Update nextcloud:35.0.2-apache Docker digest to 786c102

Reviewed-on: #841

manifests/_apps/auth-proxy.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: auth-proxy
+  name: cluster-fun-auth-proxy
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: auth-proxy
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/auth-proxy
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/base64.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: base64
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/base64
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/blackhole.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: blackhole
+  name: cluster-fun-blackhole
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: kube-system
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/blackhole
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/blog.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: blog
+  name: cluster-fun-blog
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: blog
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/blog
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,8 +22,5 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+
 ---

manifests/_apps/bsky-screenshot.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: bsky-screenshot
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: bsky-screenshot
+    name: cluster-fun (v2)
+  source:
+    path: manifests/bsky-screenshot
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data

manifests/_apps/cel-tester.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: cel-tester
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/cel-tester
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/certmanager_chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cert-manager
+  name: cluster-fun-cert-manager-issuer
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: cert-manager
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/certmanager_chart
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -24,7 +24,7 @@ spec:
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cert-manager-civo
+  name: cluster-fun-cert-manager-chart
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -32,34 +32,10 @@ spec:
   project: cluster.fun
   destination:
     namespace: cert-manager
-    name: civo
-  source:
-    path: manifests/certmanager-civo
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
----
-
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cert-manager-cert-manager
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: cert-manager
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     repoURL: 'https://charts.jetstack.io'
-    targetRevision: 1.11.0
+    targetRevision: v1.21.3
     chart: cert-manager
     helm:
       version: v3

manifests/_apps/civo-versions.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: civo-versions
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/civo-versions
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/cors-proxy.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: cors-proxy
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/cors-proxy
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/cv.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: cv
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/cv
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/dashboard.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: dashboard
+  name: cluster-fun-dashboard
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: dashboard
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/dashboard
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -26,4 +26,5 @@ spec:
     kind: Deployment
     jqPathExpressions:
     - .spec.template.spec.containers[]?.image
+
 ---

manifests/_apps/devstats-viewer.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-fun-devstats-viewer
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: devstats-viewer
+    name: cluster-fun (v2)
+  source:
+    path: manifests/devstats-viewer
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated: {}
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+
+---

manifests/_apps/feed-fetcher.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: feed-fetcher
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/feed-fetcher
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/git-sync.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: git-sync
+  name: cluster-fun-git-sync
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: git-sync
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/git-sync
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+---

manifests/_apps/gitea.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: gitea
+  name: cluster-fun-gitea
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: gitea
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/gitea
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+---

manifests/_apps/goldilocks.yaml

@@ -0,0 +1,35 @@
+
+# apiVersion: argoproj.io/v1alpha1
+# kind: Application
+# metadata:
+#   name: cluster-fun-goldilocks
+#   namespace: argocd
+#   finalizers:
+#   - resources-finalizer.argocd.argoproj.io
+# spec:
+#   project: cluster.fun
+#   destination:
+#     namespace: goldilocks
+#     name: cluster-fun (v2)
+#   source:
+#     repoURL: 'https://charts.fairwinds.com/stable'
+#     targetRevision: 10.1.0
+#     chart: goldilocks
+#     helm:
+#       version: v3
+#       values: |-
+#         vpa:
+#           enabled: true
+#         controller:
+#           flags:
+#             on-by-default: true
+#         dashboard:
+#           flags:
+#             on-by-default: true
+#           replicaCount: 1
+#   syncPolicy:
+#     automated: {}
+#     syncOptions:
+#       - CreateNamespace=true
+
+# ---

manifests/_apps/goplayground.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: goplayground
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/goplayground
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/grist.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-fun-grist
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: grist
+    name: cluster-fun (v2)
+  source:
+    path: manifests/grist
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+---

manifests/_apps/homelab-accesible-check.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-fun-homelab-accessible-check
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: homelab-accessible-check
+    name: cluster-fun (v2)
+  source:
+    path: manifests/homelab-accessible-check
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+
+---

manifests/_apps/link.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: link
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/link
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/marcusnoble.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: marcusnoble
+  name: cluster-fun-marcusnoble
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: marcusnoble
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/marcusnoble
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,8 +22,5 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+
 ---

manifests/_apps/mastodon-digest.yaml

@@ -1,28 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: mastodon-digest
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: mastodon-digest
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/mastodon-digest
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image

manifests/_apps/mastodon-to-airtable.yaml

@@ -1,28 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: mastodon-to-airtable
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: mastodon-to-airtable
-    name: civo
-  source:
-    path: manifests/mastodon-to-airtable
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image

manifests/_apps/mazanoke.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: skooner
+  name: mazanoke
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: skooner
-    name: cluster-fun (scaleway)
+    namespace: mazanoke
+    name: cluster-fun (v2)
   source:
-    path: manifests/skooner
+    path: manifests/mazanoke
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+

manifests/_apps/mealie.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: mealie
+  name: cluster-fun-mealie
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: mealie
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/mealie
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+---

manifests/_apps/monitoring.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: monitoring
+  name: cluster-fun-monitoring
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: monitoring
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/monitoring
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/nextcloud_chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: nextcloud
+  name: cluster-fun-nextcloud
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: nextcloud
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/nextcloud_chart
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+---

manifests/_apps/nginx-lb.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: nginx-lb
+  name: cluster-fun-nginx-lb
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: kube-system
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/nginx-lb
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/nodered.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: nodered
+  name: cluster-fun-nodered
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: node-red
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/nodered
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+---

manifests/_apps/opengraph-image-gen.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: opengraph
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/opengraph
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/outline.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: outline
+  name: cluster-fun-outline
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: outline
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/outline
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+---

manifests/_apps/pairdrop.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: monitoring-civo
+  name: pairdrop
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: monitoring
-    name: civo
+    namespace: pairdrop
+    name: cluster-fun (v2)
   source:
-    path: manifests/monitoring-civo
+    path: manifests/pairdrop
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+

manifests/_apps/paradoxfox.yaml

@@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: paradoxfox
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: paradoxfox
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/paradoxfox
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-    - /stringData
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image

manifests/_apps/planning-poker.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: focalboard
+  name: planning-poker
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: focalboard
-    name: cluster-fun (scaleway)
+    namespace: planning-poker
+    name: cluster-fun (v2)
   source:
-    path: manifests/focalboard
+    path: manifests/planning-poker
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+

manifests/_apps/priority-classes.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-fun-priority-classes
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: kube-system
+    name: cluster-fun (v2)
+  source:
+    path: manifests/priority-classes
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+---

manifests/_apps/qr.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: qr
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/qr
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/redis.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: redis
+  name: cluster-fun-redis
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: redis
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/redis
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+---

manifests/_apps/reloader.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: reloader
+  name: cluster-fun-reloader
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,10 +9,10 @@ spec:
   project: cluster.fun
   destination:
     namespace: kube-system
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     repoURL: 'https://stakater.github.io/stakater-charts'
-    targetRevision: v0.0.89
+    targetRevision: v0.0.129
     chart: reloader
   syncPolicy:
     automated: {}

manifests/_apps/rss.yaml

@@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: rss
+  name: cluster-fun-rss
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: rss
-    name: cluster-fun (scaleway)
+    name: cluster-fun (v2)
   source:
     path: manifests/rss
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+---

manifests/_apps/social-to-rolodex.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: social-to-rolodex
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: social-to-rolodex
+    name: cluster-fun (v2)
+  source:
+    path: manifests/social-to-rolodex
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/sre-agent.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sre-agent
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: default
+    name: cluster-fun (v2)
+  source:
+    path: manifests/sre-agent
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/starling.yaml

@@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: starling
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: starling
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/starling
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
----

manifests/_apps/svg-to-dxf.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: svg-to-dxf
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/svg-to-dxf
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/talks.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: talks
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/talks
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/tank.yaml

@@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: tank
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: tank
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/tank
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
----

manifests/_apps/text-to-dxf.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: text-to-dxf
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/text-to-dxf
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/til.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: til
-    name: civo
+    name: cluster-fun (v2)
   source:
     path: manifests/til
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,7 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
+

manifests/_apps/trek.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: proxy-civo
+  name: trek
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: proxy-civo
-    name: civo
+    namespace: trek
+    name: cluster-fun (v2)
   source:
-    path: manifests/proxy-civo
+    path: manifests/trek
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+

manifests/_apps/tweetsvg.yaml

@@ -1,28 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: tweetsvg
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: tweetsvg
-    name: civo
-  source:
-    path: manifests/tweetsvg
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image

manifests/_apps/twitter-profile-pic.yaml

@@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: twitter-profile-pic
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: twitter-profile-pic
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/twitter-profile-pic
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image
----

manifests/_apps/twitter-to-airtable.yaml

@@ -1,28 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: twitter-to-airtable
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: twitter-to-airtable
-    name: civo
-  source:
-    path: manifests/twitter-to-airtable
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .spec.template.spec.containers[]?.image

manifests/_apps/url-to-grist.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: url-to-grist
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: cloudnative-now
+    name: cluster-fun (v2)
+  source:
+    path: manifests/url-to-grist
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated: {}
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+---

manifests/_apps/vert.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: traefik-civo
+  name: vert
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: kube-system
-    name: civo
+    namespace: vert
+    name: cluster-fun (v2)
   source:
-    path: manifests/traefik
+    path: manifests/vert
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,3 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+

manifests/_apps/wallabag.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: wallabag
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: wallabag
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/wallabag
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-    automated: {}
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data

manifests/_apps/weave-net.yaml

@@ -1,18 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: weave-net
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: kube-system
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/weave-net
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}

manifests/_apps/yay-or-nay.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: matrix
+  name: yay-or-nay
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: chat
-    name: cluster-fun (scaleway)
+    namespace: yay-or-nay
+    name: cluster-fun (v2)
   source:
-    path: manifests/matrix_chart
+    path: manifests/yay-or-nay
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,5 +22,4 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
----
+---

manifests/auth-proxy/auth-ingress.yaml

@@ -23,8 +23,13 @@ spec:
     - sonarr.cluster.fun
     - lidarr.cluster.fun
     - prowlarr.cluster.fun
+    - mylarr.cluster.fun
     - transmission.cluster.fun
     - tekton.cluster.fun
+    - changedetection.cluster.fun
+    - grafana.cluster.fun
+    - podgrab.cluster.fun
+    - stablediffusion.cluster.fun
     secretName: auth-proxy-ingress
   rules:
   - host: downloads.cluster.fun
@@ -34,9 +39,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: argo.cluster.fun
     http:
       paths:
@@ -44,9 +49,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: code.cluster.fun
     http:
       paths:
@@ -54,9 +59,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: jackett.cluster.fun
     http:
       paths:
@@ -64,9 +69,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: printer.cluster.fun
     http:
       paths:
@@ -74,9 +79,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: ender3pro.printer.cluster.fun
     http:
       paths:
@@ -84,9 +89,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: flsunq5.printer.cluster.fun
     http:
       paths:
@@ -94,9 +99,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: elegoomars2.printer.cluster.fun
     http:
       paths:
@@ -104,9 +109,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: radarr.cluster.fun
     http:
       paths:
@@ -114,9 +119,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: readarr.cluster.fun
     http:
       paths:
@@ -124,9 +129,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: sonarr.cluster.fun
     http:
       paths:
@@ -134,9 +139,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: lidarr.cluster.fun
     http:
       paths:
@@ -144,9 +149,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: prowlarr.cluster.fun
     http:
       paths:
@@ -154,9 +159,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: transmission.cluster.fun
     http:
       paths:
@@ -164,9 +169,9 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
   - host: tekton.cluster.fun
     http:
       paths:
@@ -174,6 +179,56 @@ spec:
         pathType: ImplementationSpecific
         backend:
           service:
-            name: auth-proxy
+            name: tailscale-proxy
             port:
-              name: http
+              name: auth
+  - host: changedetection.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: auth
+  - host: grafana.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: auth
+  - host: podgrab.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: auth
+  - host: mylarr.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: auth
+  - host: stablediffusion.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: auth

manifests/auth-proxy/auth-proxy.yaml

@@ -1,202 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: auth-proxy
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: auth-proxy
-  namespace: auth-proxy
-  annotations:
-    kube-1password: mr6spkkx7n3memkbute6ojaarm
-    kube-1password/vault: Kubernetes
-type: Opaque
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: tailscale-auth
-  namespace: auth-proxy
-  annotations:
-    kube-1password: 2cqycmsgv5r7vcyvjpblcl2l4y
-    kube-1password/vault: Kubernetes
-type: Opaque
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: tailscale-auth-proxy
-type: Opaque
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tailscale-auth-proxy
-  labels:
-    app.kubernetes.io/name: tailscale
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: tailscale-auth-proxy
-  labels:
-    app.kubernetes.io/name: tailscale
-subjects:
-- kind: ServiceAccount
-  name: "tailscale-auth-proxy"
-roleRef:
-  kind: Role
-  name: tailscale-auth-proxy
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: tailscale-auth-proxy
-  labels:
-    app.kubernetes.io/name: tailscale
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["create"]
-- apiGroups: [""]
-  resourceNames: ["tailscale-auth-proxy"]
-  resources: ["secrets"]
-  verbs: ["get", "update"]
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: auth-proxy
-  namespace: auth-proxy
-  labels:
-    app: auth-proxy
-  annotations:
-    secret.reloader.stakater.com/reload: "tailscale-auth"
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: auth-proxy
-  template:
-    metadata:
-      labels:
-        app: auth-proxy
-    spec:
-      serviceAccountName: tailscale-auth-proxy
-      dnsPolicy: ClusterFirst
-      dnsConfig:
-        nameservers:
-          - 100.100.100.100
-      initContainers:
-      - name: sysctler
-        image: busybox
-        securityContext:
-          privileged: true
-        command: ["/bin/sh"]
-        args:
-          - -c
-          - |
-            sysctl -w net.ipv4.ip_forward=1
-            sysctl -w net.ipv6.conf.all.forwarding=1
-            sysctl -w net.ipv6.conf.all.disable_ipv6=0
-        resources:
-          requests:
-            cpu: 1m
-            memory: 1Mi
-      containers:
-      - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
-        args:
-        - --cookie-secure=false
-        - --provider=oidc
-        - --provider-display-name=Auth0
-        - --upstream=http://talos.averagemarcus.github.beta.tailscale.net
-        - --http-address=0.0.0.0:8080
-        - --email-domain=*
-        - --pass-basic-auth=false
-        - --pass-access-token=false
-        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
-        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQNFT
-        - --cookie-expire=336h0m0s
-        env:
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: OAUTH2_PROXY_CLIENT_ID
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: auth-proxy
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: auth-proxy
-        ports:
-        - containerPort: 8080
-          protocol: TCP
-        resources:
-          limits:
-            memory: 50Mi
-          requests:
-            memory: 50Mi
-      - name: tailscale
-        image: ghcr.io/tailscale/tailscale:v1.56
-        imagePullPolicy: Always
-        env:
-        - name: TS_AUTH_KEY
-          valueFrom:
-            secretKeyRef:
-              name: tailscale-auth
-              key: password
-        - name: TS_KUBE_SECRET
-          value: tailscale-auth-proxy
-        - name: TS_ACCEPT_DNS
-          value: "true"
-        - name: TS_EXTRA_ARGS
-          value: "--hostname=auth-proxy-oauth2"
-        securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
-        command:
-        - sh
-        - -c
-        - |
-          export PATH=$PATH:/tailscale/bin
-          if [[ ! -d /dev/net ]]; then mkdir -p /dev/net; fi
-          if [[ ! -c /dev/net/tun ]]; then mknod /dev/net/tun c 10 200; fi
-          echo "Starting tailscaled"
-          tailscaled --state=kube:${TS_KUBE_SECRET} --socket=/tmp/tailscaled.sock &
-          PID=$!
-          echo "Running tailscale up"
-          tailscale --socket=/tmp/tailscaled.sock up \
-            --accept-dns=${TS_ACCEPT_DNS} \
-            --authkey=${TS_AUTH_KEY} \
-            ${TS_EXTRA_ARGS}
-          echo "Re-enabling incoming traffic from the cluster"
-          wait ${PID}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: auth-proxy
-  namespace: auth-proxy
-  labels:
-    app: auth-proxy
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: auth-proxy
-  type: ClusterIP

manifests/auth-proxy/internal-proxy.yaml

@@ -1,230 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: host-mappings
-  namespace: auth-proxy
-  labels:
-    app: proxy
-data:
-  mapping.json: |
-    {
-      "tekton-el.auth-proxy.svc": "tekton-el.cluster.local",
-      "vmcluster.auth-proxy.svc": "vmcluster.cluster.local",
-      "loki.auth-proxy.svc": "loki-write.cluster.local",
-      "loki.auth-proxy.svc:80": "loki-write.cluster.local",
-      "loki-distributed.auth-proxy.svc": "loki-loki.cluster.local",
-      "loki-distributed.auth-proxy.svc:80": "loki-loki.cluster.local"
-    }
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: tailscale-internal-proxy
-  namespace: auth-proxy
-type: Opaque
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tailscale-internal-proxy
-  labels:
-    app.kubernetes.io/name: tailscale
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: tailscale-internal-proxy
-  labels:
-    app.kubernetes.io/name: tailscale
-subjects:
-- kind: ServiceAccount
-  name: "tailscale-internal-proxy"
-roleRef:
-  kind: Role
-  name: tailscale-internal-proxy
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: tailscale-internal-proxy
-  labels:
-    app.kubernetes.io/name: tailscale
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["create"]
-- apiGroups: [""]
-  resourceNames: ["tailscale-internal-proxy"]
-  resources: ["secrets"]
-  verbs: ["get", "update"]
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: internal-proxy
-  namespace: auth-proxy
-  labels:
-    app: internal-proxy
-  annotations:
-    configmap.reloader.stakater.com/reload: "host-mappings"
-    secret.reloader.stakater.com/reload: "tailscale-auth"
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: internal-proxy
-  template:
-    metadata:
-      labels:
-        app: internal-proxy
-    spec:
-      serviceAccountName: tailscale-internal-proxy
-      dnsPolicy: ClusterFirst
-      dnsConfig:
-        nameservers:
-          - 100.100.100.100
-      containers:
-      - name: proxy
-        image: rg.fr-par.scw.cloud/averagemarcus/proxy:latest
-        imagePullPolicy: Always
-        env:
-        - name: PROXY_DESTINATION
-          value: talos.averagemarcus.github.beta.tailscale.net
-        - name: PORT
-          value: "8080"
-        ports:
-        - containerPort: 8080
-          protocol: TCP
-        volumeMounts:
-        - name: host-mappings
-          mountPath: /config/
-      - name: tailscale
-        image: ghcr.io/tailscale/tailscale:v1.56
-        imagePullPolicy: Always
-        tty: true
-        env:
-        - name: TS_AUTH_KEY
-          valueFrom:
-            secretKeyRef:
-              name: tailscale-auth
-              key: password
-        - name: TS_KUBE_SECRET
-          value: tailscale-internal-proxy
-        - name: TS_ACCEPT_DNS
-          value: "true"
-        - name: TS_EXTRA_ARGS
-          value: "--hostname=auth-proxy-internal-proxy"
-        securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
-        command:
-        - sh
-        - -c
-        - |
-          export PATH=$PATH:/tailscale/bin
-          if [[ ! -d /dev/net ]]; then mkdir -p /dev/net; fi
-          if [[ ! -c /dev/net/tun ]]; then mknod /dev/net/tun c 10 200; fi
-          echo "Starting tailscaled"
-          tailscaled --state=kube:${TS_KUBE_SECRET} --socket=/tmp/tailscaled.sock &
-          PID=$!
-          echo "Running tailscale up"
-          tailscale --socket=/tmp/tailscaled.sock up \
-            --accept-dns=${TS_ACCEPT_DNS} \
-            --authkey=${TS_AUTH_KEY} \
-            ${TS_EXTRA_ARGS}
-          echo "Re-enabling incoming traffic from the cluster"
-          wait ${PID}
-      volumes:
-      - name: host-mappings
-        configMap:
-          name: host-mappings
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: tekton-el
-  namespace: auth-proxy
-  labels:
-    app: internal-proxy
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: internal-proxy
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: loki
-  namespace: auth-proxy
-  labels:
-    app: internal-proxy
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: internal-proxy
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: loki-distributed
-  namespace: auth-proxy
-  labels:
-    app: internal-proxy
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: internal-proxy
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: prometheus
-  namespace: auth-proxy
-  labels:
-    app: internal-proxy
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: internal-proxy
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: vmcluster
-  namespace: auth-proxy
-  labels:
-    app: internal-proxy
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: internal-proxy
-  type: ClusterIP
----

manifests/auth-proxy/internal-services.yaml

@@ -0,0 +1,85 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tekton-el
+  namespace: auth-proxy
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: loki
+  namespace: auth-proxy
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: loki-distributed
+  namespace: auth-proxy
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: prometheus
+  namespace: auth-proxy
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: vmcluster
+  namespace: auth-proxy
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---

manifests/auth-proxy/namespace.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth-proxy
+---

manifests/auth-proxy/non-auth-ingress.yaml

@@ -0,0 +1,73 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: non-auth-proxy
+  namespace: auth-proxy
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-body-size: 25m
+    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - hello-world.cluster.fun
+    - ombi.cluster.fun
+    - bsky-feeds.cluster.fun
+    - ai.cluster.fun
+    - hermes-hooks.cluster.fun
+    secretName: non-auth-proxy-ingress
+  rules:
+  - host: hello-world.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth
+  - host: ombi.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth
+  - host: bsky-feeds.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth
+  - host: ai.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth
+  - host: hermes-hooks.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth

manifests/auth-proxy/non-auth-proxy.yaml

@@ -1,213 +0,0 @@
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: tailscale-non-auth-proxy
-  namespace: auth-proxy
-type: Opaque
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tailscale-non-auth-proxy
-  labels:
-    app.kubernetes.io/name: tailscale
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: tailscale-non-auth-proxy
-  labels:
-    app.kubernetes.io/name: tailscale
-subjects:
-- kind: ServiceAccount
-  name: "tailscale-non-auth-proxy"
-roleRef:
-  kind: Role
-  name: tailscale-non-auth-proxy
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: tailscale-non-auth-proxy
-  labels:
-    app.kubernetes.io/name: tailscale
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["create"]
-- apiGroups: [""]
-  resourceNames: ["tailscale-non-auth-proxy"]
-  resources: ["secrets"]
-  verbs: ["get", "update"]
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: non-auth-proxy
-  namespace: auth-proxy
-  labels:
-    app: non-auth-proxy
-  annotations:
-    secret.reloader.stakater.com/reload: "tailscale-auth"
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: non-auth-proxy
-  template:
-    metadata:
-      labels:
-        app: non-auth-proxy
-    spec:
-      serviceAccountName: tailscale-non-auth-proxy
-      dnsPolicy: ClusterFirst
-      dnsConfig:
-        nameservers:
-          - 100.100.100.100
-      containers:
-      - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
-        args:
-        - --cookie-secure=false
-        - --provider=oidc
-        - --provider-display-name=Auth0
-        - --upstream=http://talos.averagemarcus.github.beta.tailscale.net
-        - --http-address=0.0.0.0:8080
-        - --email-domain=*
-        - --pass-basic-auth=false
-        - --pass-access-token=false
-        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
-        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQNFT
-        - --cookie-expire=336h0m0s
-        - --trusted-ip=0.0.0.0/0
-        env:
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: OAUTH2_PROXY_CLIENT_ID
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: auth-proxy
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: auth-proxy
-        ports:
-        - containerPort: 8080
-          protocol: TCP
-        resources:
-          limits:
-            memory: 50Mi
-          requests:
-            memory: 50Mi
-      - name: tailscale
-        image: ghcr.io/tailscale/tailscale:v1.56
-        imagePullPolicy: Always
-        tty: true
-        env:
-        - name: TS_AUTH_KEY
-          valueFrom:
-            secretKeyRef:
-              name: tailscale-auth
-              key: password
-        - name: TS_KUBE_SECRET
-          value: tailscale-non-auth-proxy
-        - name: TS_ACCEPT_DNS
-          value: "true"
-        - name: TS_EXTRA_ARGS
-          value: "--hostname=non-auth-proxy"
-        securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
-        command:
-        - sh
-        - -c
-        - |
-          export PATH=$PATH:/tailscale/bin
-          if [[ ! -d /dev/net ]]; then mkdir -p /dev/net; fi
-          if [[ ! -c /dev/net/tun ]]; then mknod /dev/net/tun c 10 200; fi
-          echo "Starting tailscaled"
-          tailscaled --state=kube:${TS_KUBE_SECRET} --socket=/tmp/tailscaled.sock &
-          PID=$!
-          echo "Running tailscale up"
-          tailscale --socket=/tmp/tailscaled.sock up \
-            --accept-dns=${TS_ACCEPT_DNS} \
-            --authkey=${TS_AUTH_KEY} \
-            ${TS_EXTRA_ARGS}
-          echo "Re-enabling incoming traffic from the cluster"
-          wait ${PID}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: non-auth-proxy
-  namespace: auth-proxy
-  labels:
-    app: non-auth-proxy
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: non-auth-proxy
-  type: ClusterIP
----
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: non-auth-proxy
-  namespace: auth-proxy
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    # - home.cluster.fun
-    - tasks.cluster.fun
-    - api.tasks.cluster.fun
-    secretName: non-auth-proxy-ingress
-  rules:
-  # - host: home.cluster.fun
-  #   http:
-  #     paths:
-  #     - path: /
-  #       pathType: ImplementationSpecific
-  #       backend:
-  #         service:
-  #           name: non-auth-proxy
-  #           port:
-  #             name: http
-  - host: tasks.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: non-auth-proxy
-            port:
-              name: http
-  - host: api.tasks.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: non-auth-proxy
-            port:
-              name: http

manifests/auth-proxy/proxy.yaml

@@ -0,0 +1,133 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: host-mappings
+  namespace: auth-proxy
+  labels:
+    app: proxy
+data:
+  mapping.json: |
+    {
+      "tekton-el.auth-proxy.svc": "tekton-el.cluster.local",
+      "vmcluster.auth-proxy.svc": "vmcluster.cluster.local",
+      "loki.auth-proxy.svc": "loki-write.cluster.local",
+      "loki.auth-proxy.svc:80": "loki-write.cluster.local",
+      "loki-distributed.auth-proxy.svc": "loki-loki.cluster.local",
+      "loki-distributed.auth-proxy.svc:80": "loki-loki.cluster.local"
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: internal-proxy
+  namespace: auth-proxy
+  labels:
+    app: internal-proxy
+  annotations:
+    configmap.reloader.stakater.com/reload: "host-mappings"
+    secret.reloader.stakater.com/reload: "tailscale-auth"
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: internal-proxy
+  template:
+    metadata:
+      labels:
+        app: internal-proxy
+    spec:
+      priorityClassName: critical
+      serviceAccountName: default
+      dnsPolicy: ClusterFirst
+      dnsConfig:
+        nameservers:
+          - 100.100.100.100
+      containers:
+      - name: proxy
+        image: rg.fr-par.scw.cloud/averagemarcus/proxy:latest@sha256:2a401eec859bf665e75bbb737b3b1709cd1fa74576e4ba8c7daeb63d8b3e8d51
+        imagePullPolicy: Always
+        env:
+        - name: PROXY_DESTINATION
+          value: talos.tail4dfb.ts.net
+        - name: PORT
+          value: "8080"
+        - name: TS_AUTH_KEY
+          valueFrom:
+            secretKeyRef:
+              name: tailscale-auth
+              key: password
+        - name: TS_HOSTNAME
+          value: auth-proxy-internal-proxy
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+        volumeMounts:
+        - name: host-mappings
+          mountPath: /config/
+
+      - name: oauth-proxy
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
+        args:
+        - --cookie-secure=false
+        - --provider=oidc
+        - --provider-display-name=Auth0
+        - --upstream=http://localhost:8080
+        - --http-address=0.0.0.0:8181
+        - --email-domain=*
+        - --pass-basic-auth=false
+        - --pass-access-token=false
+        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
+        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQNFT
+        - --cookie-expire=336h0m0s
+        env:
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: OAUTH2_PROXY_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: auth-proxy
+        - name: OAUTH2_PROXY_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: auth-proxy
+        ports:
+        - containerPort: 8181
+          protocol: TCP
+        resources:
+          limits:
+            memory: 80Mi
+          requests:
+            memory: 80Mi
+      volumes:
+      - name: host-mappings
+        configMap:
+          name: host-mappings
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tailscale-proxy
+  namespace: auth-proxy
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: non-auth
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  - name: auth
+    port: 81
+    protocol: TCP
+    targetPort: 8181
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---

manifests/auth-proxy/secrets.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: auth-proxy
+  namespace: auth-proxy
+  annotations:
+    kube-1password: mr6spkkx7n3memkbute6ojaarm
+    kube-1password/vault: Kubernetes
+type: Opaque
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: tailscale-auth
+  namespace: auth-proxy
+  annotations:
+    kube-1password: 2cqycmsgv5r7vcyvjpblcl2l4y
+    kube-1password/vault: Kubernetes
+type: Opaque
+---

manifests/base64/base64.yaml

@@ -29,9 +29,10 @@ spec:
     spec:
       imagePullSecrets:
         - name: docker-config
+      priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/base64:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/base64:latest@sha256:1ec2b770a5ffe986bdfbf24094ed945191bd7b9dd27a7b3212af92a3dfcea032
         imagePullPolicy: Always
         ports:
         - containerPort: 80
@@ -49,11 +50,10 @@ metadata:
   namespace: base64
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
-    kubernetes.io/ingress.class: traefik
-    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
+  ingressClassName: nginx
   tls:
   - hosts:
     - base64.cluster.fun

manifests/blackhole/blackhole.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: black-hole
-        image: averagemarcus/black-hole:latest
+        image: averagemarcus/black-hole:latest@sha256:1e9cb8396f67aeb25a9eaaf14b369a53a7b300ae465859f10d9f0f88ef3023e1
         imagePullPolicy: Always
         ports:
         - containerPort: 9090

manifests/blog/blog.yaml

@@ -27,9 +27,18 @@ spec:
       labels:
         app: blog
     spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: blog
+                topologyKey: kubernetes.io/hostname
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/blog:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/blog:latest@sha256:d40aa67a51924a89ad0ac6f7387a63f2f41e9bff7b5e4c6f7675cd43354b0c28
         imagePullPolicy: Always
         ports:
         - containerPort: 8000

manifests/bsky-screenshot/bsky-screenshot.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: bsky-screenshot
+  namespace: bsky-screenshot
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: bsky-screenshot
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bsky-screenshot
+  namespace: bsky-screenshot
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: bsky-screenshot
+  template:
+    metadata:
+      labels:
+        app: bsky-screenshot
+    spec:
+      containers:
+      - name: web
+        image: rg.fr-par.scw.cloud/averagemarcus/bsky-screenshot:latest@sha256:0fae863fc3123f73aa6268a125d5bf2c2122c8a3f2aedaf129462e668e56ab23
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 105Mi
+          requests:
+            memory: 105Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: bsky-screenshot
+  namespace: bsky-screenshot
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - bsky-screenshot.cluster.fun
+    secretName: bsky-screenshot-ingress
+  rules:
+  - host: bsky-screenshot.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: bsky-screenshot
+            port:
+              number: 80
+

manifests/cel-tester/cel-tester.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/cel-tester:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/cel-tester:latest@sha256:caf9044a19fa0e14f92232f68c1fe808249580d33619ea3706ff935bd2853559
         imagePullPolicy: Always
         ports:
         - containerPort: 80
@@ -47,11 +47,10 @@ metadata:
   namespace: cel-tester
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
-    kubernetes.io/ingress.class: traefik
-    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
+  ingressClassName: nginx
   tls:
   - hosts:
     - cel-tester.cluster.fun

manifests/certmanager-civo/certmanager_chart.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cert-manager
-  labels:
-    certmanager.k8s.io/disable-validation: "true"
-
----
-
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    email: letsencrypt@marcusnoble.co.uk
-    privateKeySecretRef:
-      name: letsencrypt
-    solvers:
-    - http01:
-        ingress:
-          class: traefik

manifests/civo-versions/civo-versions.yaml

@@ -38,9 +38,10 @@ spec:
       labels:
         app: civo-versions
     spec:
+      priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/civo-versions:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/civo-versions:latest@sha256:90585c61b82e124f9179b60fc8231247e3b37cab76fd7c0185aeb4a4276a0ab4
         imagePullPolicy: Always
         ports:
         - containerPort: 8000
@@ -66,11 +67,10 @@ metadata:
   namespace: civo-versions
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
-    kubernetes.io/ingress.class: traefik
-    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
+  ingressClassName: nginx
   tls:
   - hosts:
     - civo-versions.cluster.fun

manifests/cors-proxy/cors-proxy.yaml

@@ -18,7 +18,7 @@ metadata:
   name: cors-proxy
   namespace: cors-proxy
 spec:
-  replicas: 1
+  replicas: 2
   selector:
     matchLabels:
       app: cors-proxy
@@ -29,11 +29,19 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/cors-proxy:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/cors-proxy:latest@sha256:306783c26392f92af7e34d173493b0f8d6fd7623421d16a02fad26857317aeec
         imagePullPolicy: Always
         ports:
         - containerPort: 8000
           name: web
+        env:
+        - name: ALLOWLIST
+          value: cdn.bsky.app,en.wikipedia.org
+        resources:
+          requests:
+            memory: 184M
+          limits:
+            memory: 184M
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/cv/cv.yaml

@@ -62,11 +62,10 @@ metadata:
   namespace: cv
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
-    kubernetes.io/ingress.class: traefik
-    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
+  ingressClassName: nginx
   tls:
   - hosts:
     - cv.marcusnoble.co.uk

manifests/dashboard/dashboard.yaml

@@ -81,7 +81,7 @@ spec:
             secretKeyRef:
               key: password
               name: dashboard-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/devstats-viewer/devstats-viewer.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: devstats-viewer
+  namespace: devstats-viewer
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: devstats-viewer
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: devstats-viewer
+  namespace: devstats-viewer
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: devstats-viewer
+  template:
+    metadata:
+      labels:
+        app: devstats-viewer
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      containers:
+      - name: web
+        image: rg.fr-par.scw.cloud/averagemarcus/devstats-viewer:latest@sha256:ecf19a3dd9ecc16f78d0a276aa977a7a8ee17635d5ee68ea86e5ee0a2e1ebe48
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 10Mi
+          requests:
+            memory: 10Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: devstats-viewer
+  namespace: devstats-viewer
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - devstats.cluster.fun
+    secretName: devstats-viewer-ingress
+  rules:
+  - host: devstats.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: devstats-viewer
+            port:
+              number: 80

manifests/feed-fetcher/feed-fetcher.yaml

@@ -29,11 +29,16 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/feed-fetcher:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/feed-fetcher:latest@sha256:fe79408673dda5c73ed05e38cac441cbbbebd264548318f1e4701751c6a32b35
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
           name: web
+        resources:
+          requests:
+            memory: 80M
+          limits:
+            memory: 80M
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -42,11 +47,10 @@ metadata:
   namespace: feed-fetcher
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
-    kubernetes.io/ingress.class: traefik
-    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
+  ingressClassName: nginx
   tls:
   - hosts:
     - feed-fetcher.cluster.fun

manifests/focalboard/focalboard.yaml

@@ -1,116 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: focalboard
-  namespace: focalboard
-  labels:
-    app.kubernetes.io/name: focalboard
-  annotations:
-    kube-1password: dpszqviipd5tkls5bajzeb56ui
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: config.json
-type: Opaque
-
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: focalboard
-  namespace: focalboard
-  labels:
-    app.kubernetes.io/name: focalboard
-  annotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/metrics"
-    prometheus.io/port: "9000"
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: web
-    name: web
-  selector:
-    app.kubernetes.io/name: focalboard
----
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: focalboard
-  namespace: focalboard
-  labels:
-    app.kubernetes.io/name: focalboard
-  annotations:
-    secret.reloader.stakater.com/reload: "focalboard"
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: focalboard
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: focalboard
-    spec:
-      containers:
-      - name: focalboard
-        image: mattermost/focalboard:7.11.4
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 8000
-          name: web
-        env:
-        - name: FOCALBOARD_PORT
-          value: "8000"
-        - name: VIRTUAL_HOST
-          value: "localhost"
-        - name: VIRTUAL_PORT
-          value: "8000"
-        - name: VIRTUAL_PROTO
-          value: "http"
-        volumeMounts:
-        - name: data
-          mountPath: /data
-        - name: config
-          mountPath: /opt/focalboard/config.json
-          subPath: config.json
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: focalboard
-      - name: config
-        secret:
-          secretName: focalboard
-
----
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: focalboard
-  namespace: focalboard
-  labels:
-    app.kubernetes.io/name: focalboard
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-spec:
-  tls:
-    - hosts:
-      - focalboard.cluster.fun
-      secretName: focalboard-ingress
-  rules:
-  - host: focalboard.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: focalboard
-            port:
-              number: 80

manifests/focalboard/pvs.yaml

@@ -1,41 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  annotations:
-    pv.kubernetes.io/provisioned-by: csi.scaleway.com
-  finalizers:
-  - kubernetes.io/pv-protection
-  - external-attacher/csi-scaleway-com
-  name: pvc-df17f08f-a966-40a0-bc72-26cf2adb89a1
-spec:
-  accessModes:
-  - ReadWriteOnce
-  capacity:
-    storage: 2Gi
-  csi:
-    driver: csi.scaleway.com
-    fsType: ext4
-    volumeAttributes:
-      encrypted: "false"
-      storage.kubernetes.io/csiProvisionerIdentity: 1658355449315-8081-csi.scaleway.com
-    volumeHandle: fr-par-1/d823f97e-7ef0-4fb0-97ac-5a838356c355
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: scw-bssd
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: focalboard
-  namespace: focalboard
-  labels:
-    app.kubernetes.io/name: focalboard
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi
-  volumeName: pvc-df17f08f-a966-40a0-bc72-26cf2adb89a1
-
----

manifests/git-sync/git-sync.yaml

@@ -78,7 +78,7 @@ spec:
         spec:
           containers:
           - name: sync
-            image: rg.fr-par.scw.cloud/averagemarcus/git-sync:latest
+            image: rg.fr-par.scw.cloud/averagemarcus/git-sync:latest@sha256:6060f0e77e324179cf6b2136a180ceecbcc64344682154b8848434fd105323e7
             imagePullPolicy: Always
             env:
             - name: GITHUB_TOKEN

manifests/gitea/gitea.yaml

@@ -40,9 +40,10 @@ spec:
       labels:
         app: git
     spec:
+      priorityClassName: critical
       containers:
       - name: git
-        image: gitea/gitea:1.21.2
+        image: gitea/gitea:28.3.0@sha256:8967bf9deaf3c5c4adae13519436dc1b20c646ac83fe37ae810c933a1045227d
         env:
         - name: APP_NAME
           value: "Git"
@@ -66,6 +67,8 @@ spec:
           value: arc-green
         - name: ALLOWED_HOST_LIST
           value: "*"
+        - name: EGRESS_MODE
+          value: "lax"
         - name: SECRET_KEY
           valueFrom:
             secretKeyRef:
@@ -76,7 +79,7 @@ spec:
           name: web
         resources:
           requests:
-            memory: 400Mi
+            memory: 700Mi
         volumeMounts:
         - mountPath: /data
           name: git-data

manifests/gitea/pvs.yaml

@@ -1,37 +1,6 @@
 apiVersion: v1
-kind: PersistentVolume
-metadata:
-  annotations:
-    pv.kubernetes.io/provisioned-by: csi.scaleway.com
-  creationTimestamp: "2020-05-02T15:38:54Z"
-  finalizers:
-  - kubernetes.io/pv-protection
-  - external-attacher/csi-scaleway-com
-  name: pvc-02bd903f-e5ac-4c9f-a976-9fe995a352b2
-spec:
-  accessModes:
-  - ReadWriteOnce
-  capacity:
-    storage: 20Gi
-  csi:
-    driver: csi.scaleway.com
-    fsType: ext4
-    volumeAttributes:
-      storage.kubernetes.io/csiProvisionerIdentity: 1588413765965-1847-csi.scaleway.com
-    volumeHandle: fr-par-1/2ef4f017-2d41-4662-bfa4-df0dcf2085a1
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: scw-bssd-retain
-  volumeMode: Filesystem
----
-apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  annotations:
-    pv.kubernetes.io/bind-completed: "yes"
-    pv.kubernetes.io/bound-by-controller: "yes"
-    volume.beta.kubernetes.io/storage-provisioner: csi.scaleway.com
-  finalizers:
-  - kubernetes.io/pvc-protection
   labels:
     app: git
   name: git-data-git-0
@@ -42,6 +11,4 @@ spec:
   resources:
     requests:
       storage: 20Gi
-  storageClassName: scw-bssd-retain
-  volumeMode: Filesystem
-  volumeName: pvc-02bd903f-e5ac-4c9f-a976-9fe995a352b2
+  storageClassName: sbs-default-retain

manifests/goplayground/goplayground.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: x1unix/go-playground:1.13.4
+        image: x1unix/go-playground:3.0.0@sha256:4c4a9bcbc0413faaacc8eb0a425922858a55b73ab03f5359082217d5b93cc000
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 8000
@@ -47,11 +47,10 @@ metadata:
   namespace: goplayground
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
-    kubernetes.io/ingress.class: traefik
-    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
+  ingressClassName: nginx
   tls:
   - hosts:
     - go.cluster.fun

manifests/grist/grist.yaml

@@ -0,0 +1,177 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+  annotations:
+    kube-1password: bpagsbvdrwomghyeowdgauytqq
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: grist-data
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "sbs-default-retain"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8484
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: grist
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+  annotations:
+    secret.reloader.stakater.com/reload: "grist"
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: grist
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: grist
+    spec:
+      serviceAccountName: grist
+      priorityClassName: critical
+      containers:
+        - name: grist
+          image: gristlabs/grist-oss:1.7.22@sha256:40d2c0ce0c29b2aa1ec1dcf9652ec26a13a8f2b4b44116733bcede428afd27dc
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8484
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          env:
+            - name: APP_HOME_URL
+              value: https://grist.cluster.fun
+            - name:  APP_DOC_URL
+              value: https://grist.cluster.fun
+            - name: APP_HOME_INTERNAL_URL
+              value: http://grist.grist.svc
+            - name:  APP_DOC_INTERNAL_URL
+              value: http://grist.grist.svc
+            - name: GRIST_SINGLE_ORG
+              value: default
+            - name: GRIST_TELEMETRY_LEVEL
+              value: "off"
+            - name: GRIST_ANON_PLAYGROUND
+              value: "false"
+            - name: GRIST_FORCE_LOGIN
+              value: "true"
+            - name: GRIST_SANDBOX_FLAVOR
+              value: gvisor
+          resources:
+            requests:
+              memory: 300M
+            limits:
+              memory: 600M
+          securityContext:
+            capabilities:
+              add:
+              - SYS_PTRACE
+          envFrom:
+          - secretRef:
+              name: grist
+          volumeMounts:
+            - name: data
+              mountPath: /persist
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: grist-data
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: grist
+  minReplicas: 1
+  maxReplicas: 3
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grist
+  namespace: grist
+  labels:
+    app.kubernetes.io/name: grist
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - grist.cluster.fun
+    secretName: grist-ingress
+  rules:
+    - host: "grist.cluster.fun"
+      http:
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: grist
+                port:
+                  number: 80

manifests/homelab-accessible-check/homelab-accessible-check.yaml

@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-config
+  namespace: homelab-accessible-check
+  annotations:
+    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: .dockerconfigjson
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: e30=
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: homelab-accessible-check
+  namespace: homelab-accessible-check
+  annotations:
+    kube-1password: bz6ujxc5neqma242lpfqdxfiay
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homelab-accessible-check
+  namespace: homelab-accessible-check
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: homelab-accessible-check
+  template:
+    metadata:
+      labels:
+        app: homelab-accessible-check
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      containers:
+      - name: checker
+        image: rg.fr-par.scw.cloud/averagemarcus-private/homelab-accessible-check:latest
+        imagePullPolicy: Always
+        envFrom:
+        - secretRef:
+            name: "homelab-accessible-check"
+        resources:
+          limits:
+            memory: 50Mi
+          requests:
+            memory: 50Mi

manifests/link/link.yaml

@@ -22,6 +22,31 @@ data:
     kube-london: https://noti.st/averagemarcus/SFD1bY/the-wonders-and-woes-of-webhooks
     kcduk23: https://noti.st/averagemarcus/4YvpTx/webhooks-whats-the-worst-that-could-happen
     rejekts23: https://noti.st/averagemarcus/Bi7qLP/webhooks-whats-the-worst-that-could-happen
+    rejekts24: https://speaking.marcusnoble.co.uk/pg46DB/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
+    lopug24: https://speaking.marcusnoble.co.uk/I6dyx4/webhooks-whats-the-worst-that-could-happen
+    kcduk24: https://speaking.marcusnoble.co.uk/0qcuN9/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
+    rejektsna24: https://speaking.marcusnoble.co.uk/dALiFY/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
+    kcddk24: https://speaking.marcusnoble.co.uk/FU4W7x/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
+    cndoslo: https://speaking.marcusnoble.co.uk/j5M53P/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
+    rejekts25: https://speaking.marcusnoble.co.uk/AXARFf/pod-deep-dive-everything-you-didnt-know-you-needed-to-know
+    kcdbudapest: https://speaking.marcusnoble.co.uk/43QLpx/the-future-of-kubernetes-admission-logic
+    kcdczechslovak: https://speaking.marcusnoble.co.uk/Np2xUv/pod-deep-dive-the-interesting-bits
+    cnsmunich: https://speaking.marcusnoble.co.uk/HqYcp2/pod-deep-dive-the-interesting-bits
+    cnsmunich-feedback: https://yay-or-nay.cluster.fun/feedback/20UETBI0
+    containerdays25: https://speaking.marcusnoble.co.uk/HARSlE/the-future-of-kubernetes-admission-logic
+    containerdays25-feedback: https://yay-or-nay.cluster.fun/feedback/F8P351QK
+    cdl-2026: https://speaking.marcusnoble.co.uk/lMcEwR/pod-deep-dive-the-interesting-bits
+    cdl-2026-feedback: https://yay-or-nay.cluster.fun/feedback/EMLARINI
+    cdl-talk-2026: https://speaking.marcusnoble.co.uk/0rRvmv/debugging-your-conference-talk-practical-tips-to-resonate-with-your-audience
+    cdl-talk-2026-feedback: https://yay-or-nay.cluster.fun/feedback/22TO05MQ
+    technical-talking-blog-post: https://marcusnoble.co.uk/2025-04-30-my-tips-on-giving-technical-talks/
+    kubecon-eu-26: https://speaking.marcusnoble.co.uk/zT471P/kube-oddities-the-quirks-that-keep-kubernetes-interesting
+    cndro26: https://speaking.marcusnoble.co.uk/1OrBAe/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
+    cdh26: https://speaking.marcusnoble.co.uk/dvat0w/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
+    kcdsofia26: https://speaking.marcusnoble.co.uk/GFJgtL/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
+    cndpoland26: https://speaking.marcusnoble.co.uk/sZ2Ulk/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
+    kcduk2026: https://speaking.marcusnoble.co.uk/Xpj6t6/pod-deep-dive-the-interesting-bits
+    kcduk2026-feedback: https://yay-or-nay.cluster.fun/feedback/BS01AM1M
 ---
 apiVersion: v1
 kind: Service
@@ -46,6 +71,8 @@ metadata:
   namespace: link
   labels:
     app: link
+  annotations:
+    secret.reloader.stakater.com/reload: "urls-map"
 spec:
   replicas: 1
   selector:
@@ -56,9 +83,10 @@ spec:
       labels:
         app: link
     spec:
+      priorityClassName: critical
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/link:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/link:latest@sha256:11d3908c87c91c3e9b0ac64377a016f967eb96d92c5a478f61ac4d6e4b7128f9
         imagePullPolicy: Always
         ports:
         - containerPort: 5050
@@ -78,11 +106,10 @@ metadata:
   namespace: link
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
-    kubernetes.io/ingress.class: traefik
-    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
+  ingressClassName: nginx
   tls:
   - hosts:
     - go-get.link

manifests/marcusnoble/marcusnoble.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/marcusnoble:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/marcusnoble:latest@sha256:258e639003301f9a41a796c74a963b624454de6dad2dd90f0a1eb745027cfc88
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -39,16 +39,16 @@ spec:
             memory: 50Mi
           requests:
             memory: 50Mi
-        # livenessProbe:
-        #   httpGet:
-        #     path: /healthz
-        #     port: web
-        #   initialDelaySeconds: 10
-        # readinessProbe:
-        #   httpGet:
-        #     path: /healthz
-        #     port: web
-        #   initialDelaySeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /
+            port: web
+          initialDelaySeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            port: web
+          initialDelaySeconds: 10
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/mastodon-digest/mastodon_digest.yaml

@@ -1,229 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: docker-config
-  namespace: mastodon-digest
-  annotations:
-    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: .dockerconfigjson
-type: kubernetes.io/dockerconfigjson
-data:
-  .dockerconfigjson: e30=
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mastodon-digest-auth
-  namespace: mastodon-digest
-  annotations:
-    kube-1password: mr6spkkx7n3memkbute6ojaarm
-    kube-1password/vault: Kubernetes
-type: Opaque
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mastodon-digest
-  namespace: mastodon-digest
-  annotations:
-    kube-1password: bfklz3yi3dn4e7xtsbttcvhata
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: config
-  namespace: mastodon-digest
-  labels:
-    app: mastodon-digest
-data:
-  config.json: |
-    [
-      {
-        "timeline": "home",
-        "hours": 12,
-        "scorer": "ExtendedSimpleWeighted",
-        "threshold": "lax",
-        "output": "/usr/share/nginx/html/home/"
-      },
-      {
-        "timeline": "federated",
-        "hours": 12,
-        "scorer": "ExtendedSimpleWeighted",
-        "threshold": "lax",
-        "output": "/usr/share/nginx/html/federated/"
-      }
-    ]
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: index
-  namespace: mastodon-digest
-  labels:
-    app: mastodon-digest
-data:
-  index.html: |
-    <!DOCTYPE html>
-    <html lang="en">
-    <head>
-        <meta chartset="utf-8" />
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <title>Mastodon Digest</title>
-        <style>
-        body { background-color: #292c36; font-family: "Arial", sans-serif; }
-        div#container { margin: auto; max-width: 640px; padding: 10px; text-align: center; margin: 0 auto; }
-        .links { align: center; }
-        h1 { color: white; }
-        a.button { background: #595aff; color: #fff; line-height: 1.2; min-height: 38px; min-width: 88px; padding: 0 30px; border: 0; border-radius: 6px;; display: inline-flex; justify-content: center; align-items: center; }
-    </style>
-    </head>
-    <body>
-        <div id="container">
-            <h1>Mastodon Digest</h1>
-            <section class="links">
-                <a href="home/" class="button">Home</a>
-                <a href="federated/" class="button">Federated</a>
-            </section>
-        </div>
-    </body>
-    </html>
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: mastodon-digest
-  namespace: mastodon-digest
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: auth
-    name: web
-  selector:
-    app: mastodon-digest
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mastodon-digest
-  namespace: mastodon-digest
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: mastodon-digest
-  template:
-    metadata:
-      labels:
-        app: mastodon-digest
-    spec:
-      imagePullSecrets:
-        - name: docker-config
-      containers:
-      - args:
-        - --cookie-secure=false
-        - --provider=oidc
-        - --provider-display-name=Auth0
-        - --upstream=http://localhost:80
-        - --http-address=$(HOST_IP):8000
-        - --redirect-url=https://mastodon-digest.cluster.fun/oauth2/callback
-        - --email-domain=marcusnoble.co.uk
-        - --pass-basic-auth=false
-        - --pass-access-token=false
-        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
-        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQNFT
-        env:
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: OAUTH2_PROXY_CLIENT_ID
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: mastodon-digest-auth
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: mastodon-digest-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
-        name: oauth-proxy
-        ports:
-        - containerPort: 8000
-          protocol: TCP
-          name: auth
-        resources:
-          limits:
-            memory: 50Mi
-          requests:
-            memory: 50Mi
-
-      - name: web
-        image: nginx:stable
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 80
-          name: web
-        volumeMounts:
-        - name: html
-          mountPath: /usr/share/nginx/html
-        - name: index
-          mountPath: /usr/share/nginx/html/index.html
-          subPath: index.html
-
-      - name: digest
-        image: rg.fr-par.scw.cloud/averagemarcus-private/mastodon-digest:latest
-        imagePullPolicy: Always
-        env:
-        - name: CONFIG_FILE
-          value: /config.json
-        envFrom:
-        - secretRef:
-            name: mastodon-digest
-        volumeMounts:
-        - name: config
-          mountPath: /config.json
-          subPath: config.json
-        - name: html
-          mountPath: /usr/share/nginx/html
-      volumes:
-      - name: html
-        emptyDir: {}
-      - name: config
-        configMap:
-          name: config
-      - name: index
-        configMap:
-          name: index
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mastodon-digest
-  namespace: mastodon-digest
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - mastodon-digest.cluster.fun
-    secretName: mastodon-digest-ingress
-  rules:
-  - host: mastodon-digest.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: mastodon-digest
-            port:
-              number: 80

manifests/mastodon-to-airtable/twitter-to-airtable.yaml

@@ -1,151 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: docker-config
-  namespace: mastodon-to-airtable
-  annotations:
-    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: .dockerconfigjson
-type: kubernetes.io/dockerconfigjson
-data:
-  .dockerconfigjson: e30=
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mastodon-to-airtable-auth
-  namespace: mastodon-to-airtable
-  annotations:
-    kube-1password: mr6spkkx7n3memkbute6ojaarm
-    kube-1password/vault: Kubernetes
-type: Opaque
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mastodon-to-airtable
-  namespace: mastodon-to-airtable
-  annotations:
-    kube-1password: kizmkmbndgu3ryrox3csev4mim
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: mastodon-to-airtable
-  namespace: mastodon-to-airtable
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: auth
-    name: web
-  selector:
-    app: mastodon-to-airtable
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mastodon-to-airtable
-  namespace: mastodon-to-airtable
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: mastodon-to-airtable
-  template:
-    metadata:
-      labels:
-        app: mastodon-to-airtable
-    spec:
-      imagePullSecrets:
-        - name: docker-config
-      containers:
-      - args:
-        - --cookie-secure=false
-        - --provider=oidc
-        - --provider-display-name=Auth0
-        - --upstream=http://localhost:8080
-        - --http-address=$(HOST_IP):8000
-        - --redirect-url=https://mastodon-to-airtable.cluster.fun/oauth2/callback
-        - --email-domain=marcusnoble.co.uk
-        - --pass-basic-auth=false
-        - --pass-access-token=false
-        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
-        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQNFT
-        env:
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: OAUTH2_PROXY_CLIENT_ID
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: mastodon-to-airtable-auth
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: mastodon-to-airtable-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
-        name: oauth-proxy
-        ports:
-        - containerPort: 8000
-          protocol: TCP
-          name: auth
-        resources:
-          limits:
-            memory: 50Mi
-          requests:
-            memory: 50Mi
-      - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus-private/mastodon-to-airtable:latest
-        imagePullPolicy: Always
-        env:
-        - name: PORT
-          value: "8080"
-        envFrom:
-        - secretRef:
-            name: "mastodon-to-airtable"
-        ports:
-        - containerPort: 8080
-          name: web
-        resources:
-          limits:
-            memory: 50Mi
-          requests:
-            memory: 50Mi
-
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mastodon-to-airtable
-  namespace: mastodon-to-airtable
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    kubernetes.io/ingress.class: traefik
-    traefik.ingress.kubernetes.io/router.tls: "true"
-    ingress.kubernetes.io/ssl-redirect: "true"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-spec:
-  tls:
-  - hosts:
-    - mastodon-to-airtable.cluster.fun
-    secretName: mastodon-to-airtable-ingress
-  rules:
-  - host: mastodon-to-airtable.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: mastodon-to-airtable
-            port:
-              number: 80

manifests/matrix_chart/matrix_chart.yaml

@@ -1,545 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: matrix
-  namespace: chat
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - matrix.cluster.fun
-    secretName: matrix-ingress
-  rules:
-  - host: matrix.cluster.fun
-    http:
-      paths:
-      - path: /.well-known/matrix
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: well-known
-            port:
-              number: 80
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: matrix-synapse
-            port:
-              number: 80
-
----
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: riot
-  namespace: chat
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - chat.cluster.fun
-    secretName: riot-ingress
-  rules:
-  - host: chat.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: matrix-riot
-            port:
-              number: 80
-
----
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: well-known
-  namespace: chat
-  annotations:
-    configmap.reloader.stakater.com/reload: "well-known"
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: well-known
-  template:
-    metadata:
-      labels:
-        app: well-known
-    spec:
-      containers:
-      - name: web
-        image: nginx
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 80
-          name: web
-        volumeMounts:
-        - name: well-known
-          mountPath: /usr/share/nginx/html/.well-known/matrix
-        resources:
-          limits:
-            memory: 15Mi
-          requests:
-            memory: 15Mi
-      volumes:
-      - name: well-known
-        configMap:
-          name: well-known
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: well-known
-  namespace: chat
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: 80
-    name: web
-  selector:
-    app: well-known
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: well-known
-  namespace: chat
-data:
-  server: |-
-    {
-      "m.server": "matrix.cluster.fun:443"
-    }
-
-
----
-
-
-# Source: matrix/templates/riot/configmap.yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: matrix-riot-config
-  namespace: chat
-  labels:
-    app.kubernetes.io/name: "matrix"
-    component: element
-data:
-  config.json: |
-    {
-      "default_server_config": {
-        "m.homeserver": {
-          "base_url": "https://matrix.cluster.fun"
-        }
-      },
-      "brand": "Element",
-      "branding": {},
-      "integrations_ui_url": "https://scalar.vector.im/",
-      "integrations_rest_url": "https://scalar.vector.im/api",
-      "integrations_widgets_urls": [
-        "https://scalar.vector.im/_matrix/integrations/v1",
-        "https://scalar.vector.im/api",
-        "https://scalar-staging.vector.im/_matrix/integrations/v1",
-        "https://scalar-staging.vector.im/api",
-        "https://scalar-staging.riot.im/scalar/api"
-      ],
-      "showLabsSettings": true,
-      "features": {
-        "feature_pinning": true,
-        "feature_custom_status": "labs",
-        "feature_state_counters": "labs",
-        "feature_many_integration_managers": "labs",
-        "feature_mjolnir": "labs",
-        "feature_dm_verification": "labs",
-        "feature_bridge_state": "labs",
-        "feature_presence_in_room_list": true,
-        "feature_custom_themes": "labs",
-        "feature_new_spinner": "labs",
-        "feature_jump_to_date": "labs",
-        "feature_location_share_pin_drop": "labs",
-        "feature_location_share_live": "labs",
-        "feature_thread": true,
-        "feature_video_rooms": true,
-        "feature_favourite_messages": "labs"
-      },
-      "roomDirectory": {
-        "servers": []
-      },
-      "permalinkPrefix": "https://chat.cluster.fun",
-      "enable_presence_by_hs_url": {
-        "https://matrix.org": false,
-        "https://matrix-client.matrix.org": false
-      },
-      "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=2IerXP2a5g1e7hxxBbzs"
-    }
-  nginx.conf: |
-    worker_processes  auto;
-
-    error_log  /var/log/nginx/error.log warn;
-    pid        /var/run/pid/nginx.pid;
-
-    events {
-      worker_connections  1024;
-    }
-
-    http {
-      include       /etc/nginx/mime.types;
-      default_type  application/octet-stream;
-
-      log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-      '$status $body_bytes_sent "$http_referer" '
-      '"$http_user_agent" "$http_x_forwarded_for"';
-
-      access_log  /var/log/nginx/access.log  main;
-
-      sendfile        on;
-
-      keepalive_timeout  65;
-
-      include /etc/nginx/conf.d/*.conf;
-    }
-  default.conf: |
-    server {
-      listen       8080;
-      server_name  localhost;
-
-      location / {
-          root   /usr/share/nginx/html;
-          index  index.html index.htm;
-      }
-
-      # redirect server error pages to the static page /50x.html
-      #
-      error_page   500 502 503 504  /50x.html;
-      location = /50x.html {
-          root   /usr/share/nginx/html;
-      }
-    }
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: matrix-synapse-config
-  namespace: chat
-  annotations:
-    kube-1password: wbj4oozwyx6m2zz5m42pgcmymy
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: homeserver.yaml
-  labels:
-    app.kubernetes.io/name: "matrix"
-    component: synapse
-type: Opaque
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: matrix-synapse-config
-  namespace: chat
-  labels:
-    app.kubernetes.io/name: "matrix"
-    component: element
-data:
-  matrix.cluster.fun.log.config: |
-    version: 1
-
-    formatters:
-      precise:
-        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
-
-    filters:
-      context:
-        (): synapse.util.logcontext.LoggingContextFilter
-        request: ""
-
-    handlers:
-      console:
-        class: logging.StreamHandler
-        formatter: precise
-        filters: [context]
-
-    loggers:
-      synapse:
-        level: WARNING
-      synapse.storage.SQL:
-        # beware: increasing this to DEBUG will make synapse log sensitive
-        # information such as access tokens.
-        level: WARNING
-
-    root:
-      level: WARNING
-      handlers: [console]
----
-# Source: matrix/templates/riot/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: matrix-riot
-  namespace: chat
-  labels:
-    app.kubernetes.io/name: "matrix"
-    component: element
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/name: matrix-riot
----
-# Source: matrix/templates/synapse/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: matrix-synapse
-  namespace: chat
-  labels:
-    app.kubernetes.io/name: "matrix"
-    component: synapse
-  annotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/_synapse/metrics"
-    prometheus.io/port: "9000"
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
-    - port: 9000
-      targetPort: metrics
-      protocol: TCP
-      name: metrics
-  selector:
-    app.kubernetes.io/name: matrix-synapse
----
-# Source: matrix/templates/riot/deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: matrix-riot
-  namespace: chat
-  labels:
-    app.kubernetes.io/name: "matrix"
-    component: element
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: matrix-riot
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: matrix-riot
-    spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-      containers:
-        - name: "riot"
-          image: "vectorim/element-web:v1.11.52"
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /app/config.json
-              name: riot-config
-              subPath: config.json
-              readOnly: true
-            - mountPath: /etc/nginx/nginx.conf
-              name: riot-config
-              subPath: nginx.conf
-              readOnly: true
-            - mountPath: /etc/nginx/conf.d/default.conf
-              name: riot-config
-              subPath: default.conf
-              readOnly: true
-            - mountPath: /var/cache/nginx
-              name: ephemeral
-              subPath: cache
-            - mountPath: /var/run/pid
-              name: ephemeral
-              subPath: pid
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-          startupProbe:
-            httpGet:
-              path: /
-              port: http
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-          securityContext:
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-      volumes:
-        - name: riot-config
-          configMap:
-            name: matrix-riot-config
-        - name: ephemeral
-          emptyDir: {}
----
-# Source: matrix/templates/synapse/deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: matrix-synapse
-  namespace: chat
-  labels:
-    app.kubernetes.io/name: "matrix"
-    component: synapse
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: matrix-synapse
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: matrix-synapse
-    spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-      initContainers:
-        - name: generate-signing-key
-          image: "matrixdotorg/synapse:v1.98.0"
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: SYNAPSE_SERVER_NAME
-              value: matrix.cluster.fun
-            - name: SYNAPSE_REPORT_STATS
-              value: "no"
-          command: ["python"]
-          args:
-            - "-m"
-            - "synapse.app.homeserver"
-            - "--config-path"
-            - "/data/homeserver.yaml"
-            - "--keys-directory"
-            - "/data/keys"
-            - "--generate-keys"
-          volumeMounts:
-            - name: synapse-config-homeserver
-              mountPath: /data/homeserver.yaml
-              subPath: homeserver.yaml
-            - name: synapse-config-logging
-              mountPath: /data/matrix.cluster.fun.log.config
-              subPath: matrix.cluster.fun.log.config
-            - name: signing-key
-              mountPath: /data/keys
-      containers:
-        - name: "synapse"
-          image: "matrixdotorg/synapse:v1.98.0"
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8008
-              protocol: TCP
-            - name: metrics
-              containerPort: 9000
-              protocol: TCP
-          volumeMounts:
-            - name: synapse-config-homeserver
-              mountPath: /data/homeserver.yaml
-              subPath: homeserver.yaml
-            - name: mautrix-whatsapp-registration
-              mountPath: /data/mautrix-whatsapp-registration.yaml
-              subPath: registration.yaml
-            # - name: mautrix-signal-registration
-            #   mountPath: /data/mautrix-signal-registration.yaml
-            #   subPath: registration.yaml
-            # - name: mautrix-telegram-registration
-            #   mountPath: /data/mautrix-telegram-registration.yaml
-            #   subPath: registration.yaml
-            - name: synapse-config-logging
-              mountPath: /data/matrix.cluster.fun.log.config
-              subPath: matrix.cluster.fun.log.config
-            - name: signing-key
-              mountPath: /data/keys
-            - name: user-media
-              mountPath: /data/media_store
-            - name: uploads
-              mountPath: /data/uploads
-            - name: tmp
-              mountPath: /tmp
-          readinessProbe:
-            httpGet:
-              path: /_matrix/static/
-              port: http
-            periodSeconds: 10
-            timeoutSeconds: 5
-          startupProbe:
-            httpGet:
-              path: /_matrix/static/
-              port: http
-            failureThreshold: 6
-            periodSeconds: 5
-            timeoutSeconds: 5
-          livenessProbe:
-            httpGet:
-              path: /_matrix/static/
-              port: http
-            periodSeconds: 10
-            timeoutSeconds: 5
-          securityContext:
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-      volumes:
-        - name: synapse-config-logging
-          configMap:
-            name: matrix-synapse-config
-        - name: synapse-config-homeserver
-          secret:
-            secretName: matrix-synapse-config
-        - name: mautrix-whatsapp-registration
-          secret:
-            secretName: mautrix-whatsapp-registration
-        # - name: mautrix-signal-registration
-        #   secret:
-        #     secretName: mautrix-signal-registration
-        # - name: mautrix-telegram-registration
-        #   secret:
-        #     secretName: mautrix-telegram-registration
-        - name: signing-key
-          persistentVolumeClaim:
-            claimName: chat-matrix-signing-key
-        - name: user-media
-          persistentVolumeClaim:
-            claimName: chat-matrix-user-media
-        - name: uploads
-          emptyDir: {}
-        - name: tmp
-          emptyDir: {}
----

manifests/matrix_chart/pvs.yaml

@@ -1,80 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  annotations:
-    pv.kubernetes.io/provisioned-by: csi.scaleway.com
-  finalizers:
-  - kubernetes.io/pv-protection
-  - external-attacher/csi-scaleway-com
-  name: pvc-470f5860-49e0-414c-bb36-329970afc44b
-spec:
-  accessModes:
-  - ReadWriteOnce
-  capacity:
-    storage: 12Gi
-  csi:
-    driver: csi.scaleway.com
-    fsType: ext4
-    volumeAttributes:
-      storage.kubernetes.io/csiProvisionerIdentity: 1676472026170-8081-csi.scaleway.com
-    volumeHandle: fr-par-1/5e73e304-11e8-42cb-90fe-361889089d2d
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: scw-bssd
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: chat-matrix-user-media
-  namespace: chat
-  labels:
-    app.kubernetes.io/name: "matrix"
-    component: synapse
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 12Gi
-  volumeName: pvc-470f5860-49e0-414c-bb36-329970afc44b
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  annotations:
-    pv.kubernetes.io/provisioned-by: csi.scaleway.com
-  finalizers:
-  - kubernetes.io/pv-protection
-  - external-attacher/csi-scaleway-com
-  name: pvc-00a8cf81-9453-4014-aa09-9fdbcc42abf2
-spec:
-  accessModes:
-  - ReadWriteOnce
-  capacity:
-    storage: 1Gi
-  csi:
-    driver: csi.scaleway.com
-    fsType: ext4
-    volumeAttributes:
-      storage.kubernetes.io/csiProvisionerIdentity: 1588413765965-1847-csi.scaleway.com
-    volumeHandle: fr-par-1/e7437eda-59e8-43f5-af49-540618f1bd95
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: scw-bssd
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: chat-matrix-signing-key
-  namespace: chat
-  labels:
-    app.kubernetes.io/name: "matrix"
-    component: synapse
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  volumeName: pvc-00a8cf81-9453-4014-aa09-9fdbcc42abf2
----

manifests/matrix_chart/signal_bridge.yaml

@@ -1,153 +0,0 @@
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   name: mautrix-signal-registration
-#   namespace: chat
-#   annotations:
-#     kube-1password: z6tylu2br724gttcpfyi5egaui
-#     kube-1password/vault: Kubernetes
-#     kube-1password/secret-text-key: registration.yaml
-#   labels:
-#     app.kubernetes.io/name: "mautrix-signal"
-#     component: registration
-# type: Opaque
-
-# ---
-
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   name: mautrix-signal-config
-#   namespace: chat
-#   annotations:
-#     kube-1password: 5vfaorcudozlq4clkzgmzzszqe
-#     kube-1password/vault: Kubernetes
-#     kube-1password/secret-text-key: config.yaml
-#   labels:
-#     app.kubernetes.io/name: "mautrix-signal"
-#     component: config
-# type: Opaque
-
-# ---
-
-# apiVersion: v1
-# kind: Service
-# metadata:
-#   name: mautrix-signal
-#   namespace: chat
-#   labels:
-#     app.kubernetes.io/name: mautrix-signal
-#   annotations:
-#     prometheus.io/scrape: "true"
-#     prometheus.io/path: "/metrics"
-#     prometheus.io/port: "9000"
-# spec:
-#   type: ClusterIP
-#   ports:
-#   - port: 29328
-#     targetPort: http
-#     protocol: TCP
-#     name: http
-#   selector:
-#     app.kubernetes.io/name: mautrix-signal
-
-# ---
-
-# apiVersion: apps/v1
-# kind: Deployment
-# metadata:
-#   name: mautrix-signal
-#   labels:
-#     app.kubernetes.io/name: mautrix-signal
-# spec:
-#   revisionHistoryLimit: 3
-#   replicas: 1
-#   strategy:
-#     type: Recreate
-#   selector:
-#     matchLabels:
-#       app.kubernetes.io/name: mautrix-signal
-#   template:
-#     metadata:
-#       labels:
-#         app.kubernetes.io/name: mautrix-signal
-#     spec:
-#       serviceAccountName: default
-#       automountServiceAccountToken: true
-#       dnsPolicy: ClusterFirst
-#       enableServiceLinks: true
-#       initContainers:
-#       - name: config-copy
-#         image: bash:latest
-#         imagePullPolicy: IfNotPresent
-#         args:
-#           - -c
-#           - |
-#             cp /secrets/* /data/
-#         volumeMounts:
-#           - name: mautrix-signal-config
-#             mountPath: /secrets/config.yaml
-#             subPath: config.yaml
-#           - name: mautrix-signal-registration
-#             mountPath: /secrets/registration.yaml
-#             subPath: registration.yaml
-#           - name: data
-#             mountPath: /data
-#       containers:
-#         - name: signald
-#           image: docker.io/signald/signald:stable
-#           imagePullPolicy: Always
-#           volumeMounts:
-#           - name: signald
-#             mountPath: /signald
-#         - name: mautrix-signal
-#           image: "dock.mau.dev/mautrix/signal:v0.4.3"
-#           imagePullPolicy: IfNotPresent
-#           env:
-#             - name: "TZ"
-#               value: "UTC"
-#           ports:
-#             - name: http
-#               containerPort: 29328
-#               protocol: TCP
-#             - name: metrics
-#               containerPort: 9000
-#               protocol: TCP
-#           volumeMounts:
-#           - name: signald
-#             mountPath: /signald
-#           - name: data
-#             mountPath: /data
-#           livenessProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 3
-#             timeoutSeconds: 1
-#             periodSeconds: 10
-#           readinessProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 3
-#             timeoutSeconds: 1
-#             periodSeconds: 10
-#           startupProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 30
-#             timeoutSeconds: 1
-#             periodSeconds: 5
-#       volumes:
-#         - name: data
-#           emptyDir: {}
-#         - name: signald
-#           emptyDir: {}
-#         - name: mautrix-signal-config
-#           secret:
-#             secretName: mautrix-signal-config
-#         - name: mautrix-signal-registration
-#           secret:
-#             secretName: mautrix-signal-registration
-# ---

manifests/matrix_chart/telegram_bridge.yaml

@@ -1,143 +0,0 @@
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   name: mautrix-telegram-registration
-#   namespace: chat
-#   annotations:
-#     kube-1password: dancy7ogc4gjlxhfntqejgudwi
-#     kube-1password/vault: Kubernetes
-#     kube-1password/secret-text-key: registration.yaml
-#   labels:
-#     app.kubernetes.io/name: "mautrix-telegram"
-#     component: registration
-# type: Opaque
-
-# ---
-
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   name: mautrix-telegram-config
-#   namespace: chat
-#   annotations:
-#     kube-1password: nilzdpfum35hhwijnwvasbzmcq
-#     kube-1password/vault: Kubernetes
-#     kube-1password/secret-text-key: config.yaml
-#   labels:
-#     app.kubernetes.io/name: "mautrix-telegram"
-#     component: config
-# type: Opaque
-
-# ---
-
-# apiVersion: v1
-# kind: Service
-# metadata:
-#   name: mautrix-telegram
-#   namespace: chat
-#   labels:
-#     app.kubernetes.io/name: mautrix-telegram
-#   annotations:
-#     prometheus.io/scrape: "true"
-#     prometheus.io/path: "/metrics"
-#     prometheus.io/port: "9000"
-# spec:
-#   type: ClusterIP
-#   ports:
-#   - port: 29318
-#     targetPort: http
-#     protocol: TCP
-#     name: http
-#   selector:
-#     app.kubernetes.io/name: mautrix-telegram
-
-# ---
-
-# apiVersion: apps/v1
-# kind: Deployment
-# metadata:
-#   name: mautrix-telegram
-#   labels:
-#     app.kubernetes.io/name: mautrix-telegram
-# spec:
-#   revisionHistoryLimit: 3
-#   replicas: 1
-#   strategy:
-#     type: Recreate
-#   selector:
-#     matchLabels:
-#       app.kubernetes.io/name: mautrix-telegram
-#   template:
-#     metadata:
-#       labels:
-#         app.kubernetes.io/name: mautrix-telegram
-#     spec:
-#       serviceAccountName: default
-#       automountServiceAccountToken: true
-#       dnsPolicy: ClusterFirst
-#       enableServiceLinks: true
-#       initContainers:
-#       - name: config-copy
-#         image: bash:latest
-#         imagePullPolicy: IfNotPresent
-#         args:
-#           - -c
-#           - |
-#             cp /secrets/* /data/
-#         volumeMounts:
-#           - name: mautrix-telegram-config
-#             mountPath: /secrets/config.yaml
-#             subPath: config.yaml
-#           - name: mautrix-telegram-registration
-#             mountPath: /secrets/registration.yaml
-#             subPath: registration.yaml
-#           - name: data
-#             mountPath: /data
-#       containers:
-#         - name: mautrix-telegram
-#           image: "dock.mau.dev/mautrix/telegram:v0.12.1"
-#           imagePullPolicy: IfNotPresent
-#           env:
-#             - name: "TZ"
-#               value: "UTC"
-#           ports:
-#             - name: http
-#               containerPort: 29318
-#               protocol: TCP
-#             - name: metrics
-#               containerPort: 9000
-#               protocol: TCP
-#           volumeMounts:
-#           - name: data
-#             mountPath: /data
-#           livenessProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 3
-#             timeoutSeconds: 1
-#             periodSeconds: 10
-#           readinessProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 3
-#             timeoutSeconds: 1
-#             periodSeconds: 10
-#           startupProbe:
-#             tcpSocket:
-#               port: 29318
-#             initialDelaySeconds: 0
-#             failureThreshold: 30
-#             timeoutSeconds: 1
-#             periodSeconds: 5
-#       volumes:
-#         - name: data
-#           emptyDir: {}
-#         - name: mautrix-telegram-config
-#           secret:
-#             secretName: mautrix-telegram-config
-#         - name: mautrix-telegram-registration
-#           secret:
-#             secretName: mautrix-telegram-registration
-# ---

manifests/matrix_chart/whatsapp_bridge.yaml

@@ -1,143 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mautrix-whatsapp-registration
-  namespace: chat
-  annotations:
-    kube-1password: x6lzkpyov4dem5jtk2kimyrnvy
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: registration.yaml
-  labels:
-    app.kubernetes.io/name: "mautrix-whatsapp"
-    component: registration
-type: Opaque
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mautrix-whatsapp-config
-  namespace: chat
-  annotations:
-    kube-1password: ji3e2el66bu56bml3kq3ghyojq
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: config.yaml
-  labels:
-    app.kubernetes.io/name: "mautrix-whatsapp"
-    component: config
-type: Opaque
-
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: mautrix-whatsapp
-  namespace: chat
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp
-  annotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/metrics"
-    prometheus.io/port: "9000"
-spec:
-  type: ClusterIP
-  ports:
-  - port: 29318
-    targetPort: http
-    protocol: TCP
-    name: http
-  selector:
-    app.kubernetes.io/name: mautrix-whatsapp
-
----
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mautrix-whatsapp
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: mautrix-whatsapp
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: mautrix-whatsapp
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      dnsPolicy: ClusterFirst
-      enableServiceLinks: true
-      initContainers:
-      - name: config-copy
-        image: bash:latest
-        imagePullPolicy: IfNotPresent
-        args:
-          - -c
-          - |
-            cp /secrets/* /data/
-        volumeMounts:
-          - name: mautrix-whatsapp-config
-            mountPath: /secrets/config.yaml
-            subPath: config.yaml
-          - name: mautrix-whatsapp-registration
-            mountPath: /secrets/registration.yaml
-            subPath: registration.yaml
-          - name: data
-            mountPath: /data
-      containers:
-        - name: mautrix-whatsapp
-          image: "dock.mau.dev/mautrix/whatsapp:v0.10.5"
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: "TZ"
-              value: "UTC"
-          ports:
-            - name: http
-              containerPort: 29318
-              protocol: TCP
-            - name: metrics
-              containerPort: 9000
-              protocol: TCP
-          volumeMounts:
-          - name: data
-            mountPath: /data
-          livenessProbe:
-            tcpSocket:
-              port: 29318
-            initialDelaySeconds: 0
-            failureThreshold: 3
-            timeoutSeconds: 1
-            periodSeconds: 10
-          readinessProbe:
-            tcpSocket:
-              port: 29318
-            initialDelaySeconds: 0
-            failureThreshold: 3
-            timeoutSeconds: 1
-            periodSeconds: 10
-          startupProbe:
-            tcpSocket:
-              port: 29318
-            initialDelaySeconds: 0
-            failureThreshold: 30
-            timeoutSeconds: 1
-            periodSeconds: 5
-      volumes:
-        - name: data
-          emptyDir: {}
-        - name: mautrix-whatsapp-config
-          secret:
-            secretName: mautrix-whatsapp-config
-        - name: mautrix-whatsapp-registration
-          secret:
-            secretName: mautrix-whatsapp-registration
----

manifests/mazanoke/manifest.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: mazanoke
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mazanoke
+  template:
+    metadata:
+      labels:
+        app: mazanoke
+    spec:
+      containers:
+      - name: web
+        image: ghcr.io/civilblur/mazanoke:v1.1.7@sha256:ca83cddd90cd1e4b43102884bf39025731a1c7569f3bbda9d6530de72528cbab
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 200Mi
+          requests:
+            memory: 200Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - image.cluster.fun
+    secretName: mazanoke-ingress
+  rules:
+  - host: image.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: mazanoke
+            port:
+              number: 80
+

manifests/mealie/mealie.yaml

@@ -18,6 +18,8 @@ metadata:
   namespace: mealie
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: mealie
@@ -26,22 +28,21 @@ spec:
       labels:
         app: mealie
     spec:
+      priorityClassName: critical
       containers:
       - name: frontend
-        image: hkotel/mealie:frontend-nightly
+        image: ghcr.io/mealie-recipes/mealie:v3.30.0@sha256:90f83da6f3ab0a421efc827118a556168573930105f13fa3321768f42163d784
         imagePullPolicy: Always
         envFrom:
         - secretRef:
             name: mealie
         env:
-        - name: API_URL
-          value: "http://localhost:9000"
         - name: PUID
           value: "1000"
         - name: PGID
           value: "1000"
         - name: TOKEN_TIME
-          value: "168"
+          value: "720"
         - name: DB_ENGINE
           value: postgres
         - name: POSTGRES_DB
@@ -58,45 +59,28 @@ spec:
           value: "false"
         - name: RECIPE_DISABLE_AMOUNT
           value: "false"
-        ports:
-        - containerPort: 3000
-          name: web
-        volumeMounts:
-          - mountPath: /app/data
-            name: data
-      - name: api
-        image: hkotel/mealie:api-nightly
-        imagePullPolicy: Always
-        envFrom:
-        - secretRef:
-            name: mealie
-        env:
-        - name: PUID
-          value: "1000"
-        - name: PGID
-          value: "1000"
-        - name: DB_ENGINE
-          value: postgres
-        - name: POSTGRES_DB
-          value: mealie
-        - name: DEFAULT_EMAIL
-          value: "mealie@marcusnoble.co.uk"
-        - name: TOKEN_TIME
-          value: "168"
+        - name: ALLOW_SIGNUP
+          value: "false"
         - name: BASE_URL
           value: "https://mealie.cluster.fun"
         ports:
         - containerPort: 9000
-          name: api
+          name: web
         volumeMounts:
           - mountPath: /app/data
             name: data
+        resources:
+          requests:
+            cpu: 200m
+            memory: 375Mi
+          limits:
+            cpu: 1000m
+            memory: 550Mi
       volumes:
       - name: data
         persistentVolumeClaim:
           claimName: mealie
 
-
 ---
 
 apiVersion: v1
@@ -114,22 +98,6 @@ spec:
     app: mealie
 ---
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: mealie-api
-  namespace: mealie
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: api
-    name: api
-  selector:
-    app: mealie
-
----
-
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -138,6 +106,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
 spec:
   ingressClassName: nginx
   tls:
@@ -155,13 +124,3 @@ spec:
             name: mealie
             port:
               name: web
-  - host: mealie.cluster.fun
-    http:
-      paths:
-      - path: /api
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: mealie-api
-            port:
-              name: api

manifests/mealie/pvs.yaml

@@ -1,29 +1,3 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  annotations:
-    pv.kubernetes.io/provisioned-by: csi.scaleway.com
-  finalizers:
-  - kubernetes.io/pv-protection
-  - external-attacher/csi-scaleway-com
-  name: pvc-afe7fbb6-1f5a-4169-bad1-c9d43752ee7a
-spec:
-  accessModes:
-  - ReadWriteOnce
-  capacity:
-    storage: 2Gi
-  csi:
-    driver: csi.scaleway.com
-    fsType: ext4
-    volumeAttributes:
-      encrypted: "false"
-      storage.kubernetes.io/csiProvisionerIdentity: 1646426415842-8081-csi.scaleway.com
-    volumeHandle: fr-par-1/efbe7dc1-4660-4db8-a3b4-42114075a318
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: scw-bssd
-  volumeMode: Filesystem
-
----
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
@@ -35,5 +9,5 @@ spec:
   resources:
     requests:
       storage: 2Gi
-  volumeName: pvc-afe7fbb6-1f5a-4169-bad1-c9d43752ee7a
+  storageClassName: sbs-default-retain
 ---

manifests/monitoring-civo/kube-state-metrics.yaml

@@ -1,255 +0,0 @@
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kube-state-metrics
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: kube-state-metrics
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/name: kube-state-metrics
-  name: kube-state-metrics
-rules:
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-    - certificatesigningrequests
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - configmaps
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["batch"]
-    resources:
-    - cronjobs
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["extensions", "apps"]
-    resources:
-    - daemonsets
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["extensions", "apps"]
-    resources:
-    - deployments
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - endpoints
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["autoscaling"]
-    resources:
-    - horizontalpodautoscalers
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources:
-    - ingresses
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["batch"]
-    resources:
-    - jobs
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - limitranges
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources:
-      - mutatingwebhookconfigurations
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - namespaces
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["networking.k8s.io"]
-    resources:
-    - networkpolicies
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - nodes
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - persistentvolumeclaims
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - persistentvolumes
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["policy"]
-    resources:
-      - poddisruptionbudgets
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - pods
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["extensions", "apps"]
-    resources:
-    - replicasets
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - replicationcontrollers
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - resourcequotas
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - secrets
-    verbs: ["list", "watch"]
-
-  - apiGroups: [""]
-    resources:
-    - services
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["apps"]
-    resources:
-    - statefulsets
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["storage.k8s.io"]
-    resources:
-      - storageclasses
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources:
-      - validatingwebhookconfigurations
-    verbs: ["list", "watch"]
-
-  - apiGroups: ["storage.k8s.io"]
-    resources:
-      - volumeattachments
-    verbs: ["list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/name: kube-state-metrics
-  name: kube-state-metrics
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kube-state-metrics
-subjects:
-- kind: ServiceAccount
-  name: kube-state-metrics
-  namespace: monitoring
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: kube-state-metrics
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: kube-state-metrics
-  annotations:
-    prometheus.io/scrape: 'true'
-spec:
-  type: "ClusterIP"
-  ports:
-  - name: "http"
-    protocol: TCP
-    port: 8080
-    targetPort: 8080
-  selector:
-    app.kubernetes.io/name: kube-state-metrics
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: kube-state-metrics
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: kube-state-metrics
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kube-state-metrics
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: kube-state-metrics
-    spec:
-      serviceAccountName: kube-state-metrics
-      securityContext:
-        fsGroup: 65534
-        runAsGroup: 65534
-        runAsUser: 65534
-      containers:
-      - name: kube-state-metrics
-        args:
-        #- --resources=certificatesigningrequests
-        - --resources=configmaps
-        - --resources=cronjobs
-        - --resources=daemonsets
-        - --resources=deployments
-        #- --resources=endpoints
-        #- --resources=horizontalpodautoscalers
-        - --resources=ingresses
-        - --resources=jobs
-        #- --resources=limitranges
-        - --resources=mutatingwebhookconfigurations
-        - --resources=namespaces
-        #- --resources=networkpolicies
-        - --resources=nodes
-        - --resources=persistentvolumeclaims
-        - --resources=persistentvolumes
-        - --resources=poddisruptionbudgets
-        - --resources=pods
-        - --resources=replicasets
-        #- --resources=replicationcontrollers
-        #- --resources=resourcequotas
-        - --resources=secrets
-        - --resources=services
-        - --resources=statefulsets
-        - --resources=storageclasses
-        - --resources=validatingwebhookconfigurations
-        #- --resources=volumeattachments
-        imagePullPolicy: IfNotPresent
-        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1"
-        ports:
-        - containerPort: 8080
-        livenessProbe:
-          httpGet:
-            path: /healthz
-            port: 8080
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        readinessProbe:
-          httpGet:
-            path: /
-            port: 8080
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
----

manifests/monitoring-civo/prometheus-server.yaml

@@ -1,64 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: prometheus-server
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: prometheus
-    app.kubernetes.io/component: server
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/name: prometheus
-    app.kubernetes.io/component: server
-  name: prometheus-server
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-      - nodes/proxy
-      - nodes/metrics
-      - services
-      - endpoints
-      - pods
-      - ingresses
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - "extensions"
-      - "networking.k8s.io"
-    resources:
-      - ingresses/status
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - nonResourceURLs:
-      - "/metrics"
-    verbs:
-      - get
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/name: prometheus
-    app.kubernetes.io/component: server
-  name: prometheus-server
-subjects:
-  - kind: ServiceAccount
-    name: prometheus-server
-    namespace: monitoring
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: prometheus-server
----

manifests/monitoring-civo/promtail.yaml

@@ -1,292 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: promtail
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: promtail
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: promtail
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: promtail
-data:
-  promtail.yaml: |
-    client:
-      backoff_config:
-        max_period: 5m
-        max_retries: 10
-        min_period: 500ms
-      batchsize: 1048576
-      batchwait: 1s
-      external_labels: {}
-      timeout: 10s
-    positions:
-      filename: /run/promtail/positions.yaml
-    server:
-      http_listen_port: 3101
-    clients:
-    - url: http://loki-distributed.proxy-civo.svc:80/loki/api/v1/push
-      external_labels:
-        kubernetes_cluster: civo
-    target_config:
-      sync_period: 10s
-    scrape_configs:
-    - job_name: kubernetes-pods
-      pipeline_stages:
-        - docker: {}
-        - cri: {}
-        - match:
-            selector: '{app="weave-net"}'
-            action: drop
-        - match:
-            selector: '{filename=~".*konnectivity.*"}'
-            action: drop
-        - match:
-            selector: '{name=~".*"} |~ ".*/healthz.*"'
-            action: drop
-        - match:
-            selector: '{name=~".*"} |~ ".*/api/health.*"'
-            action: drop
-        - match:
-            selector: '{name=~".*"} |~ ".*kube-probe/.*"'
-            action: drop
-        - match:
-            selector: '{app="internal-proxy"}'
-            action: drop
-        - match:
-            selector: '{app="non-auth-proxy"}'
-            action: drop
-        - match:
-            selector: '{app="vpa"}'
-            action: drop
-        - match:
-            selector: '{app="promtail"}'
-            action: drop
-        - match:
-            selector: '{app="csi-node"}'
-            action: drop
-        - match:
-            selector: '{app="victoria-metrics"}'
-            action: drop
-        - match:
-            selector: '{app="git-sync"}'
-            action: drop
-        - match:
-            selector: '{app="ingress-nginx"}'
-            stages:
-            - json:
-                expressions:
-                  request_host: host
-                  request_path: path
-                  request_method: method
-                  response_status: status
-            - drop:
-                source: "request_path"
-                value:  "/healthz"
-            - drop:
-                source: "request_path"
-                value:  "/health"
-            - labels:
-                request_host:
-                request_method:
-                response_status:
-        - match:
-            selector: '{app="traefik"}'
-            stages:
-            - json:
-                expressions:
-                  request_host: RequestHost
-                  request_path: RequestPath
-                  request_method: RequestMethod
-                  response_status: OriginStatus
-            - drop:
-                source: "request_path"
-                value:  "/healthz"
-            - drop:
-                source: "request_path"
-                value:  "/health"
-            - drop:
-                source: "request_path"
-                value:  "/ping"
-            - labels:
-                request_host:
-                request_method:
-                response_status:
-      kubernetes_sd_configs:
-        - role: pod
-      relabel_configs:
-        - source_labels:
-            - __meta_kubernetes_pod_controller_name
-          regex: ([0-9a-z-.]+?)(-[0-9a-f]{8,10})?
-          action: replace
-          target_label: __tmp_controller_name
-        - source_labels:
-            - __meta_kubernetes_pod_label_app_kubernetes_io_name
-            - __meta_kubernetes_pod_label_app
-            - __tmp_controller_name
-            - __meta_kubernetes_pod_name
-          regex: ^;*([^;]+)(;.*)?$
-          action: replace
-          target_label: app
-        - source_labels:
-            - __meta_kubernetes_pod_label_app_kubernetes_io_component
-            - __meta_kubernetes_pod_label_component
-          regex: ^;*([^;]+)(;.*)?$
-          action: replace
-          target_label: component
-        - action: replace
-          source_labels:
-            - __meta_kubernetes_pod_node_name
-          target_label: node_name
-        - action: replace
-          source_labels:
-            - __meta_kubernetes_namespace
-          target_label: namespace
-        - action: replace
-          replacement: $1
-          separator: /
-          source_labels:
-            - namespace
-            - app
-          target_label: job
-        - action: replace
-          source_labels:
-            - __meta_kubernetes_pod_name
-          target_label: pod
-        - action: replace
-          source_labels:
-            - __meta_kubernetes_pod_container_name
-          target_label: container
-        - action: replace
-          replacement: /var/log/pods/*$1/*.log
-          separator: /
-          source_labels:
-            - __meta_kubernetes_pod_uid
-            - __meta_kubernetes_pod_container_name
-          target_label: __path__
-        - action: replace
-          replacement: /var/log/pods/*$1/*.log
-          regex: true/(.*)
-          separator: /
-          source_labels:
-            - __meta_kubernetes_pod_annotationpresent_kubernetes_io_config_hash
-            - __meta_kubernetes_pod_annotation_kubernetes_io_config_hash
-            - __meta_kubernetes_pod_container_name
-          target_label: __path__
-        - action: labelmap
-          regex: __meta_kubernetes_pod_label_(.+)
-
----
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: promtail-clusterrole
-  labels:
-    app.kubernetes.io/name: promtail
-rules:
-- apiGroups: [""] # "" indicates the core API group
-  resources:
-  - nodes
-  - nodes/proxy
-  - services
-  - endpoints
-  - pods
-  verbs: ["get", "watch", "list"]
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: promtail-clusterrolebinding
-  labels:
-    app.kubernetes.io/name: promtail
-subjects:
-  - kind: ServiceAccount
-    name: promtail
-    namespace: monitoring
-roleRef:
-  kind: ClusterRole
-  name: promtail-clusterrole
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: promtail
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: promtail
-  annotations:
-    configmap.reloader.stakater.com/reload: "promtail"
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: promtail
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: promtail
-      annotations:
-        prometheus.io/port: http-metrics
-        prometheus.io/scrape: "true"
-    spec:
-      serviceAccountName: promtail
-      containers:
-        - name: promtail
-          image: "grafana/promtail:2.9.3"
-          imagePullPolicy: IfNotPresent
-          args:
-            - "-config.file=/etc/promtail/promtail.yaml"
-          volumeMounts:
-            - name: config
-              mountPath: /etc/promtail
-            - name: run
-              mountPath: /run/promtail
-            - mountPath: /var/lib/docker/containers
-              name: docker
-              readOnly: true
-            - mountPath: /var/log/pods
-              name: pods
-              readOnly: true
-          env:
-            - name: HOSTNAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-          ports:
-            - containerPort: 3101
-              name: http-metrics
-          securityContext:
-            readOnlyRootFilesystem: true
-            runAsGroup: 0
-            runAsUser: 0
-          readinessProbe:
-            failureThreshold: 5
-            httpGet:
-              path: /ready
-              port: http-metrics
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 1
-      tolerations:
-        - effect: NoSchedule
-          key: node-role.kubernetes.io/master
-          operator: Exists
-      volumes:
-        - name: config
-          configMap:
-            name: promtail
-        - name: run
-          hostPath:
-            path: /run/promtail
-        - hostPath:
-            path: /var/lib/docker/containers
-          name: docker
-        - hostPath:
-            path: /var/log/pods
-          name: pods
----