moving things around

.gitignore

@@ -1,5 +1,6 @@
 media/
 default/*tt*
+default/havenllo*
 certs/ca*
 
 lab/*

default/paperless.yaml

@@ -46,10 +46,30 @@ spec:
               value: '{"invalidate_digital_signatures": true}'
             - name: PAPERLESS_DBHOST
               value: postgresql.haven
+            - name: PAPERLESS_DBNAME
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-secret
+                  key: PAPERLESS_DBNAME
+            - name: PAPERLESS_DBUSER
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-secret
+                  key: PAPERLESS_DBUSER
+            - name: PAPERLESS_DBPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-secret
+                  key: PAPERLESS_DBPASSWORD
             - name: PAPERLESS_REDIS
               value: "redis://redis.haven:6379"
             - name: PAPERLESS_PORT
               value: "8000"
+            - name: PAPERLESS_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-secret
+                  key: PAPERLESS_SECRET_KEY
           ports:
             - containerPort: 8000
               name: paperless-port

infra/beszel-agent.yaml

@@ -14,18 +14,25 @@ spec:
     spec:
       hostNetwork: true
       containers:
-      - env:
-        - name: PORT
-          value: "45876"
-        - name: KEY
-          valueFrom:
-            secretKeyRef:
-              name: beszel-key
-              key: SECRET-KEY
-        image: henrygd/beszel-agent:0.17.0
-        imagePullPolicy: Always
-        name: beszel-agent
-        ports:
-          - containerPort: 45876
-            hostPort: 45876
+        - env:
+            - name: PORT
+              value: "45876"
+            - name: KEY
+              valueFrom:
+                secretKeyRef:
+                  name: beszel-key
+                  key: SECRET-KEY
+          image: henrygd/beszel-agent:0.18.7
+          imagePullPolicy: Always
+          name: beszel-agent
+          ports:
+            - containerPort: 45876
+              hostPort: 45876
+      resources:
+        requests:
+          memory: "64Mi"
+          cpu: "50m"
+        limits:
+          memory: "128Mi"
+          cpu: "200m"
       restartPolicy: Always

infra/beszel.yaml

@@ -19,18 +19,25 @@ spec:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
-            - matchExpressions:
-              - key: kubernetes.io/arch
-                operator: In
-                values:
-                - amd64
+              - matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values:
+                      - amd64
       containers:
         - name: beszel
-          image: ghcr.io/henrygd/beszel/beszel:0.17.0
+          image: ghcr.io/henrygd/beszel/beszel:0.18.7
           imagePullPolicy: Always
           ports:
             - containerPort: 8090
               name: beszel-port
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
           volumeMounts:
             - name: beszel-config
               mountPath: /beszel_data

infra/code-config.yaml

@@ -44,7 +44,7 @@ spec:
               cpu: 200m
             limits:
               memory: 1Gi
-              cpu: 500m
+              cpu: 2000m
           ports:
             - containerPort: 8443
               name: code-port

infra/eso/bitwarden-cli.yaml

@@ -15,6 +15,8 @@ spec:
       labels:
         app.kubernetes.io/name: bitwarden-cli
     spec:
+      nodeSelector:
+        kubernetes.io/arch: amd64
       containers:
         - name: bitwarden-cli
           image: ghcr.io/charlesthomas/bitwarden-cli:2026.3.0

infra/haven-notify.yaml

@@ -2,11 +2,16 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: haven-notify
-  namespace: default
+  namespace: infra
   labels:
     app: haven-notify
 spec:
-  replicas: 1
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
   selector:
     matchLabels:
       app: haven-notify
@@ -52,7 +57,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: haven-notify
-  namespace: default
+  namespace: infra
 spec:
   selector:
     app: haven-notify
@@ -65,7 +70,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: haven-notify
-  namespace: default
+  namespace: infra
 spec:
   ingressClassName: nginx
   rules:

infra/wg-easy.yaml

@@ -78,9 +78,9 @@ spec:
             limits:
               cpu: 2000m
               memory: 1Gi
-      volumeMounts:
-        - name: wg-easy-volume
-          mountPath: /etc/wireguard
+          volumeMounts:
+            - name: wg-easy-volume
+              mountPath: /etc/wireguard
       restartPolicy: Always
       volumes:
         - name: wg-easy-volume

monitoring/kube-state-metrics.yaml

@@ -3,55 +3,51 @@ kind: ServiceAccount
 metadata:
   name: kube-state-metrics
   namespace: monitoring
+  labels:
+    app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
+automountServiceAccountToken: false
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: kube-state-metrics
+  labels:
+    app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 rules:
   - apiGroups: [""]
     resources:
       - nodes
       - pods
-      - services
-      - endpoints
-      - namespaces
-      - replicationcontrollers
+      - persistentvolumeclaims
     verbs: ["list", "watch"]
-  - apiGroups: ["extensions", "apps"]
+  - apiGroups: ["apps"]
     resources:
+      - statefulsets
       - daemonsets
       - deployments
       - replicasets
-      - statefulsets
     verbs: ["list", "watch"]
   - apiGroups: ["batch"]
     resources:
       - cronjobs
       - jobs
     verbs: ["list", "watch"]
-  - apiGroups: ["autoscaling"]
-    resources:
-      - horizontalpodautoscalers
-    verbs: ["list", "watch"]
-  - apiGroups: ["policy"]
-    resources:
-      - poddisruptionbudgets
-    verbs: ["list", "watch"]
-  - apiGroups: ["storage.k8s.io"]
-    resources:
-      - storageclasses
-      - volumeattachments
-    verbs: ["list", "watch"]
-  - apiGroups: ["apps"]
-    resources:
-      - replicasets
-    verbs: ["list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: kube-state-metrics
+  labels:
+    app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -68,6 +64,9 @@ metadata:
   namespace: monitoring
   labels:
     app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 spec:
   replicas: 1
   selector:
@@ -77,14 +76,46 @@ spec:
     metadata:
       labels:
         app: kube-state-metrics
+        app.kubernetes.io/component: exporter
+        app.kubernetes.io/name: kube-state-metrics
+        app.kubernetes.io/version: 2.19.1
     spec:
+      automountServiceAccountToken: true
       serviceAccountName: kube-state-metrics
+      nodeSelector:
+        kubernetes.io/os: linux
       containers:
         - name: kube-state-metrics
-          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0
+          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
+          imagePullPolicy: IfNotPresent
+          args:
+            - --resources=cronjobs,daemonsets,deployments,jobs,nodes,persistentvolumeclaims,pods,replicasets,statefulsets
           ports:
             - name: http-metrics
               containerPort: 8080
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http-metrics
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8081
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
           resources:
             requests:
               cpu: 50m
@@ -100,10 +131,15 @@ metadata:
   namespace: monitoring
   labels:
     app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 spec:
+  type: ClusterIP
+  selector:
+    app: kube-state-metrics
   ports:
     - name: http-metrics
       port: 8080
       targetPort: http-metrics
-  selector:
-    app: kube-state-metrics
+      protocol: TCP

monitoring/loki.yaml

@@ -24,6 +24,13 @@ spec:
               mountPath: /etc/loki/config
             - name: loki-storage
               mountPath: /tmp/loki
+          resources:
+            requests:
+              cpu: 100m
+              memory: 1Gi
+            limits:
+              cpu: 200m
+              memory: 1Gi
       volumes:
         - name: config
           configMap:

secrets/discord-webhook.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: discord-webhook, namespace: infra }
+spec:
+  refreshInterval: 1h
+  target:
+    name: discord-webhook
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        HAVEN_WEBHOOK_URL: "{{ .HAVEN_WEBHOOK_URL }}"
+  data:
+    - secretKey: HAVEN_WEBHOOK_URL
+      remoteRef:
+        {
+          key: afd065bd-be8f-4e3c-a06e-e9d3089cb8f7,
+          property: HAVEN_WEBHOOK_URL,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/kasbot.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: kasbot, namespace: default }
+spec:
+  refreshInterval: 1h
+  target:
+    name: kasbot-secrets
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        KASBOT_TOKEN: "{{ .KASBOT_TOKEN }}"
+  data:
+    - secretKey: KASBOT_TOKEN
+      remoteRef:
+        { key: 885a7d90-95be-494f-af88-300ac6a7e210, property: KASBOT_TOKEN }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/paperless.yaml

@@ -12,6 +12,7 @@ spec:
         PAPERLESS_DBNAME: "{{ .PAPERLESS_DBNAME }}"
         PAPERLESS_DBUSER: "{{ .PAPERLESS_DBUSER }}"
         PAPERLESS_DBPASSWORD: "{{ .PAPERLESS_DBPASSWORD }}"
+        PAPERLESS_SECRET_KEY: "{{ .PAPERLESS_SECRET_KEY }}"
   data:
     - secretKey: PAPERLESS_DBNAME
       remoteRef:
@@ -37,3 +38,11 @@ spec:
         }
       sourceRef:
         { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: PAPERLESS_SECRET_KEY
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_SECRET_KEY,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }