Updates

Added new RSS app
Reverted w-2-r
2020-11-07 13:29:37 +00:00 · 2020-10-19 06:05:48 +01:00 · 2020-10-15 14:40:59 +01:00 · 2020-10-14 11:05:40 +01:00 · 2020-10-14 10:02:52 +01:00 · 2020-10-14 09:40:45 +01:00
28 changed files with 949 additions and 241 deletions
--- a/manifests/11-year-anniversary.yaml
+++ b/manifests/11-year-anniversary.yaml
@@ -0,0 +1,85 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: anniversary
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-config
+  namespace: anniversary
+  annotations:
+    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: .dockerconfigjson
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: e30=
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: anniversary
+  namespace: anniversary
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: anniversary
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: anniversary
+  namespace: anniversary
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: anniversary
+  template:
+    metadata:
+      labels:
+        app: anniversary
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      containers:
+      - name: web
+        image: docker.cluster.fun/private/11-year-anniversary:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 283Mi
+          requests:
+            memory: 283Mi
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: anniversary
+  namespace: anniversary
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - 11-year-anniversary.marcusnoble.co.uk
+    secretName: anniversary-ingress
+  rules:
+  - host: 11-year-anniversary.marcusnoble.co.uk
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: anniversary
+          servicePort: 80
--- a/manifests/auth-proxy.yaml
+++ b/manifests/auth-proxy.yaml
@@ -0,0 +1,83 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: auth-proxy
+  namespace: inlets
+  annotations:
+    kube-1password: mr6spkkx7n3memkbute6ojaarm
+    kube-1password/vault: Kubernetes
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: auth-proxy
+  namespace: inlets
+  labels:
+    app: auth-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: auth-proxy
+  template:
+    metadata:
+      labels:
+        app: auth-proxy
+    spec:
+      containers:
+      - args:
+        - --cookie-secure=false
+        - --provider=oidc
+        - --provider-display-name=Auth0
+        - --upstream=http://inlets.inlets.svc.cluster.local
+        - --http-address=$(HOST_IP):8080
+        - --email-domain=*
+        - --pass-basic-auth=false
+        - --pass-access-token=false
+        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
+        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQNFT
+        - --cookie-expire=336h0m0s
+        env:
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: OAUTH2_PROXY_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: auth-proxy
+        - name: OAUTH2_PROXY_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: auth-proxy
+        image: quay.io/oauth2-proxy/oauth2-proxy:v6.1.1
+        name: oauth-proxy
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+        resources:
+          limits:
+            memory: 50Mi
+          requests:
+            memory: 50Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: auth-proxy
+  namespace: inlets
+  labels:
+    app: auth-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: auth-proxy
+  type: ClusterIP
--- a/manifests/base64.yaml
+++ b/manifests/base64.yaml
@@ -0,0 +1,72 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: base64
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: base64
+  namespace: base64
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: base64
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: base64
+  namespace: base64
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: base64
+  template:
+    metadata:
+      labels:
+        app: base64
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      containers:
+      - name: web
+        image: docker.cluster.fun/averagemarcus/base64:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 10Mi
+          requests:
+            memory: 10Mi
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: base64
+  namespace: base64
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - base64.cluster.fun
+    secretName: base64-ingress
+  rules:
+  - host: base64.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: base64
+          servicePort: 80
--- a/manifests/cctv.yaml
+++ b/manifests/cctv.yaml
@@ -1,97 +1,8 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cctv
---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cctv-auth
-  namespace: cctv
-  annotations:
-    kube-1password: mr6spkkx7n3memkbute6ojaarm
-    kube-1password/vault: Kubernetes
-type: Opaque
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cctv-auth
-  namespace: cctv
-  labels:
-    app: cctv-auth
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: cctv-auth
-  template:
-    metadata:
-      labels:
-        app: cctv-auth
-    spec:
-      containers:
-      - args:
-        - --cookie-secure=false
-        - --provider=oidc
-        - --provider-display-name=Auth0
-        - --upstream=http://inlets.inlets.svc.cluster.local
-        - --http-address=$(HOST_IP):8080
-        - --redirect-url=https://cctv.cluster.fun/oauth2/callback
-        - --email-domain=*
-        - --pass-basic-auth=false
-        - --pass-access-token=false
-        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
-        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQN
-        env:
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: OAUTH2_PROXY_CLIENT_ID
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: cctv-auth
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: cctv-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v5.1.1
-        name: oauth-proxy
-        ports:
-        - containerPort: 8080
-          protocol: TCP
-        resources:
-          limits:
-            memory: 50Mi
-          requests:
-            memory: 50Mi
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: cctv-auth
-  namespace: cctv
-  labels:
-    app: cctv-auth
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: cctv-auth
-  type: ClusterIP
---
 apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
  name: cctv-auth
-  namespace: cctv
+  namespace: inlets
  labels:
    app: cctv-auth
  annotations:
@@ -110,5 +21,5 @@ spec:
      paths:
      - path: /
        backend:
-          serviceName: cctv-auth
+          serviceName: auth-proxy
          servicePort: 80
--- a/manifests/downloads.yaml
+++ b/manifests/downloads.yaml
@@ -1,97 +1,8 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: downloads
---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: downloads-auth
-  namespace: downloads
-  annotations:
-    kube-1password: mr6spkkx7n3memkbute6ojaarm
-    kube-1password/vault: Kubernetes
-type: Opaque
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: downloads-auth
-  namespace: downloads
-  labels:
-    app: downloads-auth
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: downloads-auth
-  template:
-    metadata:
-      labels:
-        app: downloads-auth
-    spec:
-      containers:
-      - args:
-        - --cookie-secure=false
-        - --provider=oidc
-        - --provider-display-name=Auth0
-        - --upstream=http://inlets.inlets.svc.cluster.local
-        - --http-address=$(HOST_IP):8080
-        - --redirect-url=https://downloads.cluster.fun/oauth2/callback
-        - --email-domain=*
-        - --pass-basic-auth=false
-        - --pass-access-token=false
-        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
-        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQN
-        env:
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: OAUTH2_PROXY_CLIENT_ID
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: downloads-auth
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: downloads-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v5.1.1
-        name: oauth-proxy
-        ports:
-        - containerPort: 8080
-          protocol: TCP
-        resources:
-          limits:
-            memory: 250Mi
-          requests:
-            memory: 250Mi
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: downloads-auth
-  namespace: downloads
-  labels:
-    app: downloads-auth
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: downloads-auth
-  type: ClusterIP
---
 apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
  name: downloads-auth
-  namespace: downloads
+  namespace: inlets
  labels:
    app: downloads-auth
  annotations:
@@ -110,6 +21,5 @@ spec:
      paths:
      - path: /
        backend:
-          serviceName: downloads-auth
+          serviceName: auth-proxy
          servicePort: 80
-
--- a/manifests/gitea.yaml
+++ b/manifests/gitea.yaml
@@ -47,7 +47,7 @@ spec:
    spec:
      containers:
      - name: git
-        image: gitea/gitea:1.11
+        image: gitea/gitea:1.12.3
        env:
        - name: APP_NAME
          value: "Git"
--- a/manifests/goplayground.yaml
+++ b/manifests/goplayground.yaml
@@ -0,0 +1,66 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: goplayground
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: goplayground
+  namespace: goplayground
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: goplayground
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: goplayground
+  namespace: goplayground
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: goplayground
+  template:
+    metadata:
+      labels:
+        app: goplayground
+    spec:
+      containers:
+      - name: web
+        image: x1unix/go-playground:1.6.2
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 8000
+          name: web
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: goplayground
+  namespace: goplayground
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - go.cluster.fun
+    secretName: goplayground-ingress
+  rules:
+  - host: go.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: goplayground
+          servicePort: 80
+
--- a/manifests/harbor_chart.yaml
+++ b/manifests/harbor_chart.yaml
@@ -23,7 +23,7 @@ spec:
  chart:
    repository: https://helm.goharbor.io
    name: harbor
-    version: 1.3.2
+    version: 1.5.1
  maxHistory: 4
  skipCRDs: false
  valuesFrom:
@@ -33,6 +33,8 @@ spec:
      key: values.yaml
      optional: false
  values:
+    updateStrategy:
+      type: Recreate
    portal:
      resources:
        requests:
@@ -54,4 +56,3 @@ spec:
        resources:
          requests:
            memory: 64Mi
-
--- a/manifests/inlets.yaml
+++ b/manifests/inlets.yaml
@@ -49,7 +49,7 @@ spec:
    spec:
      containers:
      - name: inlets
-        image: inlets/inlets:2.7.0
+        image: inlets/inlets:2.7.6
        imagePullPolicy: Always
        command: ["inlets"]
        args:
@@ -81,7 +81,7 @@ spec:
 apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
-  name: pyload
+  name: home-assistant
  namespace: inlets
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
@@ -91,10 +91,50 @@ metadata:
 spec:
  tls:
  - hosts:
-    - pyload.cluster.fun
-    secretName: pyload-ingress
+    - home.cluster.fun
+    secretName: home-assistant-ingress
  rules:
-  - host: pyload.cluster.fun
+  - host: home.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: inlets
+          servicePort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: downloads-rpc
+  namespace: inlets
+  labels:
+    app: inlets
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      protocol: TCP
+      targetPort: 8000
+  selector:
+    app: inlets
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: vpn-check
+  namespace: inlets
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - vpn-check.cluster.fun
+    secretName: vpn-check-ingress
+  rules:
+  - host: vpn-check.cluster.fun
    http:
      paths:
      - path: /
--- a/manifests/jackett.yaml
+++ b/manifests/jackett.yaml
@@ -0,0 +1,25 @@
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: jackett-auth
+  namespace: inlets
+  labels:
+    app: jackett-auth
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - jackett.cluster.fun
+    secretName: jackett-ingress
+  rules:
+  - host: jackett.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: auth-proxy
+          servicePort: 80
--- a/manifests/kube-janitor.yaml
+++ b/manifests/kube-janitor.yaml
@@ -88,7 +88,7 @@ spec:
          - --interval=15
          - --rules-file=/config/rules.yaml
          - --include-namespaces=tekton-pipelines
-          - --include-resources=pods
+          - --include-resources=pods,pipelineruns,taskruns
        resources:
          limits:
            memory: 100Mi
--- a/manifests/linx-server.yaml
+++ b/manifests/linx-server.yaml
@@ -62,7 +62,7 @@ spec:
    spec:
      containers:
      - name: web
-        image: andreimarcu/linx-server:version-2.3.5
+        image: andreimarcu/linx-server:version-2.3.6
        imagePullPolicy: Always
        args:
          - -config
--- a/manifests/loki_chart.yaml
+++ b/manifests/loki_chart.yaml
@@ -13,6 +13,17 @@ metadata:
    kube-1password/vault: Kubernetes
 type: Opaque
 ---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: loki-values
+  namespace: logging
+  annotations:
+    kube-1password: 6u6ebtofcxbr5r4q7k5wkc5zea
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: values.yaml
+type: Opaque
+---
 apiVersion: helm.fluxcd.io/v1
 kind: HelmRelease
 metadata:
@@ -22,18 +33,21 @@ spec:
  chart:
    repository: https://grafana.github.io/loki/charts
    name: loki-stack
-    version: 0.36.2
+    version: 2.0.2
  maxHistory: 4
  skipCRDs: false
+  valuesFrom:
+  - secretKeyRef:
+      name: loki-values
+      namespace: logging
+      key: values.yaml
+      optional: false
  values:
    fluent-bit:
      enabled: "true"
    promtail:
      enabled: "true"
-    loki:
-      persistence:
-        enabled: "true"
-        size: 10Gi
+

 ---
 apiVersion: helm.fluxcd.io/v1
@@ -43,20 +57,16 @@ metadata:
  namespace: logging
 spec:
  chart:
-    repository: https://kubernetes-charts.storage.googleapis.com
+    repository: https://grafana.github.io/helm-charts
    name: grafana
-    version: 5.0.22
+    version: 6.1.3
  maxHistory: 4
  skipCRDs: false
  values:
-    image:
-      tag: 7.0.0
    admin:
      existingSecret: "grafana-credentials"
      userKey: username
      passwordKey: password
-    persistence:
-      enabled: "false"
    datasources:
      datasources.yaml:
        apiVersion: 1
--- a/manifests/matrix_chart.yaml
+++ b/manifests/matrix_chart.yaml
@@ -74,7 +74,7 @@ spec:
    synapse:
      image:
        repository: "matrixdotorg/synapse"
-        tag: v1.12.4
+        tag: v1.16.1
        pullPolicy: IfNotPresent
      service:
        type: ClusterIP
@@ -111,7 +111,7 @@ spec:
      permalinkPrefix: "https://chat.cluster.fun"
      image:
        repository: "vectorim/riot-web"
-        tag: v1.6.0
+        tag: v1.6.8
        pullPolicy: IfNotPresent
      service:
        type: ClusterIP
--- a/manifests/nextcloud_chart.yaml
+++ b/manifests/nextcloud_chart.yaml
@@ -25,7 +25,7 @@ spec:
  chart:
    repository: https://kubernetes-charts.storage.googleapis.com
    name: nextcloud
-    version: 1.10.0
+    version: 1.12.0
  maxHistory: 5
  valuesFrom:
  - secretKeyRef:
@@ -35,7 +35,7 @@ spec:
      optional: false
  values:
    image:
-      tag: 18-apache
+      tag: 19-apache
    ingress:
      enabled: true
      annotations:
--- a/manifests/nodered.yaml
+++ b/manifests/nodered.yaml
@@ -73,7 +73,7 @@ spec:
            mountPath: /data
      containers:
      - name: web
-        image: nodered/node-red:latest-12
+        image: nodered/node-red:1.1.3-12
        imagePullPolicy: Always
        ports:
        - containerPort: 1880
--- a/manifests/outline.yaml
+++ b/manifests/outline.yaml
@@ -0,0 +1,124 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: outline
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: outline
+  namespace: outline
+  annotations:
+    kube-1password: maouivotrbgydslnsukbjrwgja
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: .env
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: outline
+  namespace: outline
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: outline
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: outline
+  namespace: outline
+spec:
+  selector:
+    matchLabels:
+      app: outline
+  serviceName: outline
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: outline
+    spec:
+      containers:
+      - name: postgres
+        image: postgres:9-alpine
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 5432
+          name: db
+        env:
+        - name: POSTGRES_USER
+          value: user
+        - name: POSTGRES_PASSWORD
+          value: pass
+        - name: POSTGRES_DB
+          value: outline
+        - name: PGDATA
+          value: /var/lib/postgresql/data/outline
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/postgresql/data
+      - name: redis
+        image: redis:6
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 6379
+          name: redis
+      - name: outline
+        image: docker.cluster.fun/averagemarcus/outline:latest
+        imagePullPolicy: Always
+        command:
+          - sh
+          - -c
+          - |
+            sleep 10 && yarn sequelize db:migrate && yarn build && yarn start
+        ports:
+        - containerPort: 3000
+          name: web
+        volumeMounts:
+          - mountPath: /opt/outline/.env
+            subPath: .env
+            name: outline-env
+            readOnly: true
+      volumes:
+        - name: outline-env
+          secret:
+            secretName: outline
+  volumeClaimTemplates:
+  - metadata:
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 5Gi
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: outline
+  namespace: outline
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - outline.cluster.fun
+    secretName: outline-ingress
+  rules:
+  - host: outline.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: outline
+          servicePort: 80
--- a/manifests/paradoxfox.yaml
+++ b/manifests/paradoxfox.yaml
@@ -0,0 +1,128 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: paradoxfox
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-config
+  namespace: paradoxfox
+  annotations:
+    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: .dockerconfigjson
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: e30=
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: etsy-token
+  namespace: paradoxfox
+  annotations:
+    kube-1password: akkchysgrvhawconx63plt3xgy
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: password
+stringData:
+  password: ""
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paradoxfox
+  namespace: paradoxfox
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: 443
+    name: web
+  selector:
+    app: paradoxfox
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paradoxfox
+  namespace: paradoxfox
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: paradoxfox
+  template:
+    metadata:
+      labels:
+        app: paradoxfox
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      containers:
+      - name: web
+        image: docker.cluster.fun/private/paradoxfox:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 443
+          name: web
+        env:
+          - name: ETSY_TOKEN
+            valueFrom:
+              secretKeyRef:
+                name: etsy-token
+                key: password
+        resources:
+          limits:
+            memory: 200Mi
+          requests:
+            memory: 200Mi
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: paradoxfox
+  namespace: paradoxfox
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - paradoxfox.space
+    secretName: paradoxfox-ingress
+  rules:
+  - host: paradoxfox.space
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: paradoxfox
+          servicePort: 80
+
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: paradoxfox-www
+  namespace: paradoxfox
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - www.paradoxfox.space
+    secretName: paradoxfox-www-ingress
+  rules:
+  - host: www.paradoxfox.space
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: paradoxfox
+          servicePort: 80
--- a/manifests/printer.yaml
+++ b/manifests/printer.yaml
@@ -0,0 +1,26 @@
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: printer-auth
+  namespace: inlets
+  labels:
+    app: printer-auth
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - printer.cluster.fun
+    secretName: printer-ingress
+  rules:
+  - host: printer.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: auth-proxy
+          servicePort: 80
+
--- a/manifests/radarr.yaml
+++ b/manifests/radarr.yaml
@@ -0,0 +1,25 @@
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: radarr
+  namespace: inlets
+  labels:
+    app: radarr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - radarr.cluster.fun
+    secretName: radarr-ingress
+  rules:
+  - host: radarr.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: auth-proxy
+          servicePort: 80
--- a/manifests/rss.yaml
+++ b/manifests/rss.yaml
@@ -15,16 +15,38 @@ spec:
    requests:
      storage: 1Gi
 ---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: rss-db
+  namespace: rss
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: rss-auth
+  namespace: rss
+  annotations:
+    kube-1password: mr6spkkx7n3memkbute6ojaarm
+    kube-1password/vault: Kubernetes
+type: Opaque
+---
 apiVersion: v1
 kind: Service
 metadata:
-  name: rss
+  name: rss-new
  namespace: rss
 spec:
  type: ClusterIP
  ports:
  - port: 80
-    targetPort: 8080
+    targetPort: 8000
    name: web
  selector:
    app: rss
@@ -46,22 +68,56 @@ spec:
      labels:
        app: rss
    spec:
-      securityContext:
-        fsGroup: 1000
      dnsConfig:
        options:
          - name: ndots
            value: "2"
      containers:
-      - name: web
-        image: mdswanson/stringer
+      - args:
+        - --cookie-secure=false
+        - --provider=oidc
+        - --provider-display-name=Auth0
+        - --upstream=http://localhost:8080
+        - --http-address=$(HOST_IP):8000
+        - --redirect-url=https://rss.cluster.fun/oauth2/callback
+        - --email-domain=marcusnoble.co.uk
+        - --pass-basic-auth=false
+        - --pass-access-token=false
+        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
+        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQN
+        env:
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: OAUTH2_PROXY_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: rss-auth
+        - name: OAUTH2_PROXY_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: rss-auth
+        image: quay.io/oauth2-proxy/oauth2-proxy:v5.1.1
+        name: oauth-proxy
+        ports:
+        - containerPort: 8000
+          protocol: TCP
+        resources:
+          limits:
+            memory: 125Mi
+          requests:
+            memory: 125Mi
+      - name: web
+        image: docker.cluster.fun/averagemarcus/gopherss:latest
        env:
-        - name: SECRET_TOKEN
-          value: inward-popcorn-decamp-epsilon
        - name: PORT
          value: "8080"
-        - name: DATABASE_URL
-          value: sqlite3:/data/stringer.db
+        - name: DB_PATH
+          value: /data/feeds.db
        ports:
        - containerPort: 8080
          name: web
@@ -76,7 +132,7 @@ spec:
      volumes:
      - name: storage
        persistentVolumeClaim:
-          claimName: rss
+          claimName: rss-db
 ---
 apiVersion: extensions/v1beta1
 kind: Ingress
@@ -99,7 +155,7 @@ spec:
      paths:
      - path: /
        backend:
-          serviceName: rss
+          serviceName: rss-new
          servicePort: 80

 ---
--- a/manifests/sonarr.yaml
+++ b/manifests/sonarr.yaml
@@ -0,0 +1,25 @@
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: sonarr
+  namespace: inlets
+  labels:
+    app: sonarr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - sonarr.cluster.fun
+    secretName: sonarr-ingress
+  rules:
+  - host: sonarr.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: auth-proxy
+          servicePort: 80
--- a/manifests/til.yaml
+++ b/manifests/til.yaml
@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: til
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: til
+  namespace: til
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: til
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: til
+  namespace: til
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: til
+  template:
+    metadata:
+      labels:
+        app: til
+    spec:
+      containers:
+      - name: web
+        image: docker.cluster.fun/averagemarcus/til:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 100Mi
+          requests:
+            memory: 100Mi
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: til
+  namespace: til
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - til.marcusnoble.co.uk
+    secretName: til-ingress
+  rules:
+  - host: til.marcusnoble.co.uk
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: til
+          servicePort: 80
+
--- a/manifests/traefik-lb.yaml
+++ b/manifests/traefik-lb.yaml
@@ -46,7 +46,7 @@ spec:
        - --defaultentrypoints=http,https
        - --entrypoints=Name:https Address::443 TLS
        - --entrypoints=Name:http Address::80
-        - --accesslog
+        - --accesslog=true
        - --accesslog.format=json
        image: docker.io/traefik:1.7
        imagePullPolicy: IfNotPresent
--- a/manifests/transmission.yaml
+++ b/manifests/transmission.yaml
@@ -0,0 +1,25 @@
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: transmission
+  namespace: inlets
+  labels:
+    app: transmission
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/frontend-entry-points: http,https
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    traefik.ingress.kubernetes.io/redirect-permanent: "true"
+spec:
+  tls:
+  - hosts:
+    - transmission.cluster.fun
+    secretName: transmission-ingress
+  rules:
+  - host: transmission.cluster.fun
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: auth-proxy
+          servicePort: 80
--- a/tekton/tasks/docker-build-and-publish.yaml
+++ b/tekton/tasks/docker-build-and-publish.yaml
@@ -8,17 +8,13 @@ spec:
  - name: DOCKERFILE
    type: string
    description: The path to the dockerfile to build
-    default: /Dockerfile
+    default: Dockerfile
  - name: CONTEXT
    type: string
    description: The build context used by Docker.
-    default: ./
+    default: .
  - name: IMAGE
    type: string
-    description: Name (reference) of the image to build.
-  - name: EXTRA_ARGS
-    type: string
-    default: ""
  resources:
    inputs:
    - name: src
@@ -29,24 +25,35 @@ spec:
  steps:
  - name: build-and-push
    workingDir: /workspace/src
-    image: gcr.io/kaniko-project/executor:latest
+    image: moby/buildkit:latest
    env:
    - name: DOCKER_CONFIG
-      value: /kaniko/.docker
+      value: /root/.docker
    command:
-    - /kaniko/executor
-    - $(params.EXTRA_ARGS)
-    - --dockerfile=/workspace/src/$(params.DOCKERFILE)
-    - --context=/workspace/src/$(params.CONTEXT)
-    - --destination=$(params.IMAGE)
-    - --oci-layout-path=/workspace/src/image-digest
-    - --digest-file=/tekton/results/IMAGE_DIGEST
-    - --cache=true
+      - sh
+      - -c
+      - |
+        PLATFORMS=$(grep 'PLATFORMS ?= ' Makefile | sed -E 's/^PLATFORMS \?= (.+)$/\1/')
+        if [ -z $PLATFORMS ]; then
+          PLATFORMS=linux/amd64
+        fi
+
+        buildctl-daemonless.sh --debug \
+          build \
+          --progress=plain \
+          --frontend=dockerfile.v0 \
+          --opt filename=$(params.DOCKERFILE) \
+          --opt platform=${PLATFORMS} \
+          --local context=$(params.CONTEXT) \
+          --local dockerfile=. \
+          --output type=image,name=$(params.IMAGE),push=true \
+          --export-cache type=inline \
+          --import-cache type=registry,ref=$(params.IMAGE)
    securityContext:
-      runAsUser: 0
+      privileged: true
    volumeMounts:
      - name: docker-config
-        mountPath: /kaniko/.docker/config.json
+        mountPath: /root/.docker/config.json
        subPath: config.json
  volumes:
    - name: docker-config
--- a/terraform/bucket.tf
+++ b/terraform/bucket.tf
@@ -15,3 +15,21 @@ resource "scaleway_object_bucket" "linx" {
 output "linx-bucket_id" {
  value = scaleway_object_bucket.linx.id
 }
+
+resource "scaleway_object_bucket" "outline" {
+  name = "cluster.fun-outline"
+  acl  = "private"
+}
+
+output "outline-bucket_id" {
+  value = scaleway_object_bucket.outline.id
+}
+
+resource "scaleway_object_bucket" "logs" {
+  name = "cluster.fun-logs"
+  acl  = "private"
+}
+
+output "logs-bucket_id" {
+  value = scaleway_object_bucket.logs.id
+}
--- a/terraform/kubernetes-charts.tf
+++ b/terraform/kubernetes-charts.tf
@@ -24,7 +24,7 @@ resource "helm_release" "helm-operator" {
  repository = data.helm_repository.fluxcd.metadata[0].name
  chart      = "helm-operator"

-  max_history = 4
+  max_history = 3

  set {
    name  = "helm.versions"
Author	SHA1	Message	Date
Marcus Noble	fa51de4fb6	Updates	2020-11-07 13:29:37 +00:00
Marcus Noble	d29c9ec82c	Added new RSS app	2020-10-19 06:05:48 +01:00
Marcus Noble	5f8800f311	Reverted w-2-r	2020-10-15 14:40:59 +01:00
Marcus Noble	eef0a6c22d	Bump inlets version	2020-10-14 11:05:40 +01:00
Marcus Noble	d9d71a5dc7	Removed JQ	2020-10-14 10:02:52 +01:00
Marcus Noble	ff99e577cd	Added JQ	2020-10-14 09:40:45 +01:00
Marcus Noble	f26d02ca7f	Added base64 project	2020-10-13 17:36:48 +01:00
Marcus Noble	94e18c12ea	Use a single auth proxy	2020-10-10 16:46:27 +01:00
Marcus Noble	84a9c19d93	Added anniversary	2020-10-03 13:20:33 +01:00
Marcus Noble	8f85a65cbe	Added VPN check app	2020-09-22 22:35:40 +01:00
Marcus Noble	22ae249a1f	Added download tunnels	2020-09-20 21:18:17 +01:00
Marcus Noble	50f86cc39f	Reduce logging	2020-09-18 22:29:12 +01:00
Marcus Noble	295bb89828	Switch Loki to storing in bucket	2020-09-18 20:12:11 +01:00
Marcus Noble	3ab7377253	Added TIL	2020-09-14 18:49:45 +01:00
Marcus Noble	7d2c192b95	Improved multi-arch builds	2020-09-11 21:24:58 +01:00
Marcus Noble	a7a29c0201	Added multi-arch support	2020-09-11 20:56:46 +01:00
Marcus Noble	c40c5b5a33	Fixed probe	2020-09-09 09:42:50 +01:00
Marcus Noble	588348ac31	Added liveness probe to stringer	2020-09-09 09:11:54 +01:00
Marcus Noble	05e04afeff	Added Go playground	2020-09-01 15:30:27 +01:00
Marcus Noble	cf2a889e4d	Removed SCP archives	2020-08-25 15:25:01 +01:00
Marcus Noble	b838af199d	Added scp-archives	2020-08-24 05:58:09 +01:00
Marcus Noble	9f65bf256a	Added bucket for storing SCP archives	2020-08-23 11:16:02 +01:00
Marcus Noble	f5a7bb5abb	Bump nextcloud version	2020-08-13 21:03:28 +01:00
Marcus Noble	5567ba142a	Bumped versions	2020-08-13 20:47:20 +01:00
Marcus Noble	43aa708e09	Updated gitea	2020-07-15 10:18:10 +01:00
Marcus Noble	52339ccbed	Update nodered	2020-07-15 10:16:46 +01:00
Marcus Noble	b08f0892be	Bump version of riot	2020-07-10 20:02:58 +01:00
Marcus Noble	b60c244b8b	Update 'manifests/matrix_chart.yaml'	2020-07-10 16:19:41 +00:00
Marcus Noble	fd26f7b3de	Updated paradoxfox	2020-07-08 11:50:11 +01:00
Marcus Noble	e00db9e633	Added Paradoxfox.space	2020-07-04 19:42:10 +01:00
Marcus Noble	b35b34bb7a	Added outline	2020-06-27 17:47:35 +01:00
Marcus Noble	85bd64e87e	Remove bookstack	2020-06-27 17:47:17 +01:00
Marcus Noble	a80346f8e7	Added bookstack	2020-06-21 15:11:28 +01:00
Marcus Noble	53d8bd48bf	Added bucket for octoprint	2020-06-20 14:54:47 +01:00
Marcus Noble	9c8f29e346	Added printer auth endpoint	2020-06-16 20:38:06 +01:00
Marcus Noble	ad3fab4cfd	Removed pyload	2020-06-16 20:34:17 +01:00
Marcus Noble	cf0015d1e2	Added service for rpc	2020-06-16 20:34:09 +01:00
Marcus Noble	6ce5744672	Added missing resource types to kube-janitor	2020-06-10 12:24:40 +01:00
Marcus Noble	3d47bc34da	Added home assistant tunnel	2020-06-08 18:35:15 +01:00