group (#45)

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs
from Renovate will soon appear from 'Mend'. Learn more
[here](https://redirect.github.com/renovatebot/renovate/discussions/37842).

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| docker/build-push-action | action | digest | `f2a1d5e` -> `cb8fc75` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/morten-olsen/homelab-operator).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45Ny4xMCIsInVwZGF0ZWRJblZlciI6IjQxLjk3LjEwIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/publish-backup-tag.yml

@@ -36,7 +36,7 @@ jobs:
           fetch-depth: 0
 
       - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
         with:
           registry: ${{ env.DOCKER_REGISTRY }}
           username: ${{ github.actor }}
@@ -50,7 +50,7 @@ jobs:
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        uses: docker/build-push-action@cb8fc7586f9ad9441b20c33e0f6e8b1b58d8b4c6
         with:
           context: ./images/backup
           push: true

.github/workflows/publish-tag.yml

@@ -36,7 +36,7 @@ jobs:
           fetch-depth: 0
 
       - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
         with:
           registry: ${{ env.DOCKER_REGISTRY }}
           username: ${{ github.actor }}
@@ -50,7 +50,7 @@ jobs:
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        uses: docker/build-push-action@cb8fc7586f9ad9441b20c33e0f6e8b1b58d8b4c6
         with:
           context: ./images/operator
           push: true

charts/apps/data/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: data

charts/apps/data/templates/database.yaml

@@ -0,0 +1,6 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'

charts/apps/data/values.yaml

@@ -0,0 +1,2 @@
+globals:
+  environment: prod

charts/apps/home-assistant/values.yaml

@@ -3,7 +3,7 @@ globals:
   timezone: Europe/Amsterdam
 image:
   repository: ghcr.io/home-assistant/home-assistant
-  tag: stable@sha256:37af5e84627dc6cc4f8ce2de631cca7ee1fc76c908b429b3a8c1ec46f246a5fe
+  tag: stable@sha256:89ec0583c7f47c8a150204f6b5ed48b5432026012bebe1226cf72775a795a5e1
   pullPolicy: IfNotPresent
 subdomain: home-assistant
 piper:

charts/apps/linkwarden/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: Linkwarden

charts/apps/linkwarden/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: /api/v1/auth/callback/authentik
+      subdomain: "{{ .Values.subdomain }}"
+      matchingMode: strict

charts/apps/linkwarden/templates/database.yaml

@@ -0,0 +1,6 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'

charts/apps/linkwarden/templates/deployment.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          ports:
+            - containerPort: 3000
+              name: http
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+            - name: NEXTAUTH_URL
+              value: "https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}/api/v1/auth"
+            - name: NEXT_PUBLIC_OLLAMA_ENDPOINT_URL
+              value: "http://ollama:80"
+            - name: OLLAMA_MODEL
+              value: phi3:mini-4k
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-pg-connection"
+                  key: url
+            - name: NEXTAUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-secrets"
+                  key: nextauth
+            - name: NEXT_PUBLIC_DISABLE_REGISTRATION
+              value: "true"
+            - name: NEXT_PUBLIC_CREDENTIALS_ENABLED
+              value: "false"
+            - name: DISABLE_NEW_SSO_USERS
+              value: "false"
+            - name: NEXT_PUBLIC_AUTHENTIK_ENABLED
+              value: "true"
+            - name: AUTHENTIK_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientId
+            - name: AUTHENTIK_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientSecret
+            - name: AUTHENTIK_ISSUER
+              value: "https://authentik.{{ .Values.globals.domain }}/application/o/linkwarden"
+              # TODO:
+            # - name: AUTHENTIK_ISSUER
+            #   valueFrom:
+            #     secretKeyRef:
+            #       name: "{{ .Release.Name }}-client"
+            #       key: configurationIssuer
+          volumeMounts:
+            - mountPath: /data/data
+              name: data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"

charts/apps/linkwarden/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/linkwarden/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}"
+    port:
+      number: 80

charts/apps/linkwarden/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/linkwarden/templates/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: GenerateSecret
+metadata:
+  name: "{{ .Release.Name }}-secrets"
+spec:
+  fields:
+    - name: nextauth
+      encoding: hex
+      length: 64

charts/apps/linkwarden/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 3000
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/linkwarden/values.yaml

@@ -0,0 +1,9 @@
+globals:
+  environment: prod
+  domain: olsen.cloud
+  timezone: Europe/Amsterdam
+image:
+  repository: ghcr.io/linkwarden/linkwarden
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: linkwarden

charts/apps/metamcp/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  redirectUris:
+    - path: /api/auth/oidc/callback
+      subdomain: '{{ .Values.subdomain }}'
+      matchingMode: strict

charts/apps/metamcp/templates/deployment.yaml

@@ -1,23 +1,23 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: '{{ .Release.Name }}'
+  name: "{{ .Release.Name }}"
 spec:
   strategy:
     type: Recreate
   replicas: 1
   selector:
     matchLabels:
-      app: '{{ .Release.Name }}'
+      app: "{{ .Release.Name }}"
   template:
     metadata:
       labels:
-        app: '{{ .Release.Name }}'
+        app: "{{ .Release.Name }}"
     spec:
       containers:
-        - name: '{{ .Release.Name }}'
-          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
-          imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
           ports:
             - name: http
               containerPort: 12008
@@ -33,47 +33,68 @@ spec:
               name: data
           env:
             - name: TZ
-              value: '{{ .Values.globals.timezone }}'
+              value: "{{ .Values.globals.timezone }}"
             - name: APP_URL
-              value: https://metamcp.olsen.cloud # TODO: Change
+              value: "https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}"
             - name: NEXT_PUBLIC_APP_URL
-              value: https://metamcp.olsen.cloud # TODO: Change
+              value: "https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}"
             - name: BETTER_AUTH_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-secrets'
+                  name: "{{ .Release.Name }}-secrets"
                   key: betterauth
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: url
             - name: POSTGRES_DB
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: database
             - name: POSTGRES_HOST
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: host
             - name: POSTGRES_PORT
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: port
             - name: POSTGRES_USER
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: user
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: password
+            - name: OIDC_PROVIDER_ID
+              value: oidc
+            - name: OIDC_SCOPES
+              value: openid email profile
+            - name: OIDC_PKCE
+              value: "true"
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientId
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientSecret
+            - name: OIDC_DISCOVERY_URL
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: configuration
       volumes:
         - name: data
           persistentVolumeClaim:
-            claimName: '{{ .Release.Name }}-data'
+            claimName: "{{ .Release.Name }}-data"

charts/apps/metamcp/values.yaml

@@ -1,5 +1,6 @@
 globals:
   environment: prod
+  domain: olsen.cloud
   timezone: Europe/Amsterdam
 image:
   repository: ghcr.io/metatool-ai/metamcp

charts/apps/mqtt/templates/config.yaml

@@ -8,5 +8,5 @@ data:
   mosquitto.conf: |
     persistence true
     persistence_location /mosquitto/data/
-    listener 1884 0.0.0.0
+    listener 1883 0.0.0.0
     allow_anonymous true

charts/apps/mqtt/templates/deployment.yaml

@@ -27,7 +27,7 @@ spec:
               command:
                 - sh
                 - -c
-                - mosquitto_pub -h localhost -p 1884 -t health/ready -m "ready" -q 0 -i readiness_client -V 5
+                - mosquitto_pub -h localhost -p 1883 -t health/ready -m "ready" -q 0 -i readiness_client -V 5
             initialDelaySeconds: 10 # Give broker time to start
             periodSeconds: 20 # Check every 20 seconds
             timeoutSeconds: 5 # Fail if command takes longer than 5 seconds
@@ -37,7 +37,7 @@ spec:
               command:
                 - sh
                 - -c
-                - mosquitto_pub -h localhost -p 1884 -t health/ready -m "ready" -q 0 -i readiness_client -V 5
+                - mosquitto_pub -h localhost -p 1883 -t health/ready -m "ready" -q 0 -i readiness_client -V 5
             initialDelaySeconds: 15
             periodSeconds: 20
             timeoutSeconds: 5

charts/apps/mqtt/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}"
+    port:
+      number: 1883

charts/apps/mqtt/templates/service.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     app: "{{ .Release.Name }}"
 spec:
-  type: ClusterIP
+  type: LoadBalancer
   ports:
     - port: 1883
       targetPort: 1883

charts/apps/nocodb/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: nocodb

charts/apps/nocodb/templates/deployment.yaml

@@ -0,0 +1,33 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          ports:
+            - containerPort: 8080
+              name: http
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+            - name: PUID
+            - mountPath: /usr/app/data/
+              name: data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"

charts/apps/nocodb/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/nocodb/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}"
+    port:
+      number: 80

charts/apps/nocodb/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/nocodb/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/nocodb/values.yaml

@@ -0,0 +1,9 @@
+globals:
+  environment: prod
+  domain: olsen.cloud
+  timezone: Europe/Amsterdam
+image:
+  repository: nocodb/nocodb
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: nocodb

notes.md

@@ -0,0 +1 @@
+![authentik bg](/static/dist/assets/images/flow_background.jpg)

renovate.json5

@@ -5,6 +5,8 @@
   ],
   "packageRules": [
     {
+      "groupName": "Docker images",
+      "groupSlug": "dockerimages",
       "matchDatasources": ["docker"],
       "pinDigests": true
     }
@@ -23,4 +25,4 @@
       "datasourceTemplate": "docker"
     }
   ]
-}
+}