enable gitea

remove unneeded security context

apps/adguard-home/base/deployment.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: adguard-home
+  namespace: adguard-home
+  labels:
+    app.kubernetes.io/name: adguard-home
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: adguard-home
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: adguard-home
+    spec:
+      containers:
+        - name: adguard-home
+          image: adguard/adguardhome:v0.107.51
+          ports:
+            - protocol: TCP
+              containerPort: 53
+              name: dns-tcp
+            - protocol: UDP
+              containerPort: 53
+              name: dns-udp
+            - protocol: UDP
+              containerPort: 67
+              name: dhcps-udp
+            - protocol: UDP
+              containerPort: 68
+              name: dhcpc-udp
+            - protocol: TCP
+              containerPort: 80
+              name: http-tcp
+            - protocol: TCP
+              containerPort: 443
+              name: https-tcp
+            - protocol: UDP
+              containerPort: 443
+              name: https-udp
+            - protocol: TCP
+              containerPort: 853
+              name: dns-tls-tcp
+            - protocol: UDP
+              containerPort: 853
+              name: dns-tls-udp
+            - protocol: TCP
+              containerPort: 3000
+              name: http-alt-tcp
+            - protocol: UDP
+              containerPort: 3000
+              name: http-alt-udp
+            - protocol: TCP
+              containerPort: 5443
+              name: dnscrypt-tcp
+            - protocol: UDP
+              containerPort: 5443
+              name: dnscrypt-udp
+            - protocol: TCP
+              containerPort: 6060
+              name: http-pprof
+          env:
+            - name: TZ
+              value: Australia/Sydney
+          volumeMounts:
+            - name: adguard-home-data
+              mountPath: /opt/adguardhome/work
+            - name: adguard-home-config
+              mountPath: /opt/adguardhome/conf
+      volumes:
+        - name: adguard-home-data
+          hostPath:
+            path: /mnt/nfs/AppData/adguardhome/work
+            type: Directory
+        - name: adguard-home-config
+          hostPath:
+            path: /mnt/nfs/AppData/adguardhome/conf
+            type: Directory

apps/adguard-home/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/adguard-home/base/service.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-home
+  namespace: adguard-home
+  labels:
+    app.kubernetes.io/name: adguard-home
+spec:
+  selector:
+    app.kubernetes.io/name: adguard-home
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 53
+      targetPort: 53
+      name: dns-tcp
+    - protocol: UDP
+      port: 53
+      targetPort: 53
+      name: dns-udp
+    - protocol: UDP
+      port: 67
+      targetPort: 67
+      name: dhcps-udp
+    - protocol: UDP
+      port: 68
+      targetPort: 68
+      name: dhcpc-udp
+    - protocol: TCP
+      port: 10080
+      targetPort: 80
+      name: http-tcp
+    - protocol: TCP
+      port: 443
+      targetPort: 443
+      name: https-tcp
+    - protocol: UDP
+      port: 443
+      targetPort: 443
+      name: https-udp
+    - protocol: TCP
+      port: 853
+      targetPort: 853
+      name: dns-tls-tcp
+    - protocol: UDP
+      port: 853
+      targetPort: 853
+      name: dns-tls-udp
+    - protocol: TCP
+      port: 13000
+      targetPort: 3000
+      name: https-alt-tcp
+    - protocol: UDP
+      port: 13000
+      targetPort:  3000
+      name: https-alt-udp
+    - protocol: TCP
+      port: 5443
+      targetPort: 5443
+      name: dnscrypt-tcp
+    - protocol: UDP
+      port: 5443
+      targetPort: 5443
+      name: dnscrypt-udp
+    - protocol: TCP
+      port: 6060
+      targetPort: 6060
+      name: https-pprof

apps/adguard-home/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "adguard-home",
+  "userGivenName": "adguard-home",
+  "namespace": "adguard-home",
+  "destNamespace": "adguard-home",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/adguard-home/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/adguard-home/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,61 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: adguard-home-ingress
+  namespace: adguard-home
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "adguard-home.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 10080
+    - host: "adguard-home.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 10080
+    - host: "setup.adguard-home.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 13000
+    - host: "setup.adguard-home.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 13000
+    - host: "doh.adguard-home.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 443

apps/adguard-home/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/chattts/base/deployment.yaml

@@ -0,0 +1,30 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: chattts
+  namespace: chattts
+  labels:
+    app.kubernetes.io/name: chattts
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: chattts
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: chattts
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: chattts
+          image: lcs13324/chattts:v1.0
+          securityContext:
+            allowPrivilegeEscalation: false
+          ports:
+            - protocol: TCP
+              containerPort: 8888
+              name: http
+      nodeSelector:
+        kubernetes.io/arch: amd64

apps/chattts/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/chattts/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: chattts
+  namespace: chattts
+  labels:
+    app.kubernetes.io/name: chattts
+spec:
+  selector:
+    app.kubernetes.io/name: chattts
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 8888
+      targetPort: 8888
+      name: http

apps/chattts/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

apps/coder/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "coder",
+  "userGivenName": "coder",
+  "namespace": "coder",
+  "destNamespace": "coder",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/coder/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/coder/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: coder
+    repo: https://helm.coder.com/v2
+    version: 2.13.1
+    releaseName: coder
+    valuesFile: values.yaml

apps/coder/env/k3s-cluster/values.yaml

@@ -0,0 +1,22 @@
+coder:
+  env:
+    - name: CODER_ACCESS_URL
+      value: "https://coder.cluster.edward.sydney"
+    - name: CODER_PG_CONNECTION_URL
+      valueFrom:
+        secretKeyRef:
+          # You'll need to create a secret called coder-db-url with your
+          # Postgres connection URL like:
+          # postgres://coder:password@postgres:5432/coder?sslmode=disable
+          name: coder-secrets
+          key: db_url
+  volumes:
+    - name: coder-data
+      persistentVolumeClaim:
+        claimName: coder-pvc
+  volumeMounts:
+    - name: coder-data
+      mountPath: /config
+  service:
+    type: NodePort
+    httpNodePort: 31180

apps/gitea/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "gitea",
+  "userGivenName": "gitea",
+  "namespace": "gitea",
+  "destNamespace": "gitea",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/gitea/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/gitea/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: gitea
+    repo: oci://registry-1.docker.io/bitnamicharts
+    version: 2.3.14
+    releaseName: gitea
+    valuesFile: values.yaml

apps/gitea/env/k3s-cluster/values.yaml

@@ -0,0 +1,30 @@
+namespaceOverride: "gitea"
+podAntiAffinityPreset: ""
+adminUsername: "gitea_admin"
+adminEmail: "edward@cheng.sydney"
+appName: "gitea"
+existingSecret: "gitea-secrets"
+existingSecretKey: "admin-password"
+smtpHost: "smtp.gmail.com"
+smtpPort: "587"
+smtpUser: "me@edward.sydney"
+smtpExistingSecret: "gitea-secrets"
+persistence:
+  existingClaim: "gitea-pvc"
+service:
+  ports:
+    http: 10080
+    ssh: 10022
+ingress:
+  enabled: true
+  ingressClassName: "nginx"
+  hostname: "gitea.cluster.edward.sydney"
+serviceAccount:
+  create: false
+postgresql:
+  enabled: false
+externalDatabase:
+  host: "postgresql-primary.argocd.svc.cluster.local"
+  user: "gitea_user"
+  existingSecret: "gitea-secrets"
+  existingSecretPasswordKey: "db-password"

apps/gitlab/env/k3s-cluster/deployment.yaml

@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitlab
+  namespace: gitlab
+  labels:
+    app.kubernetes.io/name: gitlab
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: gitlab
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: gitlab
+    spec:
+      containers:
+        - name: gitlab
+          image: gitlab/gitlab-ce:17.2.1-ce.0
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: GITLAB_OMNIBUS_CONFIG
+              value: "external_url 'https://gitlab.cluster.edward.sydney'"
+          ports:
+            - protocol: TCP
+              containerPort: 443
+              name: https
+            - protocol: TCP
+              containerPort: 80
+              name: http
+            - protocol: TCP
+              containerPort: 22
+              name: ssh
+          volumeMounts:
+            - name: dshm
+              mountPath: /dev/shm
+            - name: gitlab-config
+              mountPath: /etc/config
+            - name: gitlab-log
+              mountPath: /var/log/gitlab
+            - name: gitlab-data
+              mountPath: /var/opt/gitlab
+      volumes:
+        - name: dshm
+          emptyDir:
+            medium: Memory
+            sizeLimit: 1Gi
+        - name: gitlab-config
+          hostPath:
+            path: /mnt/nfs/AppData/gitlab/config
+            type: Directory
+        - name: gitlab-log
+          hostPath:
+            path: /mnt/nfs/AppData/gitlab/log
+            type: Directory
+        - name: gitlab-data
+          hostPath:
+            path: /mnt/nfs/AppData/gitlab/data
+            type: Directory
+      nodeSelector:
+        kubernetes.io/arch: amd64

apps/gitlab/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/gitlab/env/k3s-cluster/service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitlab
+  namespace: gitlab
+  labels:
+    app.kubernetes.io/name: gitlab
+spec:
+  selector:
+    app.kubernetes.io/name: gitlab
+  type: LoadBalancer
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 10080
+      targetPort: 80
+      name: http
+    - protocol: TCP
+      port: 10443
+      targetPort: 443
+      name: https
+    - protocol: TCP
+      port: 10022
+      targetPort: 22
+      name: ssh

apps/homer/base/deployment.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homer
+  namespace: homer
+  labels:
+    app.kubernetes.io/name: homer
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: homer
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: homer
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: homer
+          image: b4bz/homer:v24.05.1
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: PORT
+              value: "8088"
+            - name: INIT_ASSETS
+              value: "0"
+          ports:
+            - protocol: TCP
+              containerPort: 8088
+              name: http
+          volumeMounts:
+            - name: assets
+              mountPath: /www/assets
+      volumes:
+        - name: assets
+          hostPath:
+            path: /mnt/nfs/AppData/homer/www/assets
+            type: Directory

apps/homer/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/homer/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: homer
+  namespace: homer
+  labels:
+    app.kubernetes.io/name: homer
+spec:
+  selector:
+    app.kubernetes.io/name: homer
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 8088
+      targetPort: 8088
+      name: http

apps/homer/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "homer",
+  "userGivenName": "homer",
+  "namespace": "homer",
+  "destNamespace": "homer",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/homer/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/homer/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: homer-ingress
+  namespace: homer
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "home.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: homer
+                port:
+                  number: 8088

apps/homer/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/kavita/base/deployment.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kavita
+  namespace: kavita
+  labels:
+    app.kubernetes.io/name: kavita
+    app.kubernetes.io/instance: kavita
+  annotations:
+    kubectl.kubernetes.io/default-container: kavita
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kavita
+      app.kubernetes.io/instance: kavita
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: kavita
+        app.kubernetes.io/instance: kavita
+    spec:
+      containers:
+        - image: jvmilazz0/kavita:0.8.1
+          imagePullPolicy: IfNotPresent
+          name: kavita
+          ports:
+            - containerPort: 5000
+              name: http
+              protocol: TCP
+          env:
+            - name: TZ
+              value: Australia/Sydney
+          volumeMounts:
+            - name: kavita-config
+              mountPath: /kavita/config
+            - name: kavita-manga
+              mountPath: /manga
+            - name: kavita-book
+              mountPath: /book
+            - name: kavita-doc
+              mountPath: /doc
+      volumes:
+        - name: kavita-config
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/config
+            type: Directory
+        - name: kavita-manga
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/manga
+            type: Directory
+        - name: kavita-book
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/book
+            type: Directory
+        - name: kavita-doc
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/doc
+            type: Directory

apps/kavita/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - ./service.yaml

apps/kavita/base/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kavita
+  namespace: kavita
+  labels:
+    app.kubernetes.io/name: kavita
+    app.kubernetes.io/instance: kavita
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5000
+      targetPort: 5000
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: kavita
+    app.kubernetes.io/instance: kavita

apps/kavita/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "kavita",
+  "userGivenName": "kavita",
+  "namespace": "kavita",
+  "destNamespace": "kavita",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/kavita/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/kavita/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kavita-ingress
+  namespace: kavita
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "kavita.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: kavita
+                port:
+                  number: 5000

apps/kavita/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/kubernetes-dashboard/README.md

@@ -0,0 +1,3 @@
+### Command to generate the token
+```bash
+kubectl -n argocd create token admin-user

apps/kubernetes-dashboard/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: kubernetes-dashboard
+    repo: https://kubernetes.github.io/dashboard/
+    version: 7.5.0
+    releaseName: kubernetes-dashboard
+    valuesFile: values.yaml

apps/kubernetes-dashboard/base/values.yaml

@@ -0,0 +1,8 @@
+app:
+  ingress:
+    enabled: true
+    hosts:
+      - k3s-dashboard.cluster.edward.sydney
+    ingressClassName: nginx
+    tls:
+      enabled: false

apps/kubernetes-dashboard/env/k3s-cluster/cluster-role.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: admin-user
+    namespace: argocd

apps/kubernetes-dashboard/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "kubernetes-dashboard",
+  "userGivenName": "kubernetes-dashboard",
+  "namespace": "argocd",
+  "destNamespace": "argocd",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/kubernetes-dashboard/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/kubernetes-dashboard/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./service-account.yaml
+  - ./cluster-role.yaml

apps/kubernetes-dashboard/env/k3s-cluster/service-account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-user
+  namespace: argocd

apps/nextcloud/base/deployment.yaml

@@ -0,0 +1,76 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nextcloud
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nextcloud
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: nextcloud
+          image: nextcloud/all-in-one:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: SKIP_DOMAIN_VALIDATION
+              value: "true"
+            - name: APACHE_PORT
+              value: "11000"
+            - name: APACHE_IP_BINDING
+              value: "0.0.0.0"
+          ports:
+            - protocol: TCP
+              containerPort: 80
+              name: 80-tcp
+            - protocol: TCP
+              containerPort: 8080
+              name: 8080-tcp
+            - protocol: TCP
+              containerPort: 8443
+              name: 8443-tcp
+            - protocol: TCP
+              containerPort: 3478
+              name: 3478-tcp
+            - protocol: UDP
+              containerPort: 3478
+              name: 3478-udp
+          volumeMounts:
+            - name: nextcloud_aio_mastercontainer
+              mountPath: /mnt/docker-aio-config
+            - name: nextcloud_aio_nextcloud
+              mountPath: /mnt/ncdata
+            - name: nextcloud_storagebox
+              mountPath: /mnt/storagebox
+            - name: docker-socket
+              mountPath: /var/run/docker.sock
+              readOnly: true
+      volumes:
+        - name: nextcloud_aio_mastercontainer
+          hostPath:
+            path: /mnt/nfs/AppData/nextcloud/config
+            type: Directory
+        - name: nextcloud_aio_nextcloud
+          hostPath:
+            path: /mnt/nfs/AppData/nextcloud/data
+            type: Directory
+        - name: nextcloud_storagebox
+          hostPath:
+            path: /mnt/nfs/AppData/nextcloud/storagebox
+            type: Directory
+        - name: docker-socket
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
+      nodeSelector:
+        kubernetes.io/arch: amd64

apps/nextcloud/base/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nextcloud-ingress
+  namespace: nextcloud
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "nextcloud.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: nextcloud
+                port:
+                  number: 8080

apps/nextcloud/base/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml
+  - ./ingress.yaml

apps/nextcloud/base/service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+spec:
+  selector:
+    app.kubernetes.io/name: nextcloud
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+      name: 80-tcp
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+      name: 8080-tcp
+    - protocol: TCP
+      port: 8443
+      targetPort: 8443
+      name: 8443-tcp

apps/nextcloud/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

apps/nexus/base/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nexus
+  namespace: nexus
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nexus
+  template:
+    metadata:
+      labels:
+        app: nexus
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: nexus
+          image: klo2k/nexus3:3.68.1-02
+          resources:
+            limits:
+              memory: "3Gi"
+              cpu: "1"
+            requests:
+              memory: "2Gi"
+              cpu: "500m"
+          ports:
+            - containerPort: 8081
+          volumeMounts:
+            - name: nexus-data
+              mountPath: /nexus-data
+      volumes:
+        - name: nexus-data
+          hostPath:
+            path: /mnt/nfs/AppData/nexus
+            type: Directory

apps/nexus/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/nexus/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nexus
+  namespace: nexus
+  annotations:
+    prometheus.io/scrape: 'true'
+    prometheus.io/path:   /
+    prometheus.io/port:   '8081'
+spec:
+  selector:
+    app: nexus
+  type: NodePort
+  ports:
+    - port: 8081
+      targetPort: 8081
+      nodePort: 32000

apps/nexus/env/k3s-cluster/config.json

@@ -0,0 +1,11 @@
+{
+  "appName": "nexus",
+  "userGivenName": "nexus",
+  "destNamespace": "nexus",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/nexus/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/nexus/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

apps/plex/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: plex-media-server
+    repo: https://raw.githubusercontent.com/plexinc/pms-docker/gh-pages
+    version: 0.4.0
+    releaseName: plex-media-server
+    valuesFile: values.yaml

apps/plex/base/values.yaml

@@ -0,0 +1,36 @@
+pms:
+  configExistingClaim: plex-config-pvc
+nodeSelector:
+  kubernetes.io/arch: amd64
+extraEnv:
+  PLEX_CLAIM: "claim-EHVggvEm_aaX_E_szfyc"
+  TZ: "Australia/Sydney"
+  PLEX_UID: 1000
+  PLEX_GID: 1000
+  ALLOWED_NETWORKS: "0.0.0.0/0"
+extraVolumeMounts:
+  - name: plex-tv
+    mountPath: /tv
+  - name: plex-movie
+    mountPath: /movie
+  - name: plex-music
+    mountPath: /music
+  - name: plex-gv
+    mountPath: /gv
+extraVolumes:
+  - name: plex-tv
+    hostPath:
+      path: /mnt/nfs/AppData/plex/tv
+      type: Directory
+  - name: plex-movie
+    hostPath:
+      path: /mnt/nfs/AppData/plex/movie
+      type: Directory
+  - name: plex-music
+    hostPath:
+      path: /mnt/nfs/AppData/plex/music
+      type: Directory
+  - name: plex-gv
+    hostPath:
+      path: /mnt/nfs/AppData/plex/gv
+      type: Directory

apps/plex/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "plex",
+  "userGivenName": "plex",
+  "namespace": "plex",
+  "destNamespace": "plex",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/plex/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/plex/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

apps/rlpa-server/base/deployment.yaml

@@ -0,0 +1,28 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rlpa-server
+  namespace: rlpa
+  labels:
+    app.kubernetes.io/name: rlpa-server
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: rlpa-server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: rlpa-server
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: rlpa-server
+          image: damonto/estkme-cloud:1.0.11
+          securityContext:
+            allowPrivilegeEscalation: false
+          ports:
+            - protocol: TCP
+              containerPort: 1888
+              name: api

apps/rlpa-server/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/rlpa-server/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: rlpa-server
+  namespace: rlpa
+  labels:
+    app.kubernetes.io/name: rlpa
+spec:
+  selector:
+    app.kubernetes.io/name: rlpa
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 1888
+      targetPort: 1888
+      name: rlpa-tcp

apps/rlpa-server/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "rlpa-server",
+  "userGivenName": "rlpa-server",
+  "namespace": "rlpa",
+  "destNamespace": "rlpa",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/rlpa-server/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/rlpa-server/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

apps/snippet-box/base/deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: snippet-box
+  namespace: snippet-box
+  labels:
+    app.kubernetes.io/name: snippet-box
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: snippet-box
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: snippet-box
+    spec:
+      containers:
+        - name: snippet-box
+          image: pawelmalak/snippet-box:arm
+          ports:
+            - protocol: TCP
+              containerPort: 5000
+              name: snippet-box
+          env:
+            - name: TZ
+              value: Australia/Sydney
+          volumeMounts:
+            - name: snippet-box-data
+              mountPath: /app/data
+      volumes:
+        - name: snippet-box-data
+          hostPath:
+            path: /mnt/nfs/AppData/snippet-box
+            type: Directory

apps/snippet-box/base/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: snippet-box-ingress
+  namespace: snippet-box
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "snippet-box.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: snippet-box
+                port:
+                  number: 5000

apps/snippet-box/base/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml
+  - ./ingress.yaml

apps/snippet-box/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: snippet-box
+  namespace: snippet-box
+  labels:
+    app.kubernetes.io/name: snippet-box
+spec:
+  selector:
+    app.kubernetes.io/name: snippet-box
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 5000
+      targetPort: 5000
+      name: snippet-box

apps/snippet-box/env/k3s-cluster/config.json

@@ -0,0 +1,11 @@
+{
+  "appName": "snippet-box",
+  "userGivenName": "snippet-box",
+  "destNamespace": "snippet-box",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/snippet-box/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/snippet-box/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

apps/sonarqube/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: sonarqube
+    repo: oci://registry-1.docker.io/bitnamicharts
+    version: 5.2.10
+    releaseName: sonarqube
+    valuesFile: values.yaml

apps/sonarqube/env/k3s-cluster/values.yaml

@@ -0,0 +1,40 @@
+priorityClassName: system-cluster-critical
+namespaceOverride: "sonarqube"
+clusterDomain: sonarqube.cluster.edward.sydney
+sonarqubeUsername: sonarqube
+existingSecret: "sonarqube-secrets"
+sonarqubeEmail: "me@edward.sydney"
+smtpHost: "smtp.gmail.com"
+smtpPort: "587"
+smtpUser: "me@edward.sydney"
+smtpProtocol: "TLS"
+smtpExistingSecret: "sonarqube-secrets"
+podSecurityContext:
+  fsGroup: 1000
+containerSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+service:
+  ports:
+    http: 8090
+    elastic: 9091
+  nodePorts:
+    http: 30080
+    elastic: 30091
+ingress:
+  enabled: true
+  ingressClassName: "nginx"
+  hostname: "sonarqube.cluster.edward.sydney"
+persistence:
+  enabled: true
+  storageClass: local-path
+  size: "32Gi"
+  existingClaim: "sonarqube-pvc"
+serviceAccount:
+  name: "sonarqube"
+postgresql:
+  enabled: false
+externalDatabase:
+  host: "postgresql-primary.argocd.svc.cluster.local"
+  user: "sonarqube_user"
+  existingSecret: "sonarqube-secrets"

apps/trillium/base/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trillium
+  namespace: trillium
+  labels:
+    app.kubernetes.io/name: trillium
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: trillium
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: trillium
+    spec:
+      containers:
+        - name: trillium
+          image: zadam/trilium:0.63.7
+          env:
+            - name: TRILIUM_DATA_DIR
+              value: "/home/node/trilium-data"
+            - name: USER_UID
+              value: "1000"
+            - name: USER_GID
+              value: "1000"
+          ports:
+            - protocol: TCP
+              containerPort: 8080
+              name: trillium-ui
+          volumeMounts:
+            - name: trillium-data
+              mountPath: /home/node/trilium-data
+      volumes:
+        - name: trillium-data
+          hostPath:
+            path: /mnt/nfs/AppData/trillium
+            type: Directory

apps/trillium/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/trillium/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: trillium
+  namespace: trillium
+  labels:
+    app.kubernetes.io/name: trillium
+spec:
+  selector:
+    app.kubernetes.io/name: trillium
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+      name: trillium-ui

apps/trillium/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "trillium",
+  "userGivenName": "trillium",
+  "namespace": "trillium",
+  "destNamespace": "trillium",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/trillium/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/trillium/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: trillium-ingress
+  namespace: trillium
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "trillium.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: trillium
+                port:
+                  number: 8080

apps/trillium/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/uptime-kuma/base/deployment.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+  labels:
+    app.kubernetes.io/name: uptime-kuma
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: uptime-kuma
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: uptime-kuma
+    spec:
+      containers:
+        - name: uptime-kuma
+          image: louislam/uptime-kuma:1.23.13
+          ports:
+            - protocol: TCP
+              containerPort: 3001
+              name: http
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+      volumes:
+        - name: data
+          hostPath:
+            path: /mnt/nfs/AppData/uptime-kuma
+            type: Directory

apps/uptime-kuma/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/uptime-kuma/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+  labels:
+    app.kubernetes.io/name: uptime-kuma
+spec:
+  selector:
+    app.kubernetes.io/name: uptime-kuma
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 3001
+      targetPort: 3001
+      name: http

apps/uptime-kuma/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "uptime-kuma",
+  "userGivenName": "uptime-kuma",
+  "namespace": "uptime-kuma",
+  "destNamespace": "uptime-kuma",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/uptime-kuma/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/uptime-kuma/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: uptime-kuma-ingress
+  namespace: uptime-kuma
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "uptime-kuma.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: uptime-kuma
+                port:
+                  number: 3001

apps/uptime-kuma/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/vaultwarden/base/deployment.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+  labels:
+    app.kubernetes.io/name: vaultwarden
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: vaultwarden
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: vaultwarden
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - securityContext:
+            runAsUser: 1000
+            runAsNonRoot: true
+            runAsGroup: 1000
+          name: vaultwarden
+          image: vaultwarden/server:1.31.0
+          env:
+            - name: DOMAIN
+              value: https://vaultwarden.cluster.edward.sydney
+            - name: SIGNUPS_ALLOWED
+              value: "true"
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: vaultwarden-secrets
+                  key: db_url
+          ports:
+            - protocol: TCP
+              containerPort: 80
+              name: http
+          volumeMounts:
+            - name: vaultwarden-data
+              mountPath: /data
+      volumes:
+        - name: vaultwarden-data
+          hostPath:
+            path: /mnt/nfs/AppData/vaultwarden/data
+            type: Directory
+

apps/vaultwarden/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/vaultwarden/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+  labels:
+    app.kubernetes.io/name: vaultwarden
+spec:
+  selector:
+    app.kubernetes.io/name: vaultwarden
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 11080
+      targetPort: 80
+      name: http

apps/vaultwarden/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "vaultwarden",
+  "userGivenName": "vaultwarden",
+  "namespace": "vaultwarden",
+  "destNamespace": "vaultwarden",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/vaultwarden/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/vaultwarden/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden-ingress
+  namespace: vaultwarden
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "vaultwarden.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: vaultwarden
+                port:
+                  number: 11080

apps/vaultwarden/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

infrastructures/couchdb/env/k3s-cluster/deployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: couchdb
+  namespace: couchdb
+  labels:
+    app.kubernetes.io/name: couchdb
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: couchdb
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: couchdb
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: couchdb
+          image: bitnami/couchdb:3.3.3
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: COUCHDB_PORT_NUMBER
+              value: "7777"
+            - name: COUCHDB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: couchdb-secrets
+                  key: password
+            - name: COUCHDB_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: couchdb-secrets
+                  key: secrets
+          ports:
+            - protocol: TCP
+              containerPort: 7777
+              name: couchdb-port
+          volumeMounts:
+            - name: couchdb-data
+              mountPath: /bitnami/couchdb
+            - name: couchdb-config
+              mountPath: /opt/bitnami/couchdb/etc/
+      volumes:
+        - name: couchdb-data
+          hostPath:
+            path: /mnt/nfs/AppData/couchdb
+            type: Directory
+        - name: couchdb-config
+          hostPath:
+            path: /mnt/nfs/AppData/couchdb/etc
+            type: Directory

infrastructures/couchdb/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: couchdb-ingress
+  namespace: couchdb
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "couchdb.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: couchdb
+                port:
+                  number: 7777

infrastructures/couchdb/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./service.yaml
+  - ./deployment.yaml
+  - ./ingress.yaml

infrastructures/couchdb/env/k3s-cluster/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: couchdb
+  namespace: couchdb
+  labels:
+    app.kubernetes.io/name: couchdb
+spec:
+  selector:
+    app.kubernetes.io/name: couchdb
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 7777
+      targetPort: 7777
+      name: couchdb-port

infrastructures/ingress-nginx/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: ingress-nginx
+    repo: https://kubernetes.github.io/ingress-nginx
+    version: 4.10.1
+    releaseName: ingress-nginx
+    valuesFile: values.yaml

infrastructures/ingress-nginx/base/values.yaml

@@ -0,0 +1,5 @@
+rbac:
+  create: true
+
+controller:
+  priorityClassName: system-cluster-critical

infrastructures/ingress-nginx/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "ingress-nginx",
+  "userGivenName": "ingress-nginx",
+  "namespace": "ingress-nginx",
+  "destNamespace": "ingress-nginx",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "infrastructures/ingress-nginx/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

infrastructures/ingress-nginx/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: ingress-nginx
+    repo: https://kubernetes.github.io/ingress-nginx
+    version: 4.10.1
+    releaseName: ingress-nginx
+    valuesFile: values.yaml

infrastructures/ingress-nginx/env/k3s-cluster/values.yaml

@@ -0,0 +1,75 @@
+rbac:
+  create: true
+
+controller:
+  priorityClassName: system-cluster-critical
+
+  extraArgs:
+    update-status-on-shutdown: "false"
+    tcp-services-configmap: "ingress-nginx/tcp-services"
+    udp-services-configmap: "ingress-nginx/udp-services"
+
+  allowSnippetAnnotations: true
+
+  config:
+    proxy-buffer-size: 16k
+    use-gzip: true
+    enable-brotli: true
+    hsts-max-age: 31536000
+    hsts-preload: true
+    disable-ipv6: true
+    disable-ipv6-dns: true
+    keep-alive-requests: 1000
+    use-geoip2: false
+    custom-http-errors: 401,403,404,500,501,502,503,504
+
+  extraEnvs:
+    - name: TZ
+      value: Australia/Sydney
+
+  addHeaders:
+    Referrer-Policy: same-origin, strict-origin-when-cross-origin
+    X-Content-Type-Options: nosniff
+    X-Frame-Options: SAMEORIGIN
+    X-XSS-Protection: 1; mode=block
+
+  ingressClassResource:
+    default: true
+
+  service:
+    externalTrafficPolicy: Cluster
+    ipFamilyPolicy: SingleStack
+
+  metrics:
+    enabled: ${metrics_enabled:=false}
+  #        serviceMonitor:
+  #          enabled: ${metrics_enabled:=false}
+  #          scrapeInterval: 1m
+
+  spec:
+    template:
+      spec:
+        containers:
+          volumeMounts:
+            - mountPath: /etc/nginx/template
+              name: nginx-template-volume
+              readOnly: true
+        volumes:
+          - name: nginx-template-volume
+            hostPath:
+              path: /mnt/nfs/AppData/ingress-nginx/etc/nginx/template
+              type: Directory
+
+defaultBackend:
+  enabled: true
+  image:
+    repository: ghcr.io/tarampampam/error-pages
+    tag: 2.27.0@sha256:40e2631173b1a407c18fe7d1ba8104d995cf9e4780d123eeadfa1d57c68eaf4f
+    pullPolicy: IfNotPresent
+  extraEnvs:
+    - name: TEMPLATE_NAME
+      value: connection
+    - name: SHOW_DETAILS
+      value: "true"
+    - name: READ_BUFFER_SIZE
+      value: "8192"

infrastructures/minio/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "minio",
+  "userGivenName": "minio",
+  "namespace": "minio",
+  "destNamespace": "minio",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "infrastructures/minio/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

infrastructures/minio/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: minio
+    repo: oci://registry-1.docker.io/bitnamicharts
+    version: 14.6.24
+    releaseName: minio
+    valuesFile: values.yaml

infrastructures/minio/env/k3s-cluster/values.yaml

@@ -0,0 +1,27 @@
+namespaceOverride: "minio"
+clusterDomain: minio.cluster.edward.sydney
+auth:
+  existingSecret: "minio-secrets"
+  rootUserSecretKey: "root_user"
+  rootPasswordSecretKey: "root_password"
+nodeSelector:
+  kubernetes.io/hostname: k3s-cluster-node-2
+service:
+  ports:
+    api: 19000
+    console: 19001
+ingress:
+  enabled: true
+  ingressClassName: "nginx"
+  hostname: "minio.cluster.edward.sydney"
+apiIngress:
+  enabled: true
+  ingressClassName: "nginx"
+  hostname: "api.minio.cluster.edward.sydney"
+persistence:
+  existingClaim: "minio-pvc"
+containerSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+podSecurityContext:
+  fsGroup: 1000

infrastructures/mongodb/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "mongodb",
+  "userGivenName": "mongodb",
+  "namespace": "mongodb",
+  "destNamespace": "mongodb",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "infrastructures/mongodb/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

infrastructures/mongodb/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: mongodb
+    repo: oci://registry-1.docker.io/bitnamicharts
+    version: 15.6.14
+    releaseName: mongodb
+    valuesFile: values.yaml

infrastructures/mongodb/env/k3s-cluster/values.yaml

@@ -0,0 +1,31 @@
+global:
+  namespaceOverride: "mongodb"
+auth:
+  usernames:
+    - edward
+    - anysync
+  databases:
+    - edward
+    - anysync
+  existingSecret: "mongodb-secrets"
+automountServiceAccountToken: true
+nodeSelector:
+  kubernetes.io/arch: amd64
+containerSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+podSecurityContext:
+  fsGroup: 1000
+startupProbe:
+  enabled: true
+service:
+  type: LoadBalancer
+persistence:
+  existingClaim: "mongodb-pvc"
+persistentVolumeClaimRetentionPolicy:
+  enabled: true
+serviceAccount:
+  create: true
+  name: mongodb
+rbac:
+  create: true

infrastructures/postgresql/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "postgresql",
+  "userGivenName": "postgresql",
+  "namespace": "postgresql",
+  "destNamespace": "postgresql",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "infrastructures/postgresql/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

infrastructures/postgresql/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: postgresql
+    repo: oci://registry-1.docker.io/bitnamicharts
+    version: 15.5.17
+    releaseName: postgresql
+    valuesFile: values.yaml