turn off nr logging

expose pg database

kubernetes/apps/adguard-home/adguard-home.yaml

@@ -7,7 +7,6 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  targetNamespace: flux-system
   path: ./kubernetes/apps/adguard-home/app
   prune: true
   sourceRef:

kubernetes/apps/capacitor/capacitor.yaml

@@ -7,7 +7,6 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  targetNamespace: flux-system
   path: ./kubernetes/apps/capacitor/app
   prune: true
   sourceRef:

kubernetes/apps/code-server/app/pvc.yaml

@@ -27,7 +27,7 @@ spec:
             - key: kubernetes.io/hostname
               operator: In
               values:
-                - rpi5-cluster-node-3
+                - rpi5-cluster-node-2
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim

kubernetes/apps/code-server/code-server.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: code-server-secrets
-  namespace: code-server
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -20,7 +20,7 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: code-server-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -40,7 +40,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: code-server-secrets
-      namespace: code-server
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/apps/dokuwiki/app/volume.yaml

@@ -27,7 +27,7 @@ spec:
             - key: kubernetes.io/hostname
               operator: In
               values:
-                - rpi5-cluster-node-3
+                - rpi5-cluster-node-2
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim

kubernetes/apps/dokuwiki/dokuwiki.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: dokuwiki-secrets
-  namespace: dokuwiki
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -20,7 +20,7 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: dokuwiki-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -39,7 +39,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: dokuwiki-secrets
-      namespace: dokuwiki
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/apps/gitea/app/volume.yaml

@@ -27,7 +27,7 @@ spec:
             - key: kubernetes.io/hostname
               operator: In
               values:
-                - rpi5-cluster-node-3
+                - rpi5-cluster-node-2
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim

kubernetes/apps/gitea/gitea.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: gitea-secrets
-  namespace: gitea
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -20,7 +20,7 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: gitea-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -39,7 +39,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: gitea-secrets
-      namespace: gitea
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/apps/homer/homer.yaml

@@ -7,7 +7,6 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  targetNamespace: flux-system
   path: ./kubernetes/apps/homer/app
   prune: true
   sourceRef:

kubernetes/apps/jellyfin/app/pvc.yaml

@@ -22,7 +22,7 @@ spec:
             - key: kubernetes.io/hostname
               operator: In
               values:
-                - rpi5-cluster-node-3
+                - rpi5-cluster-node-2
 ---
 apiVersion: v1
 kind: PersistentVolume
@@ -48,4 +48,4 @@ spec:
             - key: kubernetes.io/hostname
               operator: In
               values:
-                - rpi5-cluster-node-3
+                - rpi5-cluster-node-2

kubernetes/apps/jellyfin/app/release.yaml

@@ -25,12 +25,14 @@ spec:
           accessModes:
             - ReadWriteOnce
           volumeName: jellyfin-config
+          storageClassName: local-path
       data:
         enabled: true
         volumeClaimSpec:
           accessModes:
             - ReadWriteOnce
           volumeName: jellyfin-data
+          storageClassName: local-path
     jellyfin:
       mediaVolumes:
         - name: movies
@@ -50,7 +52,7 @@ spec:
                       - key: kubernetes.io/hostname
                         operator: In
                         values:
-                          - rpi5-cluster-node-3
+                          - rpi5-cluster-node-2
             claimRef:
               apiVersion: v1
               kind: PersistentVolumeClaim
@@ -76,7 +78,7 @@ spec:
                       - key: kubernetes.io/hostname
                         operator: In
                         values:
-                          - rpi5-cluster-node-3
+                          - rpi5-cluster-node-2
             claimRef:
               apiVersion: v1
               kind: PersistentVolumeClaim
@@ -102,7 +104,7 @@ spec:
                       - key: kubernetes.io/hostname
                         operator: In
                         values:
-                          - rpi5-cluster-node-3
+                          - rpi5-cluster-node-2
             claimRef:
               apiVersion: v1
               kind: PersistentVolumeClaim
@@ -128,7 +130,7 @@ spec:
                       - key: kubernetes.io/hostname
                         operator: In
                         values:
-                          - rpi5-cluster-node-3
+                          - rpi5-cluster-node-2
             claimRef:
               apiVersion: v1
               kind: PersistentVolumeClaim
@@ -154,7 +156,7 @@ spec:
                       - key: kubernetes.io/hostname
                         operator: In
                         values:
-                          - rpi5-cluster-node-3
+                          - rpi5-cluster-node-2
             claimRef:
               apiVersion: v1
               kind: PersistentVolumeClaim

kubernetes/apps/kavita/app/development.yaml

@@ -20,7 +20,7 @@ spec:
         app.kubernetes.io/instance: kavita
     spec:
       containers:
-        - image: jvmilazz0/kavita:latest
+        - image: jvmilazz0/kavita:0.8.1
           imagePullPolicy: IfNotPresent
           name: kavita
           ports:

kubernetes/apps/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 resources:
   - ./adguard-home/adguard-home.yaml
   - ./capacitor/capacitor.yaml
-  - ./cert-manager/cert-manager.yaml
   - ./code-server/code-server.yaml
   - ./dokuwiki/dokuwiki.yaml
   - ./gitea/gitea.yaml
@@ -12,10 +11,9 @@ resources:
   - ./kavita/kavita.yaml
   - ./nexus/nexus.yaml
   - ./podinfo/podinfo.yaml
-  - ./postgresql/postgresql.yaml
   - ./qbittorrent/qbittorrent.yaml
-  - ./redis/redis.yaml
   - ./snippet-box/snippet-box.yaml
   - ./sonarqube/sonarqube.yaml
   - ./uptime-kuma/uptime-kuma.yaml
+  - ./vaultwarden/vaultwarden.yaml
   - ./weave-gitops/weave-gitops.yaml

kubernetes/apps/nexus/app/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           resources:
             limits:
               memory: "3Gi"
-              cpu: "500m"
+              cpu: "1"
             requests:
               memory: "2Gi"
               cpu: "500m"

kubernetes/apps/qbittorrent/app/ingress.yaml

@@ -16,6 +16,6 @@ spec:
             path: "/"
             backend:
               service:
-                name: qbittorrent
+                name: qbittorrent-qbittorrent-web
                 port:
                   number: 8888

kubernetes/apps/qbittorrent/app/release.yaml

@@ -24,7 +24,9 @@ spec:
         port: 8388
     config:
       persistence:
-        name: "qbittorrent-config-pvc"
+        name: config
+        storageClass: local-path
+        size: 5Gi
     volumeMounts:
-      - name: qbittorrent-download-pvc
+      - name: download
         mountPath: /download

kubernetes/apps/qbittorrent/app/volume.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: qbittorrent-config
+  name: config
   namespace: qbittorrent
   labels:
     type: local
@@ -18,7 +18,7 @@ spec:
   claimRef:
     apiVersion: v1
     kind: PersistentVolumeClaim
-    name: qbittorrent-config-pvc
+    name: config
     namespace: qbittorrent
   nodeAffinity:
     required:
@@ -27,7 +27,7 @@ spec:
             - key: kubernetes.io/hostname
               operator: In
               values:
-                - rpi5-cluster-node-3
+                - rpi5-cluster-node-2
 ---
 #apiVersion: v1
 #kind: PersistentVolumeClaim
@@ -48,7 +48,7 @@ spec:
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: qbittorrent-download
+  name: download
   namespace: qbittorrent
   labels:
     type: local
@@ -56,7 +56,7 @@ spec:
   storageClassName: local-path
   volumeMode: Filesystem
   capacity:
-    storage: 5Gi
+    storage: 64Gi
   accessModes:
     - ReadWriteOnce
   persistentVolumeReclaimPolicy: Retain
@@ -65,7 +65,7 @@ spec:
   claimRef:
     apiVersion: v1
     kind: PersistentVolumeClaim
-    name: qbittorrent-download-pvc
+    name: download
     namespace: qbittorrent
   nodeAffinity:
     required:
@@ -74,15 +74,15 @@ spec:
             - key: kubernetes.io/hostname
               operator: In
               values:
-                - rpi5-cluster-node-3
+                - rpi5-cluster-node-2
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: qbittorrent-download-pvc
+  name: download
   namespace: qbittorrent
   labels:
-    name: qbittorrent-download-pvc
+    name: download
 spec:
   storageClassName: local-path
   volumeMode: Filesystem

kubernetes/apps/redis/app/volume.yaml

@@ -1,31 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: redis-master-pvc
-  namespace: redis
-  labels:
-    name: redis-master-pvc
-spec:
-  storageClassName: local-path
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 8Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: redis-replica-pvc
-  namespace: redis
-  labels:
-    name: redis-replica-pvc
-spec:
-  storageClassName: local-path
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 8Gi

kubernetes/apps/snippet-box/snippet-box.yaml

@@ -7,7 +7,6 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  targetNamespace: flux-system
   path: ./kubernetes/apps/snippet-box/app
   prune: true
   sourceRef:

kubernetes/apps/sonarqube/app/release.yaml

@@ -34,7 +34,7 @@ spec:
         elastic: 30091
     persistence:
       enabled: true
-      storageClass: "local-path"
+      storageClass: local-path
       size: "32Gi"
       existingClaim: "sonarqube-pvc"
     postgresql:

kubernetes/apps/sonarqube/app/volume.yaml

@@ -27,7 +27,7 @@ spec:
             - key: kubernetes.io/hostname
               operator: In
               values:
-                - rpi5-cluster-node-3
+                - rpi5-cluster-node-2
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim

kubernetes/apps/sonarqube/sonarqube.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: sonarqube-secrets
-  namespace: sonarqube
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -20,7 +20,7 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: sonarqube-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -39,7 +39,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: sonarqube-secrets
-      namespace: sonarqube
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/apps/uptime-kuma/app/release.yaml

@@ -9,6 +9,7 @@ spec:
   chart:
     spec:
       chart: uptime-kuma
+      version: 2.18.1
       sourceRef:
         kind: HelmRepository
         name: irsigler

kubernetes/apps/vaultwarden/app/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+  labels:
+    app.kubernetes.io/name: vaultwarden
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: vaultwarden
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: vaultwarden
+        rpi5.cluster.policy/egress-world: "true"
+        rpi5.cluster.policy/ingress-world: "true"
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - securityContext:
+            runAsUser: 1000
+            runAsNonRoot: true
+            runAsGroup: 1000
+          name: vaultwarden
+          image: vaultwarden/server:1.31.0
+          env:
+            - name: DOMAIN
+              value: https://vaultwarden.cluster.edward.sydney
+            - name: SIGNUPS_ALLOWED
+              value: "true"
+            - name: DATABASE_URL
+              value: postgresql://${db_username}:${db_password}@${db_host}:5432/${db_name}
+          ports:
+            - protocol: TCP
+              containerPort: 80
+              name: http
+          volumeMounts:
+            - name: vaultwarden-data
+              mountPath: /data
+      volumes:
+        - name: vaultwarden-data
+          hostPath:
+            path: /mnt/nfs/AppData/vaultwarden/data
+            type: Directory
+

kubernetes/apps/vaultwarden/app/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden-ingress
+  namespace: vaultwarden
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "vaultwarden.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: vaultwarden
+                port:
+                  number: 11080

kubernetes/apps/vaultwarden/app/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+  labels:
+    app.kubernetes.io/name: vaultwarden
+spec:
+  selector:
+    app.kubernetes.io/name: vaultwarden
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 11080
+      targetPort: 80
+      name: http

kubernetes/apps/vaultwarden/vaultwarden.yaml

@@ -0,0 +1,46 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vaultwarden-secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: vaultwarden
+  path: ./vaultwarden
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/vaultwarden/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: vaultwarden-secrets
+      namespace: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: vaultwarden-secrets

kubernetes/apps/weave-gitops/weave-gitops.yaml

@@ -7,7 +7,6 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  targetNamespace: flux-system
   path: ./kubernetes/apps/weave-gitops/app
   prune: true
   sourceRef:

kubernetes/infrastructure/cert-manager/cert-manager.yaml

@@ -8,18 +8,21 @@ spec:
   timeout: 1m30s
   retryInterval: 30s
   targetNamespace: cert-manager
-  path: ./kubernetes/apps/cert-manager/app
+  path: ./kubernetes/infrastructure/cert-manager/app
   prune: true
   sourceRef:
     kind: GitRepository
     namespace: flux-system
     name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: clusterissuer-secrets
-  namespace: cert-manager
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -32,12 +35,14 @@ spec:
     namespace: flux-system
     name: home-cluster-ops-secrets
   dependsOn:
+    - name: namespaces
+      namespace: flux-system
     - name: repositories
       namespace: flux-system
   decryption:
     provider: sops
     secretRef:
-      name: cert-manager-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -49,7 +54,7 @@ spec:
   timeout: 1m30s
   retryInterval: 30s
   targetNamespace: cert-manager
-  path: ./kubernetes/apps/cert-manager/clusterissuer
+  path: ./kubernetes/infrastructure/cert-manager/clusterissuer
   prune: true
   sourceRef:
     kind: GitRepository
@@ -57,7 +62,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: clusterissuer-secrets
-      namespace: cert-manager
+      namespace: flux-system
     - name: cert-manager
       namespace: cert-manager
   postBuild:
@@ -69,7 +74,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: certificate-secrets
-  namespace: cert-manager
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -82,12 +87,14 @@ spec:
     namespace: flux-system
     name: home-cluster-ops-secrets
   dependsOn:
+    - name: namespaces
+      namespace: flux-system
     - name: repositories
       namespace: flux-system
   decryption:
     provider: sops
     secretRef:
-      name: cert-manager-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -99,7 +106,7 @@ spec:
   timeout: 1m30s
   retryInterval: 30s
   targetNamespace: cert-manager
-  path: ./kubernetes/apps/cert-manager/certificates
+  path: ./kubernetes/infrastructure/cert-manager/certificates
   prune: true
   sourceRef:
     kind: GitRepository
@@ -107,7 +114,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: certificate-secrets
-      namespace: cert-manager
+      namespace: flux-system
     - name: cert-manager
       namespace: cert-manager
     - name: clusterissuer

kubernetes/infrastructure/consul/app/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: consul
+  namespace: consul
+  labels:
+    app: consul
+spec:
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8500
+      targetPort: 8500
+  selector:
+    app: consul
+  type: ClusterIP

kubernetes/infrastructure/consul/app/statefulset.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: consul
+  namespace: consul
+  labels:
+    app: consul
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: consul
+  template:
+    metadata:
+      labels:
+        app: consul
+    spec:
+      containers:
+        - name: consul
+          image: 'consul:1.15.4'
+          args:
+            - agent
+          ports:
+            - name: http
+              containerPort: 8500
+              protocol: TCP
+          env:
+            - name: TZ
+              value: Australia/Sydney
+          volumeMounts:
+            - name: consul-data
+              mountPath: /consul/data
+            - name: consul-config
+              mountPath: /consul/config
+          imagePullPolicy: IfNotPresent
+      volumes:
+        - name: consul-data
+          hostPath:
+            path: /mnt/nfs/AppData/consul/data
+            type: Directory
+        - name: consul-config
+          hostPath:
+            path: /mnt/nfs/AppData/consul/config
+            type: Directory
+      restartPolicy: Always
+  serviceName: consul

kubernetes/infrastructure/consul/consul.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: consul
+  namespace: consul
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/consul/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system

kubernetes/infrastructure/grafana-dashboards/grafana-dashboards.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: grafana-dashboards-secrets
+  namespace: flux-system
+spec:
+  suspend: true
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: prometheus
+  path: ./grafana-dashboards
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: grafana-dashboards
+  namespace: prometheus
+spec:
+  suspend: true
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/grafana-dashboards/dashboards
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: grafana-dashboards-secrets
+      namespace: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: grafana-dashboards-secrets

kubernetes/infrastructure/ingress-nginx/config/ingress-configmap.yaml

@@ -4,13 +4,11 @@ metadata:
   name: tcp-services
   namespace: ingress-nginx
 data:
-  "53": "flux-system/adguard-home:53"
-  "853": "flux-system/adguard-home:853"
-  "5432": "postgresql/postgresql-primary:5432"
-  "5433": "postgresql/postgresql-replica:5432"
-  "5443": "flux-system/adguard-home:5443"
-  "6060": "flux-system/adguard-home:6060"
-  "8388": "qbittorrent/qbittorrent-torrent:8388"
+  "53": "adguard-home/adguard-home:53"
+  "853": "adguard-home/adguard-home:853"
+  "5443": "adguard-home/adguard-home:5443"
+  "6060": "adguard-home/adguard-home:6060"
+  "8388": "qbittorrent/qbittorrent-qbittorrent-torrent:8388"
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -18,9 +16,9 @@ metadata:
   name: udp-services
   namespace: ingress-nginx
 data:
-  "53": "flux-system/adguard-home:53"
-  "67": "flux-system/adguard-home:67"
-  "68": "flux-system/adguard-home:68"
-  "853": "flux-system/adguard-home:853"
-  "5443": "flux-system/adguard-home:5443"
-  "8388": "qbittorrent/qbittorrent-torrent:8388"
+  "53": "adguard-home/adguard-home:53"
+  "67": "adguard-home/adguard-home:67"
+  "68": "adguard-home/adguard-home:68"
+  "853": "adguard-home/adguard-home:853"
+  "5443": "adguard-home/adguard-home:5443"
+  "8388": "qbittorrent/qbittorrent-qbittorrent-torrent:8388"

kubernetes/infrastructure/kustomization.yaml

@@ -1,8 +1,22 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./namespaces/namespaces.yaml
-  - ./repositories/repositories.yaml
-#  - ./cilium/cilium.yaml
-  - ./ingress-nginx/ingress-nginx-config.yaml
+  - ./cert-manager/cert-manager.yaml
+  #  - ./cilium/cilium.yaml
+  - ./consul/consul.yaml
+#  - ./grafana-dashboards/grafana-dashboards.yaml
   - ./ingress-nginx/ingress-nginx.yaml
+  - ./ingress-nginx/ingress-nginx-config.yaml
+  - ./local-path-provisioner/local-path-provisioner.yaml
+  - ./logstash/logstash.yaml
+  - ./minio/minio.yaml
+#  - ./mongodb/mongodb.yaml
+  - ./namespaces/namespaces.yaml
+  - ./new-relic/new-relic.yaml
+  - ./postgresql/postgresql.yaml
+  - ./prometheus/prometheus.yaml
+  - ./prometheus-alertmanager/prometheus-alertmanager.yaml
+  - ./prometheus-exporters/prometheus-exporters.yaml
+  - ./redis/redis.yaml
+#  - ./renovate/renovate.yaml
+  - ./repositories/repositories.yaml

kubernetes/infrastructure/local-path-provisioner/app/local-path-provisioner.yaml

@@ -0,0 +1,149 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: local-path-provisioner-service-account
+  namespace: local-path-storage
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: local-path-provisioner-role
+  namespace: local-path-storage
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods" ]
+    verbs: [ "get", "list", "watch", "create", "patch", "update", "delete" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: local-path-provisioner-role
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "nodes", "persistentvolumeclaims", "configmaps", "pods", "pods/log" ]
+    verbs: [ "get", "list", "watch" ]
+  - apiGroups: [ "" ]
+    resources: [ "persistentvolumes" ]
+    verbs: [ "get", "list", "watch", "create", "patch", "update", "delete" ]
+  - apiGroups: [ "" ]
+    resources: [ "events" ]
+    verbs: [ "create", "patch" ]
+  - apiGroups: [ "storage.k8s.io" ]
+    resources: [ "storageclasses" ]
+    verbs: [ "get", "list", "watch" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: local-path-provisioner-bind
+  namespace: local-path-storage
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: local-path-provisioner-role
+subjects:
+  - kind: ServiceAccount
+    name: local-path-provisioner-service-account
+    namespace: local-path-storage
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: local-path-provisioner-bind
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: local-path-provisioner-role
+subjects:
+  - kind: ServiceAccount
+    name: local-path-provisioner-service-account
+    namespace: local-path-storage
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: local-path-provisioner
+  namespace: local-path-storage
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: local-path-provisioner
+  template:
+    metadata:
+      labels:
+        app: local-path-provisioner
+    spec:
+      serviceAccountName: local-path-provisioner-service-account
+      containers:
+        - name: local-path-provisioner
+          image: rancher/local-path-provisioner:v0.0.28
+          imagePullPolicy: IfNotPresent
+          command:
+            - local-path-provisioner
+            - --debug
+            - start
+            - --config
+            - /etc/config/config.json
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/config/
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: CONFIG_MOUNT_PATH
+              value: /etc/config/
+      volumes:
+        - name: config-volume
+          configMap:
+            name: local-path-config
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: local-path
+provisioner: rancher.io/local-path
+volumeBindingMode: WaitForFirstConsumer
+reclaimPolicy: Retain
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: local-path-config
+  namespace: local-path-storage
+data:
+  config.json: |-
+    {
+      "nodePathMap": [
+        {
+          "node": "DEFAULT_PATH_FOR_NON_LISTED_NODES",
+          "paths": [
+            "/opt/local-path-provisioner"]
+        }
+      ]
+    }
+  setup: |-
+    #!/bin/sh
+    set -eu
+    mkdir -m 0777 -p "$VOL_DIR"
+  teardown: |-
+    #!/bin/sh
+    set -eu
+    rm -rf "$VOL_DIR"
+  helperPod.yaml: |-
+    apiVersion: v1
+    kind: Pod
+    metadata:
+      name: helper-pod
+    spec:
+      priorityClassName: system-node-critical
+      tolerations:
+        - key: node.kubernetes.io/disk-pressure
+          operator: Exists
+          effect: NoSchedule
+      containers:
+        - name: helper-pod
+          image: busybox
+          imagePullPolicy: IfNotPresent

kubernetes/infrastructure/local-path-provisioner/local-path-provisioner.yaml

@@ -0,0 +1,19 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/gitrepository_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: local-path-provisioner
+  namespace: local-path-storage
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/local-path-provisioner/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system

kubernetes/infrastructure/logstash/app/ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: logstash-ingress
+  namespace: logstash
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "omada.logstash.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: logstash
+                port:
+                  number: 8008
+    - host: "logstash.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: logstash
+                port:
+                  number: 9600

kubernetes/infrastructure/logstash/app/pipelines.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: logstash-pipelines
+  namespace: logstash
+data:
+  pipelines.yaml: |
+    - pipeline.id: omada
+      path.config: "/opt/bitnami/logstash/config/omada.conf"
+    - pipeline.id: misc
+      path.config: "/opt/bitnami/logstash/config/misc.conf"
+  omada.conf: |
+    input {
+      tcp {
+        port => 1514
+        type => syslog
+      }
+      udp {
+        port => 1514
+        type => syslog
+      }
+      http {
+        port => 8008
+      }
+    }
+    output {
+      s3 { 
+        access_key_id => ${omada_s3_access_key_id}
+        bucket => "logstash"
+        canned_acl => "bucket-owner-read"
+        endpoint => "http://minio.minio.svc.cluster.local:19000"
+        prefix => "omada/%{+YYYY}/%{+MM}/%{+dd}"
+        region: "ap-southeast-2"
+        secret_access_key => ${omada_s3_secret_access_key}
+        time_file => 60
+      }
+    }
+  misc.conf: |
+    input {
+      file {
+        path => "/tmp/misc"
+      }
+    }
+    output {
+      stdout { }
+    }

kubernetes/infrastructure/logstash/app/release.yaml

@@ -0,0 +1,67 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: logstash
+  namespace: logstash
+spec:
+  releaseName: logstash
+  chart:
+    spec:
+      chart: logstash
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    existingConfiguration: logstash-pipelines
+    serviceAccount:
+      name: logstash
+    containerPorts:
+      - name: monitoring
+        containerPort: 9600
+        protocol: TCP
+      - name: omada-http
+        containerPort: 8008
+        protocol: TCP
+      - name: omada-syslog-udp
+        containerPort: 1514
+        protocol: UDP
+      - name: omada-syslog-tcp
+        containerPort: 1514
+        protocol: TCP
+    podSecurityContext:
+      fsGroup: 1000
+    containerSecurityContext:
+      runAsUser: 1000
+      runAsGroup: 1000
+    service:
+      type: LoadBalancer
+      ports:
+        - name: monitoring
+          port: 9600
+          targetPort: monitoring
+          protocol: TCP
+        - name: omada-http
+          port: 8008
+          targetPort: omada-http
+          protocol: TCP
+        - name: omada-syslog-udp
+          port: 1514
+          targetPort: omada-syslog-udp
+          protocol: UDP
+        - name: omada-syslog-tcp
+          port: 1514
+          targetPort: omada-syslog-tcp
+          protocol: TCP
+    persistence:
+      enabled: true
+      existingClaim: logstash-pvc
+      size: 16Gi
+    volumePermissions:
+      enabled: true
+      securityContext:
+        runAsUser: 1000

kubernetes/infrastructure/logstash/app/volume.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: logstash-pv
+  namespace: logstash
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 16Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/logstash/data"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: logstash-pvc
+    namespace: logstash
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-1
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: logstash-pvc
+  namespace: logstash
+  labels:
+    name: logstash-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 16Gi

kubernetes/infrastructure/logstash/logstash.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: logstash-secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: logstash
+  path: ./logstash
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: logstash
+  namespace: logstash
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/logstash/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: logstash-secrets
+      namespace: flux-system
+    - name: local-path-provisioner
+      namespace: local-path-storage
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: logstash-secrets

kubernetes/infrastructure/minio/app/ingress.yaml

@@ -0,0 +1,51 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: minio-ingress
+  namespace: minio
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "minio.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: minio
+                port:
+                  number: 19001
+    - host: "api.minio.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: minio
+                port:
+                  number: 19000
+    - host: "minio.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: minio
+                port:
+                  number: 19001
+    - host: "api.minio.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: minio
+                port:
+                  number: 19000

kubernetes/infrastructure/minio/app/release.yaml

@@ -0,0 +1,36 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: minio
+  namespace: minio
+spec:
+  releaseName: minio
+  chart:
+    spec:
+      chart: minio
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    clusterDomain: minio.cluster.edward.sydney
+    auth:
+      rootUser: ${root_user}
+      rootPassword: ${root_password}
+    nodeSelector:
+      kubernetes.io/hostname: rpi5-cluster-node-2
+    service:
+      ports:
+        api: 19000
+        console: 19001
+    persistence:
+      existingClaim: "minio-pvc"
+    containerSecurityContext:
+      runAsUser: 1000
+      runAsGroup: 1000
+    podSecurityContext:
+      fsGroup: 1000

kubernetes/infrastructure/minio/app/volume.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: minio-pv
+  namespace: minio
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 256Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/minio"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: minio-pvc
+    namespace: minio
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-2
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: minio-pvc
+  namespace: minio
+  labels:
+    name: minio-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 256Gi

kubernetes/infrastructure/minio/minio.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: minio-secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: minio
+  path: ./minio
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: minio
+  namespace: minio
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/minio/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: minio-secrets
+      namespace: flux-system
+    - name: local-path-provisioner
+      namespace: local-path-storage
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: minio-secrets

kubernetes/infrastructure/mongodb/app/release.yaml

@@ -0,0 +1,82 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: mongodb
+  namespace: mongodb
+spec:
+  releaseName: mongodb
+  chart:
+    spec:
+      chart: mongodb
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    architecture: replicaset
+    auth:
+      rootPassword: ${root_password}
+      usernames:
+        - edward
+        - anysync
+      passwords:
+        - ${edward_password}
+        - ${anysync_password}
+      databases:
+        - edward
+        - anysync
+    automountServiceAccountToken: true
+    replicaCount: 2
+    containerSecurityContext:
+      runAsUser: 1000
+      runAsGroup: 1000
+    startupProbe:
+      enabled: true
+    externalAccess:
+      enabled: true
+      service:
+        type: LoadBalancer
+      autoDiscovery:
+        enabled: true
+    persistence:
+      name: "datadir-mongodb-0"
+      resourcePolicy: "keep"
+      storageClass: "local-path"
+      size: "32Gi"
+      labels:
+        name: datadir-mongodb-0
+      volumeClaimTemplates:
+        selector:
+          matchLabels:
+            name: mongodb-pv
+    persistentVolumeClaimRetentionPolicy:
+      enabled: true
+    backup:
+      enabled: true
+      cronjob:
+        schedule: "@daily"
+        containerSecurityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+        storage:
+          resourcePolicy: "keep"
+          storageClass: "local-path"
+          volumeClaimTemplates:
+            selector:
+              matchLabels:
+                name: mongodb-backup-pv
+    serviceAccount:
+      create: true
+      name: mongodb
+    rbac:
+      create: true
+
+
+
+
+
+

kubernetes/infrastructure/mongodb/app/volume.yaml

@@ -0,0 +1,61 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mongodb-pv
+  namespace: mongodb
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 32Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/mongodb"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: datadir-mongodb-0
+    namespace: mongodb
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-1
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mongodb-backup-pv
+  namespace: mongodb
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 8Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/mongodb/backup"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: mongodb-mongodump
+    namespace: mongodb
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-1

kubernetes/infrastructure/mongodb/mongodb.yaml

@@ -0,0 +1,53 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: mongodb-secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: mongodb
+  path: ./mongodb
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: mongodb
+  namespace: mongodb
+spec:
+  suspend: true
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/mongodb/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: mongodb-secrets
+      namespace: flux-system
+    - name: namespaces
+      namespace: flux-system
+    - name: local-path-provisioner
+      namespace: local-path-storage
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: mongodb-secrets

kubernetes/infrastructure/namespaces/namespaces/consul.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: consul

kubernetes/infrastructure/namespaces/namespaces/flight-tracker.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: flight-tracker

kubernetes/infrastructure/namespaces/namespaces/home-assistant.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: home-assistant

kubernetes/infrastructure/namespaces/namespaces/local-path-storage.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: local-path-storage

kubernetes/infrastructure/namespaces/namespaces/logstash.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: logstash

kubernetes/infrastructure/namespaces/namespaces/minio.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: minio

kubernetes/infrastructure/namespaces/namespaces/mongodb.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mongodb

kubernetes/infrastructure/namespaces/namespaces/new-relic.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: new-relic

kubernetes/infrastructure/namespaces/namespaces/prometheus.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: prometheus

kubernetes/infrastructure/namespaces/namespaces/renovate.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: renovate

kubernetes/infrastructure/namespaces/namespaces/vaultwarden.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vaultwarden

kubernetes/infrastructure/new-relic/app/release.yaml

@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: new-relic
+  namespace: new-relic
+spec:
+  releaseName: new-relic
+  chart:
+    spec:
+      chart: nri-bundle
+      sourceRef:
+        kind: HelmRepository
+        name: new-relic
+        namespace: flux-system
+  interval: 1h
+  values:
+    global:
+      cluster: RPi5 Cluster
+      licenseKey: ${nr_license_key}
+      lowDataMode: true
+    newrelic-infrastructure:
+      privileged: true
+    kube-state-metrics:
+      enabled: true
+      image:
+          tag: v2.10.0
+    kubeEvents:
+      enabled: true
+    newrelic-prometheus-agent:
+      enabled: true
+      lowDataMode: true
+      config:
+        kubernetes:
+          integrations_filter:
+            enabled: false
+    logging:
+      enabled: true
+    newrelic-logging:
+      enabled: false
+      lowDataMode: true
+    fluentBit:
+      persistence:
+        mode: hostPath
+        persistentVolume:
+          storageClass: "local-path"
+          existingVolume: "nr-fluentbit-pv"
+          existingVolumeClaim: "nr-fluentbit-pvc"

kubernetes/infrastructure/new-relic/app/volume.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nr-fluentbit-pv
+  namespace: minio
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/new-relic/fluentbit"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: nr-fluentbit-pvc
+    namespace: minio
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-1
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nr-fluentbit-pvc
+  namespace: new-relic
+  labels:
+    name: nr-fluentbit-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi

kubernetes/infrastructure/new-relic/new-relic.yaml

@@ -0,0 +1,52 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: new-relic-secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: new-relic
+  path: ./new-relic
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: new-relic
+  namespace: new-relic
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/new-relic/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: repositories
+      namespace: flux-system
+    - name: new-relic-secrets
+      namespace: flux-system
+    - name: local-path-provisioner
+      namespace: local-path-storage
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: new-relic-secrets

kubernetes/infrastructure/postgresql/app/pvc.yaml

@@ -27,7 +27,7 @@ spec:
             - key: kubernetes.io/hostname
               operator: In
               values:
-                - rpi5-cluster-node-3
+                - rpi5-cluster-node-2
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -74,7 +74,7 @@ spec:
             - key: kubernetes.io/hostname
               operator: In
               values:
-                - rpi5-cluster-node-3
+                - rpi5-cluster-node-2
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim

kubernetes/infrastructure/postgresql/app/release.yaml

@@ -36,6 +36,8 @@ spec:
         runAsGroup: 1000
       podLabels:
         name: "postgresql-primary"
+      service:
+        type: "LoadBalancer"
       persistence:
         existingClaim: postgresql-primary-pvc
         selector:
@@ -50,6 +52,8 @@ spec:
         runAsGroup: 1000
       podLabels:
         name: "postgresql-replica"
+      service:
+        type: "LoadBalancer"
       persistence:
         existingClaim: postgresql-replica-pvc
         selector:

kubernetes/infrastructure/postgresql/postgresql.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: postgresql-secrets
-  namespace: postgresql
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -15,12 +15,14 @@ spec:
     namespace: flux-system
     name: home-cluster-ops-secrets
   dependsOn:
+    - name: namespaces
+      namespace: flux-system
     - name: repositories
       namespace: flux-system
   decryption:
     provider: sops
     secretRef:
-      name: postgresql-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -31,7 +33,7 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  path: ./kubernetes/apps/postgresql/app
+  path: ./kubernetes/infrastructure/postgresql/app
   prune: true
   sourceRef:
     kind: GitRepository
@@ -39,7 +41,11 @@ spec:
     name: flux-system
   dependsOn:
     - name: postgresql-secrets
-      namespace: postgresql
+      namespace: flux-system
+    - name: namespaces
+      namespace: flux-system
+    - name: local-path-provisioner
+      namespace: local-path-storage
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/infrastructure/postgresql/scripts/ingress-nginx-svc-controller-patch.yaml

@@ -4,7 +4,7 @@ spec:
       port: 5432
       targetPort: 5432
       protocol: TCP
-    - name: postgresql-repl--tcp
+    - name: postgresql-repl-tcp
       port: 5433
       targetPort: 5433
       protocol: TCP

kubernetes/infrastructure/prometheus-alertmanager/app/deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prometheus-alertmanager
+  namespace: prometheus
+  labels:
+    app: prometheus-alertmanager
+spec:
+  selector:
+    matchLabels:
+      app: prometheus-alertmanager
+  template:
+    metadata:
+      labels:
+        app: prometheus-alertmanager
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: prometheus-alertmanager
+          image: prom/alertmanager:v0.27.0
+          args:
+            - "--config.file=/etc/prometheus/prometheus-alertmanager.yaml"
+          ports:
+            - containerPort: 9093
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/prometheus/
+      volumes:
+        - name: config-volume
+          hostPath:
+            path: /mnt/nfs/AppData/prometheus/conf
+            type: Directory

kubernetes/infrastructure/prometheus-alertmanager/prometheus-alertmanager.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: prometheus-alertmanager
+  namespace: prometheus
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/prometheus-alertmanager/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system

kubernetes/infrastructure/prometheus-exporters/exporters/kubernetes-event-exporter.yaml

@@ -0,0 +1,48 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kubernetes-event-exporter
+  namespace: prometheus
+spec:
+  releaseName: kubernetes-event-exporter
+  chart:
+    spec:
+      chart: kubernetes-event-exporter
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 60m
+  values:
+    containerSecurityContext:
+      enabled: true
+      runAsNonRoot: false
+      privileged: true
+      readOnlyRootFilesystem: false
+      allowPrivilegeEscalation: true
+    nodeSelector:
+      kubernetes.io/hostname: rpi5-cluster-node-1
+    metrics:
+      enabled: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kubernetes-event-exporter-ingress
+  namespace: prometheus
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "event-exporter.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: kubernetes-event-exporter-metrics
+                port:
+                  number: 2112

kubernetes/infrastructure/prometheus-exporters/exporters/node-exporter.yaml

@@ -0,0 +1,44 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prometheus-node-exporter
+  namespace: prometheus
+  labels:
+    app: prometheus-node-exporter
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: prometheus-node-exporter
+  template:
+    metadata:
+      labels:
+        app: prometheus-node-exporter
+    spec:
+      hostNetwork: true
+      hostPID: true
+      hostIPC: true
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app: prometheus-node-exporter
+      containers:
+        - name: prometheus-node-exporter
+          image: prom/node-exporter
+          args:
+            - "--path.rootfs=/host"
+          volumeMounts:
+            - name: node-volume
+              mountPath: /host
+              readOnly: true
+              mountPropagation: HostToContainer
+          securityContext:
+            privileged: true
+      volumes:
+        - name: node-volume
+          hostPath:
+            path: /
+            type: Directory

kubernetes/infrastructure/prometheus-exporters/exporters/renovate-exporter.yaml

@@ -0,0 +1,68 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: renovate-exporter
+  namespace: renovate
+spec:
+  chart:
+    spec:
+      chart: prometheus-json-exporter
+      version: 0.11.0
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        namespace: flux-system
+        name: prometheus-community
+  interval: 1h
+  driftDetection:
+    mode: enabled
+  values:
+    nameOverride: renovate-exporter
+
+    configuration:
+      # language=yaml
+      config: |
+        modules:
+          renovate:
+            http_client_config:
+              authorization:
+                credentials_file: /credentials/renovate.txt
+
+            metrics:
+              - name: renovate_organization_count
+                valuetype: gauge
+                path: "{ .app.organizationCount }"
+                help: The number of organizations known to renovate
+
+              - name: renovate_repository_count
+                valuetype: gauge
+                path: "{ .app.repositoryCount }"
+                help: The number of repositories known to renovate
+
+              - name: renovate_jobs_processed
+                valuetype: counter
+                path: "{ .jobs.history.processed }"
+                help: The number of jobs processed since the instance has started
+
+              - name: renovate_queue_size
+                valuetype: gauge
+                path: "{ .jobs.queue.size }"
+                help: The number of jobs currently in the queue
+
+    additionalVolumes:
+      - name: renovate-credentials
+        secret:
+          secretName: app-vars
+    additionalVolumeMounts:
+      - name: renovate-credentials
+        mountPath: /credentials/renovate.txt
+        subPath: api_secret
+
+    serviceMonitor:
+      enabled: true
+      defaults:
+        interval: 1m
+      targets:
+        - name: renovate
+          url: http://renovate.renovate.svc.cluster.local:8099/api/status
+          module: renovate

kubernetes/infrastructure/prometheus-exporters/prometheus-exporters.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: prometheus-exporters
+  namespace: prometheus
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/prometheus-exporters/exporters
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system

kubernetes/infrastructure/prometheus/app/deployment.yaml

@@ -0,0 +1,87 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prometheus
+  namespace: prometheus
+  labels:
+    app: prometheus
+spec:
+  strategy:
+    rollingUpdate: null
+    type: Recreate
+  selector:
+    matchLabels:
+      app: prometheus
+  template:
+    metadata:
+      labels:
+        app: prometheus
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: prometheus
+          image: prom/prometheus:v2.53.0
+          args:
+            - "--storage.tsdb.retention.time=14d"
+            - "--config.file=/etc/prometheus/prometheus.yaml"
+            - "--storage.tsdb.path=/prometheus/"
+          ports:
+            - containerPort: 9090
+          resources:
+            requests:
+              cpu: 500m
+              memory: 500M
+            limits:
+              cpu: "1"
+              memory: 2Gi
+          volumeMounts:
+            - name: prometheus-config-volume
+              mountPath: /etc/prometheus/
+            - name: prometheus-storage-volume
+              mountPath: /prometheus/
+        - name: grafana
+          image: grafana/grafana:11.0.1
+          ports:
+            - containerPort: 3000
+          volumeMounts:
+            - name: grafana-config-volume
+              mountPath: /etc/grafana
+            - name: grafana-data-volume
+              mountPath: /var/lib/grafana
+            - name: grafana-logs-volume
+              mountPath: /var/log/grafana
+            - name: grafana-plugins-volume
+              mountPath: /var/lib/grafana/plugins
+            - name: grafana-provisioning-volume
+              mountPath: /etc/grafana/provisioning
+      volumes:
+        - name: prometheus-config-volume
+          hostPath:
+            path: /mnt/nfs/AppData/prometheus/conf
+            type: Directory
+        - name: prometheus-storage-volume
+          hostPath:
+            path: /mnt/nfs/AppData/prometheus/storage
+            type: Directory
+        - name: grafana-config-volume
+          hostPath:
+            path: /mnt/nfs/AppData/grafana/config
+            type: Directory
+        - name: grafana-data-volume
+          hostPath:
+            path: /mnt/nfs/AppData/grafana/data
+            type: Directory
+        - name: grafana-logs-volume
+          hostPath:
+            path: /mnt/nfs/AppData/grafana/logs
+            type: Directory
+        - name: grafana-plugins-volume
+          hostPath:
+            path: /mnt/nfs/AppData/grafana/plugins
+            type: Directory
+        - name: grafana-provisioning-volume
+          hostPath:
+            path: /mnt/nfs/AppData/grafana/provisioning
+            type: Directory

kubernetes/infrastructure/prometheus/app/role.yaml

@@ -0,0 +1,33 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: prometheus
+rules:
+  - apiGroups: [""]
+    resources:
+      - nodes
+      - nodes/proxy
+      - services
+      - endpoints
+      - pods
+    verbs: ["get", "list", "watch"]
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses
+    verbs: ["get", "list", "watch"]
+  - nonResourceURLs: ["/metrics"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: prometheus
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: prometheus
+subjects:
+  - kind: ServiceAccount
+    name: prometheus
+    namespace: prometheus

kubernetes/infrastructure/prometheus/app/service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: prometheus
+  namespace: prometheus
+  annotations:
+    prometheus.io/scrape: 'true'
+    prometheus.io/port:   '9999'
+spec:
+  selector:
+    app: prometheus
+  type: NodePort
+  ports:
+    - port: 9999
+      targetPort: 9090
+      nodePort: 30999
+      protocol: TCP
+      name: http
+    - name: grafana-port
+      port: 3030
+      nodePort: 30303
+      targetPort: 3000

kubernetes/infrastructure/prometheus/prometheus.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: prometheus
+  namespace: prometheus
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/prometheus/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system

kubernetes/infrastructure/redis/app/release.yaml

@@ -21,6 +21,7 @@ spec:
       password: ${password}
     master:
       persistence:
+        storageClass: local-path
         existingClaim: redis-master-pvc
         selector:
           matchLabels:
@@ -30,6 +31,7 @@ spec:
     replica:
       replicaCount: 1
       persistence:
+        storageClass: local-path
         existingClaim: redis-replica-pvc
         selector:
           matchLabels:

kubernetes/infrastructure/redis/app/volume.yaml

@@ -0,0 +1,93 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: redis-master-pv
+  namespace: redis
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 8Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/redis/master"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: redis-master-pvc
+    namespace: redis
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-2
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-master-pvc
+  namespace: redis
+  labels:
+    name: redis-master-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 8Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: redis-replica-pv
+  namespace: redis
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 8Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/redis/replica"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: redis-replica-pvc
+    namespace: redis
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-2
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-replica-pvc
+  namespace: redis
+  labels:
+    name: redis-replica-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 8Gi

kubernetes/infrastructure/redis/redis.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: redis-secrets
-  namespace: redis
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -20,7 +20,7 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: redis-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -31,7 +31,7 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  path: ./kubernetes/apps/redis/app
+  path: ./kubernetes/infrastructure/redis/app
   prune: true
   sourceRef:
     kind: GitRepository
@@ -39,7 +39,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: redis-secrets
-      namespace: redis
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/infrastructure/renovate/app/ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: renovate-ingress
+  namespace: renovate
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "renovate.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: renovate
+                port:
+                  number: 8899
+    - host: "renovate.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: renovate
+                port:
+                  number: 8899

kubernetes/infrastructure/renovate/app/release.yaml

@@ -0,0 +1,62 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  releaseName: renovate
+  chart:
+    spec:
+      chart: mend-renovate-ce
+      sourceRef:
+        kind: HelmRepository
+        name: mend-renovate-cc-ee
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    renovate:
+      mendRnvAcceptTos: y
+      mendRnvLicenseKey: ${renovate_license_key}
+      mendRnvPlatform: github
+      mendRnvEndpoint: "https://api.github.com/"
+      mendRnvGithubAppId: "938218"
+      mendRnvGithubAppKey: "/usr/src/app/rpi5-cluster-renovate.2024-07-05.private-key.pem"
+      mendRnvAdminApiEnabled: "true"
+      mendRnvServerApiSecret: ${server_api_secret}
+      mendRnvWebhookSecret: ${github_app_webhook_secret}
+      githubComToken: ${github_pat}
+      mendRnvAutoDiscoverFilter: "3dwardch3ng/home-cluster-ops"
+      mendRnvEnqueueJobsOnStartup: "enabled"
+      mendRnvLogHistoryDir: "/logs"
+    postgresql:
+      enabled: true
+      host: ${db_pg_host}
+      port: 5432
+      database: ${db_pg_database}
+      user: ${db_pg_user}
+      password: ${db_pg_password}
+    service:
+      type: ClusterIP
+      port: 8099
+    podSecurityContext:
+      fsGroup: 1000
+    containerSecurityContext:
+      runAsUser: 1000
+      runAsGroup: 1000
+    extraVolumes:
+      - name: renovate-logs
+        hostPath:
+          path: /mnt/nfs/AppData/renovate/logs
+          type: Directory
+      - name: renovate-gh-app-pem
+        hostPath:
+          path: /mnt/nfs/AppData/renovate/key/rpi5-cluster-renovate.2024-07-05.private-key.pem
+          type: File
+    extraVolumeMounts:
+      - name: renovate-logs
+        mountPath: /logs
+      - name: renovate-gh-app-pem
+        mountPath: /usr/src/app/rpi5-cluster-renovate.2024-07-05.private-key.pem

kubernetes/infrastructure/renovate/renovate.yaml

@@ -0,0 +1,53 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: renovate-secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: renovate
+  path: ./renovate
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  suspend: true
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/renovate/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: repositories
+      namespace: flux-system
+    - name: renovate-secrets
+      namespace: flux-system
+    - name: local-path-provisioner
+      namespace: local-path-storage
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: renovate-secrets

kubernetes/infrastructure/repositories/repos/bjw-s.yaml

@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: bjw-s
-  namespace: flux-system
-spec:
-  interval: 6h
-  type: oci
-  url: oci://ghcr.io/bjw-s/helm

kubernetes/infrastructure/repositories/repos/external-dns.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: external-dns
-  namespace: flux-system
-spec:
-  interval: 6h
-  url: https://kubernetes-sigs.github.io/external-dns/

kubernetes/infrastructure/repositories/repos/gabe565.yaml

@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: gabe565
-  namespace: flux-system
-spec:
-  interval: 6h
-  type: oci
-  url: oci://ghcr.io/gabe565/charts

kubernetes/infrastructure/repositories/repos/mend-renovate-cc-ee.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: mend-renovate-cc-ee
+  namespace: flux-system
+spec:
+  interval: 6h
+  url: https://mend.github.io/renovate-ce-ee

kubernetes/infrastructure/repositories/repos/new-relic.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: new-relic
+  namespace: flux-system
+spec:
+  interval: 6h
+  url: https://helm-charts.newrelic.com