mirror of
https://github.com/morten-olsen/homelab-operator.git
synced 2026-02-08 01:36:28 +01:00
Compare commits
92 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
0b9bb40706 | ||
|
|
1d8f10cc88 | ||
|
|
de431ca488 | ||
|
|
ca8f632fca | ||
|
|
396a936c5c | ||
|
|
3f15920744 | ||
|
|
58255669dc | ||
|
|
e0d47f7803 | ||
|
|
6538f9ee24 | ||
|
|
9599beae72 | ||
|
|
af72239295 | ||
|
|
5fa12c203d | ||
|
|
440328ce6b | ||
|
|
67e9c3bc32 | ||
|
|
51242946e2 | ||
|
|
b33d68bf09 | ||
|
|
14adfd6227 | ||
|
|
a56e8b0ad8 | ||
|
|
1c587216cc | ||
|
|
d3abe5bb87 | ||
|
|
7c2e4b591e | ||
|
|
f553fb891c | ||
|
|
daa4abc6d6 | ||
|
|
bdf4aafbbb | ||
|
|
2e597ee105 | ||
|
|
d59aabb30c | ||
|
|
303c9704b3 | ||
|
|
bf6cf818c4 | ||
|
|
4a7a84919c | ||
|
|
324356a59d | ||
|
|
7319cf932b | ||
|
|
933b65b3dd | ||
|
|
8353dc8d0a | ||
|
|
abdd4b81c4 | ||
|
|
4691ab1139 | ||
|
|
249447b4ba | ||
|
|
5e2456bea7 | ||
|
|
6fc2cf5fd1 | ||
|
|
0f20fa0b5a | ||
|
|
a10ac58dad | ||
|
|
032a940815 | ||
|
|
5707e2124c | ||
|
|
637e1c43c5 | ||
|
|
da365d0667 | ||
|
|
83deab79ec | ||
|
|
cfc7d13b99 | ||
|
|
fee900fa72 | ||
|
|
9928f908a0 | ||
|
|
d091f3030b | ||
|
|
44ead050c7 | ||
|
|
c5a15ed5d4 | ||
|
|
a27dd320e6 | ||
|
|
0c53bf72e4 | ||
|
|
b8c7930650 | ||
|
|
eae83bf0dd | ||
|
|
42cc50948d | ||
|
|
ff06613e99 | ||
|
|
9fe279b1b5 | ||
|
|
63e0ef0909 | ||
|
|
a44e3cb2be | ||
|
|
8f5e148bb2 | ||
|
|
21262705a7 | ||
|
|
4d46998668 | ||
|
|
00d90bfa21 | ||
|
|
03e406322f | ||
|
|
5ee7a76443 | ||
|
|
683de402ff | ||
|
|
e8e939ad19 | ||
|
|
1b5b5145b0 | ||
|
|
cfd2d76873 | ||
|
|
9e5081ed9b | ||
|
|
3ab2b1969a | ||
|
|
a27b563113 | ||
|
|
295472a028 | ||
|
|
91298b3cf7 | ||
|
|
638c288a5c | ||
|
|
2be6bdca84 | ||
|
|
f362f4afc4 | ||
|
|
9fadbf75fb | ||
|
|
2add15d283 | ||
|
|
5426495be5 | ||
|
|
b8bb16ccbb | ||
|
|
d4b56007f1 | ||
|
|
130bfec468 | ||
|
|
ddb3c79657 | ||
|
|
47cf43b44e | ||
|
|
aa6d14738a | ||
|
|
9cdbaf7929 | ||
|
|
cfb90f7c9f | ||
|
|
757b2fcfac | ||
|
|
daf0ea21bb | ||
|
|
26b58a59c0 |
20
.github/workflows/main.yml
vendored
20
.github/workflows/main.yml
vendored
@@ -29,7 +29,7 @@ jobs:
|
|||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
- uses: actions/setup-node@v4
|
- uses: actions/setup-node@v5
|
||||||
with:
|
with:
|
||||||
node-version: "${{ env.NODE_VERSION }}"
|
node-version: "${{ env.NODE_VERSION }}"
|
||||||
registry-url: "${{ env.NODE_REGISTRY }}"
|
registry-url: "${{ env.NODE_REGISTRY }}"
|
||||||
@@ -55,10 +55,12 @@ jobs:
|
|||||||
|
|
||||||
- name: Install dependencies
|
- name: Install dependencies
|
||||||
run: pnpm install
|
run: pnpm install
|
||||||
|
working-directory: images/operator
|
||||||
env:
|
env:
|
||||||
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
||||||
|
|
||||||
- name: Run tests
|
- name: Run tests
|
||||||
|
working-directory: images/operator
|
||||||
run: pnpm test
|
run: pnpm test
|
||||||
|
|
||||||
update-release-draft:
|
update-release-draft:
|
||||||
@@ -71,9 +73,23 @@ jobs:
|
|||||||
environment: release
|
environment: release
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
- uses: release-drafter/release-drafter@v6
|
- id: create-release
|
||||||
|
uses: release-drafter/release-drafter@v6
|
||||||
with:
|
with:
|
||||||
config-name: release-drafter-config.yml
|
config-name: release-drafter-config.yml
|
||||||
publish: true
|
publish: true
|
||||||
env:
|
env:
|
||||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Upload Release Asset
|
||||||
|
id: upload-release-asset
|
||||||
|
uses: actions/upload-release-asset@v1
|
||||||
|
env:
|
||||||
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
with:
|
||||||
|
upload_url: ${{ steps.create-release.outputs.upload_url }}
|
||||||
|
asset_path: ./operator.yaml
|
||||||
|
asset_name: operator.yaml
|
||||||
|
asset_content_type: application/yaml
|
||||||
|
|||||||
65
.github/workflows/publish-backup-tag.yml
vendored
Normal file
65
.github/workflows/publish-backup-tag.yml
vendored
Normal file
@@ -0,0 +1,65 @@
|
|||||||
|
name: Publish tag
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- "main"
|
||||||
|
tags:
|
||||||
|
- "v*"
|
||||||
|
|
||||||
|
env:
|
||||||
|
environment: test
|
||||||
|
release_channel: latest
|
||||||
|
DO_NOT_TRACK: "1"
|
||||||
|
NODE_VERSION: "23.x"
|
||||||
|
DOCKER_REGISTRY: ghcr.io
|
||||||
|
IMAGE_NAME: ${{ github.repository }}-backup
|
||||||
|
PNPM_VERSION: 10.6.0
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
packages: read
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
release:
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
packages: write
|
||||||
|
attestations: write
|
||||||
|
id-token: write
|
||||||
|
pages: write
|
||||||
|
name: Release
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
|
- name: Log in to the Container registry
|
||||||
|
uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
|
||||||
|
with:
|
||||||
|
registry: ${{ env.DOCKER_REGISTRY }}
|
||||||
|
username: ${{ github.actor }}
|
||||||
|
password: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
|
||||||
|
- name: Extract metadata (tags, labels) for Docker
|
||||||
|
id: meta
|
||||||
|
uses: docker/metadata-action@032a4b3bda1b716928481836ac5bfe36e1feaad6
|
||||||
|
with:
|
||||||
|
images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||||
|
|
||||||
|
- name: Build and push Docker image
|
||||||
|
id: push
|
||||||
|
uses: docker/build-push-action@cb8fc7586f9ad9441b20c33e0f6e8b1b58d8b4c6
|
||||||
|
with:
|
||||||
|
context: ./images/backup
|
||||||
|
push: true
|
||||||
|
tags: ${{ steps.meta.outputs.tags }}
|
||||||
|
labels: ${{ steps.meta.outputs.labels }}
|
||||||
|
|
||||||
|
- name: Generate artifact attestation
|
||||||
|
uses: actions/attest-build-provenance@v3
|
||||||
|
with:
|
||||||
|
subject-name: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME}}
|
||||||
|
subject-digest: ${{ steps.push.outputs.digest }}
|
||||||
|
push-to-registry: true
|
||||||
12
.github/workflows/publish-tag.yml
vendored
12
.github/workflows/publish-tag.yml
vendored
@@ -3,7 +3,7 @@ name: Publish tag
|
|||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches:
|
branches:
|
||||||
- 'main'
|
- "main"
|
||||||
tags:
|
tags:
|
||||||
- "v*"
|
- "v*"
|
||||||
|
|
||||||
@@ -36,7 +36,7 @@ jobs:
|
|||||||
fetch-depth: 0
|
fetch-depth: 0
|
||||||
|
|
||||||
- name: Log in to the Container registry
|
- name: Log in to the Container registry
|
||||||
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
|
uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
|
||||||
with:
|
with:
|
||||||
registry: ${{ env.DOCKER_REGISTRY }}
|
registry: ${{ env.DOCKER_REGISTRY }}
|
||||||
username: ${{ github.actor }}
|
username: ${{ github.actor }}
|
||||||
@@ -44,21 +44,21 @@ jobs:
|
|||||||
|
|
||||||
- name: Extract metadata (tags, labels) for Docker
|
- name: Extract metadata (tags, labels) for Docker
|
||||||
id: meta
|
id: meta
|
||||||
uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
|
uses: docker/metadata-action@032a4b3bda1b716928481836ac5bfe36e1feaad6
|
||||||
with:
|
with:
|
||||||
images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
|
images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||||
|
|
||||||
- name: Build and push Docker image
|
- name: Build and push Docker image
|
||||||
id: push
|
id: push
|
||||||
uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
|
uses: docker/build-push-action@cb8fc7586f9ad9441b20c33e0f6e8b1b58d8b4c6
|
||||||
with:
|
with:
|
||||||
context: .
|
context: ./images/operator
|
||||||
push: true
|
push: true
|
||||||
tags: ${{ steps.meta.outputs.tags }}
|
tags: ${{ steps.meta.outputs.tags }}
|
||||||
labels: ${{ steps.meta.outputs.labels }}
|
labels: ${{ steps.meta.outputs.labels }}
|
||||||
|
|
||||||
- name: Generate artifact attestation
|
- name: Generate artifact attestation
|
||||||
uses: actions/attest-build-provenance@v2
|
uses: actions/attest-build-provenance@v3
|
||||||
with:
|
with:
|
||||||
subject-name: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME}}
|
subject-name: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME}}
|
||||||
subject-digest: ${{ steps.push.outputs.digest }}
|
subject-digest: ${{ steps.push.outputs.digest }}
|
||||||
|
|||||||
16
.github/workflows/renovate.yml
vendored
Normal file
16
.github/workflows/renovate.yml
vendored
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
name: Renovate
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
schedule:
|
||||||
|
- cron: "0 */6 * * *"
|
||||||
|
jobs:
|
||||||
|
renovate:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
- name: Self-hosted Renovate
|
||||||
|
uses: renovatebot/github-action@v40.3.6
|
||||||
|
with:
|
||||||
|
token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
configurationFile: ./renovate.json5
|
||||||
38
.gitignore
vendored
38
.gitignore
vendored
@@ -1,34 +1,4 @@
|
|||||||
# dependencies (bun install)
|
/secret.*.yaml
|
||||||
node_modules
|
/data/
|
||||||
|
/.envrc
|
||||||
# output
|
*.DS_Store
|
||||||
out
|
|
||||||
dist
|
|
||||||
*.tgz
|
|
||||||
|
|
||||||
# code coverage
|
|
||||||
coverage
|
|
||||||
*.lcov
|
|
||||||
|
|
||||||
# logs
|
|
||||||
logs
|
|
||||||
_.log
|
|
||||||
report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
|
|
||||||
|
|
||||||
# dotenv environment variable files
|
|
||||||
.env
|
|
||||||
.env.development.local
|
|
||||||
.env.test.local
|
|
||||||
.env.production.local
|
|
||||||
.env.local
|
|
||||||
|
|
||||||
# caches
|
|
||||||
.eslintcache
|
|
||||||
.cache
|
|
||||||
*.tsbuildinfo
|
|
||||||
|
|
||||||
# IntelliJ based IDEs
|
|
||||||
.idea
|
|
||||||
|
|
||||||
# Finder (MacOS) folder config
|
|
||||||
.DS_Store
|
|
||||||
|
|||||||
@@ -1,6 +0,0 @@
|
|||||||
FROM node:23-alpine
|
|
||||||
RUN corepack enable
|
|
||||||
COPY package.json pnpm-lock.yaml ./
|
|
||||||
RUN pnpm install --frozen-lockfile --prod
|
|
||||||
COPY . .
|
|
||||||
CMD ["node", "src/index.ts"]
|
|
||||||
14
Makefile
Normal file
14
Makefile
Normal file
@@ -0,0 +1,14 @@
|
|||||||
|
.PHONY: dev-recreate dev-destroy server-install
|
||||||
|
|
||||||
|
dev-destroy:
|
||||||
|
colima delete -f
|
||||||
|
|
||||||
|
dev-recreate: dev-destroy
|
||||||
|
colima start --network-address --kubernetes -m 8 --k3s-arg="--disable helm-controller,local-storage,traefik --docker" # --mount ${PWD}/data:/data:w
|
||||||
|
flux install --components="source-controller,helm-controller"
|
||||||
|
|
||||||
|
setup-flux:
|
||||||
|
flux install --components="source-controller,helm-controller"
|
||||||
|
|
||||||
|
server-install:
|
||||||
|
curl -sfL https://get.k3s.io | sh -s - --disable traefik,local-storage,helm-controller
|
||||||
282
README.md
282
README.md
@@ -1,282 +0,0 @@
|
|||||||
# homelab-operator
|
|
||||||
|
|
||||||
A Kubernetes operator designed for homelab environments that simplifies the
|
|
||||||
management of PostgreSQL databases and Kubernetes secrets. Built with TypeScript
|
|
||||||
and designed to run efficiently in resource-constrained environments.
|
|
||||||
|
|
||||||
## Features
|
|
||||||
|
|
||||||
- **PostgreSQL Database Management**: Automatically create and manage PostgreSQL
|
|
||||||
databases and roles
|
|
||||||
- **Secret Management**: Generate and manage Kubernetes secrets with
|
|
||||||
configurable data
|
|
||||||
- **Owner References**: Automatic cleanup when resources are deleted
|
|
||||||
- **Status Tracking**: Comprehensive status conditions and error reporting
|
|
||||||
- **Lightweight**: Minimal resource footprint suitable for homelab environments
|
|
||||||
|
|
||||||
## Architecture
|
|
||||||
|
|
||||||
The operator manages two main Custom Resource Definitions (CRDs):
|
|
||||||
|
|
||||||
### PostgresDatabase
|
|
||||||
|
|
||||||
Manages PostgreSQL databases and their associated roles:
|
|
||||||
|
|
||||||
- Creates a PostgreSQL role with a secure random password
|
|
||||||
- Creates a database owned by that role
|
|
||||||
- Generates a Kubernetes secret containing database credentials
|
|
||||||
- Ensures proper cleanup through owner references
|
|
||||||
|
|
||||||
### SecretRequest
|
|
||||||
|
|
||||||
Generates Kubernetes secrets with configurable data:
|
|
||||||
|
|
||||||
- Supports custom secret names
|
|
||||||
- Configurable data fields with various encodings
|
|
||||||
- Automatic secret lifecycle management
|
|
||||||
|
|
||||||
## Installation
|
|
||||||
|
|
||||||
### Prerequisites
|
|
||||||
|
|
||||||
- Kubernetes cluster (1.20+)
|
|
||||||
- PostgreSQL instance accessible from the cluster
|
|
||||||
- Helm 3.x (for chart-based installation)
|
|
||||||
|
|
||||||
### Using Helm Chart
|
|
||||||
|
|
||||||
1. Clone the repository:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
git clone <repository-url>
|
|
||||||
cd homelab-operator
|
|
||||||
```
|
|
||||||
|
|
||||||
2. Install using Helm:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
helm install homelab-operator ./chart \
|
|
||||||
--set-string env.POSTGRES_HOST=<your-postgres-host> \
|
|
||||||
--set-string env.POSTGRES_USER=<admin-user> \
|
|
||||||
--set-string env.POSTGRES_PASSWORD=<admin-password>
|
|
||||||
```
|
|
||||||
|
|
||||||
### Using kubectl
|
|
||||||
|
|
||||||
1. Build and push the Docker image:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker build -t your-registry/homelab-operator:latest .
|
|
||||||
docker push your-registry/homelab-operator:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
2. Apply the Kubernetes manifests:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
kubectl apply -f chart/templates/
|
|
||||||
```
|
|
||||||
|
|
||||||
## Configuration
|
|
||||||
|
|
||||||
The operator is configured through environment variables:
|
|
||||||
|
|
||||||
| Variable | Description | Required | Default |
|
|
||||||
| ------------------- | ---------------------------------------- | -------- | ------- |
|
|
||||||
| `POSTGRES_HOST` | PostgreSQL server hostname | Yes | - |
|
|
||||||
| `POSTGRES_USER` | PostgreSQL admin username | Yes | - |
|
|
||||||
| `POSTGRES_PASSWORD` | PostgreSQL admin password | Yes | - |
|
|
||||||
| `POSTGRES_PORT` | PostgreSQL server port | No | 5432 |
|
|
||||||
| `LOG_LEVEL` | Logging level (debug, info, warn, error) | No | info |
|
|
||||||
|
|
||||||
## Usage
|
|
||||||
|
|
||||||
### PostgreSQL Database
|
|
||||||
|
|
||||||
Create a PostgreSQL database with an associated role:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
apiVersion: homelab.mortenolsen.pro/v1
|
|
||||||
kind: PostgresDatabase
|
|
||||||
metadata:
|
|
||||||
name: my-app-db
|
|
||||||
namespace: my-namespace
|
|
||||||
spec: {}
|
|
||||||
```
|
|
||||||
|
|
||||||
This will create:
|
|
||||||
|
|
||||||
- A PostgreSQL role named `my-app-db`
|
|
||||||
- A PostgreSQL database named `my-namespace_my-app-db` owned by the role
|
|
||||||
- A Kubernetes secret `postgres-database-my-app-db` containing:
|
|
||||||
- `name`: Base64-encoded database name
|
|
||||||
- `user`: Base64-encoded username
|
|
||||||
- `password`: Base64-encoded password
|
|
||||||
|
|
||||||
### Secret Request
|
|
||||||
|
|
||||||
Generate a Kubernetes secret with custom data:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
apiVersion: homelab.mortenolsen.pro/v1
|
|
||||||
kind: SecretRequest
|
|
||||||
metadata:
|
|
||||||
name: my-secret
|
|
||||||
namespace: my-namespace
|
|
||||||
spec:
|
|
||||||
secretName: app-config
|
|
||||||
data:
|
|
||||||
- key: api-key
|
|
||||||
value: "my-api-key"
|
|
||||||
encoding: base64
|
|
||||||
- key: database-url
|
|
||||||
value: "postgresql://user:pass@host:5432/db"
|
|
||||||
- key: random-token
|
|
||||||
length: 32
|
|
||||||
chars: "abcdefghijklmnopqrstuvwxyz0123456789"
|
|
||||||
```
|
|
||||||
|
|
||||||
### Accessing Created Resources
|
|
||||||
|
|
||||||
To retrieve database credentials:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Get the secret
|
|
||||||
kubectl get secret postgres-database-my-app-db -o jsonpath='{.data.user}' | base64 -d
|
|
||||||
kubectl get secret postgres-database-my-app-db -o jsonpath='{.data.password}' | base64 -d
|
|
||||||
kubectl get secret postgres-database-my-app-db -o jsonpath='{.data.name}' | base64 -d
|
|
||||||
```
|
|
||||||
|
|
||||||
## Development
|
|
||||||
|
|
||||||
### Prerequisites
|
|
||||||
|
|
||||||
- [Bun](https://bun.sh/) runtime
|
|
||||||
- [pnpm](https://pnpm.io/) package manager
|
|
||||||
- Docker (for building images)
|
|
||||||
- Access to a Kubernetes cluster for testing
|
|
||||||
|
|
||||||
### Setup
|
|
||||||
|
|
||||||
1. Clone the repository:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
git clone <repository-url>
|
|
||||||
cd homelab-operator
|
|
||||||
```
|
|
||||||
|
|
||||||
2. Install dependencies:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
pnpm install
|
|
||||||
```
|
|
||||||
|
|
||||||
3. Set up development environment:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
cp .env.example .env
|
|
||||||
# Edit .env with your PostgreSQL connection details
|
|
||||||
```
|
|
||||||
|
|
||||||
### Running Locally
|
|
||||||
|
|
||||||
For development, you can run the operator locally against a remote cluster:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Ensure kubectl is configured for your development cluster
|
|
||||||
export KUBECONFIG=~/.kube/config
|
|
||||||
|
|
||||||
# Set PostgreSQL connection environment variables
|
|
||||||
export POSTGRES_HOST=localhost
|
|
||||||
export POSTGRES_USER=postgres
|
|
||||||
export POSTGRES_PASSWORD=yourpassword
|
|
||||||
|
|
||||||
# Run the operator
|
|
||||||
bun run src/index.ts
|
|
||||||
```
|
|
||||||
|
|
||||||
### Development with Docker Compose
|
|
||||||
|
|
||||||
A development environment with PostgreSQL is provided:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker-compose -f docker-compose.dev.yaml up -d
|
|
||||||
```
|
|
||||||
|
|
||||||
### Building
|
|
||||||
|
|
||||||
Build the Docker image:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker build -t homelab-operator:latest .
|
|
||||||
```
|
|
||||||
|
|
||||||
### Testing
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Run linting
|
|
||||||
pnpm run test:lint
|
|
||||||
|
|
||||||
# Apply test resources
|
|
||||||
kubectl apply -f test.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
## Contributing
|
|
||||||
|
|
||||||
1. Fork the repository
|
|
||||||
2. Create a feature branch: `git checkout -b feature/new-feature`
|
|
||||||
3. Make your changes and add tests
|
|
||||||
4. Run linting: `pnpm run test:lint`
|
|
||||||
5. Commit your changes: `git commit -am 'Add new feature'`
|
|
||||||
6. Push to the branch: `git push origin feature/new-feature`
|
|
||||||
7. Submit a pull request
|
|
||||||
|
|
||||||
## Project Structure
|
|
||||||
|
|
||||||
```
|
|
||||||
├── chart/ # Helm chart for deployment
|
|
||||||
├── src/
|
|
||||||
│ ├── crds/ # Custom Resource Definitions
|
|
||||||
│ │ ├── postgres/ # PostgreSQL database management
|
|
||||||
│ │ └── secrets/ # Secret generation
|
|
||||||
│ ├── custom-resource/ # Base CRD framework
|
|
||||||
│ ├── database/ # Database migrations
|
|
||||||
│ ├── services/ # Core services
|
|
||||||
│ │ ├── config/ # Configuration management
|
|
||||||
│ │ ├── k8s.ts # Kubernetes API client
|
|
||||||
│ │ ├── log/ # Logging service
|
|
||||||
│ │ ├── postgres/ # PostgreSQL service
|
|
||||||
│ │ └── secrets/ # Secret management
|
|
||||||
│ └── utils/ # Utilities and constants
|
|
||||||
├── Dockerfile # Container build configuration
|
|
||||||
└── docker-compose.dev.yaml # Development environment
|
|
||||||
```
|
|
||||||
|
|
||||||
## License
|
|
||||||
|
|
||||||
This project is licensed under the MIT License - see the LICENSE file for
|
|
||||||
details.
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
For support and questions:
|
|
||||||
|
|
||||||
- Create an issue in the GitHub repository
|
|
||||||
- Check existing issues for similar problems
|
|
||||||
- Review the logs using `kubectl logs -l app=homelab-operator`
|
|
||||||
|
|
||||||
## Status Monitoring
|
|
||||||
|
|
||||||
Monitor the operator status:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Check operator logs
|
|
||||||
kubectl logs -l app=homelab-operator -f
|
|
||||||
|
|
||||||
# Check CRD status
|
|
||||||
kubectl get postgresdatabases
|
|
||||||
kubectl get secretrequests
|
|
||||||
|
|
||||||
# Describe resources for detailed status
|
|
||||||
kubectl describe postgresdatabase my-app-db
|
|
||||||
kubectl describe secretrequest my-secret
|
|
||||||
```
|
|
||||||
|
|||||||
BIN
assets/2025-09-06-12-29-07.png
Normal file
BIN
assets/2025-09-06-12-29-07.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 7.1 KiB |
BIN
assets/2025-09-06-12-29-15.png
Normal file
BIN
assets/2025-09-06-12-29-15.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 7.1 KiB |
BIN
assets/2025-09-06-12-29-26.png
Normal file
BIN
assets/2025-09-06-12-29-26.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 7.1 KiB |
@@ -1,14 +0,0 @@
|
|||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: {{ include "homelab-operator.fullname" . }}
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["secrets"]
|
|
||||||
verbs: ["create", "get", "watch", "list"]
|
|
||||||
- apiGroups: ["*"]
|
|
||||||
resources: ["*"]
|
|
||||||
verbs: ["get", "watch", "list", "patch"]
|
|
||||||
- apiGroups: ["apiextensions.k8s.io"]
|
|
||||||
resources: ["customresourcedefinitions"]
|
|
||||||
verbs: ["get", "create", "replace"]
|
|
||||||
136
charts/apps/AGENT.md
Normal file
136
charts/apps/AGENT.md
Normal file
@@ -0,0 +1,136 @@
|
|||||||
|
# Agent Documentation
|
||||||
|
|
||||||
|
This document describes how to create a new application chart for the homelab operator.
|
||||||
|
|
||||||
|
## Chart Structure
|
||||||
|
|
||||||
|
Each application has its own chart located in a directory under `charts/apps`. The chart should contain the following files:
|
||||||
|
|
||||||
|
- `Chart.yaml`: The chart metadata.
|
||||||
|
- `values.yaml`: The default values for the chart.
|
||||||
|
- `templates/`: A directory containing the Kubernetes resource templates.
|
||||||
|
|
||||||
|
## Custom Resources
|
||||||
|
|
||||||
|
The homelab operator uses several custom resources to manage applications. These resources are defined in the `templates` directory of the chart.
|
||||||
|
|
||||||
|
### `PostgresDatabase`
|
||||||
|
|
||||||
|
If the application requires a PostgreSQL database, you can create a `PostgresDatabase` resource. The operator will automatically create a database and a secret containing the connection details. The secret will have the same name as the release with a `-pg-connection` postfix.
|
||||||
|
|
||||||
|
Example:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
# templates/database.yaml
|
||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: PostgresDatabase
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
```
|
||||||
|
|
||||||
|
The secret has the following values:
|
||||||
|
|
||||||
|
- `database`: name of the created database
|
||||||
|
- `host`: the hostname of the postgres server
|
||||||
|
- `port`: the port of the postgres server
|
||||||
|
- `url`: combined url in the format `postgresql://{user}:{password}@{host}:{port}/{database}`
|
||||||
|
|
||||||
|
### `OidcClient`
|
||||||
|
|
||||||
|
If the application requires OIDC authentication, you can create an `OidcClient` resource. The operator will automatically create an OIDC client and a secret containing the client ID and secret. The secret will have the same name as the release with a `-client` postfix.
|
||||||
|
|
||||||
|
You need to specify the redirect URIs for the OIDC client. The subdomain is taken from the `values.yaml` file.
|
||||||
|
|
||||||
|
Example:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
# templates/client.yaml
|
||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
redirectUris:
|
||||||
|
- path: /user/oauth2/Authentik/callback
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
matchingMode: strict
|
||||||
|
```
|
||||||
|
|
||||||
|
The secret has the following value:
|
||||||
|
|
||||||
|
- `authorization`: Authorization endpoint
|
||||||
|
- `clientId`
|
||||||
|
- `clientSecret`
|
||||||
|
- `configuration`: autodiscovery endpoint
|
||||||
|
- `configurationIssuer`: issuer url
|
||||||
|
- `endSession`: end session endpoint
|
||||||
|
- `jwks`: jwks endpoint
|
||||||
|
- `token`: token endpoint
|
||||||
|
- `userinfo`: user info endpoint
|
||||||
|
|
||||||
|
### `HttpService` and `ExternalHttpService`
|
||||||
|
|
||||||
|
To expose the application, you can use either an `HttpService` or an `ExternalHttpService` resource.
|
||||||
|
|
||||||
|
- `HttpService`: This will expose the application through the Istio gateway. This is for internal access only.
|
||||||
|
- `ExternalHttpService`: This will expose the application through a CloudFlare tunnel. This is for external access.
|
||||||
|
|
||||||
|
Both resources take a `subdomain` and a `destination` as parameters. The `destination` is the Kubernetes service to route traffic to.
|
||||||
|
|
||||||
|
Example of `HttpService`:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
# templates/http-service.yaml
|
||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: HttpService
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
destination:
|
||||||
|
host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
```
|
||||||
|
|
||||||
|
Example of `ExternalHttpService`:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
# templates/external-http-service.yaml
|
||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: ExternalHttpService
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
destination:
|
||||||
|
host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
```
|
||||||
|
|
||||||
|
## `values.yaml`
|
||||||
|
|
||||||
|
The `values.yaml` file should contain the following values:
|
||||||
|
|
||||||
|
- `globals.environment`: The environment the application is running in (e.g., `prod`, `dev`).
|
||||||
|
- `image.repository`: The Docker image repository.
|
||||||
|
- `image.tag`: The Docker image tag.
|
||||||
|
- `subdomain`: The subdomain for the application.
|
||||||
|
|
||||||
|
Example:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
# values.yaml
|
||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
image:
|
||||||
|
repository: docker.gitea.com/gitea
|
||||||
|
tag: latest
|
||||||
|
subdomain: gitea
|
||||||
|
```
|
||||||
3
charts/apps/apprise/Chart.yaml
Normal file
3
charts/apps/apprise/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: apprise
|
||||||
10
charts/apps/apprise/templates/client.yaml
Normal file
10
charts/apps/apprise/templates/client.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
redirectUris:
|
||||||
|
- path: /oauth/oidc/callback
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
matchingMode: strict
|
||||||
43
charts/apps/apprise/templates/deployment.yaml
Normal file
43
charts/apps/apprise/templates/deployment.yaml
Normal file
@@ -0,0 +1,43 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: "{{ .Release.Name }}"
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||||
|
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 8000
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
env:
|
||||||
|
- name: TZ
|
||||||
|
value: "{{ .Values.globals.timezone }}"
|
||||||
|
- name: BASE_URL
|
||||||
|
value: https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /config
|
||||||
|
name: data
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: "{{ .Release.Name }}-data"
|
||||||
11
charts/apps/apprise/templates/http-service.yaml
Normal file
11
charts/apps/apprise/templates/http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: HttpService
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
destination:
|
||||||
|
host: "{{ .Release.Name }}"
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/apprise/templates/pvc.yaml
Normal file
11
charts/apps/apprise/templates/pvc.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-data'
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- 'ReadWriteOnce'
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: '1Gi'
|
||||||
|
storageClassName: '{{ .Values.globals.environment }}'
|
||||||
15
charts/apps/apprise/templates/service.yaml
Normal file
15
charts/apps/apprise/templates/service.yaml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 8000
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
9
charts/apps/apprise/values.yaml
Normal file
9
charts/apps/apprise/values.yaml
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
timezone: Europe/Amsterdam
|
||||||
|
domain: olsen.cloud
|
||||||
|
image:
|
||||||
|
repository: docker.io/caronc/apprise
|
||||||
|
tag: latest@sha256:127b3834f0679502529397ead8ffeaadf5189019c4c863fa6652e9b942fdccf8
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
subdomain: apprise
|
||||||
3
charts/apps/audiobookshelf/Chart.yaml
Normal file
3
charts/apps/audiobookshelf/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: audiobookshelf
|
||||||
13
charts/apps/audiobookshelf/templates/client.yaml
Normal file
13
charts/apps/audiobookshelf/templates/client.yaml
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
redirectUris:
|
||||||
|
- path: /audiobookshelf/auth/openid/callback
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
matchingMode: strict
|
||||||
|
- path: /audiobookshelf/auth/openid/mobile-redirect
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
matchingMode: strict
|
||||||
52
charts/apps/audiobookshelf/templates/deployment.yaml
Normal file
52
charts/apps/audiobookshelf/templates/deployment.yaml
Normal file
@@ -0,0 +1,52 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: '{{ .Release.Name }}'
|
||||||
|
image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
|
||||||
|
imagePullPolicy: '{{ .Values.image.pullPolicy }}'
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 80
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /config
|
||||||
|
name: config
|
||||||
|
- mountPath: /metadata
|
||||||
|
name: metadata
|
||||||
|
- mountPath: /audiobooks
|
||||||
|
name: audiobooks
|
||||||
|
- mountPath: /podcasts
|
||||||
|
name: podcasts
|
||||||
|
volumes:
|
||||||
|
- name: config
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: '{{ .Release.Name }}-config'
|
||||||
|
- name: metadata
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: '{{ .Release.Name }}-metadata'
|
||||||
|
- name: audiobooks
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: books
|
||||||
|
- name: podcasts
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: podcasts
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: ExternalHttpService
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
destination:
|
||||||
|
host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
24
charts/apps/audiobookshelf/templates/pvc.yaml
Normal file
24
charts/apps/audiobookshelf/templates/pvc.yaml
Normal file
@@ -0,0 +1,24 @@
|
|||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-config'
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- 'ReadWriteOnce'
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: '1Gi'
|
||||||
|
storageClassName: '{{ .Values.globals.environment }}'
|
||||||
|
|
||||||
|
---
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-metadata'
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- 'ReadWriteOnce'
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: '1Gi'
|
||||||
|
storageClassName: '{{ .Values.globals.environment }}'
|
||||||
15
charts/apps/audiobookshelf/templates/service.yaml
Normal file
15
charts/apps/audiobookshelf/templates/service.yaml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 80
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
7
charts/apps/audiobookshelf/values.yaml
Normal file
7
charts/apps/audiobookshelf/values.yaml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/advplyr/audiobookshelf
|
||||||
|
tag: 2.29.0@sha256:dd4a3079d26bfe9f0ea63de3e3eff483dfa25fef05ef850a5a9d121dca3794b2
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
subdomain: audiobookshelf
|
||||||
3
charts/apps/baikal/Chart.yaml
Normal file
3
charts/apps/baikal/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: esphome
|
||||||
6
charts/apps/baikal/templates/database.yaml
Normal file
6
charts/apps/baikal/templates/database.yaml
Normal file
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: PostgresDatabase
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
46
charts/apps/baikal/templates/deployment.yaml
Normal file
46
charts/apps/baikal/templates/deployment.yaml
Normal file
@@ -0,0 +1,46 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: "{{ .Release.Name }}"
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||||
|
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 80
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
env:
|
||||||
|
- name: TZ
|
||||||
|
value: "{{ .Values.globals.timezone }}"
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /var/www/baikal/Specific
|
||||||
|
name: data
|
||||||
|
- mountPath: /var/www/baikal/config
|
||||||
|
name: config
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: "{{ .Release.Name }}-data"
|
||||||
|
- name: config
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: "{{ .Release.Name }}-config"
|
||||||
11
charts/apps/baikal/templates/external-http-service.yaml
Normal file
11
charts/apps/baikal/templates/external-http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: ExternalHttpService
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
destination:
|
||||||
|
host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/baikal/templates/http-service.yaml
Normal file
11
charts/apps/baikal/templates/http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: HttpService
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
destination:
|
||||||
|
host: "{{ .Release.Name }}"
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
24
charts/apps/baikal/templates/pvc.yaml
Normal file
24
charts/apps/baikal/templates/pvc.yaml
Normal file
@@ -0,0 +1,24 @@
|
|||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}-data"
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- "ReadWriteOnce"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: "1Gi"
|
||||||
|
storageClassName: "{{ .Values.globals.environment }}"
|
||||||
|
|
||||||
|
---
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}-config"
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- "ReadWriteOnce"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: "1Gi"
|
||||||
|
storageClassName: "{{ .Values.globals.environment }}"
|
||||||
15
charts/apps/baikal/templates/service.yaml
Normal file
15
charts/apps/baikal/templates/service.yaml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 80
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
9
charts/apps/baikal/values.yaml
Normal file
9
charts/apps/baikal/values.yaml
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
timezone: Europe/Amsterdam
|
||||||
|
domain: olsen.cloud
|
||||||
|
image:
|
||||||
|
repository: docker.io/ckulka/baikal
|
||||||
|
tag: nginx@sha256:045918423df00a3f9ec793a819b9acdb055d338b75387926b7d93d753ac1e93a
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
subdomain: baikal
|
||||||
3
charts/apps/bytestash/Chart.yaml
Normal file
3
charts/apps/bytestash/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: ByteStash
|
||||||
10
charts/apps/bytestash/templates/client.yaml
Normal file
10
charts/apps/bytestash/templates/client.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
redirectUris:
|
||||||
|
- path: /api/auth/oidc/callback
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
matchingMode: strict
|
||||||
54
charts/apps/bytestash/templates/deployment.yaml
Normal file
54
charts/apps/bytestash/templates/deployment.yaml
Normal file
@@ -0,0 +1,54 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: "{{ .Release.Name }}"
|
||||||
|
image: ghcr.io/jordan-dalby/bytestash:latest
|
||||||
|
ports:
|
||||||
|
- containerPort: 5000
|
||||||
|
name: http
|
||||||
|
env:
|
||||||
|
- name: ALLOW_NEW_ACCOUNTS
|
||||||
|
value: "true"
|
||||||
|
- name: DISABLE_INTERNAL_ACCOUNTS
|
||||||
|
value: "true"
|
||||||
|
- name: OIDC_ENABLED
|
||||||
|
value: "true"
|
||||||
|
- name: OIDC_DISPLAY_NAME
|
||||||
|
value: OIDC
|
||||||
|
- name: OIDC_CLIENT_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-client"
|
||||||
|
key: clientId
|
||||||
|
- name: OIDC_CLIENT_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-client"
|
||||||
|
key: clientSecret
|
||||||
|
- name: OIDC_ISSUER_URL
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-client"
|
||||||
|
key: configurationIssuer
|
||||||
|
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /data/snippets
|
||||||
|
name: data
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: "{{ .Release.Name }}-data"
|
||||||
11
charts/apps/bytestash/templates/external-http-service.yaml
Normal file
11
charts/apps/bytestash/templates/external-http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: ExternalHttpService
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
destination:
|
||||||
|
host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/bytestash/templates/http-service.yaml
Normal file
11
charts/apps/bytestash/templates/http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: HttpService
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.environment }}'
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
destination:
|
||||||
|
host: '{{ .Release.Name }}'
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/bytestash/templates/pvc.yaml
Normal file
11
charts/apps/bytestash/templates/pvc.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-data'
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- 'ReadWriteOnce'
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: '1Gi'
|
||||||
|
storageClassName: '{{ .Values.globals.environment }}'
|
||||||
15
charts/apps/bytestash/templates/service.yaml
Normal file
15
charts/apps/bytestash/templates/service.yaml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 5000
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
3
charts/apps/bytestash/values.yaml
Normal file
3
charts/apps/bytestash/values.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
subdomain: bytestash
|
||||||
3
charts/apps/calibre-web/Chart.yaml
Normal file
3
charts/apps/calibre-web/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: calibre-web
|
||||||
10
charts/apps/calibre-web/templates/client.yaml
Normal file
10
charts/apps/calibre-web/templates/client.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
redirectUris:
|
||||||
|
- path: /api/auth/oidc/callback
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
matchingMode: strict
|
||||||
42
charts/apps/calibre-web/templates/deployment.yaml
Normal file
42
charts/apps/calibre-web/templates/deployment.yaml
Normal file
@@ -0,0 +1,42 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: "{{ .Release.Name }}"
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||||
|
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||||
|
ports:
|
||||||
|
- containerPort: 8083
|
||||||
|
name: http
|
||||||
|
env:
|
||||||
|
- name: TZ
|
||||||
|
value: "{{ .Values.globals.timezone }}"
|
||||||
|
- name: PUID
|
||||||
|
value: "1000"
|
||||||
|
- name: PGID
|
||||||
|
value: "1000"
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /config
|
||||||
|
name: data
|
||||||
|
- mountPath: /books
|
||||||
|
name: books
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: "{{ .Release.Name }}-data"
|
||||||
|
- name: books
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: books
|
||||||
11
charts/apps/calibre-web/templates/external-http-service.yaml
Normal file
11
charts/apps/calibre-web/templates/external-http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: ExternalHttpService
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
destination:
|
||||||
|
host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/calibre-web/templates/http-service.yaml
Normal file
11
charts/apps/calibre-web/templates/http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: HttpService
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
destination:
|
||||||
|
host: "{{ .Release.Name }}"
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/calibre-web/templates/pvc.yaml
Normal file
11
charts/apps/calibre-web/templates/pvc.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-data'
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- 'ReadWriteOnce'
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: '1Gi'
|
||||||
|
storageClassName: '{{ .Values.globals.environment }}'
|
||||||
15
charts/apps/calibre-web/templates/service.yaml
Normal file
15
charts/apps/calibre-web/templates/service.yaml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 8083
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
9
charts/apps/calibre-web/values.yaml
Normal file
9
charts/apps/calibre-web/values.yaml
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
domain: olsen.cloud
|
||||||
|
timezone: Europe/Amsterdam
|
||||||
|
image:
|
||||||
|
repository: lscr.io/linuxserver/calibre-web
|
||||||
|
tag: latest@sha256:98a20064168ab284bbb8e048af48c89a5e25650f35a4b217705241af94c1debe
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
subdomain: calibre-web
|
||||||
3
charts/apps/coder/Chart.yaml
Normal file
3
charts/apps/coder/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: openwebui
|
||||||
10
charts/apps/coder/templates/client.yaml
Normal file
10
charts/apps/coder/templates/client.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
redirectUris:
|
||||||
|
- path: /api/v2/users/oidc/callback
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
matchingMode: strict
|
||||||
73
charts/apps/coder/templates/deployment.yaml
Normal file
73
charts/apps/coder/templates/deployment.yaml
Normal file
@@ -0,0 +1,73 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
serviceAccountName: '{{ .Release.Name }}-serviceaccount'
|
||||||
|
containers:
|
||||||
|
- name: '{{ .Release.Name }}'
|
||||||
|
image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
|
||||||
|
imagePullPolicy: '{{ .Values.image.pullPolicy }}'
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 7080
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /home/coder/.config
|
||||||
|
name: data
|
||||||
|
env:
|
||||||
|
- name: CODER_HTTP_ADDRESS
|
||||||
|
value: '0.0.0.0:7080'
|
||||||
|
- name: CODER_OIDC_ALLOWED_GROUPS
|
||||||
|
value: admin
|
||||||
|
- name: CODER_OIDC_GROUP_FIELD
|
||||||
|
value: groups
|
||||||
|
- name: CODER_ACCESS_URL
|
||||||
|
value: https://coder.olsen.cloud
|
||||||
|
- name: CODER_OIDC_ICON_URL
|
||||||
|
value: https://authentik.olsen.cloud/static/dist/assets/icons/icon.png
|
||||||
|
- name: CODER_DISABLE_PASSWORD_AUTH
|
||||||
|
value: 'true'
|
||||||
|
- name: CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS
|
||||||
|
value: 'false'
|
||||||
|
- name: CODER_OIDC_SIGN_IN_TEXT
|
||||||
|
value: 'Sign in with OIDC'
|
||||||
|
- name: CODER_OIDC_SCOPES
|
||||||
|
value: openid,profile,email,offline_access
|
||||||
|
- name: CODER_OIDC_ISSUER_URL
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: '{{ .Release.Name }}-client'
|
||||||
|
key: configurationIssuer
|
||||||
|
- name: CODER_OIDC_CLIENT_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: '{{ .Release.Name }}-client'
|
||||||
|
key: clientId
|
||||||
|
- name: CODER_OIDC_CLIENT_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: '{{ .Release.Name }}-client'
|
||||||
|
key: clientSecret
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: '{{ .Release.Name }}-data'
|
||||||
11
charts/apps/coder/templates/http-service.yaml
Normal file
11
charts/apps/coder/templates/http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: HttpService
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
destination:
|
||||||
|
host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/coder/templates/pvc.yaml
Normal file
11
charts/apps/coder/templates/pvc.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-data'
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- 'ReadWriteOnce'
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: '1Gi'
|
||||||
|
storageClassName: '{{ .Values.globals.environment }}'
|
||||||
21
charts/apps/coder/templates/role.yaml
Normal file
21
charts/apps/coder/templates/role.yaml
Normal file
@@ -0,0 +1,21 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-workspace-creator'
|
||||||
|
rules:
|
||||||
|
- apiGroups: [''] # "" indicates the core API group (for Pods, PVCs, Services)
|
||||||
|
resources: ['pods', 'pods/exec', 'pods/log', 'persistentvolumeclaims', 'services']
|
||||||
|
verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']
|
||||||
|
- apiGroups: ['apps'] # For Deployments, StatefulSets
|
||||||
|
resources: ['deployments', 'statefulsets']
|
||||||
|
verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']
|
||||||
|
- apiGroups: ['networking.k8s.io'] # For Ingresses
|
||||||
|
resources: ['ingresses']
|
||||||
|
verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']
|
||||||
|
- apiGroups: ['events.k8s.io'] # For events related to workspace activity
|
||||||
|
resources: ['events']
|
||||||
|
verbs: ['create', 'patch', 'update'] # Coder might create events for workspace lifecycle
|
||||||
|
# Add any other resources that Coder workspace templates might create (e.g., secrets, configmaps)
|
||||||
|
# - apiGroups: [""]
|
||||||
|
# resources: ["secrets", "configmaps"]
|
||||||
|
# verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
13
charts/apps/coder/templates/rolebinding.yaml
Normal file
13
charts/apps/coder/templates/rolebinding.yaml
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-workspace-creator-binding'
|
||||||
|
namespace: '{{ .Release.Namespace }}'
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: '{{ .Release.Name }}-serviceaccount'
|
||||||
|
namespace: '{{ .Release.Namespace }}'
|
||||||
|
roleRef:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: '{{ .Release.Name }}-workspace-creator'
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
15
charts/apps/coder/templates/service.yaml
Normal file
15
charts/apps/coder/templates/service.yaml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 7080
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
5
charts/apps/coder/templates/serviceaccount.yaml
Normal file
5
charts/apps/coder/templates/serviceaccount.yaml
Normal file
@@ -0,0 +1,5 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-serviceaccount'
|
||||||
|
namespace: '{{ .Release.Namespace }}'
|
||||||
7
charts/apps/coder/values.yaml
Normal file
7
charts/apps/coder/values.yaml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/coder/coder
|
||||||
|
tag: latest@sha256:73714e0685addde01bbff905cf5b647d6b677d77977c8009b6293d40fdf0f562
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
subdomain: coder
|
||||||
3
charts/apps/data/Chart.yaml
Normal file
3
charts/apps/data/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: data
|
||||||
6
charts/apps/data/templates/database.yaml
Normal file
6
charts/apps/data/templates/database.yaml
Normal file
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: PostgresDatabase
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
2
charts/apps/data/values.yaml
Normal file
2
charts/apps/data/values.yaml
Normal file
@@ -0,0 +1,2 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
3
charts/apps/esphome/Chart.yaml
Normal file
3
charts/apps/esphome/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: esphome
|
||||||
42
charts/apps/esphome/templates/deployment.yaml
Normal file
42
charts/apps/esphome/templates/deployment.yaml
Normal file
@@ -0,0 +1,42 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
hostNetwork: true
|
||||||
|
containers:
|
||||||
|
- name: "{{ .Release.Name }}"
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||||
|
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 6052
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
env:
|
||||||
|
- name: TZ
|
||||||
|
value: "{{ .Values.globals.timezone }}"
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /config
|
||||||
|
name: data
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: "{{ .Release.Name }}-data"
|
||||||
11
charts/apps/esphome/templates/http-service.yaml
Normal file
11
charts/apps/esphome/templates/http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: HttpService
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
destination:
|
||||||
|
host: "{{ .Release.Name }}"
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/esphome/templates/pvc.yaml
Normal file
11
charts/apps/esphome/templates/pvc.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-data'
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- 'ReadWriteOnce'
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: '1Gi'
|
||||||
|
storageClassName: '{{ .Values.globals.environment }}'
|
||||||
15
charts/apps/esphome/templates/service.yaml
Normal file
15
charts/apps/esphome/templates/service.yaml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 6052
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
9
charts/apps/esphome/values.yaml
Normal file
9
charts/apps/esphome/values.yaml
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
timezone: Europe/Amsterdam
|
||||||
|
domain: olsen.cloud
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/esphome/esphome
|
||||||
|
tag: latest@sha256:67f4df2206af244e79c6c624ea7ef27be572f83af981657b1ac1ffa0d7b8487a
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
subdomain: esphome
|
||||||
3
charts/apps/gitea/Chart.yaml
Normal file
3
charts/apps/gitea/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: gitea
|
||||||
36
charts/apps/gitea/templates/_runner-deployment.yaml
Normal file
36
charts/apps/gitea/templates/_runner-deployment.yaml
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-runner'
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}-runner'
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: '{{ .Release.Name }}-runner'
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}-runner'
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: '{{ .Release.Name }}-runner'
|
||||||
|
image: docker.io/gitea/act_runner:latest-dind-rootless
|
||||||
|
env:
|
||||||
|
- name: GITEA_INSTANCE_URL
|
||||||
|
value: '{{ .Release.Name }}'
|
||||||
|
- name: GITEA_RUNNER_NAME
|
||||||
|
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: '{{ .Release.Name }}-runner'
|
||||||
|
key: registration_token
|
||||||
|
- name: DOCKER_HOST
|
||||||
|
value: tcp://localhost:2376
|
||||||
|
- name: DOCKER_CERT_PATH
|
||||||
|
value: /certs/client
|
||||||
|
- name: DOCKER_TLS_VERIFY
|
||||||
|
value: '1'
|
||||||
|
securityContext:
|
||||||
|
privileged: true
|
||||||
10
charts/apps/gitea/templates/client.yaml
Normal file
10
charts/apps/gitea/templates/client.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
redirectUris:
|
||||||
|
- path: /user/oauth2/Authentik/callback
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
matchingMode: strict
|
||||||
6
charts/apps/gitea/templates/database.yaml
Normal file
6
charts/apps/gitea/templates/database.yaml
Normal file
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: PostgresDatabase
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
103
charts/apps/gitea/templates/deployment.yaml
Normal file
103
charts/apps/gitea/templates/deployment.yaml
Normal file
@@ -0,0 +1,103 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: "{{ .Release.Name }}"
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||||
|
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 3000
|
||||||
|
protocol: TCP
|
||||||
|
- name: ssh
|
||||||
|
containerPort: 22
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /data
|
||||||
|
name: data
|
||||||
|
env:
|
||||||
|
- name: TZ
|
||||||
|
value: "{{ .Values.globals.timezone }}"
|
||||||
|
- name: USER_UID
|
||||||
|
value: "1000"
|
||||||
|
- name: USER_GID
|
||||||
|
value: "1000"
|
||||||
|
- name: GITEA__server__SSH_DOMAIN
|
||||||
|
value: ssh-gitea.olsen.cloud
|
||||||
|
- name: GITEA__server__SSH_PORT
|
||||||
|
value: "2205"
|
||||||
|
- name: GITEA__service__REQUIRE_EXTERNAL_REGISTRATION_PASSWORD
|
||||||
|
value: "true"
|
||||||
|
#- name: GITEA__service__ENABLE_BASIC_AUTHENTICATION
|
||||||
|
# value: 'true'
|
||||||
|
- name: GITEA__service__ENABLE_PASSWORD_SIGNIN_FORM
|
||||||
|
value: "false"
|
||||||
|
- name: GITEA__service__DEFAULT_KEEP_EMAIL_PRIVATE
|
||||||
|
value: "true"
|
||||||
|
- name: GITEA__service__DEFAULT_USER_IS_RESTRICTED
|
||||||
|
value: "true"
|
||||||
|
- name: GITEA__service__DEFAULT_USER_VISIBILITY
|
||||||
|
value: "private"
|
||||||
|
- name: GITEA__service__DEFAULT_ORG_VISIBILITY
|
||||||
|
value: "private"
|
||||||
|
- name: GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION
|
||||||
|
value: "true"
|
||||||
|
- name: GITEA__other__SHOW_FOOTER_POWERED_BY
|
||||||
|
value: "false"
|
||||||
|
- name: GITEA__other__SHOW_FOOTER_TEMPLATE_LOAD_TIME
|
||||||
|
value: "false"
|
||||||
|
- name: GITEA__other__SHOW_FOOTER_VERSION
|
||||||
|
value: "false"
|
||||||
|
- name: GITEA__repository__ENABLE_PUSH_CREATE_USER
|
||||||
|
value: "true"
|
||||||
|
- name: GITEA__repository__ENABLE_PUSH_CREATE_ORG
|
||||||
|
value: "true"
|
||||||
|
- name: GITEA__openid__ENABLE_OPENID_SIGNIN
|
||||||
|
value: "false"
|
||||||
|
- name: GITEA__openid__ENABLE_OPENID_SIGNUP
|
||||||
|
value: "false"
|
||||||
|
- name: GITEA__database__DB_TYPE
|
||||||
|
value: postgres
|
||||||
|
- name: GITEA__database__NAME
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-pg-connection"
|
||||||
|
key: database
|
||||||
|
- name: GITEA__database__HOST
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-pg-connection"
|
||||||
|
key: host
|
||||||
|
- name: GITEA__database__USER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-pg-connection"
|
||||||
|
key: user
|
||||||
|
- name: GITEA__database__PASSWD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-pg-connection"
|
||||||
|
key: password
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: "{{ .Release.Name }}-data"
|
||||||
11
charts/apps/gitea/templates/external-http-service.yaml
Normal file
11
charts/apps/gitea/templates/external-http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: ExternalHttpService
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
destination:
|
||||||
|
host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/gitea/templates/pvc.yaml
Normal file
11
charts/apps/gitea/templates/pvc.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-data'
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- 'ReadWriteOnce'
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: '1Gi'
|
||||||
|
storageClassName: '{{ .Values.globals.environment }}'
|
||||||
32
charts/apps/gitea/templates/service.yaml
Normal file
32
charts/apps/gitea/templates/service.yaml
Normal file
@@ -0,0 +1,32 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 3000
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}-ssh"
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
type: LoadBalancer
|
||||||
|
ports:
|
||||||
|
- port: 2205
|
||||||
|
targetPort: 22
|
||||||
|
protocol: TCP
|
||||||
|
name: ssh
|
||||||
|
selector:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
8
charts/apps/gitea/values.yaml
Normal file
8
charts/apps/gitea/values.yaml
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
timezone: Europe/Amsterdam
|
||||||
|
image:
|
||||||
|
repository: docker.gitea.com/gitea
|
||||||
|
tag: latest@sha256:2edc102cbb636ae1ddac5fa0c715aa5b03079dee13ac6800b2cef6d4e912e718
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
subdomain: gitea
|
||||||
3
charts/apps/headscale/Chart.yaml
Normal file
3
charts/apps/headscale/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: headscale
|
||||||
10
charts/apps/headscale/templates/client.yaml
Normal file
10
charts/apps/headscale/templates/client.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
redirectUris:
|
||||||
|
- path: /oidc/callback
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
matchingMode: strict
|
||||||
70
charts/apps/headscale/templates/config-map.yaml
Normal file
70
charts/apps/headscale/templates/config-map.yaml
Normal file
@@ -0,0 +1,70 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-config-template'
|
||||||
|
data:
|
||||||
|
config.yaml.template: |
|
||||||
|
server_url: ${PUBLIC_URL}
|
||||||
|
listen_addr: 0.0.0.0:8080
|
||||||
|
metrics_listen_addr: 0.0.0.0:9090
|
||||||
|
grpc_listen_addr: 0.0.0.0:50443
|
||||||
|
|
||||||
|
private_key_path: /var/lib/headscale/private_key # Path inside the container
|
||||||
|
|
||||||
|
noise:
|
||||||
|
private_key_path: /var/lib/headscale/noise_private_key # Path inside the container
|
||||||
|
|
||||||
|
listen_routes: false
|
||||||
|
base_domain: "${PUBLIC_URL}" # For client routes and DNS push.
|
||||||
|
|
||||||
|
derp:
|
||||||
|
server:
|
||||||
|
enabled: false
|
||||||
|
region_id: 999
|
||||||
|
region_code: "headscale"
|
||||||
|
region_name: "Headscale Embedded DERP"
|
||||||
|
stun_listen_addr: "0.0.0.0:3478"
|
||||||
|
automatically_add_embedded_derp_region: true
|
||||||
|
urls:
|
||||||
|
- https://controlplane.tailscale.com/derpmap/default
|
||||||
|
auto_update_enabled: true
|
||||||
|
update_frequency: 24h
|
||||||
|
|
||||||
|
oidc:
|
||||||
|
enabled: true
|
||||||
|
only_start_if_oidc_is_available: true
|
||||||
|
issuer: "${OIDC_ISSUER_URL}"
|
||||||
|
client_id: "${OIDC_CLIENT_ID}"
|
||||||
|
client_secret: "${OIDC_CLIENT_SECRET}"
|
||||||
|
scopes: ["openid", "profile", "email"]
|
||||||
|
redirect_url: "${PUBLIC_URL}/oidc/callback"
|
||||||
|
pkce:
|
||||||
|
enabled: true
|
||||||
|
method: S256
|
||||||
|
|
||||||
|
|
||||||
|
# DNS configuration
|
||||||
|
dns:
|
||||||
|
magic_dns: false
|
||||||
|
override_local_dns: true # Push Headscale's DNS settings to clients
|
||||||
|
ttl: 60
|
||||||
|
nameservers:
|
||||||
|
global:
|
||||||
|
- 1.1.1.1 # Cloudflare DNS
|
||||||
|
#- 10.43.0.10 # Replace with your ClusterIP for kube-dns/CoreDNS
|
||||||
|
# Domains to search for (e.g., for Kubernetes services)
|
||||||
|
search_domains:
|
||||||
|
- svc.cluster.local
|
||||||
|
- cluster.local
|
||||||
|
|
||||||
|
auto_create_users: true
|
||||||
|
|
||||||
|
oidc_user_property: preferred_username # Or 'email' or 'sub'
|
||||||
|
|
||||||
|
prefixes:
|
||||||
|
v4: 10.20.20.0/24 # Example: A /24 subnet for your VPN clients
|
||||||
|
|
||||||
|
database:
|
||||||
|
type: sqlite
|
||||||
|
sqlite:
|
||||||
|
path: /var/lib/headscale/db.sqlite
|
||||||
97
charts/apps/headscale/templates/deployment.yaml
Normal file
97
charts/apps/headscale/templates/deployment.yaml
Normal file
@@ -0,0 +1,97 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
# To expose WireGuard UDP directly, we need a NodePort service.
|
||||||
|
# The Pod needs to be aware of the external port it's being exposed on.
|
||||||
|
# The easiest way to get WireGuard to listen on the correct port and make it
|
||||||
|
# externally accessible is to use `hostNetwork: true` for the UDP component,
|
||||||
|
# or by directly specifying the listen port in Headscale config if the NodePort is stable.
|
||||||
|
|
||||||
|
# OPTION 1: Best for simple homelab on bare metal where host network traffic isn't an issue
|
||||||
|
# hostNetwork: true # This makes the pod listen directly on the node's IPs
|
||||||
|
# dnsPolicy: ClusterFirstWithHostNet # Required if using hostNetwork
|
||||||
|
|
||||||
|
initContainers:
|
||||||
|
- name: generate-config
|
||||||
|
image: alpine/git # A small image with 'envsubst' available or easily installable
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command: ['sh', '-c']
|
||||||
|
args:
|
||||||
|
- |
|
||||||
|
# Install envsubst if it's not present (alpine/git may not have it by default)
|
||||||
|
apk update && apk add bash gettext
|
||||||
|
|
||||||
|
# Substitute environment variables into the template
|
||||||
|
# The vars are passed via `env` section below
|
||||||
|
envsubst < /config-template/config.yaml.template > /etc/headscale/config.yaml
|
||||||
|
|
||||||
|
mkdir -p /etc/headscale
|
||||||
|
# Optional: Verify the generated config
|
||||||
|
echo "--- Generated Headscale Configuration ---"
|
||||||
|
cat /etc/headscale/config.yaml
|
||||||
|
echo "---------------------------------------"
|
||||||
|
env:
|
||||||
|
# These are the variables that `envsubst` will look for and replace
|
||||||
|
- name: PUBLIC_URL
|
||||||
|
value: 'https://{{ .Values.subdomain }}.olsen.cloud'
|
||||||
|
- name: OIDC_ISSUER_URL
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: '{{ .Release.Name }}-client'
|
||||||
|
key: configurationIssuer
|
||||||
|
- name: OIDC_CLIENT_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: '{{ .Release.Name }}-client'
|
||||||
|
key: clientId
|
||||||
|
- name: OIDC_CLIENT_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: '{{ .Release.Name }}-client'
|
||||||
|
key: clientSecret
|
||||||
|
# Add any other variables used in config.yaml.template here
|
||||||
|
volumeMounts:
|
||||||
|
- name: config-template
|
||||||
|
mountPath: /config-template # Mount the ConfigMap as a volume
|
||||||
|
readOnly: true
|
||||||
|
- name: headscale-config
|
||||||
|
mountPath: /etc/headscale # Destination for the generated config
|
||||||
|
|
||||||
|
containers:
|
||||||
|
- name: '{{ .Release.Name }}'
|
||||||
|
image: headscale/headscale:latest # Use the official image
|
||||||
|
command: ['headscale', 'serve']
|
||||||
|
ports:
|
||||||
|
- name: http-api
|
||||||
|
containerPort: 8080
|
||||||
|
protocol: TCP
|
||||||
|
- name: wireguard-udp
|
||||||
|
containerPort: 41641
|
||||||
|
protocol: UDP
|
||||||
|
volumeMounts:
|
||||||
|
- name: headscale-data
|
||||||
|
mountPath: /var/lib/headscale
|
||||||
|
- name: headscale-config
|
||||||
|
mountPath: /etc/headscale
|
||||||
|
volumes:
|
||||||
|
- name: config-template
|
||||||
|
configMap:
|
||||||
|
name: '{{ .Release.Name }}-config-template'
|
||||||
|
- name: headscale-config
|
||||||
|
emptyDir: {}
|
||||||
|
- name: headscale-data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: '{{ .Release.Name }}-data'
|
||||||
11
charts/apps/headscale/templates/external-http-service.yaml
Normal file
11
charts/apps/headscale/templates/external-http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: ExternalHttpService
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
destination:
|
||||||
|
host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/headscale/templates/pvc.yaml
Normal file
11
charts/apps/headscale/templates/pvc.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-data'
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- 'ReadWriteOnce'
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: '1Gi'
|
||||||
|
storageClassName: '{{ .Values.globals.environment }}'
|
||||||
32
charts/apps/headscale/templates/service.yaml
Normal file
32
charts/apps/headscale/templates/service.yaml
Normal file
@@ -0,0 +1,32 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 8080
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-headscale'
|
||||||
|
labels:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
type: LoadBalancer
|
||||||
|
ports:
|
||||||
|
- port: 41641
|
||||||
|
targetPort: 41641
|
||||||
|
protocol: UDP
|
||||||
|
name: wireguard-udp
|
||||||
|
selector:
|
||||||
|
app: '{{ .Release.Name }}'
|
||||||
7
charts/apps/headscale/values.yaml
Normal file
7
charts/apps/headscale/values.yaml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
image:
|
||||||
|
repository: headscale/headscale
|
||||||
|
tag: latest@sha256:ea9b5ee06274d757a4d52103de56cd11a9c393acb19d9a35f4b9fe52ada410de
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
subdomain: headscale
|
||||||
3
charts/apps/homarr/Chart.yaml
Normal file
3
charts/apps/homarr/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: openwebui
|
||||||
10
charts/apps/homarr/templates/client.yaml
Normal file
10
charts/apps/homarr/templates/client.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
redirectUris:
|
||||||
|
- path: /api/auth/callback/oidc
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
matchingMode: strict
|
||||||
83
charts/apps/homarr/templates/deployment.yaml
Normal file
83
charts/apps/homarr/templates/deployment.yaml
Normal file
@@ -0,0 +1,83 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: "{{ .Release.Name }}"
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||||
|
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 7575
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /appdata
|
||||||
|
name: data
|
||||||
|
env:
|
||||||
|
- name: BASE_URL
|
||||||
|
value: https://homarr.olsen.cloud # TODO
|
||||||
|
|
||||||
|
- name: NEXTAUTH_URL
|
||||||
|
value: https://homarr.olsen.cloud
|
||||||
|
|
||||||
|
- name: AUTH_PROVIDERS
|
||||||
|
value: oidc
|
||||||
|
|
||||||
|
- name: AUTH_OIDC_CLIENT_NAME
|
||||||
|
value: Authentik
|
||||||
|
|
||||||
|
- name: AUTH_OIDC_SCOPE_OVERWRITE
|
||||||
|
value: openid email profile
|
||||||
|
|
||||||
|
- name: AUTH_OIDC_GROUPS_ATTRIBUTE
|
||||||
|
value: groups
|
||||||
|
|
||||||
|
- name: AUTH_OIDC_AUTO_LOGIN
|
||||||
|
value: "true"
|
||||||
|
|
||||||
|
- name: SECRET_ENCRYPTION_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-secrets"
|
||||||
|
key: encryptionkey
|
||||||
|
|
||||||
|
- name: AUTH_OIDC_ISSUER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-client"
|
||||||
|
key: configurationIssuer
|
||||||
|
|
||||||
|
- name: AUTH_OIDC_CLIENT_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-client"
|
||||||
|
key: clientId
|
||||||
|
|
||||||
|
- name: AUTH_OIDC_CLIENT_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-client"
|
||||||
|
key: clientSecret
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: "{{ .Release.Name }}-data"
|
||||||
11
charts/apps/homarr/templates/external-http-service.yaml
Normal file
11
charts/apps/homarr/templates/external-http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: ExternalHttpService
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
destination:
|
||||||
|
host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/homarr/templates/http-service.yaml
Normal file
11
charts/apps/homarr/templates/http-service.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: HttpService
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
destination:
|
||||||
|
host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
11
charts/apps/homarr/templates/pvc.yaml
Normal file
11
charts/apps/homarr/templates/pvc.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}-data'
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- 'ReadWriteOnce'
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: '1Gi'
|
||||||
|
storageClassName: '{{ .Values.globals.environment }}'
|
||||||
9
charts/apps/homarr/templates/secret.yaml
Normal file
9
charts/apps/homarr/templates/secret.yaml
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: GenerateSecret
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}-secrets"
|
||||||
|
spec:
|
||||||
|
fields:
|
||||||
|
- name: encryptionkey
|
||||||
|
encoding: hex
|
||||||
|
length: 64
|
||||||
15
charts/apps/homarr/templates/service.yaml
Normal file
15
charts/apps/homarr/templates/service.yaml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 7575
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
7
charts/apps/homarr/values.yaml
Normal file
7
charts/apps/homarr/values.yaml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
globals:
|
||||||
|
environment: prod
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/homarr-labs/homarr
|
||||||
|
tag: latest@sha256:9ba9831d43347b6d66143a0754c97b9790a2ffe9bdf5004083668864b3328e65
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
subdomain: homarr
|
||||||
3
charts/apps/home-assistant/Chart.yaml
Normal file
3
charts/apps/home-assistant/Chart.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: home-assistant
|
||||||
10
charts/apps/home-assistant/templates/client.yaml
Normal file
10
charts/apps/home-assistant/templates/client.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
redirectUris:
|
||||||
|
- path: /auth/openid/callback
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
matchingMode: strict
|
||||||
45
charts/apps/home-assistant/templates/deployment.yaml
Normal file
45
charts/apps/home-assistant/templates/deployment.yaml
Normal file
@@ -0,0 +1,45 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
hostNetwork: true
|
||||||
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
|
|
||||||
|
containers:
|
||||||
|
- name: "{{ .Release.Name }}"
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||||
|
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||||
|
env:
|
||||||
|
- name: TZ
|
||||||
|
value: "{{ .Values.globals.timezone }}"
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 8123
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /config
|
||||||
|
name: config
|
||||||
|
securityContext:
|
||||||
|
privileged: true
|
||||||
|
volumes:
|
||||||
|
- name: config
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: "{{ .Release.Name }}-config"
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: ExternalHttpService
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
environment: "{{ .Values.globals.environment }}"
|
||||||
|
subdomain: "{{ .Values.subdomain }}"
|
||||||
|
destination:
|
||||||
|
host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user