Just incase; put chart into chart
This commit is contained in:
parent
526aaa1dd8
commit
6b56e35f68
18 changed files with 1 additions and 1 deletions
6
chart/Chart.yaml
Normal file
6
chart/Chart.yaml
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: v2
|
||||
name: home-server
|
||||
description: A Helm chart for deploying the home-server application
|
||||
type: application
|
||||
version: 0.1.3
|
||||
appVersion: "1.0.0"
|
||||
71
chart/templates/ai-openweb.yaml
Normal file
71
chart/templates/ai-openweb.yaml
Normal file
|
|
@ -0,0 +1,71 @@
|
|||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: openwebui
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: openwebui
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: openwebui
|
||||
spec:
|
||||
containers:
|
||||
- name: openwebui
|
||||
image: ghcr.io/open-webui/open-webui:latest
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
env:
|
||||
- name: OLLAMA_BASE_URL
|
||||
value: http://ollama:11434
|
||||
volumeMounts:
|
||||
- name: ai-storage
|
||||
mountPath: /app/backend/data
|
||||
volumes:
|
||||
- name: ai-storage
|
||||
hostPath:
|
||||
path: /dpool/files/ai/
|
||||
type: Directory
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: openwebui
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
selector:
|
||||
app: openwebui
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: openwebui
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "traefik"
|
||||
external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
|
||||
spec:
|
||||
rules:
|
||||
- host: ai.hxme.net
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: openwebui
|
||||
port:
|
||||
number: 80
|
||||
tls:
|
||||
- hosts:
|
||||
- ai.hxme.net
|
||||
secretName: openwebui-tls
|
||||
|
||||
45
chart/templates/auth-authentik.yaml
Normal file
45
chart/templates/auth-authentik.yaml
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: authentik
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
url: https://charts.goauthentik.io/
|
||||
interval: 1h
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: authentik
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: authentik
|
||||
version: 2024.4.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: authentik
|
||||
namespace: {{ .Release.Namespace }}
|
||||
install:
|
||||
createNamespace: true
|
||||
upgrade:
|
||||
disableWait: false
|
||||
timeout: 10m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
name: authentik-values
|
||||
values:
|
||||
server:
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: auth.hxme.net
|
||||
hosts:
|
||||
- auth.hxme.net
|
||||
tls:
|
||||
- secretName: wildcard-hxme-net
|
||||
hosts:
|
||||
- auth.hxme.net
|
||||
138
chart/templates/dns-bind.yaml
Normal file
138
chart/templates/dns-bind.yaml
Normal file
|
|
@ -0,0 +1,138 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: bind-master-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
named.conf: |
|
||||
include "/etc/bind/externaldns-key.conf";
|
||||
|
||||
options {
|
||||
directory "/var/cache/bind";
|
||||
|
||||
recursion yes;
|
||||
allow-query { any; };
|
||||
|
||||
listen-on port 53 { any; };
|
||||
listen-on-v6 port 53 { any; };
|
||||
|
||||
forwarders {
|
||||
10.40.0.254;
|
||||
};
|
||||
|
||||
dnssec-validation auto;
|
||||
};
|
||||
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "/usr/share/dns/root.hints";
|
||||
};
|
||||
|
||||
zone "hxme.net." IN {
|
||||
type master;
|
||||
file "/etc/bind/db.hxme.net";
|
||||
allow-update { key "externaldns-key"; };
|
||||
};
|
||||
db.hxme.net: |
|
||||
$TTL 3600
|
||||
@ IN SOA ns1.hxme.net. admin.hxme.net. (
|
||||
1 ; Serial
|
||||
7200 ; Refresh
|
||||
1800 ; Retry
|
||||
1209600 ; Expire
|
||||
86400 ) ; Negative Cache TTL
|
||||
;
|
||||
@ IN NS ns1.hxme.net.
|
||||
ns1 IN A 10.40.0.110
|
||||
@ IN A 10.40.0.110
|
||||
www IN A 10.40.0.110
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: bind-master
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bind-master
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bind-master
|
||||
spec:
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
securityContext:
|
||||
fsGroup: 999
|
||||
initContainers:
|
||||
- name: fetch-root-hints
|
||||
image: debian:12
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
apt update && apt -y install curl
|
||||
curl -sfSL https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints
|
||||
volumeMounts:
|
||||
- mountPath: /usr/share/dns
|
||||
name: root-hints
|
||||
containers:
|
||||
- name: bind-master
|
||||
image: internetsystemsconsortium/bind9:9.18
|
||||
command: ["named", "-g", "-c", "/etc/bind/named.conf"]
|
||||
ports:
|
||||
- containerPort: 53
|
||||
protocol: UDP
|
||||
- containerPort: 53
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/bind/named.conf
|
||||
subPath: named.conf
|
||||
- name: config
|
||||
mountPath: /etc/bind/db.hxme.net
|
||||
subPath: db.hxme.net
|
||||
- name: dns-secrets
|
||||
mountPath: /etc/bind/externaldns-key.conf
|
||||
subPath: externaldns-key.conf
|
||||
- name: bind-cache
|
||||
mountPath: /var/cache/bind
|
||||
- name: bind-rundir
|
||||
mountPath: /var/run/named
|
||||
- name: root-hints
|
||||
mountPath: /usr/share/dns
|
||||
volumes:
|
||||
- name: dns-secrets
|
||||
secret:
|
||||
secretName: dns-secrets
|
||||
- name: config
|
||||
configMap:
|
||||
name: bind-master-config
|
||||
- name: bind-cache
|
||||
emptyDir: {}
|
||||
- name: bind-rundir
|
||||
emptyDir: {}
|
||||
- name: root-hints
|
||||
emptyDir: {}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: bind-master
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
selector:
|
||||
app: bind-master
|
||||
ports:
|
||||
- name: dns-udp
|
||||
port: 53
|
||||
protocol: UDP
|
||||
targetPort: 53
|
||||
- name: dns-tcp
|
||||
port: 53
|
||||
protocol: TCP
|
||||
targetPort: 53
|
||||
|
||||
78
chart/templates/dns-externaldns.yaml
Normal file
78
chart/templates/dns-externaldns.yaml
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: external-dns
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services","endpoints","pods"]
|
||||
verbs: ["get","watch","list"]
|
||||
- apiGroups: ["extensions","networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get","watch","list"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["list","watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
# Add DNS provider specific rules here if needed (e.g., for AWS IAM, GCP etc.)
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: external-dns-viewer
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: external-dns
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: external-dns
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: external-dns
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: external-dns
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: external-dns
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: external-dns
|
||||
spec:
|
||||
serviceAccountName: external-dns
|
||||
containers:
|
||||
- name: external-dns
|
||||
image: bitnami/external-dns:latest
|
||||
args:
|
||||
- --source=service
|
||||
- --source=ingress
|
||||
- --provider=rfc2136
|
||||
- --rfc2136-host=bind-master.{{ .Release.Namespace }}.svc.cluster.local
|
||||
- --rfc2136-port=53
|
||||
- --rfc2136-zone=hxme.net
|
||||
- --rfc2136-tsig-secret=$(RFC2136_TSIG_SECRET)
|
||||
- --rfc2136-tsig-secret-alg=hmac-sha256
|
||||
- --rfc2136-tsig-keyname=externaldns-key
|
||||
- --policy=sync
|
||||
- --registry=txt
|
||||
- --txt-owner-id=my-cluster
|
||||
env:
|
||||
- name: RFC2136_TSIG_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: dns-secrets
|
||||
key: externaldns-secret
|
||||
|
||||
129
chart/templates/files-nextcloud.yaml
Normal file
129
chart/templates/files-nextcloud.yaml
Normal file
|
|
@ -0,0 +1,129 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: nextcloud-pv
|
||||
spec:
|
||||
capacity:
|
||||
storage: 10Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: local-path
|
||||
hostPath:
|
||||
path: /dpool/temp/Nextcloud
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nextcloud-pvc
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-path
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
volumeName: nextcloud-pv
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nextcloud
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 80
|
||||
selector:
|
||||
app: nextcloud
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nextcloud
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nextcloud
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nextcloud
|
||||
spec:
|
||||
containers:
|
||||
- name: nextcloud
|
||||
image: nextcloud:29
|
||||
env:
|
||||
- name: MYSQL_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nextcloud-secrets
|
||||
key: MYSQL_PASSWORD
|
||||
- name: MYSQL_DATABASE
|
||||
value: nextcloud
|
||||
- name: MYSQL_USER
|
||||
value: nextcloud
|
||||
- name: MYSQL_HOST
|
||||
value: mariadb
|
||||
ports:
|
||||
- containerPort: 80
|
||||
volumeMounts:
|
||||
- name: nextcloud-data
|
||||
mountPath: /var/www/html
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
volumes:
|
||||
- name: nextcloud-data
|
||||
persistentVolumeClaim:
|
||||
claimName: nextcloud-pvc
|
||||
---
|
||||
apiVersion: k8s.mariadb.com/v1alpha1
|
||||
kind: MariaDB
|
||||
metadata:
|
||||
name: nextcloud-db
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
rootPasswordSecretKeyRef:
|
||||
name: nextcloud-secrets
|
||||
key: MYSQL_ROOT_PASSWORD
|
||||
database: nextcloud
|
||||
username: nextcloud
|
||||
passwordSecretKeyRef:
|
||||
name: nextcloud-secrets
|
||||
key: MYSQL_PASSWORD
|
||||
image: mariadb:10.11
|
||||
storage:
|
||||
size: 5Gi
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: nextcloud
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- nc.hxme.net
|
||||
secretName: wildcard-hxme-net
|
||||
rules:
|
||||
- host: nc.hxme.net
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: nextcloud
|
||||
port:
|
||||
number: 80
|
||||
|
||||
104
chart/templates/files-syncthing.yaml
Normal file
104
chart/templates/files-syncthing.yaml
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: syncthing-data
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: syncthing-share-pv
|
||||
spec:
|
||||
capacity:
|
||||
storage: 1000Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
hostPath:
|
||||
path: /dpool/files
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: syncthing-share
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1000Gi
|
||||
volumeName: syncthing-share-pv
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: syncthing
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: syncthing
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: syncthing
|
||||
spec:
|
||||
containers:
|
||||
- name: syncthing
|
||||
image: syncthing/syncthing:latest
|
||||
ports:
|
||||
- containerPort: 8384
|
||||
- containerPort: 22000
|
||||
- containerPort: 21027
|
||||
protocol: UDP
|
||||
volumeMounts:
|
||||
- name: syncthing-data
|
||||
mountPath: /var/syncthing
|
||||
- name: syncthing-share
|
||||
mountPath: /shared
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
volumes:
|
||||
- name: syncthing-data
|
||||
persistentVolumeClaim:
|
||||
claimName: syncthing-data
|
||||
- name: syncthing-share
|
||||
persistentVolumeClaim:
|
||||
claimName: syncthing-share
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: syncthing
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
selector:
|
||||
app: syncthing
|
||||
ports:
|
||||
- name: web-ui
|
||||
port: 8384
|
||||
targetPort: 8384
|
||||
- name: sync-tcp
|
||||
port: 22000
|
||||
targetPort: 22000
|
||||
- name: sync-udp
|
||||
port: 22000
|
||||
protocol: UDP
|
||||
targetPort: 22000
|
||||
- name: discovery
|
||||
port: 21027
|
||||
protocol: UDP
|
||||
targetPort: 21027
|
||||
type: ClusterIP
|
||||
|
||||
37
chart/templates/monitoring-grafana.yaml
Normal file
37
chart/templates/monitoring-grafana.yaml
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: grafana
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: grafana
|
||||
version: 7.3.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: grafana
|
||||
namespace: {{ .Release.Namespace }}
|
||||
install:
|
||||
createNamespace: true
|
||||
values:
|
||||
admin:
|
||||
existingSecret: grafana-admin-secret
|
||||
userKey: admin-user
|
||||
passwordKey: admin-password
|
||||
service:
|
||||
type: LoadBalancer
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: "grafana.hxme.net"
|
||||
datasources:
|
||||
datasources.yaml:
|
||||
apiVersion: 1
|
||||
datasources:
|
||||
- name: Loki
|
||||
type: loki
|
||||
access: proxy
|
||||
url: http://loki:3100
|
||||
isDefault: true
|
||||
|
||||
33
chart/templates/monitoring-loki.yaml
Normal file
33
chart/templates/monitoring-loki.yaml
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: loki
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: loki
|
||||
version: 6.6.4
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: grafana
|
||||
namespace: {{ .Release.Namespace }}
|
||||
install:
|
||||
createNamespace: true
|
||||
values:
|
||||
loki:
|
||||
auth_enabled: false
|
||||
singleBinary:
|
||||
replicas: 1
|
||||
service:
|
||||
type: LoadBalancer
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: "loki.hxme.net"
|
||||
write:
|
||||
replicas: 1
|
||||
read:
|
||||
replicas: 1
|
||||
backend:
|
||||
replicas: 1
|
||||
40
chart/templates/monitoring-prometheus.yaml
Normal file
40
chart/templates/monitoring-prometheus.yaml
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: prometheus-community
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
url: https://prometheus-community.github.io/helm-charts
|
||||
interval: 1h
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: prometheus-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: kube-prometheus-stack
|
||||
version: 58.1.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: prometheus-community
|
||||
namespace: {{ .Release.Namespace }}
|
||||
install:
|
||||
createNamespace: false
|
||||
upgrade:
|
||||
disableWait: true
|
||||
timeout: 5m
|
||||
values:
|
||||
prometheus:
|
||||
prometheusSpec:
|
||||
serviceMonitorSelectorNilUsesHelmValues: false
|
||||
# Optional: expose Prometheus/Grafana via NodePort, Ingress, etc.
|
||||
grafana:
|
||||
enabled: false
|
||||
alertmanager:
|
||||
enabled: true
|
||||
|
||||
9
chart/templates/monitoring-provider.yaml
Normal file
9
chart/templates/monitoring-provider.yaml
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: grafana
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
url: https://grafana.github.io/helm-charts
|
||||
interval: 1h
|
||||
55
chart/templates/operators-mariadb.yaml
Normal file
55
chart/templates/operators-mariadb.yaml
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: mariadb-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
url: https://helm.mariadb.com/mariadb-operator
|
||||
interval: 1h
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: mariadb-operator-crds
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: mariadb-operator-crds
|
||||
version: 0.38.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: mariadb-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
install:
|
||||
createNamespace: true
|
||||
upgrade:
|
||||
disableWait: true
|
||||
timeout: 5m
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: mariadb-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: mariadb-operator
|
||||
version: 0.38.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: mariadb-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
install:
|
||||
createNamespace: true
|
||||
dependsOn:
|
||||
- name: mariadb-operator-crds
|
||||
namespace: {{ .Release.Namespace }}
|
||||
values:
|
||||
metrics:
|
||||
enabled: true
|
||||
|
||||
98
chart/templates/operators-replicator.yaml
Normal file
98
chart/templates/operators-replicator.yaml
Normal file
|
|
@ -0,0 +1,98 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kubernetes-replicator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kubernetes-replicator
|
||||
rules:
|
||||
- apiGroups: ["", "apps", "extensions"]
|
||||
resources:
|
||||
- secrets
|
||||
- configmaps
|
||||
- roles
|
||||
- rolebindings
|
||||
- cronjobs
|
||||
- deployments
|
||||
- events
|
||||
- ingresses
|
||||
- jobs
|
||||
- pods
|
||||
- pods/attach
|
||||
- pods/exec
|
||||
- pods/log
|
||||
- pods/portforward
|
||||
- services
|
||||
- namespaces
|
||||
- serviceaccounts
|
||||
verbs: ["*"]
|
||||
- apiGroups: ["batch"]
|
||||
resources:
|
||||
- configmaps
|
||||
- cronjobs
|
||||
- deployments
|
||||
- events
|
||||
- ingresses
|
||||
- jobs
|
||||
- pods
|
||||
- pods/attach
|
||||
- pods/exec
|
||||
- pods/log
|
||||
- pods/portforward
|
||||
- services
|
||||
verbs: ["*"]
|
||||
- apiGroups: ["rbac.authorization.k8s.io"]
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
- clusterrolebindings
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kubernetes-replicator
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kubernetes-replicator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubernetes-replicator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: mittwald
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
url: https://helm.mittwald.de
|
||||
interval: 1h
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kubernetes-replicator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
interval: 5m
|
||||
chart:
|
||||
spec:
|
||||
chart: kubernetes-replicator
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: mittwald
|
||||
namespace: {{ .Release.Namespace }}
|
||||
install:
|
||||
createNamespace: false
|
||||
upgrade:
|
||||
disableWait: false
|
||||
values:
|
||||
serviceAccount:
|
||||
create: false
|
||||
name: kubernetes-replicator
|
||||
72
chart/templates/remote-access-rustdesk.yaml
Normal file
72
chart/templates/remote-access-rustdesk.yaml
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: rustdesk-charts
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
url: https://charts.rustdesk.com
|
||||
interval: 1h
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: rustdesk-server
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: rustdesk-server
|
||||
version: 0.5.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: rustdesk-charts
|
||||
namespace: {{ .Release.Namespace }}
|
||||
install:
|
||||
createNamespace: true
|
||||
values:
|
||||
hbbs:
|
||||
enabled: true
|
||||
service:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: tcp
|
||||
port: 21115
|
||||
targetPort: 21115
|
||||
- name: tcp-hbbs
|
||||
port: 21116
|
||||
targetPort: 21116
|
||||
- name: udp
|
||||
port: 21116
|
||||
targetPort: 21116
|
||||
protocol: UDP
|
||||
|
||||
hbbr:
|
||||
enabled: true
|
||||
service:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: tcp-hbbr
|
||||
port: 21117
|
||||
targetPort: 21117
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: "traefik" # or nginx or your ingress class
|
||||
annotations: {}
|
||||
hosts:
|
||||
- host: rd.hxme.net
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- rd.hxme.net
|
||||
secretName: rustdesk-tls
|
||||
|
||||
# Optional admin password – change this in production
|
||||
env:
|
||||
ENCRYPTED_ONLY: "false"
|
||||
ENABLE_LOG: "true"
|
||||
|
||||
72
chart/templates/ssl-certmanager.yaml
Normal file
72
chart/templates/ssl-certmanager.yaml
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: jetstack
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
url: https://charts.jetstack.io
|
||||
interval: 1h
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: cert-manager
|
||||
version: v1.18.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: jetstack
|
||||
namespace: {{ .Release.Namespace }}
|
||||
install:
|
||||
crds: CreateReplace
|
||||
createNamespace: false
|
||||
values:
|
||||
installCRDs: true
|
||||
extraArgs:
|
||||
- --dns01-recursive-nameservers-only
|
||||
- --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-rfc2136
|
||||
spec:
|
||||
acme:
|
||||
email: admin@hxme.net
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-rfc2136
|
||||
solvers:
|
||||
- dns01:
|
||||
rfc2136:
|
||||
nameserver: hawke.hxst.com.au:53
|
||||
tsigKeyName: "hxme-update-key"
|
||||
tsigAlgorithm: HMACSHA512
|
||||
tsigSecretSecretRef:
|
||||
name: hxme-update-key
|
||||
key: hxme-update-key
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: wildcard-hxme-net
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
secretName: wildcard-hxme-net
|
||||
secretTemplate:
|
||||
annotations:
|
||||
replicator.v1.mittwald.de/replication-allowed: "true"
|
||||
replicator.v1.mittwald.de/replicate-to: "monitoring,authentik,nextcloud"
|
||||
issuerRef:
|
||||
name: letsencrypt-rfc2136
|
||||
kind: ClusterIssuer
|
||||
commonName: "hxme.net"
|
||||
dnsNames:
|
||||
- "hxme.net"
|
||||
- "*.hxme.net"
|
||||
74
chart/templates/synctools-vaultwarden.yaml
Normal file
74
chart/templates/synctools-vaultwarden.yaml
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: bjw-s-charts
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
url: https://bjw-s.github.io/helm-charts/
|
||||
interval: 1h
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: vaultwarden
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 2.4.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s-charts
|
||||
namespace: {{ .Release.Namespace }}
|
||||
install:
|
||||
createNamespace: true
|
||||
values:
|
||||
# Basic container config
|
||||
image:
|
||||
repository: vaultwarden/server
|
||||
tag: 1.30.5
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
env:
|
||||
WEBSOCKET_ENABLED: "true"
|
||||
SIGNUPS_ALLOWED: "false"
|
||||
DOMAIN: "https://vw.hxme.net"
|
||||
ADMIN_TOKEN: "CHANGEME_SUPER_SECRET"
|
||||
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
|
||||
ingress:
|
||||
main:
|
||||
enabled: true
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "traefik" # Or nginx or your ingress class
|
||||
hosts:
|
||||
- host: vw.hxme.net
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- vw.hxme.net
|
||||
secretName: bitwarden-tls
|
||||
|
||||
persistence:
|
||||
data:
|
||||
enabled: true
|
||||
existingClaim: bitwarden-data # You must create a PVC or a StorageClass dynamic claim
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
|
||||
16
chart/values.yaml
Normal file
16
chart/values.yaml
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
global:
|
||||
domain: hxme.net
|
||||
ssl_secret_name: wildcard-hxme-net
|
||||
namespace: hsp-system
|
||||
issuerName: letsencrypt-rfc2136
|
||||
email: admin@hxme.net
|
||||
|
||||
rfc2136:
|
||||
nameserver: hawke.hxst.com.au:53
|
||||
tsigKeyName: hxme-update-key
|
||||
tsigAlgorithm: HMACSHA512
|
||||
tsigSecretName: hxme-update-key
|
||||
tsigSecretKey: hxme-update-key
|
||||
|
||||
replicatorNamespaces: "monitoring,authentik,nextcloud"
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue