Update app name

remove unneeded nexus ingress

.sops.pub.asc

@@ -0,0 +1,63 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGZlM+cBEADb3FqX+ZswYKVKx7kUGSvvBT0+Pe/6BZIQYDt8DE+gXTAwNDlq
+4Yy1XyPN5ispHo1/huUkUOaFUpkolfjzuciEIWaw2qHhTn9a7rPTx7DGCni9epic
+SuQYykC7MgQtAOkxUlx5R9XTL30JksICqlVLz8SMDHAzraLZU+4Pde+Cqgzx4x0K
+EfBzoAfjQtRe1RtikQ0ShklbbrbfETG9oGYh28RCI/ic22pgVV3EN1K1RDJDx9O+
++CWW/dahKBCrKl8BUAd7dblOkIT1iwBtteyAfvYgcaGL2O0pHKIx2XmM2OWvjbPR
+TJvYtDQXpLHEYValuDWSF3TxxlYw05MFK3TRK0bSp8f7RN8Y12bZ/yGI3HpTfF2u
+B/ZGP++v5SwzuOEJw/7VrCqihLPuq/yeCi7xUGYpuhW0vjE5GVH3R7BBpP3B1Svg
+gCrdZOP0KoMVNM0SHzVvUzf4okWo1ctHU1zhmBPmW+LAyugYvq8di7q7rRDelELW
+IBnIqEfxXCKdqD2YylUJYXRuHhSvfGw8ABt873xBYfLTQSJmadaQevB58nTCooCe
+kt9AaOpdjCjfaArajbhUQx+56GdSLh5OUabu/zG75SF3kGJJ69G3BFZH5vZSwkt9
+22O75IBBN0A+d7xt/NsPNAfckwmPHFNiKxSPMXzrdGbfHTZTiYykarqVwwARAQAB
+tClycGk1LWNsdXN0ZXIuZWR3YXJkLnN5ZG5leSAoZmx1eCBzZWNyZXRzKYkCTgQT
+AQoAOBYhBGzqkd2xlkhpyU3Ox69uO7G0T2abBQJmZTPnAhsvBQsJCAcCBhUKCQgL
+AgQWAgMBAh4BAheAAAoJEK9uO7G0T2ab2gIQAI/MhtpzyIqAto0O9erPG74HNqsB
+B4Fi/DssU+WHYOiLR8COXNYV1Hzb7VWaucyKku0OB58AN8fMfTEE5b/K2kvhAyAW
+oK+FWgLWQXrLIwZuz+rlwIZEEWJrUYOle3tosmOyE8vlvPwv9hzS1q6ueEanvT1K
+2UrtRWCdfDRVJciUTI78v88XNYD7CpOfJqlS62tk2su6NGjBg4T5N9j0u0ddZ1pU
+eH28L4jvaCiAQkKZbKSBr5LFKJio4LIkCOsYyraQrv6PxuPd5c2E2GbMOMLF2iLO
+25hlr2o34UnjDMV0bHFHUw2ujULYCzp83A5oNce6vjY/ZL0LrrjVqVn+gcnpR9MF
+K3ArlkUkp0oNuVnZ1o/zObfcv6XEG/LoQGc7nuYLMooQEEeNEP2RwvlRTAhpKPZW
+ZPthGwe7RzWwPWjmkPvBVQy4njk7rDu0Ob0NkJKOBOc28Su5iOIwzKRyzvDV6g1o
+2yYWuKmZSkjBvP909LSccoFW8I55bUg3tUH5n7BCkdeOAmsq4cGPMviJeVRByOxt
+oK4wS63g/R8h916eLwygMxutDeIEnrAcGrpCXDRzH7kOq533LbuMk1p2giY4VAIK
+S26C0zzhjF0vJwls7BoP55XZfJf/WGQdRtfH6QvKfJwk1n/2OTeeY3McSEg7JoCf
+cmPZtQG/mGAhpomjuQINBGZlM+cBEADh4OFFjCOjbPn/5B0FwZ4wqjND/ARSD6iu
+CUNAEEex+WNkEt8h2lZdUq0CAmNPqQIJQ2QE68TdueVl9X+is5uqDGgEyGo2ZccE
+RkpM89l883Pvfd/fiJSHCo/lBGSMhJQLzE/AWu4FKxkCmqFFQ9aK6XJhV/knsJ4Z
+Nis0n4weCF0YETE0vq2bPPMl2xvpMy4VKvG4t7Dhl0wJRakgtZYApOlBVpupzHh4
+bx27jkh7K2lEmJIoWc7xBtMYonvys66tQyHy86kPfQXw+gzzkUpf2XYCHRzvjPZ9
+YiZqV370LCkjLMg0zfLaINXUsw6xrHXfbnutTb3qW9YIp7xyQS64wFbKM9d+y7XL
+ZUXsAQbn9cNoEBP5pXoJSvrrkGRAZDwFW0ax2XveuAlfBRv5tiXpHyD7M7Arrjb0
+yc6ijU/ZBv0vaQZMtSt28M10Z5Tn1A93nHff2xdM0njZc3KImM/QpGXlY8pct18Q
+zUqoYu69po7j7mH78a8h2tI5X7AmU1T1JOcQQ4bp46ik3uBKCVxLSyesAeGE1Au8
+QksLqELZ/jVlV/+WQ54NDLt3bc24V8MIj57xPDumejsJnY8cJLOW7Rrsn3WJCBkw
+AKM4BlrR/HigX7sjZ57N9ZsRTuaxpvCJwlRdK4YPsEBhO2UvQNGVWLEj8dogq2+v
+a31vc/kyrwARAQABiQRsBBgBCgAgFiEEbOqR3bGWSGnJTc7Hr247sbRPZpsFAmZl
+M+cCGy4CQAkQr247sbRPZpvBdCAEGQEKAB0WIQTvmsGobbjnhWp6fYQ2D2kqSUqH
+CgUCZmUz5wAKCRA2D2kqSUqHClj8D/4pHqnYlIcJpDOhGxYlQtrk6GRSfq1g3suh
+5Lhc+eHFpVQtQM85qJTSIhS3w/XAf3GwekYuiKjGAdhrWJcglphxCPX5IMg9ofMX
+ICbOxyjdEeOwgfEMvuyPgLUet6reK8rSTefhR5L2FRuU+qibs08LKMAtRoooZ3I1
+W7q38hWBcrrQXnBxtb7YLQ6Kzwd7mEq0KXnJxV8UBUj9x90j7R5+YEs3ZIAUh6sV
+jR23RpRuBQmgGXsjv3LsYyeDCglUNmWZKWfVhhmLcIbJ5/Dej4Eg79qY6DrmyXLM
+0Sw1ZhGAj/xRGw3GMrLXoj1gjEI1etUbiCKLUud2llUk4d15NP5CfhQ6s4Gh9p60
+x1eL8+hNuoSDRuQWzn/8MWglWKeUnalXF7krjLuOVtpMR+Uh9YwufUXDiQRmx6Iy
+/k7yOKg9V6IBm+6+xxKXKPZeBuVucKPegyI00gbM9F2ql9z30/WGVRtt6vIowuPi
+5p5e3mmeL83FUv7tpVnNR50ulfVEflTBHbfgop1THJIYgNT6OODCUQFw/GPzzMNi
+8jz3a1GB+OTYNF+x7OzrgBx1AvtryNQz+8lvkWVSfhJx0kgeUwwghIPw5zV4fypf
+8XQiP67BcarnB4RiWSgUjs7uQ25ZBxRbZ+D3StvP9+5QEBIh9q7yaj2gxo6fcaNk
+ZxKPd2thGiIZD/9H27JXAz7r/U+wtycteXKXogcAdu4i5Zlpqd5c3p2K3XO+sc6Y
+cA+uFNWBrz2RsKwIAX2djfYDi8Vp6uACRkE8Vzyo5WoIk0LF6upCCD44DIZGWlzH
+t59dGr8HQFvk/6RTuWoMnbtbK1k6qV5CK6q3jVZo2Do4v4uY2D/eXjzaIew+3kDG
+v+HDAOVZuTiW2V8XQSrXUr3duCK4Lch+EE8Cw8RyPy1Um6jSUbUGXFryqiLuaqub
+72JON1QDH6sLci7xGEccKGyk9xsTLthxFTWkPEjPXNPTAlvbPwdL/eOFmmOOLUqH
+HomXDoKITUOJ5ytUQ6WgIpfdOSkRmamMtzfvs6kkogzL53vwNXJMRm05HYgjm1bD
+moLpcoFhxEDj8Cd3sY+e+J6rKOgWq8f3+cKNi4qIzpv7JyAUW2gM2sfPPJ6PViPB
+MV1CnKli8ZRLEoHXcakjq5ScJi0UyG+rT3vodUdKbVQKxeohry1gX6QO27lDSn2d
+6KQy5mueEy9eZh3WsCWXTp/oILRlrgOrxQWySv2M6b15lxFjRvHc1j2/4szaqNWr
+fPUQZsDUwl84VrjzoQpXmt+Nn8xgAGEEWpXAc5P6tkm4Nk8lkUErRkbdSWEAjOOF
+8cVKCymSVdmFE2RPvZdK9vYCCckjFNBArbT6xQwDjAo4srdaMtxJWb+3kA==
+=8DLE
+-----END PGP PUBLIC KEY BLOCK-----

.sops.yaml

@@ -0,0 +1,5 @@
+creation_rules:
+  - path_regex: \.ya?ml$
+    encrypted_regex: ^(data|stringData)$
+    pgp: 6CEA91DDB1964869C94DCEC7AF6E3BB1B44F669B
+    age: age1d47q8mlty404pxx378q49hr93aqexca4mkeqtdm00w4gjd09xd0qhxcdcz

kubernetes/apps/adguard-home/adguard-home.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: adguard-home
+  namespace: adguard-home
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: flux-system
+  path: ./kubernetes/apps/adguard-home/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system

kubernetes/apps/adguard-home/app/deployment.yaml

@@ -0,0 +1,86 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: adguard-home
+  namespace: adguard-home
+  labels:
+    app.kubernetes.io/name: adguard-home
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: adguard-home
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: adguard-home
+        rpi5.cluster.policy/egress-kubeapi: "true"
+        rpi5.cluster.policy/egress-namespace: "true"
+        rpi5.cluster.policy/egress-world: "true"
+        rpi5.cluster.policy/ingress-namespace: "true"
+        rpi5.cluster.policy/ingress-nginx: "true"
+        rpi5.cluster.policy/ingress-nodes: "true"
+        rpi5.cluster.policy/ingress-world: "true"
+    spec:
+      containers:
+        - name: adguard-home
+          image: adguard/adguardhome:v0.107.51
+          ports:
+            - protocol: TCP
+              containerPort: 53
+              name: dns-tcp
+            - protocol: UDP
+              containerPort: 53
+              name: dns-udp
+            - protocol: UDP
+              containerPort: 67
+              name: dhcps-udp
+            - protocol: UDP
+              containerPort: 68
+              name: dhcpc-udp
+            - protocol: TCP
+              containerPort: 80
+              name: http-tcp
+            - protocol: TCP
+              containerPort: 443
+              name: https-tcp
+            - protocol: UDP
+              containerPort: 443
+              name: https-udp
+            - protocol: TCP
+              containerPort: 853
+              name: dns-tls-tcp
+            - protocol: UDP
+              containerPort: 853
+              name: dns-tls-udp
+            - protocol: TCP
+              containerPort: 3000
+              name: http-alt-tcp
+            - protocol: UDP
+              containerPort: 3000
+              name: http-alt-udp
+            - protocol: TCP
+              containerPort: 5443
+              name: dnscrypt-tcp
+            - protocol: UDP
+              containerPort: 5443
+              name: dnscrypt-udp
+            - protocol: TCP
+              containerPort: 6060
+              name: http-pprof
+          env:
+            - name: TZ
+              value: Australia/Sydney
+          volumeMounts:
+            - name: adguard-home-data
+              mountPath: /opt/adguardhome/work
+            - name: adguard-home-config
+              mountPath: /opt/adguardhome/conf
+      volumes:
+        - name: adguard-home-data
+          hostPath:
+            path: /mnt/nfs/AppData/adguardhome/work
+            type: Directory
+        - name: adguard-home-config
+          hostPath:
+            path: /mnt/nfs/AppData/adguardhome/conf
+            type: Directory

kubernetes/apps/adguard-home/app/ingress.yaml

@@ -0,0 +1,61 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: adguard-home-ingress
+  namespace: adguard-home
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "adguard-home.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 10080
+    - host: "adguard-home.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 10080
+    - host: "setup.adguard-home.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 13000
+    - host: "setup.adguard-home.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 13000
+    - host: "doh.adguard-home.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 443

kubernetes/apps/adguard-home/app/service.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-home
+  namespace: adguard-home
+  labels:
+    app.kubernetes.io/name: adguard-home
+spec:
+  selector:
+    app.kubernetes.io/name: adguard-home
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 53
+      targetPort: 53
+      name: dns-tcp
+    - protocol: UDP
+      port: 53
+      targetPort: 53
+      name: dns-udp
+    - protocol: UDP
+      port: 67
+      targetPort: 67
+      name: dhcps-udp
+    - protocol: UDP
+      port: 68
+      targetPort: 68
+      name: dhcpc-udp
+    - protocol: TCP
+      port: 10080
+      targetPort: 80
+      name: http-tcp
+    - protocol: TCP
+      port: 443
+      targetPort: 443
+      name: https-tcp
+    - protocol: UDP
+      port: 443
+      targetPort: 443
+      name: https-udp
+    - protocol: TCP
+      port: 853
+      targetPort: 853
+      name: dns-tls-tcp
+    - protocol: UDP
+      port: 853
+      targetPort: 853
+      name: dns-tls-udp
+    - protocol: TCP
+      port: 13000
+      targetPort: 3000
+      name: https-alt-tcp
+    - protocol: UDP
+      port: 13000
+      targetPort:  3000
+      name: https-alt-udp
+    - protocol: TCP
+      port: 5443
+      targetPort: 5443
+      name: dnscrypt-tcp
+    - protocol: UDP
+      port: 5443
+      targetPort: 5443
+      name: dnscrypt-udp
+    - protocol: TCP
+      port: 6060
+      targetPort: 6060
+      name: https-pprof

kubernetes/apps/adguard-home/scripts/ingress-nginx-svc-controller-patch.yaml

@@ -0,0 +1,38 @@
+spec:
+  ports:
+    - name: dns-tcp
+      port: 53
+      targetPort: 53
+      protocol: TCP
+    - name: dns-udp
+      port: 53
+      targetPort: 53
+      protocol: UDP
+    - name: dhcps-udp
+      port: 67
+      targetPort: 67
+      protocol: UDP
+    - name: dhcpc-udp
+      port: 68
+      targetPort: 68
+      protocol: UDP
+    - name: dns-tls-tcp
+      port: 853
+      targetPort: 853
+      protocol: TCP
+    - name: dns-tls-udp
+      port: 853
+      targetPort: 853
+      protocol: UDP
+    - name: dnscrypt-tcp
+      port: 5443
+      targetPort: 5443
+      protocol: TCP
+    - name: dnscrypt-udp
+      port: 5443
+      targetPort: 5443
+      protocol: UDP
+    - name: https-pprof
+      port: 6060
+      targetPort: 6060
+      protocol: TCP

kubernetes/apps/adguard-home/scripts/patch-ingress-nginx.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -e
+
+kubectl patch service ingress-nginx-controller -n ingress-nginx --patch "$(cat ingress-nginx-svc-controller-patch.yaml)"

kubernetes/apps/capacitor/app/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: capacitor-ingress
+  namespace: capacitor
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "capacitor.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: capacitor
+                port:
+                  number: 9000

kubernetes/apps/capacitor/app/manifest.yaml

@@ -0,0 +1,84 @@
+---
+# Source: onechart/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: capacitor
+  namespace: capacitor
+  labels:
+    helm.sh/chart: onechart-0.63.0
+    app.kubernetes.io/name: onechart
+    app.kubernetes.io/instance: capacitor
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9000
+      targetPort: 9000
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: onechart
+    app.kubernetes.io/instance: capacitor
+---
+# Source: onechart/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: capacitor
+  namespace: capacitor
+  labels:
+    helm.sh/chart: onechart-0.63.0
+    app.kubernetes.io/name: onechart
+    app.kubernetes.io/instance: capacitor
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    kubectl.kubernetes.io/default-container: capacitor
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: onechart
+      app.kubernetes.io/instance: capacitor
+  template:
+    metadata:
+      annotations:
+        checksum/config: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+      labels:
+        app.kubernetes.io/name: onechart
+        app.kubernetes.io/instance: capacitor
+        rpi5.cluster.policy/egress-kubeapi: "true"
+        rpi5.cluster.policy/egress-namespace: "true"
+        rpi5.cluster.policy/egress-world: "true"
+        rpi5.cluster.policy/ingress-namespace: "true"
+        rpi5.cluster.policy/ingress-nginx: "true"
+        rpi5.cluster.policy/ingress-nodes: "true"
+        rpi5.cluster.policy/ingress-world: "true"
+    spec:
+      containers:
+        - image: ghcr.io/gimlet-io/capacitor:v0.4.2
+          imagePullPolicy: IfNotPresent
+          name: capacitor
+          ports:
+            - containerPort: 9000
+              name: http
+              protocol: TCP
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /
+              port: 9000
+              scheme: HTTP
+            initialDelaySeconds: 0
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 3
+          resources:
+            requests:
+              cpu: 200m
+              memory: 200Mi
+          securityContext: {}
+      initContainers: null
+      securityContext:
+        fsGroup: 999
+      serviceAccountName: capacitor

kubernetes/apps/capacitor/app/rbac.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: capacitor
+  namespace: capacitor
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: capacitor
+rules:
+  - apiGroups:
+      - networking.k8s.io
+      - apps
+      - ""
+    resources:
+      - pods
+      - pods/log
+      - ingresses
+      - deployments
+      - services
+      - secrets
+      - events
+      - configmaps
+    verbs:
+      - get
+      - watch
+      - list
+  - apiGroups:
+      - source.toolkit.fluxcd.io
+      - kustomize.toolkit.fluxcd.io
+      - helm.toolkit.fluxcd.io
+    resources:
+      - gitrepositories
+      - ocirepositories
+      - buckets
+      - helmrepositories
+      - helmcharts
+      - kustomizations
+      - helmreleases
+    verbs:
+      - get
+      - watch
+      - list
+      - patch # to allow force reconciling by adding an annotation
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: capacitor
+subjects:
+  - kind: ServiceAccount
+    name: capacitor
+    namespace: flux-system
+roleRef:
+  kind: ClusterRole
+  name: capacitor
+  apiGroup: rbac.authorization.k8s.io

kubernetes/apps/capacitor/capacitor.yaml

@@ -0,0 +1,30 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: capacitor
+  namespace: capacitor
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: flux-system
+  path: ./kubernetes/apps/capacitor/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  patches:
+    - target:
+        kind: (Service|Deployment)
+        name: capacitor
+        namespace: flux-system
+      patch: |
+        - op: replace
+          path: "/metadata/labels/app.kubernetes.io~1managed-by"
+          value: Flux
+        - op: remove
+          path: "/metadata/labels/helm.sh~1chart"
+        - op: add
+          path: "/metadata/labels/patched"
+          value: "true"

kubernetes/apps/cert-manager/app/release.yaml

@@ -0,0 +1,44 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 1h
+  driftDetection:
+    mode: enabled
+  chart:
+    spec:
+      chart: cert-manager
+      version: v1.15.0
+      sourceRef:
+        kind: HelmRepository
+        namespace: cert-manager
+        name: cert-manager
+      interval: 1h
+  install:
+    crds: Create
+  upgrade:
+    crds: CreateReplace
+  values:
+    installCRDs: true
+
+    podLabels:
+      rpi5.cluster.policy/egress-kubeapi: "true"
+      rpi5.cluster.policy/egress-namespace: "true"
+      rpi5.cluster.policy/egress-world: "true"
+      rpi5.cluster.policy/ingress-namespace: "true"
+    webhook:
+      podLabels:
+        rpi5.cluster.policy/egress-kubeapi: "true"
+    cainjector:
+      podLabels:
+        rpi5.cluster.policy/egress-kubeapi: "true"
+
+    global:
+      priorityClassName: system-cluster-critical
+
+    podDnsConfig:
+      nameservers:
+        - 1.1.1.1
+        - 1.0.0.1

kubernetes/apps/cert-manager/app/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 1h
+  url: https://charts.jetstack.io

kubernetes/apps/cert-manager/cert-manager.yaml

@@ -0,0 +1,118 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: cert-manager
+  path: ./kubernetes/apps/cert-manager/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: clusterissuer-secrets
+  namespace: cert-manager
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: cert-manager
+  path: ./clusterissuer
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: cert-manager-sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: clusterissuer
+  namespace: cert-manager
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: cert-manager
+  path: ./kubernetes/apps/cert-manager/clusterissuer
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: clusterissuer-secrets
+      namespace: cert-manager
+    - name: cert-manager
+      namespace: cert-manager
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: clusterissuer-secrets
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: certificate-secrets
+  namespace: cert-manager
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: cert-manager
+  path: ./certificates
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: cert-manager-sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: certificates
+  namespace: cert-manager
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: cert-manager
+  path: ./kubernetes/apps/cert-manager/certificates
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: certificate-secrets
+      namespace: cert-manager
+    - name: cert-manager
+      namespace: cert-manager
+    - name: clusterissuer
+      namespace: cert-manager
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: certificate-secrets

kubernetes/apps/cert-manager/certificates/adguard-home.yaml

@@ -0,0 +1,64 @@
+#apiVersion: cert-manager.io/v1
+#kind: Certificate
+#metadata:
+#  name: adguard-home-cert
+#  namespace: cert-manager
+#spec:
+#  # Secret names are always required.
+#  secretName: adguard-home.cluster.edward.sydney-tls
+#
+#  privateKey:
+#    algorithm: RSA
+#    encoding: PKCS1
+#    size: 2048
+#
+#  # keystores allows adding additional output formats. This is an example for reference only.
+#  keystores:
+#    pkcs12:
+#      create: true
+#      passwordSecretRef:
+#        name: adguard-home-tls-keystore
+#        key: ${adguard_home_certificate_tls_keystore_password}
+#      profile: Modern2023
+#
+#  duration: 2160h # 90d
+#  renewBefore: 360h # 15d
+#
+#  isCA: false
+#  usages:
+#    - server auth
+#    - client auth
+#
+#  subject:
+#    organizations:
+#      - edward.sydney
+#
+#  # The literalSubject field is exclusive with subject and commonName. It allows
+#  # specifying the subject directly as a string. This is useful for when the order
+#  # of the subject fields is important or when the subject contains special types
+#  # which can be specified by their OID.
+#  #
+#  # literalSubject: "O=jetstack, CN=example.com, 2.5.4.42=John, 2.5.4.4=Doe"
+#
+#  # At least one of commonName (possibly through literalSubject), dnsNames, uris, emailAddresses, ipAddresses or otherNames is required.
+#  dnsNames:
+#    - "${adguard_home_certificate_dns_name}"
+#    - "*.${adguard_home_certificate_dns_name}"
+#  emailAddresses:
+#    - ${adguard_home_certificate_email}
+#
+#  # Issuer references are always required.
+#  issuerRef:
+#    name: clusterissuer
+#    # We can reference ClusterIssuers by changing the kind here.
+#    # The default value is Issuer (i.e. a locally namespaced Issuer)
+#    kind: ClusterIssuer
+#    # This is optional since cert-manager will default to this value however
+#    # if you are using an external issuer, change this to that issuer group.
+#    group: cert-manager.io
+
+#The certificate request has failed to complete and will be retried:
+#  Failed to wait for order resource "adguard-home-cert-1-1931876784" to become
+#  ready: order is in "errored" state: Failed to create Order: 429 urn:ietf:params:acme:error:rateLimited:
+#  Error creating new order :: too many certificates already issued for "edward.sydney".
+#  Retry after 2024-06-25T21:00:00Z: see https://letsencrypt.org/docs/rate-limits/

kubernetes/apps/cert-manager/clusterissuer/clusterissuer-cloudflare.yaml

@@ -0,0 +1,22 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: clusterissuer
+  namespace: cert-manager
+spec:
+  acme:
+    email: ${email}
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: cluster-issuer-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            email: ${email}
+            apiTokenSecretRef:
+              name: clusterissuer-secrets
+              key: cloudflare_api_token
+        selector:
+          dnsNames:
+            - "${cluster_cert_domain}"
+            - "*.${cluster_cert_domain}"

kubernetes/apps/code-server/app/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: code-server-ingress
+  namespace: code-server
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "code-server.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: code-server
+                port:
+                  number: 8443

kubernetes/apps/code-server/app/pvc.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: code-server-pv
+  namespace: code-server
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 8Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/code-server"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: code-server-pvc
+    namespace: code-server
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: code-server-pvc
+  namespace: code-server
+  labels:
+    name: code-server-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 8Gi

kubernetes/apps/code-server/app/release.yaml

@@ -0,0 +1,31 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: code-server
+  namespace: code-server
+spec:
+  releaseName: code-server
+  targetNamespace: code-server
+  chart:
+    spec:
+      chart: code-server
+      sourceRef:
+        kind: HelmRepository
+        name: nicholaswilde
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    secret:
+      PASSWORD: ${password}
+      SUDO_PASSWORD: ${sudo_password}
+
+    env:
+      TZ: "Australia/Sydney"
+
+    persistence:
+      config:
+        enabled: true
+        existingClaim: code-server-pvc

kubernetes/apps/code-server/code-server.yaml

@@ -0,0 +1,47 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: code-server-secrets
+  namespace: code-server
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: code-server
+  path: ./code-server
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: code-server-sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: code-server
+  namespace: code-server
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: code-server
+  path: ./kubernetes/apps/code-server/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: code-server-secrets
+      namespace: code-server
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: code-server-secrets

kubernetes/apps/dokuwiki/app/ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dokuwiki-ingress
+  namespace: dokuwiki
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "dokuwiki.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: dokuwiki-dokuwiki
+                port:
+                  number: 18000
+    - host: "dokuwiki.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: dokuwiki-dokuwiki
+                port:
+                  number: 18000

kubernetes/apps/dokuwiki/app/release.yaml

@@ -0,0 +1,34 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: dokuwiki
+  namespace: dokuwiki
+spec:
+  targetNamespace: dokuwiki
+  chart:
+    spec:
+      chart: dokuwiki
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    dokuwikiUsername: ${username}
+    dokuwikiPassword: ${password}
+    dokuwikiEmail: ${email}
+    dokuwikiFullName: "Edward Cheng"
+    dokuwikiWikiName: My Doku Wiki
+    containerPorts:
+      http: 18000
+      https: 18443
+    persistence:
+      existingClaim: "dokuwiki-pvc"
+    service:
+      type: ClusterIP
+      ports:
+        http: 18000
+        https: 18443

kubernetes/apps/dokuwiki/app/volume.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: dokuwiki-pv
+  namespace: dokuwiki
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 12Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/dokuwiki"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: dokuwiki-pvc
+    namespace: dokuwiki
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: dokuwiki-pvc
+  namespace: dokuwiki
+  labels:
+    name: dokuwiki-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 12Gi

kubernetes/apps/dokuwiki/dokuwiki.yaml

@@ -0,0 +1,46 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: dokuwiki-secrets
+  namespace: dokuwiki
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: dokuwiki
+  path: ./dokuwiki
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: dokuwiki-sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: dokuwiki
+  namespace: dokuwiki
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/dokuwiki/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: dokuwiki-secrets
+      namespace: dokuwiki
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: dokuwiki-secrets

kubernetes/apps/gitea/app/ingress.yaml

@@ -0,0 +1,32 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-ingress
+  namespace: gitea
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "gitea.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: gitea-gitea
+                port:
+                  number: 10080
+    - host: "gitea.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: gitea-gitea
+                port:
+                  number: 10080

kubernetes/apps/gitea/app/release.yaml

@@ -0,0 +1,56 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  targetNamespace: gitea
+  chart:
+    spec:
+      chart: gitea
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    image:
+      debug: true
+    updateStrategy:
+      type: Recreate
+    livenessProbe:
+      enabled: true
+      initialDelaySeconds: 600
+      periodSeconds: 60
+      timeoutSeconds: 30
+      failureThreshold: 5
+      successThreshold: 1
+    readinessProbe:
+      enabled: true
+      path: /
+      initialDelaySeconds: 30
+      periodSeconds: 60
+      timeoutSeconds: 30
+      failureThreshold: 5
+      successThreshold: 1
+    adminUsername: ${admin_username}
+    adminPassword: ${admin_password}
+    adminEmail: ${admin_email}
+    appName: app_name
+    persistence:
+      existingClaim: gitea-pvc
+    service:
+      ports:
+        http: 10080
+        ssh: 10022
+    postgresql:
+      enabled: false
+    externalDatabase:
+      host: ${db_host}
+      port: ${db_port}
+      user: ${db_user}
+      database: ${db_name}
+      password: ${db_password}

kubernetes/apps/gitea/app/volume.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: gitea-pv
+  namespace: gitea
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 32Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/gitea"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: gitea-pvc
+    namespace: gitea
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-pvc
+  namespace: gitea
+  labels:
+    name: gitea-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 32Gi

kubernetes/apps/gitea/gitea.yaml

@@ -0,0 +1,47 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: gitea-secrets
+  namespace: gitea
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: gitea
+  path: ./gitea
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: gitea-sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/gitea/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: gitea-secrets
+      namespace: gitea
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: gitea-secrets
+

kubernetes/apps/homer/app/development.yaml

@@ -0,0 +1,43 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homer
+  namespace: homer
+  labels:
+    app.kubernetes.io/name: homer
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: homer
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: homer
+        rpi5.cluster.policy/egress-world: "true"
+        rpi5.cluster.policy/ingress-world: "true"
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: homer
+          image: b4bz/homer:v24.05.1
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: PORT
+              value: "8088"
+            - name: INIT_ASSETS
+              value: "0"
+          ports:
+            - protocol: TCP
+              containerPort: 8088
+              name: http
+          volumeMounts:
+            - name: assets
+              mountPath: /www/assets
+      volumes:
+        - name: assets
+          hostPath:
+            path: /mnt/nfs/AppData/homer/www/assets
+            type: Directory

kubernetes/apps/homer/app/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: homer-ingress
+  namespace: homer
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "home.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: homer
+                port:
+                  number: 8088

kubernetes/apps/homer/app/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: homer
+  namespace: homer
+  labels:
+    app.kubernetes.io/name: homer
+spec:
+  selector:
+    app.kubernetes.io/name: homer
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 8088
+      targetPort: 8088
+      name: http

kubernetes/apps/homer/homer.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: homer
+  namespace: homer
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: flux-system
+  path: ./kubernetes/apps/homer/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system

kubernetes/apps/jellyfin/app/ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: jellyfin-ingress
+  namespace: jellyfin
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "jellyfin.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: jellyfin
+                port:
+                  number: 8096
+    - host: "jellyfin.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: jellyfin
+                port:
+                  number: 8096

kubernetes/apps/jellyfin/app/pvc.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-config
+  namespace: jellyfin
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 250Mi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/jellyfin/config"
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-data
+  namespace: jellyfin
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 2Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/jellyfin/data"
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3

kubernetes/apps/jellyfin/app/release.yaml

@@ -0,0 +1,167 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  releaseName: jellyfin
+  targetNamespace: jellyfin
+  chart:
+    spec:
+      chart: jellyfin
+      sourceRef:
+        kind: HelmRepository
+        name: beluga-cloud
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    persistence:
+      config:
+        enabled: true
+        volumeClaimSpec:
+          accessModes:
+            - ReadWriteOnce
+          volumeName: jellyfin-config
+      data:
+        enabled: true
+        volumeClaimSpec:
+          accessModes:
+            - ReadWriteOnce
+          volumeName: jellyfin-data
+    jellyfin:
+      mediaVolumes:
+        - name: movies
+          readOnly: false
+          volumeSpec:
+            storageClassName: local-path
+            volumeMode: Filesystem
+            capacity:
+              storage: 8Gi
+            accessModes:
+              - ReadWriteOnce
+            persistentVolumeReclaimPolicy: Retain
+            nodeAffinity:
+              required:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: kubernetes.io/hostname
+                        operator: In
+                        values:
+                          - rpi5-cluster-node-3
+            claimRef:
+              apiVersion: v1
+              kind: PersistentVolumeClaim
+              name: jellyfin-mediavol-movies
+              namespace: jellyfin
+            hostPath:
+              path: "/mnt/nfs/AppData/jellyfin/media/movies"
+              type: "Directory"
+        - name: series
+          readOnly: false
+          volumeSpec:
+            storageClassName: local-path
+            volumeMode: Filesystem
+            capacity:
+              storage: 8Gi
+            accessModes:
+              - ReadWriteOnce
+            persistentVolumeReclaimPolicy: Retain
+            nodeAffinity:
+              required:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: kubernetes.io/hostname
+                        operator: In
+                        values:
+                          - rpi5-cluster-node-3
+            claimRef:
+              apiVersion: v1
+              kind: PersistentVolumeClaim
+              name: jellyfin-mediavol-series
+              namespace: jellyfin
+            hostPath:
+              path: "/mnt/nfs/AppData/jellyfin/media/series"
+              type: "Directory"
+        - name: music-videos
+          readOnly: false
+          volumeSpec:
+            storageClassName: local-path
+            volumeMode: Filesystem
+            capacity:
+              storage: 8Gi
+            accessModes:
+              - ReadWriteOnce
+            persistentVolumeReclaimPolicy: Retain
+            nodeAffinity:
+              required:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: kubernetes.io/hostname
+                        operator: In
+                        values:
+                          - rpi5-cluster-node-3
+            claimRef:
+              apiVersion: v1
+              kind: PersistentVolumeClaim
+              name: jellyfin-mediavol-music-videos
+              namespace: jellyfin
+            hostPath:
+              path: "/mnt/nfs/AppData/jellyfin/media/music-videos"
+              type: "Directory"
+        - name: short-videos
+          readOnly: false
+          volumeSpec:
+            storageClassName: local-path
+            volumeMode: Filesystem
+            capacity:
+              storage: 8Gi
+            accessModes:
+              - ReadWriteOnce
+            persistentVolumeReclaimPolicy: Retain
+            nodeAffinity:
+              required:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: kubernetes.io/hostname
+                        operator: In
+                        values:
+                          - rpi5-cluster-node-3
+            claimRef:
+              apiVersion: v1
+              kind: PersistentVolumeClaim
+              name: jellyfin-mediavol-short-videos
+              namespace: jellyfin
+            hostPath:
+              path: "/mnt/nfs/AppData/jellyfin/media/short-videos"
+              type: "Directory"
+        - name: gv
+          readOnly: false
+          volumeSpec:
+            storageClassName: local-path
+            volumeMode: Filesystem
+            capacity:
+              storage: 8Gi
+            accessModes:
+              - ReadWriteOnce
+            persistentVolumeReclaimPolicy: Retain
+            nodeAffinity:
+              required:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: kubernetes.io/hostname
+                        operator: In
+                        values:
+                          - rpi5-cluster-node-3
+            claimRef:
+              apiVersion: v1
+              kind: PersistentVolumeClaim
+              name: jellyfin-mediavol-gv
+              namespace: jellyfin
+            hostPath:
+              path: "/mnt/nfs/AppData/jellyfin/media/gv"
+              type: "Directory"
+      persistentTranscodes: true
+

kubernetes/apps/jellyfin/jellyfin.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/jellyfin/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+

kubernetes/apps/kavita/app/development.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kavita
+  namespace: kavita
+  labels:
+    app.kubernetes.io/name: kavita
+    app.kubernetes.io/instance: kavita
+  annotations:
+    kubectl.kubernetes.io/default-container: kavita
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kavita
+      app.kubernetes.io/instance: kavita
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: kavita
+        app.kubernetes.io/instance: kavita
+    spec:
+      containers:
+        - image: jvmilazz0/kavita:latest
+          imagePullPolicy: IfNotPresent
+          name: kavita
+          ports:
+            - containerPort: 5000
+              name: http
+              protocol: TCP
+          env:
+            - name: TZ
+              value: Australia/Sydney
+          volumeMounts:
+            - name: kavita-config
+              mountPath: /kavita/config
+            - name: kavita-manga
+              mountPath: /manga
+            - name: kavita-book
+              mountPath: /book
+            - name: kavita-doc
+              mountPath: /doc
+      volumes:
+        - name: kavita-config
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/config
+            type: Directory
+        - name: kavita-manga
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/manga
+            type: Directory
+        - name: kavita-book
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/book
+            type: Directory
+        - name: kavita-doc
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/doc
+            type: Directory

kubernetes/apps/kavita/app/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kavita-ingress
+  namespace: kavita
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "kavita.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: kavita
+                port:
+                  number: 5000

kubernetes/apps/kavita/app/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kavita
+  namespace: kavita
+  labels:
+    app.kubernetes.io/name: kavita
+    app.kubernetes.io/instance: kavita
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5000
+      targetPort: 5000
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: kavita
+    app.kubernetes.io/instance: kavita

kubernetes/apps/kavita/kavita.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kavita
+  namespace: kavita
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/kavita/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+

kubernetes/apps/kustomization.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./adguard-home/adguard-home.yaml
+  - ./capacitor/capacitor.yaml
+  - ./cert-manager/cert-manager.yaml
+  - ./code-server/code-server.yaml
+  - ./dokuwiki/dokuwiki.yaml
+  - ./gitea/gitea.yaml
+  - ./homer/homer.yaml
+  - ./jellyfin/jellyfin.yaml
+  - ./kavita/kavita.yaml
+  - ./nexus/nexus.yaml
+  - ./podinfo/podinfo.yaml
+  - ./postgresql/postgresql.yaml
+  - ./qbittorrent/qbittorrent.yaml
+  - ./redis/redis.yaml
+  - ./snippet-box/snippet-box.yaml
+  - ./sonarqube/sonarqube.yaml
+  - ./uptime-kuma/uptime-kuma.yaml
+  - ./weave-gitops/weave-gitops.yaml

kubernetes/apps/nexus/app/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nexus
+  namespace: nexus
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nexus
+  template:
+    metadata:
+      labels:
+        app: nexus
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: nexus
+          image: klo2k/nexus3:3.68.1-02
+          resources:
+            limits:
+              memory: "3Gi"
+              cpu: "500m"
+            requests:
+              memory: "2Gi"
+              cpu: "500m"
+          ports:
+            - containerPort: 8081
+          volumeMounts:
+            - name: nexus-data
+              mountPath: /nexus-data
+      volumes:
+        - name: nexus-data
+          hostPath:
+            path: /mnt/nfs/AppData/nexus
+            type: Directory

kubernetes/apps/nexus/app/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nexus
+  namespace: nexus
+  annotations:
+    prometheus.io/scrape: 'true'
+    prometheus.io/path:   /
+    prometheus.io/port:   '8081'
+spec:
+  selector:
+    app: nexus
+  type: NodePort
+  ports:
+    - port: 8081
+      targetPort: 8081
+      nodePort: 32000

kubernetes/apps/nexus/nexus.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: nexus
+  namespace: nexus
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/nexus/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system

kubernetes/apps/podinfo/app/release.yaml

@@ -0,0 +1,27 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: podinfo
+  namespace: podinfo
+spec:
+  releaseName: podinfo
+  chart:
+    spec:
+      chart: podinfo
+      sourceRef:
+        kind: HelmRepository
+        name: podinfo
+  interval: 50m
+  install:
+    remediation:
+      retries: 3
+  # Default values
+  # https://github.com/stefanprodan/podinfo/blob/master/charts/podinfo/values.yaml
+  values:
+    redis:
+      enabled: true
+      repository: public.ecr.aws/docker/library/redis
+      tag: 7.0.6
+    ingress:
+      enabled: true
+      className: nginx

kubernetes/apps/podinfo/app/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: podinfo
+  namespace: podinfo
+spec:
+  interval: 5m
+  url: https://stefanprodan.github.io/podinfo

kubernetes/apps/podinfo/podinfo.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: podinfo
+  namespace: podinfo
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/podinfo/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+

kubernetes/apps/postgresql/app/ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: postgresql-ingress
+  namespace: postgresql
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "postgres.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: postgresql-primary
+                port:
+                  number: 5432
+    - host: "replica.postgres.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: postgresql-replica
+                port:
+                  number: 5432

kubernetes/apps/postgresql/app/pvc.yaml

@@ -0,0 +1,93 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: postgresql-primary-pv
+  namespace: postgresql
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 8Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/postgresql/primary"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: postgresql-primary-pvc
+    namespace: postgresql
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgresql-primary-pvc
+  namespace: postgresql
+  labels:
+    name: postgresql-primary-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 8Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: postgresql-replica-pv
+  namespace: flux-system
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 8Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/postgresql/replica"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: postgresql-replica-pvc
+    namespace: postgresql
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgresql-replica-pvc
+  namespace: postgresql
+  labels:
+    name: postgresql-replica-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 8Gi

kubernetes/apps/postgresql/app/release.yaml

@@ -0,0 +1,57 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: postgresql
+  namespace: postgresql
+spec:
+  releaseName: postgresql
+  chart:
+    spec:
+      chart: postgresql
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    auth:
+      postgresPassword: ${postgres_password}
+      username: ${username}
+      password: ${password}
+      database: ${database}
+      replicationPassword: ${replication_password}
+    architecture: "replication"
+    replication:
+      synchronousCommit: "on"
+      numSynchronousReplicas: 1
+      applicationName: "postgres_repl"
+    primary:
+      podSecurityContext:
+        fsGroup: 1000
+      containerSecurityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      podLabels:
+        name: "postgresql-primary"
+      persistence:
+        existingClaim: postgresql-primary-pvc
+        selector:
+          matchLabels:
+            name: postgresql-primary-pvc
+    readReplicas:
+      name: "replica"
+      podSecurityContext:
+        fsGroup: 1000
+      containerSecurityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      podLabels:
+        name: "postgresql-replica"
+      persistence:
+        existingClaim: postgresql-replica-pvc
+        selector:
+          matchLabels:
+            name: postgresql-replica-pvc

kubernetes/apps/postgresql/postgresql.yaml

@@ -0,0 +1,47 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: postgresql-secrets
+  namespace: postgresql
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: postgresql
+  path: ./postgresql
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: postgresql-sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: postgresql
+  namespace: postgresql
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/postgresql/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: postgresql-secrets
+      namespace: postgresql
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: postgresql-secrets
+

kubernetes/apps/postgresql/scripts/ingress-nginx-svc-controller-patch.yaml

@@ -0,0 +1,10 @@
+spec:
+  ports:
+    - name: postgresql-tcp
+      port: 5432
+      targetPort: 5432
+      protocol: TCP
+    - name: postgresql-repl--tcp
+      port: 5433
+      targetPort: 5433
+      protocol: TCP

kubernetes/apps/postgresql/scripts/patch-ingress-nginx.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -e
+
+kubectl patch service ingress-nginx-controller -n ingress-nginx --patch "$(cat ingress-nginx-svc-controller-patch.yaml)"

kubernetes/apps/prometheus-operator/app/release.yaml

@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: prometheus-operator
+  namespace: prometheus-operator
+spec:
+  releaseName: prometheus-operator
+  chart:
+    spec:
+      chart: prometheus-operator
+      sourceRef:
+        kind: HelmRepository
+        name: truecharts
+        namespace: flux-system
+  interval: 5m
+  install:
+    remediation:
+      retries: 3
+  values:
+    service:
+      main:
+        enabled: true
+        ports:
+          main:
+            enabled: true
+
+    workload:
+      main:
+        enabled: true
+
+    portal:
+      open:
+        enabled: true
+
+    operator:
+      register: true
+
+    kps:
+      ## Install Prometheus Operator CRDs
+      ##
+      crds:
+        enabled: true
+
+      ## Manages Prometheus and Alertmanager components
+      ##
+      prometheusOperator:
+        enabled: true

kubernetes/apps/prometheus-operator/prometheus-operator.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: prometheus-operator
+  namespace: prometheus-operator
+spec:
+  suspend: true
+  interval: 1h
+  targetNamespace: flux-system
+  path: ./kubernetes/apps/prometheus-operator/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system

kubernetes/apps/qbittorrent/app/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: qbittorrent-ingress
+  namespace: qbittorrent
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "qbittorrent.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: qbittorrent
+                port:
+                  number: 8888

kubernetes/apps/qbittorrent/app/release.yaml

@@ -0,0 +1,30 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: qbittorrent
+  namespace: qbittorrent
+spec:
+  targetNamespace: qbittorrent
+  chart:
+    spec:
+      chart: qbittorrent
+      sourceRef:
+        kind: HelmRepository
+        name: adminafk
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    service:
+      web:
+        port: 8888
+      torrent:
+        port: 8388
+    config:
+      persistence:
+        name: "qbittorrent-config-pvc"
+    volumeMounts:
+      - name: qbittorrent-download-pvc
+        mountPath: /download

kubernetes/apps/qbittorrent/app/volume.yaml

@@ -0,0 +1,93 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: qbittorrent-config
+  namespace: qbittorrent
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/qbittorrent/config"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: qbittorrent-config-pvc
+    namespace: qbittorrent
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3
+---
+#apiVersion: v1
+#kind: PersistentVolumeClaim
+#metadata:
+#  name: qbittorrent-config-pvc
+#  namespace: qbittorrent
+#  labels:
+#    name: qbittorrent-config-pvc
+#spec:
+#  storageClassName: local-path
+#  volumeMode: Filesystem
+#  accessModes:
+#    - ReadWriteOnce
+#  resources:
+#    requests:
+#      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: qbittorrent-download
+  namespace: qbittorrent
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/qbittorrent/download"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: qbittorrent-download-pvc
+    namespace: qbittorrent
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: qbittorrent-download-pvc
+  namespace: qbittorrent
+  labels:
+    name: qbittorrent-download-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 64Gi

kubernetes/apps/qbittorrent/qbittorrent.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: qbittorrent
+  namespace: qbittorrent
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/qbittorrent/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+

kubernetes/apps/qbittorrent/scripts/ingress-nginx-svc-controller-patch.yaml

@@ -0,0 +1,10 @@
+spec:
+  ports:
+    - name: torrent-tcp
+      port: 8388
+      targetPort: 8388
+      protocol: TCP
+    - name: torrent-udp
+      port: 8388
+      targetPort: 8388
+      protocol: UDP

kubernetes/apps/qbittorrent/scripts/patch-ingress-nginx.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -e
+
+kubectl patch service ingress-nginx-controller -n ingress-nginx --patch "$(cat kubernetes/apps/qbittorrent/scripts/ingress-nginx-svc-controller-patch.yaml)"

kubernetes/apps/redis/app/release.yaml

@@ -0,0 +1,38 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: redis
+spec:
+  releaseName: redis
+  chart:
+    spec:
+      chart: redis
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    auth:
+      password: ${password}
+    master:
+      persistence:
+        existingClaim: redis-master-pvc
+        selector:
+          matchLabels:
+            name: redis-master-pvc
+      persistentVolumeClaimRetentionPolicy:
+        enabled: true
+    replica:
+      replicaCount: 1
+      persistence:
+        existingClaim: redis-replica-pvc
+        selector:
+          matchLabels:
+            name: redis-replica-pvc
+      persistentVolumeClaimRetentionPolicy:
+        enabled: true

kubernetes/apps/redis/app/volume.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-master-pvc
+  namespace: redis
+  labels:
+    name: redis-master-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 8Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-replica-pvc
+  namespace: redis
+  labels:
+    name: redis-replica-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 8Gi

kubernetes/apps/redis/redis.yaml

@@ -0,0 +1,46 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: redis-secrets
+  namespace: redis
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: redis
+  path: ./redis
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: redis-sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: redis
+  namespace: redis
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/redis/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: redis-secrets
+      namespace: redis
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: redis-secrets

kubernetes/apps/snippet-box/app/development.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: snippet-box
+  namespace: snippet-box
+  labels:
+    app.kubernetes.io/name: snippet-box
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: snippet-box
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: snippet-box
+    spec:
+      containers:
+        - name: snippet-box
+          image: pawelmalak/snippet-box:arm
+          ports:
+            - protocol: TCP
+              containerPort: 5000
+              name: snippet-box
+          env:
+            - name: TZ
+              value: Australia/Sydney
+          volumeMounts:
+            - name: snippet-box-data
+              mountPath: /app/data
+      volumes:
+        - name: snippet-box-data
+          hostPath:
+            path: /mnt/nfs/AppData/snippet-box
+            type: Directory

kubernetes/apps/snippet-box/app/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: snippet-box-ingress
+  namespace: snippet-box
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "snippet-box.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: snippet-box
+                port:
+                  number: 5000

kubernetes/apps/snippet-box/app/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: snippet-box
+  namespace: snippet-box
+  labels:
+    app.kubernetes.io/name: snippet-box
+spec:
+  selector:
+    app.kubernetes.io/name: snippet-box
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 5000
+      targetPort: 5000
+      name: snippet-box

kubernetes/apps/snippet-box/snippet-box.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: snippet-box
+  namespace: snippet-box
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: flux-system
+  path: ./kubernetes/apps/snippet-box/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system

kubernetes/apps/sonarqube/app/release.yaml

@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: sonarqube
+  namespace: sonarqube
+spec:
+  releaseName: sonarqube
+  chart:
+    spec:
+      chart: sonarqube
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    sonarqubeUsername: ${sonarqube_username}
+    sonarqubePassword: ${sonarqube_password}
+    sonarqubeEmail: ${sonarqube_email}
+    smtpHost: ${smtp_host}
+    smtpPort: ${smtp_port}
+    smtpUser: ${smtp_user}
+    smtpPassword: ${smtp_password}
+    smtpProtocol: ${smtp_protocol}
+    service:
+      ports:
+        http: 8090
+        elastic: 9091
+      nodePorts:
+        http: 30080
+        elastic: 30091
+    persistence:
+      enabled: true
+      storageClass: "local-path"
+      size: "32Gi"
+      existingClaim: "sonarqube-pvc"
+    postgresql:
+      enabled: false
+    externalDatabase:
+      host: ${db_host}
+      user: ${db_user}
+      password: ${db_password}
+      database: ${db_name}
+      port: ${db_port}

kubernetes/apps/sonarqube/app/volume.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: sonarqube-pv
+  namespace: sonarqube
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 32Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/sonarqube"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: sonarqube-pvc
+    namespace: sonarqube
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarqube-pvc
+  namespace: sonarqube
+  labels:
+    name: sonarqube-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 32Gi

kubernetes/apps/sonarqube/sonarqube.yaml

@@ -0,0 +1,46 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: sonarqube-secrets
+  namespace: sonarqube
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: sonarqube
+  path: ./sonarqube
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sonarqube-sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: sonarqube
+  namespace: sonarqube
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/sonarqube/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: sonarqube-secrets
+      namespace: sonarqube
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: sonarqube-secrets

kubernetes/apps/uptime-kuma/app/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: uptime-kuma-ingress
+  namespace: uptime-kuma
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "uptime-kuma.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: uptime-kuma
+                port:
+                  number: 3001

kubernetes/apps/uptime-kuma/app/pvc.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: uptime-kuma-pv
+  namespace: uptime-kuma
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 4Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/uptime-kuma"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: uptime-kuma-pvc
+    namespace: uptime-kuma
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-1
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: uptime-kuma-pvc
+  namespace: uptime-kuma
+  labels:
+    name: uptime-kuma-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 4Gi

kubernetes/apps/uptime-kuma/app/release.yaml

@@ -0,0 +1,25 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+spec:
+  releaseName: uptime-kuma
+  targetNamespace: uptime-kuma
+  chart:
+    spec:
+      chart: uptime-kuma
+      sourceRef:
+        kind: HelmRepository
+        name: irsigler
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    volume:
+      enabled: true
+      accessMode: ReadWriteOnce
+      size: 4Gi
+      existingClaim: "uptime-kuma-pvc"

kubernetes/apps/uptime-kuma/uptime-kuma.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/apps/uptime-kuma/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system

kubernetes/apps/weave-gitops/app/ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: weave-gitops-ingress
+  namespace: flux-system
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "weave-gitops.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: ww-gitops-weave-gitops
+                port:
+                  number: 9001
+    - host: "weave-gitops.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: ww-gitops-weave-gitops
+                port:
+                  number: 9001

kubernetes/apps/weave-gitops/app/release.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  annotations:
+    metadata.weave.works/description: This is the source location for the Weave GitOps
+      Dashboard's helm chart.
+  labels:
+    app.kubernetes.io/component: ui
+    app.kubernetes.io/created-by: weave-gitops-cli
+    app.kubernetes.io/name: weave-gitops-dashboard
+    app.kubernetes.io/part-of: weave-gitops
+  name: ww-gitops
+  namespace: flux-system
+spec:
+  interval: 1h0m0s
+  type: oci
+  url: oci://ghcr.io/weaveworks/charts
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  annotations:
+    metadata.weave.works/description: This is the Weave GitOps Dashboard.  It provides
+      a simple way to get insights into your GitOps workloads.
+  name: ww-gitops
+  namespace: flux-system
+spec:
+  chart:
+    spec:
+      chart: weave-gitops
+      sourceRef:
+        kind: HelmRepository
+        name: ww-gitops
+  interval: 1h0m0s
+  values:
+    adminUser:
+      create: true
+      passwordHash: $2a$10$gnPEHsFzIJXg/eron5LiQ.teGZkKETxuA2WAyKSbxHvxpkzWJvbDe
+      username: admin
+

kubernetes/apps/weave-gitops/weave-gitops.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: weave-gitops
+  namespace: flux-system
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: flux-system
+  path: ./kubernetes/apps/weave-gitops/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system

kubernetes/infrastructure/cilium/app/release.yaml

@@ -0,0 +1,43 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cilium
+  namespace: kube-system
+spec:
+  chart:
+    spec:
+      chart: cilium
+      version: 1.15.5
+      sourceRef:
+        kind: HelmRepository
+        namespace: kube-system
+        name: cilium
+  install:
+    crds: Create
+  upgrade:
+    crds: CreateReplace
+  interval: 1h
+  driftDetection:
+    mode: enabled
+  values:
+    global:
+      encryption:
+        enabled: true
+        nodeEncryption: true
+
+    policyEnforcementMode: default
+
+    operator:
+      replicas: 1
+
+    ipam:
+      mode: cluster-pool
+      operator:
+        clusterPoolIPv4PodCIDRList: [10.42.0.0/16]
+        clusterPoolIPv4MaskSize: 24
+
+    dnsProxy:
+      dnsRejectResponseCode: nameError
+
+    cni:
+      exclusive: false

kubernetes/infrastructure/cilium/cilium.yaml

@@ -0,0 +1,35 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+ name: cilium
+ namespace: kube-system
+spec:
+ interval: 10m
+ timeout: 1m30s
+ retryInterval: 30s
+ path: ./kubernetes/infrastructure/cilium/app
+ prune: true
+ sourceRef:
+   kind: GitRepository
+   namespace: flux-system
+   name: flux-system
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cilium-networkpolicies
+  namespace: kube-system
+spec:
+  suspend: false
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/cilium/networkpolicies
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: ingress-nginx
+      namespace: ingress-nginx

kubernetes/infrastructure/cilium/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cilium.yaml

kubernetes/infrastructure/cilium/networkpolicies/coredns.yaml

@@ -0,0 +1,21 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: coredns
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      k8s-app: kube-dns
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "53"
+    - toEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "6443"

kubernetes/infrastructure/cilium/networkpolicies/egress-kube-dns.yaml

@@ -0,0 +1,20 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-kube-dns
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: rpi5.cluster.policy/egress-kube-dns
+        operator: NotIn
+        values:
+          - "false"
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"

kubernetes/infrastructure/cilium/networkpolicies/egress-kubeapi.yaml

@@ -0,0 +1,22 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-kubeapi
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-kubeapi: "true"
+  egress:
+    - toEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "6443"
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "443"
+            - port: "6443"

kubernetes/infrastructure/cilium/networkpolicies/egress-namespace.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-namespace
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-namespace: "true"
+  egress:
+    - toEndpoints:
+        - {}

kubernetes/infrastructure/cilium/networkpolicies/egress-nodes.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-nodes
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-nodes: "true"
+  egress:
+    - toEntities:
+        - host
+        - remote-node

kubernetes/infrastructure/cilium/networkpolicies/egress-world.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-world
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-world: "true"
+  egress:
+    - toCIDRSet:
+        - cidr: 0.0.0.0/0

kubernetes/infrastructure/cilium/networkpolicies/ingress-namespace.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: ingress-namespace
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/ingress-namespace: "true"
+  ingress:
+    - fromEndpoints:
+        - {}

kubernetes/infrastructure/cilium/networkpolicies/ingress-nginx.yaml

@@ -0,0 +1,67 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: ingress-ingress
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/ingress-ingress: "true"
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ingress-nginx
+            app.kubernetes.io/name: ingress-nginx
+            app.kubernetes.io/component: controller
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: ingress-nginx
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-nginx
+      app.kubernetes.io/component: controller
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            rpi5.cluster.policy/ingress-ingress: "true"
+          matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-ingress
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-ingress: "true"
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ingress-nginx
+            app.kubernetes.io/name: ingress-nginx
+            app.kubernetes.io/component: controller
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: egress-nginx
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-nginx
+      app.kubernetes.io/component: controller
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            rpi5.cluster.policy/egress-ingress: "true"
+          matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists

kubernetes/infrastructure/cilium/networkpolicies/ingress-nodes.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: ingress-nodes
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/ingress-nodes: "true"
+  ingress:
+    - fromEntities:
+        - host
+        - remote-node

kubernetes/infrastructure/cilium/networkpolicies/ingress-world.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: ingress-world
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/ingress-world: "true"
+  ingress:
+    - fromEntities:
+      - world

kubernetes/infrastructure/cilium/networkpolicies/local-path-provisioner.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: local-path-provisioner
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      app: local-path-provisioner
+  egress:
+    - toEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "6443"

kubernetes/infrastructure/ingress-nginx/app/release.yaml

@@ -0,0 +1,113 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingress-nginx
+  namespace: ingress-nginx
+spec:
+  interval: 1h
+  driftDetection:
+    mode: enabled
+  chart:
+    spec:
+      chart: ingress-nginx
+      version: 4.10.1
+      sourceRef:
+        kind: HelmRepository
+        namespace: ingress-nginx
+        name: ingress-nginx
+      interval: 1h
+  values:
+    rbac:
+      create: true
+
+    controller:
+      priorityClassName: system-cluster-critical
+
+      extraArgs:
+        update-status-on-shutdown: "false"
+        tcp-services-configmap: "ingress-nginx/tcp-services"
+        udp-services-configmap: "ingress-nginx/udp-services"
+
+      podLabels:
+        rpi5.cluster.policy/egress-kubeapi: "true"
+        rpi5.cluster.policy/egress-namespace: "true"
+        rpi5.cluster.policy/egress-world-with-lan: "true"
+        rpi5.cluster.policy/ingress-nodes: "true"
+        rpi5.cluster.policy/ingress-prometheus: "true"
+        rpi5.cluster.policy/ingress-world: "true"
+
+      allowSnippetAnnotations: true
+
+#      maxmindLicenseKey: ${geoip_license_key}
+
+      config:
+        proxy-buffer-size: 16k
+        use-gzip: ${use_gzip:=true}
+        enable-brotli: ${enable_brotli:=true}
+        hsts-max-age: ${hsts_max_age:=31536000}
+        hsts-preload: ${hsts_preload:=true}
+        disable-ipv6: ${disable_ipv6:=false}
+        disable-ipv6-dns: ${disable_ipv6_dns:=false}
+        keep-alive-requests: ${keep_alive_requests:=1000}
+        use-geoip2: ${use_geoip2:=true}
+        custom-http-errors: 401,403,404,500,501,502,503,504
+
+      extraEnvs:
+        - name: TZ
+          value: Australia/Sydney
+
+      addHeaders:
+        Referrer-Policy: same-origin, strict-origin-when-cross-origin
+        X-Content-Type-Options: nosniff
+        X-Frame-Options: SAMEORIGIN
+        X-XSS-Protection: 1; mode=block
+
+      ingressClassResource:
+        default: true
+
+      service:
+        externalTrafficPolicy: Cluster
+        ipFamilyPolicy: SingleStack
+
+      metrics:
+        enabled: ${metrics_enabled:=false}
+#        serviceMonitor:
+#          enabled: ${metrics_enabled:=false}
+#          scrapeInterval: 1m
+
+      admissionWebhooks:
+        labels:
+          rpi5.cluster.policy/egress-kubeapi: "true"
+        patch:
+          labels:
+            rpi5.cluster.policy/egress-kubeapi: "true"
+
+      spec:
+        template:
+          spec:
+            containers:
+              volumeMounts:
+                - mountPath: /etc/nginx/template
+                  name: nginx-template-volume
+                  readOnly: true
+            volumes:
+              - name: nginx-template-volume
+                hostPath:
+                  path: /mnt/nfs/AppData/ingress-nginx/etc/nginx/template
+                  type: Directory
+
+    defaultBackend:
+      enabled: true
+      image:
+        repository: ghcr.io/tarampampam/error-pages
+        tag: 2.27.0@sha256:40e2631173b1a407c18fe7d1ba8104d995cf9e4780d123eeadfa1d57c68eaf4f
+        pullPolicy: IfNotPresent
+      extraEnvs:
+        - name: TEMPLATE_NAME
+          value: connection
+        - name: SHOW_DETAILS
+          value: "true"
+        - name: READ_BUFFER_SIZE
+          value: "8192"
+      podLabels:
+        rpi5.cluster.policy/ingress-namespace: "true"

kubernetes/infrastructure/ingress-nginx/app/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: ingress-nginx
+  namespace: ingress-nginx
+spec:
+  interval: 1h
+  url: https://kubernetes.github.io/ingress-nginx

kubernetes/infrastructure/ingress-nginx/config/ingress-configmap.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: tcp-services
+  namespace: ingress-nginx
+data:
+  "53": "flux-system/adguard-home:53"
+  "853": "flux-system/adguard-home:853"
+  "5432": "postgresql/postgresql-primary:5432"
+  "5433": "postgresql/postgresql-replica:5432"
+  "5443": "flux-system/adguard-home:5443"
+  "6060": "flux-system/adguard-home:6060"
+  "8388": "qbittorrent/qbittorrent-torrent:8388"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: udp-services
+  namespace: ingress-nginx
+data:
+  "53": "flux-system/adguard-home:53"
+  "67": "flux-system/adguard-home:67"
+  "68": "flux-system/adguard-home:68"
+  "853": "flux-system/adguard-home:853"
+  "5443": "flux-system/adguard-home:5443"
+  "8388": "qbittorrent/qbittorrent-torrent:8388"

kubernetes/infrastructure/ingress-nginx/config/values.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ingress-nginx-values
+  namespace: ingress-nginx
+data:
+  use_geoip2: "false"
+  disable_ipv6: "true"
+  disable_ipv6_dns: "true"

kubernetes/infrastructure/ingress-nginx/ingress-nginx-config.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: ingress-nginx-config
+  namespace: ingress-nginx
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/ingress-nginx/config
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system

kubernetes/infrastructure/ingress-nginx/ingress-nginx.yaml

@@ -0,0 +1,91 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: ingress-nginx
+  namespace: ingress-nginx
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: ingress-nginx
+  path: ./kubernetes/infrastructure/ingress-nginx/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: ingress-nginx-config
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: ingress-nginx-values
+  patches:
+    - target:
+        kind: Service
+        name: ingress-nginx-controller
+        namespace: ingress-nginx
+      patch: |
+        - op: add
+          path: /spec/ports/-
+          value:
+            name: dns-tcp
+            port: 53
+            targetPort: 53
+            protocol: TCP
+        - op: add
+          path: /spec/ports/-
+          value:
+            name: dns-udp
+            port: 53
+            targetPort: 53
+            protocol: UDP
+        - op: add
+          path: /spec/ports/-
+          value:
+            name: dhcps-udp
+            port: 67
+            targetPort: 67
+            protocol: UDP
+        - op: add
+          path: /spec/ports/-
+          value:
+            name: dhcpc-udp
+            port: 68
+            targetPort: 68
+            protocol: UDP
+        - op: add
+          path: /spec/ports/-
+          value:
+            name: dns-tls-tcp
+            port: 853
+            targetPort: 853
+            protocol: TCP
+        - op: add
+          path: /spec/ports/-
+          value:
+            name: dns-tls-udp
+            port: 853
+            targetPort: 853
+            protocol: UDP
+        - op: add
+          path: /spec/ports/-
+          value:
+            name: dnscrypt-tcp
+            port: 5443
+            targetPort: 5443
+            protocol: TCP
+        - op: add
+          path: /spec/ports/-
+          value:
+            name: dnscrypt-udp
+            port: 5443
+            targetPort: 5443
+            protocol: UDP
+        - op: add
+          path: /spec/ports/-
+          value:
+            name: https-pprof
+            port: 6060
+            targetPort: 6060
+            protocol: TCP

kubernetes/infrastructure/ingress-nginx/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ingress-nginx.yaml
+  - ingress-nginx-config.yaml