remove watchtower

clusters/cl01tl/management/komodo/templates/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: komodo-periphery-ps10rp
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: komodo-periphery-ps10rp
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: network
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    tailscale.com/tailnet-fqdn: komodo-periphery-ps10rp.boreal-beaufort.ts.net
+spec:
+  externalName: placeholder
+  type: ExternalName

hosts/ps10rp/komodo-periphery/.komodo-env

@@ -0,0 +1 @@
+PERIPHERY_PASSKEYS=""

hosts/ps10rp/komodo-periphery/.ts-env

@@ -0,0 +1 @@
+TS_AUTHKEY=""

hosts/ps10rp/komodo-periphery/compose.yaml

@@ -0,0 +1,62 @@
+---
+version: "3.7"
+
+services:
+    tailscale-komodo-periphery:
+        image: ghcr.io/tailscale/tailscale:latest
+        container_name: tailscale-komodo-periphery
+        cap_add:
+            - net_admin
+            - sys_module
+        environment:
+            - TS_STATE_DIR=/var/lib/tailscale
+            - TS_ENABLE_METRICS=true
+            - TS_HOSTNAME=komodo-periphery-ps10rp
+        env_file:
+            - .ts-env
+        labels:
+            - "com.centurylinklabs.watchtower.scope=komodo"
+        network_mode: service:komodo-periphery
+        restart: always
+        volumes:
+            - tailscale:/var/lib/tailscale
+        devices:
+            - /dev/net/tun:/dev/net/tun
+
+    watchtower:
+        image: ghcr.io/containrrr/watchtower:latest
+        container_name: komodo-periphery-watchtower
+        command: --scope komodo
+        environment:
+            - TZ=America/Chicago
+            - WATCHTOWER_HTTP_API_METRICS=true
+            - WATCHTOWER_HTTP_API_TOKEN=token
+            - WATCHTOWER_CLEANUP=true
+            - WATCHTOWER_POLL_INTERVAL=3600
+        labels:
+            - "com.centurylinklabs.watchtower.scope=komodo"
+        network_mode: service:komodo-periphery
+        restart: always
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock
+
+    komodo-periphery:
+        image: ghcr.io/mbecker20/periphery:latest
+        container_name: komodo-periphery
+        env_file:
+            - .env
+        environment:
+            - TZ=America/Chicago
+        labels:
+            - "com.centurylinklabs.watchtower.scope=komodo"
+        restart: always
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock
+            - /proc:/proc
+            - komodo-periphery-repos:/etc/komodo/repos
+            - komodo-periphery-stacks:/etc/komodo/stacks
+
+volumes:
+    tailscale:
+    komodo-periphery-repos:
+    komodo-periphery-stacks:

hosts/ps10rp/tailscale-subnet/docker-compose.yml

@@ -0,0 +1,23 @@
+services:
+    tailscale:
+        image: ghcr.io/tailscale/tailscale:v1.78.3
+        container_name: tailscale-subnet
+        cap_add:
+            - net_admin
+            - sys_module
+        environment:
+            - TS_STATE_DIR=/var/lib/tailscale
+            - TS_ENABLE_METRICS=true
+            - TS_HOSTNAME=subnet-router-local-ps10rp
+            - TS_ROUTES=192.168.5.0/24
+            - TS_EXTRA_ARGS=--stateful-filtering=false --snat-subnet-routes=false
+        network_mode: host
+        privileged: true
+        restart: always
+        volumes:
+            - tailscale:/var/lib/tailscale
+        devices:
+            - /dev/net/tun:/dev/net/tun
+
+volumes:
+    tailscale:

hosts/ps10rp/tailscale/.env

@@ -1,5 +0,0 @@
-TS_AUTHKEY=""
-TS_HOSTNAME=ps10rp
-TS_ROUTES=192.168.5.0/24
-TS_STATE_DIR=/var/lib/tailscale
-TS_EXTRA_ARGS=--stateful-filtering=false --snat-subnet-routes=false

hosts/ps10rp/tailscale/docker-compose.yml

@@ -1,27 +0,0 @@
-services:
-    tailscaled:
-        cap_add:
-            - NET_ADMIN
-            - NET_RAW
-        container_name: tailscaled
-        dns:
-            - 172.19.0.3
-            - 1.1.1.1
-        env_file:
-            - .env
-        hostname: ps10rp
-        image: docker.io/tailscale/tailscale:stable
-        network_mode: host
-        privileged: true
-        restart: always
-        volumes:
-            - tailscale:/var/lib/tailscale
-            - /dev/net/tun:/dev/net/tun
-
-volumes:
-    tailscale:
-        driver: local
-        driver_opts:
-            type: none
-            o: bind
-            device: /mnt/data/containers/tailscale

hosts/ps10rp/traefik/.env

@@ -1,3 +0,0 @@
-CF_API_EMAIL=alexanderlebens@gmail.com
-CF_API_KEY=""
-PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

hosts/ps10rp/traefik/docker-compose.yml

@@ -1,48 +1,91 @@
+---
+version: "3.7"
+
 services:
+    tailscale-traefik:
+        image: ghcr.io/tailscale/tailscale:latest
+        container_name: tailscale-traefik
+        cap_add:
+            - net_admin
+            - sys_module
+        environment:
+            - TS_STATE_DIR=/var/lib/tailscale
+            - TS_ENABLE_METRICS=true
+            - TS_HOSTNAME=traefik-ps10rp
+        env_file:
+            - .ts-env
+        network_mode: service:traefik
+        restart: always
+        volumes:
+            - tailscale:/var/lib/tailscale
+        devices:
+            - /dev/net/tun:/dev/net/tun
+
     traefik:
-        command: traefik
+        image: ghcr.io/traefik/traefik:3.3.1
         container_name: traefik
-        dns:
-            - 172.19.0.3
-            - 1.1.1.1
+        command:
+            - "--global.checkNewVersion=false"
+            - "--global.sendAnonymousUsage=false"
+            - "--api.insecure=false"
+            - "--api.dashboard=true"
+            - "--log.level=INFO"
+            - "--providers.docker=true"
+            - "--providers.docker.exposedbydefault=false"
+            - "--entryPoints.web.address=:80"
+            - "--entrypoints.web.http.redirections.entryPoint.to=web-secure"
+            - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
+            - "--entryPoints.web-secure.address=:443"
+            - "--entryPoints.web-secure.http.tls.options=default"
+            - "--entryPoints.web-secure.http.tls.certResolver=cloudflare"
+            - "--entryPoints.web-secure.http.tls.domains[0].main=*.alexlebens.net"
+            - "--entryPoints.web-secure.http.tls.domains[0].sans[0]=alexlebens.net"
+            - "--certificatesresolvers.cloudflare.acme.dnschallenge=true"
+            - "--certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare"
+            - "--certificatesresolvers.cloudflare.acme.dnschallenge.delaybeforecheck=10"
+            - "--certificatesresolvers.cloudflare.acme.dnschallenge.resolvers=1.1.1.1:53"
+            - "--certificatesresolvers.cloudflare.acme.email=alexanderlebens@gmail.com"
+            - "--certificatesresolvers.cloudflare.acme.storage=acme.json"
+            - "--metrics.prometheus=true"
+            - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
+            - "--metrics.prometheus.addEntryPointsLabels=true"
+            - "--metrics.prometheus.addRoutersLabels=true"
+            - "--metrics.prometheus.addServicesLabels=true"
+            - "--metrics.prometheus.entryPoint=web-secure"
+            - "--metrics.prometheus.manualRouting=true"
         env_file:
             - .env
-        image: docker.io/traefik:v3.3
         labels:
-            traefik.docker.network: traefik
             traefik.enable: true
-            traefik.http.routers.dashboard.entrypoints: websecure
-            traefik.http.routers.dashboard.rule: (Host(`traefik-ps10rp.lebens-home.net`) && (PathPrefix(`/api/`) || PathPrefix(`/dashboard/`)))
+            traefik.docker.network: internal
+            traefik.http.routers.dashboard.entrypoints: web-secure
+            traefik.http.routers.dashboard.rule: (Host(`traefik-ps10rp.alexlebens.net`) && (PathPrefix(`/api/`) || PathPrefix(`/dashboard/`)))
             traefik.http.routers.dashboard.service: api@internal
             traefik.http.routers.dashboard.tls: true
             traefik.http.routers.dashboard.tls.certresolver: cloudflare
+            traefik.http.routers.metrics.entrypoints: web-secure
+            traefik.http.routers.metrics.rule: (Host(`traefik-ps10rp.alexlebens.net`) && Path(`/metrics`))
+            traefik.http.routers.metrics.service: prometheus@internal
+            traefik.http.routers.metrics.tls: true
+            traefik.http.routers.metrics.tls.certresolver: cloudflare
         networks:
-            traefik: null
+            internal: null
         ports:
             - 80:80
             - 443:443
         privileged: true
         restart: always
         volumes:
-            - config:/etc/traefik
-            - log:/log
+            - letsencrypt:/letsencrypt
             - /var/run/docker.sock:/var/run/docker.sock:ro
 
 networks:
-    traefik:
-        name: traefik
+    internal:
+        name: internal
+        driver: bridge
+        ipam:
+            config:
+                - subnet: 172.18.0.0/16
 
 volumes:
-    config:
-        driver: local
-        driver_opts:
-            type: none
-            o: bind
-            device: /mnt/data/containers/traefik/config
-
-    log:
-        driver: local
-        driver_opts:
-            type: none
-            o: bind
-            device: /mnt/data/containers/traefik/log
+    letsencrypt:

hosts/ps10rp/traefik/traefik_config/conf/iplocal.yml

@@ -1,15 +0,0 @@
-http:
-  middlewares:
-    ip-local:
-      IPAllowList:
-        sourceRange:
-          - "192.168.1.1/16"
-          - "172.27.0.0/16"
-
-tcp:
-  middlewares:
-    ip-local:
-      IPAllowList:
-        sourceRange:
-          - "192.168.1.1/16"
-          - "172.27.0.0/16"

hosts/ps10rp/traefik/traefik_config/conf/metrics.yml

@@ -1,8 +0,0 @@
-http:
-  routers:
-    prometheus:
-      rule: "(Host(`traefik-ps10rp.alexlebens.net`) && Path(`/metrics`))"
-      entryPoints: websecure
-      service: prometheus@internal
-      middlewares:
-        - "ip-local@file"

hosts/ps10rp/traefik/traefik_config/traefik.yml

@@ -1,113 +0,0 @@
-################################################################
-# Global
-################################################################
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-
-################################################################
-# EntryPoints
-################################################################
-
-entryPoints:
-  web:
-    address: :80
-    http:
-      redirections:
-        entryPoint:
-          to: websecure
-          scheme: https
-
-  websecure:
-    address: :443
-    forwardedHeaders:
-      trustedIPs:
-        - "192.168.1.1/16"
-    proxyProtocol:
-      trustedIPs:
-        - "192.168.1.1/16"
-    http:
-      tls:
-        options: default
-        certResolver: cloudflare
-        domains:
-          - main: "*.lebens-home.net"
-            sans:
-              - "lebens-home.net"
-      middlewares:
-        - ip-local@file
-
-################################################################
-# Certificate Resolvers
-################################################################
-
-certificatesResolvers:
-  cloudflare:
-    acme:
-      email: alexanderlebens@gmail.com
-      storage: /etc/traefik/acme/acme.json
-      preferredChain: "ISRG Root X1"
-      dnsChallenge:
-        provider: cloudflare
-        delayBeforeCheck: "3"
-        resolvers:
-          - "1.1.1.1"
-          - "1.0.0.1"
-
-################################################################
-# Traefik logs
-################################################################
-
-log:
-  level: INFO
-
-################################################################
-# Access logs
-################################################################
-
-accessLog: {}
-
-################################################################
-# API and Dashboard
-################################################################
-
-api:
-  insecure: false
-  dashboard: true
-
-################################################################
-# Ping
-################################################################
-
-# ping:
-
-################################################################
-# Metrics
-################################################################
-
-metrics:
-  prometheus:
-    addEntryPointsLabels: true
-    addRoutersLabels: true
-    addServicesLabels: true
-    buckets:
-      - 0.1
-      - 0.3
-      - 1.2
-      - 5.0
-    entryPoint: websecure
-    manualRouting: true
-
-################################################################
-# Providers
-################################################################
-
-providers:
-  docker:
-    endpoint: "unix:///var/run/docker.sock"
-    exposedByDefault: false
-
-  file:
-    directory: "/etc/traefik/conf"
-    watch: true

hosts/ps10rp/watchtower/.env

@@ -1,5 +0,0 @@
-TZ=US/Central
-WATCHTOWER_HTTP_API_METRICS=true
-WATCHTOWER_HTTP_API_TOKEN=token
-WATCHTOWER_CLEANUP=true
-WATCHTOWER_POLL_INTERVAL=3600

hosts/ps10rp/watchtower/docker-compose.yml

@@ -1,13 +0,0 @@
-services:
-    watchtower:
-        container_name: watchtower
-        dns:
-            - 172.19.0.3
-            - 1.1.1.1
-        env_file:
-            - .env
-        image: docker.io/containrrr/watchtower:latest
-        privileged: true
-        restart: always
-        volumes:
-            - /var/run/docker.sock:/var/run/docker.sock