charts/dns/Chart.yaml

@@ -1,5 +1,5 @@
+---
 apiVersion: v2
 name: home-server-dns
-description: Deploys the DNS setup
+description: Deploys a master/slave DNS server with External DNS for declaring hostnames with annotations.
-type: application
+version: 0.0.1
-version: 0.1.0

charts/dns/templates/clusterrole.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-dns
+rules:
+  - apiGroups: [""]
+    resources: ["services","endpoints","pods"]
+    verbs: ["get","watch","list"]
+  - apiGroups: ["extensions","networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get","watch","list"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["list","watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-viewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns
+subjects:
+  - kind: ServiceAccount
+    name: external-dns
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-dns

charts/dns/templates/external-dns.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: external-dns
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: external-dns
+  template:
+    metadata:
+      labels:
+        app: external-dns
+    spec:
+      serviceAccountName: external-dns
+      containers:
+      - name: external-dns
+        image: bitnami/external-dns:latest
+        args:
+          - --source=service
+          - --source=ingress
+          - --provider=rfc2136
+          - --rfc2136-host=bind-master.dns.svc.cluster.local
+          - --rfc2136-port=53
+          - --rfc2136-zone=hxme.net
+          - --rfc2136-tsig-secret=$(RFC2136_TSIG_SECRET)
+          - --rfc2136-tsig-secret-alg=hmac-sha256
+          - --rfc2136-tsig-keyname=externaldns-key
+          - --policy=sync
+          - --registry=txt
+          - --txt-owner-id=my-cluster
+        env:
+            - name: RFC2136_TSIG_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: dns-secrets
+                  key: externaldns-secret

charts/dns/templates/master.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: bind-slave-config
+  name: bind-master-config
 data:
   named.conf: |
     include "/etc/bind/externaldns-key.conf";
@@ -50,15 +50,15 @@ data:
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: bind-slave
+  name: bind-master
 spec:
   selector:
     matchLabels:
-      app: bind-slave
+      app: bind-master
   template:
     metadata:
       labels:
-        app: bind-slave
+        app: bind-master
     spec:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
@@ -77,7 +77,7 @@ spec:
             - mountPath: /usr/share/dns
               name: root-hints
       containers:
-        - name: bind-slave
+        - name: bind-master
           image: internetsystemsconsortium/bind9:9.18
           command: ["named", "-g", "-c", "/etc/bind/named.conf"]
           ports:
@@ -107,7 +107,7 @@ spec:
             secretName: dns-secrets
         - name: config
           configMap:
-            name: bind-slave-config
+            name: bind-master-config
         - name: bind-cache
           emptyDir: {}
         - name: bind-rundir
@@ -120,10 +120,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: bind-master
-  namespace: default
 spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
   selector:
     app: bind-master
   ports:
@@ -136,3 +133,4 @@ spec:
       protocol: TCP
       targetPort: 53
 
+

charts/dns/values.yaml

@@ -1,2 +0,0 @@
-domain: "auth.dev.hxme.net"
-certSecretName: "wildcard-hxme-net"

deployments/home-server.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: home-server
+  namespace: home-server
+spec:
+  interval: 1m
+  chart:
+    spec:
+      chart: ./charts/dns
+      sourceRef:
+        kind: GitRepository
+        name: home-server
+        namespace: flux-system

deployments/kustomization.yaml

@@ -2,6 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind:       Kustomization
 
 resources:
-  - manifests/00-namespaces.yaml
+  - namespaces.yaml
-  - manifests/10-dev.yaml
+  - home-server.yaml
-  - manifests/10-prod.yaml

deployments/manifests/00-namespaces.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: home-server
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: home-server-dev

deployments/manifests/10-dev.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: GitRepository
-metadata:
-  name: home-server-dev
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: ssh://git@repobase.net/j/home-server.git
-  secretRef:
-    name: flux-ssh
-  ref:
-    branch: dev
-
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: home-server-dev
-  namespace: flux-system
-spec:
-  interval: 1m
-  path: ./deployments
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-server-dev
-  targetNamespace: home-server-dev

deployments/manifests/10-prod.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: GitRepository
-metadata:
-  name: home-server
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: ssh://git@repobase.net/j/home-server.git
-  secretRef:
-    name: flux-ssh
-  ref:
-    branch: main
-
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: home-server
-  namespace: flux-system
-spec:
-  interval: 1m
-  path: ./deployments
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-server
-  targetNamespace: home-server

deployments/namespaces.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: home-server

home-server/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+name: home-server
+description: A Helm chart that rolls a curated, functional home server
+version: 0.0.1
+
+dependencies:
+  - name: util
+    version: 0.0.1
+    repository: "file://templates/util"

home-server/values.yaml

@@ -0,0 +1,24 @@
+ai:
+  enabled: true
+
+dns:
+  enabled: false
+
+media:
+  enabled: true
+
+monitoring:
+  enabled: true
+
+remote:
+  enabled: false
+
+social:
+  enabled: true
+
+sync:
+  enabled: false
+
+util:
+  enabled: true
+

old-manifests/Chart.yaml

@@ -0,0 +1,41 @@
+apiVersion: v2
+name: home-server
+description: A Helm chart that rolls a curated, functional home server
+version: 0.0.1
+
+dependencies:
+  - name: util
+    version: 0.0.1
+    repository: "file://templates/util"
+
+  - name: dns
+    version: 0.0.1
+    repository: "file://templates/dns"
+#
+#  - name: files
+#    version: 0.0.1
+#    repository: "file://templates/files"
+#
+#  - name: ai
+#    version: 0.0.1
+#    repository: "file://templates/ai"
+#
+#  - name: media
+#    version: 0.0.1
+#    repository: "file://templates/media"
+#
+#  - name: monitoring
+#    version: 0.0.1
+#    repository: "file://templates/monitoring"
+#
+#  - name: remote
+#    version: 0.0.1
+#    repository: "file://templates/remote"
+#
+#  - name: social
+#    version: 0.0.1
+#    repository: "file://templates/social"
+#
+#  - name: sync
+#    version: 0.0.1
+#    repository: "file://templates/sync"

old-manifests/templates/ai/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ai

old-manifests/templates/ai/openwebui.yaml

@@ -0,0 +1,72 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: openwebui
+  namespace: ai
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: openwebui
+  template:
+    metadata:
+      labels:
+        app: openwebui
+    spec:
+      containers:
+        - name: openwebui
+          image: ghcr.io/open-webui/open-webui:latest
+          ports:
+            - containerPort: 8080
+          env:
+            - name: OLLAMA_BASE_URL
+              value: http://ollama:11434
+          volumeMounts:
+            - name: ai-storage
+              mountPath: /app/backend/data
+      volumes:
+        - name: ai-storage
+          hostPath:
+            path: /dpool/files/ai/
+            type: Directory
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: openwebui
+  namespace: ai
+spec:
+  selector:
+    app: openwebui
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: openwebui
+  namespace: ai
+  annotations:
+    kubernetes.io/ingress.class: "traefik" 
+    external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
+spec:
+  rules:
+    - host: ai.hxme.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: openwebui
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - ai.hxme.net
+      secretName: openwebui-tls
+
+

old-manifests/templates/auth/authentik.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: authentik
+  namespace: flux-system
+spec:
+  url: https://charts.goauthentik.io/
+  interval: 1h
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: wildcard-hxme-net
+  namespace: auth
+  annotations:
+    replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: authentik
+  namespace: auth
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: authentik
+      version: 2024.4.2
+      sourceRef:
+        kind: HelmRepository
+        name: authentik
+        namespace: flux-system
+  install:
+    createNamespace: true
+  upgrade:
+    disableWait: false
+  timeout: 10m
+  valuesFrom:
+    - kind: Secret
+      name: authentik-values
+  values:
+    ingress:
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: auth.hxme.net
+      tls:
+        - secretName: wildcard-hxme-net
+          hosts:
+            - auth.hxme.net

old-manifests/templates/auth/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ai

old-manifests/templates/dns/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+name: dns
+description: "DNS subchart for home-server"
+version: 0.0.1

old-manifests/templates/dns/bind-master.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: bind-master-config
+  namespace: dns
 data:
   named.conf: |
     include "/etc/bind/externaldns-key.conf";
@@ -51,6 +52,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: bind-master
+  namespace: dns
 spec:
   selector:
     matchLabels:
@@ -120,8 +122,8 @@ apiVersion: v1
 kind: Service
 metadata:
   name: bind-master
+  namespace: dns
 spec:
-  type: ClusterIP
   selector:
     app: bind-master
   ports:
@@ -134,3 +136,4 @@ spec:
       protocol: TCP
       targetPort: 53
 
+

old-manifests/templates/dns/externaldns.yaml

@@ -13,6 +13,7 @@ rules:
   - apiGroups: [""]
     resources: ["nodes"]
     verbs: ["list","watch"]
+  # Add DNS provider specific rules here if needed (e.g., for AWS IAM, GCP etc.)
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -25,16 +26,19 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: external-dns
+    namespace: dns
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: external-dns
+  namespace: dns
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: external-dns
+  namespace: dns
 spec:
   replicas: 1
   selector:
@@ -68,5 +72,3 @@ spec:
                 secretKeyRef:
                   name: dns-secrets
                   key: externaldns-secret
-
-

old-manifests/templates/dns/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dns

old-manifests/templates/files/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: files

old-manifests/templates/files/nextcloud.yaml

@@ -0,0 +1,137 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nextcloud-pv
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-path
+  hostPath:
+    path: /dpool/temp/Nextcloud
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-pvc
+  namespace: nextcloud
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path 
+  resources:
+    requests:
+      storage: 10Gi
+  volumeName: nextcloud-pv
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+spec:
+  ports:
+    - port: 80
+  selector:
+    app: nextcloud
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+spec:
+  securityContext:
+    runAsUser:  1000
+    runAsGroup: 1000
+    fsGroup:    1000
+  selector:
+    matchLabels:
+      app: nextcloud
+  template:
+    metadata:
+      labels:
+        app: nextcloud
+    spec:
+      containers:
+        - name: nextcloud
+          image: nextcloud:29
+          env:
+            - name: MYSQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: nextcloud-secrets
+                  key: MYSQL_PASSWORD
+            - name: MYSQL_DATABASE
+              value: nextcloud
+            - name: MYSQL_USER
+              value: nextcloud
+            - name: MYSQL_HOST
+              value: mariadb
+          ports:
+            - containerPort: 80
+          volumeMounts:
+            - name: nextcloud-data
+              mountPath: /var/www/html
+          securityContext:
+            runAsUser:  1000
+            runAsGroup: 1000
+            fsGroup:    1000
+      volumes:
+        - name: nextcloud-data
+          persistentVolumeClaim:
+            claimName: nextcloud-pvc
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: MariaDB
+metadata:
+  name: nextcloud-db
+  namespace: nextcloud
+spec:
+  rootPasswordSecretKeyRef:
+    name: nextcloud-secrets
+    key: MYSQL_ROOT_PASSWORD
+  database: nextcloud
+  username: nextcloud
+  passwordSecretKeyRef:
+    name: nextcloud-secrets
+    key: MYSQL_PASSWORD
+  image: mariadb:10.11
+  storage:
+    size: 5Gi
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: wildcard-hxme-net
+  namespace: nextcloud
+  annotations:
+    replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
+spec:
+  tls:
+    - hosts:
+        - nc.hxme.net
+      secretName: wildcard-hxme-net
+  rules:
+    - host: nc.hxme.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nextcloud
+                port:
+                  number: 80
+

old-manifests/templates/media/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: media

old-manifests/templates/monitoring/grafana.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: grafana
+  namespace: monitoring
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: grafana
+      version: 7.3.0
+      sourceRef:
+        kind: HelmRepository
+        name: grafana
+        namespace: flux-system
+  install:
+    createNamespace: true
+  values:
+    admin:
+      existingSecret: grafana-admin-secret
+      userKey: admin-user
+      passwordKey: admin-password
+    service:
+      type: LoadBalancer
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: "grafana.hxme.net"
+    datasources:
+      datasources.yaml:
+        apiVersion: 1
+        datasources:
+          - name: Loki
+            type: loki
+            access: proxy
+            url: http://loki:3100
+            isDefault: true
+

old-manifests/templates/monitoring/loki.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: loki
+  namespace: monitoring
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: loki
+      version: 6.6.4
+      sourceRef:
+        kind: HelmRepository
+        name: grafana
+        namespace: flux-system
+  install:
+    createNamespace: true
+  values:
+    loki:
+      auth_enabled: false
+    singleBinary:
+      replicas: 1
+      service:
+        type: LoadBalancer
+        annotations:
+          external-dns.alpha.kubernetes.io/hostname: "loki.hxme.net"
+    write:
+      replicas: 1
+    read:
+      replicas: 1
+    backend:
+      replicas: 1

old-manifests/templates/monitoring/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring

old-manifests/templates/monitoring/prometheus.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: prometheus-community
+  namespace: flux-system
+spec:
+  url: https://prometheus-community.github.io/helm-charts
+  interval: 1h
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: prometheus-operator
+  namespace: monitoring
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: kube-prometheus-stack
+      version: 58.1.2
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: flux-system
+  install:
+    createNamespace: true
+  upgrade:
+    disableWait: true
+  timeout: 5m
+  values:
+    prometheus:
+      prometheusSpec:
+        serviceMonitorSelectorNilUsesHelmValues: false
+    # Optional: expose Prometheus/Grafana via NodePort, Ingress, etc.
+    grafana:
+      enabled: false
+    alertmanager:
+      enabled: true
+

old-manifests/templates/monitoring/provider.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: grafana
+  namespace: flux-system
+spec:
+  url: https://grafana.github.io/helm-charts
+  interval: 1h
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: wildcard-hxme-net
+  namespace: monitoring
+  annotations:
+    replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net

old-manifests/templates/remote/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: remote

old-manifests/templates/remote/rustdesk.yaml

@@ -0,0 +1,72 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: rustdesk-charts
+  namespace: flux-system
+spec:
+  url: https://charts.rustdesk.com
+  interval: 1h
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rustdesk-server
+  namespace: remote
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: rustdesk-server
+      version: 0.5.0
+      sourceRef:
+        kind: HelmRepository
+        name: rustdesk-charts
+        namespace: flux-system
+  install:
+    createNamespace: true
+  values:
+    hbbs:
+      enabled: true
+      service:
+        type: ClusterIP
+        ports:
+          - name: tcp
+            port: 21115
+            targetPort: 21115
+          - name: tcp-hbbs
+            port: 21116
+            targetPort: 21116
+          - name: udp
+            port: 21116
+            targetPort: 21116
+            protocol: UDP
+
+    hbbr:
+      enabled: true
+      service:
+        type: ClusterIP
+        ports:
+          - name: tcp-hbbr
+            port: 21117
+            targetPort: 21117
+
+    ingress:
+      enabled: true
+      className: "traefik" # or nginx or your ingress class
+      annotations: {}
+      hosts:
+        - host: rd.hxme.net
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - hosts:
+            - rd.hxme.net
+          secretName: rustdesk-tls
+
+    # Optional admin password – change this in production
+    env:
+      ENCRYPTED_ONLY: "false"
+      ENABLE_LOG: "true"
+

old-manifests/templates/social/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: social

old-manifests/templates/sync/linkwarden.yaml

@@ -0,0 +1,60 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: linkwarden
+  namespace: sync
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: linkwarden
+  template:
+    metadata:
+      labels:
+        app: linkwarden
+    spec:
+      containers:
+        - name: linkwarden
+          image: ghcr.io/linkwarden/linkwarden:latest
+          ports:
+            - containerPort: 8080
+          env:
+            - name: ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: linkwarden-secret
+                  key: admin-password
+            # Add other environment variables here as needed
+          volumeMounts:
+            - name: linkwarden-data
+              mountPath: /data
+      volumes:
+        - name: linkwarden-data
+          emptyDir: {} # Change to persistentVolumeClaim for production
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: linkwarden-secret
+  namespace: sync
+type: Opaque
+stringData:
+  admin-password: "YourStrongAdminPasswordHere"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: linkwarden
+  namespace: sync
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: lw.hxme.net
+spec:
+  selector:
+    app: linkwarden
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 8080
+  type: ClusterIP
+

old-manifests/templates/sync/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: sync

old-manifests/templates/sync/syncthing.yaml

@@ -0,0 +1,104 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: syncthing-data
+  namespace: sync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: syncthing-share-pv
+spec:
+  capacity:
+    storage: 1000Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  hostPath:
+    path: /dpool/files
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: syncthing-share
+  namespace: sync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1000Gi
+  volumeName: syncthing-share-pv
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: syncthing
+  namespace: sync
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: syncthing
+  template:
+    metadata:
+      labels:
+        app: syncthing
+    spec:
+      containers:
+        - name: syncthing
+          image: syncthing/syncthing:latest
+          ports:
+            - containerPort: 8384 
+            - containerPort: 22000
+            - containerPort: 21027
+              protocol: UDP
+          volumeMounts:
+            - name: syncthing-data
+              mountPath: /var/syncthing
+            - name: syncthing-share
+              mountPath: /shared 
+          securityContext:
+            runAsUser:  1000
+            runAsGroup: 1000
+            fsGroup:    1000
+      volumes:
+        - name: syncthing-data
+          persistentVolumeClaim:
+            claimName: syncthing-data
+        - name: syncthing-share
+          persistentVolumeClaim:
+            claimName: syncthing-share
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: syncthing
+  namespace: sync
+spec:
+  selector:
+    app: syncthing
+  ports:
+    - name: web-ui
+      port: 8384
+      targetPort: 8384
+    - name: sync-tcp
+      port: 22000
+      targetPort: 22000
+    - name: sync-udp
+      port: 22000
+      protocol: UDP
+      targetPort: 22000
+    - name: discovery
+      port: 21027
+      protocol: UDP
+      targetPort: 21027
+  type: ClusterIP
+

old-manifests/templates/sync/vaultwarden.yaml

@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  namespace: sync
+  labels:
+    app: vaultwarden
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vaultwarden
+  template:
+    metadata:
+      labels:
+        app: vaultwarden
+    spec:
+      containers:
+        - name: vaultwarden
+          image: vaultwarden/server:1.30.5
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: WEBSOCKET_ENABLED
+              value: "true"
+            - name: SIGNUPS_ALLOWED
+              value: "false"
+            - name: DOMAIN
+              value: "https://vw.hxme.net"
+            - name: ADMIN_TOKEN
+              value: "CHANGEME_SUPER_SECRET"
+          ports:
+            - containerPort: 80
+              name: http
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 250m
+              memory: 512Mi
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: bitwarden-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden
+  namespace: sync
+  labels:
+    app: vaultwarden
+spec:
+  type: ClusterIP
+  selector:
+    app: vaultwarden
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden
+  namespace: sync
+  annotations:
+    kubernetes.io/ingress.class: traefik
+spec:
+  rules:
+    - host: vw.hxme.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vaultwarden
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - vw.hxme.net
+      secretName: bitwarden-tls
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: bitwarden-data
+  namespace: sync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+

old-manifests/templates/util/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+name: util
+description: "Utility subchart for home-server"
+version: 0.0.1

old-manifests/templates/util/templates/00-namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: util

old-manifests/templates/util/templates/10-replicator.yaml

@@ -0,0 +1,98 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubernetes-replicator
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubernetes-replicator
+rules:
+  - apiGroups: ["", "apps", "extensions"]
+    resources:
+      - secrets
+      - configmaps
+      - roles
+      - rolebindings
+      - cronjobs
+      - deployments
+      - events
+      - ingresses
+      - jobs
+      - pods
+      - pods/attach
+      - pods/exec
+      - pods/log
+      - pods/portforward
+      - services
+      - namespaces
+      - serviceaccounts
+    verbs: ["*"]
+  - apiGroups: ["batch"]
+    resources:
+      - configmaps
+      - cronjobs
+      - deployments
+      - events
+      - ingresses
+      - jobs
+      - pods
+      - pods/attach
+      - pods/exec
+      - pods/log
+      - pods/portforward
+      - services
+    verbs: ["*"]
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources:
+      - roles
+      - rolebindings
+      - clusterrolebindings
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubernetes-replicator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubernetes-replicator
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-replicator
+    namespace: kube-system
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: mittwald
+  namespace: flux-system
+spec:
+  url: https://helm.mittwald.de
+  interval: 1h
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: kubernetes-replicator
+  namespace: kube-system
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: kubernetes-replicator
+      sourceRef:
+        kind: HelmRepository
+        name: mittwald
+        namespace: flux-system
+  install:
+    createNamespace: false
+  upgrade:
+    disableWait: false
+  values:
+    serviceAccount:
+      create: false
+      name: kubernetes-replicator

old-manifests/templates/util/templates/20-certmanager.yaml

@@ -0,0 +1,72 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: jetstack
+  namespace: flux-system
+spec:
+  url: https://charts.jetstack.io
+  interval: 1h
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cert-manager
+      version: v1.18.2
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack
+        namespace: flux-system
+  install:
+    crds: CreateReplace
+    createNamespace: true
+  values:
+    installCRDs: true
+    extraArgs:
+      - --dns01-recursive-nameservers-only
+      - --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-rfc2136
+spec:
+  acme:
+    email: admin@hxme.net
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-rfc2136
+    solvers:
+    - dns01:
+        rfc2136:
+          nameserver: hawke.hxst.com.au:53
+          tsigKeyName: "hxme-update-key"
+          tsigAlgorithm: HMACSHA512
+          tsigSecretSecretRef:
+            name: hxme-update-key
+            key:  hxme-update-key
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-hxme-net
+  namespace: cert-manager
+spec:
+  secretName: wildcard-hxme-net
+  secretTemplate:
+    annotations:
+      replicator.v1.mittwald.de/replication-allowed: "true"
+      replicator.v1.mittwald.de/replicate-to: "monitoring,authentik,nextcloud"
+  issuerRef:
+    name: letsencrypt-rfc2136
+    kind: ClusterIssuer
+  commonName: "hxme.net"
+  dnsNames:
+    - "hxme.net"
+    - "*.hxme.net"

old-manifests/templates/util/templates/20-mariadb.yaml

@@ -0,0 +1,60 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mariadb-system
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: mariadb-operator
+  namespace: flux-system
+spec:
+  url: https://helm.mariadb.com/mariadb-operator
+  interval: 1h
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: mariadb-operator-crds
+  namespace: mariadb-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: mariadb-operator-crds
+      version: 0.38.1
+      sourceRef:
+        kind: HelmRepository
+        name: mariadb-operator
+        namespace: flux-system
+  install:
+    createNamespace: true
+  upgrade:
+    disableWait: true
+  timeout: 5m
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: mariadb-operator
+  namespace: mariadb-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: mariadb-operator
+      version: 0.38.1
+      sourceRef:
+        kind: HelmRepository
+        name: mariadb-operator
+        namespace: flux-system
+  install:
+    createNamespace: true
+  dependsOn:
+    - name: mariadb-operator-crds
+      namespace: mariadb-system
+  values:
+    metrics:
+      enabled: true
+

old-manifests/values.yaml

@@ -0,0 +1,24 @@
+ai:
+  enabled: true
+
+dns:
+  enabled: false
+
+media:
+  enabled: true
+
+monitoring:
+  enabled: true
+
+remote:
+  enabled: false
+
+social:
+  enabled: true
+
+sync:
+  enabled: false
+
+util:
+  enabled: true
+