diff --git a/alloy/README.md b/alloy/README.md deleted file mode 100644 index a1d0e9a..0000000 --- a/alloy/README.md +++ /dev/null @@ -1,11 +0,0 @@ -# Helm configuration for Alloy (OSS monitoring collector) - -This directory contains Helm configuration for deploying Grafana Alloy, an open-source observability data collector. - -## Quick Install - -```bash -helm repo add grafana https://grafana.github.io/helm-charts -helm repo update -helm install alloy grafana/alloy --namespace alloy -f values.yaml -``` diff --git a/alloy/values.yaml b/alloy/values.yaml deleted file mode 100644 index c7f020b..0000000 --- a/alloy/values.yaml +++ /dev/null @@ -1,107 +0,0 @@ -alloy: - clustering: - enabled: false # Single node deployment - - configMap: - create: true - content: |- - discovery.kubernetes "all_pods" { - role = "pod" - - selectors { - role = "pod" - field = "spec.nodeName=" + coalesce(env("HOSTNAME"), constants.hostname) - } - } - - discovery.relabel "all_pods" { - targets = discovery.kubernetes.all_pods.targets - - rule { - source_labels = ["__meta_kubernetes_namespace"] - target_label = "namespace" - } - rule { - source_labels = ["__meta_kubernetes_pod_name"] - target_label = "pod" - } - rule { - source_labels = ["__meta_kubernetes_pod_container_name"] - target_label = "container" - } - rule { - source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"] - target_label = "app" - } - } - - loki.source.kubernetes "all_logs" { - targets = discovery.relabel.all_pods.output - forward_to = [loki.write.main.receiver] - } - - discovery.kubernetes "shared_pods" { - role = "pod" - selectors { - role = "pod" - field = "metadata.namespace=chacal" - } - } - - discovery.relabel "shared_pods" { - targets = discovery.kubernetes.shared_pods.targets - - rule { - source_labels = ["__meta_kubernetes_namespace"] - target_label = "namespace" - } - rule { - source_labels = ["__meta_kubernetes_pod_name"] - target_label = "pod" - } - rule { - source_labels = ["__meta_kubernetes_pod_container_name"] - target_label = "container" - } - rule { - source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"] - target_label = "app" - } - } - - loki.source.kubernetes "shared_logs" { - targets = discovery.relabel.shared_pods.output - forward_to = [loki.write.shared.receiver] - } - - loki.write "main" { - endpoint { - url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push" - headers = { - "X-Scope-OrgID" = "main", - } - } - } - - loki.write "shared" { - endpoint { - url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push" - headers = { - "X-Scope-OrgID" = "chacal", - } - } - } - - mounts: - varlog: true # Mount host /var/log for pod logs - - controller: - type: daemonset # Run on every node - - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 200m - memory: 256Mi \ No newline at end of file diff --git a/certs/internal-issuer.yaml b/certs/internal-issuer.yaml deleted file mode 100644 index f9a7ffb..0000000 --- a/certs/internal-issuer.yaml +++ /dev/null @@ -1,8 +0,0 @@ -# internal-issuer.yaml -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: internal-ca -spec: - ca: - secretName: internal-ca-secret \ No newline at end of file diff --git a/cloud/affine.yaml b/cloud/affine.yaml deleted file mode 100644 index a592d73..0000000 --- a/cloud/affine.yaml +++ /dev/null @@ -1,130 +0,0 @@ ---- -# ============ AFFiNE app ============ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: affine - namespace: cloud - labels: - app: affine -spec: - replicas: 1 - selector: - matchLabels: - app: affine - strategy: - type: Recreate - template: - metadata: - labels: - app: affine - spec: - containers: - - name: affine - image: ghcr.io/toeverything/affine:stable - imagePullPolicy: Always - command: - [ - "sh", - "-c", - "node ./scripts/self-host-predeploy.js && node ./dist/main.js", - ] - env: - - name: AFFINE_CONFIG_PATH - value: "/root/.affine/config" - - name: AFFINE_SERVER_EXTERNAL_URL - value: "http://affine.haven" - - name: AFFINE_SERVER_HOST - value: "0.0.0.0" - - name: AFFINE_SERVER_PORT - value: "3010" - - name: AFFINE_SERVER_HTTPS - value: "false" - - name: AFFINE_SERVER_SUBPATH - value: "/" - - name: AFFINE_ENABLE_SYNC_FROM_STARTUP - value: "true" - - name: DATABASE_URL - value: "postgres://affine:affine@postgresql.haven:5432/affine" - - name: REDIS_SERVER_HOST - value: "redis.haven" - - name: REDIS_SERVER_PORT - value: "6379" - ports: - - containerPort: 3010 - name: http - readinessProbe: - httpGet: - path: / - port: 3010 - initialDelaySeconds: 20 - periodSeconds: 10 - failureThreshold: 6 - resources: - requests: - cpu: 200m - memory: 512Mi - limits: - cpu: 2000m - memory: 2Gi - volumeMounts: - - name: config - mountPath: /root/.affine/config - volumes: - - name: config - persistentVolumeClaim: - claimName: affine-config - terminationGracePeriodSeconds: 30 ---- -apiVersion: v1 -kind: Service -metadata: - name: affine - namespace: cloud - labels: - app: affine -spec: - type: ClusterIP - selector: - app: affine - ports: - - name: http - port: 3010 - protocol: TCP - targetPort: http ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: affine-config - namespace: cloud - annotations: - nfs.io/storage-path: "affine-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: affine - namespace: cloud - labels: - app: affine -spec: - ingressClassName: nginx - rules: - - host: affine.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: affine - port: - number: 3010 diff --git a/cloud/cloudreve.yaml b/cloud/cloudreve.yaml deleted file mode 100644 index f28de4e..0000000 --- a/cloud/cloudreve.yaml +++ /dev/null @@ -1,178 +0,0 @@ -# 2) Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cloudreve - namespace: cloud -spec: - replicas: 1 - selector: - matchLabels: - app: cloudreve - template: - metadata: - labels: - app: cloudreve - spec: - containers: - - name: cloudreve - image: cloudreve/cloudreve:v4 - imagePullPolicy: Always - ports: - - containerPort: 5212 - name: http - - containerPort: 6888 - name: slave-tcp - protocol: TCP - - containerPort: 6888 - name: slave-udp - protocol: UDP - env: - - name: CR_CONF_Database.Type - value: "postgres" - - name: CR_CONF_Database.Host - value: "postgresql.haven" - - name: CR_CONF_Database.Port - value: "5432" - - name: CR_CONF_Database.User - valueFrom: - secretKeyRef: - name: cloudreve-secret - key: DB_USER - - name: CR_CONF_Database.Name - valueFrom: - secretKeyRef: - name: cloudreve-secret - key: DB_NAME - - name: CR_CONF_Database.Password - valueFrom: - secretKeyRef: - name: cloudreve-secret - key: DB_PASSWORD - - name: CR_CONF_Database.SSLMode - value: "disable" - - name: CR_CONF_Redis.Server - value: "" - - name: CR_CONF_Redis.Password - valueFrom: - secretKeyRef: - name: cloudreve-secret - key: REDIS_PASSWORD - volumeMounts: - - name: cloudreve-data - mountPath: /cloudreve/data - resources: - requests: - cpu: "250m" - memory: "256Mi" - limits: - cpu: "1000m" - memory: "1Gi" - volumes: - - name: cloudreve-data - nfs: - server: 192.168.15.99 - path: /export/Storage/Cloud ---- -# 3) Service (HTTP) -apiVersion: v1 -kind: Service -metadata: - name: cloudreve - namespace: cloud -spec: - type: ClusterIP - selector: - app: cloudreve - ports: - - port: 5212 - targetPort: 5212 - name: http - ---- -# 4) Service (Slave node / WebDAV — optional) -apiVersion: v1 -kind: Service -metadata: - name: cloudreve-slave - namespace: cloud -spec: - type: ClusterIP - selector: - app: cloudreve - ports: - - port: 6888 - targetPort: 6888 - name: slave-tcp - protocol: TCP - - port: 6888 - targetPort: 6888 - name: slave-udp - protocol: UDP - ---- -# 5) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: cloudreve-data - namespace: cloud - annotations: - nfs.io/storage-path: "cloudreve-data" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 10Gi - limits: - storage: 50Gi ---- -# 6) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: cloudreve - namespace: cloud - annotations: - nginx.ingress.kubernetes.io/proxy-body-size: "0" - nginx.ingress.kubernetes.io/proxy-read-timeout: "600" - nginx.ingress.kubernetes.io/proxy-send-timeout: "600" -spec: - ingressClassName: nginx - rules: - - host: cloud.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: cloudreve - port: - number: 5212 ---- -# 7) Ingress Public -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: cloudreve-public - namespace: cloud - annotations: - nginx.ingress.kubernetes.io/proxy-body-size: "0" - nginx.ingress.kubernetes.io/proxy-read-timeout: "600" - nginx.ingress.kubernetes.io/proxy-send-timeout: "600" -spec: - ingressClassName: nginx - rules: - - host: cloud.ivanch.me - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: cloudreve - port: - number: 5212 diff --git a/cloud/slink.yaml b/cloud/slink.yaml deleted file mode 100644 index a38973e..0000000 --- a/cloud/slink.yaml +++ /dev/null @@ -1,136 +0,0 @@ -# 1) Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: slink - namespace: cloud -spec: - replicas: 1 - selector: - matchLabels: - app: slink - template: - metadata: - labels: - app: slink - spec: - containers: - - name: slink - image: anirdev/slink:latest - imagePullPolicy: Always - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - env: - - name: PUID - value: "1000" - - name: PGID - value: "1000" - - name: ORIGIN - value: "http://slink.haven" - - name: TZ - value: "America/Sao_Paulo" - - name: USER_APPROVAL_REQUIRED - value: "true" - - name: USER_PASSWORD_MIN_LENGTH - value: "8" - - name: USER_PASSWORD_REQUIREMENTS - value: "15" - - name: ADMIN_USERNAME - valueFrom: - secretKeyRef: - name: slink-secret - key: ADMIN_USERNAME - - name: ADMIN_EMAIL - valueFrom: - secretKeyRef: - name: slink-secret - key: ADMIN_EMAIL - - name: ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: slink-secret - key: ADMIN_PASSWORD - - name: IMAGE_MAX_SIZE - value: "50M" - - name: IMAGE_STRIP_EXIF_METADATA - value: "true" - - name: IMAGE_COMPRESSION_QUALITY - value: "90" - - name: STORAGE_PROVIDER - value: "local" - ports: - - containerPort: 3000 - name: slink-port - resources: - requests: - cpu: "100m" - memory: "64Mi" - limits: - cpu: "500m" - memory: "512Mi" - volumeMounts: - - name: slink-data - mountPath: /app/var/data - - name: slink-data - mountPath: /app/slink/images - volumes: - - name: slink-data - persistentVolumeClaim: - claimName: slink-data ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: slink - namespace: cloud -spec: - type: ClusterIP - selector: - app: slink - ports: - - port: 3000 - targetPort: slink-port ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: slink-data - namespace: cloud - annotations: - nfs.io/storage-path: "slink-data" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteMany - resources: - requests: - storage: 5Gi - limits: - storage: 15Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: slink - namespace: cloud - annotations: - nginx.ingress.kubernetes.io/proxy-body-size: "0" - nginx.ingress.kubernetes.io/proxy-read-timeout: "600" - nginx.ingress.kubernetes.io/proxy-send-timeout: "600" -spec: - ingressClassName: nginx - rules: - - host: slink.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: slink - port: - number: 3000 diff --git a/default/archivebox.yaml b/default/archivebox.yaml deleted file mode 100644 index 3e674ce..0000000 --- a/default/archivebox.yaml +++ /dev/null @@ -1,159 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: sonic - namespace: default -spec: - replicas: 1 - selector: - matchLabels: - app: sonic - template: - metadata: - labels: - app: sonic - spec: - containers: - - name: sonic - image: archivebox/sonic:latest - imagePullPolicy: Always - ports: - - containerPort: 1491 - env: - - name: SEARCH_BACKEND_PASSWORD - valueFrom: - secretKeyRef: - name: password - key: password - resources: - requests: - memory: "64Mi" - cpu: "50m" - limits: - memory: "128Mi" - cpu: "200m" ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: archivebox - namespace: default -spec: - replicas: 1 - selector: - matchLabels: - app: archivebox - template: - metadata: - labels: - app: archivebox - spec: - containers: - - name: archivebox - image: archivebox/archivebox:latest - imagePullPolicy: Always - ports: - - containerPort: 8000 - env: - - name: SONIC_HOST - value: "sonic.default.svc.cluster.local" - - name: SONIC_PORT - value: "1491" - - name: SEARCH_BACKEND_ENGINE - value: "sonic" - - name: SONIC_PASSWORD - valueFrom: - secretKeyRef: - name: password - key: password - - name: ADMIN_USERNAME - value: "ivanch" - - name: ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: password - key: password - - name: CSRF_TRUSTED_ORIGINS - value: "archive.haven" - - name: ALLOWED_HOSTS - value: "*" - - name: PUBLIC_ADD_VIEW - value: "false" - volumeMounts: - - name: archivebox-data - mountPath: /data - resources: - requests: - memory: "256Mi" - cpu: "100m" - limits: - memory: "2Gi" - cpu: "3000m" - volumes: - - name: archivebox-data - persistentVolumeClaim: - claimName: archivebox-data ---- -apiVersion: v1 -kind: Service -metadata: - name: sonic-svc - namespace: default -spec: - selector: - app: sonic - ports: - - protocol: TCP - port: 1491 - targetPort: 1491 ---- -apiVersion: v1 -kind: Service -metadata: - name: archivebox-svc - namespace: default -spec: - selector: - app: archivebox - ports: - - protocol: TCP - port: 8000 - targetPort: 8000 ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: archivebox-data - namespace: default - annotations: - nfs.io/storage-path: "archivebox-data" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 10Gi - limits: - storage: 30Gi ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: archivebox-ingress - namespace: default -spec: - ingressClassName: nginx - rules: - - host: "archive.haven" - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: archivebox-svc - port: - number: 8000 diff --git a/default/changedetection.yaml b/default/changedetection.yaml deleted file mode 100644 index ed0a209..0000000 --- a/default/changedetection.yaml +++ /dev/null @@ -1,157 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: changedetection - namespace: default - labels: - app.kubernetes.io/name: changedetection -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/name: changedetection - strategy: - type: Recreate - template: - metadata: - labels: - app.kubernetes.io/name: changedetection - spec: - affinity: - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - preference: - matchExpressions: - - key: kubernetes.io/hostname - operator: In - values: - - iris - containers: - - name: changedetection - image: lscr.io/linuxserver/changedetection.io:latest - imagePullPolicy: Always - env: - - name: PUID - value: "1000" - - name: PGID - value: "1000" - - name: TZ - value: "Etc/UTC" - - name: BASE_URL - value: "http://change.haven/" - - name: PLAYWRIGHT_DRIVER_URL - value: "ws://localhost:3000" - ports: - - containerPort: 5000 - name: http - protocol: TCP - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - cpu: 2000m - memory: 1Gi - securityContext: - allowPrivilegeEscalation: false - runAsUser: 0 - volumeMounts: - - name: config - mountPath: /config - - name: browser-sockpuppet-chrome - image: dgtlmoon/sockpuppetbrowser:latest - imagePullPolicy: Always - env: - - name: SCREEN_WIDTH - value: "1920" - - name: SCREEN_HEIGHT - value: "1024" - - name: SCREEN_DEPTH - value: "16" - - name: MAX_CONCURRENT_CHROME_PROCESSES - value: "10" - ports: - - containerPort: 3000 - name: ws - protocol: TCP - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - cpu: 2000m - memory: 4Gi - securityContext: - allowPrivilegeEscalation: false - capabilities: - add: - - SYS_ADMIN - drop: - - ALL - volumes: - - name: config - persistentVolumeClaim: - claimName: changedetection-config - dnsPolicy: ClusterFirst - restartPolicy: Always - terminationGracePeriodSeconds: 30 ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: changedetection - namespace: default - labels: - app.kubernetes.io/name: changedetection -spec: - type: ClusterIP - selector: - app.kubernetes.io/name: changedetection - ports: - - name: http - port: 5000 - protocol: TCP - targetPort: http ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: changedetection-config - namespace: default - annotations: - nfs.io/storage-path: "changedetection-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - limits: - storage: 2Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: changedetection - namespace: default - labels: - app.kubernetes.io/name: changedetection -spec: - ingressClassName: nginx - rules: - - host: change.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: changedetection - port: - number: 5000 diff --git a/default/homepage.yaml b/default/homepage.yaml deleted file mode 100644 index 9d6d64c..0000000 --- a/default/homepage.yaml +++ /dev/null @@ -1,206 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: homepage - namespace: default - labels: - app.kubernetes.io/name: homepage -secrets: - - name: homepage ---- -apiVersion: v1 -kind: Secret -type: kubernetes.io/service-account-token -metadata: - name: homepage - namespace: default - labels: - app.kubernetes.io/name: homepage - annotations: - kubernetes.io/service-account.name: homepage ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: homepage - labels: - app.kubernetes.io/name: homepage -rules: - - apiGroups: - - "" - resources: - - namespaces - - pods - - nodes - verbs: - - get - - list - - apiGroups: - - extensions - - networking.k8s.io - resources: - - ingresses - verbs: - - get - - list - - apiGroups: - - traefik.io - resources: - - ingressroutes - verbs: - - get - - list - - apiGroups: - - gateway.networking.k8s.io - resources: - - httproutes - - gateways - verbs: - - get - - list - - apiGroups: - - metrics.k8s.io - resources: - - nodes - - pods - verbs: - - get - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: homepage - labels: - app.kubernetes.io/name: homepage -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: homepage -subjects: - - kind: ServiceAccount - name: homepage - namespace: default ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: homepage - namespace: default - labels: - app.kubernetes.io/name: homepage -spec: - revisionHistoryLimit: 3 - replicas: 1 - strategy: - type: RollingUpdate - selector: - matchLabels: - app.kubernetes.io/name: homepage - template: - metadata: - labels: - app.kubernetes.io/name: homepage - annotations: - configmap.reloader/checksum: '{{ include (print $.Template.BasePath "/app/config/services.yaml") . | sha256sum }}' - spec: - serviceAccountName: homepage - automountServiceAccountToken: true - enableServiceLinks: true - containers: - - name: homepage - image: "ghcr.io/gethomepage/homepage:latest" - imagePullPolicy: Always - env: - - name: HOMEPAGE_ALLOWED_HOSTS - value: "*" - ports: - - name: http - containerPort: 3000 - protocol: TCP - livenessProbe: - httpGet: - path: / - port: 3000 - initialDelaySeconds: 30 - periodSeconds: 10 - readinessProbe: - httpGet: - path: / - port: 3000 - initialDelaySeconds: 5 - periodSeconds: 5 - volumeMounts: - - name: logs - mountPath: /app/config/logs - - name: homepage-config - mountPath: /app/config - - name: homepage-config - mountPath: /app/public/images - subPath: images - resources: - requests: - memory: "128Mi" - cpu: "100m" - limits: - memory: "512Mi" - cpu: "500m" - volumes: - - name: homepage-config - persistentVolumeClaim: - claimName: homepage-config - - name: logs - emptyDir: {} ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: homepage-config - namespace: default - annotations: - nfs.io/storage-path: "homepage-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteMany - resources: - requests: - storage: 1Gi ---- -apiVersion: v1 -kind: Service -metadata: - name: homepage - namespace: default - labels: - app.kubernetes.io/name: homepage -spec: - type: ClusterIP - ports: - - port: 3000 - targetPort: http - protocol: TCP - name: http - selector: - app.kubernetes.io/name: homepage ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: homepage - namespace: default - labels: - app.kubernetes.io/name: homepage -spec: - ingressClassName: nginx - rules: - - host: "homepage.haven" - http: - paths: - - path: "/" - pathType: Prefix - backend: - service: - name: homepage - port: - number: 3000 diff --git a/default/it-tools.yaml b/default/it-tools.yaml deleted file mode 100644 index d45234d..0000000 --- a/default/it-tools.yaml +++ /dev/null @@ -1,67 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: it-tools - namespace: default -spec: - replicas: 1 - selector: - matchLabels: - app: it-tools - template: - metadata: - labels: - app: it-tools - spec: - containers: - - name: it-tools - image: corentinth/it-tools:latest - imagePullPolicy: Always - ports: - - containerPort: 80 - readinessProbe: - httpGet: - path: / - port: 80 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - requests: - memory: "64Mi" - cpu: "50m" - limits: - memory: "128Mi" - cpu: "200m" ---- -apiVersion: v1 -kind: Service -metadata: - name: it-tools-svc - namespace: default -spec: - selector: - app: it-tools - ports: - - protocol: TCP - port: 80 - targetPort: 80 ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: it-tools-ingress - namespace: default -spec: - ingressClassName: nginx - rules: - - host: "tools.haven" - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: it-tools-svc - port: - number: 80 diff --git a/default/notepad.yaml b/default/notepad.yaml deleted file mode 100644 index 9eecd3f..0000000 --- a/default/notepad.yaml +++ /dev/null @@ -1,98 +0,0 @@ ---- -# 1) Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: notepad - namespace: default -spec: - replicas: 1 - selector: - matchLabels: - app: notepad - template: - metadata: - labels: - app: notepad - spec: - containers: - - name: notepad - image: jdreinhardt/minimalist-web-notepad:latest - imagePullPolicy: Always - # The image entrypoint runs `chown -R www-data:www-data` on the NFS-mounted - # _tmp dir, which fails because the NFS export uses all_squash (anonuid=65534). - # Override the entrypoint to skip chown — ownership is handled by the NFS server. - command: - - sh - - -c - - >- - mkdir -p /var/www/html/_tmp && - cp -n /var/www/html/notes.htaccess /var/www/html/_tmp/.htaccess 2>/dev/null; - exec docker-php-entrypoint apache2-foreground - ports: - - containerPort: 80 - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - cpu: 200m - memory: 128Mi - volumeMounts: - - name: notepad-data - mountPath: /var/www/html/_tmp - volumes: - - name: notepad-data - persistentVolumeClaim: - claimName: notepad-data - ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: notepad - namespace: default -spec: - type: ClusterIP - selector: - app: notepad - ports: - - port: 80 - targetPort: 80 ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: notepad-data - namespace: default - annotations: - nfs.io/storage-path: "notepad-data" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: notepad - namespace: default -spec: - ingressClassName: nginx - rules: - - host: notepad.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: notepad - port: - number: 80 diff --git a/default/openwebui.yaml b/default/openwebui.yaml deleted file mode 100644 index 98063cb..0000000 --- a/default/openwebui.yaml +++ /dev/null @@ -1,112 +0,0 @@ -# 1) Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: openwebui - namespace: default -spec: - replicas: 1 - selector: - matchLabels: - app: openwebui - template: - metadata: - labels: - app: openwebui - spec: - affinity: - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - preference: - matchExpressions: - - key: kubernetes.io/hostname - operator: In - values: - - iris - containers: - - name: openwebui - image: ghcr.io/open-webui/open-webui:main-slim - imagePullPolicy: Always - ports: - - containerPort: 8080 - env: - - name: PUID - value: "1000" - - name: PGID - value: "1000" - - name: TZ - value: "America/Sao_Paulo" - - name: DATABASE_URL - valueFrom: - secretKeyRef: - name: openwebui-secret - key: DATABASE_URL - resources: - requests: - cpu: "250m" - memory: "512Mi" - limits: - cpu: "1000m" - memory: "2Gi" - volumeMounts: - - name: openwebui-data - mountPath: /app/backend/data - volumes: - - name: openwebui-data - persistentVolumeClaim: - claimName: openwebui-data ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: openwebui - namespace: default -spec: - type: ClusterIP - selector: - app: openwebui - ports: - - port: 8080 - targetPort: 8080 ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: openwebui-data - namespace: default - annotations: - nfs.io/storage-path: "openwebui-data" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 5Gi - limits: - storage: 10Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: openwebui - namespace: default - annotations: - nginx.ingress.kubernetes.io/proxy-body-size: "50m" -spec: - ingressClassName: nginx - rules: - - host: openwebui.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: openwebui - port: - number: 8080 diff --git a/default/paperless.yaml b/default/paperless.yaml deleted file mode 100644 index 66932e1..0000000 --- a/default/paperless.yaml +++ /dev/null @@ -1,151 +0,0 @@ ---- -# 1) Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: paperless - namespace: default -spec: - replicas: 1 - selector: - matchLabels: - app: paperless - template: - metadata: - labels: - app: paperless - spec: - affinity: - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - preference: - matchExpressions: - - key: kubernetes.io/hostname - operator: In - values: - - iris - containers: - - name: paperless - image: ghcr.io/paperless-ngx/paperless-ngx:latest - imagePullPolicy: Always - env: - - name: PUID - value: "1000" - - name: PGID - value: "1000" - - name: PAPERLESS_URL - value: "http://paperless.haven" - - name: PAPERLESS_TIME_ZONE - value: "America/Sao_Paulo" - - name: PAPERLESS_OCR_LANGUAGE - value: "por" - - name: PAPERLESS_OCR_LANGUAGES - value: "por" - - name: PAPERLESS_OCR_USER_ARGS - value: '{"invalidate_digital_signatures": true}' - - name: PAPERLESS_DBHOST - value: postgresql.haven - - name: PAPERLESS_DBNAME - valueFrom: - secretKeyRef: - name: paperless-secret - key: PAPERLESS_DBNAME - - name: PAPERLESS_DBUSER - valueFrom: - secretKeyRef: - name: paperless-secret - key: PAPERLESS_DBUSER - - name: PAPERLESS_DBPASSWORD - valueFrom: - secretKeyRef: - name: paperless-secret - key: PAPERLESS_DBPASSWORD - - name: PAPERLESS_REDIS - value: "redis://redis.haven:6379" - - name: PAPERLESS_PORT - value: "8000" - - name: PAPERLESS_SECRET_KEY - valueFrom: - secretKeyRef: - name: paperless-secret - key: PAPERLESS_SECRET_KEY - ports: - - containerPort: 8000 - name: paperless-port - resources: - requests: - cpu: "100m" - memory: "256Mi" - limits: - cpu: "4000m" - memory: "1Gi" - volumeMounts: - - name: paperless-data - subPath: data - mountPath: /usr/src/paperless/data - - name: paperless-data - subPath: media - mountPath: /usr/src/paperless/media - - name: paperless-data - subPath: export - mountPath: /usr/src/paperless/export - - name: paperless-data - subPath: consume - mountPath: /usr/src/paperless/consume - volumes: - - name: paperless-data - persistentVolumeClaim: - claimName: paperless-data ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: paperless - namespace: default -spec: - type: ClusterIP - selector: - app: paperless - ports: - - port: 8000 - targetPort: paperless-port ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: paperless-data - namespace: default - annotations: - nfs.io/storage-path: "paperless-data" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteMany - resources: - requests: - storage: 5Gi - limits: - storage: 15Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: paperless - namespace: default -spec: - ingressClassName: nginx - rules: - - host: paperless.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: paperless - port: - number: 8000 diff --git a/default/searxng.yaml b/default/searxng.yaml deleted file mode 100644 index 21a4b46..0000000 --- a/default/searxng.yaml +++ /dev/null @@ -1,94 +0,0 @@ ---- -# 1) Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: searxng - namespace: default -spec: - replicas: 1 - selector: - matchLabels: - app: searxng - template: - metadata: - labels: - app: searxng - spec: - enableServiceLinks: false - containers: - - name: searxng - image: searxng/searxng:latest - imagePullPolicy: Always - env: - - name: PUID - value: "1000" - - name: PGID - value: "1000" - ports: - - containerPort: 8080 - name: searxng-port - resources: - requests: - cpu: "100m" - memory: "256Mi" - limits: - cpu: "500m" - memory: "512Mi" - volumeMounts: - - name: searxng-config - mountPath: /etc/searxng - volumes: - - name: searxng-config - persistentVolumeClaim: - claimName: searxng-config ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: searxng - namespace: default -spec: - type: ClusterIP - selector: - app: searxng - ports: - - port: 8080 - targetPort: searxng-port ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: searxng-config - namespace: default - annotations: - nfs.io/storage-path: "searxng-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteMany - resources: - requests: - storage: 1Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: searxng - namespace: default -spec: - ingressClassName: nginx - rules: - - host: search.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: searxng - port: - number: 8080 \ No newline at end of file diff --git a/default/stirling-pdf.yaml b/default/stirling-pdf.yaml deleted file mode 100644 index 384a5f4..0000000 --- a/default/stirling-pdf.yaml +++ /dev/null @@ -1,113 +0,0 @@ ---- -# 1) Deployment - Stirling-PDF -apiVersion: apps/v1 -kind: Deployment -metadata: - name: stirlingpdf - namespace: default - labels: - app: stirlingpdf -spec: - replicas: 1 - selector: - matchLabels: - app: stirlingpdf - template: - metadata: - labels: - app: stirlingpdf - spec: - containers: - - name: stirlingpdf - image: stirlingtools/stirling-pdf:latest - imagePullPolicy: Always - env: - - name: TZ - value: "America/Sao_Paulo" - - name: DOCKER_ENABLE_SECURITY - value: "false" - - name: SECURITY_ENABLELOGIN - value: "false" - ports: - - containerPort: 8080 - name: http - readinessProbe: - httpGet: - path: / - port: 8080 - initialDelaySeconds: 20 - periodSeconds: 10 - resources: - requests: - cpu: 100m - memory: 1Gi - limits: - cpu: 2000m - memory: 2Gi - securityContext: - allowPrivilegeEscalation: false - runAsUser: 0 - volumeMounts: - - name: config - mountPath: /configs - volumes: - - name: config - persistentVolumeClaim: - claimName: stirlingpdf-config - terminationGracePeriodSeconds: 30 ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: stirlingpdf - namespace: default - labels: - app: stirlingpdf -spec: - type: ClusterIP - selector: - app: stirlingpdf - ports: - - name: http - port: 8080 - protocol: TCP - targetPort: http ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: stirlingpdf-config - namespace: default - annotations: - nfs.io/storage-path: "stirlingpdf-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: stirlingpdf - namespace: default - labels: - app: stirlingpdf -spec: - ingressClassName: nginx - rules: - - host: stirling.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: stirlingpdf - port: - number: 8080 diff --git a/default/uptime-kuma.yaml b/default/uptime-kuma.yaml deleted file mode 100644 index 0158634..0000000 --- a/default/uptime-kuma.yaml +++ /dev/null @@ -1,107 +0,0 @@ ---- -# 1) Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: uptimekuma - namespace: default -spec: - replicas: 1 - strategy: - type: Recreate - selector: - matchLabels: - app: uptimekuma - template: - metadata: - labels: - app: uptimekuma - spec: - containers: - - name: uptimekuma - image: louislam/uptime-kuma:2 - imagePullPolicy: Always - env: - - name: PUID - value: "1000" - - name: PGID - value: "1000" - ports: - - containerPort: 3001 - name: uptimekuma-port - resources: - requests: - memory: "128Mi" - cpu: "100m" - limits: - memory: "256Mi" - cpu: "500m" - livenessProbe: - httpGet: - path: / - port: 3001 - initialDelaySeconds: 30 - periodSeconds: 60 - readinessProbe: - httpGet: - path: / - port: 3001 - initialDelaySeconds: 5 - periodSeconds: 5 - volumeMounts: - - name: uptimekuma-config - mountPath: /app/data - volumes: - - name: uptimekuma-config - persistentVolumeClaim: - claimName: uptimekuma-config ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: uptimekuma - namespace: default -spec: - type: ClusterIP - selector: - app: uptimekuma - ports: - - port: 3001 - targetPort: uptimekuma-port ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: uptimekuma-config - namespace: default - annotations: - nfs.io/storage-path: "uptimekuma-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteMany - resources: - requests: - storage: 1Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: uptimekuma - namespace: default -spec: - ingressClassName: nginx - rules: - - host: uptimekuma.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: uptimekuma - port: - number: 3001 \ No newline at end of file diff --git a/default/vaultwarden.yaml b/default/vaultwarden.yaml deleted file mode 100644 index 6cc5ace..0000000 --- a/default/vaultwarden.yaml +++ /dev/null @@ -1,148 +0,0 @@ ---- -# 1) Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: vaultwarden - namespace: default -spec: - replicas: 1 - selector: - matchLabels: - app: vaultwarden - template: - metadata: - labels: - app: vaultwarden - spec: - containers: - - name: vaultwarden - image: vaultwarden/server:latest - imagePullPolicy: Always - env: - - name: DOMAIN - value: "https://vault.haven" - - name: ADMIN_TOKEN - valueFrom: - secretKeyRef: - name: vaultwarden-admin-token - key: ADMIN_TOKEN - ports: - - containerPort: 80 - name: vault-port - # /alive requires no authentication and verifies the Vaultwarden process - startupProbe: - httpGet: - path: /alive - port: vault-port - scheme: HTTP - periodSeconds: 5 - timeoutSeconds: 3 - failureThreshold: 30 - readinessProbe: - httpGet: - path: /alive - port: vault-port - scheme: HTTP - periodSeconds: 10 - timeoutSeconds: 3 - failureThreshold: 3 - livenessProbe: - httpGet: - path: /alive - port: vault-port - scheme: HTTP - periodSeconds: 15 - timeoutSeconds: 3 - failureThreshold: 6 - volumeMounts: - - name: vaultwarden-data - mountPath: /data - resources: - requests: - cpu: 250m - memory: 64Mi - limits: - cpu: 250m - memory: 256Mi - volumes: - - name: vaultwarden-data - persistentVolumeClaim: - claimName: vaultwarden-data ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: vaultwarden - namespace: default -spec: - type: ClusterIP - selector: - app: vaultwarden - ports: - - port: 80 - targetPort: vault-port ---- -# 3) PersistentVolumeClaim (for /data) -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: vaultwarden-data - namespace: default - annotations: - nfs.io/storage-path: "vaultwarden-data" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteMany - resources: - requests: - storage: 1Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: vaultwarden - namespace: default - annotations: - cert-manager.io/cluster-issuer: internal-ca - nginx.ingress.kubernetes.io/force-ssl-redirect: "true" -spec: - ingressClassName: nginx - tls: - - hosts: - - vault.haven - secretName: vaultwarden-tls - rules: - - host: vault.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: vaultwarden - port: - number: 80 ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: vaultwarden-public - namespace: default -spec: - ingressClassName: nginx - rules: - - host: vault.ivanch.me - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: vaultwarden - port: - number: 80 diff --git a/dev/README.md b/dev/README.md deleted file mode 100644 index d2b33f9..0000000 --- a/dev/README.md +++ /dev/null @@ -1,6 +0,0 @@ -## Creating gitea-runner secrets - -```bash -kubectl create secret generic gitea-runner-token \ - --from-literal=REGISTRATION_TOKEN='your_gitea_runner_token' -n dev -``` \ No newline at end of file diff --git a/dev/gitea-runner.yaml b/dev/gitea-runner.yaml deleted file mode 100644 index 190826b..0000000 --- a/dev/gitea-runner.yaml +++ /dev/null @@ -1,202 +0,0 @@ -# --- ConfigMap for the AMD64 Runner --- -apiVersion: v1 -kind: ConfigMap -metadata: - name: gitea-runner-amd64-config - namespace: dev -data: - config.yaml: | - # Registration token and Gitea instance URL should be managed via secrets - runner: - capacity: 4 - timeout: 1h - labels: - - "ubuntu-amd64:docker://docker.gitea.com/runner-images:ubuntu-latest" - - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest" - - "ubuntu-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim" - - "runner-full:docker://git.ivanch.me/ivanch/runner-images:full" - - "runner-slim:docker://git.ivanch.me/ivanch/runner-images:slim" - - "runner-full-amd64:docker://git.ivanch.me/ivanch/runner-images:full" - - "runner-slim-amd64:docker://git.ivanch.me/ivanch/runner-images:slim" ---- -# --- ConfigMap for the ARM64 Runner --- -apiVersion: v1 -kind: ConfigMap -metadata: - name: gitea-runner-arm64-config - namespace: dev -data: - config.yaml: | - runner: - capacity: 4 - timeout: 1h - labels: - - "ubuntu-arm64:docker://docker.gitea.com/runner-images:ubuntu-latest" - - "runner-full-arm64:docker://git.ivanch.me/ivanch/runner-images:full" - - "runner-slim-arm64:docker://git.ivanch.me/ivanch/runner-images:slim" ---- -# PersistentVolumeClaim for AMD64 -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: gitea-runner-amd64-pvc - namespace: dev - annotations: - nfs.io/storage-path: "gitea-runner-amd64-pvc" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteMany - resources: - requests: - storage: 8Mi ---- -# PersistentVolumeClaim for ARM64 -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: gitea-runner-arm64-pvc - namespace: dev - annotations: - nfs.io/storage-path: "gitea-runner-arm64-pvc" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteMany - resources: - requests: - storage: 8Mi ---- -# --- Deployment for the AMD64 Runner --- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: gitea-runner-amd64 - namespace: dev -spec: - replicas: 1 - selector: - matchLabels: - app: gitea-runner-amd64 - template: - metadata: - labels: - app: gitea-runner-amd64 - spec: - containers: - - name: gitea-runner - image: gitea/act_runner:latest - imagePullPolicy: Always - resources: - requests: - cpu: "500m" - memory: "512Mi" - limits: - cpu: "4000m" - memory: "4Gi" - volumeMounts: - - name: config-volume - mountPath: /etc/gitea-runner/config.yaml - subPath: config.yaml - - name: docker-socket - mountPath: /var/run/docker.sock - - name: gitea-runner-amd64-pvc - mountPath: /data - env: - - name: GITEA_RUNNER_REGISTRATION_TOKEN - valueFrom: - secretKeyRef: - name: gitea-runner-token - key: REGISTRATION_TOKEN - - name: GITEA_INSTANCE_URL - value: https://git.ivanch.me - - name: GITEA_RUNNER_NAME - value: k8s-runner-amd64 - - name: CONFIG_FILE - value: /etc/gitea-runner/config.yaml - volumes: - - name: config-volume - configMap: - name: gitea-runner-amd64-config - - name: docker-socket - hostPath: - path: /var/run/docker.sock - - name: gitea-runner-amd64-pvc - persistentVolumeClaim: - claimName: gitea-runner-amd64-pvc - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: kubernetes.io/hostname - operator: In - values: - - iris ---- -# --- Deployment for the ARM64 Runner --- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: gitea-runner-arm64 - namespace: dev -spec: - replicas: 1 - selector: - matchLabels: - app: gitea-runner-arm64 - template: - metadata: - labels: - app: gitea-runner-arm64 - spec: - containers: - - name: gitea-runner - image: gitea/act_runner:latest - imagePullPolicy: Always - resources: - requests: - cpu: "500m" - memory: "512Mi" - limits: - cpu: "4000m" - memory: "4Gi" - volumeMounts: - - name: config-volume - mountPath: /etc/gitea-runner/config.yaml - subPath: config.yaml - - name: docker-socket - mountPath: /var/run/docker.sock - - name: gitea-runner-arm64-pvc - mountPath: /data - env: - - name: GITEA_RUNNER_REGISTRATION_TOKEN - valueFrom: - secretKeyRef: - name: gitea-runner-token - key: REGISTRATION_TOKEN - - name: GITEA_INSTANCE_URL - value: https://git.ivanch.me - - name: GITEA_RUNNER_NAME - value: k8s-runner-arm64 - - name: CONFIG_FILE - value: /etc/gitea-runner/config.yaml - volumes: - - name: config-volume - configMap: - name: gitea-runner-arm64-config - - name: docker-socket - hostPath: - path: /var/run/docker.sock - - name: gitea-runner-arm64-pvc - persistentVolumeClaim: - claimName: gitea-runner-arm64-pvc - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: kubernetes.io/hostname - operator: In - values: - - nexus diff --git a/dns/adguard-sync.yaml b/dns/adguard-sync.yaml deleted file mode 100644 index 01da142..0000000 --- a/dns/adguard-sync.yaml +++ /dev/null @@ -1,118 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: adguardsync-pvc - namespace: dns - annotations: - nfs.io/storage-path: "adguardsync-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 10Mi ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: adguardsync - namespace: dns -spec: - strategy: - type: Recreate - replicas: 1 - selector: - matchLabels: - app: adguardsync - template: - metadata: - labels: - app: adguardsync - spec: - containers: - - name: adguardsync - image: ghcr.io/bakito/adguardhome-sync:latest - imagePullPolicy: Always - ports: - - containerPort: 8080 - protocol: TCP - name: web-port - env: - - name: CRON - value: "0 * * * *" - - name: RUN_ON_START - value: "true" - - name: LOG_LEVEL - value: "info" - - name: ORIGIN_URL - value: "http://adguard.haven" - - name: ORIGIN_USERNAME - valueFrom: - secretKeyRef: - name: adguardhome-password - key: username - - name: ORIGIN_PASSWORD - valueFrom: - secretKeyRef: - name: adguardhome-password - key: password - - name: REPLICA1_URL - value: "http://adguard2.haven" - - name: REPLICA1_USERNAME - valueFrom: - secretKeyRef: - name: adguardhome-password - key: username - - name: REPLICA1_PASSWORD - valueFrom: - secretKeyRef: - name: adguardhome-password - key: password - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - volumeMounts: - - name: adguardsync-storage - mountPath: /config - volumes: - - name: adguardsync-storage - persistentVolumeClaim: - claimName: adguardsync-pvc ---- -apiVersion: v1 -kind: Service -metadata: - name: adguardsync-svc - namespace: dns -spec: - type: ClusterIP - selector: - app: adguardsync - ports: - - name: web - port: 8080 - targetPort: 8080 ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: adguardsync-ingress - namespace: dns -spec: - ingressClassName: nginx - rules: - - host: adguardsync.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: adguardsync-svc - port: - number: 8080 diff --git a/dns/adguard.yaml b/dns/adguard.yaml deleted file mode 100644 index cf1607e..0000000 --- a/dns/adguard.yaml +++ /dev/null @@ -1,173 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: adguardhome-pvc - namespace: dns - annotations: - nfs.io/storage-path: "adguardhome-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 10Gi ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: adguardhome - namespace: dns -spec: - strategy: - type: Recreate - replicas: 1 - selector: - matchLabels: - app: adguardhome - template: - metadata: - labels: - app: adguardhome - spec: - containers: - - name: adguardhome - image: adguard/adguardhome:latest - imagePullPolicy: Always - ports: - - containerPort: 53 - protocol: TCP - - containerPort: 53 - protocol: UDP - - containerPort: 3000 - protocol: TCP - name: install-port - - containerPort: 80 - protocol: TCP - name: web-port - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 1000m - memory: 2Gi - livenessProbe: - httpGet: - path: / - port: 80 - initialDelaySeconds: 30 - periodSeconds: 10 - readinessProbe: - httpGet: - path: / - port: 80 - initialDelaySeconds: 5 - periodSeconds: 5 - volumeMounts: - - name: adguardhome-storage - mountPath: /opt/adguardhome/work - - name: adguardhome-storage - mountPath: /opt/adguardhome/conf - volumes: - - name: adguardhome-storage - persistentVolumeClaim: - claimName: adguardhome-pvc ---- -apiVersion: v1 -kind: Service -metadata: - name: adguardhome-svc - namespace: dns -spec: - type: LoadBalancer - selector: - app: adguardhome - loadBalancerIP: 192.168.20.200 - ports: - - name: dns-tcp - port: 53 - targetPort: 53 - protocol: TCP - - name: dns-udp - port: 53 - targetPort: 53 - protocol: UDP - - name: web - port: 80 - targetPort: 80 ---- -apiVersion: v1 -kind: Service -metadata: - name: adguardhome-lan-svc - namespace: dns -spec: - type: LoadBalancer - selector: - app: adguardhome - loadBalancerIP: 192.168.15.200 - ports: - - name: dns-tcp - port: 53 - targetPort: 53 - protocol: TCP - - name: dns-udp - port: 53 - targetPort: 53 - protocol: UDP - - name: web - port: 80 - targetPort: 80 ---- -apiVersion: v1 -kind: Service -metadata: - name: adguard-install-svc - namespace: dns -spec: - type: ClusterIP - selector: - app: adguardhome - ports: - - name: install - port: 3000 - targetPort: 3000 ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: adguardhome-ingress - namespace: dns -spec: - ingressClassName: nginx - rules: - - host: adguard.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: adguardhome-svc - port: - number: 80 ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: adguardhome-install-ingress - namespace: dns -spec: - ingressClassName: nginx - rules: - - host: install.adguard.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: adguard-install-svc - port: - number: 3000 diff --git a/docker-ingress/README.md b/docker-ingress/README.md deleted file mode 100644 index fc82588..0000000 --- a/docker-ingress/README.md +++ /dev/null @@ -1,4 +0,0 @@ -## Create namespace -```bash -kubectl create namespace docker-ingress -``` \ No newline at end of file diff --git a/docker-ingress/changedetection.yaml b/docker-ingress/changedetection.yaml deleted file mode 100644 index 61bef23..0000000 --- a/docker-ingress/changedetection.yaml +++ /dev/null @@ -1,44 +0,0 @@ -# docker-node: iris.haven -# port: 4100 - -# Service -apiVersion: v1 -kind: Service -metadata: - name: changedetection-service - namespace: docker-ingress -spec: - ports: - - port: 80 - targetPort: 4100 ---- -# Endpoints -apiVersion: v1 -kind: Endpoints -metadata: - name: changedetection-service - namespace: docker-ingress -subsets: - - addresses: - - ip: 192.168.20.100 - ports: - - port: 4100 ---- -# Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: changedetection-ingress - namespace: docker-ingress -spec: - rules: - - host: change.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: changedetection-service - port: - number: 80 diff --git a/docker-ingress/dockge.yaml b/docker-ingress/dockge.yaml deleted file mode 100644 index b8e586d..0000000 --- a/docker-ingress/dockge.yaml +++ /dev/null @@ -1,47 +0,0 @@ -# docker-node: iris.haven -# port: 4100 - -# Service -apiVersion: v1 -kind: Service -metadata: - name: dockge-service - namespace: docker-ingress -spec: - ports: - - name: http - protocol: TCP - port: 80 - targetPort: 5001 ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: dockge-service - namespace: docker-ingress -subsets: - - addresses: - - ip: 192.168.20.100 - ports: - - name: http - protocol: TCP - port: 5001 ---- -# Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: dockge-ingress - namespace: docker-ingress -spec: - rules: - - host: dockge.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: dockge-service - port: - number: 80 diff --git a/infra/README.md b/infra/README.md deleted file mode 100644 index e4905bb..0000000 --- a/infra/README.md +++ /dev/null @@ -1,3 +0,0 @@ -```bash -kubectl create secret generic beszel-key --from-literal=SECRET-KEY= -n infra -``` \ No newline at end of file diff --git a/infra/beszel-agent.yaml b/infra/beszel-agent.yaml deleted file mode 100644 index c1c3d59..0000000 --- a/infra/beszel-agent.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: beszel-agent - namespace: infra -spec: - selector: - matchLabels: - app: beszel-agent - template: - metadata: - labels: - app: beszel-agent - spec: - hostNetwork: true - containers: - - env: - - name: PORT - value: "45876" - - name: KEY - valueFrom: - secretKeyRef: - name: beszel-key - key: SECRET-KEY - image: henrygd/beszel-agent:0.18.7 - imagePullPolicy: Always - name: beszel-agent - ports: - - containerPort: 45876 - hostPort: 45876 - resources: - requests: - memory: "64Mi" - cpu: "50m" - limits: - memory: "128Mi" - cpu: "200m" - restartPolicy: Always diff --git a/infra/beszel.yaml b/infra/beszel.yaml deleted file mode 100644 index d14e483..0000000 --- a/infra/beszel.yaml +++ /dev/null @@ -1,97 +0,0 @@ ---- -# 1) Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: beszel - namespace: infra -spec: - replicas: 1 - selector: - matchLabels: - app: beszel - template: - metadata: - labels: - app: beszel - spec: - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: kubernetes.io/arch - operator: In - values: - - amd64 - containers: - - name: beszel - image: ghcr.io/henrygd/beszel/beszel:0.18.7 - imagePullPolicy: Always - ports: - - containerPort: 8090 - name: beszel-port - resources: - requests: - memory: "128Mi" - cpu: "100m" - limits: - memory: "512Mi" - cpu: "500m" - volumeMounts: - - name: beszel-config - mountPath: /beszel_data - volumes: - - name: beszel-config - persistentVolumeClaim: - claimName: beszel-config ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: beszel - namespace: infra -spec: - type: ClusterIP - selector: - app: beszel - ports: - - port: 80 - targetPort: beszel-port ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: beszel-config - namespace: infra - annotations: - nfs.io/storage-path: "beszel-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteMany - resources: - requests: - storage: 1Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: beszel - namespace: infra -spec: - ingressClassName: nginx - rules: - - host: beszel.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: beszel - port: - number: 80 diff --git a/infra/code-config.yaml b/infra/code-config.yaml deleted file mode 100644 index 9627d92..0000000 --- a/infra/code-config.yaml +++ /dev/null @@ -1,113 +0,0 @@ ---- -# 1) Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: code-config - namespace: infra -spec: - replicas: 1 - selector: - matchLabels: - app: code-config - template: - metadata: - labels: - app: code-config - spec: - affinity: - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - preference: - matchExpressions: - - key: kubernetes.io/hostname - operator: In - values: - - iris - containers: - - name: code-config - image: lscr.io/linuxserver/code-server:latest - imagePullPolicy: Always - env: - - name: PUID - value: "1000" - - name: PGID - value: "1000" - - name: PROXY_DOMAIN - value: "code-config.haven" - - name: DEFAULT_WORKSPACE - value: "/k8s-config" - resources: - requests: - memory: 512Mi - cpu: 200m - limits: - memory: 1Gi - cpu: 2000m - ports: - - containerPort: 8443 - name: code-port - volumeMounts: - - name: code-config - mountPath: /config - - name: k8s-config - mountPath: /k8s-config - volumes: - - name: code-config - persistentVolumeClaim: - claimName: code-config - - name: k8s-config - nfs: - server: nfs-config.haven - path: /export/config ---- -# 2) Service -apiVersion: v1 -kind: Service -metadata: - name: code-config - namespace: infra -spec: - type: ClusterIP - selector: - app: code-config - ports: - - port: 8443 - targetPort: code-port ---- -# 3) PersistentVolumeClaim -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: code-config - namespace: infra - annotations: - nfs.io/storage-path: "code-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 5Gi ---- -# 4) Ingress -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: code-config - namespace: infra -spec: - ingressClassName: nginx - rules: - - host: code-config.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: code-config - port: - number: 8443 diff --git a/infra/eso/bitwarden-cli.yaml b/infra/eso/bitwarden-cli.yaml deleted file mode 100644 index 921ac59..0000000 --- a/infra/eso/bitwarden-cli.yaml +++ /dev/null @@ -1,123 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: bitwarden-cli - namespace: infra - labels: - app.kubernetes.io/name: bitwarden-cli -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: bitwarden-cli - template: - metadata: - labels: - app.kubernetes.io/name: bitwarden-cli - spec: - nodeSelector: - kubernetes.io/arch: amd64 - containers: - - name: bitwarden-cli - image: ghcr.io/charlesthomas/bitwarden-cli:2026.3.0 - imagePullPolicy: IfNotPresent - # Override the baked entrypoint so --disable-origin-protection is - # actually passed (it was commented out in the image's entrypoint.sh, - # which made bw serve reject all cross-pod requests -> connection refused). - command: ["/bin/bash", "-lc"] - args: - - | - set -e - bw config server "${BW_HOST}" - # Authenticate. Prefer the API key if client creds are present, - # otherwise fall back to username+password. The session is exported - # so the background loop can re-derive (and refresh) it. - login() { - if [ -n "$BW_CLIENTID" ] && [ -n "$BW_CLIENTSECRET" ]; then - echo "Using apikey to log in" - BW_SESSION=$(bw login --apikey --raw) || return 1 - else - echo "Using password to log in" - BW_SESSION=$(bw login "${BW_USER}" --passwordenv BW_PASSWORD --raw) || return 1 - fi - export BW_SESSION - } - login - # Warm the vault cache once at startup so bw serve has data immediately. - bw sync - bw status - # Keep the session alive: RE-LOGIN every cycle and re-sync so the on-disk - # vault cache stays warm and the session token never lapses. A loop that - # only re-ran `bw sync` with a captured session would eventually fail once - # the session expired (-> stale cache / "Not found" for changed items, or a - # full unauthenticated 400 if the initial login never happened at all). - echo "Starting periodic bw login+sync loop (every 5m)" - ( - while true; do - sleep 300 - login || true - echo "[$(date -u +%FT%TZ)] bw sync" - bw sync >/dev/null 2>&1 || echo "[$(date -u +%FT%TZ)] bw sync failed" - done - ) & - echo 'Running `bw serve` on port 8087' - bw serve --hostname 0.0.0.0 --disable-origin-protection - env: - - name: BW_HOST - valueFrom: - secretKeyRef: - name: bitwarden-cli - key: BW_HOST - - name: BW_USER - valueFrom: - secretKeyRef: - name: bitwarden-cli - key: BW_USERNAME - - name: BW_PASSWORD - valueFrom: - secretKeyRef: - name: bitwarden-cli - key: BW_PASSWORD - ports: - - name: http - containerPort: 8087 - protocol: TCP - startupProbe: - tcpSocket: { port: 8087 } - periodSeconds: 5 - timeoutSeconds: 3 - failureThreshold: 30 - readinessProbe: - tcpSocket: { port: 8087 } - periodSeconds: 10 - timeoutSeconds: 3 - failureThreshold: 3 - livenessProbe: - tcpSocket: { port: 8087 } - periodSeconds: 15 - timeoutSeconds: 3 - failureThreshold: 6 - resources: - limits: - cpu: 400m - memory: 512Mi - requests: - cpu: 50m - memory: 128Mi ---- -apiVersion: v1 -kind: Service -metadata: - name: bitwarden-cli - namespace: infra - labels: - app.kubernetes.io/name: bitwarden-cli -spec: - type: ClusterIP - selector: - app.kubernetes.io/name: bitwarden-cli - ports: - - name: http - port: 8087 - targetPort: http - protocol: TCP diff --git a/infra/eso/bw-cli-netpol.yaml b/infra/eso/bw-cli-netpol.yaml deleted file mode 100644 index c97d539..0000000 --- a/infra/eso/bw-cli-netpol.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: bw-cli - namespace: infra -spec: - podSelector: - matchLabels: - app.kubernetes.io/name: bitwarden-cli - policyTypes: - - Ingress - ingress: - - from: - # ESO pods (app.kubernetes.io/name: external-secrets) in the external-secrets namespace. - # Both podSelector AND namespaceSelector must match for cross-namespace traffic. - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: external-secrets - podSelector: - matchLabels: - app.kubernetes.io/name: external-secrets diff --git a/infra/eso/secretstores.yaml b/infra/eso/secretstores.yaml deleted file mode 100644 index 40c0d60..0000000 --- a/infra/eso/secretstores.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ClusterSecretStore -metadata: { name: bitwarden-login } -spec: - provider: - webhook: - url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}" - result: { jsonPath: "$.data.login.{{ .remoteRef.property }}" } ---- -apiVersion: external-secrets.io/v1 -kind: ClusterSecretStore -metadata: { name: bitwarden-fields } -spec: - provider: - webhook: - url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}" - result: - { - jsonPath: '$.data.fields[?@.name=="{{ .remoteRef.property }}"].value', - } diff --git a/infra/file-nginx.yaml b/infra/file-nginx.yaml deleted file mode 100644 index bb9cd10..0000000 --- a/infra/file-nginx.yaml +++ /dev/null @@ -1,129 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: file-nginx - namespace: infra - labels: - app: file-nginx -spec: - replicas: 1 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: file-nginx - template: - metadata: - labels: - app: file-nginx - spec: - containers: - - name: nginx - image: nginx:alpine - imagePullPolicy: IfNotPresent - ports: - - containerPort: 80 - securityContext: - allowPrivilegeEscalation: false - runAsUser: 0 - volumeMounts: - - name: html - mountPath: /usr/share/nginx/data - - name: nginx-conf - mountPath: /etc/nginx/conf.d/default.conf - subPath: default.conf - startupProbe: - httpGet: - path: / - port: 80 - failureThreshold: 30 - periodSeconds: 5 - readinessProbe: - httpGet: - path: / - port: 80 - initialDelaySeconds: 5 - periodSeconds: 10 - livenessProbe: - httpGet: - path: / - port: 80 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - cpu: 200m - memory: 128Mi - volumes: - - name: html - nfs: - server: vega.haven - path: /export/Fast - - name: nginx-conf - configMap: - name: file-nginx-conf - ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: file-nginx-conf - namespace: infra -data: - default.conf: | - server { - listen 80; - listen [::]:80; - server_name _; - - root /usr/share/nginx/data/file-nginx; - index index.html; - - autoindex on; - - location / { - try_files $uri $uri/ =404; - } - } ---- -apiVersion: v1 -kind: Service -metadata: - name: file-nginx - namespace: infra -spec: - selector: - app: file-nginx - ports: - - protocol: TCP - port: 80 - targetPort: 80 - ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: file-nginx - namespace: infra - annotations: - nginx.ingress.kubernetes.io/enable-cors: "true" - nginx.ingress.kubernetes.io/cors-allow-origin: "*" -spec: - ingressClassName: nginx - rules: - - host: file-nginx.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: file-nginx - port: - number: 80 diff --git a/infra/haven-notify.yaml b/infra/haven-notify.yaml deleted file mode 100644 index ab4a11e..0000000 --- a/infra/haven-notify.yaml +++ /dev/null @@ -1,86 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: haven-notify - namespace: infra - labels: - app: haven-notify -spec: - replicas: 2 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: haven-notify - template: - metadata: - labels: - app: haven-notify - spec: - containers: - - name: haven-notify - image: git.ivanch.me/ivanch/haven-notify:latest - imagePullPolicy: Always - ports: - - containerPort: 8080 - env: - - name: WEBHOOK_URL - valueFrom: - secretKeyRef: - name: discord-webhook - key: HAVEN_WEBHOOK_URL - readinessProbe: - httpGet: - path: /ready - port: 8080 - initialDelaySeconds: 5 - periodSeconds: 10 - livenessProbe: - httpGet: - path: /live - port: 8080 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - cpu: 200m - memory: 128Mi - ---- -apiVersion: v1 -kind: Service -metadata: - name: haven-notify - namespace: infra -spec: - selector: - app: haven-notify - ports: - - protocol: TCP - port: 8080 - targetPort: 8080 ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: haven-notify - namespace: infra -spec: - ingressClassName: nginx - rules: - - host: notify.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: haven-notify - port: - number: 8080 diff --git a/infra/ingress-nginx-helm.yaml b/infra/ingress-nginx-helm.yaml deleted file mode 100644 index 1f28fc3..0000000 --- a/infra/ingress-nginx-helm.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: helm.cattle.io/v1 -kind: HelmChart -metadata: - name: ingress-nginx - namespace: kube-system -spec: - repo: https://kubernetes.github.io/ingress-nginx - chart: ingress-nginx - version: 4.x.x # pinned - targetNamespace: ingress-nginx - valuesContent: |- - controller: - replicaCount: 2 - ingressClassResource: - name: nginx - enabled: true - default: true - controllerValue: "k8s.io/ingress-nginx" - ingressClass: nginx - service: - type: LoadBalancer - externalTrafficPolicy: Local - annotations: - metallb.io/ip-allocated-from-pool: default-pool - metallb.io/loadBalancerIPs: "192.168.20.204" - loadBalancerIP: 192.168.20.204 - resources: - requests: - cpu: 100m - memory: 90Mi - limits: - cpu: 1000m - memory: 256Mi diff --git a/infra/wg-easy.yaml b/infra/wg-easy.yaml deleted file mode 100644 index 628c3fb..0000000 --- a/infra/wg-easy.yaml +++ /dev/null @@ -1,127 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: wg-easy-pvc - namespace: infra - annotations: - nfs.io/storage-path: "wg-easy-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 10Gi ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: wg-easy - namespace: infra -spec: - strategy: - type: Recreate - replicas: 1 - selector: - matchLabels: - app: wg-easy - template: - metadata: - labels: - app: wg-easy - spec: - affinity: - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - preference: - matchExpressions: - - key: kubernetes.io/hostname - operator: In - values: - - nexus - weight: 100 - containers: - - name: wg-easy - image: ghcr.io/wg-easy/wg-easy:latest - imagePullPolicy: Always - ports: - - containerPort: 51820 - protocol: UDP - name: wg-port - - containerPort: 51821 - protocol: TCP - name: web-port - env: - - name: LANG - value: en - - name: WG_HOST - value: vpn.ivanch.me - - name: WG_MTU - value: "1420" - - name: UI_TRAFFIC_STATS - value: "true" - - name: UI_CHART_TYPE - value: "0" - - name: WG_ENABLE_ONE_TIME_LINKS - value: "true" - - name: UI_ENABLE_SORT_CLIENTS - value: "true" - securityContext: - capabilities: - add: - - NET_ADMIN - - SYS_MODULE - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - cpu: 2000m - memory: 1Gi - volumeMounts: - - name: wg-easy-volume - mountPath: /etc/wireguard - restartPolicy: Always - volumes: - - name: wg-easy-volume - persistentVolumeClaim: - claimName: wg-easy-pvc ---- -apiVersion: v1 -kind: Service -metadata: - name: wg-easy-svc - namespace: infra -spec: - type: LoadBalancer - selector: - app: wg-easy - loadBalancerIP: 192.168.20.203 - ports: - - name: wg-port - port: 51820 - targetPort: 51820 - protocol: UDP - - name: web-port - port: 51821 - targetPort: 51821 - protocol: TCP ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: wg-easy-ingress - namespace: infra -spec: - ingressClassName: nginx - rules: - - host: vpn.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: wg-easy-svc - port: - number: 51821 diff --git a/lab/nfs-pod.yaml b/lab/nfs-pod.yaml deleted file mode 100644 index d8ba9be..0000000 --- a/lab/nfs-pod.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: nfs-pod -spec: - containers: - - name: nfs-container - image: alpine:latest - env: - - name: PUID - value: "1000" - - name: PGID - value: "1000" - volumeMounts: - - name: nfs-backup - mountPath: /mnt/Backup - - name: nfs-storage - mountPath: /mnt/Storage - command: ["/bin/sh", "-c", "sleep infinity"] - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 800m - memory: 256Mi - securityContext: - privileged: true - volumes: - - name: nfs-backup - nfs: - server: 192.168.15.99 - path: /srv/dev-md1/Backup - - name: nfs-storage - nfs: - server: 192.168.15.99 - path: /export/Storage \ No newline at end of file diff --git a/metallb-system/address-pool.yaml b/metallb-system/address-pool.yaml deleted file mode 100644 index 3f009db..0000000 --- a/metallb-system/address-pool.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: metallb.io/v1beta1 -kind: IPAddressPool -metadata: - name: default-pool - namespace: metallb-system -spec: - addresses: - - 192.168.15.200/32 # reserved for DNS 1 - - 192.168.15.202/32 # reserved for wg-easy - - 192.168.15.203/32 # reserved for k3s ingress - - 192.168.20.200/32 # reserved for DNS 1 -# - 192.168.20.201 is reserved for DNS 2 - - 192.168.20.202-192.168.20.220 ---- -apiVersion: metallb.io/v1beta1 -kind: L2Advertisement -metadata: - name: default-advertisement - namespace: metallb-system -spec: - ipAddressPools: - - default-pool diff --git a/monitoring/grafana.yaml b/monitoring/grafana.yaml deleted file mode 100644 index 52e24cf..0000000 --- a/monitoring/grafana.yaml +++ /dev/null @@ -1,127 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: grafana - name: grafana - namespace: monitoring -spec: - selector: - matchLabels: - app: grafana - template: - metadata: - labels: - app: grafana - spec: - securityContext: - fsGroup: 472 - supplementalGroups: - - 0 - containers: - - name: grafana - image: grafana/grafana:latest - imagePullPolicy: Always - ports: - - containerPort: 3000 - name: http-grafana - protocol: TCP - readinessProbe: - failureThreshold: 3 - httpGet: - path: /robots.txt - port: 3000 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 2 - livenessProbe: - failureThreshold: 3 - initialDelaySeconds: 30 - periodSeconds: 10 - successThreshold: 1 - tcpSocket: - port: 3000 - timeoutSeconds: 1 - resources: - requests: - cpu: 250m - memory: 750Mi - limits: - memory: 1Gi - cpu: 500m - volumeMounts: - - mountPath: /var/lib/grafana - name: grafana-pv - volumes: - - name: grafana-pv - persistentVolumeClaim: - claimName: grafana-pvc ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: grafana-pvc - namespace: monitoring - annotations: - nfs.io/storage-path: "grafana-data" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi ---- -apiVersion: v1 -kind: Service -metadata: - namespace: monitoring - name: grafana -spec: - ports: - - port: 3000 - protocol: TCP - targetPort: http-grafana - selector: - app: grafana - type: ClusterIP ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - namespace: monitoring - name: grafana -spec: - ingressClassName: nginx - rules: - - host: grafana.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: grafana - port: - number: 3000 ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - namespace: monitoring - name: grafana-public -spec: - ingressClassName: nginx - rules: - - host: grafanah.ivanch.me - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: grafana - port: - number: 3000 diff --git a/monitoring/kube-state-metrics.yaml b/monitoring/kube-state-metrics.yaml deleted file mode 100644 index 75d2945..0000000 --- a/monitoring/kube-state-metrics.yaml +++ /dev/null @@ -1,145 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: kube-state-metrics - namespace: monitoring - labels: - app: kube-state-metrics - app.kubernetes.io/component: exporter - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.19.1 -automountServiceAccountToken: false ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: kube-state-metrics - labels: - app: kube-state-metrics - app.kubernetes.io/component: exporter - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.19.1 -rules: - - apiGroups: [""] - resources: - - nodes - - pods - - persistentvolumeclaims - verbs: ["list", "watch"] - - apiGroups: ["apps"] - resources: - - statefulsets - - daemonsets - - deployments - - replicasets - verbs: ["list", "watch"] - - apiGroups: ["batch"] - resources: - - cronjobs - - jobs - verbs: ["list", "watch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: kube-state-metrics - labels: - app: kube-state-metrics - app.kubernetes.io/component: exporter - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.19.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: kube-state-metrics -subjects: - - kind: ServiceAccount - name: kube-state-metrics - namespace: monitoring ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: kube-state-metrics - namespace: monitoring - labels: - app: kube-state-metrics - app.kubernetes.io/component: exporter - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.19.1 -spec: - replicas: 1 - selector: - matchLabels: - app: kube-state-metrics - template: - metadata: - labels: - app: kube-state-metrics - app.kubernetes.io/component: exporter - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.19.1 - spec: - automountServiceAccountToken: true - serviceAccountName: kube-state-metrics - nodeSelector: - kubernetes.io/os: linux - containers: - - name: kube-state-metrics - image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 - imagePullPolicy: IfNotPresent - args: - - --resources=cronjobs,daemonsets,deployments,jobs,nodes,persistentvolumeclaims,pods,replicasets,statefulsets - ports: - - name: http-metrics - containerPort: 8080 - protocol: TCP - livenessProbe: - httpGet: - path: /livez - port: http-metrics - initialDelaySeconds: 5 - timeoutSeconds: 5 - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - timeoutSeconds: 5 - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 65534 - seccompProfile: - type: RuntimeDefault - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - cpu: 200m - memory: 256Mi ---- -apiVersion: v1 -kind: Service -metadata: - name: kube-state-metrics - namespace: monitoring - labels: - app: kube-state-metrics - app.kubernetes.io/component: exporter - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.19.1 -spec: - type: ClusterIP - selector: - app: kube-state-metrics - ports: - - name: http-metrics - port: 8080 - targetPort: http-metrics - protocol: TCP diff --git a/monitoring/loki.yaml b/monitoring/loki.yaml deleted file mode 100644 index 952a937..0000000 --- a/monitoring/loki.yaml +++ /dev/null @@ -1,108 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: loki - namespace: monitoring -spec: - replicas: 1 - selector: - matchLabels: - app: loki - template: - metadata: - labels: - app: loki - spec: - containers: - - name: loki - image: grafana/loki:3 - args: ["-config.file=/etc/loki/config/config.yaml"] - ports: - - containerPort: 3100 - volumeMounts: - - name: config - mountPath: /etc/loki/config - - name: loki-storage - mountPath: /tmp/loki - resources: - requests: - cpu: 100m - memory: 1Gi - limits: - cpu: 200m - memory: 1Gi - volumes: - - name: config - configMap: - name: loki-config - - name: loki-storage - emptyDir: - medium: Memory ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: loki-config - namespace: monitoring -data: - config.yaml: | - auth_enabled: true - server: - http_listen_port: 3100 - - common: - ring: - instance_addr: 127.0.0.1 - kvstore: - store: inmemory - replication_factor: 1 - path_prefix: /tmp/loki - querier: - multi_tenant_queries_enabled: true - - schema_config: - configs: - - from: "2024-01-01" - store: tsdb - object_store: filesystem - schema: v13 - index: - prefix: index_ - period: 24h - - storage_config: - tsdb_shipper: - active_index_directory: /tmp/loki/index - cache_location: /tmp/loki/cache - filesystem: - directory: /tmp/loki/chunks - - limits_config: - allow_structured_metadata: true - retention_period: 0 - - ingester: - lifecycler: - ring: - kvstore: - store: inmemory - replication_factor: 1 - chunk_idle_period: 1m - max_chunk_age: 5m - chunk_target_size: 1536000 - - compactor: - retention_enabled: false ---- -apiVersion: v1 -kind: Service -metadata: - name: loki - namespace: monitoring -spec: - ports: - - port: 3100 - targetPort: 3100 - name: http - selector: - app: loki diff --git a/monitoring/nodeexporter.yaml b/monitoring/nodeexporter.yaml deleted file mode 100644 index bac150b..0000000 --- a/monitoring/nodeexporter.yaml +++ /dev/null @@ -1,56 +0,0 @@ -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: node-exporter - namespace: monitoring - labels: - app: node-exporter -spec: - selector: - matchLabels: - app: node-exporter - template: - metadata: - labels: - app: node-exporter - spec: - hostNetwork: true - containers: - - name: node-exporter - image: prom/node-exporter:latest - imagePullPolicy: Always - args: - - "--path.rootfs=/host" - ports: - - containerPort: 9100 - hostPort: 9100 - name: metrics - protocol: TCP - resources: - requests: - memory: "50Mi" - cpu: "100m" - limits: - memory: "100Mi" - cpu: "200m" - volumeMounts: - - name: host - mountPath: /host - readOnly: true - volumes: - - name: host - hostPath: - path: / ---- -apiVersion: v1 -kind: Service -metadata: - name: node-exporter - namespace: monitoring -spec: - selector: - app: node-exporter - ports: - - name: metrics - port: 9100 - targetPort: metrics diff --git a/monitoring/prometheus.yaml b/monitoring/prometheus.yaml deleted file mode 100644 index b85a9e0..0000000 --- a/monitoring/prometheus.yaml +++ /dev/null @@ -1,130 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: prometheus - namespace: monitoring - labels: - app: prometheus -spec: - replicas: 1 - selector: - matchLabels: - app: prometheus - template: - metadata: - labels: - app: prometheus - spec: - serviceAccountName: prometheus - containers: - - name: prometheus - image: prom/prometheus:latest - args: - - "--config.file=/etc/prometheus/prometheus.yml" - - "--storage.tsdb.path=/prometheus" - - "--storage.tsdb.retention.time=1d" - - "--web.enable-lifecycle" - ports: - - containerPort: 9090 - name: web - volumeMounts: - - name: prometheus-config-volume - mountPath: /etc/prometheus - - name: prometheus-storage - mountPath: /prometheus - resources: - requests: - memory: "500Mi" - cpu: "200m" - limits: - memory: "1Gi" - cpu: "500m" - volumes: - - name: prometheus-config-volume - persistentVolumeClaim: - claimName: prometheus-pvc - - name: prometheus-storage - emptyDir: - medium: Memory - sizeLimit: 256Mi ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: prometheus-pvc - namespace: monitoring - annotations: - nfs.io/storage-path: "prometheus-config" -spec: - storageClassName: "nfs-client" - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi ---- -# Service URL - http://prometheus.monitoring.svc.cluster.local:9090 -apiVersion: v1 -kind: Service -metadata: - name: prometheus - namespace: monitoring - labels: - app: prometheus -spec: - ports: - - name: web - port: 9090 - targetPort: web - selector: - app: prometheus - type: ClusterIP ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: prometheus - namespace: monitoring - labels: - app: prometheus ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: prometheus - namespace: monitoring - labels: - app: prometheus -rules: -- apiGroups: [""] - resources: - - nodes - - nodes/proxy - - services - - endpoints - - pods - verbs: ["get", "list", "watch"] -- apiGroups: ["extensions"] - resources: - - ingresses - verbs: ["get", "list", "watch"] -- apiGroups: ["networking.k8s.io"] - resources: - - ingresses - verbs: ["get", "list", "watch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: prometheus - namespace: monitoring - labels: - app: prometheus -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: prometheus -subjects: -- kind: ServiceAccount - name: prometheus - namespace: monitoring \ No newline at end of file