/application.yaml
Normal file
@@ -0,0 +1,82 @@
|
|||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: cilium
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
repoURL: {{ .Values.application.cilium.source.repo }}
|
||||||
|
targetRevision: {{ .Values.application.cilium.source.revision }}
|
||||||
|
path: "{{ .Values.git.path }}/{{ .Values.application.cilium.source.path }}"
|
||||||
|
destination:
|
||||||
|
name: in-cluster
|
||||||
|
namespace: {{ .Values.application.cilium.namespace }}
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
syncPolicy:
|
||||||
|
{{- toYaml .Values.application.cilium.syncPolicy | nindent 4 }}
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: metrics-server
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
repoURL: {{ .Values.application.metricsServer.source.repo }}
|
||||||
|
targetRevision: {{ .Values.application.metricsServer.source.revision }}
|
||||||
|
path: "{{ .Values.git.path }}/{{ .Values.application.metricsServer.source.path }}"
|
||||||
|
destination:
|
||||||
|
name: in-cluster
|
||||||
|
namespace: {{ .Values.application.metricsServer.namespace }}
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
syncPolicy:
|
||||||
|
{{- toYaml .Values.application.metricsServer.syncPolicy | nindent 4 }}
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: kubelet-serving-cert-approver
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
repoURL: {{ .Values.application.kubeletServingCertApprover.source.repo }}
|
||||||
|
targetRevision: {{ .Values.application.kubeletServingCertApprover.source.revision }}
|
||||||
|
path: "{{ .Values.git.path }}/{{ .Values.application.kubeletServingCertApprover.source.path }}"
|
||||||
|
destination:
|
||||||
|
name: in-cluster
|
||||||
|
namespace: {{ .Values.application.kubeletServingCertApprover.namespace }}
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
syncPolicy:
|
||||||
|
{{- toYaml .Values.application.kubeletServingCertApprover.syncPolicy | nindent 4 }}
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: prometheus-operator-crds
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
repoURL: {{ .Values.application.prometheusOperatorCrds.source.repo }}
|
||||||
|
targetRevision: {{ .Values.application.prometheusOperatorCrds.source.revision }}
|
||||||
|
path: "{{ .Values.git.path }}/{{ .Values.application.prometheusOperatorCrds.source.path }}"
|
||||||
|
destination:
|
||||||
|
name: in-cluster
|
||||||
|
namespace: {{ .Values.application.prometheusOperatorCrds.namespace }}
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
syncPolicy:
|
||||||
|
{{- toYaml .Values.application.prometheusOperatorCrds.syncPolicy | nindent 4 }}
|
||||||
148
clusters/cl01tl/deployment/stack/values.yaml
Normal file
148
clusters/cl01tl/deployment/stack/values.yaml
Normal file
@@ -0,0 +1,148 @@
|
|||||||
|
git:
|
||||||
|
repo: git@github.com:alexlebens/alexlebens-net.git
|
||||||
|
revision: HEAD
|
||||||
|
path: clusters/cl01tl
|
||||||
|
applicationSet:
|
||||||
|
- name: applications
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
enabled: true
|
||||||
|
prune: true
|
||||||
|
selfheal: false
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
- ApplyOutOfSyncOnly=true
|
||||||
|
- ServerSideApply=false
|
||||||
|
- PruneLast=true
|
||||||
|
- name: deployment
|
||||||
|
namespace: argocd
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
enabled: true
|
||||||
|
prune: true
|
||||||
|
selfheal: false
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
- ApplyOutOfSyncOnly=true
|
||||||
|
- ServerSideApply=false
|
||||||
|
- PruneLast=true
|
||||||
|
- name: platform
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
enabled: true
|
||||||
|
prune: true
|
||||||
|
selfheal: false
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
- ApplyOutOfSyncOnly=true
|
||||||
|
- ServerSideApply=true
|
||||||
|
- PruneLast=true
|
||||||
|
- name: services
|
||||||
|
ignoreDifferences:
|
||||||
|
- group: ""
|
||||||
|
kind: Service
|
||||||
|
jqPathExpressions:
|
||||||
|
- .status.loadBalancer.ingress[].ipMode
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
enabled: true
|
||||||
|
prune: true
|
||||||
|
selfheal: false
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
- ApplyOutOfSyncOnly=true
|
||||||
|
- ServerSideApply=true
|
||||||
|
- PruneLast=true
|
||||||
|
- name: storage
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
enabled: true
|
||||||
|
prune: true
|
||||||
|
selfheal: false
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
- ApplyOutOfSyncOnly=true
|
||||||
|
- ServerSideApply=false
|
||||||
|
- PruneLast=true
|
||||||
|
application:
|
||||||
|
cilium:
|
||||||
|
namespace: kube-system
|
||||||
|
source:
|
||||||
|
repo: git@github.com:alexlebens/alexlebens-net.git
|
||||||
|
revision: HEAD
|
||||||
|
path: standalone/cilium
|
||||||
|
syncPolicy:
|
||||||
|
retry:
|
||||||
|
limit: 10
|
||||||
|
backoff:
|
||||||
|
duration: 1m
|
||||||
|
factor: 2
|
||||||
|
maxDuration: 16m
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=false
|
||||||
|
- ApplyOutOfSyncOnly=true
|
||||||
|
- ServerSideApply=true
|
||||||
|
- PruneLast=true
|
||||||
|
metricsServer:
|
||||||
|
namespace: kube-system
|
||||||
|
source:
|
||||||
|
repo: git@github.com:alexlebens/alexlebens-net.git
|
||||||
|
revision: HEAD
|
||||||
|
path: standalone/metrics-server
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
prune: true
|
||||||
|
selfHeal: true
|
||||||
|
retry:
|
||||||
|
limit: 10
|
||||||
|
backoff:
|
||||||
|
duration: 1m
|
||||||
|
factor: 2
|
||||||
|
maxDuration: 16m
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=false
|
||||||
|
- ApplyOutOfSyncOnly=false
|
||||||
|
- ServerSideApply=true
|
||||||
|
- PruneLast=true
|
||||||
|
kubeletServingCertApprover:
|
||||||
|
namespace: kubelet-serving-cert-approver
|
||||||
|
source:
|
||||||
|
repo: git@github.com:alexlebens/alexlebens-net.git
|
||||||
|
revision: HEAD
|
||||||
|
path: standalone/kubelet-serving-cert-approver
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
prune: true
|
||||||
|
selfHeal: true
|
||||||
|
retry:
|
||||||
|
limit: 10
|
||||||
|
backoff:
|
||||||
|
duration: 1m
|
||||||
|
factor: 2
|
||||||
|
maxDuration: 16m
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
- ApplyOutOfSyncOnly=false
|
||||||
|
- ServerSideApply=true
|
||||||
|
- PruneLast=true
|
||||||
|
prometheusOperatorCrds:
|
||||||
|
namespace: kube-system
|
||||||
|
source:
|
||||||
|
repo: git@github.com:alexlebens/alexlebens-net.git
|
||||||
|
revision: HEAD
|
||||||
|
path: standalone/prometheus-operator-crds
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
prune: true
|
||||||
|
selfHeal: true
|
||||||
|
retry:
|
||||||
|
limit: 10
|
||||||
|
backoff:
|
||||||
|
duration: 1m
|
||||||
|
factor: 2
|
||||||
|
maxDuration: 16m
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=false
|
||||||
|
- ApplyOutOfSyncOnly=false
|
||||||
|
- ServerSideApply=true
|
||||||
|
- PruneLast=true
|
||||||
21
clusters/cl01tl/platform/authentik/Chart.yaml
Normal file
21
clusters/cl01tl/platform/authentik/Chart.yaml
Normal file
@@ -0,0 +1,21 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: authentik
|
||||||
|
version: 1.0.0
|
||||||
|
sources:
|
||||||
|
- https://github.com/goauthentik/authentik
|
||||||
|
- https://github.com/goauthentik/helm
|
||||||
|
- https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
|
||||||
|
- https://github.com/alexlebens/helm-charts/charts/postgres-cluster
|
||||||
|
dependencies:
|
||||||
|
- name: authentik
|
||||||
|
version: 2024.4.2
|
||||||
|
repository: https://charts.goauthentik.io/
|
||||||
|
- name: app-template
|
||||||
|
alias: cloudflared
|
||||||
|
repository: https://bjw-s.github.io/helm-charts/
|
||||||
|
version: 3.1.0
|
||||||
|
- name: postgres-cluster
|
||||||
|
alias: postgres-16-cluster
|
||||||
|
version: 3.0.0
|
||||||
|
repository: http://alexlebens.github.io/helm-charts
|
||||||
|
appVersion: "2024.4.2"
|
||||||
60
clusters/cl01tl/platform/authentik/templates/config-map.yaml
Normal file
60
clusters/cl01tl/platform/authentik/templates/config-map.yaml
Normal file
@@ -0,0 +1,60 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: authentik-custom-css
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
data:
|
||||||
|
custom.css: |
|
||||||
|
/* Change sign button color */
|
||||||
|
.pf-c-button.pf-m-primary {
|
||||||
|
color: black;
|
||||||
|
background-color: white;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Remove background */
|
||||||
|
.pf-c-login__main {
|
||||||
|
background-color: rgba(3, 3, 3, 0.16);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Remove specific height */
|
||||||
|
.pf-c-brand {
|
||||||
|
height: auto;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Center text */
|
||||||
|
.pf-c-title {
|
||||||
|
text-align: center;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Match text field to login button */
|
||||||
|
.pf-c-form-control {
|
||||||
|
border-radius: 3px;
|
||||||
|
background-color: white;
|
||||||
|
color: black;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Force border color */
|
||||||
|
.pf-c-form-control {
|
||||||
|
border-color: white;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Use default cursor on this div */
|
||||||
|
.pf-c-form__label {
|
||||||
|
cursor: default;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Hide required asterik */
|
||||||
|
.pf-c-form__label-required {
|
||||||
|
display: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Change link color to white */
|
||||||
|
.a {
|
||||||
|
color: white;
|
||||||
|
}
|
||||||
@@ -0,0 +1,80 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: authentik-key-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: authentik-key-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: key
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /authentik/key
|
||||||
|
metadataPolicy: None
|
||||||
|
property: key
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: authentik-cloudflared-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: authentik-cloudflared-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: web
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: cf-tunnel-token
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /cloudflare/tunnels/authentik
|
||||||
|
metadataPolicy: None
|
||||||
|
property: token
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: authentik-postgresql-16-cluster-backup-secret
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: authentik-postgresql-16-cluster-backup-secret
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: database
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: vault
|
||||||
|
data:
|
||||||
|
- secretKey: ACCESS_KEY_ID
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-authentik-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: access_key
|
||||||
|
- secretKey: ACCESS_SECRET_KEY
|
||||||
|
remoteRef:
|
||||||
|
conversionStrategy: Default
|
||||||
|
decodingStrategy: None
|
||||||
|
key: /aws/keys/cl01tl-authentik-postgresql
|
||||||
|
metadataPolicy: None
|
||||||
|
property: secret_key
|
||||||
118
clusters/cl01tl/platform/authentik/values.yaml
Normal file
118
clusters/cl01tl/platform/authentik/values.yaml
Normal file
@@ -0,0 +1,118 @@
|
|||||||
|
authentik:
|
||||||
|
global:
|
||||||
|
env:
|
||||||
|
- name: AUTHENTIK_SECRET_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-key-secret
|
||||||
|
key: key
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-postgresql-16-cluster-app
|
||||||
|
key: host
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-postgresql-16-cluster-app
|
||||||
|
key: dbname
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__USER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-postgresql-16-cluster-app
|
||||||
|
key: user
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-postgresql-16-cluster-app
|
||||||
|
key: password
|
||||||
|
server:
|
||||||
|
name: server
|
||||||
|
replicas: 1
|
||||||
|
volumes:
|
||||||
|
- name: custom-css
|
||||||
|
configMap:
|
||||||
|
name: authentik-custom-css
|
||||||
|
volumeMounts:
|
||||||
|
- name: custom-css
|
||||||
|
mountPath: /web/dist/custom.css
|
||||||
|
subPath: custom.css
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||||
|
ingressClassName: traefik
|
||||||
|
hosts:
|
||||||
|
- auth.alexlebens.net
|
||||||
|
- authentik.alexlebens.net
|
||||||
|
tls:
|
||||||
|
- secretName: authentik-secret-tls
|
||||||
|
hosts:
|
||||||
|
- auth.alexlebens.net
|
||||||
|
- authentik.alexlebens.net
|
||||||
|
worker:
|
||||||
|
name: worker
|
||||||
|
replicas: 1
|
||||||
|
prometheus:
|
||||||
|
rules:
|
||||||
|
enabled: true
|
||||||
|
postgresql:
|
||||||
|
enabled: false
|
||||||
|
redis:
|
||||||
|
enabled: true
|
||||||
|
cloudflared:
|
||||||
|
global:
|
||||||
|
nameOverride: cloudflared
|
||||||
|
controllers:
|
||||||
|
main:
|
||||||
|
type: deployment
|
||||||
|
strategy: Recreate
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
image:
|
||||||
|
repository: cloudflare/cloudflared
|
||||||
|
tag: "2024.5.0"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
args:
|
||||||
|
- tunnel
|
||||||
|
- --no-autoupdate
|
||||||
|
- run
|
||||||
|
- --token
|
||||||
|
- $(CF_MANAGED_TUNNEL_TOKEN)
|
||||||
|
env:
|
||||||
|
- name: CF_MANAGED_TUNNEL_TOKEN
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-cloudflared-secret
|
||||||
|
key: cf-tunnel-token
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 64Mi
|
||||||
|
postgres-16-cluster:
|
||||||
|
mode: standalone
|
||||||
|
cluster:
|
||||||
|
walStorage:
|
||||||
|
storageClass: local-path
|
||||||
|
storage:
|
||||||
|
storageClass: local-path
|
||||||
|
monitoring:
|
||||||
|
enabled: true
|
||||||
|
prometheusRule:
|
||||||
|
enabled: false
|
||||||
|
backup:
|
||||||
|
enabled: true
|
||||||
|
endpointURL: https://s3.us-east-2.amazonaws.com
|
||||||
|
destinationPath: s3://cl01tl-postgresql-backups/authentik
|
||||||
|
endpointCredentials: authentik-postgresql-16-cluster-backup-secret
|
||||||
|
backupIndex: 1
|
||||||
|
retentionPolicy: 14d
|
||||||
11
clusters/cl01tl/platform/external-secrets/Chart.yaml
Normal file
11
clusters/cl01tl/platform/external-secrets/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: external-secrets
|
||||||
|
version: 0.0.1
|
||||||
|
sources:
|
||||||
|
- https://github.com/external-secrets/external-secrets
|
||||||
|
- https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
|
||||||
|
dependencies:
|
||||||
|
- name: external-secrets
|
||||||
|
version: 0.9.18
|
||||||
|
repository: https://charts.external-secrets.io
|
||||||
|
appVersion: 0.9.13
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
metadata:
|
||||||
|
name: vault
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/component: auth
|
||||||
|
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||||
|
spec:
|
||||||
|
provider:
|
||||||
|
vault:
|
||||||
|
server: http://vault-internal.vault:8200
|
||||||
|
path: secret
|
||||||
|
auth:
|
||||||
|
tokenSecretRef:
|
||||||
|
namespace: vault
|
||||||
|
name: vault-token
|
||||||
|
key: token
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user