Compare commits
40
Commits
0a0058e51d
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
 ivanch
|
6c7daf2b14 | ||
 ivanchandRenovate Bot
|
db90b83179 | ||
|
ivanchandRenovate Bot
|
e7c419a353 | ||
|
ivanchandRenovate Bot
|
f19441bdf9 | ||
|
ivanchandRenovate Bot
|
680c66b267 | ||
|
ivanch
|
0f45d7619a | ||
|
ivanch
|
433a58fdfc | ||
|
ivanch
|
af7106546e | ||
|
ivanchandRenovate Bot
|
250fa7ff5b | ||
|
ivanchandRenovate Bot
|
5e47f3e1a8 | ||
|
ivanchandRenovate Bot
|
fa5222d3e1 | ||
|
ivanch
|
8c3cb72285 | ||
|
ivanch
|
573b102141 | ||
|
ivanchandRenovate Bot
|
780f6b1a86 | ||
|
ivanchandRenovate Bot
|
589e4c15e9 | ||
|
ivanchandRenovate Bot
|
6536b12ca5 | ||
|
ivanchandRenovate Bot
|
3e76a7c408 | ||
|
ivanch
|
a1e3f5eefb | ||
|
ivanch
|
cf3dc35b58 | ||
|
ivanch
|
7c43d0b7fb | ||
|
ivanch
|
3d3058a369 | ||
|
ivanch
|
a15d4f5f50 | ||
|
ivanch
|
e22ad5a495 | ||
|
ivanch
|
9c0c467405 | ||
|
ivanch
|
dfec0e9633 | ||
|
ivanch
|
febb354b9b | ||
|
ivanch
|
ca3e8b1015 | ||
|
ivanchandRenovate Bot
|
dfb1a402e1 | ||
|
ivanch
|
f45e88d600 | ||
|
Renovate Bot
|
cd573ad7b2 | ||
|
ivanch
|
44d5f88986 | ||
|
ivanch
|
65168fe127 | ||
|
ivanch
|
5a4bc8d0e9 | ||
|
ivanch
|
636c5e2d04 | ||
|
ivanch
|
e7794c4067 | ||
|
ivanch
|
d139bc0dd8 | ||
|
ivanch
|
56d9bef1fc | ||
|
ivanch
|
4b9b3348e0 | ||
|
ivanch
|
dbeca3ef1f | ||
|
ivanch
|
69fbe2be02 |
@@ -0,0 +1,4 @@
|
||||
.gitattributes text eol=lf
|
||||
*.yaml text eol=lf
|
||||
*.yml text eol=lf
|
||||
*.md text eol=lf
|
||||
@@ -0,0 +1,42 @@
|
||||
name: Trigger Renovate
|
||||
|
||||
on:
|
||||
workflow_dispatch: {}
|
||||
|
||||
jobs:
|
||||
trigger-renovate:
|
||||
name: Trigger Renovate
|
||||
runs-on: runner-slim-amd64
|
||||
env:
|
||||
KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
|
||||
steps:
|
||||
- name: Create a one-off Renovate job
|
||||
shell: bash
|
||||
run: |
|
||||
set -eu
|
||||
|
||||
if [ -z "${KUBE_CONFIG}" ]; then
|
||||
echo "KUBE_CONFIG is not set or is empty."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
WORK_DIR="${RUNNER_TEMP:-/tmp}/renovate-${GITHUB_RUN_ID:-$$}"
|
||||
mkdir -p "${WORK_DIR}"
|
||||
trap 'rm -rf "${WORK_DIR}"' EXIT
|
||||
|
||||
apk add --no-cache curl
|
||||
KUBECTL_VERSION="$(curl -fsSL https://dl.k8s.io/release/stable.txt)"
|
||||
curl -fsSLo "${WORK_DIR}/kubectl" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
|
||||
chmod 0755 "${WORK_DIR}/kubectl"
|
||||
|
||||
KUBECONFIG="${WORK_DIR}/kubeconfig"
|
||||
umask 077
|
||||
printf '%s' "${KUBE_CONFIG}" | tr -d '\r' > "${KUBECONFIG}"
|
||||
|
||||
RUN_ID="$(printf '%s' "${GITHUB_RUN_ID:-$(date -u +%Y%m%d%H%M%S)}" | tr -cd 'a-z0-9')"
|
||||
JOB_NAME="renovate-manual-${RUN_ID}"
|
||||
|
||||
"${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" version --client
|
||||
"${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs get cronjob renovate
|
||||
"${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs create job "${JOB_NAME}" --from=cronjob/renovate
|
||||
"${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs get job "${JOB_NAME}" -o wide
|
||||
@@ -1,3 +1,3 @@
|
||||
ansible-core==2.21.2
|
||||
ansible-core==2.21.4
|
||||
proxmoxer==2.3.0
|
||||
requests==2.34.2
|
||||
|
||||
@@ -3,4 +3,4 @@ collections:
|
||||
- name: community.proxmox
|
||||
version: "2.0.0"
|
||||
- name: community.general
|
||||
version: "13.2.0"
|
||||
version: "13.4.0"
|
||||
|
||||
@@ -20,8 +20,7 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: affine
|
||||
image: ghcr.io/toeverything/affine:stable
|
||||
imagePullPolicy: Always
|
||||
image: ghcr.io/toeverything/affine:0.27.4
|
||||
command:
|
||||
[
|
||||
"sh",
|
||||
@@ -44,7 +43,10 @@ spec:
|
||||
- name: AFFINE_ENABLE_SYNC_FROM_STARTUP
|
||||
value: "true"
|
||||
- name: DATABASE_URL
|
||||
value: "postgres://affine:affine@postgresql.haven:5432/affine"
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: affine-secret
|
||||
key: DB_CONNECTION_URL
|
||||
- name: REDIS_SERVER_HOST
|
||||
value: "redis.haven"
|
||||
- name: REDIS_SERVER_PORT
|
||||
@@ -97,8 +99,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: affine-config
|
||||
namespace: cloud
|
||||
annotations:
|
||||
nfs.io/storage-path: "affine-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -16,7 +16,6 @@ spec:
|
||||
containers:
|
||||
- name: cloudreve
|
||||
image: cloudreve/cloudreve:v4
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- containerPort: 5212
|
||||
name: http
|
||||
@@ -52,11 +51,6 @@ spec:
|
||||
value: "disable"
|
||||
- name: CR_CONF_Redis.Server
|
||||
value: ""
|
||||
- name: CR_CONF_Redis.Password
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: cloudreve-secret
|
||||
key: REDIS_PASSWORD
|
||||
volumeMounts:
|
||||
- name: cloudreve-data
|
||||
mountPath: /cloudreve/data
|
||||
@@ -113,8 +107,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: cloudreve-data
|
||||
namespace: cloud
|
||||
annotations:
|
||||
nfs.io/storage-path: "cloudreve-data"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -99,8 +99,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: slink-data
|
||||
namespace: cloud
|
||||
annotations:
|
||||
nfs.io/storage-path: "slink-data"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -12,7 +12,7 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: renovate
|
||||
image: renovate/renovate:44.39.3
|
||||
image: renovate/renovate:44.103.7
|
||||
args:
|
||||
- ivanch/haven
|
||||
env:
|
||||
|
||||
@@ -129,8 +129,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: archivebox-data
|
||||
namespace: default
|
||||
annotations:
|
||||
nfs.io/storage-path: "archivebox-data"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -120,8 +120,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: changedetection-config
|
||||
namespace: default
|
||||
annotations:
|
||||
nfs.io/storage-path: "changedetection-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -157,8 +157,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: homepage-config
|
||||
namespace: default
|
||||
annotations:
|
||||
nfs.io/storage-path: "homepage-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -61,8 +61,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: notepad-data
|
||||
namespace: default
|
||||
annotations:
|
||||
nfs.io/storage-path: "notepad-data"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -74,8 +74,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: openwebui-data
|
||||
namespace: default
|
||||
annotations:
|
||||
nfs.io/storage-path: "openwebui-data"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -118,8 +118,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: paperless-data
|
||||
namespace: default
|
||||
annotations:
|
||||
nfs.io/storage-path: "paperless-data"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -38,8 +38,7 @@ spec:
|
||||
env:
|
||||
- name: TZ
|
||||
value: America/Sao_Paulo
|
||||
image: mcr.microsoft.com/playwright:v1.62.1-noble
|
||||
imagePullPolicy: Always
|
||||
image: mcr.microsoft.com/playwright:v1.63.0-noble
|
||||
name: playwright
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
|
||||
@@ -63,8 +63,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: searxng-config
|
||||
namespace: default
|
||||
annotations:
|
||||
nfs.io/storage-path: "searxng-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -80,8 +80,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: stirlingpdf-config
|
||||
namespace: default
|
||||
annotations:
|
||||
nfs.io/storage-path: "stirlingpdf-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -20,7 +20,6 @@ spec:
|
||||
containers:
|
||||
- name: uptimekuma
|
||||
image: louislam/uptime-kuma:2
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
@@ -76,8 +75,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: uptimekuma-config
|
||||
namespace: default
|
||||
annotations:
|
||||
nfs.io/storage-path: "uptimekuma-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -17,8 +17,7 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: vaultwarden
|
||||
image: vaultwarden/server:latest
|
||||
imagePullPolicy: Always
|
||||
image: vaultwarden/server:1.37.3
|
||||
env:
|
||||
- name: DOMAIN
|
||||
value: "https://vault.haven"
|
||||
@@ -90,8 +89,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: vaultwarden-data
|
||||
namespace: default
|
||||
annotations:
|
||||
nfs.io/storage-path: "vaultwarden-data"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -41,8 +41,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: gitea-runner-amd64-pvc
|
||||
namespace: dev
|
||||
annotations:
|
||||
nfs.io/storage-path: "gitea-runner-amd64-pvc"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
@@ -57,8 +55,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: gitea-runner-arm64-pvc
|
||||
namespace: dev
|
||||
annotations:
|
||||
nfs.io/storage-path: "gitea-runner-arm64-pvc"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: adguardsync-pvc
|
||||
namespace: dns
|
||||
annotations:
|
||||
nfs.io/storage-path: "adguardsync-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
@@ -32,8 +30,7 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: adguardsync
|
||||
image: ghcr.io/bakito/adguardhome-sync:latest
|
||||
imagePullPolicy: Always
|
||||
image: ghcr.io/bakito/adguardhome-sync:v0.9.3
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
protocol: TCP
|
||||
|
||||
+11
-4
@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: adguardhome-pvc
|
||||
namespace: dns
|
||||
annotations:
|
||||
nfs.io/storage-path: "adguardhome-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
@@ -30,10 +28,19 @@ spec:
|
||||
labels:
|
||||
app: adguardhome
|
||||
spec:
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/arch
|
||||
operator: In
|
||||
values:
|
||||
- arm64
|
||||
containers:
|
||||
- name: adguardhome
|
||||
image: adguard/adguardhome:latest
|
||||
imagePullPolicy: Always
|
||||
image: adguard/adguardhome:v0.107.79
|
||||
ports:
|
||||
- containerPort: 53
|
||||
protocol: TCP
|
||||
|
||||
@@ -22,8 +22,7 @@ spec:
|
||||
secretKeyRef:
|
||||
name: beszel-key
|
||||
key: SECRET-KEY
|
||||
image: henrygd/beszel-agent:0.18.8
|
||||
imagePullPolicy: Always
|
||||
image: henrygd/beszel-agent:0.20.0
|
||||
name: beszel-agent
|
||||
ports:
|
||||
- containerPort: 45876
|
||||
|
||||
@@ -26,8 +26,7 @@ spec:
|
||||
- amd64
|
||||
containers:
|
||||
- name: beszel
|
||||
image: ghcr.io/henrygd/beszel/beszel:0.18.8
|
||||
imagePullPolicy: Always
|
||||
image: ghcr.io/henrygd/beszel/beszel:0.20.0
|
||||
ports:
|
||||
- containerPort: 8090
|
||||
name: beszel-port
|
||||
@@ -66,8 +65,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: beszel-config
|
||||
namespace: infra
|
||||
annotations:
|
||||
nfs.io/storage-path: "beszel-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -1,3 +1,44 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: bitwarden-cli-ca
|
||||
namespace: infra
|
||||
labels:
|
||||
app.kubernetes.io/name: bitwarden-cli
|
||||
data:
|
||||
# Public CA certificate used by the internal-ca ClusterIssuer. Keep this in
|
||||
# sync if the issuer CA is rotated.
|
||||
haven-ca.crt: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFBzCCAu+gAwIBAgIUGFrjEo+WOxJpMnJqU/RQ881kWI8wDQYJKoZIhvcNAQEL
|
||||
BQAwEzERMA8GA1UEAwwISGF2ZW4gQ0EwHhcNMjUwOTA3MTUxNTE3WhcNMzUwOTA1
|
||||
MTUxNTE3WjATMREwDwYDVQQDDAhIYXZlbiBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
|
||||
ggIPADCCAgoCggIBAK+8DxQfCYdRfGnJoEu0CiSuw64lnUFryvzy3GPkfGEEzc3f
|
||||
ZiH6pUUIpQnrbVc1wdq3ojEOveGyLIqWxkljz8gEaMDJwB7udOxfbgv0QFI4cFKs
|
||||
QzB+g3VVf74mYHvqfGB1suxmdVJ8YxcW3rQl7XD94PLxfoZuQ8IKKjskaQnYXUGH
|
||||
wi6YBmIjpxr23lvT5cTbd5YgTFYVXDzM8nWtmnd2Wa9WkNZtKaHQKIeiNEpUPV0+
|
||||
KSHVQC7vdmGmbUZXWpK2jmLFWfYaI0vXUal0CyMv1QidTd5LsDCI4Y+dx4mSBLuu
|
||||
ip5V4Wm1DxttyaKUZM2vhzHEsDSVHz/xqx9nJeoJJuP+OirQVETD3FcN5PNVkWXu
|
||||
EHQAqUciBh1CMJKKT74SE5oTT1/Eni9N2uYlvXsOs3ne6TTjZYxcL6VU+aqyYvvF
|
||||
oMo3DX2a5nZvht4E1BtCd4I/RlnOw5QBAvWbFJqpbo/DTAGo/WBgv7jXCGail+uQ
|
||||
r7iLoKFnhGq0WB9d2UUg6qDRD11I1nZANkv4t3Z2HFbG4XxdpttPm7JjxlcC3gGa
|
||||
AfE3rChmAQPWPLSn6msOcfA+l5OD9SoSYU9nHy81T2q06Kfg/VWDdz7Wvi+WNZ20
|
||||
gcfZPUZQsLlgZeyjmoA27D7ayO5uxjTWCi35kIgKcDDutyHctPRQs5zlTD35AgMB
|
||||
AAGjUzBRMB0GA1UdDgQWBBSqABoe6cCk5vMc3LfnZfhiMbJ+kjAfBgNVHSMEGDAW
|
||||
gBSqABoe6cCk5vMc3LfnZfhiMbJ+kjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
|
||||
DQEBCwUAA4ICAQAWAqQgFYEH14J2pwKptLb/K2C2oT9XLVnArQ5PKOzyWWhfZXsr
|
||||
3YB707XJ7ju12n5gBgjCK4R66IG/iYNfHdBfhb9M1BVJ3T035RH8d6lhlZbxC02s
|
||||
ZIMrQxDVFRrWm7gxcQiMILfPl2hJmsLf9XIUTBzPWFj9E+wExXrDYdiZXU+a/9qP
|
||||
JvLKZA7T2lSBu+XtccySVLHXoxZ/A/c7Gp8XYJ2srZ2tXGN+j1dXiSMWHD/fpdxs
|
||||
3GDKFnOOz2NTjHhYvBR94sOx3UkA3Pz+ufcHFBWWh23iGOPDDjh0vqAKItz2G0Kb
|
||||
9B99XVnHWHamaZ2tV40x7lVn1mo9ImFVtxW2XDQ/NkRB9PuT2ryGE67Ey/Zfoq5M
|
||||
0gZXIMtuMS25dTB8gQ8PKlXluIf4EbaDXhFk5xFHz5NP0E5Um4SxJP8H30/+UUPd
|
||||
bu/TMcNiiAgxaTLBbE3nw/L7bYfH+5KuTLlp17H0UEtSI1GosgGYooov+Zbj4ZF8
|
||||
Ko108LKAFDGe8/uQVeuo00CrEqXwVRtCCkv+LBcCJDicoyqWbp4GCBp+IVN0nxWX
|
||||
xIRYVtQZCmA3hSH3rwt0/2dBxkcta4YkHZUEZ+EXaFl3z1tcbErOhBvupBvnBuZP
|
||||
Rp2yvEJuuY6M1j+CZrfCm7qMipXTGPQ11Q7hf6jJ0xzxjTkV9TyV1ptPPQ==
|
||||
-----END CERTIFICATE-----
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
@@ -19,7 +60,7 @@ spec:
|
||||
kubernetes.io/arch: amd64
|
||||
containers:
|
||||
- name: bitwarden-cli
|
||||
image: ghcr.io/charlesthomas/bitwarden-cli:2026.7.0
|
||||
image: ghcr.io/charlesthomas/bitwarden-cli:2026.8.0 # 2026.9.0 requires Vaultwarden's unimplemented user-key-ID backfill API
|
||||
imagePullPolicy: IfNotPresent
|
||||
# Override the baked entrypoint so --disable-origin-protection is
|
||||
# actually passed (it was commented out in the image's entrypoint.sh,
|
||||
@@ -63,11 +104,14 @@ spec:
|
||||
echo 'Running `bw serve` on port 8087'
|
||||
bw serve --hostname 0.0.0.0 --disable-origin-protection
|
||||
env:
|
||||
# Bitwarden CLI is Node-based and needs the internal issuer CA to
|
||||
# verify the HTTPS certificate for vault.haven.
|
||||
- name: NODE_EXTRA_CA_CERTS
|
||||
value: /etc/ssl/certs/haven-ca.crt
|
||||
# Use the in-cluster ingress. The public endpoint currently
|
||||
# returns 502 from inside the cluster.
|
||||
- name: BW_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: bitwarden-cli
|
||||
key: BW_HOST
|
||||
value: https://vault.haven
|
||||
- name: BW_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
@@ -78,6 +122,11 @@ spec:
|
||||
secretKeyRef:
|
||||
name: bitwarden-cli
|
||||
key: BW_PASSWORD
|
||||
volumeMounts:
|
||||
- name: haven-ca
|
||||
mountPath: /etc/ssl/certs/haven-ca.crt
|
||||
subPath: haven-ca.crt
|
||||
readOnly: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8087
|
||||
@@ -104,6 +153,10 @@ spec:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
volumes:
|
||||
- name: haven-ca
|
||||
configMap:
|
||||
name: bitwarden-cli-ca
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -82,8 +82,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: code-config
|
||||
namespace: infra
|
||||
annotations:
|
||||
nfs.io/storage-path: "code-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -19,6 +19,8 @@ spec:
|
||||
metadata:
|
||||
labels:
|
||||
app: file-nginx
|
||||
annotations:
|
||||
checksum/file-nginx-conf: "4235705a54e5003a340f1a4e164c3e3239fd4327d9aa9ecf0c640a3655def3c9"
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
@@ -83,11 +85,19 @@ data:
|
||||
server_name _;
|
||||
|
||||
root /usr/share/nginx/data/file-nginx;
|
||||
index index.html;
|
||||
|
||||
autoindex on;
|
||||
autoindex_exact_size off;
|
||||
autoindex_localtime on;
|
||||
|
||||
location = /index.html {
|
||||
# The legacy static page is now the live directory browser.
|
||||
return 302 /;
|
||||
}
|
||||
|
||||
location / {
|
||||
# Bypass the static welcome page so every directory is browsable.
|
||||
index __directory_listing__;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
|
||||
+41
-11
@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: wg-easy-pvc
|
||||
namespace: infra
|
||||
annotations:
|
||||
nfs.io/storage-path: "wg-easy-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
@@ -20,7 +18,10 @@ metadata:
|
||||
namespace: infra
|
||||
spec:
|
||||
strategy:
|
||||
type: Recreate
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
@@ -38,12 +39,11 @@ spec:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- nexus
|
||||
- polaris
|
||||
weight: 100
|
||||
containers:
|
||||
- name: wg-easy
|
||||
image: ghcr.io/wg-easy/wg-easy:latest
|
||||
imagePullPolicy: Always
|
||||
image: ghcr.io/wg-easy/wg-easy:15.4.0
|
||||
ports:
|
||||
- containerPort: 51820
|
||||
protocol: UDP
|
||||
@@ -54,15 +54,11 @@ spec:
|
||||
env:
|
||||
- name: LANG
|
||||
value: en
|
||||
- name: WG_HOST
|
||||
value: vpn.ivanch.me
|
||||
- name: WG_MTU
|
||||
value: "1420"
|
||||
- name: UI_TRAFFIC_STATS
|
||||
value: "true"
|
||||
- name: UI_CHART_TYPE
|
||||
value: "0"
|
||||
- name: WG_ENABLE_ONE_TIME_LINKS
|
||||
- name: INSECURE
|
||||
value: "true"
|
||||
- name: UI_ENABLE_SORT_CLIENTS
|
||||
value: "true"
|
||||
@@ -78,14 +74,37 @@ spec:
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 1Gi
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 51821
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 51821
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 2
|
||||
volumeMounts:
|
||||
- name: wg-easy-volume
|
||||
mountPath: /etc/wireguard
|
||||
- name: kernel-modules
|
||||
mountPath: /lib/modules
|
||||
readOnly: true
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: wg-easy-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: wg-easy-pvc
|
||||
- name: kernel-modules
|
||||
hostPath:
|
||||
path: /lib/modules
|
||||
type: Directory
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -124,3 +143,14 @@ spec:
|
||||
name: wg-easy-svc
|
||||
port:
|
||||
number: 51821
|
||||
---
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: wg-easy-pdb
|
||||
namespace: infra
|
||||
spec:
|
||||
minAvailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: wg-easy
|
||||
|
||||
@@ -9,7 +9,7 @@ spec:
|
||||
project: default
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: alloy
|
||||
namespace: monitoring
|
||||
syncPolicy:
|
||||
automated: { prune: true, selfHeal: true }
|
||||
syncOptions: [CreateNamespace=true, ServerSideApply=true]
|
||||
@@ -47,10 +47,10 @@ spec:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 750Mi
|
||||
memory: 512Mi
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
memory: 2Gi
|
||||
cpu: 1000m
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/grafana
|
||||
name: grafana-pv
|
||||
@@ -64,8 +64,6 @@ kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: grafana-pvc
|
||||
namespace: monitoring
|
||||
annotations:
|
||||
nfs.io/storage-path: "grafana-data"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
|
||||
@@ -86,7 +86,7 @@ spec:
|
||||
kubernetes.io/os: linux
|
||||
containers:
|
||||
- name: kube-state-metrics
|
||||
image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
|
||||
image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --resources=cronjobs,daemonsets,deployments,jobs,nodes,persistentvolumeclaims,pods,replicasets,statefulsets
|
||||
|
||||
@@ -5,6 +5,8 @@ metadata:
|
||||
namespace: monitoring
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: loki
|
||||
@@ -36,8 +38,9 @@ spec:
|
||||
configMap:
|
||||
name: loki-config
|
||||
- name: loki-storage
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
nfs:
|
||||
server: nexus.haven
|
||||
path: /export/sandbox/loki
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
@@ -79,7 +82,12 @@ data:
|
||||
|
||||
limits_config:
|
||||
allow_structured_metadata: true
|
||||
retention_period: 0
|
||||
retention_period: 72h
|
||||
max_query_lookback: 72h
|
||||
# Global per-tenant cap: <= 0.1 MB/s sustained keeps this sandbox disk bounded.
|
||||
ingestion_rate_strategy: global
|
||||
ingestion_rate_mb: 0.1
|
||||
ingestion_burst_size_mb: 0.5
|
||||
|
||||
ingester:
|
||||
lifecycler:
|
||||
@@ -92,7 +100,12 @@ data:
|
||||
chunk_target_size: 1536000
|
||||
|
||||
compactor:
|
||||
retention_enabled: false
|
||||
working_directory: /tmp/loki/compactor
|
||||
compaction_interval: 10m
|
||||
retention_enabled: true
|
||||
retention_delete_delay: 2h
|
||||
retention_delete_worker_count: 10
|
||||
delete_request_store: filesystem
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -7,6 +7,8 @@ metadata:
|
||||
app: prometheus
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: prometheus
|
||||
@@ -22,7 +24,9 @@ spec:
|
||||
args:
|
||||
- "--config.file=/etc/prometheus/prometheus.yml"
|
||||
- "--storage.tsdb.path=/prometheus"
|
||||
- "--storage.tsdb.retention.time=1d"
|
||||
- "--storage.tsdb.retention.time=2d"
|
||||
# Keep a generous buffer on the 117 GiB sandbox filesystem; WAL may exceed this briefly.
|
||||
- "--storage.tsdb.retention.size=8GB"
|
||||
- "--web.enable-lifecycle"
|
||||
ports:
|
||||
- containerPort: 9090
|
||||
@@ -44,17 +48,15 @@ spec:
|
||||
persistentVolumeClaim:
|
||||
claimName: prometheus-pvc
|
||||
- name: prometheus-storage
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
sizeLimit: 256Mi
|
||||
nfs:
|
||||
server: nexus.haven
|
||||
path: /export/sandbox/prometheus
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: prometheus-pvc
|
||||
namespace: monitoring
|
||||
annotations:
|
||||
nfs.io/storage-path: "prometheus-config"
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
@@ -63,6 +65,19 @@ spec:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: prometheus-storage-pvc
|
||||
namespace: monitoring
|
||||
spec:
|
||||
storageClassName: "nfs-client"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
# Service URL - http://prometheus.monitoring.svc.cluster.local:9090
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -96,22 +111,22 @@ metadata:
|
||||
labels:
|
||||
app: prometheus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- nodes
|
||||
- nodes/proxy
|
||||
- services
|
||||
- endpoints
|
||||
- pods
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions"]
|
||||
resources:
|
||||
- ingresses
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources:
|
||||
- ingresses
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- nodes
|
||||
- nodes/proxy
|
||||
- services
|
||||
- endpoints
|
||||
- pods
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions"]
|
||||
resources:
|
||||
- ingresses
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources:
|
||||
- ingresses
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
@@ -125,6 +140,6 @@ roleRef:
|
||||
kind: ClusterRole
|
||||
name: prometheus
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: prometheus
|
||||
namespace: monitoring
|
||||
- kind: ServiceAccount
|
||||
name: prometheus
|
||||
namespace: monitoring
|
||||
|
||||
@@ -59,14 +59,6 @@ metadata:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: metallb-system
|
||||
---
|
||||
@@ -75,11 +67,6 @@ metadata:
|
||||
# ==============================================================================
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: alloy
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: monitoring
|
||||
---
|
||||
|
||||
+11
-4
@@ -1,14 +1,21 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"prHourlyLimit": 0,
|
||||
"kubernetes": {
|
||||
"managerFilePatterns": ["/\\.yaml$/"]
|
||||
"managerFilePatterns": [
|
||||
"/\\.yaml$/"
|
||||
]
|
||||
},
|
||||
"packageRules": [
|
||||
{
|
||||
"description": "Skip local registry images (built by CI, not upstream deps)",
|
||||
"matchDatasources": ["docker"],
|
||||
"matchPackageNames": ["git.ivanch.me/**"],
|
||||
"matchDatasources": [
|
||||
"docker"
|
||||
],
|
||||
"matchPackageNames": [
|
||||
"git.ivanch.me/**"
|
||||
],
|
||||
"enabled": false
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -12,6 +12,8 @@ spec:
|
||||
DB_USERNAME: "{{ .DB_USERNAME }}"
|
||||
DB_PASSWORD: "{{ .DB_PASSWORD }}"
|
||||
DB_NAME: "{{ .DB_NAME }}"
|
||||
DB_URL: "{{ .DB_URL }}"
|
||||
DB_CONNECTION_URL: "postgres://{{ .DB_USERNAME }}:{{ .DB_PASSWORD }}@{{ .DB_URL }}:5432/{{ .DB_NAME }}"
|
||||
data:
|
||||
- secretKey: DB_USERNAME
|
||||
remoteRef:
|
||||
@@ -28,3 +30,7 @@ spec:
|
||||
{ key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: DB_NAME }
|
||||
sourceRef:
|
||||
{ storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
|
||||
- secretKey: DB_URL
|
||||
remoteRef: { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: DB_URL }
|
||||
sourceRef:
|
||||
{ storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
|
||||
|
||||
@@ -12,7 +12,6 @@ spec:
|
||||
DB_USER: "{{ .DB_USER }}"
|
||||
DB_PASSWORD: "{{ .DB_PASSWORD }}"
|
||||
DB_NAME: "{{ .DB_NAME }}"
|
||||
REDIS_PASSWORD: "{{ .REDIS_PASSWORD }}"
|
||||
data:
|
||||
- secretKey: DB_USER
|
||||
remoteRef:
|
||||
@@ -29,8 +28,3 @@ spec:
|
||||
{ key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: DB_NAME }
|
||||
sourceRef:
|
||||
{ storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
|
||||
- secretKey: REDIS_PASSWORD
|
||||
remoteRef:
|
||||
{ key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: REDIS_PASSWORD }
|
||||
sourceRef:
|
||||
{ storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
|
||||
|
||||
Reference in New Issue
Block a user