Merge pull request 'Bring dev into main in order to apply deployments/' (#2) from dev into main

Reviewed-on: #2

charts/dns/Chart.yaml

@@ -1,5 +1,5 @@
----
 apiVersion: v2
 name: home-server-dns
-description: Deploys a master/slave DNS server with External DNS for declaring hostnames with annotations.
-version: 0.0.1
+description: Deploys the DNS setup
+type: application
+version: 0.1.0

charts/dns/templates/bind-master.yaml

@@ -3,7 +3,6 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: bind-master-config
-  namespace: dns
 data:
   named.conf: |
     include "/etc/bind/externaldns-key.conf";
@@ -52,7 +51,6 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: bind-master
-  namespace: dns
 spec:
   selector:
     matchLabels:
@@ -122,8 +120,8 @@ apiVersion: v1
 kind: Service
 metadata:
   name: bind-master
-  namespace: dns
 spec:
+  type: ClusterIP
   selector:
     app: bind-master
   ports:
@@ -136,4 +134,3 @@ spec:
       protocol: TCP
       targetPort: 53
 
-

charts/dns/templates/bind-slave.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: bind-master-config
+  name: bind-slave-config
 data:
   named.conf: |
     include "/etc/bind/externaldns-key.conf";
@@ -50,15 +50,15 @@ data:
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: bind-master
+  name: bind-slave
 spec:
   selector:
     matchLabels:
-      app: bind-master
+      app: bind-slave
   template:
     metadata:
       labels:
-        app: bind-master
+        app: bind-slave
     spec:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
@@ -77,7 +77,7 @@ spec:
             - mountPath: /usr/share/dns
               name: root-hints
       containers:
-        - name: bind-master
+        - name: bind-slave
           image: internetsystemsconsortium/bind9:9.18
           command: ["named", "-g", "-c", "/etc/bind/named.conf"]
           ports:
@@ -107,7 +107,7 @@ spec:
             secretName: dns-secrets
         - name: config
           configMap:
-            name: bind-master-config
+            name: bind-slave-config
         - name: bind-cache
           emptyDir: {}
         - name: bind-rundir
@@ -120,7 +120,10 @@ apiVersion: v1
 kind: Service
 metadata:
   name: bind-master
+  namespace: default
 spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
   selector:
     app: bind-master
   ports:
@@ -133,4 +136,3 @@ spec:
       protocol: TCP
       targetPort: 53
 
-

charts/dns/templates/clusterrole.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: external-dns
-rules:
-  - apiGroups: [""]
-    resources: ["services","endpoints","pods"]
-    verbs: ["get","watch","list"]
-  - apiGroups: ["extensions","networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get","watch","list"]
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["list","watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: external-dns-viewer
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: external-dns
-subjects:
-  - kind: ServiceAccount
-    name: external-dns
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: external-dns

charts/dns/templates/external-dns.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: external-dns
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: external-dns
-  template:
-    metadata:
-      labels:
-        app: external-dns
-    spec:
-      serviceAccountName: external-dns
-      containers:
-      - name: external-dns
-        image: bitnami/external-dns:latest
-        args:
-          - --source=service
-          - --source=ingress
-          - --provider=rfc2136
-          - --rfc2136-host=bind-master.dns.svc.cluster.local
-          - --rfc2136-port=53
-          - --rfc2136-zone=hxme.net
-          - --rfc2136-tsig-secret=$(RFC2136_TSIG_SECRET)
-          - --rfc2136-tsig-secret-alg=hmac-sha256
-          - --rfc2136-tsig-keyname=externaldns-key
-          - --policy=sync
-          - --registry=txt
-          - --txt-owner-id=my-cluster
-        env:
-            - name: RFC2136_TSIG_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: dns-secrets
-                  key: externaldns-secret

charts/dns/templates/externaldns.yaml

@@ -13,7 +13,6 @@ rules:
   - apiGroups: [""]
     resources: ["nodes"]
     verbs: ["list","watch"]
-  # Add DNS provider specific rules here if needed (e.g., for AWS IAM, GCP etc.)
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -26,19 +25,16 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: external-dns
-    namespace: dns
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: external-dns
-  namespace: dns
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: external-dns
-  namespace: dns
 spec:
   replicas: 1
   selector:
@@ -72,3 +68,5 @@ spec:
                 secretKeyRef:
                   name: dns-secrets
                   key: externaldns-secret
+
+

charts/dns/values.yaml

@@ -0,0 +1,2 @@
+domain: "auth.dev.hxme.net"
+certSecretName: "wildcard-hxme-net"

deployments/home-server.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: home-server
-  namespace: home-server
-spec:
-  interval: 1m
-  chart:
-    spec:
-      chart: ./charts/dns
-      sourceRef:
-        kind: GitRepository
-        name: home-server
-        namespace: flux-system

deployments/kustomization.yaml

@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind:       Kustomization
 
 resources:
-  - namespaces.yaml
-  - home-server.yaml
+  - manifests/00-namespaces.yaml
+  - manifests/10-dev.yaml
+  - manifests/10-prod.yaml

deployments/manifests/00-namespaces.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: home-server
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: home-server-dev

deployments/manifests/10-dev.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: GitRepository
+metadata:
+  name: home-server-dev
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: ssh://git@repobase.net/j/home-server.git
+  secretRef:
+    name: flux-ssh
+  ref:
+    branch: dev
+
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: home-server-dev
+  namespace: flux-system
+spec:
+  interval: 1m
+  path: ./deployments
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-server-dev
+  targetNamespace: home-server-dev

deployments/manifests/10-prod.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: GitRepository
+metadata:
+  name: home-server
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: ssh://git@repobase.net/j/home-server.git
+  secretRef:
+    name: flux-ssh
+  ref:
+    branch: main
+
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: home-server
+  namespace: flux-system
+spec:
+  interval: 1m
+  path: ./deployments
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-server
+  targetNamespace: home-server

deployments/namespaces.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: home-server

home-server/Chart.yaml

@@ -1,9 +0,0 @@
-apiVersion: v2
-name: home-server
-description: A Helm chart that rolls a curated, functional home server
-version: 0.0.1
-
-dependencies:
-  - name: util
-    version: 0.0.1
-    repository: "file://templates/util"

home-server/values.yaml

@@ -1,24 +0,0 @@
-ai:
-  enabled: true
-
-dns:
-  enabled: false
-
-media:
-  enabled: true
-
-monitoring:
-  enabled: true
-
-remote:
-  enabled: false
-
-social:
-  enabled: true
-
-sync:
-  enabled: false
-
-util:
-  enabled: true
-

old-manifests/Chart.yaml

@@ -1,41 +0,0 @@
-apiVersion: v2
-name: home-server
-description: A Helm chart that rolls a curated, functional home server
-version: 0.0.1
-
-dependencies:
-  - name: util
-    version: 0.0.1
-    repository: "file://templates/util"
-
-  - name: dns
-    version: 0.0.1
-    repository: "file://templates/dns"
-#
-#  - name: files
-#    version: 0.0.1
-#    repository: "file://templates/files"
-#
-#  - name: ai
-#    version: 0.0.1
-#    repository: "file://templates/ai"
-#
-#  - name: media
-#    version: 0.0.1
-#    repository: "file://templates/media"
-#
-#  - name: monitoring
-#    version: 0.0.1
-#    repository: "file://templates/monitoring"
-#
-#  - name: remote
-#    version: 0.0.1
-#    repository: "file://templates/remote"
-#
-#  - name: social
-#    version: 0.0.1
-#    repository: "file://templates/social"
-#
-#  - name: sync
-#    version: 0.0.1
-#    repository: "file://templates/sync"

old-manifests/templates/ai/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ai

old-manifests/templates/ai/openwebui.yaml

@@ -1,72 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: openwebui
-  namespace: ai
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: openwebui
-  template:
-    metadata:
-      labels:
-        app: openwebui
-    spec:
-      containers:
-        - name: openwebui
-          image: ghcr.io/open-webui/open-webui:latest
-          ports:
-            - containerPort: 8080
-          env:
-            - name: OLLAMA_BASE_URL
-              value: http://ollama:11434
-          volumeMounts:
-            - name: ai-storage
-              mountPath: /app/backend/data
-      volumes:
-        - name: ai-storage
-          hostPath:
-            path: /dpool/files/ai/
-            type: Directory
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: openwebui
-  namespace: ai
-spec:
-  selector:
-    app: openwebui
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: openwebui
-  namespace: ai
-  annotations:
-    kubernetes.io/ingress.class: "traefik" 
-    external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
-spec:
-  rules:
-    - host: ai.hxme.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: openwebui
-                port:
-                  number: 80
-  tls:
-    - hosts:
-        - ai.hxme.net
-      secretName: openwebui-tls
-
-

old-manifests/templates/auth/authentik.yaml

@@ -1,49 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: authentik
-  namespace: flux-system
-spec:
-  url: https://charts.goauthentik.io/
-  interval: 1h
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: wildcard-hxme-net
-  namespace: auth
-  annotations:
-    replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: authentik
-  namespace: auth
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: authentik
-      version: 2024.4.2
-      sourceRef:
-        kind: HelmRepository
-        name: authentik
-        namespace: flux-system
-  install:
-    createNamespace: true
-  upgrade:
-    disableWait: false
-  timeout: 10m
-  valuesFrom:
-    - kind: Secret
-      name: authentik-values
-  values:
-    ingress:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: auth.hxme.net
-      tls:
-        - secretName: wildcard-hxme-net
-          hosts:
-            - auth.hxme.net

old-manifests/templates/auth/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ai

old-manifests/templates/dns/Chart.yaml

@@ -1,4 +0,0 @@
-apiVersion: v2
-name: dns
-description: "DNS subchart for home-server"
-version: 0.0.1

old-manifests/templates/dns/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: dns

old-manifests/templates/files/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: files

old-manifests/templates/files/nextcloud.yaml

@@ -1,137 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: nextcloud-pv
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: local-path
-  hostPath:
-    path: /dpool/temp/Nextcloud
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nextcloud-pvc
-  namespace: nextcloud
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: local-path 
-  resources:
-    requests:
-      storage: 10Gi
-  volumeName: nextcloud-pv
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: nextcloud
-  namespace: nextcloud
-spec:
-  ports:
-    - port: 80
-  selector:
-    app: nextcloud
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nextcloud
-  namespace: nextcloud
-spec:
-  securityContext:
-    runAsUser:  1000
-    runAsGroup: 1000
-    fsGroup:    1000
-  selector:
-    matchLabels:
-      app: nextcloud
-  template:
-    metadata:
-      labels:
-        app: nextcloud
-    spec:
-      containers:
-        - name: nextcloud
-          image: nextcloud:29
-          env:
-            - name: MYSQL_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: nextcloud-secrets
-                  key: MYSQL_PASSWORD
-            - name: MYSQL_DATABASE
-              value: nextcloud
-            - name: MYSQL_USER
-              value: nextcloud
-            - name: MYSQL_HOST
-              value: mariadb
-          ports:
-            - containerPort: 80
-          volumeMounts:
-            - name: nextcloud-data
-              mountPath: /var/www/html
-          securityContext:
-            runAsUser:  1000
-            runAsGroup: 1000
-            fsGroup:    1000
-      volumes:
-        - name: nextcloud-data
-          persistentVolumeClaim:
-            claimName: nextcloud-pvc
----
-apiVersion: k8s.mariadb.com/v1alpha1
-kind: MariaDB
-metadata:
-  name: nextcloud-db
-  namespace: nextcloud
-spec:
-  rootPasswordSecretKeyRef:
-    name: nextcloud-secrets
-    key: MYSQL_ROOT_PASSWORD
-  database: nextcloud
-  username: nextcloud
-  passwordSecretKeyRef:
-    name: nextcloud-secrets
-    key: MYSQL_PASSWORD
-  image: mariadb:10.11
-  storage:
-    size: 5Gi
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: wildcard-hxme-net
-  namespace: nextcloud
-  annotations:
-    replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: nextcloud
-  namespace: nextcloud
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
-spec:
-  tls:
-    - hosts:
-        - nc.hxme.net
-      secretName: wildcard-hxme-net
-  rules:
-    - host: nc.hxme.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: nextcloud
-                port:
-                  number: 80
-

old-manifests/templates/media/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: media

old-manifests/templates/monitoring/grafana.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: grafana
-  namespace: monitoring
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: grafana
-      version: 7.3.0
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-        namespace: flux-system
-  install:
-    createNamespace: true
-  values:
-    admin:
-      existingSecret: grafana-admin-secret
-      userKey: admin-user
-      passwordKey: admin-password
-    service:
-      type: LoadBalancer
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: "grafana.hxme.net"
-    datasources:
-      datasources.yaml:
-        apiVersion: 1
-        datasources:
-          - name: Loki
-            type: loki
-            access: proxy
-            url: http://loki:3100
-            isDefault: true
-

old-manifests/templates/monitoring/loki.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: loki
-  namespace: monitoring
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: loki
-      version: 6.6.4
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-        namespace: flux-system
-  install:
-    createNamespace: true
-  values:
-    loki:
-      auth_enabled: false
-    singleBinary:
-      replicas: 1
-      service:
-        type: LoadBalancer
-        annotations:
-          external-dns.alpha.kubernetes.io/hostname: "loki.hxme.net"
-    write:
-      replicas: 1
-    read:
-      replicas: 1
-    backend:
-      replicas: 1

old-manifests/templates/monitoring/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring

old-manifests/templates/monitoring/prometheus.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: prometheus-community
-  namespace: flux-system
-spec:
-  url: https://prometheus-community.github.io/helm-charts
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: prometheus-operator
-  namespace: monitoring
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: kube-prometheus-stack
-      version: 58.1.2
-      sourceRef:
-        kind: HelmRepository
-        name: prometheus-community
-        namespace: flux-system
-  install:
-    createNamespace: true
-  upgrade:
-    disableWait: true
-  timeout: 5m
-  values:
-    prometheus:
-      prometheusSpec:
-        serviceMonitorSelectorNilUsesHelmValues: false
-    # Optional: expose Prometheus/Grafana via NodePort, Ingress, etc.
-    grafana:
-      enabled: false
-    alertmanager:
-      enabled: true
-

old-manifests/templates/monitoring/provider.yaml

@@ -1,22 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: grafana
-  namespace: flux-system
-spec:
-  url: https://grafana.github.io/helm-charts
-  interval: 1h
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: wildcard-hxme-net
-  namespace: monitoring
-  annotations:
-    replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net

old-manifests/templates/remote/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: remote

old-manifests/templates/remote/rustdesk.yaml

@@ -1,72 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: rustdesk-charts
-  namespace: flux-system
-spec:
-  url: https://charts.rustdesk.com
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: rustdesk-server
-  namespace: remote
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: rustdesk-server
-      version: 0.5.0
-      sourceRef:
-        kind: HelmRepository
-        name: rustdesk-charts
-        namespace: flux-system
-  install:
-    createNamespace: true
-  values:
-    hbbs:
-      enabled: true
-      service:
-        type: ClusterIP
-        ports:
-          - name: tcp
-            port: 21115
-            targetPort: 21115
-          - name: tcp-hbbs
-            port: 21116
-            targetPort: 21116
-          - name: udp
-            port: 21116
-            targetPort: 21116
-            protocol: UDP
-
-    hbbr:
-      enabled: true
-      service:
-        type: ClusterIP
-        ports:
-          - name: tcp-hbbr
-            port: 21117
-            targetPort: 21117
-
-    ingress:
-      enabled: true
-      className: "traefik" # or nginx or your ingress class
-      annotations: {}
-      hosts:
-        - host: rd.hxme.net
-          paths:
-            - path: /
-              pathType: Prefix
-      tls:
-        - hosts:
-            - rd.hxme.net
-          secretName: rustdesk-tls
-
-    # Optional admin password – change this in production
-    env:
-      ENCRYPTED_ONLY: "false"
-      ENABLE_LOG: "true"
-

old-manifests/templates/social/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: social

old-manifests/templates/sync/linkwarden.yaml

@@ -1,60 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: linkwarden
-  namespace: sync
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: linkwarden
-  template:
-    metadata:
-      labels:
-        app: linkwarden
-    spec:
-      containers:
-        - name: linkwarden
-          image: ghcr.io/linkwarden/linkwarden:latest
-          ports:
-            - containerPort: 8080
-          env:
-            - name: ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: linkwarden-secret
-                  key: admin-password
-            # Add other environment variables here as needed
-          volumeMounts:
-            - name: linkwarden-data
-              mountPath: /data
-      volumes:
-        - name: linkwarden-data
-          emptyDir: {} # Change to persistentVolumeClaim for production
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: linkwarden-secret
-  namespace: sync
-type: Opaque
-stringData:
-  admin-password: "YourStrongAdminPasswordHere"
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: linkwarden
-  namespace: sync
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: lw.hxme.net
-spec:
-  selector:
-    app: linkwarden
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
-  type: ClusterIP
-

old-manifests/templates/sync/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: sync

old-manifests/templates/sync/syncthing.yaml

@@ -1,104 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: syncthing-data
-  namespace: sync
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: syncthing-share-pv
-spec:
-  capacity:
-    storage: 1000Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  hostPath:
-    path: /dpool/files
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: syncthing-share
-  namespace: sync
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1000Gi
-  volumeName: syncthing-share-pv
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: syncthing
-  namespace: sync
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: syncthing
-  template:
-    metadata:
-      labels:
-        app: syncthing
-    spec:
-      containers:
-        - name: syncthing
-          image: syncthing/syncthing:latest
-          ports:
-            - containerPort: 8384 
-            - containerPort: 22000
-            - containerPort: 21027
-              protocol: UDP
-          volumeMounts:
-            - name: syncthing-data
-              mountPath: /var/syncthing
-            - name: syncthing-share
-              mountPath: /shared 
-          securityContext:
-            runAsUser:  1000
-            runAsGroup: 1000
-            fsGroup:    1000
-      volumes:
-        - name: syncthing-data
-          persistentVolumeClaim:
-            claimName: syncthing-data
-        - name: syncthing-share
-          persistentVolumeClaim:
-            claimName: syncthing-share
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: syncthing
-  namespace: sync
-spec:
-  selector:
-    app: syncthing
-  ports:
-    - name: web-ui
-      port: 8384
-      targetPort: 8384
-    - name: sync-tcp
-      port: 22000
-      targetPort: 22000
-    - name: sync-udp
-      port: 22000
-      protocol: UDP
-      targetPort: 22000
-    - name: discovery
-      port: 21027
-      protocol: UDP
-      targetPort: 21027
-  type: ClusterIP
-

old-manifests/templates/sync/vaultwarden.yaml

@@ -1,100 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: vaultwarden
-  namespace: sync
-  labels:
-    app: vaultwarden
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: vaultwarden
-  template:
-    metadata:
-      labels:
-        app: vaultwarden
-    spec:
-      containers:
-        - name: vaultwarden
-          image: vaultwarden/server:1.30.5
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: WEBSOCKET_ENABLED
-              value: "true"
-            - name: SIGNUPS_ALLOWED
-              value: "false"
-            - name: DOMAIN
-              value: "https://vw.hxme.net"
-            - name: ADMIN_TOKEN
-              value: "CHANGEME_SUPER_SECRET"
-          ports:
-            - containerPort: 80
-              name: http
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 250m
-              memory: 512Mi
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: bitwarden-data
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: vaultwarden
-  namespace: sync
-  labels:
-    app: vaultwarden
-spec:
-  type: ClusterIP
-  selector:
-    app: vaultwarden
-  ports:
-    - name: http
-      port: 80
-      targetPort: http
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: vaultwarden
-  namespace: sync
-  annotations:
-    kubernetes.io/ingress.class: traefik
-spec:
-  rules:
-    - host: vw.hxme.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: vaultwarden
-                port:
-                  number: 80
-  tls:
-    - hosts:
-        - vw.hxme.net
-      secretName: bitwarden-tls
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: bitwarden-data
-  namespace: sync
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-

old-manifests/templates/util/Chart.yaml

@@ -1,4 +0,0 @@
-apiVersion: v2
-name: util
-description: "Utility subchart for home-server"
-version: 0.0.1

old-manifests/templates/util/templates/00-namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: util

old-manifests/templates/util/templates/10-replicator.yaml

@@ -1,98 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kubernetes-replicator
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: kubernetes-replicator
-rules:
-  - apiGroups: ["", "apps", "extensions"]
-    resources:
-      - secrets
-      - configmaps
-      - roles
-      - rolebindings
-      - cronjobs
-      - deployments
-      - events
-      - ingresses
-      - jobs
-      - pods
-      - pods/attach
-      - pods/exec
-      - pods/log
-      - pods/portforward
-      - services
-      - namespaces
-      - serviceaccounts
-    verbs: ["*"]
-  - apiGroups: ["batch"]
-    resources:
-      - configmaps
-      - cronjobs
-      - deployments
-      - events
-      - ingresses
-      - jobs
-      - pods
-      - pods/attach
-      - pods/exec
-      - pods/log
-      - pods/portforward
-      - services
-    verbs: ["*"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources:
-      - roles
-      - rolebindings
-      - clusterrolebindings
-    verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kubernetes-replicator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kubernetes-replicator
-subjects:
-  - kind: ServiceAccount
-    name: kubernetes-replicator
-    namespace: kube-system
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: mittwald
-  namespace: flux-system
-spec:
-  url: https://helm.mittwald.de
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: kubernetes-replicator
-  namespace: kube-system
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: kubernetes-replicator
-      sourceRef:
-        kind: HelmRepository
-        name: mittwald
-        namespace: flux-system
-  install:
-    createNamespace: false
-  upgrade:
-    disableWait: false
-  values:
-    serviceAccount:
-      create: false
-      name: kubernetes-replicator

old-manifests/templates/util/templates/20-certmanager.yaml

@@ -1,72 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: jetstack
-  namespace: flux-system
-spec:
-  url: https://charts.jetstack.io
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: cert-manager
-      version: v1.18.2
-      sourceRef:
-        kind: HelmRepository
-        name: jetstack
-        namespace: flux-system
-  install:
-    crds: CreateReplace
-    createNamespace: true
-  values:
-    installCRDs: true
-    extraArgs:
-      - --dns01-recursive-nameservers-only
-      - --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-rfc2136
-spec:
-  acme:
-    email: admin@hxme.net
-    server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: letsencrypt-rfc2136
-    solvers:
-    - dns01:
-        rfc2136:
-          nameserver: hawke.hxst.com.au:53
-          tsigKeyName: "hxme-update-key"
-          tsigAlgorithm: HMACSHA512
-          tsigSecretSecretRef:
-            name: hxme-update-key
-            key:  hxme-update-key
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-hxme-net
-  namespace: cert-manager
-spec:
-  secretName: wildcard-hxme-net
-  secretTemplate:
-    annotations:
-      replicator.v1.mittwald.de/replication-allowed: "true"
-      replicator.v1.mittwald.de/replicate-to: "monitoring,authentik,nextcloud"
-  issuerRef:
-    name: letsencrypt-rfc2136
-    kind: ClusterIssuer
-  commonName: "hxme.net"
-  dnsNames:
-    - "hxme.net"
-    - "*.hxme.net"

old-manifests/templates/util/templates/20-mariadb.yaml

@@ -1,60 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: mariadb-system
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: mariadb-operator
-  namespace: flux-system
-spec:
-  url: https://helm.mariadb.com/mariadb-operator
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: mariadb-operator-crds
-  namespace: mariadb-system
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: mariadb-operator-crds
-      version: 0.38.1
-      sourceRef:
-        kind: HelmRepository
-        name: mariadb-operator
-        namespace: flux-system
-  install:
-    createNamespace: true
-  upgrade:
-    disableWait: true
-  timeout: 5m
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: mariadb-operator
-  namespace: mariadb-system
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: mariadb-operator
-      version: 0.38.1
-      sourceRef:
-        kind: HelmRepository
-        name: mariadb-operator
-        namespace: flux-system
-  install:
-    createNamespace: true
-  dependsOn:
-    - name: mariadb-operator-crds
-      namespace: mariadb-system
-  values:
-    metrics:
-      enabled: true
-

old-manifests/values.yaml

@@ -1,24 +0,0 @@
-ai:
-  enabled: true
-
-dns:
-  enabled: false
-
-media:
-  enabled: true
-
-monitoring:
-  enabled: true
-
-remote:
-  enabled: false
-
-social:
-  enabled: true
-
-sync:
-  enabled: false
-
-util:
-  enabled: true
-