diff --git a/Chart.yaml b/Chart.yaml index 7991e33..758bc24 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -4,14 +4,3 @@ description: A Helm chart for deploying the home-server application type: application version: 0.1.0 appVersion: "1.0.0" - -dependencies: - - name: subcharts - version: 0.1.0 - repository: "file://charts/subcharts" - - name: dns - version: 0.1.0 - repository: "file://charts/dns" - - name: nextcloud - version: 0.1.0 - repository: "file://charts/nextcloud" diff --git a/charts/dns/Chart.yaml b/charts/dns/Chart.yaml deleted file mode 100644 index 79489eb..0000000 --- a/charts/dns/Chart.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v2 -name: home-server-dns -description: Deploys the DNS setup -type: application -version: 0.1.0 diff --git a/charts/dns/values.yaml b/charts/dns/values.yaml deleted file mode 100644 index d36eb41..0000000 --- a/charts/dns/values.yaml +++ /dev/null @@ -1,2 +0,0 @@ -domain: "auth.dev.hxme.net" -certSecretName: "wildcard-hxme-net" diff --git a/charts/nextcloud/Chart.yaml b/charts/nextcloud/Chart.yaml deleted file mode 100644 index e08ae17..0000000 --- a/charts/nextcloud/Chart.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v2 -name: home-server-nextcloud -description: Deploys the Nextcloud setup -type: application -version: 0.1.0 diff --git a/charts/nextcloud/values.yaml b/charts/nextcloud/values.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/charts/subcharts/Chart.lock b/charts/subcharts/Chart.lock deleted file mode 100644 index e6f2224..0000000 --- a/charts/subcharts/Chart.lock +++ /dev/null @@ -1,9 +0,0 @@ -dependencies: -- name: mariadb-operator-crds - repository: https://helm.mariadb.com/mariadb-operator - version: 0.38.1 -- name: mariadb-operator - repository: https://helm.mariadb.com/mariadb-operator - version: 0.38.1 -digest: sha256:488ca12800fb05f4a89dd178558f544c44f0d7af11bb07010031e45e38df3a28 -generated: "2025-07-05T14:11:03.425098652Z" diff --git a/charts/subcharts/Chart.yaml b/charts/subcharts/Chart.yaml deleted file mode 100644 index 5bd7f27..0000000 --- a/charts/subcharts/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: home-server-subcharts -version: 0.1.0 -dependencies: - - name: cert-manager - version: v1.18.2 - repository: https://charts.jetstack.io diff --git a/charts/subcharts/templates/cert-manager.yaml b/charts/subcharts/templates/cert-manager.yaml deleted file mode 100644 index ebe0c26..0000000 --- a/charts/subcharts/templates/cert-manager.yaml +++ /dev/null @@ -1,40 +0,0 @@ ---- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: {{ .Values.global.issuerName }} -spec: - acme: - email: {{ .Values.global.email | quote }} - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: {{ .Values.global.issuerName }} - solvers: - - dns01: - rfc2136: - nameserver: {{ .Values.global.rfc2136.nameserver | quote }} - tsigKeyName: {{ .Values.global.rfc2136.tsigKeyName | quote }} - tsigAlgorithm: {{ .Values.global.rfc2136.tsigAlgorithm | quote }} - tsigSecretSecretRef: - name: {{ .Values.global.rfc2136.tsigSecretName | quote }} - key: {{ .Values.global.rfc2136.tsigSecretKey | quote }} ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: {{ .Values.global.ssl_secret_name }} - namespace: {{ .Values.global.namespace }} -spec: - secretName: {{ .Values.global.ssl_secret_name }} - secretTemplate: - annotations: - replicator.v1.mittwald.de/replication-allowed: "true" - replicator.v1.mittwald.de/replicate-to: "{{ .Values.global.replicatorNamespaces }}" - issuerRef: - name: {{ .Values.global.issuerName }} - kind: ClusterIssuer - commonName: {{ .Values.global.domain | quote }} - dnsNames: - - {{ .Values.global.domain | quote }} - - "*.{{ .Values.global.domain }}" - diff --git a/charts/subcharts/values.yaml b/charts/subcharts/values.yaml deleted file mode 100644 index b7386ca..0000000 --- a/charts/subcharts/values.yaml +++ /dev/null @@ -1,9 +0,0 @@ -mariadbNamespace: mariadb-system-dev - -mariadb-operator: - fullnameOverride: mariadb-operator - namespaceOverride: mariadb-system - metrics: - enabled: true - -mariadb-operator-crds: {} diff --git a/templates/ai-openweb.yaml b/templates/ai-openweb.yaml new file mode 100644 index 0000000..e2c52ea --- /dev/null +++ b/templates/ai-openweb.yaml @@ -0,0 +1,76 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: ai +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openwebui + namespace: ai +spec: + replicas: 1 + selector: + matchLabels: + app: openwebui + template: + metadata: + labels: + app: openwebui + spec: + containers: + - name: openwebui + image: ghcr.io/open-webui/open-webui:latest + ports: + - containerPort: 8080 + env: + - name: OLLAMA_BASE_URL + value: http://ollama:11434 + volumeMounts: + - name: ai-storage + mountPath: /app/backend/data + volumes: + - name: ai-storage + hostPath: + path: /dpool/files/ai/ + type: Directory +--- +apiVersion: v1 +kind: Service +metadata: + name: openwebui + namespace: ai +spec: + selector: + app: openwebui + ports: + - protocol: TCP + port: 80 + targetPort: 8080 +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openwebui + namespace: ai + annotations: + kubernetes.io/ingress.class: "traefik" + external-dns.alpha.kubernetes.io/hostname: nc.hxme.net +spec: + rules: + - host: ai.hxme.net + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: openwebui + port: + number: 80 + tls: + - hosts: + - ai.hxme.net + secretName: openwebui-tls + diff --git a/templates/auth-authentik.yaml b/templates/auth-authentik.yaml new file mode 100644 index 0000000..ced40ed --- /dev/null +++ b/templates/auth-authentik.yaml @@ -0,0 +1,54 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: authentik +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: authentik + namespace: flux-system +spec: + url: https://charts.goauthentik.io/ + interval: 1h +--- +apiVersion: v1 +kind: Secret +metadata: + name: wildcard-hxme-net + namespace: authentik + annotations: + replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: authentik + namespace: authentik +spec: + interval: 30m + chart: + spec: + chart: authentik + version: 2024.4.2 + sourceRef: + kind: HelmRepository + name: authentik + namespace: flux-system + install: + createNamespace: true + upgrade: + disableWait: false + timeout: 10m + valuesFrom: + - kind: Secret + name: authentik-values + values: + ingress: + annotations: + external-dns.alpha.kubernetes.io/hostname: auth.hxme.net + tls: + - secretName: wildcard-hxme-net + hosts: + - auth.hxme.net diff --git a/charts/dns/templates/bind-master.yaml b/templates/dns-bind.yaml similarity index 96% rename from charts/dns/templates/bind-master.yaml rename to templates/dns-bind.yaml index 3facb5b..23eab06 100644 --- a/charts/dns/templates/bind-master.yaml +++ b/templates/dns-bind.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: bind-master-config - namespace: {{ .Release.Namespace }} + namespace: dns data: named.conf: | include "/etc/bind/externaldns-key.conf"; @@ -52,7 +52,7 @@ apiVersion: apps/v1 kind: DaemonSet metadata: name: bind-master - namespace: {{ .Release.Namespace }} + namespace: dns spec: selector: matchLabels: @@ -122,9 +122,8 @@ apiVersion: v1 kind: Service metadata: name: bind-master - namespace: {{ .Release.Namespace }} + namespace: dns spec: - type: ClusterIP selector: app: bind-master ports: diff --git a/charts/dns/templates/externaldns.yaml b/templates/dns-externaldns.yaml similarity index 85% rename from charts/dns/templates/externaldns.yaml rename to templates/dns-externaldns.yaml index a3291b0..ed64c21 100644 --- a/charts/dns/templates/externaldns.yaml +++ b/templates/dns-externaldns.yaml @@ -3,7 +3,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: external-dns - namespace: {{ .Release.Namespace }} rules: - apiGroups: [""] resources: ["services","endpoints","pods"] @@ -14,15 +13,12 @@ rules: - apiGroups: [""] resources: ["nodes"] verbs: ["list","watch"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "watch", "list"] + # Add DNS provider specific rules here if needed (e.g., for AWS IAM, GCP etc.) --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: external-dns-viewer - namespace: {{ .Release.Namespace }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -30,19 +26,19 @@ roleRef: subjects: - kind: ServiceAccount name: external-dns - namespace: {{ .Release.Namespace }} + namespace: dns --- apiVersion: v1 kind: ServiceAccount metadata: name: external-dns - namespace: {{ .Release.Namespace }} + namespace: dns --- apiVersion: apps/v1 kind: Deployment metadata: name: external-dns - namespace: {{ .Release.Namespace }} + namespace: dns spec: replicas: 1 selector: @@ -77,4 +73,3 @@ spec: name: dns-secrets key: externaldns-secret - diff --git a/templates/dns-namespace.yaml b/templates/dns-namespace.yaml new file mode 100644 index 0000000..52c7228 --- /dev/null +++ b/templates/dns-namespace.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: dns diff --git a/charts/nextcloud/templates/nextcloud.yaml b/templates/files-nextcloud.yaml similarity index 90% rename from charts/nextcloud/templates/nextcloud.yaml rename to templates/files-nextcloud.yaml index a6ae33e..2ef2de0 100644 --- a/charts/nextcloud/templates/nextcloud.yaml +++ b/templates/files-nextcloud.yaml @@ -1,9 +1,13 @@ --- apiVersion: v1 +kind: Namespace +metadata: + name: nextcloud +--- +apiVersion: v1 kind: PersistentVolume metadata: name: nextcloud-pv - namespace: {{ .Release.Namespace }} spec: capacity: storage: 10Gi @@ -18,7 +22,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: name: nextcloud-pvc - namespace: {{ .Release.Namespace }} + namespace: nextcloud spec: accessModes: - ReadWriteOnce @@ -32,7 +36,7 @@ apiVersion: v1 kind: Service metadata: name: nextcloud - namespace: {{ .Release.Namespace }} + namespace: nextcloud spec: ports: - port: 80 @@ -43,7 +47,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: nextcloud - namespace: {{ .Release.Namespace }} + namespace: nextcloud spec: securityContext: runAsUser: 1000 @@ -90,7 +94,7 @@ apiVersion: k8s.mariadb.com/v1alpha1 kind: MariaDB metadata: name: nextcloud-db - namespace: {{ .Release.Namespace }} + namespace: nextcloud spec: rootPasswordSecretKeyRef: name: nextcloud-secrets @@ -108,7 +112,7 @@ apiVersion: v1 kind: Secret metadata: name: wildcard-hxme-net - namespace: {{ .Release.Namespace }} + namespace: nextcloud annotations: replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net --- @@ -116,7 +120,7 @@ apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: nextcloud - namespace: {{ .Release.Namespace }} + namespace: nextcloud annotations: external-dns.alpha.kubernetes.io/hostname: nc.hxme.net spec: @@ -135,3 +139,4 @@ spec: name: nextcloud port: number: 80 + diff --git a/templates/files-syncthing.yaml b/templates/files-syncthing.yaml new file mode 100644 index 0000000..a7279b2 --- /dev/null +++ b/templates/files-syncthing.yaml @@ -0,0 +1,109 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: syncthing +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: syncthing-data + namespace: syncthing +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 5Gi +--- +apiVersion: v1 +kind: PersistentVolume +metadata: + name: syncthing-share-pv +spec: + capacity: + storage: 1000Gi + accessModes: + - ReadWriteOnce + persistentVolumeReclaimPolicy: Retain + hostPath: + path: /dpool/files +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: syncthing-share + namespace: syncthing +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1000Gi + volumeName: syncthing-share-pv +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: syncthing + namespace: syncthing +spec: + replicas: 1 + selector: + matchLabels: + app: syncthing + template: + metadata: + labels: + app: syncthing + spec: + containers: + - name: syncthing + image: syncthing/syncthing:latest + ports: + - containerPort: 8384 + - containerPort: 22000 + - containerPort: 21027 + protocol: UDP + volumeMounts: + - name: syncthing-data + mountPath: /var/syncthing + - name: syncthing-share + mountPath: /shared + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + volumes: + - name: syncthing-data + persistentVolumeClaim: + claimName: syncthing-data + - name: syncthing-share + persistentVolumeClaim: + claimName: syncthing-share +--- +apiVersion: v1 +kind: Service +metadata: + name: syncthing + namespace: syncthing +spec: + selector: + app: syncthing + ports: + - name: web-ui + port: 8384 + targetPort: 8384 + - name: sync-tcp + port: 22000 + targetPort: 22000 + - name: sync-udp + port: 22000 + protocol: UDP + targetPort: 22000 + - name: discovery + port: 21027 + protocol: UDP + targetPort: 21027 + type: ClusterIP + diff --git a/templates/monitoring-grafana.yaml b/templates/monitoring-grafana.yaml new file mode 100644 index 0000000..47ed5e0 --- /dev/null +++ b/templates/monitoring-grafana.yaml @@ -0,0 +1,37 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: grafana + namespace: monitoring +spec: + interval: 30m + chart: + spec: + chart: grafana + version: 7.3.0 + sourceRef: + kind: HelmRepository + name: grafana + namespace: flux-system + install: + createNamespace: true + values: + admin: + existingSecret: grafana-admin-secret + userKey: admin-user + passwordKey: admin-password + service: + type: LoadBalancer + annotations: + external-dns.alpha.kubernetes.io/hostname: "grafana.hxme.net" + datasources: + datasources.yaml: + apiVersion: 1 + datasources: + - name: Loki + type: loki + access: proxy + url: http://loki:3100 + isDefault: true + diff --git a/templates/monitoring-loki.yaml b/templates/monitoring-loki.yaml new file mode 100644 index 0000000..b327a8e --- /dev/null +++ b/templates/monitoring-loki.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: loki + namespace: monitoring +spec: + interval: 30m + chart: + spec: + chart: loki + version: 6.6.4 + sourceRef: + kind: HelmRepository + name: grafana + namespace: flux-system + install: + createNamespace: true + values: + loki: + auth_enabled: false + singleBinary: + replicas: 1 + service: + type: LoadBalancer + annotations: + external-dns.alpha.kubernetes.io/hostname: "loki.hxme.net" + write: + replicas: 1 + read: + replicas: 1 + backend: + replicas: 1 diff --git a/templates/monitoring-prometheus.yaml b/templates/monitoring-prometheus.yaml new file mode 100644 index 0000000..dd4d5a6 --- /dev/null +++ b/templates/monitoring-prometheus.yaml @@ -0,0 +1,40 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: prometheus-community + namespace: flux-system +spec: + url: https://prometheus-community.github.io/helm-charts + interval: 1h +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: prometheus-operator + namespace: monitoring +spec: + interval: 30m + chart: + spec: + chart: kube-prometheus-stack + version: 58.1.2 + sourceRef: + kind: HelmRepository + name: prometheus-community + namespace: flux-system + install: + createNamespace: true + upgrade: + disableWait: true + timeout: 5m + values: + prometheus: + prometheusSpec: + serviceMonitorSelectorNilUsesHelmValues: false + # Optional: expose Prometheus/Grafana via NodePort, Ingress, etc. + grafana: + enabled: false + alertmanager: + enabled: true + diff --git a/templates/monitoring-provider.yaml b/templates/monitoring-provider.yaml new file mode 100644 index 0000000..3af442a --- /dev/null +++ b/templates/monitoring-provider.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: monitoring +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: grafana + namespace: flux-system +spec: + url: https://grafana.github.io/helm-charts + interval: 1h +--- +apiVersion: v1 +kind: Secret +metadata: + name: wildcard-hxme-net + namespace: monitoring + annotations: + replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net diff --git a/templates/operators-mariadb.yaml b/templates/operators-mariadb.yaml new file mode 100644 index 0000000..04febe6 --- /dev/null +++ b/templates/operators-mariadb.yaml @@ -0,0 +1,60 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: mariadb-system +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: mariadb-operator + namespace: flux-system +spec: + url: https://helm.mariadb.com/mariadb-operator + interval: 1h +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: mariadb-operator-crds + namespace: mariadb-system +spec: + interval: 30m + chart: + spec: + chart: mariadb-operator-crds + version: 0.38.1 + sourceRef: + kind: HelmRepository + name: mariadb-operator + namespace: flux-system + install: + createNamespace: true + upgrade: + disableWait: true + timeout: 5m +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: mariadb-operator + namespace: mariadb-system +spec: + interval: 30m + chart: + spec: + chart: mariadb-operator + version: 0.38.1 + sourceRef: + kind: HelmRepository + name: mariadb-operator + namespace: flux-system + install: + createNamespace: true + dependsOn: + - name: mariadb-operator-crds + namespace: mariadb-system + values: + metrics: + enabled: true + diff --git a/templates/operators-replicator.yaml b/templates/operators-replicator.yaml new file mode 100644 index 0000000..e8ec276 --- /dev/null +++ b/templates/operators-replicator.yaml @@ -0,0 +1,98 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubernetes-replicator + namespace: kube-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kubernetes-replicator +rules: + - apiGroups: ["", "apps", "extensions"] + resources: + - secrets + - configmaps + - roles + - rolebindings + - cronjobs + - deployments + - events + - ingresses + - jobs + - pods + - pods/attach + - pods/exec + - pods/log + - pods/portforward + - services + - namespaces + - serviceaccounts + verbs: ["*"] + - apiGroups: ["batch"] + resources: + - configmaps + - cronjobs + - deployments + - events + - ingresses + - jobs + - pods + - pods/attach + - pods/exec + - pods/log + - pods/portforward + - services + verbs: ["*"] + - apiGroups: ["rbac.authorization.k8s.io"] + resources: + - roles + - rolebindings + - clusterrolebindings + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: kubernetes-replicator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: kubernetes-replicator +subjects: + - kind: ServiceAccount + name: kubernetes-replicator + namespace: kube-system +--- +apiVersion: source.toolkit.fluxcd.io/v1beta2 +kind: HelmRepository +metadata: + name: mittwald + namespace: flux-system +spec: + url: https://helm.mittwald.de + interval: 1h +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: kubernetes-replicator + namespace: kube-system +spec: + interval: 5m + chart: + spec: + chart: kubernetes-replicator + sourceRef: + kind: HelmRepository + name: mittwald + namespace: flux-system + install: + createNamespace: false + upgrade: + disableWait: false + values: + serviceAccount: + create: false + name: kubernetes-replicator diff --git a/templates/remote-access-rustdesk.yaml b/templates/remote-access-rustdesk.yaml new file mode 100644 index 0000000..47ec81d --- /dev/null +++ b/templates/remote-access-rustdesk.yaml @@ -0,0 +1,77 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: rustdesk +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: rustdesk-charts + namespace: flux-system +spec: + url: https://charts.rustdesk.com + interval: 1h +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: rustdesk-server + namespace: rustdesk +spec: + interval: 30m + chart: + spec: + chart: rustdesk-server + version: 0.5.0 + sourceRef: + kind: HelmRepository + name: rustdesk-charts + namespace: flux-system + install: + createNamespace: true + values: + hbbs: + enabled: true + service: + type: ClusterIP + ports: + - name: tcp + port: 21115 + targetPort: 21115 + - name: tcp-hbbs + port: 21116 + targetPort: 21116 + - name: udp + port: 21116 + targetPort: 21116 + protocol: UDP + + hbbr: + enabled: true + service: + type: ClusterIP + ports: + - name: tcp-hbbr + port: 21117 + targetPort: 21117 + + ingress: + enabled: true + className: "traefik" # or nginx or your ingress class + annotations: {} + hosts: + - host: rd.hxme.net + paths: + - path: / + pathType: Prefix + tls: + - hosts: + - rd.hxme.net + secretName: rustdesk-tls + + # Optional admin password – change this in production + env: + ENCRYPTED_ONLY: "false" + ENABLE_LOG: "true" + diff --git a/templates/ssl-certmanager.yaml b/templates/ssl-certmanager.yaml new file mode 100644 index 0000000..f238e14 --- /dev/null +++ b/templates/ssl-certmanager.yaml @@ -0,0 +1,72 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: jetstack + namespace: flux-system +spec: + url: https://charts.jetstack.io + interval: 1h +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cert-manager + namespace: cert-manager +spec: + interval: 30m + chart: + spec: + chart: cert-manager + version: v1.18.2 + sourceRef: + kind: HelmRepository + name: jetstack + namespace: flux-system + install: + crds: CreateReplace + createNamespace: true + values: + installCRDs: true + extraArgs: + - --dns01-recursive-nameservers-only + - --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53 +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-rfc2136 +spec: + acme: + email: admin@hxme.net + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-rfc2136 + solvers: + - dns01: + rfc2136: + nameserver: hawke.hxst.com.au:53 + tsigKeyName: "hxme-update-key" + tsigAlgorithm: HMACSHA512 + tsigSecretSecretRef: + name: hxme-update-key + key: hxme-update-key +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wildcard-hxme-net + namespace: cert-manager +spec: + secretName: wildcard-hxme-net + secretTemplate: + annotations: + replicator.v1.mittwald.de/replication-allowed: "true" + replicator.v1.mittwald.de/replicate-to: "monitoring,authentik,nextcloud" + issuerRef: + name: letsencrypt-rfc2136 + kind: ClusterIssuer + commonName: "hxme.net" + dnsNames: + - "hxme.net" + - "*.hxme.net" diff --git a/templates/synctools-vaultwarden.yaml b/templates/synctools-vaultwarden.yaml new file mode 100644 index 0000000..93c3475 --- /dev/null +++ b/templates/synctools-vaultwarden.yaml @@ -0,0 +1,79 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: bitwarden +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: bjw-s-charts + namespace: flux-system +spec: + url: https://bjw-s.github.io/helm-charts/ + interval: 1h +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: vaultwarden + namespace: bitwarden +spec: + interval: 30m + chart: + spec: + chart: app-template + version: 2.4.0 + sourceRef: + kind: HelmRepository + name: bjw-s-charts + namespace: flux-system + install: + createNamespace: true + values: + # Basic container config + image: + repository: vaultwarden/server + tag: 1.30.5 + pullPolicy: IfNotPresent + + env: + WEBSOCKET_ENABLED: "true" + SIGNUPS_ALLOWED: "false" + DOMAIN: "https://vw.hxme.net" + ADMIN_TOKEN: "CHANGEME_SUPER_SECRET" + + service: + main: + ports: + http: + port: 80 + + ingress: + main: + enabled: true + annotations: + kubernetes.io/ingress.class: "traefik" # Or nginx or your ingress class + hosts: + - host: vw.hxme.net + paths: + - path: / + pathType: Prefix + tls: + - hosts: + - vw.hxme.net + secretName: bitwarden-tls + + persistence: + data: + enabled: true + existingClaim: bitwarden-data # You must create a PVC or a StorageClass dynamic claim + + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + cpu: 250m + memory: 512Mi +