Compare commits

..

71 Commits

Author SHA1 Message Date
367c30da54 Update system/ArgoCD/application-argo-cd.yaml 2025-07-05 01:30:12 +00:00
07df06fb8f Update system/ArgoCD/application-argo-cd.yaml 2025-07-05 01:27:17 +00:00
9e974b2508 Update system/ArgoCD/values.yaml 2025-07-04 07:28:30 +00:00
8d645e1089 Pterodactyl-- 2025-06-16 09:28:25 +10:00
30ada6e0f2 Pterodactyl++ 2025-06-07 13:21:56 +10:00
a09a513977 Increase Minecraft resource requests 2025-05-24 18:11:25 +10:00
d0fe364416 Upgrade Minecraft chart version 2025-05-24 18:00:20 +10:00
d1174c4ca7 Unpin Minecraft server version 2025-05-24 17:58:28 +10:00
cf6bc7bcce Reconfigure LdapWrapper PV/PVC 2025-05-23 14:44:24 +10:00
32a58b7a17 Reconfigure Jellyseerr PV/PVC #4 2025-05-22 21:47:45 +10:00
ffcc42f525 Reconfigure Jellyseerr PV/PVC #3 2025-05-22 21:44:09 +10:00
510504a3e9 Reconfigure Jellyseerr application 2025-05-22 21:40:41 +10:00
19763bee7d Reconfigure Jellyseerr PV/PVC #2 2025-05-22 21:24:50 +10:00
c3107be5d0 Reconfigure Jellyseerr PV/PVC 2025-05-22 21:22:16 +10:00
e158fb6a7d Reconfigure Jellyfin config pv/pvc;Fix sealedsecret namespace 2025-05-22 14:58:50 +10:00
64e626efdf Temporarily revert Jellyfin config PV/PVC 2025-05-22 14:04:48 +10:00
e814402f23 Reconfigure Jellyfin config pv/pvc 2025-05-22 12:30:20 +10:00
8c5fc26f27 Pin minecraft server version (fix syntax) 2025-05-21 20:52:08 +10:00
c8744d2ecc Pin minecraft server version 2025-05-21 20:49:04 +10:00
4ea33540bd Upgrade kube-vip 2025-05-19 15:34:44 +10:00
bb790668dc Reconfigure flexvolsmb pv/pvc's;Jellyfin++;Jellyseerr++;Plex-- 2025-05-19 15:20:28 +10:00
92e0a08565 Update ingress/Traefik2.x/helmchartconfig-traefik.yaml 2025-05-16 00:47:57 +00:00
bb2d591898 Update services/PVR/Jellyfin/values.yaml 2025-05-14 06:16:08 +00:00
be01b17266 Update services/PVR/Jellyfin/values.yaml 2025-05-14 06:02:19 +00:00
17a557432f Update services/PVR/Jellyfin/values.yaml 2025-05-14 05:17:07 +00:00
489033cf14 Update services/PVR/Jellyfin/values.yaml 2025-05-14 05:16:42 +00:00
b43b848692 Update services/PVR/Jellyseerr/application-jellyseerr.yaml 2025-05-13 11:30:54 +00:00
e5f5e27133 Add services/PVR/Jellyseerr/values.yaml 2025-05-13 11:17:38 +00:00
f18350d890 Add services/PVR/Jellyseerr/application-jellyseer.yaml 2025-05-13 11:09:31 +00:00
4a48c0469b Update services/PVR/Jellyfin/values.yaml 2025-05-13 09:07:46 +00:00
0b252584f4 Update services/PVR/Jellyfin/values.yaml 2025-05-13 09:05:44 +00:00
093252609e Add services/PVR/Jellyfin/values.yaml 2025-05-13 09:02:21 +00:00
b123f1b824 Update services/PVR/Jellyfin/manifests/pvc-jellyfin.yaml 2025-05-13 08:40:41 +00:00
146b032d61 Add services/PVR/Jellyfin/manifests/pvc-jellyfin.yaml 2025-05-13 08:23:35 +00:00
97bb460333 Update services/PVR/Jellyfin/application-jellyfin.yaml 2025-05-13 08:13:44 +00:00
f8abcb4129 Update services/PVR/Jellyfin/application-jellyfin.yaml 2025-05-13 02:14:21 +00:00
5fa2bda698 Update services/PVR/Jellyfin/application-jellyfin.yaml 2025-05-13 02:10:18 +00:00
ec4008740e Update services/PVR/Jellyfin/application-jellyfin.yaml 2025-05-13 02:08:58 +00:00
0ffc5b13a2 Add services/PVR/Jellyfin/application-jellyfin.yaml 2025-05-13 02:07:11 +00:00
9508ac4185 Rebase Headlamp helm chart 2025-04-28 21:06:17 +10:00
6d144ffa39 Reconfigure Vaultwarden storage 2025-04-28 20:34:57 +10:00
a7e9dcaeb0 Reconfigure Memos storage #2 2025-04-28 20:32:56 +10:00
8f874b09d7 Reconfigure Memos storage 2025-04-28 20:31:36 +10:00
818825f13c Reconfigure Lighttpd storage 2025-04-28 20:28:06 +10:00
4d680ef046 Reconfigure Guacamole storage 2025-04-28 20:21:35 +10:00
fed1b92628 Reconfigure Gotify storage 2025-04-28 20:19:51 +10:00
43bb1cae89 Reconfigure DDclient storage 2025-04-28 20:15:27 +10:00
1819e45341 Revert Authelia proxy configuration 2025-04-28 20:13:25 +10:00
797089e868 Reconfigure Authelia storage 2025-04-28 20:11:32 +10:00
21dafc8d59 Reconfigure Argus storage 2025-04-28 20:06:00 +10:00
1313409e85 Reconfigure Minecraft loadbalancer 2025-03-31 19:27:29 +11:00
c98ecd0d7a Disable middleware compression 2025-03-28 12:34:25 +11:00
24431e3ce4 Adopt kube-vip 2025-03-28 12:17:18 +11:00
ef3d1bac57 Migrate Traefik config 2025-03-28 11:51:48 +11:00
36e4aa4ff1 Dawarich-- 2025-03-28 11:13:19 +11:00
73038ac019 Reconfigure Memos 2025-03-21 11:15:23 +11:00
e1c449c0c4 Update ArgoCD 2025-03-21 11:11:24 +11:00
dc280c06ea Documentation 2025-03-21 10:57:22 +11:00
0cf244959d Update Gitea 2025-03-21 10:54:56 +11:00
94ec6be3ac Fix liveness probe endpoint 2025-02-18 19:47:02 +11:00
6432c07eb3 Add liveness probes to Guacamole containers 2025-02-18 17:18:06 +11:00
b0b7e5d102 Syncthing--;TraefikCertsDumper--;Pinned Memos 2025-02-12 22:40:57 +11:00
ad81a889ff Adopt Argus in gitops 2025-02-12 22:21:05 +11:00
9c0199bfa2 Update Vaultwarden 2025-02-12 21:57:34 +11:00
9ea7472ddb Fix chart name 2025-02-12 21:09:06 +11:00
b44768c042 Adopt ArgoCD in gitops 2025-02-12 21:08:13 +11:00
cc53be7f7c Dawarich++ 2025-02-11 13:19:25 +11:00
3000d8152f Adopt Authelia,DDclient,Gotify,Guacamole,Vaultwarden into gitops 2025-02-08 10:09:26 +11:00
82ed32b874 Adopt Longhorn in gitops 2025-02-08 09:59:37 +11:00
ee40f4a350 Rename application folder 2025-02-06 09:55:39 +11:00
8aed060596 Rename values file 2025-02-06 09:53:14 +11:00
99 changed files with 815 additions and 531 deletions

View File

@ -118,26 +118,6 @@ helm install longhorn longhorn/longhorn --namespace longhorn-system --create-nam
Log on to the web interface and delete the default disks on each node (mounted at `/var/lib/longhorn`) and replace them with new disks mounted at `/mnt/blockstorage`.
Add additional `storageClass` with backup schedule:
***After** specifying a NFS backup target (syntax: `nfs://servername:/path/to/share`) through Longhorn's dashboard*
```yaml
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
name: longhorn-dailybackup
provisioner: driver.longhorn.io
allowVolumeExpansion: true
parameters:
numberOfReplicas: "3"
staleReplicaTimeout: "2880"
fromBackup: ""
recurringJobs: '[{"name":"backup", "task":"backup", "cron":"0 0 * * *", "retain":14}]'
```
Then make this the new default `storageClass`:
```shell
kubectl patch storageclass longhorn-dailybackup -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
#kubectl delete storageclass longhorn
```
### 3) Ingress Controller
Reconfigure default Traefik configuration:
@ -161,10 +141,6 @@ kubectl get secret -n argocd argocd-initial-admin-secret -o jsonpath='{.data.pas
```
Login with username `admin` and the initial password, browse to `User Info` and `Update Password`.
Create ArgoCD applicationset
```shell
kubectl apply -f system/ArgoCD/applicationset-homelab.yml
```
### 5) Services
##### 5.1) [Argus]() <small>(release management)</small>
```shell
@ -261,15 +237,4 @@ kubectl apply -f services/PVR/deploy-Sonarr.yml
or
kubectl run -it --rm busybox --restart=Never --image=busybox:1.28 -- nslookup api.github.com [-debug] [fqdn]
* Delete namespaces stuck in `Terminating` state:
*First* check whether there are any resources still present; preventing the namespace from being deleted:
kubectl api-resources --verbs=list --namespaced -o name \
| xargs -n 1 kubectl get --show-kind --ignore-not-found -n <namespace>
Any resources returned should be deleted first (worth mentioning: if you get an error `error: unable to retrieve the complete list of server APIs`, you should check `kubectl get apiservice` for any apiservice with a status of `False`)
If there are no resources left in the namespace, and it is still stuck *terminating*, the following commands remove the blocking finalizer (this is a last resort, you are bypassing protections put in place to prevent zombie processes):
kubectl get namespace <namespace> -o json | jq -j '.spec.finalizers=null' > tmp.json
kubectl replace --raw "/api/v1/namespaces/<namespace>/finalize" -f ./tmp.json
rm ./tmp.json

View File

@ -5,19 +5,22 @@ metadata:
namespace: kube-system
spec:
valuesContent: |-
core:
defaultRuleSyntax: v2
additionalArguments:
- "--providers.file.directory=/etc/traefik/dynamic"
- "--providers.file.watch=true"
certResolvers:
certificatesResolvers:
default:
email: letsencrypt.org.danny@spamasaurus.com
storage: /data/acme.json
dnsChallenge:
provider: cloudflare
delayBeforeCheck: 5m0s
resolvers:
- 1.1.1.1:53
- 1.0.0.1:53
acme:
email: letsencrypt.org.danny@spamasaurus.com
storage: /data/acme.json
dnsChallenge:
provider: cloudflare
delayBeforeCheck: 5m0s
resolvers:
- 1.1.1.1:53
- 1.0.0.1:53
deployment:
initContainers:
- name: volume-permissions
@ -66,8 +69,8 @@ spec:
stsSeconds: 315360000
stsIncludeSubdomains: true
stsPreload: true
compression:
compress: {}
# compression:
# compress: {}
tls:
options:
defaults:
@ -76,6 +79,7 @@ spec:
curvePreferences:
- secp521r1
- secp384r1
- secp256r1
cipherSuites:
- TLS_AES_128_GCM_SHA256
- TLS_AES_256_GCM_SHA384
@ -123,8 +127,11 @@ spec:
storageClass: longhorn
ports:
web:
redirectTo:
port: websecure
redirections:
entryPoint:
to: websecure
scheme: https
permanent: true
websecure:
forwardedHeaders:
insecure: true

View File

@ -0,0 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: argus
namespace: argo-cd
spec:
destination:
namespace: argus
server: https://kubernetes.default.svc
project: default
source:
path: services/Argus
repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog.git
targetRevision: HEAD
syncPolicy:
automated:
selfHeal: true

View File

@ -18,7 +18,7 @@ spec:
serviceAccountName: argus
containers:
- name: argus
image: releaseargus/argus:0.18.0
image: releaseargus/argus:0.21.0
args:
- -config.file=/app/config/config.yml
ports:

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: argus
@ -15,4 +15,4 @@ spec:
middlewares:
- name: 2fa-authentication@file
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -15,5 +15,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,iocharset=utf8
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/argus/config

View File

@ -15,5 +15,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/argus/data

View File

@ -0,0 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: authelia
namespace: argo-cd
spec:
destination:
namespace: authelia
server: https://kubernetes.default.svc
project: default
source:
path: services/Authelia
repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog.git
targetRevision: HEAD
syncPolicy:
automated:
selfHeal: true

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: authelia
@ -14,4 +14,4 @@ spec:
port: 9091
middlewares:
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -14,5 +14,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0600,dir_mode=0600,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/authelia/conf

View File

@ -14,5 +14,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0700,dir_mode=0700,uid=999,gid=1000,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/authelia/redis

View File

@ -4,6 +4,7 @@ metadata:
name: authelia
namespace: authelia
spec:
#externalTrafficPolicy: Local
ports:
- protocol: TCP
name: web

View File

@ -0,0 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: ddclient
namespace: argo-cd
spec:
destination:
namespace: ddclient
server: https://kubernetes.default.svc
project: default
source:
path: services/DDclient
repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog.git
targetRevision: HEAD
syncPolicy:
automated:
selfHeal: true

View File

@ -15,5 +15,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/ddclient/config

View File

@ -11,7 +11,8 @@ spec:
sources:
- repoURL: https://dl.gitea.com/charts/
chart: gitea
targetRevision: 10.6.0
# targetRevision: 10.6.0
targetRevision: 11.0.0
helm:
valueFiles:
- $values/services/Gitea/values.yaml

View File

@ -0,0 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: gotify
namespace: argo-cd
spec:
destination:
namespace: gotify
server: https://kubernetes.default.svc
project: default
source:
path: services/Gotify
repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog.git
targetRevision: HEAD
syncPolicy:
automated:
selfHeal: true

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: gotify
@ -14,4 +14,4 @@ spec:
port: 80
middlewares:
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -14,5 +14,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/gotify/data

View File

@ -0,0 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: guacamole
namespace: argo-cd
spec:
destination:
namespace: guacamole
server: https://kubernetes.default.svc
project: default
source:
path: services/Guacamole
repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog.git
targetRevision: HEAD
syncPolicy:
automated:
selfHeal: true

View File

@ -35,6 +35,10 @@ spec:
ports:
- name: ui
containerPort: 8080
livenessProbe:
httpGet:
port: ui
path: /guacamole
- name: guacd
image: guacamole/guacd:1.5.5
env:
@ -43,6 +47,9 @@ spec:
ports:
- name: proxy
containerPort: 4822
livenessProbe:
tcpSocket:
port: 4822
- name: db
image: postgres:16-alpine
securityContext:
@ -60,6 +67,9 @@ spec:
ports:
- name: db
containerPort: 5432
livenessProbe:
exec:
command: ["pg_isready" ,"-U" ,"$POSTGRES_USER", "-d" ,"$POSTGRES_DATABASE"]
volumes:
- name: flexvolsmb-guacamole-db
persistentVolumeClaim:

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: guacamole
@ -15,4 +15,4 @@ spec:
middlewares:
- name: prepend-path-guacamole
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: prepend-path-guacamole

View File

@ -14,7 +14,7 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0755,dir_mode=0700,uid=70,gid=70,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/guacamole/db
---
apiVersion: v1
@ -33,5 +33,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0755,dir_mode=0755,iocharset=utf8
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/guacamole/home

View File

@ -9,9 +9,9 @@ spec:
namespace: headlamp
project: default
sources:
- repoURL: https://headlamp-k8s.github.io/headlamp/
- repoURL: https://kubernetes-sigs.github.io/headlamp/
chart: headlamp
targetRevision: 0.28.0
targetRevision: 0.30.1
helm:
valueFiles:
- $values/services/Headlamp/values.yaml

View File

@ -0,0 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: ldapwrapper
namespace: argo-cd
spec:
destination:
server: https://kubernetes.default.svc
namespace: ldapwrapper
project: default
sources:
- repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog
path: services/LdapWrapper
targetRevision: HEAD
# - repoURL: https://github.com/djpbessems/Kubernetes.K3s.installLog
# path: services/LdapWrapper
# targetRevision: master

View File

@ -31,8 +31,8 @@ spec:
name: ldap
volumeMounts:
- mountPath: /app/.cache
name: longhorn-ldapwrapper-cache
name: flexvolsmb-ldapwrapper-cache
volumes:
- name: longhorn-ldapwrapper-cache
- name: flexvolsmb-ldapwrapper-cache
persistentVolumeClaim:
claimName: longhorn-ldapwrapper-cache
claimName: flexvolsmb-ldapwrapper-cache

View File

@ -0,0 +1,19 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-ldapwrapper-cache
namespace: ldapwrapper
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-ldapwrapper-cache
flexVolume:
driver: mount/smb
secretRef:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,iocharset=utf8,cache=none,nobrl
server: 192.168.154.195
share: /K3s.Volumes/ldapwrapper/cache

View File

@ -1,13 +1,12 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: longhorn-ldapwrapper-cache
name: flexvolsmb-ldapwrapper-cache
namespace: ldapwrapper
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
- ReadWriteMany
storageClassName: flexvolsmb-ldapwrapper-cache
resources:
requests:
storage: 1Gi

View File

@ -0,0 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: lighttpd
namespace: argo-cd
spec:
destination:
namespace: lighttpd
server: https://kubernetes.default.svc
project: default
source:
path: services/Lighttpd
repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog.git
targetRevision: HEAD
syncPolicy:
automated:
selfHeal: true

View File

@ -30,8 +30,6 @@ spec:
subPath: .htpasswd
- name: configmap-lighttpd-vhosts
mountPath: /etc/lighttpd/vhosts.d
- name: flexvolsmb-lighttpd-data
mountPath: /data/scripts
- name: flexvolsmb-lighttpd-websites
mountPath: /var/www/
volumes:
@ -41,9 +39,6 @@ spec:
- name: configmap-lighttpd-vhosts
configMap:
name: configmap-lighttpd-vhosts
- name: flexvolsmb-lighttpd-data
persistentVolumeClaim:
claimName: flexvolsmb-lighttpd-data
- name: flexvolsmb-lighttpd-websites
persistentVolumeClaim:
claimName: flexvolsmb-lighttpd-websites

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: lighttpd
@ -14,4 +14,4 @@ spec:
port: 8080
middlewares:
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -1,18 +0,0 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-lighttpd-data
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-lighttpd-data
flexVolume:
driver: mount/smb
secretRef:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,iocharset=utf8
server: 192.168.154.225
share: /K3s.Volumes/lighttpd/data

View File

@ -14,5 +14,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/lighttpd/websites

View File

@ -0,0 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: memos
namespace: argo-cd
spec:
destination:
namespace: memos
server: https://kubernetes.default.svc
project: default
source:
path: services/Memos
repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog.git
targetRevision: HEAD
syncPolicy:
automated:
selfHeal: true

View File

@ -17,7 +17,8 @@ spec:
spec:
containers:
- name: app
image: neosmemo/memos:stable
image: neosmemo/memos:0.24
imagePullPolicy: Always
env:
- name: MEMOS_PORT
value: '5230'

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: memos
@ -14,4 +14,4 @@ spec:
port: 5230
middlewares:
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -15,5 +15,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0600,dir_mode=0700,uid=1001,gid=1001,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/memos/data

View File

@ -11,7 +11,7 @@ spec:
sources:
- repoURL: https://itzg.github.io/minecraft-server-charts/
chart: minecraft-bedrock
targetRevision: 2.8.2
targetRevision: 2.8.4
helm:
valueFiles:
- $values/services/Minecraft/values.yaml

View File

@ -1,9 +1,11 @@
minecraftServer:
# version: 1.21.73.01
eula: "true"
serverName: Clydebank Rd Survival
serviceType: LoadBalancer
loadBalancerIP: 192.168.154.240
loadBalancerIP: 192.168.154.241
cheats: true
@ -17,6 +19,11 @@ persistence:
accessModes:
- ReadWriteOnce
resources:
requests:
memory: 1024Mi
cpu: 500m
extraEnv:
ENABLE_ROLLING_LOGS: true
OVERRIDE_SERVER_PROPERTIES: true

View File

@ -0,0 +1,26 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: jellyfin
namespace: argo-cd
spec:
destination:
server: https://kubernetes.default.svc
namespace: jellyfin
project: default
sources:
- repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog
path: services/PVR/Jellyfin/manifests
targetRevision: HEAD
- repoURL: https://jellyfin.github.io/jellyfin-helm
chart: jellyfin
targetRevision: 2.3.0
helm:
valueFiles:
- $values/services/PVR/Jellyfin/values.yaml
- repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog
targetRevision: HEAD
ref: values
# - repoURL: https://github.com/djpbessems/Kubernetes.K3s.installLog
# targetRevision: master
# ref: values

View File

@ -0,0 +1,19 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-jellyfin-config
namespace: jellyfin
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-jellyfin-config
flexVolume:
driver: mount/smb
secretRef:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=911,gid=911,iocharset=utf8,cache=none
server: 192.168.154.195
share: /K3s.Volumes/jellyfin/config

View File

@ -0,0 +1,19 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-jellyfin-movies
namespace: jellyfin
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-jellyfin-movies
flexVolume:
driver: mount/smb
secretRef:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=911,gid=911,iocharset=utf8,cache=none
server: 192.168.154.195
share: /Public/Video's/Films

View File

@ -0,0 +1,19 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-jellyfin-series
namespace: jellyfin
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-jellyfin-series
flexVolume:
driver: mount/smb
secretRef:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=911,gid=911,iocharset=utf8,cache=none
server: 192.168.154.195
share: /Public/Video's/Series

View File

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: flexvolsmb-jellyfin-config
namespace: jellyfin
spec:
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-jellyfin-config
resources:
requests:
storage: 1Gi

View File

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: flexvolsmb-jellyfin-movies
namespace: jellyfin
spec:
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-jellyfin-movies
resources:
requests:
storage: 1Gi

View File

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: flexvolsmb-jellyfin-series
namespace: jellyfin
spec:
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-jellyfin-series
resources:
requests:
storage: 1Gi

View File

@ -0,0 +1,16 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: flexvolsmb-credentials
namespace: jellyfin
spec:
encryptedData:
password: AgCSzsJlQR2jIMsm7R9goGzziFCEb9quF+tvfXN3dKqWo/zviB4eU5CZ243bEX71eygU+1K7NpcPMF3yD1OB/QBsEKL1Lr62IcHeAHEnsySa2twfLR2wIINXm2kR946HRlmMkroUiJMAdDYCuYnXPxWRewmotvNL1ODK7Yu4rtaZbMjYrV/PDz8I6xIWmpTlsOOI7oj25ZngxS0W8OPMNn83yDR4zgsX2CenNygOfCXdYzJJcMv2Ubue/LxUt3z+RLQznu3/2h8bElauxlJC6QCHXTbjzOX3iFVbFFzn65a8NJIaPysFu+Fi68VdFzwTSq+/ITlun20/zFlW4x177hSdYgUh7pMZpcOMqOPyeT/8Jonxx3wa9CUr1JGnlRukwrfrL6Doyh04FJiftUiLVYDsqCgrLRqaTQ1+90NRFZGhaKhYkSrKfWjNbupiPCTsRsRmVbrPaVCDK5q820l8Jyjhz6dBu0Fi0qXEL7ZbXF1+bdPwnIOgtPPUOJVtc0gYuLluHS6ODd7H8bKc0me5Vr5U0ME0iqhvbyJ6tpkJFpE9tMo4wIpYG3cKiIi1SgHZ7rOKRVfS72xbRhxnKmi1O64J2+jN94wEGIHX8LFppvtxi2WrsyHffQuawkGO4S4sSYVZjoCRMcs0P+jvPMorF7Q0/uecH6noaJIj4it8YoirO6LVUOQKwDg1OEOByeCI7rDFX740UZiX9aOH6osy0Z8e
username: AgDRZH7OydcXH1rw6/GAVv4qApl1klI1iTRVozT7OjNCAhTYTFUF5gPLmtfT/CCSY0ieywjhEC5bJkLZdilcayVfUyfVoPHOC9aLuajk48owwdVwWbe4sEWUT6ZncQrt6s4WuOp6PgWIegW9ycQHZE4pylbgUPh1H0vurDXGnLKQBn5n0zMiMGxAmnXYTTXn77pAuvTN/kim6JcqVylCUbWtetvR98ex33FsHsKS7SBhAS4IZ3vK0xh2iOPH5QfJLwPbIgaa1oYzhBrqAht1sdIY9rVW2WBFqqGDwwbSxnSuddWSXXUoeWY37Lo+qDL+Zqb4+Lk7MDuuTXK/St42BZtQToyihP4PPZjKbIpRFeBPHLDTs63CyPPy5u4ip+kR/aivwgOCbKv+SAqVXAFXk9T8h9drMSCr8oUMoIp5M27Pzs3Cqm68U2KaFPmt3nzbygYjr9H7tNjlpi5FWiCsgpRqNQ93/uJ7pTQZNGk5zjzf+RdJag3NbQejxzq8uDAc/dl01NLxdBfe+pK0x0qoi5o4V5/mPwM+X6u4aOyeFqbE9Uo/cSRxkBeRyO6aHMXRXsSyiYIobbReH0+L3OqiEPF2ddgYIN+dcM665qEWQ3iEy94+JhtL715k00z6UYE70aM4wuFksbkMl4NjPFW38uQM4UMLEOg87I4h+C8p2k94UK7tQ4x9ZSL2dgIFf/wkf5/Ob6HTIFM=
template:
metadata:
creationTimestamp: null
name: flexvolsmb-credentials
namespace: jellyfin
type: mount/smb

View File

@ -0,0 +1,47 @@
ingress:
enabled: true
className: traefik
annotations:
traefik.ingress.kubernetes.io/router.middlewares: security-headers@file
hosts:
- host: player.pvr.spamasaurus.com
paths:
- path: /
pathType: ImplementationSpecific
securityContext:
capabilities:
add:
- "SYS_ADMIN"
drop:
- "ALL"
privileged: true
volumes:
- name: flexvolsmb-jellyfin-movies
persistentVolumeClaim:
claimName: flexvolsmb-jellyfin-movies
- name: flexvolsmb-jellyfin-series
persistentVolumeClaim:
claimName: flexvolsmb-jellyfin-series
- name: igpu
hostPath:
path: /dev/dri
volumeMounts:
- name: flexvolsmb-jellyfin-movies
mountPath: "/movies"
- name: flexvolsmb-jellyfin-series
mountPath: "/series"
- name: igpu
mountPath: /dev/dri
# jellyfin: {}
persistence:
config:
enabled: true
size: 5Gi
existingClaim: flexvolsmb-jellyfin-config
media:
enabled: false

View File

@ -0,0 +1,23 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: jellyseerr
namespace: argo-cd
spec:
destination:
server: https://kubernetes.default.svc
namespace: jellyseerr
project: default
sources:
- repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog
path: services/PVR/Jellyseerr/manifests
targetRevision: HEAD
- repoURL: ghcr.io/fallenbagel/jellyseerr
chart: jellyseerr-chart
targetRevision: 2.4.0
helm:
valueFiles:
- $values/services/PVR/Jellyseerr/values.yaml
- repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog
targetRevision: HEAD
ref: values

View File

@ -0,0 +1,19 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-jellyseerr-config
namespace: jellyseerr
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-jellyseerr-config
flexVolume:
driver: mount/smb
secretRef:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=911,gid=911,iocharset=utf8,cache=none,nobrl
server: 192.168.154.195
share: /K3s.Volumes/jellyseerr/config

View File

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: flexvolsmb-jellyseerr-config
namespace: jellyseerr
spec:
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-jellyseerr-config
resources:
requests:
storage: 1Gi

View File

@ -0,0 +1,16 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: flexvolsmb-credentials
namespace: jellyseerr
spec:
encryptedData:
password: AgAt3cqRtt1kYuX+F1XMrNpbSulwd+qyBQWsoPPgXQhRz3rWzemEqJwMXEYj0D9ow79p7W17ytePDnkgEZsVgXHdyiwYbMP9kfzDwoEanFyGeCwbcy90mp13xlX3dH/LpCNQcJcS5aVfaprMS6aHbVwmTCaeP2J0Kmr1eD/0o+poSAtsZn7ru2rfXIZz3bT5KqxWdR/op09ra8PvJpo3JC2h8RVV30UnXQ4+6J2wiZaIQ7vhqGjwKYKjOh6CAUzljFIflZ8a0kQSMPeuAmVQhG4cVqTe4BQ7JucB0eRdBumrYCxtbYW0wg/2YbTlAnPRm9jULpOo5UfKef0mlAW46uIHHABtQywu7RyZ0DUQ1R+4Qx/sp+qsYkeCgfwoYnh6jT/0O967D3CFFPtTrRnDr/R1vdB1h2BPRdmdo9kb90+25KFBlaX4aoA4lbQ1m6RrodU48OcAIVjqtREOXHruxQyS20LAamze3hEI16wT9pnuh+50T4ntCRF+WuuY6Oi+OLpNePWJTIICkFvc9fUCcx6eKz/KzvzqKGVSisQlPzoDJkdwOxTW4uvm2HgMCw8wBgzxkOPk6ru0jxphdSpQE2OSJr7w+15RIIf4O+ne0fBSg7KFxYsc8KvDjvFYnK/tGm00Sz3pHFdMmQPCAYAnUq5s8oimA5OF1EDhvWVgv4KNWr+pgzZPDaMjRxEQR+ZZhwsBDrEBBUQJlfe1msSs43Cn
username: AgCk+TrEHAVBFGuu3u7c+zNVagqYjcWj7mljnpSAhIibaFm8+/G44xbfiU5ks7hteWvJ6KInr8g+VAaot8ygICjI7jZoJW/rN8kwNZZVH6ddlQwczAxBukBVFQiZrjy3lN4OtfamKLCJsvBuw39OflVLjHqtfJuTTO5WLCeI9MiTkAP0ZQ/w8T2LrLRzqtmx7/Zxgw34zXYXsAfU+vsUA7QTiCCV6rvEO+P+TsK/opf7HRDqM2jIRRwPK5z9NwYV2MNEb+IO7fmDwwSbGHs135V8yST95VjkdU00m0AHq+Ry7VLjrUBwdqaj72Dn6of28vLtTNL84ck/I59j60Y0QEBQy+9oonP4Y18Bcsix2IbpYw7yklP8cD3dqbc+XufjpV3nwyF/QiJ3XpMtggSsnEvYgTsushLxxDHAS8n7MRufpxRsgZ2QdQIKNZXh+wnI8V3CXuQ9pIGK50QreO1o2BQ8CSfgsHLoyEbCxtPVvSY9/jaSxApOX9tRwyJyHUKadH5jc/EJeokQX7fWAPXwORAlWhU84hPyZtujI9iPLaxVT+2PdKMaE1qHjXZlpn5VySzmA6QOvOVjVHtbtYmI0XpMl/LdwMoLeJAOW2QgOqCLF8+4p/RiSRgUTZqdMzUkVYj3CeeDLfveq92m0nPtc12xc73y8nFf5S0Xhfvn/bu/0Jf9k0zp8jySdK7CCUWSk5/QjC2X/9g=
template:
metadata:
creationTimestamp: null
name: flexvolsmb-credentials
namespace: jellyseerr
type: mount/smb

View File

@ -0,0 +1,15 @@
ingress:
enabled: true
ingressClassName: traefik
hosts:
- host: requests.pvr.spamasaurus.com
paths:
- path: /
pathType: ImplementationSpecific
config:
persistence:
name: flexvolsmb-jellyseerr-config
storageClass: flexvolsmb-jellyseerr-config
accessModes: ["ReadWriteMany"]
size: 1Gi

View File

@ -1,34 +0,0 @@
image:
pullPolicy: Always
ingress:
enabled: true
ingressClassName: traefik
url: media.pvr.spamasaurus.com
pms:
configStorage: 20Gi
resources:
limits:
gpu.intel.com/i915: "1"
requests:
gpu.intel.com/i915: "1"
extraVolumeMounts:
- name: flexvolsmb-pvr-movies
mountPath: /movies
- name: flexvolsmb-pvr-series
mountPath: /series
extraVolumes:
- name: flexvolsmb-pvr-movies
persistentVolumeClaim:
claimName: flexvolsmb-pvr-movies
- name: flexvolsmb-pvr-series
persistentVolumeClaim:
claimName: flexvolsmb-pvr-series
# extraEnv:
# PLEX_CLAIM: "claim-EzKU3rNVbWtc3qY_y7wq"

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: prowlarr
@ -15,4 +15,4 @@ spec:
middlewares:
- name: 2fa-authentication@file
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -15,5 +15,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=1000,gid=1000,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/prowlarr/config

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: radarr
@ -15,4 +15,4 @@ spec:
middlewares:
- name: 2fa-authentication@file
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -15,5 +15,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,iocharset=utf8
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/radarr/config

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: sabnzbd
@ -15,4 +15,4 @@ spec:
middlewares:
- name: 2fa-authentication@file
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -15,5 +15,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=911,gid=911,iocharset=utf8
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/sabnzbd/config

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: sonarr
@ -15,4 +15,4 @@ spec:
middlewares:
- name: 2fa-authentication@file
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -15,5 +15,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=1000,gid=1000,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/sonarr/config

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: pvr-apikeys
@ -7,35 +7,35 @@ spec:
entryPoints:
- websecure
routes:
- match: Host(`movies.pvr.spamasaurus.com`) && (Headers(`X-Api-Key`, `<removed>`) || Query(`apikey=<removed>`))
- match: Host(`movies.pvr.spamasaurus.com`) && (Header(`X-Api-Key`, `<removed>`) || Query(`apikey`, `<removed>`))
kind: Rule
services:
- name: radarr
port: 7878
middlewares:
- name: security-headers@file
- name: compression@file
- match: Host(`index.pvr.spamasaurus.com`) && (Headers(`X-Api-Key`, `<removed>`) || Query(`apikey=<removed>`))
# - name: compression@file
- match: Host(`index.pvr.spamasaurus.com`) && (Header(`X-Api-Key`, `<removed>`) || Query(`apikey`, `<removed>`))
kind: Rule
services:
- name: prowlarr
port: 9696
middlewares:
- name: security-headers@file
- name: compression@file
- match: Host(`download.pvr.spamasaurus.com`) && (Headers(`X-Api-Key`, `<removed>`) || Query(`apikey=<removed>`))
# - name: compression@file
- match: Host(`download.pvr.spamasaurus.com`) && (Header(`X-Api-Key`, `<removed>`) || Query(`apikey`, `<removed>`))
kind: Rule
services:
- name: sabnzbd
port: 8080
middlewares:
- name: security-headers@file
- name: compression@file
- match: Host(`series.pvr.spamasaurus.com`) && (Headers(`X-Api-Key`, `<removed>`) || Query(`apikey=<removed>`))
# - name: compression@file
- match: Host(`series.pvr.spamasaurus.com`) && (Header(`X-Api-Key`, `<removed>`) || Query(`apikey`, `<removed>`))
kind: Rule
services:
- name: sonarr
port: 8989
middlewares:
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -1,65 +0,0 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-pvr-movies
namespace: pvr
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-pvr-movies
flexVolume:
driver: mount/smb
secretRef:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=911,gid=911,iocharset=utf8,cache=none
server: 192.168.154.225
share: /Public/Video's/Films
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: flexvolsmb-pvr-movies
namespace: pvr
spec:
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-pvr-movies
resources:
requests:
storage: 1Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-pvr-series
namespace: pvr
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-pvr-series
flexVolume:
driver: mount/smb
secretRef:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=911,gid=911,iocharset=utf8,cache=none
server: 192.168.154.225
share: /Public/Video's/Series
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: flexvolsmb-pvr-series
namespace: pvr
spec:
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-pvr-series
resources:
requests:
storage: 1Gi

View File

@ -0,0 +1,19 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-pvr-movies
namespace: pvr
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-pvr-movies
flexVolume:
driver: mount/smb
secretRef:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=911,gid=911,iocharset=utf8,cache=none
server: 192.168.154.195
share: /Public/Video's/Films

View File

@ -0,0 +1,19 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-pvr-series
namespace: pvr
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-pvr-series
flexVolume:
driver: mount/smb
secretRef:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,uid=911,gid=911,iocharset=utf8,cache=none
server: 192.168.154.195
share: /Public/Video's/Series

View File

@ -1,12 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: flexvolsmb-lighttpd-data
namespace: lighttpd
name: flexvolsmb-pvr-movies
namespace: pvr
spec:
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-lighttpd-data
storageClassName: flexvolsmb-pvr-movies
resources:
requests:
storage: 1Gi

View File

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: flexvolsmb-pvr-series
namespace: pvr
spec:
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-pvr-series
resources:
requests:
storage: 1Gi

View File

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: smb-pvr-volatile
namespace: pvr
spec:
accessModes:
- ReadWriteMany
storageClassName: pvr
resources:
requests:
storage: 100Gi

View File

@ -4,7 +4,7 @@ metadata:
name: pvr
provisioner: smb.csi.k8s.io
parameters:
source: "//192.168.154.225/K3s.StorageClass/pvr"
source: "//192.168.154.195/K3s.StorageClass/pvr"
csi.storage.k8s.io/node-stage-secret-name: "smb-credentials"
csi.storage.k8s.io/node-stage-secret-namespace: "pvr"
# createSubDir: "true" # optional: create a sub dir for new volume
@ -17,16 +17,3 @@ mountOptions:
- cache=none
- uid=911
- gid=911
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: smb-pvr-volatile
namespace: pvr
spec:
accessModes:
- ReadWriteMany
storageClassName: pvr
resources:
requests:
storage: 100Gi

View File

@ -1,4 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
name: syncthing

View File

@ -1,46 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: syncthing
name: syncthing
namespace: syncthing
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: syncthing
template:
metadata:
labels:
app: syncthing
spec:
hostname: syncthing
containers:
- image: bv11-cr01.bessems.eu/proxy/syncthing/syncthing
name: syncthing
args:
- --no-browser
- --no-default-folder
- --no-restart
ports:
- containerPort: 8384
name: web
- containerPort: 22000
name: tcp-file-xfer
protocol: TCP
- containerPort: 22000
name: quic-file-xfer
protocol: UDP
- containerPort: 21027
name: discovery
protocol: UDP
volumeMounts:
- mountPath: /var/syncthing
name: longhorn-syncthing-data
volumes:
- name: longhorn-syncthing-data
persistentVolumeClaim:
claimName: longhorn-syncthing-data

View File

@ -1,18 +0,0 @@
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: syncthing
namespace: syncthing
spec:
entryPoints:
- websecure
routes:
- match: Host(`sync.spamasaurus.com`)
kind: Rule
services:
- name: syncthing
port: 8384
middlewares:
- name: 2fa-authentication@file
- name: security-headers@file
- name: compression@file

View File

@ -1,12 +0,0 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: longhorn-syncthing-data
namespace: syncthing
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 5Gi

View File

@ -1,21 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: syncthing
namespace: syncthing
spec:
ports:
- protocol: TCP
name: web
port: 8384
- protocol: TCP
name: tcp-file-xfer
port: 22000
- protocol: UDP
name: quic-file-xfer
port: 22000
- protocol: UDP
name: discovery
port: 21027
selector:
app: syncthing

View File

@ -1,105 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: traefik-certs-dumper
labels:
app: traefik-certs-dumper
spec:
replicas: 1
selector:
matchLabels:
app: traefik-certs-dumper
template:
metadata:
labels:
app: traefik-certs-dumper
spec:
containers:
- name: traefik-certs-dumper
image: bv11-cr01.bessems.eu/proxy/ldez/traefik-certs-dumper:latest-amd64
imagePullPolicy: Always
command: ['traefik-certs-dumper', 'file']
args:
- --watch
- --version=v2
- --source=/data/source/acme.json
- --dest=/data/export/
- --domain-subdir
volumeMounts:
- mountPath: /data/source/acme.json
name: flexvolsmb-traefikcertsdumper-acmejson
subPath: acme.json
readOnly: true
- mountPath: /data/export
name: flexvolsmb-traefikcertsdumper-export
volumes:
- name: flexvolsmb-traefikcertsdumper-acmejson
persistentVolumeClaim:
claimName: flexvolsmb-traefikcertsdumper-acmejson
- name: flexvolsmb-traefikcertsdumper-export
persistentVolumeClaim:
claimName: flexvolsmb-traefikcertsdumper-export
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-traefikcertsdumper-acmejson
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-traefikcertsdumper-acmejson
flexVolume:
driver: mount/smb
secretRef:
name: smb-secret
options:
opts: domain=bessems.eu,file_mode=0600,dir_mode=0600,iocharset=utf8,nobrl
server: 192.168.11.225
share: /K3s.Volumes/traefik/data
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: flexvolsmb-traefikcertsdumper-acmejson
namespace: default
spec:
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-traefikcertsdumper-acmejson
resources:
requests:
storage: 1Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: flexvolsmb-traefikcertsdumper-export
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-traefikcertsdumper-export
flexVolume:
driver: mount/smb
secretRef:
name: smb-secret
options:
opts: domain=bessems.eu,file_mode=0777,dir_mode=0777,iocharset=utf8,nobrl
server: 192.168.11.225
share: /K3s.Volumes/traefikcertsdumper/export
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: flexvolsmb-traefikcertsdumper-export
namespace: default
spec:
accessModes:
- ReadWriteMany
storageClassName: flexvolsmb-traefikcertsdumper-export
resources:
requests:
storage: 1Gi

View File

@ -0,0 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: vaultwarden
namespace: argo-cd
spec:
destination:
namespace: vaultwarden
server: https://kubernetes.default.svc
project: default
source:
path: services/Vaultwarden
repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog.git
targetRevision: HEAD
syncPolicy:
automated:
selfHeal: true

View File

@ -18,8 +18,7 @@ spec:
serviceAccountName: vaultwarden
containers:
- name: vaultwarden
# image: bv11-cr01.bessems.eu/proxy/vaultwarden/server
image: vaultwarden/server
image: vaultwarden/server:1.33.2
env:
- name: ENABLE_DB_WAL
value: "false"

View File

@ -1,4 +1,4 @@
apiVersion: traefik.containo.us/v1alpha1
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: vaultwarden
@ -14,7 +14,7 @@ spec:
port: 8080
middlewares:
- name: security-headers@file
- name: compression@file
# - name: compression@file
- match: Host(`vault.spamasaurus.com`) && Path(`/notifications/hub`)
kind: Rule
services:
@ -22,4 +22,4 @@ spec:
port: 3012
middlewares:
- name: security-headers@file
- name: compression@file
# - name: compression@file

View File

@ -14,5 +14,5 @@ spec:
name: flexvolsmb-credentials
options:
opts: file_mode=0777,dir_mode=0777,iocharset=utf8,nobrl
server: 192.168.154.225
server: 192.168.154.195
share: /K3s.Volumes/vaultwarden/data

View File

@ -0,0 +1,23 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: longhorn
namespace: argo-cd
spec:
destination:
server: https://kubernetes.default.svc
namespace: longhorn-system
project: default
sources:
- repoURL: https://charts.longhorn.io
chart: longhorn
targetRevision: 1.8.0
helm:
valueFiles:
- $values/storage/Longhorn/values.yaml
- repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog
targetRevision: master
ref: values
# - repoURL: https://github.com/djpbessems/Kubernetes.K3s.installLog
# targetRevision: master
# ref: values

View File

@ -1,5 +0,0 @@
defaultSettings:
defaultDataPath: /mnt/blockstorage/
ingress:
enabled: true
host: storage.spamasaurus.com

View File

@ -1,19 +0,0 @@
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: longhorn-dashboard
namespace: default
spec:
entryPoints:
- websecure
routes:
- match: Host(`storage.spamasaurus.com`)
kind: Rule
services:
- name: longhorn-frontend
port: 80
namespace: longhorn-system
middlewares:
- name: 2fa-authentication@file
- name: security-headers@file
- name: compression@file

View File

@ -0,0 +1,8 @@
defaultSettings:
defaultDataPath: /mnt/blockstorage/
ingress:
enabled: true
host: storage.spamasaurus.com
annotations:
# traefik.ingress.kubernetes.io/router.middlewares: 2fa-authentication@file,security-headers@file,compression@file
traefik.ingress.kubernetes.io/router.middlewares: 2fa-authentication@file,security-headers@file

View File

@ -1,25 +0,0 @@
{
"kind": "SealedSecret",
"apiVersion": "bitnami.com/v1alpha1",
"metadata": {
"name": "smb-credentials",
"namespace": "default",
"creationTimestamp": null
},
"spec": {
"template": {
"metadata": {
"name": "smb-credentials",
"namespace": "default",
"creationTimestamp": null
},
"type": "Opaque",
"data": null
},
"encryptedData": {
"domain": "AgCFtOnYpGlu49+rxtdMcweWKvIOo+cRq2wbI+SkQft1cARN5msXCyepELkF79onzT6UtQg3ASNvzR81TZRPqLKibq/qeV3+TyeuTYQOsj8xahe0+pJmg3NZGa4CBhYSj5Es6UFBZ6m8EcOR08HTG3zkXRao5tdfUoKWzB5Ie9savYYUrCHBVCWW29oBoKMKujPxId51qB1yP1Rwa5rZE2+9mfscs+cp5WAyLFd5UjVIjSP13///U/VzFAYcMW/Sm+xmenxnYuzKD2xmAF7YLIsQaaKHv2gNcJuHluSna3YZrSebZoomXdpjWhB78a1pZvQSJkTrDX++E71Urqf9fsKUu6ekV/rfffRyzUFdnxwlJVB94c9ZRml82fJRdFtIYwvkSI/EFU18CjjJKfpuwG5HmL/1AKVSl5/NdaB+xGSlhi6QblIl/p97RZa3wt9l9LzhlCqT9EoDCNB45fOBSX5lpLPBDxOvlWrW4m3sKvwIdno8bKMPhO/m9yCooZZ8QX1zfakgfkCThsOQ1UCFWBiNqzFnTqPhz3Mg8GLTD4jREi10KONTGl+aFFSJ8Y51Ufen8YLA9DcgLypdn4UBelwBsu6qmg/CZbxb5QIPjE2NN5Ioz3R4Nyl2pX9EbyQGfw8umBn57sdFzbl58tbhp4YQn4vl0cFCwYxkJMqx4bd5Rz9Jvf1dCgKU5AXg60+LhZJMU8TLzAN6Qa5L",
"password": "AgA9rRVJ7uUGmwnla+Y7He2aFaAthEiLI72GyzLflzQCJWHtPukAon/1NseeJb0BqVqnc5APPgFeDZ7k0JQRlmlqWPLArKcrTcj0PdWaxrSioohZTMe5LoS7GlFpJrhfULMLKipaIMXaCXx/E8etkYOM6tcnjCxUh+KKdcpPfzH7U6i02tCA+IXcrBDO3jx78G1XAtbYYIgD7wsfXD5EeR5DcoPBOsaeYNiLvQQS5aiWaS0rqDUsv6EeL6dhUeBoAljisL8EMP6yb0XIvNXcYmYidSbbwrt2T6D0YtJ4ivsFuxvT7bkbnI3G7orAdw4EGYvhPBNII4T1QYBjCKP+F6fowDYoufUHR5lnD1wiaw6axrE8X//ekaVipVJbaTQhvtFtnMbKnjYtjL9F3K994HCIDlO6nzhCzm+UpQRk2lDqEL3xLmU6L6oUxpOI9VPunubNDY+CBK4dbzThDJ7ruW1fYv9jdn5h9LzkIoDTIebFy5hl5CSAT6YAjedeYi19cuUBRB9m8PhWMna6NUMeQSZila87SzagBAspCke5iufFFQxg6FyV7Kfm9+O9annY/PyvJXMQ87sto4d5qXyb5yIUpElrp2P1DzMuIHyhlKcjEQGG6TRbRHEmR9dquwsg8I7e0DZD8JcgPwRCqZDPJaS4f3loxyfqds5sp2Hgf2MusIZQn+8AgFLimR/EZ+zV3otGb3UdfDU8Zv5EoeFxBUxb",
"username": "AgCr48TUqDuqHyKLzZTrKqUawED+Ltb/NuA6nOSjb08TuVR7tOPzgga3IH+Y6fN16lzobcmylwh70kosXs0KKWFmpG7TsoNzWtB5hq1KJsvJNWAJNs6mO1n+40wyLE0aS/bo4dDFpFtUVe/n8DdDyH42FwsnnfNJbtEqzItOXaVO/TiDjFDy09SPblVSgFaK+i0A+jdIbqdBQH2bkPDM3WTn0iBLdXpaxAHqWyLDnLmg8dyU8kJfjUS17OylJZP2bm375exikKw+69h7hLbcuKhsFQnmY2Vffe+0D+ozpCO/8PBqv1dkA0FG8EuhqGCbX6dUxbOdhVzkHyK0a+N8bX45ORSlc+V49bzU7BrvzkmPz3j4Yg11ZZP9vXnRrUJgzD8Jp274dArb+3EF+JH5lNBl1RFbB6s0vrbHXOI5oNXxl+dv9ri+2JKE95DXbsN9uXeLnCh+UqBCmSWW4MfO8rHgM/HQL8k8IHwEBphsDjwthWzQz34b4yUSzh5hEJMMa74S2VFTJeITY8DsvNo+rvOjSxyc3XxkLNH6FmFmGgAfVcWHelm4JCY47Ua1IgztsQbeqXRQQVmxC/A9iqYamZuvkZBSYdN6EcRbFf/FXlmqWw4BQV1d4xHgakoY3O/zWAg/39nNH2bIm190EsLap4qAEShFGf5kvXqymXXpqWPIjIDTy11eGlF9N9OhuYbsP+U6XPwemhg="
}
}
}

View File

@ -0,0 +1,15 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: smb-credentials
namespace: default
spec:
encryptedData:
password: AgCkOReg8deCpkzUQj+J6XjMKcHUXwzg5AM2Y68CrC1gNgWSWhVKONX5UruNemJ773ZmgRDdDbIwQUBanLUByMbo4y3/kVnwgJCOADD+ERo30ysbdei+SNIIgg55J8R8nU/H31GFWYdq8Ck3FPNvBXo9uMHyUzqopZm8iOV2YVNA0kx9J1uArpzzc1bx3ZA2sV1Rcg9FtLvPErd7WEn5xdosC2Jtxl8NpMFEU32CiKJVM0h4GjmT5uyEOEYeVBURqRB73QfwS7rIRGGCfV8Px6ByF+ADZQ++0Vdla+kWLfsbTW6qcnDv6rqTc8MtXCfYDC3eWKnNvVgI7aNyyWNntQ1qlgW4o3kBNJm33HEU8lxWtgbt8L+g6l/x/ECRsb2EDJWa15VkEJr2WyghkM9WrgL+C0sVwxjOSPcbiZyk2VLfKL02NN4sJ8GQxVW1AvE6MM+YrPD/9o6YaQkOjI6IbZThpDnGGM3n+VQvUB3mSBR1cC9DNjssbzZOJiMm11OfW3Pfw2blyCzO8swM0RN+pO1+8/63uFh6y3hzYuW/6XkHY1bp2EqBRvpaCsjiJfLg+zhPGKz0Lv7L6GzCaXolxWGrdkTiPVpTKvQl1rW5HhWEYz5W+djRZTSX0Kimu3sawI0riPvJyD+6ANHGvHnW8ioONuv3/TXuCs5As2f9V8PikR8jeEGr5YJQOwnXTXaVd/5Yg7ulVXltLnFZ2fa3jYkW
username: AgAUu6XbTsHoS33fRV9N31CxHildp0XrnrDkT3UuJQKIx8c/GmUy6LZK1/yWD4hwco0DY6BmDMUUXdJQQDE5aYLBADRq5EobwlyuBgHP2pAhncV750e+u0VhWsCg0AREjLJA4P9xN61Qpbw7w1Yfi6OBjFhzKw4e0YyG3D7EoA2Q9+0dQrkPf3ooLJBx6SE/NuVs7uTuKWi2hC+kuKp3WhgrTU9IG+r1UFOO2jPR9ZFtsHaIArDzgbYZ03dFAXuTFjFLLx519/vCMXKKOglUsTzzaZUb798u3zG1xic+nZIvt6OmjyB86QZ+mjRAElVRINZRUJEMPbWkP2frbN1caQnPvX28LGcRiP0wFM+tgJG/3tAu9T1kaYnLFx+g8wex/kYqI0xktFJb2aisEb32Dhr4S883gpvvEouxuY/Y1g0ZuKxuS7tL8SE3i8x6GBFGaqLx+Wp60G2LsHDDn1PRqZ/GRlPci6QnAwScMPRuHbZOkyQem5w7n5t+LkoYq/gQ/hI+kiyEJOT7XqgR0iCsGGqsLQrVuP1M4XaZQEMlXl8q/iw4N7B28XMDAvWKF02jPM1XsCXMi5ins20KjzHwriMZA0CR7LWyBQsp88phQ/JNqTkEYa+AMdL2zVrhKYao7GvbYs15i3dcuZR08Lof2QIkeLe96DVKb3z6cqqRkbCxlErmD2M8BKhS3TXcNRhSgMReFUqTUAU=
template:
metadata:
creationTimestamp: null
name: smb-credentials
namespace: default
type: Opaque

View File

@ -1,17 +0,0 @@
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: <name>
provisioner: smb.csi.k8s.io
parameters:
source: "//192.168.11.225/K3s.StorageClass/<name>"
csi.storage.k8s.io/node-stage-secret-name: "smb-credentials"
csi.storage.k8s.io/node-stage-secret-namespace: "default"
createSubDir: "true" # optional: create a sub dir for new volume
reclaimPolicy: Retain # only retain is supported
volumeBindingMode: Immediate
mountOptions:
- dir_mode=0700
- file_mode=0700
- uid=1001
- gid=1001

View File

@ -0,0 +1,23 @@
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: smb-csi
mountOptions:
- dir_mode=0777
- file_mode=0777
- uid=1001
- gid=1001
- nobrl
- noperm
- mfsymlinks
- cache=strict
- noserverino
parameters:
csi.storage.k8s.io/node-stage-secret-name: smb-credentials
csi.storage.k8s.io/node-stage-secret-namespace: default
csi.storage.k8s.io/provisioner-secret-name: smb-credentials
csi.storage.k8s.io/provisioner-secret-namespace: default
source: //192.168.154.195/K3s.StorageClass/smb-csi
provisioner: smb.csi.k8s.io
reclaimPolicy: Retain
volumeBindingMode: Immediate

View File

@ -0,0 +1,25 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: argo-cd
namespace: argo-cd
spec:
destination:
server: https://kubernetes.default.svc
namespace: argo-cd
project: default
sources:
- repoURL: https://argoproj.github.io/argo-helm
chart: argo-cd
targetRevision: 8.1.2
helm:
valueFiles:
- $values/system/ArgoCD/values.yaml
- repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog
targetRevision: lab-k8s
ref: values
# - repoURL: https://github.com/djpbessems/Kubernetes.K3s.installLog
# targetRevision: master
# ref: values
syncPolicy:
automated: {}

View File

@ -1,8 +0,0 @@
configs:
params:
server.insecure: true
global:
domain: gitops.spamasaurus.com
server:
ingress:
enabled: true

10
system/ArgoCD/values.yaml Normal file
View File

@ -0,0 +1,10 @@
configs:
params:
server.insecure: true
global:
domain: gitops.lab.spamasaurus.com
server:
ingress:
enabled: true
annotations:
traefik.ingress.kubernetes.io/router.middlewares: security-headers@file

View File

@ -0,0 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: kube-vip
namespace: argo-cd
spec:
destination:
namespace: kube-system
server: https://kubernetes.default.svc
project: default
source:
path: system/kube-vip
repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog.git
targetRevision: HEAD
syncPolicy:
automated:
selfHeal: true

View File

@ -0,0 +1,87 @@
apiVersion: apps/v1
kind: DaemonSet
metadata:
creationTimestamp: null
labels:
app.kubernetes.io/name: kube-vip-ds
app.kubernetes.io/version: v0.9.1
name: kube-vip-ds
namespace: kube-system
spec:
selector:
matchLabels:
app.kubernetes.io/name: kube-vip-ds
template:
metadata:
creationTimestamp: null
labels:
app.kubernetes.io/name: kube-vip-ds
app.kubernetes.io/version: v0.9.1
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/master
operator: Exists
- matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: Exists
containers:
- args:
- manager
env:
- name: vip_arp
value: "true"
- name: port
value: "6443"
- name: vip_nodename
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- name: vip_interface
value: eth0
- name: vip_cidr
value: "32"
- name: dns_mode
value: first
- name: cp_enable
value: "true"
- name: cp_namespace
value: kube-system
- name: svc_enable
value: "true"
- name: svc_leasename
value: plndr-svcs-lock
- name: vip_leaderelection
value: "true"
- name: vip_leasename
value: plndr-cp-lock
- name: vip_leaseduration
value: "5"
- name: vip_renewdeadline
value: "3"
- name: vip_retryperiod
value: "1"
- name: address
value: 192.168.154.240
- name: prometheus_server
value: :2112
image: ghcr.io/kube-vip/kube-vip:v0.9.1
imagePullPolicy: IfNotPresent
name: kube-vip
resources: {}
securityContext:
capabilities:
add:
- NET_ADMIN
- NET_RAW
hostNetwork: true
serviceAccountName: kube-vip
tolerations:
- effect: NoSchedule
operator: Exists
- effect: NoExecute
operator: Exists
updateStrategy: {}