diff --git a/kubernetes/apps/downloads/prowlarr/app/helmrelease.yaml b/kubernetes/apps/downloads/prowlarr/app/helmrelease.yaml index 109add93..8d6c4f6d 100644 --- a/kubernetes/apps/downloads/prowlarr/app/helmrelease.yaml +++ b/kubernetes/apps/downloads/prowlarr/app/helmrelease.yaml @@ -99,6 +99,17 @@ spec: app: enabled: true className: internal + annotations: + external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN} + gethomepage.dev/enabled: "true" + gethomepage.dev/group: Downloads + gethomepage.dev/name: Prowlarr + gethomepage.dev/icon: prowlarr.png + gethomepage.dev/description: Torrent/NZB Indexer Management + gethomepage.dev/widget.type: prowlarr + gethomepage.dev/widget.url: http://prowlarr.downloads + gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PROWLARR_TOKEN}}` }}" + nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET} hosts: - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}" paths: @@ -111,26 +122,6 @@ spec: - hosts: - *host secretName: "{{ .Release.Name }}-tls" - # app: - # className: internal - # annotations: - # external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN} - # # gethomepage.dev/enabled: "true" - # # gethomepage.dev/group: Downloads - # # gethomepage.dev/name: Prowlarr - # # gethomepage.dev/icon: prowlarr.png - # # gethomepage.dev/description: Torrent/NZB Indexer Management - # # gethomepage.dev/widget.type: prowlarr - # # gethomepage.dev/widget.url: http://prowlarr.downloads - # # gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PROWLARR_TOKEN}}` }}" - # # nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET} - # hosts: - # - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}" - # paths: - # - path: / - # service: - # identifier: app - # port: http persistence: config: enabled: true diff --git a/kubernetes/apps/downloads/radarr/app/helmrelease.yaml b/kubernetes/apps/downloads/radarr/app/helmrelease.yaml index f2501ec5..4843efe2 100644 --- a/kubernetes/apps/downloads/radarr/app/helmrelease.yaml +++ b/kubernetes/apps/downloads/radarr/app/helmrelease.yaml @@ -97,6 +97,17 @@ spec: app: enabled: true className: internal + annotations: + external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN} + gethomepage.dev/enabled: "true" + gethomepage.dev/group: Downloads + gethomepage.dev/name: Radarr + gethomepage.dev/icon: radarr.png + gethomepage.dev/description: Movie Downloads + gethomepage.dev/widget.type: radarr + gethomepage.dev/widget.url: http://radarr.downloads + gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}" + nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET} hosts: - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}" paths: diff --git a/kubernetes/apps/downloads/sabnzbd/app/helmrelease.yaml b/kubernetes/apps/downloads/sabnzbd/app/helmrelease.yaml index a7a4f6cb..3d5e65ec 100644 --- a/kubernetes/apps/downloads/sabnzbd/app/helmrelease.yaml +++ b/kubernetes/apps/downloads/sabnzbd/app/helmrelease.yaml @@ -90,6 +90,16 @@ spec: app: enabled: true className: internal + annotations: + external-dns.alpha.kubernetes.io/target: "internal.${SECRET_DOMAIN}" + gethomepage.dev/enabled: "true" + gethomepage.dev/group: Downloads + gethomepage.dev/name: SABnzbd + gethomepage.dev/icon: sabnzbd + gethomepage.dev/widget.type: sabnzbd + gethomepage.dev/widget.url: http://sabnzbd.downloads:8080 + gethomepage.dev/widget.key: "{{`{{HOMEPAGE_VAR_SABNZBD_TOKEN}}`}}" + nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET} hosts: - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}" paths: @@ -102,17 +112,6 @@ spec: - hosts: - *host secretName: "{{ .Release.Name }}-tls" - # annotations: - # external-dns.alpha.kubernetes.io/target: "internal.${SECRET_DOMAIN}" - # gethomepage.dev/enabled: "true" - # gethomepage.dev/group: Downloads - # gethomepage.dev/name: SABnzbd - # gethomepage.dev/icon: sabnzbd - # gethomepage.dev/widget.type: sabnzbd - # gethomepage.dev/widget.url: http://sabnzbd.downloads:8080 - # gethomepage.dev/widget.key: "{{`{{HOMEPAGE_VAR_SABNZBD_TOKEN}}`}}" - # nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET} - persistence: config: enabled: true diff --git a/kubernetes/apps/downloads/sonarr/app/helmrelease.yaml b/kubernetes/apps/downloads/sonarr/app/helmrelease.yaml index f521710b..8e08ed90 100644 --- a/kubernetes/apps/downloads/sonarr/app/helmrelease.yaml +++ b/kubernetes/apps/downloads/sonarr/app/helmrelease.yaml @@ -93,17 +93,17 @@ spec: ingress: app: className: internal - # annotations: - # external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN} - # gethomepage.dev/enabled: "true" - # gethomepage.dev/group: Downloads - # gethomepage.dev/name: Sonarr - # gethomepage.dev/icon: sonarr.png - # gethomepage.dev/description: TV Downloads - # gethomepage.dev/widget.type: sonarr - # gethomepage.dev/widget.url: http://sonarr.downloads - # gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_SONARR_TOKEN}}` }}" - # nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET} + annotations: + external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN} + gethomepage.dev/enabled: "true" + gethomepage.dev/group: Downloads + gethomepage.dev/name: Sonarr + gethomepage.dev/icon: sonarr.png + gethomepage.dev/description: TV Downloads + gethomepage.dev/widget.type: sonarr + gethomepage.dev/widget.url: http://sonarr.downloads + gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_SONARR_TOKEN}}` }}" + nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET} hosts: - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}" paths: diff --git a/kubernetes/apps/helpers/homepage/app/externalsecret.yaml b/kubernetes/apps/helpers/homepage/app/externalsecret.yaml new file mode 100644 index 00000000..eb1177a1 --- /dev/null +++ b/kubernetes/apps/helpers/homepage/app/externalsecret.yaml @@ -0,0 +1,55 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: &name prowlarr +spec: + target: + name: *name + deletionPolicy: Delete + template: + type: Opaque + data: + # HOMEPAGE_VAR_LIDARR_TOKEN: "{{ .LIDARR_API_KEY }}" + # HOMEPAGE_VAR_OVERSEERR_TOKEN: "{{ .OVERSEERR_API_KEY }}" + # HOMEPAGE_VAR_PLEX_TOKEN: "{{ .PLEX_TOKEN }}" + HOMEPAGE_VAR_PROWLARR_TOKEN: "{{ .PROWLARR_API_KEY }}" + HOMEPAGE_VAR_RADARR_TOKEN: "{{ .RADARR_API_KEY }}" + # HOMEPAGE_VAR_READARR_TOKEN: "{{ .READARR_API_KEY }}" + HOMEPAGE_VAR_SABNZBD_TOKEN: "{{ .SABNZBD_API_KEY }}" + HOMEPAGE_VAR_SONARR_TOKEN: "{{ .SONARR_API_KEY }}" + # HOMEPAGE_VAR_TAUTULLI_TOKEN: "{{ .TAUTULLI_API_KEY }}" + data: + - secretKey: PROWLARR_API_KEY + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: ae9d8486-9279-4790-ac34-64c8922bb414 + property: password + - secretKey: RADARR_API_KEY + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: 093af32f-2565-4807-9574-6b6a886a4e03 + property: password + - secretKey: SABNZBD_API_KEY + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: f6eb2b25-18a4-4f3f-af8e-38a6ee61787b + property: username + - secretKey: SONARR_API_KEY + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: cccf2793-8f91-47da-be0d-63f08cdeda95 + property: password diff --git a/kubernetes/apps/helpers/homepage/app/helmrelease.yaml b/kubernetes/apps/helpers/homepage/app/helmrelease.yaml new file mode 100644 index 00000000..ca5e6e92 --- /dev/null +++ b/kubernetes/apps/helpers/homepage/app/helmrelease.yaml @@ -0,0 +1,115 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: &app homepage +spec: + interval: 30m + chart: + spec: + chart: app-template + version: 3.5.1 + sourceRef: + kind: HelmRepository + name: bjw-s + namespace: flux-system + install: + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + strategy: rollback + retries: 3 + values: + controllers: + homepage: + annotations: + configmap.reloader.stakater.com/reload: *app + secret.reloader.stakater.com/reload: *app + containers: + app: + image: + repository: ghcr.io/gethomepage/homepage + tag: v0.9.11@sha256:d41dca72f3a68d2c675eb232a448104af200096f05e2610ffbfdb16bc7f71410 + env: + TZ: "${TIMEZONE}" + envFrom: + - secretRef: + name: *app + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: { drop: ["ALL"] } + resources: + requests: + cpu: 10m + memory: 128Mi + limits: + memory: 768Mi + defaultPodOptions: + securityContext: + runAsNonRoot: true + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + fsGroupChangePolicy: OnRootMismatch + seccompProfile: { type: RuntimeDefault } + service: + app: + controller: *app + ports: + http: + port: 3000 + serviceAccount: + create: true + name: *app + ingress: + app: + className: internal + annotations: + external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN} + hosts: + - host: "home.${SECRET_INTERNAL_DOMAIN}" + paths: + - path: / + pathType: Prefix + service: + identifier: app + port: http + persistence: + logs: + type: emptyDir + globalMounts: + - path: /app/config/logs + config: + type: emptyDir + globalMounts: + - path: /app/config + services: + type: secret + name: *app + globalMounts: + - subPath: services.yaml + path: /app/config/services.yaml + readOnly: true + configmap: + type: configMap + name: *app + globalMounts: + - subPath: bookmarks.yaml + path: /app/config/bookmarks.yaml + readOnly: true + - subPath: docker.yaml + path: /app/config/docker.yaml + readOnly: true + - subPath: kubernetes.yaml + path: /app/config/kubernetes.yaml + readOnly: true + - subPath: settings.yaml + path: /app/config/settings.yaml + readOnly: true + - subPath: widgets.yaml + path: /app/config/widgets.yaml + readOnly: true diff --git a/kubernetes/apps/helpers/homepage/app/kustomization.yaml b/kubernetes/apps/helpers/homepage/app/kustomization.yaml new file mode 100644 index 00000000..cba7824a --- /dev/null +++ b/kubernetes/apps/helpers/homepage/app/kustomization.yaml @@ -0,0 +1,19 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./rbac.yaml + - ./externalsecret.yaml + - ./helmrelease.yaml +configMapGenerator: + - name: homepage + files: + - bookmarks.yaml=./resources/bookmarks.yaml + - docker.yaml=./resources/docker.yaml + - kubernetes.yaml=./resources/kubernetes.yaml + - services.yaml=./resources/services.yaml + - settings.yaml=./resources/settings.yaml + - widgets.yaml=./resources/widgets.yaml +generatorOptions: + disableNameSuffixHash: true diff --git a/kubernetes/apps/helpers/homepage/app/rbac.yaml b/kubernetes/apps/helpers/homepage/app/rbac.yaml new file mode 100644 index 00000000..0a552b4a --- /dev/null +++ b/kubernetes/apps/helpers/homepage/app/rbac.yaml @@ -0,0 +1,50 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: homepage +rules: + - apiGroups: + - "" + resources: + - namespaces + - pods + - nodes + verbs: + - get + - list + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses + verbs: + - get + - list + - apiGroups: + - metrics.k8s.io + resources: + - nodes + - pods + verbs: + - get + - list + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: &app homepage +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: homepage +subjects: + - kind: ServiceAccount + name: *app + namespace: default diff --git a/kubernetes/apps/helpers/homepage/ks.yaml b/kubernetes/apps/helpers/homepage/ks.yaml new file mode 100644 index 00000000..04f01197 --- /dev/null +++ b/kubernetes/apps/helpers/homepage/ks.yaml @@ -0,0 +1,26 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app homepage + namespace: flux-system +spec: + targetNamespace: default + commonMetadata: + labels: + app.kubernetes.io/name: *app + dependsOn: + - name: external-secrets + path: ./kubernetes/apps/helpers/homepage/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: false + interval: 30m + retryInterval: 1m + timeout: 5m + postBuild: + substitute: + APP: *app diff --git a/kubernetes/apps/helpers/kustomization.yaml b/kubernetes/apps/helpers/kustomization.yaml new file mode 100644 index 00000000..68e2d2e9 --- /dev/null +++ b/kubernetes/apps/helpers/kustomization.yaml @@ -0,0 +1,8 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./namespace.yaml + - ./homepage/ks.yaml + - ./theme-park/ks.yaml diff --git a/kubernetes/apps/helpers/namespace.yaml b/kubernetes/apps/helpers/namespace.yaml new file mode 100644 index 00000000..f05fc2ad --- /dev/null +++ b/kubernetes/apps/helpers/namespace.yaml @@ -0,0 +1,8 @@ +--- +# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json +apiVersion: v1 +kind: Namespace +metadata: + name: default + labels: + kustomize.toolkit.fluxcd.io/prune: disabled diff --git a/kubernetes/apps/helpers/theme-park/app/helmrelease.yaml b/kubernetes/apps/helpers/theme-park/app/helmrelease.yaml new file mode 100644 index 00000000..3cd2b606 --- /dev/null +++ b/kubernetes/apps/helpers/theme-park/app/helmrelease.yaml @@ -0,0 +1,73 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: &app theme-park +spec: + interval: 30m + chart: + spec: + chart: app-template + version: 3.5.1 + sourceRef: + kind: HelmRepository + name: bjw-s + namespace: flux-system + install: + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + strategy: rollback + retries: 3 + values: + controllers: + theme-park: + replicas: 2 + strategy: RollingUpdate + containers: + app: + image: + repository: ghcr.io/onedr0p/theme-park + tag: 1.18.0@sha256:210d8f5d9466df493503184fb076bbf1fb9fbc2b42e273cd4516ac3fd1df7ba2 + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + memory: 64Mi + defaultPodOptions: + securityContext: + runAsNonRoot: true + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + fsGroupChangePolicy: OnRootMismatch + seccompProfile: { type: RuntimeDefault } + service: + app: + controller: *app + ports: + http: + port: 8080 + ingress: + app: + className: internal + # annotations: + # external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN} + hosts: + - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}" + paths: + - path: / + service: + identifier: app + port: http + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + app.kubernetes.io/name: *app diff --git a/kubernetes/apps/helpers/theme-park/app/kustomization.yaml b/kubernetes/apps/helpers/theme-park/app/kustomization.yaml new file mode 100644 index 00000000..17cbc72b --- /dev/null +++ b/kubernetes/apps/helpers/theme-park/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./helmrelease.yaml diff --git a/kubernetes/apps/helpers/theme-park/ks.yaml b/kubernetes/apps/helpers/theme-park/ks.yaml new file mode 100644 index 00000000..5da6a62f --- /dev/null +++ b/kubernetes/apps/helpers/theme-park/ks.yaml @@ -0,0 +1,24 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app theme-park + namespace: flux-system +spec: + targetNamespace: default + commonMetadata: + labels: + app.kubernetes.io/name: *app + path: ./kubernetes/apps/helpers/theme-park/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: false + interval: 30m + retryInterval: 1m + timeout: 5m + postBuild: + substitute: + APP: *app