enable gitea

remove unneeded security context

.sops.pub.asc

@@ -1,63 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBGZlM+cBEADb3FqX+ZswYKVKx7kUGSvvBT0+Pe/6BZIQYDt8DE+gXTAwNDlq
-4Yy1XyPN5ispHo1/huUkUOaFUpkolfjzuciEIWaw2qHhTn9a7rPTx7DGCni9epic
-SuQYykC7MgQtAOkxUlx5R9XTL30JksICqlVLz8SMDHAzraLZU+4Pde+Cqgzx4x0K
-EfBzoAfjQtRe1RtikQ0ShklbbrbfETG9oGYh28RCI/ic22pgVV3EN1K1RDJDx9O+
-+CWW/dahKBCrKl8BUAd7dblOkIT1iwBtteyAfvYgcaGL2O0pHKIx2XmM2OWvjbPR
-TJvYtDQXpLHEYValuDWSF3TxxlYw05MFK3TRK0bSp8f7RN8Y12bZ/yGI3HpTfF2u
-B/ZGP++v5SwzuOEJw/7VrCqihLPuq/yeCi7xUGYpuhW0vjE5GVH3R7BBpP3B1Svg
-gCrdZOP0KoMVNM0SHzVvUzf4okWo1ctHU1zhmBPmW+LAyugYvq8di7q7rRDelELW
-IBnIqEfxXCKdqD2YylUJYXRuHhSvfGw8ABt873xBYfLTQSJmadaQevB58nTCooCe
-kt9AaOpdjCjfaArajbhUQx+56GdSLh5OUabu/zG75SF3kGJJ69G3BFZH5vZSwkt9
-22O75IBBN0A+d7xt/NsPNAfckwmPHFNiKxSPMXzrdGbfHTZTiYykarqVwwARAQAB
-tClycGk1LWNsdXN0ZXIuZWR3YXJkLnN5ZG5leSAoZmx1eCBzZWNyZXRzKYkCTgQT
-AQoAOBYhBGzqkd2xlkhpyU3Ox69uO7G0T2abBQJmZTPnAhsvBQsJCAcCBhUKCQgL
-AgQWAgMBAh4BAheAAAoJEK9uO7G0T2ab2gIQAI/MhtpzyIqAto0O9erPG74HNqsB
-B4Fi/DssU+WHYOiLR8COXNYV1Hzb7VWaucyKku0OB58AN8fMfTEE5b/K2kvhAyAW
-oK+FWgLWQXrLIwZuz+rlwIZEEWJrUYOle3tosmOyE8vlvPwv9hzS1q6ueEanvT1K
-2UrtRWCdfDRVJciUTI78v88XNYD7CpOfJqlS62tk2su6NGjBg4T5N9j0u0ddZ1pU
-eH28L4jvaCiAQkKZbKSBr5LFKJio4LIkCOsYyraQrv6PxuPd5c2E2GbMOMLF2iLO
-25hlr2o34UnjDMV0bHFHUw2ujULYCzp83A5oNce6vjY/ZL0LrrjVqVn+gcnpR9MF
-K3ArlkUkp0oNuVnZ1o/zObfcv6XEG/LoQGc7nuYLMooQEEeNEP2RwvlRTAhpKPZW
-ZPthGwe7RzWwPWjmkPvBVQy4njk7rDu0Ob0NkJKOBOc28Su5iOIwzKRyzvDV6g1o
-2yYWuKmZSkjBvP909LSccoFW8I55bUg3tUH5n7BCkdeOAmsq4cGPMviJeVRByOxt
-oK4wS63g/R8h916eLwygMxutDeIEnrAcGrpCXDRzH7kOq533LbuMk1p2giY4VAIK
-S26C0zzhjF0vJwls7BoP55XZfJf/WGQdRtfH6QvKfJwk1n/2OTeeY3McSEg7JoCf
-cmPZtQG/mGAhpomjuQINBGZlM+cBEADh4OFFjCOjbPn/5B0FwZ4wqjND/ARSD6iu
-CUNAEEex+WNkEt8h2lZdUq0CAmNPqQIJQ2QE68TdueVl9X+is5uqDGgEyGo2ZccE
-RkpM89l883Pvfd/fiJSHCo/lBGSMhJQLzE/AWu4FKxkCmqFFQ9aK6XJhV/knsJ4Z
-Nis0n4weCF0YETE0vq2bPPMl2xvpMy4VKvG4t7Dhl0wJRakgtZYApOlBVpupzHh4
-bx27jkh7K2lEmJIoWc7xBtMYonvys66tQyHy86kPfQXw+gzzkUpf2XYCHRzvjPZ9
-YiZqV370LCkjLMg0zfLaINXUsw6xrHXfbnutTb3qW9YIp7xyQS64wFbKM9d+y7XL
-ZUXsAQbn9cNoEBP5pXoJSvrrkGRAZDwFW0ax2XveuAlfBRv5tiXpHyD7M7Arrjb0
-yc6ijU/ZBv0vaQZMtSt28M10Z5Tn1A93nHff2xdM0njZc3KImM/QpGXlY8pct18Q
-zUqoYu69po7j7mH78a8h2tI5X7AmU1T1JOcQQ4bp46ik3uBKCVxLSyesAeGE1Au8
-QksLqELZ/jVlV/+WQ54NDLt3bc24V8MIj57xPDumejsJnY8cJLOW7Rrsn3WJCBkw
-AKM4BlrR/HigX7sjZ57N9ZsRTuaxpvCJwlRdK4YPsEBhO2UvQNGVWLEj8dogq2+v
-a31vc/kyrwARAQABiQRsBBgBCgAgFiEEbOqR3bGWSGnJTc7Hr247sbRPZpsFAmZl
-M+cCGy4CQAkQr247sbRPZpvBdCAEGQEKAB0WIQTvmsGobbjnhWp6fYQ2D2kqSUqH
-CgUCZmUz5wAKCRA2D2kqSUqHClj8D/4pHqnYlIcJpDOhGxYlQtrk6GRSfq1g3suh
-5Lhc+eHFpVQtQM85qJTSIhS3w/XAf3GwekYuiKjGAdhrWJcglphxCPX5IMg9ofMX
-ICbOxyjdEeOwgfEMvuyPgLUet6reK8rSTefhR5L2FRuU+qibs08LKMAtRoooZ3I1
-W7q38hWBcrrQXnBxtb7YLQ6Kzwd7mEq0KXnJxV8UBUj9x90j7R5+YEs3ZIAUh6sV
-jR23RpRuBQmgGXsjv3LsYyeDCglUNmWZKWfVhhmLcIbJ5/Dej4Eg79qY6DrmyXLM
-0Sw1ZhGAj/xRGw3GMrLXoj1gjEI1etUbiCKLUud2llUk4d15NP5CfhQ6s4Gh9p60
-x1eL8+hNuoSDRuQWzn/8MWglWKeUnalXF7krjLuOVtpMR+Uh9YwufUXDiQRmx6Iy
-/k7yOKg9V6IBm+6+xxKXKPZeBuVucKPegyI00gbM9F2ql9z30/WGVRtt6vIowuPi
-5p5e3mmeL83FUv7tpVnNR50ulfVEflTBHbfgop1THJIYgNT6OODCUQFw/GPzzMNi
-8jz3a1GB+OTYNF+x7OzrgBx1AvtryNQz+8lvkWVSfhJx0kgeUwwghIPw5zV4fypf
-8XQiP67BcarnB4RiWSgUjs7uQ25ZBxRbZ+D3StvP9+5QEBIh9q7yaj2gxo6fcaNk
-ZxKPd2thGiIZD/9H27JXAz7r/U+wtycteXKXogcAdu4i5Zlpqd5c3p2K3XO+sc6Y
-cA+uFNWBrz2RsKwIAX2djfYDi8Vp6uACRkE8Vzyo5WoIk0LF6upCCD44DIZGWlzH
-t59dGr8HQFvk/6RTuWoMnbtbK1k6qV5CK6q3jVZo2Do4v4uY2D/eXjzaIew+3kDG
-v+HDAOVZuTiW2V8XQSrXUr3duCK4Lch+EE8Cw8RyPy1Um6jSUbUGXFryqiLuaqub
-72JON1QDH6sLci7xGEccKGyk9xsTLthxFTWkPEjPXNPTAlvbPwdL/eOFmmOOLUqH
-HomXDoKITUOJ5ytUQ6WgIpfdOSkRmamMtzfvs6kkogzL53vwNXJMRm05HYgjm1bD
-moLpcoFhxEDj8Cd3sY+e+J6rKOgWq8f3+cKNi4qIzpv7JyAUW2gM2sfPPJ6PViPB
-MV1CnKli8ZRLEoHXcakjq5ScJi0UyG+rT3vodUdKbVQKxeohry1gX6QO27lDSn2d
-6KQy5mueEy9eZh3WsCWXTp/oILRlrgOrxQWySv2M6b15lxFjRvHc1j2/4szaqNWr
-fPUQZsDUwl84VrjzoQpXmt+Nn8xgAGEEWpXAc5P6tkm4Nk8lkUErRkbdSWEAjOOF
-8cVKCymSVdmFE2RPvZdK9vYCCckjFNBArbT6xQwDjAo4srdaMtxJWb+3kA==
-=8DLE
------END PGP PUBLIC KEY BLOCK-----

.sops.yaml

@@ -1,4 +0,0 @@
-creation_rules:
-  - path_regex: \.ya?ml$
-    encrypted_regex: ^(data|stringData)$
-    age: age1d47q8mlty404pxx378q49hr93aqexca4mkeqtdm00w4gjd09xd0qhxcdcz

apps/adguard-home/base/deployment.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: adguard-home
+  namespace: adguard-home
+  labels:
+    app.kubernetes.io/name: adguard-home
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: adguard-home
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: adguard-home
+    spec:
+      containers:
+        - name: adguard-home
+          image: adguard/adguardhome:v0.107.51
+          ports:
+            - protocol: TCP
+              containerPort: 53
+              name: dns-tcp
+            - protocol: UDP
+              containerPort: 53
+              name: dns-udp
+            - protocol: UDP
+              containerPort: 67
+              name: dhcps-udp
+            - protocol: UDP
+              containerPort: 68
+              name: dhcpc-udp
+            - protocol: TCP
+              containerPort: 80
+              name: http-tcp
+            - protocol: TCP
+              containerPort: 443
+              name: https-tcp
+            - protocol: UDP
+              containerPort: 443
+              name: https-udp
+            - protocol: TCP
+              containerPort: 853
+              name: dns-tls-tcp
+            - protocol: UDP
+              containerPort: 853
+              name: dns-tls-udp
+            - protocol: TCP
+              containerPort: 3000
+              name: http-alt-tcp
+            - protocol: UDP
+              containerPort: 3000
+              name: http-alt-udp
+            - protocol: TCP
+              containerPort: 5443
+              name: dnscrypt-tcp
+            - protocol: UDP
+              containerPort: 5443
+              name: dnscrypt-udp
+            - protocol: TCP
+              containerPort: 6060
+              name: http-pprof
+          env:
+            - name: TZ
+              value: Australia/Sydney
+          volumeMounts:
+            - name: adguard-home-data
+              mountPath: /opt/adguardhome/work
+            - name: adguard-home-config
+              mountPath: /opt/adguardhome/conf
+      volumes:
+        - name: adguard-home-data
+          hostPath:
+            path: /mnt/nfs/AppData/adguardhome/work
+            type: Directory
+        - name: adguard-home-config
+          hostPath:
+            path: /mnt/nfs/AppData/adguardhome/conf
+            type: Directory

apps/adguard-home/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/adguard-home/base/service.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-home
+  namespace: adguard-home
+  labels:
+    app.kubernetes.io/name: adguard-home
+spec:
+  selector:
+    app.kubernetes.io/name: adguard-home
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 53
+      targetPort: 53
+      name: dns-tcp
+    - protocol: UDP
+      port: 53
+      targetPort: 53
+      name: dns-udp
+    - protocol: UDP
+      port: 67
+      targetPort: 67
+      name: dhcps-udp
+    - protocol: UDP
+      port: 68
+      targetPort: 68
+      name: dhcpc-udp
+    - protocol: TCP
+      port: 10080
+      targetPort: 80
+      name: http-tcp
+    - protocol: TCP
+      port: 443
+      targetPort: 443
+      name: https-tcp
+    - protocol: UDP
+      port: 443
+      targetPort: 443
+      name: https-udp
+    - protocol: TCP
+      port: 853
+      targetPort: 853
+      name: dns-tls-tcp
+    - protocol: UDP
+      port: 853
+      targetPort: 853
+      name: dns-tls-udp
+    - protocol: TCP
+      port: 13000
+      targetPort: 3000
+      name: https-alt-tcp
+    - protocol: UDP
+      port: 13000
+      targetPort:  3000
+      name: https-alt-udp
+    - protocol: TCP
+      port: 5443
+      targetPort: 5443
+      name: dnscrypt-tcp
+    - protocol: UDP
+      port: 5443
+      targetPort: 5443
+      name: dnscrypt-udp
+    - protocol: TCP
+      port: 6060
+      targetPort: 6060
+      name: https-pprof

apps/adguard-home/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "adguard-home",
+  "userGivenName": "adguard-home",
+  "namespace": "adguard-home",
+  "destNamespace": "adguard-home",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/adguard-home/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/adguard-home/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,61 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: adguard-home-ingress
+  namespace: adguard-home
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "adguard-home.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 10080
+    - host: "adguard-home.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 10080
+    - host: "setup.adguard-home.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 13000
+    - host: "setup.adguard-home.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 13000
+    - host: "doh.adguard-home.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: adguard-home
+                port:
+                  number: 443

apps/adguard-home/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/chattts/base/deployment.yaml

@@ -0,0 +1,30 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: chattts
+  namespace: chattts
+  labels:
+    app.kubernetes.io/name: chattts
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: chattts
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: chattts
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: chattts
+          image: lcs13324/chattts:v1.0
+          securityContext:
+            allowPrivilegeEscalation: false
+          ports:
+            - protocol: TCP
+              containerPort: 8888
+              name: http
+      nodeSelector:
+        kubernetes.io/arch: amd64

apps/chattts/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/chattts/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: chattts
+  namespace: chattts
+  labels:
+    app.kubernetes.io/name: chattts
+spec:
+  selector:
+    app.kubernetes.io/name: chattts
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 8888
+      targetPort: 8888
+      name: http

apps/chattts/env/k3s-cluster/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - cilium.yaml
+  - ../../base

apps/coder/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "coder",
+  "userGivenName": "coder",
+  "namespace": "coder",
+  "destNamespace": "coder",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/coder/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/coder/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: coder
+    repo: https://helm.coder.com/v2
+    version: 2.13.1
+    releaseName: coder
+    valuesFile: values.yaml

apps/coder/env/k3s-cluster/values.yaml

@@ -0,0 +1,22 @@
+coder:
+  env:
+    - name: CODER_ACCESS_URL
+      value: "https://coder.cluster.edward.sydney"
+    - name: CODER_PG_CONNECTION_URL
+      valueFrom:
+        secretKeyRef:
+          # You'll need to create a secret called coder-db-url with your
+          # Postgres connection URL like:
+          # postgres://coder:password@postgres:5432/coder?sslmode=disable
+          name: coder-secrets
+          key: db_url
+  volumes:
+    - name: coder-data
+      persistentVolumeClaim:
+        claimName: coder-pvc
+  volumeMounts:
+    - name: coder-data
+      mountPath: /config
+  service:
+    type: NodePort
+    httpNodePort: 31180

apps/gitea/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "gitea",
+  "userGivenName": "gitea",
+  "namespace": "gitea",
+  "destNamespace": "gitea",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/gitea/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/gitea/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: gitea
+    repo: oci://registry-1.docker.io/bitnamicharts
+    version: 2.3.14
+    releaseName: gitea
+    valuesFile: values.yaml

apps/gitea/env/k3s-cluster/values.yaml

@@ -0,0 +1,30 @@
+namespaceOverride: "gitea"
+podAntiAffinityPreset: ""
+adminUsername: "gitea_admin"
+adminEmail: "edward@cheng.sydney"
+appName: "gitea"
+existingSecret: "gitea-secrets"
+existingSecretKey: "admin-password"
+smtpHost: "smtp.gmail.com"
+smtpPort: "587"
+smtpUser: "me@edward.sydney"
+smtpExistingSecret: "gitea-secrets"
+persistence:
+  existingClaim: "gitea-pvc"
+service:
+  ports:
+    http: 10080
+    ssh: 10022
+ingress:
+  enabled: true
+  ingressClassName: "nginx"
+  hostname: "gitea.cluster.edward.sydney"
+serviceAccount:
+  create: false
+postgresql:
+  enabled: false
+externalDatabase:
+  host: "postgresql-primary.argocd.svc.cluster.local"
+  user: "gitea_user"
+  existingSecret: "gitea-secrets"
+  existingSecretPasswordKey: "db-password"

apps/gitlab/env/k3s-cluster/deployment.yaml

@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitlab
+  namespace: gitlab
+  labels:
+    app.kubernetes.io/name: gitlab
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: gitlab
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: gitlab
+    spec:
+      containers:
+        - name: gitlab
+          image: gitlab/gitlab-ce:17.2.1-ce.0
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: GITLAB_OMNIBUS_CONFIG
+              value: "external_url 'https://gitlab.cluster.edward.sydney'"
+          ports:
+            - protocol: TCP
+              containerPort: 443
+              name: https
+            - protocol: TCP
+              containerPort: 80
+              name: http
+            - protocol: TCP
+              containerPort: 22
+              name: ssh
+          volumeMounts:
+            - name: dshm
+              mountPath: /dev/shm
+            - name: gitlab-config
+              mountPath: /etc/config
+            - name: gitlab-log
+              mountPath: /var/log/gitlab
+            - name: gitlab-data
+              mountPath: /var/opt/gitlab
+      volumes:
+        - name: dshm
+          emptyDir:
+            medium: Memory
+            sizeLimit: 1Gi
+        - name: gitlab-config
+          hostPath:
+            path: /mnt/nfs/AppData/gitlab/config
+            type: Directory
+        - name: gitlab-log
+          hostPath:
+            path: /mnt/nfs/AppData/gitlab/log
+            type: Directory
+        - name: gitlab-data
+          hostPath:
+            path: /mnt/nfs/AppData/gitlab/data
+            type: Directory
+      nodeSelector:
+        kubernetes.io/arch: amd64

apps/gitlab/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/gitlab/env/k3s-cluster/service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitlab
+  namespace: gitlab
+  labels:
+    app.kubernetes.io/name: gitlab
+spec:
+  selector:
+    app.kubernetes.io/name: gitlab
+  type: LoadBalancer
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 10080
+      targetPort: 80
+      name: http
+    - protocol: TCP
+      port: 10443
+      targetPort: 443
+      name: https
+    - protocol: TCP
+      port: 10022
+      targetPort: 22
+      name: ssh

apps/homer/base/deployment.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homer
+  namespace: homer
+  labels:
+    app.kubernetes.io/name: homer
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: homer
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: homer
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: homer
+          image: b4bz/homer:v24.05.1
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: PORT
+              value: "8088"
+            - name: INIT_ASSETS
+              value: "0"
+          ports:
+            - protocol: TCP
+              containerPort: 8088
+              name: http
+          volumeMounts:
+            - name: assets
+              mountPath: /www/assets
+      volumes:
+        - name: assets
+          hostPath:
+            path: /mnt/nfs/AppData/homer/www/assets
+            type: Directory

apps/homer/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/homer/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: homer
+  namespace: homer
+  labels:
+    app.kubernetes.io/name: homer
+spec:
+  selector:
+    app.kubernetes.io/name: homer
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 8088
+      targetPort: 8088
+      name: http

apps/homer/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "homer",
+  "userGivenName": "homer",
+  "namespace": "homer",
+  "destNamespace": "homer",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/homer/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/homer/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: homer-ingress
+  namespace: homer
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "home.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: homer
+                port:
+                  number: 8088

apps/homer/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/kavita/base/deployment.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kavita
+  namespace: kavita
+  labels:
+    app.kubernetes.io/name: kavita
+    app.kubernetes.io/instance: kavita
+  annotations:
+    kubectl.kubernetes.io/default-container: kavita
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kavita
+      app.kubernetes.io/instance: kavita
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: kavita
+        app.kubernetes.io/instance: kavita
+    spec:
+      containers:
+        - image: jvmilazz0/kavita:0.8.1
+          imagePullPolicy: IfNotPresent
+          name: kavita
+          ports:
+            - containerPort: 5000
+              name: http
+              protocol: TCP
+          env:
+            - name: TZ
+              value: Australia/Sydney
+          volumeMounts:
+            - name: kavita-config
+              mountPath: /kavita/config
+            - name: kavita-manga
+              mountPath: /manga
+            - name: kavita-book
+              mountPath: /book
+            - name: kavita-doc
+              mountPath: /doc
+      volumes:
+        - name: kavita-config
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/config
+            type: Directory
+        - name: kavita-manga
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/manga
+            type: Directory
+        - name: kavita-book
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/book
+            type: Directory
+        - name: kavita-doc
+          hostPath:
+            path: /mnt/nfs/AppData/kavita/doc
+            type: Directory

apps/kavita/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - ./service.yaml

apps/kavita/base/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kavita
+  namespace: kavita
+  labels:
+    app.kubernetes.io/name: kavita
+    app.kubernetes.io/instance: kavita
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5000
+      targetPort: 5000
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: kavita
+    app.kubernetes.io/instance: kavita

apps/kavita/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "kavita",
+  "userGivenName": "kavita",
+  "namespace": "kavita",
+  "destNamespace": "kavita",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/kavita/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/kavita/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kavita-ingress
+  namespace: kavita
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "kavita.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: kavita
+                port:
+                  number: 5000

apps/kavita/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/kubernetes-dashboard/README.md

@@ -0,0 +1,3 @@
+### Command to generate the token
+```bash
+kubectl -n argocd create token admin-user

apps/kubernetes-dashboard/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: kubernetes-dashboard
+    repo: https://kubernetes.github.io/dashboard/
+    version: 7.5.0
+    releaseName: kubernetes-dashboard
+    valuesFile: values.yaml

apps/kubernetes-dashboard/base/values.yaml

@@ -0,0 +1,8 @@
+app:
+  ingress:
+    enabled: true
+    hosts:
+      - k3s-dashboard.cluster.edward.sydney
+    ingressClassName: nginx
+    tls:
+      enabled: false

apps/kubernetes-dashboard/env/k3s-cluster/cluster-role.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: admin-user
+    namespace: argocd

apps/kubernetes-dashboard/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "kubernetes-dashboard",
+  "userGivenName": "kubernetes-dashboard",
+  "namespace": "argocd",
+  "destNamespace": "argocd",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/kubernetes-dashboard/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/kubernetes-dashboard/env/k3s-cluster/kustomization.yaml

@@ -1,7 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./capacitor
-  - ./cert-manager
-  - ./cilium
-  - ./podinfo
+  - ../../base
+  - ./service-account.yaml
+  - ./cluster-role.yaml

apps/kubernetes-dashboard/env/k3s-cluster/service-account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-user
+  namespace: argocd

apps/nextcloud/base/deployment.yaml

@@ -0,0 +1,76 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nextcloud
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nextcloud
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: nextcloud
+          image: nextcloud/all-in-one:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: SKIP_DOMAIN_VALIDATION
+              value: "true"
+            - name: APACHE_PORT
+              value: "11000"
+            - name: APACHE_IP_BINDING
+              value: "0.0.0.0"
+          ports:
+            - protocol: TCP
+              containerPort: 80
+              name: 80-tcp
+            - protocol: TCP
+              containerPort: 8080
+              name: 8080-tcp
+            - protocol: TCP
+              containerPort: 8443
+              name: 8443-tcp
+            - protocol: TCP
+              containerPort: 3478
+              name: 3478-tcp
+            - protocol: UDP
+              containerPort: 3478
+              name: 3478-udp
+          volumeMounts:
+            - name: nextcloud_aio_mastercontainer
+              mountPath: /mnt/docker-aio-config
+            - name: nextcloud_aio_nextcloud
+              mountPath: /mnt/ncdata
+            - name: nextcloud_storagebox
+              mountPath: /mnt/storagebox
+            - name: docker-socket
+              mountPath: /var/run/docker.sock
+              readOnly: true
+      volumes:
+        - name: nextcloud_aio_mastercontainer
+          hostPath:
+            path: /mnt/nfs/AppData/nextcloud/config
+            type: Directory
+        - name: nextcloud_aio_nextcloud
+          hostPath:
+            path: /mnt/nfs/AppData/nextcloud/data
+            type: Directory
+        - name: nextcloud_storagebox
+          hostPath:
+            path: /mnt/nfs/AppData/nextcloud/storagebox
+            type: Directory
+        - name: docker-socket
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
+      nodeSelector:
+        kubernetes.io/arch: amd64

apps/nextcloud/base/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nextcloud-ingress
+  namespace: nextcloud
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "nextcloud.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: nextcloud
+                port:
+                  number: 8080

apps/nextcloud/base/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml
+  - ./ingress.yaml

apps/nextcloud/base/service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/name: nextcloud
+spec:
+  selector:
+    app.kubernetes.io/name: nextcloud
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+      name: 80-tcp
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+      name: 8080-tcp
+    - protocol: TCP
+      port: 8443
+      targetPort: 8443
+      name: 8443-tcp

apps/nextcloud/env/k3s-cluster/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - podinfo.yaml
+  - ../../base

apps/nexus/base/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nexus
+  namespace: nexus
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nexus
+  template:
+    metadata:
+      labels:
+        app: nexus
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: nexus
+          image: klo2k/nexus3:3.68.1-02
+          resources:
+            limits:
+              memory: "3Gi"
+              cpu: "1"
+            requests:
+              memory: "2Gi"
+              cpu: "500m"
+          ports:
+            - containerPort: 8081
+          volumeMounts:
+            - name: nexus-data
+              mountPath: /nexus-data
+      volumes:
+        - name: nexus-data
+          hostPath:
+            path: /mnt/nfs/AppData/nexus
+            type: Directory

apps/nexus/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/nexus/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nexus
+  namespace: nexus
+  annotations:
+    prometheus.io/scrape: 'true'
+    prometheus.io/path:   /
+    prometheus.io/port:   '8081'
+spec:
+  selector:
+    app: nexus
+  type: NodePort
+  ports:
+    - port: 8081
+      targetPort: 8081
+      nodePort: 32000

apps/nexus/env/k3s-cluster/config.json

@@ -0,0 +1,11 @@
+{
+  "appName": "nexus",
+  "userGivenName": "nexus",
+  "destNamespace": "nexus",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/nexus/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/nexus/env/k3s-cluster/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - capacitor.yaml
+  - ../../base

apps/plex/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: plex-media-server
+    repo: https://raw.githubusercontent.com/plexinc/pms-docker/gh-pages
+    version: 0.4.0
+    releaseName: plex-media-server
+    valuesFile: values.yaml

apps/plex/base/values.yaml

@@ -0,0 +1,36 @@
+pms:
+  configExistingClaim: plex-config-pvc
+nodeSelector:
+  kubernetes.io/arch: amd64
+extraEnv:
+  PLEX_CLAIM: "claim-EHVggvEm_aaX_E_szfyc"
+  TZ: "Australia/Sydney"
+  PLEX_UID: 1000
+  PLEX_GID: 1000
+  ALLOWED_NETWORKS: "0.0.0.0/0"
+extraVolumeMounts:
+  - name: plex-tv
+    mountPath: /tv
+  - name: plex-movie
+    mountPath: /movie
+  - name: plex-music
+    mountPath: /music
+  - name: plex-gv
+    mountPath: /gv
+extraVolumes:
+  - name: plex-tv
+    hostPath:
+      path: /mnt/nfs/AppData/plex/tv
+      type: Directory
+  - name: plex-movie
+    hostPath:
+      path: /mnt/nfs/AppData/plex/movie
+      type: Directory
+  - name: plex-music
+    hostPath:
+      path: /mnt/nfs/AppData/plex/music
+      type: Directory
+  - name: plex-gv
+    hostPath:
+      path: /mnt/nfs/AppData/plex/gv
+      type: Directory

apps/plex/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "plex",
+  "userGivenName": "plex",
+  "namespace": "plex",
+  "destNamespace": "plex",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/plex/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/plex/env/k3s-cluster/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - cert-manager.yaml
+  - ../../base

apps/rlpa-server/base/deployment.yaml

@@ -0,0 +1,28 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rlpa-server
+  namespace: rlpa
+  labels:
+    app.kubernetes.io/name: rlpa-server
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: rlpa-server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: rlpa-server
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: rlpa-server
+          image: damonto/estkme-cloud:1.0.11
+          securityContext:
+            allowPrivilegeEscalation: false
+          ports:
+            - protocol: TCP
+              containerPort: 1888
+              name: api

apps/rlpa-server/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/rlpa-server/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: rlpa-server
+  namespace: rlpa
+  labels:
+    app.kubernetes.io/name: rlpa
+spec:
+  selector:
+    app.kubernetes.io/name: rlpa
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 1888
+      targetPort: 1888
+      name: rlpa-tcp

apps/rlpa-server/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "rlpa-server",
+  "userGivenName": "rlpa-server",
+  "namespace": "rlpa",
+  "destNamespace": "rlpa",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/rlpa-server/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/rlpa-server/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

apps/snippet-box/base/deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: snippet-box
+  namespace: snippet-box
+  labels:
+    app.kubernetes.io/name: snippet-box
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: snippet-box
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: snippet-box
+    spec:
+      containers:
+        - name: snippet-box
+          image: pawelmalak/snippet-box:arm
+          ports:
+            - protocol: TCP
+              containerPort: 5000
+              name: snippet-box
+          env:
+            - name: TZ
+              value: Australia/Sydney
+          volumeMounts:
+            - name: snippet-box-data
+              mountPath: /app/data
+      volumes:
+        - name: snippet-box-data
+          hostPath:
+            path: /mnt/nfs/AppData/snippet-box
+            type: Directory

apps/snippet-box/base/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: snippet-box-ingress
+  namespace: snippet-box
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "snippet-box.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: snippet-box
+                port:
+                  number: 5000

apps/snippet-box/base/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml
+  - ./ingress.yaml

apps/snippet-box/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: snippet-box
+  namespace: snippet-box
+  labels:
+    app.kubernetes.io/name: snippet-box
+spec:
+  selector:
+    app.kubernetes.io/name: snippet-box
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 5000
+      targetPort: 5000
+      name: snippet-box

apps/snippet-box/env/k3s-cluster/config.json

@@ -0,0 +1,11 @@
+{
+  "appName": "snippet-box",
+  "userGivenName": "snippet-box",
+  "destNamespace": "snippet-box",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/snippet-box/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/snippet-box/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

apps/sonarqube/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: sonarqube
+    repo: oci://registry-1.docker.io/bitnamicharts
+    version: 5.2.10
+    releaseName: sonarqube
+    valuesFile: values.yaml

apps/sonarqube/env/k3s-cluster/values.yaml

@@ -0,0 +1,40 @@
+priorityClassName: system-cluster-critical
+namespaceOverride: "sonarqube"
+clusterDomain: sonarqube.cluster.edward.sydney
+sonarqubeUsername: sonarqube
+existingSecret: "sonarqube-secrets"
+sonarqubeEmail: "me@edward.sydney"
+smtpHost: "smtp.gmail.com"
+smtpPort: "587"
+smtpUser: "me@edward.sydney"
+smtpProtocol: "TLS"
+smtpExistingSecret: "sonarqube-secrets"
+podSecurityContext:
+  fsGroup: 1000
+containerSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+service:
+  ports:
+    http: 8090
+    elastic: 9091
+  nodePorts:
+    http: 30080
+    elastic: 30091
+ingress:
+  enabled: true
+  ingressClassName: "nginx"
+  hostname: "sonarqube.cluster.edward.sydney"
+persistence:
+  enabled: true
+  storageClass: local-path
+  size: "32Gi"
+  existingClaim: "sonarqube-pvc"
+serviceAccount:
+  name: "sonarqube"
+postgresql:
+  enabled: false
+externalDatabase:
+  host: "postgresql-primary.argocd.svc.cluster.local"
+  user: "sonarqube_user"
+  existingSecret: "sonarqube-secrets"

apps/trillium/base/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trillium
+  namespace: trillium
+  labels:
+    app.kubernetes.io/name: trillium
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: trillium
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: trillium
+    spec:
+      containers:
+        - name: trillium
+          image: zadam/trilium:0.63.7
+          env:
+            - name: TRILIUM_DATA_DIR
+              value: "/home/node/trilium-data"
+            - name: USER_UID
+              value: "1000"
+            - name: USER_GID
+              value: "1000"
+          ports:
+            - protocol: TCP
+              containerPort: 8080
+              name: trillium-ui
+          volumeMounts:
+            - name: trillium-data
+              mountPath: /home/node/trilium-data
+      volumes:
+        - name: trillium-data
+          hostPath:
+            path: /mnt/nfs/AppData/trillium
+            type: Directory

apps/trillium/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/trillium/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: trillium
+  namespace: trillium
+  labels:
+    app.kubernetes.io/name: trillium
+spec:
+  selector:
+    app.kubernetes.io/name: trillium
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+      name: trillium-ui

apps/trillium/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "trillium",
+  "userGivenName": "trillium",
+  "namespace": "trillium",
+  "destNamespace": "trillium",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/trillium/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/trillium/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: trillium-ingress
+  namespace: trillium
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "trillium.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: trillium
+                port:
+                  number: 8080

apps/trillium/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/uptime-kuma/base/deployment.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+  labels:
+    app.kubernetes.io/name: uptime-kuma
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: uptime-kuma
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: uptime-kuma
+    spec:
+      containers:
+        - name: uptime-kuma
+          image: louislam/uptime-kuma:1.23.13
+          ports:
+            - protocol: TCP
+              containerPort: 3001
+              name: http
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+      volumes:
+        - name: data
+          hostPath:
+            path: /mnt/nfs/AppData/uptime-kuma
+            type: Directory

apps/uptime-kuma/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/uptime-kuma/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+  labels:
+    app.kubernetes.io/name: uptime-kuma
+spec:
+  selector:
+    app.kubernetes.io/name: uptime-kuma
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 3001
+      targetPort: 3001
+      name: http

apps/uptime-kuma/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "uptime-kuma",
+  "userGivenName": "uptime-kuma",
+  "namespace": "uptime-kuma",
+  "destNamespace": "uptime-kuma",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/uptime-kuma/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/uptime-kuma/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: uptime-kuma-ingress
+  namespace: uptime-kuma
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "uptime-kuma.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: uptime-kuma
+                port:
+                  number: 3001

apps/uptime-kuma/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/vaultwarden/base/deployment.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+  labels:
+    app.kubernetes.io/name: vaultwarden
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: vaultwarden
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: vaultwarden
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - securityContext:
+            runAsUser: 1000
+            runAsNonRoot: true
+            runAsGroup: 1000
+          name: vaultwarden
+          image: vaultwarden/server:1.31.0
+          env:
+            - name: DOMAIN
+              value: https://vaultwarden.cluster.edward.sydney
+            - name: SIGNUPS_ALLOWED
+              value: "true"
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: vaultwarden-secrets
+                  key: db_url
+          ports:
+            - protocol: TCP
+              containerPort: 80
+              name: http
+          volumeMounts:
+            - name: vaultwarden-data
+              mountPath: /data
+      volumes:
+        - name: vaultwarden-data
+          hostPath:
+            path: /mnt/nfs/AppData/vaultwarden/data
+            type: Directory
+

apps/vaultwarden/base/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./deployment.yaml
+  - ./service.yaml

apps/vaultwarden/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+  labels:
+    app.kubernetes.io/name: vaultwarden
+spec:
+  selector:
+    app.kubernetes.io/name: vaultwarden
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 11080
+      targetPort: 80
+      name: http

apps/vaultwarden/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "vaultwarden",
+  "userGivenName": "vaultwarden",
+  "namespace": "vaultwarden",
+  "destNamespace": "vaultwarden",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/vaultwarden/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/vaultwarden/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden-ingress
+  namespace: vaultwarden
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "vaultwarden.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: vaultwarden
+                port:
+                  number: 11080

apps/vaultwarden/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

infrastructures/couchdb/env/k3s-cluster/deployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: couchdb
+  namespace: couchdb
+  labels:
+    app.kubernetes.io/name: couchdb
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: couchdb
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: couchdb
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: couchdb
+          image: bitnami/couchdb:3.3.3
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: COUCHDB_PORT_NUMBER
+              value: "7777"
+            - name: COUCHDB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: couchdb-secrets
+                  key: password
+            - name: COUCHDB_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: couchdb-secrets
+                  key: secrets
+          ports:
+            - protocol: TCP
+              containerPort: 7777
+              name: couchdb-port
+          volumeMounts:
+            - name: couchdb-data
+              mountPath: /bitnami/couchdb
+            - name: couchdb-config
+              mountPath: /opt/bitnami/couchdb/etc/
+      volumes:
+        - name: couchdb-data
+          hostPath:
+            path: /mnt/nfs/AppData/couchdb
+            type: Directory
+        - name: couchdb-config
+          hostPath:
+            path: /mnt/nfs/AppData/couchdb/etc
+            type: Directory

infrastructures/couchdb/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: couchdb-ingress
+  namespace: couchdb
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "couchdb.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: couchdb
+                port:
+                  number: 7777

infrastructures/couchdb/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./service.yaml
+  - ./deployment.yaml
+  - ./ingress.yaml

infrastructures/couchdb/env/k3s-cluster/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: couchdb
+  namespace: couchdb
+  labels:
+    app.kubernetes.io/name: couchdb
+spec:
+  selector:
+    app.kubernetes.io/name: couchdb
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 7777
+      targetPort: 7777
+      name: couchdb-port

infrastructures/ingress-nginx/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: ingress-nginx
+    repo: https://kubernetes.github.io/ingress-nginx
+    version: 4.10.1
+    releaseName: ingress-nginx
+    valuesFile: values.yaml

infrastructures/ingress-nginx/base/values.yaml

@@ -0,0 +1,5 @@
+rbac:
+  create: true
+
+controller:
+  priorityClassName: system-cluster-critical

infrastructures/ingress-nginx/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "ingress-nginx",
+  "userGivenName": "ingress-nginx",
+  "namespace": "ingress-nginx",
+  "destNamespace": "ingress-nginx",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "infrastructures/ingress-nginx/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

infrastructures/ingress-nginx/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: ingress-nginx
+    repo: https://kubernetes.github.io/ingress-nginx
+    version: 4.10.1
+    releaseName: ingress-nginx
+    valuesFile: values.yaml

infrastructures/ingress-nginx/env/k3s-cluster/values.yaml

@@ -0,0 +1,75 @@
+rbac:
+  create: true
+
+controller:
+  priorityClassName: system-cluster-critical
+
+  extraArgs:
+    update-status-on-shutdown: "false"
+    tcp-services-configmap: "ingress-nginx/tcp-services"
+    udp-services-configmap: "ingress-nginx/udp-services"
+
+  allowSnippetAnnotations: true
+
+  config:
+    proxy-buffer-size: 16k
+    use-gzip: true
+    enable-brotli: true
+    hsts-max-age: 31536000
+    hsts-preload: true
+    disable-ipv6: true
+    disable-ipv6-dns: true
+    keep-alive-requests: 1000
+    use-geoip2: false
+    custom-http-errors: 401,403,404,500,501,502,503,504
+
+  extraEnvs:
+    - name: TZ
+      value: Australia/Sydney
+
+  addHeaders:
+    Referrer-Policy: same-origin, strict-origin-when-cross-origin
+    X-Content-Type-Options: nosniff
+    X-Frame-Options: SAMEORIGIN
+    X-XSS-Protection: 1; mode=block
+
+  ingressClassResource:
+    default: true
+
+  service:
+    externalTrafficPolicy: Cluster
+    ipFamilyPolicy: SingleStack
+
+  metrics:
+    enabled: ${metrics_enabled:=false}
+  #        serviceMonitor:
+  #          enabled: ${metrics_enabled:=false}
+  #          scrapeInterval: 1m
+
+  spec:
+    template:
+      spec:
+        containers:
+          volumeMounts:
+            - mountPath: /etc/nginx/template
+              name: nginx-template-volume
+              readOnly: true
+        volumes:
+          - name: nginx-template-volume
+            hostPath:
+              path: /mnt/nfs/AppData/ingress-nginx/etc/nginx/template
+              type: Directory
+
+defaultBackend:
+  enabled: true
+  image:
+    repository: ghcr.io/tarampampam/error-pages
+    tag: 2.27.0@sha256:40e2631173b1a407c18fe7d1ba8104d995cf9e4780d123eeadfa1d57c68eaf4f
+    pullPolicy: IfNotPresent
+  extraEnvs:
+    - name: TEMPLATE_NAME
+      value: connection
+    - name: SHOW_DETAILS
+      value: "true"
+    - name: READ_BUFFER_SIZE
+      value: "8192"

infrastructures/minio/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "minio",
+  "userGivenName": "minio",
+  "namespace": "minio",
+  "destNamespace": "minio",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "infrastructures/minio/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

infrastructures/minio/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: minio
+    repo: oci://registry-1.docker.io/bitnamicharts
+    version: 14.6.24
+    releaseName: minio
+    valuesFile: values.yaml

infrastructures/minio/env/k3s-cluster/values.yaml

@@ -0,0 +1,27 @@
+namespaceOverride: "minio"
+clusterDomain: minio.cluster.edward.sydney
+auth:
+  existingSecret: "minio-secrets"
+  rootUserSecretKey: "root_user"
+  rootPasswordSecretKey: "root_password"
+nodeSelector:
+  kubernetes.io/hostname: k3s-cluster-node-2
+service:
+  ports:
+    api: 19000
+    console: 19001
+ingress:
+  enabled: true
+  ingressClassName: "nginx"
+  hostname: "minio.cluster.edward.sydney"
+apiIngress:
+  enabled: true
+  ingressClassName: "nginx"
+  hostname: "api.minio.cluster.edward.sydney"
+persistence:
+  existingClaim: "minio-pvc"
+containerSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+podSecurityContext:
+  fsGroup: 1000

infrastructures/mongodb/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "mongodb",
+  "userGivenName": "mongodb",
+  "namespace": "mongodb",
+  "destNamespace": "mongodb",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "infrastructures/mongodb/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

infrastructures/mongodb/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: mongodb
+    repo: oci://registry-1.docker.io/bitnamicharts
+    version: 15.6.14
+    releaseName: mongodb
+    valuesFile: values.yaml

infrastructures/mongodb/env/k3s-cluster/values.yaml

@@ -0,0 +1,31 @@
+global:
+  namespaceOverride: "mongodb"
+auth:
+  usernames:
+    - edward
+    - anysync
+  databases:
+    - edward
+    - anysync
+  existingSecret: "mongodb-secrets"
+automountServiceAccountToken: true
+nodeSelector:
+  kubernetes.io/arch: amd64
+containerSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+podSecurityContext:
+  fsGroup: 1000
+startupProbe:
+  enabled: true
+service:
+  type: LoadBalancer
+persistence:
+  existingClaim: "mongodb-pvc"
+persistentVolumeClaimRetentionPolicy:
+  enabled: true
+serviceAccount:
+  create: true
+  name: mongodb
+rbac:
+  create: true