Merge pull request 'Update outlinewiki/outline Docker tag to v0.87.1' (#550) from renovate/outlinewiki-outline-0.x into master

Reviewed-on: #550

manifests/_apps/base64.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/blog.yaml

@@ -22,8 +22,5 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+
 ---

manifests/_apps/bsky-screenshot.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: twitter-to-airtable
+  name: bsky-screenshot
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: twitter-to-airtable
+    namespace: bsky-screenshot
     name: civo
   source:
-    path: manifests/twitter-to-airtable
+    path: manifests/bsky-screenshot
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,7 +22,3 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image

manifests/_apps/civo-versions.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/cors-proxy.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cluster-fun-starling
+  name: cors-proxy
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: starling
+    namespace: cors-proxy
     name: cluster-fun (v2)
   source:
-    path: manifests/starling
+    path: manifests/cors-proxy
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:

manifests/_apps/cv.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/dashboard.yaml

@@ -22,8 +22,5 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+
 ---

manifests/_apps/devstats-viewer.yaml

@@ -22,8 +22,5 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+
 ---

manifests/_apps/feed-fetcher.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/grist.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-fun-grist
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: grist
+    name: cluster-fun (v2)
+  source:
+    path: manifests/grist
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+---

manifests/_apps/marcusnoble.yaml

@@ -22,8 +22,5 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+
 ---

manifests/_apps/mastodon-digest.yaml

@@ -22,8 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/mealie.yaml

@@ -22,8 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/opengraph-image-gen.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/qr.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/reloader.yaml

@@ -21,3 +21,26 @@ spec:
     jsonPointers:
     - /data
 ---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-fun-reloader-civo
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: kube-system
+    name: civo
+  source:
+    repoURL: 'https://stakater.github.io/stakater-charts'
+    targetRevision: v0.0.89
+    chart: reloader
+  syncPolicy:
+    automated: {}
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+---

manifests/_apps/rss.yaml

@@ -22,8 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/social-to-rolodex.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: mastodon-to-airtable
+  name: social-to-rolodex
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: mastodon-to-airtable
+    namespace: social-to-rolodex
     name: civo
   source:
-    path: manifests/mastodon-to-airtable
+    path: manifests/social-to-rolodex
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/svg-to-dxf.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/talks.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/tank.yaml

@@ -22,8 +22,5 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+
 ---

manifests/_apps/text-to-dxf.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/til.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/tweetsvg.yaml

@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/twitter-profile-pic.yaml

@@ -22,8 +22,5 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+
 ---

manifests/_apps/yay-or-nay.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: yay-or-nay
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: yay-or-nay
+    name: cluster-fun (v2)
+  source:
+    path: manifests/yay-or-nay
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated: {}
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+---

manifests/auth-proxy/auth-ingress.yaml

@@ -23,10 +23,13 @@ spec:
     - sonarr.cluster.fun
     - lidarr.cluster.fun
     - prowlarr.cluster.fun
+    - mylarr.cluster.fun
     - transmission.cluster.fun
     - tekton.cluster.fun
     - changedetection.cluster.fun
     - grafana.cluster.fun
+    - podgrab.cluster.fun
+    - stablediffusion.cluster.fun
     secretName: auth-proxy-ingress
   rules:
   - host: downloads.cluster.fun
@@ -199,3 +202,33 @@ spec:
             name: tailscale-proxy
             port:
               name: auth
+  - host: podgrab.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: auth
+  - host: mylarr.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: auth
+  - host: stablediffusion.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: auth

manifests/auth-proxy/non-auth-ingress.yaml

@@ -6,11 +6,18 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-body-size: 25m
+    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
 spec:
   ingressClassName: nginx
   tls:
   - hosts:
     - hello-world.cluster.fun
+    - ombi.cluster.fun
+    - bsky-feeds.cluster.fun
+    - ai.cluster.fun
     secretName: non-auth-proxy-ingress
   rules:
   - host: hello-world.cluster.fun
@@ -23,3 +30,33 @@ spec:
             name: tailscale-proxy
             port:
               name: non-auth
+  - host: ombi.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth
+  - host: bsky-feeds.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth
+  - host: ai.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth

manifests/auth-proxy/proxy.yaml

@@ -49,7 +49,7 @@ spec:
         imagePullPolicy: Always
         env:
         - name: PROXY_DESTINATION
-          value: talos.averagemarcus.github.beta.tailscale.net
+          value: talos.tail4dfb.ts.net
         - name: PORT
           value: "8080"
         - name: TS_AUTH_KEY
@@ -67,7 +67,7 @@ spec:
           mountPath: /config/
 
       - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
         args:
         - --cookie-secure=false
         - --provider=oidc

manifests/bsky-screenshot/bsky-screenshot.yaml

@@ -0,0 +1,70 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: bsky-screenshot
+  namespace: bsky-screenshot
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: bsky-screenshot
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bsky-screenshot
+  namespace: bsky-screenshot
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: bsky-screenshot
+  template:
+    metadata:
+      labels:
+        app: bsky-screenshot
+    spec:
+      containers:
+      - name: web
+        image: rg.fr-par.scw.cloud/averagemarcus/bsky-screenshot:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 20Mi
+          requests:
+            memory: 20Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: bsky-screenshot
+  namespace: bsky-screenshot
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    ingress.kubernetes.io/ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  tls:
+  - hosts:
+    - bsky-screenshot.cluster.fun
+    secretName: bsky-screenshot-ingress
+  rules:
+  - host: bsky-screenshot.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: bsky-screenshot
+            port:
+              number: 80
+

manifests/cors-proxy/cors-proxy.yaml

@@ -0,0 +1,76 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: cors-proxy
+  namespace: cors-proxy
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: 8000
+    name: web
+  selector:
+    app: cors-proxy
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cors-proxy
+  namespace: cors-proxy
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: cors-proxy
+  template:
+    metadata:
+      labels:
+        app: cors-proxy
+    spec:
+      containers:
+      - name: web
+        image: rg.fr-par.scw.cloud/averagemarcus/cors-proxy:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 8000
+          name: web
+        env:
+        - name: ALLOWLIST
+          value: cdn.bsky.app
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cors-proxy
+  namespace: cors-proxy
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - cors-proxy.cluster.fun
+    - cors-proxy.marcusnoble.co.uk
+    secretName: cors-proxy-ingress
+  rules:
+  - host: cors-proxy.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: cors-proxy
+            port:
+              number: 80
+  - host: cors-proxy.marcusnoble.co.uk
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: cors-proxy
+            port:
+              number: 80

manifests/dashboard/dashboard.yaml

@@ -81,7 +81,7 @@ spec:
             secretKeyRef:
               key: password
               name: dashboard-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/gitea/gitea.yaml

@@ -42,7 +42,7 @@ spec:
     spec:
       containers:
       - name: git
-        image: gitea/gitea:1.22.0
+        image: gitea/gitea:1.24.5
         env:
         - name: APP_NAME
           value: "Git"

manifests/goplayground/goplayground.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: x1unix/go-playground:1.15.1
+        image: x1unix/go-playground:2.5.7
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 8000

manifests/grist/grist.yaml

@@ -0,0 +1,171 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+  annotations:
+    kube-1password: bpagsbvdrwomghyeowdgauytqq
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: grist-data
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "sbs-default-retain"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8484
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: grist
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+  annotations:
+    secret.reloader.stakater.com/reload: "grist"
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: grist
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: grist
+    spec:
+      serviceAccountName: grist
+      containers:
+        - name: grist
+          image: gristlabs/grist-oss:1.7.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8484
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          env:
+            - name: APP_HOME_URL
+              value: https://grist.cluster.fun
+            - name:  APP_DOC_URL
+              value: https://grist.cluster.fun
+            - name: APP_HOME_INTERNAL_URL
+              value: http://grist.grist.svc
+            - name:  APP_DOC_INTERNAL_URL
+              value: http://grist.grist.svc
+            - name: GRIST_SINGLE_ORG
+              value: default
+            - name: GRIST_TELEMETRY_LEVEL
+              value: "off"
+            - name: ALLOWED_WEBHOOK_DOMAINS
+              value: "tank.tank.svc,matrix.cluster.fun"
+            - name: GRIST_ANON_PLAYGROUND
+              value: "false"
+            - name: GRIST_FORCE_LOGIN
+              value: "true"
+            - name: GRIST_SANDBOX_FLAVOR
+              value: gvisor
+          securityContext:
+            capabilities:
+              add:
+              - SYS_PTRACE
+          envFrom:
+          - secretRef:
+              name: grist
+          volumeMounts:
+            - name: data
+              mountPath: /persist
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: grist-data
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: grist
+  minReplicas: 1
+  maxReplicas: 3
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - grist.cluster.fun
+    secretName: grist-ingress
+  rules:
+    - host: "grist.cluster.fun"
+      http:
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: grist
+                port:
+                  number: 80

manifests/link/link.yaml

@@ -24,6 +24,17 @@ data:
     rejekts23: https://noti.st/averagemarcus/Bi7qLP/webhooks-whats-the-worst-that-could-happen
     rejekts24: https://speaking.marcusnoble.co.uk/pg46DB/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
     lopug24: https://speaking.marcusnoble.co.uk/I6dyx4/webhooks-whats-the-worst-that-could-happen
+    kcduk24: https://speaking.marcusnoble.co.uk/0qcuN9/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
+    rejektsna24: https://speaking.marcusnoble.co.uk/dALiFY/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
+    kcddk24: https://speaking.marcusnoble.co.uk/FU4W7x/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
+    cndoslo: https://speaking.marcusnoble.co.uk/j5M53P/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
+    rejekts25: https://speaking.marcusnoble.co.uk/AXARFf/pod-deep-dive-everything-you-didnt-know-you-needed-to-know
+    kcdbudapest: https://speaking.marcusnoble.co.uk/43QLpx/the-future-of-kubernetes-admission-logic
+    kcdczechslovak: https://speaking.marcusnoble.co.uk/Np2xUv/pod-deep-dive-the-interesting-bits
+    cnsmunich: https://speaking.marcusnoble.co.uk/HqYcp2/pod-deep-dive-the-interesting-bits
+    cnsmunich-feedback: https://yay-or-nay.cluster.fun/feedback/20UETBI0
+    containerdays25: https://speaking.marcusnoble.co.uk/HARSlE/the-future-of-kubernetes-admission-logic
+    containerdays25-feedback: https://yay-or-nay.cluster.fun/feedback/F8P351QK
 ---
 apiVersion: v1
 kind: Service

manifests/mastodon-digest/mastodon_digest.yaml

@@ -152,7 +152,7 @@ spec:
             secretKeyRef:
               key: password
               name: mastodon-digest-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/matrix_chart/matrix_chart.yaml

@@ -124,6 +124,15 @@ data:
     {
       "m.server": "matrix.cluster.fun:443"
     }
+  client: |-
+    {
+      "m.homeserver": {
+        "base_url": "https://matrix.cluster.fun"
+      },
+      "org.matrix.msc3575.proxy": {
+        "url": "https://syncv3.matrix.cluster.fun"
+      }
+    }
 
 
 ---
@@ -339,7 +348,7 @@ metadata:
     app.kubernetes.io/name: "matrix"
     component: element
 spec:
-  replicas: 2
+  replicas: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: matrix-riot
@@ -354,7 +363,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: "riot"
-          image: "vectorim/element-web:v1.11.68"
+          image: "vectorim/element-web:v1.11.110"
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -379,6 +388,8 @@ spec:
             - mountPath: /var/run/pid
               name: ephemeral
               subPath: pid
+            - mountPath: /tmp
+              name: tmp
           readinessProbe:
             httpGet:
               path: /
@@ -403,6 +414,8 @@ spec:
             name: matrix-riot-config
         - name: ephemeral
           emptyDir: {}
+        - name: tmp
+          emptyDir: {}
 ---
 # Source: matrix/templates/synapse/deployment.yaml
 apiVersion: apps/v1
@@ -431,7 +444,7 @@ spec:
         fsGroup: 1000
       initContainers:
         - name: generate-signing-key
-          image: "ghcr.io/element-hq/synapse:v1.108.0"
+          image: "ghcr.io/element-hq/synapse:v1.137.0"
           imagePullPolicy: IfNotPresent
           env:
             - name: SYNAPSE_SERVER_NAME
@@ -458,7 +471,7 @@ spec:
               mountPath: /data/keys
       containers:
         - name: "synapse"
-          image: "ghcr.io/element-hq/synapse:v1.108.0"
+          image: "ghcr.io/element-hq/synapse:v1.137.0"
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -471,15 +484,6 @@ spec:
             - name: synapse-config-homeserver
               mountPath: /data/homeserver.yaml
               subPath: homeserver.yaml
-            - name: mautrix-whatsapp-registration
-              mountPath: /data/mautrix-whatsapp-registration.yaml
-              subPath: registration.yaml
-            # - name: mautrix-signal-registration
-            #   mountPath: /data/mautrix-signal-registration.yaml
-            #   subPath: registration.yaml
-            # - name: mautrix-telegram-registration
-            #   mountPath: /data/mautrix-telegram-registration.yaml
-            #   subPath: registration.yaml
             - name: synapse-config-logging
               mountPath: /data/matrix.cluster.fun.log.config
               subPath: matrix.cluster.fun.log.config
@@ -523,15 +527,6 @@ spec:
         - name: synapse-config-homeserver
           secret:
             secretName: matrix-synapse-config
-        - name: mautrix-whatsapp-registration
-          secret:
-            secretName: mautrix-whatsapp-registration
-        # - name: mautrix-signal-registration
-        #   secret:
-        #     secretName: mautrix-signal-registration
-        # - name: mautrix-telegram-registration
-        #   secret:
-        #     secretName: mautrix-telegram-registration
         - name: signing-key
           persistentVolumeClaim:
             claimName: chat-matrix-signing-key

manifests/matrix_chart/signal_bridge.yaml

@@ -1,153 +0,0 @@
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   name: mautrix-signal-registration
-#   namespace: chat
-#   annotations:
-#     kube-1password: z6tylu2br724gttcpfyi5egaui
-#     kube-1password/vault: Kubernetes
-#     kube-1password/secret-text-key: registration.yaml
-#   labels:
-#     app.kubernetes.io/name: "mautrix-signal"
-#     component: registration
-# type: Opaque
-
-# ---
-
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   name: mautrix-signal-config
-#   namespace: chat
-#   annotations:
-#     kube-1password: 5vfaorcudozlq4clkzgmzzszqe
-#     kube-1password/vault: Kubernetes
-#     kube-1password/secret-text-key: config.yaml
-#   labels:
-#     app.kubernetes.io/name: "mautrix-signal"
-#     component: config
-# type: Opaque
-
-# ---
-
-# apiVersion: v1
-# kind: Service
-# metadata:
-#   name: mautrix-signal
-#   namespace: chat
-#   labels:
-#     app.kubernetes.io/name: mautrix-signal
-#   annotations:
-#     prometheus.io/scrape: "true"
-#     prometheus.io/path: "/metrics"
-#     prometheus.io/port: "9000"
-# spec:
-#   type: ClusterIP
-#   ports:
-#   - port: 29328
-#     targetPort: http
-#     protocol: TCP
-#     name: http
-#   selector:
-#     app.kubernetes.io/name: mautrix-signal
-
-# ---
-
-# apiVersion: apps/v1
-# kind: Deployment
-# metadata:
-#   name: mautrix-signal
-#   labels:
-#     app.kubernetes.io/name: mautrix-signal
-# spec:
-#   revisionHistoryLimit: 3
-#   replicas: 1
-#   strategy:
-#     type: Recreate
-#   selector:
-#     matchLabels:
-#       app.kubernetes.io/name: mautrix-signal
-#   template:
-#     metadata:
-#       labels:
-#         app.kubernetes.io/name: mautrix-signal
-#     spec:
-#       serviceAccountName: default
-#       automountServiceAccountToken: true
-#       dnsPolicy: ClusterFirst
-#       enableServiceLinks: true
-#       initContainers:
-#       - name: config-copy
-#         image: bash:latest
-#         imagePullPolicy: IfNotPresent
-#         args:
-#           - -c
-#           - |
-#             cp /secrets/* /data/
-#         volumeMounts:
-#           - name: mautrix-signal-config
-#             mountPath: /secrets/config.yaml
-#             subPath: config.yaml
-#           - name: mautrix-signal-registration
-#             mountPath: /secrets/registration.yaml
-#             subPath: registration.yaml
-#           - name: data
-#             mountPath: /data
-#       containers:
-#         - name: signald
-#           image: docker.io/signald/signald:stable
-#           imagePullPolicy: Always
-#           volumeMounts:
-#           - name: signald
-#             mountPath: /signald
-#         - name: mautrix-signal
-#           image: "dock.mau.dev/mautrix/signal:v0.4.3"
-#           imagePullPolicy: IfNotPresent
-#           env:
-#             - name: "TZ"
-#               value: "UTC"
-#           ports:
-#             - name: http
-#               containerPort: 29328
-#               protocol: TCP
-#             - name: metrics
-#               containerPort: 9000
-#               protocol: TCP
-#           volumeMounts:
-#           - name: signald
-#             mountPath: /signald
-#           - name: data
-#             mountPath: /data
-#           livenessProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 3
-#             timeoutSeconds: 1
-#             periodSeconds: 10
-#           readinessProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 3
-#             timeoutSeconds: 1
-#             periodSeconds: 10
-#           startupProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 30
-#             timeoutSeconds: 1
-#             periodSeconds: 5
-#       volumes:
-#         - name: data
-#           emptyDir: {}
-#         - name: signald
-#           emptyDir: {}
-#         - name: mautrix-signal-config
-#           secret:
-#             secretName: mautrix-signal-config
-#         - name: mautrix-signal-registration
-#           secret:
-#             secretName: mautrix-signal-registration
-# ---

manifests/matrix_chart/sliding-sync.yaml

@@ -0,0 +1,119 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: matrix-sliding-sync
+  namespace: chat
+  annotations:
+    kube-1password: 7kvyfcszfaavj2d7uvl4troagm
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: sliding-sync
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sliding-sync
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: sliding-sync
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: sliding-sync
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: sliding-sync
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: "sliding-sync"
+          image: "ghcr.io/matrix-org/sliding-sync:v0.99.19"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8008
+              protocol: TCP
+            - name: metrics
+              containerPort: 9090
+              protocol: TCP
+          env:
+          - name: SYNCV3_SERVER
+            value: https://matrix.cluster.fun
+          - name: SYNCV3_BINDADDR
+            value: ":8008"
+          - name: SYNCV3_PROM
+            value: ":9090"
+          - name: SYNCV3_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: matrix-sliding-sync
+                key: SYNCV3_SECRET
+          - name: SYNCV3_DB
+            valueFrom:
+              secretKeyRef:
+                name: matrix-sliding-sync
+                key: SYNCV3_DB
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sliding-sync
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: sliding-sync
+  annotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "9090"
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: http
+    name: web
+  - port: 9090
+    targetPort: metrics
+    protocol: TCP
+    name: metrics
+  selector:
+    app.kubernetes.io/name: sliding-sync
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: sliding-sync
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: sliding-sync
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - syncv3.matrix.cluster.fun
+    secretName: sliding-sync-ingress
+  rules:
+  - host: syncv3.matrix.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: sliding-sync
+            port:
+              number: 80
+---

manifests/matrix_chart/telegram_bridge.yaml

@@ -1,143 +0,0 @@
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   name: mautrix-telegram-registration
-#   namespace: chat
-#   annotations:
-#     kube-1password: dancy7ogc4gjlxhfntqejgudwi
-#     kube-1password/vault: Kubernetes
-#     kube-1password/secret-text-key: registration.yaml
-#   labels:
-#     app.kubernetes.io/name: "mautrix-telegram"
-#     component: registration
-# type: Opaque
-
-# ---
-
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   name: mautrix-telegram-config
-#   namespace: chat
-#   annotations:
-#     kube-1password: nilzdpfum35hhwijnwvasbzmcq
-#     kube-1password/vault: Kubernetes
-#     kube-1password/secret-text-key: config.yaml
-#   labels:
-#     app.kubernetes.io/name: "mautrix-telegram"
-#     component: config
-# type: Opaque
-
-# ---
-
-# apiVersion: v1
-# kind: Service
-# metadata:
-#   name: mautrix-telegram
-#   namespace: chat
-#   labels:
-#     app.kubernetes.io/name: mautrix-telegram
-#   annotations:
-#     prometheus.io/scrape: "true"
-#     prometheus.io/path: "/metrics"
-#     prometheus.io/port: "9000"
-# spec:
-#   type: ClusterIP
-#   ports:
-#   - port: 29318
-#     targetPort: http
-#     protocol: TCP
-#     name: http
-#   selector:
-#     app.kubernetes.io/name: mautrix-telegram
-
-# ---
-
-# apiVersion: apps/v1
-# kind: Deployment
-# metadata:
-#   name: mautrix-telegram
-#   labels:
-#     app.kubernetes.io/name: mautrix-telegram
-# spec:
-#   revisionHistoryLimit: 3
-#   replicas: 1
-#   strategy:
-#     type: Recreate
-#   selector:
-#     matchLabels:
-#       app.kubernetes.io/name: mautrix-telegram
-#   template:
-#     metadata:
-#       labels:
-#         app.kubernetes.io/name: mautrix-telegram
-#     spec:
-#       serviceAccountName: default
-#       automountServiceAccountToken: true
-#       dnsPolicy: ClusterFirst
-#       enableServiceLinks: true
-#       initContainers:
-#       - name: config-copy
-#         image: bash:latest
-#         imagePullPolicy: IfNotPresent
-#         args:
-#           - -c
-#           - |
-#             cp /secrets/* /data/
-#         volumeMounts:
-#           - name: mautrix-telegram-config
-#             mountPath: /secrets/config.yaml
-#             subPath: config.yaml
-#           - name: mautrix-telegram-registration
-#             mountPath: /secrets/registration.yaml
-#             subPath: registration.yaml
-#           - name: data
-#             mountPath: /data
-#       containers:
-#         - name: mautrix-telegram
-#           image: "dock.mau.dev/mautrix/telegram:v0.12.1"
-#           imagePullPolicy: IfNotPresent
-#           env:
-#             - name: "TZ"
-#               value: "UTC"
-#           ports:
-#             - name: http
-#               containerPort: 29318
-#               protocol: TCP
-#             - name: metrics
-#               containerPort: 9000
-#               protocol: TCP
-#           volumeMounts:
-#           - name: data
-#             mountPath: /data
-#           livenessProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 3
-#             timeoutSeconds: 1
-#             periodSeconds: 10
-#           readinessProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 3
-#             timeoutSeconds: 1
-#             periodSeconds: 10
-#           startupProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 30
-#             timeoutSeconds: 1
-#             periodSeconds: 5
-#       volumes:
-#         - name: data
-#           emptyDir: {}
-#         - name: mautrix-telegram-config
-#           secret:
-#             secretName: mautrix-telegram-config
-#         - name: mautrix-telegram-registration
-#           secret:
-#             secretName: mautrix-telegram-registration
-# ---

manifests/matrix_chart/whatsapp_bridge.yaml

@@ -1,143 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mautrix-whatsapp-registration
-  namespace: chat
-  annotations:
-    kube-1password: x6lzkpyov4dem5jtk2kimyrnvy
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: registration.yaml
-  labels:
-    app.kubernetes.io/name: "mautrix-whatsapp"
-    component: registration
-type: Opaque
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mautrix-whatsapp-config
-  namespace: chat
-  annotations:
-    kube-1password: ji3e2el66bu56bml3kq3ghyojq
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: config.yaml
-  labels:
-    app.kubernetes.io/name: "mautrix-whatsapp"
-    component: config
-type: Opaque
-
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: mautrix-whatsapp
-  namespace: chat
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp
-  annotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/metrics"
-    prometheus.io/port: "9000"
-spec:
-  type: ClusterIP
-  ports:
-  - port: 29318
-    targetPort: http
-    protocol: TCP
-    name: http
-  selector:
-    app.kubernetes.io/name: mautrix-whatsapp
-
----
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mautrix-whatsapp
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: mautrix-whatsapp
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: mautrix-whatsapp
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      dnsPolicy: ClusterFirst
-      enableServiceLinks: true
-      initContainers:
-      - name: config-copy
-        image: bash:latest
-        imagePullPolicy: IfNotPresent
-        args:
-          - -c
-          - |
-            cp /secrets/* /data/
-        volumeMounts:
-          - name: mautrix-whatsapp-config
-            mountPath: /secrets/config.yaml
-            subPath: config.yaml
-          - name: mautrix-whatsapp-registration
-            mountPath: /secrets/registration.yaml
-            subPath: registration.yaml
-          - name: data
-            mountPath: /data
-      containers:
-        - name: mautrix-whatsapp
-          image: "dock.mau.dev/mautrix/whatsapp:v0.10.8"
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: "TZ"
-              value: "UTC"
-          ports:
-            - name: http
-              containerPort: 29318
-              protocol: TCP
-            - name: metrics
-              containerPort: 9000
-              protocol: TCP
-          volumeMounts:
-          - name: data
-            mountPath: /data
-          livenessProbe:
-            tcpSocket:
-              port: 29318
-            initialDelaySeconds: 0
-            failureThreshold: 3
-            timeoutSeconds: 1
-            periodSeconds: 10
-          readinessProbe:
-            tcpSocket:
-              port: 29318
-            initialDelaySeconds: 0
-            failureThreshold: 3
-            timeoutSeconds: 1
-            periodSeconds: 10
-          startupProbe:
-            tcpSocket:
-              port: 29318
-            initialDelaySeconds: 0
-            failureThreshold: 30
-            timeoutSeconds: 1
-            periodSeconds: 5
-      volumes:
-        - name: data
-          emptyDir: {}
-        - name: mautrix-whatsapp-config
-          secret:
-            secretName: mautrix-whatsapp-config
-        - name: mautrix-whatsapp-registration
-          secret:
-            secretName: mautrix-whatsapp-registration
----

manifests/mealie/mealie.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
       - name: frontend
-        image: ghcr.io/mealie-recipes/mealie:v1.8.0
+        image: ghcr.io/mealie-recipes/mealie:v3.1.2
         imagePullPolicy: Always
         envFrom:
         - secretRef:

manifests/monitoring-civo/kube-state-metrics.yaml

@@ -237,7 +237,7 @@ spec:
         - --resources=validatingwebhookconfigurations
         #- --resources=volumeattachments
         imagePullPolicy: IfNotPresent
-        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0"
+        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0"
         ports:
         - containerPort: 8080
         livenessProbe:

manifests/monitoring-civo/promtail.yaml

@@ -236,7 +236,7 @@ spec:
       serviceAccountName: promtail
       containers:
         - name: promtail
-          image: "grafana/promtail:2.9.8"
+          image: "grafana/promtail:2.9.15"
           imagePullPolicy: IfNotPresent
           args:
             - "-config.file=/etc/promtail/promtail.yaml"

manifests/monitoring-civo/vmagent.yaml

@@ -147,7 +147,7 @@ spec:
       serviceAccountName: prometheus-server
       containers:
         - name: vmagent
-          image: "victoriametrics/vmagent:v1.101.0"
+          image: "victoriametrics/vmagent:v1.124.0"
           imagePullPolicy: "IfNotPresent"
           args:
             - -remoteWrite.url=http://vmcluster.proxy-civo.svc/insert/0/prometheus/

manifests/monitoring/kube-state-metrics.yaml

@@ -237,7 +237,7 @@ spec:
         - --resources=validatingwebhookconfigurations
         #- --resources=volumeattachments
         imagePullPolicy: IfNotPresent
-        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0"
+        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.16.0"
         ports:
         - containerPort: 8080
         livenessProbe:

manifests/monitoring/node-exporter.yaml

@@ -54,7 +54,7 @@ spec:
       serviceAccountName: prometheus-node-exporter
       containers:
         - name: prometheus-node-exporter
-          image: "prom/node-exporter:v1.8.1"
+          image: "prom/node-exporter:v1.9.1"
           imagePullPolicy: "IfNotPresent"
           args:
             - --path.procfs=/host/proc

manifests/monitoring/promtail.yaml

@@ -215,7 +215,7 @@ spec:
       serviceAccountName: promtail
       containers:
         - name: promtail
-          image: "grafana/promtail:2.9.8"
+          image: "grafana/promtail:2.9.15"
           imagePullPolicy: IfNotPresent
           args:
             - "-config.file=/etc/promtail/promtail.yaml"

manifests/monitoring/vmagent.yaml

@@ -153,7 +153,7 @@ spec:
       serviceAccountName: prometheus-server
       containers:
         - name: vmagent
-          image: "victoriametrics/vmagent:v1.101.0"
+          image: "victoriametrics/vmagent:v1.124.0"
           imagePullPolicy: "IfNotPresent"
           args:
             - -remoteWrite.url=http://vmcluster.auth-proxy.svc/insert/0/prometheus/

manifests/nextcloud_chart/manifest.yaml

@@ -203,7 +203,7 @@ spec:
     spec:
       containers:
       - name: nextcloud
-        image: "nextcloud:29.0.1-apache"
+        image: "nextcloud:31.0.8-apache"
         imagePullPolicy: IfNotPresent
         env:
         - name: SQLITE_DATABASE
@@ -374,7 +374,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: nextcloud
-              image: "nextcloud:29.0.1-apache"
+              image: "nextcloud:31.0.8-apache"
               imagePullPolicy: IfNotPresent
               command: [ "curl" ]
               args:

manifests/nginx-lb/nginx-lb.yaml

@@ -15,7 +15,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx
   namespace: ingress-nginx
 ---
@@ -27,7 +26,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-admission
   namespace: ingress-nginx
 ---
@@ -39,7 +37,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx
   namespace: ingress-nginx
 rules:
@@ -144,7 +141,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-admission
   namespace: ingress-nginx
 rules:
@@ -163,7 +159,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx
 rules:
 - apiGroups:
@@ -245,7 +240,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-admission
 rules:
 - apiGroups:
@@ -264,7 +258,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx
   namespace: ingress-nginx
 roleRef:
@@ -284,7 +277,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-admission
   namespace: ingress-nginx
 roleRef:
@@ -303,7 +295,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -322,7 +313,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-admission
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -337,10 +327,31 @@ apiVersion: v1
 data:
   allow-snippet-annotations: "true"
   use-proxy-protocol: "true"
-  log-format-upstream: '{"time": "$time_iso8601", "request_id": "$req_id", "remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time, "status": $status, "host": "$host", "request_proto": "$server_protocol", "path": "$uri", "request_query": "$args", "request_length": $request_length, "duration": $request_time,"method": "$request_method", "http_referrer": "$http_referer", "http_user_agent": "$http_user_agent", "redirect_location": "$redirect_location" }'
+  log-format-upstream: '{"time": "$time_iso8601", "request_id": "$req_id", "remote_user": "$remote_user", "remote_addr_masked": "$remote_addr_masked", "bytes_sent": $bytes_sent, "request_time": $request_time, "status": $status, "host": "$host", "request_proto": "$server_protocol", "path": "$uri", "request_query": "$args", "request_length": $request_length, "duration": $request_time,"method": "$request_method", "http_referrer": "$http_referer", "http_user_agent": "$http_user_agent", "redirect_location": "$redirect_location" }'
   plugins: "redirect_location"
   location-snippet: |
     set $redirect_location '';
+  server-snippet: |
+    set_by_lua_block $remote_addr_masked {
+      local bit = require("bit")
+
+      local hval = 2166136261
+      local rem_addr = ngx.var.remote_addr
+
+      for w in rem_addr:gmatch(".") do
+        hval = bit.bxor(hval,string.byte(w))
+        hval = hval + bit.lshift(hval,1) + bit.lshift(hval,4) + bit.lshift(hval,7) + bit.lshift(hval,8) + bit.lshift(hval,24)
+      end
+      if hval < 0 then
+        hval = bit.bnot(hval)
+      end
+      local octet1 = bit.band(bit.rshift(hval,24), 255)
+      local octet2 = bit.band(bit.rshift(hval,16), 255)
+      local octet3 = bit.band(bit.rshift(hval,8), 255)
+      local octet4 = bit.band(hval, 255)
+      local op = octet1 .. "." .. octet2 .. "." .. octet3 .. "." .. octet4
+      return op
+    }
 kind: ConfigMap
 metadata:
   labels:
@@ -348,7 +359,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-controller
   namespace: ingress-nginx
 ---
@@ -384,7 +394,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-controller
   namespace: ingress-nginx
 spec:
@@ -417,7 +426,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-controller-admission
   namespace: ingress-nginx
 spec:
@@ -440,7 +448,6 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-controller
   namespace: ingress-nginx
 spec:
@@ -484,7 +491,7 @@ spec:
               fieldPath: metadata.namespace
         - name: LD_PRELOAD
           value: /usr/local/lib/libmimalloc.so
-        image: registry.k8s.io/ingress-nginx/controller:v1.10.1@sha256:e24f39d3eed6bcc239a56f20098878845f62baa34b9f2be2fd2c38ce9fb0f29e
+        image: registry.k8s.io/ingress-nginx/controller:v1.13.2@sha256:1f7eaeb01933e719c8a9f4acd8181e555e582330c7d50f24484fb64d2ba9b2ef
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
@@ -694,3 +701,20 @@ webhooks:
     resources:
     - ingresses
   sideEffects: None
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+  name: ingress-nginx
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: ingress-nginx
+      app.kubernetes.io/name: ingress-nginx
+  minAvailable: 1

manifests/nodered/nodered.yaml

@@ -57,7 +57,7 @@ spec:
           - name: data
             mountPath: /data
       - name: update-native-modules
-        image: nodered/node-red:3.1.10-18
+        image: nodered/node-red:4.1.0-18
         imagePullPolicy: IfNotPresent
         command:
           - bash
@@ -65,12 +65,15 @@ spec:
           - |
             cd /data
             npm rebuild
+            npm install tldts
+            npm install @atproto/api
+            npm install node-fetch
         volumeMounts:
           - name: data
             mountPath: /data
       containers:
       - name: web
-        image: nodered/node-red:3.1.10-18
+        image: nodered/node-red:4.1.0-18
         imagePullPolicy: Always
         ports:
         - containerPort: 1880

manifests/outline/outline.yaml

@@ -45,7 +45,7 @@ spec:
     spec:
       containers:
       - name: outline
-        image: outlinewiki/outline:0.77.1
+        image: outlinewiki/outline:0.87.1
         imagePullPolicy: IfNotPresent
         env:
         - name: ALLOWED_DOMAINS
@@ -69,6 +69,10 @@ spec:
           failureThreshold: 30
           timeoutSeconds: 1
           periodSeconds: 5
+        resources:
+          requests:
+            cpu: 8m
+            memory: 800Mi
         volumeMounts:
           - mountPath: /opt/outline/.env
             subPath: .env

manifests/proxy-civo/non-auth-proxy.yaml

@@ -58,7 +58,7 @@ spec:
         imagePullPolicy: Always
         env:
         - name: PROXY_DESTINATION
-          value: talos.averagemarcus.github.beta.tailscale.net
+          value: talos.tail4dfb.ts.net
         - name: PORT
           value: "8080"
         - name: TS_AUTH_KEY

manifests/redis/redis.yaml

@@ -329,7 +329,7 @@ spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: redis
-          image: docker.io/bitnami/redis:7.2.4-debian-11-r11
+          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11
           imagePullPolicy: "IfNotPresent"
           securityContext:
             runAsUser: 1001
@@ -471,7 +471,7 @@ spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: redis
-          image: docker.io/bitnami/redis:7.2.4-debian-11-r11
+          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11
           imagePullPolicy: "IfNotPresent"
           securityContext:
             runAsUser: 1001

manifests/rss/miniflux.yaml

@@ -66,7 +66,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: ghcr.io/miniflux/miniflux:2.1.3
+        image: ghcr.io/miniflux/miniflux:2.2.12
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

manifests/social-to-grist/social-to-grist.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: docker-config
-  namespace: twitter-to-airtable
+  namespace: social-to-grist
   annotations:
     kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
     kube-1password/vault: Kubernetes
@@ -14,8 +14,8 @@ data:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: twitter-to-airtable-auth
-  namespace: twitter-to-airtable
+  name: social-to-grist-auth
+  namespace: social-to-grist
   annotations:
     kube-1password: mr6spkkx7n3memkbute6ojaarm
     kube-1password/vault: Kubernetes
@@ -24,10 +24,10 @@ type: Opaque
 apiVersion: v1
 kind: Secret
 metadata:
-  name: twitter-to-airtable
-  namespace: twitter-to-airtable
+  name: social-to-grist
+  namespace: social-to-grist
   annotations:
-    kube-1password: 2fjbfe2titvezdh2ktsyhugatq
+    kube-1password: oa3ycnui3ji4lc665bifaao63q
     kube-1password/vault: Kubernetes
     kube-1password/secret-text-parse: "true"
 type: Opaque
@@ -35,8 +35,8 @@ type: Opaque
 apiVersion: v1
 kind: Service
 metadata:
-  name: twitter-to-airtable
-  namespace: twitter-to-airtable
+  name: social-to-grist
+  namespace: social-to-grist
 spec:
   type: ClusterIP
   ports:
@@ -44,22 +44,22 @@ spec:
     targetPort: auth
     name: web
   selector:
-    app: twitter-to-airtable
+    app: social-to-grist
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: twitter-to-airtable
-  namespace: twitter-to-airtable
+  name: social-to-grist
+  namespace: social-to-grist
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: twitter-to-airtable
+      app: social-to-grist
   template:
     metadata:
       labels:
-        app: twitter-to-airtable
+        app: social-to-grist
     spec:
       imagePullSecrets:
         - name: docker-config
@@ -70,7 +70,7 @@ spec:
         - --provider-display-name=Auth0
         - --upstream=http://localhost:8080
         - --http-address=$(HOST_IP):8000
-        - --redirect-url=https://twitter-to-airtable.cluster.fun/oauth2/callback
+        - --redirect-url=https://social-to-grist.cluster.fun/oauth2/callback
         - --email-domain=marcusnoble.co.uk
         - --pass-basic-auth=false
         - --pass-access-token=false
@@ -86,13 +86,13 @@ spec:
           valueFrom:
             secretKeyRef:
               key: username
-              name: twitter-to-airtable-auth
+              name: social-to-grist-auth
         - name: OAUTH2_PROXY_CLIENT_SECRET
           valueFrom:
             secretKeyRef:
               key: password
-              name: twitter-to-airtable-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+              name: social-to-grist-auth
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
         name: oauth-proxy
         ports:
         - containerPort: 8000
@@ -104,14 +104,14 @@ spec:
           requests:
             memory: 50Mi
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus-private/twitter-to-airtable:latest
+        image: rg.fr-par.scw.cloud/averagemarcus-private/social-to-grist:latest
         imagePullPolicy: Always
         env:
         - name: PORT
           value: "8080"
         envFrom:
         - secretRef:
-            name: "twitter-to-airtable"
+            name: "social-to-grist"
         ports:
         - containerPort: 8080
           name: web
@@ -125,8 +125,8 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: twitter-to-airtable
-  namespace: twitter-to-airtable
+  name: social-to-grist
+  namespace: social-to-grist
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
     kubernetes.io/ingress.class: traefik
@@ -136,16 +136,16 @@ metadata:
 spec:
   tls:
   - hosts:
-    - twitter-to-airtable.cluster.fun
-    secretName: twitter-to-airtable-ingress
+    - social-to-grist.cluster.fun
+    secretName: social-to-grist-ingress
   rules:
-  - host: twitter-to-airtable.cluster.fun
+  - host: social-to-grist.cluster.fun
     http:
       paths:
       - path: /
         pathType: ImplementationSpecific
         backend:
           service:
-            name: twitter-to-airtable
+            name: social-to-grist
             port:
               number: 80

manifests/social-to-rolodex/social-to-rolodex.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: docker-config
-  namespace: mastodon-to-airtable
+  namespace: social-to-rolodex
   annotations:
     kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
     kube-1password/vault: Kubernetes
@@ -14,8 +14,8 @@ data:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: mastodon-to-airtable-auth
-  namespace: mastodon-to-airtable
+  name: social-to-rolodex-auth
+  namespace: social-to-rolodex
   annotations:
     kube-1password: mr6spkkx7n3memkbute6ojaarm
     kube-1password/vault: Kubernetes
@@ -24,10 +24,10 @@ type: Opaque
 apiVersion: v1
 kind: Secret
 metadata:
-  name: mastodon-to-airtable
-  namespace: mastodon-to-airtable
+  name: social-to-rolodex
+  namespace: social-to-rolodex
   annotations:
-    kube-1password: kizmkmbndgu3ryrox3csev4mim
+    kube-1password: oa3ycnui3ji4lc665bifaao63q
     kube-1password/vault: Kubernetes
     kube-1password/secret-text-parse: "true"
 type: Opaque
@@ -35,8 +35,8 @@ type: Opaque
 apiVersion: v1
 kind: Service
 metadata:
-  name: mastodon-to-airtable
-  namespace: mastodon-to-airtable
+  name: social-to-rolodex
+  namespace: social-to-rolodex
 spec:
   type: ClusterIP
   ports:
@@ -44,22 +44,22 @@ spec:
     targetPort: auth
     name: web
   selector:
-    app: mastodon-to-airtable
+    app: social-to-rolodex
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: mastodon-to-airtable
-  namespace: mastodon-to-airtable
+  name: social-to-rolodex
+  namespace: social-to-rolodex
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: mastodon-to-airtable
+      app: social-to-rolodex
   template:
     metadata:
       labels:
-        app: mastodon-to-airtable
+        app: social-to-rolodex
     spec:
       imagePullSecrets:
         - name: docker-config
@@ -70,7 +70,7 @@ spec:
         - --provider-display-name=Auth0
         - --upstream=http://localhost:8080
         - --http-address=$(HOST_IP):8000
-        - --redirect-url=https://mastodon-to-airtable.cluster.fun/oauth2/callback
+        - --redirect-url=https://social-to-rolodex.cluster.fun/oauth2/callback
         - --email-domain=marcusnoble.co.uk
         - --pass-basic-auth=false
         - --pass-access-token=false
@@ -86,13 +86,13 @@ spec:
           valueFrom:
             secretKeyRef:
               key: username
-              name: mastodon-to-airtable-auth
+              name: social-to-rolodex-auth
         - name: OAUTH2_PROXY_CLIENT_SECRET
           valueFrom:
             secretKeyRef:
               key: password
-              name: mastodon-to-airtable-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+              name: social-to-rolodex-auth
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
         name: oauth-proxy
         ports:
         - containerPort: 8000
@@ -104,14 +104,14 @@ spec:
           requests:
             memory: 50Mi
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus-private/mastodon-to-airtable:latest
+        image: rg.fr-par.scw.cloud/averagemarcus-private/social-to-rolodex:latest
         imagePullPolicy: Always
         env:
         - name: PORT
           value: "8080"
         envFrom:
         - secretRef:
-            name: "mastodon-to-airtable"
+            name: "social-to-rolodex"
         ports:
         - containerPort: 8080
           name: web
@@ -125,8 +125,8 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: mastodon-to-airtable
-  namespace: mastodon-to-airtable
+  name: social-to-rolodex
+  namespace: social-to-rolodex
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
     kubernetes.io/ingress.class: traefik
@@ -136,16 +136,16 @@ metadata:
 spec:
   tls:
   - hosts:
-    - mastodon-to-airtable.cluster.fun
-    secretName: mastodon-to-airtable-ingress
+    - social-to-rolodex.cluster.fun
+    secretName: social-to-rolodex-ingress
   rules:
-  - host: mastodon-to-airtable.cluster.fun
+  - host: social-to-rolodex.cluster.fun
     http:
       paths:
       - path: /
         pathType: ImplementationSpecific
         backend:
           service:
-            name: mastodon-to-airtable
+            name: social-to-rolodex
             port:
               number: 80

manifests/starling/starling.yaml

@@ -1,106 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: docker-config
-  namespace: starling
-  annotations:
-    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: .dockerconfigjson
-type: kubernetes.io/dockerconfigjson
-data:
-  .dockerconfigjson: e30=
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: starling
-  namespace: starling
-  annotations:
-    kube-1password: ufxpki65ffgprn2upksirweeie
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: starling
-  namespace: starling
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: web
-    name: web
-  selector:
-    app: starling
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: starling
-  namespace: starling
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: starling
-  template:
-    metadata:
-      labels:
-        app: starling
-    spec:
-      imagePullSecrets:
-        - name: docker-config
-      containers:
-      - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus-private/starling:latest
-        imagePullPolicy: Always
-        env:
-        - name: PORT
-          value: "3000"
-        - name: SHARED_SECRET
-          valueFrom:  
-            secretKeyRef:
-              name: starling
-              key: SHARED_SECRET
-        - name: ACCESS_TOKEN
-          valueFrom:  
-            secretKeyRef:
-              name: starling
-              key: ACCESS_TOKEN
-        ports:
-        - containerPort: 3000
-          name: web
-        resources:
-          limits:
-            memory: 50Mi
-          requests:
-            memory: 50Mi
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: starling
-  namespace: starling
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - starling.marcusnoble.co.uk
-    secretName: starling-ingress
-  rules:
-  - host: starling.marcusnoble.co.uk
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: starling
-            port:
-              number: 80

manifests/traefik/traefik.yaml

@@ -45,7 +45,7 @@ spec:
         - --entrypoints.websecure.http.tls=true
         - --entrypoints.web.http.redirections.entrypoint.to=websecure
         - --entrypoints.web.http.redirections.entrypoint.scheme=https
-        image: rancher/mirrored-library-traefik:2.10.7
+        image: rancher/mirrored-library-traefik:2.11.29
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

manifests/wallabag/wallabag.yaml

@@ -95,7 +95,7 @@ spec:
     spec:
       initContainers:
         - name: db-migrate
-          image: "wallabag/wallabag:2.6.9"
+          image: "wallabag/wallabag:2.6.13"
           imagePullPolicy: IfNotPresent
           command:
           - /var/www/wallabag/bin/console
@@ -126,7 +126,7 @@ spec:
               value: "false"
       containers:
         - name: wallabag
-          image: "wallabag/wallabag:2.6.9"
+          image: "wallabag/wallabag:2.6.13"
           imagePullPolicy: IfNotPresent
           envFrom:
           - secretRef:

manifests/yay-or-nay/yay-or-nay.yaml

@@ -0,0 +1,94 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: yay-or-nay
+  namespace: yay-or-nay
+  annotations:
+    kube-1password: vtnx2swze7r6qepxnlepufvcbi
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: yay-or-nay
+  labels:
+    app: yay-or-nay
+    app.kubernetes.io/name: yay-or-nay
+  annotations:
+    reloader.stakater.com/search: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: yay-or-nay
+  template:
+    metadata:
+      labels:
+        app: yay-or-nay
+        app.kubernetes.io/name: yay-or-nay
+    spec:
+      containers:
+      - name: yay-or-nay
+        image: ghcr.io/mocdaniel/yay-or-nay:1.1.1
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 3000
+          name: web
+        envFrom:
+        - secretRef:
+            name: yay-or-nay
+        livenessProbe:
+          httpGet:
+            path: /
+            port: web
+          initialDelaySeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            port: web
+          initialDelaySeconds: 10
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: yay-or-nay
+  labels:
+    app.kubernetes.io/name: yay-or-nay
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: yay-or-nay
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: yay-or-nay
+  namespace: yay-or-nay
+  labels:
+    app.kubernetes.io/name: yay-or-nay
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  tls:
+    - hosts:
+        - "yay-or-nay.cluster.fun"
+      secretName: "yay-or-nay-ingress"
+  rules:
+    - host: "yay-or-nay.cluster.fun"
+      http:
+        paths:
+          - path: "/"
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: yay-or-nay
+                port:
+                  name: web