j/home-server
1
0
Fork 0
Code Issues 11 Pull requests Projects 2 Releases Packages Wiki Activity Actions

Compare commits

base: j:c1c7cd3fedef3034e4508947f7cf594ecb7d4192
Branches Tags
j:main
j:ye
j:before-helm
j:ey
..
compare: j:3d53cf9a2fc2052d905412700e9f82805b7f12fe
Branches Tags
j:main
j:ye
j:before-helm
j:ey

No commits in common. "c1c7cd3fedef3034e4508947f7cf594ecb7d4192" and "3d53cf9a2fc2052d905412700e9f82805b7f12fe" have entirely different histories.
c1c7cd3fed ... 3d53cf9a2f

19 changed files with 1238 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

76
deployments-old/ai/openweb.yaml Normal file
View file

@ -0,0 +1,76 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: ai
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: openwebui
namespace: ai
spec:
replicas: 1
selector:
matchLabels:
app: openwebui
template:
metadata:
labels:
app: openwebui
spec:
containers:
- name: openwebui
image: ghcr.io/open-webui/open-webui:latest
ports:
- containerPort: 8080
env:
- name: OLLAMA_BASE_URL
value: http://ollama:11434
volumeMounts:
- name: ai-storage
mountPath: /app/backend/data
volumes:
- name: ai-storage
hostPath:
path: /dpool/files/ai/
type: Directory
---
apiVersion: v1
kind: Service
metadata:
name: openwebui
namespace: ai
spec:
selector:
app: openwebui
ports:
- protocol: TCP
port: 80
targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: openwebui
namespace: ai
annotations:
kubernetes.io/ingress.class: "traefik"
external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
spec:
rules:
- host: ai.hxme.net
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: openwebui
port:
number: 80
tls:
- hosts:
- ai.hxme.net
secretName: openwebui-tls

54
deployments-old/auth/authentik.yaml Normal file
View file

@ -0,0 +1,54 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: authentik
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: authentik
namespace: flux-system
spec:
url: https://charts.goauthentik.io/
interval: 1h
---
apiVersion: v1
kind: Secret
metadata:
name: wildcard-hxme-net
namespace: authentik
annotations:
replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: authentik
namespace: authentik
spec:
interval: 30m
chart:
spec:
chart: authentik
version: 2024.4.2
sourceRef:
kind: HelmRepository
name: authentik
namespace: flux-system
install:
createNamespace: true
upgrade:
disableWait: false
timeout: 10m
valuesFrom:
- kind: Secret
name: authentik-values
values:
ingress:
annotations:
external-dns.alpha.kubernetes.io/hostname: auth.hxme.net
tls:
- secretName: wildcard-hxme-net
hosts:
- auth.hxme.net

138
deployments-old/dns/bind.yaml Normal file
View file

@ -0,0 +1,138 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: bind-master-config
namespace: dns
data:
named.conf: |
include "/etc/bind/externaldns-key.conf";
options {
directory "/var/cache/bind";
recursion yes;
allow-query { any; };
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
forwarders {
10.40.0.254;
};
dnssec-validation auto;
};
zone "." IN {
type hint;
file "/usr/share/dns/root.hints";
};
zone "hxme.net." IN {
type master;
file "/etc/bind/db.hxme.net";
allow-update { key "externaldns-key"; };
};
db.hxme.net: |
$TTL 3600
@ IN SOA ns1.hxme.net. admin.hxme.net. (
1 ; Serial
7200 ; Refresh
1800 ; Retry
1209600 ; Expire
86400 ) ; Negative Cache TTL
;
@ IN NS ns1.hxme.net.
ns1 IN A 10.40.0.110
@ IN A 10.40.0.110
www IN A 10.40.0.110
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: bind-master
namespace: dns
spec:
selector:
matchLabels:
app: bind-master
template:
metadata:
labels:
app: bind-master
spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
securityContext:
fsGroup: 999
initContainers:
- name: fetch-root-hints
image: debian:12
command:
- sh
- -c
- |
apt update && apt -y install curl
curl -sfSL https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints
volumeMounts:
- mountPath: /usr/share/dns
name: root-hints
containers:
- name: bind-master
image: internetsystemsconsortium/bind9:9.18
command: ["named", "-g", "-c", "/etc/bind/named.conf"]
ports:
- containerPort: 53
protocol: UDP
- containerPort: 53
protocol: TCP
volumeMounts:
- name: config
mountPath: /etc/bind/named.conf
subPath: named.conf
- name: config
mountPath: /etc/bind/db.hxme.net
subPath: db.hxme.net
- name: dns-secrets
mountPath: /etc/bind/externaldns-key.conf
subPath: externaldns-key.conf
- name: bind-cache
mountPath: /var/cache/bind
- name: bind-rundir
mountPath: /var/run/named
- name: root-hints
mountPath: /usr/share/dns
volumes:
- name: dns-secrets
secret:
secretName: dns-secrets
- name: config
configMap:
name: bind-master-config
- name: bind-cache
emptyDir: {}
- name: bind-rundir
emptyDir: {}
- name: root-hints
emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
name: bind-master
namespace: dns
spec:
selector:
app: bind-master
ports:
- name: dns-udp
port: 53
protocol: UDP
targetPort: 53
- name: dns-tcp
port: 53
protocol: TCP
targetPort: 53

75
deployments-old/dns/externaldns.yaml Normal file
View file

@ -0,0 +1,75 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: external-dns
rules:
- apiGroups: [""]
resources: ["services","endpoints","pods"]
verbs: ["get","watch","list"]
- apiGroups: ["extensions","networking.k8s.io"]
resources: ["ingresses"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["nodes"]
verbs: ["list","watch"]
# Add DNS provider specific rules here if needed (e.g., for AWS IAM, GCP etc.)
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: external-dns-viewer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: external-dns
subjects:
- kind: ServiceAccount
name: external-dns
namespace: dns
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: external-dns
namespace: dns
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
namespace: dns
spec:
replicas: 1
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: bitnami/external-dns:latest
args:
- --source=service
- --source=ingress
- --provider=rfc2136
- --rfc2136-host=bind-master.dns.svc.cluster.local
- --rfc2136-port=53
- --rfc2136-zone=hxme.net
- --rfc2136-tsig-secret=$(RFC2136_TSIG_SECRET)
- --rfc2136-tsig-secret-alg=hmac-sha256
- --rfc2136-tsig-keyname=externaldns-key
- --policy=sync
- --registry=txt
- --txt-owner-id=my-cluster
env:
- name: RFC2136_TSIG_SECRET
valueFrom:
secretKeyRef:
name: dns-secrets
key: externaldns-secret

5
deployments-old/dns/namespace.yaml Normal file
View file

@ -0,0 +1,5 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: dns

142
deployments-old/files/nextcloud.yaml Normal file
View file

@ -0,0 +1,142 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: nextcloud
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: nextcloud-pv
spec:
capacity:
storage: 10Gi
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
storageClassName: local-path
hostPath:
path: /dpool/temp/Nextcloud
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nextcloud-pvc
namespace: nextcloud
spec:
accessModes:
- ReadWriteOnce
storageClassName: local-path
resources:
requests:
storage: 10Gi
volumeName: nextcloud-pv
---
apiVersion: v1
kind: Service
metadata:
name: nextcloud
namespace: nextcloud
spec:
ports:
- port: 80
selector:
app: nextcloud
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nextcloud
namespace: nextcloud
spec:
securityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
selector:
matchLabels:
app: nextcloud
template:
metadata:
labels:
app: nextcloud
spec:
containers:
- name: nextcloud
image: nextcloud:29
env:
- name: MYSQL_PASSWORD
valueFrom:
secretKeyRef:
name: nextcloud-secrets
key: MYSQL_PASSWORD
- name: MYSQL_DATABASE
value: nextcloud
- name: MYSQL_USER
value: nextcloud
- name: MYSQL_HOST
value: mariadb
ports:
- containerPort: 80
volumeMounts:
- name: nextcloud-data
mountPath: /var/www/html
securityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
volumes:
- name: nextcloud-data
persistentVolumeClaim:
claimName: nextcloud-pvc
---
apiVersion: k8s.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: nextcloud-db
namespace: nextcloud
spec:
rootPasswordSecretKeyRef:
name: nextcloud-secrets
key: MYSQL_ROOT_PASSWORD
database: nextcloud
username: nextcloud
passwordSecretKeyRef:
name: nextcloud-secrets
key: MYSQL_PASSWORD
image: mariadb:10.11
storage:
size: 5Gi
---
apiVersion: v1
kind: Secret
metadata:
name: wildcard-hxme-net
namespace: nextcloud
annotations:
replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nextcloud
namespace: nextcloud
annotations:
external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
spec:
tls:
- hosts:
- nc.hxme.net
secretName: wildcard-hxme-net
rules:
- host: nc.hxme.net
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: nextcloud
port:
number: 80

109
deployments-old/files/syncthing.yaml Normal file
View file

@ -0,0 +1,109 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: syncthing
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: syncthing-data
namespace: syncthing
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 5Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: syncthing-share-pv
spec:
capacity:
storage: 1000Gi
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
hostPath:
path: /dpool/files
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: syncthing-share
namespace: syncthing
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1000Gi
volumeName: syncthing-share-pv
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: syncthing
namespace: syncthing
spec:
replicas: 1
selector:
matchLabels:
app: syncthing
template:
metadata:
labels:
app: syncthing
spec:
containers:
- name: syncthing
image: syncthing/syncthing:latest
ports:
- containerPort: 8384
- containerPort: 22000
- containerPort: 21027
protocol: UDP
volumeMounts:
- name: syncthing-data
mountPath: /var/syncthing
- name: syncthing-share
mountPath: /shared
securityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
volumes:
- name: syncthing-data
persistentVolumeClaim:
claimName: syncthing-data
- name: syncthing-share
persistentVolumeClaim:
claimName: syncthing-share
---
apiVersion: v1
kind: Service
metadata:
name: syncthing
namespace: syncthing
spec:
selector:
app: syncthing
ports:
- name: web-ui
port: 8384
targetPort: 8384
- name: sync-tcp
port: 22000
targetPort: 22000
- name: sync-udp
port: 22000
protocol: UDP
targetPort: 22000
- name: discovery
port: 21027
protocol: UDP
targetPort: 21027
type: ClusterIP

17
deployments-old/kustomization.yaml Normal file
View file

@ -0,0 +1,17 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- monitoring/provider.yaml
- monitoring/grafana.yaml
- monitoring/loki.yaml
- monitoring/prometheus.yaml
- operators/mariadb.yaml
- operators/replicator.yaml
- dns/namespace.yaml
- dns/bind.yaml
- dns/externaldns.yaml
- ssl/certmanager.yaml
- auth/authentik.yaml
- files/nextcloud.yaml
- files/syncthing.yaml

37
deployments-old/monitoring/grafana.yaml Normal file
View file

@ -0,0 +1,37 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: grafana
namespace: monitoring
spec:
interval: 30m
chart:
spec:
chart: grafana
version: 7.3.0
sourceRef:
kind: HelmRepository
name: grafana
namespace: flux-system
install:
createNamespace: true
values:
admin:
existingSecret: grafana-admin-secret
userKey: admin-user
passwordKey: admin-password
service:
type: LoadBalancer
annotations:
external-dns.alpha.kubernetes.io/hostname: "grafana.hxme.net"
datasources:
datasources.yaml:
apiVersion: 1
datasources:
- name: Loki
type: loki
access: proxy
url: http://loki:3100
isDefault: true

33
deployments-old/monitoring/loki.yaml Normal file
View file

@ -0,0 +1,33 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: loki
namespace: monitoring
spec:
interval: 30m
chart:
spec:
chart: loki
version: 6.6.4
sourceRef:
kind: HelmRepository
name: grafana
namespace: flux-system
install:
createNamespace: true
values:
loki:
auth_enabled: false
singleBinary:
replicas: 1
service:
type: LoadBalancer
annotations:
external-dns.alpha.kubernetes.io/hostname: "loki.hxme.net"
write:
replicas: 1
read:
replicas: 1
backend:
replicas: 1

40
deployments-old/monitoring/prometheus.yaml Normal file
View file

@ -0,0 +1,40 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: prometheus-community
namespace: flux-system
spec:
url: https://prometheus-community.github.io/helm-charts
interval: 1h
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: prometheus-operator
namespace: monitoring
spec:
interval: 30m
chart:
spec:
chart: kube-prometheus-stack
version: 58.1.2
sourceRef:
kind: HelmRepository
name: prometheus-community
namespace: flux-system
install:
createNamespace: true
upgrade:
disableWait: true
timeout: 5m
values:
prometheus:
prometheusSpec:
serviceMonitorSelectorNilUsesHelmValues: false
# Optional: expose Prometheus/Grafana via NodePort, Ingress, etc.
grafana:
enabled: false
alertmanager:
enabled: true

22
deployments-old/monitoring/provider.yaml Normal file
View file

@ -0,0 +1,22 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: monitoring
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: grafana
namespace: flux-system
spec:
url: https://grafana.github.io/helm-charts
interval: 1h
---
apiVersion: v1
kind: Secret
metadata:
name: wildcard-hxme-net
namespace: monitoring
annotations:
replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net

60
deployments-old/operators/mariadb.yaml Normal file
View file

@ -0,0 +1,60 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: mariadb-system
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: mariadb-operator
namespace: flux-system
spec:
url: https://helm.mariadb.com/mariadb-operator
interval: 1h
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: mariadb-operator-crds
namespace: mariadb-system
spec:
interval: 30m
chart:
spec:
chart: mariadb-operator-crds
version: 0.38.1
sourceRef:
kind: HelmRepository
name: mariadb-operator
namespace: flux-system
install:
createNamespace: true
upgrade:
disableWait: true
timeout: 5m
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: mariadb-operator
namespace: mariadb-system
spec:
interval: 30m
chart:
spec:
chart: mariadb-operator
version: 0.38.1
sourceRef:
kind: HelmRepository
name: mariadb-operator
namespace: flux-system
install:
createNamespace: true
dependsOn:
- name: mariadb-operator-crds
namespace: mariadb-system
values:
metrics:
enabled: true

98
deployments-old/operators/replicator.yaml Normal file
View file

@ -0,0 +1,98 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: kubernetes-replicator
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: kubernetes-replicator
rules:
- apiGroups: ["", "apps", "extensions"]
resources:
- secrets
- configmaps
- roles
- rolebindings
- cronjobs
- deployments
- events
- ingresses
- jobs
- pods
- pods/attach
- pods/exec
- pods/log
- pods/portforward
- services
- namespaces
- serviceaccounts
verbs: ["*"]
- apiGroups: ["batch"]
resources:
- configmaps
- cronjobs
- deployments
- events
- ingresses
- jobs
- pods
- pods/attach
- pods/exec
- pods/log
- pods/portforward
- services
verbs: ["*"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources:
- roles
- rolebindings
- clusterrolebindings
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kubernetes-replicator
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: kubernetes-replicator
subjects:
- kind: ServiceAccount
name: kubernetes-replicator
namespace: kube-system
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: mittwald
namespace: flux-system
spec:
url: https://helm.mittwald.de
interval: 1h
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: kubernetes-replicator
namespace: kube-system
spec:
interval: 5m
chart:
spec:
chart: kubernetes-replicator
sourceRef:
kind: HelmRepository
name: mittwald
namespace: flux-system
install:
createNamespace: false
upgrade:
disableWait: false
values:
serviceAccount:
create: false
name: kubernetes-replicator

77
deployments-old/remote-access/rustdesk.yaml Normal file
View file

@ -0,0 +1,77 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: rustdesk
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: rustdesk-charts
namespace: flux-system
spec:
url: https://charts.rustdesk.com
interval: 1h
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: rustdesk-server
namespace: rustdesk
spec:
interval: 30m
chart:
spec:
chart: rustdesk-server
version: 0.5.0
sourceRef:
kind: HelmRepository
name: rustdesk-charts
namespace: flux-system
install:
createNamespace: true
values:
hbbs:
enabled: true
service:
type: ClusterIP
ports:
- name: tcp
port: 21115
targetPort: 21115
- name: tcp-hbbs
port: 21116
targetPort: 21116
- name: udp
port: 21116
targetPort: 21116
protocol: UDP
hbbr:
enabled: true
service:
type: ClusterIP
ports:
- name: tcp-hbbr
port: 21117
targetPort: 21117
ingress:
enabled: true
className: "traefik" # or nginx or your ingress class
annotations: {}
hosts:
- host: rd.hxme.net
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- rd.hxme.net
secretName: rustdesk-tls
# Optional admin password – change this in production
env:
ENCRYPTED_ONLY: "false"
ENABLE_LOG: "true"

72
deployments-old/ssl/certmanager.yaml Normal file
View file

@ -0,0 +1,72 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: jetstack
namespace: flux-system
spec:
url: https://charts.jetstack.io
interval: 1h
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cert-manager
namespace: cert-manager
spec:
interval: 30m
chart:
spec:
chart: cert-manager
version: v1.18.2
sourceRef:
kind: HelmRepository
name: jetstack
namespace: flux-system
install:
crds: CreateReplace
createNamespace: true
values:
installCRDs: true
extraArgs:
- --dns01-recursive-nameservers-only
- --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-rfc2136
spec:
acme:
email: admin@hxme.net
server: https://acme-v02.api.letsencrypt.org/directory
privateKeySecretRef:
name: letsencrypt-rfc2136
solvers:
- dns01:
rfc2136:
nameserver: hawke.hxst.com.au:53
tsigKeyName: "hxme-update-key"
tsigAlgorithm: HMACSHA512
tsigSecretSecretRef:
name: hxme-update-key
key: hxme-update-key
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: wildcard-hxme-net
namespace: cert-manager
spec:
secretName: wildcard-hxme-net
secretTemplate:
annotations:
replicator.v1.mittwald.de/replication-allowed: "true"
replicator.v1.mittwald.de/replicate-to: "monitoring,authentik,nextcloud"
issuerRef:
name: letsencrypt-rfc2136
kind: ClusterIssuer
commonName: "hxme.net"
dnsNames:
- "hxme.net"
- "*.hxme.net"

79
deployments-old/synctools/vaultwarden.yaml Normal file
View file

@ -0,0 +1,79 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: bitwarden
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: bjw-s-charts
namespace: flux-system
spec:
url: https://bjw-s.github.io/helm-charts/
interval: 1h
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: vaultwarden
namespace: bitwarden
spec:
interval: 30m
chart:
spec:
chart: app-template
version: 2.4.0
sourceRef:
kind: HelmRepository
name: bjw-s-charts
namespace: flux-system
install:
createNamespace: true
values:
# Basic container config
image:
repository: vaultwarden/server
tag: 1.30.5
pullPolicy: IfNotPresent
env:
WEBSOCKET_ENABLED: "true"
SIGNUPS_ALLOWED: "false"
DOMAIN: "https://vw.hxme.net"
ADMIN_TOKEN: "CHANGEME_SUPER_SECRET"
service:
main:
ports:
http:
port: 80
ingress:
main:
enabled: true
annotations:
kubernetes.io/ingress.class: "traefik" # Or nginx or your ingress class
hosts:
- host: vw.hxme.net
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- vw.hxme.net
secretName: bitwarden-tls
persistence:
data:
enabled: true
existingClaim: bitwarden-data # You must create a PVC or a StorageClass dynamic claim
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 250m
memory: 512Mi

16
deployments/home-server/dovecot.yaml
View file

@ -39,6 +39,14 @@ data:
ssl = yes ssl = yes
} }
} }
ldap.conf: |
hosts = ldap://auth.hxme.net
auth_bind = yes
base = dc=ldap,dc=goauthentik,dc=io
dn = cn=binduser,ou=service-accounts,dc=ldap,dc=goauthentik,dc=io
dnpass = FtaJpthRpKyhEEy69H5qxPymtSeSeuCT9SQCdXmWDeAe7cgTCnk6HXpSzTNS
user_attrs = =home=/data/%u
user_filter = (&(objectClass=person)(uid=%u))
--- ---
apiVersion: apps/v1 apiVersion: apps/v1
@ -65,10 +73,6 @@ spec:
volumeMounts: volumeMounts:
- name: config - name: config
mountPath: /config/ mountPath: /config/
- name: ldap-config
mountPath: /config/ldap.conf
subPath: ldap.conf
readOnly: true
- name: certs - name: certs
mountPath: /etc/ssl/hxme mountPath: /etc/ssl/hxme
readOnly: true readOnly: true
@ -77,8 +81,8 @@ spec:
configMap: configMap:
name: dovecot-config name: dovecot-config
- name: ldap - name: ldap
secret: configMap:
secretName: dovecot-ldap name: dovecot-ldap
- name: tls - name: tls
secret: secret:
secretName: wildcard-hxme-net secretName: wildcard-hxme-net

94
deployments/home-server/samba.yaml Normal file
View file

@ -0,0 +1,94 @@
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: smb-share-pv
spec:
capacity:
storage: 10Gi
accessModes:
- ReadWriteMany
storageClassName: local-path
persistentVolumeReclaimPolicy: Retain
hostPath:
path: /dpool/
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: smb-share-pvc
namespace: home-server
spec:
accessModes:
- ReadWriteMany
storageClassName: local-path
resources:
requests:
storage: 10Gi
volumeName: smb-share-pv
---
apiVersion: v1
kind: Service
metadata:
name: smb-server
namespace: home-server
spec:
selector:
app: smb-server
ports:
- name: smb
port: 445
targetPort: 445
- name: netbios
port: 139
targetPort: 139
type: NodePort # Use ClusterIP or LoadBalancer depending on access requirements
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: smb-server
namespace: home-server
spec:
replicas: 1
selector:
matchLabels:
app: smb-server
template:
metadata:
labels:
app: smb-server
spec:
containers:
- name: samba
image: dperson/samba
env:
- name: SMB_USER
valueFrom:
secretKeyRef:
name: smb-credentials
key: username
- name: SMB_PASS
valueFrom:
secretKeyRef:
name: smb-credentials
key: password
args:
- -u
- "$(SMB_USER);$(SMB_PASS)"
- -s
- "share;/mount;yes;no;no;$(SMB_USER)"
ports:
- containerPort: 139
- containerPort: 445
securityContext:
capabilities:
add: ["NET_ADMIN"]
volumeMounts:
- name: share
mountPath: /mount
volumes:
- name: share
persistentVolumeClaim:
claimName: smb-share-pvc