Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Renovate Bot
|
be5de643d0 |
No files matched your search
@@ -35,7 +35,7 @@ jobs:
|
||||
path: default
|
||||
|
||||
- name: Diff Resources
|
||||
uses: docker://ghcr.io/allenporter/flux-local:v6.0.2
|
||||
uses: docker://ghcr.io/allenporter/flux-local:v6.0.1
|
||||
with:
|
||||
args: >-
|
||||
diff ${{ matrix.resources }}
|
||||
|
||||
@@ -10,7 +10,7 @@ on:
|
||||
jobs:
|
||||
renovate:
|
||||
runs-on: ubuntu-latest
|
||||
container: ghcr.io/renovatebot/renovate:39.57.1
|
||||
container: ghcr.io/renovatebot/renovate:37.440.7
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- run: renovate
|
||||
|
||||
@@ -8,7 +8,7 @@ spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: coredns
|
||||
version: 1.36.1
|
||||
version: 1.36.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: coredns
|
||||
|
||||
@@ -30,7 +30,7 @@ spec:
|
||||
app:
|
||||
image:
|
||||
repository: docker.io/cloudflare/cloudflared
|
||||
tag: 2024.11.1
|
||||
tag: 2024.10.1
|
||||
env:
|
||||
NO_AUTOUPDATE: true
|
||||
TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
|
||||
|
||||
+1
-1
@@ -8,7 +8,7 @@ spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: ingress-nginx
|
||||
version: 4.11.3
|
||||
version: 4.11.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: ingress-nginx
|
||||
|
||||
+1
-1
@@ -9,7 +9,7 @@ spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: ingress-nginx
|
||||
version: 4.11.3
|
||||
version: 4.11.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: ingress-nginx
|
||||
|
||||
@@ -30,7 +30,7 @@ releases:
|
||||
- name: coredns
|
||||
namespace: kube-system
|
||||
chart: coredns/coredns
|
||||
version: 1.36.1
|
||||
version: 1.36.0
|
||||
values:
|
||||
- ../apps/kube-system/coredns/app/helm-values.yaml
|
||||
needs:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
|
||||
---
|
||||
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
|
||||
talosVersion: v1.8.4
|
||||
talosVersion: v1.8.1
|
||||
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
|
||||
kubernetesVersion: v1.31.2
|
||||
|
||||
|
||||
@@ -12,7 +12,7 @@ spec:
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
name: bjw-s-charts
|
||||
namespace: flux-system
|
||||
install:
|
||||
createNamespace: true
|
||||
@@ -42,16 +42,11 @@ spec:
|
||||
repository: ghcr.io/gimlet-io/capacitor
|
||||
tag: v0.4.8@sha256:a80207f52c054dba9e04e8b1ea86e297817ecf05ddbfce249c1f5eaf6ce8c7d8
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 100
|
||||
runAsGroup: 101
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
readOnlyRootFilesystem: true
|
||||
|
||||
probes:
|
||||
startup:
|
||||
@@ -93,9 +88,9 @@ spec:
|
||||
ingress:
|
||||
app:
|
||||
enabled: true
|
||||
className: internal
|
||||
className: ingress-internal
|
||||
hosts:
|
||||
- host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
|
||||
- host: &host "{{ .Release.Name }}.k8s.home.arpa"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
|
||||
@@ -1,50 +1,48 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: capacitor
|
||||
namespace: flux-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: capacitor
|
||||
rules:
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
- apps
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- pods/log
|
||||
- ingresses
|
||||
- deployments
|
||||
- services
|
||||
- secrets
|
||||
- events
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
- apiGroups:
|
||||
- source.toolkit.fluxcd.io
|
||||
- kustomize.toolkit.fluxcd.io
|
||||
- helm.toolkit.fluxcd.io
|
||||
- infra.contrib.fluxcd.io
|
||||
resources:
|
||||
- gitrepositories
|
||||
- ocirepositories
|
||||
- buckets
|
||||
- helmrepositories
|
||||
- helmcharts
|
||||
- kustomizations
|
||||
- helmreleases
|
||||
- terraforms
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
- patch # to allow force reconciling by adding an annotation
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
- apps
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- pods/log
|
||||
- ingresses
|
||||
- deployments
|
||||
- services
|
||||
- secrets
|
||||
- events
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
- apiGroups:
|
||||
- source.toolkit.fluxcd.io
|
||||
- kustomize.toolkit.fluxcd.io
|
||||
- helm.toolkit.fluxcd.io
|
||||
resources:
|
||||
- gitrepositories
|
||||
- ocirepositories
|
||||
- buckets
|
||||
- helmrepositories
|
||||
- helmcharts
|
||||
- kustomizations
|
||||
- helmreleases
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
- patch # to allow force reconciling by adding an annotation
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/certificate_v1.json
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: &name home-selfsigned-ca
|
||||
spec:
|
||||
isCA: true
|
||||
commonName: *name
|
||||
subject:
|
||||
organizations:
|
||||
- ${SECRET_DOMAIN}
|
||||
secretName: root-secret
|
||||
privateKey:
|
||||
algorithm: ECDSA
|
||||
size: 256
|
||||
issuerRef:
|
||||
name: selfsigned-issuer
|
||||
kind: ClusterIssuer
|
||||
group: cert-manager.io
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: &name strong-selfsigned-ca
|
||||
spec:
|
||||
isCA: true
|
||||
commonName: *name
|
||||
subject:
|
||||
organizations:
|
||||
- ${SECRET_DOMAIN}
|
||||
secretName: strong-root-secret
|
||||
privateKey:
|
||||
algorithm: ECDSA
|
||||
size: 384
|
||||
issuerRef:
|
||||
name: selfsigned-issuer
|
||||
kind: ClusterIssuer
|
||||
group: cert-manager.io
|
||||
@@ -1,28 +1,5 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: selfsigned-issuer
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: home-selfsigned-ca
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
isCA: true
|
||||
commonName: home-selfsigned-ca
|
||||
secretName: root-secret
|
||||
privateKey:
|
||||
algorithm: ECDSA
|
||||
size: 256
|
||||
issuerRef:
|
||||
name: selfsigned-issuer
|
||||
kind: ClusterIssuer
|
||||
group: cert-manager.io
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/clusterissuer_v1.json
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
@@ -30,3 +7,11 @@ metadata:
|
||||
spec:
|
||||
ca:
|
||||
secretName: root-secret
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: strong-ca-issuer
|
||||
spec:
|
||||
ca:
|
||||
secretName: strong-root-secret
|
||||
@@ -3,4 +3,5 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./certificate.yaml
|
||||
- ./clusterissuer.yaml
|
||||
@@ -1,32 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cloudnative-pg
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
# renovate: registryUrl=https://cloudnative-pg.github.io/charts
|
||||
chart: cloudnative-pg
|
||||
version: 0.22.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cloudnative-pg
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
values:
|
||||
crds:
|
||||
create: true
|
||||
monitoring:
|
||||
podMonitorEnabled: false
|
||||
grafanaDashboard:
|
||||
create: true
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -1,89 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/postgresql.cnpg.io/cluster_v1.json
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: postgres
|
||||
namespace: databases
|
||||
spec:
|
||||
instances: 3
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:16.5-1
|
||||
primaryUpdateStrategy: unsupervised
|
||||
storage:
|
||||
size: 20Gi
|
||||
storageClass: nfs-provision-csi-database
|
||||
superuserSecret:
|
||||
name: cloudnative-pg
|
||||
enableSuperuserAccess: true
|
||||
postgresql:
|
||||
parameters:
|
||||
max_connections: "600"
|
||||
max_slot_wal_keep_size: 10GB
|
||||
shared_buffers: 512MB
|
||||
nodeMaintenanceWindow:
|
||||
inProgress: false
|
||||
reusePVC: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 2Gi
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 4Gi
|
||||
monitoring:
|
||||
enablePodMonitor: true
|
||||
# backup:
|
||||
# retentionPolicy: 30d
|
||||
# barmanObjectStore: &barmanObjectStore
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# wal:
|
||||
# compression: bzip2
|
||||
# maxParallel: 8
|
||||
# destinationPath: "s3://cloudnative-pg-v1"
|
||||
# endpointURL: "https://${SECRET_QNAP_HOSTNAME}:8010"
|
||||
# # Note: serverName version needs to be incremented or changed
|
||||
# # when recovering from an existing cnpg cluster
|
||||
# serverName: ¤tCluster postgres-v2
|
||||
# s3Credentials:
|
||||
# accessKeyId:
|
||||
# name: cloudnative-pg
|
||||
# key: s3-key-id
|
||||
# secretAccessKey:
|
||||
# name: cloudnative-pg
|
||||
# key: s3-secret-key
|
||||
# # Note: externalClusters is needed when recovering from an existing cnpg cluster
|
||||
# externalClusters:
|
||||
# # s3 instance recovery
|
||||
# - name: &previousCluster postgres-v1
|
||||
# barmanObjectStore:
|
||||
# <<: *barmanObjectStore
|
||||
# serverName: *previousCluster
|
||||
# running instance
|
||||
#- name: postgres
|
||||
# connectionParameters:
|
||||
# host: 10.1.0.23
|
||||
# user: postgres
|
||||
# dbname: postgres
|
||||
# sslmode: require
|
||||
# password:
|
||||
# name: cloudnative-pg
|
||||
# key: password
|
||||
|
||||
# Note: previousCluster needs to be set to the name of the previous
|
||||
# cluster when recovering from an existing cnpg cluster
|
||||
bootstrap:
|
||||
# # s3 instance recovery
|
||||
# recovery:
|
||||
# source: *previousCluster
|
||||
# recover from another running instance
|
||||
initdb:
|
||||
database: homeops
|
||||
# import:
|
||||
# type: monolith
|
||||
# databases:
|
||||
# - "*"
|
||||
# roles:
|
||||
# - "*"
|
||||
# source:
|
||||
# externalCluster: postgres
|
||||
@@ -1,32 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: &name cloudnative-pg
|
||||
spec:
|
||||
target:
|
||||
name: *name
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
username: "{{ .username }}"
|
||||
password: "{{ .password }}"
|
||||
data:
|
||||
- secretKey: username
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretKey 88217883-df53-4c96-aad7-f3b2142382de
|
||||
property: username
|
||||
- secretKey: password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: *secretKey
|
||||
property: password
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./externalsecret.yaml
|
||||
- ./cluster.yaml
|
||||
# - ./gatus.yaml
|
||||
- ./prometheusrule.yaml
|
||||
- ./scheduledbackup.yaml
|
||||
- ./service.yaml
|
||||
@@ -1,67 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/monitoring.coreos.com/prometheusrule_v1.json
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: cloudnative-pg-rules
|
||||
labels:
|
||||
prometheus: k8s
|
||||
role: alert-rules
|
||||
spec:
|
||||
groups:
|
||||
- name: cloudnative-pg.rules
|
||||
rules:
|
||||
- alert: LongRunningTransaction
|
||||
annotations:
|
||||
description: Pod {{ $labels.pod }} is taking more than 5 minutes (300 seconds) for a query.
|
||||
summary: A query is taking longer than 5 minutes.
|
||||
expr: |-
|
||||
cnpg_backends_max_tx_duration_seconds > 300
|
||||
for: 1m
|
||||
labels:
|
||||
severity: warning
|
||||
- alert: BackendsWaiting
|
||||
annotations:
|
||||
description: Pod {{ $labels.pod }} has been waiting for longer than 5 minutes
|
||||
summary: If a backend is waiting for longer than 5 minutes
|
||||
expr: |-
|
||||
cnpg_backends_waiting_total > 300
|
||||
for: 1m
|
||||
labels:
|
||||
severity: warning
|
||||
- alert: PGDatabase
|
||||
annotations:
|
||||
description: Over 150,000,000 transactions from frozen xid on pod {{ $labels.pod }}
|
||||
summary: Number of transactions from the frozen XID to the current one
|
||||
expr: |-
|
||||
cnpg_pg_database_xid_age > 150000000
|
||||
for: 1m
|
||||
labels:
|
||||
severity: warning
|
||||
- alert: PGReplication
|
||||
annotations:
|
||||
description: Standby is lagging behind by over 300 seconds (5 minutes)
|
||||
summary: The standby is lagging behind the primary
|
||||
expr: |-
|
||||
cnpg_pg_replication_lag > 300
|
||||
for: 1m
|
||||
labels:
|
||||
severity: warning
|
||||
- alert: LastFailedArchiveTime
|
||||
annotations:
|
||||
description: Archiving failed for {{ $labels.pod }}
|
||||
summary: Checks the last time archiving failed. Will be < 0 when it has not failed.
|
||||
expr: |-
|
||||
(cnpg_pg_stat_archiver_last_failed_time - cnpg_pg_stat_archiver_last_archived_time) > 1
|
||||
for: 1m
|
||||
labels:
|
||||
severity: warning
|
||||
- alert: DatabaseDeadlockConflicts
|
||||
annotations:
|
||||
description: There are over 10 deadlock conflicts in {{ $labels.pod }}
|
||||
summary: Checks the number of database conflicts
|
||||
expr: |-
|
||||
cnpg_pg_stat_database_deadlocks > 10
|
||||
for: 1m
|
||||
labels:
|
||||
severity: warning
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/postgresql.cnpg.io/scheduledbackup_v1.json
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: ScheduledBackup
|
||||
metadata:
|
||||
name: postgres
|
||||
spec:
|
||||
schedule: "@daily"
|
||||
immediate: true
|
||||
backupOwnerReference: self
|
||||
cluster:
|
||||
name: postgres
|
||||
@@ -1,19 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/service-v1.json
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: postgres-lb
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: postgres.${SECRET_INTERNAL_DOMAIN}
|
||||
io.cilium/lb-ipam-ips: "${SVC_POSTGRES_ADDR}"
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
- name: postgres
|
||||
port: 5432
|
||||
protocol: TCP
|
||||
targetPort: 5432
|
||||
selector:
|
||||
cnpg.io/cluster: postgres
|
||||
role: primary
|
||||
@@ -1,47 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app cloudnative-pg
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: databases
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
dependsOn:
|
||||
- name: external-secrets
|
||||
- name: openebs
|
||||
path: ./kubernetes/apps/databases/cloudnative-pg/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app cloudnative-pg-cluster
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: databases
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
dependsOn:
|
||||
- name: cloudnative-pg
|
||||
path: ./kubernetes/apps/databases/cloudnative-pg/cluster
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./cloudnative-pg/ks.yaml
|
||||
- ./redis/ks.yaml
|
||||
@@ -1,38 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: databases
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
# ---
|
||||
# # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
|
||||
# apiVersion: notification.toolkit.fluxcd.io/v1beta3
|
||||
# kind: Provider
|
||||
# metadata:
|
||||
# name: alert-manager
|
||||
# namespace: databases
|
||||
# spec:
|
||||
# type: alertmanager
|
||||
# address: http://alertmanager-operated.observability.svc.cluster.local:9093/api/v2/alerts/
|
||||
# ---
|
||||
# # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/alert_v1beta3.json
|
||||
# apiVersion: notification.toolkit.fluxcd.io/v1beta3
|
||||
# kind: Alert
|
||||
# metadata:
|
||||
# name: alert-manager
|
||||
# namespace: databases
|
||||
# spec:
|
||||
# providerRef:
|
||||
# name: alert-manager
|
||||
# eventSeverity: error
|
||||
# eventSources:
|
||||
# - kind: HelmRelease
|
||||
# name: "*"
|
||||
# exclusionList:
|
||||
# - "error.*lookup github\\.com"
|
||||
# - "error.*lookup raw\\.githubusercontent\\.com"
|
||||
# - "dial.*tcp.*timeout"
|
||||
# - "waiting.*socket"
|
||||
# suspend: false
|
||||
@@ -1,47 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app redis
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: *app
|
||||
version: 20.4.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bitnami
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
values:
|
||||
auth:
|
||||
enabled: false
|
||||
sentinel: false
|
||||
master:
|
||||
persistence:
|
||||
enabled: false
|
||||
replica:
|
||||
persistence:
|
||||
enabled: false
|
||||
sentinel:
|
||||
enabled: true
|
||||
masterSet: redis-master
|
||||
getMasterTimeout: 10
|
||||
startupProbe:
|
||||
failureThreshold: 2
|
||||
persistence:
|
||||
enabled: false
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
interval: 1m
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: databases
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app redis
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: databases
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
path: ./kubernetes/apps/databases/redis/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../../../templates/csi-driver-nfs/claims/cifs-appdata.yaml
|
||||
# - ../../../templates/csi-driver-nfs/claims/cifs-books.yaml
|
||||
- ../../../templates/csi-driver-nfs/claims/cifs-downloads.yaml
|
||||
# - ../../../templates/csi-driver-nfs/claims/cifs-games.yaml
|
||||
# - ../../../templates/csi-driver-nfs/claims/cifs-misc.yaml
|
||||
- ../../../templates/csi-driver-nfs/claims/cifs-movies.yaml
|
||||
# - ../../../templates/csi-driver-nfs/claims/cifs-music.yaml
|
||||
- ../../../templates/csi-driver-nfs/claims/cifs-tv.yaml
|
||||
@@ -1,23 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app downloads-cifs-pvcs
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: downloads
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
dependsOn:
|
||||
- name: csi-driver-nfs
|
||||
path: ./kubernetes/apps/downloads/cifs-pvcs
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -1,21 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./ks.yaml
|
||||
# - ./flaresolverr/ks.yaml
|
||||
# - ./flood/ks.yaml
|
||||
# - ./lidarr/ks.yaml
|
||||
- ./prowlarr/ks.yaml
|
||||
- ./radarr/ks.yaml
|
||||
- ./sabnzbd/ks.yaml
|
||||
- ./sonarr/ks.yaml
|
||||
# configMapGenerator:
|
||||
# - name: authelia-ingress-hv
|
||||
# namespace: downloads
|
||||
# files:
|
||||
# - values.yaml=../security/authelia/app/resources/authelia-ingress-hv.yaml
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: downloads
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
vpn-routed-gateway: "true"
|
||||
annotations:
|
||||
volsync.backube/privileged-movers: "true"
|
||||
@@ -1,67 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: &name prowlarr
|
||||
spec:
|
||||
target:
|
||||
name: *name
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
# App
|
||||
PROWLARR__AUTH__APIKEY: "{{ .PROWLARR_API_KEY }}"
|
||||
PROWLARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
|
||||
PROWLARR__POSTGRES__PORT: "5432"
|
||||
PROWLARR__POSTGRES__USER: &dbUser "{{ .PROWLARR_POSTGRES_USER }}"
|
||||
PROWLARR__POSTGRES__PASSWORD: &dbPass "{{ .PROWLARR_POSTGRES_PASSWORD }}"
|
||||
PROWLARR__POSTGRES__MAINDB: &dbName prowlarr_main
|
||||
# Postgres Init
|
||||
INIT_POSTGRES_DBNAME: *dbName
|
||||
INIT_POSTGRES_HOST: *dbHost
|
||||
INIT_POSTGRES_USER: *dbUser
|
||||
INIT_POSTGRES_PASS: *dbPass
|
||||
INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
|
||||
data:
|
||||
- secretKey: PROWLARR_API_KEY
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretApiKey ae9d8486-9279-4790-ac34-64c8922bb414
|
||||
property: password
|
||||
- secretKey: PROWLARR_POSTGRES_USER
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretDatabaseKey bce2ff77-66cd-47bd-a9e7-160c2d3bb616
|
||||
property: username
|
||||
- secretKey: PROWLARR_POSTGRES_PASSWORD
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: *secretDatabaseKey
|
||||
property: password
|
||||
- secretKey: POSTGRES_ADMIN_USER
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
|
||||
property: username
|
||||
- secretKey: POSTGRES_ADMIN_PASS
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: *secretAdminDatabaseKey
|
||||
property: password
|
||||
@@ -1,132 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app prowlarr
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
# valuesFrom:
|
||||
# - kind: ConfigMap
|
||||
# name: authelia-ingress-hv
|
||||
values:
|
||||
controllers:
|
||||
prowlarr:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
initContainers:
|
||||
init-db:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/postgres-init
|
||||
tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
|
||||
envFrom: &envFrom
|
||||
- secretRef:
|
||||
name: *app
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/prowlarr-develop
|
||||
tag: rolling@sha256:155e7c757880e6afc5933b3060dfaec1c79712caf68031096fd5866ae4a31d0f
|
||||
env:
|
||||
TZ: "${TIMEZONE}"
|
||||
PROWLARR__APP__INSTANCENAME: Prowlarr
|
||||
PROWLARR__APP__THEME: dark
|
||||
PROWLARR__AUTH__METHOD: External
|
||||
PROWLARR__AUTH__REQUIRED: DisabledForLocalAddresses
|
||||
PROWLARR__LOG__DBENABLED: "False"
|
||||
PROWLARR__LOG__LEVEL: info
|
||||
PROWLARR__SERVER__PORT: &port 80
|
||||
PROWLARR__UPDATE__BRANCH: develop
|
||||
envFrom: *envFrom
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: *port
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 5
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: { drop: [ "ALL" ] }
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
defaultPodOptions:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: { type: RuntimeDefault }
|
||||
service:
|
||||
app:
|
||||
controller: *app
|
||||
ports:
|
||||
http:
|
||||
port: *port
|
||||
ingress:
|
||||
app:
|
||||
enabled: true
|
||||
className: internal
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
|
||||
gethomepage.dev/enabled: "true"
|
||||
gethomepage.dev/group: Downloads
|
||||
gethomepage.dev/name: Prowlarr
|
||||
gethomepage.dev/icon: prowlarr.png
|
||||
gethomepage.dev/description: Torrent/NZB Indexer Management
|
||||
gethomepage.dev/widget.type: prowlarr
|
||||
gethomepage.dev/widget.url: http://prowlarr.downloads
|
||||
gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PROWLARR_TOKEN}}` }}"
|
||||
nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
|
||||
hosts:
|
||||
- host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
service:
|
||||
identifier: app
|
||||
port: http
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
secretName: "{{ .Release.Name }}-tls"
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/k3s/config/prowlarr
|
||||
tmp:
|
||||
type: emptyDir
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./externalsecret.yaml
|
||||
- ./helmrelease.yaml
|
||||
# - ../../../../templates/gatus/guarded
|
||||
@@ -1,27 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app prowlarr
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: downloads
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
dependsOn:
|
||||
- name: cloudnative-pg-cluster
|
||||
- name: downloads-cifs-pvcs
|
||||
path: ./kubernetes/apps/downloads/prowlarr/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -1,67 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: &name radarr
|
||||
spec:
|
||||
target:
|
||||
name: *name
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
# App
|
||||
RADARR__AUTH__APIKEY: "{{ .RADARR_API_KEY }}"
|
||||
RADARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
|
||||
RADARR__POSTGRES__PORT: "5432"
|
||||
RADARR__POSTGRES__USER: &dbUser "{{ .RADARR_POSTGRES_USER }}"
|
||||
RADARR__POSTGRES__PASSWORD: &dbPass "{{ .RADARR_POSTGRES_PASSWORD }}"
|
||||
RADARR__POSTGRES__MAINDB: &dbName radarr_main
|
||||
# Postgres Init
|
||||
INIT_POSTGRES_DBNAME: *dbName
|
||||
INIT_POSTGRES_HOST: *dbHost
|
||||
INIT_POSTGRES_USER: *dbUser
|
||||
INIT_POSTGRES_PASS: *dbPass
|
||||
INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
|
||||
data:
|
||||
- secretKey: RADARR_API_KEY
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretApiKey 093af32f-2565-4807-9574-6b6a886a4e03
|
||||
property: password
|
||||
- secretKey: RADARR_POSTGRES_USER
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretDatabaseKey b99de2a6-f2b4-42c5-8852-87038e6c48fe
|
||||
property: username
|
||||
- secretKey: RADARR_POSTGRES_PASSWORD
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: *secretDatabaseKey
|
||||
property: password
|
||||
- secretKey: POSTGRES_ADMIN_USER
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
|
||||
property: username
|
||||
- secretKey: POSTGRES_ADMIN_PASS
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: *secretAdminDatabaseKey
|
||||
property: password
|
||||
@@ -1,168 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app radarr
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
# valuesFrom:
|
||||
# - kind: ConfigMap
|
||||
# name: authelia-ingress-hv
|
||||
values:
|
||||
controllers:
|
||||
radarr:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
initContainers:
|
||||
init-db:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/postgres-init
|
||||
tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
|
||||
envFrom: &envFrom
|
||||
- secretRef:
|
||||
name: *app
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/radarr-develop
|
||||
tag: rolling@sha256:f21d401a2ce6ebf5401c4dc71e3184ece740fff227a6af0ffa1a51fe4af7627c
|
||||
env:
|
||||
TZ: "${TIMEZONE}"
|
||||
RADARR__APP__INSTANCENAME: Radarr
|
||||
RADARR__APP__THEME: dark
|
||||
RADARR__AUTH__METHOD: External
|
||||
RADARR__AUTH__REQUIRED: DisabledForLocalAddresses
|
||||
RADARR__LOG__DBENABLED: "False"
|
||||
RADARR__LOG__LEVEL: info
|
||||
RADARR__SERVER__PORT: &port 80
|
||||
RADARR__UPDATE__BRANCH: develop
|
||||
envFrom: *envFrom
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: *port
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 5
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: { drop: ["ALL"] }
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 256M
|
||||
limits:
|
||||
memory: 4Gi
|
||||
defaultPodOptions:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: { type: RuntimeDefault }
|
||||
service:
|
||||
app:
|
||||
controller: *app
|
||||
ports:
|
||||
http:
|
||||
port: *port
|
||||
ingress:
|
||||
app:
|
||||
enabled: true
|
||||
className: internal
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
|
||||
gethomepage.dev/enabled: "true"
|
||||
gethomepage.dev/group: Downloads
|
||||
gethomepage.dev/name: Radarr
|
||||
gethomepage.dev/icon: radarr.png
|
||||
gethomepage.dev/description: Movie Downloads
|
||||
gethomepage.dev/widget.type: radarr
|
||||
gethomepage.dev/widget.url: http://radarr.downloads
|
||||
gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}"
|
||||
nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
|
||||
hosts:
|
||||
- host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
service:
|
||||
identifier: app
|
||||
port: http
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
secretName: "{{ .Release.Name }}-tls"
|
||||
# app:
|
||||
# enabled: true
|
||||
# className: internal
|
||||
# annotations:
|
||||
# external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
|
||||
# # gethomepage.dev/enabled: "true"
|
||||
# # gethomepage.dev/group: Downloads
|
||||
# # gethomepage.dev/name: Radarr
|
||||
# # gethomepage.dev/icon: radarr.png
|
||||
# # gethomepage.dev/description: Movie Downloads
|
||||
# # gethomepage.dev/widget.type: radarr
|
||||
# # gethomepage.dev/widget.url: http://radarr.downloads
|
||||
# # gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}"
|
||||
# # nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
|
||||
# hosts:
|
||||
# - host: &host "{{ .Release.Name }}.k8s.home.arpa"
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
# service:
|
||||
# identifier: app
|
||||
# port: http
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/k3s/config/radarr
|
||||
tmp:
|
||||
type: emptyDir
|
||||
media:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/movies
|
||||
downloads:
|
||||
existingClaim: cifs-downloads
|
||||
advancedMounts:
|
||||
radarr:
|
||||
app:
|
||||
- path: /downloads/downloaded_movies
|
||||
readOnly: false
|
||||
subPath: sabnzbd/downloaded_movies
|
||||
- path: /downloads/movies-radarr
|
||||
readOnly: false
|
||||
subPath: flood/movies-radarr
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
# - ../../../../templates/volsync
|
||||
- ./externalsecret.yaml
|
||||
- ./helmrelease.yaml
|
||||
# - ../../../../templates/gatus/guarded
|
||||
@@ -1,27 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app radarr
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: downloads
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
dependsOn:
|
||||
- name: cloudnative-pg-cluster
|
||||
- name: downloads-cifs-pvcs
|
||||
path: ./kubernetes/apps/downloads/radarr/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -1,32 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: &name sabnzbd
|
||||
spec:
|
||||
target:
|
||||
name: *name
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
SABNZBD__API_KEY: "{{ .SABNZBD_API_KEY }}"
|
||||
SABNZBD__NZB_KEY: "{{ .SABNZBD_NZB_KEY }}"
|
||||
data:
|
||||
- secretKey: SABNZBD_API_KEY
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretDatabaseKey f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
|
||||
property: username
|
||||
- secretKey: SABNZBD_NZB_KEY
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: *secretDatabaseKey
|
||||
property: password
|
||||
@@ -1,141 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app sabnzbd
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
# valuesFrom:
|
||||
# - kind: ConfigMap
|
||||
# name: authelia-ingress-hv
|
||||
values:
|
||||
controllers:
|
||||
sabnzbd:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/sabnzbd
|
||||
tag: rolling@sha256:86c645db93affcbf01cc2bce2560082bfde791009e1506dba68269b9c50bc341
|
||||
env:
|
||||
TZ: "America/Denver"
|
||||
SABNZBD__PORT: &port 8080
|
||||
SABNZBD__HOST_WHITELIST_ENTRIES: >-
|
||||
sabnzbd,
|
||||
sabnzbd.downloads,
|
||||
sabnzbd.downloads.svc,
|
||||
sabnzbd.downloads.svc.cluster,
|
||||
sabnzbd.downloads.svc.cluster.local,
|
||||
sabnzbd.${SECRET_INTERNAL_DOMAIN}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: *app
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /api?mode=version
|
||||
port: *port
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 1Gi
|
||||
limits:
|
||||
memory: 4Gi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: { drop: ["ALL"] }
|
||||
defaultPodOptions:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
seccompProfile: { type: RuntimeDefault }
|
||||
service:
|
||||
app:
|
||||
controller: *app
|
||||
ports:
|
||||
http:
|
||||
port: *port
|
||||
ingress:
|
||||
app:
|
||||
enabled: true
|
||||
className: internal
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: "internal.${SECRET_DOMAIN}"
|
||||
gethomepage.dev/enabled: "true"
|
||||
gethomepage.dev/group: Downloads
|
||||
gethomepage.dev/name: SABnzbd
|
||||
gethomepage.dev/icon: sabnzbd
|
||||
gethomepage.dev/widget.type: sabnzbd
|
||||
gethomepage.dev/widget.url: http://sabnzbd.downloads:8080
|
||||
gethomepage.dev/widget.key: "{{`{{HOMEPAGE_VAR_SABNZBD_TOKEN}}`}}"
|
||||
nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
|
||||
hosts:
|
||||
- host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
service:
|
||||
identifier: app
|
||||
port: http
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
secretName: "{{ .Release.Name }}-tls"
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/k3s/config/sabnzbd
|
||||
tmp:
|
||||
type: emptyDir
|
||||
incomplete:
|
||||
type: emptyDir
|
||||
applications:
|
||||
existingClaim: cifs-appdata
|
||||
globalMounts:
|
||||
- path: /media/applications
|
||||
downloads:
|
||||
existingClaim: cifs-downloads
|
||||
globalMounts:
|
||||
- path: /downloads
|
||||
subPath: sabnzbd
|
||||
# games:
|
||||
# existingClaim: cifs-games
|
||||
# globalMounts:
|
||||
# - path: /media/games
|
||||
# misc:
|
||||
# existingClaim: cifs-misc
|
||||
# globalMounts:
|
||||
# - path: /media/misc
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
# - ../../../../templates/volsync
|
||||
- ./externalsecret.yaml
|
||||
- ./helmrelease.yaml
|
||||
# - ../../../../templates/gatus/guarded
|
||||
@@ -1,27 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app sabnzbd
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: downloads
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
dependsOn:
|
||||
- name: external-secrets
|
||||
- name: downloads-cifs-pvcs
|
||||
path: ./kubernetes/apps/downloads/sabnzbd/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -1,67 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: &name sonarr
|
||||
spec:
|
||||
target:
|
||||
name: *name
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
# App
|
||||
SONARR__AUTH__APIKEY: "{{ .SONARR_API_KEY }}"
|
||||
SONARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
|
||||
SONARR__POSTGRES__PORT: "5432"
|
||||
SONARR__POSTGRES__USER: &dbUser "{{ .SONARR_POSTGRES_USER }}"
|
||||
SONARR__POSTGRES__PASSWORD: &dbPass "{{ .SONARR_POSTGRES_PASSWORD }}"
|
||||
SONARR__POSTGRES__MAINDB: &dbName sonarr_main
|
||||
# Postgres Init
|
||||
INIT_POSTGRES_DBNAME: *dbName
|
||||
INIT_POSTGRES_HOST: *dbHost
|
||||
INIT_POSTGRES_USER: *dbUser
|
||||
INIT_POSTGRES_PASS: *dbPass
|
||||
INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
|
||||
data:
|
||||
- secretKey: SONARR_API_KEY
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretApiKey cccf2793-8f91-47da-be0d-63f08cdeda95
|
||||
property: password
|
||||
- secretKey: SONARR_POSTGRES_USER
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretDatabaseKey 6fbd4e66-0750-4dea-94b6-b5eb25c77c44
|
||||
property: username
|
||||
- secretKey: SONARR_POSTGRES_PASSWORD
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: *secretDatabaseKey
|
||||
property: password
|
||||
- secretKey: POSTGRES_ADMIN_USER
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
|
||||
property: username
|
||||
- secretKey: POSTGRES_ADMIN_PASS
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: *secretAdminDatabaseKey
|
||||
property: password
|
||||
@@ -1,141 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app sonarr
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
values:
|
||||
controllers:
|
||||
sonarr:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
initContainers:
|
||||
init-db:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/postgres-init
|
||||
tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
|
||||
envFrom: &envFrom
|
||||
- secretRef:
|
||||
name: *app
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/sonarr-develop
|
||||
tag: rolling@sha256:371517bc99a5c755bea0c73e8e9fcd23ae436a593fb4a116368947c9c9182977
|
||||
env:
|
||||
TZ: "${TIMEZONE}"
|
||||
SONARR__APP__INSTANCENAME: Sonarr
|
||||
SONARR__APP__THEME: dark
|
||||
SONARR__AUTH__METHOD: External
|
||||
SONARR__AUTH__REQUIRED: DisabledForLocalAddresses
|
||||
SONARR__LOG__DBENABLED: "False"
|
||||
SONARR__LOG__LEVEL: info
|
||||
SONARR__SERVER__PORT: &port 80
|
||||
SONARR__UPDATE__BRANCH: develop
|
||||
envFrom: *envFrom
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: *port
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 5
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: { drop: ["ALL"] }
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
memory: 4Gi
|
||||
defaultPodOptions:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: { type: RuntimeDefault }
|
||||
service:
|
||||
app:
|
||||
controller: *app
|
||||
ports:
|
||||
http:
|
||||
port: *port
|
||||
ingress:
|
||||
app:
|
||||
className: internal
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
|
||||
gethomepage.dev/enabled: "true"
|
||||
gethomepage.dev/group: Downloads
|
||||
gethomepage.dev/name: Sonarr
|
||||
gethomepage.dev/icon: sonarr.png
|
||||
gethomepage.dev/description: TV Downloads
|
||||
gethomepage.dev/widget.type: sonarr
|
||||
gethomepage.dev/widget.url: http://sonarr.downloads
|
||||
gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_SONARR_TOKEN}}` }}"
|
||||
nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
|
||||
hosts:
|
||||
- host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
service:
|
||||
identifier: app
|
||||
port: http
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
secretName: "{{ .Release.Name }}-tls"
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/k3s/config/sonarr
|
||||
tmp:
|
||||
type: emptyDir
|
||||
media:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/shows
|
||||
downloads:
|
||||
existingClaim: cifs-downloads
|
||||
advancedMounts:
|
||||
sonarr:
|
||||
app:
|
||||
- path: /downloads/downloaded_tv
|
||||
readOnly: false
|
||||
subPath: sabnzbd/downloaded_tv
|
||||
- path: /downloads/tv-sonarr
|
||||
readOnly: false
|
||||
subPath: flood/tv-sonarr
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
# - ../../../../templates/volsync
|
||||
- ./externalsecret.yaml
|
||||
- ./helmrelease.yaml
|
||||
# - ../../../../templates/gatus/guarded
|
||||
@@ -1,27 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app sonarr
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: downloads
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
dependsOn:
|
||||
- name: cloudnative-pg-cluster
|
||||
- name: downloads-cifs-pvcs
|
||||
path: ./kubernetes/apps/downloads/sonarr/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -8,7 +8,7 @@ spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: external-secrets
|
||||
version: 0.11.0
|
||||
version: 0.10.5
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: external-secrets
|
||||
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
spec:
|
||||
provider:
|
||||
webhook:
|
||||
url: "http://bitwarden-cli.external-secrets.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
|
||||
url: "http://bitwarden-cli.kube-system.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
|
||||
headers:
|
||||
Content-Type: application/json
|
||||
result:
|
||||
@@ -20,6 +20,6 @@ metadata:
|
||||
spec:
|
||||
provider:
|
||||
webhook:
|
||||
url: "http://bitwarden-cli.external-secrets.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
|
||||
url: "http://bitwarden-cli.kube-system.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
|
||||
result:
|
||||
jsonPath: "$.data.fields[?@.name==\"{{ .remoteRef.property }}\"].value"
|
||||
@@ -53,15 +53,17 @@ spec:
|
||||
spec:
|
||||
exec:
|
||||
command:
|
||||
- /usr/bin/curl
|
||||
- -X
|
||||
- POST
|
||||
- -s
|
||||
- http://127.0.0.1:8087/sync
|
||||
- "/bin/bash"
|
||||
- -c
|
||||
- curl
|
||||
- -X POST
|
||||
- -s http://127.0.0.1:8087/sync
|
||||
initialDelaySeconds: 20
|
||||
failureThreshold: 3
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 120
|
||||
readiness:
|
||||
enabled: false
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
|
||||
@@ -1,55 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: &name homepage
|
||||
spec:
|
||||
target:
|
||||
name: *name
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
# HOMEPAGE_VAR_LIDARR_TOKEN: "{{ .LIDARR_API_KEY }}"
|
||||
# HOMEPAGE_VAR_OVERSEERR_TOKEN: "{{ .OVERSEERR_API_KEY }}"
|
||||
# HOMEPAGE_VAR_PLEX_TOKEN: "{{ .PLEX_TOKEN }}"
|
||||
HOMEPAGE_VAR_PROWLARR_TOKEN: "{{ .PROWLARR_API_KEY }}"
|
||||
HOMEPAGE_VAR_RADARR_TOKEN: "{{ .RADARR_API_KEY }}"
|
||||
# HOMEPAGE_VAR_READARR_TOKEN: "{{ .READARR_API_KEY }}"
|
||||
HOMEPAGE_VAR_SABNZBD_TOKEN: "{{ .SABNZBD_API_KEY }}"
|
||||
HOMEPAGE_VAR_SONARR_TOKEN: "{{ .SONARR_API_KEY }}"
|
||||
# HOMEPAGE_VAR_TAUTULLI_TOKEN: "{{ .TAUTULLI_API_KEY }}"
|
||||
data:
|
||||
- secretKey: PROWLARR_API_KEY
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: ae9d8486-9279-4790-ac34-64c8922bb414
|
||||
property: password
|
||||
- secretKey: RADARR_API_KEY
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 093af32f-2565-4807-9574-6b6a886a4e03
|
||||
property: password
|
||||
- secretKey: SABNZBD_API_KEY
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
|
||||
property: username
|
||||
- secretKey: SONARR_API_KEY
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: cccf2793-8f91-47da-be0d-63f08cdeda95
|
||||
property: password
|
||||
@@ -1,115 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app homepage
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
values:
|
||||
controllers:
|
||||
homepage:
|
||||
annotations:
|
||||
configmap.reloader.stakater.com/reload: *app
|
||||
secret.reloader.stakater.com/reload: *app
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: ghcr.io/gethomepage/homepage
|
||||
tag: v0.9.13@sha256:1504b26bd82523e68adbae8c5a908d1633d02c68c65b62d084d81a6866552db6
|
||||
env:
|
||||
TZ: "${TIMEZONE}"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: *app
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: { drop: ["ALL"] }
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
memory: 768Mi
|
||||
defaultPodOptions:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: { type: RuntimeDefault }
|
||||
service:
|
||||
app:
|
||||
controller: *app
|
||||
ports:
|
||||
http:
|
||||
port: 3000
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: *app
|
||||
ingress:
|
||||
app:
|
||||
className: internal
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
|
||||
hosts:
|
||||
- host: "home.${SECRET_INTERNAL_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
service:
|
||||
identifier: app
|
||||
port: http
|
||||
persistence:
|
||||
logs:
|
||||
type: emptyDir
|
||||
globalMounts:
|
||||
- path: /app/config/logs
|
||||
config:
|
||||
type: emptyDir
|
||||
globalMounts:
|
||||
- path: /app/config
|
||||
# services:
|
||||
# type: secret
|
||||
# name: *app
|
||||
# globalMounts:
|
||||
# - subPath: services.yaml
|
||||
# path: /app/config/services.yaml
|
||||
# readOnly: true
|
||||
configmap:
|
||||
type: configMap
|
||||
name: *app
|
||||
globalMounts:
|
||||
- subPath: bookmarks.yaml
|
||||
path: /app/config/bookmarks.yaml
|
||||
readOnly: true
|
||||
- subPath: docker.yaml
|
||||
path: /app/config/docker.yaml
|
||||
readOnly: true
|
||||
- subPath: kubernetes.yaml
|
||||
path: /app/config/kubernetes.yaml
|
||||
readOnly: true
|
||||
- subPath: settings.yaml
|
||||
path: /app/config/settings.yaml
|
||||
readOnly: true
|
||||
- subPath: widgets.yaml
|
||||
path: /app/config/widgets.yaml
|
||||
readOnly: true
|
||||
@@ -1,19 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./rbac.yaml
|
||||
- ./externalsecret.yaml
|
||||
- ./helmrelease.yaml
|
||||
configMapGenerator:
|
||||
- name: homepage
|
||||
files:
|
||||
- bookmarks.yaml=./resources/bookmarks.yaml
|
||||
- docker.yaml=./resources/docker.yaml
|
||||
- kubernetes.yaml=./resources/kubernetes.yaml
|
||||
# - services.yaml=./resources/services.yaml
|
||||
- settings.yaml=./resources/settings.yaml
|
||||
- widgets.yaml=./resources/widgets.yaml
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,50 +0,0 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: homepage
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
- pods
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- extensions
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- metrics.k8s.io
|
||||
resources:
|
||||
- nodes
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions/status
|
||||
verbs:
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: &app homepage
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: homepage
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: *app
|
||||
namespace: default
|
||||
@@ -1,23 +0,0 @@
|
||||
- Communicate:
|
||||
- Discord:
|
||||
- icon: discord.png
|
||||
href: "https://discord.com/app"
|
||||
- Gmail:
|
||||
- icon: gmail.png
|
||||
href: "https://mail.kraven.org"
|
||||
- Google Calendar:
|
||||
- icon: google-calendar.png
|
||||
href: "https://calendar.google.com"
|
||||
- Google Voice:
|
||||
- icon: google-voice.png
|
||||
href: "https://voice.google.com"
|
||||
- Git:
|
||||
- kubesearch:
|
||||
- icon: kubernetes-dashboard.png
|
||||
href: "https://kubesearch.dev/"
|
||||
- talos-cluster:
|
||||
- icon: github.png
|
||||
href: "https://github.com/brunnels/talos-cluster"
|
||||
- cluster-template:
|
||||
- icon: github.png
|
||||
href: "https://github.com/onedr0p/cluster-template"
|
||||
Whitespace-only changes.
@@ -1 +0,0 @@
|
||||
mode: cluster
|
||||
@@ -1,23 +0,0 @@
|
||||
- Infrastructure:
|
||||
- Unraid:
|
||||
icon: unraid
|
||||
href: http://192.168.1.68
|
||||
description: Unraid
|
||||
widget:
|
||||
type: unraid
|
||||
url: https//192.168.1.68
|
||||
username: root
|
||||
password: dlord781
|
||||
- Calendar:
|
||||
- Agenda:
|
||||
widget:
|
||||
type: calendar
|
||||
view: agenda
|
||||
maxEvents: 20
|
||||
integrations:
|
||||
- type: sonarr
|
||||
service_group: Downloads
|
||||
service_name: Sonarr
|
||||
- type: radarr
|
||||
service_group: Downloads
|
||||
service_name: Radarr
|
||||
@@ -1,69 +0,0 @@
|
||||
title: Dashboard
|
||||
favicon: "https://raw.githubusercontent.com/brunnels/assets/main/homepage/icons/heimdall.svg"
|
||||
theme: dark
|
||||
background:
|
||||
image: https://images.unsplash.com/photo-1502790671504-542ad42d5189?auto=format&fit=crop&w=2560&q=80
|
||||
blur: sm
|
||||
saturate: 50
|
||||
brightness: 50
|
||||
opacity: 50
|
||||
color: slate
|
||||
headerStyle: clean
|
||||
providers:
|
||||
longhorn:
|
||||
url: http://longhorn-frontend.longhorn-system
|
||||
layout:
|
||||
# Automation:
|
||||
# style: column
|
||||
# Infrastructure:
|
||||
# icon: mdi-server
|
||||
# style: column
|
||||
# Git:
|
||||
# icon: mdi-desktop-tower
|
||||
# style: column
|
||||
# Storage:
|
||||
# icon: mdi-desktop-tower
|
||||
# style: column
|
||||
# Tools:
|
||||
# style: column
|
||||
# Observability:
|
||||
# icon: mdi-chart-line
|
||||
# style: row
|
||||
# columns: 4
|
||||
# Media:
|
||||
# icon: mdi-play-circle
|
||||
# style: row
|
||||
# columns: 4
|
||||
# Downloads:
|
||||
# icon: mdi-download-circle
|
||||
# style: row
|
||||
# columns: 4
|
||||
Home:
|
||||
style: column
|
||||
icon: mdi-home-analytics
|
||||
Git:
|
||||
style: column
|
||||
icon: mdi-desktop-tower
|
||||
Storage:
|
||||
style: row
|
||||
columns: 2
|
||||
icon: mdi-desktop-tower
|
||||
Calendar:
|
||||
style: column
|
||||
icon: mdi-calendar
|
||||
Media:
|
||||
style: column
|
||||
icon: mdi-play-circle
|
||||
Infrastructure:
|
||||
style: column
|
||||
icon: mdi-server
|
||||
DNS:
|
||||
style: column
|
||||
icon: mdi-server
|
||||
Observability:
|
||||
style: column
|
||||
icon: mdi-chart-line
|
||||
Downloads:
|
||||
style: row
|
||||
columns: 3
|
||||
icon: mdi-download-circle
|
||||
@@ -1,32 +0,0 @@
|
||||
- resources:
|
||||
backend: kubernetes
|
||||
cpu: true
|
||||
expanded: true
|
||||
memory: true
|
||||
- kubernetes:
|
||||
cluster:
|
||||
cpu: true
|
||||
label: cluster
|
||||
memory: true
|
||||
show: true
|
||||
showLabel: true
|
||||
nodes:
|
||||
cpu: true
|
||||
memory: true
|
||||
show: false
|
||||
showLabel: true
|
||||
- search:
|
||||
provider: [duckduckgo, google]
|
||||
target: _blank
|
||||
- openmeteo:
|
||||
latitude: "${SECRET_LATITUDE}"
|
||||
longitude: "${SECRET_LONGITUDE}"
|
||||
timezone: "${TIMEZONE}"
|
||||
units: imperial
|
||||
cache: 15
|
||||
- datetime:
|
||||
text_size: l
|
||||
format:
|
||||
dateStyle: long
|
||||
timeStyle: short
|
||||
hourCycle: h23
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app homepage
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: default
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
dependsOn:
|
||||
- name: external-secrets
|
||||
path: ./kubernetes/apps/helpers/homepage/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./homepage/ks.yaml
|
||||
- ./theme-park/ks.yaml
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: default
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -1,73 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app theme-park
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
values:
|
||||
controllers:
|
||||
theme-park:
|
||||
replicas: 2
|
||||
strategy: RollingUpdate
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/theme-park
|
||||
tag: 1.18.0@sha256:210d8f5d9466df493503184fb076bbf1fb9fbc2b42e273cd4516ac3fd1df7ba2
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
memory: 64Mi
|
||||
defaultPodOptions:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: { type: RuntimeDefault }
|
||||
service:
|
||||
app:
|
||||
controller: *app
|
||||
ports:
|
||||
http:
|
||||
port: 8080
|
||||
ingress:
|
||||
app:
|
||||
className: internal
|
||||
# annotations:
|
||||
# external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
|
||||
hosts:
|
||||
- host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
service:
|
||||
identifier: app
|
||||
port: http
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: DoNotSchedule
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: *app
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app theme-park
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: default
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
path: ./kubernetes/apps/helpers/theme-park/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -1,128 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app jellyfin
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
defaultPodOptions:
|
||||
enableServiceLinks: false
|
||||
securityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
controllers:
|
||||
jellyfin:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: ghcr.io/jellyfin/jellyfin
|
||||
tag: 10.10.3@sha256:17c3a8d9dddb97789b5f37112840ebf96566442c14d4754193a6c2eb154bc221
|
||||
env:
|
||||
DOTNET_SYSTEM_IO_DISABLEFILELOCKING: "true"
|
||||
JELLYFIN_FFmpeg__probesize: 50000000
|
||||
JELLYFIN_FFmpeg__analyzeduration: 50000000
|
||||
JELLYFIN_PublishedServerUrl: &loadBalancerIP ${CLUSTER_LB_JELLYFIN}
|
||||
TZ: ${TIMEZONE}
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: &port 8096
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
resources:
|
||||
requests:
|
||||
# gpu.intel.com/i915: 1
|
||||
cpu: 100m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
# gpu.intel.com/i915: 1
|
||||
memory: 4Gi
|
||||
service:
|
||||
app:
|
||||
controller: *app
|
||||
ports:
|
||||
http:
|
||||
port: *port
|
||||
ingress:
|
||||
app:
|
||||
enabled: true
|
||||
className: internal
|
||||
hosts:
|
||||
- host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
service:
|
||||
identifier: app
|
||||
port: http
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/k3s/config/jellyfin
|
||||
music:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/music
|
||||
globalMounts:
|
||||
- path: /var/mnt/vol1/music
|
||||
photo:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/photos/original
|
||||
globalMounts:
|
||||
- path: /var/mnt/vol1/photo
|
||||
video:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/movies
|
||||
globalMounts:
|
||||
- path: /var/mnt/vol1/video
|
||||
transcode:
|
||||
enabled: true
|
||||
type: emptyDir
|
||||
globalMounts:
|
||||
- path: /transcode
|
||||
cache:
|
||||
enabled: true
|
||||
type: emptyDir
|
||||
globalMounts:
|
||||
- path: /cache
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app jellyfin
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: media
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
dependsOn:
|
||||
- name: external-secrets
|
||||
path: ./kubernetes/apps/media/jellyfin/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./jellyfin/ks.yaml
|
||||
- ./overseerr/ks.yaml
|
||||
- ./tautulli/ks.yaml
|
||||
- ./plex/ks.yaml
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: media
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -1,115 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app overseerr
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
values:
|
||||
controllers:
|
||||
overseerr:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: ghcr.io/sct/overseerr
|
||||
tag: rolling@sha256:714ea6db2bc007a2262d112bef7eec74972eb33d9c72bddb9cbd98b8742de950
|
||||
env:
|
||||
TZ: "${TIMEZONE}"
|
||||
LOG_LEVEL: "info"
|
||||
PORT: &port 80
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /api/v1/status
|
||||
port: *port
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness: *probes
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: { drop: [ "ALL" ] }
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
memory: 4Gi
|
||||
defaultPodOptions:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: { type: RuntimeDefault }
|
||||
service:
|
||||
app:
|
||||
controller: *app
|
||||
ports:
|
||||
http:
|
||||
port: *port
|
||||
ingress:
|
||||
app:
|
||||
className: internal
|
||||
# annotations:
|
||||
# external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
|
||||
# gethomepage.dev/enabled: "true"
|
||||
# gethomepage.dev/group: Media
|
||||
# gethomepage.dev/name: Overseerr
|
||||
# gethomepage.dev/icon: overseerr
|
||||
# gethomepage.dev/description: Media Request Management
|
||||
# gethomepage.dev/widget.type: overseerr
|
||||
# gethomepage.dev/widget.url: http://overseerr.media
|
||||
# gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_OVERSEERR_TOKEN}}` }}"
|
||||
hosts:
|
||||
- host: "requests.${SECRET_INTERNAL_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
service:
|
||||
identifier: app
|
||||
port: http
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/k3s/config/overseerr
|
||||
globalMounts:
|
||||
- path: /app/config
|
||||
cache:
|
||||
storageClass: openebs-hostpath
|
||||
accessMode: ReadWriteOnce
|
||||
size: 15Gi
|
||||
globalMounts:
|
||||
- path: /app/config/cache
|
||||
logs:
|
||||
type: emptyDir
|
||||
globalMounts:
|
||||
- path: /app/config/logs
|
||||
tmp:
|
||||
type: emptyDir
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
# - ../../../../templates/gatus/external
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app overseerr
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: media
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
path: ./kubernetes/apps/media/overseerr/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -1,23 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: &name plex
|
||||
spec:
|
||||
target:
|
||||
name: *name
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
PLEX_CLAIM: "{{ .PLEX_CLAIM }}"
|
||||
data:
|
||||
- secretKey: PLEX_CLAIM
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: &secretApiKey 8406f7ea-46b0-42ed-bcae-a83984d7b6ae
|
||||
property: password
|
||||
@@ -1,149 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app plex
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
values:
|
||||
controllers:
|
||||
plex:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/plex
|
||||
tag: rolling@sha256:1f28b5e5a964481f80e76db3c986082d2fc3bca2d16d2742704e9adf8349c79c
|
||||
env:
|
||||
TZ: "${TIMEZONE}"
|
||||
ALLOWED_NETWORKS: "${LAN_CIDR},${CLUSTER_CIDR},${SERVICE_CIDR}"
|
||||
PLEX_ADVERTISE_URL: "http://172.16.10.4:32400,https://plex.${SECRET_INTERNAL_DOMAIN}"
|
||||
PLEX_PREFERENCE_1: "AllowMediaDeletion=0"
|
||||
PLEX_PREFERENCE_2: "EnableIPv6=0"
|
||||
PLEX_PREFERENCE_3: "FriendlyName=LordFamilyFlix"
|
||||
PLEX_PREFERENCE_4: "LanNetworksBandwidth=${LAN_CIDR}"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: *app
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /identity
|
||||
port: &port 32400
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness: *probes
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
memory: 4Gi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: { drop: ["ALL"] }
|
||||
defaultPodOptions:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: { type: RuntimeDefault }
|
||||
service:
|
||||
app:
|
||||
controller: *app
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
http:
|
||||
port: *port
|
||||
ingress:
|
||||
app:
|
||||
className: internal
|
||||
# annotations:
|
||||
# external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
|
||||
# gethomepage.dev/enabled: "true"
|
||||
# gethomepage.dev/group: Media
|
||||
# gethomepage.dev/name: Plex
|
||||
# gethomepage.dev/icon: plex
|
||||
# gethomepage.dev/description: Media Player
|
||||
# gethomepage.dev/widget.type: plex
|
||||
# gethomepage.dev/widget.url: http://plex.media:32400
|
||||
# gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PLEX_TOKEN}}` }}"
|
||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
# nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
|
||||
hosts:
|
||||
- host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
service:
|
||||
identifier: app
|
||||
port: http
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/k3s/config/plex
|
||||
cache:
|
||||
storageClass: openebs-hostpath
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
globalMounts:
|
||||
- path: "/config/Library/Application Support/Plex Media Server/Cache"
|
||||
tmp:
|
||||
type: emptyDir
|
||||
transcode:
|
||||
type: emptyDir
|
||||
movies:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/movies
|
||||
globalMounts:
|
||||
- path: /media/movies
|
||||
music:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/music
|
||||
globalMounts:
|
||||
- path: /media/music
|
||||
pictures:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/photos/original
|
||||
globalMounts:
|
||||
- path: /media/photos
|
||||
tv:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/shows
|
||||
globalMounts:
|
||||
- path: /media/tv
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./externalsecret.yaml
|
||||
- ./helmrelease.yaml
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app plex
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: media
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
path: ./kubernetes/apps/media/plex/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -1,104 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app tautulli
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 3.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
strategy: rollback
|
||||
retries: 3
|
||||
values:
|
||||
controllers:
|
||||
tautulli:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/tautulli
|
||||
tag: rolling@sha256:96285c7e57dc77b790bb934be25d1d18a7c220b0f9e29748f65b2374bbef24c8
|
||||
env:
|
||||
TZ: America/Denver
|
||||
TAUTULLI__PORT: &port 80
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /status
|
||||
port: *port
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness: *probes
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: { drop: [ "ALL" ] }
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
memory: 4Gi
|
||||
defaultPodOptions:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile: { type: RuntimeDefault }
|
||||
service:
|
||||
app:
|
||||
controller: *app
|
||||
ports:
|
||||
http:
|
||||
port: *port
|
||||
ingress:
|
||||
app:
|
||||
className: internal
|
||||
# annotations:
|
||||
# external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
|
||||
# gethomepage.dev/enabled: "true"
|
||||
# gethomepage.dev/group: Media
|
||||
# gethomepage.dev/name: Tautulli
|
||||
# gethomepage.dev/icon: tautulli
|
||||
# gethomepage.dev/description: Plex Stream Monitoring
|
||||
# gethomepage.dev/widget.type: tautulli
|
||||
# gethomepage.dev/widget.url: http://tautulli.media
|
||||
# gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_TAUTULLI_TOKEN}}` }}"
|
||||
hosts:
|
||||
- host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
service:
|
||||
identifier: app
|
||||
port: http
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: nfs
|
||||
server: 192.168.1.68
|
||||
path: /mnt/user/k3s/config/tautulli
|
||||
tmp:
|
||||
type: emptyDir
|
||||
add-ons:
|
||||
type: emptyDir
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
# - ../../../../templates/gatus/guarded
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app tautulli
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: media
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
path: ./kubernetes/apps/media/tautulli/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
postBuild:
|
||||
substitute:
|
||||
APP: *app
|
||||
@@ -30,7 +30,7 @@ spec:
|
||||
app:
|
||||
image:
|
||||
repository: docker.io/cloudflare/cloudflared
|
||||
tag: 2024.11.1
|
||||
tag: 2024.11.0
|
||||
env:
|
||||
NO_AUTOUPDATE: true
|
||||
TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
|
||||
|
||||
@@ -30,7 +30,7 @@ spec:
|
||||
webhook:
|
||||
image:
|
||||
repository: ghcr.io/kashalls/external-dns-unifi-webhook
|
||||
tag: v0.3.2@sha256:f8cf534970560bc8d1a61cc13f7c9580d91be60f5c6c7a86c3be0ca362208500
|
||||
tag: v0.3.1@sha256:593eeb3594a8418084d3235b2a30ca8aa4c58b949fac3433b86df6c725364e32
|
||||
env:
|
||||
- name: UNIFI_HOST
|
||||
value: https://192.168.10.1
|
||||
@@ -66,7 +66,7 @@ spec:
|
||||
sources: ["crd", "ingress"]
|
||||
txtPrefix: k8s.
|
||||
txtOwnerId: default
|
||||
domainFilters: ["${SECRET_INTERNAL_DOMAIN}", "${SECRET_DOMAIN}"]
|
||||
domainFilters: ["${SECRET_DOMAIN_INTERNAL}", "${SECRET_DOMAIN}"]
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
|
||||
@@ -64,7 +64,7 @@ spec:
|
||||
namespaceSelector:
|
||||
any: true
|
||||
extraArgs:
|
||||
default-ssl-certificate: "network/${SECRET_INTERNAL_DOMAIN/./-}-production-tls"
|
||||
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &chart csi-driver-nfs
|
||||
namespace: system
|
||||
spec:
|
||||
interval: 5m
|
||||
chart:
|
||||
spec:
|
||||
chart: *chart
|
||||
version: v4.9.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: csi-driver-nfs
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
values:
|
||||
controller:
|
||||
replicas: 2
|
||||
feature:
|
||||
enableFSGroupPolicy: true
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./storage-classes
|
||||
- ./helmrelease.yaml
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./provisions.yaml
|
||||
@@ -1,40 +0,0 @@
|
||||
---
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: nfs-provision-csi
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/substitute: "disabled"
|
||||
provisioner: nfs.csi.k8s.io
|
||||
parameters:
|
||||
server: 192.168.1.68
|
||||
share: /mnt/user/k3s/
|
||||
allowVolumeExpansion: true
|
||||
reclaimPolicy: Retain
|
||||
volumeBindingMode: Immediate
|
||||
mountOptions:
|
||||
- nfsvers=4.1
|
||||
- nconnect=8
|
||||
- hard
|
||||
- noatime
|
||||
- nodiratime
|
||||
---
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: nfs-provision-csi-database
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/substitute: "disabled"
|
||||
provisioner: nfs.csi.k8s.io
|
||||
parameters:
|
||||
server: 192.168.1.68
|
||||
share: /mnt/user/cnpg
|
||||
allowVolumeExpansion: true
|
||||
reclaimPolicy: Retain
|
||||
volumeBindingMode: Immediate
|
||||
mountOptions:
|
||||
- nfsvers=4.1
|
||||
- nconnect=8
|
||||
- hard
|
||||
- noatime
|
||||
- nodiratime
|
||||
@@ -1,20 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app csi-driver-nfs
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: kube-system
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
path: ./kubernetes/apps/storage/csi-driver-nfs/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
timeout: 5m
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./csi-driver-nfs/ks.yaml
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: storage
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
@@ -30,7 +30,7 @@ releases:
|
||||
- name: coredns
|
||||
namespace: kube-system
|
||||
chart: coredns/coredns
|
||||
version: 1.36.1
|
||||
version: 1.36.0
|
||||
values:
|
||||
- ../apps/kube-system/coredns/app/helm-values.yaml
|
||||
needs:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
|
||||
---
|
||||
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
|
||||
talosVersion: v1.8.4
|
||||
talosVersion: v1.8.1
|
||||
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
|
||||
kubernetesVersion: v1.31.2
|
||||
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: bitnami
|
||||
namespace: flux-system
|
||||
spec:
|
||||
type: oci
|
||||
interval: 5m
|
||||
url: oci://registry-1.docker.io/bitnamicharts
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: cloudnative-pg
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1h
|
||||
url: https://cloudnative-pg.github.io/charts
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: csi-driver-nfs
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30m
|
||||
url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
|
||||
timeout: 3m
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: csi-driver-smb
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1h
|
||||
url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
|
||||
@@ -16,6 +16,3 @@ resources:
|
||||
- ./external-secrets.yaml
|
||||
- ./ingress-nginx.yaml
|
||||
- ./k8s-gateway.yaml
|
||||
- ./csi-driver-nfs.yaml
|
||||
- ./cloudnative-pg.yaml
|
||||
- ./bitnami.yaml
|
||||
@@ -4,11 +4,10 @@ metadata:
|
||||
name: cluster-secrets
|
||||
namespace: flux-system
|
||||
stringData:
|
||||
SECRET_INTERNAL_DOMAIN: ENC[AES256_GCM,data:AvYATV6LqEmALp/j1w==,iv:DDf17Gf2ta+UuMysaeTtN92ti0wrz+eAmawwJSZxyQY=,tag:hoarzYqJXEfMWSFRzpOlzw==,type:str]
|
||||
SECRET_DOMAIN: ENC[AES256_GCM,data:HjoRmQzaP5jG8m1iMc198Q==,iv:1GNInjU80g3lstoVYUY9/pOSh9QnCCmXN44PhZgvOv8=,tag:62X6LxGg9vt1wiW8kf/CsA==,type:str]
|
||||
SECRET_ACME_EMAIL: ENC[AES256_GCM,data:gG7gLBw7i5xLu1HkOYA8O76WPsc=,iv:d71Ip9lrtZR5FFWvV+NQbP9epP6v9cYM1Ntag6yHWAQ=,tag:ZzljWFeetwVubEuIOljrSA==,type:str]
|
||||
SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:22ZGxjzd/GM9JscAoadi+f2Y6UKL6BJ16LOpxObPrw+geR6A,iv:9M1HGTCzlDI8bLAUFzYPznzBJueRnc+/tGORIlDJS88=,tag:1aGOpgabBTt+OdJI/7xBnw==,type:str]
|
||||
SECRET_UNRAID_HOSTNAME: ENC[AES256_GCM,data:DxjjDKkowZYrE7qK,iv:hifntnMQWrtBEDPucuO/KmblEuWNF7qUz8Mi9s44KaM=,tag:zyEJ92uqKXfu6yh18dqqYw==,type:str]
|
||||
SECRET_DOMAIN: ENC[AES256_GCM,data:uqdjPED+mxmdUTx7TJIR9A==,iv:hmVDDwzqBYWA7mSqCp0WEZZjHXY1jPtfj71kcHQuWNk=,tag:s/o0767NO/ERXhOrVogwlw==,type:str]
|
||||
SECRET_INTERNAL_DOMAIN: ENC[AES256_GCM,data:V+a232owGhaq0AbwmA==,iv:Kun8a5FY4hJkYIaQaQabhF68YQmg84WvSf7mN5wXReE=,tag:btvlR9FxIC40pcfjIT1xZQ==,type:str]
|
||||
SECRET_ACME_EMAIL: ENC[AES256_GCM,data:O54SPqcxk9AQPM+/SY3AJf9Q18s=,iv:nz8g9wMv1qvFrcaybD1GaxUMU5/yWKNpfncswCN8MCk=,tag:OzDI/ADGJEmZqzdkBMOV6A==,type:str]
|
||||
SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:v+fc5FKSWZDj1FxKOfFqX8b0IhBUzhWMJv/mnPRzRP6+d5qQ,iv:3Vi4MKuFKnCeqdekTWEJs4az+eKbR7acmAeWdk6aOp4=,tag:FtVoEGs5CgXtKGF28Rrjng==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
@@ -18,14 +17,14 @@ sops:
|
||||
- recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQZVo3MWRwMFRzeXA5UXN0
|
||||
cGRkbUl6THpQRzlORENoNDZzbzlQenkvMEh3Ck53NzdEOW4yVjlJcUNLU1M2QVVK
|
||||
Qm9CMVpFeXg3dGRuaVVreUFtdDJ0MVUKLS0tIDVQQUpTVHJDSHhJdS9lMk5NdXhu
|
||||
N1dXTnlOaUNLUjh5SVRCZzlhVUF4Y1EKoLjz8aT2CdHI6URVJheQID4/7DkPfWXB
|
||||
yG/wM3CEOlnXP5Eyj8X5r/LmCoeBD7LNlAwQ0PGythA3v+LQpat9Uw==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZTZrNUxQeDRHWUhPUk1o
|
||||
UklhUlo0V2ZIOTRmTXd3bWN5bndLT0VUZG1RCnJSd3doWHhrOFdpeUE2Q0JWdWoy
|
||||
OTRnOVZYajdFMVIzQzRKdlF4bTVEb2MKLS0tIHk2OEtTYUlML0YxU2sva2JjUUJQ
|
||||
S1hvdXk5dFdRZE00T2NrNC9GaStIYUUK6NfuJJZDu8O2c+6pacIbah7oI8eKYxqX
|
||||
AWRROo/oWzrHoK7eXZHKeTuTi3lgFIFuRSEMzyipcZfu2HKHyVLShQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-11-23T05:19:00Z"
|
||||
mac: ENC[AES256_GCM,data:Hk6SChJVwvvZVbHi4G8biDLrY4gMOfuczt1BHQXx+LEIhN2KDriCIRRL6RT22D41AQ/5rhVb127ZfQXe+WztGK/+do2ED/q8nLwiqWVc3tkpPgVSB4hMHClCJtHh7bSMHP1rtYQElMPopVYPPkzrsK3cC/hNfHJrD1Gy0AJKQaQ=,iv:ydVoJQ36J2RCLBjSak6AfxyVHO//kLWY3hzYukjEdYA=,tag:ISui4EMJb6IWaWh7Se3pFQ==,type:str]
|
||||
lastmodified: "2024-11-07T06:32:06Z"
|
||||
mac: ENC[AES256_GCM,data:VgeNG+ZraWxkjsd2PBTCaeulXifmt5KkMEVJCJOmLWuKAFCyrIZ+C1fV1J8+rGkRkuEDx+ZWHtvElv9TfTCFqHAhLG/crkRe/HQFvsxOJoC8qO4ciFMn80jTzDGj6dD5VVGLUnkAWaiWbInS0oJC6/ZEhPuTCo1JFrPycpnr4YA=,iv:dE0czOEMYM82/a9/2HLezQlrs6ITatuZPKw+NuegIHw=,tag:UZw1WhREn5sitTbgf9MBSA==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.9.1
|
||||
@@ -5,14 +5,4 @@ metadata:
|
||||
name: cluster-settings
|
||||
namespace: flux-system
|
||||
data:
|
||||
TIMEZONE: "US/Mountain"
|
||||
CLUSTER_CIDR: "10.96.0.0/16"
|
||||
SERVICE_CIDR: "172.16.10.0/24"
|
||||
LAN_CIDR: "10.0.10.0/24"
|
||||
THEME_PARK_SNIPPET: >
|
||||
proxy_set_header Accept-Encoding "";
|
||||
sub_filter '</body>' '<link rel="stylesheet" type="text/css" href="https://theme-park.${SECRET_DOMAIN}/css/base/{{ .Release.Name }}/nord.css"></body>';
|
||||
sub_filter_once on;
|
||||
SVC_POSTGRES_ADDR: "10.50.0.24"
|
||||
SVC_QBITTTORENT_ADDR: "10.50.0.25"
|
||||
SVC_VPN_ADDR: "10.50.0.26"
|
||||
SETTING_EXAMPLE: Global settings for your cluster go in this file, this file is NOT encrypted
|
||||
Loaded 100 of 106 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user