shpaq/auricom-home-cluster
1
0
Fork 0
mirror of https://github.com/auricom/home-cluster.git synced 2025-09-17 18:24:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixup! ♻️ migration externalsecrets

Browse Source
This commit is contained in:
auricom
2023-07-10 19:15:56 +02:00
parent fb3be5853f
commit f945aa99f8
49 changed files with 352 additions and 450 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
kubernetes/apps/default/home-assistant/app/externalsecret.yaml
View File

@@ -21,6 +21,7 @@ spec:
HASS_SECRET_LONGITUDE: "{{ .HASS_LONGITUDE }}"
HASS_SECRET_DB_URL: "postgresql://{{ .POSTGRES_USER }}:{{ .POSTGRES_PASS }}@postgres-rw.default.svc.cluster.local/home_assistant"
HASS_SECRET_URL: "{{ .HASS_URL }}"
PROMETHEUS_TOKEN: "{{ .PROMETHEUS_TOKEN }}"
# Postgres Init
INIT_POSTGRES_DBNAME: home_assistant
INIT_POSTGRES_HOST: postgres-rw.default.svc.cluster.local

2
kubernetes/apps/default/home-assistant/app/podmonitor.yaml
View File

@@ -11,7 +11,7 @@ spec:
port: http
scrapeTimeout: 30s
bearerTokenSecret:
name: home-automation
name: home-assistant-secret
key: PROMETHEUS_TOKEN
selector:
matchLabels:

2
kubernetes/apps/default/home-assistant/app/volsync.yaml
View File

@@ -30,7 +30,7 @@ metadata:
name: home-assistant
namespace: default
spec:
sourcePVC: home-assistant-config
sourcePVC: hass-config
trigger:
schedule: "0 7 * * *"
restic:

7
kubernetes/apps/default/joplin/app/helmrelease.yaml
View File

@@ -32,6 +32,13 @@ spec:
controller:
annotations:
reloader.stakater.com/auto: "true"
initContainers:
01-init-db:
image: ghcr.io/onedr0p/postgres-init:14.8
imagePullPolicy: IfNotPresent
envFrom: &envFrom
- secretRef:
name: &secret joplin-secret
image:
repository: joplin/server
tag: 2.11.2-beta

7
kubernetes/apps/default/lidarr/app/backups/kustomization.yaml
View File

@@ -1,7 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./replicationsource.yaml
- ./restic.sops.yaml

25
kubernetes/apps/default/lidarr/app/backups/replicationsource.yaml
View File

@@ -1,25 +0,0 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
name: lidarr
namespace: default
spec:
sourcePVC: lidarr-config
trigger:
schedule: "0 0 * * *"
restic:
copyMethod: Snapshot
pruneIntervalDays: 10
repository: lidarr-restic
cacheCapacity: 2Gi
volumeSnapshotClassName: csi-ceph-blockpool
storageClassName: rook-ceph-block
moverSecurityContext:
runAsUser: 568
runAsGroup: 568
fsGroup: 568
retain:
daily: 10
within: 3d

35
kubernetes/apps/default/lidarr/app/backups/restic.sops.yaml
View File

@@ -1,35 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: lidarr-restic
namespace: default
type: Opaque
stringData:
#ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
RESTIC_REPOSITORY: ENC[AES256_GCM,data:9TU2gSIK5QV/xBdBBziqF7ajXzwH8F/ZssdBHwufbWVWcDvT+1bVrINVEiHWQf5XnqxOpphq9cI=,iv:l7+Sd+QhcRuq0d0AcBoeRaQCVFxjokRxwh4QQ+BFoxA=,tag:15dkxHK2dOYGiHYI1BZ9Yw==,type:str]
#ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
#ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
#ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-12-28T15:33:10Z"
mac: ENC[AES256_GCM,data:SqVBbFRJ1z/Jq6O5EbGsL20yLjMRf2UyQXmBUxwbLRK8WfBahgW0YYcXCnzWsSWAgAIxgn18INd61zMiH9eT6MIRi2N1avtwoHYIY8Z6lG/+qPf4fUXeXTALuhozwJ73ozYw9hPKh+nUYuSZHluEv8xRalu5Ml4uPY5EhER5l5Q=,iv:4Dja+GbOy986eYvlNSGH0rH/UuQr6sPBzEw8gQbQHsw=,tag:7R7lYosch5PSCZodb1uhdQ==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

18
kubernetes/apps/default/lidarr/app/externalsecret.yaml Normal file
View File

@@ -0,0 +1,18 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: lidarr
namespace: default
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: lidarr-secret
creationPolicy: Owner
dataFrom:
- extract:
# LIDARR__API_KEY
key: lidarr

9
kubernetes/apps/default/lidarr/app/helmrelease.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: &app lidarr
namespace: default
spec:
interval: 15m
interval: 30m
chart:
spec:
chart: app-template
@@ -15,7 +15,7 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
maxHistory: 2
install:
createNamespace: true
remediation:
@@ -27,6 +27,9 @@ spec:
uninstall:
keepHistory: false
values:
controller:
annotations:
reloader.stakater.com/auto: "true"
image:
repository: ghcr.io/onedr0p/lidarr-develop
tag: 1.2.6.3313@sha256:495d884e08bb476ad16f5428c87e143efbf1be5556c9a6e0525ecaafc777e407
@@ -37,7 +40,7 @@ spec:
LIDARR__LOG_LEVEL: info
envFrom:
- secretRef:
name: *app
name: lidarr-secret
service:
main:
ports:

4
kubernetes/apps/default/lidarr/app/kustomization.yaml
View File

@@ -4,7 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./backups
- ./externalsecret.yaml
- ./helmrelease.yaml
- ./secret.sops.yaml
- ./volsync.yaml
- ./volume.yaml

29
kubernetes/apps/default/lidarr/app/secret.sops.yaml
View File

@@ -1,29 +0,0 @@
# yamllint disable
apiVersion: v1
kind: Secret
metadata:
name: lidarr
namespace: default
type: Opaque
stringData:
LIDARR__API_KEY: ENC[AES256_GCM,data:GSu/jivdFANYsUrPwRM5bwrWLX/7nwKn9AOLium0m6Y=,iv:xn+wD7ZyJfL80UpAVy/XIiubtifwIrBuU876Uy8vrgU=,tag:H8lV7wJeV2m2XDLVMx6p/Q==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-12-28T15:32:56Z"
mac: ENC[AES256_GCM,data:qYD7LQtuhERFaWAhakfOrX8kRtB9gVa4e3ePf8X61edHBzJAInvUceBCOUDZahnyCSg6pzBIfFp5uOgPbYTs8wfc4Aq/vvgWt4b7LIRdWbpo3EoYDfL/fKKZFGzOoX42y9Krd8dtndD0YYRvRt4pQkBwEkAluSOWbNOG1rWBnHw=,iv:3EZYLcxGsS9YyaITAKw9AG8TWCZrbm80pv7ohQXSZvU=,tag:eQNjWtRicx0b++n28qK7wQ==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

49
kubernetes/apps/default/lidarr/app/volsync.yaml Normal file
View File

@@ -0,0 +1,49 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: lidarr-restic
namespace: default
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: lidarr-restic-secret
creationPolicy: Owner
template:
engineVersion: v2
data:
RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lidarr'
RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}'
AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}'
AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}'
dataFrom:
- extract:
key: volsync-restic-template
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
name: lidarr
namespace: default
spec:
sourcePVC: lidarr-config
trigger:
schedule: "0 7 * * *"
restic:
copyMethod: Snapshot
pruneIntervalDays: 7
repository: lidarr-restic-secret
cacheCapacity: 10Gi
volumeSnapshotClassName: csi-ceph-blockpool
storageClassName: rook-ceph-block
moverSecurityContext:
runAsUser: 568
runAsGroup: 568
fsGroup: 568
retain:
daily: 7
within: 3d

1
kubernetes/apps/default/lidarr/ks.yaml
View File

@@ -9,6 +9,7 @@ metadata:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-external-secrets-stores
- name: cluster-apps-rook-ceph-cluster
- name: cluster-apps-volsync-app
path: ./kubernetes/apps/default/lidarr/app

7
kubernetes/apps/default/lychee/app/backups/kustomization.yaml
View File

@@ -1,7 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./replicationsource.yaml
- ./restic.sops.yaml

25
kubernetes/apps/default/lychee/app/backups/replicationsource.yaml
View File

@@ -1,25 +0,0 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
name: lychee
namespace: default
spec:
sourcePVC: lychee-files
trigger:
schedule: "0 0 * * *"
restic:
copyMethod: Snapshot
pruneIntervalDays: 10
repository: lychee-restic
cacheCapacity: 20Gi
volumeSnapshotClassName: csi-ceph-blockpool
storageClassName: rook-ceph-block
moverSecurityContext:
runAsUser: 33
runAsGroup: 33
fsGroup: 33
retain:
daily: 10
within: 3d

35
kubernetes/apps/default/lychee/app/backups/restic.sops.yaml
View File

@@ -1,35 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: lychee-restic
namespace: default
type: Opaque
stringData:
#ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
RESTIC_REPOSITORY: ENC[AES256_GCM,data:indKdyrRptk2rKJFrtaNjufG4asKcjTb9mvQjW9t00iJuR1mNLafazViyBcEjIoSm4MN4B9WAI4=,iv:E16uoSrAJQ+CF/uu1dP5ZJ9l0uT5DyTbWa50j3pGk1I=,tag:TPpmObERt9fz8tgWA1P81g==,type:str]
#ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
#ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
#ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-12-28T15:00:37Z"
mac: ENC[AES256_GCM,data:rl+tYaE6BAR0IFy4Jz2mZ6MZKBDmjZ8R0WCxrpV9jgWWGKKnIfduRoiErXFTSX3BojqSMnOowzi3Y7W0YgZTHPJXfymTHx4UfbRyNJkZHOc4P6S4tyZLxj5n/F9uO/i4GSt+x0By2PLuVJUR5oY2siLezSCDevtiSs6MEIlLRAw=,iv:1tvzLaymrwk3u6pv8Y9wbh7Xz8gbUZZ5C3meLFNDB1E=,tag:kDU4NvGtullPjHe0Fw+JVg==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

34
kubernetes/apps/default/lychee/app/externalsecret.yaml Normal file
View File

@@ -0,0 +1,34 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: lychee
namespace: default
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: lychee-secret
creationPolicy: Owner
template:
engineVersion: v2
data:
# App
DB_HOST: &dbHost postgres-rw.default.svc.cluster.local
DB_PORT: "5432"
DB_DATABASE: &dbName lychee
DB_USERNAME: &dbUser "{{ .POSTGRES_USERNAME }}"
DB_PASSWORD: &dbPass "{{ .POSTGRES_PASSWORD }}"
# Postgres Init
INIT_POSTGRES_DBNAME: *dbName
INIT_POSTGRES_HOST: *dbHost
INIT_POSTGRES_USER: *dbUser
INIT_POSTGRES_PASS: *dbPass
INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
dataFrom:
- extract:
key: cloudnative-pg
- extract:
key: lychee

19
kubernetes/apps/default/lychee/app/helmrelease.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: &app lychee
namespace: default
spec:
interval: 15m
interval: 30m
chart:
spec:
chart: app-template
@@ -15,7 +15,7 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
maxHistory: 2
install:
createNamespace: true
remediation:
@@ -27,6 +27,16 @@ spec:
uninstall:
keepHistory: false
values:
initContainers:
01-init-db:
image: ghcr.io/onedr0p/postgres-init:14.8
imagePullPolicy: IfNotPresent
envFrom: &envFrom
- secretRef:
name: &secret lychee-secret
controller:
annotations:
reloader.stakater.com/auto: "true"
image:
repository: lycheeorg/lychee-laravel
tag: v4.9.4
@@ -34,14 +44,11 @@ spec:
TIMEZONE: ${TIMEZONE}
APP_NAME: Lychee
DB_CONNECTION: pgsql
DB_HOST: ${POSTGRES_HOST}
DB_PORT: ${POSTGRES_PORT}
DB_DATABASE: lychee
REDIS_HOST: redis.default.svc.cluster.local.
REDIS_PORT: 6379
envFrom:
- secretRef:
name: *app
name: lychee-secret
service:
main:
ports:

6
kubernetes/apps/default/lychee/app/kustomization.yaml
View File

@@ -4,9 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./backups
- ./externalsecret.yaml
- ./helmrelease.yaml
- ./secret.sops.yaml
- ./volsync.yaml
- ./volume.yaml
patchesStrategicMerge:
- ./patches/postgres.yaml

32
kubernetes/apps/default/lychee/app/patches/postgres.yaml
View File

@@ -1,32 +0,0 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: lychee
namespace: default
spec:
values:
initContainers:
init-db:
image: ghcr.io/onedr0p/postgres-initdb:14.8
env:
- name: POSTGRES_HOST
value: ${POSTGRES_HOST}
- name: POSTGRES_DB
value: lychee
- name: POSTGRES_SUPER_PASS
valueFrom:
secretKeyRef:
name: postgres-superuser
key: password
- name: POSTGRES_USER
valueFrom:
secretKeyRef:
name: lychee
key: DB_USERNAME
- name: POSTGRES_PASS
valueFrom:
secretKeyRef:
name: lychee
key: DB_PASSWORD

30
kubernetes/apps/default/lychee/app/secret.sops.yaml
View File

@@ -1,30 +0,0 @@
# yamllint disable
apiVersion: v1
kind: Secret
metadata:
name: lychee
namespace: default
type: Opaque
stringData:
DB_USERNAME: ENC[AES256_GCM,data:aEFa7HU4,iv:fS7dJjHGB/Qd0lLKKOG1MJ18WA6L3YxyBWbo8gZvmXc=,tag:FRTCcKgAy9oqUw/qz8MSwg==,type:str]
DB_PASSWORD: ENC[AES256_GCM,data:sc3ekmCLFNk+Oy9fAF4=,iv:Jr8XwbB5wO0rGbozPODZIijg9BbBiqnoV34YDOEJHc8=,tag:M/3L2WbfHkRUvfP95GLcMQ==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-12-28T15:01:21Z"
mac: ENC[AES256_GCM,data:k1UsbtS868JoU28Y1vi+Pdbe5TlHKuH8HFMUrh8V6JA2Kak0TvS+3Mi7aAhXQJnWZRegeyrV4A2Z9rfuS55uKztFDQHdTmk0o00I9rq0G42EdsaynIM2ToR61/1cBHvwUuopxEJ8S+sM18/W0IQIJ2qH4hZsdQBVI75KtehSlT8=,iv:Il7gSuAItFi1k2UF3Y1qPpq+rjDQQx/qtl1Vt0+Th6M=,tag:5vTTFYYzuvDoRORuOsR7aQ==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

49
kubernetes/apps/default/lychee/app/volsync.yaml Normal file
View File

@@ -0,0 +1,49 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: lychee-restic
namespace: default
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: lychee-restic-secret
creationPolicy: Owner
template:
engineVersion: v2
data:
RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lychee'
RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}'
AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}'
AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}'
dataFrom:
- extract:
key: volsync-restic-template
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
name: lychee
namespace: default
spec:
sourcePVC: lychee-files
trigger:
schedule: "0 7 * * *"
restic:
copyMethod: Snapshot
pruneIntervalDays: 7
repository: lychee-restic-secret
cacheCapacity: 20Gi
volumeSnapshotClassName: csi-ceph-blockpool
storageClassName: rook-ceph-block
moverSecurityContext:
runAsUser: 33
runAsGroup: 33
fsGroup: 33
retain:
daily: 7
within: 3d

1
kubernetes/apps/default/lychee/ks.yaml
View File

@@ -15,6 +15,7 @@ spec:
name: home-ops-kubernetes
dependsOn:
- name: cluster-apps-cloudnative-pg-cluster
- name: cluster-apps-external-secrets-stores
- name: cluster-apps-rook-ceph-cluster
- name: cluster-apps-volsync-app
healthChecks:

18
kubernetes/apps/default/mailrise/app/externalsecret.yaml Normal file
View File

@@ -0,0 +1,18 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: mailrise
namespace: default
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: mailrise-secret
creationPolicy: Owner
dataFrom:
- extract:
# PUSHOVER_TRUENAS
key: mailrise

8
kubernetes/apps/default/mailrise/app/helmrelease.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: &app mailrise
namespace: default
spec:
interval: 15m
interval: 30m
chart:
spec:
chart: app-template
@@ -15,7 +15,7 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
maxHistory: 2
install:
createNamespace: true
remediation:
@@ -39,7 +39,7 @@ spec:
TZ: ${TIMEZONE}
envFrom:
- secretRef:
name: *app
name: mailrise-secret
service:
main:
type: LoadBalancer
@@ -77,8 +77,6 @@ spec:
labelSelector:
matchLabels:
app.kubernetes.io/name: *app
podAnnotations:
secret.reloader.stakater.com/reload: *app
resources:
requests:
cpu: 10m

2
kubernetes/apps/default/mailrise/app/kustomization.yaml
View File

@@ -4,8 +4,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./externalsecret.yaml
- ./helmrelease.yaml
- ./secret.sops.yaml
configMapGenerator:
- name: mailrise-configmap
files:

29
kubernetes/apps/default/mailrise/app/secret.sops.yaml
View File

@@ -1,29 +0,0 @@
# yamllint disable
apiVersion: v1
kind: Secret
metadata:
name: mailrise
namespace: default
type: Opaque
stringData:
PUSHOVER_TRUENAS: ENC[AES256_GCM,data:0sViJTQ7VNLccJLzJpwYQGbX0wP3oMCdMng/OFMW85Vfkejag0EEIP6HBCo/rOetq6VAtjvDoUNIx7I2HlHmm0uE7+oM,iv:bz43yn8QOG2/oWnxISTd5Y/JHVdhVfemcNWi62OGD2Q=,tag:YckZYWnKnhXB+0vUO9T5Tg==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-12-29T15:53:20Z"
mac: ENC[AES256_GCM,data:NwSRgt+Qr/suY+xca7c9hAAivYTPr9Uo9dJ5bzJzN8F1Tj4jxQcD/NHYvn+8OiPg9PCOlVDLzwcuuwUBwDc01diUMmkH5VTz50nQIO+CNlESJrVCDLEId8qgw3qU9AlBg9ik1lmNtggwl5X8NLduzrmYqS3mi+/jgt/3spZuLOA=,iv:FDe5+AEFs+76sP4PkwLIoofKcg0AbEqITp7nZKfab7o=,tag:zwcklTcIo4qeGxFLasidEw==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

2
kubernetes/apps/default/mailrise/ks.yaml
View File

@@ -13,6 +13,8 @@ spec:
sourceRef:
kind: GitRepository
name: home-ops-kubernetes
dependsOn:
- name: cluster-apps-external-secrets-stores
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease

7
kubernetes/apps/default/media-browser/app/backups/kustomization.yaml
View File

@@ -1,7 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./replicationsource.yaml
- ./restic.sops.yaml

21
kubernetes/apps/default/media-browser/app/backups/replicationsource.yaml
View File

@@ -1,21 +0,0 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
name: media-browser
namespace: default
spec:
sourcePVC: media-browser-config
trigger:
schedule: "0 0 * * *"
restic:
copyMethod: Snapshot
pruneIntervalDays: 10
repository: media-browser-restic
cacheCapacity: 2Gi
volumeSnapshotClassName: csi-ceph-blockpool
storageClassName: rook-ceph-block
retain:
daily: 10
within: 3d

34
kubernetes/apps/default/media-browser/app/backups/restic.sops.yaml
View File

@@ -1,34 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: media-browser-restic
type: Opaque
stringData:
#ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
RESTIC_REPOSITORY: ENC[AES256_GCM,data:0yTdf+xoL8IPuWqVGPSWDpJ9/mDomP9QR5NCkDHrFDoY30nsvyDSChBWa3gCtrBjQOvyoXsfPg2N2eCCvSIR,iv:Ky3NuiDgw9w4isHBNcaWx1EQX5893GgaCPyhCNgmcLM=,tag:TnMn/2adBvA6emxeSRayxA==,type:str]
#ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
#ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
#ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-12-28T14:47:51Z"
mac: ENC[AES256_GCM,data:glyXcw3UgFAceT3sfX1YsO1pZBQg29fK8iXGiaIfx+AlHD/AerUOSoFGYHhlun3lRbXxv1jH8Q4Jkd4afpcQmA9fpXEEP/OIrWF0ORSrPG8jAOCGYHyFoMv4MevTUZqSfY2g8vVfYQt++5TBPDTZe/JNdoPO0v9ENGjWTnPnq3g=,iv:oynyyDwR0yLE5+ZtyZY1Ynhm5xbD8pQ05Hbz/tJROrY=,tag:ULMrr+hXq/Ga2vsf8hHcwg==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

8
kubernetes/apps/default/media-browser/app/helmrelease.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: &app media-browser
namespace: default
spec:
interval: 15m
interval: 30m
chart:
spec:
chart: app-template
@@ -15,7 +15,7 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
maxHistory: 2
install:
createNamespace: true
remediation:
@@ -27,6 +27,9 @@ spec:
uninstall:
keepHistory: false
values:
controller:
annotations:
reloader.stakater.com/auto: "true"
image:
repository: docker.io/filebrowser/filebrowser
tag: v2.23.0
@@ -61,6 +64,7 @@ spec:
enabled: true
ingressClassName: "nginx"
annotations:
auth.home.arpa/enabled: "true"
hajimari.io/icon: mdi:folder-play-outline
hosts:
- host: &host "{{ .Release.Name }}.${SECRET_CLUSTER_DOMAIN}"

2
kubernetes/apps/default/media-browser/app/kustomization.yaml
View File

@@ -4,6 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./backups
- ./helmrelease.yaml
- ./volsync.yaml
- ./volume.yaml

49
kubernetes/apps/default/media-browser/app/volsync.yaml Normal file
View File

@@ -0,0 +1,49 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: lychee-restic
namespace: default
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: lychee-restic-secret
creationPolicy: Owner
template:
engineVersion: v2
data:
RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lychee'
RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}'
AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}'
AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}'
dataFrom:
- extract:
key: volsync-restic-template
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
name: lychee
namespace: default
spec:
sourcePVC: lychee-files
trigger:
schedule: "0 7 * * *"
restic:
copyMethod: Snapshot
pruneIntervalDays: 7
repository: lychee-restic-secret
cacheCapacity: 20Gi
volumeSnapshotClassName: csi-ceph-blockpool
storageClassName: rook-ceph-block
moverSecurityContext:
runAsUser: 33
runAsGroup: 33
fsGroup: 33
retain:
daily: 7
within: 3d

1
kubernetes/apps/default/media-browser/ks.yaml
View File

@@ -9,6 +9,7 @@ metadata:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-external-secrets-stores
- name: cluster-apps-rook-ceph-cluster
- name: cluster-apps-volsync-app
path: ./kubernetes/apps/default/media-browser/app

4
kubernetes/apps/default/music-transcode/app/helm-release.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: music-transcode
namespace: default
spec:
interval: 15m
interval: 30m
chart:
spec:
chart: app-template
@@ -15,7 +15,7 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
maxHistory: 2
install:
createNamespace: true
remediation:

7
kubernetes/apps/default/navidrome/app/backups/kustomization.yaml
View File

@@ -1,7 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./replicationsource.yaml
- ./restic.sops.yaml

25
kubernetes/apps/default/navidrome/app/backups/replicationsource.yaml
View File

@@ -1,25 +0,0 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
name: navidrome
namespace: default
spec:
sourcePVC: navidrome-config
trigger:
schedule: "0 0 * * *"
restic:
copyMethod: Snapshot
pruneIntervalDays: 10
repository: navidrome-restic
cacheCapacity: 2Gi
volumeSnapshotClassName: csi-ceph-blockpool
storageClassName: rook-ceph-block
moverSecurityContext:
runAsUser: 568
runAsGroup: 568
fsGroup: 568
retain:
daily: 10
within: 3d

34
kubernetes/apps/default/navidrome/app/backups/restic.sops.yaml
View File

@@ -1,34 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: navidrome-restic
type: Opaque
stringData:
#ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
RESTIC_REPOSITORY: ENC[AES256_GCM,data:/DJM9W9fInB4vj+epdSzoZ6qLJbtgNATZXW34AZ2gStf57gF8QB2z+kiKKEv4bYdcMmg2Q06ejPMvxc=,iv:3gMbOnVt7DZjiMVy3h9FkXDWBdyw1uLmPtwKvApqKyQ=,tag:jFRup6tGA8pfvOOPGlkfow==,type:str]
#ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
#ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
#ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-12-28T14:46:17Z"
mac: ENC[AES256_GCM,data:NWdJiyeL7eqshNhdWXQNHYOEFRbJ38hlz6p2K1RW+poJaSdFwk8sPIcou/h2xbU2Dxf3I7om0nZEeLgFtL1RZ7uTk5fpE6eOvtFerQx+uhHOfm03Ti2kofDLf/RgufPtw9ztq73a/lFBlAYAIFzn9PM95fkvjdRfrHs05PuNFAc=,iv:L7+N//Mh32T9gT5AQ9Nq433odU2lxEot1KaJkEbjOLQ=,tag:Fn4B2an5C0+H48rSc5aQnA==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

4
kubernetes/apps/default/navidrome/app/helmrelease.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: &app navidrome
namespace: default
spec:
interval: 15m
interval: 30m
chart:
spec:
chart: app-template
@@ -15,7 +15,7 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
maxHistory: 2
install:
createNamespace: true
remediation:

2
kubernetes/apps/default/navidrome/app/kustomization.yaml
View File

@@ -4,6 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./backups
- ./helmrelease.yaml
- ./volsync.yaml
- ./volume.yaml

49
kubernetes/apps/default/navidrome/app/volsync.yaml Normal file
View File

@@ -0,0 +1,49 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: navidrome-restic
namespace: default
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: navidrome-restic-secret
creationPolicy: Owner
template:
engineVersion: v2
data:
RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/navidrome'
RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}'
AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}'
AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}'
dataFrom:
- extract:
key: volsync-restic-template
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
name: navidrome
namespace: default
spec:
sourcePVC: navidrome-config
trigger:
schedule: "0 7 * * *"
restic:
copyMethod: Snapshot
pruneIntervalDays: 7
repository: navidrome-restic-secret
cacheCapacity: 20Gi
volumeSnapshotClassName: csi-ceph-blockpool
storageClassName: rook-ceph-block
moverSecurityContext:
runAsUser: 568
runAsGroup: 568
fsGroup: 568
retain:
daily: 7
within: 3d

1
kubernetes/apps/default/navidrome/ks.yaml
View File

@@ -9,6 +9,7 @@ metadata:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-external-secrets-stores
- name: cluster-apps-rook-ceph-cluster
- name: cluster-apps-volsync-app
path: ./kubernetes/apps/default/navidrome/app

9
kubernetes/apps/default/nitter/app/helmrelease.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: &app nitter
namespace: default
spec:
interval: 15m
interval: 30m
chart:
spec:
chart: app-template
@@ -15,7 +15,7 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
maxHistory: 2
install:
createNamespace: true
remediation:
@@ -27,6 +27,9 @@ spec:
uninstall:
keepHistory: false
values:
controller:
annotations:
reloader.stakater.com/auto: "true"
image:
repository: docker.io/zedeus/nitter
tag: latest@sha256:db0674e7426309b0ae41ad36fa0bbd1d52ab7abe20823b27a49017116a2c0b34
@@ -74,8 +77,6 @@ spec:
subPath: config.yml
mountPath: /src/nitter.conf
readOnly: false
podAnnotations:
secret.reloader.stakater.com/reload: *app
resources:
requests:
cpu: 50m

18
kubernetes/apps/default/opnsense/app/externalsecret.yaml Normal file
View File

@@ -0,0 +1,18 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: opnsense-backup
namespace: default
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: opnsense-backup-secret
creationPolicy: Owner
dataFrom:
- extract:
# OPNSENSE_KEY, OPNSENSE_SECRET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
key: opnsense-backup

6
kubernetes/apps/default/opnsense/app/helmrelease.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: opnsense-backup
namespace: default
spec:
interval: 15m
interval: 30m
chart:
spec:
chart: app-template
@@ -15,13 +15,17 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
controller:
type: cronjob

2
kubernetes/apps/default/opnsense/app/kustomization.yaml
View File

@@ -4,7 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./secret.sops.yaml
- ./externalsecret.yaml
- ./helmrelease.yaml
configMapGenerator:
- name: opnsense-backup-configmap

31
kubernetes/apps/default/opnsense/app/secret.sops.yaml
View File

@@ -1,31 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: opnsense-backup-secret
namespace: default
type: Opaque
stringData:
OPNSENSE_KEY: ENC[AES256_GCM,data:o2RT80AbQJg1EOFbX3iMIyC8eRIVx0YcL7/+H51SpDdcs0ynisIaKgycxOTg6t65VTApnVhyZaWgVbQxfSsH2zKuGT9dFYfUHbcFjve3isc=,iv:l/qvdOFBZhA2LFV7Q6vIBuVkNSJmEWEqiAUU9vXsSuo=,tag:Itiz/H7S4F+TktGyT7WX2A==,type:str]
OPNSENSE_SECRET: ENC[AES256_GCM,data:ITYxDGhq7rxU2w3BSa3t+ka/TbPipP1tJzoUuWkvNyXxBlNV277oNRWxMUta210+xq9C8m7BD7ay6lVrbvev4Rf8YNdgTGXl6tFmfVnSqmo=,iv:MbrRhgGoRz2cu9H0y+pYBZrX2CikDfplOGH0h8e6GDo=,tag:pVqki2c534KKZ8GLSF3BlQ==,type:str]
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:bi/0BL4yJo64Ya4tFmyjjfxcSgM=,iv:WfaYaVCMvq4MlUY3AHyyd5UyVngLX8qjC4WDJyStGhg=,tag:6Rk/Qsf5cfSbZm0be4V1wA==,type:str]
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:jfCGidFYWH45ilkGvViGLQ8ZXDTMCKaH93DtbtEwITGlEUuMYNZIxA==,iv:2kNo+aj7m9rCaovgXoIbiTQFgUux9L4LsQLH+GHGLaA=,tag:m+qNg1DHuNfaakYdMB4QpQ==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMEhOUTJMcUYvNFozRDNr
WnhJTEYzVWN4V1VXemhtWWU1SmMvUmljNFFNCk91aHhXRVBDSzhhcjIzalQ5SEpN
cTJIOGVVYWNYRGdtMm5nZUZ5Q0EzTE0KLS0tIFRMYnNGakdrSktjT2ZoNk1sN21C
YlhlTVhRdDFJUVZiMTdtVXlveWNDWE0KG7MKLp5tUCm7KpuhpmsvAWDrreBuHSEp
zyH6hY1i7jgjh020qZI32zNDHeTIJhi+mHur/jvBJhEGLMz6JYUPrg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-12-29T07:38:56Z"
mac: ENC[AES256_GCM,data:1tbBSKSUY1PFKcoQshI/6mv1KUV3b/K/BGALgNNDunjc4PRVBOMbZI6Aa4MWk0ElN7NB9Y6nO+Gv+i6sTet4peRMEBnfoWTSRjImYMiyt+aQ2XjMfI/ZEtOBgv8VFmSQr68Mkgp1zDLiD8lCwewE1nqoUg82jQNzy/bFUYcvIfY=,iv:IKd7yXgBfZBJX7yKH6HzlETA7WBvJrmsWNpO+ZZsElA=,tag:5R05VsD8CPHu8PX+MLXuJw==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

2
kubernetes/apps/default/opnsense/ks.yaml
View File

@@ -13,6 +13,8 @@ spec:
sourceRef:
kind: GitRepository
name: home-ops-kubernetes
dependsOn:
- name: cluster-apps-external-secrets-stores
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease