fixes

.github/workflows/main.yml

@@ -55,10 +55,12 @@ jobs:
 
       - name: Install dependencies
         run: pnpm install
+        working-directory: images/operator
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Run tests
+        working-directory: images/operator
         run: pnpm test
 
   update-release-draft:

.github/workflows/publish-backup-tag.yml

@@ -0,0 +1,65 @@
+name: Publish tag
+
+on:
+  push:
+    branches:
+      - "main"
+    tags:
+      - "v*"
+
+env:
+  environment: test
+  release_channel: latest
+  DO_NOT_TRACK: "1"
+  NODE_VERSION: "23.x"
+  DOCKER_REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}-backup
+  PNPM_VERSION: 10.6.0
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  release:
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      pages: write
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: ./images/backup
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

.github/workflows/publish-tag.yml

@@ -3,7 +3,7 @@ name: Publish tag
 on:
   push:
     branches:
-      - 'main'
+      - "main"
     tags:
       - "v*"
 
@@ -52,7 +52,7 @@ jobs:
         id: push
         uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
         with:
-          context: .
+          context: ./images/operator
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -1,39 +1,2 @@
-# dependencies (bun install)
-node_modules
-
-# output
-out
-dist
-*.tgz
-
-# code coverage
-coverage
-*.lcov
-
-# logs
-logs
-_.log
-report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
-
-# dotenv environment variable files
-.env
-.env.development.local
-.env.test.local
-.env.production.local
-.env.local
-
-# caches
-.eslintcache
-.cache
-*.tsbuildinfo
-
-# IntelliJ based IDEs
-.idea
-
-# Finder (MacOS) folder config
-.DS_Store
-
-/data/
-
-/cloudflare.yaml
 /secret.*.yaml
+/data/

.python-version

@@ -1 +0,0 @@
-3.13

charts/apps/AGENT.md

@@ -0,0 +1,136 @@
+# Agent Documentation
+
+This document describes how to create a new application chart for the homelab operator.
+
+## Chart Structure
+
+Each application has its own chart located in a directory under `charts/apps`. The chart should contain the following files:
+
+- `Chart.yaml`: The chart metadata.
+- `values.yaml`: The default values for the chart.
+- `templates/`: A directory containing the Kubernetes resource templates.
+
+## Custom Resources
+
+The homelab operator uses several custom resources to manage applications. These resources are defined in the `templates` directory of the chart.
+
+### `PostgresDatabase`
+
+If the application requires a PostgreSQL database, you can create a `PostgresDatabase` resource. The operator will automatically create a database and a secret containing the connection details. The secret will have the same name as the release with a `-pg-connection` postfix.
+
+Example:
+
+```yaml
+# templates/database.yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+```
+
+The secret has the following values:
+
+- `database`: name of the created database
+- `host`: the hostname of the postgres server
+- `port`: the port of the postgres server
+- `url`: combined url in the format `postgresql://{user}:{password}@{host}:{port}/{database}`
+
+### `OidcClient`
+
+If the application requires OIDC authentication, you can create an `OidcClient` resource. The operator will automatically create an OIDC client and a secret containing the client ID and secret. The secret will have the same name as the release with a `-client` postfix.
+
+You need to specify the redirect URIs for the OIDC client. The subdomain is taken from the `values.yaml` file.
+
+Example:
+
+```yaml
+# templates/client.yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: /user/oauth2/Authentik/callback
+      subdomain: "{{ .Values.subdomain }}"
+      matchingMode: strict
+```
+
+The secret has the following value:
+
+- `authorization`: Authorization endpoint
+- `clientId`
+- `clientSecret`
+- `configuration`: autodiscovery endpoint
+- `configurationIssuer`: issuer url
+- `endSession`: end session endpoint
+- `jwks`: jwks endpoint
+- `token`: token endpoint
+- `userinfo`: user info endpoint
+
+### `HttpService` and `ExternalHttpService`
+
+To expose the application, you can use either an `HttpService` or an `ExternalHttpService` resource.
+
+- `HttpService`: This will expose the application through the Istio gateway. This is for internal access only.
+- `ExternalHttpService`: This will expose the application through a CloudFlare tunnel. This is for external access.
+
+Both resources take a `subdomain` and a `destination` as parameters. The `destination` is the Kubernetes service to route traffic to.
+
+Example of `HttpService`:
+
+```yaml
+# templates/http-service.yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
+    port:
+      number: 80
+```
+
+Example of `ExternalHttpService`:
+
+```yaml
+# templates/external-http-service.yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
+    port:
+      number: 80
+```
+
+## `values.yaml`
+
+The `values.yaml` file should contain the following values:
+
+- `globals.environment`: The environment the application is running in (e.g., `prod`, `dev`).
+- `image.repository`: The Docker image repository.
+- `image.tag`: The Docker image tag.
+- `subdomain`: The subdomain for the application.
+
+Example:
+
+```yaml
+# values.yaml
+globals:
+  environment: prod
+image:
+  repository: docker.gitea.com/gitea
+  tag: latest
+subdomain: gitea
+```

charts/apps/charts/volumes/templates/books-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: books
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-books
-  nfs:
-    path: '{{ .Values.books.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: books
-spec:
-  storageClassName: manual-books
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/charts/volumes/templates/movies-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: movies
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-movies
-  nfs:
-    path: '{{ .Values.movies.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: movies
-spec:
-  storageClassName: manual-movies
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/charts/volumes/templates/music-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: music
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-music
-  nfs:
-    path: '{{ .Values.music.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: music
-spec:
-  storageClassName: manual-music
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/charts/volumes/templates/tv-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: tvshows
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-tvshows
-  nfs:
-    path: '{{ .Values.tvshows.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: tvshows
-spec:
-  storageClassName: manual-tvshows
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/charts/volumes/values.yaml

@@ -1,11 +0,0 @@
-host: 192.168.20.106
-movies:
-  path: /mnt/HDD/Movies
-tvshows:
-  path: /mnt/HDD/TV-Shows
-music:
-  path: /mnt/HDD/Music2
-books:
-  path: /mnt/HDD/Books
-podcasts:
-  path: /mnt/HDD/Podcasts

charts/apps/harbor/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: monitoring

charts/apps/harbor/templates/helm.yaml

@@ -0,0 +1,38 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  interval: 1h
+  url: https://helm.goharbor.io
+
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  chart:
+    spec:
+      chart: harbor
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        apiVersion: source.toolkit.fluxcd.io/v1
+        kind: HelmRepository
+        name: '{{ .Release.Name }}'
+        namespace: '{{ .Release.Namespace }}'
+  interval: 1h
+  values:
+    persistence:
+      persistentVolumeClaim:
+        registry:
+          storageClass: '{{ .Values.globals.environment }}'
+        jobservice:
+          jobLog:
+            storageClass: '{{ .Values.globals.environment }}'
+        database:
+          storageClass: '{{ .Values.globals.environment }}'
+        redis:
+          storageClass: '{{ .Values.globals.environment }}'
+        trivy:
+          storageClass: '{{ .Values.globals.environment }}'

charts/apps/harbor/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/harbor/values.yaml

@@ -0,0 +1,3 @@
+globals:
+  environment: prod
+subdomain: harbor