idk

applications/databases/databases.yaml

@@ -0,0 +1,42 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: home-server-databases
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+    - list:
+        elements:
+          - name: mariadb-operators
+            path: applications/30-databases/mariadb-operators
+            wave: 1
+          - name: mariadb-database
+            path: applications/30-databases/mariadb-database
+            wave: 2
+          - name: postgresql
+            path: applications/30-databases/postgresql
+            wave: 2
+          - name: redis
+            path: applications/30-databases/redis
+            wave: 2
+  template:
+    metadata:
+      name: '{{.name}}'
+    spec:
+      project: default
+      source:
+        repoURL: 'https://repobase.net/j/home-server.git'
+        targetRevision: HEAD
+        path: '{{.path}}'
+      destination:
+        server: 'https://kubernetes.default.svc'
+        namespace: database
+      syncPolicy:
+        automated:
+          prune: false
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+          - SyncWave={{.wave}}

applications/databases/mariadb-database/database.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: MariaDB
+metadata:
+  name: mariadb
+  namespace: database
+spec:
+  rootPasswordSecretKeyRef:
+    name: db-secrets
+    key:  db-root-password
+
+  storage:
+    size: 5Gi

applications/databases/mariadb-operators/mariadb-operators.yaml

@@ -0,0 +1,53 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: mariadb-operator-crds
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: "https://helm.mariadb.com/mariadb-operator"
+    chart: "mariadb-operator-crds"
+    targetRevision: "25.8.3"
+    helm:
+      releaseName: "mariadb-operator-crds"
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: database
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - SkipHooks=false
+      - SyncWave=0
+
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: mariadb-operator
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: "https://helm.mariadb.com/mariadb-operator"
+    chart: "mariadb-operator"
+    targetRevision: "25.8.3"
+    helm:
+      releaseName: "mariadb-operator"
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: database
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - SkipHooks=false
+      - SyncWave=1

applications/databases/postgresql/bitnami.yaml

@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: postgresql-database
+  namespace: argocd  # Replace with your Argo CD namespace if different
+spec:
+  project: default
+
+  source:
+    repoURL: https://charts.bitnami.com/bitnami
+    chart: postgresql
+    targetRevision: 16.7.26
+    helm:
+      releaseName: postgresql
+      values: |
+        auth:
+          existingSecret: postgresql-secret
+          secretKeys:
+            postgresPasswordKey: postgres-password
+            passwordKey: password
+            usernameKey: username
+            databaseKey: database
+        postgresql:
+          initdbScriptsConfigMap: postgresql-init
+        primary:
+          persistence:
+            enabled: true
+            size: 8Gi
+        architecture: standalone
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: database
+
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: false
+    syncOptions:
+      - CreateNamespace=true

applications/databases/redis/redis.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis-deployment
+  namespace: database
+  labels:
+    app: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - name: redis
+        image: redis:latest
+        ports:
+        - containerPort: 6379
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: database
+spec:
+  selector:
+    app: redis
+  ports:
+    - protocol: TCP
+      port: 6379
+      targetPort: 6379
+
+

applications/domain-names/bind/bind.yaml

@@ -0,0 +1,139 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: bind-master-config
+  namespace: home-server
+data:
+  named.conf: |
+    include "/etc/bind/externaldns-key.conf";
+
+    options {
+        directory "/var/cache/bind";
+
+        recursion yes;
+        allow-query { any; };
+
+        listen-on port 53 { any; };
+        listen-on-v6 port 53 { any; };
+
+        forwarders {
+            10.40.0.254;
+        };
+
+        dnssec-validation auto;
+    };
+
+    zone "." IN {
+        type hint;
+        file "/usr/share/dns/root.hints";
+    };
+
+    zone "hxme.net." IN {
+      type master;
+      file "/etc/bind/db.hxme.net";
+      allow-update { key "externaldns-key"; };
+    };
+  db.hxme.net: |
+    $TTL    3600
+    @       IN      SOA     ns1.hxme.net. admin.hxme.net. (
+                            1         ; Serial
+                            7200      ; Refresh
+                            1800      ; Retry
+                            1209600   ; Expire
+                            86400 )   ; Negative Cache TTL
+    ;
+    @       IN      NS      ns1.hxme.net.
+    ns1     IN      A       10.40.0.110
+    @       IN      A       10.40.0.110
+    www     IN      A       10.40.0.110
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: bind-master
+  namespace: home-server
+spec:
+  selector:
+    matchLabels:
+      app: bind-master
+  template:
+    metadata:
+      labels:
+        app: bind-master
+    spec:
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      securityContext:
+        fsGroup: 999
+      initContainers:
+        - name: fetch-root-hints
+          image: debian:12
+          command:
+            - sh
+            - -c
+            - |
+              apt update && apt -y install curl
+              curl -sfSL https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints
+          volumeMounts:
+            - mountPath: /usr/share/dns
+              name: root-hints
+      containers:
+        - name: bind-master
+          image: internetsystemsconsortium/bind9:9.18
+          command: ["named", "-g", "-c", "/etc/bind/named.conf"]
+          ports:
+            - containerPort: 53
+              protocol: UDP
+            - containerPort: 53
+              protocol: TCP
+          volumeMounts:
+            - name: config
+              mountPath: /etc/bind/named.conf
+              subPath: named.conf
+            - name: config
+              mountPath: /etc/bind/db.hxme.net
+              subPath: db.hxme.net
+            - name: dns-secrets
+              mountPath: /etc/bind/externaldns-key.conf
+              subPath: externaldns-key.conf
+            - name: bind-cache
+              mountPath: /var/cache/bind
+            - name: bind-rundir
+              mountPath: /var/run/named
+            - name: root-hints
+              mountPath: /usr/share/dns
+      volumes:
+        - name: dns-secrets
+          secret:
+            secretName: dns-secrets
+        - name: config
+          configMap:
+            name: bind-master-config
+        - name: bind-cache
+          emptyDir: {}
+        - name: bind-rundir
+          emptyDir: {}
+        - name: root-hints
+          emptyDir: {}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bind-master
+  namespace: home-server
+spec:
+  selector:
+    app: bind-master
+  ports:
+    - name: dns-udp
+      port: 53
+      protocol: UDP
+      targetPort: 53
+    - name: dns-tcp
+      port: 53
+      protocol: TCP
+      targetPort: 53
+
+

applications/domain-names/certmanager-a/certmanager-a.yaml

@@ -0,0 +1,33 @@
+---
+# 1. cert-manager Helm chart
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: "https://charts.jetstack.io"
+    chart: "cert-manager"
+    targetRevision: "v1.18.2"
+    helm:
+      releaseName: "cert-manager"
+      values: |
+        installCRDs: true
+        extraArgs:
+          - --dns01-recursive-nameservers-only
+          - --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: home-server
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - SkipHooks=false
+      - SyncWave=0   # ensure cert-manager is installed first
+

applications/domain-names/certmanager-b/certmanager-b.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-rfc2136
+spec:
+  acme:
+    email: admin@hxme.net
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-rfc2136
+    solvers:
+      - dns01:
+          rfc2136:
+            nameserver: hawke.hxst.com.au:53
+            tsigKeyName: "hxme-update-key"
+            tsigAlgorithm: HMACSHA512
+            tsigSecretSecretRef:
+              name: hxme-update-key
+              key: hxme-update-key
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-hxme-net
+  namespace: home-server
+spec:
+  secretName: wildcard-hxme-net
+  secretTemplate:
+    annotations:
+      replicator.v1.mittwald.de/replication-allowed: "true"
+      replicator.v1.mittwald.de/replicate-to: "home-media"
+  issuerRef:
+    name: letsencrypt-rfc2136
+    kind: ClusterIssuer
+  commonName: "hxme.net"
+  dnsNames:
+    - "hxme.net"
+    - "*.hxme.net"
+

applications/domain-names/dns.yaml

@@ -0,0 +1,42 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: hxme-dns-deploy
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+    - list:
+        elements:
+          - name: certmanager-crds
+            path: applications/20-domain-names/certmanager-a
+            wave: 1
+          - name: certmanager-not-crds
+            path: applications/20-domain-names/certmanager-b
+            wave: 2
+          - name: bind
+            path: applications/20-domain-names/bind
+            wave: 3
+          - name: externaldns
+            path: applications/20-domain-names/externaldns
+            wave: 3
+  template:
+    metadata:
+      name: '{{.name}}'
+    spec:
+      project: default
+      source:
+        repoURL: 'https://repobase.net/j/home-server.git'
+        targetRevision: HEAD
+        path: '{{.path}}'
+      destination:
+        server: 'https://kubernetes.default.svc'
+        namespace: database
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+          - SyncWave={{.wave}}

applications/domain-names/externaldns/externaldns.yaml

@@ -0,0 +1,78 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-dns
+rules:
+  - apiGroups: [""]
+    resources: ["services","endpoints","pods"]
+    verbs: ["get","watch","list"]
+  - apiGroups: ["extensions","networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get","watch","list"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["list","watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "watch", "list"]
+  # Add DNS provider specific rules here if needed (e.g., for AWS IAM, GCP etc.)
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-viewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns
+subjects:
+  - kind: ServiceAccount
+    name: external-dns
+    namespace: home-server
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-dns
+  namespace: home-server
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: external-dns
+  namespace: home-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: external-dns
+  template:
+    metadata:
+      labels:
+        app: external-dns
+    spec:
+      serviceAccountName: external-dns
+      containers:
+      - name: external-dns
+        image: bitnami/external-dns:latest
+        args:
+          - --source=service
+          - --source=ingress
+          - --provider=rfc2136
+          - --rfc2136-host=bind-master.home-server.svc.cluster.local
+          - --rfc2136-port=53
+          - --rfc2136-zone=hxme.net
+          - --rfc2136-tsig-secret=$(RFC2136_TSIG_SECRET)
+          - --rfc2136-tsig-secret-alg=hmac-sha256
+          - --rfc2136-tsig-keyname=externaldns-key
+          - --policy=sync
+          - --registry=txt
+          - --txt-owner-id=my-cluster
+        env:
+            - name: RFC2136_TSIG_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: dns-secrets
+                  key: externaldns-secret
+

applications/replicator/replicator.yaml

@@ -0,0 +1,91 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubernetes-replicator
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubernetes-replicator
+rules:
+  - apiGroups: ["", "apps", "extensions"]
+    resources:
+      - secrets
+      - configmaps
+      - roles
+      - rolebindings
+      - cronjobs
+      - deployments
+      - events
+      - ingresses
+      - jobs
+      - pods
+      - pods/attach
+      - pods/exec
+      - pods/log
+      - pods/portforward
+      - services
+      - namespaces
+      - serviceaccounts
+    verbs: ["*"]
+  - apiGroups: ["batch"]
+    resources:
+      - configmaps
+      - cronjobs
+      - deployments
+      - events
+      - ingresses
+      - jobs
+      - pods
+      - pods/attach
+      - pods/exec
+      - pods/log
+      - pods/portforward
+      - services
+    verbs: ["*"]
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources:
+      - roles
+      - rolebindings
+      - clusterrolebindings
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubernetes-replicator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubernetes-replicator
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-replicator
+    namespace: kube-system
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kubernetes-replicator
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: "https://helm.mittwald.de"
+    chart: "kubernetes-replicator"
+    targetRevision: "2.12.0"
+    helm:
+      releaseName: "kubernetes-replicator"
+      values: |
+        serviceAccount:
+          create: false
+          name: kubernetes-replicator
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

deploy.old/server.yaml

@@ -0,0 +1,76 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: deploy-hxme
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+    - list:
+        elements:
+          - name: deploy-eso
+            path: applications/10-external-secrets
+            namespace: home-server
+            wave: 1
+
+          - name: deploy-replicator
+            path: applications/10-replicator
+            namespace: home-server
+            wave: 2
+
+          - name: deploy-dns
+            path: applications/20-domain-names
+            namespace: home-server
+            wave: 3
+
+          - name: deploy-databases
+            path: applications/30-databases
+            namespace: database
+            wave: 4
+
+          - name: deploy-authentik
+            path: applications/40-authentik
+            namespace: home-server
+            wave: 5
+
+          - name: deploy-nextcloud
+            path: applications/50-nextcloud
+            namespace: home-server
+            wave: 6
+
+          - name: deploy-general-shit
+            path: applications/60-general-shit
+            namespace: home-server
+            wave: 7
+
+          - name: deploy-monitoring
+            path: applications/70-monitoring
+            namespace: home-server
+            wave: 8
+
+          - name: deploy-private
+            path: applications/80-private
+            namespace: home-server-private
+            wave: 9
+
+  template:
+    metadata:
+      name: "{{.name}}"
+    spec:
+      project: default
+      source:
+        repoURL: 'https://repobase.net/j/home-server.git'
+        targetRevision: main 
+        path: "{{.path}}"
+      destination:
+        server: 'https://kubernetes.default.svc'
+        namespace: '{{.namespace}}'
+      syncPolicy:
+        automated:
+          enabled: true
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+          - SyncWave={{.wave}}

deploy/server.yaml

@@ -9,50 +9,20 @@ spec:
   generators:
     - list:
         elements:
-          - name: deploy-eso
+          - name: deploy-domain-names
-            path: applications/10-external-secrets
+            path: applications/domain-names
             namespace: home-server
             wave: 1
 
           - name: deploy-replicator
-            path: applications/10-replicator
+            path: applications/replicator
             namespace: home-server
             wave: 2
 
-          - name: deploy-dns
-            path: applications/20-domain-names
-            namespace: home-server
-            wave: 3
-
           - name: deploy-databases
-            path: applications/30-databases
+            path: applications/databases
             namespace: database
-            wave: 4
+            wave: 3
-
-          - name: deploy-authentik
-            path: applications/40-authentik
-            namespace: home-server
-            wave: 5
-
-          - name: deploy-nextcloud
-            path: applications/50-nextcloud
-            namespace: home-server
-            wave: 6
-
-          - name: deploy-general-shit
-            path: applications/60-general-shit
-            namespace: home-server
-            wave: 7
-
-          - name: deploy-monitoring
-            path: applications/70-monitoring
-            namespace: home-server
-            wave: 8
-
-          - name: deploy-private
-            path: applications/80-private
-            namespace: home-server-private
-            wave: 9
 
   template:
     metadata: